sandbox/win/src/restricted_token_utils.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <aclapi.h>
   6 #include <sddl.h>
   7 #include <vector>
   8
   9 #include "sandbox/win/src/restricted_token_utils.h"
  10
  11 #include "base/logging.h"
  12 #include "base/win/scoped_handle.h"
  13 #include "base/win/scoped_process_information.h"
  14 #include "base/win/windows_version.h"
  15 #include "sandbox/win/src/job.h"
  16 #include "sandbox/win/src/restricted_token.h"
  17 #include "sandbox/win/src/security_level.h"
  18 #include "sandbox/win/src/sid.h"
  19
  20 namespace sandbox {
  21
  22 DWORD CreateRestrictedToken(HANDLE *token_handle,
  23                             TokenLevel security_level,
  24                             IntegrityLevel integrity_level,
  25                             TokenType token_type) {
  26   if (!token_handle)
  27     return ERROR_BAD_ARGUMENTS;
  28
  29   RestrictedToken restricted_token;
  30   restricted_token.Init(NULL);  // Initialized with the current process token
  31
  32   std::vector<base::string16> privilege_exceptions;
  33   std::vector<Sid> sid_exceptions;
  34
  35   bool deny_sids = true;
  36   bool remove_privileges = true;
  37
  38   switch (security_level) {
  39     case USER_UNPROTECTED: {
  40       deny_sids = false;
  41       remove_privileges = false;
  42       break;
  43     }
  44     case USER_RESTRICTED_SAME_ACCESS: {
  45       deny_sids = false;
  46       remove_privileges = false;
  47
  48       unsigned err_code = restricted_token.AddRestrictingSidAllSids();
  49       if (ERROR_SUCCESS != err_code)
  50         return err_code;
  51
  52       break;
  53     }
  54     case USER_NON_ADMIN: {
  55       sid_exceptions.push_back(WinBuiltinUsersSid);
  56       sid_exceptions.push_back(WinWorldSid);
  57       sid_exceptions.push_back(WinInteractiveSid);
  58       sid_exceptions.push_back(WinAuthenticatedUserSid);
  59       privilege_exceptions.push_back(SE_CHANGE_NOTIFY_NAME);
  60       break;
  61     }
  62     case USER_INTERACTIVE: {
  63       sid_exceptions.push_back(WinBuiltinUsersSid);
  64       sid_exceptions.push_back(WinWorldSid);
  65       sid_exceptions.push_back(WinInteractiveSid);
  66       sid_exceptions.push_back(WinAuthenticatedUserSid);
  67       privilege_exceptions.push_back(SE_CHANGE_NOTIFY_NAME);
  68       restricted_token.AddRestrictingSid(WinBuiltinUsersSid);
  69       restricted_token.AddRestrictingSid(WinWorldSid);
  70       restricted_token.AddRestrictingSid(WinRestrictedCodeSid);
  71       restricted_token.AddRestrictingSidCurrentUser();
  72       restricted_token.AddRestrictingSidLogonSession();
  73       break;
  74     }
  75     case USER_LIMITED: {
  76       sid_exceptions.push_back(WinBuiltinUsersSid);
  77       sid_exceptions.push_back(WinWorldSid);
  78       sid_exceptions.push_back(WinInteractiveSid);
  79       privilege_exceptions.push_back(SE_CHANGE_NOTIFY_NAME);
  80       restricted_token.AddRestrictingSid(WinBuiltinUsersSid);
  81       restricted_token.AddRestrictingSid(WinWorldSid);
  82       restricted_token.AddRestrictingSid(WinRestrictedCodeSid);
  83
  84       // This token has to be able to create objects in BNO.
  85       // Unfortunately, on vista, it needs the current logon sid
  86       // in the token to achieve this. You should also set the process to be
  87       // low integrity level so it can't access object created by other
  88       // processes.
