1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "sandbox/win/src/process_mitigations.h"
6
7#include <algorithm>
8
9#include "base/win/windows_version.h"
10#include "sandbox/win/src/nt_internals.h"
11#include "sandbox/win/src/win_utils.h"
12
13namespace {
14
15// Functions for enabling policies.
16typedef BOOL (WINAPI *SetProcessDEPPolicyFunction)(DWORD dwFlags);
17
18typedef BOOL (WINAPI *SetProcessMitigationPolicyFunction)(
19    PROCESS_MITIGATION_POLICY mitigation_policy,
20    PVOID buffer,
21    SIZE_T length);
22
23typedef BOOL (WINAPI *SetDefaultDllDirectoriesFunction)(
24    DWORD DirectoryFlags);
25
26}  // namespace
27
28namespace sandbox {
29
30bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags flags) {
31  if (!CanSetProcessMitigationsPostStartup(flags))
32    return false;
33
34  base::win::Version version = base::win::GetVersion();
35  HMODULE module = ::GetModuleHandleA("kernel32.dll");
36
37  if (version >= base::win::VERSION_VISTA &&
38      (flags & MITIGATION_DLL_SEARCH_ORDER)) {
39    SetDefaultDllDirectoriesFunction set_default_dll_directories =
40        reinterpret_cast<SetDefaultDllDirectoriesFunction>(
41            ::GetProcAddress(module, "SetDefaultDllDirectories"));
42
43    // Check for SetDefaultDllDirectories since it requires KB2533623.
44    if (set_default_dll_directories) {
45      if (!set_default_dll_directories(LOAD_LIBRARY_SEARCH_DEFAULT_DIRS) &&
46          ERROR_ACCESS_DENIED != ::GetLastError()) {
47        return false;
48      }
49    }
50  }
51
52  // Set the heap to terminate on corruption
53  if (version >= base::win::VERSION_VISTA &&
54      (flags & MITIGATION_HEAP_TERMINATE)) {
55    if (!::HeapSetInformation(NULL, HeapEnableTerminationOnCorruption,
56                              NULL, 0) &&
57        ERROR_ACCESS_DENIED != ::GetLastError()) {
58      return false;
59    }
60  }
61
62#if !defined(_WIN64)  // DEP is always enabled on 64-bit.
63  if (flags & MITIGATION_DEP) {
64    DWORD dep_flags = PROCESS_DEP_ENABLE;
65    // DEP support is quirky on XP, so don't force a failure in that case.
66    const bool return_on_fail = version >= base::win::VERSION_VISTA;
67
68    if (flags & MITIGATION_DEP_NO_ATL_THUNK)
69      dep_flags |= PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION;
70
71    SetProcessDEPPolicyFunction set_process_dep_policy =
72        reinterpret_cast<SetProcessDEPPolicyFunction>(
73            ::GetProcAddress(module, "SetProcessDEPPolicy"));
74    if (set_process_dep_policy) {
75      if (!set_process_dep_policy(dep_flags) &&
76          ERROR_ACCESS_DENIED != ::GetLastError() && return_on_fail) {
77        return false;
78      }
79    } else {
80      // We're on XP sp2, so use the less standard approach.
81      // For reference: http://www.uninformed.org/?v=2&a=4
82      const int MEM_EXECUTE_OPTION_ENABLE = 1;
83      const int MEM_EXECUTE_OPTION_DISABLE = 2;
84      const int MEM_EXECUTE_OPTION_ATL7_THUNK_EMULATION = 4;
85      const int MEM_EXECUTE_OPTION_PERMANENT = 8;
86
87      NtSetInformationProcessFunction set_information_process = NULL;
88      ResolveNTFunctionPtr("NtSetInformationProcess",
89                           &set_information_process);
90      if (!set_information_process)
91        return false;
92      ULONG dep = MEM_EXECUTE_OPTION_DISABLE | MEM_EXECUTE_OPTION_PERMANENT;
93      if (!(dep_flags & PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION))
94        dep |= MEM_EXECUTE_OPTION_ATL7_THUNK_EMULATION;
95      if (!SUCCEEDED(set_information_process(GetCurrentProcess(),
96                                             ProcessExecuteFlags,
97                                             &dep, sizeof(dep))) &&
98          ERROR_ACCESS_DENIED != ::GetLastError() && return_on_fail) {
99        return false;
100      }
101    }
102  }
103#endif
104
105  // This is all we can do in Win7 and below.
