1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include <algorithm> 6 #include <cctype> 7 8 #include <windows.h> 9 #include <winioctl.h> 10 11 #include "base/win/scoped_handle.h" 12 #include "sandbox/win/src/filesystem_policy.h" 13 #include "sandbox/win/src/nt_internals.h" 14 #include "sandbox/win/src/sandbox.h" 15 #include "sandbox/win/src/sandbox_factory.h" 16 #include "sandbox/win/src/sandbox_policy.h" 17 #include "sandbox/win/src/win_utils.h" 18 #include "sandbox/win/tests/common/controller.h" 19 #include "sandbox/win/tests/common/test_utils.h" 20 #include "testing/gtest/include/gtest/gtest.h" 21 22 #define BINDNTDLL(name) \ 23 name ## Function name = reinterpret_cast<name ## Function>( \ 24 ::GetProcAddress(::GetModuleHandle(L"ntdll.dll"), #name)) 25 26 namespace sandbox { 27 28 const ULONG kSharing = FILE_SHARE_WRITE | FILE_SHARE_READ | FILE_SHARE_DELETE; 29 30 // Creates a file using different desired access. Returns if the call succeeded 31 // or not. The first argument in argv is the filename. If the second argument 32 // is "read", we try read only access. Otherwise we try read-write access. 33 SBOX_TESTS_COMMAND int File_Create(int argc, wchar_t **argv) { 34 if (argc != 2) 35 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 36 37 bool read = (_wcsicmp(argv[0], L"Read") == 0); 38 39 if (read) { 40 base::win::ScopedHandle file1(CreateFile( 41 argv[1], GENERIC_READ, kSharing, NULL, OPEN_EXISTING, 0, NULL)); 42 base::win::ScopedHandle file2(CreateFile( 43 argv[1], FILE_EXECUTE, kSharing, NULL, OPEN_EXISTING, 0, NULL)); 44 45 if (file1.Get() && file2.Get()) 46 return SBOX_TEST_SUCCEEDED; 47 return SBOX_TEST_DENIED; 48 } else { 49 base::win::ScopedHandle file1(CreateFile( 50 argv[1], GENERIC_ALL, kSharing, NULL, OPEN_EXISTING, 0, NULL)); 51 base::win::ScopedHandle file2(CreateFile( 52 argv[1], GENERIC_READ | FILE_WRITE_DATA, kSharing, NULL, OPEN_EXISTING, 53 0, NULL)); 54 55 if (file1.Get() && file2.Get()) 56 return SBOX_TEST_SUCCEEDED; 57 return SBOX_TEST_DENIED; 58 } 59 } 60 61 SBOX_TESTS_COMMAND int File_Win32Create(int argc, wchar_t **argv) { 62 if (argc != 1) { 63 SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 64 } 65 66 base::string16 full_path = MakePathToSys(argv[0], false); 67 if (full_path.empty()) { 68 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 69 } 70 71 HANDLE file = ::CreateFileW(full_path.c_str(), GENERIC_READ, kSharing, 72 NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); 73 74 if (INVALID_HANDLE_VALUE != file) { 75 ::CloseHandle(file); 76 return SBOX_TEST_SUCCEEDED; 77 } else { 78 if (ERROR_ACCESS_DENIED == ::GetLastError()) { 79 return SBOX_TEST_DENIED; 80 } else { 81 return SBOX_TEST_FAILED; 82 } 83 } 84 return SBOX_TEST_SUCCEEDED; 85 } 86 87 // Creates the file in parameter using the NtCreateFile api and returns if the 88 // call succeeded or not. 89 SBOX_TESTS_COMMAND int File_CreateSys32(int argc, wchar_t **argv) { 90 BINDNTDLL(NtCreateFile); 91 BINDNTDLL(RtlInitUnicodeString); 92 if (!NtCreateFile || !RtlInitUnicodeString) 93 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 94 95 if (argc != 1) 96 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 97 98 base::string16 file(argv[0]); 99 if (0 != _wcsnicmp(file.c_str(), kNTObjManPrefix, kNTObjManPrefixLen)) 100 file = MakePathToSys(argv[0], true); 101 102 UNICODE_STRING object_name; 103 RtlInitUnicodeString(&object_name, file.c_str()); 104 105 OBJECT_ATTRIBUTES obj_attributes = {0}; 106 InitializeObjectAttributes(&obj_attributes, &object_name, 107 OBJ_CASE_INSENSITIVE, NULL, NULL); 108 109 HANDLE handle; 110 IO_STATUS_BLOCK io_block = {0}; 111 NTSTATUS status = NtCreateFile(&handle, FILE_READ_DATA, &obj_attributes, 112 &io_block, NULL, 0, kSharing, FILE_OPEN, 113 0, NULL, 0); 114 if (NT_SUCCESS(status)) { 115 ::CloseHandle(handle); 116 return SBOX_TEST_SUCCEEDED; 117 } else if (STATUS_ACCESS_DENIED == status) { 118 return SBOX_TEST_DENIED; 119 } else if (STATUS_OBJECT_NAME_NOT_FOUND == status) { 120 return SBOX_TEST_NOT_FOUND; 121 } 122 return SBOX_TEST_FAILED; 123 } 124 125 // Opens the file in parameter using the NtOpenFile api and returns if the 126 // call succeeded or not. 127 SBOX_TESTS_COMMAND int File_OpenSys32(int argc, wchar_t **argv) { 128 BINDNTDLL(NtOpenFile); 129 BINDNTDLL(RtlInitUnicodeString); 130 if (!NtOpenFile || !RtlInitUnicodeString) 131 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 132 133 if (argc != 1) 134 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 135 136 base::string16 file = MakePathToSys(argv[0], true); 137 UNICODE_STRING object_name; 138 RtlInitUnicodeString(&object_name, file.c_str()); 139 140 OBJECT_ATTRIBUTES obj_attributes = {0}; 141 InitializeObjectAttributes(&obj_attributes, &object_name, 142 OBJ_CASE_INSENSITIVE, NULL, NULL); 143 144 HANDLE handle; 145 IO_STATUS_BLOCK io_block = {0}; 146 NTSTATUS status = NtOpenFile(&handle, FILE_READ_DATA, &obj_attributes, 147 &io_block, kSharing, 0); 148 if (NT_SUCCESS(status)) { 149 ::CloseHandle(handle); 150 return SBOX_TEST_SUCCEEDED; 151 } else if (STATUS_ACCESS_DENIED == status) { 152 return SBOX_TEST_DENIED; 153 } else if (STATUS_OBJECT_NAME_NOT_FOUND == status) { 154 return SBOX_TEST_NOT_FOUND; 155 } 156 return SBOX_TEST_FAILED; 157 } 158 159 SBOX_TESTS_COMMAND int File_GetDiskSpace(int argc, wchar_t **argv) { 160 base::string16 sys_path = MakePathToSys(L"", false); 161 if (sys_path.empty()) { 162 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 163 } 164 ULARGE_INTEGER free_user = {0}; 165 ULARGE_INTEGER total = {0}; 166 ULARGE_INTEGER free_total = {0}; 167 if (::GetDiskFreeSpaceExW(sys_path.c_str(), &free_user, &total, 168 &free_total)) { 169 if ((total.QuadPart != 0) && (free_total.QuadPart !=0)) { 170 return SBOX_TEST_SUCCEEDED; 171 } 172 } else { 173 if (ERROR_ACCESS_DENIED == ::GetLastError()) { 174 return SBOX_TEST_DENIED; 175 } else { 176 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 177 } 178 } 179 return SBOX_TEST_SUCCEEDED; 180 } 181 182 // Move a file using the MoveFileEx api and returns if the call succeeded or 183 // not. 184 SBOX_TESTS_COMMAND int File_Rename(int argc, wchar_t **argv) { 185 if (argc != 2) 186 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 187 188 if (::MoveFileEx(argv[0], argv[1], 0)) 189 return SBOX_TEST_SUCCEEDED; 190 191 if (::GetLastError() != ERROR_ACCESS_DENIED) 192 return SBOX_TEST_FAILED; 193 194 return SBOX_TEST_DENIED; 195 } 196 197 // Query the attributes of file in parameter using the NtQueryAttributesFile api 198 // and NtQueryFullAttributesFile and returns if the call succeeded or not. The 199 // second argument in argv is "d" or "f" telling if we expect the attributes to 200 // specify a file or a directory. The expected attribute has to match the real 201 // attributes for the call to be successful. 202 SBOX_TESTS_COMMAND int File_QueryAttributes(int argc, wchar_t **argv) { 203 BINDNTDLL(NtQueryAttributesFile); 204 BINDNTDLL(NtQueryFullAttributesFile); 205 BINDNTDLL(RtlInitUnicodeString); 206 if (!NtQueryAttributesFile || !NtQueryFullAttributesFile || 207 !RtlInitUnicodeString) 208 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 209 210 if (argc != 2) 211 return SBOX_TEST_FAILED_TO_EXECUTE_COMMAND; 212 213 bool expect_directory = (L'd' == argv[1][0]); 214 215 UNICODE_STRING object_name; 216 base::string16 file = MakePathToSys(argv[0], true); 217 RtlInitUnicodeString(&object_name, file.c_str()); 218 219 OBJECT_ATTRIBUTES obj_attributes = {0}; 220 InitializeObjectAttributes(&obj_attributes, &object_name, 221 OBJ_CASE_INSENSITIVE, NULL, NULL); 222 223 FILE_BASIC_INFORMATION info = {0}; 224 FILE_NETWORK_OPEN_INFORMATION full_info = {0}; 225 NTSTATUS status1 = NtQueryAttributesFile(&obj_attributes, &info); 226 NTSTATUS status2 = NtQueryFullAttributesFile(&obj_attributes, &full_info); 227 228 if (status1 != status2) 229 return SBOX_TEST_FAILED; 230 231 if (NT_SUCCESS(status1)) { 232 if (info.FileAttributes != full_info.FileAttributes) 233 return SBOX_TEST_FAILED; 234 235 bool is_directory1 = (info.