onlineupdate/source/update/common/uachelper.cxx

   1 /* This Source Code Form is subject to the terms of the Mozilla Public
   2  * License, v. 2.0. If a copy of the MPL was not distributed with this
   3  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   4
   5 #ifdef _WIN32
   6 #include <windows.h>
   7 #include <wtsapi32.h>
   8 #include "uachelper.h"
   9 #include "updatelogging.h"
  10
  11 // See the MSDN documentation with title: Privilege Constants
  12 // At the time of this writing, this documentation is located at:
  13 // http://msdn.microsoft.com/en-us/library/windows/desktop/bb530716%28v=vs.85%29.aspx
  14 LPCTSTR UACHelper::PrivsToDisable[] =
  15 {
  16     SE_ASSIGNPRIMARYTOKEN_NAME,
  17     SE_AUDIT_NAME,
  18     SE_BACKUP_NAME,
  19     // CreateProcess will succeed but the app will fail to launch on some WinXP
  20     // machines if SE_CHANGE_NOTIFY_NAME is disabled.  In particular this happens
  21     // for limited user accounts on those machines.  The define is kept here as a
  22     // reminder that it should never be re-added.
  23     // This permission is for directory watching but also from MSDN: "This
  24     // privilege also causes the system to skip all traversal access checks."
  25     // SE_CHANGE_NOTIFY_NAME,
  26     SE_CREATE_GLOBAL_NAME,
  27     SE_CREATE_PAGEFILE_NAME,
  28     SE_CREATE_PERMANENT_NAME,
  29     SE_CREATE_SYMBOLIC_LINK_NAME,
  30     SE_CREATE_TOKEN_NAME,
  31     SE_DEBUG_NAME,
  32     SE_ENABLE_DELEGATION_NAME,
  33     SE_IMPERSONATE_NAME,
  34     SE_INC_BASE_PRIORITY_NAME,
  35     SE_INCREASE_QUOTA_NAME,
  36     SE_INC_WORKING_SET_NAME,
  37     SE_LOAD_DRIVER_NAME,
  38     SE_LOCK_MEMORY_NAME,
  39     SE_MACHINE_ACCOUNT_NAME,
  40     SE_MANAGE_VOLUME_NAME,
  41     SE_PROF_SINGLE_PROCESS_NAME,
  42     SE_RELABEL_NAME,
  43     SE_REMOTE_SHUTDOWN_NAME,
  44     SE_RESTORE_NAME,
  45     SE_SECURITY_NAME,
  46     SE_SHUTDOWN_NAME,
  47     SE_SYNC_AGENT_NAME,
  48     SE_SYSTEM_ENVIRONMENT_NAME,
  49     SE_SYSTEM_PROFILE_NAME,
  50     SE_SYSTEMTIME_NAME,
  51     SE_TAKE_OWNERSHIP_NAME,
  52     SE_TCB_NAME,
  53     SE_TIME_ZONE_NAME,
  54     SE_TRUSTED_CREDMAN_ACCESS_NAME,
  55     SE_UNDOCK_NAME,
  56     SE_UNSOLICITED_INPUT_NAME
  57 };
  58
  59 /**
  60  * Opens a user token for the given session ID
  61  *
  62  * @param  sessionID  The session ID for the token to obtain
  63  * @return A handle to the token to obtain which will be primary if enough
  64  *         permissions exist.  Caller should close the handle.
  65  */
  66 HANDLE
  67 UACHelper::OpenUserToken(DWORD sessionID)
  68 {
  69     HMODULE module = LoadLibraryW(L"wtsapi32.dll");
  70     HANDLE token = nullptr;
  71     decltype(WTSQueryUserToken)* wtsQueryUserToken =
  72         (decltype(WTSQueryUserToken)*) GetProcAddress(module, "WTSQueryUserToken");
  73     if (wtsQueryUserToken)
  74     {
  75         wtsQueryUserToken(sessionID, &token);
  76     }
  77     FreeLibrary(module);
  78     return token;
  79 }
  80
  81 /**
  82  * Opens a linked token for the specified token.
  83  *
  84  * @param  token The token to get the linked token from
  85  * @return A linked token or nullptr if one does not exist.
  86  *         Caller should close the handle.
  87  */
  88 HANDLE
  89 UACHelper::OpenLinkedToken(HANDLE token)
  90 {
  91     // Magic below...
  92     // UAC creates 2 tokens.  One is the restricted token which we have.
  93     // the other is the UAC elevated one. Since we are running as a service
  94     // as the system account we have access to both.
  95     TOKEN_LINKED_TOKEN tlt;
  96     HANDLE hNewLinkedToken = nullptr;
  97     DWORD len;
  98     if (GetTokenInformation(token, (TOKEN_INFORMATION_CLASS)TokenLinkedToken,
  99                             &tlt, sizeof(TOKEN_LINKED_TOKEN), &len))
 100     {
 101         token = tlt.LinkedToken;
 102         hNewLinkedToken = token;
 103     }
 104     return hNewLinkedToken;
 105 }
 106
 107
 108 /**
 109  * Enables or disables a privilege for the specified token.
