Changeset 44530 in vbox for trunk

Timestamp:

Feb 4, 2013 4:15:22 PM (12 years ago)

Author:

vboxsync

Message:

VBoxServiceVMInfo-win: More user enumeration fixes: Use the process' SID for determining user ownership. Tested on Windows XP and Vista/8. More guest property debugging information on verbose level 4+.

File:

• trunk/src/VBox/Additions/common/VBoxService/VBoxServiceVMInfo-win.cpp (modified) (22 diffs)

trunk/src/VBox/Additions/common/VBoxService/VBoxServiceVMInfo-win.cpp

@@ -57 +57 @@
     /** Number of assigned user processes. */
     ULONG ulNumProcs;
-    /** Last (highest) session number. This
+    /** Last (highest) session ID. This
      *  is needed for distinguishing old session
      *  process counts from new (current) session
      *  ones. */
-    ULONG ulSession;
+    ULONG ulLastSession;
 } VBOXSERVICEVMINFOUSER, *PVBOXSERVICEVMINFOUSER;
 
@@ -76 +76 @@
     /** The PID. */
     DWORD id;
+    /** The SID. */
+    PSID pSid;
     /** The LUID. */
     LUID luid;
@@ -89 +91 @@
 bool VBoxServiceVMInfoWinIsLoggedIn(PVBOXSERVICEVMINFOUSER a_pUserInfo, PLUID a_pSession);
 int  VBoxServiceVMInfoWinProcessesEnumerate(PVBOXSERVICEVMINFOPROC *ppProc, DWORD *pdwCount);
-void VBoxServiceVMInfoWinProcessesFree(PVBOXSERVICEVMINFOPROC paProcs);
+void VBoxServiceVMInfoWinProcessesFree(DWORD cProcs, PVBOXSERVICEVMINFOPROC paProcs);
 
 typedef BOOL WINAPI FNQUERYFULLPROCESSIMAGENAME(HANDLE,  DWORD, LPTSTR, PDWORD);
@@ -238 +240 @@
             case TokenGroups:
                 dwTokenInfoSize = 0;
-                /* Allocating will follow in a second step. */
+                /* Allocation will follow in a second step. */
                 break;
 
-            /** @todo Implement more token classes here. */
+            case TokenUser:
+                dwTokenInfoSize = 0;
+                /* Allocation will follow in a second step. */
+                break;
 
             default:
@@ -269 +274 @@
                             break;
 
+                        case TokenUser:
+                            pvTokenInfo = (PTOKEN_USER)HeapAlloc(GetProcessHeap(),
+                                                                 HEAP_ZERO_MEMORY, dwRetLength);
+                            if (!pvTokenInfo)
+                                dwErr = GetLastError();
+                            dwTokenInfoSize = dwRetLength;
+                            break;
+
                         default:
                             AssertMsgFailed(("Re-allocating of token information for token class not implemented\n"));
@@ -291 +304 @@
                     {
                         PTOKEN_STATISTICS pStats = (PTOKEN_STATISTICS)pvTokenInfo;
+                        AssertPtr(pStats);
                         memcpy(&pProc->luid, &pStats->AuthenticationId, sizeof(LUID));
                         /** @todo Add more information of TOKEN_STATISTICS as needed. */
@@ -336 +350 @@
                     }
 
