michael@0: // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
michael@0: // Use of this source code is governed by a BSD-style license that can be
michael@0: // found in the LICENSE file.
michael@0: 
michael@0: #include "sandbox/win/src/filesystem_interception.h"
michael@0: 
michael@0: #include "sandbox/win/src/crosscall_client.h"
michael@0: #include "sandbox/win/src/ipc_tags.h"
michael@0: #include "sandbox/win/src/policy_params.h"
michael@0: #include "sandbox/win/src/policy_target.h"
michael@0: #include "sandbox/win/src/sandbox_factory.h"
michael@0: #include "sandbox/win/src/sandbox_nt_util.h"
michael@0: #include "sandbox/win/src/sharedmem_ipc_client.h"
michael@0: #include "sandbox/win/src/target_services.h"
michael@0: 
michael@0: namespace sandbox {
michael@0: 
michael@0: NTSTATUS WINAPI TargetNtCreateFile(NtCreateFileFunction orig_CreateFile,
michael@0:                                    PHANDLE file, ACCESS_MASK desired_access,
michael@0:                                    POBJECT_ATTRIBUTES object_attributes,
michael@0:                                    PIO_STATUS_BLOCK io_status,
michael@0:                                    PLARGE_INTEGER allocation_size,
michael@0:                                    ULONG file_attributes, ULONG sharing,
michael@0:                                    ULONG disposition, ULONG options,
michael@0:                                    PVOID ea_buffer, ULONG ea_length) {
michael@0:   // Check if the process can open it first.
michael@0:   NTSTATUS status = orig_CreateFile(file, desired_access, object_attributes,
michael@0:                                     io_status, allocation_size,
michael@0:                                     file_attributes, sharing, disposition,
michael@0:                                     options, ea_buffer, ea_length);
michael@0:   if (STATUS_ACCESS_DENIED != status)
michael@0:     return status;
michael@0: 
michael@0:   // We don't trust that the IPC can work this early.
michael@0:   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
michael@0:     return status;
michael@0: 
michael@0:   do {
michael@0:     if (!ValidParameter(file, sizeof(HANDLE), WRITE))
michael@0:       break;
michael@0:     if (!ValidParameter(io_status, sizeof(IO_STATUS_BLOCK), WRITE))
michael@0:       break;
michael@0: 
michael@0:     void* memory = GetGlobalIPCMemory();
michael@0:     if (NULL == memory)
michael@0:       break;
michael@0: 
michael@0:     wchar_t* name;
michael@0:     uint32 attributes = 0;
michael@0:     NTSTATUS ret = AllocAndCopyName(object_attributes, &name, &attributes,
michael@0:                                     NULL);
michael@0:     if (!NT_SUCCESS(ret) || NULL == name)
michael@0:       break;
michael@0: 
michael@0:     ULONG broker = FALSE;
michael@0:     CountedParameterSet<OpenFile> params;
michael@0:     params[OpenFile::NAME] = ParamPickerMake(name);
michael@0:     params[OpenFile::ACCESS] = ParamPickerMake(desired_access);
michael@0:     params[OpenFile::OPTIONS] = ParamPickerMake(options);
michael@0:     params[OpenFile::BROKER] = ParamPickerMake(broker);
michael@0: 
michael@0:     if (!QueryBroker(IPC_NTCREATEFILE_TAG, params.GetBase()))
michael@0:       break;
michael@0: 
michael@0:     SharedMemIPCClient ipc(memory);
michael@0:     CrossCallReturn answer = {0};
michael@0:     // The following call must match in the parameters with
michael@0:     // FilesystemDispatcher::ProcessNtCreateFile.
