Home | History | Annotate | Download | only in win 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "remoting/host/win/launch_process_with_token.h"
      6 
      7 #include <windows.h>
      8 #include <winternl.h>
      9 
     10 #include <limits>
     11 
     12 #include "base/logging.h"
     13 #include "base/memory/scoped_ptr.h"
     14 #include "base/rand_util.h"
     15 #include "base/scoped_native_library.h"
     16 #include "base/strings/string16.h"
     17 #include "base/strings/stringprintf.h"
     18 #include "base/strings/utf_string_conversions.h"
     19 #include "base/win/scoped_handle.h"
     20 #include "base/win/scoped_process_information.h"
     21 #include "base/win/windows_version.h"
     22 
     23 using base::win::ScopedHandle;
     24 
     25 namespace {
     26 
     27 const char kCreateProcessDefaultPipeNameFormat[] =
     28     "\\\\.\\Pipe\\TerminalServer\\SystemExecSrvr\\%d";
     29 
     30 // Undocumented WINSTATIONINFOCLASS value causing
     31 // winsta!WinStationQueryInformationW() to return the name of the pipe for
     32 // requesting cross-session process creation.
     33 const WINSTATIONINFOCLASS kCreateProcessPipeNameClass =
     34     static_cast<WINSTATIONINFOCLASS>(0x21);
     35 
     36 const int kPipeBusyWaitTimeoutMs = 2000;
     37 const int kPipeConnectMaxAttempts = 3;
     38 
     39 // Terminates the process and closes process and thread handles in
     40 // |process_information| structure.
     41 void CloseHandlesAndTerminateProcess(PROCESS_INFORMATION* process_information) {
     42   if (process_information->hThread) {
     43     CloseHandle(process_information->hThread);
     44     process_information->hThread = NULL;
     45   }
     46 
     47   if (process_information->hProcess) {
     48     TerminateProcess(process_information->hProcess, CONTROL_C_EXIT);
     49     CloseHandle(process_information->hProcess);
     50     process_information->hProcess = NULL;
     51   }
     52 }
     53 
     54 // Connects to the executor server corresponding to |session_id|.
     55 bool ConnectToExecutionServer(uint32 session_id,
     56                               base::win::ScopedHandle* pipe_out) {
     57   base::string16 pipe_name;
     58 
     59   // Use winsta!WinStationQueryInformationW() to determine the process creation
     60   // pipe name for the session.
     61   base::FilePath winsta_path(
     62       base::GetNativeLibraryName(base::UTF8ToUTF16("winsta")));
     63   base::ScopedNativeLibrary winsta(winsta_path);
     64   if (winsta.is_valid()) {
     65     PWINSTATIONQUERYINFORMATIONW win_station_query_information =
     66         reinterpret_cast<PWINSTATIONQUERYINFORMATIONW>(
     67             winsta.GetFunctionPointer("WinStationQueryInformationW"));
     68     if (win_station_query_information) {
     69       wchar_t name[MAX_PATH];
     70       ULONG name_length;
     71       if (win_station_query_information(0,
     72                                         session_id,
     73                                         kCreateProcessPipeNameClass,
     74                                         name,
     75                                         sizeof(name),
     76                                         &name_length)) {
     77         pipe_name.assign(name);
     78       }
     79     }
     80   }
     81 
     82   // Use the default pipe name if we couldn't query its name.
     83   if (pipe_name.empty()) {
     84     pipe_name = base::UTF8ToUTF16(
     85         base::StringPrintf(kCreateProcessDefaultPipeNameFormat, session_id));
     86   }
     87 
     88   // Try to connect to the named pipe.
     89   base::win::ScopedHandle pipe;
     90   for (int i = 0; i < kPipeConnectMaxAttempts; ++i) {
     91     pipe.Set(CreateFile(pipe_name.c_str(),
     92                         GENERIC_READ | GENERIC_WRITE,
     93                         0,
     94                         NULL,
     95                         OPEN_EXISTING,
     96                         0,
     97                         NULL));
     98     if (pipe.IsValid()) {
     99       break;
    100     }
    101 
    102     // Cannot continue retrying if error is something other than
    103     // ERROR_PIPE_BUSY.
    104     if (GetLastError() != ERROR_PIPE_BUSY) {
    105       break;
    106     }
    107 
    108     // Cannot continue retrying if wait on pipe fails.
