1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_
6#define SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_
7
8#include <windows.h>
9
10#include "base/basictypes.h"
11#include "sandbox/win/src/security_level.h"
12
13namespace sandbox {
14
15// Sets the mitigation policy for the current process, ignoring any settings
16// that are invalid for the current version of Windows.
17bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags flags);
18
19// Returns the flags that must be enforced after startup for the current OS
20// version.
21MitigationFlags FilterPostStartupProcessMitigations(MitigationFlags flags);
22
23// Converts sandbox flags to the PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES
24// policy flags used by UpdateProcThreadAttribute(). The size field varies
25// between a 32-bit and a 64-bit type based on the exact build and version of
26// Windows, so the returned size must be passed to UpdateProcThreadAttribute().
27void ConvertProcessMitigationsToPolicy(MitigationFlags flags,
28                                       DWORD64* policy_flags, size_t* size);
29
30// Adds mitigations that need to be performed on the suspended target process
31// before execution begins.
32bool ApplyProcessMitigationsToSuspendedProcess(HANDLE process,
33                                               MitigationFlags flags);
34
35// Returns true if all the supplied flags can be set after a process starts.
36bool CanSetProcessMitigationsPostStartup(MitigationFlags flags);
37
38// Returns true if all the supplied flags can be set before a process starts.
39bool CanSetProcessMitigationsPreStartup(MitigationFlags flags);
40
41}  // namespace sandbox
42
43#endif  // SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_
44
45