sandbox/win/src/process_thread_interception.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/win/src/process_thread_interception.h"
   6
   7 #include "sandbox/win/src/crosscall_client.h"
   8 #include "sandbox/win/src/ipc_tags.h"
   9 #include "sandbox/win/src/policy_params.h"
  10 #include "sandbox/win/src/policy_target.h"
  11 #include "sandbox/win/src/sandbox_factory.h"
  12 #include "sandbox/win/src/sandbox_nt_util.h"
  13 #include "sandbox/win/src/sharedmem_ipc_client.h"
  14 #include "sandbox/win/src/target_services.h"
  15
  16 namespace sandbox {
  17
  18 SANDBOX_INTERCEPT NtExports g_nt;
  19
  20 // Hooks NtOpenThread and proxy the call to the broker if it's trying to
  21 // open a thread in the same process.
  22 NTSTATUS WINAPI TargetNtOpenThread(NtOpenThreadFunction orig_OpenThread,
  23                                    PHANDLE thread, ACCESS_MASK desired_access,
  24                                    POBJECT_ATTRIBUTES object_attributes,
  25                                    PCLIENT_ID client_id) {
  26   NTSTATUS status = orig_OpenThread(thread, desired_access, object_attributes,
  27                                     client_id);
  28   if (NT_SUCCESS(status))
  29     return status;
  30
  31   do {
  32     if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  33       break;
  34     if (!client_id)
  35       break;
  36
  37     uint32 thread_id = 0;
  38     bool should_break = false;
  39     __try {
  40       // We support only the calls for the current process
  41       if (NULL != client_id->UniqueProcess)
  42         should_break = true;
  43
  44       // Object attributes should be NULL or empty.
  45       if (!should_break && NULL != object_attributes) {
  46         if (0 != object_attributes->Attributes ||
  47             NULL != object_attributes->ObjectName ||
  48             NULL != object_attributes->RootDirectory ||
  49             NULL != object_attributes->SecurityDescriptor ||
  50             NULL != object_attributes->SecurityQualityOfService) {
  51           should_break = true;
  52         }
  53       }
  54
  55       thread_id = static_cast<uint32>(
  56                       reinterpret_cast<ULONG_PTR>(client_id->UniqueThread));
  57     } __except(EXCEPTION_EXECUTE_HANDLER) {
  58       break;
  59     }
  60
  61     if (should_break)
  62       break;
  63
  64     if (!ValidParameter(thread, sizeof(HANDLE), WRITE))
  65       break;
  66
  67     void* memory = GetGlobalIPCMemory();
  68     if (NULL == memory)
  69       break;
  70
  71     SharedMemIPCClient ipc(memory);
  72     CrossCallReturn answer = {0};
  73     ResultCode code = CrossCall(ipc, IPC_NTOPENTHREAD_TAG, desired_access,
  74                                 thread_id, &answer);
  75     if (SBOX_ALL_OK != code)
  76       break;
  77
  78     if (!NT_SUCCESS(answer.nt_status))
  79       // The nt_status here is most likely STATUS_INVALID_CID because
  80       // in the broker we set the process id in the CID (client ID) param
  81       // to be the current process. If you try to open a thread from another
  82       // process you will get this INVALID_CID error. On the other hand, if you
  83       // try to open a thread in your own process, it should return success.
  84       // We don't want to return STATUS_INVALID_CID here, so we return the
  85       // return of the original open thread status, which is most likely
  86       // STATUS_ACCESS_DENIED.
  87       break;
  88
  89     __try {
  90       // Write the output parameters.
  91       *thread = answer.handle;
  92     } __except(EXCEPTION_EXECUTE_HANDLER) {
  93       break;
  94     }
  95
  96     return answer.nt_status;
  97   } while (false);
  98
  99   return status;
 100 }
 101
 102 // Hooks NtOpenProcess and proxy the call to the broker if it's trying to
 103 // open the current process.
 104 NTSTATUS WINAPI TargetNtOpenProcess(NtOpenProcessFunction orig_OpenProcess,
 105                                    PHANDLE process, ACCESS_MASK desired_access,
 106                                    POBJECT_ATTRIBUTES object_attributes,
 107                                    PCLIENT_ID client_id) {
 108   NTSTATUS status = orig_OpenProcess(process, desired_access, object_attributes,
 109                                      client_id);
 110   if (NT_SUCCESS(status))
 111     return status;
 112
 113   do {
 114     if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
 115       break;
 116     if (!client_id)
 117       break;
 118
 119     uint32 process_id = 0;
 120     bool should_break = false;
 121     __try {
 122       // Object attributes should be NULL or empty.
