sandbox/win/src/sandbox_policy_base.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/win/src/sandbox_policy_base.h"
   6
   7 #include <sddl.h>
   8
   9 #include "base/basictypes.h"
  10 #include "base/callback.h"
  11 #include "base/logging.h"
  12 #include "base/win/windows_version.h"
  13 #include "sandbox/win/src/app_container.h"
  14 #include "sandbox/win/src/filesystem_dispatcher.h"
  15 #include "sandbox/win/src/filesystem_policy.h"
  16 #include "sandbox/win/src/handle_dispatcher.h"
  17 #include "sandbox/win/src/handle_policy.h"
  18 #include "sandbox/win/src/job.h"
  19 #include "sandbox/win/src/interception.h"
  20 #include "sandbox/win/src/process_mitigations.h"
  21 #include "sandbox/win/src/named_pipe_dispatcher.h"
  22 #include "sandbox/win/src/named_pipe_policy.h"
  23 #include "sandbox/win/src/policy_broker.h"
  24 #include "sandbox/win/src/policy_engine_processor.h"
  25 #include "sandbox/win/src/policy_low_level.h"
  26 #include "sandbox/win/src/process_mitigations_win32k_dispatcher.h"
  27 #include "sandbox/win/src/process_mitigations_win32k_policy.h"
  28 #include "sandbox/win/src/process_thread_dispatcher.h"
  29 #include "sandbox/win/src/process_thread_policy.h"
  30 #include "sandbox/win/src/registry_dispatcher.h"
  31 #include "sandbox/win/src/registry_policy.h"
  32 #include "sandbox/win/src/restricted_token_utils.h"
  33 #include "sandbox/win/src/sandbox_policy.h"
  34 #include "sandbox/win/src/sync_dispatcher.h"
  35 #include "sandbox/win/src/sync_policy.h"
  36 #include "sandbox/win/src/target_process.h"
  37 #include "sandbox/win/src/window.h"
  38
  39 namespace {
  40
  41 // The standard windows size for one memory page.
  42 const size_t kOneMemPage = 4096;
  43 // The IPC and Policy shared memory sizes.
  44 const size_t kIPCMemSize = kOneMemPage * 2;
  45 const size_t kPolMemSize = kOneMemPage * 14;
  46
  47 // Helper function to allocate space (on the heap) for policy.
  48 sandbox::PolicyGlobal* MakeBrokerPolicyMemory() {
  49   const size_t kTotalPolicySz = kPolMemSize;
  50   sandbox::PolicyGlobal* policy = static_cast<sandbox::PolicyGlobal*>
  51       (::operator new(kTotalPolicySz));
  52   DCHECK(policy);
  53   memset(policy, 0, kTotalPolicySz);
  54   policy->data_size = kTotalPolicySz - sizeof(sandbox::PolicyGlobal);
  55   return policy;
  56 }
  57
  58 bool IsInheritableHandle(HANDLE handle) {
  59   if (!handle)
  60     return false;
  61   if (handle == INVALID_HANDLE_VALUE)
  62     return false;
  63   // File handles (FILE_TYPE_DISK) and pipe handles are known to be
  64   // inheritable.  Console handles (FILE_TYPE_CHAR) are not
  65   // inheritable via PROC_THREAD_ATTRIBUTE_HANDLE_LIST.
  66   DWORD handle_type = GetFileType(handle);
  67   return handle_type == FILE_TYPE_DISK || handle_type == FILE_TYPE_PIPE;
  68 }
  69
  70 }
  71
  72 namespace sandbox {
  73
  74 SANDBOX_INTERCEPT IntegrityLevel g_shared_delayed_integrity_level;
  75 SANDBOX_INTERCEPT MitigationFlags g_shared_delayed_mitigations;
  76
  77 // Initializes static members.
