michael@0: // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
michael@0: // Use of this source code is governed by a BSD-style license that can be
michael@0: // found in the LICENSE file.
michael@0: 
michael@0: #include "sandbox/win/src/registry_interception.h"
michael@0: 
michael@0: #include "sandbox/win/src/crosscall_client.h"
michael@0: #include "sandbox/win/src/ipc_tags.h"
michael@0: #include "sandbox/win/src/sandbox_factory.h"
michael@0: #include "sandbox/win/src/sandbox_nt_util.h"
michael@0: #include "sandbox/win/src/sharedmem_ipc_client.h"
michael@0: #include "sandbox/win/src/target_services.h"
michael@0: 
michael@0: namespace sandbox {
michael@0: 
michael@0: NTSTATUS WINAPI TargetNtCreateKey(NtCreateKeyFunction orig_CreateKey,
michael@0:                                   PHANDLE key, ACCESS_MASK desired_access,
michael@0:                                   POBJECT_ATTRIBUTES object_attributes,
michael@0:                                   ULONG title_index, PUNICODE_STRING class_name,
michael@0:                                   ULONG create_options, PULONG disposition) {
michael@0:   // Check if the process can create it first.
michael@0:   NTSTATUS status = orig_CreateKey(key, desired_access, object_attributes,
michael@0:                                    title_index, class_name, create_options,
michael@0:                                    disposition);
michael@0:   if (NT_SUCCESS(status))
michael@0:     return status;
michael@0: 
michael@0:   // We don't trust that the IPC can work this early.
michael@0:   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
michael@0:     return status;
michael@0: 
michael@0:   do {
michael@0:     if (!ValidParameter(key, sizeof(HANDLE), WRITE))
michael@0:       break;
michael@0: 
michael@0:     if (disposition && !ValidParameter(disposition, sizeof(ULONG), WRITE))
michael@0:       break;
michael@0: 
michael@0:     // At this point we don't support class_name.
michael@0:     if (class_name && class_name->Buffer && class_name->Length)
michael@0:       break;
michael@0: 
michael@0:     // We don't support creating link keys, volatile keys and backup/restore.
michael@0:     if (create_options)
michael@0:       break;
michael@0: 
michael@0:     void* memory = GetGlobalIPCMemory();
michael@0:     if (NULL == memory)
michael@0:       break;
michael@0: 
michael@0:     wchar_t* name;
michael@0:     uint32 attributes = 0;
michael@0:     HANDLE root_directory = 0;
michael@0:     NTSTATUS ret = AllocAndCopyName(object_attributes, &name, &attributes,
michael@0:                                     &root_directory);
michael@0:     if (!NT_SUCCESS(ret) || NULL == name)
michael@0:       break;
michael@0: 
michael@0:     SharedMemIPCClient ipc(memory);
michael@0:     CrossCallReturn answer = {0};
michael@0: 
michael@0:     ResultCode code = CrossCall(ipc, IPC_NTCREATEKEY_TAG, name, attributes,
michael@0:                                 root_directory, desired_access, title_index,
michael@0:                                 create_options, &answer);
michael@0: 
michael@0:     operator delete(name, NT_ALLOC);
michael@0: 
michael@0:     if (SBOX_ALL_OK != code)
michael@0:       break;
michael@0: 
michael@0:     if (!NT_SUCCESS(answer.nt_status))
michael@0:         // TODO(nsylvain): We should return answer.nt_status here instead
michael@0:         // of status. We can do this only after we checked the policy.
michael@0:         // otherwise we will returns ACCESS_DENIED for all paths
michael@0:         // that are not specified by a policy, even though your token allows
michael@0:         // access to that path, and the original call had a more meaningful
michael@0:         // error. Bug 4369
michael@0:         break;
michael@0: 
michael@0:     __try {
michael@0:       *key = answer.handle;
michael@0: 
michael@0:       if (disposition)
michael@0:        *disposition = answer.extended[0].unsigned_int;
michael@0: 
michael@0:       status = answer.nt_status;
michael@0:     } __except(EXCEPTION_EXECUTE_HANDLER) {
michael@0:       break;
michael@0:     }
michael@0:   } while (false);
michael@0: 
michael@0:   return status;
michael@0: }
michael@0: 
michael@0: NTSTATUS WINAPI CommonNtOpenKey(NTSTATUS status, PHANDLE key,
michael@0:                                 ACCESS_MASK desired_access,
michael@0:                                 POBJECT_ATTRIBUTES object_attributes) {
michael@0:   // We don't trust that the IPC can work this early.