michael@0:     ResultCode code = CrossCall(ipc, IPC_NTCREATEFILE_TAG, name, attributes,
michael@0:                                 desired_access, file_attributes, sharing,
michael@0:                                 disposition, options, &answer);
michael@0: 
michael@0:     operator delete(name, NT_ALLOC);
michael@0: 
michael@0:     if (SBOX_ALL_OK != code)
michael@0:       break;
michael@0: 
michael@0:     if (!NT_SUCCESS(answer.nt_status))
michael@0:         return answer.nt_status;
michael@0: 
michael@0:     __try {
michael@0:       *file = answer.handle;
michael@0:       io_status->Status = answer.nt_status;
michael@0:       io_status->Information = answer.extended[0].ulong_ptr;
michael@0:       status = io_status->Status;
michael@0:     } __except(EXCEPTION_EXECUTE_HANDLER) {
michael@0:       break;
michael@0:     }
michael@0:   } while (false);
michael@0: 
michael@0:   return status;
michael@0: }
michael@0: 
michael@0: NTSTATUS WINAPI TargetNtOpenFile(NtOpenFileFunction orig_OpenFile, PHANDLE file,
michael@0:                                  ACCESS_MASK desired_access,
michael@0:                                  POBJECT_ATTRIBUTES object_attributes,
michael@0:                                  PIO_STATUS_BLOCK io_status, ULONG sharing,
michael@0:                                  ULONG options) {
michael@0:   // Check if the process can open it first.
michael@0:   NTSTATUS status = orig_OpenFile(file, desired_access, object_attributes,
michael@0:                                   io_status, sharing, options);
michael@0:   if (STATUS_ACCESS_DENIED != status)
michael@0:     return status;
michael@0: 
michael@0:   // We don't trust that the IPC can work this early.
michael@0:   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
michael@0:     return status;
michael@0: 
michael@0:   do {
michael@0:     if (!ValidParameter(file, sizeof(HANDLE), WRITE))
michael@0:       break;
michael@0:     if (!ValidParameter(io_status, sizeof(IO_STATUS_BLOCK), WRITE))
michael@0:       break;
michael@0: 
michael@0:     void* memory = GetGlobalIPCMemory();
michael@0:     if (NULL == memory)
michael@0:       break;
michael@0: 
michael@0:     wchar_t* name;
michael@0:     uint32 attributes;
michael@0:     NTSTATUS ret = AllocAndCopyName(object_attributes, &name, &attributes,
michael@0:                                     NULL);
michael@0:     if (!NT_SUCCESS(ret) || NULL == name)
michael@0:       break;
michael@0: 
michael@0:     ULONG broker = FALSE;
michael@0:     CountedParameterSet<OpenFile> params;
michael@0:     params[OpenFile::NAME] = ParamPickerMake(name);
michael@0:     params[OpenFile::ACCESS] = ParamPickerMake(desired_access);
michael@0:     params[OpenFile::OPTIONS] = ParamPickerMake(options);
michael@0:     params[OpenFile::BROKER] = ParamPickerMake(broker);
michael@0: 
michael@0:     if (!QueryBroker(IPC_NTOPENFILE_TAG, params.GetBase()))
michael@0:       break;
michael@0: 
michael@0:     SharedMemIPCClient ipc(memory);
michael@0:     CrossCallReturn answer = {0};
michael@0:     ResultCode code = CrossCall(ipc, IPC_NTOPENFILE_TAG, name, attributes,
michael@0:                                 desired_access, sharing, options, &answer);
michael@0: 
michael@0:     operator delete(name, NT_ALLOC);
michael@0: 
michael@0:     if (SBOX_ALL_OK != code)
michael@0:       break;
michael@0: 
michael@0:     if (!NT_SUCCESS(answer.nt_status))
michael@0:       return answer.nt_status;
michael@0: 
michael@0:     __try {
michael@0:       *file = answer.handle;
michael@0:       io_status->Status = answer.nt_status;
michael@0:       io_status->Information = answer.extended[0].ulong_ptr;
michael@0:       status = io_status->Status;
michael@0:     } __except(EXCEPTION_EXECUTE_HANDLER) {
michael@0:       break;
michael@0:     }
michael@0:   } while (false);
michael@0: 
michael@0:   return status;
michael@0: }
michael@0: 
michael@0: NTSTATUS WINAPI TargetNtQueryAttributesFile(
michael@0:     NtQueryAttributesFileFunction orig_QueryAttributes,
michael@0:     POBJECT_ATTRIBUTES object_attributes,
michael@0:     PFILE_BASIC_INFORMATION file_attributes) {
michael@0:   // Check if the process can query it first.
michael@0:   NTSTATUS status = orig_QueryAttributes(object_attributes, file_attributes);
michael@0:   if (STATUS_ACCESS_DENIED != status)
michael@0:     return status;
michael@0: 
michael@0:   // We don't trust that the IPC can work this early.
