0N/A

1879N/A#include "precompiled.hpp"

1879N/A#include "classfile/vmSymbols.hpp"

1879N/A#include "memory/allocation.inline.hpp"

1879N/A#include "memory/resourceArea.hpp"

1879N/A#include "oops/oop.inline.hpp"

1879N/A#include "os_windows.inline.hpp"

1879N/A#include "runtime/handles.inline.hpp"

1879N/A#include "runtime/perfMemory.hpp"

4064N/A#include "services/memTracker.hpp"

1879N/A#include "utilities/exceptions.hpp"

0N/A

0N/A#include <windows.h>

0N/A#include <sys/types.h>

0N/A#include <sys/stat.h>

0N/A#include <errno.h>

0N/A#include <lmcons.h>

0N/A

0N/Atypedef BOOL (WINAPI *SetSecurityDescriptorControlFnPtr)(

0N/A IN PSECURITY_DESCRIPTOR pSecurityDescriptor,

0N/A IN SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest,

0N/A IN SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet);

0N/A

0N/A

0N/Astatic char* create_standard_memory(size_t size) {

0N/A

0N/A // allocate an aligned chuck of memory

0N/A char* mapAddress = os::reserve_memory(size);

0N/A

0N/A if (mapAddress == NULL) {

0N/A return NULL;

0N/A }

0N/A

0N/A // commit memory

4552N/A if (!os::commit_memory(mapAddress, size, !ExecMem)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("Could not commit PerfData memory\n");

0N/A }

0N/A os::release_memory(mapAddress, size);

0N/A return NULL;

0N/A }

0N/A

0N/A return mapAddress;

0N/A}

0N/A

0N/Astatic void delete_standard_memory(char* addr, size_t size) {

0N/A

0N/A // there are no persistent external resources to cleanup for standard

0N/A // memory. since DestroyJavaVM does not support unloading of the JVM,

0N/A // cleanup of the memory resource is not performed. The memory will be

0N/A // reclaimed by the OS upon termination of the process.

0N/A //

0N/A return;

0N/A

0N/A}

0N/A

0N/Astatic void save_memory_to_file(char* addr, size_t size) {

0N/A

0N/A const char* destfile = PerfMemory::get_perfdata_file_path();

0N/A assert(destfile[0] != '\0', "invalid Perfdata file path");

0N/A

0N/A int fd = ::_open(destfile, _O_BINARY|_O_CREAT|_O_WRONLY|_O_TRUNC,

0N/A _S_IREAD|_S_IWRITE);

0N/A

0N/A if (fd == OS_ERR) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("Could not create Perfdata save file: %s: %s\n",

0N/A destfile, strerror(errno));

0N/A }

0N/A } else {

0N/A for (size_t remaining = size; remaining > 0;) {

0N/A

0N/A int nbytes = ::_write(fd, addr, (unsigned int)remaining);

0N/A if (nbytes == OS_ERR) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("Could not write Perfdata save file: %s: %s\n",

0N/A destfile, strerror(errno));

0N/A }

0N/A break;

0N/A }

0N/A

0N/A remaining -= (size_t)nbytes;

0N/A addr += nbytes;

0N/A }

0N/A

0N/A int result = ::_close(fd);

0N/A if (PrintMiscellaneous && Verbose) {

0N/A if (result == OS_ERR) {

0N/A warning("Could not close %s: %s\n", destfile, strerror(errno));

0N/A }

0N/A }

0N/A }

0N/A

3863N/A FREE_C_HEAP_ARRAY(char, destfile, mtInternal);

0N/A}

0N/A

0N/A

0N/A

0N/Astatic HANDLE sharedmem_fileMapHandle = NULL;

0N/Astatic HANDLE sharedmem_fileHandle = INVALID_HANDLE_VALUE;

0N/Astatic char* sharedmem_fileName = NULL;

0N/A

0N/Astatic char* get_user_tmp_dir(const char* user) {

0N/A

0N/A const char* tmpdir = os::get_temp_directory();

0N/A const char* perfdir = PERFDATA_NAME;

1353N/A size_t nbytes = strlen(tmpdir) + strlen(perfdir) + strlen(user) + 3;

3863N/A char* dirname = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

0N/A

0N/A // construct the path name to user specific tmp directory

1353N/A _snprintf(dirname, nbytes, "%s\\%s_%s", tmpdir, perfdir, user);

0N/A

0N/A return dirname;

0N/A}

0N/A

0N/Astatic int filename_to_pid(const char* filename) {

0N/A

0N/A // a filename that doesn't begin with a digit is not a

0N/A // candidate for conversion.

0N/A //

0N/A if (!isdigit(*filename)) {

0N/A return 0;

0N/A }

0N/A

0N/A // check if file name can be converted to an integer without

0N/A // any leftover characters.

0N/A //

0N/A char* remainder = NULL;

0N/A errno = 0;

0N/A int pid = (int)strtol(filename, &remainder, 10);

0N/A

0N/A if (errno != 0) {

0N/A return 0;

0N/A }

0N/A

0N/A // check for left over characters. If any, then the filename is

0N/A // not a candidate for conversion.

0N/A //

0N/A if (remainder != NULL && *remainder != '\0') {

0N/A return 0;

0N/A }

0N/A

0N/A // successful conversion, return the pid

0N/A return pid;

0N/A}

0N/A

0N/Astatic bool is_directory_secure(const char* path) {

0N/A

0N/A DWORD fa;

0N/A

0N/A fa = GetFileAttributes(path);

0N/A if (fa == 0xFFFFFFFF) {

0N/A DWORD lasterror = GetLastError();

0N/A if (lasterror == ERROR_FILE_NOT_FOUND) {

0N/A return false;

0N/A }

0N/A else {

0N/A // unexpected error, declare the path insecure

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("could not get attributes for file %s: ",

0N/A " lasterror = %d\n", path, lasterror);

0N/A }

0N/A return false;

0N/A }

0N/A }

0N/A

0N/A if (fa & FILE_ATTRIBUTE_REPARSE_POINT) {

0N/A // we don't accept any redirection for the user specific directory

0N/A // so declare the path insecure. This may be too conservative,

0N/A // as some types of reparse points might be acceptable, but it

0N/A // is probably more secure to avoid these conditions.

