Files
NotesAgentic/frontend/src-tauri/src/extension_container.rs
T

694 lines
25 KiB
Rust

//! Per-instance AppContainer profile ownership. No existing profile is adopted.
use crate::workspace::{HostError, Result};
use windows_sys::Win32::Security::{
FreeSid, IsValidSid,
Isolation::{CreateAppContainerProfile, DeleteAppContainerProfile},
PSID,
};
pub struct Profile {
name: Vec<u16>,
sid: PSID,
exists: bool,
}
impl Profile {
pub fn create() -> Result<Self> {
Self::create_named(format!(
"OpenNexus.sandbox.{}",
uuid::Uuid::new_v4().simple()
))
}
fn create_named(name: String) -> Result<Self> {
let name: Vec<u16> = name.encode_utf16().chain(Some(0)).collect();
let mut sid = std::ptr::null_mut();
let status = unsafe {
CreateAppContainerProfile(
name.as_ptr(),
name.as_ptr(),
name.as_ptr(),
std::ptr::null(),
0,
&mut sid,
)
};
if status < 0 {
// In particular, ERROR_ALREADY_EXISTS must not transfer ownership.
if !sid.is_null() {
unsafe {
FreeSid(sid);
}
}
return Err(HostError::new("EXTENSION_CONTAINER_CREATE_FAILED"));
}
let profile = Self {
name,
sid,
exists: true,
};
if sid.is_null() || unsafe { IsValidSid(sid) } == 0 {
return Err(HostError::new("EXTENSION_CONTAINER_SID_INVALID"));
}
Ok(profile)
}
/// Borrowed SID for SECURITY_CAPABILITIES. Valid only while this owner lives.
pub fn sid(&self) -> PSID {
self.sid
}
/// Grant this instance read/execute access to one Host-owned package object.
/// The caller must open it without following reparse points and retain the
/// verified package handles for the entire launch. No recursive inheritance
/// is used: every directory and file must be checked and granted separately.
/// This adds an ACE; it does not sanitize pre-existing permissions.
pub fn grant_package_read_execute(&self, object: &std::fs::File) -> Result<()> {
use std::os::windows::{fs::MetadataExt, io::AsRawHandle};
use windows_sys::Win32::{
Foundation::LocalFree,
Security::{Authorization::*, DACL_SECURITY_INFORMATION},
Storage::FileSystem::{
GetFileInformationByHandle, BY_HANDLE_FILE_INFORMATION,
FILE_ATTRIBUTE_REPARSE_POINT, FILE_GENERIC_EXECUTE, FILE_GENERIC_READ,
},
};
struct LocalAllocation(*mut core::ffi::c_void);
impl Drop for LocalAllocation {
fn drop(&mut self) {
if !self.0.is_null() {
unsafe {
LocalFree(self.0);
}
}
}
}
let metadata = object
.metadata()
.map_err(|_| HostError::new("EXTENSION_CONTAINER_ACL_FAILED"))?;
if metadata.file_attributes() & FILE_ATTRIBUTE_REPARSE_POINT != 0
|| !(metadata.is_file() || metadata.is_dir())
{
return Err(HostError::new("EXTENSION_CONTAINER_ACL_OBJECT_INVALID"));
}
if metadata.is_file() {
let mut info = BY_HANDLE_FILE_INFORMATION::default();
if unsafe { GetFileInformationByHandle(object.as_raw_handle(), &mut info) } == 0
|| info.nNumberOfLinks != 1
{
return Err(HostError::new("EXTENSION_CONTAINER_ACL_OBJECT_INVALID"));
}
}
let mut old_acl = std::ptr::null_mut();
let mut descriptor = std::ptr::null_mut();
let status = unsafe {
GetSecurityInfo(
object.as_raw_handle(),
SE_FILE_OBJECT,
DACL_SECURITY_INFORMATION,
std::ptr::null_mut(),
std::ptr::null_mut(),
&mut old_acl,
std::ptr::null_mut(),
&mut descriptor,
)
};
let _descriptor = LocalAllocation(descriptor);
// A null DACL grants everyone full access, so fail closed rather than
// silently treating it as a suitably isolated package object.
