Changeset 80569 in vbox for trunk/src/VBox/Main

Timestamp:

Sep 3, 2019 2:34:21 PM (6 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

133086

Message:

Main: bugref:9341: Added VM autostart during boot support for windows host

Location:

trunk/src/VBox/Main

Files:

• Makefile.kmk (modified) (3 diffs)
• idl/VirtualBox.xidl (modified) (2 diffs)
• include/MachineLaunchVMCommonWorker.h (added)
• include/VirtualBoxSDSImpl.h (modified) (1 diff)
• src-all/ExtPackManagerImpl.cpp (modified) (1 diff)
• src-all/MachineLaunchVMCommonWorker.cpp (added)
• src-client/ClientTokenHolder.cpp (modified) (1 diff)
• src-global/win/VirtualBoxSDSImpl.cpp (modified) (4 diffs)
• src-helper-apps/VBoxExtPackHelperApp.cpp (modified) (1 diff)
• src-server/ClientToken.cpp (modified) (2 diffs)
• src-server/MachineImpl.cpp (modified) (3 diffs)
• src-server/generic/AutostartDb-generic.cpp (modified) (4 diffs)

trunk/src/VBox/Main/Makefile.kmk

@@ -385 +385 @@
 VBoxSDS_TEMPLATE = VBOXMAINEXE
 VBoxSDS_DEFS += VBOX_COM_OUTOFPROC_MODULE _WIN32_WINNT=0x0600
+ ifdef VBOX_WITH_VBOXSDL
+VBoxSDS_DEFS += VBOX_WITH_VBOXSDL
+ endif
+ ifdef VBOX_WITH_HEADLESS
+VBoxSDS_DEFS += VBOX_WITH_HEADLESS
+ endif
+ ifdef VBOX_WITH_QTGUI
+VBoxSDS_DEFS += VBOX_WITH_QTGUI
+ endif
 VBoxSDS_INCS  = \
         include \
@@ -394 +403 @@
         src-global/win/VBoxSDS.cpp \
         src-global/win/VirtualBoxSDSImpl.cpp \
-        src-global/win/VBoxSDS.rc
+        src-global/win/VBoxSDS.rc \
+        src-all/MachineLaunchVMCommonWorker.cpp
 $(call KB_FN_DO_PASS0_ON_TARGET,VBoxSDS) # Sets VBoxSDS_0_OUTDIR
 
@@ -553 +563 @@
         src-server/HostVideoInputDeviceImpl.cpp \
         src-server/MachineImpl.cpp \
+        src-all/MachineLaunchVMCommonWorker.cpp \
         src-server/MachineImplCloneVM.cpp \
         src-server/MachineImplMoveVM.cpp \

