sandbox/win/src/registry_interception.cc

   1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/win/src/registry_interception.h"
   6
   7 #include "sandbox/win/src/crosscall_client.h"
   8 #include "sandbox/win/src/ipc_tags.h"
   9 #include "sandbox/win/src/policy_params.h"
  10 #include "sandbox/win/src/policy_target.h"
  11 #include "sandbox/win/src/sandbox_factory.h"
  12 #include "sandbox/win/src/sandbox_nt_util.h"
  13 #include "sandbox/win/src/sharedmem_ipc_client.h"
  14 #include "sandbox/win/src/target_services.h"
  15
  16 namespace sandbox {
  17
  18 NTSTATUS WINAPI TargetNtCreateKey(NtCreateKeyFunction orig_CreateKey,
  19                                   PHANDLE key, ACCESS_MASK desired_access,
  20                                   POBJECT_ATTRIBUTES object_attributes,
  21                                   ULONG title_index, PUNICODE_STRING class_name,
  22                                   ULONG create_options, PULONG disposition) {
  23   // Check if the process can create it first.
  24   NTSTATUS status = orig_CreateKey(key, desired_access, object_attributes,
  25                                    title_index, class_name, create_options,
  26                                    disposition);
  27   if (NT_SUCCESS(status))
  28     return status;
  29
  30   // We don't trust that the IPC can work this early.
  31   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
  32     return status;
  33
  34   do {
  35     if (!ValidParameter(key, sizeof(HANDLE), WRITE))
  36       break;
  37
  38     if (disposition && !ValidParameter(disposition, sizeof(ULONG), WRITE))
  39       break;
  40
  41     // At this point we don't support class_name.
  42     if (class_name && class_name->Buffer && class_name->Length)
  43       break;
  44
  45     // We don't support creating link keys, volatile keys and backup/restore.
  46     if (create_options)
  47       break;
  48
  49     void* memory = GetGlobalIPCMemory();
  50     if (NULL == memory)
  51       break;
  52
  53     wchar_t* name;
  54     uint32 attributes = 0;
  55     HANDLE root_directory = 0;
  56     NTSTATUS ret = AllocAndCopyName(object_attributes, &name, &attributes,
  57                                     &root_directory);
  58     if (!NT_SUCCESS(ret) || NULL == name)
  59       break;
  60
  61     uint32 desired_access_uint32 = desired_access;
  62     CountedParameterSet<OpenKey> params;
  63     params[OpenKey::ACCESS] = ParamPickerMake(desired_access_uint32);
  64
  65     wchar_t* full_name = NULL;
  66
  67     if (root_directory) {
  68       ret = sandbox::AllocAndGetFullPath(root_directory, name, &full_name);
  69       if (!NT_SUCCESS(ret) || NULL == full_name)
  70         break;
  71       params[OpenKey::NAME] = ParamPickerMake(full_name);
  72     } else {
  73       params[OpenKey::NAME] = ParamPickerMake(name);
  74     }
  75
  76     bool query_broker = QueryBroker(IPC_NTCREATEKEY_TAG, params.GetBase());
  77
  78     if (full_name != NULL)
  79       operator delete(full_name, NT_ALLOC);
  80
  81     if (!query_broker)
  82       break;
  83
  84     SharedMemIPCClient ipc(memory);
  85     CrossCallReturn answer = {0};
  86
  87     ResultCode code = CrossCall(ipc, IPC_NTCREATEKEY_TAG, name, attributes,
  88                                 root_directory, desired_access, title_index,
  89                                 create_options, &answer);
  90
  91     operator delete(name, NT_ALLOC);
  92
  93     if (SBOX_ALL_OK != code)
  94       break;
  95
  96     if (!NT_SUCCESS(answer.nt_status))
  97         // TODO(nsylvain): We should return answer.nt_status here instead
  98         // of status. We can do this only after we checked the policy.
  99         // otherwise we will returns ACCESS_DENIED for all paths
 100         // that are not specified by a policy, even though your token allows
 101         // access to that path, and the original call had a more meaningful
 102         // error. Bug 4369
 103         break;
 104
 105     __try {
 106       *key = answer.handle;
 107
 108       if (disposition)
 109        *disposition = answer.extended[0].unsigned_int;
 110
 111       status = answer.nt_status;
 112     } __except(EXCEPTION_EXECUTE_HANDLER) {
 113       break;
 114     }
 115   } while (false);
 116
 117   return status;
 118 }
 119
 120 NTSTATUS WINAPI CommonNtOpenKey(NTSTATUS status, PHANDLE key,
 121                                 ACCESS_MASK desired_access,
 122                                 POBJECT_ATTRIBUTES object_attributes) {
 123   // We don't trust that the IPC can work this early.
