From: MauMau <maumau307@gmail.com>
To: Michael Paquier <michael.paquier@gmail.com>
To: Tsunakawa, Takayuki <tsunakawa.takay@jp.fujitsu.com>
Cc: Breen Hagan <breen@rtda.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Re: BUG #13755: pgwin32_is_service not checking if SECURITY_SERVICE_SID is disabled
Date: Tue, 8 Nov 2016 06:47:52 +0900
Message-ID: <8230C8E316B544FC92813D96FA139F2E@tunaPC> (raw)
In-Reply-To: <CAB7nPqQzLmq=LT-4+S-svHob85KNdtCQdq4NLczde98LXTFsnQ@mail.gmail.com>
References: <CAB7nPqTAiB6+z=Cbqzt4KNNkynhP6D7_r_KaZBkmpt9mX7STuQ@mail.gmail.com>
<20160404160801.GA186687@alvherre.pgsql>
<CAB7nPqQjdCfny+SeF8mVehP+e1m4EwYxLBC2rhNHPwk5aTisPw@mail.gmail.com>
<CAB7nPqSvfu=KpJ=NX+YAHmgAmQdzA7N5h31BjzXeMgczhGCC+Q@mail.gmail.com>
<64a0ee81-2e30-c9b1-97b6-312772f89a2e@iki.fi>
<CAC6pFPwwwufOHocFEbZimnd6-Mh3A2xYA=F9HmC_kxV1NTXhoA@mail.gmail.com>
<CAB7nPqRzb4Fb9bJOttXHjh38hFxaN79hTNJEV0aBbgz=K52ASw@mail.gmail.com>
<CAB7nPqTMMFdzG5kcCjeC98rVJA+sKquowWDOu1=6w=OAkzRiSg@mail.gmail.com>
<952A88FFCBDA419EB6D6556B6A8F29C1@tunaPC>
<CAB7nPqTRtATjX5JwYwE41X4TzzVLnykmXiTxNsn3wziMHp43Hg@mail.gmail.com>
<0A3221C70F24FB45833433255569204D1F63BD65@G01JPEXMBYT05>
<CAB7nPqQzLmq=LT-4+S-svHob85KNdtCQdq4NLczde98LXTFsnQ@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Hi, Michael
As I guessed in the previous mail, both our patches cause
pgwin32_is_service() to return 1 even when SECURITY_SERVICE_RID is
disabled, if the service is running as a Local System. The existing
logic of checking for Local System should be removed. The attached
patch fixes this problem.
Regards
Takayuki Tsunakawa
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackersAttachments:win32-security-service-v5.patch (application/octet-stream, 6.2K) downloaddiff --git a/src/port/win32security.c b/src/port/win32security.cindex 2c9ca15..9e65e60 100644--- a/src/port/win32security.c+++ b/src/port/win32security.c@@ -18,11 +18,6 @@
#endif
-static BOOL pgwin32_get_dynamic_tokeninfo(HANDLE token,- TOKEN_INFORMATION_CLASS class,- char **InfoBuffer, char *errbuf, int errsize);--
/*
* Utility wrapper for frontend and backend when reporting an error
* message.
@@ -53,33 +48,11 @@ log_error(const char *fmt,...)
int
pgwin32_is_admin(void)
{
- HANDLE AccessToken;- char *InfoBuffer = NULL;- char errbuf[256];- PTOKEN_GROUPS Groups;
PSID AdministratorsSid;
PSID PowerUsersSid;
SID_IDENTIFIER_AUTHORITY NtAuthority = {SECURITY_NT_AUTHORITY};
- UINT x;- BOOL success;-- if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &AccessToken))- {- log_error(_("could not open process token: error code %lu\n"),- GetLastError());- exit(1);- }-- if (!pgwin32_get_dynamic_tokeninfo(AccessToken, TokenGroups,- &InfoBuffer, errbuf, sizeof(errbuf)))- {- log_error("%s", errbuf);- exit(1);- }-- Groups = (PTOKEN_GROUPS) InfoBuffer;-- CloseHandle(AccessToken);+ BOOL IsAdministrators;+ BOOL IsPowerUsers;
if (!AllocateAndInitializeSid(&NtAuthority, 2,
SECURITY_BUILTIN_DOMAIN_RID,
@@ -101,32 +74,26 @@ pgwin32_is_admin(void)
exit(1);
}
- success = FALSE;-- for (x = 0; x < Groups->GroupCount; x++)+ if (!CheckTokenMembership(NULL, AdministratorsSid, &IsAdministrators) ||+ !CheckTokenMembership(NULL, PowerUsersSid, &IsPowerUsers))
{
- if ((EqualSid(AdministratorsSid, Groups->Groups[x].Sid) &&- (Groups->Groups[x].Attributes & SE_GROUP_ENABLED)) ||- (EqualSid(PowerUsersSid, Groups->Groups[x].Sid) &&- (Groups->Groups[x].Attributes & SE_GROUP_ENABLED)))- {- success = TRUE;- break;- }+ log_error("could not check access token membership: error code %lu\n",+ GetLastError());+ exit(1);
}
- free(InfoBuffer);
FreeSid(AdministratorsSid);
FreeSid(PowerUsersSid);
- return success;++ if (IsAdministrators || IsPowerUsers)+ return 1;+ else+ return 0;
}
/*
- * We consider ourselves running as a service if one of the following is- * true:- *- * 1) We are running as Local System (only used by services)- * 2) Our token contains SECURITY_SERVICE_RID (automatically added to the+ * We consider ourselves running as a service if + * our token contains SECURITY_SERVICE_RID (automatically added to the
