sandbox/src/broker_services.cc - chromium/src - Git at Google

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #include "sandbox/src/broker_services.h"

 #include "base/logging.h"
 #include "base/threading/platform_thread.h"
 #include "sandbox/src/sandbox_policy_base.h"
 #include "sandbox/src/sandbox.h"
 #include "sandbox/src/target_process.h"
 #include "sandbox/src/win2k_threadpool.h"
 #include "sandbox/src/win_utils.h"

 namespace {

 // Utility function to associate a completion port to a job object.
 bool AssociateCompletionPort(HANDLE job, HANDLE port, void* key) {
   JOBOBJECT_ASSOCIATE_COMPLETION_PORT job_acp = { key, port };
   return ::SetInformationJobObject(job,
                                    JobObjectAssociateCompletionPortInformation,
                                    &job_acp, sizeof(job_acp))? true : false;
 }

 // Utility function to do the cleanup necessary when something goes wrong
 // while in SpawnTarget and we must terminate the target process.
 sandbox::ResultCode SpawnCleanup(sandbox::TargetProcess* target, DWORD error) {
   if (0 == error)
     error = ::GetLastError();

   target->Terminate();
   delete target;
   ::SetLastError(error);
   return sandbox::SBOX_ERROR_GENERIC;
 }

 // the different commands that you can send to the worker thread that
 // executes TargetEventsThread().
 enum {
   THREAD_CTRL_NONE,
   THREAD_CTRL_QUIT,
   THREAD_CTRL_LAST
 };

 }

 namespace sandbox {

 BrokerServicesBase::BrokerServicesBase()
     : thread_pool_(NULL), job_port_(NULL), no_targets_(NULL),
       job_thread_(NULL) {
 }

 // The broker uses a dedicated worker thread that services the job completion
 // port to perform policy notifications and associated cleanup tasks.
 ResultCode BrokerServicesBase::Init() {
   if ((NULL != job_port_) || (NULL != thread_pool_))
     return SBOX_ERROR_UNEXPECTED_CALL;

   ::InitializeCriticalSection(&lock_);

   job_port_ = ::CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, 0, 0);
   if (NULL == job_port_)
     return SBOX_ERROR_GENERIC;

   no_targets_ = ::CreateEventW(NULL, TRUE, FALSE, NULL);

   job_thread_ = ::CreateThread(NULL, 0,  // Default security and stack.
                                TargetEventsThread, this, NULL, NULL);
   if (NULL == job_thread_)
     return SBOX_ERROR_GENERIC;

   return SBOX_ALL_OK;
 }

 // The destructor should only be called when the Broker process is terminating.
 // Since BrokerServicesBase is a singleton, this is called from the CRT
 // termination handlers, if this code lives on a DLL it is called during
 // DLL_PROCESS_DETACH in other words, holding the loader lock, so we cannot
 // wait for threads here.
 BrokerServicesBase::~BrokerServicesBase() {
   // If there is no port Init() was never called successfully.
   if (!job_port_)
     return;
   // Closing the port causes, that no more Job notifications are delivered to
   // the worker thread and also causes the thread to exit. This is what we
   // want to do since we are going to close all outstanding Jobs and notifying
   // the policy objects ourselves.
   ::PostQueuedCompletionStatus(job_port_, 0, THREAD_CTRL_QUIT, FALSE);
   ::CloseHandle(job_port_);

   if (WAIT_TIMEOUT == ::WaitForSingleObject(job_thread_, 1000)) {
     // Cannot clean broker services.
     NOTREACHED();
     return;
   }

   JobTrackerList::iterator it;
   for (it = tracker_list_.begin(); it != tracker_list_.end(); ++it) {
     JobTracker* tracker = (*it);
     FreeResources(tracker);
     delete tracker;
   }
   ::CloseHandle(job_thread_);
   delete thread_pool_;
   ::CloseHandle(no_targets_);
   // If job_port_ isn't NULL, assumes that the lock has been initialized.
   if (job_port_)
     ::DeleteCriticalSection(&lock_);
 }

 TargetPolicy* BrokerServicesBase::CreatePolicy() {
   // If you change the type of the object being created here you must also
   // change the downcast to it in SpawnTarget().
   return new PolicyBase;
 }

 void BrokerServicesBase::FreeResources(JobTracker* tracker) {
   if (NULL != tracker->policy) {
     BOOL res = ::TerminateJobObject(tracker->job, SBOX_ALL_OK);
     DCHECK(res);
     // Closing the job causes the target process to be destroyed so this
     // needs to happen before calling OnJobEmpty().
     res = ::CloseHandle(tracker->job);
     DCHECK(res);
     // In OnJobEmpty() we don't actually use the job handle directly.
     tracker->policy->OnJobEmpty(tracker->job);
     tracker->policy->Release();
     tracker->policy = NULL;
   }
 }

