1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <map>
6
7 #include "sandbox/win/src/policy_broker.h"
8
9 #include "base/logging.h"
10 #include "base/win/pe_image.h"
11 #include "base/win/windows_version.h"
12 #include "sandbox/win/src/interception.h"
13 #include "sandbox/win/src/interceptors.h"
14 #include "sandbox/win/src/policy_target.h"
15 #include "sandbox/win/src/process_thread_interception.h"
16 #include "sandbox/win/src/sandbox.h"
17 #include "sandbox/win/src/sandbox_nt_types.h"
18 #include "sandbox/win/src/sandbox_types.h"
19 #include "sandbox/win/src/target_process.h"
20
21 // This code executes on the broker side, as a callback from the policy on the
22 // target side (the child).
23
24 namespace sandbox {
25
26 // This is the list of all imported symbols from ntdll.dll.
27 SANDBOX_INTERCEPT NtExports g_nt;
28
29 #define INIT_GLOBAL_NT(member) \
30 g_nt.member = reinterpret_cast<Nt##member##Function>( \
31 ntdll_image.GetProcAddress("Nt" #member)); \
32 if (NULL == g_nt.member) \
33 return false
34
35 #define INIT_GLOBAL_RTL(member) \
36 g_nt.member = reinterpret_cast<member##Function>( \
37 ntdll_image.GetProcAddress(#member)); \
38 if (NULL == g_nt.member) \
39 return false
40
SetupNtdllImports(TargetProcess * child)41 bool SetupNtdllImports(TargetProcess *child) {
42 HMODULE ntdll = ::GetModuleHandle(kNtdllName);
43 base::win::PEImage ntdll_image(ntdll);
44
45 // Bypass purify's interception.
46 wchar_t* loader_get = reinterpret_cast<wchar_t*>(
47 ntdll_image.GetProcAddress("LdrGetDllHandle"));
48 if (loader_get) {
49 GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
50 GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
51 loader_get, &ntdll);
52 }
53
54 INIT_GLOBAL_NT(AllocateVirtualMemory);
55 INIT_GLOBAL_NT(Close);
56 INIT_GLOBAL_NT(DuplicateObject);
57 INIT_GLOBAL_NT(FreeVirtualMemory);
58 INIT_GLOBAL_NT(MapViewOfSection);
59 INIT_GLOBAL_NT(ProtectVirtualMemory);
60 INIT_GLOBAL_NT(QueryInformationProcess);
61 INIT_GLOBAL_NT(QueryObject);
62 INIT_GLOBAL_NT(QuerySection);
63 INIT_GLOBAL_NT(QueryVirtualMemory);
64 INIT_GLOBAL_NT(UnmapViewOfSection);
65
66 INIT_GLOBAL_RTL(RtlAllocateHeap);
67 INIT_GLOBAL_RTL(RtlAnsiStringToUnicodeString);
68 INIT_GLOBAL_RTL(RtlCompareUnicodeString);
69 INIT_GLOBAL_RTL(RtlCreateHeap);
70 INIT_GLOBAL_RTL(RtlCreateUserThread);
71 INIT_GLOBAL_RTL(RtlDestroyHeap);
72 INIT_GLOBAL_RTL(RtlFreeHeap);
73 INIT_GLOBAL_RTL(_strnicmp);
74 INIT_GLOBAL_RTL(strlen);
75 INIT_GLOBAL_RTL(wcslen);
76 INIT_GLOBAL_RTL(memcpy);
77
78 #ifndef NDEBUG
79 // Verify that the structure is fully initialized.
80 for (size_t i = 0; i < sizeof(g_nt)/sizeof(void*); i++)
81 DCHECK(reinterpret_cast<char**>(&g_nt)[i]);
82 #endif
83 return (SBOX_ALL_OK == child->TransferVariable("g_nt", &g_nt, sizeof(g_nt)));
84 }
85
86 #undef INIT_GLOBAL_NT
87 #undef INIT_GLOBAL_RTL
88
SetupBasicInterceptions(InterceptionManager * manager)89 bool SetupBasicInterceptions(InterceptionManager* manager) {
90 // Interceptions provided by process_thread_policy, without actual policy.
91 if (!INTERCEPT_NT(manager, NtOpenThread, OPEN_TREAD_ID, 20) ||
92 !INTERCEPT_NT(manager, NtOpenProcess, OPEN_PROCESS_ID, 20) ||
93 !INTERCEPT_NT(manager, NtOpenProcessToken, OPEN_PROCESS_TOKEN_ID, 16))
94 return false;
95
96 // Interceptions with neither policy nor IPC.
97 if (!INTERCEPT_NT(manager, NtSetInformationThread, SET_INFORMATION_THREAD_ID,
98 20) ||
99 !INTERCEPT_NT(manager, NtOpenThreadToken, OPEN_THREAD_TOKEN_ID, 20))
100 return false;
101
102 if (base::win::GetVersion() >= base::win::VERSION_XP) {
103 // Bug 27218: We don't have dispatch for some x64 syscalls.
104 // This one is also provided by process_thread_policy.
105 if (!INTERCEPT_NT(manager, NtOpenProcessTokenEx, OPEN_PROCESS_TOKEN_EX_ID,
106 20))
107 return false;
108
109 return INTERCEPT_NT(manager, NtOpenThreadTokenEx, OPEN_THREAD_TOKEN_EX_ID,
110 24);
111 }
112
113 return true;
114 }
115
116 } // namespace sandbox
117