pg.ddx.io pgsql-bugs@postgresql.org mailing list archive help / color / mirror / Atom feed From: MauMau <maumau307@gmail.com>
To: Michael Paquier <michael.paquier@gmail.com>
To: Tsunakawa, Takayuki <tsunakawa.takay@jp.fujitsu.com>
To: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Breen Hagan <breen@rtda.com>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: BUG #13755: pgwin32_is_service not checking if SECURITY_SERVICE_SID is disabled
Date: Fri, 17 Mar 2017 07:21:24 +0900
Message-ID: <59B164A913E841B7850A1FBF23D47187@tunaPC> (raw )
In-Reply-To: <f20d0a60-e9cc-beb6-93d9-ecdda829b1e4@iki.fi >
References: <CAB7nPqTAiB6+z=Cbqzt4KNNkynhP6D7_r_KaZBkmpt9mX7STuQ@mail.gmail.com >
<952A88FFCBDA419EB6D6556B6A8F29C1@tunaPC >
<CAB7nPqTRtATjX5JwYwE41X4TzzVLnykmXiTxNsn3wziMHp43Hg@mail.gmail.com >
<0A3221C70F24FB45833433255569204D1F63BD65@G01JPEXMBYT05 >
<CAB7nPqQzLmq=LT-4+S-svHob85KNdtCQdq4NLczde98LXTFsnQ@mail.gmail.com >
<8230C8E316B544FC92813D96FA139F2E@tunaPC >
<CAB7nPqRTaifmRyZojGJF1AV9_72QwjBgdUe1HhS3Gx2qYAJcNA@mail.gmail.com >
<0A3221C70F24FB45833433255569204D1F63C649@G01JPEXMBYT05 >
<CAB7nPqQnCB2zrSq0iTEtc=oYPcc_Oh_HxP=3Vy9ZnFd-m8ZXKw@mail.gmail.com >
<0A3221C70F24FB45833433255569204D1F63C6C9@G01JPEXMBYT05 >
<CAB7nPqSxV744oC6ai5og566=5=9+pT10WkN5KdpjyrjAx+=wNA@mail.gmail.com >
<0A3221C70F24FB45833433255569204D1F63C7A6@G01JPEXMBYT05 >
<CAB7nPqREw6B-qQAOrbLZTTQ-Ug3NKX2O59WeAiP5sSWSKuJuMQ@mail.gmail.com >
<0A3221C70F24FB45833433255569204D1F63C85A@G01JPEXMBYT05 >
<CAB7nPqQ-A1vgh3aRk08LSu-F9HE-tw9DRk850YnUMgqQf5XrXA@mail.gmail.com >
<f20d0a60-e9cc-beb6-93d9-ecdda829b1e4@iki.fi >
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
From: Heikki Linnakangas
So, I think we still need the check for Local System.
Thanks, fixed and confirmed that the error message is output in the
event log.
Regards
MauMau
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Attachments:
win32-security-service-v7.patch (application/octet-stream, 6.4K) download
diff --git a/src/port/win32security.c b/src/port/win32security.c
index 777a2e5b99..ca0fa35299 100644
--- a/src/port/win32security.c
+++ b/src/port/win32security.c
@@ -18,11 +18,6 @@
#endif
-static BOOL pgwin32_get_dynamic_tokeninfo(HANDLE token,
- TOKEN_INFORMATION_CLASS class,
- char **InfoBuffer, char *errbuf, int errsize);
-
-
/*
* Utility wrapper for frontend and backend when reporting an error
* message.
@@ -53,33 +48,11 @@ log_error(const char *fmt,...)
int
pgwin32_is_admin(void)
{
- HANDLE AccessToken;
- char *InfoBuffer = NULL;
- char errbuf[256];
- PTOKEN_GROUPS Groups;
PSID AdministratorsSid;
PSID PowerUsersSid;
SID_IDENTIFIER_AUTHORITY NtAuthority = {SECURITY_NT_AUTHORITY};
- UINT x;
- BOOL success;
-
- if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &AccessToken))
- {
- log_error(_("could not open process token: error code %lu\n"),
- GetLastError());
- exit(1);
- }
-
- if (!pgwin32_get_dynamic_tokeninfo(AccessToken, TokenGroups,
- &InfoBuffer, errbuf, sizeof(errbuf)))
- {
- log_error("%s", errbuf);
- exit(1);
- }
-
- Groups = (PTOKEN_GROUPS) InfoBuffer;
-
- CloseHandle(AccessToken);
+ BOOL IsAdministrators;
+ BOOL IsPowerUsers;
if (!AllocateAndInitializeSid(&NtAuthority, 2,
SECURITY_BUILTIN_DOMAIN_RID,
@@ -101,32 +74,26 @@ pgwin32_is_admin(void)
exit(1);
}
- success = FALSE;
-
- for (x = 0; x < Groups->GroupCount; x++)
+ if (!CheckTokenMembership(NULL, AdministratorsSid, &IsAdministrators) ||
+ !CheckTokenMembership(NULL, PowerUsersSid, &IsPowerUsers))
{
- if ((EqualSid(AdministratorsSid, Groups->Groups[x].Sid) &&
- (Groups->Groups[x].Attributes & SE_GROUP_ENABLED)) ||
- (EqualSid(PowerUsersSid, Groups->Groups[x].Sid) &&
- (Groups->Groups[x].Attributes & SE_GROUP_ENABLED)))
- {
- success = TRUE;
- break;
- }
+ log_error("could not check access token membership: error code %lu\n",
+ GetLastError());
+ exit(1);
}
- free(InfoBuffer);
FreeSid(AdministratorsSid);
FreeSid(PowerUsersSid);
- return success;
+
+ if (IsAdministrators || IsPowerUsers)
+ return 1;
+ else
+ return 0;
}
/*
- * We consider ourselves running as a service if one of the following is
- * true:
- *
- * 1) We are running as Local System (only used by services)
- * 2) Our token contains SECURITY_SERVICE_RID (automatically added to the
+ * We consider ourselves running as a service if
+ * our token contains SECURITY_SERVICE_RID (automatically added to the
* process token by the SCM when starting a service)
*
* Return values:
@@ -143,140 +110,62 @@ int
pgwin32_is_service(void)
{
static int _is_service = -1;
- HANDLE AccessToken;
- char *InfoBuffer = NULL;
- char errbuf[256];
- PTOKEN_GROUPS Groups;
- PTOKEN_USER User;
+ BOOL IsMember;
PSID ServiceSid;
PSID LocalSystemSid;
SID_IDENTIFIER_AUTHORITY NtAuthority = {SECURITY_NT_AUTHORITY};
- UINT x;
/* Only check the first time */
if (_is_service != -1)
return _is_service;
- if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &AccessToken))
- {
- fprintf(stderr, "could not open process token: error code %lu\n",
- GetLastError());
- return -1;
- }
-
/* First check for local system */
- if (!pgwin32_get_dynamic_tokeninfo(AccessToken, TokenUser, &InfoBuffer,
- errbuf, sizeof(errbuf)))
- {
- fprintf(stderr, "%s", errbuf);
- return -1;
- }
-
- User = (PTOKEN_USER) InfoBuffer;
-
if (!AllocateAndInitializeSid(&NtAuthority, 1,
SECURITY_LOCAL_SYSTEM_RID, 0, 0, 0, 0, 0, 0, 0,
&LocalSystemSid))
{
fprintf(stderr, "could not get SID for local system account\n");
- CloseHandle(AccessToken);
return -1;
}
- if (EqualSid(LocalSystemSid, User->User.Sid))
+ if (!CheckTokenMembership(NULL, LocalSystemSid, &IsMember))
{
+ fprintf(stderr, "could not check access token membership: error code %lu\n",
