private AppContainer(ITracer tracer, string name, SafeSecurityIdentifier securityIdentifierHandle)
{
if (tracer == null)
{
throw new ArgumentNullException(nameof(tracer));
}
if (name == null)
{
throw new ArgumentNullException(nameof(name));
}
if (securityIdentifierHandle == null)
{
throw new ArgumentNullException(nameof(securityIdentifierHandle));
}
this.Name = name;
this.SecurityIdentifier = new SecurityIdentifier(securityIdentifierHandle.DangerousGetHandle());
if (Methods.GetAppContainerFolderPath(this.SecurityIdentifier.Value, out string folderPath) == HResult.OK)
{
this.FolderPath = folderPath;
}
this.disposalEscrow = new DisposalEscrow();
this.securityIdentifierHandle = securityIdentifierHandle;
this.tracer = tracer;
this.attributeListHandle = this.AllocateAttributeList();
}
private void SetSecurityCapabilities(
ref SECURITY_CAPABILITIES securityCapabilities,
SafeSecurityIdentifier appContainerSid,
WELL_KNOWN_SID_TYPE[] appCapabilities)
{
using (var localDisposalEscrow = new DisposalEscrow())
{
securityCapabilities.AppContainerSid = appContainerSid.DangerousGetHandle();
securityCapabilities.Capabilities = IntPtr.Zero;
securityCapabilities.CapabilityCount = 0;
securityCapabilities.Reserved = 0;
if (appCapabilities != null && appCapabilities.Length > 0)
{
var attributesMemory = localDisposalEscrow.Add(new SafeHGlobalBuffer(Marshal.SizeOf(typeof(SID_AND_ATTRIBUTES)) * appCapabilities.Length));
for (int i = 0; i < appCapabilities.Length; i++)
{
Int32 sidSize = Constants.SECURITY_MAX_SID_SIZE;
var safeMemory = localDisposalEscrow.Add(new SafeHGlobalBuffer(sidSize));
if (!Methods.CreateWellKnownSid(appCapabilities[i], IntPtr.Zero, safeMemory, ref sidSize))
{
throw new SandboxException(
"Unable to create well known sid.",
new Win32Exception());
}
var attribute = new SID_AND_ATTRIBUTES
{
Attributes = SID_ATTRIBUTES.SE_GROUP_ENABLED,
Sid = safeMemory.DangerousGetHandle(),
};
Marshal.StructureToPtr(attribute, IntPtr.Add(attributesMemory.DangerousGetHandle(), i * Marshal.SizeOf(typeof(SID_AND_ATTRIBUTES))), fDeleteOld: false);
}
securityCapabilities.Capabilities = attributesMemory.DangerousGetHandle();
securityCapabilities.CapabilityCount = appCapabilities.Length;
}
this.disposalEscrow.Subsume(localDisposalEscrow);
}
}
private static AppContainer DeriveFromName(ITracer tracer, string appContainerName)
{
SafeSecurityIdentifier appContainerSid = null;
HResult result = Methods.DeriveAppContainerSidFromAppContainerName(appContainerName, out appContainerSid);
if (result != HResult.OK)
{
throw new SandboxException(
"Unable to get AppContainerProfile",
result);
}
try
{
return(new AppContainer(tracer, appContainerName, appContainerSid));
}
catch
{
appContainerSid.Dispose();
throw;
}
}