michael@0:   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
michael@0:     return status;
michael@0: 
michael@0:   do {
michael@0:     if (!ValidParameter(key, sizeof(HANDLE), WRITE))
michael@0:       break;
michael@0: 
michael@0:     void* memory = GetGlobalIPCMemory();
michael@0:     if (NULL == memory)
michael@0:       break;
michael@0: 
michael@0:     wchar_t* name;
michael@0:     uint32 attributes;
michael@0:     HANDLE root_directory;
michael@0:     NTSTATUS ret = AllocAndCopyName(object_attributes, &name, &attributes,
michael@0:                                     &root_directory);
michael@0:     if (!NT_SUCCESS(ret) || NULL == name)
michael@0:       break;
michael@0: 
michael@0:     SharedMemIPCClient ipc(memory);
michael@0:     CrossCallReturn answer = {0};
michael@0:     ResultCode code = CrossCall(ipc, IPC_NTOPENKEY_TAG, name, attributes,
michael@0:                                 root_directory, desired_access, &answer);
michael@0: 
michael@0:     operator delete(name, NT_ALLOC);
michael@0: 
michael@0:     if (SBOX_ALL_OK != code)
michael@0:       break;
michael@0: 
michael@0:     if (!NT_SUCCESS(answer.nt_status))
michael@0:         // TODO(nsylvain): We should return answer.nt_status here instead
michael@0:         // of status. We can do this only after we checked the policy.
michael@0:         // otherwise we will returns ACCESS_DENIED for all paths
michael@0:         // that are not specified by a policy, even though your token allows
michael@0:         // access to that path, and the original call had a more meaningful
michael@0:         // error. Bug 4369
michael@0:         break;
michael@0: 
michael@0:     __try {
michael@0:       *key = answer.handle;
michael@0:       status = answer.nt_status;
michael@0:     } __except(EXCEPTION_EXECUTE_HANDLER) {
michael@0:       break;
michael@0:     }
michael@0:   } while (false);
michael@0: 
michael@0:   return status;
michael@0: }
michael@0: 
michael@0: NTSTATUS WINAPI TargetNtOpenKey(NtOpenKeyFunction orig_OpenKey, PHANDLE key,
michael@0:                                 ACCESS_MASK desired_access,
michael@0:                                 POBJECT_ATTRIBUTES object_attributes) {
michael@0:   // Check if the process can open it first.
michael@0:   NTSTATUS status = orig_OpenKey(key, desired_access, object_attributes);
michael@0:   if (NT_SUCCESS(status))
michael@0:     return status;
michael@0: 
michael@0:   return CommonNtOpenKey(status, key, desired_access, object_attributes);
michael@0: }
michael@0: 
michael@0: NTSTATUS WINAPI TargetNtOpenKeyEx(NtOpenKeyExFunction orig_OpenKeyEx,
michael@0:                                   PHANDLE key, ACCESS_MASK desired_access,
michael@0:                                   POBJECT_ATTRIBUTES object_attributes,
michael@0:                                   ULONG open_options) {
michael@0:   // Check if the process can open it first.
michael@0:   NTSTATUS status = orig_OpenKeyEx(key, desired_access, object_attributes,
michael@0:                                    open_options);
michael@0: 
michael@0:   // We do not support open_options at this time. The 2 current known values
michael@0:   // are REG_OPTION_CREATE_LINK, to open a symbolic link, and
michael@0:   // REG_OPTION_BACKUP_RESTORE to open the key with special privileges.
michael@0:   if (NT_SUCCESS(status) || open_options != 0)
michael@0:     return status;
michael@0: 
michael@0:   return CommonNtOpenKey(status, key, desired_access, object_attributes);
michael@0: }
michael@0: 
michael@0: }  // namespace sandbox