michael@0:   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
michael@0:     return status;
michael@0: 
michael@0:   do {
michael@0:     if (!ValidParameter(file_attributes, sizeof(FILE_BASIC_INFORMATION), WRITE))
michael@0:       break;
michael@0: 
michael@0:     void* memory = GetGlobalIPCMemory();
michael@0:     if (NULL == memory)
michael@0:       break;
michael@0: 
michael@0:     wchar_t* name = NULL;
michael@0:     uint32 attributes = 0;
michael@0:     NTSTATUS ret = AllocAndCopyName(object_attributes, &name, &attributes,
michael@0:                                     NULL);
michael@0:     if (!NT_SUCCESS(ret) || NULL == name)
michael@0:       break;
michael@0: 
michael@0:     InOutCountedBuffer file_info(file_attributes,
michael@0:                                  sizeof(FILE_BASIC_INFORMATION));
michael@0: 
michael@0:     ULONG broker = FALSE;
michael@0:     CountedParameterSet<FileName> params;
michael@0:     params[FileName::NAME] = ParamPickerMake(name);
michael@0:     params[FileName::BROKER] = ParamPickerMake(broker);
michael@0: 
michael@0:     if (!QueryBroker(IPC_NTQUERYATTRIBUTESFILE_TAG, params.GetBase()))
michael@0:       break;
michael@0: 
michael@0:     SharedMemIPCClient ipc(memory);
michael@0:     CrossCallReturn answer = {0};
michael@0:     ResultCode code = CrossCall(ipc, IPC_NTQUERYATTRIBUTESFILE_TAG, name,
michael@0:                                 attributes, file_info, &answer);
michael@0: 
michael@0:     operator delete(name, NT_ALLOC);
michael@0: 
michael@0:     if (SBOX_ALL_OK != code)
michael@0:       break;
michael@0: 
michael@0:     return answer.nt_status;
michael@0: 
michael@0:   } while (false);
michael@0: 
michael@0:   return status;
michael@0: }
michael@0: 
michael@0: NTSTATUS WINAPI TargetNtQueryFullAttributesFile(
michael@0:     NtQueryFullAttributesFileFunction orig_QueryFullAttributes,
michael@0:     POBJECT_ATTRIBUTES object_attributes,
michael@0:     PFILE_NETWORK_OPEN_INFORMATION file_attributes) {
michael@0:   // Check if the process can query it first.
michael@0:   NTSTATUS status = orig_QueryFullAttributes(object_attributes,
michael@0:                                              file_attributes);
michael@0:   if (STATUS_ACCESS_DENIED != status)
michael@0:     return status;
michael@0: 
michael@0:   // We don't trust that the IPC can work this early.
michael@0:   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
michael@0:     return status;
michael@0: 
michael@0:   do {
michael@0:     if (!ValidParameter(file_attributes, sizeof(FILE_NETWORK_OPEN_INFORMATION),
michael@0:                         WRITE))
michael@0:       break;
michael@0: 
michael@0:     void* memory = GetGlobalIPCMemory();
michael@0:     if (NULL == memory)
michael@0:       break;
michael@0: 
michael@0:     wchar_t* name = NULL;
michael@0:     uint32 attributes = 0;
michael@0:     NTSTATUS ret = AllocAndCopyName(object_attributes, &name, &attributes,
michael@0:                                     NULL);
michael@0:     if (!NT_SUCCESS(ret) || NULL == name)
michael@0:       break;
michael@0: 
michael@0:     InOutCountedBuffer file_info(file_attributes,
michael@0:                                  sizeof(FILE_NETWORK_OPEN_INFORMATION));
michael@0: 
michael@0:     ULONG broker = FALSE;
michael@0:     CountedParameterSet<FileName> params;
michael@0:     params[FileName::NAME] = ParamPickerMake(name);
michael@0:     params[FileName::BROKER] = ParamPickerMake(broker);
michael@0: 
michael@0:     if (!QueryBroker(IPC_NTQUERYFULLATTRIBUTESFILE_TAG, params.GetBase()))
michael@0:       break;
michael@0: 
michael@0:     SharedMemIPCClient ipc(memory);
michael@0:     CrossCallReturn answer = {0};
michael@0:     ResultCode code = CrossCall(ipc, IPC_NTQUERYFULLATTRIBUTESFILE_TAG, name,
michael@0:                                 attributes, file_info, &answer);
michael@0: 
michael@0:     operator delete(name, NT_ALLOC);
michael@0: 
michael@0:     if (SBOX_ALL_OK != code)
michael@0:       break;
michael@0: 
michael@0:     return answer.nt_status;
michael@0:   } while (false);
michael@0: 
michael@0:   return status;
michael@0: }
michael@0: 
michael@0: NTSTATUS WINAPI TargetNtSetInformationFile(
michael@0:     NtSetInformationFileFunction orig_SetInformationFile, HANDLE file,
michael@0:     PIO_STATUS_BLOCK io_status, PVOID file_info, ULONG length,
michael@0:     FILE_INFORMATION_CLASS file_info_class) {
michael@0:   // Check if the process can open it first.
