restricted_token.cc 9.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/restricted_token.h"
  5. #include <windows.h>
  6. #include <stddef.h>
  7. #include <memory>
  8. #include <unordered_set>
  9. #include <vector>
  10. #include "base/logging.h"
  11. #include "base/win/access_token.h"
  12. #include "sandbox/win/src/acl.h"
  13. namespace {
  14. std::vector<SID_AND_ATTRIBUTES> ConvertToAttributes(
  15. const std::vector<base::win::Sid>& sids,
  16. DWORD attributes) {
  17. std::vector<SID_AND_ATTRIBUTES> ret(sids.size());
  18. for (size_t i = 0; i < sids.size(); ++i) {
  19. ret[i].Attributes = attributes;
  20. ret[i].Sid = sids[i].GetPSID();
  21. }
  22. return ret;
  23. }
  24. bool DeletePrivilege(const base::win::ScopedHandle& token,
  25. const wchar_t* name) {
  26. TOKEN_PRIVILEGES privs = {};
  27. privs.PrivilegeCount = 1;
  28. if (!::LookupPrivilegeValue(nullptr, name, &privs.Privileges[0].Luid))
  29. return false;
  30. privs.Privileges[0].Attributes = SE_PRIVILEGE_REMOVED;
  31. return !!::AdjustTokenPrivileges(token.Get(), FALSE, &privs, 0, nullptr,
  32. nullptr);
  33. }
  34. } // namespace
  35. namespace sandbox {
  36. RestrictedToken::RestrictedToken()
  37. : integrity_level_(INTEGRITY_LEVEL_LAST),
  38. init_(false),
  39. lockdown_default_dacl_(false),
  40. delete_all_privileges_(false),
  41. remove_traversal_privilege_(false) {}
  42. RestrictedToken::~RestrictedToken() {}
  43. DWORD RestrictedToken::Init(const HANDLE effective_token) {
  44. if (init_)
  45. return ERROR_ALREADY_INITIALIZED;
  46. HANDLE temp_token;
  47. if (effective_token) {
  48. // We duplicate the handle to be able to use it even if the original handle
  49. // is closed.
  50. if (!::DuplicateHandle(::GetCurrentProcess(), effective_token,
  51. ::GetCurrentProcess(), &temp_token, 0, false,
  52. DUPLICATE_SAME_ACCESS)) {
  53. return ::GetLastError();
  54. }
  55. } else {
  56. if (!::OpenProcessToken(::GetCurrentProcess(), TOKEN_ALL_ACCESS,
  57. &temp_token)) {
  58. return ::GetLastError();
  59. }
  60. }
  61. effective_token_.Set(temp_token);
  62. absl::optional<base::win::AccessToken> query_token =
  63. base::win::AccessToken::FromToken(effective_token_.Get());
  64. if (!query_token)
  65. return ERROR_NO_TOKEN;
  66. query_token_.swap(query_token);
  67. init_ = true;
  68. return ERROR_SUCCESS;
  69. }
  70. DWORD RestrictedToken::GetRestrictedToken(
  71. base::win::ScopedHandle* token) const {
  72. DCHECK(init_);
  73. if (!init_)
  74. return ERROR_NO_TOKEN;
  75. std::vector<SID_AND_ATTRIBUTES> deny_sids =
  76. ConvertToAttributes(sids_for_deny_only_, SE_GROUP_USE_FOR_DENY_ONLY);
  77. std::vector<SID_AND_ATTRIBUTES> restrict_sids =
  78. ConvertToAttributes(sids_to_restrict_, 0);
  79. bool result = true;
  80. HANDLE new_token_handle = nullptr;
  81. if (!deny_sids.empty() || !restrict_sids.empty() || delete_all_privileges_) {
  82. result = ::CreateRestrictedToken(
  83. effective_token_.Get(),
  84. delete_all_privileges_ ? DISABLE_MAX_PRIVILEGE : 0,
  85. static_cast<DWORD>(deny_sids.size()), deny_sids.data(), 0, nullptr,
  86. static_cast<DWORD>(restrict_sids.size()), restrict_sids.data(),
  87. &new_token_handle);
  88. } else {
  89. // Duplicate the token even if it's not modified at this point
  90. // because any subsequent changes to this token would also affect the
  91. // current process.
