The Tor Browser / file comparison

comparison: security/sandbox/win/src/filesystem_policy.cc

security/sandbox/win/src/filesystem_policy.cc

changeset 0
6474c204b198
equal deleted inserted replaced
-1:000000000000 0:488417031e5e
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <string>
6
7 #include "sandbox/win/src/filesystem_policy.h"
8
9 #include "base/logging.h"
10 #include "base/win/scoped_handle.h"
11 #include "sandbox/win/src/ipc_tags.h"
12 #include "sandbox/win/src/policy_engine_opcodes.h"
13 #include "sandbox/win/src/policy_params.h"
14 #include "sandbox/win/src/sandbox_utils.h"
15 #include "sandbox/win/src/sandbox_types.h"
16 #include "sandbox/win/src/win_utils.h"
17
18 namespace {
19
20 NTSTATUS NtCreateFileInTarget(HANDLE* target_file_handle,
21 ACCESS_MASK desired_access,
22 OBJECT_ATTRIBUTES* obj_attributes,
23 IO_STATUS_BLOCK* io_status_block,
24 ULONG file_attributes,
25 ULONG share_access,
26 ULONG create_disposition,
27 ULONG create_options,
28 PVOID ea_buffer,
29 ULONG ea_lenght,
30 HANDLE target_process) {
31 NtCreateFileFunction NtCreateFile = NULL;
32 ResolveNTFunctionPtr("NtCreateFile", &NtCreateFile);
33
34 HANDLE local_handle = INVALID_HANDLE_VALUE;
35 NTSTATUS status = NtCreateFile(&local_handle, desired_access, obj_attributes,
36 io_status_block, NULL, file_attributes,
37 share_access, create_disposition,
38 create_options, ea_buffer, ea_lenght);
39 if (!NT_SUCCESS(status)) {
40 return status;
41 }
42
43 if (!sandbox::SameObject(local_handle, obj_attributes->ObjectName->Buffer)) {
44 // The handle points somewhere else. Fail the operation.
45 ::CloseHandle(local_handle);
46 return STATUS_ACCESS_DENIED;
47 }
48
49 if (!::DuplicateHandle(::GetCurrentProcess(), local_handle,
50 target_process, target_file_handle, 0, FALSE,
51 DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) {
52 return STATUS_ACCESS_DENIED;
53 }
54 return STATUS_SUCCESS;
55 }
56
57 } // namespace.
58
59 namespace sandbox {
60
61 bool FileSystemPolicy::GenerateRules(const wchar_t* name,
62 TargetPolicy::Semantics semantics,
63 LowLevelPolicy* policy) {
64 std::wstring mod_name(name);
65 if (mod_name.empty()) {
66 return false;
67 }
68
69 // Don't do any pre-processing if the name starts like the the native
70 // object manager style.
71 if (0 != _wcsnicmp(mod_name.c_str(), kNTObjManPrefix, kNTObjManPrefixLen)) {
72 // TODO(cpu) bug 32224: This prefix add is a hack because we don't have the
73 // infrastructure to normalize names. In any case we need to escape the
74 // question marks.
75 if (!PreProcessName(mod_name, &mod_name)) {
76 // The path to be added might contain a reparse point.
77 NOTREACHED();
78 return false;
79 }
80 if (0 != mod_name.compare(0, kNTPrefixLen, kNTPrefix)) {
81 // TODO(nsylvain): Find a better way to do name resolution. Right now we
82 // take the name and we expand it.
83 mod_name.insert(0, L"\\/?/?\\");
84 name = mod_name.c_str();
85 }
86 }
87
88 EvalResult result = ASK_BROKER;
89
90 // List of supported calls for the filesystem.
