win/src/restricted_token.h

// Copyright 2010 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef SANDBOX_WIN_SRC_RESTRICTED_TOKEN_H_
#define SANDBOX_WIN_SRC_RESTRICTED_TOKEN_H_

#include <vector>

#include <optional>
#include "base/win/access_control_list.h"
#include "base/win/access_token.h"
#include "base/win/sid.h"
#include "base/win/windows_types.h"
#include "sandbox/win/src/security_level.h"

namespace sandbox {

// Handles the creation of a restricted token using the effective token or
// any token handle.
// Sample usage:
//    RestrictedToken restricted_token;
//
//    restricted_token.AddRestrictingSid(base::win::WellKnownSid::kUsers);
//    auto token = restricted_token.GetRestrictedToken();
//    if (!token) {
//      // handle error.
//    }
//    [...]
class RestrictedToken {
 public:
  RestrictedToken();

  RestrictedToken(const RestrictedToken&) = delete;
  RestrictedToken& operator=(const RestrictedToken&) = delete;

  ~RestrictedToken();

  // Creates a restricted token. This creates a primary token for process
  // creation. If the function fails an empty value is returned.
  std::optional<base::win::AccessToken> GetRestrictedToken() const;

  // Lists all sids in the token and mark them as Deny Only except for those
  // present in the exceptions parameter. If there is no exception needed,
  // the caller can pass an empty list or nullptr for the exceptions
  // parameter.
  //
  // Sample usage:
  //    std::vector<base::win::Sid> sid_exceptions;
  //    sid_exceptions.emplace_back(base::win::WellKnownSid::kWorld);
  //    restricted_token.AddAllSidsForDenyOnly(sid_exceptions);
  // Note: A Sid marked for Deny Only in a token cannot be used to grant
  // access to any resource. It can only be used to deny access.
  void AddAllSidsForDenyOnly(const std::vector<base::win::Sid>& exceptions);

  // Adds a user or group SID for Deny Only in the restricted token.
  // `sid` is the SID to add in the Deny Only list.
  //
  // Sample Usage:
  //    restricted_token.AddSidForDenyOnly(sid);
  void AddSidForDenyOnly(const base::win::Sid& sid);

  // Adds a known SID for Deny Only in the restricted token.
  // `known_sid` is the SID to add in the Deny Only list.
  // Sample Usage:
  //    restricted_token.AddSidForDenyOnly(base::win::WellKnownSid::kWorld);
  void AddSidForDenyOnly(base::win::WellKnownSid known_sid);

  // Adds the user sid of the token for Deny Only in the restricted token.
  void AddUserSidForDenyOnly();

  // Specify to remove all privileges in the restricted token. By default this
  // will not remove SeChangeNotifyPrivilege, however you can specify true for
  // `remove_traversal_privilege` to remove that privilege as well.
  void DeleteAllPrivileges(bool remove_traversal_privilege);

  // Adds a SID to the list of restricting sids in the restricted token.
  // `sid` is the sid to add to the list restricting sids.
  //
  // Sample usage:
  //    restricted_token.AddRestrictingSid(ATL::Sids::Users().GetPSID());
  // Note: The list of restricting is used to force Windows to perform all
  // access checks twice. The first time using your user SID and your groups,
  // and the second time using your list of restricting sids. The access has
  // to be granted in both places to get access to the resource requested.
  void AddRestrictingSid(const base::win::Sid& sid);

  // Adds a known SID to the list of restricting sids in the restricted token.
  // `known_sid` is the sid to add to the list restricting sids.

  // Sample usage:
  //    restricted_token.AddRestrictingSid(base::win::WellKnownSid::kWorld);
  // Note: The list of restricting is used to force Windows to perform all
  // access checks twice. The first time using your user SID and your groups,
  // and the second time using your list of restricting sids. The access has
  // to be granted in both places to get access to the resource requested.
  void AddRestrictingSid(base::win::WellKnownSid known_sid);

  // Adds the logon sid of the token in the list of restricting sids for the
  // restricted token.
  void AddRestrictingSidLogonSession();

  // Adds the owner sid of the token in the list of restricting sids for the
  // restricted token.
  void AddRestrictingSidCurrentUser();

  // Adds all group sids and the user sid to the restricting sids list.
  void AddRestrictingSidAllSids();

  // Sets the token integrity level. The integrity level cannot be higher than
  // your current integrity level.
  void SetIntegrityLevel(IntegrityLevel integrity_level);

  // Set a flag which indicates the created token should have a locked down
  // default DACL when created.
  void SetLockdownDefaultDacl();

  // Add a SID to the default DACL. These SIDs are added regardless of the
  // SetLockdownDefaultDacl state.
  void AddDefaultDaclSid(const base::win::Sid& sid,
                         base::win::SecurityAccessMode access_mode,
                         ACCESS_MASK access);

  // Add a SID to the default DACL. These SIDs are added regardless of the
  // SetLockdownDefaultDacl state.
  void AddDefaultDaclSid(base::win::WellKnownSid known_sid,
                         base::win::SecurityAccessMode access_mode,
                         ACCESS_MASK access);

  // Creates a restricted token. This is only used for testing to change the
  // token used to build the restricted token.
  std::optional<base::win::AccessToken> GetRestrictedTokenForTesting(
      base::win::AccessToken& token);

 private:
  std::vector<base::win::Sid> BuildDenyOnlySids(
      const base::win::AccessToken& token) const;
  std::vector<base::win::Sid> BuildRestrictedSids(
      const base::win::AccessToken& token) const;
  std::optional<base::win::AccessToken> CreateRestricted(
      const base::win::AccessToken& token) const;

  // The list of restricting sids in the restricted token.
  std::vector<base::win::Sid> sids_to_restrict_;
  // The list of sids to mark as Deny Only in the restricted token.
  std::vector<base::win::Sid> sids_for_deny_only_;
  // The list of sids to add to the default DACL of the restricted token.
  std::vector<base::win::ExplicitAccessEntry> sids_for_default_dacl_;
  // The token to restrict, this is only used for testing.
  std::optional<base::win::AccessToken> effective_token_;
  // The token integrity level RID.
  std::optional<DWORD> integrity_rid_;
  // Lockdown the default DACL when creating new tokens.
  bool lockdown_default_dacl_ = false;
  // Delete all privileges except for SeChangeNotifyPrivilege.
  bool delete_all_privileges_ = false;
  // Also delete SeChangeNotifyPrivilege if delete_all_privileges_ is true.
  bool remove_traversal_privilege_ = false;
  // Add all SIDs for deny only.
  bool add_all_sids_for_deny_only_ = false;
  // The list of exceptions when adding all SIDs for deny only.
  std::vector<base::win::Sid> add_all_exceptions_;
  // Add the user's sid to the deny only list.
  bool add_user_sid_for_deny_only_ = false;
  // Add the logon session SID to the restricted SID list.
  bool add_restricting_sid_logon_session_ = false;
  // Add the current user SID to the restricted SID list.
  bool add_restricting_sid_current_user_ = false;
  // Add all SIDs to the restricted SIDs.
  bool add_restricting_sid_all_sids_ = false;
};

}  // namespace sandbox

#endif  // SANDBOX_WIN_SRC_RESTRICTED_TOKEN_H_