  92. result = ::DuplicateTokenEx(effective_token_.Get(), TOKEN_ALL_ACCESS,
  93. nullptr, SecurityIdentification, TokenPrimary,
  94. &new_token_handle);
  95. }
  96. if (!result)
  97. return ::GetLastError();
  98. base::win::ScopedHandle new_token(new_token_handle);
  99. if (delete_all_privileges_ && remove_traversal_privilege_) {
  100. if (!DeletePrivilege(new_token, SE_CHANGE_NOTIFY_NAME))
  101. return ::GetLastError();
  102. }
  103. if (lockdown_default_dacl_) {
  104. // Don't add Restricted sid and also remove logon sid access.
  105. if (!RevokeLogonSidFromDefaultDacl(new_token.Get()))
  106. return ::GetLastError();
  107. } else {
  108. // Modify the default dacl on the token to contain Restricted.
  109. if (!AddSidToDefaultDacl(new_token.Get(),
  110. base::win::WellKnownSid::kRestricted,
  111. SecurityAccessMode::kGrant, GENERIC_ALL)) {
  112. return ::GetLastError();
  113. }
  114. }
  115. for (const auto& default_dacl_sid : sids_for_default_dacl_) {
  116. if (!AddSidToDefaultDacl(new_token.Get(), std::get<0>(default_dacl_sid),
  117. std::get<1>(default_dacl_sid),
  118. std::get<2>(default_dacl_sid))) {
  119. return ::GetLastError();
  120. }
  121. }
  122. // Add user to default dacl.
  123. if (!AddUserSidToDefaultDacl(new_token.Get(), GENERIC_ALL))
  124. return ::GetLastError();
  125. DWORD error = SetTokenIntegrityLevel(new_token.Get(), integrity_level_);
  126. if (ERROR_SUCCESS != error)
  127. return error;
  128. HANDLE token_handle;
  129. if (!::DuplicateHandle(::GetCurrentProcess(), new_token.Get(),
  130. ::GetCurrentProcess(), &token_handle, TOKEN_ALL_ACCESS,
  131. false, // Don't inherit.
  132. 0)) {
  133. return ::GetLastError();
  134. }
  135. token->Set(token_handle);
  136. return ERROR_SUCCESS;
  137. }
  138. DWORD RestrictedToken::GetRestrictedTokenForImpersonation(
  139. base::win::ScopedHandle* token) const {
  140. DCHECK(init_);
  141. if (!init_)
  142. return ERROR_NO_TOKEN;
  143. base::win::ScopedHandle restricted_token;
  144. DWORD err_code = GetRestrictedToken(&restricted_token);
  145. if (ERROR_SUCCESS != err_code)
  146. return err_code;
  147. HANDLE impersonation_token_handle;
  148. if (!::DuplicateTokenEx(restricted_token.Get(), TOKEN_ALL_ACCESS, nullptr,
  149. SecurityImpersonation, TokenImpersonation,
  150. &impersonation_token_handle)) {
  151. return ::GetLastError();
  152. }
  153. token->Set(impersonation_token_handle);
  154. return ERROR_SUCCESS;
  155. }
  156. DWORD RestrictedToken::AddAllSidsForDenyOnly(
  157. const std::vector<base::win::Sid>& exceptions) {
  158. DCHECK(init_);
  159. if (!init_)
  160. return ERROR_NO_TOKEN;
  161. // Build the list of the deny only group SIDs
  162. for (const base::win::AccessToken::Group& group : query_token_->Groups()) {
  163. if (group.IsIntegrity() || group.IsLogonId())
  164. continue;
  165. bool should_ignore = false;
  166. for (const base::win::Sid& sid : exceptions) {
  167. if (sid == group.GetSid()) {
  168. should_ignore = true;
  169. break;
  170. }
  171. }
  172. if (!should_ignore) {
  173. sids_for_deny_only_.push_back(group.GetSid().Clone());
  174. }
  175. }
  176. return ERROR_SUCCESS;
  177. }
  178. DWORD RestrictedToken::AddSidForDenyOnly(const base::win::Sid& sid) {
  179. DCHECK(init_);
  180. if (!init_)
  181. return ERROR_NO_TOKEN;
  182. sids_for_deny_only_.push_back(sid.Clone());