    109     if (!WaitNamedPipe(pipe_name.c_str(), kPipeBusyWaitTimeoutMs)) {
    110       break;
    111     }
    112   }
    113 
    114   if (!pipe.IsValid()) {
    115     PLOG(ERROR) << "Failed to connect to '" << pipe_name << "'";
    116     return false;
    117   }
    118 
    119   *pipe_out = pipe.Pass();
    120   return true;
    121 }
    122 
    123 // Copies the process token making it a primary impersonation token.
    124 // The returned handle will have |desired_access| rights.
    125 bool CopyProcessToken(DWORD desired_access, ScopedHandle* token_out) {
    126   HANDLE temp_handle;
    127   if (!OpenProcessToken(GetCurrentProcess(),
    128                         TOKEN_DUPLICATE | desired_access,
    129                         &temp_handle)) {
    130     PLOG(ERROR) << "Failed to open process token";
    131     return false;
    132   }
    133   ScopedHandle process_token(temp_handle);
    134 
    135   if (!DuplicateTokenEx(process_token.Get(),
    136                         desired_access,
    137                         NULL,
    138                         SecurityImpersonation,
    139                         TokenPrimary,
    140                         &temp_handle)) {
    141     PLOG(ERROR) << "Failed to duplicate the process token";
    142     return false;
    143   }
    144 
    145   token_out->Set(temp_handle);
    146   return true;
    147 }
    148 
    149 // Creates a copy of the current process with SE_TCB_NAME privilege enabled.
    150 bool CreatePrivilegedToken(ScopedHandle* token_out) {
    151   ScopedHandle privileged_token;
    152   DWORD desired_access = TOKEN_ADJUST_PRIVILEGES | TOKEN_IMPERSONATE |
    153                          TOKEN_DUPLICATE | TOKEN_QUERY;
    154   if (!CopyProcessToken(desired_access, &privileged_token)) {
    155     return false;
    156   }
    157 
    158   // Get the LUID for the SE_TCB_NAME privilege.
    159   TOKEN_PRIVILEGES state;
    160   state.PrivilegeCount = 1;
    161   state.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    162   if (!LookupPrivilegeValue(NULL, SE_TCB_NAME, &state.Privileges[0].Luid)) {
    163     PLOG(ERROR) << "Failed to lookup the LUID for the SE_TCB_NAME privilege";
    164     return false;
    165   }
    166 
    167   // Enable the SE_TCB_NAME privilege.
    168   if (!AdjustTokenPrivileges(privileged_token.Get(), FALSE, &state, 0, NULL,
    169                              0)) {
    170     PLOG(ERROR) << "Failed to enable SE_TCB_NAME privilege in a token";
    171     return false;
    172   }
    173 
    174   *token_out = privileged_token.Pass();
    175   return true;
    176 }
    177 
    178 // Fills the process and thread handles in the passed |process_information|
    179 // structure and resume the process if the caller didn't want to suspend it.
    180 bool ProcessCreateProcessResponse(DWORD creation_flags,
    181                                   PROCESS_INFORMATION* process_information) {
    182   // The execution server does not return handles to the created process and
    183   // thread.
    184   if (!process_information->hProcess) {
    185     // N.B. PROCESS_ALL_ACCESS is different in XP and Vista+ versions of
    186     // the SDK. |desired_access| below is effectively PROCESS_ALL_ACCESS from
    187     // the XP version of the SDK.
    188     DWORD desired_access =
    189         STANDARD_RIGHTS_REQUIRED |
    190         SYNCHRONIZE |
    191         PROCESS_TERMINATE |
    192         PROCESS_CREATE_THREAD |
    193         PROCESS_SET_SESSIONID |
    194         PROCESS_VM_OPERATION |
    195         PROCESS_VM_READ |
    196         PROCESS_VM_WRITE |
    197         PROCESS_DUP_HANDLE |
    198         PROCESS_CREATE_PROCESS |
    199         PROCESS_SET_QUOTA |
    200         PROCESS_SET_INFORMATION |
    201         PROCESS_QUERY_INFORMATION |
    202         PROCESS_SUSPEND_RESUME;
    203     process_information->hProcess =
    204         OpenProcess(desired_access,
    205                     FALSE,
    206                     process_information->dwProcessId);
    207     if (!process_information->hProcess) {
    208       PLOG(ERROR) << "Failed to open the process "
    209                   << process_information->dwProcessId;
    210       return false;
    211     }
    212   }
    213 
    214   if (!process_information->hThread) {
    215     // N.B. THREAD_ALL_ACCESS is different in XP and Vista+ versions of
    216     // the SDK. |desired_access| below is effectively THREAD_ALL_ACCESS from
    217     // the XP version of the SDK.
