1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#ifndef SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_ 6#define SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_ 7 8#include <windows.h> 9 10#include "base/basictypes.h" 11#include "sandbox/win/src/security_level.h" 12 13namespace sandbox { 14 15// Sets the mitigation policy for the current process, ignoring any settings 16// that are invalid for the current version of Windows. 17bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags flags); 18 19// Returns the flags that must be enforced after startup for the current OS 20// version. 21MitigationFlags FilterPostStartupProcessMitigations(MitigationFlags flags); 22 23// Converts sandbox flags to the PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES 24// policy flags used by UpdateProcThreadAttribute(). The size field varies 25// between a 32-bit and a 64-bit type based on the exact build and version of 26// Windows, so the returned size must be passed to UpdateProcThreadAttribute(). 27void ConvertProcessMitigationsToPolicy(MitigationFlags flags, 28 DWORD64* policy_flags, size_t* size); 29 30// Adds mitigations that need to be performed on the suspended target process 31// before execution begins. 32bool ApplyProcessMitigationsToSuspendedProcess(HANDLE process, 33 MitigationFlags flags); 34 35// Returns true if all the supplied flags can be set after a process starts. 36bool CanSetProcessMitigationsPostStartup(MitigationFlags flags); 37 38// Returns true if all the supplied flags can be set before a process starts. 39bool CanSetProcessMitigationsPreStartup(MitigationFlags flags); 40 41} // namespace sandbox 42 43#endif // SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_ 44 45