0N/A //

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("%s is a reparse point\n", path);

0N/A }

0N/A return false;

0N/A }

0N/A

0N/A if (fa & FILE_ATTRIBUTE_DIRECTORY) {

0N/A // this is the expected case. Since windows supports symbolic

0N/A // links to directories only, not to files, there is no need

0N/A // to check for open write permissions on the directory. If the

0N/A // directory has open write permissions, any files deposited that

0N/A // are not expected will be removed by the cleanup code.

0N/A //

0N/A return true;

0N/A }

0N/A else {

0N/A // this is either a regular file or some other type of file,

0N/A // any of which are unexpected and therefore insecure.

0N/A //

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("%s is not a directory, file attributes = "

0N/A INTPTR_FORMAT "\n", path, fa);

0N/A }

0N/A return false;

0N/A }

0N/A}

0N/A

0N/Astatic char* get_user_name() {

0N/A

0N/A /* get the user name. This code is adapted from code found in

0N/A char* user = getenv("USERNAME");

0N/A char buf[UNLEN+1];

0N/A DWORD buflen = sizeof(buf);

0N/A if (user == NULL || strlen(user) == 0) {

0N/A if (GetUserName(buf, &buflen)) {

0N/A user = buf;

0N/A }

0N/A else {

0N/A return NULL;

0N/A }

0N/A }

0N/A

3863N/A char* user_name = NEW_C_HEAP_ARRAY(char, strlen(user)+1, mtInternal);

0N/A strcpy(user_name, user);

0N/A

0N/A return user_name;

0N/A}

0N/A

0N/Astatic char* get_user_name_slow(int vmid) {

0N/A

0N/A // directory search

2108N/A char* latest_user = NULL;

2108N/A time_t latest_ctime = 0;

0N/A

0N/A const char* tmpdirname = os::get_temp_directory();

0N/A

0N/A DIR* tmpdirp = os::opendir(tmpdirname);

0N/A

0N/A if (tmpdirp == NULL) {

0N/A return NULL;

0N/A }

0N/A

0N/A // for each entry in the directory that matches the pattern hsperfdata_*,

0N/A // open the directory and check if the file for the given vmid exists.

0N/A // The file with the expected name and the latest creation date is used

0N/A // to determine the user name for the process id.

0N/A //

0N/A struct dirent* dentry;

3863N/A char* tdbuf = NEW_C_HEAP_ARRAY(char, os::readdir_buf_size(tmpdirname), mtInternal);

0N/A errno = 0;

0N/A while ((dentry = os::readdir(tmpdirp, (struct dirent *)tdbuf)) != NULL) {

0N/A

0N/A // check if the directory entry is a hsperfdata file

0N/A if (strncmp(dentry->d_name, PERFDATA_NAME, strlen(PERFDATA_NAME)) != 0) {

0N/A continue;

0N/A }

0N/A

0N/A char* usrdir_name = NEW_C_HEAP_ARRAY(char,

3863N/A strlen(tmpdirname) + strlen(dentry->d_name) + 2, mtInternal);

0N/A strcpy(usrdir_name, tmpdirname);

1353N/A strcat(usrdir_name, "\\");

0N/A strcat(usrdir_name, dentry->d_name);

0N/A

0N/A DIR* subdirp = os::opendir(usrdir_name);

0N/A

0N/A if (subdirp == NULL) {

3863N/A FREE_C_HEAP_ARRAY(char, usrdir_name, mtInternal);

0N/A continue;

0N/A }

0N/A

0N/A // Since we don't create the backing store files in directories

0N/A // pointed to by symbolic links, we also don't follow them when

0N/A // looking for the files. We check for a symbolic link after the

0N/A // call to opendir in order to eliminate a small window where the

0N/A // symlink can be exploited.

0N/A //

0N/A if (!is_directory_secure(usrdir_name)) {

3863N/A FREE_C_HEAP_ARRAY(char, usrdir_name, mtInternal);

0N/A os::closedir(subdirp);

0N/A continue;

0N/A }

0N/A

0N/A struct dirent* udentry;

3863N/A char* udbuf = NEW_C_HEAP_ARRAY(char, os::readdir_buf_size(usrdir_name), mtInternal);

0N/A errno = 0;

0N/A while ((udentry = os::readdir(subdirp, (struct dirent *)udbuf)) != NULL) {

0N/A

0N/A if (filename_to_pid(udentry->d_name) == vmid) {

0N/A struct stat statbuf;

0N/A

0N/A char* filename = NEW_C_HEAP_ARRAY(char,

3863N/A strlen(usrdir_name) + strlen(udentry->d_name) + 2, mtInternal);

0N/A

0N/A strcpy(filename, usrdir_name);

0N/A strcat(filename, "\\");

0N/A strcat(filename, udentry->d_name);

0N/A

0N/A if (::stat(filename, &statbuf) == OS_ERR) {

3863N/A FREE_C_HEAP_ARRAY(char, filename, mtInternal);

0N/A continue;

0N/A }

0N/A

0N/A // skip over files that are not regular files.

0N/A if ((statbuf.st_mode & S_IFMT) != S_IFREG) {

3863N/A FREE_C_HEAP_ARRAY(char, filename, mtInternal);

0N/A continue;

0N/A }

0N/A

2108N/A // If we found a matching file with a newer creation time, then

2108N/A // save the user name. The newer creation time indicates that

2108N/A // we found a newer incarnation of the process associated with

2108N/A // vmid. Due to the way that Windows recycles pids and the fact

2108N/A // that we can't delete the file from the file system namespace

2108N/A // until last close, it is possible for there to be more than

2108N/A // one hsperfdata file with a name matching vmid (diff users).

