acl_unittest.cc 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100
  1. // Copyright 2021 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/acl.h"
  5. #include <windows.h>
  6. #include <aclapi.h>
  7. #include "base/win/scoped_handle.h"
  8. #include "base/win/scoped_localalloc.h"
  9. #include "testing/gtest/include/gtest/gtest.h"
  10. namespace sandbox {
  11. namespace {
  12. void CheckGetIntegrityLevelSid(IntegrityLevel integrity_level,
  13. const wchar_t* sddl) {
  14. absl::optional<base::win::Sid> sddl_sid =
  15. base::win::Sid::FromSddlString(sddl);
  16. ASSERT_TRUE(sddl_sid);
  17. absl::optional<base::win::Sid> integrity_sid =
  18. GetIntegrityLevelSid(integrity_level);
  19. ASSERT_TRUE(integrity_sid);
  20. EXPECT_EQ(*sddl_sid, *integrity_sid);
  21. }
  22. void CheckSetObjectIntegrityLabel(DWORD mandatory_policy,
  23. IntegrityLevel integrity_level,
  24. DWORD expected_error = ERROR_SUCCESS) {
  25. base::win::ScopedHandle job(::CreateJobObject(nullptr, nullptr));
  26. DWORD result = SetObjectIntegrityLabel(job.Get(), SecurityObjectType::kKernel,
  27. mandatory_policy, integrity_level);
  28. EXPECT_EQ(result, expected_error);
  29. if (result != ERROR_SUCCESS)
  30. return;
  31. PACL sacl = nullptr;
  32. PSECURITY_DESCRIPTOR sd_ptr = nullptr;
  33. result =
  34. ::GetSecurityInfo(job.Get(), SE_KERNEL_OBJECT, LABEL_SECURITY_INFORMATION,
  35. nullptr, nullptr, nullptr, &sacl, &sd_ptr);
  36. ASSERT_EQ(result, DWORD{ERROR_SUCCESS});
  37. auto sd = base::win::TakeLocalAlloc(sd_ptr);
  38. ASSERT_EQ(sacl->AceCount, 1);
  39. LPVOID ace_ptr;
  40. ASSERT_TRUE(::GetAce(sacl, 0, &ace_ptr));
  41. PSYSTEM_MANDATORY_LABEL_ACE ace =
  42. static_cast<PSYSTEM_MANDATORY_LABEL_ACE>(ace_ptr);
  43. ASSERT_EQ(ace->Header.AceType, SYSTEM_MANDATORY_LABEL_ACE_TYPE);
  44. EXPECT_EQ(ace->Header.AceFlags, 0);
  45. EXPECT_EQ(ace->Mask, mandatory_policy);
  46. absl::optional<base::win::Sid> integrity_sid =
  47. GetIntegrityLevelSid(integrity_level);
  48. ASSERT_TRUE(integrity_sid);
  49. ASSERT_TRUE(::IsValidSid(&ace->SidStart));
  50. EXPECT_TRUE(integrity_sid->Equal(&ace->SidStart));
  51. }
  52. } // namespace
  53. // Checks the functionality of GetIntegrityLevelSid.
  54. TEST(AclTest, GetIntegrityLevelSid) {
  55. EXPECT_FALSE(GetIntegrityLevelSid(INTEGRITY_LEVEL_LAST));
  56. CheckGetIntegrityLevelSid(INTEGRITY_LEVEL_SYSTEM, L"S-1-16-16384");
  57. CheckGetIntegrityLevelSid(INTEGRITY_LEVEL_HIGH, L"S-1-16-12288");
  58. CheckGetIntegrityLevelSid(INTEGRITY_LEVEL_MEDIUM, L"S-1-16-8192");
  59. CheckGetIntegrityLevelSid(INTEGRITY_LEVEL_MEDIUM_LOW, L"S-1-16-6144");
  60. CheckGetIntegrityLevelSid(INTEGRITY_LEVEL_LOW, L"S-1-16-4096");
  61. CheckGetIntegrityLevelSid(INTEGRITY_LEVEL_BELOW_LOW, L"S-1-16-2048");
  62. CheckGetIntegrityLevelSid(INTEGRITY_LEVEL_UNTRUSTED, L"S-1-16-0");
  63. }
  64. // Checks the functionality of SetObjectIntegrityLabel.
  65. TEST(AclTest, SetObjectIntegrityLabel) {
  66. EXPECT_EQ(SetObjectIntegrityLabel(nullptr, SecurityObjectType::kKernel, 0,
  67. INTEGRITY_LEVEL_LAST),
  68. DWORD{ERROR_INVALID_SID});
  69. EXPECT_EQ(SetObjectIntegrityLabel(nullptr, SecurityObjectType::kKernel, 0,
  70. INTEGRITY_LEVEL_LOW),
  71. DWORD{ERROR_INVALID_HANDLE});
  72. // This assumes that the caller doesn't have SeRelabelPrivilege or is running
  73. // as a service process.
  74. CheckSetObjectIntegrityLabel(0, INTEGRITY_LEVEL_SYSTEM, ERROR_INVALID_LABEL);
  75. CheckSetObjectIntegrityLabel(0, INTEGRITY_LEVEL_LOW);
  76. CheckSetObjectIntegrityLabel(0, INTEGRITY_LEVEL_UNTRUSTED);
  77. CheckSetObjectIntegrityLabel(SYSTEM_MANDATORY_LABEL_NO_WRITE_UP,
  78. INTEGRITY_LEVEL_LOW);
  79. CheckSetObjectIntegrityLabel(SYSTEM_MANDATORY_LABEL_NO_READ_UP,
  80. INTEGRITY_LEVEL_LOW);
  81. CheckSetObjectIntegrityLabel(SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP,
  82. INTEGRITY_LEVEL_LOW);
  83. CheckSetObjectIntegrityLabel(SYSTEM_MANDATORY_LABEL_NO_WRITE_UP |
  84. SYSTEM_MANDATORY_LABEL_NO_READ_UP |
  85. SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP,
  86. INTEGRITY_LEVEL_LOW);
  87. }
  88. } // namespace sandbox