1// Copyright (c) 2006-2010 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#ifndef SANDBOX_SRC_PROCESS_THREAD_POLICY_H_ 6#define SANDBOX_SRC_PROCESS_THREAD_POLICY_H_ 7 8#include <string> 9 10#include "sandbox/win/src/policy_low_level.h" 11 12#include "base/basictypes.h" 13#include "base/strings/string16.h" 14#include "sandbox/win/src/crosscall_server.h" 15#include "sandbox/win/src/sandbox_policy.h" 16 17namespace sandbox { 18 19enum EvalResult; 20 21// This class centralizes most of the knowledge related to process execution. 22class ProcessPolicy { 23 public: 24 // Creates the required low-level policy rules to evaluate a high-level. 25 // policy rule for process creation 26 // 'name' is the executable to be spawn. 27 // 'semantics' is the desired semantics. 28 // 'policy' is the policy generator to which the rules are going to be added. 29 static bool GenerateRules(const wchar_t* name, 30 TargetPolicy::Semantics semantics, 31 LowLevelPolicy* policy); 32 33 // Opens a thread from the child process and returns the handle. 34 // client_info contains the information about the child process, 35 // desired_access is the access requested by the child and thread_id 36 // is the thread_id to be opened. 37 // The function returns the return value of NtOpenThread. 38 static NTSTATUS OpenThreadAction(const ClientInfo& client_info, 39 uint32 desired_access, 40 uint32 thread_id, 41 HANDLE* handle); 42 43 // Opens the process id passed in and returns the duplicated handle to 44 // the child. We only allow the child processes to open themselves. Any other 45 // pid open is denied. 46 static NTSTATUS OpenProcessAction(const ClientInfo& client_info, 47 uint32 desired_access, 48 uint32 process_id, 49 HANDLE* handle); 50 51 // Opens the token associated with the process and returns the duplicated 52 // handle to the child. We only allow the child processes to open his own 53 // token (using ::GetCurrentProcess()). 54 static NTSTATUS OpenProcessTokenAction(const ClientInfo& client_info, 55 HANDLE process, 56 uint32 desired_access, 57 HANDLE* handle); 58 59 // Opens the token associated with the process and returns the duplicated 60 // handle to the child. We only allow the child processes to open his own 61 // token (using ::GetCurrentProcess()). 62 static NTSTATUS OpenProcessTokenExAction(const ClientInfo& client_info, 63 HANDLE process, 64 uint32 desired_access, 65 uint32 attributes, 66 HANDLE* handle); 67 68 // Processes a 'CreateProcessW()' request from the target. 69 // 'client_info' : the target process that is making the request. 70 // 'eval_result' : The desired policy action to accomplish. 71 // 'app_name' : The full path of the process to be created. 72 // 'command_line' : The command line passed to the created process. 73 static DWORD CreateProcessWAction(EvalResult eval_result, 74 const ClientInfo& client_info, 75 const base::string16 &app_name, 76 const base::string16 &command_line, 77 PROCESS_INFORMATION* process_info); 78}; 79 80} // namespace sandbox 81 82 83#endif // SANDBOX_SRC_PROCESS_THREAD_POLICY_H_ 84