1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "sandbox/win/src/app_container.h" 6 7 #include <Sddl.h> 8 #include <vector> 9 10 #include "base/logging.h" 11 #include "base/memory/scoped_ptr.h" 12 #include "base/win/startup_information.h" 13 #include "sandbox/win/src/internal_types.h" 14 15 namespace { 16 17 // Converts the passed in sid string to a PSID that must be relased with 18 // LocalFree. 19 PSID ConvertSid(const base::string16& sid) { 20 PSID local_sid; 21 if (!ConvertStringSidToSid(sid.c_str(), &local_sid)) 22 return NULL; 23 return local_sid; 24 } 25 26 template <typename T> 27 T BindFunction(const char* name) { 28 HMODULE module = GetModuleHandle(sandbox::kKerneldllName); 29 void* function = GetProcAddress(module, name); 30 if (!function) { 31 module = GetModuleHandle(sandbox::kKernelBasedllName); 32 function = GetProcAddress(module, name); 33 } 34 return reinterpret_cast<T>(function); 35 } 36 37 } // namespace 38 39 namespace sandbox { 40 41 AppContainerAttributes::AppContainerAttributes() { 42 memset(&capabilities_, 0, sizeof(capabilities_)); 43 } 44 45 AppContainerAttributes::~AppContainerAttributes() { 46 for (size_t i = 0; i < attributes_.size(); i++) 47 LocalFree(attributes_[i].Sid); 48 LocalFree(capabilities_.AppContainerSid); 49 } 50 51 ResultCode AppContainerAttributes::SetAppContainer( 52 const base::string16& app_container_sid, 53 const std::vector<base::string16>& capabilities) { 54 DCHECK(!capabilities_.AppContainerSid); 55 DCHECK(attributes_.empty()); 56 capabilities_.AppContainerSid = ConvertSid(app_container_sid); 57 if (!capabilities_.AppContainerSid) 58 return SBOX_ERROR_INVALID_APP_CONTAINER; 59 60 for (size_t i = 0; i < capabilities.size(); i++) { 61 SID_AND_ATTRIBUTES sid_and_attributes; 62 sid_and_attributes.Sid = ConvertSid(capabilities[i]); 63 if (!sid_and_attributes.Sid) 64 return SBOX_ERROR_INVALID_CAPABILITY; 65 66 sid_and_attributes.Attributes = SE_GROUP_ENABLED; 67 attributes_.push_back(sid_and_attributes); 68 } 69 70 if (capabilities.size()) { 71 capabilities_.CapabilityCount = static_cast<DWORD>(capabilities.size()); 72 capabilities_.Capabilities = &attributes_[0]; 73 } 74 return SBOX_ALL_OK; 75 } 76 77 ResultCode AppContainerAttributes::ShareForStartup( 78 base::win::StartupInformation* startup_information) const { 79 // The only thing we support so far is an AppContainer. 80 if (!capabilities_.AppContainerSid) 81 return SBOX_ERROR_INVALID_APP_CONTAINER; 82 83 if (!startup_information->UpdateProcThreadAttribute( 84 PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES, 85 const_cast<SECURITY_CAPABILITIES*>(&capabilities_), 86 sizeof(capabilities_))) { 87 DPLOG(ERROR) << "Failed UpdateProcThreadAttribute"; 88 return SBOX_ERROR_CANNOT_INIT_APPCONTAINER; 89 } 90 return SBOX_ALL_OK; 91 } 92 93 bool AppContainerAttributes::HasAppContainer() const { 94 return (capabilities_.AppContainerSid != NULL); 95 } 96 97 ResultCode CreateAppContainer(const base::string16& sid, 98 const base::string16& name) { 99 PSID local_sid; 100 if (!ConvertStringSidToSid(sid.c_str(), &local_sid)) 101 return SBOX_ERROR_INVALID_APP_CONTAINER; 102 103 typedef HRESULT (WINAPI* AppContainerRegisterSidPtr)(PSID sid, 104 LPCWSTR moniker, 105 LPCWSTR display_name); 106 static AppContainerRegisterSidPtr AppContainerRegisterSid = NULL; 107 108 if (!AppContainerRegisterSid) { 109 AppContainerRegisterSid = 110 BindFunction<AppContainerRegisterSidPtr>("AppContainerRegisterSid"); 111 } 112 113 ResultCode operation_result = SBOX_ERROR_GENERIC; 114 if (AppContainerRegisterSid) { 115 HRESULT rv = AppContainerRegisterSid(local_sid, name.c_str(), name.c_str()); 116 if (SUCCEEDED(rv)) 117 operation_result = SBOX_ALL_OK; 118 else 119 DLOG(ERROR) << "AppContainerRegisterSid error:" << std::hex << rv; 120 } 121 LocalFree(local_sid); 122 return operation_result; 123 } 124 125 ResultCode DeleteAppContainer(const base::string16& sid) { 126 PSID local_sid; 127 if (!ConvertStringSidToSid(sid.c_str(), &local_sid)) 128 return SBOX_ERROR_INVALID_APP_CONTAINER; 129 130 typedef HRESULT (WINAPI* AppContainerUnregisterSidPtr)(PSID sid); 131 static AppContainerUnregisterSidPtr AppContainerUnregisterSid = NULL; 132 133 if (!AppContainerUnregisterSid) { 134 AppContainerUnregisterSid = 135 BindFunction<AppContainerUnregisterSidPtr>("AppContainerUnregisterSid"); 136 } 137 138 ResultCode operation_result = SBOX_ERROR_GENERIC; 139 if (AppContainerUnregisterSid) { 140 HRESULT rv = AppContainerUnregisterSid(local_sid); 141 if (SUCCEEDED(rv)) 142 operation_result = SBOX_ALL_OK; 143 else 144 DLOG(ERROR) << "AppContainerUnregisterSid error:" << std::hex << rv; 145 } 146 LocalFree(local_sid); 147 return operation_result; 148 } 149 150 base::string16 LookupAppContainer(const base::string16& sid) { 151 PSID local_sid; 152 if (!ConvertStringSidToSid(sid.c_str(), &local_sid)) 153 return base::string16(); 154 155 typedef HRESULT (WINAPI* AppContainerLookupMonikerPtr)(PSID sid, 156 LPWSTR* moniker); 157 typedef BOOLEAN (WINAPI* AppContainerFreeMemoryPtr)(void* ptr); 158 159 static AppContainerLookupMonikerPtr AppContainerLookupMoniker = NULL; 160 static AppContainerFreeMemoryPtr AppContainerFreeMemory = NULL; 161 162 if (!AppContainerLookupMoniker || !AppContainerFreeMemory) { 163 AppContainerLookupMoniker = 164 BindFunction<AppContainerLookupMonikerPtr>("AppContainerLookupMoniker"); 165 AppContainerFreeMemory = 166 BindFunction<AppContainerFreeMemoryPtr>("AppContainerFreeMemory"); 167 } 168 169 if (!AppContainerLookupMoniker || !AppContainerFreeMemory) 170 return base::string16(); 171 172 wchar_t* buffer = NULL; 173 HRESULT rv = AppContainerLookupMoniker(local_sid, &buffer); 174 if (FAILED(rv)) 175 return base::string16(); 176 177 base::string16 name(buffer); 178 if (!AppContainerFreeMemory(buffer)) 179 NOTREACHED(); 180 return name; 181 } 182 183 } // namespace sandbox 184