  78 HWINSTA PolicyBase::alternate_winstation_handle_ = NULL;
  79 HDESK PolicyBase::alternate_desktop_handle_ = NULL;
  80 IntegrityLevel PolicyBase::alternate_desktop_integrity_level_label_ =
  81     INTEGRITY_LEVEL_SYSTEM;
  82
  83 PolicyBase::PolicyBase()
  84     : ref_count(1),
  85       lockdown_level_(USER_LOCKDOWN),
  86       initial_level_(USER_LOCKDOWN),
  87       job_level_(JOB_LOCKDOWN),
  88       ui_exceptions_(0),
  89       memory_limit_(0),
  90       use_alternate_desktop_(false),
  91       use_alternate_winstation_(false),
  92       file_system_init_(false),
  93       relaxed_interceptions_(true),
  94       stdout_handle_(INVALID_HANDLE_VALUE),
  95       stderr_handle_(INVALID_HANDLE_VALUE),
  96       integrity_level_(INTEGRITY_LEVEL_LAST),
  97       delayed_integrity_level_(INTEGRITY_LEVEL_LAST),
  98       mitigations_(0),
  99       delayed_mitigations_(0),
 100       policy_maker_(NULL),
 101       policy_(NULL) {
 102   ::InitializeCriticalSection(&lock_);
 103   // Initialize the IPC dispatcher array.
 104   memset(&ipc_targets_, NULL, sizeof(ipc_targets_));
 105   Dispatcher* dispatcher = NULL;
 106
 107   dispatcher = new FilesystemDispatcher(this);
 108   ipc_targets_[IPC_NTCREATEFILE_TAG] = dispatcher;
 109   ipc_targets_[IPC_NTOPENFILE_TAG] = dispatcher;
 110   ipc_targets_[IPC_NTSETINFO_RENAME_TAG] = dispatcher;
 111   ipc_targets_[IPC_NTQUERYATTRIBUTESFILE_TAG] = dispatcher;
 112   ipc_targets_[IPC_NTQUERYFULLATTRIBUTESFILE_TAG] = dispatcher;
 113
 114   dispatcher = new NamedPipeDispatcher(this);
 115   ipc_targets_[IPC_CREATENAMEDPIPEW_TAG] = dispatcher;
 116
 117   dispatcher = new ThreadProcessDispatcher(this);
 118   ipc_targets_[IPC_NTOPENTHREAD_TAG] = dispatcher;
 119   ipc_targets_[IPC_NTOPENPROCESS_TAG] = dispatcher;
 120   ipc_targets_[IPC_CREATEPROCESSW_TAG] = dispatcher;
 121   ipc_targets_[IPC_NTOPENPROCESSTOKEN_TAG] = dispatcher;
 122   ipc_targets_[IPC_NTOPENPROCESSTOKENEX_TAG] = dispatcher;
 123
 124   dispatcher = new SyncDispatcher(this);
 125   ipc_targets_[IPC_CREATEEVENT_TAG] = dispatcher;
 126   ipc_targets_[IPC_OPENEVENT_TAG] = dispatcher;
 127
 128   dispatcher = new RegistryDispatcher(this);
 129   ipc_targets_[IPC_NTCREATEKEY_TAG] = dispatcher;
 130   ipc_targets_[IPC_NTOPENKEY_TAG] = dispatcher;
 131
 132   dispatcher = new HandleDispatcher(this);
 133   ipc_targets_[IPC_DUPLICATEHANDLEPROXY_TAG] = dispatcher;
 134
 135   dispatcher = new ProcessMitigationsWin32KDispatcher(this);
 136   ipc_targets_[IPC_GDI_GDIDLLINITIALIZE_TAG] = dispatcher;
 137   ipc_targets_[IPC_GDI_GETSTOCKOBJECT_TAG] = dispatcher;
 138   ipc_targets_[IPC_USER_REGISTERCLASSW_TAG] = dispatcher;
 139 }
 140
 141 PolicyBase::~PolicyBase() {
 142   TargetSet::iterator it;
 143   for (it = targets_.begin(); it != targets_.end(); ++it) {
 144     TargetProcess* target = (*it);
 145     delete target;
 146   }
 147   delete ipc_targets_[IPC_NTCREATEFILE_TAG];
 148   delete ipc_targets_[IPC_CREATENAMEDPIPEW_TAG];
 149   delete ipc_targets_[IPC_NTOPENTHREAD_TAG];
 150   delete ipc_targets_[IPC_CREATEEVENT_TAG];
 151   delete ipc_targets_[IPC_NTCREATEKEY_TAG];
 152   delete ipc_targets_[IPC_DUPLICATEHANDLEPROXY_TAG];