+                    case TokenUser:
+                    {
+                        PTOKEN_USER pUser = (PTOKEN_USER)pvTokenInfo;
+                        AssertPtr(pUser);
+
+                        DWORD dwLength = GetLengthSid(pUser->User.Sid);
+                        Assert(dwLength);
+                        if (dwLength)
+                        {
+                            pProc->pSid = (PSID)RTMemAlloc(dwLength);
+                            AssertPtr(pProc->pSid);
+                            if (CopySid(dwLength, pProc->pSid, pUser->User.Sid))
+                            {
+                                if (!IsValidSid(pProc->pSid))
+                                    dwErr = ERROR_INVALID_NAME;
+                            }
+                            else
+                                dwErr = GetLastError();
+                        }
+                        else
+                            dwErr = ERROR_NO_DATA;
+
+                        if (dwErr != ERROR_SUCCESS)
+                            VBoxServiceError("Error retrieving SID of process PID=%ld: %ld\n",
+                                             pProc->id, dwErr);
+                        break;
+                    }
+
                     default:
                         AssertMsgFailed(("Unhandled token information class\n"));
@@ -423 +465 @@
             {
                 paProcs[i].id = paPID[i];
-                rc = VBoxServiceVMInfoWinProcessesGetTokenInfo(&paProcs[i], TokenGroups);
-                if (RT_FAILURE(rc))
-                {
-                    /* Because some processes cannot be opened/parsed on
-                           Windows, we should not consider to be this an error here. */
-                    rc = VINF_SUCCESS;
-                }
-                else
-                {
-                    rc = VBoxServiceVMInfoWinProcessesGetTokenInfo(&paProcs[i], TokenStatistics);
-                    if (RT_FAILURE(rc))
-                    {
-                        /* Because some processes cannot be opened/parsed on
-                           Windows, we should not consider to be this an error here. */
-                        rc = VINF_SUCCESS;
-                    }
-                }
+                paProcs[i].pSid = NULL;
+
+                int rc2 = VBoxServiceVMInfoWinProcessesGetTokenInfo(&paProcs[i], TokenUser);
+                if (RT_FAILURE(rc2) && g_cVerbosity)
+                    VBoxServiceError("Get token class \"user\" for process %ld failed, rc=%Rrc\n",
+                                     paProcs[i].id, rc2);
+
+                rc2 = VBoxServiceVMInfoWinProcessesGetTokenInfo(&paProcs[i], TokenGroups);
+                if (RT_FAILURE(rc2) && g_cVerbosity)
+                    VBoxServiceError("Get token class \"groups\" for process %ld failed, rc=%Rrc\n",
+                                     paProcs[i].id, rc2);
+
+                rc2 = VBoxServiceVMInfoWinProcessesGetTokenInfo(&paProcs[i], TokenStatistics);
+                if (RT_FAILURE(rc2) && g_cVerbosity)
+                    VBoxServiceError("Get token class \"statistics\" for process %ld failed, rc=%Rrc\n",
+                                     paProcs[i].id, rc2);
             }
 
@@ -465 +506 @@
  * @param   paProcs     What
  */
-void VBoxServiceVMInfoWinProcessesFree(PVBOXSERVICEVMINFOPROC paProcs)
-{
+void VBoxServiceVMInfoWinProcessesFree(DWORD cProcs, PVBOXSERVICEVMINFOPROC paProcs)
+{
+    for (DWORD i = 0; i < cProcs; i++)
+    {
+        if (paProcs[i].pSid)
+            RTMemFree(paProcs[i].pSid);
+    }
     RTMemFree(paProcs);
 }
@@ -474 +520 @@
  *
  * @returns Number of processes found for a specified session.
- * @param   pSession        The session.
+ * @param   pSession        The current user's SID.
  * @param   paProcs         The process snapshot.
  * @param   cProcs          The number of processes in the snaphot.
@@ -493 +539 @@
     if (rcNt != STATUS_SUCCESS)
     {
-        VBoxServiceError("Could not get logon session data! rcNt=%#x", rcNt);
+        VBoxServiceError("Could not get logon session data! rcNt=%#x\n", rcNt);
         return 0;
     }
+
+    if (!IsValidSid(pSessionData->Sid))
+    {
+       VBoxServiceError("User SID=%p is not valid\n", pSessionData->Sid);
+       return 0;
+    }
+
+    int rc = VINF_SUCCESS;
 
     /*
@@ -505 +559 @@
     for (DWORD i = 0; i < cProcs; i++)
     {
-        VBoxServiceVerbose(4, "PID=%ld: (Interactive: %RTbool) %ld:%ld <-> %ld:%ld\n",
-                           paProcs[i].id,                  paProcs[i].fInteractive,
-                           paProcs[i].luid.HighPart,       paProcs[i].luid.LowPart,
-                           pSessionData->LogonId.HighPart, pSessionData->LogonId.LowPart);
         if (g_cVerbosity)
         {
             TCHAR szModule[_1K];
-            int rc2 = VBoxServiceVMInfoWinProcessesGetModuleName(&paProcs[i], szModule, sizeof(szModule));
-            if (RT_SUCCESS(rc2))
+            rc = VBoxServiceVMInfoWinProcessesGetModuleName(&paProcs[i], szModule, sizeof(szModule));
+            if (RT_SUCCESS(rc))
                 VBoxServiceVerbose(4, "PID=%ld: %s\n",
                                    paProcs[i].id, szModule);
         }
 