106  if (version < base::win::VERSION_WIN8)
107    return true;
108
109  SetProcessMitigationPolicyFunction set_process_mitigation_policy =
110      reinterpret_cast<SetProcessMitigationPolicyFunction>(
111          ::GetProcAddress(module, "SetProcessMitigationPolicy"));
112  if (!set_process_mitigation_policy)
113    return false;
114
115  // Enable ASLR policies.
116  if (flags & MITIGATION_RELOCATE_IMAGE) {
117    PROCESS_MITIGATION_ASLR_POLICY policy = { 0 };
118    policy.EnableForceRelocateImages = true;
119    policy.DisallowStrippedImages = (flags &
120        MITIGATION_RELOCATE_IMAGE_REQUIRED) ==
121        MITIGATION_RELOCATE_IMAGE_REQUIRED;
122
123    if (!set_process_mitigation_policy(ProcessASLRPolicy, &policy,
124                                       sizeof(policy)) &&
125        ERROR_ACCESS_DENIED != ::GetLastError()) {
126      return false;
127    }
128  }
129
130  // Enable strict handle policies.
131  if (flags & MITIGATION_STRICT_HANDLE_CHECKS) {
132    PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY policy = { 0 };
133    policy.HandleExceptionsPermanentlyEnabled =
134        policy.RaiseExceptionOnInvalidHandleReference = true;
135
136    if (!set_process_mitigation_policy(ProcessStrictHandleCheckPolicy, &policy,
137                                       sizeof(policy)) &&
138        ERROR_ACCESS_DENIED != ::GetLastError()) {
139      return false;
140    }
141  }
142
143  // Enable system call policies.
144  if (flags & MITIGATION_WIN32K_DISABLE) {
145    PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY policy = { 0 };
146    policy.DisallowWin32kSystemCalls = true;
147
148    if (!set_process_mitigation_policy(ProcessSystemCallDisablePolicy, &policy,
149                                       sizeof(policy)) &&
150        ERROR_ACCESS_DENIED != ::GetLastError()) {
151      return false;
152    }
153  }
154
155  // Enable system call policies.
156  if (flags & MITIGATION_EXTENSION_DLL_DISABLE) {
157    PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY policy = { 0 };
158    policy.DisableExtensionPoints = true;
159
160    if (!set_process_mitigation_policy(ProcessExtensionPointDisablePolicy,
161                                       &policy, sizeof(policy)) &&
162        ERROR_ACCESS_DENIED != ::GetLastError()) {
163      return false;
164    }
165  }
166
167  return true;
168}
169
170void ConvertProcessMitigationsToPolicy(MitigationFlags flags,
171                                       DWORD64* policy_flags, size_t* size) {
172  base::win::Version version = base::win::GetVersion();
173
174  *policy_flags = 0;
175#if defined(_WIN64)
176  *size = sizeof(*policy_flags);
177#elif defined(_M_IX86)
178  // A 64-bit flags attribute is illegal on 32-bit Win 7 and below.
179  if (version < base::win::VERSION_WIN8)
180    *size = sizeof(DWORD);
181  else
182    *size = sizeof(*policy_flags);
183#else
184#error This platform is not supported.
185#endif
186
187  // Nothing for Win XP or Vista.
188  if (version <= base::win::VERSION_VISTA)
189    return;
190
191  // DEP and SEHOP are not valid for 64-bit Windows
192#if !defined(_WIN64)
193  if (flags & MITIGATION_DEP) {
194    *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE;
195    if (!(flags & MITIGATION_DEP_NO_ATL_THUNK))
196      *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE;
197  }
198
199  if (flags & MITIGATION_SEHOP)
200    *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE;
201#endif
202
203  // Win 7
204  if (version < base::win::VERSION_WIN8)
205    return;
206
207  if (flags & MITIGATION_RELOCATE_IMAGE) {
208    *policy_flags |=
209        PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON;
210    if (flags & MITIGATION_RELOCATE_IMAGE_REQUIRED) {
211      *policy_flags |=
212          PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON_REQ_RELOCS;
213    }
214  }
215
216  if (flags & MITIGATION_HEAP_TERMINATE) {
217    *policy_flags |=
218        PROCESS_CREATION_MITIGATION_POLICY_HEAP_TERMINATE_ALWAYS_ON;
219  }
220
221  if (flags & MITIGATION_BOTTOM_UP_ASLR) {
222    *policy_flags |=
223        PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON;
224  }
225
226  if (flags & MITIGATION_HIGH_ENTROPY_ASLR) {
227    *policy_flags |=
228        PROCESS_CREATION_MITIGATION_POLICY_HIGH_ENTROPY_ASLR_ALWAYS_ON;
229  }
230
231  if (flags & MITIGATION_STRICT_HANDLE_CHECKS) {
232    *policy_flags |=
233        PROCESS_CREATION_MITIGATION_POLICY_STRICT_HANDLE_CHECKS_ALWAYS_ON;
234  }
235
236  if (flags & MITIGATION_WIN32K_DISABLE) {
237    *policy_flags |=
238        PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_ALWAYS_ON;
239  }
240
241  if (flags & MITIGATION_EXTENSION_DLL_DISABLE) {
242    *policy_flags |=
243        PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON;
244  }
245}
246
247MitigationFlags FilterPostStartupProcessMitigations(MitigationFlags flags) {
248  base::win::Version version = base::win::GetVersion();
249
250  // Windows XP SP2+.