 // The worker thread stays in a loop waiting for asynchronous notifications
 // from the job objects. Right now we only care about knowing when the last
 // process on a job terminates, but in general this is the place to tell
 // the policy about events.
 DWORD WINAPI BrokerServicesBase::TargetEventsThread(PVOID param) {
   if (NULL == param)
     return 1;

   base::PlatformThread::SetName("BrokerEvent");

   BrokerServicesBase* broker = reinterpret_cast<BrokerServicesBase*>(param);
   HANDLE port = broker->job_port_;
   HANDLE no_targets = broker->no_targets_;

   int target_counter = 0;
   ::ResetEvent(no_targets);

   while (true) {
     DWORD events = 0;
     ULONG_PTR key = 0;
     LPOVERLAPPED ovl = NULL;

     if (!::GetQueuedCompletionStatus(port, &events, &key, &ovl, INFINITE))
       // this call fails if the port has been closed before we have a
       // chance to service the last packet which is 'exit' anyway so
       // this is not an error.
       return 1;

     if (key > THREAD_CTRL_LAST) {
       // The notification comes from a job object. There are nine notifications
       // that jobs can send and some of them depend on the job attributes set.
       JobTracker* tracker = reinterpret_cast<JobTracker*>(key);

       switch (events) {
         case JOB_OBJECT_MSG_ACTIVE_PROCESS_ZERO: {
           // The job object has signaled that the last process associated
           // with it has terminated. Assuming there is no way for a process
           // to appear out of thin air in this job, it safe to assume that
           // we can tell the policy to destroy the target object, and for
           // us to release our reference to the policy object.
           FreeResources(tracker);
           break;
         }

         case JOB_OBJECT_MSG_NEW_PROCESS: {
           ++target_counter;
           if (1 == target_counter) {
             ::ResetEvent(no_targets);
           }
           break;
         }

         case JOB_OBJECT_MSG_EXIT_PROCESS:
         case JOB_OBJECT_MSG_ABNORMAL_EXIT_PROCESS: {
           --target_counter;
           if (0 == target_counter)
             ::SetEvent(no_targets);

           DCHECK(target_counter >= 0);
           break;
         }

         case JOB_OBJECT_MSG_ACTIVE_PROCESS_LIMIT: {
           break;
         }

         default: {
           NOTREACHED();
           break;
         }
       }

     } else if (THREAD_CTRL_QUIT == key) {
       // The broker object is being destroyed so the thread needs to exit.
       return 0;
     } else {
       // We have not implemented more commands.
       NOTREACHED();
     }
   }

   NOTREACHED();
   return 0;
 }

 // SpawnTarget does all the interesting sandbox setup and creates the target
 // process inside the sandbox.
 ResultCode BrokerServicesBase::SpawnTarget(const wchar_t* exe_path,
                                            const wchar_t* command_line,
                                            TargetPolicy* policy,
                                            PROCESS_INFORMATION* target_info) {
   if (!exe_path)
     return SBOX_ERROR_BAD_PARAMS;

   if (!policy)
     return SBOX_ERROR_BAD_PARAMS;

   // Even though the resources touched by SpawnTarget can be accessed in
   // multiple threads, the method itself cannot be called from more than
   // 1 thread. This is to protect the global variables used while setting up
   // the child process.
   static DWORD thread_id = ::GetCurrentThreadId();
   DCHECK(thread_id == ::GetCurrentThreadId());

   AutoLock lock(&lock_);

   // This downcast is safe as long as we control CreatePolicy()
   PolicyBase* policy_base = static_cast<PolicyBase*>(policy);

   // Construct the tokens and the job object that we are going to associate
   // with the soon to be created target process.
   HANDLE lockdown_token = NULL;
   HANDLE initial_token = NULL;
   DWORD win_result = policy_base->MakeTokens(&initial_token, &lockdown_token);
   if (ERROR_SUCCESS != win_result)
     return SBOX_ERROR_GENERIC;

   HANDLE job = NULL;
   win_result = policy_base->MakeJobObject(&job);
   if (ERROR_SUCCESS != win_result)
     return SBOX_ERROR_GENERIC;

   if (ERROR_ALREADY_EXISTS == ::GetLastError())
     return SBOX_ERROR_GENERIC;

