Sandbox: Add support for file system policies that use implied device paths.

sandbox/win/src/filesystem_policy.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "sandbox/win/src/filesystem_policy.h"
 
 #include "base/logging.h"
 #include "base/win/scoped_handle.h"
+#include "base/win/windows_version.h"
 #include "sandbox/win/src/ipc_tags.h"
 #include "sandbox/win/src/policy_engine_opcodes.h"
 #include "sandbox/win/src/policy_params.h"
 #include "sandbox/win/src/sandbox_utils.h"
 #include "sandbox/win/src/sandbox_types.h"
 #include "sandbox/win/src/win_utils.h"
 
 namespace {
 
 NTSTATUS NtCreateFileInTarget(HANDLE* target_file_handle,
@@ skipping 50 matching lines @@
 namespace sandbox {
 
 bool FileSystemPolicy::GenerateRules(const wchar_t* name,
                                      TargetPolicy::Semantics semantics,
                                      LowLevelPolicy* policy) {
   base::string16 mod_name(name);
   if (mod_name.empty()) {
     return false;
   }
 
-  // Don't do any pre-processing if the name starts like the the native
-  // object manager style.
-  if (0 != _wcsnicmp(mod_name.c_str(), kNTObjManPrefix, kNTObjManPrefixLen)) {
+  if (base::win::GetVersion() >= base::win::VERSION_WIN7) {
     // TODO(cpu) bug 32224: This prefix add is a hack because we don't have the
     // infrastructure to normalize names. In any case we need to escape the
     // question marks.
     if (!PreProcessName(mod_name, &mod_name)) {
       // The path to be added might contain a reparse point.
       NOTREACHED();
       return false;
     }
 
-    mod_name = FixNTPrefixForMatch(mod_name);
-    name = mod_name.c_str();
+    if (_wcsnicmp(mod_name.c_str(), kNTDevicePrefix, kNTDevicePrefixLen)) {
+      mod_name = FixNTPrefixForMatch(mod_name);
+      name = mod_name.c_str();
+    }
+  } else if (!_wcsnicmp(mod_name.c_str(), kNTDevicePrefix,
+                        kNTDevicePrefixLen)) {
+    // Device paths in policy are not supported before Windows 7.
+    return false;
   }
 
   EvalResult result = ASK_BROKER;
 
   // List of supported calls for the filesystem.
   const unsigned kCallNtCreateFile = 0x1;
   const unsigned kCallNtOpenFile = 0x2;
   const unsigned kCallNtQueryAttributesFile = 0x4;
   const unsigned kCallNtQueryFullAttributesFile = 0x8;
   const unsigned kCallNtSetInfoRename = 0x10;
@@ skipping 317 matching lines @@
   } else {
     // Start of name matches NT prefix, replace with escaped format
     // Fixes bug: 334882
     mod_name.replace(0, kNTPrefixLen, kNTPrefixEscaped);
   }
 
   return mod_name;
 }
 
 }  // namespace sandbox