2108N/A //

2108N/A // We no longer ignore hsperfdata files where (st_size == 0).

2108N/A // In this function, all we're trying to do is determine the

2108N/A // name of the user that owns the process associated with vmid

2108N/A // so the size doesn't matter. Very rarely, we have observed

2108N/A // hsperfdata files where (st_size == 0) and the st_size field

2108N/A // later becomes the expected value.

2108N/A //

2108N/A if (statbuf.st_ctime > latest_ctime) {

2108N/A char* user = strchr(dentry->d_name, '_') + 1;

0N/A

3863N/A if (latest_user != NULL) FREE_C_HEAP_ARRAY(char, latest_user, mtInternal);

3863N/A latest_user = NEW_C_HEAP_ARRAY(char, strlen(user)+1, mtInternal);

0N/A

2108N/A strcpy(latest_user, user);

2108N/A latest_ctime = statbuf.st_ctime;

0N/A }

0N/A

3863N/A FREE_C_HEAP_ARRAY(char, filename, mtInternal);

0N/A }

0N/A }

0N/A os::closedir(subdirp);

3863N/A FREE_C_HEAP_ARRAY(char, udbuf, mtInternal);

3863N/A FREE_C_HEAP_ARRAY(char, usrdir_name, mtInternal);

0N/A }

0N/A os::closedir(tmpdirp);

3863N/A FREE_C_HEAP_ARRAY(char, tdbuf, mtInternal);

0N/A

2108N/A return(latest_user);

0N/A}

0N/A

0N/Astatic char* get_user_name(int vmid) {

0N/A

0N/A // A fast implementation is not provided at this time. It's possible

0N/A // to provide a fast process id to user name mapping function using

0N/A // the win32 apis, but the default ACL for the process object only

0N/A // allows processes with the same owner SID to acquire the process

0N/A // handle (via OpenProcess(PROCESS_QUERY_INFORMATION)). It's possible

0N/A // to have the JVM change the ACL for the process object to allow arbitrary

0N/A // users to access the process handle and the process security token.

0N/A // The security ramifications need to be studied before providing this

0N/A // mechanism.

0N/A //

0N/A return get_user_name_slow(vmid);

0N/A}

0N/A

0N/Astatic char *get_sharedmem_objectname(const char* user, int vmid) {

0N/A

0N/A // construct file mapping object's name, add 3 for two '_' and a

0N/A // null terminator.

0N/A int nbytes = (int)strlen(PERFDATA_NAME) + (int)strlen(user) + 3;

0N/A

0N/A // the id is converted to an unsigned value here because win32 allows

0N/A // negative process ids. However, OpenFileMapping API complains

0N/A // about a name containing a '-' characters.

0N/A //

0N/A nbytes += UINT_CHARS;

3863N/A char* name = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

0N/A _snprintf(name, nbytes, "%s_%s_%u", PERFDATA_NAME, user, vmid);

0N/A

0N/A return name;

0N/A}

0N/A

0N/Astatic char* get_sharedmem_filename(const char* dirname, int vmid) {

0N/A

0N/A // add 2 for the file separator and a null terminator.

0N/A size_t nbytes = strlen(dirname) + UINT_CHARS + 2;

0N/A

3863N/A char* name = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

0N/A _snprintf(name, nbytes, "%s\\%d", dirname, vmid);

0N/A

0N/A return name;

0N/A}

0N/A

0N/Astatic void remove_file(const char* dirname, const char* filename) {

0N/A

0N/A size_t nbytes = strlen(dirname) + strlen(filename) + 2;

3863N/A char* path = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

0N/A

0N/A strcpy(path, dirname);

0N/A strcat(path, "\\");

0N/A strcat(path, filename);

0N/A

0N/A if (::unlink(path) == OS_ERR) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A if (errno != ENOENT) {

0N/A warning("Could not unlink shared memory backing"

0N/A " store file %s : %s\n", path, strerror(errno));

0N/A }

0N/A }

0N/A }

0N/A

3863N/A FREE_C_HEAP_ARRAY(char, path, mtInternal);

0N/A}

0N/A

0N/Astatic bool is_alive(int pid) {

0N/A

0N/A HANDLE ph = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);

0N/A if (ph == NULL) {

0N/A // the process does not exist.

0N/A if (PrintMiscellaneous && Verbose) {

0N/A DWORD lastError = GetLastError();

0N/A if (lastError != ERROR_INVALID_PARAMETER) {

0N/A warning("OpenProcess failed: %d\n", GetLastError());

0N/A }

0N/A }

0N/A return false;

0N/A }

0N/A

0N/A DWORD exit_status;

0N/A if (!GetExitCodeProcess(ph, &exit_status)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("GetExitCodeProcess failed: %d\n", GetLastError());

0N/A }

0N/A CloseHandle(ph);

0N/A return false;

0N/A }

0N/A

0N/A CloseHandle(ph);

0N/A return (exit_status == STILL_ACTIVE) ? true : false;

0N/A}

0N/A

0N/Astatic bool is_filesystem_secure(const char* path) {

0N/A

0N/A char root_path[MAX_PATH];

0N/A char fs_type[MAX_PATH];

0N/A

0N/A if (PerfBypassFileSystemCheck) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("bypassing file system criteria checks for %s\n", path);

0N/A }

0N/A return true;

0N/A }

0N/A

0N/A char* first_colon = strchr((char *)path, ':');

0N/A if (first_colon == NULL) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("expected device specifier in path: %s\n", path);

0N/A }

0N/A return false;

0N/A }

0N/A

0N/A size_t len = (size_t)(first_colon - path);

0N/A assert(len + 2 <= MAX_PATH, "unexpected device specifier length");

0N/A strncpy(root_path, path, len + 1);

0N/A root_path[len + 1] = '\\';

0N/A root_path[len + 2] = '\0';

0N/A

0N/A // check that we have something like "C:\" or "AA:\"

0N/A assert(strlen(root_path) >= 3, "device specifier too short");

0N/A assert(strchr(root_path, ':') != NULL, "bad device specifier format");

0N/A assert(strchr(root_path, '\\') != NULL, "bad device specifier format");

0N/A

0N/A DWORD maxpath;

0N/A DWORD flags;

0N/A

0N/A if (!GetVolumeInformation(root_path, NULL, 0, NULL, &maxpath,

0N/A &flags, fs_type, MAX_PATH)) {

0N/A // we can't get information about the volume, so assume unsafe.

