security/sandbox/win/src/process_thread_policy.h@6474c204b198
security/sandbox/win/src/process_thread_policy.h
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
1 // Copyright (c) 2006-2010 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #ifndef SANDBOX_SRC_PROCESS_THREAD_POLICY_H_
6 #define SANDBOX_SRC_PROCESS_THREAD_POLICY_H_
8 #include <string>
10 #include "sandbox/win/src/policy_low_level.h"
12 #include "base/basictypes.h"
13 #include "sandbox/win/src/crosscall_server.h"
14 #include "sandbox/win/src/sandbox_policy.h"
16 namespace sandbox {
18 enum EvalResult;
20 // This class centralizes most of the knowledge related to process execution.
21 class ProcessPolicy {
22 public:
23 // Creates the required low-level policy rules to evaluate a high-level.
24 // policy rule for process creation
25 // 'name' is the executable to be spawn.
26 // 'semantics' is the desired semantics.
27 // 'policy' is the policy generator to which the rules are going to be added.
28 static bool GenerateRules(const wchar_t* name,
29 TargetPolicy::Semantics semantics,
30 LowLevelPolicy* policy);
32 // Opens a thread from the child process and returns the handle.
33 // client_info contains the information about the child process,
34 // desired_access is the access requested by the child and thread_id
35 // is the thread_id to be opened.
36 // The function returns the return value of NtOpenThread.
37 static NTSTATUS OpenThreadAction(const ClientInfo& client_info,
38 uint32 desired_access,
39 uint32 thread_id,
40 HANDLE* handle);
42 // Opens the process id passed in and returns the duplicated handle to
43 // the child. We only allow the child processes to open themselves. Any other
44 // pid open is denied.
45 static NTSTATUS OpenProcessAction(const ClientInfo& client_info,
46 uint32 desired_access,
47 uint32 process_id,
48 HANDLE* handle);
50 // Opens the token associated with the process and returns the duplicated
51 // handle to the child. We only allow the child processes to open his own
52 // token (using ::GetCurrentProcess()).
53 static NTSTATUS OpenProcessTokenAction(const ClientInfo& client_info,
54 HANDLE process,
55 uint32 desired_access,
56 HANDLE* handle);
58 // Opens the token associated with the process and returns the duplicated
59 // handle to the child. We only allow the child processes to open his own
60 // token (using ::GetCurrentProcess()).
61 static NTSTATUS OpenProcessTokenExAction(const ClientInfo& client_info,
62 HANDLE process,
63 uint32 desired_access,
64 uint32 attributes,
65 HANDLE* handle);
67 // Processes a 'CreateProcessW()' request from the target.
68 // 'client_info' : the target process that is making the request.
69 // 'eval_result' : The desired policy action to accomplish.
70 // 'app_name' : The full path of the process to be created.
71 // 'command_line' : The command line passed to the created process.
72 static DWORD CreateProcessWAction(EvalResult eval_result,
73 const ClientInfo& client_info,
74 const std::wstring &app_name,
75 const std::wstring &command_line,
76 PROCESS_INFORMATION* process_info);
77 };
79 } // namespace sandbox
82 #endif // SANDBOX_SRC_PROCESS_THREAD_POLICY_H_
