OLD | NEW |
1 | 1 |
2 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 2 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
3 // Use of this source code is governed by a BSD-style license that can be | 3 // Use of this source code is governed by a BSD-style license that can be |
4 // found in the LICENSE file. | 4 // found in the LICENSE file. |
5 // | 5 // |
6 // This file implements the Windows service controlling Me2Me host processes | 6 // This file implements the Windows service controlling Me2Me host processes |
7 // running within user sessions. | 7 // running within user sessions. |
8 | 8 |
9 #include "remoting/host/win/unprivileged_process_delegate.h" | 9 #include "remoting/host/win/unprivileged_process_delegate.h" |
10 | 10 |
(...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
51 const char kDesktopSdFormat[] = "O:SYG:SYD:(A;;0xf01ff;;;SY)(A;;0xf01ff;;;%s)"; | 51 const char kDesktopSdFormat[] = "O:SYG:SYD:(A;;0xf01ff;;;SY)(A;;0xf01ff;;;%s)"; |
52 | 52 |
53 // Mandatory label specifying low integrity level. | 53 // Mandatory label specifying low integrity level. |
54 const char kLowIntegrityMandatoryLabel[] = "S:(ML;CIOI;NW;;;LW)"; | 54 const char kLowIntegrityMandatoryLabel[] = "S:(ML;CIOI;NW;;;LW)"; |
55 | 55 |
56 // Security descriptor of the window station the worker process attaches to. It | 56 // Security descriptor of the window station the worker process attaches to. It |
57 // gives SYSTEM and the logon SID full access the window station. The child | 57 // gives SYSTEM and the logon SID full access the window station. The child |
58 // containers and objects inherit ACE giving SYSTEM and the logon SID full | 58 // containers and objects inherit ACE giving SYSTEM and the logon SID full |
59 // access to them as well. | 59 // access to them as well. |
60 const char kWindowStationSdFormat[] = "O:SYG:SYD:(A;CIOIIO;GA;;;SY)" | 60 const char kWindowStationSdFormat[] = "O:SYG:SYD:(A;CIOIIO;GA;;;SY)" |
61 "(A;CIOIIO;GA;;;%1$s)(A;NP;0xf037f;;;SY)(A;NP;0xf037f;;;%1$s)"; | 61 "(A;CIOIIO;GA;;;%s)(A;NP;0xf037f;;;SY)(A;NP;0xf037f;;;%s)"; |
62 | 62 |
63 // Security descriptor of the worker process. It gives access SYSTEM full access | 63 // Security descriptor of the worker process. It gives access SYSTEM full access |
64 // to the process. It gives READ_CONTROL, SYNCHRONIZE, PROCESS_QUERY_INFORMATION | 64 // to the process. It gives READ_CONTROL, SYNCHRONIZE, PROCESS_QUERY_INFORMATION |
65 // and PROCESS_TERMINATE rights to the built-in administrators group. | 65 // and PROCESS_TERMINATE rights to the built-in administrators group. |
66 const char kWorkerProcessSd[] = "O:SYG:SYD:(A;;GA;;;SY)(A;;0x120401;;;BA)"; | 66 const char kWorkerProcessSd[] = "O:SYG:SYD:(A;;GA;;;SY)(A;;0x120401;;;BA)"; |
67 | 67 |
68 // Security descriptor of the worker process threads. It gives access SYSTEM | 68 // Security descriptor of the worker process threads. It gives access SYSTEM |
69 // full access to the threads. It gives READ_CONTROL, SYNCHRONIZE, | 69 // full access to the threads. It gives READ_CONTROL, SYNCHRONIZE, |
70 // THREAD_QUERY_INFORMATION and THREAD_TERMINATE rights to the built-in | 70 // THREAD_QUERY_INFORMATION and THREAD_TERMINATE rights to the built-in |
71 // administrators group. | 71 // administrators group. |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
116 std::string logon_sid_string = ConvertSidToString(logon_sid.get()); | 116 std::string logon_sid_string = ConvertSidToString(logon_sid.get()); |
117 if (logon_sid_string.empty()) { | 117 if (logon_sid_string.empty()) { |
118 PLOG(ERROR) << "Failed to convert a SID to string"; | 118 PLOG(ERROR) << "Failed to convert a SID to string"; |
119 return false; | 119 return false; |
120 } | 120 } |
121 | 121 |
122 // Format the security descriptors in SDDL form. | 122 // Format the security descriptors in SDDL form. |
123 std::string desktop_sddl = | 123 std::string desktop_sddl = |
124 base::StringPrintf(kDesktopSdFormat, logon_sid_string.c_str()); | 124 base::StringPrintf(kDesktopSdFormat, logon_sid_string.c_str()); |
125 std::string window_station_sddl = | 125 std::string window_station_sddl = |
126 base::StringPrintf(kWindowStationSdFormat, logon_sid_string.c_str()); | 126 base::StringPrintf(kWindowStationSdFormat, logon_sid_string.c_str(), |
| 127 logon_sid_string.c_str()); |
127 | 128 |
128 // The worker runs at low integrity level. Make sure it will be able to attach | 129 // The worker runs at low integrity level. Make sure it will be able to attach |
129 // to the window station and desktop. | 130 // to the window station and desktop. |
130 if (base::win::GetVersion() >= base::win::VERSION_VISTA) { | 131 if (base::win::GetVersion() >= base::win::VERSION_VISTA) { |
131 desktop_sddl += kLowIntegrityMandatoryLabel; | 132 desktop_sddl += kLowIntegrityMandatoryLabel; |
132 window_station_sddl += kLowIntegrityMandatoryLabel; | 133 window_station_sddl += kLowIntegrityMandatoryLabel; |
133 } | 134 } |
134 | 135 |
135 // Create the desktop and window station security descriptors. | 136 // Create the desktop and window station security descriptors. |
136 ScopedSd desktop_sd = ConvertSddlToSd(desktop_sddl); | 137 ScopedSd desktop_sd = ConvertSddlToSd(desktop_sddl); |
(...skipping 275 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
412 PLOG(ERROR) << "Failed to duplicate a handle"; | 413 PLOG(ERROR) << "Failed to duplicate a handle"; |
413 ReportFatalError(); | 414 ReportFatalError(); |
414 return; | 415 return; |
415 } | 416 } |
416 ScopedHandle limited_handle(temp_handle); | 417 ScopedHandle limited_handle(temp_handle); |
417 | 418 |
418 event_handler_->OnProcessLaunched(limited_handle.Pass()); | 419 event_handler_->OnProcessLaunched(limited_handle.Pass()); |
419 } | 420 } |
420 | 421 |
421 } // namespace remoting | 422 } // namespace remoting |
OLD | NEW |