michael@0: // Copyright (c) 2012 The Chromium Authors. All rights reserved.
michael@0: // Use of this source code is governed by a BSD-style license that can be
michael@0: // found in the LICENSE file.
michael@0: 
michael@0: #include "sandbox/win/src/target_process.h"
michael@0: 
michael@0: #include "base/basictypes.h"
michael@0: #include "base/memory/scoped_ptr.h"
michael@0: #include "base/win/pe_image.h"
michael@0: #include "base/win/startup_information.h"
michael@0: #include "base/win/windows_version.h"
michael@0: #include "sandbox/win/src/crosscall_server.h"
michael@0: #include "sandbox/win/src/crosscall_client.h"
michael@0: #include "sandbox/win/src/policy_low_level.h"
michael@0: #include "sandbox/win/src/sandbox_types.h"
michael@0: #include "sandbox/win/src/sharedmem_ipc_server.h"
michael@0: 
michael@0: namespace {
michael@0: 
michael@0: void CopyPolicyToTarget(const void* source, size_t size, void* dest) {
michael@0:   if (!source || !size)
michael@0:     return;
michael@0:   memcpy(dest, source, size);
michael@0:   sandbox::PolicyGlobal* policy =
michael@0:       reinterpret_cast<sandbox::PolicyGlobal*>(dest);
michael@0: 
michael@0:   size_t offset = reinterpret_cast<size_t>(source);
michael@0: 
michael@0:   for (size_t i = 0; i < sandbox::kMaxServiceCount; i++) {
michael@0:     size_t buffer = reinterpret_cast<size_t>(policy->entry[i]);
michael@0:     if (buffer) {
michael@0:       buffer -= offset;
michael@0:       policy->entry[i] = reinterpret_cast<sandbox::PolicyBuffer*>(buffer);
michael@0:     }
michael@0:   }
michael@0: }
michael@0: 
michael@0: }
michael@0: 
michael@0: namespace sandbox {
michael@0: 
michael@0: SANDBOX_INTERCEPT HANDLE g_shared_section;
michael@0: SANDBOX_INTERCEPT size_t g_shared_IPC_size;
michael@0: SANDBOX_INTERCEPT size_t g_shared_policy_size;
michael@0: 
michael@0: // Returns the address of the main exe module in memory taking in account
michael@0: // address space layout randomization.
michael@0: void* GetBaseAddress(const wchar_t* exe_name, void* entry_point) {
michael@0:   HMODULE exe = ::LoadLibrary(exe_name);
michael@0:   if (NULL == exe)
michael@0:     return exe;
michael@0: 
michael@0:   base::win::PEImage pe(exe);
michael@0:   if (!pe.VerifyMagic()) {
michael@0:     ::FreeLibrary(exe);
michael@0:     return exe;
michael@0:   }
michael@0:   PIMAGE_NT_HEADERS nt_header = pe.GetNTHeaders();
michael@0:   char* base = reinterpret_cast<char*>(entry_point) -
michael@0:     nt_header->OptionalHeader.AddressOfEntryPoint;
michael@0: 
michael@0:   ::FreeLibrary(exe);
michael@0:   return base;
michael@0: }
michael@0: 
michael@0: 
michael@0: TargetProcess::TargetProcess(HANDLE initial_token, HANDLE lockdown_token,
michael@0:                              HANDLE job, ThreadProvider* thread_pool)
michael@0:   // This object owns everything initialized here except thread_pool and
michael@0:   // the job_ handle. The Job handle is closed by BrokerServices and results
michael@0:   // eventually in a call to our dtor.
michael@0:     : lockdown_token_(lockdown_token),
michael@0:       initial_token_(initial_token),
michael@0:       job_(job),
michael@0:       thread_pool_(thread_pool),
michael@0:       base_address_(NULL) {
michael@0: }
michael@0: 
michael@0: TargetProcess::~TargetProcess() {
michael@0:   DWORD exit_code = 0;
michael@0:   // Give a chance to the process to die. In most cases the JOB_KILL_ON_CLOSE
michael@0:   // will take effect only when the context changes. As far as the testing went,
michael@0:   // this wait was enough to switch context and kill the processes in the job.
michael@0:   // If this process is already dead, the function will return without waiting.
