sandbox/win/src/broker_services.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/win/src/broker_services.h"
   6
   7 #include "base/logging.h"
   8 #include "base/memory/scoped_ptr.h"
   9 #include "base/threading/platform_thread.h"
  10 #include "base/win/scoped_handle.h"
  11 #include "base/win/scoped_process_information.h"
  12 #include "base/win/startup_information.h"
  13 #include "base/win/windows_version.h"
  14 #include "sandbox/win/src/app_container.h"
  15 #include "sandbox/win/src/process_mitigations.h"
  16 #include "sandbox/win/src/sandbox_policy_base.h"
  17 #include "sandbox/win/src/sandbox.h"
  18 #include "sandbox/win/src/target_process.h"
  19 #include "sandbox/win/src/win2k_threadpool.h"
  20 #include "sandbox/win/src/win_utils.h"
  21
  22 namespace {
  23
  24 // Utility function to associate a completion port to a job object.
  25 bool AssociateCompletionPort(HANDLE job, HANDLE port, void* key) {
  26   JOBOBJECT_ASSOCIATE_COMPLETION_PORT job_acp = { key, port };
  27   return ::SetInformationJobObject(job,
  28                                    JobObjectAssociateCompletionPortInformation,
  29                                    &job_acp, sizeof(job_acp))? true : false;
  30 }
  31
  32 // Utility function to do the cleanup necessary when something goes wrong
  33 // while in SpawnTarget and we must terminate the target process.
  34 sandbox::ResultCode SpawnCleanup(sandbox::TargetProcess* target, DWORD error) {
  35   if (0 == error)
  36     error = ::GetLastError();
  37
  38   target->Terminate();
  39   delete target;
  40   ::SetLastError(error);
  41   return sandbox::SBOX_ERROR_GENERIC;
  42 }
  43
  44 // the different commands that you can send to the worker thread that
  45 // executes TargetEventsThread().
  46 enum {
  47   THREAD_CTRL_NONE,
  48   THREAD_CTRL_REMOVE_PEER,
  49   THREAD_CTRL_QUIT,
  50   THREAD_CTRL_LAST,
  51 };
  52
  53 // Helper structure that allows the Broker to associate a job notification
  54 // with a job object and with a policy.
  55 struct JobTracker {
  56   HANDLE job;
  57   sandbox::PolicyBase* policy;
  58   JobTracker(HANDLE cjob, sandbox::PolicyBase* cpolicy)
  59       : job(cjob), policy(cpolicy) {
  60   }
  61 };
  62
  63 // Helper structure that allows the broker to track peer processes
  64 struct PeerTracker {
  65   HANDLE wait_object;
  66   base::win::ScopedHandle process;
  67   DWORD id;
  68   HANDLE job_port;
  69   PeerTracker(DWORD process_id, HANDLE broker_job_port)
  70       : wait_object(NULL), id(process_id), job_port(broker_job_port) {
  71   }
  72 };
  73
  74 void DeregisterPeerTracker(PeerTracker* peer) {
  75   // Deregistration shouldn't fail, but we leak rather than crash if it does.
  76   if (::UnregisterWaitEx(peer->wait_object, INVALID_HANDLE_VALUE)) {
  77     delete peer;
  78   } else {
  79     NOTREACHED();
  80   }
  81 }
  82
  83 }  // namespace
  84
  85 namespace sandbox {
  86
  87 BrokerServicesBase::BrokerServicesBase()
  88     : thread_pool_(NULL), job_port_(NULL), no_targets_(NULL),
  89       job_thread_(NULL) {
  90 }
  91
  92 // The broker uses a dedicated worker thread that services the job completion
  93 // port to perform policy notifications and associated cleanup tasks.
  94 ResultCode BrokerServicesBase::Init() {
  95   if ((NULL != job_port_) || (NULL != thread_pool_))
  96     return SBOX_ERROR_UNEXPECTED_CALL;
  97
  98   ::InitializeCriticalSection(&lock_);
  99
 100   job_port_ = ::CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, 0, 0);
 101   if (NULL == job_port_)
 102     return SBOX_ERROR_GENERIC;
 103
 104   no_targets_ = ::CreateEventW(NULL, TRUE, FALSE, NULL);
 105
 106   job_thread_ = ::CreateThread(NULL, 0,  // Default security and stack.
