security_level.h 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300
  1. // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_WIN_SRC_SECURITY_LEVEL_H_
  5. #define SANDBOX_WIN_SRC_SECURITY_LEVEL_H_
  6. #include <stdint.h>
  7. namespace sandbox {
  8. // List of all the integrity levels supported in the sandbox.
  9. // The integrity level of the sandboxed process can't be set to a level higher
  10. // than the broker process.
  11. //
  12. // Note: These levels map to SIDs under the hood.
  13. // INTEGRITY_LEVEL_SYSTEM: "S-1-16-16384" System Mandatory Level
  14. // INTEGRITY_LEVEL_HIGH: "S-1-16-12288" High Mandatory Level
  15. // INTEGRITY_LEVEL_MEDIUM: "S-1-16-8192" Medium Mandatory Level
  16. // INTEGRITY_LEVEL_MEDIUM_LOW: "S-1-16-6144"
  17. // INTEGRITY_LEVEL_LOW: "S-1-16-4096" Low Mandatory Level
  18. // INTEGRITY_LEVEL_BELOW_LOW: "S-1-16-2048"
  19. // INTEGRITY_LEVEL_UNTRUSTED: "S-1-16-0" Untrusted Mandatory Level
  20. //
  21. // Not defined: "S-1-16-20480" Protected Process Mandatory Level
  22. // Not defined: "S-1-16-28672" Secure Process Mandatory Level
  23. enum IntegrityLevel {
  24. INTEGRITY_LEVEL_SYSTEM,
  25. INTEGRITY_LEVEL_HIGH,
  26. INTEGRITY_LEVEL_MEDIUM,
  27. INTEGRITY_LEVEL_MEDIUM_LOW,
  28. INTEGRITY_LEVEL_LOW,
  29. INTEGRITY_LEVEL_BELOW_LOW,
  30. INTEGRITY_LEVEL_UNTRUSTED,
  31. INTEGRITY_LEVEL_LAST
  32. };
  33. // The Token level specifies a set of security profiles designed to
  34. // provide the bulk of the security of sandbox.
  35. //
  36. // TokenLevel |Restricting |Deny Only |Privileges|
  37. // |Sids |Sids | |
  38. // ----------------------------|--------------|----------------|----------|
  39. // USER_LOCKDOWN | Null Sid | All | None |
  40. // ----------------------------|--------------|----------------|----------|
  41. // USER_RESTRICTED | RESTRICTED | All | Traverse |
  42. // ----------------------------|--------------|----------------|----------|
  43. // USER_LIMITED | Users | All except: | Traverse |
  44. // | Everyone | Users | |
  45. // | RESTRICTED | Everyone | |
  46. // | | Interactive | |
  47. // ----------------------------|--------------|----------------|----------|
  48. // USER_INTERACTIVE | Users | All except: | Traverse |
  49. // | Everyone | Users | |
  50. // | RESTRICTED | Everyone | |
  51. // | Owner | Interactive | |
  52. // | | Local | |
  53. // | | Authent-users | |
  54. // | | User | |
  55. // ----------------------------|--------------|----------------|----------|
  56. // USER_RESTRICTED_NON_ADMIN | Users | All except: | Traverse |
  57. // | Everyone | Users | |
  58. // | Interactive | Everyone | |
  59. // | Local | Interactive | |
  60. // | Authent-users| Local | |
  61. // | User | Authent-users | |
  62. // | | User | |
  63. // ----------------------------|--------------|----------------|----------|
  64. // USER_RESTRICTED_SAME_ACCESS | All | None | All |
  65. // ----------------------------|--------------|----------------|----------|
  66. // USER_UNPROTECTED | None | None | All |
  67. // ----------------------------|--------------|----------------|----------|
  68. //
  69. // The above restrictions are actually a transformation that is applied to
  70. // the existing broker process token. The resulting token that will be
  71. // applied to the target process depends both on the token level selected
  72. // and on the broker token itself.
  73. //
  74. // The LOCKDOWN and RESTRICTED are designed to allow access to almost
  75. // nothing that has security associated with and they are the recommended
  76. // levels to run sandboxed code specially if there is a chance that the
  77. // broker is process might be started by a user that belongs to the Admins
  78. // or power users groups.