    218     DWORD desired_access =
    219         STANDARD_RIGHTS_REQUIRED |
    220         SYNCHRONIZE |
    221         THREAD_TERMINATE |
    222         THREAD_SUSPEND_RESUME |
    223         THREAD_GET_CONTEXT |
    224         THREAD_SET_CONTEXT |
    225         THREAD_QUERY_INFORMATION |
    226         THREAD_SET_INFORMATION |
    227         THREAD_SET_THREAD_TOKEN |
    228         THREAD_IMPERSONATE |
    229         THREAD_DIRECT_IMPERSONATION;
    230     process_information->hThread =
    231         OpenThread(desired_access,
    232                    FALSE,
    233                    process_information->dwThreadId);
    234     if (!process_information->hThread) {
    235       PLOG(ERROR) << "Failed to open the thread "
    236                   << process_information->dwThreadId;
    237       return false;
    238     }
    239   }
    240 
    241   // Resume the thread if the caller didn't want to suspend the process.
    242   if ((creation_flags & CREATE_SUSPENDED) == 0) {
    243     if (!ResumeThread(process_information->hThread)) {
    244       PLOG(ERROR) << "Failed to resume the thread "
    245                   << process_information->dwThreadId;
    246       return false;
    247     }
    248   }
    249 
    250   return true;
    251 }
    252 
    253 // Receives the response to a remote process create request.
    254 bool ReceiveCreateProcessResponse(
    255     HANDLE pipe,
    256     PROCESS_INFORMATION* process_information_out) {
    257   struct CreateProcessResponse {
    258     DWORD size;
    259     BOOL success;
    260     DWORD last_error;
    261     PROCESS_INFORMATION process_information;
    262   };
    263 
    264   DWORD bytes;
    265   CreateProcessResponse response;
    266   if (!ReadFile(pipe, &response, sizeof(response), &bytes, NULL)) {
    267     PLOG(ERROR) << "Failed to receive CreateProcessAsUser response";
    268     return false;
    269   }
    270 
    271   // The server sends the data in one chunk so if we didn't received a complete
    272   // answer something bad happend and there is no point in retrying.
    273   if (bytes != sizeof(response)) {
    274     SetLastError(ERROR_RECEIVE_PARTIAL);
    275     return false;
    276   }
    277 
    278   if (!response.success) {
    279     SetLastError(response.last_error);
    280     return false;
    281   }
    282 
    283   *process_information_out = response.process_information;
    284   return true;
    285 }
    286 
    287 // Sends a remote process create request to the execution server.
    288 bool SendCreateProcessRequest(
    289     HANDLE pipe,
    290     const base::FilePath::StringType& application_name,
    291     const base::CommandLine::StringType& command_line,
    292     DWORD creation_flags,
    293     const base::char16* desktop_name) {
    294   // |CreateProcessRequest| structure passes the same parameters to
    295   // the execution server as CreateProcessAsUser() function does. Strings are
    296   // stored as wide strings immediately after the structure. String pointers are
    297   // represented as byte offsets to string data from the beginning of
    298   // the structure.
    299   struct CreateProcessRequest {
    300     DWORD size;
    301     DWORD process_id;
    302     BOOL use_default_token;
    303     HANDLE token;
    304     LPWSTR application_name;
    305     LPWSTR command_line;
    306     SECURITY_ATTRIBUTES process_attributes;
    307     SECURITY_ATTRIBUTES thread_attributes;
    308     BOOL inherit_handles;
    309     DWORD creation_flags;
    310     LPVOID environment;
    311     LPWSTR current_directory;
    312     STARTUPINFOW startup_info;
    313     PROCESS_INFORMATION process_information;
    314   };
    315 
    316   base::string16 desktop;
    317   if (desktop_name)
    318     desktop = desktop_name;
    319 
    320   // Allocate a large enough buffer to hold the CreateProcessRequest structure
    321   // and three NULL-terminated string parameters.