 153   delete policy_maker_;
 154   delete policy_;
 155   ::DeleteCriticalSection(&lock_);
 156 }
 157
 158 void PolicyBase::AddRef() {
 159   ::InterlockedIncrement(&ref_count);
 160 }
 161
 162 void PolicyBase::Release() {
 163   if (0 == ::InterlockedDecrement(&ref_count))
 164     delete this;
 165 }
 166
 167 ResultCode PolicyBase::SetTokenLevel(TokenLevel initial, TokenLevel lockdown) {
 168   if (initial < lockdown) {
 169     return SBOX_ERROR_BAD_PARAMS;
 170   }
 171   initial_level_ = initial;
 172   lockdown_level_ = lockdown;
 173   return SBOX_ALL_OK;
 174 }
 175
 176 TokenLevel PolicyBase::GetInitialTokenLevel() const {
 177   return initial_level_;
 178 }
 179
 180 TokenLevel PolicyBase::GetLockdownTokenLevel() const{
 181   return lockdown_level_;
 182 }
 183
 184 ResultCode PolicyBase::SetJobLevel(JobLevel job_level, uint32 ui_exceptions) {
 185   if (memory_limit_ && job_level == JOB_NONE) {
 186     return SBOX_ERROR_BAD_PARAMS;
 187   }
 188   job_level_ = job_level;
 189   ui_exceptions_ = ui_exceptions;
 190   return SBOX_ALL_OK;
 191 }
 192
 193 ResultCode PolicyBase::SetJobMemoryLimit(size_t memory_limit) {
 194   if (memory_limit && job_level_ == JOB_NONE) {
 195     return SBOX_ERROR_BAD_PARAMS;
 196   }
 197   memory_limit_ = memory_limit;
 198   return SBOX_ALL_OK;
 199 }
 200
 201 ResultCode PolicyBase::SetAlternateDesktop(bool alternate_winstation) {
 202   use_alternate_desktop_ = true;
 203   use_alternate_winstation_ = alternate_winstation;
 204   return CreateAlternateDesktop(alternate_winstation);
 205 }
 206
 207 base::string16 PolicyBase::GetAlternateDesktop() const {
 208   // No alternate desktop or winstation. Return an empty string.
 209   if (!use_alternate_desktop_ && !use_alternate_winstation_) {
 210     return base::string16();
 211   }
 212
 213   // The desktop and winstation should have been created by now.
 214   // If we hit this scenario, it means that the user ignored the failure
 215   // during SetAlternateDesktop, so we ignore it here too.
 216   if (use_alternate_desktop_ && !alternate_desktop_handle_) {
 217     return base::string16();
 218   }
 219   if (use_alternate_winstation_ && (!alternate_desktop_handle_ ||
 220                                     !alternate_winstation_handle_)) {
 221     return base::string16();
 222   }
 223
 224   return GetFullDesktopName(alternate_winstation_handle_,
 225                             alternate_desktop_handle_);
 226 }
 227
 228 ResultCode PolicyBase::CreateAlternateDesktop(bool alternate_winstation) {
 229   if (alternate_winstation) {
 230     // Previously called with alternate_winstation = false?
 231     if (!alternate_winstation_handle_ && alternate_desktop_handle_)
 232       return SBOX_ERROR_UNSUPPORTED;
 233
 234     // Check if it's already created.
 235     if (alternate_winstation_handle_ && alternate_desktop_handle_)
 236       return SBOX_ALL_OK;
 237
 238     DCHECK(!alternate_winstation_handle_);
 239     // Create the window station.
 240     ResultCode result = CreateAltWindowStation(&alternate_winstation_handle_);
 241     if (SBOX_ALL_OK != result)
 242       return result;
 243
 244     // Verify that everything is fine.