+ GetLastError());
FreeSid(LocalSystemSid);
- free(InfoBuffer);
- CloseHandle(AccessToken);
- _is_service = 1;
- return _is_service;
+ return -1;
}
-
FreeSid(LocalSystemSid);
- free(InfoBuffer);
- /* Now check for group SID */
- if (!pgwin32_get_dynamic_tokeninfo(AccessToken, TokenGroups, &InfoBuffer,
- errbuf, sizeof(errbuf)))
+ if (IsMember)
{
- fprintf(stderr, "%s", errbuf);
- return -1;
+ _is_service = 1;
+ return _is_service;
}
- Groups = (PTOKEN_GROUPS) InfoBuffer;
-
+ /* Check for service group membership */
if (!AllocateAndInitializeSid(&NtAuthority, 1,
SECURITY_SERVICE_RID, 0, 0, 0, 0, 0, 0, 0,
&ServiceSid))
{
- fprintf(stderr, "could not get SID for service group\n");
- free(InfoBuffer);
- CloseHandle(AccessToken);
+ fprintf(stderr, "could not get SID for service group: error code %lu\n",
+ GetLastError());
return -1;
}
- _is_service = 0;
- for (x = 0; x < Groups->GroupCount; x++)
+ if (!CheckTokenMembership(NULL, ServiceSid, &IsMember))
{
- if (EqualSid(ServiceSid, Groups->Groups[x].Sid))
- {
- _is_service = 1;
- break;
- }
+ fprintf(stderr, "could not check access token membership: error code %lu\n",
+ GetLastError());
+ FreeSid(ServiceSid);
+ return -1;
}
-
- free(InfoBuffer);
FreeSid(ServiceSid);
- CloseHandle(AccessToken);
+ if (IsMember)
+ _is_service = 1;
+ else
+ _is_service = 0;
return _is_service;
}
-
-
-/*
- * Call GetTokenInformation() on a token and return a dynamically sized
- * buffer with the information in it. This buffer must be free():d by
- * the calling function!
- */
-static BOOL
-pgwin32_get_dynamic_tokeninfo(HANDLE token, TOKEN_INFORMATION_CLASS class,
- char **InfoBuffer, char *errbuf, int errsize)
-{
- DWORD InfoBufferSize;
-
- if (GetTokenInformation(token, class, NULL, 0, &InfoBufferSize))
- {
- snprintf(errbuf, errsize,
- "could not get token information buffer size: got zero size\n");
- return FALSE;
- }
-
- if (GetLastError() != ERROR_INSUFFICIENT_BUFFER)
- {
- snprintf(errbuf, errsize,
- "could not get token information buffer size: error code %lu\n",
- GetLastError());
- return FALSE;
- }
-
- *InfoBuffer = malloc(InfoBufferSize);
- if (*InfoBuffer == NULL)
- {
- snprintf(errbuf, errsize,
- "could not allocate %d bytes for token information\n",
- (int) InfoBufferSize);
- return FALSE;
- }
-
- if (!GetTokenInformation(token, class, *InfoBuffer,
- InfoBufferSize, &InfoBufferSize))
- {
- snprintf(errbuf, errsize,
- "could not get token information: error code %lu\n",
- GetLastError());
- return FALSE;
- }
-
- return TRUE;
-}
=
view thread (38+ messages) latest in thread
Message-ID: <59B164A913E841B7850A1FBF23D47187@tunaPC>
Permalink: ../59B164A913E841B7850A1FBF23D47187@tunaPC/
Also on: postgresql.org/message-id/59B164A913E841B7850A1FBF23D47187@tunaPC
copy link · copy postgr.es · copy git am
reply Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: maumau307@gmail.com, michael.paquier@gmail.com, tsunakawa.takay@jp.fujitsu.com, hlinnaka@iki.fi, breen@rtda.com, alvherre@2ndquadrant.com, pgsql-hackers@postgresql.org
Subject: Re: BUG #13755: pgwin32_is_service not checking if SECURITY_SERVICE_SID is disabled
In-Reply-To: <59B164A913E841B7850A1FBF23D47187@tunaPC>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox