// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #ifndef SANDBOX_SRC_SECURITY_LEVEL_H_ #define SANDBOX_SRC_SECURITY_LEVEL_H_ #include namespace sandbox { // List of all the integrity levels supported in the sandbox. This is used // only on Windows Vista. You can't set the integrity level of the process // in the sandbox to a level higher than yours. enum IntegrityLevel { INTEGRITY_LEVEL_SYSTEM, INTEGRITY_LEVEL_HIGH, INTEGRITY_LEVEL_MEDIUM, INTEGRITY_LEVEL_MEDIUM_LOW, INTEGRITY_LEVEL_LOW, INTEGRITY_LEVEL_BELOW_LOW, INTEGRITY_LEVEL_UNTRUSTED, INTEGRITY_LEVEL_LAST }; // The Token level specifies a set of security profiles designed to // provide the bulk of the security of sandbox. // // TokenLevel |Restricting |Deny Only |Privileges| // |Sids |Sids | | // ----------------------------|--------------|----------------|----------| // USER_LOCKDOWN | Null Sid | All | None | // ----------------------------|--------------|----------------|----------| // USER_RESTRICTED | RESTRICTED | All | Traverse | // ----------------------------|--------------|----------------|----------| // USER_LIMITED | Users | All except: | Traverse | // | Everyone | Users | | // | RESTRICTED | Everyone | | // | | Interactive | | // ----------------------------|--------------|----------------|----------| // USER_INTERACTIVE | Users | All except: | Traverse | // | Everyone | Users | | // | RESTRICTED | Everyone | | // | Owner | Interactive | | // | | Local | | // | | Authent-users | | // | | User | | // ----------------------------|--------------|----------------|----------| // USER_NON_ADMIN | None | All except: | Traverse | // | | Users | | // | | Everyone | | // | | Interactive | | // | | Local | | // | | Authent-users | | // | | User | | // ----------------------------|--------------|----------------|----------| // USER_RESTRICTED_SAME_ACCESS | All | None | All | // ----------------------------|--------------|----------------|----------| // USER_UNPROTECTED | None | None | All | // ----------------------------|--------------|----------------|----------| // // The above restrictions are actually a transformation that is applied to // the existing broker process token. The resulting token that will be // applied to the target process depends both on the token level selected // and on the broker token itself. // // The LOCKDOWN and RESTRICTED are designed to allow access to almost // nothing that has security associated with and they are the recommended // levels to run sandboxed code specially if there is a chance that the // broker is process might be started by a user that belongs to the Admins // or power users groups. enum TokenLevel { USER_LOCKDOWN = 0, USER_RESTRICTED, USER_LIMITED, USER_INTERACTIVE, USER_NON_ADMIN, USER_RESTRICTED_SAME_ACCESS, USER_UNPROTECTED, USER_LAST }; // The Job level specifies a set of decreasing security profiles for the // Job object that the target process will be placed into. // This table summarizes the security associated with each level: // // JobLevel |General |Quota | // |restrictions |restrictions | // -----------------|---------------------------------- |--------------------| // JOB_NONE | No job is assigned to the | None | // | sandboxed process. | | // -----------------|---------------------------------- |--------------------| // JOB_UNPROTECTED | None | *Kill on Job close.| // -----------------|---------------------------------- |--------------------| // JOB_INTERACTIVE | *Forbid system-wide changes using | | // | SystemParametersInfo(). | *Kill on Job close.| // | *Forbid the creation/switch of | | // | Desktops. | | // | *Forbids calls to ExitWindows(). | | // -----------------|---------------------------------- |--------------------| // JOB_LIMITED_USER | Same as INTERACTIVE_USER plus: | *One active process| // | *Forbid changes to the display | limit. | // | settings. | *Kill on Job close.| // -----------------|---------------------------------- |--------------------| // JOB_RESTRICTED | Same as LIMITED_USER plus: | *One active process| // | * No read/write to the clipboard. | limit. | // | * No access to User Handles that | *Kill on Job close.| // | belong to other processes. | | // | * Forbid message broadcasts. | | // | * Forbid setting global hooks. | | // | * No access to the global atoms | | // | table. | | // -----------------|-----------------------------------|--------------------| // JOB_LOCKDOWN | Same as RESTRICTED | *One active process| // | | limit. | // | | *Kill on Job close.