nrubsig.kpaste.net RSS
Difference between
modified post 928609bd by Anonymous on Fri 24th May 2024 13:38
original post 7e33d2 by Anonymous on Fri 24th May 2024 13:11
Download diff
Show
old version |
new version |
both versions
| 1 | 1 | ||
| 2 | 2 | /* | |
| 3 | 3 | * MIT License | |
| 4 | 4 | * | |
| 5 | 5 | * Copyright (c) 2024 Roland Mainz <roland.mainz@nrubsig.org> | |
| 6 | 6 | * | |
| 7 | 7 | * Permission is hereby granted, free of charge, to any person obtaining a copy | |
| 8 | 8 | * of this software and associated documentation files (the "Software"), to deal | |
| 9 | 9 | * in the Software without restriction, including without limitation the rights | |
| 10 | 10 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | |
| 11 | 11 | * copies of the Software, and to permit persons to whom the Software is | |
| 12 | 12 | * furnished to do so, subject to the following conditions: | |
| 13 | 13 | * | |
| 14 | 14 | * The above copyright notice and this permission notice shall be included in all | |
| 15 | 15 | * copies or substantial portions of the Software. | |
| 16 | 16 | * | |
| 17 | 17 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
| 18 | 18 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
| 19 | 19 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | |
| 20 | 20 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
| 21 | 21 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | |
| 22 | 22 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | |
| 23 | 23 | * SOFTWARE. | |
| 24 | 24 | */ | |
| 25 | 25 | ||
| 26 | 26 | /* | |
| 27 | 27 | * winsg.c - run Win32 or Cygwin program with a different group | |
| 28 | 28 | * | |
| 29 | 29 | * Written by Roland Mainz <roland.mainz@nrubsig.org> | |
| 30 | 30 | */ | |
| 31 | 31 | ||
| 32 | 32 | #include <windows.h> | |
| 33 | 33 | #include <stdio.h> | |
| 34 | 34 | #include <stdbool.h> | |
| 35 | 35 | #include <Lmcons.h> | |
| 36 | 36 | #include <process.h> | |
| 37 | 37 | ||
| 38 | 38 | /* | |
| 39 | 39 | * Performance hack: | |
| 40 | 40 | * GETTOKINFO_EXTRA_BUFFER - extra space for more data | |
| 41 | 41 | * |GetTokenInformation()| for |TOKEN_USER| and |TOKEN_PRIMARY_GROUP| | |
| 42 | 42 | * always fails in Win10 with |ERROR_INSUFFICIENT_BUFFER| if you | |
| 43 | 43 | * just pass the |sizeof(TOKEN_*)| value. Instead of calling | |
| 44 | 44 | * |GetTokenInformation()| with |NULL| arg to obtain the size to | |
| 45 | 45 | * allocate we just provide 2048 bytes of extra space after the | |
| 46 | 46 | * |TOKEN_*| size, and pray it is enough | |
| 47 | 47 | */ | |
| 48 | 48 | #define GETTOKINFO_EXTRA_BUFFER (2048) | |
| 49 | 49 | ||
| 50 | 50 | bool get_token_primarygroup_name(HANDLE tok, char *out_buffer) | |
| 51 | 51 | { | |
| 52 | 52 | DWORD tokdatalen; | |
| 53 | 53 | PTOKEN_PRIMARY_GROUP ptpgroup; | |
| 54 | 54 | PSID pgsid; | |
| 55 | 55 | DWORD namesize = GNLEN+1; | |
