1 // Copyright (c) 2006-2010 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef SANDBOX_SRC_PROCESS_THREAD_POLICY_H_ 6 #define SANDBOX_SRC_PROCESS_THREAD_POLICY_H_ 7 8 #include <string> 9 10 #include "sandbox/win/src/policy_low_level.h" 11 12 #include "base/basictypes.h" 13 #include "sandbox/win/src/crosscall_server.h" 14 #include "sandbox/win/src/sandbox_policy.h" 15 16 namespace sandbox { 17 18 enum EvalResult; 19 20 // This class centralizes most of the knowledge related to process execution. 21 class ProcessPolicy { 22 public: 23 // Creates the required low-level policy rules to evaluate a high-level. 24 // policy rule for process creation 25 // 'name' is the executable to be spawn. 26 // 'semantics' is the desired semantics. 27 // 'policy' is the policy generator to which the rules are going to be added. 28 static bool GenerateRules(const wchar_t* name, 29 TargetPolicy::Semantics semantics, 30 LowLevelPolicy* policy); 31 32 // Opens a thread from the child process and returns the handle. 33 // client_info contains the information about the child process, 34 // desired_access is the access requested by the child and thread_id 35 // is the thread_id to be opened. 36 // The function returns the return value of NtOpenThread. 37 static NTSTATUS OpenThreadAction(const ClientInfo& client_info, 38 uint32 desired_access, 39 uint32 thread_id, 40 HANDLE* handle); 41 42 // Opens the process id passed in and returns the duplicated handle to 43 // the child. We only allow the child processes to open themselves. Any other 44 // pid open is denied. 45 static NTSTATUS OpenProcessAction(const ClientInfo& client_info, 46 uint32 desired_access, 47 uint32 process_id, 48 HANDLE* handle); 49 50 // Opens the token associated with the process and returns the duplicated 51 // handle to the child. We only allow the child processes to open his own 52 // token (using ::GetCurrentProcess()). 53 static NTSTATUS OpenProcessTokenAction(const ClientInfo& client_info, 54 HANDLE process, 55 uint32 desired_access, 56 HANDLE* handle); 57 58 // Opens the token associated with the process and returns the duplicated 59 // handle to the child. We only allow the child processes to open his own 60 // token (using ::GetCurrentProcess()). 61 static NTSTATUS OpenProcessTokenExAction(const ClientInfo& client_info, 62 HANDLE process, 63 uint32 desired_access, 64 uint32 attributes, 65 HANDLE* handle); 66 67 // Processes a 'CreateProcessW()' request from the target. 68 // 'client_info' : the target process that is making the request. 69 // 'eval_result' : The desired policy action to accomplish. 70 // 'app_name' : The full path of the process to be created. 71 // 'command_line' : The command line passed to the created process. 72 static DWORD CreateProcessWAction(EvalResult eval_result, 73 const ClientInfo& client_info, 74 const std::wstring &app_name, 75 const std::wstring &command_line, 76 PROCESS_INFORMATION* process_info); 77 }; 78 79 } // namespace sandbox 80 81 82 #endif // SANDBOX_SRC_PROCESS_THREAD_POLICY_H_ 83