 123       if (!should_break && NULL != object_attributes) {
 124         if (0 != object_attributes->Attributes ||
 125             NULL != object_attributes->ObjectName ||
 126             NULL != object_attributes->RootDirectory ||
 127             NULL != object_attributes->SecurityDescriptor ||
 128             NULL != object_attributes->SecurityQualityOfService) {
 129           should_break = true;
 130         }
 131       }
 132
 133       process_id = static_cast<uint32>(
 134                       reinterpret_cast<ULONG_PTR>(client_id->UniqueProcess));
 135     } __except(EXCEPTION_EXECUTE_HANDLER) {
 136       break;
 137     }
 138
 139     if (should_break)
 140       break;
 141
 142     if (!ValidParameter(process, sizeof(HANDLE), WRITE))
 143       break;
 144
 145     void* memory = GetGlobalIPCMemory();
 146     if (NULL == memory)
 147       break;
 148
 149     SharedMemIPCClient ipc(memory);
 150     CrossCallReturn answer = {0};
 151     ResultCode code = CrossCall(ipc, IPC_NTOPENPROCESS_TAG, desired_access,
 152                                 process_id, &answer);
 153     if (SBOX_ALL_OK != code)
 154       break;
 155
 156     if (!NT_SUCCESS(answer.nt_status))
 157       return answer.nt_status;
 158
 159     __try {
 160       // Write the output parameters.
 161       *process = answer.handle;
 162     } __except(EXCEPTION_EXECUTE_HANDLER) {
 163       break;
 164     }
 165
 166     return answer.nt_status;
 167   } while (false);
 168
 169   return status;
 170 }
 171
 172
 173 NTSTATUS WINAPI TargetNtOpenProcessToken(
 174     NtOpenProcessTokenFunction orig_OpenProcessToken, HANDLE process,
 175     ACCESS_MASK desired_access, PHANDLE token) {
 176   NTSTATUS status = orig_OpenProcessToken(process, desired_access, token);
 177   if (NT_SUCCESS(status))
 178     return status;
 179
 180   do {
 181     if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
 182       break;
 183
 184     if (CURRENT_PROCESS != process)
 185       break;
 186
 187     if (!ValidParameter(token, sizeof(HANDLE), WRITE))
 188       break;
 189
 190     void* memory = GetGlobalIPCMemory();
 191     if (NULL == memory)
 192       break;
 193
 194     SharedMemIPCClient ipc(memory);
 195     CrossCallReturn answer = {0};
 196     ResultCode code = CrossCall(ipc, IPC_NTOPENPROCESSTOKEN_TAG, process,
 197                                 desired_access, &answer);
 198     if (SBOX_ALL_OK != code)
 199       break;
 200
 201     if (!NT_SUCCESS(answer.nt_status))
 202       return answer.nt_status;
 203
 204     __try {
 205       // Write the output parameters.
 206       *token = answer.handle;
 207     } __except(EXCEPTION_EXECUTE_HANDLER) {
 208       break;
 209     }
 210
 211     return answer.nt_status;
 212   } while (false);
 213
 214   return status;
 215 }
 216
 217 NTSTATUS WINAPI TargetNtOpenProcessTokenEx(
 218     NtOpenProcessTokenExFunction orig_OpenProcessTokenEx, HANDLE process,
 219     ACCESS_MASK desired_access, ULONG handle_attributes, PHANDLE token) {
 220   NTSTATUS status = orig_OpenProcessTokenEx(process, desired_access,
 221                                             handle_attributes, token);
 222   if (NT_SUCCESS(status))
 223     return status;
 224
 225   do {
 226     if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
 227       break;
 228
 229     if (CURRENT_PROCESS != process)
 230       break;
 231
 232     if (!ValidParameter(token, sizeof(HANDLE), WRITE))
 233       break;
 234
 235     void* memory = GetGlobalIPCMemory();
 236     if (NULL == memory)
 237       break;
 238
 239     SharedMemIPCClient ipc(memory);
 240     CrossCallReturn answer = {0};
 241     ResultCode code = CrossCall(ipc, IPC_NTOPENPROCESSTOKENEX_TAG, process,
 242                                 desired_access, handle_attributes, &answer);
 243     if (SBOX_ALL_OK != code)
 244       break;
 245
 246     if (!NT_SUCCESS(answer.nt_status))
 247       return answer.nt_status;
 248
 249     __try {
 250       // Write the output parameters.
