Modify CreateRestrictedToken to use better pattern (#40453)
Co-authored-by: Brian Perkins <bperkins@ntdev.microsoft.com>
Brian Perkins committed
May 7, 2026 at 12:29 UTC
d56c3d19c261bbe120c533fe1d33d62d9d41d075
1 file changed
+3
-13
src/windows/common/WslSecurity.cpp
+3
-13
@@ -81,21 +81,11 @@ wil::unique_handle wsl::windows::common::security::CreateRestrictedToken(_In_ HA
81
THROW_IF_WIN32_BOOL_FALSE(::CreateRestrictedToken(newToken.get(), DISABLE_MAX_PRIVILEGE, 0, NULL, 0, NULL, 0, NULL, &restrictedToken));
82
83
// Drop the token down to medium integrity level.
84
- union
85
- {
86
- SID sid;
87
- BYTE buffer[SECURITY_SID_SIZE(1)];
88
- } sidBuffer;
89
- SID_IDENTIFIER_AUTHORITY systemSidAuthority = SECURITY_MANDATORY_LABEL_AUTHORITY;
90
- THROW_IF_NTSTATUS_FAILED(::RtlInitializeSidEx(&sidBuffer.sid, &systemSidAuthority, 1, SECURITY_MANDATORY_MEDIUM_RID));
91
-
92
- // Set the integrity level to untrusted.
84
+ auto [sid, sidBuffer] = wsl::windows::common::security::CreateSid(SECURITY_MANDATORY_LABEL_AUTHORITY, SECURITY_MANDATORY_MEDIUM_RID);
85
TOKEN_MANDATORY_LABEL tokenLabel{};
86
tokenLabel.Label.Attributes = SE_GROUP_INTEGRITY;
95
- tokenLabel.Label.Sid = &sidBuffer.sid;
96
- THROW_IF_WIN32_BOOL_FALSE(::SetTokenInformation(
97
- restrictedToken.get(), TokenIntegrityLevel, &tokenLabel, (sizeof(tokenLabel) + ::GetLengthSid(&sidBuffer.sid))));
98
-
87
+ tokenLabel.Label.Sid = sid;
88
+ THROW_IF_WIN32_BOOL_FALSE(::SetTokenInformation(restrictedToken.get(), TokenIntegrityLevel, &tokenLabel, sizeof(tokenLabel)));
89
return restrictedToken;
90
}
91