 107                                TargetEventsThread, this, NULL, NULL);
 108   if (NULL == job_thread_)
 109     return SBOX_ERROR_GENERIC;
 110
 111   return SBOX_ALL_OK;
 112 }
 113
 114 // The destructor should only be called when the Broker process is terminating.
 115 // Since BrokerServicesBase is a singleton, this is called from the CRT
 116 // termination handlers, if this code lives on a DLL it is called during
 117 // DLL_PROCESS_DETACH in other words, holding the loader lock, so we cannot
 118 // wait for threads here.
 119 BrokerServicesBase::~BrokerServicesBase() {
 120   // If there is no port Init() was never called successfully.
 121   if (!job_port_)
 122     return;
 123
 124   // Closing the port causes, that no more Job notifications are delivered to
 125   // the worker thread and also causes the thread to exit. This is what we
 126   // want to do since we are going to close all outstanding Jobs and notifying
 127   // the policy objects ourselves.
 128   ::PostQueuedCompletionStatus(job_port_, 0, THREAD_CTRL_QUIT, FALSE);
 129   ::CloseHandle(job_port_);
 130
 131   if (WAIT_TIMEOUT == ::WaitForSingleObject(job_thread_, 1000)) {
 132     // Cannot clean broker services.
 133     NOTREACHED();
 134     return;
 135   }
 136
 137   JobTrackerList::iterator it;
 138   for (it = tracker_list_.begin(); it != tracker_list_.end(); ++it) {
 139     JobTracker* tracker = (*it);
 140     FreeResources(tracker);
 141     delete tracker;
 142   }
 143   ::CloseHandle(job_thread_);
 144   delete thread_pool_;
 145   ::CloseHandle(no_targets_);
 146
 147   // Cancel the wait events and delete remaining peer trackers.
 148   for (PeerTrackerMap::iterator it = peer_map_.begin();
 149        it != peer_map_.end(); ++it) {
 150     DeregisterPeerTracker(it->second);
 151   }
 152
 153   // If job_port_ isn't NULL, assumes that the lock has been initialized.
 154   if (job_port_)
 155     ::DeleteCriticalSection(&lock_);
 156 }
 157
 158 TargetPolicy* BrokerServicesBase::CreatePolicy() {
 159   // If you change the type of the object being created here you must also
 160   // change the downcast to it in SpawnTarget().
 161   return new PolicyBase;
 162 }
 163
 164 void BrokerServicesBase::FreeResources(JobTracker* tracker) {
 165   if (NULL != tracker->policy) {
 166     BOOL res = ::TerminateJobObject(tracker->job, SBOX_ALL_OK);
 167     DCHECK(res);
 168     // Closing the job causes the target process to be destroyed so this
 169     // needs to happen before calling OnJobEmpty().
 170     res = ::CloseHandle(tracker->job);
 171     DCHECK(res);
 172     // In OnJobEmpty() we don't actually use the job handle directly.
 173     tracker->policy->OnJobEmpty(tracker->job);
 174     tracker->policy->Release();
 175     tracker->policy = NULL;
 176   }
 177 }
 178
 179 // The worker thread stays in a loop waiting for asynchronous notifications
 180 // from the job objects. Right now we only care about knowing when the last
 181 // process on a job terminates, but in general this is the place to tell
 182 // the policy about events.
 183 DWORD WINAPI BrokerServicesBase::TargetEventsThread(PVOID param) {
 184   if (NULL == param)
 185     return 1;
 186
 187   base::PlatformThread::SetName("BrokerEvent");
 188
 189   BrokerServicesBase* broker = reinterpret_cast<BrokerServicesBase*>(param);
 190   HANDLE port = broker->job_port_;
 191   HANDLE no_targets = broker->no_targets_;
 192
 193   int target_counter = 0;
 194   ::ResetEvent(no_targets);
 195
 196   while (true) {
 197     DWORD events = 0;
 198     ULONG_PTR key = 0;
 199     LPOVERLAPPED ovl = NULL;
 200
 201     if (!::GetQueuedCompletionStatus(port, &events, &key, &ovl, INFINITE))
 202       // this call fails if the port has been closed before we have a
 203       // chance to service the last packet which is 'exit' anyway so
 204       // this is not an error.
 205       return 1;
 206
 207     if (key > THREAD_CTRL_LAST) {
 208       // The notification comes from a job object. There are nine notifications
 209       // that jobs can send and some of them depend on the job attributes set.
