mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 1841629 p1: Make USER_RESTRICTED_NON_ADMIN allow for use_restricting_sids settings. r=handyman 

Differential Revision: https://phabricator.services.mozilla.com/D182998
This commit is contained in:
Bob Owen 2023-07-10 08:00:19 +00:00
Родитель a5a680e7e5
Коммит abe79cb63d
2 изменённых файлов: 34 добавлений и 8 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

26
security/sandbox/chromium-shim/patches/with_update/add_option_to_not_use_restricting_sids.patch
Просмотреть файл

@ -56,7 +56,31 @@ diff --git a/security/sandbox/chromium/sandbox/win/src/restricted_token_utils.cc
sid_exceptions.push_back(WinWorldSid);
sid_exceptions.push_back(WinInteractiveSid);
sid_exceptions.push_back(WinAuthenticatedUserSid);
@@ -108,49 +112,57 @@ DWORD CreateRestrictedToken(HANDLE effec
@@ -108,64 +112,74 @@ DWORD CreateRestrictedToken(HANDLE effec
break;
}
case USER_RESTRICTED_NON_ADMIN: {
sid_exceptions.push_back(WinBuiltinUsersSid);
sid_exceptions.push_back(WinWorldSid);
sid_exceptions.push_back(WinInteractiveSid);
sid_exceptions.push_back(WinAuthenticatedUserSid);
privilege_exceptions.push_back(SE_CHANGE_NOTIFY_NAME);
- restricted_token.AddRestrictingSid(WinBuiltinUsersSid);
- restricted_token.AddRestrictingSid(WinWorldSid);
- restricted_token.AddRestrictingSid(WinInteractiveSid);
- restricted_token.AddRestrictingSid(WinAuthenticatedUserSid);
- restricted_token.AddRestrictingSid(WinRestrictedCodeSid);
- restricted_token.AddRestrictingSidCurrentUser();
- restricted_token.AddRestrictingSidLogonSession();
+ if (use_restricting_sids) {
+ restricted_token.AddRestrictingSid(WinBuiltinUsersSid);
+ restricted_token.AddRestrictingSid(WinWorldSid);
+ restricted_token.AddRestrictingSid(WinInteractiveSid);
+ restricted_token.AddRestrictingSid(WinAuthenticatedUserSid);
+ restricted_token.AddRestrictingSid(WinRestrictedCodeSid);
+ restricted_token.AddRestrictingSidCurrentUser();
+ restricted_token.AddRestrictingSidLogonSession();
+ }
break;
}
case USER_INTERACTIVE: {

2
security/sandbox/chromium/sandbox/win/src/restricted_token_utils.cc
Просмотреть файл

@ -109,6 +109,7 @@ DWORD CreateRestrictedToken(HANDLE effective_token,
sid_exceptions.push_back(WinInteractiveSid);
sid_exceptions.push_back(WinAuthenticatedUserSid);
privilege_exceptions.push_back(SE_CHANGE_NOTIFY_NAME);
if (use_restricting_sids) {
restricted_token.AddRestrictingSid(WinBuiltinUsersSid);
restricted_token.AddRestrictingSid(WinWorldSid);
restricted_token.AddRestrictingSid(WinInteractiveSid);
@ -116,6 +117,7 @@ DWORD CreateRestrictedToken(HANDLE effective_token,
restricted_token.AddRestrictingSid(WinRestrictedCodeSid);
restricted_token.AddRestrictingSidCurrentUser();
restricted_token.AddRestrictingSidLogonSession();
}
break;
}
case USER_INTERACTIVE: {