  79. enum TokenLevel {
  80. USER_LOCKDOWN = 0,
  81. USER_RESTRICTED,
  82. USER_LIMITED,
  83. USER_INTERACTIVE,
  84. USER_RESTRICTED_NON_ADMIN,
  85. USER_RESTRICTED_SAME_ACCESS,
  86. USER_UNPROTECTED,
  87. USER_LAST
  88. };
  89. // The Job level specifies a set of decreasing security profiles for the
  90. // Job object that the target process will be placed into.
  91. // This table summarizes the security associated with each level:
  92. //
  93. // JobLevel |General |Quota |
  94. // |restrictions |restrictions |
  95. // -----------------|---------------------------------- |--------------------|
  96. // kNone | No job is assigned to the | None |
  97. // | sandboxed process. | |
  98. // -----------------|---------------------------------- |--------------------|
  99. // kUnprotected | None | *Kill on Job close.|
  100. // -----------------|---------------------------------- |--------------------|
  101. // kInteractive | *Forbid system-wide changes using | |
  102. // | SystemParametersInfo(). | *Kill on Job close.|
  103. // | *Forbid the creation/switch of | |
  104. // | Desktops. | |
  105. // | *Forbids calls to ExitWindows(). | |
  106. // -----------------|---------------------------------- |--------------------|
  107. // kLimitedUser | Same as kInteractive plus: | *One active process|
  108. // | *Forbid changes to the display | limit. |
  109. // | settings. | *Kill on Job close.|
  110. // -----------------|---------------------------------- |--------------------|
  111. // kLockdown | Same as kLimitedUser plus: | *One active process|
  112. // | * No read/write to the clipboard. | limit. |
  113. // | * No access to User Handles that | *Kill on Job close.|
  114. // | belong to other processes. | *Kill on unhandled |
  115. // | * Forbid message broadcasts. | exception. |
  116. // | * Forbid setting global hooks. | |
  117. // | * No access to the global atoms | |
  118. // | table. | |
  119. // -----------------|-----------------------------------|--------------------|
  120. //
  121. // In the context of the above table, 'user handles' refers to the handles of
  122. // windows, bitmaps, menus, etc. Files, treads and registry handles are kernel
  123. // handles and are not affected by the job level settings.
  124. enum class JobLevel {
  125. kLockdown = 0,
  126. kLimitedUser,
  127. kInteractive,
  128. kUnprotected,
  129. kNone
  130. };
  131. // These flags correspond to various process-level mitigations (eg. ASLR and
  132. // DEP). Most are implemented via UpdateProcThreadAttribute() plus flags for
  133. // the PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY attribute argument; documented
  134. // here: http://msdn.microsoft.com/en-us/library/windows/desktop/ms686880
  135. // Some mitigations are implemented directly by the sandbox or emulated to
  136. // the greatest extent possible when not directly supported by the OS.
  137. // Flags that are unsupported for the target OS will be silently ignored.
  138. // Flags that are invalid for their application (pre or post startup) will
  139. // return SBOX_ERROR_BAD_PARAMS.
  140. typedef uint64_t MitigationFlags;
  141. // Permanently enables DEP for the target process. Corresponds to
  142. // PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE.
  143. const MitigationFlags MITIGATION_DEP = 0x00000001;
  144. // Permanently Disables ATL thunk emulation when DEP is enabled. Valid
  145. // only when MITIGATION_DEP is passed. Corresponds to not passing
  146. // PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE.
  147. const MitigationFlags MITIGATION_DEP_NO_ATL_THUNK = 0x00000002;
  148. // Enables Structured exception handling override prevention. Must be
  149. // enabled prior to process start. Corresponds to
  150. // PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE.
  151. const MitigationFlags MITIGATION_SEHOP = 0x00000004;
  152. // Forces ASLR on all images in the child process. In debug builds, must be
  153. // enabled after startup. Corresponds to
  154. // PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON .
  155. const MitigationFlags MITIGATION_RELOCATE_IMAGE = 0x00000008;
  156. // Refuses to load DLLs that cannot support ASLR. In debug builds, must be
  157. // enabled after startup. Corresponds to
  158. // PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON_REQ_RELOCS.