  183. return ERROR_SUCCESS;
  184. }
  185. DWORD RestrictedToken::AddSidForDenyOnly(base::win::WellKnownSid known_sid) {
  186. absl::optional<base::win::Sid> sid = base::win::Sid::FromKnownSid(known_sid);
  187. if (!sid)
  188. return ERROR_INVALID_SID;
  189. return AddSidForDenyOnly(*sid);
  190. }
  191. DWORD RestrictedToken::AddUserSidForDenyOnly() {
  192. DCHECK(init_);
  193. if (!init_)
  194. return ERROR_NO_TOKEN;
  195. sids_for_deny_only_.push_back(query_token_->User());
  196. return ERROR_SUCCESS;
  197. }
  198. DWORD RestrictedToken::DeleteAllPrivileges(bool remove_traversal_privilege) {
  199. DCHECK(init_);
  200. if (!init_)
  201. return ERROR_NO_TOKEN;
  202. delete_all_privileges_ = true;
  203. remove_traversal_privilege_ = remove_traversal_privilege;
  204. return ERROR_SUCCESS;
  205. }
  206. DWORD RestrictedToken::AddRestrictingSid(const base::win::Sid& sid) {
  207. DCHECK(init_);
  208. if (!init_)
  209. return ERROR_NO_TOKEN;
  210. sids_to_restrict_.push_back(sid.Clone()); // No attributes
  211. return ERROR_SUCCESS;
  212. }
  213. DWORD RestrictedToken::AddRestrictingSid(base::win::WellKnownSid known_sid) {
  214. absl::optional<base::win::Sid> sid = base::win::Sid::FromKnownSid(known_sid);
  215. if (!sid)
  216. return ERROR_INVALID_SID;
  217. return AddRestrictingSid(*sid);
  218. }
  219. DWORD RestrictedToken::AddRestrictingSidLogonSession() {
  220. DCHECK(init_);
  221. if (!init_)
  222. return ERROR_NO_TOKEN;
  223. absl::optional<base::win::Sid> logon_sid = query_token_->LogonId();
  224. if (logon_sid)
  225. sids_to_restrict_.push_back(std::move(*logon_sid));
  226. return ERROR_SUCCESS;
  227. }
  228. DWORD RestrictedToken::AddRestrictingSidCurrentUser() {
  229. DCHECK(init_);
  230. if (!init_)
  231. return ERROR_NO_TOKEN;
  232. sids_to_restrict_.push_back(query_token_->User());
  233. return ERROR_SUCCESS;
  234. }
  235. DWORD RestrictedToken::AddRestrictingSidAllSids() {
  236. DCHECK(init_);
  237. if (!init_)
  238. return ERROR_NO_TOKEN;
  239. // Add the current user to the list.
  240. DWORD error = AddRestrictingSidCurrentUser();
  241. if (ERROR_SUCCESS != error)
  242. return error;
  243. for (const base::win::AccessToken::Group& group : query_token_->Groups()) {
  244. if (group.IsIntegrity())
  245. continue;
  246. AddRestrictingSid(group.GetSid());
  247. }
  248. return ERROR_SUCCESS;
  249. }
  250. DWORD RestrictedToken::SetIntegrityLevel(IntegrityLevel integrity_level) {
  251. integrity_level_ = integrity_level;
  252. return ERROR_SUCCESS;
  253. }
  254. void RestrictedToken::SetLockdownDefaultDacl() {
  255. lockdown_default_dacl_ = true;
  256. }
  257. DWORD RestrictedToken::AddDefaultDaclSid(const base::win::Sid& sid,
  258. SecurityAccessMode access_mode,
  259. ACCESS_MASK access) {
  260. DCHECK(init_);
  261. if (!init_)
  262. return ERROR_NO_TOKEN;
  263. sids_for_default_dacl_.push_back(
  264. std::make_tuple(sid.Clone(), access_mode, access));
  265. return ERROR_SUCCESS;
  266. }
  267. DWORD RestrictedToken::AddDefaultDaclSid(base::win::WellKnownSid known_sid,
  268. SecurityAccessMode access_mode,
  269. ACCESS_MASK access) {
  270. absl::optional<base::win::Sid> sid = base::win::Sid::FromKnownSid(known_sid);
  271. if (!sid)
  272. return ERROR_INVALID_SID;
  273. return AddDefaultDaclSid(*sid, access_mode, access);
  274. }
  275. } // namespace sandbox