michael@0:   // TODO(nsylvain):  If the process is still alive at the end, we should kill
michael@0:   // it. http://b/893891
michael@0:   // For now, this wait is there only to do a best effort to prevent some leaks
michael@0:   // from showing up in purify.
michael@0:   if (sandbox_process_info_.IsValid()) {
michael@0:     ::WaitForSingleObject(sandbox_process_info_.process_handle(), 50);
michael@0:     if (!::GetExitCodeProcess(sandbox_process_info_.process_handle(),
michael@0:                               &exit_code) || (STILL_ACTIVE == exit_code)) {
michael@0:       // It is an error to destroy this object while the target process is still
michael@0:       // alive because we need to destroy the IPC subsystem and cannot risk to
michael@0:       // have an IPC reach us after this point.
michael@0:       if (shared_section_.IsValid())
michael@0:         shared_section_.Take();
michael@0:       SharedMemIPCServer* server = ipc_server_.release();
michael@0:       sandbox_process_info_.TakeProcessHandle();
michael@0:       return;
michael@0:     }
michael@0:   }
michael@0: 
michael@0:   // ipc_server_ references our process handle, so make sure the former is shut
michael@0:   // down before the latter is closed (by ScopedProcessInformation).
michael@0:   ipc_server_.reset();
michael@0: }
michael@0: 
michael@0: // Creates the target (child) process suspended and assigns it to the job
michael@0: // object.
michael@0: DWORD TargetProcess::Create(const wchar_t* exe_path,
michael@0:                             const wchar_t* command_line,
michael@0:                             bool inherit_handles,
michael@0:                             const base::win::StartupInformation& startup_info,
michael@0:                             base::win::ScopedProcessInformation* target_info) {
michael@0:   exe_name_.reset(_wcsdup(exe_path));
michael@0: 
michael@0:   // the command line needs to be writable by CreateProcess().
michael@0:   scoped_ptr_malloc<wchar_t> cmd_line(_wcsdup(command_line));
michael@0: 
michael@0:   // Start the target process suspended.
michael@0:   DWORD flags =
michael@0:       CREATE_SUSPENDED | CREATE_UNICODE_ENVIRONMENT | DETACHED_PROCESS;
michael@0: 
michael@0:   if (startup_info.has_extended_startup_info())
michael@0:     flags |= EXTENDED_STARTUPINFO_PRESENT;
michael@0: 
michael@0:   if (job_ && base::win::GetVersion() < base::win::VERSION_WIN8) {
michael@0:     // Windows 8 implements nested jobs, but for older systems we need to
michael@0:     // break out of any job we're in to enforce our restrictions.
michael@0:     flags |= CREATE_BREAKAWAY_FROM_JOB;
michael@0:   }
michael@0: 
michael@0:   base::win::ScopedProcessInformation process_info;
michael@0: 
michael@0:   if (!::CreateProcessAsUserW(lockdown_token_,
michael@0:                               exe_path,
michael@0:                               cmd_line.get(),
michael@0:                               NULL,   // No security attribute.
michael@0:                               NULL,   // No thread attribute.
michael@0:                               inherit_handles,
michael@0:                               flags,
michael@0:                               NULL,   // Use the environment of the caller.
michael@0:                               NULL,   // Use current directory of the caller.
michael@0:                               startup_info.startup_info(),
michael@0:                               process_info.Receive())) {
michael@0:     return ::GetLastError();
michael@0:   }
michael@0:   lockdown_token_.Close();
michael@0: 
michael@0:   DWORD win_result = ERROR_SUCCESS;
michael@0: 
michael@0:   if (job_) {
michael@0:     // Assign the suspended target to the windows job object.
michael@0:     if (!::AssignProcessToJobObject(job_, process_info.process_handle())) {
michael@0:       win_result = ::GetLastError();
michael@0:       ::TerminateProcess(process_info.process_handle(), 0);
michael@0:       return win_result;
michael@0:     }
michael@0:   }
michael@0: 
michael@0:   if (initial_token_.IsValid()) {
michael@0:     // Change the token of the main thread of the new process for the
michael@0:     // impersonation token with more rights. This allows the target to start;
michael@0:     // otherwise it will crash too early for us to help.
michael@0:     HANDLE temp_thread = process_info.thread_handle();
michael@0:     if (!::SetThreadToken(&temp_thread, initial_token_)) {
michael@0:       win_result = ::GetLastError();
michael@0:       // It might be a security breach if we let the target run outside the job
michael@0:       // so kill it before it causes damage.