  159. const MitigationFlags MITIGATION_RELOCATE_IMAGE_REQUIRED = 0x00000010;
  160. // Terminates the process on Windows heap corruption. Coresponds to
  161. // PROCESS_CREATION_MITIGATION_POLICY_HEAP_TERMINATE_ALWAYS_ON.
  162. const MitigationFlags MITIGATION_HEAP_TERMINATE = 0x00000020;
  163. // Sets a random lower bound as the minimum user address. Must be
  164. // enabled prior to process start. On 32-bit processes this is
  165. // emulated to a much smaller degree. Corresponds to
  166. // PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON.
  167. const MitigationFlags MITIGATION_BOTTOM_UP_ASLR = 0x00000040;
  168. // Increases the randomness range of bottom-up ASLR to up to 1TB. Must be
  169. // enabled prior to process start and with MITIGATION_BOTTOM_UP_ASLR.
  170. // Corresponds to
  171. // PROCESS_CREATION_MITIGATION_POLICY_HIGH_ENTROPY_ASLR_ALWAYS_ON
  172. const MitigationFlags MITIGATION_HIGH_ENTROPY_ASLR = 0x00000080;
  173. // Immediately raises an exception on a bad handle reference. Must be
  174. // enabled after startup. Corresponds to
  175. // PROCESS_CREATION_MITIGATION_POLICY_STRICT_HANDLE_CHECKS_ALWAYS_ON.
  176. const MitigationFlags MITIGATION_STRICT_HANDLE_CHECKS = 0x00000100;
  177. // Strengthens the DLL search order. See
  178. // http://msdn.microsoft.com/en-us/library/windows/desktop/hh310515. In a
  179. // component build - sets this to LOAD_LIBRARY_SEARCH_DEFAULT_DIRS allowing
  180. // additional directories to be added via Windows AddDllDirectory() function,
  181. // but preserving current load order. In a non-component build, all DLLs should
  182. // be loaded manually, so strenthen to LOAD_LIBRARY_SEARCH_SYSTEM32 |
  183. // LOAD_LIBRARY_SEARCH_USER_DIRS, removing LOAD_LIBRARY_SEARCH_APPLICATION_DIR,
  184. // preventing DLLs being implicitly loaded from the application path. Must be
  185. // enabled after startup.
  186. const MitigationFlags MITIGATION_DLL_SEARCH_ORDER = 0x00000200;
  187. // Changes the mandatory integrity level policy on the current process' token
  188. // to enable no-read and no-execute up. This prevents a lower IL process from
  189. // opening the process token for impersonate/duplicate/assignment.
  190. const MitigationFlags MITIGATION_HARDEN_TOKEN_IL_POLICY = 0x00000400;
  191. // Prevents the process from making Win32k calls. Corresponds to
  192. // PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_ALWAYS_ON.
  193. //
  194. // Applications linked to user32.dll or gdi32.dll make Win32k calls during
  195. // setup, even if Win32k is not otherwise used. So they also need to add a rule
  196. // with SUBSYS_WIN32K_LOCKDOWN and semantics FAKE_USER_GDI_INIT to allow the
  197. // initialization to succeed.
  198. const MitigationFlags MITIGATION_WIN32K_DISABLE = 0x00000800;
  199. // Prevents certain built-in third party extension points from being used.
  200. // - App_Init DLLs
  201. // - Winsock Layered Service Providers (LSPs)
  202. // - Global Windows Hooks (NOT thread-targeted hooks)
  203. // - Legacy Input Method Editors (IMEs)
  204. // I.e.: Disable legacy hooking mechanisms. Corresponds to
  205. // PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON.
  206. const MitigationFlags MITIGATION_EXTENSION_POINT_DISABLE = 0x00001000;
  207. // Prevents the process from generating dynamic code or modifying executable
  208. // code. Second option to allow thread-specific opt-out.
  209. // - VirtualAlloc with PAGE_EXECUTE_*
  210. // - VirtualProtect with PAGE_EXECUTE_*
  211. // - MapViewOfFile with FILE_MAP_EXECUTE | FILE_MAP_WRITE
  212. // - SetProcessValidCallTargets for CFG
  213. // Corresponds to
  214. // PROCESS_CREATION_MITIGATION_POLICY_PROHIBIT_DYNAMIC_CODE_ALWAYS_ON and
  215. // PROCESS_CREATION_MITIGATION_POLICY_PROHIBIT_DYNAMIC_CODE_ALWAYS_ON_ALLOW_OPT_OUT.
