[PATCH] kernel32: Implement stub for SetProcessMitigationPolicy
This is needed by x64 chromium sandbox for >= win8. Not doing anything but returning true is enough to make it work, though security won't be perfect. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=45643 Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de> --- ...api-ms-win-core-processthreads-l1-1-1.spec | 2 +- ...api-ms-win-core-processthreads-l1-1-2.spec | 2 +- dlls/kernel32/kernel32.spec | 1 + dlls/kernel32/process.c | 10 ++++++++++ dlls/kernelbase/kernelbase.spec | 2 +- include/winnt.h | 19 +++++++++++++++++++ 6 files changed, 33 insertions(+), 3 deletions(-) diff --git a/dlls/api-ms-win-core-processthreads-l1-1-1/api-ms-win-core-processthreads-l1-1-1.spec b/dlls/api-ms-win-core-processthreads-l1-1-1/api-ms-win-core-processthreads-l1-1-1.spec index ebbe55fe68..616fa63909 100644 --- a/dlls/api-ms-win-core-processthreads-l1-1-1/api-ms-win-core-processthreads-l1-1-1.spec +++ b/dlls/api-ms-win-core-processthreads-l1-1-1/api-ms-win-core-processthreads-l1-1-1.spec @@ -44,7 +44,7 @@ @ stdcall ResumeThread(long) kernel32.ResumeThread @ stdcall SetPriorityClass(long long) kernel32.SetPriorityClass @ stdcall SetProcessAffinityUpdateMode(long long) kernel32.SetProcessAffinityUpdateMode -@ stub SetProcessMitigationPolicy +@ stdcall SetProcessMitigationPolicy(long ptr long) kernel32.SetProcessMitigationPolicy @ stdcall SetProcessShutdownParameters(long long) kernel32.SetProcessShutdownParameters @ stdcall SetThreadContext(long ptr) kernel32.SetThreadContext @ stdcall SetThreadIdealProcessorEx(long ptr ptr) kernel32.SetThreadIdealProcessorEx diff --git a/dlls/api-ms-win-core-processthreads-l1-1-2/api-ms-win-core-processthreads-l1-1-2.spec b/dlls/api-ms-win-core-processthreads-l1-1-2/api-ms-win-core-processthreads-l1-1-2.spec index db94c2e5e7..8de6c5b66c 100644 --- a/dlls/api-ms-win-core-processthreads-l1-1-2/api-ms-win-core-processthreads-l1-1-2.spec +++ b/dlls/api-ms-win-core-processthreads-l1-1-2/api-ms-win-core-processthreads-l1-1-2.spec @@ -49,7 +49,7 @@ @ stdcall ResumeThread(long) kernel32.ResumeThread @ stdcall SetPriorityClass(long long) kernel32.SetPriorityClass @ stdcall SetProcessAffinityUpdateMode(long long) kernel32.SetProcessAffinityUpdateMode -@ stub SetProcessMitigationPolicy +@ stdcall SetProcessMitigationPolicy(long ptr long) kernel32.SetProcessMitigationPolicy @ stdcall SetProcessPriorityBoost(long long) kernel32.SetProcessPriorityBoost @ stdcall SetProcessShutdownParameters(long long) kernel32.SetProcessShutdownParameters @ stdcall SetThreadContext(long ptr) kernel32.SetThreadContext diff --git a/dlls/kernel32/kernel32.spec b/dlls/kernel32/kernel32.spec index 9844a744d7..2d5b6df8dd 100644 --- a/dlls/kernel32/kernel32.spec +++ b/dlls/kernel32/kernel32.spec @@ -1427,6 +1427,7 @@ @ stdcall SetProcessAffinityMask(long long) @ stdcall SetProcessAffinityUpdateMode(long long) @ stdcall SetProcessDEPPolicy(long) +@ stdcall SetProcessMitigationPolicy(long ptr long) # @ stub SetProcessPreferredUILanguages @ stdcall SetProcessPriorityBoost(long long) @ stdcall SetProcessShutdownParameters(long long) diff --git a/dlls/kernel32/process.c b/dlls/kernel32/process.c index 42dd7cbbc0..a6a067b3cb 100644 --- a/dlls/kernel32/process.c +++ b/dlls/kernel32/process.c @@ -4536,3 +4536,13 @@ BOOL WINAPI BaseFlushAppcompatCache(void) SetLastError(ERROR_CALL_NOT_IMPLEMENTED); return FALSE; } + +/********************************************************************** + * SetProcessMitigationPolicy (KERNEL32.