remoting/host/win/elevated_controller.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "remoting/host/win/elevated_controller.h"
   6
   7 #include "base/file_util.h"
   8 #include "base/file_version_info.h"
   9 #include "base/json/json_reader.h"
  10 #include "base/json/json_writer.h"
  11 #include "base/logging.h"
  12 #include "base/memory/scoped_ptr.h"
  13 #include "base/path_service.h"
  14 #include "base/process/memory.h"
  15 #include "base/strings/utf_string_conversions.h"
  16 #include "base/values.h"
  17 #include "base/win/scoped_handle.h"
  18 #include "remoting/host/branding.h"
  19 #include "remoting/host/usage_stats_consent.h"
  20 #include "remoting/host/verify_config_window_win.h"
  21 #include "remoting/host/win/core_resource.h"
  22 #include "remoting/host/win/security_descriptor.h"
  23
  24 namespace remoting {
  25
  26 namespace {
  27
  28 // The maximum size of the configuration file. "1MB ought to be enough" for any
  29 // reasonable configuration we will ever need. 1MB is low enough to make
  30 // the probability of out of memory situation fairly low. OOM is still possible
  31 // and we will crash if it occurs.
  32 const size_t kMaxConfigFileSize = 1024 * 1024;
  33
  34 // The host configuration file name.
  35 const base::FilePath::CharType kConfigFileName[] = FILE_PATH_LITERAL("host.json");
  36
  37 // The unprivileged configuration file name.
  38 const base::FilePath::CharType kUnprivilegedConfigFileName[] =
  39     FILE_PATH_LITERAL("host_unprivileged.json");
  40
  41 // The extension for the temporary file.
  42 const base::FilePath::CharType kTempFileExtension[] = FILE_PATH_LITERAL("json~");
  43
  44 // The host configuration file security descriptor that enables full access to
  45 // Local System and built-in administrators only.
  46 const char kConfigFileSecurityDescriptor[] =
  47     "O:BAG:BAD:(A;;GA;;;SY)(A;;GA;;;BA)";
  48
  49 const char kUnprivilegedConfigFileSecurityDescriptor[] =
  50     "O:BAG:BAD:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GR;;;AU)";
  51
  52 // Configuration keys.
  53 const char kHostId[] = "host_id";
  54 const char kXmppLogin[] = "xmpp_login";
  55 const char kHostOwner[] = "host_owner";
  56 const char kHostSecretHash[] = "host_secret_hash";
  57
  58 // The configuration keys that cannot be specified in UpdateConfig().
  59 const char* const kReadonlyKeys[] = { kHostId, kHostOwner, kXmppLogin };
  60
  61 // The configuration keys whose values may be read by GetConfig().
  62 const char* const kUnprivilegedConfigKeys[] = { kHostId, kXmppLogin };
  63
  64 // Determines if the client runs in the security context that allows performing
  65 // administrative tasks (i.e. the user belongs to the adminstrators group and
  66 // the client runs elevated).
  67 bool IsClientAdmin() {
  68   HRESULT hr = CoImpersonateClient();
  69   if (FAILED(hr)) {
  70     return false;
  71   }
  72
  73   SID_IDENTIFIER_AUTHORITY nt_authority = SECURITY_NT_AUTHORITY;
  74   PSID administrators_group = NULL;
  75   BOOL result = AllocateAndInitializeSid(&nt_authority,
  76                                          2,
  77                                          SECURITY_BUILTIN_DOMAIN_RID,
  78                                          DOMAIN_ALIAS_RID_ADMINS,
  79                                          0, 0, 0, 0, 0, 0,
  80                                          &administrators_group);
  81   if (result) {
  82     if (!CheckTokenMembership(NULL, administrators_group, &result)) {
  83       result = false;
  84     }
  85     FreeSid(administrators_group);
  86   }
  87
  88   hr = CoRevertToSelf();
  89   CHECK(SUCCEEDED(hr));
  90
  91   return !!result;
  92 }
  93
  94 // Reads and parses the configuration file up to |kMaxConfigFileSize| in
  95 // size.
  96 HRESULT ReadConfig(const base::FilePath& filename,
  97                    scoped_ptr<base::DictionaryValue>* config_out) {
  98
  99   // Read raw data from the configuration file.
