# - XFLAGS=/DDEBUG
# Causes PuTTY to enable internal debugging.
#
+# - XFLAGS=/DUNPROTECT
+# Disable tightened ACL on PuTTY process so that e.g. debuggers
+# can attach to it.
+#
# - XFLAGS=/DMALLOC_LOG
# Causes PuTTY to emit a file called putty_mem.log, logging every
# memory allocation and free, so you can track memory leaks.
+ sshdh sshcrcda sshpubk sshzlib sshdss x11fwd portfwd
+ sshaes sshccp sshsh256 sshsh512 sshbn wildcard pinger ssharcf
+ sshgssc pgssapi sshshare sshecc
-WINSSH = SSH winnoise winsecur winpgntc wingss winshare winnps winnpc
+WINSSH = SSH winnoise wincapi winpgntc wingss winshare winnps winnpc
+ winhsock errsock
UXSSH = SSH uxnoise uxagentc uxgss uxshare
# Pageant or PuTTYgen).
MISC = timing callback misc version settings tree234 proxy conf be_misc
WINMISC = MISC winstore winnet winhandl cmdline windefs winmisc winproxy
- + wintime winhsock errsock
+ + wintime winhsock errsock winsecur
UXMISC = MISC uxstore uxsel uxnet uxpeer cmdline uxmisc uxproxy time
OSXMISC = MISC uxstore uxsel osxsel uxnet uxpeer uxmisc uxproxy time
#define WINSECUR_GLOBAL
#include "winsecur.h"
+/* Initialised once, then kept around to reuse forever */
+static PSID worldsid, networksid, usersid;
+
+
int got_advapi(void)
{
static int attempted = FALSE;
return successful;
}
-int got_crypt(void)
-{
- static int attempted = FALSE;
- static int successful;
- static HMODULE crypt;
-
- if (!attempted) {
- attempted = TRUE;
- crypt = load_system32_dll("crypt32.dll");
- successful = crypt &&
- GET_WINDOWS_FUNCTION(crypt, CryptProtectMemory);
- }
- return successful;
-}
-
PSID get_user_sid(void)
{
HANDLE proc = NULL, tok = NULL;
return ret;
}
-int make_private_security_descriptor(DWORD permissions,
- PSECURITY_DESCRIPTOR *psd,
- PACL *acl,
- char **error)
+int getsids(char *error)
{
SID_IDENTIFIER_AUTHORITY world_auth = SECURITY_WORLD_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY nt_auth = SECURITY_NT_AUTHORITY;
- EXPLICIT_ACCESS ea[3];
- int acl_err;
- int ret = FALSE;
+ int ret;
- /* Initialised once, then kept around to reuse forever */
- static PSID worldsid, networksid, usersid;
-
- *psd = NULL;
- *acl = NULL;
- *error = NULL;
-
- if (!got_advapi()) {
- *error = dupprintf("unable to load advapi32.dll");
- goto cleanup;
- }
+ error=NULL;
if (!usersid) {
if ((usersid = get_user_sid()) == NULL) {
- *error = dupprintf("unable to construct SID for current user: %s",
+ error = dupprintf("unable to construct SID for current user: %s",
win_strerror(GetLastError()));
goto cleanup;
}
if (!worldsid) {
if (!AllocateAndInitializeSid(&world_auth, 1, SECURITY_WORLD_RID,
0, 0, 0, 0, 0, 0, 0, &worldsid)) {
- *error = dupprintf("unable to construct SID for world: %s",
+ error = dupprintf("unable to construct SID for world: %s",
win_strerror(GetLastError()));
goto cleanup;
}
if (!networksid) {
if (!AllocateAndInitializeSid(&nt_auth, 1, SECURITY_NETWORK_RID,
0, 0, 0, 0, 0, 0, 0, &networksid)) {
- *error = dupprintf("unable to construct SID for "
+ error = dupprintf("unable to construct SID for "
"local same-user access only: %s",
win_strerror(GetLastError()));
goto cleanup;
}
}
+ ret=TRUE;
+
+ cleanup:
+ if (ret) {
+ sfree(error);
+ error = NULL;
+ }
+ return ret;
+}
+
+
+int make_private_security_descriptor(DWORD permissions,
+ PSECURITY_DESCRIPTOR *psd,
+ PACL *acl,
+ char **error)
+{
+ SID_IDENTIFIER_AUTHORITY world_auth = SECURITY_WORLD_SID_AUTHORITY;
+ SID_IDENTIFIER_AUTHORITY nt_auth = SECURITY_NT_AUTHORITY;
+ EXPLICIT_ACCESS ea[3];
+ int acl_err;
+ int ret = FALSE;
+
+
+ *psd = NULL;
+ *acl = NULL;
+ *error = NULL;
+
+ if (!getsids(*error))
+ goto cleanup;
+
memset(ea, 0, sizeof(ea));
ea[0].grfAccessPermissions = permissions;
ea[0].grfAccessMode = REVOKE_ACCESS;
return ret;
}
+int setprocessacl(char *error)
+{
+ SID_IDENTIFIER_AUTHORITY world_auth = SECURITY_WORLD_SID_AUTHORITY;
+ SID_IDENTIFIER_AUTHORITY nt_auth = SECURITY_NT_AUTHORITY;
+ EXPLICIT_ACCESS ea[2];
+ int acl_err;
+ int ret=FALSE;
+ PACL acl = NULL;
+
+ static const nastyace=WRITE_DAC | WRITE_OWNER |
+ PROCESS_CREATE_PROCESS | PROCESS_CREATE_THREAD |
+ PROCESS_DUP_HANDLE | PROCESS_QUERY_INFORMATION |
+ PROCESS_SET_QUOTA | PROCESS_SET_INFORMATION |
+ PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE |
+ PROCESS_SUSPEND_RESUME;
+
+ if (!getsids(error))
+ goto cleanup;
+
+ memset(ea, 0, sizeof(ea));
+
+ /* Everyone: deny */
+ ea[0].grfAccessPermissions = nastyace;
+ ea[0].grfAccessMode = DENY_ACCESS;
+ ea[0].grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
+ ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
+ ea[0].Trustee.ptstrName = (LPTSTR)worldsid;
+
+ /* User: user ace */
+ ea[1].grfAccessPermissions = ~nastyace & 0x1fff;
+ ea[1].grfAccessMode = GRANT_ACCESS;
+ ea[1].grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
+ ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
+ ea[1].Trustee.ptstrName = (LPTSTR)usersid;
+
+ acl_err = p_SetEntriesInAclA(2, ea, NULL, &acl);
+
+ if (acl_err != ERROR_SUCCESS || acl == NULL) {
+ error = dupprintf("unable to construct ACL: %s",
+ win_strerror(acl_err));
+ goto cleanup;
+ }
+
+ if (ERROR_SUCCESS !=
+ SetSecurityInfo(
+ GetCurrentProcess(),
+ SE_KERNEL_OBJECT,
+ OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
+ usersid,
+ NULL,
+ acl,
+ NULL
+ )) {
+ error=dupprintf("Unable to set process ACL: %s",
+ win_strerror(GetLastError()));
+ goto cleanup;
+ }
+
+
+ ret=TRUE;
+
+ cleanup:
+ if (!ret) {
+ if (acl) {
+ LocalFree(acl);
+ acl = NULL;
+ }
+ }
+ return ret;
+}
#endif /* !defined NO_SECURITY */
projects / PuTTY.git / commitdiff