process_mitigations.h 2.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_WIN_SRC_PROCESS_MITIGATIONS_H_
  5. #define SANDBOX_WIN_SRC_PROCESS_MITIGATIONS_H_
  6. #include <windows.h>
  7. #include <stddef.h>
  8. #include "sandbox/win/src/security_level.h"
  9. namespace sandbox {
  10. // Sets the mitigation policy for the current process, ignoring any settings
  11. // that are invalid for the current version of Windows.
  12. bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags flags);
  13. // Sets the mitigation policy for the current thread, ignoring any settings
  14. // that are invalid for the current version of Windows.
  15. bool ApplyMitigationsToCurrentThread(MitigationFlags flags);
  16. // Returns the flags that must be enforced after startup for the current OS
  17. // version.
  18. MitigationFlags FilterPostStartupProcessMitigations(MitigationFlags flags);
  19. // Converts sandbox flags to the PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES
  20. // policy flags used by UpdateProcThreadAttribute().
  21. // - |policy_flags| must be a two-element DWORD64 array.
  22. // - |size| is a size_t so that it can be passed directly into
  23. // UpdateProcThreadAttribute().
  24. void ConvertProcessMitigationsToPolicy(MitigationFlags flags,
  25. DWORD64* policy_flags,
  26. size_t* size);
  27. // Converts sandbox flags to COMPONENT_FILTER so that it can be passed directly
  28. // to UpdateProcThreadAttribute().
  29. void ConvertProcessMitigationsToComponentFilter(MitigationFlags flags,
  30. COMPONENT_FILTER* filter);
  31. // Adds mitigations that need to be performed on the suspended target process
  32. // before execution begins.
  33. bool ApplyProcessMitigationsToSuspendedProcess(HANDLE process,
  34. MitigationFlags flags);
  35. // Returns the list of process mitigations which can be enabled post startup.
  36. MitigationFlags GetAllowedPostStartupProcessMitigations();
  37. // Returns true if all the supplied flags can be set after a process starts.
  38. bool CanSetProcessMitigationsPostStartup(MitigationFlags flags);
  39. // Returns true if all the supplied flags can be set before a process starts.
  40. bool CanSetProcessMitigationsPreStartup(MitigationFlags flags);
  41. // Returns true if all the supplied flags can be set on the current thread.
  42. bool CanSetMitigationsPerThread(MitigationFlags flags);
  43. } // namespace sandbox
  44. #endif // SANDBOX_WIN_SRC_PROCESS_MITIGATIONS_H_