  89       if (base::win::GetVersion() >= base::win::VERSION_VISTA)
  90         restricted_token.AddRestrictingSidLogonSession();
  91       break;
  92     }
  93     case USER_RESTRICTED: {
  94       privilege_exceptions.push_back(SE_CHANGE_NOTIFY_NAME);
  95       restricted_token.AddUserSidForDenyOnly();
  96       restricted_token.AddRestrictingSid(WinRestrictedCodeSid);
  97       break;
  98     }
  99     case USER_LOCKDOWN: {
 100       restricted_token.AddUserSidForDenyOnly();
 101       restricted_token.AddRestrictingSid(WinNullSid);
 102       break;
 103     }
 104     default: {
 105       return ERROR_BAD_ARGUMENTS;
 106     }
 107   }
 108
 109   DWORD err_code = ERROR_SUCCESS;
 110   if (deny_sids) {
 111     err_code = restricted_token.AddAllSidsForDenyOnly(&sid_exceptions);
 112     if (ERROR_SUCCESS != err_code)
 113       return err_code;
 114   }
 115
 116   if (remove_privileges) {
 117     err_code = restricted_token.DeleteAllPrivileges(&privilege_exceptions);
 118     if (ERROR_SUCCESS != err_code)
 119       return err_code;
 120   }
 121
 122   restricted_token.SetIntegrityLevel(integrity_level);
 123
 124   switch (token_type) {
 125     case PRIMARY: {
 126       err_code = restricted_token.GetRestrictedTokenHandle(token_handle);
 127       break;
 128     }
 129     case IMPERSONATION: {
 130       err_code = restricted_token.GetRestrictedTokenHandleForImpersonation(
 131           token_handle);
 132       break;
 133     }
 134     default: {
 135       err_code = ERROR_BAD_ARGUMENTS;
 136       break;
 137     }
 138   }
 139
 140   return err_code;
 141 }
 142
 143 DWORD StartRestrictedProcessInJob(wchar_t *command_line,
 144                                   TokenLevel primary_level,
 145                                   TokenLevel impersonation_level,
 146                                   JobLevel job_level,
 147                                   HANDLE *const job_handle_ret) {
 148   Job job;
 149   DWORD err_code = job.Init(job_level, NULL, 0, 0);
 150   if (ERROR_SUCCESS != err_code)
 151     return err_code;
 152
 153   if (JOB_UNPROTECTED != job_level) {
 154     // Share the Desktop handle to be able to use MessageBox() in the sandboxed
 155     // application.
 156     err_code = job.UserHandleGrantAccess(GetDesktopWindow());
 157     if (ERROR_SUCCESS != err_code)
 158       return err_code;
 159   }
 160
 161   // Create the primary (restricted) token for the process
 162   HANDLE primary_token_handle = NULL;
 163   err_code = CreateRestrictedToken(&primary_token_handle,
 164                                    primary_level,
 165                                    INTEGRITY_LEVEL_LAST,
 166                                    PRIMARY);
 167   if (ERROR_SUCCESS != err_code) {
 168     return err_code;
 169   }
 170   base::win::ScopedHandle primary_token(primary_token_handle);
 171
 172   // Create the impersonation token (restricted) to be able to start the
 173   // process.
 174   HANDLE impersonation_token_handle;
 175   err_code = CreateRestrictedToken(&impersonation_token_handle,
 176                                    impersonation_level,
 177                                    INTEGRITY_LEVEL_LAST,
 178                                    IMPERSONATION);
 179   if (ERROR_SUCCESS != err_code) {
 180     return err_code;
 181   }
 182   base::win::ScopedHandle impersonation_token(impersonation_token_handle);
 183
 184   // Start the process
 185   STARTUPINFO startup_info = {0};
 186   PROCESS_INFORMATION temp_process_info = {};
 187   DWORD flags = CREATE_SUSPENDED;
 188
 189   if (base::win::GetVersion() < base::win::VERSION_WIN8) {
 190     // Windows 8 implements nested jobs, but for older systems we need to
 191     // break out of any job we're in to enforce our restrictions.
 192     flags |= CREATE_BREAKAWAY_FROM_JOB;
 193   }
 194
 195   if (!::CreateProcessAsUser(primary_token.Get(),
 196                              NULL,   // No application name.
 197                              command_line,
 198                              NULL,   // No security attribute.
 199                              NULL,   // No thread attribute.
 200                              FALSE,  // Do not inherit handles.
 201                              flags,
 202                              NULL,   // Use the environment of the caller.
 203                              NULL,   // Use current directory of the caller.
 204                              &startup_info,
 205                              &temp_process_info)) {
 206     return ::GetLastError();
 207   }
 208   base::win::ScopedProcessInformation process_info(temp_process_info);
 209
 210   // Change the token of the main thread of the new process for the
 211   // impersonation token with more rights.
 212   {
 213     HANDLE temp_thread = process_info.thread_handle();
 214     if (!::SetThreadToken(&temp_thread, impersonation_token.Get())) {
 215       ::TerminateProcess(process_info.process_handle(),
 216                          0);  // exit code
 217       return ::GetLastError();
 218     }
 219   }
 220
 221   err_code = job.AssignProcessToJob(process_info.process_handle());
 222   if (ERROR_SUCCESS != err_code) {
 223     ::TerminateProcess(process_info.process_handle(),
 224                        0);  // exit code
 225     return ::GetLastError();
 226   }
 227
 228   // Start the application
 229   ::ResumeThread(process_info.thread_handle());
 230
 231   (*job_handle_ret) = job.Detach();
 232
 233   return ERROR_SUCCESS;
 234 }
 235
 236 DWORD SetObjectIntegrityLabel(HANDLE handle, SE_OBJECT_TYPE type,
 237                               const wchar_t* ace_access,
 238                               const wchar_t* integrity_level_sid) {
 239   // Build the SDDL string for the label.
 240   base::string16 sddl = L"S:(";   // SDDL for a SACL.
 241   sddl += SDDL_MANDATORY_LABEL;   // Ace Type is "Mandatory Label".
 242   sddl += L";;";                  // No Ace Flags.
 243   sddl += ace_access;             // Add the ACE access.
 244   sddl += L";;;";                 // No ObjectType and Inherited Object Type.
 245   sddl += integrity_level_sid;    // Trustee Sid.
 246   sddl += L")";
 247
 248   DWORD error = ERROR_SUCCESS;
 249   PSECURITY_DESCRIPTOR sec_desc = NULL;
 250
 251   PACL sacl = NULL;
 252   BOOL sacl_present = FALSE;
 253   BOOL sacl_defaulted = FALSE;
 254
 255   if (::ConvertStringSecurityDescriptorToSecurityDescriptorW(sddl.c_str(),
 256                                                              SDDL_REVISION,
 257                                                              &sec_desc, NULL)) {
 258     if (::GetSecurityDescriptorSacl(sec_desc, &sacl_present, &sacl,
 259                                     &sacl_defaulted)) {
 260       error = ::SetSecurityInfo(handle, type,
 261                                 LABEL_SECURITY_INFORMATION, NULL, NULL, NULL,
 262                                 sacl);
 263     } else {
 264       error = ::GetLastError();
 265     }
 266
 267     ::LocalFree(sec_desc);
 268   } else {
 269     return::GetLastError();
 270   }
 271
 272   return error;
 273 }
 274
 275 const wchar_t* GetIntegrityLevelString(IntegrityLevel integrity_level) {
 276   switch (integrity_level) {
 277     case INTEGRITY_LEVEL_SYSTEM:
 278       return L"S-1-16-16384";
 279     case INTEGRITY_LEVEL_HIGH:
 280       return L"S-1-16-12288";
 281     case INTEGRITY_LEVEL_MEDIUM:
 282       return L"S-1-16-8192";
 283     case INTEGRITY_LEVEL_MEDIUM_LOW:
 284       return L"S-1-16-6144";
 285     case INTEGRITY_LEVEL_LOW:
 286       return L"S-1-16-4096";
 287     case INTEGRITY_LEVEL_BELOW_LOW:
 288       return L"S-1-16-2048";
 289     case INTEGRITY_LEVEL_UNTRUSTED:
 290       return L"S-1-16-0";
 291     case INTEGRITY_LEVEL_LAST:
 292       return NULL;
 293   }
 294
 295   NOTREACHED();
 296   return NULL;
 297 }
 298 DWORD SetTokenIntegrityLevel(HANDLE token, IntegrityLevel integrity_level) {
 299   if (base::win::GetVersion() < base::win::VERSION_VISTA)
 300     return ERROR_SUCCESS;
 301
 302   const wchar_t* integrity_level_str = GetIntegrityLevelString(integrity_level);
 303   if (!integrity_level_str) {
 304     // No mandatory level specified, we don't change it.
