The Tor Browser / file comparison
comparison: security/sandbox/win/src/filesystem_dispatcher.cc
security/sandbox/win/src/filesystem_dispatcher.cc
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:72021d17b3ba |
|---|---|
| 1 // Copyright (c) 2006-2010 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "sandbox/win/src/filesystem_dispatcher.h" | |
| 6 | |
| 7 #include "sandbox/win/src/crosscall_client.h" | |
| 8 #include "sandbox/win/src/filesystem_interception.h" | |
| 9 #include "sandbox/win/src/filesystem_policy.h" | |
| 10 #include "sandbox/win/src/interception.h" | |
| 11 #include "sandbox/win/src/interceptors.h" | |
| 12 #include "sandbox/win/src/ipc_tags.h" | |
| 13 #include "sandbox/win/src/policy_broker.h" | |
| 14 #include "sandbox/win/src/policy_params.h" | |
| 15 #include "sandbox/win/src/sandbox.h" | |
| 16 #include "sandbox/win/src/sandbox_nt_util.h" | |
| 17 | |
| 18 namespace sandbox { | |
| 19 | |
| 20 FilesystemDispatcher::FilesystemDispatcher(PolicyBase* policy_base) | |
| 21 : policy_base_(policy_base) { | |
| 22 static const IPCCall create_params = { | |
| 23 {IPC_NTCREATEFILE_TAG, WCHAR_TYPE, ULONG_TYPE, ULONG_TYPE, ULONG_TYPE, | |
| 24 ULONG_TYPE, ULONG_TYPE, ULONG_TYPE}, | |
| 25 reinterpret_cast<CallbackGeneric>(&FilesystemDispatcher::NtCreateFile) | |
| 26 }; | |
| 27 | |
| 28 static const IPCCall open_file = { | |
| 29 {IPC_NTOPENFILE_TAG, WCHAR_TYPE, ULONG_TYPE, ULONG_TYPE, ULONG_TYPE, | |
| 30 ULONG_TYPE}, | |
| 31 reinterpret_cast<CallbackGeneric>(&FilesystemDispatcher::NtOpenFile) | |
| 32 }; | |
| 33 | |
| 34 static const IPCCall attribs = { | |
| 35 {IPC_NTQUERYATTRIBUTESFILE_TAG, WCHAR_TYPE, ULONG_TYPE, INOUTPTR_TYPE}, | |
| 36 reinterpret_cast<CallbackGeneric>( | |
| 37 &FilesystemDispatcher::NtQueryAttributesFile) | |
| 38 }; | |
| 39 | |
| 40 static const IPCCall full_attribs = { | |
| 41 {IPC_NTQUERYFULLATTRIBUTESFILE_TAG, WCHAR_TYPE, ULONG_TYPE, INOUTPTR_TYPE}, | |
| 42 reinterpret_cast<CallbackGeneric>( | |
| 43 &FilesystemDispatcher::NtQueryFullAttributesFile) | |
| 44 }; | |
| 45 | |
| 46 static const IPCCall set_info = { | |
| 47 {IPC_NTSETINFO_RENAME_TAG, VOIDPTR_TYPE, INOUTPTR_TYPE, INOUTPTR_TYPE, | |
| 48 ULONG_TYPE, ULONG_TYPE}, | |
| 49 reinterpret_cast<CallbackGeneric>( | |
| 50 &FilesystemDispatcher::NtSetInformationFile) | |
| 51 }; | |
| 52 | |
| 53 ipc_calls_.push_back(create_params); | |
| 54 ipc_calls_.push_back(open_file); | |
| 55 ipc_calls_.push_back(attribs); | |
| 56 ipc_calls_.push_back(full_attribs); | |
| 57 ipc_calls_.push_back(set_info); | |
| 58 } | |
| 59 | |
| 60 bool FilesystemDispatcher::SetupService(InterceptionManager* manager, | |
| 61 int service) { | |
| 62 switch (service) { | |
| 63 case IPC_NTCREATEFILE_TAG: | |
| 64 return INTERCEPT_NT(manager, NtCreateFile, CREATE_FILE_ID, 48); | |
| 65 | |
| 66 case IPC_NTOPENFILE_TAG: | |
| 67 return INTERCEPT_NT(manager, NtOpenFile, OPEN_FILE_ID, 28); | |
| 68 | |
| 69 case IPC_NTQUERYATTRIBUTESFILE_TAG: | |
| 70 return INTERCEPT_NT(manager, NtQueryAttributesFile, QUERY_ATTRIB_FILE_ID, | |
| 71 12); | |
| 72 | |
| 73 case IPC_NTQUERYFULLATTRIBUTESFILE_TAG: | |