if status != 0 || old_acl.is_null() {
return Err(HostError::new("EXTENSION_CONTAINER_ACL_FAILED"));
}
let entry = EXPLICIT_ACCESS_W {
grfAccessPermissions: FILE_GENERIC_READ | FILE_GENERIC_EXECUTE,
grfAccessMode: GRANT_ACCESS,
grfInheritance: 0,
Trustee: TRUSTEE_W {
TrusteeForm: TRUSTEE_IS_SID,
TrusteeType: TRUSTEE_IS_UNKNOWN,
ptstrName: self.sid.cast(),
..Default::default()
},
};
let mut acl = std::ptr::null_mut();
let status = unsafe { SetEntriesInAclW(1, &entry, old_acl, &mut acl) };
let _acl = LocalAllocation(acl.cast());
if status != 0 || acl.is_null() {
return Err(HostError::new("EXTENSION_CONTAINER_ACL_FAILED"));
}
let status = unsafe {
SetSecurityInfo(
object.as_raw_handle(),
SE_FILE_OBJECT,
DACL_SECURITY_INFORMATION,
std::ptr::null_mut(),
std::ptr::null_mut(),
acl,
std::ptr::null(),
)
};
if status != 0 {
return Err(HostError::new("EXTENSION_CONTAINER_ACL_FAILED"));
}
Ok(())
}
pub fn folder(&self) -> Result<std::path::PathBuf> {
use std::os::windows::ffi::OsStringExt;
use windows_sys::Win32::{
Foundation::LocalFree,
Security::{
Authorization::ConvertSidToStringSidW, Isolation::GetAppContainerFolderPath,
},
System::Com::CoTaskMemFree,
};
let mut string = std::ptr::null_mut();
if unsafe { ConvertSidToStringSidW(self.sid, &mut string) } == 0 {
return Err(HostError::new("EXTENSION_CONTAINER_SID_INVALID"));
}
let mut folder = std::ptr::null_mut();
let status = unsafe { GetAppContainerFolderPath(string, &mut folder) };
unsafe {
LocalFree(string.cast());
}
if status < 0 || folder.is_null() {
if !folder.is_null() {
unsafe {
CoTaskMemFree(folder.cast());
}
}
return Err(HostError::new("EXTENSION_CONTAINER_FOLDER_FAILED"));
}
let mut length = 0;
while length < 32768 && unsafe { *folder.add(length) } != 0 {
length += 1;
}
let result = if length == 32768 {
Err(HostError::new("EXTENSION_CONTAINER_FOLDER_FAILED"))
} else {
Ok(std::path::PathBuf::from(std::ffi::OsString::from_wide(
unsafe { std::slice::from_raw_parts(folder, length) },
)))
};
unsafe {
CoTaskMemFree(folder.cast());
}
result
}
/// Stop all container processes and close their handles before removal.
pub fn remove(mut self) -> Result<()> {
self.remove_inner()
}
fn remove_inner(&mut self) -> Result<()> {
if self.exists {
if unsafe { DeleteAppContainerProfile(self.name.as_ptr()) } < 0 {
return Err(HostError::new("EXTENSION_CONTAINER_CLEANUP_FAILED"));
}
self.exists = false;
}
Ok(())
}
}
impl Drop for Profile {
fn drop(&mut self) {
// Explicit remove reports failures; drop is a final best-effort retry.
let _ = self.remove_inner();
if !self.sid.is_null() {
unsafe {
FreeSid(self.sid);
}
self.sid = std::ptr::null_mut();
}
}
}
#[cfg(test)]
mod tests {
use super::*;
use std::{
mem::size_of,
os::windows::{
ffi::OsStrExt,
io::{AsHandle, AsRawHandle, FromRawHandle, OwnedHandle},
},
};
use windows_sys::Win32::{
Security::{
EqualSid, GetTokenInformation, TokenIsAppContainer, SECURITY_CAPABILITIES, TOKEN_QUERY,
},
System::Threading::*,
};
#[test]
fn distinct_profiles_and_collision_do_not_take_ownership_of_existing_data() {
let one = Profile::create().unwrap();
let two = Profile::create().unwrap();
assert_eq!(unsafe { EqualSid(one.sid(), two.sid()) }, 0);
let name = String::from_utf16(&one.name[..one.name.len() - 1]).unwrap();
assert!(Profile::create_named(name.clone()).is_err());
// Repeated collision must still fail: the failing owner did not delete it.
