filesystem_interception.cc 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358
  1. // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/filesystem_interception.h"
  5. #include <stdint.h>
  6. #include "sandbox/win/src/crosscall_client.h"
  7. #include "sandbox/win/src/filesystem_policy.h"
  8. #include "sandbox/win/src/ipc_tags.h"
  9. #include "sandbox/win/src/policy_params.h"
  10. #include "sandbox/win/src/policy_target.h"
  11. #include "sandbox/win/src/sandbox_factory.h"
  12. #include "sandbox/win/src/sandbox_nt_util.h"
  13. #include "sandbox/win/src/sharedmem_ipc_client.h"
  14. #include "sandbox/win/src/target_services.h"
  15. namespace sandbox {
  16. namespace {
  17. // This checks for three conditions on whether to ask the broker.
  18. // - The path looks like a DOS device path (namely \??\something).
  19. // - The path looks like a short-name path.
  20. // - Whether the details match the policy.
  21. bool ShouldAskBroker(IpcTag ipc_tag,
  22. const std::unique_ptr<wchar_t, NtAllocDeleter>& name,
  23. size_t name_len,
  24. uint32_t desired_access = 0,
  25. bool open_only = true) {
  26. const wchar_t* name_ptr = name.get();
  27. if (name_len >= 4 && name_ptr[0] == L'\\' && name_ptr[1] == L'?' &&
  28. name_ptr[2] == L'?' && name_ptr[3] == L'\\') {
  29. return true;
  30. }
  31. for (size_t index = 0; index < name_len; ++index) {
  32. if (name_ptr[index] == L'~')
  33. return true;
  34. }
  35. CountedParameterSet<OpenFile> params;
  36. params[OpenFile::NAME] = ParamPickerMake(name_ptr);
  37. params[OpenFile::ACCESS] = ParamPickerMake(desired_access);
  38. uint32_t open_only_int = open_only;
  39. params[OpenFile::OPENONLY] = ParamPickerMake(open_only_int);
  40. return QueryBroker(ipc_tag, params.GetBase());
  41. }
  42. } // namespace
  43. NTSTATUS WINAPI TargetNtCreateFile(NtCreateFileFunction orig_CreateFile,
  44. PHANDLE file,
  45. ACCESS_MASK desired_access,
  46. POBJECT_ATTRIBUTES object_attributes,
  47. PIO_STATUS_BLOCK io_status,
  48. PLARGE_INTEGER allocation_size,
  49. ULONG file_attributes,
  50. ULONG sharing,
  51. ULONG disposition,
  52. ULONG options,
  53. PVOID ea_buffer,
  54. ULONG ea_length) {
  55. // Check if the process can open it first.
  56. NTSTATUS status = orig_CreateFile(
  57. file, desired_access, object_attributes, io_status, allocation_size,
  58. file_attributes, sharing, disposition, options, ea_buffer, ea_length);
  59. if (STATUS_ACCESS_DENIED != status)
  60. return status;
  61. // We don't trust that the IPC can work this early.
  62. if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  63. return status;
  64. do {
  65. if (!ValidParameter(file, sizeof(HANDLE), WRITE))
  66. break;
  67. if (!ValidParameter(io_status, sizeof(IO_STATUS_BLOCK), WRITE))
  68. break;
  69. void* memory = GetGlobalIPCMemory();
  70. if (!memory)
  71. break;
  72. std::unique_ptr<wchar_t, NtAllocDeleter> name;
  73. size_t name_len;
  74. uint32_t attributes;
  75. NTSTATUS ret =
  76. CopyNameAndAttributes(object_attributes, &name, &name_len, &attributes);
  77. if (!NT_SUCCESS(ret) || !name || !name_len)
  78. break;
  79. if (!ShouldAskBroker(IpcTag::NTCREATEFILE, name, name_len, desired_access,
  80. disposition == FILE_OPEN)) {
  81. break;
  82. }
  83. SharedMemIPCClient ipc(memory);
  84. CrossCallReturn answer = {0};
  85. // The following call must match in the parameters with
  86. // FilesystemDispatcher::ProcessNtCreateFile.