michael@0:       ::TerminateProcess(process_info.process_handle(), 0);
michael@0:       return win_result;
michael@0:     }
michael@0:     initial_token_.Close();
michael@0:   }
michael@0: 
michael@0:   CONTEXT context;
michael@0:   context.ContextFlags = CONTEXT_ALL;
michael@0:   if (!::GetThreadContext(process_info.thread_handle(), &context)) {
michael@0:     win_result = ::GetLastError();
michael@0:     ::TerminateProcess(process_info.process_handle(), 0);
michael@0:     return win_result;
michael@0:   }
michael@0: 
michael@0: #if defined(_WIN64)
michael@0:   void* entry_point = reinterpret_cast<void*>(context.Rcx);
michael@0: #else
michael@0: #pragma warning(push)
michael@0: #pragma warning(disable: 4312)
michael@0:   // This cast generates a warning because it is 32 bit specific.
michael@0:   void* entry_point = reinterpret_cast<void*>(context.Eax);
michael@0: #pragma warning(pop)
michael@0: #endif  // _WIN64
michael@0: 
michael@0:   if (!target_info->DuplicateFrom(process_info)) {
michael@0:     win_result = ::GetLastError();  // This may or may not be correct.
michael@0:     ::TerminateProcess(process_info.process_handle(), 0);
michael@0:     return win_result;
michael@0:   }
michael@0: 
michael@0:   base_address_ = GetBaseAddress(exe_path, entry_point);
michael@0:   sandbox_process_info_.Set(process_info.Take());
michael@0:   return win_result;
michael@0: }
michael@0: 
michael@0: ResultCode TargetProcess::TransferVariable(const char* name, void* address,
michael@0:                                            size_t size) {
michael@0:   if (!sandbox_process_info_.IsValid())
michael@0:     return SBOX_ERROR_UNEXPECTED_CALL;
michael@0: 
michael@0:   void* child_var = address;
michael@0: 
michael@0: #if SANDBOX_EXPORTS
michael@0:   HMODULE module = ::LoadLibrary(exe_name_.get());
michael@0:   if (NULL == module)
michael@0:     return SBOX_ERROR_GENERIC;
michael@0: 
michael@0:   child_var = ::GetProcAddress(module, name);
michael@0:   ::FreeLibrary(module);
michael@0: 
michael@0:   if (NULL == child_var)
michael@0:     return SBOX_ERROR_GENERIC;
michael@0: 
michael@0:   size_t offset = reinterpret_cast<char*>(child_var) -
michael@0:                   reinterpret_cast<char*>(module);
michael@0:   child_var = reinterpret_cast<char*>(MainModule()) + offset;
michael@0: #else
michael@0:   UNREFERENCED_PARAMETER(name);
michael@0: #endif
michael@0: 
michael@0:   SIZE_T written;
michael@0:   if (!::WriteProcessMemory(sandbox_process_info_.process_handle(),
michael@0:                             child_var, address, size, &written))
michael@0:     return SBOX_ERROR_GENERIC;
michael@0: 
michael@0:   if (written != size)
michael@0:     return SBOX_ERROR_GENERIC;
michael@0: 
michael@0:   return SBOX_ALL_OK;
michael@0: }
michael@0: 
michael@0: // Construct the IPC server and the IPC dispatcher. When the target does
michael@0: // an IPC it will eventually call the dispatcher.
michael@0: DWORD TargetProcess::Init(Dispatcher* ipc_dispatcher, void* policy,
michael@0:                           uint32 shared_IPC_size, uint32 shared_policy_size) {
michael@0:   // We need to map the shared memory on the target. This is necessary for
michael@0:   // any IPC that needs to take place, even if the target has not yet hit
michael@0:   // the main( ) function or even has initialized the CRT. So here we set
michael@0:   // the handle to the shared section. The target on the first IPC must do
michael@0:   // the rest, which boils down to calling MapViewofFile()
michael@0: 
michael@0:   // We use this single memory pool for IPC and for policy.