91 const unsigned kCallNtCreateFile = 0x1;
92 const unsigned kCallNtOpenFile = 0x2;
93 const unsigned kCallNtQueryAttributesFile = 0x4;
94 const unsigned kCallNtQueryFullAttributesFile = 0x8;
95 const unsigned kCallNtSetInfoRename = 0x10;
96
97 DWORD rule_to_add = kCallNtOpenFile | kCallNtCreateFile |
98 kCallNtQueryAttributesFile |
99 kCallNtQueryFullAttributesFile | kCallNtSetInfoRename;
100
101 PolicyRule create(result);
102 PolicyRule open(result);
103 PolicyRule query(result);
104 PolicyRule query_full(result);
105 PolicyRule rename(result);
106
107 switch (semantics) {
108 case TargetPolicy::FILES_ALLOW_DIR_ANY: {
109 open.AddNumberMatch(IF, OpenFile::OPTIONS, FILE_DIRECTORY_FILE, AND);
110 create.AddNumberMatch(IF, OpenFile::OPTIONS, FILE_DIRECTORY_FILE, AND);
111 break;
112 }
113 case TargetPolicy::FILES_ALLOW_READONLY: {
114 // We consider all flags that are not known to be readonly as potentially
115 // used for write.
116 DWORD allowed_flags = FILE_READ_DATA | FILE_READ_ATTRIBUTES |
117 FILE_READ_EA | SYNCHRONIZE | FILE_EXECUTE |
118 GENERIC_READ | GENERIC_EXECUTE | READ_CONTROL;
119 DWORD restricted_flags = ~allowed_flags;
120 open.AddNumberMatch(IF_NOT, OpenFile::ACCESS, restricted_flags, AND);
121 create.AddNumberMatch(IF_NOT, OpenFile::ACCESS, restricted_flags, AND);
122
123 // Read only access don't work for rename.
124 rule_to_add &= ~kCallNtSetInfoRename;
125 break;
126 }
127 case TargetPolicy::FILES_ALLOW_QUERY: {
128 // Here we don't want to add policy for the open or the create.
129 rule_to_add &= ~(kCallNtOpenFile | kCallNtCreateFile |
130 kCallNtSetInfoRename);
131 break;
132 }
133 case TargetPolicy::FILES_ALLOW_ANY: {
134 break;
135 }
136 default: {
137 NOTREACHED();
138 return false;
139 }
140 }
141
142 if ((rule_to_add & kCallNtCreateFile) &&
143 (!create.AddStringMatch(IF, OpenFile::NAME, name, CASE_INSENSITIVE) ||
144 !policy->AddRule(IPC_NTCREATEFILE_TAG, &create))) {
145 return false;
146 }
147
148 if ((rule_to_add & kCallNtOpenFile) &&
149 (!open.AddStringMatch(IF, OpenFile::NAME, name, CASE_INSENSITIVE) ||
150 !policy->AddRule(IPC_NTOPENFILE_TAG, &open))) {
151 return false;
152 }
153
154 if ((rule_to_add & kCallNtQueryAttributesFile) &&
155 (!query.AddStringMatch(IF, FileName::NAME, name, CASE_INSENSITIVE) ||
156 !policy->AddRule(IPC_NTQUERYATTRIBUTESFILE_TAG, &query))) {
157 return false;
158 }
159
160 if ((rule_to_add & kCallNtQueryFullAttributesFile) &&
161 (!query_full.AddStringMatch(IF, FileName::NAME, name, CASE_INSENSITIVE)
162 || !policy->AddRule(IPC_NTQUERYFULLATTRIBUTESFILE_TAG,
163 &query_full))) {
164 return false;
165 }
166
167 if ((rule_to_add & kCallNtSetInfoRename) &&
168 (!rename.AddStringMatch(IF, FileName::NAME, name, CASE_INSENSITIVE) ||
169 !policy->AddRule(IPC_NTSETINFO_RENAME_TAG, &rename))) {
170 return false;
171 }
172
173 return true;
174 }
175
176 // Right now we insert two rules, to be evaluated before any user supplied rule:
177 // - go to the broker if the path doesn't look like the paths that we push on
178 // the policy (namely \??\something).
179 // - go to the broker if it looks like this is a short-name path.