  87. ResultCode code = CrossCall(ipc, IpcTag::NTCREATEFILE, name.get(),
  88. attributes, desired_access, file_attributes,
  89. sharing, disposition, options, &answer);
  90. if (SBOX_ALL_OK != code)
  91. break;
  92. status = answer.nt_status;
  93. if (!NT_SUCCESS(answer.nt_status))
  94. break;
  95. __try {
  96. *file = answer.handle;
  97. io_status->Status = answer.nt_status;
  98. io_status->Information = answer.extended[0].ulong_ptr;
  99. } __except (EXCEPTION_EXECUTE_HANDLER) {
  100. break;
  101. }
  102. } while (false);
  103. return status;
  104. }
  105. NTSTATUS WINAPI TargetNtOpenFile(NtOpenFileFunction orig_OpenFile,
  106. PHANDLE file,
  107. ACCESS_MASK desired_access,
  108. POBJECT_ATTRIBUTES object_attributes,
  109. PIO_STATUS_BLOCK io_status,
  110. ULONG sharing,
  111. ULONG options) {
  112. // Check if the process can open it first.
  113. NTSTATUS status = orig_OpenFile(file, desired_access, object_attributes,
  114. io_status, sharing, options);
  115. if (STATUS_ACCESS_DENIED != status)
  116. return status;
  117. // We don't trust that the IPC can work this early.
  118. if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  119. return status;
  120. do {
  121. if (!ValidParameter(file, sizeof(HANDLE), WRITE))
  122. break;
  123. if (!ValidParameter(io_status, sizeof(IO_STATUS_BLOCK), WRITE))
  124. break;
  125. void* memory = GetGlobalIPCMemory();
  126. if (!memory)
  127. break;
  128. std::unique_ptr<wchar_t, NtAllocDeleter> name;
  129. size_t name_len;
  130. uint32_t attributes;
  131. NTSTATUS ret =
  132. CopyNameAndAttributes(object_attributes, &name, &name_len, &attributes);
  133. if (!NT_SUCCESS(ret) || !name || !name_len)
  134. break;
  135. if (!ShouldAskBroker(IpcTag::NTOPENFILE, name, name_len, desired_access,
  136. true)) {
  137. break;
  138. }
  139. SharedMemIPCClient ipc(memory);
  140. CrossCallReturn answer = {0};
  141. ResultCode code = CrossCall(ipc, IpcTag::NTOPENFILE, name.get(), attributes,
  142. desired_access, sharing, options, &answer);
  143. if (SBOX_ALL_OK != code)
  144. break;
  145. status = answer.nt_status;
  146. if (!NT_SUCCESS(answer.nt_status))
  147. break;
  148. __try {
  149. *file = answer.handle;
  150. io_status->Status = answer.nt_status;
  151. io_status->Information = answer.extended[0].ulong_ptr;
  152. } __except (EXCEPTION_EXECUTE_HANDLER) {
  153. break;
  154. }
  155. } while (false);
  156. return status;
  157. }
  158. NTSTATUS WINAPI
  159. TargetNtQueryAttributesFile(NtQueryAttributesFileFunction orig_QueryAttributes,
  160. POBJECT_ATTRIBUTES object_attributes,
  161. PFILE_BASIC_INFORMATION file_attributes) {
  162. // Check if the process can query it first.
  163. NTSTATUS status = orig_QueryAttributes(object_attributes, file_attributes);
  164. if (STATUS_ACCESS_DENIED != status)
  165. return status;
  166. // We don't trust that the IPC can work this early.
  167. if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  168. return status;
  169. do {
  170. if (!ValidParameter(file_attributes, sizeof(FILE_BASIC_INFORMATION), WRITE))
  171. break;
  172. void* memory = GetGlobalIPCMemory();
  173. if (!memory)
  174. break;
  175. std::unique_ptr<wchar_t, NtAllocDeleter> name;
  176. size_t name_len;
  177. uint32_t attributes;
  178. NTSTATUS ret =
  179. CopyNameAndAttributes(object_attributes, &name, &name_len, &attributes);
  180. if (!NT_SUCCESS(ret) || !name || !name_len)
  181. break;
  182. if (!ShouldAskBroker(IpcTag::NTQUERYATTRIBUTESFILE, name, name_len))
  183. break;
  184. InOutCountedBuffer file_info(file_attributes,
  185. sizeof(FILE_BASIC_INFORMATION));
  186. SharedMemIPCClient ipc(memory);
  187. CrossCallReturn answer = {0};
  188. ResultCode code = CrossCall(ipc, IpcTag::NTQUERYATTRIBUTESFILE, name.get(),
  189. attributes, file_info, &answer);
  190. if (SBOX_ALL_OK != code)
  191. break;
  192. status = answer.nt_status;
  193. } while (false);
  194. return status;
  195. }
  196. NTSTATUS WINAPI TargetNtQueryFullAttributesFile(
  197. NtQueryFullAttributesFileFunction orig_QueryFullAttributes,
  198. POBJECT_ATTRIBUTES object_attributes,
  199. PFILE_NETWORK_OPEN_INFORMATION file_attributes) {
  200. // Check if the process can query it first.