 100   base::win::ScopedHandle file(
 101       CreateFileW(filename.value().c_str(),
 102                   GENERIC_READ,
 103                   FILE_SHARE_READ | FILE_SHARE_WRITE,
 104                   NULL,
 105                   OPEN_EXISTING,
 106                   FILE_FLAG_SEQUENTIAL_SCAN,
 107                   NULL));
 108
 109   if (!file.IsValid()) {
 110     DWORD error = GetLastError();
 111     LOG_GETLASTERROR(ERROR)
 112         << "Failed to open '" << filename.value() << "'";
 113     return HRESULT_FROM_WIN32(error);
 114   }
 115
 116   scoped_ptr<char[]> buffer(new char[kMaxConfigFileSize]);
 117   DWORD size = kMaxConfigFileSize;
 118   if (!::ReadFile(file, &buffer[0], size, &size, NULL)) {
 119     DWORD error = GetLastError();
 120     LOG_GETLASTERROR(ERROR)
 121         << "Failed to read '" << filename.value() << "'";
 122     return HRESULT_FROM_WIN32(error);
 123   }
 124
 125   // Parse the JSON configuration, expecting it to contain a dictionary.
 126   std::string file_content(buffer.get(), size);
 127   scoped_ptr<base::Value> value(
 128       base::JSONReader::Read(file_content, base::JSON_ALLOW_TRAILING_COMMAS));
 129
 130   base::DictionaryValue* dictionary;
 131   if (value.get() == NULL || !value->GetAsDictionary(&dictionary)) {
 132     LOG(ERROR) << "Failed to read '" << filename.value() << "'.";
 133     return E_FAIL;
 134   }
 135
 136   value.release();
 137   config_out->reset(dictionary);
 138   return S_OK;
 139 }
 140
 141 base::FilePath GetTempLocationFor(const base::FilePath& filename) {
 142   return filename.ReplaceExtension(kTempFileExtension);
 143 }
 144
 145 // Writes a config file to a temporary location.
 146 HRESULT WriteConfigFileToTemp(const base::FilePath& filename,
 147                               const char* security_descriptor,
 148                               const char* content,
 149                               size_t length) {
 150   // Create the security descriptor for the configuration file.
 151   ScopedSd sd = ConvertSddlToSd(security_descriptor);
 152   if (!sd) {
 153     DWORD error = GetLastError();
 154     LOG_GETLASTERROR(ERROR) <<
 155         "Failed to create a security descriptor for the configuration file";
 156     return HRESULT_FROM_WIN32(error);
 157   }
 158
 159   SECURITY_ATTRIBUTES security_attributes = {0};
 160   security_attributes.nLength = sizeof(security_attributes);
 161   security_attributes.lpSecurityDescriptor = sd.get();
 162   security_attributes.bInheritHandle = FALSE;
 163
 164   // Create a temporary file and write configuration to it.
 165   base::FilePath tempname = GetTempLocationFor(filename);
 166   base::win::ScopedHandle file(
 167       CreateFileW(tempname.value().c_str(),
 168                   GENERIC_WRITE,
 169                   0,
 170                   &security_attributes,
 171                   CREATE_ALWAYS,
 172                   FILE_FLAG_SEQUENTIAL_SCAN,
 173                   NULL));
 174
 175   if (!file.IsValid()) {
 176     DWORD error = GetLastError();
 177     LOG_GETLASTERROR(ERROR)
 178         << "Failed to create '" << filename.value() << "'";
 179     return HRESULT_FROM_WIN32(error);
 180   }
 181
 182   DWORD written;
 183   if (!WriteFile(file, content, static_cast<DWORD>(length), &written, NULL)) {
 184     DWORD error = GetLastError();
 185     LOG_GETLASTERROR(ERROR)
 186         << "Failed to write to '" << filename.value() << "'";
 187     return HRESULT_FROM_WIN32(error);
 188   }
 189
 190   return S_OK;
 191 }
 192
 193 // Moves a config file from its temporary location to its permanent location.
 194 HRESULT MoveConfigFileFromTemp(const base::FilePath& filename) {
 195   // Now that the configuration is stored successfully replace the actual
 196   // configuration file.
 197   base::FilePath tempname = GetTempLocationFor(filename);
 198   if (!MoveFileExW(tempname.value().c_str(),
 199                    filename.value().c_str(),
 200                    MOVEFILE_REPLACE_EXISTING)) {
 201       DWORD error = GetLastError();
 202       LOG_GETLASTERROR(ERROR)
 203           << "Failed to rename '" << tempname.value() << "' to '"
 204           << filename.value() << "'";
 205       return HRESULT_FROM_WIN32(error);
 206   }
 207
 208   return S_OK;
 209 }
 210
 211 // Writes the configuration file up to |kMaxConfigFileSize| in size.
