Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(427)

Side by Side Diff: sandbox/win/src/broker_services.cc

Issue 10907217: Revert 156550 - Add sandbox support for Windows process mitigations (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src/
Patch Set: Created 8 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « sandbox/win/sandbox_win.gypi ('k') | sandbox/win/src/dep.h » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "sandbox/win/src/broker_services.h" 5 #include "sandbox/win/src/broker_services.h"
6 6
7 #include "base/logging.h" 7 #include "base/logging.h"
8 #include "base/memory/scoped_ptr.h" 8 #include "base/memory/scoped_ptr.h"
9 #include "base/threading/platform_thread.h" 9 #include "base/threading/platform_thread.h"
10 #include "base/win/scoped_handle.h" 10 #include "base/win/scoped_handle.h"
11 #include "base/win/scoped_process_information.h" 11 #include "base/win/scoped_process_information.h"
12 #include "base/win/startup_information.h" 12 #include "base/win/startup_information.h"
13 #include "base/win/windows_version.h" 13 #include "base/win/windows_version.h"
14 #include "sandbox/win/src/app_container.h" 14 #include "sandbox/win/src/app_container.h"
15 #include "sandbox/win/src/process_mitigations.h"
16 #include "sandbox/win/src/sandbox_policy_base.h" 15 #include "sandbox/win/src/sandbox_policy_base.h"
17 #include "sandbox/win/src/sandbox.h" 16 #include "sandbox/win/src/sandbox.h"
18 #include "sandbox/win/src/target_process.h" 17 #include "sandbox/win/src/target_process.h"
19 #include "sandbox/win/src/win2k_threadpool.h" 18 #include "sandbox/win/src/win2k_threadpool.h"
20 #include "sandbox/win/src/win_utils.h" 19 #include "sandbox/win/src/win_utils.h"
21 20
22 namespace { 21 namespace {
23 22
24 // Utility function to associate a completion port to a job object. 23 // Utility function to associate a completion port to a job object.
25 bool AssociateCompletionPort(HANDLE job, HANDLE port, void* key) { 24 bool AssociateCompletionPort(HANDLE job, HANDLE port, void* key) {
(...skipping 288 matching lines...) Expand 10 before | Expand all | Expand 10 after
314 return result; 313 return result;
315 314
316 // Initialize the startup information from the policy. 315 // Initialize the startup information from the policy.
317 base::win::StartupInformation startup_info; 316 base::win::StartupInformation startup_info;
318 string16 desktop = policy_base->GetAlternateDesktop(); 317 string16 desktop = policy_base->GetAlternateDesktop();
319 if (!desktop.empty()) { 318 if (!desktop.empty()) {
320 startup_info.startup_info()->lpDesktop = 319 startup_info.startup_info()->lpDesktop =
321 const_cast<wchar_t*>(desktop.c_str()); 320 const_cast<wchar_t*>(desktop.c_str());
322 } 321 }
323 322
324 if (base::win::GetVersion() >= base::win::VERSION_VISTA) { 323 const AppContainerAttributes* app_container = policy_base->GetAppContainer();
325 int attribute_count = 0; 324 if (app_container) {
326 const AppContainerAttributes* app_container = 325 startup_info.InitializeProcThreadAttributeList(1);
327 policy_base->GetAppContainer(); 326 result = app_container->ShareForStartup(&startup_info);
328 if (app_container) 327 if (SBOX_ALL_OK != result)
329 ++attribute_count; 328 return result;
330
331 DWORD64 mitigations;
332 size_t mitigations_size;
333 ConvertProcessMitigationsToPolicy(policy->GetProcessMitigations(),
334 &mitigations, &mitigations_size);
335 if (mitigations)
336 ++attribute_count;
337
338 if (!startup_info.InitializeProcThreadAttributeList(attribute_count))
339 return SBOX_ERROR_PROC_THREAD_ATTRIBUTES;
340
341 if (app_container) {
342 result = app_container->ShareForStartup(&startup_info);
343 if (SBOX_ALL_OK != result)
344 return result;
345 }
346
347 if (mitigations) {
348 if (!startup_info.UpdateProcThreadAttribute(
349 PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, &mitigations,
350 mitigations_size)) {
351 return SBOX_ERROR_PROC_THREAD_ATTRIBUTES;
352 }
353 }
354 } 329 }
355 330
356 // Construct the thread pool here in case it is expensive. 331 // Construct the thread pool here in case it is expensive.
357 // The thread pool is shared by all the targets 332 // The thread pool is shared by all the targets
358 if (NULL == thread_pool_) 333 if (NULL == thread_pool_)
359 thread_pool_ = new Win2kThreadPool(); 334 thread_pool_ = new Win2kThreadPool();
360 335
361 // Create the TargetProces object and spawn the target suspended. Note that 336 // Create the TargetProces object and spawn the target suspended. Note that
362 // Brokerservices does not own the target object. It is owned by the Policy. 337 // Brokerservices does not own the target object. It is owned by the Policy.
363 base::win::ScopedProcessInformation process_info; 338 base::win::ScopedProcessInformation process_info;
(...skipping 96 matching lines...) Expand 10 before | Expand all | Expand 10 after
460 return SBOX_ERROR_UNSUPPORTED; 435 return SBOX_ERROR_UNSUPPORTED;
461 436
462 string16 name = LookupAppContainer(sid); 437 string16 name = LookupAppContainer(sid);
463 if (name.empty()) 438 if (name.empty())
464 return SBOX_ERROR_INVALID_APP_CONTAINER; 439 return SBOX_ERROR_INVALID_APP_CONTAINER;
465 440
466 return DeleteAppContainer(sid); 441 return DeleteAppContainer(sid);
467 } 442 }
468 443
469 } // namespace sandbox 444 } // namespace sandbox
OLDNEW
« no previous file with comments | « sandbox/win/sandbox_win.gypi ('k') | sandbox/win/src/dep.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698