 251       *token = answer.handle;
 252     } __except(EXCEPTION_EXECUTE_HANDLER) {
 253       break;
 254     }
 255
 256     return answer.nt_status;
 257   } while (false);
 258
 259   return status;
 260 }
 261
 262 BOOL WINAPI TargetCreateProcessW(CreateProcessWFunction orig_CreateProcessW,
 263                                  LPCWSTR application_name, LPWSTR command_line,
 264                                  LPSECURITY_ATTRIBUTES process_attributes,
 265                                  LPSECURITY_ATTRIBUTES thread_attributes,
 266                                  BOOL inherit_handles, DWORD flags,
 267                                  LPVOID environment, LPCWSTR current_directory,
 268                                  LPSTARTUPINFOW startup_info,
 269                                  LPPROCESS_INFORMATION process_information) {
 270   if (orig_CreateProcessW(application_name, command_line, process_attributes,
 271                           thread_attributes, inherit_handles, flags,
 272                           environment, current_directory, startup_info,
 273                           process_information)) {
 274     return TRUE;
 275   }
 276
 277   // We don't trust that the IPC can work this early.
 278   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
 279     return FALSE;
 280
 281   DWORD original_error = ::GetLastError();
 282
 283   do {
 284     if (!ValidParameter(process_information, sizeof(PROCESS_INFORMATION),
 285                         WRITE))
 286       break;
 287
 288     void* memory = GetGlobalIPCMemory();
 289     if (NULL == memory)
 290       break;
 291
 292     const wchar_t* cur_dir = NULL;
 293
 294     wchar_t current_directory[MAX_PATH];
 295     DWORD result = ::GetCurrentDirectory(MAX_PATH, current_directory);
 296     if (0 != result && result < MAX_PATH)
 297       cur_dir = current_directory;
 298
 299     SharedMemIPCClient ipc(memory);
 300     CrossCallReturn answer = {0};
 301
 302     InOutCountedBuffer proc_info(process_information,
 303                                  sizeof(PROCESS_INFORMATION));
 304
 305     ResultCode code = CrossCall(ipc, IPC_CREATEPROCESSW_TAG, application_name,
 306                                 command_line, cur_dir, proc_info, &answer);
 307     if (SBOX_ALL_OK != code)
 308       break;
 309
 310     ::SetLastError(answer.win32_result);
 311     if (ERROR_SUCCESS != answer.win32_result)
 312       return FALSE;
 313
 314     return TRUE;
 315   } while (false);
 316
 317   ::SetLastError(original_error);
 318   return FALSE;
 319 }
 320
 321 BOOL WINAPI TargetCreateProcessA(CreateProcessAFunction orig_CreateProcessA,
 322                                  LPCSTR application_name, LPSTR command_line,
 323                                  LPSECURITY_ATTRIBUTES process_attributes,
 324                                  LPSECURITY_ATTRIBUTES thread_attributes,
 325                                  BOOL inherit_handles, DWORD flags,
 326                                  LPVOID environment, LPCSTR current_directory,
 327                                  LPSTARTUPINFOA startup_info,
 328                                  LPPROCESS_INFORMATION process_information) {
 329   if (orig_CreateProcessA(application_name, command_line, process_attributes,
 330                           thread_attributes, inherit_handles, flags,
 331                           environment, current_directory, startup_info,
 332                           process_information)) {
 333     return TRUE;
 334   }
 335
 336   // We don't trust that the IPC can work this early.
 337   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
 338     return FALSE;
 339
 340   DWORD original_error = ::GetLastError();
 341
 342   do {
 343     if (!ValidParameter(process_information, sizeof(PROCESS_INFORMATION),
 344                         WRITE))
 345       break;
 346
 347     void* memory = GetGlobalIPCMemory();
 348     if (NULL == memory)
 349       break;
 350
 351     // Convert the input params to unicode.