 212 HRESULT WriteConfig(const char* content, size_t length, HWND owner_window) {
 213   if (length > kMaxConfigFileSize) {
 214       return E_FAIL;
 215   }
 216
 217   // Extract the configuration data that the user will verify.
 218   scoped_ptr<base::Value> config_value(base::JSONReader::Read(content));
 219   if (!config_value.get()) {
 220     return E_FAIL;
 221   }
 222   base::DictionaryValue* config_dict = NULL;
 223   if (!config_value->GetAsDictionary(&config_dict)) {
 224     return E_FAIL;
 225   }
 226   std::string email;
 227   if (!config_dict->GetString(kHostOwner, &email)) {
 228     if (!config_dict->GetString(kXmppLogin, &email)) {
 229       return E_FAIL;
 230     }
 231   }
 232   std::string host_id, host_secret_hash;
 233   if (!config_dict->GetString(kHostId, &host_id) ||
 234       !config_dict->GetString(kHostSecretHash, &host_secret_hash)) {
 235     return E_FAIL;
 236   }
 237
 238   // Ask the user to verify the configuration (unless the client is admin
 239   // already).
 240   if (!IsClientAdmin()) {
 241     remoting::VerifyConfigWindowWin verify_win(email, host_id,
 242                                                host_secret_hash);
 243     DWORD error = verify_win.DoModal(owner_window);
 244     if (error != ERROR_SUCCESS) {
 245       return HRESULT_FROM_WIN32(error);
 246     }
 247   }
 248
 249   // Extract the unprivileged fields from the configuration.
 250   base::DictionaryValue unprivileged_config_dict;
 251   for (int i = 0; i < arraysize(kUnprivilegedConfigKeys); ++i) {
 252     const char* key = kUnprivilegedConfigKeys[i];
 253     base::string16 value;
 254     if (config_dict->GetString(key, &value)) {
 255       unprivileged_config_dict.SetString(key, value);
 256     }
 257   }
 258   std::string unprivileged_config_str;
 259   base::JSONWriter::Write(&unprivileged_config_dict, &unprivileged_config_str);
 260
 261   // Write the full configuration file to a temporary location.
 262   base::FilePath full_config_file_path =
 263       remoting::GetConfigDir().Append(kConfigFileName);
 264   HRESULT hr = WriteConfigFileToTemp(full_config_file_path,
 265                                      kConfigFileSecurityDescriptor,
 266                                      content,
 267                                      length);
 268   if (FAILED(hr)) {
 269     return hr;
 270   }
 271
 272   // Write the unprivileged configuration file to a temporary location.
 273   base::FilePath unprivileged_config_file_path =
 274       remoting::GetConfigDir().Append(kUnprivilegedConfigFileName);
 275   hr = WriteConfigFileToTemp(unprivileged_config_file_path,
 276                              kUnprivilegedConfigFileSecurityDescriptor,
 277                              unprivileged_config_str.data(),
 278                              unprivileged_config_str.size());
 279   if (FAILED(hr)) {
 280     return hr;
 281   }
 282
 283   // Move the full configuration file to its permanent location.
 284   hr = MoveConfigFileFromTemp(full_config_file_path);
 285   if (FAILED(hr)) {
 286     return hr;
 287   }
 288
 289   // Move the unprivileged configuration file to its permanent location.
 290   hr = MoveConfigFileFromTemp(unprivileged_config_file_path);
 291   if (FAILED(hr)) {
 292     return hr;
 293   }
 294
 295   return S_OK;
 296 }
 297
 298 } // namespace
 299
 300 ElevatedController::ElevatedController() : owner_window_(NULL) {
 301 }
 302
 303 HRESULT ElevatedController::FinalConstruct() {
 304   return S_OK;
 305 }
 306
 307 void ElevatedController::FinalRelease() {
 308 }
 309
 310 STDMETHODIMP ElevatedController::GetConfig(BSTR* config_out) {
 311   base::FilePath config_dir = remoting::GetConfigDir();
 312
 313   // Read the unprivileged part of host configuration.
