Sandbox: Add support for file system policies that use implied device paths.

sandbox/win/src/filesystem_policy.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "sandbox/win/src/filesystem_policy.h"
 
 #include "base/logging.h"
 #include "base/win/scoped_handle.h"
+#include "base/win/windows_version.h"
 #include "sandbox/win/src/ipc_tags.h"
 #include "sandbox/win/src/policy_engine_opcodes.h"
 #include "sandbox/win/src/policy_params.h"
 #include "sandbox/win/src/sandbox_utils.h"
 #include "sandbox/win/src/sandbox_types.h"
 #include "sandbox/win/src/win_utils.h"
 
 namespace {
 
 NTSTATUS NtCreateFileInTarget(HANDLE* target_file_handle,
@@ skipping 50 matching lines @@
 namespace sandbox {
 
 bool FileSystemPolicy::GenerateRules(const wchar_t* name,
                                      TargetPolicy::Semantics semantics,
                                      LowLevelPolicy* policy) {
   base::string16 mod_name(name);
   if (mod_name.empty()) {
     return false;
   }
 
-  // Don't do any pre-processing if the name starts like the the native
-  // object manager style.
-  if (0 != _wcsnicmp(mod_name.c_str(), kNTObjManPrefix, kNTObjManPrefixLen)) {
-    // TODO(cpu) bug 32224: This prefix add is a hack because we don't have the
-    // infrastructure to normalize names. In any case we need to escape the
-    // question marks.
-    if (!PreProcessName(mod_name, &mod_name)) {
-      // The path to be added might contain a reparse point.
-      NOTREACHED();
-      return false;
-    }
+  if (!PreProcessName(mod_name, &mod_name)) {
+    // The path to be added might contain a reparse point.
+    NOTREACHED();
+    return false;
+  }
 
+  // TODO(cpu) bug 32224: This prefix add is a hack because we don't have the
+  // infrastructure to normalize names. In any case we need to escape the
+  // question marks.
+  if (_wcsnicmp(mod_name.c_str(), kNTDevicePrefix, kNTDevicePrefixLen)) {
     mod_name = FixNTPrefixForMatch(mod_name);
     name = mod_name.c_str();
   }
 
   EvalResult result = ASK_BROKER;
 
   // List of supported calls for the filesystem.
   const unsigned kCallNtCreateFile = 0x1;
   const unsigned kCallNtOpenFile = 0x2;
   const unsigned kCallNtQueryAttributesFile = 0x4;
@@ skipping 319 matching lines @@
   } else {
     // Start of name matches NT prefix, replace with escaped format
     // Fixes bug: 334882
     mod_name.replace(0, kNTPrefixLen, kNTPrefixEscaped);
   }
 
   return mod_name;
 }
 
 }  // namespace sandbox