michael@0:   NTSTATUS status = orig_SetInformationFile(file, io_status, file_info, length,
michael@0:                                             file_info_class);
michael@0:   if (STATUS_ACCESS_DENIED != status)
michael@0:     return status;
michael@0: 
michael@0:   // We don't trust that the IPC can work this early.
michael@0:   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
michael@0:     return status;
michael@0: 
michael@0:   do {
michael@0:     void* memory = GetGlobalIPCMemory();
michael@0:     if (NULL == memory)
michael@0:       break;
michael@0: 
michael@0:     if (!ValidParameter(io_status, sizeof(IO_STATUS_BLOCK), WRITE))
michael@0:       break;
michael@0: 
michael@0:     if (!ValidParameter(file_info, length, READ))
michael@0:       break;
michael@0: 
michael@0:     FILE_RENAME_INFORMATION* file_rename_info =
michael@0:         reinterpret_cast<FILE_RENAME_INFORMATION*>(file_info);
michael@0:     OBJECT_ATTRIBUTES object_attributes;
michael@0:     UNICODE_STRING object_name;
michael@0:     InitializeObjectAttributes(&object_attributes, &object_name, 0, NULL, NULL);
michael@0: 
michael@0:     __try {
michael@0:       if (!IsSupportedRenameCall(file_rename_info, length, file_info_class))
michael@0:         break;
michael@0: 
michael@0:       object_attributes.RootDirectory = file_rename_info->RootDirectory;
michael@0:       object_name.Buffer = file_rename_info->FileName;
michael@0:       object_name.Length = object_name.MaximumLength =
michael@0:           static_cast<USHORT>(file_rename_info->FileNameLength);
michael@0:     } __except(EXCEPTION_EXECUTE_HANDLER) {
michael@0:       break;
michael@0:     }
michael@0: 
michael@0:     wchar_t* name;
michael@0:     NTSTATUS ret = AllocAndCopyName(&object_attributes, &name, NULL, NULL);
michael@0:     if (!NT_SUCCESS(ret) || !name)
michael@0:       break;
michael@0: 
michael@0:     ULONG broker = FALSE;
michael@0:     CountedParameterSet<FileName> params;
michael@0:     params[FileName::NAME] = ParamPickerMake(name);
michael@0:     params[FileName::BROKER] = ParamPickerMake(broker);
michael@0: 
michael@0:     if (!QueryBroker(IPC_NTSETINFO_RENAME_TAG, params.GetBase()))
michael@0:       break;
michael@0: 
michael@0:     InOutCountedBuffer io_status_buffer(io_status, sizeof(IO_STATUS_BLOCK));
michael@0:     // This is actually not an InOut buffer, only In, but using InOut facility
michael@0:     // really helps to simplify the code.
michael@0:     InOutCountedBuffer file_info_buffer(file_info, length);
michael@0: 
michael@0:     SharedMemIPCClient ipc(memory);
michael@0:     CrossCallReturn answer = {0};
michael@0:     ResultCode code = CrossCall(ipc, IPC_NTSETINFO_RENAME_TAG, file,
michael@0:                                 io_status_buffer, file_info_buffer, length,
michael@0:                                 file_info_class, &answer);
michael@0: 
michael@0:     if (SBOX_ALL_OK != code)
michael@0:       break;
michael@0: 
michael@0:     status = answer.nt_status;
michael@0:   } while (false);
michael@0: 
michael@0:   return status;
michael@0: }
michael@0: 
michael@0: }  // namespace sandbox