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("could not get device information for %s: "

0N/A " path = %s: lasterror = %d\n",

0N/A root_path, path, GetLastError());

0N/A }

0N/A return false;

0N/A }

0N/A

0N/A if ((flags & FS_PERSISTENT_ACLS) == 0) {

0N/A // file system doesn't support ACLs, declare file system unsafe

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("file system type %s on device %s does not support"

0N/A " ACLs\n", fs_type, root_path);

0N/A }

0N/A return false;

0N/A }

0N/A

0N/A if ((flags & FS_VOL_IS_COMPRESSED) != 0) {

0N/A // file system is compressed, declare file system unsafe

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("file system type %s on device %s is compressed\n",

0N/A fs_type, root_path);

0N/A }

0N/A return false;

0N/A }

0N/A

0N/A return true;

0N/A}

0N/A

0N/Astatic void cleanup_sharedmem_resources(const char* dirname) {

0N/A

0N/A // open the user temp directory

0N/A DIR* dirp = os::opendir(dirname);

0N/A

0N/A if (dirp == NULL) {

0N/A // directory doesn't exist, so there is nothing to cleanup

0N/A return;

0N/A }

0N/A

0N/A if (!is_directory_secure(dirname)) {

0N/A // the directory is not secure, don't attempt any cleanup

0N/A return;

0N/A }

0N/A

0N/A // for each entry in the directory that matches the expected file

0N/A // name pattern, determine if the file resources are stale and if

0N/A // so, remove the file resources. Note, instrumented HotSpot processes

0N/A // for this user may start and/or terminate during this search and

0N/A // remove or create new files in this directory. The behavior of this

0N/A // loop under these conditions is dependent upon the implementation of

0N/A // opendir/readdir.

0N/A //

0N/A struct dirent* entry;

3863N/A char* dbuf = NEW_C_HEAP_ARRAY(char, os::readdir_buf_size(dirname), mtInternal);

0N/A errno = 0;

0N/A while ((entry = os::readdir(dirp, (struct dirent *)dbuf)) != NULL) {

0N/A

0N/A int pid = filename_to_pid(entry->d_name);

0N/A

0N/A if (pid == 0) {

0N/A

0N/A if (strcmp(entry->d_name, ".") != 0 && strcmp(entry->d_name, "..") != 0) {

0N/A

0N/A // attempt to remove all unexpected files, except "." and ".."

0N/A remove_file(dirname, entry->d_name);

0N/A }

0N/A

0N/A errno = 0;

0N/A continue;

0N/A }

0N/A

0N/A // we now have a file name that converts to a valid integer

0N/A // that could represent a process id . if this process id

0N/A // matches the current process id or the process is not running,

0N/A // then remove the stale file resources.

0N/A //

0N/A // process liveness is detected by checking the exit status

0N/A // of the process. if the process id is valid and the exit status

0N/A // indicates that it is still running, the file file resources

0N/A // are not removed. If the process id is invalid, or if we don't

0N/A // have permissions to check the process status, or if the process

0N/A // id is valid and the process has terminated, the the file resources

0N/A // are assumed to be stale and are removed.

0N/A //

0N/A if (pid == os::current_process_id() || !is_alive(pid)) {

0N/A

0N/A // we can only remove the file resources. Any mapped views

0N/A // of the file can only be unmapped by the processes that

0N/A // opened those views and the file mapping object will not

0N/A // get removed until all views are unmapped.

0N/A //

0N/A remove_file(dirname, entry->d_name);

0N/A }

0N/A errno = 0;

0N/A }

0N/A os::closedir(dirp);

3863N/A FREE_C_HEAP_ARRAY(char, dbuf, mtInternal);

0N/A}

0N/A

0N/Astatic HANDLE create_file_mapping(const char* name, HANDLE fh, LPSECURITY_ATTRIBUTES fsa, size_t size) {

0N/A

0N/A DWORD lowSize = (DWORD)size;

0N/A DWORD highSize = 0;

0N/A HANDLE fmh = NULL;

0N/A

0N/A // Create a file mapping object with the given name. This function

0N/A // will grow the file to the specified size.

0N/A //

0N/A fmh = CreateFileMapping(

0N/A fh, /* HANDLE file handle for backing store */

0N/A fsa, /* LPSECURITY_ATTRIBUTES Not inheritable */

0N/A PAGE_READWRITE, /* DWORD protections */

0N/A highSize, /* DWORD High word of max size */

0N/A lowSize, /* DWORD Low word of max size */

0N/A name); /* LPCTSTR name for object */

0N/A

0N/A if (fmh == NULL) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("CreateFileMapping failed, lasterror = %d\n", GetLastError());

0N/A }

0N/A return NULL;

0N/A }

0N/A

0N/A if (GetLastError() == ERROR_ALREADY_EXISTS) {

0N/A

0N/A // a stale file mapping object was encountered. This object may be

0N/A // owned by this or some other user and cannot be removed until

0N/A // the other processes either exit or close their mapping objects

0N/A // and/or mapped views of this mapping object.