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0; 236 if (expect_directory == is_directory1) 237 return SBOX_TEST_SUCCEEDED; 238 } else if (STATUS_ACCESS_DENIED == status1) { 239 return SBOX_TEST_DENIED; 240 } else if (STATUS_OBJECT_NAME_NOT_FOUND == status1) { 241 return SBOX_TEST_NOT_FOUND; 242 } 243 244 return SBOX_TEST_FAILED; 245 } 246 247 TEST(FilePolicyTest, DenyNtCreateCalc) { 248 TestRunner runner; 249 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_DIR_ANY, 250 L"calc.exe")); 251 252 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_CreateSys32 calc.exe")); 253 254 runner.SetTestState(BEFORE_REVERT); 255 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_CreateSys32 calc.exe")); 256 } 257 258 TEST(FilePolicyTest, AllowNtCreateCalc) { 259 TestRunner runner; 260 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, L"calc.exe")); 261 262 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_CreateSys32 calc.exe")); 263 264 runner.SetTestState(BEFORE_REVERT); 265 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_CreateSys32 calc.exe")); 266 } 267 268 TEST(FilePolicyTest, AllowNtCreateWithNativePath) { 269 base::string16 calc = MakePathToSys(L"calc.exe", false); 270 base::string16 nt_path; 271 ASSERT_TRUE(GetNtPathFromWin32Path(calc, &nt_path)); 272 TestRunner runner; 273 runner.AddFsRule(TargetPolicy::FILES_ALLOW_READONLY, nt_path.c_str()); 274 275 wchar_t buff[MAX_PATH]; 276 ::wsprintfW(buff, L"File_CreateSys32 %s", nt_path.c_str()); 277 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(buff)); 278 279 std::transform(nt_path.begin(), nt_path.end(), nt_path.begin(), std::tolower); 280 ::wsprintfW(buff, L"File_CreateSys32 %s", nt_path.c_str()); 281 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(buff)); 282 } 283 284 TEST(FilePolicyTest, AllowReadOnly) { 285 TestRunner runner; 286 287 // Create a temp file because we need write access to it. 288 wchar_t temp_directory[MAX_PATH]; 289 wchar_t temp_file_name[MAX_PATH]; 290 ASSERT_NE(::GetTempPath(MAX_PATH, temp_directory), 0u); 291 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name), 0u); 292 293 EXPECT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_READONLY, 294 temp_file_name)); 295 296 wchar_t command_read[MAX_PATH + 20] = {0}; 297 wsprintf(command_read, L"File_Create Read \"%ls\"", temp_file_name); 298 wchar_t command_write[MAX_PATH + 20] = {0}; 299 wsprintf(command_write, L"File_Create Write \"%ls\"", temp_file_name); 300 301 // Verify that we have read access after revert. 302 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(command_read)); 303 304 // Verify that we don't have write access after revert. 305 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command_write)); 306 307 // Verify that we really have write access to the file. 308 runner.SetTestState(BEFORE_REVERT); 309 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(command_write)); 310 311 DeleteFile(temp_file_name); 312 } 313 314 TEST(FilePolicyTest, AllowWildcard) { 315 TestRunner runner; 316 317 // Create a temp file because we need write access to it. 318 wchar_t temp_directory[MAX_PATH]; 319 wchar_t temp_file_name[MAX_PATH]; 320 ASSERT_NE(::GetTempPath(MAX_PATH, temp_directory), 0u); 321 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name), 0u); 322 323 wcscat_s(temp_directory, MAX_PATH, L"*"); 324 EXPECT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_directory)); 325 326 wchar_t command_write[MAX_PATH + 20] = {0}; 327 wsprintf(command_write, L"File_Create Write \"%ls\"", temp_file_name); 328 329 // Verify that we have write access after revert. 