process_thread_interception.cc 10.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339
  1. // Copyright (c) 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/process_thread_interception.h"
  5. #include <stdint.h>
  6. #include "base/win/windows_version.h"
  7. #include "sandbox/win/src/crosscall_client.h"
  8. #include "sandbox/win/src/ipc_tags.h"
  9. #include "sandbox/win/src/policy_params.h"
  10. #include "sandbox/win/src/policy_target.h"
  11. #include "sandbox/win/src/sandbox_factory.h"
  12. #include "sandbox/win/src/sandbox_nt_util.h"
  13. #include "sandbox/win/src/sharedmem_ipc_client.h"
  14. #include "sandbox/win/src/target_services.h"
  15. namespace sandbox {
  16. // Hooks NtOpenThread and proxy the call to the broker if it's trying to
  17. // open a thread in the same process.
  18. NTSTATUS WINAPI TargetNtOpenThread(NtOpenThreadFunction orig_OpenThread,
  19. PHANDLE thread,
  20. ACCESS_MASK desired_access,
  21. POBJECT_ATTRIBUTES object_attributes,
  22. PCLIENT_ID client_id) {
  23. NTSTATUS status =
  24. orig_OpenThread(thread, desired_access, object_attributes, client_id);
  25. if (NT_SUCCESS(status))
  26. return status;
  27. do {
  28. if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  29. break;
  30. if (!client_id)
  31. break;
  32. uint32_t thread_id = 0;
  33. bool should_break = false;
  34. __try {
  35. // We support only the calls for the current process
  36. if (client_id->UniqueProcess)
  37. should_break = true;
  38. // Object attributes should be nullptr or empty.
  39. if (!should_break && object_attributes) {
  40. if (object_attributes->Attributes || object_attributes->ObjectName ||
  41. object_attributes->RootDirectory ||
  42. object_attributes->SecurityDescriptor ||
  43. object_attributes->SecurityQualityOfService) {
  44. should_break = true;
  45. }
  46. }
  47. thread_id = static_cast<uint32_t>(
  48. reinterpret_cast<ULONG_PTR>(client_id->UniqueThread));
  49. } __except (EXCEPTION_EXECUTE_HANDLER) {
  50. break;
  51. }
  52. if (should_break)
  53. break;
  54. if (!ValidParameter(thread, sizeof(HANDLE), WRITE))
  55. break;
  56. void* memory = GetGlobalIPCMemory();
  57. if (!memory)
  58. break;
  59. SharedMemIPCClient ipc(memory);
  60. CrossCallReturn answer = {0};
  61. ResultCode code = CrossCall(ipc, IpcTag::NTOPENTHREAD, desired_access,
  62. thread_id, &answer);
  63. if (SBOX_ALL_OK != code)
  64. break;
  65. if (!NT_SUCCESS(answer.nt_status))
  66. // The nt_status here is most likely STATUS_INVALID_CID because
  67. // in the broker we set the process id in the CID (client ID) param
  68. // to be the current process. If you try to open a thread from another
  69. // process you will get this INVALID_CID error. On the other hand, if you
  70. // try to open a thread in your own process, it should return success.
  71. // We don't want to return STATUS_INVALID_CID here, so we return the
  72. // return of the original open thread status, which is most likely
  73. // STATUS_ACCESS_DENIED.
  74. break;
  75. __try {
  76. // Write the output parameters.
  77. *thread = answer.handle;
  78. } __except (EXCEPTION_EXECUTE_HANDLER) {
  79. break;
  80. }
  81. return answer.nt_status;
  82. } while (false);
  83. return status;
  84. }
  85. // Hooks NtOpenProcess and proxy the call to the broker if it's trying to
  86. // open the current process.
  87. NTSTATUS WINAPI TargetNtOpenProcess(NtOpenProcessFunction orig_OpenProcess,
  88. PHANDLE process,
  89. ACCESS_MASK desired_access,
  90. POBJECT_ATTRIBUTES object_attributes,
  91. PCLIENT_ID client_id) {
  92. NTSTATUS status =
  93. orig_OpenProcess(process, desired_access, object_attributes, client_id);
  94. if (NT_SUCCESS(status))
  95. return status;
  96. do {
  97. if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  98. break;
  99. if (!client_id)
  100. break;
  101. uint32_t process_id = 0;
  102. bool should_break = false;
  103. __try {
  104. // Object attributes should be nullptr or empty.
  105. if (!should_break && object_attributes) {
  106. if (object_attributes->Attributes || object_attributes->ObjectName ||
  107. object_attributes->RootDirectory ||
  108. object_attributes->SecurityDescriptor ||
  109. object_attributes->SecurityQualityOfService) {
  110. should_break = true;
  111. }
  112. }
  113. process_id = static_cast<uint32_t>(
  114. reinterpret_cast<ULONG_PTR>(client_id->UniqueProcess));
  115. } __except (EXCEPTION_EXECUTE_HANDLER) {
  116. break;
  117. }
  118. if (should_break)
  119. break;
  120. if (!ValidParameter(process, sizeof(HANDLE), WRITE))
  121. break;
  122. void* memory = GetGlobalIPCMemory();
  123. if (!memory)
  124. break;
  125. SharedMemIPCClient ipc(memory);
  126. CrossCallReturn answer = {0};
  127. ResultCode code = CrossCall(ipc, IpcTag::NTOPENPROCESS, desired_access,
  128. process_id, &answer);
  129. if (SBOX_ALL_OK != code)
  130. break;
  131. if (!NT_SUCCESS(answer.nt_status))
  132. return answer.nt_status;
  133. __try {
  134. // Write the output parameters.