 314   scoped_ptr<base::DictionaryValue> config;
 315   HRESULT hr = ReadConfig(config_dir.Append(kUnprivilegedConfigFileName),
 316                           &config);
 317   if (FAILED(hr)) {
 318     return hr;
 319   }
 320
 321   // Convert the config back to a string and return it to the caller.
 322   std::string file_content;
 323   base::JSONWriter::Write(config.get(), &file_content);
 324
 325   *config_out = ::SysAllocString(base::UTF8ToUTF16(file_content).c_str());
 326   if (config_out == NULL) {
 327     return E_OUTOFMEMORY;
 328   }
 329
 330   return S_OK;
 331 }
 332
 333 STDMETHODIMP ElevatedController::GetVersion(BSTR* version_out) {
 334   // Report the product version number of the daemon controller binary as
 335   // the host version.
 336   HMODULE binary = base::GetModuleFromAddress(
 337       reinterpret_cast<void*>(&ReadConfig));
 338   scoped_ptr<FileVersionInfo> version_info(
 339       FileVersionInfo::CreateFileVersionInfoForModule(binary));
 340
 341   base::string16 version;
 342   if (version_info.get()) {
 343     version = version_info->product_version();
 344   }
 345
 346   *version_out = ::SysAllocString(version.c_str());
 347   if (version_out == NULL) {
 348     return E_OUTOFMEMORY;
 349   }
 350
 351   return S_OK;
 352 }
 353
 354 STDMETHODIMP ElevatedController::SetConfig(BSTR config) {
 355   // Determine the config directory path and create it if necessary.
 356   base::FilePath config_dir = remoting::GetConfigDir();
 357   if (!base::CreateDirectory(config_dir)) {
 358     return HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED);
 359   }
 360
 361   std::string file_content = base::UTF16ToUTF8(
 362     base::string16(static_cast<base::char16*>(config), ::SysStringLen(config)));
 363
 364   return WriteConfig(file_content.c_str(), file_content.size(), owner_window_);
 365 }
 366
 367 STDMETHODIMP ElevatedController::SetOwnerWindow(LONG_PTR window_handle) {
 368   owner_window_ = reinterpret_cast<HWND>(window_handle);
 369   return S_OK;
 370 }
 371
 372 STDMETHODIMP ElevatedController::StartDaemon() {
 373   ScopedScHandle service;
 374   HRESULT hr = OpenService(&service);
 375   if (FAILED(hr)) {
 376     return hr;
 377   }
 378
 379   // Change the service start type to 'auto'.
 380   if (!::ChangeServiceConfigW(service,
 381                               SERVICE_NO_CHANGE,
 382                               SERVICE_AUTO_START,
 383                               SERVICE_NO_CHANGE,
 384                               NULL,
 385                               NULL,
 386                               NULL,
 387                               NULL,
 388                               NULL,
 389                               NULL,
 390                               NULL)) {
 391     DWORD error = GetLastError();
 392     LOG_GETLASTERROR(ERROR)
 393         << "Failed to change the '" << kWindowsServiceName
 394         << "'service start type to 'auto'";
 395     return HRESULT_FROM_WIN32(error);
 396   }
 397
 398   // Start the service.
 399   if (!StartService(service, 0, NULL)) {
 400     DWORD error = GetLastError();
 401     if (error != ERROR_SERVICE_ALREADY_RUNNING) {
 402       LOG_GETLASTERROR(ERROR)
 403           << "Failed to start the '" << kWindowsServiceName << "'service";
 404
 405       return HRESULT_FROM_WIN32(error);
 406     }
 407   }
 408
 409   return S_OK;
 410 }
 411
 412 STDMETHODIMP ElevatedController::StopDaemon() {
 413   ScopedScHandle service;
 414   HRESULT hr = OpenService(&service);
 415   if (FAILED(hr)) {
 416     return hr;
 417   }
 418
 419   // Change the service start type to 'manual'.
 420   if (!::ChangeServiceConfigW(service,
 421                               SERVICE_NO_CHANGE,
 422                               SERVICE_DEMAND_START,
 423                               SERVICE_NO_CHANGE,
 424                               NULL,
 425                               NULL,
 426                               NULL,
 427                               NULL,
 428                               NULL,
 429                               NULL,
 430                               NULL)) {
 431     DWORD error = GetLastError();
 432     LOG_GETLASTERROR(ERROR)
 433         << "Failed to change the '" << kWindowsServiceName
 434         << "'service start type to 'manual'";
 435     return HRESULT_FROM_WIN32(error);
 436   }
 437
 438   // Stop the service.
 439   SERVICE_STATUS status;
 440   if (!ControlService(service, SERVICE_CONTROL_STOP, &status)) {
 441     DWORD error = GetLastError();
 442     if (error != ERROR_SERVICE_NOT_ACTIVE) {
 443       LOG_GETLASTERROR(ERROR)
 444           << "Failed to stop the '" << kWindowsServiceName << "'service";
 445       return HRESULT_FROM_WIN32(error);
 446     }
 447   }
 448
 449   return S_OK;
 450 }
 451
 452 STDMETHODIMP ElevatedController::UpdateConfig(BSTR config) {
 453   // Parse the config.
 454   std::string config_str = base::UTF16ToUTF8(
 455     base::string16(static_cast<base::char16*>(config), ::SysStringLen(config)));
 456   scoped_ptr<base::Value> config_value(base::JSONReader::Read(config_str));
 457   if (!config_value.get()) {
 458     return E_FAIL;
 459   }
 460   base::DictionaryValue* config_dict = NULL;
 461   if (!config_value->GetAsDictionary(&config_dict)) {
 462     return E_FAIL;
 463   }
 464   // Check for bad keys.
 465   for (int i = 0; i < arraysize(kReadonlyKeys); ++i) {
 466     if (config_dict->HasKey(kReadonlyKeys[i])) {
 467       return HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED);
 468     }
 469   }
 470   // Get the old config.
 471   base::FilePath config_dir = remoting::GetConfigDir();
 472   scoped_ptr<base::DictionaryValue> config_old;
 473   HRESULT hr = ReadConfig(config_dir.Append(kConfigFileName), &config_old);
 474   if (FAILED(hr)) {
 475     return hr;
 476   }
 477   // Merge items from the given config into the old config.
 478   config_old->MergeDictionary(config_dict);
 479   // Write the updated config.
 480   std::string config_updated_str;
 481   base::JSONWriter::Write(config_old.get(), &config_updated_str);
 482   return WriteConfig(config_updated_str.c_str(), config_updated_str.size(),
 483                      owner_window_);
 484 }
 485
 486 STDMETHODIMP ElevatedController::GetUsageStatsConsent(BOOL* allowed,
 487                                                          BOOL* set_by_policy) {
 488   bool local_allowed;
 489   bool local_set_by_policy;
 490   if (remoting::GetUsageStatsConsent(&local_allowed, &local_set_by_policy)) {
 491     *allowed = local_allowed;
 492     *set_by_policy = local_set_by_policy;
 493     return S_OK;
 494   } else {
 495     return E_FAIL;
 496   }
 497 }
 498
 499 STDMETHODIMP ElevatedController::SetUsageStatsConsent(BOOL allowed) {
 500   if (remoting::SetUsageStatsConsent(!!allowed)) {
 501     return S_OK;
 502   } else {
 503     return E_FAIL;
 504   }
 505 }
 506
 507 HRESULT ElevatedController::OpenService(ScopedScHandle* service_out) {
 508   DWORD error;
 509
 510   ScopedScHandle scmanager(
 511       ::OpenSCManagerW(NULL, SERVICES_ACTIVE_DATABASE,
 512                        SC_MANAGER_CONNECT | SC_MANAGER_ENUMERATE_SERVICE));
 513   if (!scmanager.IsValid()) {
 514     error = GetLastError();
 515     LOG_GETLASTERROR(ERROR)
 516         << "Failed to connect to the service control manager";
 517
 518     return HRESULT_FROM_WIN32(error);
 519   }
 520
 521   DWORD desired_access = SERVICE_CHANGE_CONFIG | SERVICE_QUERY_STATUS |
 522                          SERVICE_START | SERVICE_STOP;
 523   ScopedScHandle service(
 524       ::OpenServiceW(scmanager, kWindowsServiceName, desired_access));
 525   if (!service.IsValid()) {
 526     error = GetLastError();
 527     LOG_GETLASTERROR(ERROR)
 528         << "Failed to open to the '" << kWindowsServiceName << "' service";
 529
 530     return HRESULT_FROM_WIN32(error);
 531   }
 532
 533   service_out->Set(service.Take());
 534   return S_OK;
 535 }
 536
 537 } // namespace remoting