1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "sandbox/win/src/window.h"
6
7 #include <aclapi.h>
8
9 #include <memory>
10
11 #include "base/logging.h"
12 #include "sandbox/win/src/acl.h"
13 #include "sandbox/win/src/sid.h"
14
15 namespace {
16
17 // Gets the security attributes of a window object referenced by |handle|. The
18 // lpSecurityDescriptor member of the SECURITY_ATTRIBUTES parameter returned
19 // must be freed using LocalFree by the caller.
GetSecurityAttributes(HANDLE handle,SECURITY_ATTRIBUTES * attributes)20 bool GetSecurityAttributes(HANDLE handle, SECURITY_ATTRIBUTES* attributes) {
21 attributes->bInheritHandle = FALSE;
22 attributes->nLength = sizeof(SECURITY_ATTRIBUTES);
23
24 PACL dacl = NULL;
25 DWORD result = ::GetSecurityInfo(handle, SE_WINDOW_OBJECT,
26 DACL_SECURITY_INFORMATION, NULL, NULL, &dacl,
27 NULL, &attributes->lpSecurityDescriptor);
28 if (ERROR_SUCCESS == result)
29 return true;
30
31 return false;
32 }
33
34 } // namespace
35
36 namespace sandbox {
37
CreateAltWindowStation(HWINSTA * winsta)38 ResultCode CreateAltWindowStation(HWINSTA* winsta) {
39 // Get the security attributes from the current window station; we will
40 // use this as the base security attributes for the new window station.
41 HWINSTA current_winsta = ::GetProcessWindowStation();
42 if (!current_winsta)
43 return SBOX_ERROR_CANNOT_GET_WINSTATION;
44
45 SECURITY_ATTRIBUTES attributes = {0};
46 if (!GetSecurityAttributes(current_winsta, &attributes))
47 return SBOX_ERROR_CANNOT_QUERY_WINSTATION_SECURITY;
48
49 // Create the window station using nullptr for the name to ask the os to
50 // generate it.
51 *winsta = ::CreateWindowStationW(
52 nullptr, 0, GENERIC_READ | WINSTA_CREATEDESKTOP, &attributes);
53 if (*winsta == nullptr && ::GetLastError() == ERROR_ACCESS_DENIED) {
54 *winsta = ::CreateWindowStationW(
55 nullptr, 0, WINSTA_READATTRIBUTES | WINSTA_CREATEDESKTOP, &attributes);
56 }
57 LocalFree(attributes.lpSecurityDescriptor);
58
59 if (*winsta)
60 return SBOX_ALL_OK;
61
62 return SBOX_ERROR_CANNOT_CREATE_WINSTATION;
63 }
64
CreateAltDesktop(HWINSTA winsta,HDESK * desktop)65 ResultCode CreateAltDesktop(HWINSTA winsta, HDESK* desktop) {
66 base::string16 desktop_name = L"sbox_alternate_desktop_";
67
68 if (!winsta) {
69 desktop_name += L"local_winstation_";
70 }
71
72 // Append the current PID to the desktop name.
73 wchar_t buffer[16];
74 _snwprintf_s(buffer, sizeof(buffer) / sizeof(wchar_t), L"0x%X",
75 ::GetCurrentProcessId());
76 desktop_name += buffer;
77
78 HDESK current_desktop = GetThreadDesktop(GetCurrentThreadId());
79
80 if (!current_desktop)
81 return SBOX_ERROR_CANNOT_GET_DESKTOP;
82
83 // Get the security attributes from the current desktop, we will use this as
84 // the base security attributes for the new desktop.
85 SECURITY_ATTRIBUTES attributes = {0};
86 if (!GetSecurityAttributes(current_desktop, &attributes))
87 return SBOX_ERROR_CANNOT_QUERY_DESKTOP_SECURITY;
88
89 // Back up the current window station, in case we need to switch it.
90 HWINSTA current_winsta = ::GetProcessWindowStation();
91
92 if (winsta) {
93 // We need to switch to the alternate window station before creating the
94 // desktop.
95 if (!::SetProcessWindowStation(winsta)) {
96 ::LocalFree(attributes.lpSecurityDescriptor);
97 return SBOX_ERROR_CANNOT_CREATE_DESKTOP;
98 }
99 }
100
101 // Create the destkop.
102 *desktop = ::CreateDesktop(desktop_name.c_str(),
103 NULL,
104 NULL,
105 0,
106 DESKTOP_CREATEWINDOW | DESKTOP_READOBJECTS |
107 READ_CONTROL | WRITE_DAC | WRITE_OWNER,
108 &attributes);
109 ::LocalFree(attributes.lpSecurityDescriptor);
110
111 if (winsta) {
112 // Revert to the right window station.
113 if (!::SetProcessWindowStation(current_winsta)) {
114 return SBOX_ERROR_FAILED_TO_SWITCH_BACK_WINSTATION;
115 }
116 }
117
118 if (*desktop) {
119 // Replace the DACL on the new Desktop with a reduced privilege version.
120 // We can soft fail on this for now, as it's just an extra mitigation.
121 static const ACCESS_MASK kDesktopDenyMask = WRITE_DAC | WRITE_OWNER |
122 DELETE |
123 DESKTOP_CREATEMENU |
124 DESKTOP_CREATEWINDOW |
125 DESKTOP_HOOKCONTROL |
126 DESKTOP_JOURNALPLAYBACK |
127 DESKTOP_JOURNALRECORD |
128 DESKTOP_SWITCHDESKTOP;
129 AddKnownSidToObject(*desktop, SE_WINDOW_OBJECT, Sid(WinRestrictedCodeSid),
130 DENY_ACCESS, kDesktopDenyMask);
131 return SBOX_ALL_OK;
132 }
133
134 return SBOX_ERROR_CANNOT_CREATE_DESKTOP;
135 }
136
GetWindowObjectName(HANDLE handle)137 base::string16 GetWindowObjectName(HANDLE handle) {
138 // Get the size of the name.
139 DWORD size = 0;
140 ::GetUserObjectInformation(handle, UOI_NAME, NULL, 0, &size);
141
142 if (!size) {
143 NOTREACHED();
144 return base::string16();
145 }
146
147 // Create the buffer that will hold the name.
148 std::unique_ptr<wchar_t[]> name_buffer(new wchar_t[size]);
149
150 // Query the name of the object.
151 if (!::GetUserObjectInformation(handle, UOI_NAME, name_buffer.get(), size,
152 &size)) {
153 NOTREACHED();
154 return base::string16();
155 }
156
157 return base::string16(name_buffer.get());
158 }
159
GetFullDesktopName(HWINSTA winsta,HDESK desktop)160 base::string16 GetFullDesktopName(HWINSTA winsta, HDESK desktop) {
161 if (!desktop) {
162 NOTREACHED();
163 return base::string16();
164 }
165
166 base::string16 name;
167 if (winsta) {
168 name = GetWindowObjectName(winsta);
169 name += L'\\';
170 }
171
172 name += GetWindowObjectName(desktop);
173 return name;
174 }
175
176 } // namespace sandbox
177