 245     if (!alternate_winstation_handle_ ||
 246         GetWindowObjectName(alternate_winstation_handle_).empty())
 247       return SBOX_ERROR_CANNOT_CREATE_DESKTOP;
 248
 249     // Create the destkop.
 250     result = CreateAltDesktop(alternate_winstation_handle_,
 251                               &alternate_desktop_handle_);
 252     if (SBOX_ALL_OK != result)
 253       return result;
 254
 255     // Verify that everything is fine.
 256     if (!alternate_desktop_handle_ ||
 257         GetWindowObjectName(alternate_desktop_handle_).empty())
 258       return SBOX_ERROR_CANNOT_CREATE_DESKTOP;
 259   } else {
 260     // Previously called with alternate_winstation = true?
 261     if (alternate_winstation_handle_)
 262       return SBOX_ERROR_UNSUPPORTED;
 263
 264     // Check if it already exists.
 265     if (alternate_desktop_handle_)
 266       return SBOX_ALL_OK;
 267
 268     // Create the destkop.
 269     ResultCode result = CreateAltDesktop(NULL, &alternate_desktop_handle_);
 270     if (SBOX_ALL_OK != result)
 271       return result;
 272
 273     // Verify that everything is fine.
 274     if (!alternate_desktop_handle_ ||
 275         GetWindowObjectName(alternate_desktop_handle_).empty())
 276       return SBOX_ERROR_CANNOT_CREATE_DESKTOP;
 277   }
 278
 279   return SBOX_ALL_OK;
 280 }
 281
 282 void PolicyBase::DestroyAlternateDesktop() {
 283   if (alternate_desktop_handle_) {
 284     ::CloseDesktop(alternate_desktop_handle_);
 285     alternate_desktop_handle_ = NULL;
 286   }
 287
 288   if (alternate_winstation_handle_) {
 289     ::CloseWindowStation(alternate_winstation_handle_);
 290     alternate_winstation_handle_ = NULL;
 291   }
 292 }
 293
 294 ResultCode PolicyBase::SetIntegrityLevel(IntegrityLevel integrity_level) {
 295   integrity_level_ = integrity_level;
 296   return SBOX_ALL_OK;
 297 }
 298
 299 IntegrityLevel PolicyBase::GetIntegrityLevel() const {
 300   return integrity_level_;
 301 }
 302
 303 ResultCode PolicyBase::SetDelayedIntegrityLevel(
 304     IntegrityLevel integrity_level) {
 305   delayed_integrity_level_ = integrity_level;
 306   return SBOX_ALL_OK;
 307 }
 308
 309 ResultCode PolicyBase::SetAppContainer(const wchar_t* sid) {
 310   if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
 311     return SBOX_ALL_OK;
 312
 313   // Windows refuses to work with an impersonation token for a process inside
 314   // an AppContainer. If the caller wants to use a more privileged initial
 315   // token, or if the lockdown level will prevent the process from starting,
 316   // we have to fail the operation.
 317   if (lockdown_level_ < USER_LIMITED || lockdown_level_ != initial_level_)
 318     return SBOX_ERROR_CANNOT_INIT_APPCONTAINER;
 319
 320   DCHECK(!appcontainer_list_.get());
 321   appcontainer_list_.reset(new AppContainerAttributes);
 322   ResultCode rv = appcontainer_list_->SetAppContainer(sid, capabilities_);
 323   if (rv != SBOX_ALL_OK)
 324     return rv;
 325
 326   return SBOX_ALL_OK;
 327 }
 328
 329 ResultCode PolicyBase::SetCapability(const wchar_t* sid) {
 330   capabilities_.push_back(sid);
 331   return SBOX_ALL_OK;
 332 }
 333
 334 ResultCode PolicyBase::SetProcessMitigations(
 335     MitigationFlags flags) {
 336   if (!CanSetProcessMitigationsPreStartup(flags))
 337     return SBOX_ERROR_BAD_PARAMS;
 338   mitigations_ = flags;
 339   return SBOX_ALL_OK;
 340 }
 341
 342 MitigationFlags PolicyBase::GetProcessMitigations() {
 343   return mitigations_;
 344 }
 345
 346 ResultCode PolicyBase::SetDelayedProcessMitigations(
 347     MitigationFlags flags) {
 348   if (!CanSetProcessMitigationsPostStartup(flags))
 349     return SBOX_ERROR_BAD_PARAMS;
 350   delayed_mitigations_ = flags;
 351   return SBOX_ALL_OK;
 352 }
 353
 354 MitigationFlags PolicyBase::GetDelayedProcessMitigations() const {
