* AddUserToTokenDacl(HANDLE hToken) * * This function adds the current user account to the restricted * token used when we create a restricted process. * * This is required because of some security changes in Windows * that appeared in patches to XP/2K3 and in Vista/2008. * * On these machines, the Administrator account is not included in * the default DACL - you just get Administrators +
| 500 | * have any of its own. |
| 501 | */ |
| 502 | BOOL |
| 503 | AddUserToTokenDacl(HANDLE hToken) |
| 504 | { |
| 505 | int i; |
| 506 | ACL_SIZE_INFORMATION asi; |
| 507 | ACCESS_ALLOWED_ACE *pace; |
| 508 | DWORD dwNewAclSize; |
| 509 | DWORD dwSize = 0; |
| 510 | DWORD dwTokenInfoLength = 0; |
| 511 | PACL pacl = NULL; |
| 512 | PTOKEN_USER pTokenUser = NULL; |
| 513 | TOKEN_DEFAULT_DACL tddNew; |
| 514 | TOKEN_DEFAULT_DACL *ptdd = NULL; |
| 515 | TOKEN_INFORMATION_CLASS tic = TokenDefaultDacl; |
| 516 | BOOL ret = FALSE; |
| 517 | |
| 518 | /* Figure out the buffer size for the DACL info */ |
| 519 | if (!GetTokenInformation(hToken, tic, (LPVOID) NULL, dwTokenInfoLength, &dwSize)) |
| 520 | { |
| 521 | if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) |
| 522 | { |
| 523 | ptdd = (TOKEN_DEFAULT_DACL *) LocalAlloc(LPTR, dwSize); |
| 524 | if (ptdd == NULL) |
| 525 | { |
| 526 | log_error(errcode(ERRCODE_OUT_OF_MEMORY), |
| 527 | _("out of memory")); |
| 528 | goto cleanup; |
| 529 | } |
| 530 | |
| 531 | if (!GetTokenInformation(hToken, tic, (LPVOID) ptdd, dwSize, &dwSize)) |
| 532 | { |
| 533 | log_error(errcode(ERRCODE_SYSTEM_ERROR), |
| 534 | "could not get token information: error code %lu", |
| 535 | GetLastError()); |
| 536 | goto cleanup; |
| 537 | } |
| 538 | } |
| 539 | else |
| 540 | { |
| 541 | log_error(errcode(ERRCODE_SYSTEM_ERROR), |
| 542 | "could not get token information buffer size: error code %lu", |
| 543 | GetLastError()); |
| 544 | goto cleanup; |
| 545 | } |
| 546 | } |
| 547 | |
| 548 | /* Get the ACL info */ |
| 549 | if (!GetAclInformation(ptdd->DefaultDacl, (LPVOID) &asi, |
| 550 | (DWORD) sizeof(ACL_SIZE_INFORMATION), |
| 551 | AclSizeInformation)) |
| 552 | { |
| 553 | log_error(errcode(ERRCODE_SYSTEM_ERROR), |
| 554 | "could not get ACL information: error code %lu", |
| 555 | GetLastError()); |
| 556 | goto cleanup; |
| 557 | } |
| 558 | |
| 559 | /* Get the current user SID */ |
no test coverage detected