signed_policy.cc 2.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576
  1. // Copyright 2019 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/signed_policy.h"
  5. #include <stdint.h>
  6. #include <string>
  7. #include "sandbox/win/src/ipc_tags.h"
  8. #include "sandbox/win/src/policy_engine_opcodes.h"
  9. #include "sandbox/win/src/policy_params.h"
  10. #include "sandbox/win/src/sandbox_nt_util.h"
  11. #include "sandbox/win/src/sandbox_policy.h"
  12. #include "sandbox/win/src/win_utils.h"
  13. namespace sandbox {
  14. bool SignedPolicy::GenerateRules(const wchar_t* name,
  15. Semantics semantics,
  16. LowLevelPolicy* policy) {
  17. // Only support one semantic.
  18. if (Semantics::kSignedAllowLoad != semantics) {
  19. return false;
  20. }
  21. base::FilePath file_path(name);
  22. std::wstring nt_path_name;
  23. if (!GetNtPathFromWin32Path(file_path.DirName().value().c_str(),
  24. &nt_path_name))
  25. return false;
  26. base::FilePath nt_path(nt_path_name);
  27. std::wstring nt_filename = nt_path.Append(file_path.BaseName()).value();
  28. // Create a rule to ASK_BROKER if name matches.
  29. PolicyRule signed_policy(ASK_BROKER);
  30. if (!signed_policy.AddStringMatch(IF, NameBased::NAME, nt_filename.c_str(),
  31. CASE_INSENSITIVE)) {
  32. return false;
  33. }
  34. if (!policy->AddRule(IpcTag::NTCREATESECTION, &signed_policy)) {
  35. return false;
  36. }
  37. return true;
  38. }
  39. NTSTATUS SignedPolicy::CreateSectionAction(
  40. EvalResult eval_result,
  41. const ClientInfo& client_info,
  42. const base::win::ScopedHandle& local_file_handle,
  43. HANDLE* target_section_handle) {
  44. // The only action supported is ASK_BROKER which means create the requested
  45. // section as specified.
  46. if (ASK_BROKER != eval_result)
  47. return false;
  48. HANDLE local_section_handle = nullptr;
  49. NTSTATUS status = GetNtExports()->CreateSection(
  50. &local_section_handle,
  51. SECTION_QUERY | SECTION_MAP_WRITE | SECTION_MAP_READ |
  52. SECTION_MAP_EXECUTE,
  53. nullptr, 0, PAGE_EXECUTE, SEC_IMAGE, local_file_handle.Get());
  54. if (!local_section_handle)
  55. return status;
  56. // Duplicate section handle back to the target.
  57. if (!::DuplicateHandle(::GetCurrentProcess(), local_section_handle,
  58. client_info.process, target_section_handle, 0, false,
  59. DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) {
  60. return STATUS_ACCESS_DENIED;
  61. }
  62. return status;
  63. }
  64. } // namespace sandbox