 355   return delayed_mitigations_;
 356 }
 357
 358 void PolicyBase::SetStrictInterceptions() {
 359   relaxed_interceptions_ = false;
 360 }
 361
 362 ResultCode PolicyBase::SetStdoutHandle(HANDLE handle) {
 363   if (!IsInheritableHandle(handle))
 364     return SBOX_ERROR_BAD_PARAMS;
 365   stdout_handle_ = handle;
 366   return SBOX_ALL_OK;
 367 }
 368
 369 ResultCode PolicyBase::SetStderrHandle(HANDLE handle) {
 370   if (!IsInheritableHandle(handle))
 371     return SBOX_ERROR_BAD_PARAMS;
 372   stderr_handle_ = handle;
 373   return SBOX_ALL_OK;
 374 }
 375
 376 ResultCode PolicyBase::AddRule(SubSystem subsystem, Semantics semantics,
 377                                const wchar_t* pattern) {
 378   if (NULL == policy_) {
 379     policy_ = MakeBrokerPolicyMemory();
 380     DCHECK(policy_);
 381     policy_maker_ = new LowLevelPolicy(policy_);
 382     DCHECK(policy_maker_);
 383   }
 384
 385   switch (subsystem) {
 386     case SUBSYS_FILES: {
 387       if (!file_system_init_) {
 388         if (!FileSystemPolicy::SetInitialRules(policy_maker_))
 389           return SBOX_ERROR_BAD_PARAMS;
 390         file_system_init_ = true;
 391       }
 392       if (!FileSystemPolicy::GenerateRules(pattern, semantics, policy_maker_)) {
 393         NOTREACHED();
 394         return SBOX_ERROR_BAD_PARAMS;
 395       }
 396       break;
 397     }
 398     case SUBSYS_SYNC: {
 399       if (!SyncPolicy::GenerateRules(pattern, semantics, policy_maker_)) {
 400         NOTREACHED();
 401         return SBOX_ERROR_BAD_PARAMS;
 402       }
 403       break;
 404     }
 405     case SUBSYS_PROCESS: {
 406       if (lockdown_level_  < USER_INTERACTIVE &&
 407           TargetPolicy::PROCESS_ALL_EXEC == semantics) {
 408         // This is unsupported. This is a huge security risk to give full access
 409         // to a process handle.
 410         return SBOX_ERROR_UNSUPPORTED;
 411       }
 412       if (!ProcessPolicy::GenerateRules(pattern, semantics, policy_maker_)) {
 413         NOTREACHED();
 414         return SBOX_ERROR_BAD_PARAMS;
 415       }
 416       break;
 417     }
 418     case SUBSYS_NAMED_PIPES: {
 419       if (!NamedPipePolicy::GenerateRules(pattern, semantics, policy_maker_)) {
 420         NOTREACHED();
 421         return SBOX_ERROR_BAD_PARAMS;
 422       }
 423       break;
 424     }
 425     case SUBSYS_REGISTRY: {
 426       if (!RegistryPolicy::GenerateRules(pattern, semantics, policy_maker_)) {
 427         NOTREACHED();
 428         return SBOX_ERROR_BAD_PARAMS;
 429       }
 430       break;
 431     }
 432     case SUBSYS_HANDLES: {
 433       if (!HandlePolicy::GenerateRules(pattern, semantics, policy_maker_)) {
 434         NOTREACHED();
 435         return SBOX_ERROR_BAD_PARAMS;
 436       }
 437       break;
 438     }
 439
 440     case SUBSYS_WIN32K_LOCKDOWN: {
 441       if (!ProcessMitigationsWin32KLockdownPolicy::GenerateRules(
 442               pattern, semantics,policy_maker_)) {
 443         NOTREACHED();
 444         return SBOX_ERROR_BAD_PARAMS;
 445       }
 446       break;
 447     }
 448
 449     default: {
 450       return SBOX_ERROR_UNSUPPORTED;
 451     }
 452   }
 453
 454   return SBOX_ALL_OK;
 455 }
 456
 457 ResultCode PolicyBase::AddDllToUnload(const wchar_t* dll_name) {
 458   blacklisted_dlls_.push_back(dll_name);
 459   return SBOX_ALL_OK;
 460 }
 461
 462 ResultCode PolicyBase::AddKernelObjectToClose(const base::char16* handle_type,
 463                                               const base::char16* handle_name) {
 464   return handle_closer_.AddHandle(handle_type, handle_name);
 465 }
 466
 467 // When an IPC is ready in any of the targets we get called. We manage an array
 468 // of IPC dispatchers which are keyed on the IPC tag so we normally delegate
 469 // to the appropriate dispatcher unless we can handle the IPC call ourselves.
