ipc: allow admins but require high integrity label

zx2c4 · zx2c4 · commit 15b24b6179e0 · 2021-06-24T17:01:02.000+02:00
Might be more reasonable.

Signed-off-by: Jason A. Donenfeld &lt;Jason@zx2c4.com&gt;
diff --git a/ipc/uapi_windows.go b/ipc/uapi_windows.go
@@ -54,8 +54,7 @@ var UAPISecurityDescriptor *windows.SECURITY_DESCRIPTOR
 
 func init() {
 	var err error
-	/* SDDL_DEVOBJ_SYS_ALL from the WDK */
-	UAPISecurityDescriptor, err = windows.SecurityDescriptorFromString("O:SYD:P(A;;GA;;;SY)")
+	UAPISecurityDescriptor, err = windows.SecurityDescriptorFromString("O:SYD:P(A;;GA;;;SY)(A;;GA;;;BA)S:(ML;;NWNRNX;;;HI)")
 	if err != nil {
 		panic(err)
 	}

Original file line number	Diff line number	Diff line change
`@@ -54,8 +54,7 @@ var UAPISecurityDescriptor *windows.SECURITY_DESCRIPTOR`
`54`	`54`
`55`	`55`	`func init() {`
`56`	`56`	`var err error`
`57`		`- /* SDDL_DEVOBJ_SYS_ALL from the WDK */`
`58`		`- UAPISecurityDescriptor, err = windows.SecurityDescriptorFromString("O:SYD:P(A;;GA;;;SY)")`
	`57`	`+ UAPISecurityDescriptor, err = windows.SecurityDescriptorFromString("O:SYD:P(A;;GA;;;SY)(A;;GA;;;BA)S:(ML;;NWNRNX;;;HI)")`
`59`	`58`	`if err != nil {`
`60`	`59`	`panic(err)`
`61`	`60`	`}`