* process token by the SCM when starting a service)
*
* Return values:
@@ -143,140 +110,37 @@ int
pgwin32_is_service(void)
{
static int _is_service = -1;
- HANDLE AccessToken;- char *InfoBuffer = NULL;- char errbuf[256];- PTOKEN_GROUPS Groups;- PTOKEN_USER User;+ BOOL IsMember;
PSID ServiceSid;
- PSID LocalSystemSid;
SID_IDENTIFIER_AUTHORITY NtAuthority = {SECURITY_NT_AUTHORITY};
- UINT x;
/* Only check the first time */
if (_is_service != -1)
return _is_service;
- if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &AccessToken))- {- fprintf(stderr, "could not open process token: error code %lu\n",- GetLastError());- return -1;- }-- /* First check for local system */- if (!pgwin32_get_dynamic_tokeninfo(AccessToken, TokenUser, &InfoBuffer,- errbuf, sizeof(errbuf)))- {- fprintf(stderr, "%s", errbuf);- return -1;- }-- User = (PTOKEN_USER) InfoBuffer;-- if (!AllocateAndInitializeSid(&NtAuthority, 1,- SECURITY_LOCAL_SYSTEM_RID, 0, 0, 0, 0, 0, 0, 0,- &LocalSystemSid))- {- fprintf(stderr, "could not get SID for local system account\n");- CloseHandle(AccessToken);- return -1;- }-- if (EqualSid(LocalSystemSid, User->User.Sid))- {- FreeSid(LocalSystemSid);- free(InfoBuffer);- CloseHandle(AccessToken);- _is_service = 1;- return _is_service;- }-- FreeSid(LocalSystemSid);- free(InfoBuffer);-- /* Now check for group SID */- if (!pgwin32_get_dynamic_tokeninfo(AccessToken, TokenGroups, &InfoBuffer,- errbuf, sizeof(errbuf)))- {- fprintf(stderr, "%s", errbuf);- return -1;- }-- Groups = (PTOKEN_GROUPS) InfoBuffer;-+ /* Check for service group membership */
if (!AllocateAndInitializeSid(&NtAuthority, 1,
SECURITY_SERVICE_RID, 0, 0, 0, 0, 0, 0, 0,
&ServiceSid))
{
- fprintf(stderr, "could not get SID for service group\n");- free(InfoBuffer);- CloseHandle(AccessToken);+ fprintf(stderr, "could not get SID for service group: error code %lu\n",+ GetLastError());
return -1;
}
- _is_service = 0;- for (x = 0; x < Groups->GroupCount; x++)+ if (!CheckTokenMembership(NULL, ServiceSid, &IsMember))
{
- if (EqualSid(ServiceSid, Groups->Groups[x].Sid))- {- _is_service = 1;- break;- }+ fprintf(stderr, "could not check access token membership: error code %lu\n",+ GetLastError());+ FreeSid(ServiceSid);+ return -1;
}
-- free(InfoBuffer);
FreeSid(ServiceSid);
- CloseHandle(AccessToken);+ if (IsMember)+ _is_service = 1;+ else+ _is_service = 0;
return _is_service;
}
---/*- * Call GetTokenInformation() on a token and return a dynamically sized- * buffer with the information in it. This buffer must be free():d by- * the calling function!- */-static BOOL-pgwin32_get_dynamic_tokeninfo(HANDLE token, TOKEN_INFORMATION_CLASS class,- char **InfoBuffer, char *errbuf, int errsize)-{- DWORD InfoBufferSize;-- if (GetTokenInformation(token, class, NULL, 0, &InfoBufferSize))- {- snprintf(errbuf, errsize,- "could not get token information buffer size: got zero size\n");- return FALSE;- }-- if (GetLastError() != ERROR_INSUFFICIENT_BUFFER)- {- snprintf(errbuf, errsize,- "could not get token information buffer size: error code %lu\n",- GetLastError());- return FALSE;- }-- *InfoBuffer = malloc(InfoBufferSize);- if (*InfoBuffer == NULL)- {- snprintf(errbuf, errsize,- "could not allocate %d bytes for token information\n",- (int) InfoBufferSize);- return FALSE;- }-- if (!GetTokenInformation(token, class, *InfoBuffer,- InfoBufferSize, &InfoBufferSize))- {- snprintf(errbuf, errsize,- "could not get token information: error code %lu\n",- GetLastError());- return FALSE;- }-- return TRUE;-}
=
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: maumau307@gmail.com, michael.paquier@gmail.com, tsunakawa.takay@jp.fujitsu.com, breen@rtda.com, hlinnaka@iki.fi, alvherre@2ndquadrant.com, pgsql-hackers@postgresql.org
Subject: Re: Re: BUG #13755: pgwin32_is_service not checking if SECURITY_SERVICE_SID is disabled
In-Reply-To: <8230C8E316B544FC92813D96FA139F2E@tunaPC>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox