https://git.reactos.org/?p=reactos.git;a=commitdiff;h=13e6cbcafa09a4eb42cf8bc52e13b6b343833b0f
commit 13e6cbcafa09a4eb42cf8bc52e13b6b343833b0f Author: Eric Kohl <[email protected]> AuthorDate: Mon May 29 09:38:31 2023 +0200 Commit: Eric Kohl <[email protected]> CommitDate: Mon May 29 09:38:31 2023 +0200 [UMPNPMGR] Check for interactive caller in PNP_ReportLogOn Do not run device install when a non-interactive user logs on. --- base/services/umpnpmgr/rpcserver.c | 55 +++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) diff --git a/base/services/umpnpmgr/rpcserver.c b/base/services/umpnpmgr/rpcserver.c index f3dcd0817cc..304b291dc5e 100644 --- a/base/services/umpnpmgr/rpcserver.c +++ b/base/services/umpnpmgr/rpcserver.c @@ -549,6 +549,56 @@ GetConfigurationData( } +static +BOOL +IsCallerInteractive( + _In_ handle_t hBinding) +{ + SID_IDENTIFIER_AUTHORITY NtAuthority = {SECURITY_NT_AUTHORITY}; + HANDLE hToken; + PSID pInteractiveSid = NULL; + BOOL bInteractive = FALSE; + RPC_STATUS RpcStatus; + + DPRINT("IsCallerInteractive(%p)\n", hBinding); + + /* Allocate an interactive user sid */ + if (!AllocateAndInitializeSid(&NtAuthority, + 1, + SECURITY_INTERACTIVE_RID, + 0, 0, 0, 0, 0, 0, 0, + &pInteractiveSid)) + { + DPRINT1("AllocateAndInitializeSid failed\n"); + return FALSE; + } + + /* Impersonate the client */ + RpcStatus = RpcImpersonateClient(hBinding); + if (RpcStatus != RPC_S_OK) + { + DPRINT1("RpcImpersonateClient failed (Status 0x%08lx)\n", RpcStatus); + goto done; + } + + /* Open the thread token and check for interactive user membership */ + if (OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, FALSE, &hToken)) + { + CheckTokenMembership(hToken, pInteractiveSid, &bInteractive); + CloseHandle(hToken); + } + + /* Revert the impersonation */ + RpcRevertToSelf(); + +done: + if (pInteractiveSid) + FreeSid(pInteractiveSid); + + return bInteractive; +} + + VOID __RPC_USER PNP_NOTIFY_HANDLE_rundown( @@ -646,12 +696,15 @@ PNP_ReportLogOn( DWORD ReturnValue = CR_FAILURE; HANDLE hProcess; - UNREFERENCED_PARAMETER(hBinding); UNREFERENCED_PARAMETER(Admin); DPRINT("PNP_ReportLogOn(%p %u, %u)\n", hBinding, Admin, ProcessId); + /* Fail, if the caller is not an interactive user */ + if (!IsCallerInteractive(hBinding)) + goto cleanup; + /* Get the users token */ hProcess = OpenProcess(PROCESS_ALL_ACCESS, TRUE, ProcessId);
