GitHubMirror/sys
1
0
Fork 0
mirror of https://github.com/rwinkhart/sys.git synced 2026-09-02 15:17:31 -04:00
Code Issues Packages Projects Releases Wiki Activity

windows: add Token.IsRestricted helper

Browse Source 
This adds an additional helper method to Token to determine whether or
not it's a restricted one, by using:
https://docs.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-istokenrestricted

Change-Id: I1f2d051450524c22665c4bb99f5948b375b5e199
Reviewed-on: https://go-review.googlesource.com/c/sys/+/272107
Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
Trust: Alex Brainman <alex.brainman@gmail.com>
Trust: Jason A. Donenfeld <Jason@zx2c4.com>
This commit is contained in:
Jason A. Donenfeld
2020-11-26 22:47:55 +00:00
parent a4b67b81d3
commit f88b827b86
2 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
windows/security_windows.go
+11
View File
@@ -624,6 +624,7 @@ func (tml *Tokenmandatorylabel) Size() uint32 {
// Authorization Functions // Authorization Functions
//sys checkTokenMembership(tokenHandle Token, sidToCheck *SID, isMember *int32) (err error) = advapi32.CheckTokenMembership //sys checkTokenMembership(tokenHandle Token, sidToCheck *SID, isMember *int32) (err error) = advapi32.CheckTokenMembership
//sys isTokenRestricted(tokenHandle Token) (ret bool, err error) [!failretval] = advapi32.IsTokenRestricted
//sys OpenProcessToken(process Handle, access uint32, token *Token) (err error) = advapi32.OpenProcessToken //sys OpenProcessToken(process Handle, access uint32, token *Token) (err error) = advapi32.OpenProcessToken
//sys OpenThreadToken(thread Handle, access uint32, openAsSelf bool, token *Token) (err error) = advapi32.OpenThreadToken //sys OpenThreadToken(thread Handle, access uint32, openAsSelf bool, token *Token) (err error) = advapi32.OpenThreadToken
//sys ImpersonateSelf(impersonationlevel uint32) (err error) = advapi32.ImpersonateSelf //sys ImpersonateSelf(impersonationlevel uint32) (err error) = advapi32.ImpersonateSelf
@@ -837,6 +838,16 @@ func (t Token) IsMember(sid *SID) (bool, error) {
return b != 0, nil return b != 0, nil
} }
// IsRestricted reports whether the access token t is a restricted token.
func (t Token) IsRestricted() (isRestricted bool, err error) {
isRestricted, err = isTokenRestricted(t)
if !isRestricted && err == syscall.EINVAL {
// If err is EINVAL, this returned ERROR_SUCCESS indicating a non-restricted token.
err = nil
}
return
}
const ( const (
WTS_CONSOLE_CONNECT = 0x1 WTS_CONSOLE_CONNECT = 0x1
WTS_CONSOLE_DISCONNECT = 0x2 WTS_CONSOLE_DISCONNECT = 0x2
windows/zsyscall_windows.go
+10
View File
@@ -95,6 +95,7 @@ var (
procImpersonateSelf = modadvapi32.NewProc("ImpersonateSelf") procImpersonateSelf = modadvapi32.NewProc("ImpersonateSelf")
procInitializeSecurityDescriptor = modadvapi32.NewProc("InitializeSecurityDescriptor") procInitializeSecurityDescriptor = modadvapi32.NewProc("InitializeSecurityDescriptor")
procInitiateSystemShutdownExW = modadvapi32.NewProc("InitiateSystemShutdownExW") procInitiateSystemShutdownExW = modadvapi32.NewProc("InitiateSystemShutdownExW")
procIsTokenRestricted = modadvapi32.NewProc("IsTokenRestricted")
procIsValidSecurityDescriptor = modadvapi32.NewProc("IsValidSecurityDescriptor") procIsValidSecurityDescriptor = modadvapi32.NewProc("IsValidSecurityDescriptor")
procIsValidSid = modadvapi32.NewProc("IsValidSid") procIsValidSid = modadvapi32.NewProc("IsValidSid")
procIsWellKnownSid = modadvapi32.NewProc("IsWellKnownSid") procIsWellKnownSid = modadvapi32.NewProc("IsWellKnownSid")
@@ -756,6 +757,15 @@ func InitiateSystemShutdownEx(machineName *uint16, message *uint16, timeout uint
return return
} }
func isTokenRestricted(tokenHandle Token) (ret bool, err error) {
r0, _, e1 := syscall.Syscall(procIsTokenRestricted.Addr(), 1, uintptr(tokenHandle), 0, 0)
ret = r0 != 0
if !ret {
err = errnoErr(e1)
}
return
}
func isValidSecurityDescriptor(sd *SECURITY_DESCRIPTOR) (isValid bool) { func isValidSecurityDescriptor(sd *SECURITY_DESCRIPTOR) (isValid bool) {
r0, _, _ := syscall.Syscall(procIsValidSecurityDescriptor.Addr(), 1, uintptr(unsafe.Pointer(sd)), 0, 0) r0, _, _ := syscall.Syscall(procIsValidSecurityDescriptor.Addr(), 1, uintptr(unsafe.Pointer(sd)), 0, 0)
isValid = r0 != 0 isValid = r0 != 0