0N/A //

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("file mapping already exists, lasterror = %d\n", GetLastError());

0N/A }

0N/A

0N/A CloseHandle(fmh);

0N/A return NULL;

0N/A }

0N/A

0N/A return fmh;

0N/A}

0N/A

0N/A

0N/Astatic void free_security_desc(PSECURITY_DESCRIPTOR pSD) {

0N/A

0N/A BOOL success, exists, isdefault;

0N/A PACL pACL;

0N/A

0N/A if (pSD != NULL) {

0N/A

0N/A // get the access control list from the security descriptor

0N/A success = GetSecurityDescriptorDacl(pSD, &exists, &pACL, &isdefault);

0N/A

0N/A // if an ACL existed and it was not a default acl, then it must

0N/A // be an ACL we enlisted. free the resources.

0N/A //

0N/A if (success && exists && pACL != NULL && !isdefault) {

3863N/A FREE_C_HEAP_ARRAY(char, pACL, mtInternal);

0N/A }

0N/A

0N/A // free the security descriptor

3863N/A FREE_C_HEAP_ARRAY(char, pSD, mtInternal);

0N/A }

0N/A}

0N/A

0N/Astatic void free_security_attr(LPSECURITY_ATTRIBUTES lpSA) {

0N/A

0N/A if (lpSA != NULL) {

0N/A // free the contained security descriptor and the ACL

0N/A free_security_desc(lpSA->lpSecurityDescriptor);

0N/A lpSA->lpSecurityDescriptor = NULL;

0N/A

0N/A // free the security attributes structure

3863N/A FREE_C_HEAP_ARRAY(char, lpSA, mtInternal);

0N/A }

0N/A}

0N/A

0N/Astatic PSID get_user_sid(HANDLE hProcess) {

0N/A

0N/A HANDLE hAccessToken;

0N/A PTOKEN_USER token_buf = NULL;

0N/A DWORD rsize = 0;

0N/A

0N/A if (hProcess == NULL) {

0N/A return NULL;

0N/A }

0N/A

0N/A // get the process token

0N/A if (!OpenProcessToken(hProcess, TOKEN_READ, &hAccessToken)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("OpenProcessToken failure: lasterror = %d \n", GetLastError());

0N/A }

0N/A return NULL;

0N/A }

0N/A

0N/A // determine the size of the token structured needed to retrieve

0N/A // the user token information from the access token.

0N/A //

0N/A if (!GetTokenInformation(hAccessToken, TokenUser, NULL, rsize, &rsize)) {

0N/A DWORD lasterror = GetLastError();

0N/A if (lasterror != ERROR_INSUFFICIENT_BUFFER) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("GetTokenInformation failure: lasterror = %d,"

0N/A " rsize = %d\n", lasterror, rsize);

0N/A }

0N/A CloseHandle(hAccessToken);

0N/A return NULL;

0N/A }

0N/A }

0N/A

3863N/A token_buf = (PTOKEN_USER) NEW_C_HEAP_ARRAY(char, rsize, mtInternal);

0N/A

0N/A // get the user token information

0N/A if (!GetTokenInformation(hAccessToken, TokenUser, token_buf, rsize, &rsize)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("GetTokenInformation failure: lasterror = %d,"

0N/A " rsize = %d\n", GetLastError(), rsize);

0N/A }

3863N/A FREE_C_HEAP_ARRAY(char, token_buf, mtInternal);

0N/A CloseHandle(hAccessToken);

0N/A return NULL;

0N/A }

0N/A

0N/A DWORD nbytes = GetLengthSid(token_buf->User.Sid);

3863N/A PSID pSID = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

0N/A

0N/A if (!CopySid(nbytes, pSID, token_buf->User.Sid)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("GetTokenInformation failure: lasterror = %d,"

0N/A " rsize = %d\n", GetLastError(), rsize);

0N/A }

3863N/A FREE_C_HEAP_ARRAY(char, token_buf, mtInternal);

3863N/A FREE_C_HEAP_ARRAY(char, pSID, mtInternal);

0N/A CloseHandle(hAccessToken);

0N/A return NULL;

0N/A }

0N/A

0N/A // close the access token.

0N/A CloseHandle(hAccessToken);

3863N/A FREE_C_HEAP_ARRAY(char, token_buf, mtInternal);

0N/A

0N/A return pSID;

0N/A}

0N/A

0N/Atypedef struct ace_data {

0N/A PSID pSid; // SID of the ACE

0N/A DWORD mask; // mask for the ACE

0N/A} ace_data_t;

0N/A

0N/A

0N/A

0N/Astatic bool add_allow_aces(PSECURITY_DESCRIPTOR pSD,

0N/A ace_data_t aces[], int ace_count) {

0N/A PACL newACL = NULL;

0N/A PACL oldACL = NULL;

0N/A

0N/A if (pSD == NULL) {

0N/A return false;

0N/A }

0N/A

0N/A BOOL exists, isdefault;

0N/A

0N/A // retrieve any existing access control list.

0N/A if (!GetSecurityDescriptorDacl(pSD, &exists, &oldACL, &isdefault)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("GetSecurityDescriptor failure: lasterror = %d \n",

0N/A GetLastError());

0N/A }

0N/A return false;

0N/A }

0N/A

0N/A // get the size of the DACL

0N/A ACL_SIZE_INFORMATION aclinfo;

0N/A

0N/A // GetSecurityDescriptorDacl may return true value for exists (lpbDaclPresent)

0N/A // while oldACL is NULL for some case.

0N/A if (oldACL == NULL) {

0N/A exists = FALSE;

0N/A }

0N/A

0N/A if (exists) {

0N/A if (!GetAclInformation(oldACL, &aclinfo,

0N/A sizeof(ACL_SIZE_INFORMATION),

0N/A AclSizeInformation)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("GetAclInformation failure: lasterror = %d \n", GetLastError());

0N/A return false;

0N/A }

0N/A }

0N/A } else {

0N/A aclinfo.AceCount = 0; // assume NULL DACL

0N/A aclinfo.AclBytesFree = 0;

0N/A aclinfo.AclBytesInUse = sizeof(ACL);

0N/A }

0N/A

0N/A // compute the size needed for the new ACL

0N/A // initial size of ACL is sum of the following:

0N/A // * size of ACL structure.

