JehanneOS
/
newlib
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

* uinfo.cc (cygheap_user::init): Use sec_user_nih to build a 

security descriptor. Set both the process and the default DACLs.
	* fork.cc (fork_parent): Use sec_none_nih security attributes.
	* spawn.cc (spawn_guts): Ditto.
This commit is contained in:
Corinna Vinschen 2004-02-06 10:37:37 +00:00
parent 4ea8488c70
commit 043878df18
4 changed files with 30 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
winsup/cygwin/ChangeLog
View File

@ -1,3 +1,10 @@
2004-02-06 Pierre Humblet <pierre.humblet@ieee.org>
* uinfo.cc (cygheap_user::init): Use sec_user_nih to build a
security descriptor. Set both the process and the default DACLs.
* fork.cc (fork_parent): Use sec_none_nih security attributes.
* spawn.cc (spawn_guts): Ditto.
2004-02-05 Christopher Faylor <cgf@redhat.com> 2004-02-05 Christopher Faylor <cgf@redhat.com>
* cygwin.din: Make many more functions SIGFE. * cygwin.din: Make many more functions SIGFE.

6
winsup/cygwin/fork.cc
View File

@ -456,8 +456,6 @@ fork_parent (HANDLE& hParent, dll *&first_dll,
out: out:
#endif #endif
char sa_buf[1024];
PSECURITY_ATTRIBUTES sec_attribs = sec_user_nih (sa_buf);
syscall_printf ("CreateProcess (%s, %s, 0, 0, 1, %x, 0, 0, %p, %p)", syscall_printf ("CreateProcess (%s, %s, 0, 0, 1, %x, 0, 0, %p, %p)",
myself->progname, myself->progname, c_flags, &si, &pi); myself->progname, myself->progname, c_flags, &si, &pi);
__malloc_lock (); __malloc_lock ();
@ -465,8 +463,8 @@ fork_parent (HANDLE& hParent, dll *&first_dll,
newheap = cygheap_setup_for_child (&ch, cygheap->fdtab.need_fixup_before ()); newheap = cygheap_setup_for_child (&ch, cygheap->fdtab.need_fixup_before ());
rc = CreateProcess (myself->progname, /* image to run */ rc = CreateProcess (myself->progname, /* image to run */
myself->progname, /* what we send in arg0 */ myself->progname, /* what we send in arg0 */
sec_attribs, &sec_none_nih,
sec_attribs, &sec_none_nih,
TRUE, /* inherit handles from parent */ TRUE, /* inherit handles from parent */
c_flags, c_flags,
NULL, /* environment filled in later */ NULL, /* environment filled in later */

15
winsup/cygwin/spawn.cc
View File

@ -639,8 +639,6 @@ spawn_guts (const char * prog_arg, const char *const *argv,
syscall_printf ("null_app_name %d (%s, %.9500s)", null_app_name, runpath, one_line.buf); syscall_printf ("null_app_name %d (%s, %.9500s)", null_app_name, runpath, one_line.buf);
void *newheap; void *newheap;
/* Preallocated buffer for `sec_user' call */
char sa_buf[1024];
cygbench ("spawn-guts"); cygbench ("spawn-guts");
@ -656,14 +654,13 @@ spawn_guts (const char * prog_arg, const char *const *argv,
&& cygheap->user.saved_gid == cygheap->user.real_gid && cygheap->user.saved_gid == cygheap->user.real_gid
&& !cygheap->user.groups.issetgroups ())) && !cygheap->user.groups.issetgroups ()))
{ {
PSECURITY_ATTRIBUTES sec_attribs = sec_user_nih (sa_buf);
ciresrv.moreinfo->envp = build_env (envp, envblock, ciresrv.moreinfo->envc, ciresrv.moreinfo->envp = build_env (envp, envblock, ciresrv.moreinfo->envc,
real_path.iscygexec ()); real_path.iscygexec ());
newheap = cygheap_setup_for_child (&ciresrv, cygheap->fdtab.need_fixup_before ()); newheap = cygheap_setup_for_child (&ciresrv, cygheap->fdtab.need_fixup_before ());
rc = CreateProcess (runpath, /* image name - with full path */ rc = CreateProcess (runpath, /* image name - with full path */
one_line.buf, /* what was passed to exec */ one_line.buf, /* what was passed to exec */
sec_attribs, /* process security attrs */ &sec_none_nih,/* process security attrs */
sec_attribs, /* thread security attrs */ &sec_none_nih,/* thread security attrs */
TRUE, /* inherit handles from parent */ TRUE, /* inherit handles from parent */
flags, flags,
envblock, /* environment */ envblock, /* environment */
@ -673,14 +670,10 @@ spawn_guts (const char * prog_arg, const char *const *argv,
} }
else else
{ {
PSID sid = cygheap->user.sid ();
/* Give access to myself */ /* Give access to myself */
if (mode == _P_OVERLAY) if (mode == _P_OVERLAY)
myself.set_acl(); myself.set_acl();
/* Set security attributes with sid */
PSECURITY_ATTRIBUTES sec_attribs = sec_user_nih (sa_buf, sid);
/* allow the child to interact with our window station/desktop */ /* allow the child to interact with our window station/desktop */
HANDLE hwst, hdsk; HANDLE hwst, hdsk;
SECURITY_INFORMATION dsi = DACL_SECURITY_INFORMATION; SECURITY_INFORMATION dsi = DACL_SECURITY_INFORMATION;
@ -704,8 +697,8 @@ spawn_guts (const char * prog_arg, const char *const *argv,
rc = CreateProcessAsUser (cygheap->user.token (), rc = CreateProcessAsUser (cygheap->user.token (),
runpath, /* image name - with full path */ runpath, /* image name - with full path */
one_line.buf, /* what was passed to exec */ one_line.buf, /* what was passed to exec */
sec_attribs, /* process security attrs */ &sec_none_nih, /* process security attrs */
sec_attribs, /* thread security attrs */ &sec_none_nih, /* thread security attrs */
TRUE, /* inherit handles from parent */ TRUE, /* inherit handles from parent */
flags, flags,
envblock, /* environment */ envblock, /* environment */