| 74 return INTERCEPT_NT(manager, NtQueryFullAttributesFile, | |
| 75 QUERY_FULL_ATTRIB_FILE_ID, 12); | |
| 76 | |
| 77 case IPC_NTSETINFO_RENAME_TAG: | |
| 78 return INTERCEPT_NT(manager, NtSetInformationFile, SET_INFO_FILE_ID, 24); | |
| 79 | |
| 80 default: | |
| 81 return false; | |
| 82 } | |
| 83 } | |
| 84 | |
| 85 bool FilesystemDispatcher::NtCreateFile( | |
| 86 IPCInfo* ipc, std::wstring* name, DWORD attributes, DWORD desired_access, | |
| 87 DWORD file_attributes, DWORD share_access, DWORD create_disposition, | |
| 88 DWORD create_options) { | |
| 89 if (!PreProcessName(*name, name)) { | |
| 90 // The path requested might contain a reparse point. | |
| 91 ipc->return_info.nt_status = STATUS_ACCESS_DENIED; | |
| 92 return true; | |
| 93 } | |
| 94 | |
| 95 const wchar_t* filename = name->c_str(); | |
| 96 | |
| 97 ULONG broker = TRUE; | |
| 98 CountedParameterSet<OpenFile> params; | |
| 99 params[OpenFile::NAME] = ParamPickerMake(filename); | |
| 100 params[OpenFile::ACCESS] = ParamPickerMake(desired_access); | |
| 101 params[OpenFile::OPTIONS] = ParamPickerMake(create_options); | |
| 102 params[OpenFile::BROKER] = ParamPickerMake(broker); | |
| 103 | |
| 104 // To evaluate the policy we need to call back to the policy object. We | |
| 105 // are just middlemen in the operation since is the FileSystemPolicy which | |
| 106 // knows what to do. | |
| 107 EvalResult result = policy_base_->EvalPolicy(IPC_NTCREATEFILE_TAG, | |
| 108 params.GetBase()); | |
| 109 HANDLE handle; | |
| 110 ULONG_PTR io_information = 0; | |
| 111 NTSTATUS nt_status; | |
| 112 if (!FileSystemPolicy::CreateFileAction(result, *ipc->client_info, *name, | |
| 113 attributes, desired_access, | |
| 114 file_attributes, share_access, | |
| 115 create_disposition, create_options, | |
| 116 &handle, &nt_status, | |
| 117 &io_information)) { | |
| 118 ipc->return_info.nt_status = STATUS_ACCESS_DENIED; | |
| 119 return true; | |
| 120 } | |
| 121 // Return operation status on the IPC. | |
| 122 ipc->return_info.extended[0].ulong_ptr = io_information; | |
| 123 ipc->return_info.nt_status = nt_status; | |
| 124 ipc->return_info.handle = handle; | |
| 125 return true; | |
| 126 } | |
| 127 | |
| 128 bool FilesystemDispatcher::NtOpenFile( | |
| 129 IPCInfo* ipc, std::wstring* name, DWORD attributes, DWORD desired_access, | |
| 130 DWORD share_access, DWORD open_options) { | |
| 131 if (!PreProcessName(*name, name)) { | |
| 132 // The path requested might contain a reparse point. | |
| 133 ipc->return_info.nt_status = STATUS_ACCESS_DENIED; | |
| 134 return true; | |
| 135 } | |
| 136 | |
| 137 const wchar_t* filename = name->c_str(); | |
| 138 | |
| 139 ULONG broker = TRUE; | |
| 140 CountedParameterSet<OpenFile> params; | |
| 141 params[OpenFile::NAME] = ParamPickerMake(filename); | |
| 142 params[OpenFile::ACCESS] = ParamPickerMake(desired_access); | |
| 143 params[OpenFile::OPTIONS] = ParamPickerMake(open_options); | |
| 144 params[OpenFile::BROKER] = ParamPickerMake(broker); | |
| 145 | |
| 146 // To evaluate the policy we need to call back to the policy object. We | |
