The Tor Browser / file comparison

comparison: security/sandbox/win/src/file_policy_test.cc

security/sandbox/win/src/file_policy_test.cc

changeset 0
6474c204b198
equal deleted inserted replaced
-1:000000000000 0:692e92a9bca6
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <algorithm>
6 #include <cctype>
7
8 #include <windows.h>
9 #include <winioctl.h>
10
11 #include "base/win/scoped_handle.h"
12 #include "sandbox/win/src/nt_internals.h"
13 #include "sandbox/win/src/sandbox.h"
14 #include "sandbox/win/src/sandbox_factory.h"
15 #include "sandbox/win/src/sandbox_policy.h"
16 #include "sandbox/win/src/win_utils.h"
17 #include "sandbox/win/tests/common/controller.h"
18 #include "sandbox/win/tests/common/test_utils.h"
19 #include "testing/gtest/include/gtest/gtest.h"
20
21 #define BINDNTDLL(name) \
22 name ## Function name = reinterpret_cast<name ## Function>( \
23 ::GetProcAddress(::GetModuleHandle(L"ntdll.dll"), #name))
24
25 namespace sandbox {
26
27 const ULONG kSharing = FILE_SHARE_WRITE | FILE_SHARE_READ | FILE_SHARE_DELETE;
28
29 // Creates a file using different desired access. Returns if the call succeeded
30 // or not. The first argument in argv is the filename. If the second argument
31 // is "read", we try read only access. Otherwise we try read-write access.
32 SBOX_TESTS_COMMAND int File_Create(int argc, wchar_t **argv) {
33 if (argc != 2)
34 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
35
36 bool read = (_wcsicmp(argv[0], L"Read") == 0);
37
38 if (read) {
39 base::win::ScopedHandle file1(CreateFile(
40 argv[1], GENERIC_READ, kSharing, NULL, OPEN_EXISTING, 0, NULL));
41 base::win::ScopedHandle file2(CreateFile(
42 argv[1], FILE_EXECUTE, kSharing, NULL, OPEN_EXISTING, 0, NULL));
43
44 if (file1.Get() && file2.Get())
45 return SBOX_TEST_SUCCEEDED;
46 return SBOX_TEST_DENIED;
47 } else {
48 base::win::ScopedHandle file1(CreateFile(
49 argv[1], GENERIC_ALL, kSharing, NULL, OPEN_EXISTING, 0, NULL));
50 base::win::ScopedHandle file2(CreateFile(
51 argv[1], GENERIC_READ | FILE_WRITE_DATA, kSharing, NULL, OPEN_EXISTING,
52 0, NULL));
53
54 if (file1.Get() && file2.Get())
55 return SBOX_TEST_SUCCEEDED;
56 return SBOX_TEST_DENIED;
57 }
58 }
59
60 SBOX_TESTS_COMMAND int File_Win32Create(int argc, wchar_t **argv) {
61 if (argc != 1) {
62 SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
63 }
64
65 std::wstring full_path = MakePathToSys(argv[0], false);
66 if (full_path.empty()) {
67 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
68 }
69
70 HANDLE file = ::CreateFileW(full_path.c_str(), GENERIC_READ, kSharing,
71 NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
72
73 if (INVALID_HANDLE_VALUE != file) {
74 ::CloseHandle(file);
75 return SBOX_TEST_SUCCEEDED;
76 } else {
77 if (ERROR_ACCESS_DENIED == ::GetLastError()) {
78 return SBOX_TEST_DENIED;
79 } else {
80 return SBOX_TEST_FAILED;
81 }
82 }
83 return SBOX_TEST_SUCCEEDED;
84 }
85
86 // Creates the file in parameter using the NtCreateFile api and returns if the
87 // call succeeded or not.