330 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(command_write)); 331 332 DeleteFile(temp_file_name); 333 } 334 335 TEST(FilePolicyTest, AllowNtCreatePatternRule) { 336 TestRunner runner; 337 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, L"App*.dll")); 338 339 EXPECT_EQ(SBOX_TEST_SUCCEEDED, 340 runner.RunTest(L"File_OpenSys32 appmgmts.dll")); 341 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_OpenSys32 appwiz.cpl")); 342 343 runner.SetTestState(BEFORE_REVERT); 344 EXPECT_EQ(SBOX_TEST_SUCCEEDED, 345 runner.RunTest(L"File_OpenSys32 appmgmts.dll")); 346 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_OpenSys32 appwiz.cpl")); 347 } 348 349 TEST(FilePolicyTest, CheckNotFound) { 350 TestRunner runner; 351 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, L"n*.dll")); 352 353 EXPECT_EQ(SBOX_TEST_NOT_FOUND, 354 runner.RunTest(L"File_OpenSys32 notfound.dll")); 355 } 356 357 TEST(FilePolicyTest, CheckNoLeak) { 358 TestRunner runner; 359 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_CreateSys32 notfound.exe")); 360 } 361 362 TEST(FilePolicyTest, TestQueryAttributesFile) { 363 TestRunner runner; 364 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, 365 L"appmgmts.dll")); 366 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, 367 L"notfound.exe")); 368 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, L"drivers")); 369 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_QUERY, 370 L"ipconfig.exe")); 371 372 EXPECT_EQ(SBOX_TEST_SUCCEEDED, 373 runner.RunTest(L"File_QueryAttributes drivers d")); 374 375 EXPECT_EQ(SBOX_TEST_SUCCEEDED, 376 runner.RunTest(L"File_QueryAttributes appmgmts.dll f")); 377 378 EXPECT_EQ(SBOX_TEST_SUCCEEDED, 379 runner.RunTest(L"File_QueryAttributes ipconfig.exe f")); 380 381 EXPECT_EQ(SBOX_TEST_DENIED, 382 runner.RunTest(L"File_QueryAttributes ftp.exe f")); 383 384 EXPECT_EQ(SBOX_TEST_NOT_FOUND, 385 runner.RunTest(L"File_QueryAttributes notfound.exe f")); 386 } 387 388 // Makes sure that we don't leak information when there is not policy to allow 389 // a path. 390 TEST(FilePolicyTest, TestQueryAttributesFileNoPolicy) { 391 TestRunner runner; 392 EXPECT_EQ(SBOX_TEST_DENIED, 393 runner.RunTest(L"File_QueryAttributes ftp.exe f")); 394 395 EXPECT_EQ(SBOX_TEST_DENIED, 396 runner.RunTest(L"File_QueryAttributes notfound.exe f")); 397 } 398 399 TEST(FilePolicyTest, TestRename) { 400 TestRunner runner; 401 402 // Give access to the temp directory. 403 wchar_t temp_directory[MAX_PATH]; 404 wchar_t temp_file_name1[MAX_PATH]; 405 wchar_t temp_file_name2[MAX_PATH]; 406 wchar_t temp_file_name3[MAX_PATH]; 407 wchar_t temp_file_name4[MAX_PATH]; 408 wchar_t temp_file_name5[MAX_PATH]; 409 wchar_t temp_file_name6[MAX_PATH]; 410 wchar_t temp_file_name7[MAX_PATH]; 411 wchar_t temp_file_name8[MAX_PATH]; 412 ASSERT_NE(::GetTempPath(MAX_PATH, temp_directory), 0u); 413 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name1), 0u); 414 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name2), 0u); 415 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name3), 0u); 416 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name4), 0u); 417 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name5), 0u); 418 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name6), 0u); 419 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name7), 0u); 420 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name8), 0u); 421 422 423 // Add rules to make file1->file2 succeed. 