0N/A // * size of each ACE structure that ACL is to contain minus the sid

0N/A // sidStart member (DWORD) of the ACE.

0N/A // * length of the SID that each ACE is to contain.

0N/A DWORD newACLsize = aclinfo.AclBytesInUse +

0N/A (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) * ace_count;

0N/A for (int i = 0; i < ace_count; i++) {

1875N/A assert(aces[i].pSid != 0, "pSid should not be 0");

0N/A newACLsize += GetLengthSid(aces[i].pSid);

0N/A }

0N/A

0N/A // create the new ACL

3863N/A newACL = (PACL) NEW_C_HEAP_ARRAY(char, newACLsize, mtInternal);

0N/A

0N/A if (!InitializeAcl(newACL, newACLsize, ACL_REVISION)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("InitializeAcl failure: lasterror = %d \n", GetLastError());

0N/A }

3863N/A FREE_C_HEAP_ARRAY(char, newACL, mtInternal);

0N/A return false;

0N/A }

0N/A

0N/A unsigned int ace_index = 0;

0N/A // copy any existing ACEs from the old ACL (if any) to the new ACL.

0N/A if (aclinfo.AceCount != 0) {

0N/A while (ace_index < aclinfo.AceCount) {

0N/A LPVOID ace;

0N/A if (!GetAce(oldACL, ace_index, &ace)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("InitializeAcl failure: lasterror = %d \n", GetLastError());

0N/A }

3863N/A FREE_C_HEAP_ARRAY(char, newACL, mtInternal);

0N/A return false;

0N/A }

0N/A if (((ACCESS_ALLOWED_ACE *)ace)->Header.AceFlags && INHERITED_ACE) {

0N/A // this is an inherited, allowed ACE; break from loop so we can

0N/A // add the new access allowed, non-inherited ACE in the correct

0N/A // position, immediately following all non-inherited ACEs.

0N/A break;

0N/A }

0N/A

0N/A // determine if the SID of this ACE matches any of the SIDs

0N/A // for which we plan to set ACEs.

0N/A int matches = 0;

0N/A for (int i = 0; i < ace_count; i++) {

0N/A if (EqualSid(aces[i].pSid, &(((ACCESS_ALLOWED_ACE *)ace)->SidStart))) {

0N/A matches++;

0N/A break;

0N/A }

0N/A }

0N/A

0N/A // if there are no SID matches, then add this existing ACE to the new ACL

0N/A if (matches == 0) {

0N/A if (!AddAce(newACL, ACL_REVISION, MAXDWORD, ace,

0N/A ((PACE_HEADER)ace)->AceSize)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("AddAce failure: lasterror = %d \n", GetLastError());

0N/A }

3863N/A FREE_C_HEAP_ARRAY(char, newACL, mtInternal);

0N/A return false;

0N/A }

0N/A }

0N/A ace_index++;

0N/A }

0N/A }

0N/A

0N/A // add the passed-in access control entries to the new ACL

0N/A for (int i = 0; i < ace_count; i++) {

0N/A if (!AddAccessAllowedAce(newACL, ACL_REVISION,

0N/A aces[i].mask, aces[i].pSid)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("AddAccessAllowedAce failure: lasterror = %d \n",

0N/A GetLastError());

0N/A }

3863N/A FREE_C_HEAP_ARRAY(char, newACL, mtInternal);

0N/A return false;

0N/A }

0N/A }

0N/A

0N/A // now copy the rest of the inherited ACEs from the old ACL

0N/A if (aclinfo.AceCount != 0) {

0N/A // picking up at ace_index, where we left off in the

0N/A // previous ace_index loop

0N/A while (ace_index < aclinfo.AceCount) {

0N/A LPVOID ace;

0N/A if (!GetAce(oldACL, ace_index, &ace)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("InitializeAcl failure: lasterror = %d \n", GetLastError());

0N/A }

3863N/A FREE_C_HEAP_ARRAY(char, newACL, mtInternal);

0N/A return false;

0N/A }

0N/A if (!AddAce(newACL, ACL_REVISION, MAXDWORD, ace,

0N/A ((PACE_HEADER)ace)->AceSize)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("AddAce failure: lasterror = %d \n", GetLastError());

0N/A }

3863N/A FREE_C_HEAP_ARRAY(char, newACL, mtInternal);

0N/A return false;

0N/A }

0N/A ace_index++;

0N/A }

0N/A }

0N/A

0N/A // add the new ACL to the security descriptor.

0N/A if (!SetSecurityDescriptorDacl(pSD, TRUE, newACL, FALSE)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("SetSecurityDescriptorDacl failure:"

0N/A " lasterror = %d \n", GetLastError());

0N/A }

3863N/A FREE_C_HEAP_ARRAY(char, newACL, mtInternal);

0N/A return false;

0N/A }

0N/A

605N/A // if running on windows 2000 or later, set the automatic inheritance

0N/A // control flags.

0N/A SetSecurityDescriptorControlFnPtr _SetSecurityDescriptorControl;

0N/A _SetSecurityDescriptorControl = (SetSecurityDescriptorControlFnPtr)

0N/A GetProcAddress(GetModuleHandle(TEXT("advapi32.dll")),

0N/A "SetSecurityDescriptorControl");

0N/A

0N/A if (_SetSecurityDescriptorControl != NULL) {

605N/A // We do not want to further propagate inherited DACLs, so making them

0N/A // protected prevents that.

0N/A if (!_SetSecurityDescriptorControl(pSD, SE_DACL_PROTECTED,

0N/A SE_DACL_PROTECTED)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("SetSecurityDescriptorControl failure:"

0N/A " lasterror = %d \n", GetLastError());

0N/A }

3863N/A FREE_C_HEAP_ARRAY(char, newACL, mtInternal);

0N/A return false;

0N/A }

0N/A }

0N/A // Note, the security descriptor maintains a reference to the newACL, not

0N/A // a copy of it. Therefore, the newACL is not freed here. It is freed when

0N/A // the security descriptor containing its reference is freed.

