src/sandbox/win/src/process_mitigations.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/win/src/process_mitigations.h"
   6
   7 #include <algorithm>
   8
   9 #include "base/win/windows_version.h"
  10 #include "sandbox/win/src/nt_internals.h"
  11 #include "sandbox/win/src/sandbox_utils.h"
  12 #include "sandbox/win/src/win_utils.h"
  13
  14 namespace {
  15
  16 // Functions for enabling policies.
  17 typedef BOOL (WINAPI *SetProcessDEPPolicyFunction)(DWORD dwFlags);
  18
  19 typedef BOOL (WINAPI *SetProcessMitigationPolicyFunction)(
  20     PROCESS_MITIGATION_POLICY mitigation_policy,
  21     PVOID buffer,
  22     SIZE_T length);
  23
  24 typedef BOOL (WINAPI *SetDefaultDllDirectoriesFunction)(
  25     DWORD DirectoryFlags);
  26
  27 }  // namespace
  28
  29 namespace sandbox {
  30
  31 bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags flags) {
  32   if (!CanSetProcessMitigationsPostStartup(flags))
  33     return false;
  34
  35   // We can't apply anything before Win XP, so just return cleanly.
  36   if (!IsXPSP2OrLater())
  37     return true;
  38
  39   base::win::Version version = base::win::GetVersion();
  40   HMODULE module = ::GetModuleHandleA("kernel32.dll");
  41
  42   if (version >= base::win::VERSION_VISTA &&
  43       (flags & MITIGATION_DLL_SEARCH_ORDER)) {
  44     SetDefaultDllDirectoriesFunction set_default_dll_directories =
  45         reinterpret_cast<SetDefaultDllDirectoriesFunction>(
  46             ::GetProcAddress(module, "SetDefaultDllDirectories"));
  47
  48     // Check for SetDefaultDllDirectories since it requires KB2533623.
  49     if (set_default_dll_directories) {
  50       if (!set_default_dll_directories(LOAD_LIBRARY_SEARCH_DEFAULT_DIRS) &&
  51           ERROR_ACCESS_DENIED != ::GetLastError()) {
  52         return false;
  53       }
  54     }
  55   }
  56
  57   // Set the heap to terminate on corruption
  58   if (version >= base::win::VERSION_VISTA &&
  59       (flags & MITIGATION_HEAP_TERMINATE)) {
  60     if (!::HeapSetInformation(NULL, HeapEnableTerminationOnCorruption,
  61                               NULL, 0) &&
  62         ERROR_ACCESS_DENIED != ::GetLastError()) {
  63       return false;
  64     }
  65   }
  66
  67 #if !defined(_WIN64)  // DEP is always enabled on 64-bit.
  68   if (flags & MITIGATION_DEP) {
  69     DWORD dep_flags = PROCESS_DEP_ENABLE;
  70     // DEP support is quirky on XP, so don't force a failure in that case.
  71     const bool return_on_fail = version >= base::win::VERSION_VISTA;
  72
  73     if (flags & MITIGATION_DEP_NO_ATL_THUNK)
  74       dep_flags |= PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION;
  75
  76     SetProcessDEPPolicyFunction set_process_dep_policy =
  77         reinterpret_cast<SetProcessDEPPolicyFunction>(
  78             ::GetProcAddress(module, "SetProcessDEPPolicy"));
  79     if (set_process_dep_policy) {
  80       if (!set_process_dep_policy(dep_flags) &&
  81           ERROR_ACCESS_DENIED != ::GetLastError() && return_on_fail) {
  82         return false;
  83       }
  84     } else {
  85       // We're on XP sp2, so use the less standard approach.
  86       // For reference: http://www.uninformed.org/?v=2&a=4
  87       const int MEM_EXECUTE_OPTION_ENABLE = 1;
  88       const int MEM_EXECUTE_OPTION_DISABLE = 2;
  89       const int MEM_EXECUTE_OPTION_ATL7_THUNK_EMULATION = 4;
  90       const int MEM_EXECUTE_OPTION_PERMANENT = 8;
  91
  92       NtSetInformationProcessFunction set_information_process = NULL;
  93       ResolveNTFunctionPtr("NtSetInformationProcess",
  94                            &set_information_process);
  95       if (!set_information_process)
  96         return false;
  97       ULONG dep = MEM_EXECUTE_OPTION_DISABLE | MEM_EXECUTE_OPTION_PERMANENT;
  98       if (!(dep_flags & PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION))
  99         dep |= MEM_EXECUTE_OPTION_ATL7_THUNK_EMULATION;
 100       if (!SUCCEEDED(set_information_process(GetCurrentProcess(),
 101                                              ProcessExecuteFlags,
 102                                              &dep, sizeof(dep))) &&
 103           ERROR_ACCESS_DENIED != ::GetLastError() && return_on_fail) {
 104         return false;
 105       }
 106     }
 107   }
 108 #endif
 109
 110   // This is all we can do in Win7 and below.
