mirror of
https://git.tartarus.org/simon/putty.git
synced 2025-01-10 09:58:01 +00:00
163b899df2
Daniel Meidlinger reports that at least one Windows machine which is not obviously otherwise misconfigured will respond to our SetEntriesInAcl call with odd errors like ERROR_NONE_MAPPED or ERROR_TRUSTED_RELATIONSHIP_FAILURE. This is apparently to do with failure to convert the names "EVERYONE" and "CURRENT_USER" used in the ACL specification to SIDs. (Or perhaps only one of them is the problem - I didn't investigate in that direction.) If we instead construct a fully SID-based ACL, using the well-known world SID in place of EVERYONE and calling our existing get_user_sid routine in place of CURRENT_USER, he reports that the problem goes away, so let's do that instead. While I'm here, I've slightly simplified the function prototype of make_private_security_descriptor(), by turning 'networksid' into an internal static that we can reuse in subsequent calls once we've set it up. (Mostly because I didn't fancy adding another two pointless parameters at every call site for the two new SIDs.) [originally from svn r10096]
64 lines
2.2 KiB
C
64 lines
2.2 KiB
C
/*
|
|
* winsecur.h: some miscellaneous security-related helper functions,
|
|
* defined in winsecur.c, that use the advapi32 library. Also
|
|
* centralises the machinery for dynamically loading that library.
|
|
*/
|
|
|
|
#if !defined NO_SECURITY
|
|
|
|
#include <aclapi.h>
|
|
|
|
#ifndef WINSECUR_GLOBAL
|
|
#define WINSECUR_GLOBAL extern
|
|
#endif
|
|
|
|
/*
|
|
* Functions loaded from advapi32.dll.
|
|
*/
|
|
DECL_WINDOWS_FUNCTION(WINSECUR_GLOBAL, BOOL, OpenProcessToken,
|
|
(HANDLE, DWORD, PHANDLE));
|
|
DECL_WINDOWS_FUNCTION(WINSECUR_GLOBAL, BOOL, GetTokenInformation,
|
|
(HANDLE, TOKEN_INFORMATION_CLASS,
|
|
LPVOID, DWORD, PDWORD));
|
|
DECL_WINDOWS_FUNCTION(WINSECUR_GLOBAL, BOOL, InitializeSecurityDescriptor,
|
|
(PSECURITY_DESCRIPTOR, DWORD));
|
|
DECL_WINDOWS_FUNCTION(WINSECUR_GLOBAL, BOOL, SetSecurityDescriptorOwner,
|
|
(PSECURITY_DESCRIPTOR, PSID, BOOL));
|
|
DECL_WINDOWS_FUNCTION(WINSECUR_GLOBAL, DWORD, GetSecurityInfo,
|
|
(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION,
|
|
PSID *, PSID *, PACL *, PACL *,
|
|
PSECURITY_DESCRIPTOR *));
|
|
DECL_WINDOWS_FUNCTION(WINSECUR_GLOBAL, DWORD, SetEntriesInAclA,
|
|
(ULONG, PEXPLICIT_ACCESS, PACL, PACL *));
|
|
int got_advapi(void);
|
|
|
|
/*
|
|
* Functions loaded from crypt32.dll.
|
|
*/
|
|
DECL_WINDOWS_FUNCTION(WINSECUR_GLOBAL, BOOL, CryptProtectMemory,
|
|
(LPVOID, DWORD, DWORD));
|
|
int got_crypt(void);
|
|
|
|
/*
|
|
* Find the SID describing the current user. The return value (if not
|
|
* NULL for some error-related reason) is smalloced.
|
|
*/
|
|
PSID get_user_sid(void);
|
|
|
|
/*
|
|
* Construct a PSECURITY_DESCRIPTOR of the type used for named pipe
|
|
* servers, i.e. allowing access only to the current user id and also
|
|
* only local (i.e. not over SMB) connections.
|
|
*
|
|
* If this function returns TRUE, then 'psd' and 'acl' will have been
|
|
* filled in with memory allocated using LocalAlloc (and hence must be
|
|
* freed later using LocalFree). If it returns FALSE, then instead
|
|
* 'error' has been filled with a dynamically allocated error message.
|
|
*/
|
|
int make_private_security_descriptor(DWORD permissions,
|
|
PSECURITY_DESCRIPTOR *psd,
|
|
PACL *acl,
|
|
char **error);
|
|
|
|
#endif
|