88 SBOX_TESTS_COMMAND int File_CreateSys32(int argc, wchar_t **argv) {
89 BINDNTDLL(NtCreateFile);
90 BINDNTDLL(RtlInitUnicodeString);
91 if (!NtCreateFile || !RtlInitUnicodeString)
92 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
93
94 if (argc != 1)
95 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
96
97 std::wstring file(argv[0]);
98 if (0 != _wcsnicmp(file.c_str(), kNTObjManPrefix, kNTObjManPrefixLen))
99 file = MakePathToSys(argv[0], true);
100
101 UNICODE_STRING object_name;
102 RtlInitUnicodeString(&object_name, file.c_str());
103
104 OBJECT_ATTRIBUTES obj_attributes = {0};
105 InitializeObjectAttributes(&obj_attributes, &object_name,
106 OBJ_CASE_INSENSITIVE, NULL, NULL);
107
108 HANDLE handle;
109 IO_STATUS_BLOCK io_block = {0};
110 NTSTATUS status = NtCreateFile(&handle, FILE_READ_DATA, &obj_attributes,
111 &io_block, NULL, 0, kSharing, FILE_OPEN,
112 0, NULL, 0);
113 if (NT_SUCCESS(status)) {
114 ::CloseHandle(handle);
115 return SBOX_TEST_SUCCEEDED;
116 } else if (STATUS_ACCESS_DENIED == status) {
117 return SBOX_TEST_DENIED;
118 } else if (STATUS_OBJECT_NAME_NOT_FOUND == status) {
119 return SBOX_TEST_NOT_FOUND;
120 }
121 return SBOX_TEST_FAILED;
122 }
123
124 // Opens the file in parameter using the NtOpenFile api and returns if the
125 // call succeeded or not.
126 SBOX_TESTS_COMMAND int File_OpenSys32(int argc, wchar_t **argv) {
127 BINDNTDLL(NtOpenFile);
128 BINDNTDLL(RtlInitUnicodeString);
129 if (!NtOpenFile || !RtlInitUnicodeString)
130 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
131
132 if (argc != 1)
133 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
134
135 std::wstring file = MakePathToSys(argv[0], true);
136 UNICODE_STRING object_name;
137 RtlInitUnicodeString(&object_name, file.c_str());
138
139 OBJECT_ATTRIBUTES obj_attributes = {0};
140 InitializeObjectAttributes(&obj_attributes, &object_name,
141 OBJ_CASE_INSENSITIVE, NULL, NULL);
142
143 HANDLE handle;
144 IO_STATUS_BLOCK io_block = {0};
145 NTSTATUS status = NtOpenFile(&handle, FILE_READ_DATA, &obj_attributes,
146 &io_block, kSharing, 0);
147 if (NT_SUCCESS(status)) {
148 ::CloseHandle(handle);
149 return SBOX_TEST_SUCCEEDED;
150 } else if (STATUS_ACCESS_DENIED == status) {
151 return SBOX_TEST_DENIED;
152 } else if (STATUS_OBJECT_NAME_NOT_FOUND == status) {
153 return SBOX_TEST_NOT_FOUND;
154 }
155 return SBOX_TEST_FAILED;
156 }
157
158 SBOX_TESTS_COMMAND int File_GetDiskSpace(int argc, wchar_t **argv) {
159 std::wstring sys_path = MakePathToSys(L"", false);
160 if (sys_path.empty()) {
161 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
162 }
163 ULARGE_INTEGER free_user = {0};
164 ULARGE_INTEGER total = {0};
165 ULARGE_INTEGER free_total = {0};
166 if (::GetDiskFreeSpaceExW(sys_path.c_str(), &free_user, &total,
167 &free_total)) {
168 if ((total.QuadPart != 0) && (free_total.QuadPart !=0)) {
169 return SBOX_TEST_SUCCEEDED;
170 }
171 } else {
172 if (ERROR_ACCESS_DENIED == ::GetLastError()) {
173 return SBOX_TEST_DENIED;
174 } else {
175 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
176 }
177 }
178 return SBOX_TEST_SUCCEEDED;
179 }
180
181 // Move a file using the MoveFileEx api and returns if the call succeeded or
182 // not.
183 SBOX_TESTS_COMMAND int File_Rename(int argc, wchar_t **argv) {
184 if (argc != 2)
185 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
186
187 if (::MoveFileEx(argv[0], argv[1], 0))
188 return SBOX_TEST_SUCCEEDED;
189
190 if (::GetLastError() != ERROR_ACCESS_DENIED)
191 return SBOX_TEST_FAILED;
192
193 return SBOX_TEST_DENIED;
194 }
195
196 // Query the attributes of file in parameter using the NtQueryAttributesFile api
197 // and NtQueryFullAttributesFile and returns if the call succeeded or not. The
198 // second argument in argv is "d" or "f" telling if we expect the attributes to
199 // specify a file or a directory. The expected attribute has to match the real
200 // attributes for the call to be successful.
