|
| 1 | +//! Windows ACL implementation for [`super::set_private_directory_permissions`]. |
| 2 | +
|
| 3 | +//---------------------------------------------------------------------------------------------------- Use |
| 4 | +use std::ffi::OsStr; |
| 5 | +use std::os::windows::ffi::OsStrExt; |
| 6 | +use std::path::Path; |
| 7 | +use std::ptr; |
| 8 | + |
| 9 | +use target_os_lib::core::{Error, Owned, Result, PCWSTR, PWSTR}; |
| 10 | +use target_os_lib::Win32::Foundation::{ |
| 11 | + ERROR_ALREADY_EXISTS, ERROR_INSUFFICIENT_BUFFER, E_UNEXPECTED, HANDLE, HLOCAL, |
| 12 | +}; |
| 13 | +use target_os_lib::Win32::Security::Authorization::{ |
| 14 | + ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, SDDL_REVISION_1, |
| 15 | +}; |
| 16 | +use target_os_lib::Win32::Security::{ |
| 17 | + GetTokenInformation, TokenUser, PSECURITY_DESCRIPTOR, SECURITY_ATTRIBUTES, TOKEN_ACCESS_MASK, |
| 18 | + TOKEN_QUERY, TOKEN_USER, |
| 19 | +}; |
| 20 | +use target_os_lib::Win32::Storage::FileSystem::CreateDirectoryW; |
| 21 | +use target_os_lib::Win32::System::Threading::{GetCurrentProcess, OpenProcessToken}; |
| 22 | + |
| 23 | +//---------------------------------------------------------------------------------------------------- SecurityDescriptor |
| 24 | +/// Security descriptor parsed from SDDL, with its `LocalAlloc` buffer freed on drop. |
| 25 | +struct SecurityDescriptor { |
| 26 | + psd: PSECURITY_DESCRIPTOR, |
| 27 | + _buf: Owned<HLOCAL>, |
| 28 | +} |
| 29 | + |
| 30 | +impl SecurityDescriptor { |
| 31 | + fn from_sddl(sddl: &str) -> Result<Self> { |
| 32 | + let sddl_w = to_wide_nul(OsStr::new(sddl)); |
| 33 | + let mut psd = PSECURITY_DESCRIPTOR::default(); |
| 34 | + // SAFETY: `sddl_w` is owned and null-terminated; `psd` is a valid out-pointer. |
| 35 | + unsafe { |
| 36 | + ConvertStringSecurityDescriptorToSecurityDescriptorW( |
| 37 | + PCWSTR(sddl_w.as_ptr()), |
| 38 | + SDDL_REVISION_1, |
| 39 | + &raw mut psd, |
| 40 | + None, |
| 41 | + ) |
| 42 | + }?; |
| 43 | + Ok(Self { |
| 44 | + psd, |
| 45 | + // SAFETY: `psd.0` is a `LocalAlloc` buffer per the function contract. |
| 46 | + _buf: unsafe { Owned::new(HLOCAL(psd.0)) }, |
| 47 | + }) |
| 48 | + } |
| 49 | +} |
| 50 | + |
| 51 | +//---------------------------------------------------------------------------------------------------- Apply |
| 52 | +/// Apply a private ACL to each path in `roots`. |
| 53 | +/// |
| 54 | +/// SYSTEM and Administrators are granted access alongside the user so |
| 55 | +/// Windows backup, antivirus, and indexer services keep working. |
| 56 | +pub(super) fn apply(roots: &[&Path]) { |
| 57 | + let user = match current_user_sid_string() { |
| 58 | + Ok(u) => u, |
| 59 | + Err(e) => { |
| 60 | + eprintln!("warning: could not retrieve user SID: {e}"); |
| 61 | + return; |
| 62 | + } |
| 63 | + }; |
| 64 | + let sddl = format!("O:{user}D:P(A;OICI;FA;;;{user})(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)"); |
| 65 | + let sd = match SecurityDescriptor::from_sddl(&sddl) { |
| 66 | + Ok(sd) => sd, |
| 67 | + Err(e) => { |
| 68 | + eprintln!("warning: could not parse Windows security descriptor: {e}"); |
| 69 | + return; |
| 70 | + } |
| 71 | + }; |
| 72 | + |
| 73 | + let sa = SECURITY_ATTRIBUTES { |
| 74 | + nLength: size_of::<SECURITY_ATTRIBUTES>() as u32, |
| 75 | + lpSecurityDescriptor: sd.psd.0, |
| 76 | + bInheritHandle: false.into(), |
| 77 | + }; |
| 78 | + for root in roots { |
| 79 | + if let Err(e) = create_private_directory(root, &sa) { |
| 80 | + eprintln!( |
