app_container_unittest.cc 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <windows.h>
  5. #include <Sddl.h>
  6. #include <memory>
  7. #include <string>
  8. #include <vector>
  9. #include "base/files/file_path.h"
  10. #include "base/files/file_util.h"
  11. #include "base/files/scoped_temp_dir.h"
  12. #include "base/path_service.h"
  13. #include "base/rand_util.h"
  14. #include "base/strings/stringprintf.h"
  15. #include "base/win/sid.h"
  16. #include "base/win/windows_version.h"
  17. #include "sandbox/features.h"
  18. #include "sandbox/win/src/app_container_base.h"
  19. #include "sandbox/win/src/security_capabilities.h"
  20. #include "sandbox/win/src/win_utils.h"
  21. #include "testing/gtest/include/gtest/gtest.h"
  22. namespace sandbox {
  23. namespace {
  24. bool ValidSecurityCapabilities(
  25. PSECURITY_CAPABILITIES security_capabilities,
  26. const base::win::Sid& package_sid,
  27. const std::vector<base::win::Sid>& capabilities) {
  28. if (!security_capabilities)
  29. return false;
  30. if (!package_sid.Equal(security_capabilities->AppContainerSid)) {
  31. return false;
  32. }
  33. // If empty then count and list of capabilities should be 0 and nullptr.
  34. if (capabilities.empty() && !security_capabilities->CapabilityCount &&
  35. !security_capabilities->Capabilities) {
  36. return true;
  37. }
  38. if (!security_capabilities->Capabilities)
  39. return false;
  40. if (security_capabilities->CapabilityCount != capabilities.size())
  41. return false;
  42. for (DWORD index = 0; index < security_capabilities->CapabilityCount;
  43. ++index) {
  44. if (!capabilities[index].Equal(
  45. security_capabilities->Capabilities[index].Sid)) {
  46. return false;
  47. }
  48. if (security_capabilities->Capabilities[index].Attributes !=
  49. SE_GROUP_ENABLED) {
  50. return false;
  51. }
  52. }
  53. return true;
  54. }
  55. bool CompareSidVectors(const std::vector<base::win::Sid>& left,
  56. const std::vector<base::win::Sid>& right) {
  57. if (left.size() != right.size())
  58. return false;
  59. auto left_interator = left.cbegin();
  60. auto right_interator = right.cbegin();
  61. while (left_interator != left.cend()) {
  62. if (*left_interator != *right_interator)
  63. return false;
  64. ++left_interator;
  65. ++right_interator;
  66. }
  67. return true;
  68. }
  69. bool GetProfilePath(const std::wstring& package_name,
  70. base::FilePath* profile_path) {
  71. base::FilePath local_app_data;
  72. if (!base::PathService::Get(base::DIR_LOCAL_APP_DATA, &local_app_data))
  73. return false;
  74. *profile_path = local_app_data.Append(L"Packages").Append(package_name);
  75. return true;
  76. }
  77. bool ProfileExist(const std::wstring& package_name) {
  78. base::FilePath profile_path;
  79. if (!GetProfilePath(package_name, &profile_path))
  80. return false;
  81. return base::PathExists(profile_path);
  82. }
  83. std::wstring GenerateRandomPackageName() {
  84. return base::StringPrintf(L"%016lX%016lX", base::RandUint64(),
  85. base::RandUint64());