45
winsup/cygwin/uinfo.cc
View File

@ -46,8 +46,7 @@ cygheap_user::init ()
HANDLE ptok; HANDLE ptok;
DWORD siz; DWORD siz;
char pdacl_buf [sizeof (PTOKEN_DEFAULT_DACL) + ACL_DEFAULT_SIZE]; PSECURITY_DESCRIPTOR psd;
PTOKEN_DEFAULT_DACL pdacl = (PTOKEN_DEFAULT_DACL) pdacl_buf;
if (!OpenProcessToken (hMainProc, TOKEN_ADJUST_DEFAULT | TOKEN_QUERY, if (!OpenProcessToken (hMainProc, TOKEN_ADJUST_DEFAULT | TOKEN_QUERY,
&ptok)) &ptok))
@ -70,34 +69,24 @@ cygheap_user::init ()
if (!SetTokenInformation (ptok, TokenOwner, &effec_cygsid, sizeof (cygsid))) if (!SetTokenInformation (ptok, TokenOwner, &effec_cygsid, sizeof (cygsid)))
debug_printf ("SetTokenInformation(TokenOwner): %E"); debug_printf ("SetTokenInformation(TokenOwner): %E");
/* Add the user in the default DACL if needed */ /* Standard way to build a security descriptor with the usual DACL */
if (!GetTokenInformation (ptok, TokenDefaultDacl, pdacl, sizeof (pdacl_buf), &siz)) char sa_buf[1024];
system_printf ("GetTokenInformation (TokenDefaultDacl): %E"); psd = (PSECURITY_DESCRIPTOR) (sec_user_nih (sa_buf, sid()))->lpSecurityDescriptor;
else if (pdacl->DefaultDacl) /* Running with security */
{
PACL pAcl = pdacl->DefaultDacl;
PACCESS_ALLOWED_ACE pAce;
for (int i = 0; i < pAcl->AceCount; i++) BOOL acl_exists, dummy;
{ TOKEN_DEFAULT_DACL dacl;
if (!GetAce (pAcl, i, (LPVOID *) &pAce)) if (GetSecurityDescriptorDacl (psd, &acl_exists,
system_printf ("GetAce: %E"); &dacl.DefaultDacl, &dummy)
else if (pAce->Header.AceType == ACCESS_ALLOWED_ACE_TYPE && acl_exists && dacl.DefaultDacl)
&& effec_cygsid == &pAce->SidStart) {
goto out; /* Set the default DACL and the process DACL */
} if (!SetTokenInformation (ptok, TokenDefaultDacl, &dacl, sizeof (dacl)))
pAcl->AclSize = &pdacl_buf[sizeof (pdacl_buf)] - (char *) pAcl; system_printf ("SetTokenInformation (TokenDefaultDacl): %E");
if (!AddAccessAllowedAce (pAcl, ACL_REVISION, GENERIC_ALL, effec_cygsid)) if (!SetKernelObjectSecurity (hMainProc, DACL_SECURITY_INFORMATION, psd))
system_printf ("AddAccessAllowedAce: %E"); system_printf ("SetKernelObjectSecurity: %E");
else if (FindFirstFreeAce (pAcl, (LPVOID *) &pAce), !(pAce))
debug_printf ("FindFirstFreeAce %E");
else
{
pAcl->AclSize = (char *) pAce - (char *) pAcl;
if (!SetTokenInformation (ptok, TokenDefaultDacl, pdacl, sizeof (* pdacl)))
system_printf ("SetTokenInformation (TokenDefaultDacl): %E");
}
} }
else
system_printf("Cannot get dacl: %E");
out: out:
CloseHandle (ptok); CloseHandle (ptok);
} }