| 147 // are just middlemen in the operation since is the FileSystemPolicy which | |
| 148 // knows what to do. | |
| 149 EvalResult result = policy_base_->EvalPolicy(IPC_NTOPENFILE_TAG, | |
| 150 params.GetBase()); | |
| 151 HANDLE handle; | |
| 152 ULONG_PTR io_information = 0; | |
| 153 NTSTATUS nt_status; | |
| 154 if (!FileSystemPolicy::OpenFileAction(result, *ipc->client_info, *name, | |
| 155 attributes, desired_access, | |
| 156 share_access, open_options, &handle, | |
| 157 &nt_status, &io_information)) { | |
| 158 ipc->return_info.nt_status = STATUS_ACCESS_DENIED; | |
| 159 return true; | |
| 160 } | |
| 161 // Return operation status on the IPC. | |
| 162 ipc->return_info.extended[0].ulong_ptr = io_information; | |
| 163 ipc->return_info.nt_status = nt_status; | |
| 164 ipc->return_info.handle = handle; | |
| 165 return true; | |
| 166 } | |
| 167 | |
| 168 bool FilesystemDispatcher::NtQueryAttributesFile( | |
| 169 IPCInfo* ipc, std::wstring* name, DWORD attributes, CountedBuffer* info) { | |
| 170 if (sizeof(FILE_BASIC_INFORMATION) != info->Size()) | |
| 171 return false; | |
| 172 | |
| 173 if (!PreProcessName(*name, name)) { | |
| 174 // The path requested might contain a reparse point. | |
| 175 ipc->return_info.nt_status = STATUS_ACCESS_DENIED; | |
| 176 return true; | |
| 177 } | |
| 178 | |
| 179 ULONG broker = TRUE; | |
| 180 const wchar_t* filename = name->c_str(); | |
| 181 CountedParameterSet<FileName> params; | |
| 182 params[FileName::NAME] = ParamPickerMake(filename); | |
| 183 params[FileName::BROKER] = ParamPickerMake(broker); | |
| 184 | |
| 185 // To evaluate the policy we need to call back to the policy object. We | |
| 186 // are just middlemen in the operation since is the FileSystemPolicy which | |
| 187 // knows what to do. | |
| 188 EvalResult result = policy_base_->EvalPolicy(IPC_NTQUERYATTRIBUTESFILE_TAG, | |
| 189 params.GetBase()); | |
| 190 | |
| 191 FILE_BASIC_INFORMATION* information = | |
| 192 reinterpret_cast<FILE_BASIC_INFORMATION*>(info->Buffer()); | |
| 193 NTSTATUS nt_status; | |
| 194 if (!FileSystemPolicy::QueryAttributesFileAction(result, *ipc->client_info, | |
| 195 *name, attributes, | |
| 196 information, &nt_status)) { | |
| 197 ipc->return_info.nt_status = STATUS_ACCESS_DENIED; | |
| 198 return true; | |
| 199 } | |
| 200 | |
| 201 // Return operation status on the IPC. | |
| 202 ipc->return_info.nt_status = nt_status; | |
| 203 return true; | |
| 204 } | |
| 205 | |
| 206 bool FilesystemDispatcher::NtQueryFullAttributesFile( | |
| 207 IPCInfo* ipc, std::wstring* name, DWORD attributes, CountedBuffer* info) { | |
| 208 if (sizeof(FILE_NETWORK_OPEN_INFORMATION) != info->Size()) | |
| 209 return false; | |
| 210 | |
| 211 if (!PreProcessName(*name, name)) { | |
| 212 // The path requested might contain a reparse point. | |
| 213 ipc->return_info.nt_status = STATUS_ACCESS_DENIED; | |
| 214 return true; | |
| 215 } | |
| 216 | |
| 217 ULONG broker = TRUE; | |
| 218 const wchar_t* filename = name->c_str(); | |
| 219 CountedParameterSet<FileName> params; | |
| 220 params[FileName::NAME] = ParamPickerMake(filename); | |