424 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_file_name1)); 425 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_file_name2)); 426 427 // Add rules to make file3->file4 fail. 428 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_file_name3)); 429 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_READONLY, 430 temp_file_name4)); 431 432 // Add rules to make file5->file6 fail. 433 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_READONLY, 434 temp_file_name5)); 435 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_file_name6)); 436 437 // Add rules to make file7->no_pol_file fail. 438 ASSERT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, temp_file_name7)); 439 440 // Delete the files where the files are going to be renamed to. 441 ::DeleteFile(temp_file_name2); 442 ::DeleteFile(temp_file_name4); 443 ::DeleteFile(temp_file_name6); 444 ::DeleteFile(temp_file_name8); 445 446 447 wchar_t command[MAX_PATH*2 + 20] = {0}; 448 wsprintf(command, L"File_Rename \"%ls\" \"%ls\"", temp_file_name1, 449 temp_file_name2); 450 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(command)); 451 452 wsprintf(command, L"File_Rename \"%ls\" \"%ls\"", temp_file_name3, 453 temp_file_name4); 454 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command)); 455 456 wsprintf(command, L"File_Rename \"%ls\" \"%ls\"", temp_file_name5, 457 temp_file_name6); 458 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command)); 459 460 wsprintf(command, L"File_Rename \"%ls\" \"%ls\"", temp_file_name7, 461 temp_file_name8); 462 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command)); 463 464 465 // Delete all the files in case they are still there. 466 ::DeleteFile(temp_file_name1); 467 ::DeleteFile(temp_file_name2); 468 ::DeleteFile(temp_file_name3); 469 ::DeleteFile(temp_file_name4); 470 ::DeleteFile(temp_file_name5); 471 ::DeleteFile(temp_file_name6); 472 ::DeleteFile(temp_file_name7); 473 ::DeleteFile(temp_file_name8); 474 } 475 476 TEST(FilePolicyTest, OpenSys32FilesDenyBecauseOfDir) { 477 TestRunner runner; 478 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_DIR_ANY, 479 L"notepad.exe")); 480 481 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_Win32Create notepad.exe")); 482 483 runner.SetTestState(BEFORE_REVERT); 484 EXPECT_EQ(SBOX_TEST_SUCCEEDED, 485 runner.RunTest(L"File_Win32Create notepad.exe")); 486 } 487 488 TEST(FilePolicyTest, OpenSys32FilesAllowNotepad) { 489 TestRunner runner; 490 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_ANY, 491 L"notepad.exe")); 492 493 EXPECT_EQ(SBOX_TEST_SUCCEEDED, 494 runner.RunTest(L"File_Win32Create notepad.exe")); 495 496 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_Win32Create calc.exe")); 497 498 runner.SetTestState(BEFORE_REVERT); 499 EXPECT_EQ(SBOX_TEST_SUCCEEDED, 500 runner.RunTest(L"File_Win32Create notepad.exe")); 501 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_Win32Create calc.exe")); 502 } 503 504 TEST(FilePolicyTest, FileGetDiskSpace) { 505 TestRunner runner; 506 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_GetDiskSpace")); 507 runner.SetTestState(BEFORE_REVERT); 508 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_GetDiskSpace")); 509 510 // Add an 'allow' rule in the windows\system32 such that GetDiskFreeSpaceEx 511 // succeeds (it does an NtOpenFile) but windows\system32\notepad.exe is 512 // denied since there is no wild card in the rule. 513 EXPECT_TRUE(runner.AddRuleSys32(TargetPolicy::FILES_ALLOW_DIR_ANY, L"")); 514 runner.SetTestState(BEFORE_REVERT); 515 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_GetDiskSpace")); 516 517 runner.SetTestState(AFTER_REVERT); 518 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"File_GetDiskSpace")); 519 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"File_Win32Create notepad.exe")); 520 } 521 522 // http://crbug.com/146944 523 TEST(FilePolicyTest, DISABLED_TestReparsePoint) { 524 TestRunner runner; 525 526 // Create a temp file because we need write access to it. 527 wchar_t temp_directory[MAX_PATH]; 528 wchar_t temp_file_name[MAX_PATH]; 529 ASSERT_NE(::GetTempPath(MAX_PATH, temp_directory), 0u); 530 ASSERT_NE(::GetTempFileName(temp_directory, L"test", 0, temp_file_name), 0u); 531 532 // Delete the file and create a directory instead. 