   // Construct the thread pool here in case it is expensive.
   // The thread pool is shared by all the targets
   if (NULL == thread_pool_)
     thread_pool_ = new Win2kThreadPool();

   // Create the TargetProces object and spawn the target suspended. Note that
   // Brokerservices does not own the target object. It is owned by the Policy.
   PROCESS_INFORMATION process_info = {0};
   TargetProcess* target = new TargetProcess(initial_token, lockdown_token,
                                             job, thread_pool_);

   std::wstring desktop = policy_base->GetAlternateDesktop();

   win_result = target->Create(exe_path, command_line,
                               desktop.empty() ? NULL : desktop.c_str(),
                               &process_info);
   if (ERROR_SUCCESS != win_result)
     return SpawnCleanup(target, win_result);

   if ((INVALID_HANDLE_VALUE == process_info.hProcess) ||
       (INVALID_HANDLE_VALUE == process_info.hThread))
     return SpawnCleanup(target, win_result);

   // Now the policy is the owner of the target.
   if (!policy_base->AddTarget(target)) {
     return SpawnCleanup(target, 0);
   }

   // We are going to keep a pointer to the policy because we'll call it when
   // the job object generates notifications using the completion port.
   policy_base->AddRef();
   JobTracker* tracker = new JobTracker(job, policy_base);
   if (!AssociateCompletionPort(job, job_port_, tracker))
     return SpawnCleanup(target, 0);
   // Save the tracker because in cleanup we might need to force closing
   // the Jobs.
   tracker_list_.push_back(tracker);

   // We return the caller a duplicate of the process handle so they
   // can close it at will.
   HANDLE dup_process_handle = NULL;
   if (!::DuplicateHandle(::GetCurrentProcess(), process_info.hProcess,
                          ::GetCurrentProcess(), &dup_process_handle,
                          0, FALSE, DUPLICATE_SAME_ACCESS))
     return SpawnCleanup(target, 0);

   *target_info = process_info;
   target_info->hProcess = dup_process_handle;
   return SBOX_ALL_OK;
 }


 ResultCode BrokerServicesBase::WaitForAllTargets() {
   ::WaitForSingleObject(no_targets_, INFINITE);
   return SBOX_ALL_OK;
 }

 }  // namespace sandbox
	// Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#include "sandbox/src/broker_services.h"

	#include "base/logging.h"
	#include "base/threading/platform_thread.h"
	#include "sandbox/src/sandbox_policy_base.h"
	#include "sandbox/src/sandbox.h"
	#include "sandbox/src/target_process.h"
	#include "sandbox/src/win2k_threadpool.h"
	#include "sandbox/src/win_utils.h"

	namespace {

	// Utility function to associate a completion port to a job object.
	bool AssociateCompletionPort(HANDLE job, HANDLE port, void* key) {
	JOBOBJECT_ASSOCIATE_COMPLETION_PORT job_acp = { key, port };
	return ::SetInformationJobObject(job,
	JobObjectAssociateCompletionPortInformation,
	&job_acp, sizeof(job_acp))? true : false;
	}

	// Utility function to do the cleanup necessary when something goes wrong
	// while in SpawnTarget and we must terminate the target process.
	sandbox::ResultCode SpawnCleanup(sandbox::TargetProcess* target, DWORD error) {
	if (0 == error)
	error = ::GetLastError();

	target->Terminate();
	delete target;
	::SetLastError(error);
	return sandbox::SBOX_ERROR_GENERIC;
	}

	// the different commands that you can send to the worker thread that
	// executes TargetEventsThread().
	enum {
	THREAD_CTRL_NONE,
	THREAD_CTRL_QUIT,
	THREAD_CTRL_LAST
	};

	}

	namespace sandbox {

	BrokerServicesBase::BrokerServicesBase()
	: thread_pool_(NULL), job_port_(NULL), no_targets_(NULL),
	job_thread_(NULL) {
	}

	// The broker uses a dedicated worker thread that services the job completion
	// port to perform policy notifications and associated cleanup tasks.
	ResultCode BrokerServicesBase::Init() {
	if ((NULL != job_port_) \|\| (NULL != thread_pool_))
	return SBOX_ERROR_UNEXPECTED_CALL;