-        if (   paProcs[i].fInteractive
-            && (   paProcs[i].luid.HighPart == pSessionData->LogonId.HighPart
-                && paProcs[i].luid.LowPart  == pSessionData->LogonId.LowPart))
-        {
-            cNumProcs++;
-            if (!g_cVerbosity) /* We want a bit more info on higher verbosity. */
-                break;
-        }
-    }
-
-    if (g_cVerbosity)
-        VBoxServiceVerbose(3, "Session has %u processes total\n", cNumProcs);
-    else
-        VBoxServiceVerbose(3, "Session has at least one process\n");
+        PSID pProcSID = paProcs[i].pSid;
+        if (   RT_SUCCESS(rc)
+            && pProcSID
+            && IsValidSid(pProcSID))
+        {
+            if (   EqualSid(pSessionData->Sid, paProcs[i].pSid)
+                && paProcs[i].fInteractive)
+            {
+                cNumProcs++;
+                if (!g_cVerbosity) /* We want a bit more info on higher verbosity. */
+                    break;
+            }
+        }
+    }
 
     if (puTerminalSession)
@@ -537 +587 @@
 
     LsaFreeReturnBuffer(pSessionData);
+
     return cNumProcs;
 }
@@ -611 +662 @@
     }
 
-    VBoxServiceVerbose(3, "Session data: Name=%ls, Session=%u, LogonID=%ld,%ld, LogonType=%ld\n",
+    VBoxServiceVerbose(3, "Session data: Name=%ls, SessionID=%RU32, LogonID=%ld,%ld, LogonType=%ld\n",
                        pSessionData->UserName.Buffer,
                        pSessionData->Session,
@@ -749 +800 @@
     }
 
+    if (fFoundUser)
+        pUserInfo->ulLastSession = pSessionData->Session;
+
     LsaFreeReturnBuffer(pSessionData);
     return fFoundUser;
@@ -823 +877 @@
         {
             ULONG cUniqueUsers = 0;
+
+            /**
+             * Note: The cSessions loop variable does *not* correlate with
+             *       the Windows session ID!
+             */
             for (ULONG i = 0; i < cSessions; i++)
             {
-                VBoxServiceVerbose(3, "Handling session %u\n", i);
-
-                VBOXSERVICEVMINFOUSER UserInfo;
-                if (VBoxServiceVMInfoWinIsLoggedIn(&UserInfo, &paSessions[i]))
+                VBoxServiceVerbose(3, "Handling session %RU32 (of %RU32)\n", i + 1, cSessions);
+
+                VBOXSERVICEVMINFOUSER userSession;
+                if (VBoxServiceVMInfoWinIsLoggedIn(&userSession, &paSessions[i]))
                 {
-                    VBoxServiceVerbose(4, "Handling user=%ls, domain=%ls, package=%ls\n",
-                                       UserInfo.wszUser, UserInfo.wszLogonDomain, UserInfo.wszAuthenticationPackage);
+                    VBoxServiceVerbose(4, "Handling user=%ls, domain=%ls, package=%ls, session=%RU32\n",
+                                       userSession.wszUser, userSession.wszLogonDomain, userSession.wszAuthenticationPackage,
+                                       userSession.ulLastSession);
 
                     /* Retrieve assigned processes of current session. */
-                    uint32_t cSessionProcs = VBoxServiceVMInfoWinSessionHasProcesses(&paSessions[i], paProcs, cProcs,
-                                                                                     NULL /* Terminal session ID */);
+                    uint32_t cCurSessionProcs = VBoxServiceVMInfoWinSessionHasProcesses(&paSessions[i], paProcs, cProcs,
+                                                                                        NULL /* Terminal session ID */);
                     /* Don't return here when current session does not have assigned processes
                      * anymore -- in that case we have to search through the unique users list below
                      * and see if got a stale user/session entry. */
 