533 ASSERT_TRUE(::DeleteFile(temp_file_name)); 534 ASSERT_TRUE(::CreateDirectory(temp_file_name, NULL)); 535 536 // Create a temporary file in the subfolder. 537 base::string16 subfolder = temp_file_name; 538 base::string16 temp_file_title = subfolder.substr(subfolder.rfind(L"\\") + 1); 539 base::string16 temp_file = subfolder + L"\\file_" + temp_file_title; 540 541 HANDLE file = ::CreateFile(temp_file.c_str(), FILE_ALL_ACCESS, 542 FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, 543 CREATE_ALWAYS, 0, NULL); 544 ASSERT_TRUE(INVALID_HANDLE_VALUE != file); 545 ASSERT_TRUE(::CloseHandle(file)); 546 547 // Create a temporary file in the temp directory. 548 base::string16 temp_dir = temp_directory; 549 base::string16 temp_file_in_temp = temp_dir + L"file_" + temp_file_title; 550 file = ::CreateFile(temp_file_in_temp.c_str(), FILE_ALL_ACCESS, 551 FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, 552 CREATE_ALWAYS, 0, NULL); 553 ASSERT_TRUE(file != NULL); 554 ASSERT_TRUE(::CloseHandle(file)); 555 556 // Give write access to the temp directory. 557 base::string16 temp_dir_wildcard = temp_dir + L"*"; 558 EXPECT_TRUE(runner.AddFsRule(TargetPolicy::FILES_ALLOW_ANY, 559 temp_dir_wildcard.c_str())); 560 561 // Prepare the command to execute. 562 base::string16 command_write; 563 command_write += L"File_Create Write \""; 564 command_write += temp_file; 565 command_write += L"\""; 566 567 // Verify that we have write access to the original file 568 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(command_write.c_str())); 569 570 // Replace the subfolder by a reparse point to %temp%. 571 ::DeleteFile(temp_file.c_str()); 572 HANDLE dir = ::CreateFile(subfolder.c_str(), FILE_ALL_ACCESS, 573 FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, 574 OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL); 575 EXPECT_TRUE(INVALID_HANDLE_VALUE != dir); 576 577 base::string16 temp_dir_nt; 578 temp_dir_nt += L"\\??\\"; 579 temp_dir_nt += temp_dir; 580 EXPECT_TRUE(SetReparsePoint(dir, temp_dir_nt.c_str())); 581 EXPECT_TRUE(::CloseHandle(dir)); 582 583 // Try to open the file again. 584 EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command_write.c_str())); 585 586 // Remove the reparse point. 587 dir = ::CreateFile(subfolder.c_str(), FILE_ALL_ACCESS, 588 FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 589 FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, 590 NULL); 591 EXPECT_TRUE(INVALID_HANDLE_VALUE != dir); 592 EXPECT_TRUE(DeleteReparsePoint(dir)); 593 EXPECT_TRUE(::CloseHandle(dir)); 594 595 // Cleanup. 596 EXPECT_TRUE(::DeleteFile(temp_file_in_temp.c_str())); 597 EXPECT_TRUE(::RemoveDirectory(subfolder.c_str())); 598 } 599 600 TEST(FilePolicyTest, CheckExistingNTPrefixEscape) { 601 base::string16 name = L"\\??\\NAME"; 602 603 base::string16 result = FixNTPrefixForMatch(name); 604 605 EXPECT_STREQ(result.c_str(), L"\\/?/?\\NAME"); 606 } 607 608 TEST(FilePolicyTest, CheckEscapedNTPrefixNoEscape) { 609 base::string16 name = L"\\/?/?\\NAME"; 610 611 base::string16 result = FixNTPrefixForMatch(name); 612 613 EXPECT_STREQ(result.c_str(), name.c_str()); 614 } 615 616 TEST(FilePolicyTest, CheckMissingNTPrefixEscape) { 617 base::string16 name = L"C:\\NAME"; 618 619 base::string16 result = FixNTPrefixForMatch(name); 620 621 EXPECT_STREQ(result.c_str(), L"\\/?/?\\C:\\NAME"); 622 } 623 624 } // namespace sandbox 625