201 SBOX_TESTS_COMMAND int File_QueryAttributes(int argc, wchar_t **argv) {
202 BINDNTDLL(NtQueryAttributesFile);
203 BINDNTDLL(NtQueryFullAttributesFile);
204 BINDNTDLL(RtlInitUnicodeString);
205 if (!NtQueryAttributesFile || !NtQueryFullAttributesFile ||
206 !RtlInitUnicodeString)
207 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
208
209 if (argc != 2)
210 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND;
211
212 bool expect_directory = (L'd' == argv[1][0]);
213
214 UNICODE_STRING object_name;
215 std::wstring file = MakePathToSys(argv[0], true);
216 RtlInitUnicodeString(&object_name, file.c_str());
217
218 OBJECT_ATTRIBUTES obj_attributes = {0};
219 InitializeObjectAttributes(&obj_attributes, &object_name,
220 OBJ_CASE_INSENSITIVE, NULL, NULL);
221
222 FILE_BASIC_INFORMATION info = {0};
223 FILE_NETWORK_OPEN_INFORMATION full_info = {0};
224 NTSTATUS status1 = NtQueryAttributesFile(&obj_attributes, &info);
225 NTSTATUS status2 = NtQueryFullAttributesFile(&obj_attributes, &full_info);
226
227 if (status1 != status2)
228 return SBOX_TEST_FAILED;
229
230 if (NT_SUCCESS(status1)) {
231 if (info.FileAttributes != full_info.FileAttributes)
232 return SBOX_TEST_FAILED;
233
234 bool is_directory1 = (info.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0;
235 if (expect_directory == is_directory1)
236 return SBOX_TEST_SUCCEEDED;
237 } else if (STATUS_ACCESS_DENIED == status1) {
238 return SBOX_TEST_DENIED;
239 } else if (STATUS_OBJECT_NAME_NOT_FOUND == status1) {
240 return SBOX_TEST_NOT_FOUND;
241 }
242
243 return SBOX_TEST_FAILED;
244 }
245
246 TEST(FilePolicyTest, DenyNtCreateCalc) {
247 TestRunner runner;
248 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_DIR_ANY,
249 L"calc.exe"));
250
251 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_CreateSys32 calc.exe"));
252
253 runner.SetTestState(BEFORE_REVERT);
254 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_CreateSys32 calc.exe"));
255 }
256
257 TEST(FilePolicyTest, AllowNtCreateCalc) {
258 TestRunner runner;
259 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, L"calc.exe"));
260
261 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_CreateSys32 calc.exe"));
262
263 runner.SetTestState(BEFORE_REVERT);
264 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_CreateSys32 calc.exe"));
265 }
266
267 TEST(FilePolicyTest, AllowNtCreateWithNativePath) {
268 std::wstring calc = MakePathToSys(L"calc.exe", false);
269 std::wstring nt_path;
270 ASSERT_TRUE(GetNtPathFromWin32Path(calc, &nt_path));
271 TestRunner runner;
272 runner.AddFsRule(TargetPolicy::FILES_ALLOW_READONLY, nt_path.c_str());
273
274 wchar_t buff[MAX_PATH];
275 ::wsprintfW(buff, L"File_CreateSys32 %s", nt_path.c_str());
276 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(buff));
277
278 std::transform(nt_path.begin(), nt_path.end(), nt_path.begin(), std::tolower);
279 ::wsprintfW(buff, L"File_CreateSys32 %s", nt_path.c_str());
280 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(buff));
281 }
282
283 TEST(FilePolicyTest, AllowReadOnly) {
284 TestRunner runner;
285
286 // Create a temp file because we need write access to it.
