# HG changeset patch
# User Bob Owen <bobowencode@gmail.com>
# Date 1611849321 0
#      Thu Jan 28 15:55:21 2021 +0000
# Node ID c9195d88e6c67ef2c23c12e307bc16b94d696f50
# Parent  37557864a6845bb8068904e44e8a7dd16746d211
Bug 1716024 p1: Add MITIGATION_CET_COMPAT_MODE to chromium sandbox code. r=handyman!

diff --git a/sandbox/win/src/process_mitigations.cc b/sandbox/win/src/process_mitigations.cc
--- a/sandbox/win/src/process_mitigations.cc
+++ b/sandbox/win/src/process_mitigations.cc
@@ -81,16 +81,37 @@ bool IsRunning32bitEmulatedOnArm64() {
 bool IsRunning32bitEmulatedOnArm64() {
 #if defined(ARCH_CPU_X86)
   return base::win::OSInfo::IsRunningEmulatedOnArm64();
 #else
   return false;
 #endif  // defined(ARCH_CPU_X86)
 }
 
+// Returns true if user-mode Hardware-enforced Stack Protection is available for
+// the Win32 environment.
+bool IsUserCetWin32Available() {
+  static bool cetAvailable = []() -> bool {
+    using IsUserCetAvailableInEnvironmentFunction =
+      decltype(&IsUserCetAvailableInEnvironment);
+
+    IsUserCetAvailableInEnvironmentFunction is_user_cet_available =
+        reinterpret_cast<IsUserCetAvailableInEnvironmentFunction>(
+            ::GetProcAddress(::GetModuleHandleW(L"kernel32.dll"),
+                             "IsUserCetAvailableInEnvironment"));
+    if (!is_user_cet_available) {
+      return false;
+    }
+
+    return is_user_cet_available(USER_CET_ENVIRONMENT_WIN32_PROCESS);
+  }();
+
+  return cetAvailable;
+}
+
 bool SetProcessMitigationPolicyInternal(PROCESS_MITIGATION_POLICY policy,
                                         PVOID lpBuffer,
                                         SIZE_T dwLength) {
   PCHECK(::SetProcessMitigationPolicy(policy, lpBuffer, dwLength))
       << "SetProcessMitigationPolicy failed with Policy: " << policy;
 
   return true;
 }
@@ -506,16 +527,21 @@ void ConvertProcessMitigationsToPolicy(M
     }
 
     if (flags & MITIGATION_CET_STRICT_MODE) {
       DCHECK(!(flags & MITIGATION_CET_DISABLED))
           << "Cannot enable CET strict mode if CET is disabled.";
       *policy_value_2 |=
           PROCESS_CREATION_MITIGATION_POLICY2_CET_USER_SHADOW_STACKS_STRICT_MODE;
     }
+
+    if (flags & MITIGATION_CET_COMPAT_MODE && IsUserCetWin32Available()) {
+      *policy_value_2 |=
+          PROCESS_CREATION_MITIGATION_POLICY2_CET_USER_SHADOW_STACKS_ALWAYS_ON;
+    }
 
     if (flags & MITIGATION_CET_ALLOW_DYNAMIC_APIS) {
       DCHECK(!(flags & MITIGATION_CET_DISABLED))
           << "Cannot enable in-process CET apis if CET is disabled.";
       DCHECK(!(flags & MITIGATION_DYNAMIC_CODE_DISABLE))
           << "Cannot enable in-process CET apis if dynamic code is disabled.";
       *policy_value_2 |=
           PROCESS_CREATION_MITIGATION_POLICY2_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY_ALWAYS_OFF;
diff --git a/sandbox/win/src/security_level.h b/sandbox/win/src/security_level.h
--- a/sandbox/win/src/security_level.h
+++ b/sandbox/win/src/security_level.h
@@ -286,11 +286,15 @@ const MitigationFlags MITIGATION_RESTRIC
 // Working down from the high bit to avoid conflict with new upstream flags.
 
 // Disable Control Flow Guard. This may seem more like an anti-mitigation, but
 // this flag allows code to make targeted changes to CFG to avoid bugs, while
 // leaving it enabled in the common case. Corresponds to
 // PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_ON.
 const MitigationFlags MITIGATION_CONTROL_FLOW_GUARD_DISABLE = 0x80000000;
 
+// This enables CET User Shadow Stack for compatible modules and corresponds to
+// PROCESS_CREATION_MITIGATION_POLICY2_CET_USER_SHADOW_STACKS_ALWAYS_ON.
+const MitigationFlags MITIGATION_CET_COMPAT_MODE = 0x40000000;
+
 }  // namespace sandbox
 
 #endif  // SANDBOX_WIN_SRC_SECURITY_LEVEL_H_