  135. *process = answer.handle;
  136. } __except (EXCEPTION_EXECUTE_HANDLER) {
  137. break;
  138. }
  139. return answer.nt_status;
  140. } while (false);
  141. return status;
  142. }
  143. NTSTATUS WINAPI
  144. TargetNtOpenProcessToken(NtOpenProcessTokenFunction orig_OpenProcessToken,
  145. HANDLE process,
  146. ACCESS_MASK desired_access,
  147. PHANDLE token) {
  148. NTSTATUS status = orig_OpenProcessToken(process, desired_access, token);
  149. if (NT_SUCCESS(status))
  150. return status;
  151. do {
  152. if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  153. break;
  154. if (CURRENT_PROCESS != process)
  155. break;
  156. if (!ValidParameter(token, sizeof(HANDLE), WRITE))
  157. break;
  158. void* memory = GetGlobalIPCMemory();
  159. if (!memory)
  160. break;
  161. SharedMemIPCClient ipc(memory);
  162. CrossCallReturn answer = {0};
  163. ResultCode code = CrossCall(ipc, IpcTag::NTOPENPROCESSTOKEN, process,
  164. desired_access, &answer);
  165. if (SBOX_ALL_OK != code)
  166. break;
  167. if (!NT_SUCCESS(answer.nt_status))
  168. return answer.nt_status;
  169. __try {
  170. // Write the output parameters.
  171. *token = answer.handle;
  172. } __except (EXCEPTION_EXECUTE_HANDLER) {
  173. break;
  174. }
  175. return answer.nt_status;
  176. } while (false);
  177. return status;
  178. }
  179. NTSTATUS WINAPI
  180. TargetNtOpenProcessTokenEx(NtOpenProcessTokenExFunction orig_OpenProcessTokenEx,
  181. HANDLE process,
  182. ACCESS_MASK desired_access,
  183. ULONG handle_attributes,
  184. PHANDLE token) {
  185. NTSTATUS status = orig_OpenProcessTokenEx(process, desired_access,
  186. handle_attributes, token);
  187. if (NT_SUCCESS(status))
  188. return status;
  189. do {
  190. if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  191. break;
  192. if (CURRENT_PROCESS != process)
  193. break;
  194. if (!ValidParameter(token, sizeof(HANDLE), WRITE))
  195. break;
  196. void* memory = GetGlobalIPCMemory();
  197. if (!memory)
  198. break;
  199. SharedMemIPCClient ipc(memory);
  200. CrossCallReturn answer = {0};
  201. ResultCode code = CrossCall(ipc, IpcTag::NTOPENPROCESSTOKENEX, process,
  202. desired_access, handle_attributes, &answer);
  203. if (SBOX_ALL_OK != code)
  204. break;
  205. if (!NT_SUCCESS(answer.nt_status))
  206. return answer.nt_status;
  207. __try {
  208. // Write the output parameters.
  209. *token = answer.handle;
  210. } __except (EXCEPTION_EXECUTE_HANDLER) {
  211. break;
  212. }
  213. return answer.nt_status;
  214. } while (false);
  215. return status;
  216. }
  217. HANDLE WINAPI TargetCreateThread(CreateThreadFunction orig_CreateThread,
  218. LPSECURITY_ATTRIBUTES thread_attributes,
  219. SIZE_T stack_size,
  220. LPTHREAD_START_ROUTINE start_address,
  221. LPVOID parameter,
  222. DWORD creation_flags,
  223. LPDWORD thread_id) {
  224. HANDLE hThread = nullptr;
  225. TargetServices* target_services = SandboxFactory::GetTargetServices();
  226. if (!target_services || target_services->GetState()->IsCsrssConnected()) {
  227. hThread = orig_CreateThread(thread_attributes, stack_size, start_address,
  228. parameter, creation_flags, thread_id);
  229. if (hThread)
  230. return hThread;
  231. }
  232. DWORD original_error = ::GetLastError();
  233. do {
  234. if (!target_services)
  235. break;
  236. // We don't trust that the IPC can work this early.
  237. if (!target_services->GetState()->InitCalled())
  238. break;
  239. __try {
  240. if (thread_id && !ValidParameter(thread_id, sizeof(*thread_id), WRITE))
  241. break;
  242. if (!start_address)
  243. break;
  244. // We don't support thread_attributes not being null.
  245. if (thread_attributes)
  246. break;
  247. } __except (EXCEPTION_EXECUTE_HANDLER) {
  248. break;
  249. }
  250. void* memory = GetGlobalIPCMemory();
  251. if (!memory)
  252. break;
  253. SharedMemIPCClient ipc(memory);
  254. CrossCallReturn answer = {0};
  255. // NOTE: we don't pass the thread_attributes through. This matches the
  256. // approach in CreateProcess and in CreateThreadInternal().
  257. ResultCode code = CrossCall(ipc, IpcTag::CREATETHREAD,
  258. reinterpret_cast<LPVOID>(stack_size),
  259. reinterpret_cast<LPVOID>(start_address),
  260. parameter, creation_flags, &answer);
  261. if (SBOX_ALL_OK != code)
  262. break;
  263. ::SetLastError(answer.win32_result);
  264. if (ERROR_SUCCESS != answer.win32_result)
  265. return nullptr;
  266. __try {
  267. if (thread_id)
  268. *thread_id = ::GetThreadId(answer.handle);
  269. return answer.handle;
  270. } __except (EXCEPTION_EXECUTE_HANDLER) {
  271. break;
  272. }
  273. } while (false);
  274. ::SetLastError(original_error);
  275. return nullptr;
  276. }
  277. } // namespace sandbox