michael@0:   DWORD shared_mem_size = static_cast<DWORD>(shared_IPC_size +
michael@0:                                              shared_policy_size);
michael@0:   shared_section_.Set(::CreateFileMappingW(INVALID_HANDLE_VALUE, NULL,
michael@0:                                            PAGE_READWRITE | SEC_COMMIT,
michael@0:                                            0, shared_mem_size, NULL));
michael@0:   if (!shared_section_.IsValid()) {
michael@0:     return ::GetLastError();
michael@0:   }
michael@0: 
michael@0:   DWORD access = FILE_MAP_READ | FILE_MAP_WRITE;
michael@0:   HANDLE target_shared_section;
michael@0:   if (!::DuplicateHandle(::GetCurrentProcess(), shared_section_,
michael@0:                          sandbox_process_info_.process_handle(),
michael@0:                          &target_shared_section, access, FALSE, 0)) {
michael@0:     return ::GetLastError();
michael@0:   }
michael@0: 
michael@0:   void* shared_memory = ::MapViewOfFile(shared_section_,
michael@0:                                         FILE_MAP_WRITE|FILE_MAP_READ,
michael@0:                                         0, 0, 0);
michael@0:   if (NULL == shared_memory) {
michael@0:     return ::GetLastError();
michael@0:   }
michael@0: 
michael@0:   CopyPolicyToTarget(policy, shared_policy_size,
michael@0:                      reinterpret_cast<char*>(shared_memory) + shared_IPC_size);
michael@0: 
michael@0:   ResultCode ret;
michael@0:   // Set the global variables in the target. These are not used on the broker.
michael@0:   g_shared_section = target_shared_section;
michael@0:   ret = TransferVariable("g_shared_section", &g_shared_section,
michael@0:                          sizeof(g_shared_section));
michael@0:   g_shared_section = NULL;
michael@0:   if (SBOX_ALL_OK != ret) {
michael@0:     return (SBOX_ERROR_GENERIC == ret)?
michael@0:            ::GetLastError() : ERROR_INVALID_FUNCTION;
michael@0:   }
michael@0:   g_shared_IPC_size = shared_IPC_size;
michael@0:   ret = TransferVariable("g_shared_IPC_size", &g_shared_IPC_size,
michael@0:                          sizeof(g_shared_IPC_size));
michael@0:   g_shared_IPC_size = 0;
michael@0:   if (SBOX_ALL_OK != ret) {
michael@0:     return (SBOX_ERROR_GENERIC == ret) ?
michael@0:            ::GetLastError() : ERROR_INVALID_FUNCTION;
michael@0:   }
michael@0:   g_shared_policy_size = shared_policy_size;
michael@0:   ret = TransferVariable("g_shared_policy_size", &g_shared_policy_size,
michael@0:                          sizeof(g_shared_policy_size));
michael@0:   g_shared_policy_size = 0;
michael@0:   if (SBOX_ALL_OK != ret) {
michael@0:     return (SBOX_ERROR_GENERIC == ret) ?
michael@0:            ::GetLastError() : ERROR_INVALID_FUNCTION;
michael@0:   }
michael@0: 
michael@0:   ipc_server_.reset(
michael@0:       new SharedMemIPCServer(sandbox_process_info_.process_handle(),
michael@0:                              sandbox_process_info_.process_id(),
michael@0:                              job_, thread_pool_, ipc_dispatcher));
michael@0: 
michael@0:   if (!ipc_server_->Init(shared_memory, shared_IPC_size, kIPCChannelSize))
michael@0:     return ERROR_NOT_ENOUGH_MEMORY;
michael@0: 
michael@0:   // After this point we cannot use this handle anymore.
michael@0:   ::CloseHandle(sandbox_process_info_.TakeThreadHandle());
michael@0: 
michael@0:   return ERROR_SUCCESS;
michael@0: }
michael@0: 
michael@0: void TargetProcess::Terminate() {
michael@0:   if (!sandbox_process_info_.IsValid())
michael@0:     return;
michael@0: 
michael@0:   ::TerminateProcess(sandbox_process_info_.process_handle(), 0);
michael@0: }
michael@0: 
michael@0: TargetProcess* MakeTestTargetProcess(HANDLE process, HMODULE base_address) {
michael@0:   TargetProcess* target = new TargetProcess(NULL, NULL, NULL, NULL);
michael@0:   PROCESS_INFORMATION process_info = {};
michael@0:   process_info.hProcess = process;
michael@0:   target->sandbox_process_info_.Set(process_info);
michael@0:   target->base_address_ = base_address;
michael@0:   return target;
michael@0: }
michael@0: 
michael@0: }  // namespace sandbox