  201. NTSTATUS status =
  202. orig_QueryFullAttributes(object_attributes, file_attributes);
  203. if (STATUS_ACCESS_DENIED != status)
  204. return status;
  205. // We don't trust that the IPC can work this early.
  206. if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  207. return status;
  208. do {
  209. if (!ValidParameter(file_attributes, sizeof(FILE_NETWORK_OPEN_INFORMATION),
  210. WRITE))
  211. break;
  212. void* memory = GetGlobalIPCMemory();
  213. if (!memory)
  214. break;
  215. std::unique_ptr<wchar_t, NtAllocDeleter> name;
  216. size_t name_len;
  217. uint32_t attributes;
  218. NTSTATUS ret =
  219. CopyNameAndAttributes(object_attributes, &name, &name_len, &attributes);
  220. if (!NT_SUCCESS(ret) || !name || !name_len)
  221. break;
  222. if (!ShouldAskBroker(IpcTag::NTQUERYFULLATTRIBUTESFILE, name, name_len))
  223. break;
  224. InOutCountedBuffer file_info(file_attributes,
  225. sizeof(FILE_NETWORK_OPEN_INFORMATION));
  226. SharedMemIPCClient ipc(memory);
  227. CrossCallReturn answer = {0};
  228. ResultCode code = CrossCall(ipc, IpcTag::NTQUERYFULLATTRIBUTESFILE,
  229. name.get(), attributes, file_info, &answer);
  230. if (SBOX_ALL_OK != code)
  231. break;
  232. status = answer.nt_status;
  233. } while (false);
  234. return status;
  235. }
  236. NTSTATUS WINAPI
  237. TargetNtSetInformationFile(NtSetInformationFileFunction orig_SetInformationFile,
  238. HANDLE file,
  239. PIO_STATUS_BLOCK io_status,
  240. PVOID file_info,
  241. ULONG length,
  242. FILE_INFORMATION_CLASS file_info_class) {
  243. // Check if the process can open it first.
  244. NTSTATUS status = orig_SetInformationFile(file, io_status, file_info, length,
  245. file_info_class);
  246. if (STATUS_ACCESS_DENIED != status)
  247. return status;
  248. // We don't trust that the IPC can work this early.
  249. if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  250. return status;
  251. do {
  252. void* memory = GetGlobalIPCMemory();
  253. if (!memory)
  254. break;
  255. if (!ValidParameter(io_status, sizeof(IO_STATUS_BLOCK), WRITE))
  256. break;
  257. if (!ValidParameter(file_info, length, READ))
  258. break;
  259. FILE_RENAME_INFORMATION* file_rename_info =
  260. reinterpret_cast<FILE_RENAME_INFORMATION*>(file_info);
  261. OBJECT_ATTRIBUTES object_attributes;
  262. UNICODE_STRING object_name;
  263. InitializeObjectAttributes(&object_attributes, &object_name, 0, nullptr,
  264. nullptr);
  265. __try {
  266. if (!IsSupportedRenameCall(file_rename_info, length, file_info_class))
  267. break;
  268. object_attributes.RootDirectory = file_rename_info->RootDirectory;
  269. object_name.Buffer = file_rename_info->FileName;
  270. object_name.Length = object_name.MaximumLength =
  271. static_cast<USHORT>(file_rename_info->FileNameLength);
  272. } __except (EXCEPTION_EXECUTE_HANDLER) {
  273. break;
  274. }
  275. std::unique_ptr<wchar_t, NtAllocDeleter> name;
  276. size_t name_len;
  277. NTSTATUS ret = CopyNameAndAttributes(&object_attributes, &name, &name_len);
  278. if (!NT_SUCCESS(ret) || !name || !name_len)
  279. break;
  280. if (!ShouldAskBroker(IpcTag::NTSETINFO_RENAME, name, name_len))
  281. break;
  282. InOutCountedBuffer io_status_buffer(io_status, sizeof(IO_STATUS_BLOCK));
  283. // This is actually not an InOut buffer, only In, but using InOut facility
  284. // really helps to simplify the code.
  285. InOutCountedBuffer file_info_buffer(file_info, length);
  286. SharedMemIPCClient ipc(memory);
  287. CrossCallReturn answer = {0};
  288. ResultCode code =
  289. CrossCall(ipc, IpcTag::NTSETINFO_RENAME, file, io_status_buffer,
  290. file_info_buffer, length, file_info_class, &answer);
  291. if (SBOX_ALL_OK != code)
  292. break;
  293. status = answer.nt_status;
  294. } while (false);
  295. return status;
  296. }
  297. } // namespace sandbox