sandbox/win/src/process_mitigations_test.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/strings/stringprintf.h"
   6 #include "base/win/scoped_handle.h"
   7
   8 #include "base/win/windows_version.h"
   9 #include "sandbox/win/src/nt_internals.h"
  10 #include "sandbox/win/src/process_mitigations.h"
  11 #include "sandbox/win/src/sandbox.h"
  12 #include "sandbox/win/src/sandbox_factory.h"
  13 #include "sandbox/win/src/target_services.h"
  14 #include "sandbox/win/src/win_utils.h"
  15 #include "sandbox/win/tests/common/controller.h"
  16 #include "testing/gtest/include/gtest/gtest.h"
  17
  18 namespace {
  19
  20 typedef BOOL (WINAPI *GetProcessDEPPolicyFunction)(
  21     HANDLE process,
  22     LPDWORD flags,
  23     PBOOL permanent);
  24
  25 typedef BOOL (WINAPI *GetProcessMitigationPolicyFunction)(
  26     HANDLE process,
  27     PROCESS_MITIGATION_POLICY mitigation_policy,
  28     PVOID buffer,
  29     SIZE_T length);
  30
  31 GetProcessMitigationPolicyFunction get_process_mitigation_policy;
  32
  33 bool CheckWin8DepPolicy() {
  34   PROCESS_MITIGATION_DEP_POLICY policy = {};
  35   if (!get_process_mitigation_policy(::GetCurrentProcess(), ProcessDEPPolicy,
  36                                      &policy, sizeof(policy))) {
  37     return false;
  38   }
  39   return policy.Enable && policy.Permanent;
  40 }
  41
  42 #if defined(NDEBUG)
  43 bool CheckWin8AslrPolicy() {
  44   PROCESS_MITIGATION_ASLR_POLICY policy = {};
  45   if (!get_process_mitigation_policy(::GetCurrentProcess(), ProcessASLRPolicy,
  46                                      &policy, sizeof(policy))) {
  47      return false;
  48   }
  49   return policy.EnableForceRelocateImages && policy.DisallowStrippedImages;
  50 }
  51 #endif  // defined(NDEBUG)
  52
  53 bool CheckWin8StrictHandlePolicy() {
  54   PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY policy = {};
  55   if (!get_process_mitigation_policy(::GetCurrentProcess(),
  56                                      ProcessStrictHandleCheckPolicy,
  57                                      &policy, sizeof(policy))) {
  58      return false;
  59   }
  60   return policy.RaiseExceptionOnInvalidHandleReference &&
  61          policy.HandleExceptionsPermanentlyEnabled;
  62 }
  63
  64 bool CheckWin8Win32CallPolicy() {
  65   PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY policy = {};
  66   if (!get_process_mitigation_policy(::GetCurrentProcess(),
  67                                      ProcessSystemCallDisablePolicy,
  68                                      &policy, sizeof(policy))) {
  69      return false;
  70   }
  71   return policy.DisallowWin32kSystemCalls;
  72 }
  73
  74 bool CheckWin8DllExtensionPolicy() {
  75   PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY policy = {};
  76   if (!get_process_mitigation_policy(::GetCurrentProcess(),
  77                                      ProcessExtensionPointDisablePolicy,
  78                                      &policy, sizeof(policy))) {
  79      return false;
  80   }
  81   return policy.DisableExtensionPoints;
  82 }
  83
  84 }  // namespace
  85
  86 namespace sandbox {
  87
  88 SBOX_TESTS_COMMAND int CheckWin8(int argc, wchar_t **argv) {
  89   get_process_mitigation_policy =
  90       reinterpret_cast<GetProcessMitigationPolicyFunction>(
  91           ::GetProcAddress(::GetModuleHandleW(L"kernel32.dll"),
  92                            "GetProcessMitigationPolicy"));
  93   if (!get_process_mitigation_policy)
  94     return SBOX_TEST_NOT_FOUND;
  95
  96 #if !defined(_WIN64)  // DEP is always enabled on 64-bit.
  97   if (!CheckWin8DepPolicy())
  98     return SBOX_TEST_FIRST_ERROR;
  99 #endif
 100
 101 #if defined(NDEBUG)  // ASLR cannot be forced in debug builds.
 102   if (!CheckWin8AslrPolicy())
 103     return SBOX_TEST_SECOND_ERROR;
 104 #endif
 105
 106   if (!CheckWin8StrictHandlePolicy())
 107     return SBOX_TEST_THIRD_ERROR;
 108
 109   if (!CheckWin8DllExtensionPolicy())
 110     return SBOX_TEST_FIFTH_ERROR;
 111
 112   return SBOX_TEST_SUCCEEDED;
 113 }
 114
 115 TEST(ProcessMitigationsTest, CheckWin8) {
 116   if (base::win::GetVersion() < base::win::VERSION_WIN8)
 117     return;
 118
 119   TestRunner runner;
 120   sandbox::TargetPolicy* policy = runner.GetPolicy();
 121
 122   sandbox::MitigationFlags mitigations = MITIGATION_DEP |
 123                                          MITIGATION_DEP_NO_ATL_THUNK |
 124                                          MITIGATION_EXTENSION_DLL_DISABLE;
 125 #if defined(NDEBUG)  // ASLR cannot be forced in debug builds.
 126   mitigations |= MITIGATION_RELOCATE_IMAGE |
 127                  MITIGATION_RELOCATE_IMAGE_REQUIRED;
 128 #endif
 129
 130   EXPECT_EQ(policy->SetProcessMitigations(mitigations), SBOX_ALL_OK);
 131
 132   mitigations |= MITIGATION_STRICT_HANDLE_CHECKS;
 133
 134   EXPECT_EQ(policy->SetDelayedProcessMitigations(mitigations), SBOX_ALL_OK);
 135
 136   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckWin8"));
 137 }
 138
 139
 140 SBOX_TESTS_COMMAND int CheckDep(int argc, wchar_t **argv) {
 141   GetProcessDEPPolicyFunction get_process_dep_policy =
 142       reinterpret_cast<GetProcessDEPPolicyFunction>(
 143           ::GetProcAddress(::GetModuleHandleW(L"kernel32.dll"),
 144                            "GetProcessDEPPolicy"));
 145   if (get_process_dep_policy) {
 146     BOOL is_permanent = FALSE;
 147     DWORD dep_flags = 0;
 148
 149     if (!get_process_dep_policy(::GetCurrentProcess(), &dep_flags,
 150         &is_permanent)) {
 151       return SBOX_TEST_FIRST_ERROR;
 152     }
 153
 154     if (!(dep_flags & PROCESS_DEP_ENABLE) || !is_permanent)
 155       return SBOX_TEST_SECOND_ERROR;
 156
 157   } else {
 158     NtQueryInformationProcessFunction query_information_process = NULL;
 159     ResolveNTFunctionPtr("NtQueryInformationProcess",
 160                           &query_information_process);
 161     if (!query_information_process)
 162       return SBOX_TEST_NOT_FOUND;
 163
 164     ULONG size = 0;
 165     ULONG dep_flags = 0;
 166     if (!SUCCEEDED(query_information_process(::GetCurrentProcess(),
 167                                              ProcessExecuteFlags, &dep_flags,
 168                                              sizeof(dep_flags), &size))) {
 169       return SBOX_TEST_THIRD_ERROR;
 170     }
 171
 172     static const int MEM_EXECUTE_OPTION_DISABLE = 2;
 173     static const int MEM_EXECUTE_OPTION_PERMANENT = 8;
 174     dep_flags &= 0xff;
 175
 176     if (dep_flags != (MEM_EXECUTE_OPTION_DISABLE |
 177                       MEM_EXECUTE_OPTION_PERMANENT)) {
 178       return SBOX_TEST_FOURTH_ERROR;
 179     }
 180   }
 181
 182   return SBOX_TEST_SUCCEEDED;
 183 }
 184
 185 #if !defined(_WIN64)  // DEP is always enabled on 64-bit.
 186 TEST(ProcessMitigationsTest, CheckDep) {
 187   if (base::win::GetVersion() > base::win::VERSION_WIN7)
 188     return;
 189
 190   TestRunner runner;
 191   sandbox::TargetPolicy* policy = runner.GetPolicy();
 192
 193   EXPECT_EQ(policy->SetProcessMitigations(
 194                 MITIGATION_DEP |
 195                 MITIGATION_DEP_NO_ATL_THUNK |
 196                 MITIGATION_SEHOP),
 197             SBOX_ALL_OK);
 198   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckDep"));
 199 }
 200 #endif
 201
 202 SBOX_TESTS_COMMAND int CheckWin8Lockdown(int argc, wchar_t **argv) {
 203   get_process_mitigation_policy =
 204       reinterpret_cast<GetProcessMitigationPolicyFunction>(
 205           ::GetProcAddress(::GetModuleHandleW(L"kernel32.dll"),
 206                            "GetProcessMitigationPolicy"));
 207   if (!get_process_mitigation_policy)
 208     return SBOX_TEST_NOT_FOUND;
 209
 210   if (!CheckWin8Win32CallPolicy())
 211     return SBOX_TEST_FIRST_ERROR;
 212   return SBOX_TEST_SUCCEEDED;
 213 }
 214
 215 // This test validates that setting the MITIGATION_WIN32K_DISABLE mitigation on
 216 // the target process causes the launch to fail in process initialization.
 217 // The test process itself links against user32/gdi32.
 218 TEST(ProcessMitigationsTest, CheckWin8Win32KLockDownFailure) {
 219   if (base::win::GetVersion() < base::win::VERSION_WIN8)
 220     return;
 221
 222   TestRunner runner;
 223   sandbox::TargetPolicy* policy = runner.GetPolicy();
 224
 225   EXPECT_EQ(policy->SetProcessMitigations(MITIGATION_WIN32K_DISABLE),
 226             SBOX_ALL_OK);
 227   EXPECT_NE(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckWin8Lockdown"));
 228 }
 229
 230 // This test validates that setting the MITIGATION_WIN32K_DISABLE mitigation
 231 // along with the policy to fake user32 and gdi32 initialization successfully
 232 // launches the target process.
 233 // The test process itself links against user32/gdi32.
 234 TEST(ProcessMitigationsTest, CheckWin8Win32KLockDownSuccess) {
 235   if (base::win::GetVersion() < base::win::VERSION_WIN8)
 236     return;
 237
 238   TestRunner runner;
 239   sandbox::TargetPolicy* policy = runner.GetPolicy();
 240
 241   EXPECT_EQ(policy->SetProcessMitigations(MITIGATION_WIN32K_DISABLE),
 242             SBOX_ALL_OK);
 243   EXPECT_EQ(policy->AddRule(sandbox::TargetPolicy::SUBSYS_WIN32K_LOCKDOWN,
 244                             sandbox::TargetPolicy::FAKE_USER_GDI_INIT, NULL),
 245             sandbox::SBOX_ALL_OK);
 246   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckWin8Lockdown"));
 247 }
 248
 249 }  // namespace sandbox
 250