180 //
181 // It is possible to add a rule to go to the broker in any case; it would look
182 // something like:
183 // rule = new PolicyRule(ASK_BROKER);
184 // rule->AddNumberMatch(IF_NOT, FileName::BROKER, TRUE, AND);
185 // policy->AddRule(service, rule);
186 bool FileSystemPolicy::SetInitialRules(LowLevelPolicy* policy) {
187 PolicyRule format(ASK_BROKER);
188 PolicyRule short_name(ASK_BROKER);
189
190 bool rv = format.AddNumberMatch(IF_NOT, FileName::BROKER, TRUE, AND);
191 rv &= format.AddStringMatch(IF_NOT, FileName::NAME, L"\\/?/?\\*",
192 CASE_SENSITIVE);
193
194 rv &= short_name.AddNumberMatch(IF_NOT, FileName::BROKER, TRUE, AND);
195 rv &= short_name.AddStringMatch(IF, FileName::NAME, L"*~*", CASE_SENSITIVE);
196
197 if (!rv || !policy->AddRule(IPC_NTCREATEFILE_TAG, &format))
198 return false;
199
200 if (!policy->AddRule(IPC_NTCREATEFILE_TAG, &short_name))
201 return false;
202
203 if (!policy->AddRule(IPC_NTOPENFILE_TAG, &format))
204 return false;
205
206 if (!policy->AddRule(IPC_NTOPENFILE_TAG, &short_name))
207 return false;
208
209 if (!policy->AddRule(IPC_NTQUERYATTRIBUTESFILE_TAG, &format))
210 return false;
211
212 if (!policy->AddRule(IPC_NTQUERYATTRIBUTESFILE_TAG, &short_name))
213 return false;
214
215 if (!policy->AddRule(IPC_NTQUERYFULLATTRIBUTESFILE_TAG, &format))
216 return false;
217
218 if (!policy->AddRule(IPC_NTQUERYFULLATTRIBUTESFILE_TAG, &short_name))
219 return false;
220
221 if (!policy->AddRule(IPC_NTSETINFO_RENAME_TAG, &format))
222 return false;
223
224 if (!policy->AddRule(IPC_NTSETINFO_RENAME_TAG, &short_name))
225 return false;
226
227 return true;
228 }
229
230 bool FileSystemPolicy::CreateFileAction(EvalResult eval_result,
231 const ClientInfo& client_info,
232 const std::wstring &file,
233 uint32 attributes,
234 uint32 desired_access,
235 uint32 file_attributes,
236 uint32 share_access,
237 uint32 create_disposition,
238 uint32 create_options,
239 HANDLE *handle,
240 NTSTATUS* nt_status,
241 ULONG_PTR *io_information) {
242 // The only action supported is ASK_BROKER which means create the requested
243 // file as specified.
244 if (ASK_BROKER != eval_result) {
245 *nt_status = STATUS_ACCESS_DENIED;
246 return false;
247 }
248 IO_STATUS_BLOCK io_block = {0};
249 UNICODE_STRING uni_name = {0};
250 OBJECT_ATTRIBUTES obj_attributes = {0};
251 InitObjectAttribs(file, attributes, NULL, &obj_attributes, &uni_name);
252 *nt_status = NtCreateFileInTarget(handle, desired_access, &obj_attributes,
253 &io_block, file_attributes, share_access,
254 create_disposition, create_options, NULL,
255 0, client_info.process);
256
257 *io_information = io_block.Information;
258 return true;
259 }
260
261 bool FileSystemPolicy::OpenFileAction(EvalResult eval_result,
262 const ClientInfo& client_info,
263 const std::wstring &file,
264 uint32 attributes,
265 uint32 desired_access,
266 uint32 share_access,
267 uint32 open_options,
268 HANDLE *handle,
269 NTSTATUS* nt_status,
270 ULONG_PTR *io_information) {
271 // The only action supported is ASK_BROKER which means open the requested
272 // file as specified.
273 if (ASK_BROKER != eval_result) {
274 *nt_status = STATUS_ACCESS_DENIED;
275 return true;
276 }
277 // An NtOpen is equivalent to an NtCreate with FileAttributes = 0 and
278 // CreateDisposition = FILE_OPEN.
