rlz/win/lib/process_info.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4 //
   5 // Information about the current process.
   6
   7 #include "rlz/win/lib/process_info.h"
   8
   9 #include <windows.h>
  10 #include <Sddl.h>  // For ConvertSidToStringSid.
  11 #include <LMCons.h>  // For UNLEN
  12
  13 #include "base/logging.h"
  14 #include "base/memory/scoped_ptr.h"
  15 #include "base/process/process_handle.h"
  16 #include "base/win/scoped_handle.h"
  17 #include "base/win/windows_version.h"
  18 #include "rlz/lib/assert.h"
  19
  20 namespace {
  21
  22 HRESULT GetCurrentUser(std::wstring* name,
  23                        std::wstring* domain,
  24                        std::wstring* sid) {
  25   DWORD err;
  26
  27   // Get the current username & domain the hard way.  (GetUserNameEx would be
  28   // nice, but unfortunately requires connectivity to a domain controller.
  29   // Useless.)
  30
  31   // (Following call doesn't work if running as a Service - because a Service
  32   // runs under special accounts like LOCAL_SYSTEM, not as the logged in user.
  33   // In which case, search for and use the process handle of a running
  34   // Explorer.exe.)
  35   HANDLE token;
  36   if (!::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &token))
  37     return E_FAIL;
  38
  39   base::win::ScopedHandle scoped_process_token(token);
  40
  41   // (Following call will fail with ERROR_INSUFFICIENT_BUFFER and give us the
  42   // required size.)
  43   scoped_ptr<char[]> token_user_bytes;
  44   DWORD token_user_size;
  45   DWORD token_user_size2;
  46   BOOL result = ::GetTokenInformation(token, TokenUser, NULL, 0,
  47                                       &token_user_size);
  48   err = ::GetLastError();
  49   CHECK(!result && err == ERROR_INSUFFICIENT_BUFFER);
  50
  51   token_user_bytes.reset(new char[token_user_size]);
  52   if (!token_user_bytes.get())
  53     return E_OUTOFMEMORY;
  54
  55   if (!::GetTokenInformation(token, TokenUser, token_user_bytes.get(),
  56                              token_user_size, &token_user_size2)) {
  57     return E_FAIL;
  58   }
  59
  60   WCHAR user_name[UNLEN + 1];  // max username length
  61   WCHAR domain_name[UNLEN + 1];
  62   DWORD user_name_size = UNLEN + 1;
  63   DWORD domain_name_size = UNLEN + 1;
  64   SID_NAME_USE sid_type;
  65   TOKEN_USER* token_user =
  66       reinterpret_cast<TOKEN_USER*>(token_user_bytes.get());
  67   if (!token_user)
  68     return E_FAIL;
  69   PSID user_sid = token_user->User.Sid;
  70   if (!::LookupAccountSidW(NULL, user_sid, user_name, &user_name_size,
  71                            domain_name, &domain_name_size, &sid_type)) {
  72     return E_FAIL;
  73   }
  74
  75   if (name != NULL) {
  76     *name = user_name;
  77   }
  78   if (domain != NULL) {
  79     *domain = domain_name;
  80   }
  81   if (sid != NULL) {
  82     LPWSTR string_sid;
  83     ConvertSidToStringSidW(user_sid, &string_sid);
  84     *sid = string_sid;  // copy out to cstring
  85     // free memory, as documented for ConvertSidToStringSid
  86     LocalFree(string_sid);
  87   }
  88
  89   return S_OK;
  90 }
  91
  92 HRESULT GetElevationType(PTOKEN_ELEVATION_TYPE elevation) {
  93   if (!elevation)
  94     return E_POINTER;
  95
  96   *elevation = TokenElevationTypeDefault;
  97
  98   if (base::win::GetVersion() < base::win::VERSION_VISTA)
  99     return E_FAIL;
 100
 101   HANDLE process_token;
 102   if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &process_token))
 103     return HRESULT_FROM_WIN32(GetLastError());
 104
 105   base::win::ScopedHandle scoped_process_token(process_token);
 106
 107   DWORD size;
 108   TOKEN_ELEVATION_TYPE elevation_type;
 109   if (!GetTokenInformation(process_token, TokenElevationType, &elevation_type,
 110                            sizeof(elevation_type), &size)) {
 111     return HRESULT_FROM_WIN32(GetLastError());
 112   }
 113
 114   *elevation = elevation_type;
 115   return S_OK;
 116 }
 117
 118 // based on http://msdn2.microsoft.com/en-us/library/aa376389.aspx
 119 bool GetUserGroup(long* group) {
 120   if (!group)
 121     return false;
 122
 123   *group = 0;
 124
 125   // groups are listed in DECREASING order of importance
 126   // (eg. If a user is a member of both the admin group and
 127   // the power user group, it is more useful to list the user
 128   // as an admin)
 129   DWORD user_groups[] =  {DOMAIN_ALIAS_RID_ADMINS,
 130                           DOMAIN_ALIAS_RID_POWER_USERS};
 131   SID_IDENTIFIER_AUTHORITY nt_authority = SECURITY_NT_AUTHORITY;
 132
 133   for (int i = 0; i < arraysize(user_groups) && *group == 0; ++i) {
 134     PSID current_group;
 135     if (AllocateAndInitializeSid(&nt_authority, 2,
 136                                  SECURITY_BUILTIN_DOMAIN_RID,
 137                                  user_groups[i], 0, 0, 0, 0,
 138                                  0, 0, &current_group)) {
 139       BOOL current_level;
 140       if (CheckTokenMembership(NULL, current_group, &current_level) &&
 141           current_level) {
 142         *group = user_groups[i];
 143       }
 144
 145       FreeSid(current_group);
 146     }
 147   }
 148
 149   return group != 0;
 150 }
 151 }  //anonymous
 152
 153
 154 namespace rlz_lib {
 155
 156 bool ProcessInfo::IsRunningAsSystem() {
 157   static std::wstring name;
 158   static std::wstring domain;
 159   static std::wstring sid;
 160   if (name.empty())
 161     CHECK(SUCCEEDED(GetCurrentUser(&name, &domain, &sid)));
 162
 163   return (name == L"SYSTEM");
 164 }
 165
 166 bool ProcessInfo::HasAdminRights() {
 167   static bool evaluated = false;
 168   static bool has_rights = false;
 169
 170   if (!evaluated) {
 171     if (IsRunningAsSystem()) {
 172       has_rights = true;
 173     } else if (base::win::GetVersion() >= base::win::VERSION_VISTA) {
 174       TOKEN_ELEVATION_TYPE elevation;
 175       base::IntegrityLevel level;
 176
 177       if (SUCCEEDED(GetElevationType(&elevation)) &&
 178         base::GetProcessIntegrityLevel(base::GetCurrentProcessHandle(), &level))
 179         has_rights = (elevation == TokenElevationTypeFull) ||
 180                     (level == HIGH_INTEGRITY);
 181     } else {
 182       long group = 0;
 183       if (GetUserGroup(&group))
 184         has_rights = (group == DOMAIN_ALIAS_RID_ADMINS);
 185     }
 186   }
 187
 188   evaluated = true;
 189   if (!has_rights)
 190     ASSERT_STRING("ProcessInfo::HasAdminRights: Does not have admin rights.");
 191
 192   return has_rights;
 193 }
 194
 195 };  // namespace