	::InitializeCriticalSection(&lock_);

	job_port_ = ::CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, 0, 0);
	if (NULL == job_port_)
	return SBOX_ERROR_GENERIC;

	no_targets_ = ::CreateEventW(NULL, TRUE, FALSE, NULL);

	job_thread_ = ::CreateThread(NULL, 0, // Default security and stack.
	TargetEventsThread, this, NULL, NULL);
	if (NULL == job_thread_)
	return SBOX_ERROR_GENERIC;

	return SBOX_ALL_OK;
	}

	// The destructor should only be called when the Broker process is terminating.
	// Since BrokerServicesBase is a singleton, this is called from the CRT
	// termination handlers, if this code lives on a DLL it is called during
	// DLL_PROCESS_DETACH in other words, holding the loader lock, so we cannot
	// wait for threads here.
	BrokerServicesBase::~BrokerServicesBase() {
	// If there is no port Init() was never called successfully.
	if (!job_port_)
	return;
	// Closing the port causes, that no more Job notifications are delivered to
	// the worker thread and also causes the thread to exit. This is what we
	// want to do since we are going to close all outstanding Jobs and notifying
	// the policy objects ourselves.
	::PostQueuedCompletionStatus(job_port_, 0, THREAD_CTRL_QUIT, FALSE);
	::CloseHandle(job_port_);

	if (WAIT_TIMEOUT == ::WaitForSingleObject(job_thread_, 1000)) {
	// Cannot clean broker services.
	NOTREACHED();
	return;
	}

	JobTrackerList::iterator it;
	for (it = tracker_list_.begin(); it != tracker_list_.end(); ++it) {
	JobTracker* tracker = (*it);
	FreeResources(tracker);
	delete tracker;
	}
	::CloseHandle(job_thread_);
	delete thread_pool_;
	::CloseHandle(no_targets_);
	// If job_port_ isn't NULL, assumes that the lock has been initialized.
	if (job_port_)
	::DeleteCriticalSection(&lock_);
	}

	TargetPolicy* BrokerServicesBase::CreatePolicy() {
	// If you change the type of the object being created here you must also
	// change the downcast to it in SpawnTarget().
	return new PolicyBase;
	}

	void BrokerServicesBase::FreeResources(JobTracker* tracker) {
	if (NULL != tracker->policy) {
	BOOL res = ::TerminateJobObject(tracker->job, SBOX_ALL_OK);
	DCHECK(res);
	// Closing the job causes the target process to be destroyed so this
	// needs to happen before calling OnJobEmpty().
	res = ::CloseHandle(tracker->job);
	DCHECK(res);
	// In OnJobEmpty() we don't actually use the job handle directly.
	tracker->policy->OnJobEmpty(tracker->job);
	tracker->policy->Release();
	tracker->policy = NULL;
	}
	}

	// The worker thread stays in a loop waiting for asynchronous notifications
	// from the job objects. Right now we only care about knowing when the last
	// process on a job terminates, but in general this is the place to tell
	// the policy about events.
	DWORD WINAPI BrokerServicesBase::TargetEventsThread(PVOID param) {
	if (NULL == param)
	return 1;

	base::PlatformThread::SetName("BrokerEvent");

	BrokerServicesBase* broker = reinterpret_cast<BrokerServicesBase*>(param);
	HANDLE port = broker->job_port_;
	HANDLE no_targets = broker->no_targets_;

	int target_counter = 0;
	::ResetEvent(no_targets);

	while (true) {
	DWORD events = 0;
	ULONG_PTR key = 0;
	LPOVERLAPPED ovl = NULL;

	if (!::GetQueuedCompletionStatus(port, &events, &key, &ovl, INFINITE))
	// this call fails if the port has been closed before we have a
	// chance to service the last packet which is 'exit' anyway so
	// this is not an error.
	return 1;

	if (key > THREAD_CTRL_LAST) {
	// The notification comes from a job object. There are nine notifications
	// that jobs can send and some of them depend on the job attributes set.
	JobTracker* tracker = reinterpret_cast<JobTracker*>(key);

	switch (events) {
	case JOB_OBJECT_MSG_ACTIVE_PROCESS_ZERO: {
	// The job object has signaled that the last process associated
	// with it has terminated. Assuming there is no way for a process
	// to appear out of thin air in this job, it safe to assume that
	// we can tell the policy to destroy the target object, and for
	// us to release our reference to the policy object.
	FreeResources(tracker);
	break;
	}

	case JOB_OBJECT_MSG_NEW_PROCESS: {
	++target_counter;
	if (1 == target_counter) {
	::ResetEvent(no_targets);
	}
	break;
	}

	case JOB_OBJECT_MSG_EXIT_PROCESS:
	case JOB_OBJECT_MSG_ABNORMAL_EXIT_PROCESS: {
	--target_counter;
	if (0 == target_counter)
	::SetEvent(no_targets);

