OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef REMOTING_HOST_WIN_COM_SECURITY_H_ | 5 #ifndef REMOTING_HOST_WIN_COM_SECURITY_H_ |
6 #define REMOTING_HOST_WIN_COM_SECURITY_H_ | 6 #define REMOTING_HOST_WIN_COM_SECURITY_H_ |
7 | 7 |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 // Concatenates ACE type, permissions and sid given as SDDL strings into an ACE | 10 // Concatenates ACE type, permissions and sid given as SDDL strings into an ACE |
11 // definition in SDDL form. | 11 // definition in SDDL form. |
12 #define SDDL_ACE(type, permissions, sid) \ | 12 #define SDDL_ACE(type, permissions, sid) \ |
13 L"(" type L";;" permissions L";;;" sid L")" | 13 L"(" type L";;" permissions L";;;" sid L")" |
14 | 14 |
15 // Text representation of COM_RIGHTS_EXECUTE and COM_RIGHTS_EXECUTE_LOCAL | 15 // Text representation of COM_RIGHTS_EXECUTE and COM_RIGHTS_EXECUTE_LOCAL |
16 // permission bits that is used in the SDDL definition below. | 16 // permission bits that is used in the SDDL definition below. |
17 #define SDDL_COM_EXECUTE_LOCAL L"0x3" | 17 #define SDDL_COM_EXECUTE_LOCAL L"0x3" |
18 | 18 |
19 namespace remoting { | 19 namespace remoting { |
20 | 20 |
21 // Initializes COM security of the process applying the passed security | 21 // Initializes COM security of the process applying the passed security |
22 // descriptor. The mandatory label is applied if mandatory integrity control is | 22 // descriptor. The function configures the following settings: |
23 // supported by the OS (i.e. on Vista and above). The function configures | 23 // - Server authenticates that all data received is from the expected client. |
24 // the following settings: | 24 // - Server can impersonate clients to check their identity but cannot act on |
25 // - the server authenticates that all data received is from the expected | 25 // their behalf. |
26 // client. | 26 // - Caller's identity is verified on every call (Dynamic cloaking). |
27 // - the server can impersonate clients to check their identity but cannot act | |
28 // on their behalf. | |
29 // - the caller's identity is verified on every call (Dynamic cloaking). | |
30 // - Unless |activate_as_activator| is true, activations where the server would | 27 // - Unless |activate_as_activator| is true, activations where the server would |
31 // run under this process's identity are prohibited. | 28 // run under this process's identity are prohibited. |
32 bool InitializeComSecurity(const std::string& security_descriptor, | 29 bool InitializeComSecurity(const std::string& security_descriptor, |
33 const std::string& mandatory_label, | 30 const std::string& mandatory_label, |
34 bool activate_as_activator); | 31 bool activate_as_activator); |
35 | 32 |
36 } // namespace remoting | 33 } // namespace remoting |
37 | 34 |
38 #endif // REMOTING_HOST_WIN_COM_SECURITY_H_ | 35 #endif // REMOTING_HOST_WIN_COM_SECURITY_H_ |
OLD | NEW |