assert!(Profile::create_named(name.clone()).is_err());
one.remove().unwrap();
Profile::create_named(name).unwrap().remove().unwrap();
two.remove().unwrap();
}
struct Attributes {
buffer: Vec<usize>,
}
impl Attributes {
fn new() -> Self {
let mut bytes = 0;
unsafe {
InitializeProcThreadAttributeList(std::ptr::null_mut(), 1, 0, &mut bytes);
}
assert!(bytes > 0);
let mut result = Self {
buffer: vec![0; bytes.div_ceil(size_of::<usize>())],
};
assert_ne!(
unsafe {
InitializeProcThreadAttributeList(
result.buffer.as_mut_ptr().cast(),
1,
0,
&mut bytes,
)
},
0
);
result
}
}
impl Drop for Attributes {
fn drop(&mut self) {
unsafe {
DeleteProcThreadAttributeList(self.buffer.as_mut_ptr().cast());
}
}
}
struct Process {
process: OwnedHandle,
_thread: OwnedHandle,
}
impl Drop for Process {
fn drop(&mut self) {
unsafe {
TerminateProcess(self.process.as_raw_handle(), 1);
WaitForSingleObject(self.process.as_raw_handle(), 5000);
}
}
}
#[test]
fn real_suspended_process_has_appcontainer_token_before_job_resume() {
let profile = Profile::create().unwrap();
checked_process(&profile, None);
profile.remove().unwrap();
}
// Only tests use cmd.exe, with fixed commands and controlled temporary paths.
// A production extension launcher must use a verified entry, never a shell.
fn checked_process(profile: &Profile, command: Option<&str>) -> Option<u32> {
let executable = std::path::PathBuf::from(std::env::var_os("SystemRoot").unwrap())
.join("System32/cmd.exe");
checked_executable(
profile,
&executable,
command.map(|c| format!("cmd.exe /d /c {c}")),
)
}
fn checked_executable(
profile: &Profile,
executable: &std::path::Path,
command: Option<String>,
) -> Option<u32> {
let mut attributes = Attributes::new();
let caps = SECURITY_CAPABILITIES {
AppContainerSid: profile.sid(),
Capabilities: std::ptr::null_mut(),
CapabilityCount: 0,
Reserved: 0,
};
assert_ne!(
unsafe {
UpdateProcThreadAttribute(
attributes.buffer.as_mut_ptr().cast(),
0,
PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES as usize,
(&caps as *const SECURITY_CAPABILITIES).cast(),
size_of::<SECURITY_CAPABILITIES>(),
std::ptr::null_mut(),
std::ptr::null(),
)
},
0
);
let mut startup = STARTUPINFOEXW::default();
startup.StartupInfo.cb = size_of::<STARTUPINFOEXW>() as u32;
startup.lpAttributeList = attributes.buffer.as_mut_ptr().cast();
let executable: Vec<u16> = executable
.as_os_str()
.encode_wide()
.chain(Some(0))
.collect();
let folder = profile.folder().unwrap();
let environment: Vec<u16> = format!(
"LOCALAPPDATA={}\0SystemRoot={}\0TEMP={}\0TMP={}\0\0",
folder.display(),
std::env::var("SystemRoot").unwrap(),
folder.join("Temp").display(),
folder.join("Temp").display()
)
.encode_utf16()
.collect();
let mut command_line: Vec<u16> = command
.as_ref()
.map(|command| command.encode_utf16().chain(Some(0)).collect())
.unwrap_or_default();
let mut info = PROCESS_INFORMATION::default();
assert_ne!(
unsafe {
CreateProcessW(
executable.as_ptr(),
if command_line.is_empty() {
std::ptr::null_mut()
} else {
command_line.as_mut_ptr()
},
std::ptr::null(),
std::ptr::null(),
0,
CREATE_SUSPENDED
| CREATE_NO_WINDOW
| EXTENDED_STARTUPINFO_PRESENT
| CREATE_UNICODE_ENVIRONMENT,
environment.as_ptr().cast(),
std::ptr::null(),
&startup.StartupInfo,
&mut info,
)
},
0,
"AppContainer process creation failed: {}",
std::io::Error::last_os_error()
);
let process = Process {
