mirror of
https://github.com/henrypp/simplewall.git
synced 2026-10-22 11:03:28 -05:00
606 lines
16 KiB
C
606 lines
16 KiB
C
// simplewall
|
|
// Copyright (c) 2020-2023 Henry++
|
|
|
|
#include "global.h"
|
|
|
|
_Ret_maybenull_
|
|
PSID _app_quyerybuiltinsid (
|
|
_In_ WELL_KNOWN_SID_TYPE sid_type
|
|
)
|
|
{
|
|
PSID sid;
|
|
ULONG sid_length;
|
|
|
|
sid_length = SECURITY_MAX_SID_SIZE;
|
|
sid = _r_mem_allocate (sid_length);
|
|
|
|
if (!CreateWellKnownSid (sid_type, NULL, sid, &sid_length))
|
|
{
|
|
_r_log_v (LOG_LEVEL_ERROR, NULL, L"CreateWellKnownSid", GetLastError (), L"%" TEXT (PRIu32), sid_type);
|
|
|
|
_r_mem_free (sid);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
return sid;
|
|
}
|
|
|
|
VOID _app_generate_credentials ()
|
|
{
|
|
R_STRINGREF service_name;
|
|
|
|
// For revoke current user (v3.0.5 Beta and lower)
|
|
if (!config.pbuiltin_current_sid)
|
|
config.pbuiltin_current_sid = _r_sys_getcurrenttoken ().token_sid;
|
|
|
|
// S-1-5-32-544 (BUILTIN\Administrators)
|
|
if (!config.pbuiltin_admins_sid)
|
|
config.pbuiltin_admins_sid = _app_quyerybuiltinsid (WinBuiltinAdministratorsSid);
|
|
|
|
// S-1-5-32-556 (BUILTIN\Network Configuration Operators)
|
|
if (!config.pbuiltin_netops_sid)
|
|
config.pbuiltin_netops_sid = _app_quyerybuiltinsid (WinBuiltinNetworkConfigurationOperatorsSid);
|
|
|
|
if (!config.pservice_mpssvc_sid)
|
|
{
|
|
_r_obj_initializestringref (&service_name, L"mpssvc");
|
|
|
|
_r_sys_getservicesid (&service_name, &config.pservice_mpssvc_sid);
|
|
}
|
|
|
|
if (!config.pservice_nlasvc_sid)
|
|
{
|
|
_r_obj_initializestringref (&service_name, L"NlaSvc");
|
|
|
|
_r_sys_getservicesid (&service_name, &config.pservice_nlasvc_sid);
|
|
}
|
|
|
|
if (!config.pservice_policyagent_sid)
|
|
{
|
|
_r_obj_initializestringref (&service_name, L"PolicyAgent");
|
|
|
|
_r_sys_getservicesid (&service_name, &config.pservice_policyagent_sid);
|
|
}
|
|
|
|
if (!config.pservice_rpcss_sid)
|
|
{
|
|
_r_obj_initializestringref (&service_name, L"RpcSs");
|
|
|
|
_r_sys_getservicesid (&service_name, &config.pservice_rpcss_sid);
|
|
}
|
|
|
|
if (!config.pservice_wdiservicehost_sid)
|
|
{
|
|
_r_obj_initializestringref (&service_name, L"WdiServiceHost");
|
|
|
|
_r_sys_getservicesid (&service_name, &config.pservice_wdiservicehost_sid);
|
|
}
|
|
}
|
|
|
|
_Ret_maybenull_
|
|
PACL _app_createaccesscontrollist (
|
|
_In_ PACL acl,
|
|
_In_ BOOLEAN is_secure
|
|
)
|
|
{
|
|
EXPLICIT_ACCESS ea[3] = {0};
|
|
PACL new_dacl;
|
|
PACCESS_ALLOWED_ACE ace;
|
|
BOOLEAN is_secured = FALSE;
|
|
BOOLEAN is_currentuserhaverights = FALSE;
|
|
BOOLEAN is_openforeveryone = FALSE;
|
|
ULONG count;
|
|
ULONG status;
|
|
|
|
for (WORD ace_index = 0; ace_index < acl->AceCount; ace_index++)
|
|
{
|
|
ace = NULL;
|
|
|
|
if (!GetAce (acl, ace_index, &ace))
|
|
continue;
|
|
|
|
if (ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE)
|
|
{
|
|
// versions of SW before v3.0.5 added Carte blanche for current user
|
|
//
|
|
// src: https://github.com/henrypp/simplewall/blob/v.2.3.12/src/main.cpp#L8273
|
|
// src: https://github.com/henrypp/simplewall/blob/v.2.3.13/src/main.cpp#L8354
|
|
// src: https://github.com/henrypp/simplewall/blob/v.2.4.6/src/main.cpp#L8828
|
|
// src: https://github.com/henrypp/simplewall/blob/v.3.0.5/src/wfp.cpp#L109
|
|
if (RtlEqualSid (&ace->SidStart, config.pbuiltin_current_sid))
|
|
{
|
|
if ((ace->Mask & (FWPM_GENERIC_EXECUTE | FWPM_GENERIC_WRITE | DELETE | WRITE_DAC | WRITE_OWNER)) != 0)
|
|
is_currentuserhaverights = TRUE;
|
|
}
|
|
|
|
// versions of SW before v3.1.1 added Carte blanche for Everyone
|
|
//
|
|
// src: https://github.com/henrypp/simplewall/blob/v.2.4.6/src/main.cpp#L8833
|
|
// src: https://github.com/henrypp/simplewall/blob/v.3.0.5/src/wfp.cpp#L114
|
|
// src: https://github.com/henrypp/simplewall/blob/v.3.1.1/src/wfp.cpp#L150
|
|
else if (RtlEqualSid (&ace->SidStart, &SeEveryoneSid))
|
|
{
|
|
if (((ace->Mask & ~(FWPM_ACTRL_CLASSIFY | FWPM_ACTRL_OPEN)) & (FWPM_GENERIC_EXECUTE | FWPM_GENERIC_READ)) != 0)
|
|
is_openforeveryone = TRUE;
|
|
}
|
|
}
|
|
else if (ace->Header.AceType == ACCESS_DENIED_ACE_TYPE)
|
|
{
|
|
if (RtlEqualSid (&ace->SidStart, &SeEveryoneSid))
|
|
{
|
|
if ((ace->Mask == (FWPM_ACTRL_WRITE | DELETE | WRITE_DAC | WRITE_OWNER)))
|
|
is_secured = TRUE;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (is_openforeveryone || is_currentuserhaverights || is_secured != is_secure)
|
|
{
|
|
count = 0;
|
|
|
|
// revoke current user access rights
|
|
if (is_currentuserhaverights)
|
|
_app_setexplicitaccess (&ea[count++], REVOKE_ACCESS, 0, NO_INHERITANCE, config.pbuiltin_current_sid);
|
|
|
|
// revoke everyone access rights
|
|
if (is_openforeveryone)
|
|
_app_setexplicitaccess (&ea[count++], REVOKE_ACCESS, 0, NO_INHERITANCE, &SeEveryoneSid);
|
|
|
|
// secure filter from deletion
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
is_secure ? DENY_ACCESS : GRANT_ACCESS,
|
|
FWPM_ACTRL_WRITE | DELETE | WRITE_DAC | WRITE_OWNER,
|
|
is_secure ? CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE : NO_INHERITANCE,
|
|
&SeEveryoneSid
|
|
);
|
|
|
|
status = SetEntriesInAcl (count, ea, acl, &new_dacl);
|
|
|
|
if (status == ERROR_SUCCESS)
|
|
return new_dacl;
|
|
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"SetEntriesInAcl", status, NULL);
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
VOID _app_setexplicitaccess (
|
|
_Out_ PEXPLICIT_ACCESS ea,
|
|
_In_ ACCESS_MODE mode,
|
|
_In_ ULONG rights,
|
|
_In_ ULONG inheritance,
|
|
_In_opt_ PSID sid
|
|
)
|
|
{
|
|
ea->grfAccessMode = mode;
|
|
ea->grfAccessPermissions = rights;
|
|
ea->grfInheritance = inheritance;
|
|
|
|
RtlZeroMemory (&(ea->Trustee), sizeof (ea->Trustee));
|
|
|
|
BuildTrusteeWithSid (&(ea->Trustee), sid);
|
|
}
|
|
|
|
VOID _app_setsecurityinfoforengine (
|
|
_In_ HANDLE hengine
|
|
)
|
|
{
|
|
PSECURITY_DESCRIPTOR security_descriptor;
|
|
PACCESS_ALLOWED_ACE ace;
|
|
EXPLICIT_ACCESS ea[18] = {0};
|
|
PACL new_dacl;
|
|
PSID sid_owner;
|
|
PSID sid_group;
|
|
PACL dacl;
|
|
PACL sacl;
|
|
ULONG count;
|
|
BOOLEAN is_currentuserhaverights = FALSE;
|
|
BOOLEAN is_openforeveryone = FALSE;
|
|
ULONG status;
|
|
|
|
status = FwpmEngineGetSecurityInfo (hengine, DACL_SECURITY_INFORMATION, &sid_owner, &sid_group, &dacl, &sacl, &security_descriptor);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
{
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmEngineGetSecurityInfo", status, NULL);
|
|
|
|
return;
|
|
}
|
|
|
|
if (dacl)
|
|
{
|
|
for (WORD ace_index = 0; ace_index < dacl->AceCount; ace_index++)
|
|
{
|
|
ace = NULL;
|
|
|
|
if (!GetAce (dacl, ace_index, &ace))
|
|
continue;
|
|
|
|
if (ace->Header.AceType != ACCESS_ALLOWED_ACE_TYPE)
|
|
continue;
|
|
|
|
// versions of SW before v3.0.5 added Carte blanche for current user
|
|
//
|