 111   if (version < base::win::VERSION_WIN8)
 112     return true;
 113
 114   SetProcessMitigationPolicyFunction set_process_mitigation_policy =
 115       reinterpret_cast<SetProcessMitigationPolicyFunction>(
 116           ::GetProcAddress(module, "SetProcessMitigationPolicy"));
 117   if (!set_process_mitigation_policy)
 118     return false;
 119
 120   // Enable ASLR policies.
 121   if (flags & MITIGATION_RELOCATE_IMAGE) {
 122     PROCESS_MITIGATION_ASLR_POLICY policy = { 0 };
 123     policy.EnableForceRelocateImages = true;
 124     policy.DisallowStrippedImages = (flags &
 125         MITIGATION_RELOCATE_IMAGE_REQUIRED) ==
 126         MITIGATION_RELOCATE_IMAGE_REQUIRED;
 127
 128     if (!set_process_mitigation_policy(ProcessASLRPolicy, &policy,
 129                                        sizeof(policy)) &&
 130         ERROR_ACCESS_DENIED != ::GetLastError()) {
 131       return false;
 132     }
 133   }
 134
 135   // Enable strict handle policies.
 136   if (flags & MITIGATION_STRICT_HANDLE_CHECKS) {
 137     PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY policy = { 0 };
 138     policy.HandleExceptionsPermanentlyEnabled =
 139         policy.RaiseExceptionOnInvalidHandleReference = true;
 140
 141     if (!set_process_mitigation_policy(ProcessStrictHandleCheckPolicy, &policy,
 142                                        sizeof(policy)) &&
 143         ERROR_ACCESS_DENIED != ::GetLastError()) {
 144       return false;
 145     }
 146   }
 147
 148   // Enable system call policies.
 149   if (flags & MITIGATION_WIN32K_DISABLE) {
 150     PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY policy = { 0 };
 151     policy.DisallowWin32kSystemCalls = true;
 152
 153     if (!set_process_mitigation_policy(ProcessSystemCallDisablePolicy, &policy,
 154                                        sizeof(policy)) &&
 155         ERROR_ACCESS_DENIED != ::GetLastError()) {
 156       return false;
 157     }
 158   }
 159
 160   // Enable system call policies.
 161   if (flags & MITIGATION_EXTENSION_DLL_DISABLE) {
 162     PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY policy = { 0 };
 163     policy.DisableExtensionPoints = true;
 164
 165     if (!set_process_mitigation_policy(ProcessExtensionPointDisablePolicy,
 166                                        &policy, sizeof(policy)) &&
 167         ERROR_ACCESS_DENIED != ::GetLastError()) {
 168       return false;
 169     }
 170   }
 171
 172   return true;
 173 }
 174
 175 void ConvertProcessMitigationsToPolicy(MitigationFlags flags,
 176                                        DWORD64* policy_flags, size_t* size) {
 177   base::win::Version version = base::win::GetVersion();
 178
 179   *policy_flags = 0;
 180 #if defined(_WIN64)
 181   *size = sizeof(*policy_flags);
 182 #elif defined(_M_IX86)
 183   // A 64-bit flags attribute is illegal on 32-bit Win 7 and below.
 184   if (version < base::win::VERSION_WIN8)
 185     *size = sizeof(DWORD);
 186   else
 187     *size = sizeof(*policy_flags);
 188 #else
 189 #error This platform is not supported.
 190 #endif
 191
 192   // Nothing for Win XP or Vista.
 193   if (version <= base::win::VERSION_VISTA)
 194     return;
 195
 196   // DEP and SEHOP are not valid for 64-bit Windows
 197 #if !defined(_WIN64)
 198   if (flags & MITIGATION_DEP) {
 199     *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE;
 200     if (!(flags & MITIGATION_DEP_NO_ATL_THUNK))
 201       *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE;
 202   }
 203
 204   if (flags & MITIGATION_SEHOP)
 205     *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE;
 206 #endif
 207
 208   // Win 7
 209   if (version < base::win::VERSION_WIN8)
 210     return;
 211
 212   if (flags & MITIGATION_RELOCATE_IMAGE) {
 213     *policy_flags |=
 214         PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON;
 215     if (flags & MITIGATION_RELOCATE_IMAGE_REQUIRED) {
 216       *policy_flags |=
 217           PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON_REQ_RELOCS;
 218     }
 219   }
 220
 221   if (flags & MITIGATION_HEAP_TERMINATE) {
 222     *policy_flags |=
 223         PROCESS_CREATION_MITIGATION_POLICY_HEAP_TERMINATE_ALWAYS_ON;
 224   }
 225
 226   if (flags & MITIGATION_BOTTOM_UP_ASLR) {
 227     *policy_flags |=
 228         PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON;
 229   }
 230
 231   if (flags & MITIGATION_HIGH_ENTROPY_ASLR) {
 232     *policy_flags |=
 233         PROCESS_CREATION_MITIGATION_POLICY_HIGH_ENTROPY_ASLR_ALWAYS_ON;
 234   }
 235
 236   if (flags & MITIGATION_STRICT_HANDLE_CHECKS) {
 237     *policy_flags |=
 238         PROCESS_CREATION_MITIGATION_POLICY_STRICT_HANDLE_CHECKS_ALWAYS_ON;
 239   }
 240
 241   if (flags & MITIGATION_WIN32K_DISABLE) {
 242     *policy_flags |=
 243         PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_ALWAYS_ON;
 244   }
 245
 246   if (flags & MITIGATION_EXTENSION_DLL_DISABLE) {
 247     *policy_flags |=
 248         PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON;
 249   }
 250 }
 251
 252 MitigationFlags FilterPostStartupProcessMitigations(MitigationFlags flags) {
 253   // Anything prior to XP SP2.