  216. const MitigationFlags MITIGATION_DYNAMIC_CODE_DISABLE = 0x00002000;
  217. const MitigationFlags MITIGATION_DYNAMIC_CODE_DISABLE_WITH_OPT_OUT = 0x00004000;
  218. // The following per-thread flag can be used with the
  219. // ApplyMitigationsToCurrentThread API. Requires the above process mitigation
  220. // to be set on the current process.
  221. const MitigationFlags MITIGATION_DYNAMIC_CODE_OPT_OUT_THIS_THREAD = 0x00008000;
  222. // Prevents the process from loading non-system fonts into GDI.
  223. // Corresponds to
  224. // PROCESS_CREATION_MITIGATION_POLICY_FONT_DISABLE_ALWAYS_ON
  225. const MitigationFlags MITIGATION_NONSYSTEM_FONT_DISABLE = 0x00010000;
  226. // Prevents the process from loading binaries NOT signed by MS.
  227. // Corresponds to
  228. // PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON
  229. const MitigationFlags MITIGATION_FORCE_MS_SIGNED_BINS = 0x00020000;
  230. // Blocks mapping of images from remote devices. Corresponds to
  231. // PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_REMOTE_ALWAYS_ON.
  232. const MitigationFlags MITIGATION_IMAGE_LOAD_NO_REMOTE = 0x00040000;
  233. // Blocks mapping of images that have the low manditory label. Corresponds to
  234. // PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_LOW_LABEL_ALWAYS_ON.
  235. const MitigationFlags MITIGATION_IMAGE_LOAD_NO_LOW_LABEL = 0x00080000;
  236. // Forces image load preference to prioritize the Windows install System32
  237. // folder before dll load dir, application dir and any user dirs set.
  238. // - Affects IAT resolution standard search path only, NOT direct LoadLibrary or
  239. // executable search path.
  240. // PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON.
  241. const MitigationFlags MITIGATION_IMAGE_LOAD_PREFER_SYS32 = 0x00100000;
  242. // Prevents hyperthreads from interfering with indirect branch predictions.
  243. // (SPECTRE Variant 2 mitigation.) Corresponds to
  244. // PROCESS_CREATION_MITIGATION_POLICY2_RESTRICT_INDIRECT_BRANCH_PREDICTION_ALWAYS_ON.
  245. const MitigationFlags MITIGATION_RESTRICT_INDIRECT_BRANCH_PREDICTION =
  246. 0x00200000;
  247. // Turns off CET for the process. This allows chrome.exe to
  248. // be turned 'on' using IFEO or through build settings but children we know to
  249. // have issues can be turned off. Corresponds to
  250. // PROCESS_CREATION_MITIGATION_POLICY2_CET_USER_SHADOW_STACKS_ALWAYS_OFF.
  251. const MitigationFlags MITIGATION_CET_DISABLED = 0x00400000;
  252. // Enable KTM component mitigation. When enabled, it locks down all function
  253. // calls to consume the kernel transaction manager.
  254. const MitigationFlags MITIGATION_KTM_COMPONENT = 0x00800000;
  255. // CET in default state (i.e. not disabled where it is supported) and
  256. // CetDynamicApisOutOfProcOnly will be false inside the process. Should not
  257. // be mixed with MITIGATION_CET_DISABLED or MITIGATION_DYNAMIC_CODE_DISABLE
  258. // as it does not make sense without CET, nor where dynamic code cannot be
  259. // created in the first place. Corresponds to
  260. // PROCESS_CREATION_MITIGATION_POLICY2_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY_ALWAYS_OFF.
  261. const MitigationFlags MITIGATION_CET_ALLOW_DYNAMIC_APIS = 0x01000000;
  262. // CET in strict mode. Be cautious if applying to processes that might
  263. // include third party code. Corresponds to
  264. // PROCESS_CREATION_MITIGATION_POLICY2_CET_USER_SHADOW_STACKS_STRICT_MODE.
  265. const MitigationFlags MITIGATION_CET_STRICT_MODE = 0x02000000;
  266. } // namespace sandbox
  267. #endif // SANDBOX_WIN_SRC_SECURITY_LEVEL_H_