| 56 | 56 | char domainbuffer[UNLEN+1]; | |
| 57 | 57 | DWORD domainbuffer_size = sizeof(domainbuffer); | |
| 58 | 58 | SID_NAME_USE name_use; | |
| 59 | 59 | ||
| 60 | 60 | tokdatalen = sizeof(TOKEN_PRIMARY_GROUP)+GETTOKINFO_EXTRA_BUFFER; | |
| 61 | 61 | ptpgroup = _alloca(tokdatalen); | |
| 62 | 62 | if (!GetTokenInformation(tok, TokenPrimaryGroup, ptpgroup, | |
| 63 | 63 | tokdatalen, &tokdatalen)) { | |
| 64 | 64 | (void)fprintf(stderr, "get_token_primarygroup_name: " | |
| 65 | 65 | "GetTokenInformation(tok=0x%p, TokenPrimaryGroup) failed, " | |
| 66 | 66 | "status=%d\n", | |
| 67 | 67 | (void *)tok, (int)GetLastError()); | |
| 68 | 68 | return false; | |
| 69 | 69 | } | |
| 70 | 70 | ||
| 71 | 71 | pgsid = ptpgroup->PrimaryGroup; | |
| 72 | 72 | ||
| 73 | 73 | if (!LookupAccountSidA(NULL, pgsid, out_buffer, &namesize, | |
| 74 | 74 | domainbuffer, &domainbuffer_size, &name_use)) { | |
| 75 | 75 | (void)fprintf(stderr, "get_token_primarygroup_name: " | |
| 76 | 76 | "LookupAccountSidA() failed, status=%d\n", | |
| 77 | 77 | (int)GetLastError()); | |
| 78 | 78 | return false; | |
| 79 | 79 | } | |
| 80 | 80 | ||
| 81 | 81 | return true; | |
| 82 | 82 | } | |
| 83 | 83 | ||
| 84 | - | bool set_token_primarygroup_name(HANDLE tok, const char *new_groupname) | |
| 84 | + | bool is_group_in_token(HANDLE tok, PSID qsid) | |
| 85 | 85 | { | |
| 86 | 86 | DWORD tokdatalen; | |
| 87 | - | TOKEN_PRIMARY_GROUP tpgroup; | |
| 87 | + | PTOKEN_GROUPS ptgroups; | |
| 94 | 88 | ||
| 95 | - | if (!LookupAccountNameA(NULL, new_groupname, | |
| 89 | + | tokdatalen = sizeof(TOKEN_GROUPS)+GETTOKINFO_EXTRA_BUFFER; | |
| 96 | - | pgsid, &pgsid_size, domainbuffer, &domainbuffer_size, &name_use)) { | |
| 90 | + | ptgroups = _alloca(tokdatalen); | |
| 97 | - | (void)fprintf(stderr, "set_token_primarygroup_name: " | |
| 91 | + | if (!GetTokenInformation(tok, TokenGroups, ptgroups, | |
| 98 | - | "LookupAccountNameA() failed.\n"); | |
| 92 | + | tokdatalen, &tokdatalen)) { | |
| 93 | + | (void)fprintf(stderr, "is_group_in_token: " | |
| 99 | 97 | return false; | |
| 100 | 98 | } | |
| 101 | 99 | ||
| 102 | - | tokdatalen = sizeof(TOKEN_PRIMARY_GROUP); | |
| 100 | + | int i; | |
| 103 | - | tpgroup.PrimaryGroup = pgsid; | |
| 101 | + | (void)fprintf(stderr, "is_group_in_token: got %d groups\n", (int)ptgroups->GroupCount); | |
| 104 | - | if (!SetTokenInformation(tok, TokenPrimaryGroup, | |
| 102 | + | for (i = 0 ; i < ptgroups->GroupCount ; i++) { | |
| 105 | - | &tpgroup, tokdatalen)) { | |
| 103 | + | if (EqualSid(qsid, ptgroups->Groups[i].Sid) && | |
| 106 | - | (void)fprintf(stderr, "set_token_primarygroup_name: " | |
| 104 | + | (ptgroups->Groups[i].Attributes & SE_GROUP_ENABLED)) { | |
| 107 | - | "SetTokenInformation(tok=0x%p, TokenPrimaryGroup) failed, " | |
| 105 | + | (void)puts("#match"); | |
| 106 | + | return true; | |
| 111 | 107 | } | |
| 108 | + | } | |
| 112 | 109 | ||
| 113 | - | return true; | |