    322   size_t size = sizeof(CreateProcessRequest) + sizeof(wchar_t) *
    323       (application_name.size() + command_line.size() + desktop.size() + 3);
    324   scoped_ptr<char[]> buffer(new char[size]);
    325   memset(buffer.get(), 0, size);
    326 
    327   // Marshal the input parameters.
    328   CreateProcessRequest* request =
    329       reinterpret_cast<CreateProcessRequest*>(buffer.get());
    330   request->size = size;
    331   request->process_id = GetCurrentProcessId();
    332   request->use_default_token = TRUE;
    333   // Always pass CREATE_SUSPENDED to avoid a race between the created process
    334   // exiting too soon and OpenProcess() call below.
    335   request->creation_flags = creation_flags | CREATE_SUSPENDED;
    336   request->startup_info.cb = sizeof(request->startup_info);
    337 
    338   size_t buffer_offset = sizeof(CreateProcessRequest);
    339 
    340   request->application_name = reinterpret_cast<LPWSTR>(buffer_offset);
    341   std::copy(application_name.begin(),
    342             application_name.end(),
    343             reinterpret_cast<wchar_t*>(buffer.get() + buffer_offset));
    344   buffer_offset += (application_name.size() + 1) * sizeof(wchar_t);
    345 
    346   request->command_line = reinterpret_cast<LPWSTR>(buffer_offset);
    347   std::copy(command_line.begin(),
    348             command_line.end(),
    349             reinterpret_cast<wchar_t*>(buffer.get() + buffer_offset));
    350   buffer_offset += (command_line.size() + 1) * sizeof(wchar_t);
    351 
    352   request->startup_info.lpDesktop =
    353       reinterpret_cast<LPWSTR>(buffer_offset);
    354   std::copy(desktop.begin(),
    355             desktop.end(),
    356             reinterpret_cast<wchar_t*>(buffer.get() + buffer_offset));
    357 
    358   // Pass the request to create a process in the target session.
    359   DWORD bytes;
    360   if (!WriteFile(pipe, buffer.get(), size, &bytes, NULL)) {
    361     PLOG(ERROR) << "Failed to send CreateProcessAsUser request";
    362     return false;
    363   }
    364 
    365   return true;
    366 }
    367 
    368 // Requests the execution server to create a process in the specified session
    369 // using the default (i.e. Winlogon) token. This routine relies on undocumented
    370 // OS functionality and will likely not work on anything but XP or W2K3.
    371 bool CreateRemoteSessionProcess(
    372     uint32 session_id,
    373     const base::FilePath::StringType& application_name,
    374     const base::CommandLine::StringType& command_line,
    375     DWORD creation_flags,
    376     const base::char16* desktop_name,
    377     PROCESS_INFORMATION* process_information_out) {
    378   DCHECK_LT(base::win::GetVersion(), base::win::VERSION_VISTA);
    379 
    380   base::win::ScopedHandle pipe;
    381   if (!ConnectToExecutionServer(session_id, &pipe))
    382     return false;
    383 
    384   if (!SendCreateProcessRequest(pipe.Get(), application_name, command_line,
    385                                 creation_flags, desktop_name)) {
    386     return false;
    387   }
    388 
    389   PROCESS_INFORMATION process_information;
    390   if (!ReceiveCreateProcessResponse(pipe.Get(), &process_information))
    391     return false;
    392 
    393   if (!ProcessCreateProcessResponse(creation_flags, &process_information)) {
    394     CloseHandlesAndTerminateProcess(&process_information);
    395     return false;
    396   }
    397 
    398   *process_information_out = process_information;
    399   return true;
    400 }
    401 
    402 }  // namespace
    403 
    404 namespace remoting {
    405 
    406 base::LazyInstance<base::Lock>::Leaky g_inherit_handles_lock =
    407     LAZY_INSTANCE_INITIALIZER;
    408 
    409 // Creates a copy of the current process token for the given |session_id| so
    410 // it can be used to launch a process in that session.
    411 bool CreateSessionToken(uint32 session_id, ScopedHandle* token_out) {
    412   ScopedHandle session_token;
    413   DWORD desired_access = TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID |
    414                          TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_QUERY;
    415   if (!CopyProcessToken(desired_access, &session_token)) {
    416     return false;
    417   }
    418 
    419   // Temporarily enable the SE_TCB_NAME privilege as it is required by
    420   // SetTokenInformation(TokenSessionId).