 254   if (!IsXPSP2OrLater())
 255     return 0;
 256
 257   base::win::Version version = base::win::GetVersion();
 258
 259   // Windows XP SP2+.
 260   if (version < base::win::VERSION_VISTA) {
 261     return flags & (MITIGATION_DEP |
 262                     MITIGATION_DEP_NO_ATL_THUNK);
 263
 264   // Windows Vista
 265   if (version < base::win::VERSION_WIN7) {
 266     return flags & (MITIGATION_DEP |
 267                     MITIGATION_DEP_NO_ATL_THUNK |
 268                     MITIGATION_BOTTOM_UP_ASLR |
 269                     MITIGATION_DLL_SEARCH_ORDER |
 270                     MITIGATION_HEAP_TERMINATE);
 271   }
 272
 273   // Windows 7 and Vista.
 274   } else if (version < base::win::VERSION_WIN8) {
 275     return flags & (MITIGATION_BOTTOM_UP_ASLR |
 276                     MITIGATION_DLL_SEARCH_ORDER |
 277                     MITIGATION_HEAP_TERMINATE);
 278   }
 279
 280   // Windows 8 and above.
 281   return flags & (MITIGATION_BOTTOM_UP_ASLR |
 282                   MITIGATION_DLL_SEARCH_ORDER);
 283 }
 284
 285 bool ApplyProcessMitigationsToSuspendedProcess(HANDLE process,
 286                                                MitigationFlags flags) {
 287 // This is a hack to fake a weak bottom-up ASLR on 32-bit Windows.
 288 #if !defined(_WIN64)
 289   if (flags & MITIGATION_BOTTOM_UP_ASLR) {
 290     unsigned int limit;
 291     rand_s(&limit);
 292     char* ptr = 0;
 293     const size_t kMask64k = 0xFFFF;
 294     // Random range (512k-16.5mb) in 64k steps.
 295     const char* end = ptr + ((((limit % 16384) + 512) * 1024) & ~kMask64k);
 296     while (ptr < end) {
 297       MEMORY_BASIC_INFORMATION memory_info;
 298       if (!::VirtualQueryEx(process, ptr, &memory_info, sizeof(memory_info)))
 299         break;
 300       size_t size = std::min((memory_info.RegionSize + kMask64k) & ~kMask64k,
 301                              static_cast<SIZE_T>(end - ptr));
 302       if (ptr && memory_info.State == MEM_FREE)
 303         ::VirtualAllocEx(process, ptr, size, MEM_RESERVE, PAGE_NOACCESS);
 304       ptr += size;
 305     }
 306   }
 307 #endif
 308
 309   return true;
 310 }
 311
 312 bool CanSetProcessMitigationsPostStartup(MitigationFlags flags) {
 313   // All of these mitigations can be enabled after startup.
 314   return !(flags & ~(MITIGATION_HEAP_TERMINATE |
 315                      MITIGATION_DEP |
 316                      MITIGATION_DEP_NO_ATL_THUNK |
 317                      MITIGATION_RELOCATE_IMAGE |
 318                      MITIGATION_RELOCATE_IMAGE_REQUIRED |
 319                      MITIGATION_BOTTOM_UP_ASLR |
 320                      MITIGATION_STRICT_HANDLE_CHECKS |
 321                      MITIGATION_WIN32K_DISABLE |
 322                      MITIGATION_EXTENSION_DLL_DISABLE |
 323                      MITIGATION_DLL_SEARCH_ORDER));
 324 }
 325
 326 bool CanSetProcessMitigationsPreStartup(MitigationFlags flags) {
 327   // These mitigations cannot be enabled prior to startup.
 328   return !(flags & (MITIGATION_STRICT_HANDLE_CHECKS |
 329                     MITIGATION_WIN32K_DISABLE |
 330                     MITIGATION_DLL_SEARCH_ORDER));
 331 }
 332
 333 }  // namespace sandbox
 334