	DCHECK(target_counter >= 0);
	break;
	}

	case JOB_OBJECT_MSG_ACTIVE_PROCESS_LIMIT: {
	break;
	}

	default: {
	NOTREACHED();
	break;
	}
	}

	} else if (THREAD_CTRL_QUIT == key) {
	// The broker object is being destroyed so the thread needs to exit.
	return 0;
	} else {
	// We have not implemented more commands.
	NOTREACHED();
	}
	}

	NOTREACHED();
	return 0;
	}

	// SpawnTarget does all the interesting sandbox setup and creates the target
	// process inside the sandbox.
	ResultCode BrokerServicesBase::SpawnTarget(const wchar_t* exe_path,
	const wchar_t* command_line,
	TargetPolicy* policy,
	PROCESS_INFORMATION* target_info) {
	if (!exe_path)
	return SBOX_ERROR_BAD_PARAMS;

	if (!policy)
	return SBOX_ERROR_BAD_PARAMS;

	// Even though the resources touched by SpawnTarget can be accessed in
	// multiple threads, the method itself cannot be called from more than
	// 1 thread. This is to protect the global variables used while setting up
	// the child process.
	static DWORD thread_id = ::GetCurrentThreadId();
	DCHECK(thread_id == ::GetCurrentThreadId());

	AutoLock lock(&lock_);

	// This downcast is safe as long as we control CreatePolicy()
	PolicyBase* policy_base = static_cast<PolicyBase*>(policy);

	// Construct the tokens and the job object that we are going to associate
	// with the soon to be created target process.
	HANDLE lockdown_token = NULL;
	HANDLE initial_token = NULL;
	DWORD win_result = policy_base->MakeTokens(&initial_token, &lockdown_token);
	if (ERROR_SUCCESS != win_result)
	return SBOX_ERROR_GENERIC;

	HANDLE job = NULL;
	win_result = policy_base->MakeJobObject(&job);
	if (ERROR_SUCCESS != win_result)
	return SBOX_ERROR_GENERIC;

	if (ERROR_ALREADY_EXISTS == ::GetLastError())
	return SBOX_ERROR_GENERIC;

	// Construct the thread pool here in case it is expensive.
	// The thread pool is shared by all the targets
	if (NULL == thread_pool_)
	thread_pool_ = new Win2kThreadPool();

	// Create the TargetProces object and spawn the target suspended. Note that
	// Brokerservices does not own the target object. It is owned by the Policy.
	PROCESS_INFORMATION process_info = {0};
	TargetProcess* target = new TargetProcess(initial_token, lockdown_token,
	job, thread_pool_);

	std::wstring desktop = policy_base->GetAlternateDesktop();

	win_result = target->Create(exe_path, command_line,
	desktop.empty() ? NULL : desktop.c_str(),
	&process_info);
	if (ERROR_SUCCESS != win_result)
	return SpawnCleanup(target, win_result);

	if ((INVALID_HANDLE_VALUE == process_info.hProcess) \|\|
	(INVALID_HANDLE_VALUE == process_info.hThread))
	return SpawnCleanup(target, win_result);

	// Now the policy is the owner of the target.
	if (!policy_base->AddTarget(target)) {
	return SpawnCleanup(target, 0);
	}

	// We are going to keep a pointer to the policy because we'll call it when
	// the job object generates notifications using the completion port.
	policy_base->AddRef();
	JobTracker* tracker = new JobTracker(job, policy_base);
	if (!AssociateCompletionPort(job, job_port_, tracker))
	return SpawnCleanup(target, 0);
	// Save the tracker because in cleanup we might need to force closing
	// the Jobs.
	tracker_list_.push_back(tracker);

	// We return the caller a duplicate of the process handle so they
	// can close it at will.
	HANDLE dup_process_handle = NULL;
	if (!::DuplicateHandle(::GetCurrentProcess(), process_info.hProcess,
	::GetCurrentProcess(), &dup_process_handle,
	0, FALSE, DUPLICATE_SAME_ACCESS))
	return SpawnCleanup(target, 0);

	*target_info = process_info;
	target_info->hProcess = dup_process_handle;
	return SBOX_ALL_OK;
	}


	ResultCode BrokerServicesBase::WaitForAllTargets() {
	::WaitForSingleObject(no_targets_, INFINITE);
	return SBOX_ALL_OK;
	}

	} // namespace sandbox