named_pipe_policy.cc 3.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889
  1. // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/named_pipe_policy.h"
  5. #include <string>
  6. #include "sandbox/win/src/ipc_tags.h"
  7. #include "sandbox/win/src/policy_engine_opcodes.h"
  8. #include "sandbox/win/src/policy_params.h"
  9. #include "sandbox/win/src/sandbox_types.h"
  10. namespace {
  11. // Creates a named pipe and duplicates the handle to 'target_process'. The
  12. // remaining parameters are the same as CreateNamedPipeW().
  13. HANDLE CreateNamedPipeHelper(HANDLE target_process,
  14. LPCWSTR pipe_name,
  15. DWORD open_mode,
  16. DWORD pipe_mode,
  17. DWORD max_instances,
  18. DWORD out_buffer_size,
  19. DWORD in_buffer_size,
  20. DWORD default_timeout,
  21. LPSECURITY_ATTRIBUTES security_attributes) {
  22. HANDLE pipe = ::CreateNamedPipeW(
  23. pipe_name, open_mode, pipe_mode, max_instances, out_buffer_size,
  24. in_buffer_size, default_timeout, security_attributes);
  25. if (INVALID_HANDLE_VALUE == pipe)
  26. return pipe;
  27. HANDLE new_pipe;
  28. if (!::DuplicateHandle(::GetCurrentProcess(), pipe, target_process, &new_pipe,
  29. 0, false,
  30. DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) {
  31. return INVALID_HANDLE_VALUE;
  32. }
  33. return new_pipe;
  34. }
  35. } // namespace
  36. namespace sandbox {
  37. bool NamedPipePolicy::GenerateRules(const wchar_t* name,
  38. Semantics semantics,
  39. LowLevelPolicy* policy) {
  40. if (Semantics::kNamedPipesAllowAny != semantics) {
  41. return false;
  42. }
  43. PolicyRule pipe(ASK_BROKER);
  44. if (!pipe.AddStringMatch(IF, NameBased::NAME, name, CASE_INSENSITIVE)) {
  45. return false;
  46. }
  47. if (!policy->AddRule(IpcTag::CREATENAMEDPIPEW, &pipe)) {
  48. return false;
  49. }
  50. return true;
  51. }
  52. DWORD NamedPipePolicy::CreateNamedPipeAction(EvalResult eval_result,
  53. const ClientInfo& client_info,
  54. const std::wstring& name,
  55. DWORD open_mode,
  56. DWORD pipe_mode,
  57. DWORD max_instances,
  58. DWORD out_buffer_size,
  59. DWORD in_buffer_size,
  60. DWORD default_timeout,
  61. HANDLE* pipe) {
  62. *pipe = INVALID_HANDLE_VALUE;
  63. // The only action supported is ASK_BROKER which means create the pipe.
  64. if (ASK_BROKER != eval_result) {
  65. return ERROR_ACCESS_DENIED;
  66. }
  67. *pipe = CreateNamedPipeHelper(client_info.process, name.c_str(), open_mode,
  68. pipe_mode, max_instances, out_buffer_size,
  69. in_buffer_size, default_timeout, nullptr);
  70. if (INVALID_HANDLE_VALUE == *pipe)
  71. return ERROR_ACCESS_DENIED;
  72. return ERROR_SUCCESS;
  73. }
  74. } // namespace sandbox