251  if (version < base::win::VERSION_VISTA) {
252    return flags & (MITIGATION_DEP |
253                    MITIGATION_DEP_NO_ATL_THUNK);
254  }
255
256  // Windows Vista
257  if (version < base::win::VERSION_WIN7) {
258    return flags & (MITIGATION_BOTTOM_UP_ASLR |
259                    MITIGATION_DLL_SEARCH_ORDER |
260                    MITIGATION_HEAP_TERMINATE);
261  }
262
263  // Windows 7.
264  if (version < base::win::VERSION_WIN8) {
265    return flags & (MITIGATION_BOTTOM_UP_ASLR |
266                    MITIGATION_DLL_SEARCH_ORDER |
267                    MITIGATION_HEAP_TERMINATE);
268  }
269
270  // Windows 8 and above.
271  return flags & (MITIGATION_BOTTOM_UP_ASLR |
272                  MITIGATION_DLL_SEARCH_ORDER);
273}
274
275bool ApplyProcessMitigationsToSuspendedProcess(HANDLE process,
276                                               MitigationFlags flags) {
277// This is a hack to fake a weak bottom-up ASLR on 32-bit Windows.
278#if !defined(_WIN64)
279  if (flags & MITIGATION_BOTTOM_UP_ASLR) {
280    unsigned int limit;
281    rand_s(&limit);
282    char* ptr = 0;
283    const size_t kMask64k = 0xFFFF;
284    // Random range (512k-16.5mb) in 64k steps.
285    const char* end = ptr + ((((limit % 16384) + 512) * 1024) & ~kMask64k);
286    while (ptr < end) {
287      MEMORY_BASIC_INFORMATION memory_info;
288      if (!::VirtualQueryEx(process, ptr, &memory_info, sizeof(memory_info)))
289        break;
290      size_t size = std::min((memory_info.RegionSize + kMask64k) & ~kMask64k,
291                             static_cast<SIZE_T>(end - ptr));
292      if (ptr && memory_info.State == MEM_FREE)
293        ::VirtualAllocEx(process, ptr, size, MEM_RESERVE, PAGE_NOACCESS);
294      ptr += size;
295    }
296  }
297#endif
298
299  return true;
300}
301
302bool CanSetProcessMitigationsPostStartup(MitigationFlags flags) {
303  // All of these mitigations can be enabled after startup.
304  return !(flags & ~(MITIGATION_HEAP_TERMINATE |
305                     MITIGATION_DEP |
306                     MITIGATION_DEP_NO_ATL_THUNK |
307                     MITIGATION_RELOCATE_IMAGE |
308                     MITIGATION_RELOCATE_IMAGE_REQUIRED |
309                     MITIGATION_BOTTOM_UP_ASLR |
310                     MITIGATION_STRICT_HANDLE_CHECKS |
311                     MITIGATION_EXTENSION_DLL_DISABLE |
312                     MITIGATION_DLL_SEARCH_ORDER));
313}
314
315bool CanSetProcessMitigationsPreStartup(MitigationFlags flags) {
316  // These mitigations cannot be enabled prior to startup.
317  return !(flags & (MITIGATION_STRICT_HANDLE_CHECKS |
318                    MITIGATION_DLL_SEARCH_ORDER));
319}
320
321}  // namespace sandbox
322
323