  86. }
  87. class SECURITY_ATTRIBUTES_SDDL : public SECURITY_ATTRIBUTES {
  88. public:
  89. explicit SECURITY_ATTRIBUTES_SDDL(LPCWSTR sddl) : SECURITY_ATTRIBUTES() {
  90. nLength = sizeof(SECURITY_ATTRIBUTES);
  91. if (!::ConvertStringSecurityDescriptorToSecurityDescriptor(
  92. sddl, SDDL_REVISION_1, &lpSecurityDescriptor, nullptr)) {
  93. lpSecurityDescriptor = nullptr;
  94. }
  95. }
  96. ~SECURITY_ATTRIBUTES_SDDL() {
  97. if (lpSecurityDescriptor)
  98. ::LocalFree(lpSecurityDescriptor);
  99. }
  100. bool IsValid() { return lpSecurityDescriptor != nullptr; }
  101. };
  102. std::wstring CreateSddlWithSid(const base::win::Sid& sid) {
  103. auto sddl_string = sid.ToSddlString();
  104. if (!sddl_string)
  105. return L"";
  106. std::wstring base_sddl = L"D:(A;;GA;;;WD)(A;;GA;;;";
  107. return base_sddl + *sddl_string + L")";
  108. }
  109. std::wstring CreateSddlWithSid(base::win::WellKnownSid known_sid) {
  110. auto sid = base::win::Sid::FromKnownSid(known_sid);
  111. if (!sid)
  112. return L"";
  113. return CreateSddlWithSid(*sid);
  114. }
  115. void AccessCheckFile(AppContainer* container,
  116. const base::FilePath& path,
  117. const base::win::Sid& sid,
  118. DWORD desired_access,
  119. DWORD expected_access,
  120. BOOL expected_status) {
  121. SECURITY_ATTRIBUTES_SDDL sa(CreateSddlWithSid(sid).c_str());
  122. ASSERT_TRUE(sa.IsValid());
  123. base::win::ScopedHandle file_handle(::CreateFile(
  124. path.value().c_str(), DELETE, FILE_SHARE_READ | FILE_SHARE_DELETE, &sa,
  125. CREATE_ALWAYS, FILE_FLAG_DELETE_ON_CLOSE, nullptr));
  126. ASSERT_TRUE(file_handle.IsValid());
  127. DWORD granted_access;
  128. BOOL access_status;
  129. ASSERT_TRUE(container->AccessCheck(path.value().c_str(),
  130. SecurityObjectType::kFile, desired_access,
  131. &granted_access, &access_status));
  132. ASSERT_EQ(expected_status, access_status);
  133. if (access_status)
  134. ASSERT_EQ(expected_access, granted_access);
  135. }
  136. void AccessCheckFile(AppContainer* container,
  137. const base::FilePath& path,
  138. base::win::WellKnownSid known_sid,
  139. DWORD desired_access,
  140. DWORD expected_access,
  141. BOOL expected_status) {
  142. auto sid = base::win::Sid::FromKnownSid(known_sid);
  143. ASSERT_TRUE(sid);
  144. AccessCheckFile(container, path, *sid, desired_access, expected_access,
  145. expected_status);
  146. }
  147. void AccessCheckFile(AppContainer* container,
  148. const base::FilePath& path,
  149. base::win::WellKnownCapability known_cap,
  150. DWORD desired_access,
  151. DWORD expected_access,
  152. BOOL expected_status) {
  153. auto sid = base::win::Sid::FromKnownCapability(known_cap);
  154. ASSERT_TRUE(sid);
  155. AccessCheckFile(container, path, *sid, desired_access, expected_access,
  156. expected_status);
  157. }
  158. } // namespace
  159. TEST(AppContainerTest, SecurityCapabilities) {
  160. if (!features::IsAppContainerSandboxSupported())
  161. return;
  162. // This isn't a valid package SID but it doesn't matter for this test.