 470 Dispatcher* PolicyBase::OnMessageReady(IPCParams* ipc,
 471                                        CallbackGeneric* callback) {
 472   DCHECK(callback);
 473   static const IPCParams ping1 = {IPC_PING1_TAG, ULONG_TYPE};
 474   static const IPCParams ping2 = {IPC_PING2_TAG, INOUTPTR_TYPE};
 475
 476   if (ping1.Matches(ipc) || ping2.Matches(ipc)) {
 477     *callback = reinterpret_cast<CallbackGeneric>(
 478                     static_cast<Callback1>(&PolicyBase::Ping));
 479     return this;
 480   }
 481
 482   Dispatcher* dispatch = GetDispatcher(ipc->ipc_tag);
 483   if (!dispatch) {
 484     NOTREACHED();
 485     return NULL;
 486   }
 487   return dispatch->OnMessageReady(ipc, callback);
 488 }
 489
 490 // Delegate to the appropriate dispatcher.
 491 bool PolicyBase::SetupService(InterceptionManager* manager, int service) {
 492   if (IPC_PING1_TAG == service || IPC_PING2_TAG == service)
 493     return true;
 494
 495   Dispatcher* dispatch = GetDispatcher(service);
 496   if (!dispatch) {
 497     NOTREACHED();
 498     return false;
 499   }
 500   return dispatch->SetupService(manager, service);
 501 }
 502
 503 ResultCode PolicyBase::MakeJobObject(HANDLE* job) {
 504   if (job_level_ != JOB_NONE) {
 505     // Create the windows job object.
 506     Job job_obj;
 507     DWORD result = job_obj.Init(job_level_, NULL, ui_exceptions_,
 508                                 memory_limit_);
 509     if (ERROR_SUCCESS != result) {
 510       return SBOX_ERROR_GENERIC;
 511     }
 512     *job = job_obj.Detach();
 513   } else {
 514     *job = NULL;
 515   }
 516   return SBOX_ALL_OK;
 517 }
 518
 519 ResultCode PolicyBase::MakeTokens(HANDLE* initial, HANDLE* lockdown) {
 520   // Create the 'naked' token. This will be the permanent token associated
 521   // with the process and therefore with any thread that is not impersonating.
 522   DWORD result = CreateRestrictedToken(lockdown, lockdown_level_,
 523                                        integrity_level_, PRIMARY);
 524   if (ERROR_SUCCESS != result)
 525     return SBOX_ERROR_GENERIC;
 526
 527   // If we're launching on the alternate desktop we need to make sure the
 528   // integrity label on the object is no higher than the sandboxed process's
 529   // integrity level. So, we lower the label on the desktop process if it's
 530   // not already low enough for our process.
 531   if (use_alternate_desktop_ &&
 532       integrity_level_ != INTEGRITY_LEVEL_LAST &&
 533       alternate_desktop_integrity_level_label_ < integrity_level_ &&
 534       base::win::OSInfo::GetInstance()->version() >= base::win::VERSION_VISTA) {
 535     // Integrity label enum is reversed (higher level is a lower value).
