policy_broker.cc 2.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/policy_broker.h"
  5. #include <stddef.h>
  6. #include <map>
  7. #include "base/check.h"
  8. #include "base/win/pe_image.h"
  9. #include "base/win/windows_version.h"
  10. #include "sandbox/win/src/interception.h"
  11. #include "sandbox/win/src/interceptors.h"
  12. #include "sandbox/win/src/internal_types.h"
  13. #include "sandbox/win/src/policy_target.h"
  14. #include "sandbox/win/src/process_thread_interception.h"
  15. #include "sandbox/win/src/sandbox.h"
  16. #include "sandbox/win/src/sandbox_nt_types.h"
  17. #include "sandbox/win/src/sandbox_nt_util.h"
  18. #include "sandbox/win/src/sandbox_types.h"
  19. #include "sandbox/win/src/target_process.h"
  20. // This code executes on the broker side, as a callback from the policy on the
  21. // target side (the child).
  22. namespace sandbox {
  23. bool SetupNtdllImports(TargetProcess& child) {
  24. return (SBOX_ALL_OK ==
  25. child.TransferVariable("g_nt", GetNtExports(), sizeof(NtExports)));
  26. }
  27. #undef INIT_GLOBAL_NT
  28. #undef INIT_GLOBAL_RTL
  29. bool SetupBasicInterceptions(InterceptionManager* manager,
  30. bool is_csrss_connected) {
  31. // Interceptions provided by process_thread_policy, without actual policy.
  32. if (!INTERCEPT_NT(manager, NtOpenThread, OPEN_THREAD_ID, 20) ||
  33. !INTERCEPT_NT(manager, NtOpenProcess, OPEN_PROCESS_ID, 20) ||
  34. !INTERCEPT_NT(manager, NtOpenProcessToken, OPEN_PROCESS_TOKEN_ID, 16))
  35. return false;
  36. // Interceptions with neither policy nor IPC.
  37. if (!INTERCEPT_NT(manager, NtSetInformationThread, SET_INFORMATION_THREAD_ID,
  38. 20) ||
  39. !INTERCEPT_NT(manager, NtOpenThreadToken, OPEN_THREAD_TOKEN_ID, 20))
  40. return false;
  41. // This one is also provided by process_thread_policy.
  42. if (!INTERCEPT_NT(manager, NtOpenProcessTokenEx, OPEN_PROCESS_TOKEN_EX_ID,
  43. 20))
  44. return false;
  45. if (!INTERCEPT_NT(manager, NtOpenThreadTokenEx, OPEN_THREAD_TOKEN_EX_ID, 24))
  46. return false;
  47. if (!is_csrss_connected) {
  48. if (!INTERCEPT_EAT(manager, kKerneldllName, CreateThread, CREATE_THREAD_ID,
  49. 28))
  50. return false;
  51. }
  52. return true;
  53. }
  54. } // namespace sandbox