0N/A //

0N/A return true;

0N/A}

0N/A

0N/Astatic LPSECURITY_ATTRIBUTES make_security_attr(ace_data_t aces[], int count) {

0N/A

0N/A // allocate space for a security descriptor

0N/A PSECURITY_DESCRIPTOR pSD = (PSECURITY_DESCRIPTOR)

3863N/A NEW_C_HEAP_ARRAY(char, SECURITY_DESCRIPTOR_MIN_LENGTH, mtInternal);

0N/A

0N/A // initialize the security descriptor

0N/A if (!InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("InitializeSecurityDescriptor failure: "

0N/A "lasterror = %d \n", GetLastError());

0N/A }

0N/A free_security_desc(pSD);

0N/A return NULL;

0N/A }

0N/A

0N/A // add the access control entries

0N/A if (!add_allow_aces(pSD, aces, count)) {

0N/A free_security_desc(pSD);

0N/A return NULL;

0N/A }

0N/A

0N/A // allocate and initialize the security attributes structure and

0N/A // return it to the caller.

0N/A //

0N/A LPSECURITY_ATTRIBUTES lpSA = (LPSECURITY_ATTRIBUTES)

3863N/A NEW_C_HEAP_ARRAY(char, sizeof(SECURITY_ATTRIBUTES), mtInternal);

0N/A lpSA->nLength = sizeof(SECURITY_ATTRIBUTES);

0N/A lpSA->lpSecurityDescriptor = pSD;

0N/A lpSA->bInheritHandle = FALSE;

0N/A

0N/A return(lpSA);

0N/A}

0N/A

0N/A

0N/Astatic LPSECURITY_ATTRIBUTES make_user_everybody_admin_security_attr(

0N/A DWORD umask, DWORD emask, DWORD amask) {

0N/A

0N/A ace_data_t aces[3];

0N/A

0N/A // initialize the user ace data

0N/A aces[0].pSid = get_user_sid(GetCurrentProcess());

0N/A aces[0].mask = umask;

0N/A

1875N/A if (aces[0].pSid == 0)

1875N/A return NULL;

1875N/A

0N/A // get the well known SID for BUILTIN\Administrators

0N/A PSID administratorsSid = NULL;

0N/A SID_IDENTIFIER_AUTHORITY SIDAuthAdministrators = SECURITY_NT_AUTHORITY;

0N/A

0N/A if (!AllocateAndInitializeSid( &SIDAuthAdministrators, 2,

0N/A SECURITY_BUILTIN_DOMAIN_RID,

0N/A DOMAIN_ALIAS_RID_ADMINS,

0N/A 0, 0, 0, 0, 0, 0, &administratorsSid)) {

0N/A

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("AllocateAndInitializeSid failure: "

0N/A "lasterror = %d \n", GetLastError());

0N/A }

0N/A return NULL;

0N/A }

0N/A

0N/A // initialize the ace data for administrator group

0N/A aces[1].pSid = administratorsSid;

0N/A aces[1].mask = amask;

0N/A

0N/A // get the well known SID for the universal Everybody

0N/A PSID everybodySid = NULL;

0N/A SID_IDENTIFIER_AUTHORITY SIDAuthEverybody = SECURITY_WORLD_SID_AUTHORITY;

0N/A

0N/A if (!AllocateAndInitializeSid( &SIDAuthEverybody, 1, SECURITY_WORLD_RID,

0N/A 0, 0, 0, 0, 0, 0, 0, &everybodySid)) {

0N/A

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("AllocateAndInitializeSid failure: "

0N/A "lasterror = %d \n", GetLastError());

0N/A }

0N/A return NULL;

0N/A }

0N/A

0N/A // initialize the ace data for everybody else.

0N/A aces[2].pSid = everybodySid;

0N/A aces[2].mask = emask;

0N/A

0N/A // create a security attributes structure with access control

0N/A // entries as initialized above.

0N/A LPSECURITY_ATTRIBUTES lpSA = make_security_attr(aces, 3);

3863N/A FREE_C_HEAP_ARRAY(char, aces[0].pSid, mtInternal);

0N/A FreeSid(everybodySid);

0N/A FreeSid(administratorsSid);

0N/A return(lpSA);

0N/A}

0N/A

0N/A

0N/Astatic LPSECURITY_ATTRIBUTES make_tmpdir_security_attr() {

0N/A

0N/A // create full access rights for the user/owner of the directory

0N/A // and read-only access rights for everybody else. This is

0N/A // effectively equivalent to UNIX 755 permissions on a directory.

0N/A //

0N/A DWORD umask = STANDARD_RIGHTS_REQUIRED | FILE_ALL_ACCESS;

0N/A DWORD emask = GENERIC_READ | FILE_LIST_DIRECTORY | FILE_TRAVERSE;

0N/A DWORD amask = STANDARD_RIGHTS_ALL | FILE_ALL_ACCESS;

0N/A

0N/A return make_user_everybody_admin_security_attr(umask, emask, amask);

0N/A}

0N/A

0N/Astatic LPSECURITY_ATTRIBUTES make_file_security_attr() {

0N/A

0N/A // create extensive access rights for the user/owner of the file

0N/A // and attribute read-only access rights for everybody else. This

0N/A // is effectively equivalent to UNIX 600 permissions on a file.