-#ifdef DEBUG
-                    char szDebugUserPath[255]; RTStrPrintf(szDebugUserPath,  sizeof(szDebugUserPath), "/VirtualBox/GuestInfo/Debug/LSA/Session/%RU32", i);
-                    VBoxServiceWritePropF(s_uGuestPropClientID, szDebugUserPath,
-                                          "%RU32: cSessionProcs=%RU32 (%RU32 total)", s_uIter, cSessionProcs, cProcs);
-#endif
+                    if (g_cVerbosity > 3)
+                    {
+                        char szDebugSessionPath[255]; RTStrPrintf(szDebugSessionPath,  sizeof(szDebugSessionPath), "/VirtualBox/GuestInfo/Debug/LSA/Session/%RU32",
+                                                                  userSession.ulLastSession);
+                        VBoxServiceWritePropF(s_uGuestPropClientID, szDebugSessionPath,
+                                              "#%RU32: cSessionProcs=%RU32 (of %RU32 procs total)", s_uIter, cCurSessionProcs, cProcs);
+                    }
+
                     bool fFoundUser = false;
                     for (ULONG a = 0; a < cUniqueUsers; a++)
@@ -851 +914 @@
                         AssertPtr(pCurUser);
 
-                        if (   !wcscmp(UserInfo.wszUser, pCurUser->wszUser)
-                            && !wcscmp(UserInfo.wszLogonDomain, pCurUser->wszLogonDomain)
-                            && !wcscmp(UserInfo.wszAuthenticationPackage, pCurUser->wszAuthenticationPackage))
+                        if (   !wcscmp(userSession.wszUser, pCurUser->wszUser)
+                            && !wcscmp(userSession.wszLogonDomain, pCurUser->wszLogonDomain)
+                            && !wcscmp(userSession.wszAuthenticationPackage, pCurUser->wszAuthenticationPackage))
                         {
                             /*
                              * Only respect the highest session for the current user.
                              */
-                            if (i > pCurUser->ulSession)
+                            if (userSession.ulLastSession > pCurUser->ulLastSession)
                             {
-                                VBoxServiceVerbose(4, "Updating user=%ls to %u processes (last session=%RU32)\n",
-                                                   pCurUser->wszUser, cSessionProcs, i);
-
-                                if (!cSessionProcs)
-                                    VBoxServiceVerbose(3, "Stale session for user=%ls detected! Procs %RU32->%RU32, Session RU%32->RU32\n",
+                                VBoxServiceVerbose(4, "Updating user=%ls to %u processes (last used session: %RU32)\n",
+                                                   pCurUser->wszUser, cCurSessionProcs, userSession.ulLastSession);
+
+                                if (!cCurSessionProcs)
+                                    VBoxServiceVerbose(3, "Stale session for user=%ls detected! Processes: %RU32 -> %RU32, Session: %RU32 -> %RU32\n",
                                                        pCurUser->wszUser,
-                                                       pCurUser->ulNumProcs, cSessionProcs,
-                                                       pCurUser->ulSession, i);
-
-                                pCurUser->ulNumProcs = cSessionProcs;
-                                pCurUser->ulSession  = i;
+                                                       pCurUser->ulNumProcs, cCurSessionProcs,
+                                                       pCurUser->ulLastSession, userSession.ulLastSession);
+
+                                pCurUser->ulNumProcs = cCurSessionProcs;
+                                pCurUser->ulLastSession  = userSession.ulLastSession;
                             }
                             /* There can be multiple session objects using the same session ID for the
                              * current user -- so when we got the same session again just add the found
                              * processes to it. */
-                            else if (   pCurUser->ulSession == i
-                                     && cSessionProcs)
+                            else if (pCurUser->ulLastSession == userSession.ulLastSession)
                             {
-                                VBoxServiceVerbose(4, "Adding %u processes to user=%ls (session=%RU32)\n",
-                                                   cSessionProcs, pCurUser->wszUser, i);
-
-                                pCurUser->ulNumProcs += cSessionProcs;
+                                VBoxServiceVerbose(4, "Updating processes for user=%ls (old procs=%RU32, new procs=%RU32, session=%RU32)\n",
+                                                   pCurUser->wszUser, pCurUser->ulNumProcs, cCurSessionProcs, pCurUser->ulLastSession);
+
+                                pCurUser->ulNumProcs = cCurSessionProcs;
                             }
 