| // | | *Kill on unhandled | // | | exception. | // | | | // In the context of the above table, 'user handles' refers to the handles of // windows, bitmaps, menus, etc. Files, treads and registry handles are kernel // handles and are not affected by the job level settings. enum JobLevel { JOB_LOCKDOWN = 0, JOB_RESTRICTED, JOB_LIMITED_USER, JOB_INTERACTIVE, JOB_UNPROTECTED, JOB_NONE }; // These flags correspond to various process-level mitigations (eg. ASLR and // DEP). Most are implemented via UpdateProcThreadAttribute() plus flags for // the PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY attribute argument; documented // here: http://msdn.microsoft.com/en-us/library/windows/desktop/ms686880 // Some mitigations are implemented directly by the sandbox or emulated to // the greatest extent possible when not directly supported by the OS. // Flags that are unsupported for the target OS will be silently ignored. // Flags that are invalid for their application (pre or post startup) will // return SBOX_ERROR_BAD_PARAMS. typedef uint64_t MitigationFlags; // Permanently enables DEP for the target process. Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE. const MitigationFlags MITIGATION_DEP = 0x00000001; // Permanently Disables ATL thunk emulation when DEP is enabled. Valid // only when MITIGATION_DEP is passed. Corresponds to not passing // PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE. const MitigationFlags MITIGATION_DEP_NO_ATL_THUNK = 0x00000002; // Enables Structured exception handling override prevention. Must be // enabled prior to process start. Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE. const MitigationFlags MITIGATION_SEHOP = 0x00000004; // Forces ASLR on all images in the child process. Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON . const MitigationFlags MITIGATION_RELOCATE_IMAGE = 0x00000008; // Refuses to load DLLs that cannot support ASLR. Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON_REQ_RELOCS. const MitigationFlags MITIGATION_RELOCATE_IMAGE_REQUIRED = 0x00000010; // Terminates the process on Windows heap corruption. Coresponds to // PROCESS_CREATION_MITIGATION_POLICY_HEAP_TERMINATE_ALWAYS_ON. const MitigationFlags MITIGATION_HEAP_TERMINATE = 0x00000020; // Sets a random lower bound as the minimum user address. Must be // enabled prior to process start. On 32-bit processes this is // emulated to a much smaller degree. Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON. const MitigationFlags MITIGATION_BOTTOM_UP_ASLR = 0x00000040; // Increases the randomness range of bottom-up ASLR to up to 1TB. Must be // enabled prior to process start and with MITIGATION_BOTTOM_UP_ASLR. // Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_HIGH_ENTROPY_ASLR_ALWAYS_ON const MitigationFlags MITIGATION_HIGH_ENTROPY_ASLR = 0x00000080; // Immediately raises an exception on a bad handle reference. Must be // enabled after startup. Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_STRICT_HANDLE_CHECKS_ALWAYS_ON. const MitigationFlags MITIGATION_STRICT_HANDLE_CHECKS = 0x00000100; // Prevents the process from making Win32k calls. Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_ALWAYS_ON. const MitigationFlags MITIGATION_WIN32K_DISABLE = 0x00000200; // Disables common DLL injection methods (e.g. window hooks and // App_InitDLLs). Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON. const MitigationFlags MITIGATION_EXTENSION_DLL_DISABLE = 0x00000400; // Prevents the process from loading non-system fonts into GDI. // Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_FONT_DISABLE_ALWAYS_ON const MitigationFlags MITIGATION_NONSYSTEM_FONT_DISABLE = 0x00000800; // Sets the DLL search order to LOAD_LIBRARY_SEARCH_DEFAULT_DIRS. Additional // directories can be added via the Windows AddDllDirectory() function. // http://msdn.microsoft.com/en-us/library/windows/desktop/hh310515 // Must be enabled after startup. const MitigationFlags MITIGATION_DLL_SEARCH_ORDER = 0x00000001ULL << 32; // Changes the mandatory integrity level policy on the current process' token // to enable no-read and no-execute up. This prevents a lower IL process from // opening the process token for impersonate/duplicate/assignment. const MitigationFlags MITIGATION_HARDEN_TOKEN_IL_POLICY = 0x00000001ULL << 33; // Blocks mapping of images from remote devices. Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_REMOTE_ALWAYS_ON. const MitigationFlags MITIGATION_IMAGE_LOAD_NO_REMOTE = 0x00000001ULL << 52; // Blocks mapping of images that have the low manditory label. Corresponds to // PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_LOW_LABEL_ALWAYS_ON. const MitigationFlags MITIGATION_IMAGE_LOAD_NO_LOW_LABEL = 0x00000001ULL << 56; } // namespace sandbox #endif // SANDBOX_SRC_SECURITY_LEVEL_H_