 210       JobTracker* tracker = reinterpret_cast<JobTracker*>(key);
 211
 212       switch (events) {
 213         case JOB_OBJECT_MSG_ACTIVE_PROCESS_ZERO: {
 214           // The job object has signaled that the last process associated
 215           // with it has terminated. Assuming there is no way for a process
 216           // to appear out of thin air in this job, it safe to assume that
 217           // we can tell the policy to destroy the target object, and for
 218           // us to release our reference to the policy object.
 219           FreeResources(tracker);
 220           break;
 221         }
 222
 223         case JOB_OBJECT_MSG_NEW_PROCESS: {
 224           ++target_counter;
 225           if (1 == target_counter) {
 226             ::ResetEvent(no_targets);
 227           }
 228           break;
 229         }
 230
 231         case JOB_OBJECT_MSG_EXIT_PROCESS:
 232         case JOB_OBJECT_MSG_ABNORMAL_EXIT_PROCESS: {
 233           {
 234             AutoLock lock(&broker->lock_);
 235             broker->child_process_ids_.erase(reinterpret_cast<DWORD>(ovl));
 236           }
 237           --target_counter;
 238           if (0 == target_counter)
 239             ::SetEvent(no_targets);
 240
 241           DCHECK(target_counter >= 0);
 242           break;
 243         }
 244
 245         case JOB_OBJECT_MSG_ACTIVE_PROCESS_LIMIT: {
 246           break;
 247         }
 248
 249         default: {
 250           NOTREACHED();
 251           break;
 252         }
 253       }
 254     } else if (THREAD_CTRL_REMOVE_PEER == key) {
 255       // Remove a process from our list of peers.
 256       AutoLock lock(&broker->lock_);
 257       PeerTrackerMap::iterator it =
 258           broker->peer_map_.find(reinterpret_cast<DWORD>(ovl));
 259       DeregisterPeerTracker(it->second);
 260       broker->peer_map_.erase(it);
 261     } else if (THREAD_CTRL_QUIT == key) {
 262       // The broker object is being destroyed so the thread needs to exit.
 263       return 0;
 264     } else {
 265       // We have not implemented more commands.
 266       NOTREACHED();
 267     }
 268   }
 269
 270   NOTREACHED();
 271   return 0;
 272 }
 273
 274 // SpawnTarget does all the interesting sandbox setup and creates the target
 275 // process inside the sandbox.
 276 ResultCode BrokerServicesBase::SpawnTarget(const wchar_t* exe_path,
 277                                            const wchar_t* command_line,
 278                                            TargetPolicy* policy,
 279                                            PROCESS_INFORMATION* target_info) {
 280   if (!exe_path)
 281     return SBOX_ERROR_BAD_PARAMS;
 282
 283   if (!policy)
 284     return SBOX_ERROR_BAD_PARAMS;
 285
 286   // Even though the resources touched by SpawnTarget can be accessed in
 287   // multiple threads, the method itself cannot be called from more than
 288   // 1 thread. This is to protect the global variables used while setting up
 289   // the child process.
 290   static DWORD thread_id = ::GetCurrentThreadId();
 291   DCHECK(thread_id == ::GetCurrentThreadId());
 292
 293   AutoLock lock(&lock_);
 294
 295   // This downcast is safe as long as we control CreatePolicy()
 296   PolicyBase* policy_base = static_cast<PolicyBase*>(policy);
 297
 298   // Construct the tokens and the job object that we are going to associate
 299   // with the soon to be created target process.
 300   HANDLE initial_token_temp;
 301   HANDLE lockdown_token_temp;
 302   ResultCode result = policy_base->MakeTokens(&initial_token_temp,
 303                                               &lockdown_token_temp);
 304   if (SBOX_ALL_OK != result)
 305     return result;
 306
 307   base::win::ScopedHandle initial_token(initial_token_temp);
 308   base::win::ScopedHandle lockdown_token(lockdown_token_temp);
 309
 310   HANDLE job_temp;
 311   result = policy_base->MakeJobObject(&job_temp);
 312   if (SBOX_ALL_OK != result)
 313     return result;
 314
 315   base::win::ScopedHandle job(job_temp);
 316
 317   // Initialize the startup information from the policy.