| 81 | + "warning: could not create private directory {}: {e}", |
| 82 | + root.display() |
| 83 | + ); |
| 84 | + } |
| 85 | + } |
| 86 | +} |
| 87 | + |
| 88 | +//---------------------------------------------------------------------------------------------------- Helpers |
| 89 | +fn current_user_sid_string() -> Result<String> { |
| 90 | + let token = open_process_token(TOKEN_QUERY)?; |
| 91 | + |
| 92 | + let mut len: u32 = 0; |
| 93 | + // SAFETY: probe call with null buffer; `len` is a valid out-pointer. |
| 94 | + match unsafe { GetTokenInformation(*token, TokenUser, None, 0, &raw mut len) } { |
| 95 | + Err(e) if e.code() == ERROR_INSUFFICIENT_BUFFER.to_hresult() => {} |
| 96 | + Err(e) => return Err(e), |
| 97 | + Ok(()) => return Err(Error::from_hresult(E_UNEXPECTED)), |
| 98 | + } |
| 99 | + |
| 100 | + // `u64` elements satisfy `TOKEN_USER`'s 8-byte alignment. |
| 101 | + let mut buf: Vec<u64> = vec![0; (len as usize).div_ceil(size_of::<u64>())]; |
| 102 | + // SAFETY: `buf` is sized per the probe and aligned for `TOKEN_USER`. |
| 103 | + unsafe { |
| 104 | + GetTokenInformation( |
| 105 | + *token, |
| 106 | + TokenUser, |
| 107 | + Some(buf.as_mut_ptr().cast()), |
| 108 | + len, |
| 109 | + &raw mut len, |
| 110 | + ) |
| 111 | + }?; |
| 112 | + |
| 113 | + // SAFETY: `buf` was just populated as a `TOKEN_USER` by the call above. |
| 114 | + let token_user = unsafe { &*buf.as_ptr().cast::<TOKEN_USER>() }; |
| 115 | + let mut sid_pwstr = PWSTR::null(); |
| 116 | + // SAFETY: `token_user.User.Sid` is valid; out-pointer is owned. |
| 117 | + unsafe { ConvertSidToStringSidW(token_user.User.Sid, &raw mut sid_pwstr) }?; |
| 118 | + // SAFETY: `sid_pwstr.0` is a `LocalAlloc` buffer per `ConvertSidToStringSidW`. |
| 119 | + let _sid_guard = unsafe { Owned::new(HLOCAL(sid_pwstr.0.cast())) }; |
| 120 | + |
| 121 | + // SAFETY: `sid_pwstr` was just populated above. The `to_string` failure |
| 122 | + // case is unreachable for a Windows-emitted SID and maps to `E_UNEXPECTED`. |
| 123 | + unsafe { sid_pwstr.to_string() }.map_err(|_| Error::from_hresult(E_UNEXPECTED)) |
| 124 | +} |
| 125 | + |
| 126 | +fn create_private_directory(path: &Path, sa: &SECURITY_ATTRIBUTES) -> Result<()> { |
| 127 | + if path.is_dir() { |
| 128 | + return Ok(()); |
| 129 | + } |
| 130 | + |
| 131 | + if let Some(parent) = path.parent() { |
| 132 | + if !parent.as_os_str().is_empty() { |
| 133 | + create_private_directory(parent, sa)?; |
| 134 | + } |
| 135 | + } |
| 136 | + |
| 137 | + let path_w = to_wide_nul(path.as_os_str()); |
| 138 | + // SAFETY: `path_w` is owned; `sa` outlives this call. |
| 139 | + unsafe { CreateDirectoryW(PCWSTR(path_w.as_ptr()), Some(ptr::from_ref(sa))) }.or_else(|e| { |
| 140 | + if e.code() == ERROR_ALREADY_EXISTS.to_hresult() { |
| 141 | + Ok(()) |
| 142 | + } else { |
| 143 | + Err(e) |
| 144 | + } |
| 145 | + }) |
| 146 | +} |
| 147 | + |
| 148 | +fn open_process_token(access: TOKEN_ACCESS_MASK) -> Result<Owned<HANDLE>> { |
| 149 | + let mut token = HANDLE::default(); |
| 150 | + // SAFETY: `token` is a valid out-pointer; the returned handle is owned |
| 151 | + // by the resulting `Owned<HANDLE>`. |
| 152 | + unsafe { OpenProcessToken(GetCurrentProcess(), access, &raw mut token) }?; |
| 153 | + // SAFETY: `OpenProcessToken` returned Ok; `token` is now owned. |
| 154 | + Ok(unsafe { Owned::new(token) }) |
| 155 | +} |
| 156 | + |
| 157 | +fn to_wide_nul(s: &OsStr) -> Vec<u16> { |
| 158 | + s.encode_wide().chain(std::iter::once(0)).collect() |
| 159 | +} |
0 commit comments