sandbox/win/src/integrity_level_test.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <windows.h>
   6 #include <atlsecurity.h>
   7
   8 #include "base/win/windows_version.h"
   9 #include "testing/gtest/include/gtest/gtest.h"
  10 #include "sandbox/win/src/sandbox.h"
  11 #include "sandbox/win/src/sandbox_policy.h"
  12 #include "sandbox/win/src/sandbox_factory.h"
  13 #include "sandbox/win/tests/common/controller.h"
  14
  15 namespace sandbox {
  16
  17
  18 SBOX_TESTS_COMMAND int CheckIntegrityLevel(int argc, wchar_t **argv) {
  19   ATL::CAccessToken token;
  20   if (!token.GetEffectiveToken(TOKEN_READ))
  21     return SBOX_TEST_FAILED;
  22
  23   char* buffer[100];
  24   DWORD buf_size = 100;
  25   if (!::GetTokenInformation(token.GetHandle(), TokenIntegrityLevel,
  26                              reinterpret_cast<void*>(buffer), buf_size,
  27                              &buf_size))
  28     return SBOX_TEST_FAILED;
  29
  30   TOKEN_MANDATORY_LABEL* label =
  31       reinterpret_cast<TOKEN_MANDATORY_LABEL*>(buffer);
  32
  33   PSID sid_low = NULL;
  34   if (!::ConvertStringSidToSid(L"S-1-16-4096", &sid_low))
  35     return SBOX_TEST_FAILED;
  36
  37   BOOL is_low_sid = ::EqualSid(label->Label.Sid, sid_low);
  38
  39   ::LocalFree(sid_low);
  40
  41   if (is_low_sid)
  42     return SBOX_TEST_SUCCEEDED;
  43
  44   return SBOX_TEST_DENIED;
  45 }
  46
  47 TEST(IntegrityLevelTest, TestLowILReal) {
  48   if (base::win::GetVersion() != base::win::VERSION_VISTA)
  49     return;
  50
  51   TestRunner runner(JOB_LOCKDOWN, USER_INTERACTIVE, USER_INTERACTIVE);
  52
  53   runner.SetTimeout(INFINITE);
  54
  55   runner.GetPolicy()->SetIntegrityLevel(INTEGRITY_LEVEL_LOW);
  56
  57   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckIntegrityLevel"));
  58
  59   runner.SetTestState(BEFORE_REVERT);
  60   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckIntegrityLevel"));
  61 }
  62
  63 TEST(DelayedIntegrityLevelTest, TestLowILDelayed) {
  64   if (base::win::GetVersion() != base::win::VERSION_VISTA)
  65     return;
  66
  67   TestRunner runner(JOB_LOCKDOWN, USER_INTERACTIVE, USER_INTERACTIVE);
  68
  69   runner.SetTimeout(INFINITE);
  70
  71   runner.GetPolicy()->SetDelayedIntegrityLevel(INTEGRITY_LEVEL_LOW);
  72
  73   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckIntegrityLevel"));
  74
  75   runner.SetTestState(BEFORE_REVERT);
  76   EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"CheckIntegrityLevel"));
  77 }
  78
  79 TEST(IntegrityLevelTest, TestNoILChange) {
  80   if (base::win::GetVersion() != base::win::VERSION_VISTA)
  81     return;
  82
  83   TestRunner runner(JOB_LOCKDOWN, USER_INTERACTIVE, USER_INTERACTIVE);
  84
  85   runner.SetTimeout(INFINITE);
  86
  87   EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"CheckIntegrityLevel"));
  88 }
  89
  90 }  // namespace sandbox