fix(ipc): add version check for security descriptor initialization

Prcuvu · Prcuvu · commit b97ccffe76a6 · 2018-03-27T19:02:57.000+08:00
Add an OS version check to prevent failure on older Windows versions, since ALL APPLICATION PACKAGES principal is first implemented in Windows 8, and integrity mechanism is first implemented in Windows Vista. Fixes #157
diff --git a/WeaselIPCServer/SecurityAttribute.cpp b/WeaselIPCServer/SecurityAttribute.cpp
@@ -1,18 +1,82 @@
 #include "stdafx.h"
 #include "SecurityAttribute.h"
 #include <Sddl.h>
+#include <VersionHelpers.hpp>
+
+#ifndef SDDL_ALL_APP_PACKAGES
+#define SDDL_ALL_APP_PACKAGES TEXT("AC")
+#endif
+
+#define LOW_INTEGRITY_SDDL_SACL      SDDL_SACL             \
+                                     SDDL_DELIMINATOR      \
+                                     SDDL_ACE_BEGIN        \
+                                     SDDL_MANDATORY_LABEL  \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_NO_WRITE_UP      \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_ML_LOW           \
+                                     SDDL_ACE_END
+
+#define LOCAL_SYSTEM_FILE_ACCESS     SDDL_ACE_BEGIN        \
+                                     SDDL_ACCESS_ALLOWED   \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_FILE_ALL         \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_LOCAL_SYSTEM     \
+                                     SDDL_ACE_END
+
+#define EVERYONE_FILE_ACCESS         SDDL_ACE_BEGIN        \
+                                     SDDL_ACCESS_ALLOWED   \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_FILE_ALL         \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_EVERYONE         \
+                                     SDDL_ACE_END
+
+#define ALL_APP_PACKAGES_FILE_ACCESS SDDL_ACE_BEGIN        \
+                                     SDDL_ACCESS_ALLOWED   \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_FILE_ALL         \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_SEPERATOR        \
+                                     SDDL_ALL_APP_PACKAGES \
+                                     SDDL_ACE_END
 
 namespace weasel {
 
 	void SecurityAttribute::_Init()
 	{
-		// Privilages for UWP and IE protected mode
+		// Privileges for UWP and IE protected mode
 		// https://stackoverflow.com/questions/39138674/accessing-named-pipe-servers-from-within-ie-epm-bho
-		ConvertStringSecurityDescriptorToSecurityDescriptorW(
-			L"S:(ML;;NW;;;LW)D:(A;;FA;;;SY)(A;;FA;;;WD)(A;;FA;;;AC)",
-			SDDL_REVISION_1,
-			&pd,
-			NULL);
+		if (IsWindowsVistaOrGreater())
+		{
+			ConvertStringSecurityDescriptorToSecurityDescriptor(
+				IsWindows8OrGreater() ? LOW_INTEGRITY_SDDL_SACL
+				                        SDDL_DACL
+				                        SDDL_DELIMINATOR
+				                        LOCAL_SYSTEM_FILE_ACCESS
+				                        EVERYONE_FILE_ACCESS
+				                        ALL_APP_PACKAGES_FILE_ACCESS
+				                      : LOW_INTEGRITY_SDDL_SACL
+				                        SDDL_DACL
+				                        SDDL_DELIMINATOR
+				                        LOCAL_SYSTEM_FILE_ACCESS
+				                        EVERYONE_FILE_ACCESS,
+				SDDL_REVISION_1,
+				&pd,
+				NULL);
+		}
 
 		sa.nLength = sizeof(SECURITY_ATTRIBUTES);
 		sa.lpSecurityDescriptor = pd;
diff --git a/WeaselIPCServer/SecurityAttribute.h b/WeaselIPCServer/SecurityAttribute.h
@@ -9,7 +9,7 @@ namespace weasel {
 		SECURITY_ATTRIBUTES sa;
 		void _Init();
 	public:
-		SecurityAttribute() { _Init(); }
+		SecurityAttribute() : pd(NULL) { _Init(); }
 		SECURITY_ATTRIBUTES *get_attr();
 	};
 };