process: unsafe { OwnedHandle::from_raw_handle(info.hProcess) },
_thread: unsafe { OwnedHandle::from_raw_handle(info.hThread) },
};
let job = crate::extension_job::Job::new().unwrap();
unsafe {
job.assign_suspended(process.process.as_handle()).unwrap();
}
let mut token = std::ptr::null_mut();
assert_ne!(
unsafe { OpenProcessToken(process.process.as_raw_handle(), TOKEN_QUERY, &mut token) },
0
);
let token = unsafe { OwnedHandle::from_raw_handle(token) };
let mut contained = 0u32;
let mut length = 0;
assert_ne!(
unsafe {
GetTokenInformation(
token.as_raw_handle(),
TokenIsAppContainer,
(&mut contained as *mut u32).cast(),
size_of::<u32>() as u32,
&mut length,
)
},
0
);
assert_eq!(contained, 1);
use windows_sys::Win32::Security::{
TokenAppContainerSid, TokenCapabilities, TOKEN_APPCONTAINER_INFORMATION,
};
let mut required = 0;
unsafe {
GetTokenInformation(
token.as_raw_handle(),
TokenAppContainerSid,
std::ptr::null_mut(),
0,
&mut required,
);
}
assert!(required > 0 && required < 4096);
let mut data = vec![0usize; (required as usize).div_ceil(size_of::<usize>())];
assert_ne!(
unsafe {
GetTokenInformation(
token.as_raw_handle(),
TokenAppContainerSid,
data.as_mut_ptr().cast(),
required,
&mut required,
)
},
0
);
let identity = unsafe { &*data.as_ptr().cast::<TOKEN_APPCONTAINER_INFORMATION>() };
assert_ne!(
unsafe { EqualSid(identity.TokenAppContainer, profile.sid()) },
0
);
let mut required = 0;
unsafe {
GetTokenInformation(
token.as_raw_handle(),
TokenCapabilities,
std::ptr::null_mut(),
0,
&mut required,
);
}
assert!((4..4096).contains(&required));
let mut capabilities = vec![0usize; (required as usize).div_ceil(size_of::<usize>())];
assert_ne!(
unsafe {
GetTokenInformation(
token.as_raw_handle(),
TokenCapabilities,
capabilities.as_mut_ptr().cast(),
required,
&mut required,
)
},
0
);
assert_eq!(unsafe { *capabilities.as_ptr().cast::<u32>() }, 0);
let exit = command.map(|_| {
assert_ne!(
unsafe { ResumeThread(process._thread.as_raw_handle()) },
u32::MAX
);
assert_eq!(
unsafe { WaitForSingleObject(process.process.as_raw_handle(), 10_000) },
0
);
let mut exit = 0;
assert_ne!(
unsafe { GetExitCodeProcess(process.process.as_raw_handle(), &mut exit) },
0
);
exit
});
job.terminate().unwrap();
drop(token);
drop(process);
drop(job);
drop(attributes);
exit
}
#[test]
fn real_container_can_read_only_explicitly_granted_package_objects() {
use std::os::windows::fs::OpenOptionsExt;
use windows_sys::Win32::Storage::FileSystem::*;
let profile = Profile::create().unwrap();
let directory = tempfile::tempdir().unwrap();
let payload = directory.path().join("payload.txt");
let hidden = directory.path().join("ungranted.txt");
std::fs::write(&payload, b"verified package content").unwrap();
std::fs::write(&hidden, b"private sibling").unwrap();
let open = |path: &std::path::Path| {
std::fs::OpenOptions::new()
.access_mode(READ_CONTROL | WRITE_DAC)
.share_mode(FILE_SHARE_READ | FILE_SHARE_WRITE)
.custom_flags(FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT)
.open(path)
.unwrap()
};
let root_handle = open(directory.path());
let file_handle = open(&payload);
let read = format!("set /p value=<\"{}\"", payload.display());
assert_ne!(checked_process(&profile, Some(&read)), Some(0));
profile.grant_package_read_execute(&root_handle).unwrap();
// The directory ACE does not propagate to existing children.
