sandbox_policy_base.h 9.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_BASE_H_
  5. #define SANDBOX_WIN_SRC_SANDBOX_POLICY_BASE_H_
  6. #include <stddef.h>
  7. #include <stdint.h>
  8. #include <list>
  9. #include <memory>
  10. #include <string>
  11. #include <vector>
  12. #include "base/compiler_specific.h"
  13. #include "base/dcheck_is_on.h"
  14. #include "base/memory/raw_ptr.h"
  15. #include "base/memory/scoped_refptr.h"
  16. #include "base/process/launch.h"
  17. #include "base/strings/string_piece.h"
  18. #include "base/synchronization/lock.h"
  19. #include "base/win/scoped_handle.h"
  20. #include "base/win/windows_types.h"
  21. #include "sandbox/win/src/app_container_base.h"
  22. #include "sandbox/win/src/handle_closer.h"
  23. #include "sandbox/win/src/ipc_tags.h"
  24. #include "sandbox/win/src/job.h"
  25. #include "sandbox/win/src/policy_engine_opcodes.h"
  26. #include "sandbox/win/src/policy_engine_params.h"
  27. #include "sandbox/win/src/sandbox_policy.h"
  28. namespace sandbox {
  29. class BrokerServicesBase;
  30. class Dispatcher;
  31. class LowLevelPolicy;
  32. class PolicyDiagnostic;
  33. class TargetProcess;
  34. struct PolicyGlobal;
  35. // The members of this class are shared between multiple sandbox::PolicyBase
  36. // objects and must be safe for access from multiple threads once created.
  37. // When shared members will not be destroyed until BrokerServicesBase is
  38. // destroyed at process shutdown.
  39. class ConfigBase final : public TargetConfig {
  40. public:
  41. ConfigBase() noexcept;
  42. ~ConfigBase() override;
  43. ConfigBase(const ConfigBase&) = delete;
  44. ConfigBase& operator=(const ConfigBase&) = delete;
  45. bool IsConfigured() const override;
  46. ResultCode AddRule(SubSystem subsystem,
  47. Semantics semantics,
  48. const wchar_t* pattern) override;
  49. ResultCode AddDllToUnload(const wchar_t* dll_name) override;
  50. private:
  51. // Can call Freeze()
  52. friend class BrokerServicesBase;
  53. // Can examine private fields.
  54. friend class PolicyDiagnostic;
  55. // Can call private accessors.
  56. friend class PolicyBase;
  57. // Promise that no further changes will be made to the configuration, and
  58. // this object can be reused by multiple policies.
  59. bool Freeze();
  60. // Use in DCHECK only - returns `true` in non-DCHECK builds.
  61. bool IsOnCreatingThread() const;
  62. #if DCHECK_IS_ON()
  63. // Used to sequence-check in DCHECK builds.
  64. uint32_t creating_thread_id_;
  65. #endif // DCHECK_IS_ON()
  66. // Once true the configuration is frozen and can be applied to later policies.
  67. bool configured_ = false;
  68. ResultCode AddRuleInternal(SubSystem subsystem,
  69. Semantics semantics,
  70. const wchar_t* pattern);
  71. // Should only be called once the object is configured.
  72. PolicyGlobal* policy();
  73. std::vector<std::wstring>& blocklisted_dlls();
  74. // Object in charge of generating the low level policy. Will be reset() when
  75. // Freeze() is called.
  76. std::unique_ptr<LowLevelPolicy> policy_maker_;
  77. // Memory structure that stores the low level policy rules for proxied calls.
  78. raw_ptr<PolicyGlobal> policy_;
  79. // The list of dlls to unload in the target process.
  80. std::vector<std::wstring> blocklisted_dlls_;
  81. };
  82. class PolicyBase final : public TargetPolicy {
  83. public:
  84. PolicyBase(base::StringPiece key);
  85. ~PolicyBase() override;
  86. PolicyBase(const PolicyBase&) = delete;
  87. PolicyBase& operator=(const PolicyBase&) = delete;
  88. // TargetPolicy:
  89. TargetConfig* GetConfig() override;
  90. ResultCode SetTokenLevel(TokenLevel initial, TokenLevel lockdown) override;
  91. TokenLevel GetInitialTokenLevel() const override;
  92. TokenLevel GetLockdownTokenLevel() const override;
  93. ResultCode SetJobLevel(JobLevel job_level, uint32_t ui_exceptions) override;
  94. JobLevel GetJobLevel() const override;
  95. ResultCode SetJobMemoryLimit(size_t memory_limit) override;
  96. ResultCode SetAlternateDesktop(bool alternate_winstation) override;
  97. std::wstring GetAlternateDesktop() const override;
  98. ResultCode CreateAlternateDesktop(bool alternate_winstation) override;
  99. void DestroyAlternateDesktop() override;
  100. ResultCode SetIntegrityLevel(IntegrityLevel integrity_level) override;
  101. IntegrityLevel GetIntegrityLevel() const override;
  102. ResultCode SetDelayedIntegrityLevel(IntegrityLevel integrity_level) override;
  103. ResultCode SetLowBox(const wchar_t* sid) override;
  104. ResultCode SetProcessMitigations(MitigationFlags flags) override;
  105. MitigationFlags GetProcessMitigations() override;
  106. ResultCode SetDelayedProcessMitigations(MitigationFlags flags) override;
  107. MitigationFlags GetDelayedProcessMitigations() const override;
  108. ResultCode SetDisconnectCsrss() override;
  109. void SetStrictInterceptions() override;
  110. ResultCode SetStdoutHandle(HANDLE handle) override;
  111. ResultCode SetStderrHandle(HANDLE handle) override;
  112. ResultCode AddKernelObjectToClose(const wchar_t* handle_type,
  113. const wchar_t* handle_name) override;
  114. void AddHandleToShare(HANDLE handle) override;
  115. void SetLockdownDefaultDacl() override;
  116. void AddRestrictingRandomSid() override;
  117. ResultCode AddAppContainerProfile(const wchar_t* package_name,
  118. bool create_profile) override;
  119. scoped_refptr<AppContainer> GetAppContainer() override;
  120. void SetEffectiveToken(HANDLE token) override;
  121. void SetAllowNoSandboxJob() override;
  122. bool GetAllowNoSandboxJob() override;
  123. // Creates a Job object with the level specified in a previous call to
  124. // SetJobLevel().
