| 158 | |
| 159 | |
| 160 | PVOID BuildRestrictedSD(PSECURITY_DESCRIPTOR pSD) { |
| 161 | DWORD dwAclLength; |
| 162 | PSID pAuthenticatedUsersSID = NULL; |
| 163 | PACL pDACL = NULL; |
| 164 | BOOL bResult = FALSE; |
| 165 | SID_IDENTIFIER_AUTHORITY siaNT = SECURITY_NT_AUTHORITY; |
| 166 | |
| 167 | // initialize the security descriptor |
| 168 | if (!InitializeSecurityDescriptor(pSD, |
| 169 | SECURITY_DESCRIPTOR_REVISION)) { |
| 170 | // syslog(LOG_ERR, "InitializeSecurityDescriptor() failed with error %d\n", |
| 171 | // GetLastError()); |
| 172 | goto end; |
| 173 | } |
| 174 | |
| 175 | // obtain a sid for the Authenticated Users Group |
| 176 | if (!AllocateAndInitializeSid(&siaNT, 1, |
| 177 | SECURITY_AUTHENTICATED_USER_RID, 0, 0, 0, 0, 0, 0, 0, |
| 178 | &pAuthenticatedUsersSID)) { |
| 179 | // syslog(LOG_ERR, "AllocateAndInitializeSid() failed with error %d\n", |
| 180 | // GetLastError()); |
| 181 | goto end; |
| 182 | } |
| 183 | |
| 184 | // NOTE: |
| 185 | // |
| 186 | // The Authenticated Users group includes all user accounts that |
| 187 | // have been successfully authenticated by the system. If access |
| 188 | // must be restricted to a specific user or group other than |
| 189 | // Authenticated Users, the SID can be constructed using the |
| 190 | // LookupAccountSid() API based on a user or group name. |
| 191 | |
| 192 | // calculate the DACL length |
| 193 | dwAclLength = sizeof(ACL) |
| 194 | // add space for Authenticated Users group ACE |
| 195 | + sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) |
| 196 | + GetLengthSid(pAuthenticatedUsersSID); |
| 197 | |
| 198 | // allocate memory for the DACL |
| 199 | pDACL = (PACL) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, |
| 200 | dwAclLength); |
| 201 | if (!pDACL) { |
| 202 | // syslog(LOG_ERR, "HeapAlloc() failed with error %d\n", GetLastError()); |
| 203 | goto end; |
| 204 | } |
| 205 | |
| 206 | // initialize the DACL |
| 207 | if (!InitializeAcl(pDACL, dwAclLength, ACL_REVISION)) { |
| 208 | // syslog(LOG_ERR, "InitializeAcl() failed with error %d\n", |
| 209 | // GetLastError()); |
| 210 | goto end; |
| 211 | } |
| 212 | |
| 213 | // add the Authenticated Users group ACE to the DACL with |
| 214 | // GENERIC_READ, GENERIC_WRITE, and GENERIC_EXECUTE access |
| 215 | |
| 216 | if (!AddAccessAllowedAce(pDACL, ACL_REVISION, |
| 217 | MAXIMUM_ALLOWED , |