 110  *
 111  * @param  token  The token to adjust the privilege on.
 112  * @param  priv   The privilege to adjust.
 113  * @param  enable Whether to enable or disable it
 114  * @return TRUE if the token was adjusted to the specified value.
 115  */
 116 BOOL
 117 UACHelper::SetPrivilege(HANDLE token, LPCTSTR priv, BOOL enable)
 118 {
 119     LUID luidOfPriv;
 120     if (!LookupPrivilegeValue(nullptr, priv, &luidOfPriv))
 121     {
 122         return FALSE;
 123     }
 124
 125     TOKEN_PRIVILEGES tokenPriv;
 126     tokenPriv.PrivilegeCount = 1;
 127     tokenPriv.Privileges[0].Luid = luidOfPriv;
 128     tokenPriv.Privileges[0].Attributes = enable ? SE_PRIVILEGE_ENABLED : 0;
 129
 130     SetLastError(ERROR_SUCCESS);
 131     if (!AdjustTokenPrivileges(token, false, &tokenPriv,
 132                                sizeof(tokenPriv), nullptr, nullptr))
 133     {
 134         return FALSE;
 135     }
 136
 137     return GetLastError() == ERROR_SUCCESS;
 138 }
 139
 140 /**
 141  * For each privilege that is specified, an attempt will be made to
 142  * drop the privilege.
 143  *
 144  * @param  token         The token to adjust the privilege on.
 145  *         Pass nullptr for current token.
 146  * @param  unneededPrivs An array of unneeded privileges.
 147  * @param  count         The size of the array
 148  * @return TRUE if there were no errors
 149  */
 150 BOOL
 151 UACHelper::DisableUnneededPrivileges(HANDLE token,
 152                                      LPCTSTR *unneededPrivs,
 153                                      size_t count)
 154 {
 155     HANDLE obtainedToken = nullptr;
 156     if (!token)
 157     {
 158         // Note: This handle is a pseudo-handle and need not be closed
 159         HANDLE process = GetCurrentProcess();
 160         if (!OpenProcessToken(process, TOKEN_ALL_ACCESS_P, &obtainedToken))
 161         {
 162             LOG_WARN(("Could not obtain token for current process, no "
 163                       "privileges changed. (%d)", GetLastError()));
 164             return FALSE;
 165         }
 166         token = obtainedToken;
 167     }
 168
 169     BOOL result = TRUE;
 170     for (size_t i = 0; i < count; i++)
 171     {
 172         if (SetPrivilege(token, unneededPrivs[i], FALSE))
 173         {
 174             LOG(("Disabled unneeded token privilege: %s.",
 175                  unneededPrivs[i]));
 176         }
 177         else
 178         {
 179             LOG(("Could not disable token privilege value: %s. (%d)",
 180                  unneededPrivs[i], GetLastError()));
 181             result = FALSE;
 182         }
 183     }
 184
 185     if (obtainedToken)
 186     {
 187         CloseHandle(obtainedToken);
 188     }
 189     return result;
 190 }
 191
 192 /**
 193  * Disables privileges for the specified token.
 194  * The privileges to disable are in PrivsToDisable.
 195  * In the future there could be new privs and we are not sure if we should
 196  * explicitly disable these or not.
 197  *
 198  * @param  token The token to drop the privilege on.
 199  *         Pass nullptr for current token.
 200  * @return TRUE if there were no errors
 201  */
 202 BOOL
 203 UACHelper::DisablePrivileges(HANDLE token)
 204 {
 205     static const size_t PrivsToDisableSize =
 206         sizeof(UACHelper::PrivsToDisable) / sizeof(UACHelper::PrivsToDisable[0]);
 207
 208     return DisableUnneededPrivileges(token, UACHelper::PrivsToDisable,
 209                                      PrivsToDisableSize);
 210 }
 211
 212 /**
 213  * Check if the current user can elevate.
 214  *
 215  * @return true if the user can elevate.
 216  *         false otherwise.
 217  */
 218 bool
 219 UACHelper::CanUserElevate()
 220 {
 221     HANDLE token;
 222     if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token))
 223     {
 224         return false;
 225     }
 226
 227     TOKEN_ELEVATION_TYPE elevationType;
 228     DWORD len;
 229     bool canElevate = GetTokenInformation(token, TokenElevationType,
 230                                           &elevationType,
 231                                           sizeof(elevationType), &len) &&
 232                       (elevationType == TokenElevationTypeLimited);
 233     CloseHandle(token);
 234
 235     return canElevate;
 236 }
 237 #endif