| 56 | } |
| 57 | |
| 58 | void WINAPI ServiceMain(DWORD dwNumServicesArgs, LPTSTR* args) { |
| 59 | g_Status.dwServiceType = SERVICE_WIN32_OWN_PROCESS; |
| 60 | g_Status.dwWaitHint = 500; |
| 61 | |
| 62 | bool error = true; |
| 63 | do { // non-loop for easy breaking |
| 64 | g_hService = ::RegisterServiceCtrlHandlerEx(L"WinArkSvc", |
| 65 | ServiceHandler, nullptr); |
| 66 | if (!g_hService) |
| 67 | break; |
| 68 | |
| 69 | g_hStopEvent = ::CreateEvent(nullptr, FALSE, FALSE, nullptr); |
| 70 | if (!g_hStopEvent) |
| 71 | break; |
| 72 | |
| 73 | SetStatus(SERVICE_START_PENDING); |
| 74 | |
| 75 | // create a mailslotand configure |
| 76 | // its security descriptor to allow full control to the user running the service, |
| 77 | // with all other users having write/read access only |
| 78 | |
| 79 | // create the Everyone SID |
| 80 | // |
| 81 | BYTE worldSid[SECURITY_MAX_SID_SIZE]; |
| 82 | DWORD len = sizeof(worldSid); |
| 83 | auto pWorldSid = (PSID)worldSid; |
| 84 | |
| 85 | if (!::CreateWellKnownSid(WinWorldSid, nullptr, pWorldSid, &len)) |
| 86 | break; |
| 87 | |
| 88 | // |
| 89 | // get SID of the user running this process |
| 90 | // |
| 91 | HANDLE hToken; |
| 92 | if (!::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &hToken)) |
| 93 | break; |
| 94 | |
| 95 | BYTE userBuffer[SECURITY_MAX_SID_SIZE + sizeof(TOKEN_USER) + sizeof(SID_AND_ATTRIBUTES)]; |
| 96 | auto user = (TOKEN_USER*)userBuffer; |
| 97 | BOOL ok = ::GetTokenInformation(hToken, TokenUser, userBuffer, sizeof(userBuffer), &len); |
| 98 | ::CloseHandle(hToken); |
| 99 | if (!ok) |
| 100 | break; |
| 101 | auto ownerSid = user->User.Sid; |
| 102 | |
| 103 | // |
| 104 | // allocate and initialize a new security descriptor |
| 105 | // |
| 106 | PSECURITY_DESCRIPTOR sd = ::HeapAlloc(::GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH); |
| 107 | if (!sd) |
| 108 | break; |
| 109 | if (!::InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION)) { |
| 110 | break; |
| 111 | } |
| 112 | |
| 113 | // |
| 114 | // build ACEs |
| 115 | // |
nothing calls this directly
no test coverage detected