restricted_token_utils.h 5.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108
  1. // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_WIN_SRC_RESTRICTED_TOKEN_UTILS_H_
  5. #define SANDBOX_WIN_SRC_RESTRICTED_TOKEN_UTILS_H_
  6. #include "base/win/scoped_handle.h"
  7. #include "base/win/sid.h"
  8. #include "base/win/windows_types.h"
  9. #include "sandbox/win/src/restricted_token.h"
  10. #include "sandbox/win/src/security_level.h"
  11. #include "third_party/abseil-cpp/absl/types/optional.h"
  12. // Contains the utility functions to be able to create restricted tokens based
  13. // on a security profiles.
  14. namespace sandbox {
  15. // The type of the token returned by the CreateRestrictedToken and
  16. // CreateLowBoxToken APIs.
  17. enum TokenType { IMPERSONATION = 0, PRIMARY };
  18. // Creates a restricted token from effective token. If it's nullptr then
  19. // effective token of process is used instead. The parameter security_level
  20. // determines how much the token isrestricted. The token_type determines if
  21. // the token will be used as a primarytoken or impersonation token. The
  22. // integrity level of the token is set to |integrity level|.
  23. // |token| is the output value containing the handle of the newly created
  24. // restricted token.
  25. // |lockdown_default_dacl| indicates the token's default DACL should be locked
  26. // down to restrict what other process can open kernel resources created while
  27. // running under the token.
  28. // |unique_restricted_sid| indicates an optional restricted SID to add to the
  29. // token's restricted SID list defined by |security_level|. This allows a
  30. // sandbox process to be grant access to itself and its resources but not
  31. // other sandboxed processes at the same security level.
  32. // If the function succeeds, the return value is ERROR_SUCCESS. If the
  33. // function fails, the return value is the win32 error code corresponding to
  34. // the error.
  35. DWORD CreateRestrictedToken(
  36. HANDLE effective_token,
  37. TokenLevel security_level,
  38. IntegrityLevel integrity_level,
  39. TokenType token_type,
  40. bool lockdown_default_dacl,
  41. const absl::optional<base::win::Sid>& unique_restricted_sid,
  42. base::win::ScopedHandle* token);
  43. // Sets the integrity level on a token. If the integrity level that you specify
  44. // is greater than the current integrity level, the function will fail.
  45. // |token| must be a token handle with TOKEN_ADJUST_DEFAULTS access.
  46. // If the function succeeds, the return value is ERROR_SUCCESS. If the
  47. // function fails, the return value is the win32 error code corresponding to
  48. // the error.
  49. DWORD SetTokenIntegrityLevel(HANDLE token, IntegrityLevel integrity_level);
  50. // Sets the integrity level on the current process token. If the integrity level
  51. // that you specify is greater than the current integrity level, the function
  52. // will fail.
  53. // If the function succeeds, the return value is ERROR_SUCCESS. If the
  54. // function fails, the return value is the win32 error code corresponding to
  55. // the error.
  56. DWORD SetProcessIntegrityLevel(IntegrityLevel integrity_level);
  57. // Hardens the integrity level policy on a token. Specifically it sets the
  58. // policy to block read and execute so that a lower privileged process cannot
  59. // open the token for impersonate or duplicate permissions. This should limit
  60. // potential security holes.
  61. // |token| must be a token handle with READ_CONTROL and WRITE_OWNER access.
  62. // If the function succeeds, the return value is ERROR_SUCCESS. If the
  63. // function fails, the return value is the win32 error code corresponding to
  64. // the error.
  65. DWORD HardenTokenIntegrityLevelPolicy(HANDLE token);
  66. // Hardens the integrity level policy on the current process. Specifically it
  67. // sets the policy to block read and execute so that a lower privileged process
  68. // cannot open the token for impersonate or duplicate permissions. This should
  69. // limit potential security holes.
  70. // If the function succeeds, the return value is ERROR_SUCCESS. If the
  71. // function fails, the return value is the win32 error code corresponding to
  72. // the error.
  73. DWORD HardenProcessIntegrityLevelPolicy();
  74. // Create a lowbox token. This is not valid prior to Windows 8.
  75. // |base_token| a base token to derive the lowbox token from. Can be nullptr.
  76. // |security_capabilities| list of LowBox capabilities to use when creating the
  77. // token.
  78. // |token| is the output value containing the handle of the newly created
  79. // restricted token.
  80. // |lockdown_default_dacl| indicates the token's default DACL should be locked
  81. // down to restrict what other process can open kernel resources created while
  82. // running under the token.
  83. // If the function succeeds, the return value is ERROR_SUCCESS. If the
  84. // function fails, the return value is the win32 error code corresponding to
  85. // the error.
  86. DWORD CreateLowBoxToken(HANDLE base_token,
  87. TokenType token_type,
  88. SECURITY_CAPABILITIES* security_capabilities,
  89. base::win::ScopedHandle* token);
  90. // Returns true if a low IL token can access the current desktop, false
  91. // otherwise.
  92. bool CanLowIntegrityAccessDesktop();
  93. } // namespace sandbox
  94. #endif // SANDBOX_WIN_SRC_RESTRICTED_TOKEN_UTILS_H_