287 wchar_t temp_directory[MAX_PATH];
288 wchar_t temp_file_name[MAX_PATH];
289 ASSERT_NE(::GetTempPath(MAX_PATH, temp_directory), 0u);
290 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name), 0u);
291
292 EXPECT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_READONLY,
293 temp_file_name));
294
295 wchar_t command_read[MAX_PATH + 20] = {0};
296 wsprintf(command_read, L"File_Create Read \"%ls\"", temp_file_name);
297 wchar_t command_write[MAX_PATH + 20] = {0};
298 wsprintf(command_write, L"File_Create Write \"%ls\"", temp_file_name);
299
300 // Verify that we have read access after revert.
301 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(command_read));
302
303 // Verify that we don't have write access after revert.
304 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command_write));
305
306 // Verify that we really have write access to the file.
307 runner.SetTestState(BEFORE_REVERT);
308 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(command_write));
309
310 DeleteFile(temp_file_name);
311 }
312
313 TEST(FilePolicyTest, AllowWildcard) {
314 TestRunner runner;
315
316 // Create a temp file because we need write access to it.
317 wchar_t temp_directory[MAX_PATH];
318 wchar_t temp_file_name[MAX_PATH];
319 ASSERT_NE(::GetTempPath(MAX_PATH, temp_directory), 0u);
320 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name), 0u);
321
322 wcscat_s(temp_directory, MAX_PATH, L"*");
323 EXPECT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_directory));
324
325 wchar_t command_write[MAX_PATH + 20] = {0};
326 wsprintf(command_write, L"File_Create Write \"%ls\"", temp_file_name);
327
328 // Verify that we have write access after revert.
329 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(command_write));
330
331 DeleteFile(temp_file_name);
332 }
333
334 TEST(FilePolicyTest, AllowNtCreatePatternRule) {
335 TestRunner runner;
336 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, L"App*.dll"));
337
338 EXPECT_EQ(SBOX_TEST_SUCCEEDED,
339 runner.RunTest(L"File_OpenSys32 appmgmts.dll"));
340 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_OpenSys32 appwiz.cpl"));
341
342 runner.SetTestState(BEFORE_REVERT);
343 EXPECT_EQ(SBOX_TEST_SUCCEEDED,
344 runner.RunTest(L"File_OpenSys32 appmgmts.dll"));
345 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_OpenSys32 appwiz.cpl"));
346 }
347
348 TEST(FilePolicyTest, CheckNotFound) {
349 TestRunner runner;
350 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, L"n*.dll"));
351
352 EXPECT_EQ(SBOX_TEST_NOT_FOUND,
353 runner.RunTest(L"File_OpenSys32 notfound.dll"));
354 }
355
356 TEST(FilePolicyTest, CheckNoLeak) {
357 TestRunner runner;
358 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_CreateSys32 notfound.exe"));
359 }
360
361 TEST(FilePolicyTest, TestQueryAttributesFile) {
362 TestRunner runner;
363 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY,
364 L"appmgmts.dll"));
365 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY,
366 L"notfound.exe"));
367 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, L"drivers"));
368 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_QUERY,
369 L"ipconfig.exe"));
370
371 EXPECT_EQ(SBOX_TEST_SUCCEEDED,
372 runner.RunTest(L"File_QueryAttributes drivers d"));
373
374 EXPECT_EQ(SBOX_TEST_SUCCEEDED,
375 runner.RunTest(L"File_QueryAttributes appmgmts.dll f"));
376
377 EXPECT_EQ(SBOX_TEST_SUCCEEDED,
378 runner.RunTest(L"File_QueryAttributes ipconfig.exe f"));
379
380 EXPECT_EQ(SBOX_TEST_DENIED,
381 runner.RunTest(L"File_QueryAttributes ftp.exe f"));
382
383 EXPECT_EQ(SBOX_TEST_NOT_FOUND,
384 runner.RunTest(L"File_QueryAttributes notfound.exe f"));
385 }
386
387 // Makes sure that we don't leak information when there is not policy to allow
388 // a path.
389 TEST(FilePolicyTest, TestQueryAttributesFileNoPolicy) {
390 TestRunner runner;
391 EXPECT_EQ(SBOX_TEST_DENIED,
392 runner.RunTest(L"File_QueryAttributes ftp.exe f"));
393
394 EXPECT_EQ(SBOX_TEST_DENIED,
395 runner.RunTest(L"File_QueryAttributes notfound.exe f"));
396 }
397
398 TEST(FilePolicyTest, TestRename) {
399 TestRunner runner;
400
401 // Give access to the temp directory.