|
// src: https://github.com/henrypp/simplewall/blob/v.2.3.12/src/main.cpp#L8273
|
|
// src: https://github.com/henrypp/simplewall/blob/v.2.3.13/src/main.cpp#L8354
|
|
// src: https://github.com/henrypp/simplewall/blob/v.2.4.6/src/main.cpp#L8815
|
|
// src: https://github.com/henrypp/simplewall/blob/v.3.0.5/src/wfp.cpp#L96
|
|
if (RtlEqualSid (&ace->SidStart, config.pbuiltin_current_sid))
|
|
{
|
|
if ((ace->Mask == (FWPM_GENERIC_ALL | DELETE | WRITE_DAC | WRITE_OWNER)))
|
|
is_currentuserhaverights = TRUE;
|
|
}
|
|
|
|
// versions of SW before v3.1.1 added Carte blanche for Everyone
|
|
//
|
|
// src: https://github.com/henrypp/simplewall/blob/v.2.4.6/src/main.cpp#L8820
|
|
// src: https://github.com/henrypp/simplewall/blob/v.3.0.5/src/wfp.cpp#L101
|
|
// src: https://github.com/henrypp/simplewall/blob/v.3.1.1/src/wfp.cpp#L137
|
|
else if (RtlEqualSid (&ace->SidStart, &SeEveryoneSid))
|
|
{
|
|
if (((ace->Mask & ~(FWPM_ACTRL_CLASSIFY | FWPM_ACTRL_OPEN)) & (FWPM_GENERIC_ALL)) != 0)
|
|
is_openforeveryone = TRUE;
|
|
}
|
|
}
|
|
|
|
if (is_currentuserhaverights || is_openforeveryone)
|
|
{
|
|
FwpmEngineSetSecurityInfo (hengine, OWNER_SECURITY_INFORMATION, &SeLocalServiceSid, NULL, NULL, NULL);
|
|
|
|
FwpmNetEventsSetSecurityInfo (hengine, OWNER_SECURITY_INFORMATION, &SeLocalServiceSid, NULL, NULL, NULL);
|
|
|
|
count = 0;
|
|
|
|
// revoke current user access rights
|
|
if (is_currentuserhaverights)
|
|
{
|
|
if (config.pbuiltin_current_sid)
|
|
_app_setexplicitaccess (&ea[count++], REVOKE_ACCESS, 0, NO_INHERITANCE, config.pbuiltin_current_sid);
|
|
}
|
|
|
|
// reset default engine rights
|
|
if (is_openforeveryone)
|
|
{
|
|
if (config.pbuiltin_admins_sid)
|
|
{
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
FWPM_GENERIC_ALL | DELETE | WRITE_DAC | WRITE_OWNER, NO_INHERITANCE,
|
|
config.pbuiltin_admins_sid
|
|
);
|
|
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
0x10000000,
|
|
OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
|
|
config.pbuiltin_admins_sid
|
|
);
|
|
}
|
|
|
|
if (config.pbuiltin_netops_sid)
|
|
{
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
FWPM_GENERIC_ALL | DELETE,
|
|
NO_INHERITANCE,
|
|
config.pbuiltin_netops_sid
|
|
);
|
|
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
0xE0000000,
|
|
OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
|
|
config.pbuiltin_netops_sid
|
|
);
|
|
}
|
|
|
|
if (config.pservice_mpssvc_sid)
|
|
{
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
FWPM_GENERIC_ALL | DELETE,
|
|
NO_INHERITANCE,
|
|
config.pservice_mpssvc_sid->buffer
|
|
);
|
|
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
0xE0000000,
|
|
OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
|
|
config.pservice_mpssvc_sid->buffer
|
|
);
|
|
}
|
|
|
|
if (config.pservice_nlasvc_sid)
|
|
{
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
FWPM_GENERIC_READ | FWPM_GENERIC_EXECUTE,
|
|
NO_INHERITANCE,
|
|
config.pservice_nlasvc_sid->buffer
|
|
);
|
|
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
0xA0000000,
|
|
OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
|
|
config.pservice_nlasvc_sid->buffer
|
|
);
|
|
}
|
|
|
|
if (config.pservice_policyagent_sid)
|
|
{
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
FWPM_GENERIC_ALL | DELETE,
|
|
NO_INHERITANCE,
|
|
config.pservice_policyagent_sid->buffer
|
|
);
|
|
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
