Subject: Re: BUG #13755: pgwin32_is_service not checking if
 SECURITY_SERVICE_SID is disabled
To: Michael Paquier <michael.paquier@gmail.com>, Breen Hagan <breen@rtda.com>
References: 
 <CAB7nPqTAiB6+z=Cbqzt4KNNkynhP6D7_r_KaZBkmpt9mX7STuQ@mail.gmail.com>
 <20160404160801.GA186687@alvherre.pgsql>
 <CAB7nPqQjdCfny+SeF8mVehP+e1m4EwYxLBC2rhNHPwk5aTisPw@mail.gmail.com>
 <CAB7nPqSvfu=KpJ=NX+YAHmgAmQdzA7N5h31BjzXeMgczhGCC+Q@mail.gmail.com>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>,
 PostgreSQL mailing lists <pgsql-bugs@postgresql.org>
From: Heikki Linnakangas <hlinnaka@iki.fi>
Message-ID: <64a0ee81-2e30-c9b1-97b6-312772f89a2e@iki.fi>
Date: Wed, 21 Sep 2016 15:50:51 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Icedove/45.2.0
MIME-Version: 1.0
In-Reply-To: 
 <CAB7nPqSvfu=KpJ=NX+YAHmgAmQdzA7N5h31BjzXeMgczhGCC+Q@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-bugs-owner@postgresql.org

On 04/08/2016 09:48 AM, Michael Paquier wrote:
> So I have been looking at this issue again and finished with the patch
> attached. I think that it makes the most sense to browse the whole
> list of groups, and choose if Postgres is running as a service if
> service SID matches with one of the group SIDs listed, on top of which
> this group SID should be enabled via SE_GROUP_ENABLED. Checking for
> SE_GROUP_USE_FOR_DENY_ONLY would not make much sense, because it would
> mean that SE_GROUP_ENABLED is not set, and that's what we are
> interested in. That was in short the point of Breen, and it looks to
> be the saner way to go.

Yeah, seems like the right way. pgwin32_is_admin() also checks for 
SE_GROUP_ENABLED.

I think this is ready to be committed, except that I don't have an easy 
way to reproduce the original problem to test this. I suppose I could 
write a test program to call CreateRestrictedToken() and 
CreateProcessAsUser(), but would rather avoid the work. Breen, if I push 
a fix for this, can you build from sources and verify that it fixes your 
original problem? Or alternatively, can you provide a test program that 
I can use to verify it?

- Heikki


-- 
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs