sandbox/win/src/sync_policy.cc

   1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <string>
   6
   7 #include "sandbox/win/src/sync_policy.h"
   8
   9 #include "base/logging.h"
  10 #include "base/strings/stringprintf.h"
  11 #include "sandbox/win/src/ipc_tags.h"
  12 #include "sandbox/win/src/nt_internals.h"
  13 #include "sandbox/win/src/policy_engine_opcodes.h"
  14 #include "sandbox/win/src/policy_params.h"
  15 #include "sandbox/win/src/sandbox_types.h"
  16 #include "sandbox/win/src/sandbox_utils.h"
  17 #include "sandbox/win/src/sync_interception.h"
  18 #include "sandbox/win/src/win_utils.h"
  19
  20 namespace sandbox {
  21
  22 // Provides functionality to resolve a symbolic link within the object
  23 // directory passed in.
  24 NTSTATUS ResolveSymbolicLink(const base::string16& directory_name,
  25                              const base::string16& name,
  26                              base::string16* target) {
  27   NtOpenDirectoryObjectFunction NtOpenDirectoryObject = NULL;
  28   ResolveNTFunctionPtr("NtOpenDirectoryObject", &NtOpenDirectoryObject);
  29
  30   NtQuerySymbolicLinkObjectFunction NtQuerySymbolicLinkObject = NULL;
  31   ResolveNTFunctionPtr("NtQuerySymbolicLinkObject",
  32                        &NtQuerySymbolicLinkObject);
  33
  34   NtOpenSymbolicLinkObjectFunction NtOpenSymbolicLinkObject = NULL;
  35   ResolveNTFunctionPtr("NtOpenSymbolicLinkObject", &NtOpenSymbolicLinkObject);
  36
  37   NtCloseFunction NtClose = NULL;
  38   ResolveNTFunctionPtr("NtClose", &NtClose);
  39
  40   OBJECT_ATTRIBUTES symbolic_link_directory_attributes = {};
  41   UNICODE_STRING symbolic_link_directory_string = {};
  42   InitObjectAttribs(directory_name, OBJ_CASE_INSENSITIVE, NULL,
  43                     &symbolic_link_directory_attributes,
  44                     &symbolic_link_directory_string, NULL);
  45
  46   HANDLE symbolic_link_directory = NULL;
  47   NTSTATUS status = NtOpenDirectoryObject(&symbolic_link_directory,
  48                                           DIRECTORY_QUERY,
  49                                           &symbolic_link_directory_attributes);
  50   if (!NT_SUCCESS(status))
  51     return status;
  52
  53   OBJECT_ATTRIBUTES symbolic_link_attributes = {};
  54   UNICODE_STRING name_string = {};
  55   InitObjectAttribs(name, OBJ_CASE_INSENSITIVE, symbolic_link_directory,
  56                     &symbolic_link_attributes, &name_string, NULL);
  57
  58   HANDLE symbolic_link = NULL;
  59   status = NtOpenSymbolicLinkObject(&symbolic_link, GENERIC_READ,
  60                                     &symbolic_link_attributes);
  61   CHECK(NT_SUCCESS(NtClose(symbolic_link_directory)));
  62   if (!NT_SUCCESS(status))
  63     return status;
  64
  65   UNICODE_STRING target_path = {};
  66   unsigned long target_length = 0;
  67   status = NtQuerySymbolicLinkObject(symbolic_link, &target_path,
  68                                      &target_length);
  69   if (status != STATUS_BUFFER_TOO_SMALL) {
  70     CHECK(NT_SUCCESS(NtClose(symbolic_link)));
  71     return status;
  72   }
  73
  74   target_path.Length = 0;
  75   target_path.MaximumLength = static_cast<USHORT>(target_length);
  76   target_path.Buffer = new wchar_t[target_path.MaximumLength + 1];
  77   status = NtQuerySymbolicLinkObject(symbolic_link, &target_path,
  78                                      &target_length);
  79   if (NT_SUCCESS(status))
  80     target->assign(target_path.Buffer, target_length);
  81
  82   CHECK(NT_SUCCESS(NtClose(symbolic_link)));
  83   delete[] target_path.Buffer;
  84   return status;
  85 }
  86
  87 NTSTATUS GetBaseNamedObjectsDirectory(HANDLE* directory) {
  88   static HANDLE base_named_objects_handle = NULL;
  89   if (base_named_objects_handle) {
  90     *directory = base_named_objects_handle;
  91     return STATUS_SUCCESS;
  92   }
  93
  94   NtOpenDirectoryObjectFunction NtOpenDirectoryObject = NULL;
  95   ResolveNTFunctionPtr("NtOpenDirectoryObject", &NtOpenDirectoryObject);
  96
  97   DWORD session_id = 0;
  98   ProcessIdToSessionId(::GetCurrentProcessId(), &session_id);
  99
 100   base::string16 base_named_objects_path;
 101
 102   NTSTATUS status = ResolveSymbolicLink(L"\\Sessions\\BNOLINKS",
 103                                         base::StringPrintf(L"%d", session_id),
 104                                         &base_named_objects_path);
 105   if (!NT_SUCCESS(status)) {
 106     DLOG(ERROR) << "Failed to resolve BaseNamedObjects path. Error: "
 107                 << status;
 108     return status;
 109   }
 110
 111   UNICODE_STRING directory_name = {};
 112   OBJECT_ATTRIBUTES object_attributes = {};
 113   InitObjectAttribs(base_named_objects_path, OBJ_CASE_INSENSITIVE, NULL,
 114                     &object_attributes, &directory_name, NULL);
 115   status = NtOpenDirectoryObject(&base_named_objects_handle,
 116                                  DIRECTORY_ALL_ACCESS,
 117                                  &object_attributes);
 118   if (NT_SUCCESS(status))
 119     *directory = base_named_objects_handle;
 120   return status;
 121 }
 122
 123 bool SyncPolicy::GenerateRules(const wchar_t* name,
 124                                TargetPolicy::Semantics semantics,
 125                                LowLevelPolicy* policy) {
 126   base::string16 mod_name(name);
 127   if (mod_name.empty()) {
 128     return false;
 129   }
 130
 131   if (TargetPolicy::EVENTS_ALLOW_ANY != semantics &&
 132       TargetPolicy::EVENTS_ALLOW_READONLY != semantics) {
 133     // Other flags are not valid for sync policy yet.
 134     NOTREACHED();
 135     return false;
 136   }
 137
 138   // Add the open rule.
 139   EvalResult result = ASK_BROKER;
 140   PolicyRule open(result);
 141
 142   if (!open.AddStringMatch(IF, OpenEventParams::NAME, name, CASE_INSENSITIVE))
 143     return false;
 144
 145   if (TargetPolicy::EVENTS_ALLOW_READONLY == semantics) {
 146     // We consider all flags that are not known to be readonly as potentially
 147     // used for write.
 148     uint32 allowed_flags = SYNCHRONIZE | GENERIC_READ | READ_CONTROL;
 149     uint32 restricted_flags = ~allowed_flags;
 150     open.AddNumberMatch(IF_NOT, OpenEventParams::ACCESS, restricted_flags, AND);
 151   }
 152
 153   if (!policy->AddRule(IPC_OPENEVENT_TAG, &open))
 154     return false;
 155
 156   // If it's not a read only, add the create rule.
 157   if (TargetPolicy::EVENTS_ALLOW_READONLY != semantics) {
 158     PolicyRule create(result);
 159     if (!create.AddStringMatch(IF, NameBased::NAME, name, CASE_INSENSITIVE))
 160       return false;
 161
 162     if (!policy->AddRule(IPC_CREATEEVENT_TAG, &create))
 163       return false;
 164   }
 165
 166   return true;
 167 }
 168
 169 NTSTATUS SyncPolicy::CreateEventAction(EvalResult eval_result,
 170                                        const ClientInfo& client_info,
 171                                        const base::string16 &event_name,
 172                                        uint32 event_type,
 173                                        uint32 initial_state,
 174                                        HANDLE *handle) {
 175   NtCreateEventFunction NtCreateEvent = NULL;
 176   ResolveNTFunctionPtr("NtCreateEvent", &NtCreateEvent);
 177
 178   // The only action supported is ASK_BROKER which means create the requested
 179   // file as specified.
 180   if (ASK_BROKER != eval_result)
 181     return false;
 182
 183   HANDLE object_directory = NULL;
 184   NTSTATUS status = GetBaseNamedObjectsDirectory(&object_directory);
 185   if (status != STATUS_SUCCESS)
 186     return status;
 187
 188   UNICODE_STRING unicode_event_name = {};
 189   OBJECT_ATTRIBUTES object_attributes = {};
 190   InitObjectAttribs(event_name, OBJ_CASE_INSENSITIVE, object_directory,
 191                     &object_attributes, &unicode_event_name, NULL);
 192
 193   HANDLE local_handle = NULL;
 194   status = NtCreateEvent(&local_handle, EVENT_ALL_ACCESS, &object_attributes,
 195                          static_cast<EVENT_TYPE>(event_type),
 196                          static_cast<BOOLEAN>(initial_state));
 197   if (NULL == local_handle)
 198     return status;
 199
 200   if (!::DuplicateHandle(::GetCurrentProcess(), local_handle,
 201                          client_info.process, handle, 0, FALSE,
 202                          DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) {
 203     return STATUS_ACCESS_DENIED;
 204   }
 205   return status;
 206 }
 207
 208 NTSTATUS SyncPolicy::OpenEventAction(EvalResult eval_result,
 209                                      const ClientInfo& client_info,
 210                                      const base::string16 &event_name,
 211                                      uint32 desired_access,
 212                                      HANDLE *handle) {
 213   NtOpenEventFunction NtOpenEvent = NULL;
 214   ResolveNTFunctionPtr("NtOpenEvent", &NtOpenEvent);
 215
 216   // The only action supported is ASK_BROKER which means create the requested
 217   // event as specified.
 218   if (ASK_BROKER != eval_result)
 219     return false;
 220
 221   HANDLE object_directory = NULL;
 222   NTSTATUS status = GetBaseNamedObjectsDirectory(&object_directory);
 223   if (status != STATUS_SUCCESS)
 224     return status;
 225
 226   UNICODE_STRING unicode_event_name = {};
 227   OBJECT_ATTRIBUTES object_attributes = {};
 228   InitObjectAttribs(event_name, OBJ_CASE_INSENSITIVE, object_directory,
 229                     &object_attributes, &unicode_event_name, NULL);
 230
 231   HANDLE local_handle = NULL;
 232   status = NtOpenEvent(&local_handle, desired_access, &object_attributes);
 233   if (NULL == local_handle)
 234     return status;
 235
 236   if (!::DuplicateHandle(::GetCurrentProcess(), local_handle,
 237                          client_info.process, handle, 0, FALSE,
 238                          DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) {
 239     return STATUS_ACCESS_DENIED;
 240   }
 241   return status;
 242 }
 243
 244 }  // namespace sandbox