1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "sandbox/win/src/policy_target.h"
#include "sandbox/win/src/crosscall_client.h"
#include "sandbox/win/src/ipc_tags.h"
#include "sandbox/win/src/policy_engine_processor.h"
#include "sandbox/win/src/policy_low_level.h"
#include "sandbox/win/src/policy_params.h"
#include "sandbox/win/src/sandbox_factory.h"
#include "sandbox/win/src/sandbox_nt_util.h"
#include "sandbox/win/src/sharedmem_ipc_client.h"
#include "sandbox/win/src/target_services.h"
namespace sandbox {
// Handle for our private heap.
extern void* g_heap;
// This is the list of all imported symbols from ntdll.dll.
SANDBOX_INTERCEPT NtExports g_nt;
// Policy data.
extern void* volatile g_shared_policy_memory;
SANDBOX_INTERCEPT size_t g_shared_policy_size;
bool QueryBroker(int ipc_id, CountedParameterSetBase* params) {
DCHECK_NT(static_cast<size_t>(ipc_id) < kMaxServiceCount);
DCHECK_NT(g_shared_policy_memory);
DCHECK_NT(g_shared_policy_size > 0);
if (static_cast<size_t>(ipc_id) >= kMaxServiceCount)
return false;
PolicyGlobal* global_policy =
reinterpret_cast<PolicyGlobal*>(g_shared_policy_memory);
if (!global_policy->entry[ipc_id])
return false;
PolicyBuffer* policy = reinterpret_cast<PolicyBuffer*>(
reinterpret_cast<char*>(g_shared_policy_memory) +
reinterpret_cast<size_t>(global_policy->entry[ipc_id]));
if ((reinterpret_cast<size_t>(global_policy->entry[ipc_id]) >
global_policy->data_size) ||
(g_shared_policy_size < global_policy->data_size)) {
NOTREACHED_NT();
return false;
}
for (int i = 0; i < params->count; i++) {
if (!params->parameters[i].IsValid()) {
NOTREACHED_NT();
return false;
}
}
PolicyProcessor processor(policy);
PolicyResult result = processor.Evaluate(kShortEval, params->parameters,
params->count);
DCHECK_NT(POLICY_ERROR != result);
return POLICY_MATCH == result && ASK_BROKER == processor.GetAction();
}
// -----------------------------------------------------------------------
// Hooks NtSetInformationThread to block RevertToSelf from being
// called before the actual call to LowerToken.
NTSTATUS WINAPI TargetNtSetInformationThread(
NtSetInformationThreadFunction orig_SetInformationThread, HANDLE thread,
NT_THREAD_INFORMATION_CLASS thread_info_class, PVOID thread_information,
ULONG thread_information_bytes) {
do {
if (SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf())
break;
if (ThreadImpersonationToken != thread_info_class)
break;
if (!thread_information)
break;
HANDLE token;
if (sizeof(token) > thread_information_bytes)
break;
NTSTATUS ret = CopyData(&token, thread_information, sizeof(token));
if (!NT_SUCCESS(ret) || NULL != token)
break;
// This is a revert to self.
return STATUS_SUCCESS;
} while (false);
return orig_SetInformationThread(thread, thread_info_class,
thread_information,
thread_information_bytes);
}
// Hooks NtOpenThreadToken to force the open_as_self parameter to be set to
// FALSE if we are still running with the impersonation token. open_as_self set
// to TRUE means that the token will be open using the process token instead of
// the impersonation token. This is bad because the process token does not have
// access to open the thread token.
NTSTATUS WINAPI TargetNtOpenThreadToken(
NtOpenThreadTokenFunction orig_OpenThreadToken, HANDLE thread,
ACCESS_MASK desired_access, BOOLEAN open_as_self, PHANDLE token) {
if (!SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf())
open_as_self = FALSE;
return orig_OpenThreadToken(thread, desired_access, open_as_self, token);
}
// See comment for TargetNtOpenThreadToken
NTSTATUS WINAPI TargetNtOpenThreadTokenEx(
NtOpenThreadTokenExFunction orig_OpenThreadTokenEx, HANDLE thread,
ACCESS_MASK desired_access, BOOLEAN open_as_self, ULONG handle_attributes,
PHANDLE token) {
if (!SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf())
open_as_self = FALSE;
return orig_OpenThreadTokenEx(thread, desired_access, open_as_self,
handle_attributes, token);
}
} // namespace sandbox
|