 305     return ERROR_SUCCESS;
 306   }
 307
 308   PSID integrity_sid = NULL;
 309   if (!::ConvertStringSidToSid(integrity_level_str, &integrity_sid))
 310     return ::GetLastError();
 311
 312   TOKEN_MANDATORY_LABEL label = {0};
 313   label.Label.Attributes = SE_GROUP_INTEGRITY;
 314   label.Label.Sid = integrity_sid;
 315
 316   DWORD size = sizeof(TOKEN_MANDATORY_LABEL) + ::GetLengthSid(integrity_sid);
 317   BOOL result = ::SetTokenInformation(token, TokenIntegrityLevel, &label,
 318                                       size);
 319   ::LocalFree(integrity_sid);
 320
 321   return result ? ERROR_SUCCESS : ::GetLastError();
 322 }
 323
 324 DWORD SetProcessIntegrityLevel(IntegrityLevel integrity_level) {
 325   if (base::win::GetVersion() < base::win::VERSION_VISTA)
 326     return ERROR_SUCCESS;
 327
 328   // We don't check for an invalid level here because we'll just let it
 329   // fail on the SetTokenIntegrityLevel call later on.
 330   if (integrity_level == INTEGRITY_LEVEL_LAST) {
 331     // No mandatory level specified, we don't change it.
 332     return ERROR_SUCCESS;
 333   }
 334
 335   HANDLE token_handle;
 336   if (!::OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_DEFAULT,
 337                           &token_handle))
 338     return ::GetLastError();
 339
 340   base::win::ScopedHandle token(token_handle);
 341
 342   return SetTokenIntegrityLevel(token.Get(), integrity_level);
 343 }
 344
 345 DWORD HardenTokenIntegrityLevelPolicy(HANDLE token) {
 346   if (base::win::GetVersion() < base::win::VERSION_WIN7)
 347     return ERROR_SUCCESS;
 348
 349   DWORD last_error = 0;
 350   DWORD length_needed = 0;
 351
 352   ::GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION,
 353                             NULL, 0, &length_needed);
 354
 355   last_error = ::GetLastError();
 356   if (last_error != ERROR_INSUFFICIENT_BUFFER)
 357     return last_error;
 358
 359   std::vector<char> security_desc_buffer(length_needed);
 360   PSECURITY_DESCRIPTOR security_desc =
 361       reinterpret_cast<PSECURITY_DESCRIPTOR>(&security_desc_buffer[0]);
 362
 363   if (!::GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION,
 364                                  security_desc, length_needed,
 365                                  &length_needed))
 366     return ::GetLastError();
 367
 368   PACL sacl = NULL;
 369   BOOL sacl_present = FALSE;
 370   BOOL sacl_defaulted = FALSE;
 371
 372   if (!::GetSecurityDescriptorSacl(security_desc, &sacl_present,
 373                                    &sacl, &sacl_defaulted))
 374     return ::GetLastError();
 375
 376   for (DWORD ace_index = 0; ace_index < sacl->AceCount; ++ace_index) {
 377     PSYSTEM_MANDATORY_LABEL_ACE ace;
 378
 379     if (::GetAce(sacl, ace_index, reinterpret_cast<LPVOID*>(&ace))
 380         && ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) {
 381       ace->Mask |= SYSTEM_MANDATORY_LABEL_NO_READ_UP
 382                 |  SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP;
 383       break;
 384     }
 385   }
 386
 387   if (!::SetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION,
 388                                  security_desc))
 389     return ::GetLastError();
 390
 391   return ERROR_SUCCESS;
 392 }
 393
 394 DWORD HardenProcessIntegrityLevelPolicy() {
 395   if (base::win::GetVersion() < base::win::VERSION_WIN7)
 396     return ERROR_SUCCESS;
 397
 398   HANDLE token_handle;
 399   if (!::OpenProcessToken(GetCurrentProcess(), READ_CONTROL | WRITE_OWNER,
 400                           &token_handle))
 401     return ::GetLastError();
 402
 403   base::win::ScopedHandle token(token_handle);
 404
 405   return HardenTokenIntegrityLevelPolicy(token.Get());
 406 }
 407
 408 }  // namespace sandbox