| 221 params[FileName::BROKER] = ParamPickerMake(broker); | |
| 222 | |
| 223 // To evaluate the policy we need to call back to the policy object. We | |
| 224 // are just middlemen in the operation since is the FileSystemPolicy which | |
| 225 // knows what to do. | |
| 226 EvalResult result = policy_base_->EvalPolicy( | |
| 227 IPC_NTQUERYFULLATTRIBUTESFILE_TAG, params.GetBase()); | |
| 228 | |
| 229 FILE_NETWORK_OPEN_INFORMATION* information = | |
| 230 reinterpret_cast<FILE_NETWORK_OPEN_INFORMATION*>(info->Buffer()); | |
| 231 NTSTATUS nt_status; | |
| 232 if (!FileSystemPolicy::QueryFullAttributesFileAction(result, | |
| 233 *ipc->client_info, | |
| 234 *name, attributes, | |
| 235 information, | |
| 236 &nt_status)) { | |
| 237 ipc->return_info.nt_status = STATUS_ACCESS_DENIED; | |
| 238 return true; | |
| 239 } | |
| 240 | |
| 241 // Return operation status on the IPC. | |
| 242 ipc->return_info.nt_status = nt_status; | |
| 243 return true; | |
| 244 } | |
| 245 | |
| 246 bool FilesystemDispatcher::NtSetInformationFile( | |
| 247 IPCInfo* ipc, HANDLE handle, CountedBuffer* status, CountedBuffer* info, | |
| 248 DWORD length, DWORD info_class) { | |
| 249 if (sizeof(IO_STATUS_BLOCK) != status->Size()) | |
| 250 return false; | |
| 251 if (length != info->Size()) | |
| 252 return false; | |
| 253 | |
| 254 FILE_RENAME_INFORMATION* rename_info = | |
| 255 reinterpret_cast<FILE_RENAME_INFORMATION*>(info->Buffer()); | |
| 256 | |
| 257 if (!IsSupportedRenameCall(rename_info, length, info_class)) | |
| 258 return false; | |
| 259 | |
| 260 std::wstring name; | |
| 261 name.assign(rename_info->FileName, rename_info->FileNameLength / | |
| 262 sizeof(rename_info->FileName[0])); | |
| 263 if (!PreProcessName(name, &name)) { | |
| 264 // The path requested might contain a reparse point. | |
| 265 ipc->return_info.nt_status = STATUS_ACCESS_DENIED; | |
| 266 return true; | |
| 267 } | |
| 268 | |
| 269 ULONG broker = TRUE; | |
| 270 const wchar_t* filename = name.c_str(); | |
| 271 CountedParameterSet<FileName> params; | |
| 272 params[FileName::NAME] = ParamPickerMake(filename); | |
| 273 params[FileName::BROKER] = ParamPickerMake(broker); | |
| 274 | |
| 275 // To evaluate the policy we need to call back to the policy object. We | |
| 276 // are just middlemen in the operation since is the FileSystemPolicy which | |
| 277 // knows what to do. | |
| 278 EvalResult result = policy_base_->EvalPolicy(IPC_NTSETINFO_RENAME_TAG, | |
| 279 params.GetBase()); | |
| 280 | |
| 281 IO_STATUS_BLOCK* io_status = | |
| 282 reinterpret_cast<IO_STATUS_BLOCK*>(status->Buffer()); | |
| 283 NTSTATUS nt_status; | |
| 284 if (!FileSystemPolicy::SetInformationFileAction(result, *ipc->client_info, | |
| 285 handle, rename_info, length, | |
| 286 info_class, io_status, | |
| 287 &nt_status)) { | |
| 288 ipc->return_info.nt_status = STATUS_ACCESS_DENIED; | |
| 289 return true; | |
| 290 } | |
| 291 | |
| 292 // Return operation status on the IPC. | |
| 293 ipc->return_info.nt_status = nt_status; | |
| 294 return true; | |
| 295 } | |
| 296 | |
| 297 } // namespace sandbox |
