[ros-diffs] [reactos] 01/01: [UMPNPMGR] Check for interactive caller in PNP_ReportLogOn

[Eric Kohl]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=13e6cbcafa09a4eb42cf8…

commit 13e6cbcafa09a4eb42cf8bc52e13b6b343833b0f
Author:     Eric Kohl <eric.kohl(a)reactos.org>
AuthorDate: Mon May 29 09:38:31 2023 +0200
Commit:     Eric Kohl <eric.kohl(a)reactos.org>
CommitDate: Mon May 29 09:38:31 2023 +0200

    [UMPNPMGR] Check for interactive caller in PNP_ReportLogOn
    
    Do not run device install when a non-interactive user logs on.
---
 base/services/umpnpmgr/rpcserver.c | 55 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 54 insertions(+), 1 deletion(-)

diff --git a/base/services/umpnpmgr/rpcserver.c b/base/services/umpnpmgr/rpcserver.c
index f3dcd0817cc..304b291dc5e 100644
--- a/base/services/umpnpmgr/rpcserver.c
+++ b/base/services/umpnpmgr/rpcserver.c
@@ -549,6 +549,56 @@ GetConfigurationData(
 }
 
 
+static
+BOOL
+IsCallerInteractive(
+    _In_ handle_t hBinding)
+{
+    SID_IDENTIFIER_AUTHORITY NtAuthority = {SECURITY_NT_AUTHORITY};
+    HANDLE hToken;
+    PSID pInteractiveSid = NULL;
+    BOOL bInteractive = FALSE;
+    RPC_STATUS RpcStatus;
+
+    DPRINT("IsCallerInteractive(%p)\n", hBinding);
+
+    /* Allocate an interactive user sid */
+    if (!AllocateAndInitializeSid(&NtAuthority,
+                                  1,
+                                  SECURITY_INTERACTIVE_RID,
+                                  0, 0, 0, 0, 0, 0, 0,
+                                  &pInteractiveSid))
+    {
+        DPRINT1("AllocateAndInitializeSid failed\n");
+        return FALSE;
+    }
+
+    /* Impersonate the client */
+    RpcStatus = RpcImpersonateClient(hBinding);
+    if (RpcStatus != RPC_S_OK)
+    {
+        DPRINT1("RpcImpersonateClient failed (Status 0x%08lx)\n", RpcStatus);
+        goto done;
+    }
+
+    /* Open the thread token and check for interactive user membership */
+    if (OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, FALSE, &hToken))
+    {
+        CheckTokenMembership(hToken, pInteractiveSid, &bInteractive);
+        CloseHandle(hToken);
+    }
+
+    /* Revert the impersonation */
+    RpcRevertToSelf();
+
+done:
+    if (pInteractiveSid)
+        FreeSid(pInteractiveSid);
+
+    return bInteractive;
+}
+
+
 VOID
 __RPC_USER
 PNP_NOTIFY_HANDLE_rundown(
@@ -646,12 +696,15 @@ PNP_ReportLogOn(
     DWORD ReturnValue = CR_FAILURE;
     HANDLE hProcess;
 
-    UNREFERENCED_PARAMETER(hBinding);
     UNREFERENCED_PARAMETER(Admin);
 
     DPRINT("PNP_ReportLogOn(%p %u, %u)\n",
            hBinding, Admin, ProcessId);
 
+    /* Fail, if the caller is not an interactive user */
+    if (!IsCallerInteractive(hBinding))
+        goto cleanup;
+
     /* Get the users token */
     hProcess = OpenProcess(PROCESS_ALL_ACCESS, TRUE, ProcessId);