assert_ne!(checked_process(&profile, Some(&read)), Some(0));
profile.grant_package_read_execute(&file_handle).unwrap();
assert_eq!(checked_process(&profile, Some(&read)), Some(0));
let other = Profile::create().unwrap();
assert_ne!(checked_process(&other, Some(&read)), Some(0));
other.remove().unwrap();
let created = directory.path().join("new.txt");
assert_ne!(
checked_process(
&profile,
Some(&format!("echo changed>\"{}\"", created.display()))
),
Some(0)
);
assert!(!created.exists());
assert_ne!(
checked_process(
&profile,
Some(&format!("set /p value=<\"{}\"", hidden.display()))
),
Some(0)
);
assert_ne!(
checked_process(
&profile,
Some(&format!("echo changed>\"{}\"", payload.display()))
),
Some(0)
);
assert_eq!(
std::fs::read(&payload).unwrap(),
b"verified package content"
);
drop(file_handle);
drop(root_handle);
profile.remove().unwrap();
}
#[test]
fn package_grant_rejects_hardlinks_and_handles_without_acl_write_access() {
use std::os::windows::fs::OpenOptionsExt;
use windows_sys::Win32::Storage::FileSystem::*;
let profile = Profile::create().unwrap();
let directory = tempfile::tempdir().unwrap();
let payload = directory.path().join("payload.txt");
let alias = directory.path().join("alias.txt");
std::fs::write(&payload, b"unchanged").unwrap();
let read_only = std::fs::File::open(&payload).unwrap();
assert!(profile.grant_package_read_execute(&read_only).is_err());
drop(read_only);
std::fs::hard_link(&payload, &alias).unwrap();
let handle = std::fs::OpenOptions::new()
.access_mode(READ_CONTROL | WRITE_DAC)
.custom_flags(FILE_FLAG_OPEN_REPARSE_POINT)
.open(&payload)
.unwrap();
assert_eq!(
profile
.grant_package_read_execute(&handle)
.unwrap_err()
.code,
"EXTENSION_CONTAINER_ACL_OBJECT_INVALID"
);
assert_eq!(std::fs::read(&alias).unwrap(), b"unchanged");
drop(handle);
profile.remove().unwrap();
}
#[test]
fn real_container_cannot_reach_ipv4_or_ipv6_loopback_listeners() {
use std::{
net::{TcpListener, UdpSocket},
os::windows::fs::OpenOptionsExt,
};
use windows_sys::Win32::Storage::FileSystem::*;
let profile = Profile::create().unwrap();
let package = tempfile::tempdir().unwrap();
let executable = package.path().join("network-probe.exe");
let fixture = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
.join("tests/fixtures/sandbox_network_probe.rs");
let compile = std::process::Command::new("rustc")
.arg("--edition=2021")
.arg(&fixture)
.arg("-o")
.arg(&executable)
.output()
.unwrap();
assert!(
compile.status.success(),
"{}",
String::from_utf8_lossy(&compile.stderr)
);
let open = |path: &std::path::Path| {
std::fs::OpenOptions::new()
.access_mode(READ_CONTROL | WRITE_DAC)
.share_mode(FILE_SHARE_READ | FILE_SHARE_WRITE)
.custom_flags(FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT)
.open(path)
.unwrap()
};
let root = open(package.path());
let entry = open(&executable);
profile.grant_package_read_execute(&root).unwrap();
profile.grant_package_read_execute(&entry).unwrap();
for ip in ["127.0.0.1:0", "[::1]:0"] {
let tcp = TcpListener::bind(ip).unwrap();
let udp = UdpSocket::bind(ip).unwrap();
for (mode, address) in [
("tcp", tcp.local_addr().unwrap()),
("udp", udp.local_addr().unwrap()),
] {
let address = address.to_string();
// The exact executable and target work outside containment.
assert!(std::process::Command::new(&executable)
.args([mode, &address])
.status()
.unwrap()
.success());
if mode == "tcp" {
tcp.set_nonblocking(true).unwrap();
tcp.accept().unwrap();
} else {
udp.set_read_timeout(Some(std::time::Duration::from_secs(2)))
.unwrap();
let mut bytes = [0u8; 8];
assert_eq!(udp.recv(&mut bytes).unwrap(), 5);
assert_eq!(&bytes[..5], b"probe");
udp.set_nonblocking(true).unwrap();
}
let command = format!("\"{}\" {mode} {address}", executable.display());
// Loopback isolation can silently drop packets. TCP must
// explicitly report denial or timeout; UDP send may succeed,
// but no datagram may reach the controlled listener below.
let exit = checked_executable(&profile, &executable, Some(command));
eprintln!("container network probe {mode} {address}: {exit:?}");
if mode == "tcp" {
assert!(matches!(exit, Some(77 | 80)), "{mode} {address}: {exit:?}");
} else {
assert!(matches!(exit, Some(0 | 77)), "{mode} {address}: {exit:?}");
std::thread::sleep(std::time::Duration::from_millis(200));
}
if mode == "tcp" {
assert_eq!(
tcp.accept().unwrap_err().kind(),
std::io::ErrorKind::WouldBlock
);
} else {
assert_eq!(
udp.recv(&mut [0u8; 8]).unwrap_err().kind(),
std::io::ErrorKind::WouldBlock
);
}
assert!(std::process::Command::new(&executable)
.args([mode, &address])
.status()
.unwrap()
.success());
if mode == "tcp" {
tcp.accept().unwrap();
} else {
udp.set_nonblocking(false).unwrap();
assert_eq!(udp.recv(&mut [0u8; 8]).unwrap(), 5);
}
}
}
drop(entry);
drop(root);
profile.remove().unwrap();
}
}