 318   base::win::StartupInformation startup_info;
 319   string16 desktop = policy_base->GetAlternateDesktop();
 320   if (!desktop.empty()) {
 321     startup_info.startup_info()->lpDesktop =
 322         const_cast<wchar_t*>(desktop.c_str());
 323   }
 324
 325   bool inherit_handles = false;
 326   if (base::win::GetVersion() >= base::win::VERSION_VISTA) {
 327     int attribute_count = 0;
 328     const AppContainerAttributes* app_container =
 329         policy_base->GetAppContainer();
 330     if (app_container)
 331       ++attribute_count;
 332
 333     DWORD64 mitigations;
 334     size_t mitigations_size;
 335     ConvertProcessMitigationsToPolicy(policy->GetProcessMitigations(),
 336                                       &mitigations, &mitigations_size);
 337     if (mitigations)
 338       ++attribute_count;
 339
 340     HANDLE stdout_handle = policy_base->GetStdoutHandle();
 341     HANDLE stderr_handle = policy_base->GetStderrHandle();
 342     HANDLE inherit_handle_list[2];
 343     int inherit_handle_count = 0;
 344     if (stdout_handle != INVALID_HANDLE_VALUE)
 345       inherit_handle_list[inherit_handle_count++] = stdout_handle;
 346     // Handles in the list must be unique.
 347     if (stderr_handle != stdout_handle && stderr_handle != INVALID_HANDLE_VALUE)
 348       inherit_handle_list[inherit_handle_count++] = stderr_handle;
 349     if (inherit_handle_count)
 350       ++attribute_count;
 351
 352     if (!startup_info.InitializeProcThreadAttributeList(attribute_count))
 353       return SBOX_ERROR_PROC_THREAD_ATTRIBUTES;
 354
 355     if (app_container) {
 356       result = app_container->ShareForStartup(&startup_info);
 357       if (SBOX_ALL_OK != result)
 358         return result;
 359     }
 360
 361     if (mitigations) {
 362       if (!startup_info.UpdateProcThreadAttribute(
 363                PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, &mitigations,
 364                mitigations_size)) {
 365         return SBOX_ERROR_PROC_THREAD_ATTRIBUTES;
 366       }
 367     }
 368
 369     if (inherit_handle_count) {
 370       if (!startup_info.UpdateProcThreadAttribute(
 371               PROC_THREAD_ATTRIBUTE_HANDLE_LIST,
 372               inherit_handle_list,
 373               sizeof(inherit_handle_list[0]) * inherit_handle_count)) {
 374         return SBOX_ERROR_PROC_THREAD_ATTRIBUTES;
 375       }
 376       startup_info.startup_info()->dwFlags |= STARTF_USESTDHANDLES;
 377       startup_info.startup_info()->hStdInput = INVALID_HANDLE_VALUE;
 378       startup_info.startup_info()->hStdOutput = stdout_handle;
 379       startup_info.startup_info()->hStdError = stderr_handle;
 380       // Allowing inheritance of handles is only secure now that we
 381       // have limited which handles will be inherited.
 382       inherit_handles = true;
 383     }
 384   }
 385
 386   // Construct the thread pool here in case it is expensive.
 387   // The thread pool is shared by all the targets
 388   if (NULL == thread_pool_)
 389     thread_pool_ = new Win2kThreadPool();
 390
 391   // Create the TargetProces object and spawn the target suspended. Note that
 392   // Brokerservices does not own the target object. It is owned by the Policy.
 393   base::win::ScopedProcessInformation process_info;
 394   TargetProcess* target = new TargetProcess(initial_token.Take(),
 395                                             lockdown_token.Take(),
 396                                             job,
 397                                             thread_pool_);
 398
 399   DWORD win_result = target->Create(exe_path, command_line, inherit_handles,
 400                                     startup_info, &process_info);
 401   if (ERROR_SUCCESS != win_result)
 402     return SpawnCleanup(target, win_result);
 403
 404   // Now the policy is the owner of the target.
 405   if (!policy_base->AddTarget(target)) {
 406     return SpawnCleanup(target, 0);
 407   }
 408
 409   // We are going to keep a pointer to the policy because we'll call it when
 410   // the job object generates notifications using the completion port.
