Lots of raw winapi structs currently leak into public interface awkwardly

• JOBOBJECT_SECURITY_LIMIT_INFORMATION
• JOBOBJECT_BASIC_UI_RESTRICTIONS
• doc: job::object::uilimit: terser 1-liners, links
• remove dead example use of JOBOBJECT_SECURITY_LIMIT_INFORMATION
• job group affinity information
• job::object::{Basic,Extended}LimitInformation
• job::object::EndOfJobTimeInformation
• job::object::NetRateControlInformation
• examples/mad_sandbox: use job::object::EndOfJobTimeInformation
• doc: note job escapability
• doc: fix links for job::object::NetRateControlInformation
• examples/mad_sandbox: remove TODO for job::object::NetRateControlInformation
• job::object::CpuRateControlInformation
• job::object::BasicAccountingInformation
• job::object::BasicAndIoAccountingInformation
• add missing job::object::[ui]limit constants
• job::object::NotificationLimitInformation[2]
• job::object::LimitViolationInformation[2]
• remove support for JOBOBJECT_ASSOCIATE_COMPLETION_PORT: pointer/handle-laden (unsound?), we lack I/O completion port handle types or use case
• job::object::BasicProcessIdList
• job::object::uilimit::Flags: JOB_OBJECT_UILIMIT_IME
• cleanup job object docs, names, cruft

Kernel Object Types

https://docs.microsoft.com/en-us/windows/win32/sysinfo/kernel-objects

• Generic
  • Desktop
  • Winsta
  • Job
  • Process
  • Thread
  • Access Token
    • Primary Access Token
    • Impersonation Access Token
  • File?
  • Pipe?

Storage

• Nullable
• NonNull

Ownership

| Ownership | Clone | Drop | Desc | | ------------ | ------ | ------ | ----- | | Owned | DuplicateHandle? | CloseHandle? | Self explanatory | | Borrowed<'a> | Copy | | In structs? | | Psuedo | Copy | | -1 and other non-real handles | | Weak | ??? | | Some GetX functions return a handle which could be yanked out from under you | | Remote | DuplicateHandle? | DUPLICATE_CLOSE_SOURCE | Another process's handle |

Bumps wasmtime from 0.40.0 to 2.0.2.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Use cases:

• Have a single binary with both a UI component, and a low/untrusted launch token, without breaking user32.dll.
• rustc 1.63.0 std init with lower token?

References:

• Linker support for delay-loaded DLLs
• Understand the delay load helper function
• /DELAYLOAD (Delay Load Import)

Mainly focused on windows, usespace / unprivileged sandboxing. If a browser can use it, it belongs here. Heavier weight Hyper-V based stuff may or may not belong here.

• [ ] GetProcessHandleCount
• [ ] NtQuerySystemInformation(SystemHandleInformation, ...)
• [x] process::ThreadAttributeRef::handle_list allows passing in a specific list of handles

It also appears to be possible to enumerate another process's handles with undocumented system APIs: https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/get-all-open-handles-and-kernel-object-address-from-userland:

#include <iostream>
#include <Windows.h>
#include <winternl.h>

#define SystemHandleInformation 0x10
#define SystemHandleInformationSize 1024 * 1024 * 2

using fNtQuerySystemInformation = NTSTATUS(WINAPI*)(
    ULONG SystemInformationClass,
    PVOID SystemInformation,
    ULONG SystemInformationLength,
    PULONG ReturnLength
);

// handle information
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
{
    USHORT UniqueProcessId;
    USHORT CreatorBackTraceIndex;
    UCHAR ObjectTypeIndex;
    UCHAR HandleAttributes;
    USHORT HandleValue;
    PVOID Object;
    ULONG GrantedAccess;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;

// handle table information
typedef struct _SYSTEM_HANDLE_INFORMATION
{
    ULONG NumberOfHandles;
    SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;


int main()
{
    ULONG returnLenght = 0;
    fNtQuerySystemInformation NtQuerySystemInformation = (fNtQuerySystemInformation)GetProcAddress(GetModuleHandle(L"ntdll"), "NtQuerySystemInformation");
    PSYSTEM_HANDLE_INFORMATION handleTableInformation = (PSYSTEM_HANDLE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, SystemHandleInformationSize);
    NtQuerySystemInformation(SystemHandleInformation, handleTableInformation, SystemHandleInformationSize, &returnLenght);

    for (int i = 0; i < handleTableInformation->NumberOfHandles; i++)
    {
        SYSTEM_HANDLE_TABLE_ENTRY_INFO handleInfo = (SYSTEM_HANDLE_TABLE_ENTRY_INFO)handleTableInformation->Handles[i];

        if (handleInfo.UniqueProcessId == 4)
        {
            printf_s("Handle 0x%x at 0x%p, PID: %x\n", handleInfo.HandleValue, handleInfo.Object, handleInfo.UniqueProcessId);
        }
        else
        {
            break;
        }
    }

    return 0;
}

Open issues

| Category | Desc | | ---------- | ----- | | | Bugs to fix | | Documentation to write | | Improvements to existing APIs to make

Backlog

| Category | Desc | | ---------- | ----- | | | New APIs to write | | Stuff to research, may or may not lead to new APIs | | Stuff I might never work on

• [ ] Despite sids_to_disable and sids_to_restrict both sounding like negative/subtractive options, "sids_to_restrict" contains a list of sids that are positively added to the second list of sids to be used for access checks. Sanitizing parameters in this context would be great.
• [ ] An empty privileges list and a None privileges list are equivalent, remove the pointless Option?
• [ ] An empty sids_to_disable list and a None sids list are equivalent, remove the pointless Option?
• [ ] An empty sids_to_restrict list is not the same as a None restriction list. Keep that at least.

Fairly harmless runtime bugs if mixed up (e.g. ERROR_BAD_TOKEN_TYPE errors), but particularly process spawning seems to be a common footgun for me that would be nice to catch at compile time instead of run time.

Niche function, fairly harmless runtime bug if called (e.g. passing a desktop handle results in ERROR_INVALID_HANDLE.)

Some other generic HANDLE functions (e.g. get_handle_information) should still work on desktop handles. This might simply be a matter of preventing desktop::OwnedHandle => handle::Owned conversion, but still allowing conversion to handle::Borrowed?

https://github.com/MaulingMonkey/firehazard/blob/285fde75ea166fb1dcaa9ccb03f0a7b32544c983/examples/max_sandbox/debugger.rs#L113-L118

debug_active_process_stop may already unsuspend threads, which makes this awkward if we want to attach a proper debugger to the process at this point.