  163. base::win::Sid package_sid =
  164. *base::win::Sid::FromKnownSid(base::win::WellKnownSid::kNull);
  165. std::vector<base::win::Sid> capabilities;
  166. SecurityCapabilities no_capabilities(package_sid);
  167. EXPECT_TRUE(
  168. ValidSecurityCapabilities(&no_capabilities, package_sid, capabilities));
  169. capabilities.push_back(
  170. *base::win::Sid::FromKnownSid(base::win::WellKnownSid::kWorld));
  171. SecurityCapabilities one_capability(package_sid, capabilities);
  172. EXPECT_TRUE(
  173. ValidSecurityCapabilities(&one_capability, package_sid, capabilities));
  174. capabilities.push_back(
  175. *base::win::Sid::FromKnownSid(base::win::WellKnownSid::kNetwork));
  176. SecurityCapabilities two_capabilities(package_sid, capabilities);
  177. EXPECT_TRUE(
  178. ValidSecurityCapabilities(&two_capabilities, package_sid, capabilities));
  179. }
  180. TEST(AppContainerTest, CreateAndDeleteAppContainerProfile) {
  181. if (!features::IsAppContainerSandboxSupported())
  182. return;
  183. std::wstring package_name = GenerateRandomPackageName();
  184. EXPECT_FALSE(ProfileExist(package_name));
  185. scoped_refptr<AppContainerBase> profile_container =
  186. AppContainerBase::CreateProfile(package_name.c_str(), L"Name",
  187. L"Description");
  188. ASSERT_NE(nullptr, profile_container.get());
  189. EXPECT_TRUE(ProfileExist(package_name));
  190. EXPECT_TRUE(AppContainerBase::Delete(package_name.c_str()));
  191. EXPECT_FALSE(ProfileExist(package_name));
  192. }
  193. TEST(AppContainerTest, CreateAndOpenAppContainer) {
  194. if (!features::IsAppContainerSandboxSupported())
  195. return;
  196. std::wstring package_name = GenerateRandomPackageName();
  197. EXPECT_FALSE(ProfileExist(package_name));
  198. scoped_refptr<AppContainerBase> profile_container =
  199. AppContainerBase::CreateProfile(package_name.c_str(), L"Name",
  200. L"Description");
  201. ASSERT_NE(nullptr, profile_container.get());
  202. EXPECT_TRUE(ProfileExist(package_name));
  203. scoped_refptr<AppContainerBase> open_container =
  204. AppContainerBase::Open(package_name.c_str());
  205. ASSERT_NE(nullptr, open_container.get());
  206. EXPECT_TRUE(::EqualSid(profile_container->GetPackageSid().GetPSID(),
  207. open_container->GetPackageSid().GetPSID()));
  208. EXPECT_TRUE(AppContainerBase::Delete(package_name.c_str()));
  209. EXPECT_FALSE(ProfileExist(package_name));
  210. scoped_refptr<AppContainerBase> open_container2 =
  211. AppContainerBase::Open(package_name.c_str());
  212. EXPECT_FALSE(ProfileExist(package_name));
  213. }
  214. TEST(AppContainerTest, SetLowPrivilegeAppContainer) {
  215. if (!features::IsAppContainerSandboxSupported())
  216. return;
  217. std::wstring package_name = GenerateRandomPackageName();
  218. scoped_refptr<AppContainerBase> container =
  219. AppContainerBase::Open(package_name.c_str());
  220. ASSERT_NE(nullptr, container.get());
  221. container->SetEnableLowPrivilegeAppContainer(true);
  222. EXPECT_TRUE(container->GetEnableLowPrivilegeAppContainer());
  223. }
  224. TEST(AppContainerTest, OpenAppContainerAndGetSecurityCapabilities) {
  225. if (!features::IsAppContainerSandboxSupported())
  226. return;
  227. std::wstring package_name = GenerateRandomPackageName();
  228. scoped_refptr<AppContainerBase> container =
  229. AppContainerBase::Open(package_name.c_str());
  230. ASSERT_NE(nullptr, container.get());
  231. std::vector<base::win::Sid> capabilities;
  232. auto no_capabilities = container->GetSecurityCapabilities();
  233. ASSERT_TRUE(ValidSecurityCapabilities(
  234. no_capabilities.get(), container->GetPackageSid(), capabilities));
  235. ASSERT_TRUE(container->AddCapability(L"FakeCapability"));
  236. capabilities.push_back(
  237. *base::win::Sid::FromNamedCapability(L"FakeCapability"));