  125. ResultCode InitJob();
  126. // Returns the handle for this policy's job, or INVALID_HANDLE_VALUE if the
  127. // job is not initialized.
  128. HANDLE GetJobHandle();
  129. // Returns true if a job is associated with this policy.
  130. bool HasJob();
  131. // Updates the active process limit on the policy's job to zero.
  132. // Has no effect if the job is allowed to spawn processes.
  133. ResultCode DropActiveProcessLimit();
  134. // Creates the two tokens with the levels specified in a previous call to
  135. // SetTokenLevel(). Also creates a lowbox token if specified based on the
  136. // lowbox SID.
  137. ResultCode MakeTokens(base::win::ScopedHandle* initial,
  138. base::win::ScopedHandle* lockdown,
  139. base::win::ScopedHandle* lowbox);
  140. // Applies the sandbox to |target| and takes ownership. Internally a
  141. // call to TargetProcess::Init() is issued.
  142. ResultCode ApplyToTarget(std::unique_ptr<TargetProcess> target);
  143. // Called when there are no more active processes in the policy's Job.
  144. // If a process is not in a job, call OnProcessFinished().
  145. bool OnJobEmpty();
  146. // Called when a process no longer needs to be tracked. Processes in jobs
  147. // should be notified via OnJobEmpty instead.
  148. bool OnProcessFinished(DWORD process_id);
  149. EvalResult EvalPolicy(IpcTag service, CountedParameterSetBase* params);
  150. HANDLE GetStdoutHandle();
  151. HANDLE GetStderrHandle();
  152. // Returns the list of handles being shared with the target process.
  153. const base::HandlesToInheritVector& GetHandlesBeingShared();
  154. private:
  155. // BrokerServicesBase is allowed to set shared backing fields for FixedPolicy.
  156. friend class sandbox::BrokerServicesBase;
  157. // Allow PolicyDiagnostic to snapshot PolicyBase for diagnostics.
  158. friend class PolicyDiagnostic;
  159. // Sets up interceptions for a new target. This policy must own |target|.
  160. ResultCode SetupAllInterceptions(TargetProcess& target);
  161. // Sets up the handle closer for a new target. This policy must own |target|.
  162. bool SetupHandleCloser(TargetProcess& target);
  163. // TargetConfig will really be a ConfigBase.
  164. bool SetConfig(TargetConfig* config);
  165. // Gets possibly shared data or allocates if it did not already exist.
  166. ConfigBase* config();
  167. // Tag provided when this policy was created - mainly for debugging.
  168. std::string tag_;
  169. // Backing data if this object was created with an empty tag_.
  170. std::unique_ptr<ConfigBase> config_;
  171. // Shared backing data if this object will share fields with other policies.
  172. raw_ptr<ConfigBase> config_ptr_;
  173. // Remaining members are unique to this instance and will be configured every
  174. // time.
  175. // The policy takes ownership of a target as it is applied to it.
  176. std::unique_ptr<TargetProcess> target_;
  177. // The user-defined global policy settings.
  178. TokenLevel lockdown_level_;
  179. TokenLevel initial_level_;
  180. JobLevel job_level_;
  181. uint32_t ui_exceptions_;
  182. size_t memory_limit_;
  183. bool use_alternate_desktop_;
  184. bool use_alternate_winstation_;
  185. bool relaxed_interceptions_;
  186. HANDLE stdout_handle_;
  187. HANDLE stderr_handle_;
  188. IntegrityLevel integrity_level_;
  189. IntegrityLevel delayed_integrity_level_;
  190. MitigationFlags mitigations_;
  191. MitigationFlags delayed_mitigations_;
  192. bool is_csrss_connected_;
  193. // This is a map of handle-types to names that we need to close in the
  194. // target process. A null set means we need to close all handles of the
  195. // given type.
  196. HandleCloser handle_closer_;
  197. std::unique_ptr<Dispatcher> dispatcher_;
  198. bool lockdown_default_dacl_;
  199. bool add_restricting_random_sid_;
  200. static HDESK alternate_desktop_handle_;
  201. static HWINSTA alternate_winstation_handle_;
  202. static HDESK alternate_desktop_local_winstation_handle_;
  203. static IntegrityLevel alternate_desktop_integrity_level_label_;
  204. static IntegrityLevel
  205. alternate_desktop_local_winstation_integrity_level_label_;
  206. // Contains the list of handles being shared with the target process.
  207. // This list contains handles other than the stderr/stdout handles which are
  208. // shared with the target at times.
  209. base::HandlesToInheritVector handles_to_share_;
  210. scoped_refptr<AppContainerBase> app_container_;
  211. HANDLE effective_token_;
  212. bool allow_no_sandbox_job_;
  213. Job job_;
  214. };
  215. } // namespace sandbox
  216. #endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_BASE_H_