| 110 | + | (void)puts("#no match"); | |
| 115 | 111 | ||
| 116 | - | enum shelltype { | |
| 112 | + | return false; | |
| 117 | - | SHELLTYPE_NOT_SET = 0, | |
| 113 | + | } | |
| 122 | 114 | ||
| 123 | - | int main(int ac, char *av[]) | |
| 115 | + | bool set_token_primarygroup_name(HANDLE tok, const char *new_groupname) | |
| 124 | 116 | { | |
| 125 | - | char pgroupname[GNLEN+1]; | |
| 117 | + | DWORD tokdatalen; | |
| 126 | - | enum shelltype st = SHELLTYPE_NOT_SET; | |
| 118 | + | TOKEN_PRIMARY_GROUP tpgroup; | |
| 127 | - | int cmd_arg_index = -1; | |
| 119 | + | char sidbuff[SECURITY_MAX_SID_SIZE+1]; | |
| 128 | - | const char *newgrpname = NULL; | |
| 120 | + | PSID pgsid = (PSID)sidbuff; | |
| 129 | - | int subcmdret = EXIT_FAILURE; | |
| 121 | + | DWORD pgsid_size = sizeof(sidbuff); | |
| 122 | + | char domainbuffer[UNLEN+1]; | |
| 130 | 125 | ||
| 131 | - | int i; | |
| 126 | + | if (!LookupAccountNameA(NULL, new_groupname, | |
| 127 | + | pgsid, &pgsid_size, domainbuffer, &domainbuffer_size, &name_use)) { | |
| 132 | 132 | ||
| 133 | - | for (i=1 ; i < ac ; i++) { | |
| 133 | + | #if 1 | |
| 134 | - | (void)fprintf(stderr, "# i=%d, av[i]='%s'\n", i, av[i]); | |
| 134 | + | if (!is_group_in_token(tok, pgsid)) { | |
| 135 | - | ||
| 135 | + | (void)fprintf(stderr, "set_token_primarygroup_name: " | |
| 136 | - | if (!strcmp(av[i], "-")) { | |
| 136 | + | "group '%s' is not a member.\n", new_groupname); | |
| 137 | - | (void)fprintf(stderr, "%s: Run in new login not supported yet.\n", av[0]); | |
| 137 | + | return false; | |
| 139 | 138 | } | |
| 140 | - | else if (!strcmp(av[i], "-c")) { | |
| 139 | + | #else | |
| 141 | - | st = SHELLTYPE_SYSTEM; | |
| 140 | + | BOOL is_member = FALSE; | |
| 142 | - | cmd_arg_index = i+1; | |
| 141 | + | if (!CheckTokenMembership(tok, pgsid, &is_member)) { | |
| 143 | - | break; | |
| 142 | + | (void)fprintf(stderr, "set_token_primarygroup_name: " | |
| 143 | + | "CheckTokenMembership() failed, status=%d.\n", (int)GetLastError()); | |
| 144 | 145 | } | |
| 145 | - | else if (!strcmp(av[i], "/C")) { | |
| 146 | + | ||
| 146 | - | st = SHELLTYPE_CMD; | |
| 147 | + | if (!is_member) { | |
| 147 | - | cmd_arg_index = i+1; | |
| 148 | + | (void)fprintf(stderr, "set_token_primarygroup_name: " | |
| 148 | - | break; | |
| 149 | + | "group '%s' is not a member.\n", new_groupname); | |
| 150 | + | return false; | |
| 149 | 151 | } | |
| 150 | - | else if (!strcmp(av[i], "-g")) { | |
| 152 | + | #endif | |
| 159 | 153 | ||
| 160 | - | cmd_arg_index = i+1; | |
| 154 | + | tokdatalen = sizeof(TOKEN_PRIMARY_GROUP); | |
| 161 | - | st = SHELLTYPE_NONE; | |
| 155 | + | tpgroup.PrimaryGroup = pgsid; | |
| 162 | - | break; | |
| 156 | + | if (!SetTokenInformation(tok, TokenPrimaryGroup, | |
| 157 | + | &tpgroup, tokdatalen)) { | |
| 163 | 163 | } | |
| 164 | + |
Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.