michael@0: // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
michael@0: // Use of this source code is governed by a BSD-style license that can be
michael@0: // found in the LICENSE file.
michael@0: 
michael@0: #include "sandbox/win/src/policy_target.h"
michael@0: 
michael@0: #include "sandbox/win/src/crosscall_client.h"
michael@0: #include "sandbox/win/src/ipc_tags.h"
michael@0: #include "sandbox/win/src/policy_engine_processor.h"
michael@0: #include "sandbox/win/src/policy_low_level.h"
michael@0: #include "sandbox/win/src/policy_params.h"
michael@0: #include "sandbox/win/src/sandbox_factory.h"
michael@0: #include "sandbox/win/src/sandbox_nt_util.h"
michael@0: #include "sandbox/win/src/sharedmem_ipc_client.h"
michael@0: #include "sandbox/win/src/target_services.h"
michael@0: 
michael@0: namespace sandbox {
michael@0: 
michael@0: // Handle for our private heap.
michael@0: extern void* g_heap;
michael@0: 
michael@0: // This is the list of all imported symbols from ntdll.dll.
michael@0: SANDBOX_INTERCEPT NtExports g_nt;
michael@0: 
michael@0: // Policy data.
michael@0: extern void* volatile     g_shared_policy_memory;
michael@0: SANDBOX_INTERCEPT size_t  g_shared_policy_size;
michael@0: 
michael@0: bool QueryBroker(int ipc_id, CountedParameterSetBase* params) {
michael@0:   DCHECK_NT(static_cast<size_t>(ipc_id) < kMaxServiceCount);
michael@0:   DCHECK_NT(g_shared_policy_memory);
michael@0:   DCHECK_NT(g_shared_policy_size > 0);
michael@0: 
michael@0:   if (static_cast<size_t>(ipc_id) >= kMaxServiceCount)
michael@0:     return false;
michael@0: 
michael@0:   PolicyGlobal* global_policy =
michael@0:       reinterpret_cast<PolicyGlobal*>(g_shared_policy_memory);
michael@0: 
michael@0:   if (!global_policy->entry[ipc_id])
michael@0:     return false;
michael@0: 
michael@0:   PolicyBuffer* policy = reinterpret_cast<PolicyBuffer*>(
michael@0:       reinterpret_cast<char*>(g_shared_policy_memory) +
michael@0:       reinterpret_cast<size_t>(global_policy->entry[ipc_id]));
michael@0: 
michael@0:   if ((reinterpret_cast<size_t>(global_policy->entry[ipc_id]) >
michael@0:        global_policy->data_size) ||
michael@0:       (g_shared_policy_size < global_policy->data_size)) {
michael@0:     NOTREACHED_NT();
michael@0:     return false;
michael@0:   }
michael@0: 
michael@0:   for (int i = 0; i < params->count; i++) {
michael@0:     if (!params->parameters[i].IsValid()) {
michael@0:       NOTREACHED_NT();
michael@0:       return false;
michael@0:     }
michael@0:   }
michael@0: 
michael@0:   PolicyProcessor processor(policy);
michael@0:   PolicyResult result = processor.Evaluate(kShortEval, params->parameters,
michael@0:                                            params->count);
michael@0:   DCHECK_NT(POLICY_ERROR != result);
michael@0: 
michael@0:   return POLICY_MATCH == result && ASK_BROKER == processor.GetAction();
michael@0: }
michael@0: 
michael@0: // -----------------------------------------------------------------------
michael@0: 
michael@0: // Hooks NtSetInformationThread to block RevertToSelf from being
michael@0: // called before the actual call to LowerToken.
michael@0: NTSTATUS WINAPI TargetNtSetInformationThread(
michael@0:     NtSetInformationThreadFunction orig_SetInformationThread, HANDLE thread,
michael@0:     NT_THREAD_INFORMATION_CLASS thread_info_class, PVOID thread_information,
michael@0:     ULONG thread_information_bytes) {
michael@0:   do {
michael@0:     if (SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf())
michael@0:       break;
michael@0:     if (ThreadImpersonationToken != thread_info_class)
michael@0:       break;
michael@0:     if (!thread_information)
michael@0:       break;
michael@0:     HANDLE token;
michael@0:     if (sizeof(token) > thread_information_bytes)
michael@0:       break;
michael@0: 
michael@0:     NTSTATUS ret = CopyData(&token, thread_information, sizeof(token));
michael@0:     if (!NT_SUCCESS(ret) || NULL != token)
michael@0:       break;
michael@0: 
michael@0:     // This is a revert to self.
michael@0:     return STATUS_SUCCESS;
michael@0:   } while (false);
michael@0: 
michael@0:   return orig_SetInformationThread(thread, thread_info_class,
michael@0:                                    thread_information,
michael@0:                                    thread_information_bytes);
michael@0: }
michael@0: 
michael@0: // Hooks NtOpenThreadToken to force the open_as_self parameter to be set to
michael@0: // FALSE if we are still running with the impersonation token. open_as_self set
michael@0: // to TRUE means that the token will be open using the process token instead of
michael@0: // the impersonation token. This is bad because the process token does not have
michael@0: // access to open the thread token.
michael@0: NTSTATUS WINAPI TargetNtOpenThreadToken(
michael@0:     NtOpenThreadTokenFunction orig_OpenThreadToken, HANDLE thread,
michael@0:     ACCESS_MASK desired_access, BOOLEAN open_as_self, PHANDLE token) {
michael@0:   if (!SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf())
michael@0:     open_as_self = FALSE;
michael@0: 
michael@0:   return orig_OpenThreadToken(thread, desired_access, open_as_self, token);
michael@0: }
michael@0: 
michael@0: // See comment for TargetNtOpenThreadToken
michael@0: NTSTATUS WINAPI TargetNtOpenThreadTokenEx(
michael@0:     NtOpenThreadTokenExFunction orig_OpenThreadTokenEx, HANDLE thread,
michael@0:     ACCESS_MASK desired_access, BOOLEAN open_as_self, ULONG handle_attributes,
michael@0:     PHANDLE token) {
michael@0:   if (!SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf())
michael@0:     open_as_self = FALSE;
michael@0: 
michael@0:   return orig_OpenThreadTokenEx(thread, desired_access, open_as_self,
michael@0:                                 handle_attributes, token);
michael@0: }
michael@0: 
michael@0: }  // namespace sandbox