402 wchar_t temp_directory[MAX_PATH];
403 wchar_t temp_file_name1[MAX_PATH];
404 wchar_t temp_file_name2[MAX_PATH];
405 wchar_t temp_file_name3[MAX_PATH];
406 wchar_t temp_file_name4[MAX_PATH];
407 wchar_t temp_file_name5[MAX_PATH];
408 wchar_t temp_file_name6[MAX_PATH];
409 wchar_t temp_file_name7[MAX_PATH];
410 wchar_t temp_file_name8[MAX_PATH];
411 ASSERT_NE(::GetTempPath(MAX_PATH, temp_directory), 0u);
412 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name1), 0u);
413 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name2), 0u);
414 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name3), 0u);
415 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name4), 0u);
416 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name5), 0u);
417 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name6), 0u);
418 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name7), 0u);
419 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name8), 0u);
420
421
422 // Add rules to make file1->file2 succeed.
423 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_file_name1));
424 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_file_name2));
425
426 // Add rules to make file3->file4 fail.
427 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_file_name3));
428 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_READONLY,
429 temp_file_name4));
430
431 // Add rules to make file5->file6 fail.
432 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_READONLY,
433 temp_file_name5));
434 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_file_name6));
435
436 // Add rules to make file7->no_pol_file fail.
437 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_file_name7));
438
439 // Delete the files where the files are going to be renamed to.
440 ::DeleteFile(temp_file_name2);
441 ::DeleteFile(temp_file_name4);
442 ::DeleteFile(temp_file_name6);
443 ::DeleteFile(temp_file_name8);
444
445
446 wchar_t command[MAX_PATH*2 + 20] = {0};
447 wsprintf(command, L"File_Rename \"%ls\" \"%ls\"", temp_file_name1,
448 temp_file_name2);
449 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(command));
450
451 wsprintf(command, L"File_Rename \"%ls\" \"%ls\"", temp_file_name3,
452 temp_file_name4);
453 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command));
454
455 wsprintf(command, L"File_Rename \"%ls\" \"%ls\"", temp_file_name5,
456 temp_file_name6);
457 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command));
458
459 wsprintf(command, L"File_Rename \"%ls\" \"%ls\"", temp_file_name7,
460 temp_file_name8);
461 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command));
462
463
464 // Delete all the files in case they are still there.
465 ::DeleteFile(temp_file_name1);
466 ::DeleteFile(temp_file_name2);
467 ::DeleteFile(temp_file_name3);
468 ::DeleteFile(temp_file_name4);
469 ::DeleteFile(temp_file_name5);
470 ::DeleteFile(temp_file_name6);
471 ::DeleteFile(temp_file_name7);
472 ::DeleteFile(temp_file_name8);
473 }
474
475 TEST(FilePolicyTest, OpenSys32FilesDenyBecauseOfDir) {
476 TestRunner runner;
477 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_DIR_ANY,
478 L"notepad.exe"));
479
480 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_Win32Create notepad.exe"));
481
482 runner.SetTestState(BEFORE_REVERT);
483 EXPECT_EQ(SBOX_TEST_SUCCEEDED,
484 runner.RunTest(L"File_Win32Create notepad.exe"));
485 }
486
487 TEST(FilePolicyTest, OpenSys32FilesAllowNotepad) {
488 TestRunner runner;
489 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY,
490 L"notepad.exe"));
491
492 EXPECT_EQ(SBOX_TEST_SUCCEEDED,
493 runner.RunTest(L"File_Win32Create notepad.exe"));
494
495 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_Win32Create calc.exe"));
496
497 runner.SetTestState(BEFORE_REVERT);
498 EXPECT_EQ(SBOX_TEST_SUCCEEDED,
499 runner.RunTest(L"File_Win32Create notepad.exe"));
500 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_Win32Create calc.exe"));
501 }
502
503 TEST(FilePolicyTest, FileGetDiskSpace) {
504 TestRunner runner;
505 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_GetDiskSpace"));
506 runner.SetTestState(BEFORE_REVERT);
507 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_GetDiskSpace"));
508
509 // Add an 'allow' rule in the windows\system32 such that GetDiskFreeSpaceEx
510 // succeeds (it does an NtOpenFile) but windows\system32\notepad.exe is
511 // denied since there is no wild card in the rule.
