sandbox/win/src/acl.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/win/src/acl.h"
   6
   7 #include <aclapi.h>
   8 #include <sddl.h>
   9
  10 #include "base/logging.h"
  11
  12 namespace sandbox {
  13
  14 bool GetDefaultDacl(
  15     HANDLE token,
  16     scoped_ptr<TOKEN_DEFAULT_DACL, base::FreeDeleter>* default_dacl) {
  17   if (token == NULL)
  18     return false;
  19
  20   DCHECK(default_dacl != NULL);
  21
  22   unsigned long length = 0;
  23   ::GetTokenInformation(token, TokenDefaultDacl, NULL, 0, &length);
  24   if (length == 0) {
  25     NOTREACHED();
  26     return false;
  27   }
  28
  29   TOKEN_DEFAULT_DACL* acl =
  30       reinterpret_cast<TOKEN_DEFAULT_DACL*>(malloc(length));
  31   default_dacl->reset(acl);
  32
  33   if (!::GetTokenInformation(token, TokenDefaultDacl, default_dacl->get(),
  34                              length, &length))
  35       return false;
  36
  37   return true;
  38 }
  39
  40 bool AddSidToDacl(const Sid& sid, ACL* old_dacl, ACCESS_MODE access_mode,
  41                   ACCESS_MASK access, ACL** new_dacl) {
  42   EXPLICIT_ACCESS new_access = {0};
  43   new_access.grfAccessMode = access_mode;
  44   new_access.grfAccessPermissions = access;
  45   new_access.grfInheritance = NO_INHERITANCE;
  46
  47   new_access.Trustee.pMultipleTrustee = NULL;
  48   new_access.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
  49   new_access.Trustee.TrusteeForm = TRUSTEE_IS_SID;
  50   new_access.Trustee.ptstrName = reinterpret_cast<LPWSTR>(
  51                                     const_cast<SID*>(sid.GetPSID()));
  52
  53   if (ERROR_SUCCESS != ::SetEntriesInAcl(1, &new_access, old_dacl, new_dacl))
  54     return false;
  55
  56   return true;
  57 }
  58
  59 bool AddSidToDefaultDacl(HANDLE token, const Sid& sid, ACCESS_MASK access) {
  60   if (token == NULL)
  61     return false;
  62
  63   scoped_ptr<TOKEN_DEFAULT_DACL, base::FreeDeleter> default_dacl;
  64   if (!GetDefaultDacl(token, &default_dacl))
  65     return false;
  66
  67   ACL* new_dacl = NULL;
  68   if (!AddSidToDacl(sid, default_dacl->DefaultDacl, GRANT_ACCESS, access,
  69                     &new_dacl))
  70     return false;
  71
  72   TOKEN_DEFAULT_DACL new_token_dacl = {0};
  73   new_token_dacl.DefaultDacl = new_dacl;
  74
  75   BOOL ret = ::SetTokenInformation(token, TokenDefaultDacl, &new_token_dacl,
  76                                    sizeof(new_token_dacl));
  77   ::LocalFree(new_dacl);
  78   return (TRUE == ret);
  79 }
  80
  81 bool AddUserSidToDefaultDacl(HANDLE token, ACCESS_MASK access) {
  82   DWORD size = sizeof(TOKEN_USER) + SECURITY_MAX_SID_SIZE;
  83   TOKEN_USER* token_user = reinterpret_cast<TOKEN_USER*>(malloc(size));
  84
  85   scoped_ptr<TOKEN_USER, base::FreeDeleter> token_user_ptr(token_user);
  86
  87   if (!::GetTokenInformation(token, TokenUser, token_user, size, &size))
  88     return false;
  89
  90   return AddSidToDefaultDacl(token,
  91                              reinterpret_cast<SID*>(token_user->User.Sid),
  92                              access);
  93 }
  94
  95 bool AddKnownSidToObject(HANDLE object, SE_OBJECT_TYPE object_type,
  96                          const Sid& sid, ACCESS_MODE access_mode,
  97                          ACCESS_MASK access) {
  98   PSECURITY_DESCRIPTOR descriptor = NULL;
  99   PACL old_dacl = NULL;
 100   PACL new_dacl = NULL;
 101
 102   if (ERROR_SUCCESS != ::GetSecurityInfo(object, object_type,
 103                                          DACL_SECURITY_INFORMATION, NULL, NULL,
 104                                          &old_dacl, NULL, &descriptor))
 105     return false;
 106
 107   if (!AddSidToDacl(sid.GetPSID(), old_dacl, access_mode, access, &new_dacl)) {
 108     ::LocalFree(descriptor);
 109     return false;
 110   }
 111
 112   DWORD result = ::SetSecurityInfo(object, object_type,
 113                                    DACL_SECURITY_INFORMATION, NULL, NULL,
 114                                    new_dacl, NULL);
 115
 116   ::LocalFree(new_dacl);
 117   ::LocalFree(descriptor);
 118
 119   if (ERROR_SUCCESS != result)
 120     return false;
 121
 122   return true;
 123 }
 124
 125 }  // namespace sandbox