 536     static_assert(INTEGRITY_LEVEL_SYSTEM < INTEGRITY_LEVEL_UNTRUSTED,
 537                   "Integrity level ordering reversed.");
 538     result = SetObjectIntegrityLabel(alternate_desktop_handle_,
 539                                      SE_WINDOW_OBJECT,
 540                                      L"",
 541                                      GetIntegrityLevelString(integrity_level_));
 542     if (ERROR_SUCCESS != result)
 543       return SBOX_ERROR_GENERIC;
 544
 545     alternate_desktop_integrity_level_label_ = integrity_level_;
 546   }
 547
 548   if (appcontainer_list_.get() && appcontainer_list_->HasAppContainer()) {
 549     // Windows refuses to work with an impersonation token. See SetAppContainer
 550     // implementation for more details.
 551     if (lockdown_level_ < USER_LIMITED || lockdown_level_ != initial_level_)
 552       return SBOX_ERROR_CANNOT_INIT_APPCONTAINER;
 553
 554     *initial = INVALID_HANDLE_VALUE;
 555     return SBOX_ALL_OK;
 556   }
 557
 558   // Create the 'better' token. We use this token as the one that the main
 559   // thread uses when booting up the process. It should contain most of
 560   // what we need (before reaching main( ))
 561   result = CreateRestrictedToken(initial, initial_level_,
 562                                  integrity_level_, IMPERSONATION);
 563   if (ERROR_SUCCESS != result) {
 564     ::CloseHandle(*lockdown);
 565     return SBOX_ERROR_GENERIC;
 566   }
 567   return SBOX_ALL_OK;
 568 }
 569
 570 const AppContainerAttributes* PolicyBase::GetAppContainer() {
 571   if (!appcontainer_list_.get() || !appcontainer_list_->HasAppContainer())
 572     return NULL;
 573
 574   return appcontainer_list_.get();
 575 }
 576
 577 bool PolicyBase::AddTarget(TargetProcess* target) {
 578   if (NULL != policy_)
 579     policy_maker_->Done();
 580
 581   if (!ApplyProcessMitigationsToSuspendedProcess(target->Process(),
 582                                                  mitigations_)) {
 583     return false;
 584   }
 585
 586   if (!SetupAllInterceptions(target))
 587     return false;
 588
 589   if (!SetupHandleCloser(target))
 590     return false;
 591
 592   // Initialize the sandbox infrastructure for the target.
 593   if (ERROR_SUCCESS != target->Init(this, policy_, kIPCMemSize, kPolMemSize))
 594     return false;
 595
 596   g_shared_delayed_integrity_level = delayed_integrity_level_;
 597   ResultCode ret = target->TransferVariable(
 598                        "g_shared_delayed_integrity_level",
 599                        &g_shared_delayed_integrity_level,
 600                        sizeof(g_shared_delayed_integrity_level));
 601   g_shared_delayed_integrity_level = INTEGRITY_LEVEL_LAST;
 602   if (SBOX_ALL_OK != ret)
 603     return false;
 604
 605   // Add in delayed mitigations and pseudo-mitigations enforced at startup.
 606   g_shared_delayed_mitigations = delayed_mitigations_ |
 607       FilterPostStartupProcessMitigations(mitigations_);
 608   if (!CanSetProcessMitigationsPostStartup(g_shared_delayed_mitigations))
 609     return false;
 610
 611   ret = target->TransferVariable("g_shared_delayed_mitigations",
 612                                  &g_shared_delayed_mitigations,
 613                                  sizeof(g_shared_delayed_mitigations));
 614   g_shared_delayed_mitigations = 0;
 615   if (SBOX_ALL_OK != ret)
 616     return false;
 617
 618   AutoLock lock(&lock_);
 619   targets_.push_back(target);
 620   return true;
 621 }
 622
 623 bool PolicyBase::OnJobEmpty(HANDLE job) {
 624   AutoLock lock(&lock_);
 625   TargetSet::iterator it;
 626   for (it = targets_.begin(); it != targets_.end(); ++it) {
 627     if ((*it)->Job() == job)
 628       break;
 629   }
 630   if (it == targets_.end()) {
 631     return false;
 632   }
 633   TargetProcess* target = *it;
 634   targets_.erase(it);
 635   delete target;
 636   return true;
 637 }
 638
 639 EvalResult PolicyBase::EvalPolicy(int service,
 640                                   CountedParameterSetBase* params) {
 641   if (NULL != policy_) {
 642     if (NULL == policy_->entry[service]) {
 643       // There is no policy for this particular service. This is not a big
 644       // deal.