512 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_DIR_ANY, L""));
513 runner.SetTestState(BEFORE_REVERT);
514 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_GetDiskSpace"));
515
516 runner.SetTestState(AFTER_REVERT);
517 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_GetDiskSpace"));
518 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_Win32Create notepad.exe"));
519 }
520
521 // http://crbug.com/146944
522 TEST(FilePolicyTest, DISABLED_TestReparsePoint) {
523 TestRunner runner;
524
525 // Create a temp file because we need write access to it.
526 wchar_t temp_directory[MAX_PATH];
527 wchar_t temp_file_name[MAX_PATH];
528 ASSERT_NE(::GetTempPath(MAX_PATH, temp_directory), 0u);
529 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name), 0u);
530
531 // Delete the file and create a directory instead.
532 ASSERT_TRUE(::DeleteFile(temp_file_name));
533 ASSERT_TRUE(::CreateDirectory(temp_file_name, NULL));
534
535 // Create a temporary file in the subfolder.
536 std::wstring subfolder = temp_file_name;
537 std::wstring temp_file_title = subfolder.substr(subfolder.rfind(L"\\") + 1);
538 std::wstring temp_file = subfolder + L"\\file_" + temp_file_title;
539
540 HANDLE file = ::CreateFile(temp_file.c_str(), FILE_ALL_ACCESS,
541 FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
542 CREATE_ALWAYS, 0, NULL);
543 ASSERT_TRUE(INVALID_HANDLE_VALUE != file);
544 ASSERT_TRUE(::CloseHandle(file));
545
546 // Create a temporary file in the temp directory.
547 std::wstring temp_dir = temp_directory;
548 std::wstring temp_file_in_temp = temp_dir + L"file_" + temp_file_title;
549 file = ::CreateFile(temp_file_in_temp.c_str(), FILE_ALL_ACCESS,
550 FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
551 CREATE_ALWAYS, 0, NULL);
552 ASSERT_TRUE(file != NULL);
553 ASSERT_TRUE(::CloseHandle(file));
554
555 // Give write access to the temp directory.
556 std::wstring temp_dir_wildcard = temp_dir + L"*";
557 EXPECT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY,
558 temp_dir_wildcard.c_str()));
559
560 // Prepare the command to execute.
561 std::wstring command_write;
562 command_write += L"File_Create Write \"";
563 command_write += temp_file;
564 command_write += L"\"";
565
566 // Verify that we have write access to the original file
567 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(command_write.c_str()));
568
569 // Replace the subfolder by a reparse point to %temp%.
570 ::DeleteFile(temp_file.c_str());
571 HANDLE dir = ::CreateFile(subfolder.c_str(), FILE_ALL_ACCESS,
572 FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
573 OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
574 EXPECT_TRUE(INVALID_HANDLE_VALUE != dir);
575
576 std::wstring temp_dir_nt;
577 temp_dir_nt += L"\\??\\";
578 temp_dir_nt += temp_dir;
579 EXPECT_TRUE(SetReparsePoint(dir, temp_dir_nt.c_str()));
580 EXPECT_TRUE(::CloseHandle(dir));
581
582 // Try to open the file again.
583 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command_write.c_str()));
584
585 // Remove the reparse point.
586 dir = ::CreateFile(subfolder.c_str(), FILE_ALL_ACCESS,
587 FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
588 FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT,
589 NULL);
590 EXPECT_TRUE(INVALID_HANDLE_VALUE != dir);
591 EXPECT_TRUE(DeleteReparsePoint(dir));
592 EXPECT_TRUE(::CloseHandle(dir));
593
594 // Cleanup.
595 EXPECT_TRUE(::DeleteFile(temp_file_in_temp.c_str()));
596 EXPECT_TRUE(::RemoveDirectory(subfolder.c_str()));
597 }
598
599 } // namespace sandbox

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial