diff options
| author | jschuh@chromium.org <jschuh@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-02-26 19:21:18 +0000 |
|---|---|---|
| committer | jschuh@chromium.org <jschuh@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-02-26 19:21:18 +0000 |
| commit | aad3a0ee8771945a83e45646415c154bb837e1a4 (patch) | |
| tree | 6534ca4ff4273de48781fd2e218f7a14fbfb15e4 /sandbox/win/src/acl.h | |
| parent | 7c849b3d759fa9fedd7d4aea73577d643465918d (diff) | |
| download | chromium_src-aad3a0ee8771945a83e45646415c154bb837e1a4.zip chromium_src-aad3a0ee8771945a83e45646415c154bb837e1a4.tar.gz chromium_src-aad3a0ee8771945a83e45646415c154bb837e1a4.tar.bz2 | |
Reduce sandbox permissions granted to alternate desktop
This pass adds the first round of deny ACEs for the Winstation and
Desktop objects. Assuming these stick, I'll get more aggressive in
a follow-up.
BUG=346586
NOTRY=true
Review URL: https://codereview.chromium.org/178423005
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@253546 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'sandbox/win/src/acl.h')
| -rw-r--r-- | sandbox/win/src/acl.h | 20 |
1 files changed, 11 insertions, 9 deletions
diff --git a/sandbox/win/src/acl.h b/sandbox/win/src/acl.h index 25d5cdb..531259f 100644 --- a/sandbox/win/src/acl.h +++ b/sandbox/win/src/acl.h @@ -5,6 +5,7 @@ #ifndef SANDBOX_SRC_ACL_H_ #define SANDBOX_SRC_ACL_H_ +#include <AccCtrl.h> #include <windows.h> #include "base/memory/scoped_ptr.h" @@ -16,11 +17,11 @@ namespace sandbox { bool GetDefaultDacl(HANDLE token, scoped_ptr_malloc<TOKEN_DEFAULT_DACL>* default_dacl); -// Appends an ACE represented by |sid| and |access| to |old_dacl|. If the -// function succeeds, new_dacl contains the new dacl and must be freed using -// LocalFree. -bool AddSidToDacl(const Sid& sid, ACL* old_dacl, ACCESS_MASK access, - ACL** new_dacl); +// Appends an ACE represented by |sid|, |access_mode|, and |access| to +// |old_dacl|. If the function succeeds, new_dacl contains the new dacl and +// must be freed using LocalFree. +bool AddSidToDacl(const Sid& sid, ACL* old_dacl, ACCESS_MODE access_mode, + ACCESS_MASK access, ACL** new_dacl); // Adds and ACE represented by |sid| and |access| to the default dacl present // in the token. @@ -30,10 +31,11 @@ bool AddSidToDefaultDacl(HANDLE token, const Sid& sid, ACCESS_MASK access); // present in the token. bool AddUserSidToDefaultDacl(HANDLE token, ACCESS_MASK access); -// Adds an ACE represented by |known_sid| and |access| to the dacl of the kernel -// object referenced by |object|. -bool AddKnownSidToKernelObject(HANDLE object, const Sid& sid, - ACCESS_MASK access); +// Adds an ACE represented by |known_sid|, |access_mode|, and |access| to +// the dacl of the kernel object referenced by |object| and of |object_type|. +bool AddKnownSidToObject(HANDLE object, SE_OBJECT_TYPE object_type, + const Sid& sid, ACCESS_MODE access_mode, + ACCESS_MASK access); } // namespace sandbox |