 352     UNICODE_STRING *cmd_unicode = NULL;
 353     UNICODE_STRING *app_unicode = NULL;
 354     if (command_line) {
 355       cmd_unicode = AnsiToUnicode(command_line);
 356       if (!cmd_unicode)
 357         break;
 358     }
 359
 360     if (application_name) {
 361       app_unicode = AnsiToUnicode(application_name);
 362       if (!app_unicode) {
 363         operator delete(cmd_unicode, NT_ALLOC);
 364         break;
 365       }
 366     }
 367
 368     const wchar_t* cmd_line = cmd_unicode ? cmd_unicode->Buffer : NULL;
 369     const wchar_t* app_name = app_unicode ? app_unicode->Buffer : NULL;
 370     const wchar_t* cur_dir = NULL;
 371
 372     wchar_t current_directory[MAX_PATH];
 373     DWORD result = ::GetCurrentDirectory(MAX_PATH, current_directory);
 374     if (0 != result && result < MAX_PATH)
 375       cur_dir = current_directory;
 376
 377     SharedMemIPCClient ipc(memory);
 378     CrossCallReturn answer = {0};
 379
 380     InOutCountedBuffer proc_info(process_information,
 381                                  sizeof(PROCESS_INFORMATION));
 382
 383     ResultCode code = CrossCall(ipc, IPC_CREATEPROCESSW_TAG, app_name,
 384                                 cmd_line, cur_dir, proc_info, &answer);
 385
 386     operator delete(cmd_unicode, NT_ALLOC);
 387     operator delete(app_unicode, NT_ALLOC);
 388
 389     if (SBOX_ALL_OK != code)
 390       break;
 391
 392     ::SetLastError(answer.win32_result);
 393     if (ERROR_SUCCESS != answer.win32_result)
 394       return FALSE;
 395
 396     return TRUE;
 397   } while (false);
 398
 399   ::SetLastError(original_error);
 400   return FALSE;
 401 }
 402
 403 // Creates a thread without registering with CSRSS. This is required if we
 404 // closed the CSRSS ALPC port after lockdown.
 405 HANDLE WINAPI TargetCreateThread(CreateThreadFunction orig_CreateThread,
 406                                  LPSECURITY_ATTRIBUTES thread_attributes,
 407                                  SIZE_T stack_size,
 408                                  LPTHREAD_START_ROUTINE start_address,
 409                                  PVOID parameter,
 410                                  DWORD creation_flags,
 411                                  LPDWORD thread_id) {
 412 // Try the normal CreateThread; switch to RtlCreateUserThread if needed.
 413   static bool use_create_thread = true;
 414   HANDLE thread;
 415   if (use_create_thread) {
 416     thread = orig_CreateThread(thread_attributes, stack_size, start_address,
 417                                parameter, creation_flags, thread_id);
 418     if (thread)
 419       return thread;
 420   }
 421
 422   PSECURITY_DESCRIPTOR sd =
 423       thread_attributes ? thread_attributes->lpSecurityDescriptor : NULL;
 424   CLIENT_ID client_id;
 425
 426   NTSTATUS result = g_nt.RtlCreateUserThread(NtCurrentProcess, sd,
 427                                              creation_flags & CREATE_SUSPENDED,
 428                                              0, stack_size, 0, start_address,
 429                                              parameter, &thread, &client_id);
 430   if (!NT_SUCCESS(result))
 431     return 0;
 432
 433   // CSRSS is closed if we got here, so use RtlCreateUserThread from here on.
 434   use_create_thread = false;
 435   if (thread_id)
 436     *thread_id = HandleToUlong(client_id.UniqueThread);
 437   return thread;
 438 }
 439
 440 // Cache the default LCID to avoid pinging CSRSS after lockdown.
 441 // TODO(jschuh): This approach will miss a default locale changes after
 442 // lockdown. In the future we may want to have the broker check instead.
 443 LCID WINAPI TargetGetUserDefaultLCID(
 444     GetUserDefaultLCIDFunction orig_GetUserDefaultLCID) {
 445   static LCID default_lcid = orig_GetUserDefaultLCID();
 446   return default_lcid;
 447 }
 448
 449 }  // namespace sandbox