    421   ScopedHandle privileged_token;
    422   if (!CreatePrivilegedToken(&privileged_token)) {
    423     return false;
    424   }
    425   if (!ImpersonateLoggedOnUser(privileged_token.Get())) {
    426     PLOG(ERROR) << "Failed to impersonate the privileged token";
    427     return false;
    428   }
    429 
    430   // Change the session ID of the token.
    431   DWORD new_session_id = session_id;
    432   if (!SetTokenInformation(session_token.Get(),
    433                            TokenSessionId,
    434                            &new_session_id,
    435                            sizeof(new_session_id))) {
    436     PLOG(ERROR) << "Failed to change session ID of a token";
    437 
    438     // Revert to the default token.
    439     CHECK(RevertToSelf());
    440     return false;
    441   }
    442 
    443   // Revert to the default token.
    444   CHECK(RevertToSelf());
    445 
    446   *token_out = session_token.Pass();
    447   return true;
    448 }
    449 
    450 bool LaunchProcessWithToken(const base::FilePath& binary,
    451                             const base::CommandLine::StringType& command_line,
    452                             HANDLE user_token,
    453                             SECURITY_ATTRIBUTES* process_attributes,
    454                             SECURITY_ATTRIBUTES* thread_attributes,
    455                             bool inherit_handles,
    456                             DWORD creation_flags,
    457                             const base::char16* desktop_name,
    458                             ScopedHandle* process_out,
    459                             ScopedHandle* thread_out) {
    460   base::FilePath::StringType application_name = binary.value();
    461 
    462   STARTUPINFOW startup_info;
    463   memset(&startup_info, 0, sizeof(startup_info));
    464   startup_info.cb = sizeof(startup_info);
    465   if (desktop_name)
    466     startup_info.lpDesktop = const_cast<base::char16*>(desktop_name);
    467 
    468   PROCESS_INFORMATION temp_process_info = {};
    469   BOOL result = CreateProcessAsUser(user_token,
    470                                     application_name.c_str(),
    471                                     const_cast<LPWSTR>(command_line.c_str()),
    472                                     process_attributes,
    473                                     thread_attributes,
    474                                     inherit_handles,
    475                                     creation_flags,
    476                                     NULL,
    477                                     NULL,
    478                                     &startup_info,
    479                                     &temp_process_info);
    480 
    481   // CreateProcessAsUser will fail on XP and W2K3 with ERROR_PIPE_NOT_CONNECTED
    482   // if the user hasn't logged to the target session yet. In such a case
    483   // we try to talk to the execution server directly emulating what
    484   // the undocumented and not-exported advapi32!CreateRemoteSessionProcessW()
    485   // function does. The created process will run under Winlogon'a token instead
    486   // of |user_token|. Since Winlogon runs as SYSTEM, this suits our needs.
    487   if (!result &&
    488       GetLastError() == ERROR_PIPE_NOT_CONNECTED &&
    489       base::win::GetVersion() < base::win::VERSION_VISTA) {
    490     DWORD session_id;
    491     DWORD return_length;
    492     result = GetTokenInformation(user_token,
    493                                  TokenSessionId,
    494                                  &session_id,
    495                                  sizeof(session_id),
    496                                  &return_length);
    497     if (result && session_id != 0) {
    498       result = CreateRemoteSessionProcess(session_id,
    499                                           application_name,
    500                                           command_line,
    501                                           creation_flags,
    502                                           desktop_name,
    503                                           &temp_process_info);
    504     } else {
    505       // Restore the error status returned by CreateProcessAsUser().
    506       result = FALSE;
    507       SetLastError(ERROR_PIPE_NOT_CONNECTED);
    508     }
    509   }
    510 
    511   if (!result) {
    512     PLOG(ERROR) << "Failed to launch a process with a user token";
    513     return false;
    514   }
    515 
    516   base::win::ScopedProcessInformation process_info(temp_process_info);
    517 
    518   CHECK(process_info.IsValid());
    519   process_out->Set(process_info.TakeProcessHandle());
    520   thread_out->Set(process_info.TakeThreadHandle());
    521   return true;
    522 }
    523 
    524 }  // namespace remoting
    525