0N/A //

0N/A DWORD umask = STANDARD_RIGHTS_ALL | FILE_ALL_ACCESS;

0N/A DWORD emask = STANDARD_RIGHTS_READ | FILE_READ_ATTRIBUTES |

0N/A FILE_READ_EA | FILE_LIST_DIRECTORY | FILE_TRAVERSE;

0N/A DWORD amask = STANDARD_RIGHTS_ALL | FILE_ALL_ACCESS;

0N/A

0N/A return make_user_everybody_admin_security_attr(umask, emask, amask);

0N/A}

0N/A

0N/Astatic LPSECURITY_ATTRIBUTES make_smo_security_attr() {

0N/A

0N/A // create extensive access rights for the user/owner of the shared

0N/A // memory object and attribute read-only access rights for everybody

0N/A // else. This is effectively equivalent to UNIX 600 permissions on

0N/A // on the shared memory object.

0N/A //

0N/A DWORD umask = STANDARD_RIGHTS_REQUIRED | FILE_MAP_ALL_ACCESS;

0N/A DWORD emask = STANDARD_RIGHTS_READ; // attributes only

0N/A DWORD amask = STANDARD_RIGHTS_ALL | FILE_MAP_ALL_ACCESS;

0N/A

0N/A return make_user_everybody_admin_security_attr(umask, emask, amask);

0N/A}

0N/A

0N/Astatic bool make_user_tmp_dir(const char* dirname) {

0N/A

0N/A

0N/A LPSECURITY_ATTRIBUTES pDirSA = make_tmpdir_security_attr();

0N/A if (pDirSA == NULL) {

0N/A return false;

0N/A }

0N/A

0N/A

0N/A // create the directory with the given security attributes

0N/A if (!CreateDirectory(dirname, pDirSA)) {

0N/A DWORD lasterror = GetLastError();

0N/A if (lasterror == ERROR_ALREADY_EXISTS) {

0N/A // The directory already exists and was probably created by another

0N/A // JVM instance. However, this could also be the result of a

0N/A // deliberate symlink. Verify that the existing directory is safe.

0N/A //

0N/A if (!is_directory_secure(dirname)) {

0N/A // directory is not secure

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("%s directory is insecure\n", dirname);

0N/A }

0N/A return false;

0N/A }

0N/A // The administrator should be able to delete this directory.

0N/A // But the directory created by previous version of JVM may not

0N/A // have permission for administrators to delete this directory.

0N/A // So add full permission to the administrator. Also setting new

0N/A // DACLs might fix the corrupted the DACLs.

0N/A SECURITY_INFORMATION secInfo = DACL_SECURITY_INFORMATION;

0N/A if (!SetFileSecurity(dirname, secInfo, pDirSA->lpSecurityDescriptor)) {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A lasterror = GetLastError();

0N/A warning("SetFileSecurity failed for %s directory. lasterror %d \n",

0N/A dirname, lasterror);

0N/A }

0N/A }

0N/A }

0N/A else {

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("CreateDirectory failed: %d\n", GetLastError());

0N/A }

0N/A return false;

0N/A }

0N/A }

0N/A

0N/A // free the security attributes structure

0N/A free_security_attr(pDirSA);

0N/A

0N/A return true;

0N/A}

0N/A

0N/Astatic HANDLE create_sharedmem_resources(const char* dirname, const char* filename, const char* objectname, size_t size) {

0N/A

0N/A HANDLE fh = INVALID_HANDLE_VALUE;

0N/A HANDLE fmh = NULL;

0N/A

0N/A

0N/A // create the security attributes for the backing store file

0N/A LPSECURITY_ATTRIBUTES lpFileSA = make_file_security_attr();

0N/A if (lpFileSA == NULL) {

0N/A return NULL;

0N/A }

0N/A

0N/A // create the security attributes for the shared memory object

0N/A LPSECURITY_ATTRIBUTES lpSmoSA = make_smo_security_attr();

0N/A if (lpSmoSA == NULL) {

0N/A free_security_attr(lpFileSA);

0N/A return NULL;

0N/A }

0N/A

0N/A // create the user temporary directory

0N/A if (!make_user_tmp_dir(dirname)) {

0N/A // could not make/find the directory or the found directory

0N/A // was not secure

0N/A return NULL;

0N/A }

0N/A

0N/A // Create the file - the FILE_FLAG_DELETE_ON_CLOSE flag allows the

0N/A // file to be deleted by the last process that closes its handle to

0N/A // the file. This is important as the apis do not allow a terminating

0N/A // JVM being monitored by another process to remove the file name.

0N/A //

0N/A // the FILE_SHARE_DELETE share mode is valid only in winnt

0N/A //

0N/A fh = CreateFile(

0N/A filename, /* LPCTSTR file name */

0N/A

0N/A GENERIC_READ|GENERIC_WRITE, /* DWORD desired access */

0N/A

0N/A (os::win32::is_nt() ? FILE_SHARE_DELETE : 0)|

0N/A FILE_SHARE_READ, /* DWORD share mode, future READONLY

0N/A lpFileSA, /* LPSECURITY security attributes */

0N/A CREATE_ALWAYS, /* DWORD creation disposition

0N/A FILE_FLAG_DELETE_ON_CLOSE, /* DWORD flags and attributes */

0N/A

0N/A NULL); /* HANDLE template file access */

0N/A

0N/A free_security_attr(lpFileSA);

0N/A

0N/A if (fh == INVALID_HANDLE_VALUE) {

0N/A DWORD lasterror = GetLastError();

0N/A if (PrintMiscellaneous && Verbose) {

0N/A warning("could not create file %s: %d\n", filename, lasterror);

0N/A }

0N/A return NULL;

0N/A }

0N/A

0N/A // try to create the file mapping

0N/A fmh = create_file_mapping(objectname, fh, lpSmoSA, size);

0N/A

0N/A free_security_attr(lpSmoSA);

0N/A

0N/A if (fmh == NULL) {

0N/A // closing the file handle here will decrement the reference count

0N/A // on the file. When all processes accessing the file close their

0N/A // handle to it, the reference count will decrement to 0 and the

0N/A // OS will delete the file. These semantics are requested by the

0N/A // FILE_FLAG_DELETE_ON_CLOSE flag in CreateFile call above.

0N/A CloseHandle(fh);

0N/A fh = NULL;