@samitouri / QOSAMI-WSL-1
Code Commits Issues Pulls Sessions CI/CD
master
master
h 124 lines 3.42 KB
Raw
1 /*++
2
3 Copyright (c) Microsoft. All rights reserved.
4
5 Module Name:
6
7 WslSecurity.h
8
9 Abstract:
10
11 This file contains WSL Core security function declarations.
12
13 --*/
14
15 #pragma once
16
17 #include <xstring>
18 #include <optional>
19 #include "wrl/client.h"
20 #include "wil/resource.h"
21 #include "Redirector.h"
22
23 namespace wsl::windows::common::security {
24 using unique_revert_to_self = wil::unique_call<decltype(&::RpcRevertToSelf), ::RpcRevertToSelf>;
25
26 using unique_acl = wil::unique_any<ACL*, decltype(&::LocalFree), ::LocalFree>;
27
28 struct privilege_context
29 {
30 privilege_context() = delete;
31 privilege_context(const privilege_context&) = delete;
32
33 privilege_context(wil::unique_handle&& token, LUID luid) : token(std::move(token)), luid(luid)
34 {
35 }
36
37 ~privilege_context()
38 {
39 // Disable the privilege.
40 if (token)
41 {
42 TOKEN_PRIVILEGES newState{};
43 newState.PrivilegeCount = 1;
44 newState.Privileges[0].Attributes = 0;
45 newState.Privileges[0].Luid = luid;
46 LOG_IF_WIN32_BOOL_FALSE(::AdjustTokenPrivileges(token.get(), FALSE, &newState, 0, nullptr, nullptr));
47 }
48 }
49
50 wil::unique_handle token;
51 LUID luid;
52 };
53
54 /// <summary>
55 /// Acquires the specified privilege on the current process token.
56 /// </summary>
57 std::unique_ptr<privilege_context> AcquirePrivilege(_In_ LPCWSTR privilegeName);
58
59 /// <summary>
60 /// Acquires the specified privileges on the current process token.
61 /// </summary>
62 std::vector<std::unique_ptr<privilege_context>> AcquirePrivileges(_In_ const std::vector<LPCWSTR>& privilegeNames);
63
64 /// <summary>
65 /// Apply process mitigation policies to current process.
66 /// </summary>
67 void ApplyProcessMitigationPolicies();
68
69 /// <summary>
70 /// Creates a security descriptor from the provided user sid.
71 /// </summary>
72 SECURITY_DESCRIPTOR CreateSecurityDescriptor(_In_ PSID userSid);
73
74 template <typename... TArgs>
75 std::pair<PSID, std::vector<char>> CreateSid(SID_IDENTIFIER_AUTHORITY Authority, TArgs... values)
76 {
77 std::vector<char> buffer(SECURITY_SID_SIZE(sizeof...(TArgs)));
78 auto* sid = reinterpret_cast<PSID>(buffer.data());
79
80 THROW_IF_NTSTATUS_FAILED(RtlInitializeSidEx(sid, &Authority, sizeof...(TArgs), std::forward<TArgs>(values)...));
81
82 return std::make_pair(sid, std::move(buffer));
83 }
84
85 /// <summary>
86 /// Creates a restricted token from the provided token.
87 /// </summary>
88 wil::unique_handle CreateRestrictedToken(_In_ HANDLE token);
89
90 /// <summary>
91 /// Configures a COM object for impersonation.
92 /// <summary>
93 void ConfigureForCOMImpersonation(IUnknown* instance);
94
95 /// <summary>
96 /// Enables a privilege on the token.
97 /// </summary>
98 LUID EnableTokenPrivilege(_Inout_ HANDLE token, _In_ LPCWSTR privilegeName);
99
100 /// <summary>
101 /// Returns the basic integrity level for provided token.
102 /// </summary>
103 DWORD GetUserBasicIntegrityLevel(_In_ HANDLE token);
104
105 /// <summary>
106 /// Returns the user token for the current client.
107 /// </summary>
108 wil::unique_handle GetUserToken(_In_ TOKEN_TYPE tokenType, _In_ RPC_BINDING_HANDLE handle = nullptr);
109
110 /// <summary>
111 /// Queries if the provided token is elevated.
112 /// </summary>
113 bool IsTokenElevated(_In_ HANDLE token);
114
115 /// <summary>
116 /// Returns true if the provided token is a member of the localsystem group
117 /// </summary>
118 bool IsTokenLocalSystem(_In_opt_ HANDLE token);
119
120 /// <summary>
121 /// Impersonates the RPC caller
122 /// </summary>
123 unique_revert_to_self RpcImpersonateCaller(_In_ RPC_BINDING_HANDLE handle);
124 } // namespace wsl::windows::common::security