diff options
| author | Odd Stranne <odd@mullvad.net> | 2019-03-06 14:58:25 +0100 |
|---|---|---|
| committer | Simon Rozman <simon@rozman.si> | 2019-03-08 10:03:56 +0100 |
| commit | a6d5ef82f4d90f3e997aa2ed4bf61414d6c39ee6 (patch) | |
| tree | 3b5bd8d10285d7b02f2b5a8107b6e24e358a9095 /ipc/uapi_windows.go | |
| parent | 5c7cc256e39a772dcaeb879bb4371ecb68b3e280 (diff) | |
Windows: Apply strict security descriptor on pipe server
Signed-off-by: Odd Stranne <odd@mullvad.net>
Diffstat (limited to 'ipc/uapi_windows.go')
| -rw-r--r-- | ipc/uapi_windows.go | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/ipc/uapi_windows.go b/ipc/uapi_windows.go index 158c5a8..8f0268d 100644 --- a/ipc/uapi_windows.go +++ b/ipc/uapi_windows.go @@ -46,9 +46,20 @@ func (l *UAPIListener) Addr() net.Addr { return l.listener.Addr() } +func GetSystemSecurityDescriptor() string { + // + // SDDL encoded. + // + // (system = SECURITY_NT_AUTHORITY | SECURITY_LOCAL_SYSTEM_RID) + // owner: system + // grant: GENERIC_ALL to system + // + return "O:SYD:(A;;GA;;;SY)" +} + func UAPIListen(name string) (net.Listener, error) { config := winio.PipeConfig{ - SecurityDescriptor: "O:SYD:P(A;;GA;;;SY)", /* Local System only, not inheritable */ + SecurityDescriptor: GetSystemSecurityDescriptor(), } listener, err := winio.ListenPipe("\\\\.\\pipe\\WireGuard\\"+name, &config) if err != nil { |