@) + */ +BOOL WINAPI SetProcessMitigationPolicy(PROCESS_MITIGATION_POLICY migitation_policy, void *buffer, SIZE_T length) +{ + FIXME("(%d, %p, %lu): stub\n", migitation_policy, buffer, length); + + return TRUE; +} diff --git a/dlls/kernelbase/kernelbase.spec b/dlls/kernelbase/kernelbase.spec index c4a75bc169..885c8eca10 100644 --- a/dlls/kernelbase/kernelbase.spec +++ b/dlls/kernelbase/kernelbase.spec @@ -1456,7 +1456,7 @@ # @ stub SetProcessDefaultCpuSets # @ stub SetProcessGroupAffinity # @ stub SetProcessInformation -# @ stub SetProcessMitigationPolicy +@ stdcall SetProcessMitigationPolicy(long ptr long) kernel32.SetProcessMitigationPolicy # @ stub SetProcessPreferredUILanguages @ stdcall SetProcessPriorityBoost(long long) kernel32.SetProcessPriorityBoost @ stdcall SetProcessShutdownParameters(long long) kernel32.SetProcessShutdownParameters diff --git a/include/winnt.h b/include/winnt.h index 719cf8496f..efa41b698d 100644 --- a/include/winnt.h +++ b/include/winnt.h @@ -6288,6 +6288,25 @@ typedef enum _RTL_UMS_SCHEDULER_REASON typedef void (CALLBACK *PRTL_UMS_SCHEDULER_ENTRY_POINT)(RTL_UMS_SCHEDULER_REASON,ULONG_PTR,PVOID); +typedef enum _PROCESS_MITIGATION_POLICY { + ProcessDEPPolicy, + ProcessASLRPolicy, + ProcessDynamicCodePolicy, + ProcessStrictHandleCheckPolicy, + ProcessSystemCallDisablePolicy, + ProcessMitigationOptionsMask, + ProcessExtensionPointDisablePolicy, + ProcessControlFlowGuardPolicy, + ProcessSignaturePolicy, + ProcessFontDisablePolicy, + ProcessImageLoadPolicy, + ProcessSystemCallFilterPolicy, + ProcessPayloadRestrictionPolicy, + ProcessChildProcessPolicy, + ProcessSideChannelIsolationPolicy, + MaxProcessMitigationPolicy +} PROCESS_MITIGATION_POLICY, *PPROCESS_MITIGATION_POLICY; + #ifdef __cplusplus } #endif -- 2.18.0
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=45648 Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de> --- dlls/kernel32/process.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dlls/kernel32/process.c b/dlls/kernel32/process.c index b7ab648fe5..b35e60ee42 100644 --- a/dlls/kernel32/process.c +++ b/dlls/kernel32/process.c @@ -4371,6 +4371,14 @@ BOOL WINAPI UpdateProcThreadAttribute(struct _PROC_THREAD_ATTRIBUTE_LIST *list, } break; + case PROC_THREAD_ATTRIBUTE_MIGITATION_POLICY: + if (size != sizeof(DWORD) && size != sizeof(DWORD64) && size != sizeof(DWORD64) * 2) + { + SetLastError(ERROR_BAD_LENGTH); + return FALSE; + } + break; + default: SetLastError(ERROR_NOT_SUPPORTED); FIXME("Unhandled attribute number %lu\n", attr & PROC_THREAD_ATTRIBUTE_NUMBER); -- 2.18.0
Hi, While running your changed tests on Windows, I think I found new failures. Being a bot and all I'm not very good at pattern recognition, so I might be wrong, but could you please double-check? Full results can be found at: https://testbot.winehq.org/JobDetails.pl?Key=40713 Your paranoid android. === debian9 (build) === error: patch failed: dlls/kernel32/process.c:4371 Task: Patch failed to apply
