policy_target.cc 4.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122
  1. // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/policy_target.h"
  5. #include <stddef.h>
  6. #include "sandbox/win/src/crosscall_client.h"
  7. #include "sandbox/win/src/ipc_tags.h"
  8. #include "sandbox/win/src/policy_engine_processor.h"
  9. #include "sandbox/win/src/policy_low_level.h"
  10. #include "sandbox/win/src/policy_params.h"
  11. #include "sandbox/win/src/sandbox_factory.h"
  12. #include "sandbox/win/src/sandbox_nt_util.h"
  13. #include "sandbox/win/src/sharedmem_ipc_client.h"
  14. #include "sandbox/win/src/target_services.h"
  15. namespace sandbox {
  16. // Policy data.
  17. extern void* volatile g_shared_policy_memory;
  18. SANDBOX_INTERCEPT size_t g_shared_policy_size;
  19. bool QueryBroker(IpcTag ipc_id, CountedParameterSetBase* params) {
  20. DCHECK_NT(static_cast<size_t>(ipc_id) < kMaxServiceCount);
  21. DCHECK_NT(g_shared_policy_memory);
  22. DCHECK_NT(g_shared_policy_size > 0);
  23. if (static_cast<size_t>(ipc_id) >= kMaxServiceCount)
  24. return false;
  25. PolicyGlobal* global_policy =
  26. reinterpret_cast<PolicyGlobal*>(g_shared_policy_memory);
  27. if (!global_policy->entry[static_cast<size_t>(ipc_id)])
  28. return false;
  29. PolicyBuffer* policy = reinterpret_cast<PolicyBuffer*>(
  30. reinterpret_cast<char*>(g_shared_policy_memory) +
  31. reinterpret_cast<size_t>(
  32. global_policy->entry[static_cast<size_t>(ipc_id)]));
  33. if ((reinterpret_cast<size_t>(
  34. global_policy->entry[static_cast<size_t>(ipc_id)]) >
  35. global_policy->data_size) ||
  36. (g_shared_policy_size < global_policy->data_size)) {
  37. NOTREACHED_NT();
  38. return false;
  39. }
  40. for (size_t i = 0; i < params->count; i++) {
  41. if (!params->parameters[i].IsValid()) {
  42. NOTREACHED_NT();
  43. return false;
  44. }
  45. }
  46. PolicyProcessor processor(policy);
  47. PolicyResult result =
  48. processor.Evaluate(kShortEval, params->parameters, params->count);
  49. DCHECK_NT(POLICY_ERROR != result);
  50. return POLICY_MATCH == result && ASK_BROKER == processor.GetAction();
  51. }
  52. // -----------------------------------------------------------------------
  53. // Hooks NtSetInformationThread to block RevertToSelf from being
  54. // called before the actual call to LowerToken.
  55. NTSTATUS WINAPI TargetNtSetInformationThread(
  56. NtSetInformationThreadFunction orig_SetInformationThread,
  57. HANDLE thread,
  58. NT_THREAD_INFORMATION_CLASS thread_info_class,
  59. PVOID thread_information,
  60. ULONG thread_information_bytes) {
  61. do {
  62. if (SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf())
  63. break;
  64. if (ThreadImpersonationToken != thread_info_class)
  65. break;
  66. // This is a revert to self.
  67. return STATUS_SUCCESS;
  68. } while (false);
  69. return orig_SetInformationThread(
  70. thread, thread_info_class, thread_information, thread_information_bytes);
  71. }
  72. // Hooks NtOpenThreadToken to force the open_as_self parameter to be set to
  73. // false if we are still running with the impersonation token. open_as_self set
  74. // to true means that the token will be open using the process token instead of
  75. // the impersonation token. This is bad because the process token does not have
  76. // access to open the thread token.
  77. NTSTATUS WINAPI
  78. TargetNtOpenThreadToken(NtOpenThreadTokenFunction orig_OpenThreadToken,
  79. HANDLE thread,
  80. ACCESS_MASK desired_access,
  81. BOOLEAN open_as_self,
  82. PHANDLE token) {
  83. if (!SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf())
  84. open_as_self = false;
  85. return orig_OpenThreadToken(thread, desired_access, open_as_self, token);
  86. }
  87. // See comment for TargetNtOpenThreadToken
  88. NTSTATUS WINAPI
  89. TargetNtOpenThreadTokenEx(NtOpenThreadTokenExFunction orig_OpenThreadTokenEx,
  90. HANDLE thread,
  91. ACCESS_MASK desired_access,
  92. BOOLEAN open_as_self,
  93. ULONG handle_attributes,
  94. PHANDLE token) {
  95. if (!SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf())
  96. open_as_self = false;
  97. return orig_OpenThreadTokenEx(thread, desired_access, open_as_self,
  98. handle_attributes, token);
  99. }
  100. } // namespace sandbox