 411   policy_base->AddRef();
 412   if (job.IsValid()) {
 413     scoped_ptr<JobTracker> tracker(new JobTracker(job.Take(), policy_base));
 414     if (!AssociateCompletionPort(tracker->job, job_port_, tracker.get()))
 415       return SpawnCleanup(target, 0);
 416     // Save the tracker because in cleanup we might need to force closing
 417     // the Jobs.
 418     tracker_list_.push_back(tracker.release());
 419     child_process_ids_.insert(process_info.process_id());
 420   } else {
 421     // We have to signal the event once here because the completion port will
 422     // never get a message that this target is being terminated thus we should
 423     // not block WaitForAllTargets until we have at least one target with job.
 424     if (child_process_ids_.empty())
 425       ::SetEvent(no_targets_);
 426     // We can not track the life time of such processes and it is responsibility
 427     // of the host application to make sure that spawned targets without jobs
 428     // are terminated when the main application don't need them anymore.
 429   }
 430
 431   *target_info = process_info.Take();
 432   return SBOX_ALL_OK;
 433 }
 434
 435
 436 ResultCode BrokerServicesBase::WaitForAllTargets() {
 437   ::WaitForSingleObject(no_targets_, INFINITE);
 438   return SBOX_ALL_OK;
 439 }
 440
 441 bool BrokerServicesBase::IsActiveTarget(DWORD process_id) {
 442   AutoLock lock(&lock_);
 443   return child_process_ids_.find(process_id) != child_process_ids_.end() ||
 444          peer_map_.find(process_id) != peer_map_.end();
 445 }
 446
 447 VOID CALLBACK BrokerServicesBase::RemovePeer(PVOID parameter, BOOLEAN timeout) {
 448   PeerTracker* peer = reinterpret_cast<PeerTracker*>(parameter);
 449   // Don't check the return code because we this may fail (safely) at shutdown.
 450   ::PostQueuedCompletionStatus(peer->job_port, 0, THREAD_CTRL_REMOVE_PEER,
 451                                reinterpret_cast<LPOVERLAPPED>(peer->id));
 452 }
 453
 454 ResultCode BrokerServicesBase::AddTargetPeer(HANDLE peer_process) {
 455   scoped_ptr<PeerTracker> peer(new PeerTracker(::GetProcessId(peer_process),
 456                                                job_port_));
 457   if (!peer->id)
 458     return SBOX_ERROR_GENERIC;
 459
 460   HANDLE process_handle;
 461   if (!::DuplicateHandle(::GetCurrentProcess(), peer_process,
 462                          ::GetCurrentProcess(), &process_handle,
 463                          SYNCHRONIZE, FALSE, 0)) {
 464     return SBOX_ERROR_GENERIC;
 465   }
 466   peer->process.Set(process_handle);
 467
 468   AutoLock lock(&lock_);
 469   if (!peer_map_.insert(std::make_pair(peer->id, peer.get())).second)
 470     return SBOX_ERROR_BAD_PARAMS;
 471
 472   if (!::RegisterWaitForSingleObject(
 473           &peer->wait_object, peer->process, RemovePeer, peer.get(), INFINITE,
 474           WT_EXECUTEONLYONCE | WT_EXECUTEINWAITTHREAD)) {
 475     peer_map_.erase(peer->id);
 476     return SBOX_ERROR_GENERIC;
 477   }
 478
 479   // Release the pointer since it will be cleaned up by the callback.
 480   peer.release();
 481   return SBOX_ALL_OK;
 482 }
 483
 484 ResultCode BrokerServicesBase::InstallAppContainer(const wchar_t* sid,
 485                                                    const wchar_t* name) {
 486   if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
 487     return SBOX_ERROR_UNSUPPORTED;
 488
 489   string16 old_name = LookupAppContainer(sid);
 490   if (old_name.empty())
 491     return CreateAppContainer(sid, name);
 492
 493   if (old_name != name)
 494     return SBOX_ERROR_INVALID_APP_CONTAINER;
 495
 496   return SBOX_ALL_OK;
 497 }
 498
 499 ResultCode BrokerServicesBase::UninstallAppContainer(const wchar_t* sid) {
 500   if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
 501     return SBOX_ERROR_UNSUPPORTED;
 502
 503   string16 name =  LookupAppContainer(sid);
 504   if (name.empty())
 505     return SBOX_ERROR_INVALID_APP_CONTAINER;
 506
 507   return DeleteAppContainer(sid);
 508 }
 509
 510 }  // namespace sandbox