  238. ASSERT_TRUE(container->AddCapability(
  239. base::win::WellKnownCapability::kInternetClient));
  240. capabilities.push_back(*base::win::Sid::FromKnownCapability(
  241. base::win::WellKnownCapability::kInternetClient));
  242. const wchar_t kSddlSid[] = L"S-1-15-3-1";
  243. ASSERT_TRUE(container->AddCapabilitySddl(kSddlSid));
  244. capabilities.push_back(*base::win::Sid::FromSddlString(kSddlSid));
  245. auto with_capabilities = container->GetSecurityCapabilities();
  246. ASSERT_TRUE(ValidSecurityCapabilities(
  247. with_capabilities.get(), container->GetPackageSid(), capabilities));
  248. }
  249. TEST(AppContainerTest, GetResources) {
  250. if (!features::IsAppContainerSandboxSupported())
  251. return;
  252. std::wstring package_name = GenerateRandomPackageName();
  253. scoped_refptr<AppContainerBase> profile_container =
  254. AppContainerBase::CreateProfile(package_name.c_str(), L"Name",
  255. L"Description");
  256. ASSERT_NE(nullptr, profile_container.get());
  257. base::win::ScopedHandle key;
  258. EXPECT_TRUE(profile_container->GetRegistryLocation(KEY_READ, &key));
  259. EXPECT_TRUE(key.IsValid());
  260. key.Close();
  261. base::FilePath path;
  262. EXPECT_TRUE(profile_container->GetFolderPath(&path));
  263. EXPECT_TRUE(base::PathExists(path));
  264. base::FilePath pipe_path;
  265. EXPECT_TRUE(profile_container->GetPipePath(package_name.c_str(), &pipe_path));
  266. base::win::ScopedHandle pipe_handle;
  267. pipe_handle.Set(::CreateNamedPipe(
  268. pipe_path.value().c_str(), PIPE_ACCESS_DUPLEX, PIPE_TYPE_BYTE,
  269. PIPE_UNLIMITED_INSTANCES, 0, 0, 0, nullptr));
  270. EXPECT_TRUE(pipe_handle.IsValid());
  271. EXPECT_TRUE(AppContainerBase::Delete(package_name.c_str()));
  272. }
  273. TEST(AppContainerTest, AccessCheckFile) {
  274. if (!features::IsAppContainerSandboxSupported())
  275. return;
  276. // We don't need a valid profile to do the access check tests.
  277. std::wstring package_name = GenerateRandomPackageName();
  278. scoped_refptr<AppContainerBase> container =
  279. AppContainerBase::Open(package_name.c_str());
  280. container->AddCapability(base::win::WellKnownCapability::kInternetClient);
  281. base::ScopedTempDir temp_dir;
  282. ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
  283. base::FilePath path = temp_dir.GetPath().Append(package_name);
  284. AccessCheckFile(container.get(), path, base::win::WellKnownSid::kNull,
  285. FILE_READ_DATA, 0, FALSE);
  286. AccessCheckFile(container.get(), path,
  287. base::win::WellKnownSid::kAllApplicationPackages,
  288. FILE_READ_DATA, FILE_READ_DATA, TRUE);
  289. AccessCheckFile(container.get(), path, container->GetPackageSid(),
  290. FILE_READ_DATA, FILE_READ_DATA, TRUE);
  291. AccessCheckFile(container.get(), path,
  292. base::win::WellKnownCapability::kInternetClient,
  293. FILE_READ_DATA, FILE_READ_DATA, TRUE);
  294. // Check mapping generic access rights.
  295. AccessCheckFile(container.get(), path,
  296. base::win::WellKnownSid::kAllApplicationPackages,
  297. GENERIC_READ | GENERIC_EXECUTE,
  298. FILE_GENERIC_READ | FILE_GENERIC_EXECUTE, TRUE);
  299. if (!features::IsAppContainerSandboxSupported())
  300. return;
  301. container->SetEnableLowPrivilegeAppContainer(true);
  302. AccessCheckFile(container.get(), path,
  303. base::win::WellKnownSid::kAllApplicationPackages,
  304. FILE_READ_DATA, 0, FALSE);
  305. AccessCheckFile(container.get(), path,
  306. base::win::WellKnownSid::kAllRestrictedApplicationPackages,
  307. FILE_READ_DATA, FILE_READ_DATA, TRUE);
  308. }
  309. TEST(AppContainerTest, AccessCheckRegistry) {
  310. if (!features::IsAppContainerSandboxSupported())
  311. return;
  312. // We don't need a valid profile to do the access check tests.