@@ -891 +953 @@
                     if (!fFoundUser)
                     {
-                        VBoxServiceVerbose(4, "Adding new user=%ls (session=%RU32) with %u processes\n",
-                                           UserInfo.wszUser, i, cSessionProcs);
-
-                        memcpy(&pUserInfo[cUniqueUsers], &UserInfo, sizeof(VBOXSERVICEVMINFOUSER));
-                        pUserInfo[cUniqueUsers].ulNumProcs = cSessionProcs;
-                        pUserInfo[cUniqueUsers].ulSession  = i;
+                        VBoxServiceVerbose(4, "Adding new user=%ls (session=%RU32) with %RU32 processes\n",
+                                           userSession.wszUser, userSession.ulLastSession, cCurSessionProcs);
+
+                        memcpy(&pUserInfo[cUniqueUsers], &userSession, sizeof(VBOXSERVICEVMINFOUSER));
+                        pUserInfo[cUniqueUsers].ulNumProcs = cCurSessionProcs;
                         cUniqueUsers++;
                         Assert(cUniqueUsers <= cSessions);
@@ -903 +964 @@
             }
 
-#ifdef DEBUG
-            VBoxServiceWritePropF(s_uGuestPropClientID, "/VirtualBox/GuestInfo/Debug/LSA",
-                                  "%RU32: cSessions=%RU32, cProcs=%RU32, cUniqueUsers=%RU32",
-                                  s_uIter, cSessions, cProcs, cUniqueUsers);
-#endif
+            if (g_cVerbosity > 3)
+                VBoxServiceWritePropF(s_uGuestPropClientID, "/VirtualBox/GuestInfo/Debug/LSA",
+                                      "#%RU32: cSessions=%RU32, cProcs=%RU32, cUniqueUsers=%RU32",
+                                      s_uIter, cSessions, cProcs, cUniqueUsers);
+
             VBoxServiceVerbose(3, "Found %u unique logged-in user(s)\n",
                                cUniqueUsers);
@@ -914 +975 @@
             for (ULONG i = 0; i < cUniqueUsers; i++)
             {
-#ifdef DEBUG
-                char szDebugUserPath[255]; RTStrPrintf(szDebugUserPath,  sizeof(szDebugUserPath), "/VirtualBox/GuestInfo/Debug/LSA/User/%RU32", i);
-                VBoxServiceWritePropF(s_uGuestPropClientID, szDebugUserPath,
-                                      "%RU32: szName=%ls, sessionID=%RU32, cProcs=%RU32",
-                                      s_uIter, pUserInfo[i].wszUser, pUserInfo[i].ulSession, pUserInfo[i].ulNumProcs);
-#endif
+                if (g_cVerbosity > 3)
+                {
+                    char szDebugUserPath[255]; RTStrPrintf(szDebugUserPath,  sizeof(szDebugUserPath), "/VirtualBox/GuestInfo/Debug/LSA/User/%RU32", i);
+                    VBoxServiceWritePropF(s_uGuestPropClientID, szDebugUserPath,
+                                          "#%RU32: szName=%ls, sessionID=%RU32, cProcs=%RU32",
+                                          s_uIter, pUserInfo[i].wszUser, pUserInfo[i].ulLastSession, pUserInfo[i].ulNumProcs);
+                }
+
                 bool fAddUser = false;
                 if (pUserInfo[i].ulNumProcs)
@@ -926 +989 @@
                 if (fAddUser)
                 {
-                    VBoxServiceVerbose(3, "User %ls has %ld interactive processes (session %u)\n",
-                                       pUserInfo[i].wszUser, pUserInfo[i].ulNumProcs, pUserInfo[i].ulSession);
+                    VBoxServiceVerbose(3, "User \"%ls\" has %RU32 interactive processes (session=%RU32)\n",
+                                       pUserInfo[i].wszUser, pUserInfo[i].ulNumProcs, pUserInfo[i].ulLastSession);
 
                     if (*pcUsersInList > 0)
@@ -952 +1015 @@
             RTMemFree(pUserInfo);
         }
-        VBoxServiceVMInfoWinProcessesFree(paProcs);
+        VBoxServiceVMInfoWinProcessesFree(cProcs, paProcs);
     }
     LsaFreeReturnBuffer(paSessions);