0xE0000000,
|
|
OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
|
|
config.pservice_policyagent_sid->buffer
|
|
);
|
|
}
|
|
|
|
if (config.pservice_rpcss_sid)
|
|
{
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
FWPM_GENERIC_ALL | DELETE,
|
|
NO_INHERITANCE,
|
|
config.pservice_rpcss_sid->buffer
|
|
);
|
|
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
0xE0000000,
|
|
OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
|
|
config.pservice_rpcss_sid->buffer
|
|
);
|
|
}
|
|
|
|
if (config.pservice_wdiservicehost_sid)
|
|
{
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
FWPM_GENERIC_READ | FWPM_GENERIC_EXECUTE,
|
|
NO_INHERITANCE,
|
|
config.pservice_wdiservicehost_sid->buffer
|
|
);
|
|
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
GRANT_ACCESS,
|
|
0xA0000000,
|
|
OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
|
|
config.pservice_wdiservicehost_sid->buffer
|
|
);
|
|
}
|
|
|
|
_app_setexplicitaccess (
|
|
&ea[count++],
|
|
SET_ACCESS,
|
|
FWPM_ACTRL_CLASSIFY | FWPM_ACTRL_OPEN,
|
|
OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE,
|
|
&SeEveryoneSid
|
|
);
|
|
}
|
|
|
|
status = SetEntriesInAcl (count, ea, dacl, &new_dacl);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
{
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"SetEntriesInAcl", status, NULL);
|
|
}
|
|
else
|
|
{
|
|
status = FwpmEngineSetSecurityInfo (hengine, DACL_SECURITY_INFORMATION, NULL, NULL, new_dacl, NULL);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmEngineSetSecurityInfo", status, NULL);
|
|
|
|
status = FwpmNetEventsSetSecurityInfo (hengine, DACL_SECURITY_INFORMATION, NULL, NULL, new_dacl, NULL);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmNetEventsSetSecurityInfo", status, NULL);
|
|
|
|
LocalFree (new_dacl);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (security_descriptor)
|
|
FwpmFreeMemory ((PVOID_PTR)&security_descriptor);
|
|
}
|
|
|
|
VOID _app_setsecurityinfoforprovider (
|
|
_In_ HANDLE hengine,
|
|
_In_ LPCGUID provider_guid,
|
|
_In_ BOOLEAN is_secure
|
|
)
|
|
{
|
|
PSECURITY_DESCRIPTOR security_descriptor;
|
|
PSID sid_owner;
|
|
PSID sid_group;
|
|
PACL dacl;
|
|
PACL sacl;
|
|
PACL new_dacl;
|
|
ULONG status;
|
|
|
|
status = FwpmProviderGetSecurityInfoByKey (hengine, provider_guid, DACL_SECURITY_INFORMATION, &sid_owner, &sid_group, &dacl, &sacl, &security_descriptor);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
{
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmProviderGetSecurityInfoByKey", status, NULL);
|
|
|
|
return;
|
|
}
|
|
|
|
if (dacl)
|
|
{
|
|
new_dacl = _app_createaccesscontrollist (dacl, is_secure);
|
|
|
|
if (new_dacl)
|
|
{
|
|
status = FwpmProviderSetSecurityInfoByKey (hengine, provider_guid, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, (const SID *)config.pbuiltin_admins_sid, NULL, new_dacl, NULL);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmProviderSetSecurityInfoByKey", status, NULL);
|
|
|
|
LocalFree (new_dacl);
|
|
}
|
|
}
|
|
|
|
if (security_descriptor)
|
|
FwpmFreeMemory ((PVOID_PTR)&security_descriptor);
|
|
}
|
|
|
|
VOID _app_setsecurityinfoforsublayer (
|
|
_In_ HANDLE hengine,
|
|
_In_ LPCGUID sublayer_guid,
|
|
_In_ BOOLEAN is_secure
|
|
)
|
|
{
|
|
PSECURITY_DESCRIPTOR security_descriptor;
|
|
PSID sid_owner;
|
|
PSID sid_group;
|
|
PACL dacl;
|
|
PACL sacl;
|
|
PACL new_dacl;
|
|
ULONG status;
