Add a sandbox policy for duplicating handles into the broker.

sandbox/src/handle_policy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/src/handle_policy.h"
 
 #include <string>
 
 #include "base/win/scoped_handle.h"
 #include "sandbox/src/broker_services.h"
 #include "sandbox/src/ipc_tags.h"
 #include "sandbox/src/policy_engine_opcodes.h"
 #include "sandbox/src/policy_params.h"
 #include "sandbox/src/sandbox_types.h"
 #include "sandbox/src/sandbox_utils.h"
 
 namespace sandbox {
 
 bool HandlePolicy::GenerateRules(const wchar_t* type_name,
                                  TargetPolicy::Semantics semantics,
                                  LowLevelPolicy* policy) {
-  // We don't support any other semantics for handles yet.
-  if (TargetPolicy::HANDLES_DUP_ANY != semantics) {
-    return false;
+  PolicyRule duplicate_rule(ASK_BROKER);
+
+  switch (semantics) {
+    case TargetPolicy::HANDLES_DUP_ANY: {
+      if (!duplicate_rule.AddNumberMatch(IF_NOT, HandleTarget::TARGET,
+                                         ::GetCurrentProcessId(), EQUAL)) {
+        return false;
+      }
+      break;
+    }
+
+    case TargetPolicy::HANDLES_DUP_BROKER: {
+      if (!duplicate_rule.AddNumberMatch(IF, HandleTarget::TARGET,

[rvargas (doing something else), 2012/05/18 21:02:52]

So we need two explicit rules in case we want to give a process access to
duplicate stuff anywhere. I'm fine with that, just checking.

[jschuh, 2012/05/18 21:40:53]

Yep. It's the same effort to implement either way, but I preferred this
approach.

+                                         ::GetCurrentProcessId(), EQUAL)) {
+        return false;
+      }
+      break;
+    }
+
+    default:
+     return false;
   }
-  PolicyRule duplicate_rule(ASK_BROKER);
-  if (!duplicate_rule.AddStringMatch(IF, NameBased::NAME, type_name,
+  if (!duplicate_rule.AddStringMatch(IF, HandleTarget::NAME, type_name,
                                      CASE_INSENSITIVE)) {
     return false;
   }
   if (!policy->AddRule(IPC_DUPLICATEHANDLEPROXY_TAG, &duplicate_rule)) {
     return false;
   }
   return true;
 }
 
 DWORD HandlePolicy::DuplicateHandleProxyAction(EvalResult eval_result,
                                                const ClientInfo& client_info,
                                                HANDLE source_handle,
                                                DWORD target_process_id,
                                                HANDLE* target_handle,
                                                DWORD desired_access,
                                                DWORD options) {
   // The only action supported is ASK_BROKER which means duplicate the handle.
   if (ASK_BROKER != eval_result) {
     return ERROR_ACCESS_DENIED;
   }
 
-  // Make sure the target is one of our sandboxed children.
-  if (!BrokerServicesBase::GetInstance()->IsActiveTarget(target_process_id)) {
-    return ERROR_ACCESS_DENIED;
+  base::win::ScopedHandle remote_target_process;
+  if (target_process_id != ::GetCurrentProcessId()) {
+    // Sandboxed children are dynamic, so we check that manually.
+    if (!BrokerServicesBase::GetInstance()->IsActiveTarget(target_process_id)) {
+      return ERROR_ACCESS_DENIED;
+    }
+
+    remote_target_process.Set(::OpenProcess(PROCESS_DUP_HANDLE, FALSE,
+                                            target_process_id));
+    if (NULL == remote_target_process)

[rvargas (doing something else), 2012/05/18 21:02:52]

!IsValid()

[jschuh, 2012/05/18 21:40:53]

Done.

+      return ::GetLastError();
   }
 
-  base::win::ScopedHandle target_process(::OpenProcess(PROCESS_DUP_HANDLE,
-                                                       FALSE,
-                                                       target_process_id));
-  if (NULL == target_process)
-    return ::GetLastError();
-
+  // If the policy didn't block us and we have no valid target, then the broker
+  // (this process) is the valid target.
+  HANDLE target_process = remote_target_process.IsValid() ?

[rvargas (doing something else), 2012/05/18 21:02:52]

interesting artifact of the limitations of ScopedHandle... 

[jschuh, 2012/05/18 21:40:53]

Yeah, we can blame MS for making the process pseudo-handle and invalid handle
share the same numerical value.

[rvargas (doing something else), 2012/05/18 22:07:04]

Except that a sane (auto-) implementation would not care about that, and
using/closing the pseudo handle works just fine

+                          remote_target_process : ::GetCurrentProcess();
   DWORD result = ERROR_SUCCESS;
   if (!::DuplicateHandle(client_info.process, source_handle, target_process,
                          target_handle, desired_access, FALSE,
                          options)) {
     return ::GetLastError();
   }
 
   return ERROR_SUCCESS;
 }
 
 }  // namespace sandbox