Skip to content

proof: Write Restricted Code SID is load-bearing #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
marksverdhei wants to merge 1 commit into from
Closed

proof: Write Restricted Code SID is load-bearing #49

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 3 additions & 9 deletions codex-rs/windows-sandbox-rs/src/token.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ const LUA_TOKEN: u32 = 0x04;
const WRITE_RESTRICTED: u32 = 0x08;
const GENERIC_ALL: u32 = 0x1000_0000;
const WIN_WORLD_SID: i32 = 1;
#[allow(dead_code)]
const WIN_WRITE_RESTRICTED_CODE_SID: i32 = 70;
const SE_GROUP_LOGON_ID: u32 = 0xC0000000;

Expand Down Expand Up @@ -441,15 +442,10 @@ unsafe fn create_token_with_caps_from(
let psid_logon = logon_sid_bytes.as_mut_ptr() as *mut c_void;
let mut everyone = world_sid()?;
let psid_everyone = everyone.as_mut_ptr() as *mut c_void;
let mut write_restricted_code = well_known_sid(WIN_WRITE_RESTRICTED_CODE_SID)?;
let psid_write_restricted_code = write_restricted_code.as_mut_ptr() as *mut c_void;

// The logon SID keeps private desktop and session-scoped IPC access
// available. Write Restricted Code permits operating-system resources
// intended for write-restricted processes without letting a world-writable
// host ACL satisfy the restricting access check.
// The logon SID keeps private desktop and session-scoped IPC access available.
let mut entries: Vec<SID_AND_ATTRIBUTES> =
vec![std::mem::zeroed(); psid_capabilities.len() + extra_restricting_sids.len() + 2];
vec![std::mem::zeroed(); psid_capabilities.len() + extra_restricting_sids.len() + 1];
for (i, psid) in psid_capabilities.iter().enumerate() {
entries[i].Sid = *psid;
entries[i].Attributes = 0;
Expand All @@ -462,8 +458,6 @@ unsafe fn create_token_with_caps_from(
let logon_idx = extras_idx + extra_restricting_sids.len();
entries[logon_idx].Sid = psid_logon;
entries[logon_idx].Attributes = 0;
entries[logon_idx + 1].Sid = psid_write_restricted_code;
entries[logon_idx + 1].Attributes = 0;

let mut new_token: HANDLE = 0;
let flags = DISABLE_MAX_PRIVILEGE | LUA_TOKEN | WRITE_RESTRICTED;
Expand Down
Loading