Revert 156550 - Add sandbox support for Windows process mitigations

sandbox/win/src/sandbox_policy_base.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/sandbox_policy_base.h"
 
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/logging.h"
 #include "base/win/windows_version.h"
 #include "sandbox/win/src/app_container.h"
 #include "sandbox/win/src/filesystem_dispatcher.h"
 #include "sandbox/win/src/filesystem_policy.h"
 #include "sandbox/win/src/handle_dispatcher.h"
 #include "sandbox/win/src/handle_policy.h"
 #include "sandbox/win/src/job.h"
 #include "sandbox/win/src/interception.h"
-#include "sandbox/win/src/process_mitigations.h"
 #include "sandbox/win/src/named_pipe_dispatcher.h"
 #include "sandbox/win/src/named_pipe_policy.h"
 #include "sandbox/win/src/policy_broker.h"
 #include "sandbox/win/src/policy_engine_processor.h"
 #include "sandbox/win/src/policy_low_level.h"
 #include "sandbox/win/src/process_thread_dispatcher.h"
 #include "sandbox/win/src/process_thread_policy.h"
 #include "sandbox/win/src/registry_dispatcher.h"
 #include "sandbox/win/src/registry_policy.h"
 #include "sandbox/win/src/restricted_token_utils.h"
@@ skipping 18 matching lines @@
   memset(mem, 0, kTotalPolicySz);
   sandbox::PolicyGlobal* policy = reinterpret_cast<sandbox::PolicyGlobal*>(mem);
   policy->data_size = kTotalPolicySz - sizeof(sandbox::PolicyGlobal);
   return policy;
 }
 }
 
 namespace sandbox {
 
 SANDBOX_INTERCEPT IntegrityLevel g_shared_delayed_integrity_level;
-SANDBOX_INTERCEPT MitigationFlags g_shared_delayed_mitigations;
 
 // Initializes static members.
 HWINSTA PolicyBase::alternate_winstation_handle_ = NULL;
 HDESK PolicyBase::alternate_desktop_handle_ = NULL;
 
 PolicyBase::PolicyBase()
     : ref_count(1),
       lockdown_level_(USER_LOCKDOWN),
       initial_level_(USER_LOCKDOWN),
       job_level_(JOB_LOCKDOWN),
       ui_exceptions_(0),
       use_alternate_desktop_(false),
       use_alternate_winstation_(false),
       file_system_init_(false),
       relaxed_interceptions_(true),
       integrity_level_(INTEGRITY_LEVEL_LAST),
       delayed_integrity_level_(INTEGRITY_LEVEL_LAST),
-      mitigations_(0),
-      delayed_mitigations_(0),
       policy_maker_(NULL),
       policy_(NULL) {
   ::InitializeCriticalSection(&lock_);
   // Initialize the IPC dispatcher array.
   memset(&ipc_targets_, NULL, sizeof(ipc_targets_));
   Dispatcher* dispatcher = NULL;
 
   dispatcher = new FilesystemDispatcher(this);
   ipc_targets_[IPC_NTCREATEFILE_TAG] = dispatcher;
   ipc_targets_[IPC_NTOPENFILE_TAG] = dispatcher;
@@ skipping 186 matching lines @@
     return rv;
 
   return SBOX_ALL_OK;
 }
 
 ResultCode PolicyBase::SetCapability(const wchar_t* sid) {
   capabilities_.push_back(sid);
   return SBOX_ALL_OK;
 }
 
-ResultCode PolicyBase::SetProcessMitigations(
-    MitigationFlags flags) {
-  if (!CanSetProcessMitigationsPreStartup(flags))
-    return SBOX_ERROR_BAD_PARAMS;
-  mitigations_ = flags;
-  return SBOX_ALL_OK;
-}
-
-MitigationFlags PolicyBase::GetProcessMitigations() {
-  return mitigations_;
-}
-
-ResultCode PolicyBase::SetDelayedProcessMitigations(
-    MitigationFlags flags) {
-  if (!CanSetProcessMitigationsPostStartup(flags))
-    return SBOX_ERROR_BAD_PARAMS;
-  delayed_mitigations_ = flags;
-  return SBOX_ALL_OK;
-}
-
-MitigationFlags PolicyBase::GetDelayedProcessMitigations() {
-  return delayed_mitigations_;
-}
-
 void PolicyBase::SetStrictInterceptions() {
   relaxed_interceptions_ = false;
 }
 
 ResultCode PolicyBase::AddRule(SubSystem subsystem, Semantics semantics,
                                const wchar_t* pattern) {
   if (NULL == policy_) {
     policy_ = MakeBrokerPolicyMemory();
     DCHECK(policy_);
     policy_maker_ = new LowLevelPolicy(policy_);
@@ skipping 154 matching lines @@
   if (!appcontainer_list_.get() || !appcontainer_list_->HasAppContainer())
     return NULL;
 
   return appcontainer_list_.get();
 }
 
 bool PolicyBase::AddTarget(TargetProcess* target) {
   if (NULL != policy_)
     policy_maker_->Done();
 
-  if (!ApplyProcessMitigationsToSuspendedProcess(target->Process(),
-                                                 mitigations_)) {
-    return false;
-  }
-
   if (!SetupAllInterceptions(target))
     return false;
 
   if (!SetupHandleCloser(target))
     return false;
 
   // Initialize the sandbox infrastructure for the target.
   if (ERROR_SUCCESS != target->Init(this, policy_, kIPCMemSize, kPolMemSize))
     return false;
 
   g_shared_delayed_integrity_level = delayed_integrity_level_;
   ResultCode ret = target->TransferVariable(
                        "g_shared_delayed_integrity_level",
                        &g_shared_delayed_integrity_level,
                        sizeof(g_shared_delayed_integrity_level));
   g_shared_delayed_integrity_level = INTEGRITY_LEVEL_LAST;
   if (SBOX_ALL_OK != ret)
     return false;
 
-  // Add in delayed mitigations and pseudo-mitigations enforced at startup.
-  g_shared_delayed_mitigations = delayed_mitigations_ |
-      FilterPostStartupProcessMitigations(mitigations_);
-  if (!CanSetProcessMitigationsPostStartup(g_shared_delayed_mitigations))
-    return false;
-
-  ret = target->TransferVariable("g_shared_delayed_mitigations",
-                                 &g_shared_delayed_mitigations,
-                                 sizeof(g_shared_delayed_mitigations));
-  g_shared_delayed_mitigations = 0;
-  if (SBOX_ALL_OK != ret)
-    return false;
-
   AutoLock lock(&lock_);
   targets_.push_back(target);
   return true;
 }
 
 bool PolicyBase::OnJobEmpty(HANDLE job) {
   AutoLock lock(&lock_);
   TargetSet::iterator it;
   for (it = targets_.begin(); it != targets_.end(); ++it) {
     if ((*it)->Job() == job)
@@ skipping 96 matching lines @@
 
   // Finally, setup imports on the target so the interceptions can work.
   return SetupNtdllImports(target);
 }
 
 bool PolicyBase::SetupHandleCloser(TargetProcess* target) {
   return handle_closer_.InitializeTargetHandles(target);
 }
 
 }  // namespace sandbox