|
|
|
|
status = FwpmSubLayerGetSecurityInfoByKey (hengine, sublayer_guid, DACL_SECURITY_INFORMATION, &sid_owner, &sid_group, &dacl, &sacl, &security_descriptor);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
{
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmSubLayerGetSecurityInfoByKey", status, NULL);
|
|
|
|
return;
|
|
}
|
|
|
|
if (dacl)
|
|
{
|
|
new_dacl = _app_createaccesscontrollist (dacl, is_secure);
|
|
|
|
if (new_dacl)
|
|
{
|
|
status = FwpmSubLayerSetSecurityInfoByKey (hengine, sublayer_guid, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, (const SID *)config.pbuiltin_admins_sid, NULL, new_dacl, NULL);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmSubLayerSetSecurityInfoByKey", status, NULL);
|
|
|
|
LocalFree (new_dacl);
|
|
}
|
|
}
|
|
|
|
if (security_descriptor)
|
|
FwpmFreeMemory ((PVOID_PTR)&security_descriptor);
|
|
}
|
|
|
|
VOID _app_setsecurityinfoforcallout (
|
|
_In_ HANDLE hengine,
|
|
_In_ LPCGUID callout_guid,
|
|
_In_ BOOLEAN is_secure
|
|
)
|
|
{
|
|
PSECURITY_DESCRIPTOR security_descriptor;
|
|
PSID sid_owner;
|
|
PSID sid_group;
|
|
PACL dacl;
|
|
PACL sacl;
|
|
PACL new_dacl;
|
|
ULONG status;
|
|
|
|
status = FwpmCalloutGetSecurityInfoByKey (hengine, callout_guid, DACL_SECURITY_INFORMATION, &sid_owner, &sid_group, &dacl, &sacl, &security_descriptor);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
{
|
|
if (status != FWP_E_CALLOUT_NOT_FOUND)
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmCalloutGetSecurityInfoByKey", status, NULL);
|
|
|
|
return;
|
|
}
|
|
|
|
if (dacl)
|
|
{
|
|
new_dacl = _app_createaccesscontrollist (dacl, is_secure);
|
|
|
|
if (new_dacl)
|
|
{
|
|
status = FwpmCalloutSetSecurityInfoByKey (hengine, callout_guid, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, (const SID *)config.pbuiltin_admins_sid, NULL, new_dacl, NULL);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmCalloutSetSecurityInfoByKey", status, NULL);
|
|
|
|
LocalFree (new_dacl);
|
|
}
|
|
}
|
|
|
|
if (security_descriptor)
|
|
FwpmFreeMemory ((PVOID_PTR)&security_descriptor);
|
|
}
|
|
|
|
VOID _app_setsecurityinfoforfilter (
|
|
_In_ HANDLE hengine,
|
|
_In_ LPCGUID filter_guid,
|
|
_In_ BOOLEAN is_secure,
|
|
_In_ LPCWSTR file_name,
|
|
_In_ UINT line
|
|
)
|
|
{
|
|
PSECURITY_DESCRIPTOR security_descriptor;
|
|
PSID sid_owner;
|
|
PSID sid_group;
|
|
PACL dacl;
|
|
PACL sacl;
|
|
PACL new_dacl;
|
|
ULONG status;
|
|
|
|
status = FwpmFilterGetSecurityInfoByKey (hengine, filter_guid, DACL_SECURITY_INFORMATION, &sid_owner, &sid_group, &dacl, &sacl, &security_descriptor);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
{
|
|
// FWP_E_FILTER_NOT_FOUND
|
|
_r_log_v (LOG_LEVEL_ERROR, NULL, L"FwpmFilterSetSecurityInfoByKey", status, L"%s:%" TEXT (PRIu32), DBG_ARG_VAR);
|
|
|
|
return;
|
|
}
|
|
|
|
if (dacl)
|
|
{
|
|
new_dacl = _app_createaccesscontrollist (dacl, is_secure);
|
|
|
|
if (new_dacl)
|
|
{
|
|
status = FwpmFilterSetSecurityInfoByKey (hengine, filter_guid, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, (const SID *)config.pbuiltin_admins_sid, NULL, new_dacl, NULL);
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
_r_log_v (LOG_LEVEL_ERROR, NULL, L"FwpmFilterSetSecurityInfoByKey", status, L"#%" TEXT (PRIu32), line);
|
|
|
|
LocalFree (new_dacl);
|
|
}
|
|
}
|
|
|
|
if (security_descriptor)
|
|
FwpmFreeMemory ((PVOID_PTR)&security_descriptor);
|
|
}
|