1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#include "sandbox/win/src/handle_closer_agent.h" 6 7#include "base/logging.h" 8#include "sandbox/win/src/nt_internals.h" 9#include "sandbox/win/src/win_utils.h" 10 11namespace { 12 13// Returns type infomation for an NT object. This routine is expected to be 14// called for invalid handles so it catches STATUS_INVALID_HANDLE exceptions 15// that can be generated when handle tracing is enabled. 16NTSTATUS QueryObjectTypeInformation(HANDLE handle, 17 void* buffer, 18 ULONG* size) { 19 static NtQueryObject QueryObject = NULL; 20 if (!QueryObject) 21 ResolveNTFunctionPtr("NtQueryObject", &QueryObject); 22 23 NTSTATUS status = STATUS_UNSUCCESSFUL; 24 __try { 25 status = QueryObject(handle, ObjectTypeInformation, buffer, *size, size); 26 } __except(GetExceptionCode() == STATUS_INVALID_HANDLE ? 27 EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH) { 28 status = STATUS_INVALID_HANDLE; 29 } 30 return status; 31} 32 33} // namespace 34 35namespace sandbox { 36 37// Memory buffer mapped from the parent, with the list of handles. 38SANDBOX_INTERCEPT HandleCloserInfo* g_handles_to_close = NULL; 39 40bool HandleCloserAgent::NeedsHandlesClosed() { 41 return g_handles_to_close != NULL; 42} 43 44// Reads g_handles_to_close and creates the lookup map. 45void HandleCloserAgent::InitializeHandlesToClose() { 46 CHECK(g_handles_to_close != NULL); 47 48 // Grab the header. 49 HandleListEntry* entry = g_handles_to_close->handle_entries; 50 for (size_t i = 0; i < g_handles_to_close->num_handle_types; ++i) { 51 // Set the type name. 52 char16* input = entry->handle_type; 53 HandleMap::mapped_type& handle_names = handles_to_close_[input]; 54 input = reinterpret_cast<char16*>(reinterpret_cast<char*>(entry) 55 + entry->offset_to_names); 56 // Grab all the handle names. 57 for (size_t j = 0; j < entry->name_count; ++j) { 58 std::pair<HandleMap::mapped_type::iterator, bool> name 59 = handle_names.insert(input); 60 CHECK(name.second); 61 input += name.first->size() + 1; 62 } 63 64 // Move on to the next entry. 65 entry = reinterpret_cast<HandleListEntry*>(reinterpret_cast<char*>(entry) 66 + entry->record_bytes); 67 68 DCHECK(reinterpret_cast<char16*>(entry) >= input); 69 DCHECK(reinterpret_cast<char16*>(entry) - input < 70 sizeof(size_t) / sizeof(char16)); 71 } 72 73 // Clean up the memory we copied over. 74 ::VirtualFree(g_handles_to_close, 0, MEM_RELEASE); 75 g_handles_to_close = NULL; 76} 77 78bool HandleCloserAgent::CloseHandles() { 79 DWORD handle_count = UINT_MAX; 80 const int kInvalidHandleThreshold = 100; 81 const size_t kHandleOffset = sizeof(HANDLE); 82 83 if (!::GetProcessHandleCount(::GetCurrentProcess(), &handle_count)) 84 return false; 85 86 // Set up buffers for the type info and the name. 87 std::vector<BYTE> type_info_buffer(sizeof(OBJECT_TYPE_INFORMATION) + 88 32 * sizeof(wchar_t)); 89 OBJECT_TYPE_INFORMATION* type_info = 90 reinterpret_cast<OBJECT_TYPE_INFORMATION*>(&(type_info_buffer[0])); 91 string16 handle_name; 92 HANDLE handle = NULL; 93 int invalid_count = 0; 94 95 // Keep incrementing until we hit the number of handles reported by 96 // GetProcessHandleCount(). If we hit a very long sequence of invalid 97 // handles we assume that we've run past the end of the table. 98 while (handle_count && invalid_count < kInvalidHandleThreshold) { 99 reinterpret_cast<size_t&>(handle) += kHandleOffset; 100 NTSTATUS rc; 101 102 // Get the type name, reusing the buffer. 103 ULONG size = static_cast<ULONG>(type_info_buffer.size()); 104 rc = QueryObjectTypeInformation(handle, type_info, &size); 105 while (rc == STATUS_INFO_LENGTH_MISMATCH || 106 rc == STATUS_BUFFER_OVERFLOW) { 107 type_info_buffer.resize(size + sizeof(wchar_t)); 108 type_info = reinterpret_cast<OBJECT_TYPE_INFORMATION*>( 109 &(type_info_buffer[0])); 110 rc = QueryObjectTypeInformation(handle, type_info, &size); 111 // Leave padding for the nul terminator. 112 if (NT_SUCCESS(rc) && size == type_info_buffer.size()) 113 rc = STATUS_INFO_LENGTH_MISMATCH; 114 } 115 if (!NT_SUCCESS(rc) || !type_info->Name.Buffer) { 116 ++invalid_count; 117 continue; 118 } 119 120 --handle_count; 121 type_info->Name.Buffer[type_info->Name.Length / sizeof(wchar_t)] = L'\0'; 122 123 // Check if we're looking for this type of handle. 124 HandleMap::iterator result = 125 handles_to_close_.find(type_info->Name.Buffer); 126 if (result != handles_to_close_.end()) { 127 HandleMap::mapped_type& names = result->second; 128 // Empty set means close all handles of this type; otherwise check name. 129 if (!names.empty()) { 130 // Move on to the next handle if this name doesn't match. 131 if (!GetHandleName(handle, &handle_name) || !names.count(handle_name)) 132 continue; 133 } 134 135 if (!::SetHandleInformation(handle, HANDLE_FLAG_PROTECT_FROM_CLOSE, 0)) 136 return false; 137 if (!::CloseHandle(handle)) 138 return false; 139 } 140 } 141 142 return true; 143} 144 145} // namespace sandbox 146