 124   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
 125     return status;
 126
 127   do {
 128     if (!ValidParameter(key, sizeof(HANDLE), WRITE))
 129       break;
 130
 131     void* memory = GetGlobalIPCMemory();
 132     if (NULL == memory)
 133       break;
 134
 135     wchar_t* name;
 136     uint32 attributes;
 137     HANDLE root_directory;
 138     NTSTATUS ret = AllocAndCopyName(object_attributes, &name, &attributes,
 139                                     &root_directory);
 140     if (!NT_SUCCESS(ret) || NULL == name)
 141       break;
 142
 143     uint32 desired_access_uint32 = desired_access;
 144     CountedParameterSet<OpenKey> params;
 145     params[OpenKey::ACCESS] = ParamPickerMake(desired_access_uint32);
 146
 147     wchar_t* full_name = NULL;
 148
 149     if (root_directory) {
 150       ret = sandbox::AllocAndGetFullPath(root_directory, name, &full_name);
 151       if (!NT_SUCCESS(ret) || NULL == full_name)
 152         break;
 153       params[OpenKey::NAME] = ParamPickerMake(full_name);
 154     } else {
 155       params[OpenKey::NAME] = ParamPickerMake(name);
 156     }
 157
 158     bool query_broker = QueryBroker(IPC_NTOPENKEY_TAG, params.GetBase());
 159
 160     if (full_name != NULL)
 161       operator delete(full_name, NT_ALLOC);
 162
 163     if (!query_broker)
 164       break;
 165
 166     SharedMemIPCClient ipc(memory);
 167     CrossCallReturn answer = {0};
 168     ResultCode code = CrossCall(ipc, IPC_NTOPENKEY_TAG, name, attributes,
 169                                 root_directory, desired_access, &answer);
 170
 171     operator delete(name, NT_ALLOC);
 172
 173     if (SBOX_ALL_OK != code)
 174       break;
 175
 176     if (!NT_SUCCESS(answer.nt_status))
 177         // TODO(nsylvain): We should return answer.nt_status here instead
 178         // of status. We can do this only after we checked the policy.
 179         // otherwise we will returns ACCESS_DENIED for all paths
 180         // that are not specified by a policy, even though your token allows
 181         // access to that path, and the original call had a more meaningful
 182         // error. Bug 4369
 183         break;
 184
 185     __try {
 186       *key = answer.handle;
 187       status = answer.nt_status;
 188     } __except(EXCEPTION_EXECUTE_HANDLER) {
 189       break;
 190     }
 191   } while (false);
 192
 193   return status;
 194 }
 195
 196 NTSTATUS WINAPI TargetNtOpenKey(NtOpenKeyFunction orig_OpenKey, PHANDLE key,
 197                                 ACCESS_MASK desired_access,
 198                                 POBJECT_ATTRIBUTES object_attributes) {
 199   // Check if the process can open it first.
 200   NTSTATUS status = orig_OpenKey(key, desired_access, object_attributes);
 201   if (NT_SUCCESS(status))
 202     return status;
 203
 204   return CommonNtOpenKey(status, key, desired_access, object_attributes);
 205 }
 206
 207 NTSTATUS WINAPI TargetNtOpenKeyEx(NtOpenKeyExFunction orig_OpenKeyEx,
 208                                   PHANDLE key, ACCESS_MASK desired_access,
 209                                   POBJECT_ATTRIBUTES object_attributes,
 210                                   ULONG open_options) {
 211   // Check if the process can open it first.
 212   NTSTATUS status = orig_OpenKeyEx(key, desired_access, object_attributes,
 213                                    open_options);
 214
 215   // We do not support open_options at this time. The 2 current known values
 216   // are REG_OPTION_CREATE_LINK, to open a symbolic link, and
 217   // REG_OPTION_BACKUP_RESTORE to open the key with special privileges.
 218   if (NT_SUCCESS(status) || open_options != 0)
 219     return status;
 220
 221   return CommonNtOpenKey(status, key, desired_access, object_attributes);
 222 }
 223
 224 }  // namespace sandbox