michael@0: // Copyright (c) 2011 The Chromium Authors. All rights reserved.
michael@0: // Use of this source code is governed by a BSD-style license that can be
michael@0: // found in the LICENSE file.
michael@0: 
michael@0: #include <windows.h>
michael@0: #include <atlsecurity.h>
michael@0: 
michael@0: #include "base/win/windows_version.h"
michael@0: #include "testing/gtest/include/gtest/gtest.h"
michael@0: #include "sandbox/win/src/sandbox.h"
michael@0: #include "sandbox/win/src/sandbox_policy.h"
michael@0: #include "sandbox/win/src/sandbox_factory.h"
michael@0: #include "sandbox/win/tests/common/controller.h"
michael@0: 
michael@0: namespace sandbox {
michael@0: 
michael@0: 
michael@0: SBOX_TESTS_COMMAND int CheckIntegrityLevel(int argc, wchar_t **argv) {
michael@0:   ATL::CAccessToken token;
michael@0:   if (!token.GetEffectiveToken(TOKEN_READ))
michael@0:     return SBOX_TEST_FAILED;
michael@0: 
michael@0:   char* buffer[100];
michael@0:   DWORD buf_size = 100;
michael@0:   if (!::GetTokenInformation(token.GetHandle(), TokenIntegrityLevel,
michael@0:                              reinterpret_cast<void*>(buffer), buf_size,
michael@0:                              &buf_size))
michael@0:     return SBOX_TEST_FAILED;
michael@0: 
michael@0:   TOKEN_MANDATORY_LABEL* label =
michael@0:       reinterpret_cast<TOKEN_MANDATORY_LABEL*>(buffer);
michael@0: 
michael@0:   PSID sid_low = NULL;
michael@0:   if (!::ConvertStringSidToSid(L"S-1-16-4096", &sid_low))
michael@0:     return SBOX_TEST_FAILED;
michael@0: 
michael@0:   BOOL is_low_sid = ::EqualSid(label->Label.Sid, sid_low);
michael@0: 
michael@0:   ::LocalFree(sid_low);
michael@0: 
michael@0:   if (is_low_sid)
michael@0:     return SBOX_TEST_SUCCEEDED;
michael@0: 
michael@0:   return SBOX_TEST_DENIED;
michael@0: }
michael@0: 
michael@0: TEST(IntegrityLevelTest, TestLowILReal) {
michael@0:   if (base::win::GetVersion() != base::win::VERSION_VISTA)
michael@0:     return;
michael@0: 
michael@0:   TestRunner runner(JOB_LOCKDOWN, USER_INTERACTIVE, USER_INTERACTIVE);
michael@0: 
michael@0:   runner.SetTimeout(INFINITE);
michael@0: 
michael@0:   runner.GetPolicy()->SetIntegrityLevel(INTEGRITY_LEVEL_LOW);
michael@0: 
michael@0:   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckIntegrityLevel"));
michael@0: 
michael@0:   runner.SetTestState(BEFORE_REVERT);
michael@0:   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckIntegrityLevel"));
michael@0: }
michael@0: 
michael@0: TEST(DelayedIntegrityLevelTest, TestLowILDelayed) {
michael@0:   if (base::win::GetVersion() != base::win::VERSION_VISTA)
michael@0:     return;
michael@0: 
michael@0:   TestRunner runner(JOB_LOCKDOWN, USER_INTERACTIVE, USER_INTERACTIVE);
michael@0: 
michael@0:   runner.SetTimeout(INFINITE);
michael@0: 
michael@0:   runner.GetPolicy()->SetDelayedIntegrityLevel(INTEGRITY_LEVEL_LOW);
michael@0: 
michael@0:   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckIntegrityLevel"));
michael@0: 
michael@0:   runner.SetTestState(BEFORE_REVERT);
michael@0:   EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"CheckIntegrityLevel"));
michael@0: }
michael@0: 
michael@0: TEST(IntegrityLevelTest, TestNoILChange) {
michael@0:   if (base::win::GetVersion() != base::win::VERSION_VISTA)
michael@0:     return;
michael@0: 
michael@0:   TestRunner runner(JOB_LOCKDOWN, USER_INTERACTIVE, USER_INTERACTIVE);
michael@0: 
michael@0:   runner.SetTimeout(INFINITE);
michael@0: 
michael@0:   EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"CheckIntegrityLevel"));
michael@0: }
michael@0: 
michael@0: }  // namespace sandbox