279 IO_STATUS_BLOCK io_block = {0};
280 UNICODE_STRING uni_name = {0};
281 OBJECT_ATTRIBUTES obj_attributes = {0};
282 InitObjectAttribs(file, attributes, NULL, &obj_attributes, &uni_name);
283 *nt_status = NtCreateFileInTarget(handle, desired_access, &obj_attributes,
284 &io_block, 0, share_access, FILE_OPEN,
285 open_options, NULL, 0,
286 client_info.process);
287
288 *io_information = io_block.Information;
289 return true;
290 }
291
292 bool FileSystemPolicy::QueryAttributesFileAction(
293 EvalResult eval_result,
294 const ClientInfo& client_info,
295 const std::wstring &file,
296 uint32 attributes,
297 FILE_BASIC_INFORMATION* file_info,
298 NTSTATUS* nt_status) {
299 // The only action supported is ASK_BROKER which means query the requested
300 // file as specified.
301 if (ASK_BROKER != eval_result) {
302 *nt_status = STATUS_ACCESS_DENIED;
303 return true;
304 }
305
306 NtQueryAttributesFileFunction NtQueryAttributesFile = NULL;
307 ResolveNTFunctionPtr("NtQueryAttributesFile", &NtQueryAttributesFile);
308
309 UNICODE_STRING uni_name = {0};
310 OBJECT_ATTRIBUTES obj_attributes = {0};
311 InitObjectAttribs(file, attributes, NULL, &obj_attributes, &uni_name);
312 *nt_status = NtQueryAttributesFile(&obj_attributes, file_info);
313
314 return true;
315 }
316
317 bool FileSystemPolicy::QueryFullAttributesFileAction(
318 EvalResult eval_result,
319 const ClientInfo& client_info,
320 const std::wstring &file,
321 uint32 attributes,
322 FILE_NETWORK_OPEN_INFORMATION* file_info,
323 NTSTATUS* nt_status) {
324 // The only action supported is ASK_BROKER which means query the requested
325 // file as specified.
326 if (ASK_BROKER != eval_result) {
327 *nt_status = STATUS_ACCESS_DENIED;
328 return true;
329 }
330
331 NtQueryFullAttributesFileFunction NtQueryFullAttributesFile = NULL;
332 ResolveNTFunctionPtr("NtQueryFullAttributesFile", &NtQueryFullAttributesFile);
333
334 UNICODE_STRING uni_name = {0};
335 OBJECT_ATTRIBUTES obj_attributes = {0};
336 InitObjectAttribs(file, attributes, NULL, &obj_attributes, &uni_name);
337 *nt_status = NtQueryFullAttributesFile(&obj_attributes, file_info);
338
339 return true;
340 }
341
342 bool FileSystemPolicy::SetInformationFileAction(
343 EvalResult eval_result, const ClientInfo& client_info,
344 HANDLE target_file_handle, void* file_info, uint32 length,
345 uint32 info_class, IO_STATUS_BLOCK* io_block,
346 NTSTATUS* nt_status) {
347 // The only action supported is ASK_BROKER which means open the requested
348 // file as specified.
349 if (ASK_BROKER != eval_result) {
350 *nt_status = STATUS_ACCESS_DENIED;
351 return true;
352 }
353
354 NtSetInformationFileFunction NtSetInformationFile = NULL;
355 ResolveNTFunctionPtr("NtSetInformationFile", &NtSetInformationFile);
356
357 HANDLE local_handle = NULL;
358 if (!::DuplicateHandle(client_info.process, target_file_handle,
359 ::GetCurrentProcess(), &local_handle, 0, FALSE,
360 DUPLICATE_SAME_ACCESS)) {
361 *nt_status = STATUS_ACCESS_DENIED;
362 return true;
363 }
364
365 base::win::ScopedHandle handle(local_handle);
366
367 FILE_INFORMATION_CLASS file_info_class =
368 static_cast<FILE_INFORMATION_CLASS>(info_class);
369 *nt_status = NtSetInformationFile(local_handle, io_block, file_info, length,
370 file_info_class);
371
372 return true;
373 }
374
375 bool PreProcessName(const std::wstring& path, std::wstring* new_path) {
376 ConvertToLongPath(path, new_path);
377
378 bool reparsed = false;
379 if (ERROR_SUCCESS != IsReparsePoint(*new_path, &reparsed))
380 return false;
381
382 // We can't process reparsed file.
383 return !reparsed;
384 }
385
386 } // namespace sandbox

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial