Sandbox: Add support for file system policies that use implied device paths.

sandbox/win/src/win_utils.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/win_utils.h"
 
 #include <map>
 
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string_util.h"
 #include "base/win/pe_image.h"
+#include "base/win/windows_version.h"
 #include "sandbox/win/src/internal_types.h"
 #include "sandbox/win/src/nt_internals.h"
 #include "sandbox/win/src/sandbox_nt_util.h"
 
 namespace {
 
 // Holds the information about a known registry key.
 struct KnownReservedKey {
   const wchar_t* name;
   HKEY key;
 };
 
 // Contains all the known registry key by name and by handle.
 const KnownReservedKey kKnownKey[] = {
     { L"HKEY_CLASSES_ROOT", HKEY_CLASSES_ROOT },
     { L"HKEY_CURRENT_USER", HKEY_CURRENT_USER },
     { L"HKEY_LOCAL_MACHINE", HKEY_LOCAL_MACHINE},
     { L"HKEY_USERS", HKEY_USERS},
     { L"HKEY_PERFORMANCE_DATA", HKEY_PERFORMANCE_DATA},
     { L"HKEY_PERFORMANCE_TEXT", HKEY_PERFORMANCE_TEXT},
     { L"HKEY_PERFORMANCE_NLSTEXT", HKEY_PERFORMANCE_NLSTEXT},
     { L"HKEY_CURRENT_CONFIG", HKEY_CURRENT_CONFIG},
     { L"HKEY_DYN_DATA", HKEY_DYN_DATA}
 };
 
+// Returns true if |path| starts with "\??\" and returns a path without that
+// component.
+bool IsNTPath(const base::string16& path, base::string16* trimmed_path ) {
+  if ((path.size() < sandbox::kNTPrefixLen) ||
+      (0 != path.compare(0, sandbox::kNTPrefixLen, sandbox::kNTPrefix))) {
+    *trimmed_path = path;
+    return false;
+  }
+
+  *trimmed_path = path.substr(sandbox::kNTPrefixLen);
+  return true;
+}
+
+// Returns true if |path| starts with "\Device\" and returns a path without that
+// component.
+bool IsDevicePath(const base::string16& path, base::string16* trimmed_path ) {

[cpu_(ooo_6.6-7.5), 2015/02/13 19:27:37]

name: TrimDevicePath() ?

and above TrimNtPath() ?

[rvargas (doing something else), 2015/02/13 19:43:05]

Not so sure. I want the "main" function to be the implied by the return value
("is this a foo kind of path?"). The first version had the out argument as
optional but all users were passing a value so I removed that feature.

I don't think it is worth splitting this in two functions: check + trim.

See line 227

[cpu_(ooo_6.6-7.5), 2015/02/17 21:59:45]

Acknowledged.

+  if ((path.size() < sandbox::kNTDevicePrefixLen) ||
+      (0 != _wcsnicmp(path.c_str(), sandbox::kNTDevicePrefix,
+                      sandbox::kNTDevicePrefixLen))) {
+    *trimmed_path = path;
+    return false;
+  }
+
+  *trimmed_path = path.substr(sandbox::kNTDevicePrefixLen);
+  return true;
+}
+
+bool StartsWithDriveLetter(const base::string16& path) {
+  if (path.size() < 3)
+    return false;
+
+  if (path[1] != L':' || path[2] != L'\\')
+    return false;
+

[cpu_(ooo_6.6-7.5), 2015/02/13 19:27:37]

I think the thing below is
http://en.cppreference.com/w/cpp/string/byte/isalpha

[rvargas (doing something else), 2015/02/13 19:43:05]

That is locale dependent and a drive letter is not.

[cpu_(ooo_6.6-7.5), 2015/02/17 21:59:45]

Acknowledged.

+  return (path[0] >= 'a' && path[0] <= 'z') ||
+         (path[0] >= 'A' && path[0] <= 'Z');
+}
+
+const wchar_t kNTDotPrefix[] = L"\\\\.\\";
+const size_t kNTDotPrefixLen = arraysize(kNTDotPrefix) - 1;
+
+// Removes "\\\\.\\" from the path.
+void RemoveImpliedDevice(base::string16* path) {
+  if (0 == path->compare(0, kNTDotPrefixLen, kNTDotPrefix))
+    *path = path->substr(kNTDotPrefixLen);
+}
+
 }  // namespace
 
 namespace sandbox {
 
 // Returns true if the provided path points to a pipe.
 bool IsPipe(const base::string16& path) {
-  base::string16 lower_path = base::StringToLowerASCII(path);

[cpu_(ooo_6.6-7.5), 2015/02/13 19:27:37]

without this helper do we still need to include string_util ?

   size_t start = 0;
-  if (0 == lower_path.compare(0, sandbox::kNTPrefixLen, sandbox::kNTPrefix))
+  if (0 == path.compare(0, sandbox::kNTPrefixLen, sandbox::kNTPrefix))
     start = sandbox::kNTPrefixLen;
 
   const wchar_t kPipe[] = L"pipe\\";
-  return (0 == lower_path.compare(start, arraysize(kPipe) - 1, kPipe));
+  if (path.size() < start + arraysize(kPipe) - 1)
+    return false;
+
+  return (0 == _wcsnicmp(path.c_str() + start, kPipe, arraysize(kPipe) - 1));
 }
 
 HKEY GetReservedKeyFromName(const base::string16& name) {
   for (size_t i = 0; i < arraysize(kKnownKey); ++i) {
     if (name == kKnownKey[i].name)
       return kKnownKey[i].key;
   }
 
   return NULL;
 }
@@ skipping 15 matching lines @@
         return false;
 
       *resolved_name += name.substr(wcslen(kKnownKey[i].name));
       return true;
     }
   }
 
   return false;
 }
 
+// |full_path| can have any of the following forms:
+//    \??\c:\some\foo\bar
+//    \Device\HarddiskVolume0\some\foo\bar
+//    \??\HarddiskVolume0\some\foo\bar
+// For OSes before Win7, anything but the first form will be rejected.
 DWORD IsReparsePoint(const base::string16& full_path, bool* result) {
-  base::string16 path = full_path;
-
-  // Remove the nt prefix.
-  if (0 == path.compare(0, kNTPrefixLen, kNTPrefix))
-    path = path.substr(kNTPrefixLen);
-
   // Check if it's a pipe. We can't query the attributes of a pipe.
-  if (IsPipe(path)) {
+  if (IsPipe(full_path)) {
     *result = FALSE;
     return ERROR_SUCCESS;
   }
 
+  base::string16 path;
+  bool nt_path = IsNTPath(full_path, &path);
+  bool has_drive = StartsWithDriveLetter(path);
+  bool is_device_path = IsDevicePath(path, &path);
+
+  if (!has_drive && !is_device_path && !nt_path)
+    return ERROR_INVALID_NAME;
+
+  bool added_implied_device = false;
+  if (!has_drive) {
+    if (base::win::GetVersion() >= base::win::VERSION_WIN7) {
+      path = base::string16(kNTDotPrefix) + path;
+      added_implied_device = true;
+    } else {
+      return ERROR_INVALID_NAME;
+    }
+  }
+
   base::string16::size_type last_pos = base::string16::npos;
+  bool passed_once = false;
 
   do {
     path = path.substr(0, last_pos);
 
     DWORD attributes = ::GetFileAttributes(path.c_str());
     if (INVALID_FILE_ATTRIBUTES == attributes) {
       DWORD error = ::GetLastError();
       if (error != ERROR_FILE_NOT_FOUND &&
           error != ERROR_PATH_NOT_FOUND &&
           error != ERROR_INVALID_NAME) {
         // Unexpected error.
+        if (passed_once && added_implied_device &&
+            path.rfind(L'\\') == kNTDotPrefixLen - 1) {

[cpu_(ooo_6.6-7.5), 2015/02/17 21:59:45]

I get nervous when I see && == and - in a line with no ( ), I hope this is not a
operator precedence quiz.

[rvargas (doing something else), 2015/02/17 22:59:29]

Done.

+          break;
+        }
         NOTREACHED_NT();
         return error;
       }
     } else if (FILE_ATTRIBUTE_REPARSE_POINT & attributes) {
       // This is a reparse point.
       *result = true;
       return ERROR_SUCCESS;
     }
 
+    passed_once = true;
     last_pos = path.rfind(L'\\');
   } while (last_pos > 2);  // Skip root dir.
 
   *result = false;
   return ERROR_SUCCESS;
 }
 
-// We get a |full_path| of the form \??\c:\some\foo\bar, and the name that
+// We get a |full_path| of the forms accepted by IsReparsePoint(), and the name
 // we'll get from |handle| will be \device\harddiskvolume1\some\foo\bar.
 bool SameObject(HANDLE handle, const wchar_t* full_path) {
-  base::string16 path(full_path);
-  DCHECK_NT(!path.empty());
-
   // Check if it's a pipe.
-  if (IsPipe(path))
+  if (IsPipe(full_path))
     return true;

[cpu_(ooo_6.6-7.5), 2015/02/17 21:59:46]

two objects are the same if one of them is a pipe. 

Uhh..  

(yeah I know it is not new code)

[rvargas (doing something else), 2015/02/17 22:59:29]

Open to suggestions... Of course, the reasoning was that under PIPE no same
person would have redirections

 
   base::string16 actual_path;
   if (!GetPathFromHandle(handle, &actual_path))
     return false;
 
+  base::string16 path(full_path);
+  DCHECK_NT(!path.empty());
+
   // This may end with a backslash.
   const wchar_t kBackslash = '\\';
   if (path[path.length() - 1] == kBackslash)
     path = path.substr(0, path.length() - 1);
 
   // Perfect match (case-insesitive check).
   if (0 == _wcsicmp(actual_path.c_str(), path.c_str()))
     return true;
 
-  // Look for the drive letter.
-  size_t colon_pos = path.find(L':');
-  if (colon_pos == 0 || colon_pos == base::string16::npos)
-    return false;
+  bool nt_path = IsNTPath(path, &path);
+  bool has_drive = StartsWithDriveLetter(path);
 
-  // Only one character for the drive.
-  if (colon_pos > 1 && path[colon_pos - 2] != kBackslash)
+  if (!has_drive && nt_path) {
+    base::string16 simple_actual_path;
+    if (!IsDevicePath(actual_path, &simple_actual_path))
+      return false;
+
+    // Perfect match (case-insesitive check).
+    return (0 == _wcsicmp(simple_actual_path.c_str(), path.c_str()));
+  }
+
+  if (!has_drive)
     return false;
 
   // We only need 3 chars, but let's alloc a buffer for four.
   wchar_t drive[4] = {0};
   wchar_t vol_name[MAX_PATH];
-  memcpy(drive, &path[colon_pos - 1], 2 * sizeof(*drive));
+  memcpy(drive, &path[0], 2 * sizeof(*drive));
 
   // We'll get a double null terminated string.
   DWORD vol_length = ::QueryDosDeviceW(drive, vol_name, MAX_PATH);
   if (vol_length < 2 || vol_length == MAX_PATH)
     return false;
 
   // Ignore the nulls at the end.
   vol_length = static_cast<DWORD>(wcslen(vol_name));
 
   // The two paths should be the same length.
-  if (vol_length + path.size() - (colon_pos + 1) != actual_path.size())
+  if (vol_length + path.size() - 2 != actual_path.size())
     return false;
 
   // Check up to the drive letter.
   if (0 != _wcsnicmp(actual_path.c_str(), vol_name, vol_length))
     return false;
 
   // Check the path after the drive letter.
-  if (0 != _wcsicmp(&actual_path[vol_length], &path[colon_pos + 1]))
+  if (0 != _wcsicmp(&actual_path[vol_length], &path[2]))
     return false;
 
   return true;
 }

[cpu_(ooo_6.6-7.5), 2015/02/17 21:59:45]

if I might suggest, I think we need a helper here or elsewhere of the form

bool icompare(const std::string& s1, const std::string& s2, size_t len) {
   return 0 == _wcsnicmp(s1.c_str(), s2.c_str(), len);
}

possibly with ( ..., size_t start, size_t len)

[rvargas (doing something else), 2015/02/17 22:59:29]

Not sure the result is better, but done.

 
+// Paths like \Device\HarddiskVolume0\some\foo\bar are assumed to be already
+// expanded.
 bool ConvertToLongPath(const base::string16& short_path,
                        base::string16* long_path) {
   // Check if the path is a NT path.
-  bool is_nt_path = false;
-  base::string16 path = short_path;
-  if (0 == path.compare(0, kNTPrefixLen, kNTPrefix)) {
-    path = path.substr(kNTPrefixLen);
-    is_nt_path = true;
+  base::string16 path;
+  bool is_nt_path = IsNTPath(short_path, &path);
+  if (IsDevicePath(path, &path))
+    return false;

[cpu_(ooo_6.6-7.5), 2015/02/17 21:59:46]

can lines 272 and 273 be moved above 269 ?

[rvargas (doing something else), 2015/02/17 22:59:29]

Done.

+
+  bool added_implied_device = false;
+  if (!StartsWithDriveLetter(path) && is_nt_path &&
+      base::win::GetVersion() >= base::win::VERSION_WIN7) {
+    // This workaround does NOT work for before win7. The policy cannot have
+    // short names in that case.
+    path = base::string16(kNTDotPrefix) + path;
+    added_implied_device = true;
   }
 
   DWORD size = MAX_PATH;
   scoped_ptr<wchar_t[]> long_path_buf(new wchar_t[size]);
 
   DWORD return_value = ::GetLongPathName(path.c_str(), long_path_buf.get(),
                                          size);
   while (return_value >= size) {
     size *= 2;
     long_path_buf.reset(new wchar_t[size]);
@@ skipping 15 matching lines @@
       return false;
 
     // Ok, it worked. Let's reset the return value.
     path = begin + end;
     return_value = 1;
   } else if (0 != return_value) {
     path = long_path_buf.get();
   }
 
   if (return_value != 0) {
+    if (added_implied_device)
+      RemoveImpliedDevice(&path);
+
     if (is_nt_path) {
       *long_path = kNTPrefix;
       *long_path += path;
     } else {
       *long_path = path;
     }
 
     return true;
   }
 
@@ skipping 75 matching lines @@
     ::InterlockedCompareExchangePointer(
         reinterpret_cast<PVOID volatile*>(&ntdll), ntdll_local, NULL);
 
   }
 
   CHECK_NT(ntdll);
   FARPROC* function_ptr = reinterpret_cast<FARPROC*>(ptr);
   *function_ptr = ::GetProcAddress(ntdll, name);
   CHECK_NT(*function_ptr);
 }