1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "sandbox/win/src/handle_dispatcher.h"
7 #include "base/win/scoped_handle.h"
8 #include "sandbox/win/src/handle_interception.h"
9 #include "sandbox/win/src/handle_policy.h"
10 #include "sandbox/win/src/ipc_tags.h"
11 #include "sandbox/win/src/policy_broker.h"
12 #include "sandbox/win/src/policy_params.h"
13 #include "sandbox/win/src/sandbox.h"
14 #include "sandbox/win/src/sandbox_nt_util.h"
15 #include "sandbox/win/src/sandbox_types.h"
16 #include "sandbox/win/src/sandbox_utils.h"
20 HandleDispatcher::HandleDispatcher(PolicyBase* policy_base)
21 : policy_base_(policy_base) {
22 static const IPCCall duplicate_handle_proxy = {
23 {IPC_DUPLICATEHANDLEPROXY_TAG, VOIDPTR_TYPE, ULONG_TYPE, ULONG_TYPE,
25 reinterpret_cast<CallbackGeneric>(&HandleDispatcher::DuplicateHandleProxy)
28 ipc_calls_.push_back(duplicate_handle_proxy);
31 bool HandleDispatcher::SetupService(InterceptionManager* manager,
33 // We perform no interceptions for handles right now.
35 case IPC_DUPLICATEHANDLEPROXY_TAG:
42 bool HandleDispatcher::DuplicateHandleProxy(IPCInfo* ipc,
44 DWORD target_process_id,
48 static NtQueryObject QueryObject = NULL;
50 ResolveNTFunctionPtr("NtQueryObject", &QueryObject);
52 // Get a copy of the handle for use in the broker process.
54 if (!::DuplicateHandle(ipc->client_info->process, source_handle,
55 ::GetCurrentProcess(), &handle_temp,
56 0, FALSE, DUPLICATE_SAME_ACCESS | options)) {
57 ipc->return_info.win32_result = ::GetLastError();
60 options &= ~DUPLICATE_CLOSE_SOURCE;
61 base::win::ScopedHandle handle(handle_temp);
63 // Get the object type (32 characters is safe; current max is 14).
64 BYTE buffer[sizeof(OBJECT_TYPE_INFORMATION) + 32 * sizeof(wchar_t)];
65 OBJECT_TYPE_INFORMATION* type_info =
66 reinterpret_cast<OBJECT_TYPE_INFORMATION*>(buffer);
67 ULONG size = sizeof(buffer) - sizeof(wchar_t);
68 error = QueryObject(handle, ObjectTypeInformation, type_info, size, &size);
69 if (!NT_SUCCESS(error)) {
70 ipc->return_info.win32_result = error;
73 type_info->Name.Buffer[type_info->Name.Length / sizeof(wchar_t)] = L'\0';
75 CountedParameterSet<HandleTarget> params;
76 params[HandleTarget::NAME] = ParamPickerMake(type_info->Name.Buffer);
77 params[HandleTarget::TARGET] = ParamPickerMake(target_process_id);
79 EvalResult eval = policy_base_->EvalPolicy(IPC_DUPLICATEHANDLEPROXY_TAG,
81 ipc->return_info.win32_result =
82 HandlePolicy::DuplicateHandleProxyAction(eval, handle,
84 &ipc->return_info.handle,
85 desired_access, options);
89 } // namespace sandbox