From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from sa-prd-fep-041.btinternet.com (mailomta27-sa.btinternet.com [213.120.69.33]) by sourceware.org (Postfix) with ESMTPS id 33903396B42E for ; Tue, 10 Aug 2021 17:04:30 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 33903396B42E Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=dronecode.org.uk Authentication-Results: sourceware.org; spf=none smtp.mailfrom=dronecode.org.uk Received: from sa-prd-rgout-002.btmx-prd.synchronoss.net ([10.2.38.5]) by sa-prd-fep-041.btinternet.com with ESMTP id <20210810170429.VPAF18744.sa-prd-fep-041.btinternet.com@sa-prd-rgout-002.btmx-prd.synchronoss.net>; Tue, 10 Aug 2021 18:04:29 +0100 Authentication-Results: btinternet.com; none X-SNCR-Rigid: 60FF56FA02421038 X-Originating-IP: [86.140.112.60] X-OWM-Source-IP: 86.140.112.60 (GB) X-OWM-Env-Sender: jonturney@btinternet.com X-VadeSecure-score: verdict=clean score=0/300, class=clean X-RazorGate-Vade: gggruggvucftvghtrhhoucdtuddrgedvtddrjeelgddutdelucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuueftkffvkffujffvgffngfevqffopdfqfgfvnecuuegrihhlohhuthemuceftddunecunecujfgurhephffvufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeflohhnucfvuhhrnhgvhicuoehjohhnrdhtuhhrnhgvhiesughrohhnvggtohguvgdrohhrghdruhhkqeenucggtffrrghtthgvrhhnpeefieduveehgfffffeuueehleefgeevfedvffeljeefheduteelteelvdettefhvdenucfkphepkeeirddugedtrdduuddvrdeitdenucevlhhushhtvghrufhiiigvpeehnecurfgrrhgrmhephhgvlhhopehlohgtrghlhhhoshhtrdhlohgtrghlughomhgrihhnpdhinhgvthepkeeirddugedtrdduuddvrdeitddpmhgrihhlfhhrohhmpeeojhhonhdrthhurhhnvgihsegurhhonhgvtghouggvrdhorhhgrdhukheqpdhrtghpthhtohepoegthihgfihinhdqrghpphhssegthihgfihinhdrtghomheqpdhrtghpthhtohepoehjohhnrdhtuhhrnhgvhiesughrohhnvggtohguvgdrohhrghdruhhkqe X-RazorGate-Vade-Verdict: clean 0 X-RazorGate-Vade-Classification: clean Received: from localhost.localdomain (86.140.112.60) by sa-prd-rgout-002.btmx-prd.synchronoss.net (5.8.340) (authenticated as jonturney@btinternet.com) id 60FF56FA02421038; Tue, 10 Aug 2021 18:04:29 +0100 From: Jon Turney To: cygwin-apps@cygwin.com Cc: Jon Turney Subject: [PATCH setup 06/11] Enable SeCreateSymbolicLink privilege Date: Tue, 10 Aug 2021 18:02:23 +0100 Message-Id: <20210810170228.1690-7-jon.turney@dronecode.org.uk> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210810170228.1690-1-jon.turney@dronecode.org.uk> References: <20210810170228.1690-1-jon.turney@dronecode.org.uk> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-1200.5 required=5.0 tests=BAYES_00, FORGED_SPF_HELO, GIT_PATCH_0, KAM_DMARC_STATUS, KAM_LAZY_DOMAIN_SECURITY, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_PASS, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: cygwin-apps@cygwin.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Cygwin package maintainer discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Aug 2021 17:04:40 -0000 I'm not sure if SeCreateSymbolicLink privilege can get removed by UAC filtering, but to make sure to enable it, if we can. Also report if it's available to log. --- win32.cc | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ win32.h | 2 ++ 2 files changed, 60 insertions(+) diff --git a/win32.cc b/win32.cc index 8ee424f..6455384 100644 --- a/win32.cc +++ b/win32.cc @@ -280,6 +280,28 @@ NTSecurity::setBackupPrivileges () } } +void +NTSecurity::setSymlinkPrivilege () +{ + LUID symlink; + if (!LookupPrivilegeValue (NULL, SE_CREATE_SYMBOLIC_LINK_NAME, &symlink)) + NoteFailedAPI ("LookupPrivilegeValue"); + + PTOKEN_PRIVILEGES new_priv; + new_priv = (PTOKEN_PRIVILEGES) alloca (sizeof (TOKEN_PRIVILEGES)); + new_priv->PrivilegeCount = 1; + new_priv->Privileges[0].Luid = symlink; + new_priv->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + + if (!AdjustTokenPrivileges (token.theHANDLE (), FALSE, new_priv, + 0, NULL, NULL)) + NoteFailedAPI ("AdjustTokenPrivileges"); + else if (GetLastError () == ERROR_NOT_ALL_ASSIGNED) + Log (LOG_TIMESTAMP) << "User has NO symlink creation right" << endLog; + else + Log (LOG_TIMESTAMP) << "User has symlink creation right" << endLog; +} + void NTSecurity::resetPrimaryGroup () { @@ -321,6 +343,9 @@ NTSecurity::setDefaultSecurity (bool isAdmin) /* Set backup and restore privileges if available. */ setBackupPrivileges (); + /* Set symlink creation privilege, if available. */ + setSymlinkPrivilege (); + /* If initializing the well-known SIDs didn't work, we're finished here. */ if (!wellKnownSIDsinitialized ()) return; @@ -371,6 +396,39 @@ NTSecurity::isRunAsAdmin () return (is_run_as_admin == TRUE); } +bool +NTSecurity::hasSymlinkCreationRights () +{ + LUID symlink; + if (!LookupPrivilegeValue (NULL, SE_CREATE_SYMBOLIC_LINK_NAME, &symlink)) + { + NoteFailedAPI ("LookupPrivilegeValue"); + return FALSE; + } + + DWORD size; + GetTokenInformation (token.theHANDLE (), TokenPrivileges, NULL, 0, &size); + /* Will fail ERROR_INSUFFICIENT_BUFFER, but updates size */ + + TOKEN_PRIVILEGES *privileges = (TOKEN_PRIVILEGES *)alloca(size); + if (!GetTokenInformation (token.theHANDLE (), TokenPrivileges, privileges, + size, &size)) + { + NoteFailedAPI ("GetTokenInformation(privileges)"); + return FALSE; + } + + unsigned int i; + for (i = 0; i < privileges->PrivilegeCount; i++) + { + if (memcmp(&privileges->Privileges[i].Luid, &symlink, sizeof(LUID)) == 0) + { + return (privileges->Privileges[i].Attributes & SE_PRIVILEGE_ENABLED); + } + } + + return FALSE; +} VersionInfo::VersionInfo () { diff --git a/win32.h b/win32.h index daebf2e..e498077 100644 --- a/win32.h +++ b/win32.h @@ -132,12 +132,14 @@ public: void initialiseWellKnownSIDs (); void setDefaultSecurity(bool isAdmin); bool isRunAsAdmin (); + bool hasSymlinkCreationRights (); private: void NoteFailedAPI (const std::string &); bool wellKnownSIDsinitialized () const { return _wellKnownSIDsinitialized; } void wellKnownSIDsinitialized (bool b) { _wellKnownSIDsinitialized = b; } void setDefaultDACL (); void setBackupPrivileges (); + void setSymlinkPrivilege (); SIDWrapper nullSID, everyOneSID, administratorsSID, usersSID, cr_ownerSID, cr_groupSID; -- 2.32.0