1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_ 6 #define SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_ 7 8 #include <windows.h> 9 10 #include "base/basictypes.h" 11 #include "sandbox/win/src/security_level.h" 12 13 namespace sandbox { 14 15 // Sets the mitigation policy for the current process, ignoring any settings 16 // that are invalid for the current version of Windows. 17 bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags flags); 18 19 // Returns the flags that must be enforced after startup for the current OS 20 // version. 21 MitigationFlags FilterPostStartupProcessMitigations(MitigationFlags flags); 22 23 // Converts sandbox flags to the PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES 24 // policy flags used by UpdateProcThreadAttribute(). The size field varies 25 // between a 32-bit and a 64-bit type based on the exact build and version of 26 // Windows, so the returned size must be passed to UpdateProcThreadAttribute(). 27 void ConvertProcessMitigationsToPolicy(MitigationFlags flags, 28 DWORD64* policy_flags, size_t* size); 29 30 // Adds mitigations that need to be performed on the suspended target process 31 // before execution begins. 32 bool ApplyProcessMitigationsToSuspendedProcess(HANDLE process, 33 MitigationFlags flags); 34 35 // Returns true if all the supplied flags can be set after a process starts. 36 bool CanSetProcessMitigationsPostStartup(MitigationFlags flags); 37 38 // Returns true if all the supplied flags can be set before a process starts. 39 bool CanSetProcessMitigationsPreStartup(MitigationFlags flags); 40 41 } // namespace sandbox 42 43 #endif // SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_ 44 45