 645       return DENY_ACCESS;
 646     }
 647     for (int i = 0; i < params->count; i++) {
 648       if (!params->parameters[i].IsValid()) {
 649         NOTREACHED();
 650         return SIGNAL_ALARM;
 651       }
 652     }
 653     PolicyProcessor pol_evaluator(policy_->entry[service]);
 654     PolicyResult result =  pol_evaluator.Evaluate(kShortEval,
 655                                                   params->parameters,
 656                                                   params->count);
 657     if (POLICY_MATCH == result) {
 658       return pol_evaluator.GetAction();
 659     }
 660     DCHECK(POLICY_ERROR != result);
 661   }
 662
 663   return DENY_ACCESS;
 664 }
 665
 666 HANDLE PolicyBase::GetStdoutHandle() {
 667   return stdout_handle_;
 668 }
 669
 670 HANDLE PolicyBase::GetStderrHandle() {
 671   return stderr_handle_;
 672 }
 673
 674 // We service IPC_PING_TAG message which is a way to test a round trip of the
 675 // IPC subsystem. We receive a integer cookie and we are expected to return the
 676 // cookie times two (or three) and the current tick count.
 677 bool PolicyBase::Ping(IPCInfo* ipc, void* arg1) {
 678   switch (ipc->ipc_tag) {
 679     case IPC_PING1_TAG: {
 680       IPCInt ipc_int(arg1);
 681       uint32 cookie = ipc_int.As32Bit();
 682       ipc->return_info.extended_count = 2;
 683       ipc->return_info.extended[0].unsigned_int = ::GetTickCount();
 684       ipc->return_info.extended[1].unsigned_int = 2 * cookie;
 685       return true;
 686     }
 687     case IPC_PING2_TAG: {
 688       CountedBuffer* io_buffer = reinterpret_cast<CountedBuffer*>(arg1);
 689       if (sizeof(uint32) != io_buffer->Size())
 690         return false;
 691
 692       uint32* cookie = reinterpret_cast<uint32*>(io_buffer->Buffer());
 693       *cookie = (*cookie) * 3;
 694       return true;
 695     }
 696     default: return false;
 697   }
 698 }
 699
 700 Dispatcher* PolicyBase::GetDispatcher(int ipc_tag) {
 701   if (ipc_tag >= IPC_LAST_TAG || ipc_tag <= IPC_UNUSED_TAG)
 702     return NULL;
 703
 704   return ipc_targets_[ipc_tag];
 705 }
 706
 707 bool PolicyBase::SetupAllInterceptions(TargetProcess* target) {
 708   InterceptionManager manager(target, relaxed_interceptions_);
 709
 710   if (policy_) {
 711     for (int i = 0; i < IPC_LAST_TAG; i++) {
 712       if (policy_->entry[i] && !ipc_targets_[i]->SetupService(&manager, i))
 713           return false;
 714     }
 715   }
 716
 717   if (!blacklisted_dlls_.empty()) {
 718     std::vector<base::string16>::iterator it = blacklisted_dlls_.begin();
 719     for (; it != blacklisted_dlls_.end(); ++it) {
 720       manager.AddToUnloadModules(it->c_str());
 721     }
 722   }
 723
 724   if (!SetupBasicInterceptions(&manager))
 725     return false;
 726
 727   if (!manager.InitializeInterceptions())
 728     return false;
 729
 730   // Finally, setup imports on the target so the interceptions can work.
 731   return SetupNtdllImports(target);
 732 }
 733
 734 bool PolicyBase::SetupHandleCloser(TargetProcess* target) {
 735   return handle_closer_.InitializeTargetHandles(target);
 736 }
 737
 738 }  // namespace sandbox