This is needed by x64 chromium sandbox for >= win10. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=45644 Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de> --- dlls/kernel32/process.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/dlls/kernel32/process.c b/dlls/kernel32/process.c index a6a067b3cb..b7ab648fe5 100644 --- a/dlls/kernel32/process.c +++ b/dlls/kernel32/process.c @@ -4363,8 +4363,17 @@ BOOL WINAPI UpdateProcThreadAttribute(struct _PROC_THREAD_ATTRIBUTE_LIST *list, } break; + case PROC_THREAD_ATTRIBUTE_CHILD_PROCESS_POLICY: + if (size != sizeof(DWORD) && size != sizeof(DWORD64)) + { + SetLastError(ERROR_BAD_LENGTH); + return FALSE; + } + break; + default: SetLastError(ERROR_NOT_SUPPORTED); + FIXME("Unhandled attribute number %lu\n", attr & PROC_THREAD_ATTRIBUTE_NUMBER); return FALSE; } -- 2.18.0
This is required by chromium x64 sandbox >=win8 chrome for some reason is not affected Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=45646 Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de> --- dlls/ntdll/misc.c | 9 +++++++++ dlls/ntdll/ntdll.spec | 1 + 2 files changed, 10 insertions(+) diff --git a/dlls/ntdll/misc.c b/dlls/ntdll/misc.c index 1c9c91cfbb..12d8fbdf85 100644 --- a/dlls/ntdll/misc.c +++ b/dlls/ntdll/misc.c @@ -511,3 +511,12 @@ BOOL WINAPI ApiSetQueryApiSetPresence(const UNICODE_STRING *namespace, BOOLEAN * *present = TRUE; return TRUE; } + +NTSTATUS WINAPI NtCreateLowBoxToken(HANDLE *token_handle, HANDLE existing_token_handle, ACCESS_MASK desired_access, + OBJECT_ATTRIBUTES *object_attributes, SID *package_sid, ULONG capability_count, + SID_AND_ATTRIBUTES *capabilities, ULONG handle_count, HANDLE *handle) +{ + /* We need to return a NULL handle since later it will be passed to CloseHandle and that must not fail */ + *token_handle = NULL; + return STATUS_SUCCESS; +} diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec index f3e9d4b895..6f120acc06 100644 --- a/dlls/ntdll/ntdll.spec +++ b/dlls/ntdll/ntdll.spec @@ -143,6 +143,7 @@ @ stdcall NtCreateKey(ptr long ptr long ptr long ptr) @ stdcall NtCreateKeyTransacted(ptr long ptr long ptr long long ptr) @ stdcall NtCreateKeyedEvent(ptr long ptr long) +@ stdcall NtCreateLowBoxToken(ptr long long ptr ptr long ptr long ptr) @ stdcall NtCreateMailslotFile(ptr long ptr ptr long long long ptr) @ stdcall NtCreateMutant(ptr long ptr long) @ stdcall NtCreateNamedPipeFile(ptr long ptr ptr long long long long long long long long long ptr) -- 2.18.0
Hi, While running your changed tests on Windows, I think I found new failures. Being a bot and all I'm not very good at pattern recognition, so I might be wrong, but could you please double-check? Full results can be found at: https://testbot.winehq.org/JobDetails.pl?Key=40715 Your paranoid android. === debian9 (build) === error: patch failed: dlls/ntdll/misc.c:511 Task: Patch failed to apply
In RtlDestroyHeap critSection.DebugInfo->Spare[0] is always set to NULL, this will crash if we deleted the debug info already Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de> --- dlls/ntdll/heap.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/dlls/ntdll/heap.c b/dlls/ntdll/heap.c index 3ecbd8bb46..26db6a609d 100644 --- a/dlls/ntdll/heap.c +++ b/dlls/ntdll/heap.c @@ -1066,8 +1066,6 @@ static SUBHEAP *HEAP_CreateSubHeap( HEAP *heap, LPVOID address, DWORD flags, NtDuplicateObject( NtCurrentProcess(), sem, NtCurrentProcess(), &sem, 0, 0, DUP_HANDLE_MAKE_GLOBAL | DUP_HANDLE_SAME_ACCESS | DUP_HANDLE_CLOSE_SOURCE ); heap->critSection.LockSemaphore = sem; - RtlFreeHeap( processHeap, 0, heap->critSection.DebugInfo ); - heap->critSection.DebugInfo = NULL; } } -- 2.18.0
participants (2)
-
Fabian Maurer -
Marvin