  313. std::wstring package_name = GenerateRandomPackageName();
  314. scoped_refptr<AppContainerBase> container =
  315. AppContainerBase::Open(package_name.c_str());
  316. // Ensure the key doesn't exist.
  317. RegDeleteKey(HKEY_CURRENT_USER, package_name.c_str());
  318. SECURITY_ATTRIBUTES_SDDL sa(
  319. CreateSddlWithSid(base::win::WellKnownSid::kAllApplicationPackages)
  320. .c_str());
  321. HKEY key_handle;
  322. ASSERT_EQ(ERROR_SUCCESS,
  323. RegCreateKeyEx(HKEY_CURRENT_USER, package_name.c_str(), 0, nullptr,
  324. REG_OPTION_VOLATILE, KEY_ALL_ACCESS, &sa,
  325. &key_handle, nullptr));
  326. base::win::ScopedHandle key(key_handle);
  327. std::wstring key_name = L"CURRENT_USER\\";
  328. key_name += package_name;
  329. DWORD granted_access;
  330. BOOL access_status;
  331. ASSERT_TRUE(
  332. container->AccessCheck(key_name.c_str(), SecurityObjectType::kRegistry,
  333. KEY_QUERY_VALUE, &granted_access, &access_status));
  334. ASSERT_TRUE(access_status);
  335. ASSERT_EQ(DWORD{KEY_QUERY_VALUE}, granted_access);
  336. RegDeleteKey(HKEY_CURRENT_USER, package_name.c_str());
  337. }
  338. TEST(AppContainerTest, ImpersonationCapabilities) {
  339. if (!features::IsAppContainerSandboxSupported())
  340. return;
  341. std::wstring package_name = GenerateRandomPackageName();
  342. scoped_refptr<AppContainerBase> container =
  343. AppContainerBase::Open(package_name.c_str());
  344. ASSERT_NE(nullptr, container.get());
  345. std::vector<base::win::Sid> capabilities;
  346. std::vector<base::win::Sid> impersonation_capabilities;
  347. ASSERT_TRUE(container->AddCapability(
  348. base::win::WellKnownCapability::kInternetClient));
  349. capabilities.push_back(*base::win::Sid::FromKnownCapability(
  350. base::win::WellKnownCapability::kInternetClient));
  351. impersonation_capabilities.push_back(*base::win::Sid::FromKnownCapability(
  352. base::win::WellKnownCapability::kInternetClient));
  353. ASSERT_TRUE(CompareSidVectors(container->GetCapabilities(), capabilities));
  354. ASSERT_TRUE(CompareSidVectors(container->GetImpersonationCapabilities(),
  355. impersonation_capabilities));
  356. ASSERT_TRUE(container->AddImpersonationCapability(
  357. base::win::WellKnownCapability::kPrivateNetworkClientServer));
  358. impersonation_capabilities.push_back(*base::win::Sid::FromKnownCapability(
  359. base::win::WellKnownCapability::kPrivateNetworkClientServer));
  360. ASSERT_TRUE(container->AddImpersonationCapability(L"FakeCapability"));
  361. impersonation_capabilities.push_back(
  362. *base::win::Sid::FromNamedCapability(L"FakeCapability"));
  363. const wchar_t kSddlSid[] = L"S-1-15-3-1";
  364. ASSERT_TRUE(container->AddImpersonationCapabilitySddl(kSddlSid));
  365. impersonation_capabilities.push_back(
  366. *base::win::Sid::FromSddlString(kSddlSid));
  367. ASSERT_TRUE(CompareSidVectors(container->GetCapabilities(), capabilities));
  368. ASSERT_TRUE(CompareSidVectors(container->GetImpersonationCapabilities(),
  369. impersonation_capabilities));
  370. }
  371. } // namespace sandbox