trunk/src/VBox/Main/idl/VirtualBox.xidl

@@ -27033 +27033 @@
   <interface
     name="IVirtualBoxSDS" extends="$unknown" notdual="yes"
-    uuid="152265b8-fe7d-4077-9dd6-032bc3f1c5a3"
+    uuid="bc1a2773-18f2-4066-08ce-1e44d59d84af"
     wsmap="suppress" internal="yes"
     reservedMethods="0" reservedAttributes="0"
@@ -27068 +27068 @@
         <param name="pid" type="long" dir="in">
           <desc>The process ID of the VBoxSVC instance (same as during registration).</desc>
+        </param>
+      </method>
+
+      <method name="launchVMProcess">
+        <desc>
+          Spawns a new process that will execute the virtual machine in the interactive
+          windows session of calling user. Any additional checks are performed by created
+          process itself
+
+          If launching the VM succeeds, the new VM process will create its own session
+          and write-lock the machine for it, preventing conflicting changes from other
+          processes. If the machine is already locked (because it is already running or
+          because another session has a write lock), launching the VM process will therefore
+          fail. Reversely, future attempts to obtain a write lock will also fail while the
+          machine is running.
+
+          Launching a VM process can take some time (a new VM is started in a new process,
+          for which memory and other resources need to be set up) but the method does
+          not wait for completion and just returns the PID of created process.
+
+          <result name="E_INVALIDARG">
+            Some of the parameters are invalid.
+          </result>
+          <result name="VBOX_E_IPRT_ERROR">
+            Launching process for machine failed.
+          </result>
+        </desc>
+        <param name="machine" type="wstring" dir="in">
+          <desc>
+            The name or id of the machine the VM will start for.
+          </desc>
+        </param>
+        <param name="comment" type="wstring" dir="in">
+          <desc>
+            The comment for VM.
+          </desc>
+        </param>
+        <param name="frontend" type="wstring" dir="in">
+          <desc>
+            Front-end to use for the new VM process. The following are currently supported:
+            <ul>
+              <li><tt>"gui"</tt>: VirtualBox Qt GUI front-end</li>
+              <li><tt>"headless"</tt>: VBoxHeadless (VRDE Server) front-end</li>
+              <li><tt>"sdl"</tt>: VirtualBox SDL front-end</li>
+              <li><tt>""</tt>: use the per-VM default frontend if set, otherwise
+                the global default defined in the system properties. If neither
+                are set, the API will launch a <tt>"gui"</tt> session, which may
+                fail if there is no windowing environment available. See
+                <link to="IMachine::defaultFrontend"/> and
+                <link to="ISystemProperties::defaultFrontend"/>.</li>
+            </ul>
+          </desc>
+        </param>
+        <param name="environmentChanges" type="wstring" dir="in">
+          <desc>
+            Environment changes to pass to the VM process, putenv style using newline as separator.
+            <!-- TODO: make this a safearray so values can safely contain newlines and '\'. -->
+          </desc>
+        </param>
+        <param name="cmdOptions" type="wstring" dir="in">
+          <desc>
+            Additional command line options to pass to the VM process.
+          </desc>
+        </param>
+        <param name="sessionId" type="unsigned long" dir="in">
+          <desc>
+            Windows session where the VM process should be launched.
+          </desc>
+        </param>
+        <param name="pid" type="unsigned long" dir="return">
+          <desc>The PID of created process.</desc>
         </param>
       </method>

trunk/src/VBox/Main/include/VirtualBoxSDSImpl.h

@@ -94 +94 @@
     STDMETHOD(RegisterVBoxSVC)(IVBoxSVCRegistration *aVBoxSVC, LONG aPid, IUnknown **aExistingVirtualBox);
     STDMETHOD(DeregisterVBoxSVC)(IVBoxSVCRegistration *aVBoxSVC, LONG aPid);
+    STDMETHOD(LaunchVMProcess)(IN_BSTR aMachine, IN_BSTR aComment, IN_BSTR aFrontend, IN_BSTR aEnvironmentChanges,
+                               IN_BSTR aCmdOptions, ULONG aSessionId, ULONG *aPid);
     /** @} */
 

trunk/src/VBox/Main/src-all/ExtPackManagerImpl.cpp

@@ -2508 +2508 @@
                          NULL /*pszAsUser*/,
                          NULL /*pszPassword*/,
+                         NULL /*pvExtraData*/,
                          &hProcess);
     if (RT_SUCCESS(vrc))

trunk/src/VBox/Main/src-client/ClientTokenHolder.cpp

@@ -250 +250 @@
     HANDLE initDoneSem = (HANDLE)data[1];
 
-    HANDLE mutex = ::OpenMutex(MUTEX_ALL_ACCESS, FALSE, Bstr(strSessionId).raw());
-    AssertMsg(mutex, ("cannot open token, err=%d\n", ::GetLastError()));
-
+    Bstr bstrSessionId(strSessionId);
+    HANDLE mutex = ::OpenMutex(MUTEX_ALL_ACCESS, FALSE, bstrSessionId.raw());
+
+    //AssertMsg(mutex, ("cannot open token, err=%u\n", ::GetLastError()));
+    AssertMsg(mutex, ("cannot open token %ls, err=%u\n", bstrSessionId.raw(), ::GetLastError()));
     if (mutex)
     {

trunk/src/VBox/Main/src-global/win/VirtualBoxSDSImpl.cpp

@@ -31 +31 @@
 #include <iprt/critsect.h>
 #include <iprt/mem.h>
+#include <iprt/process.h>
 #include <iprt/system.h>
 
@@ -37 +38 @@
 #include <sddl.h>
 #include <lmcons.h> /* UNLEN */
+
+#include "MachineLaunchVMCommonWorker.h"
+
+
+/*********************************************************************************************************************************
+*   Defined Constants And Macros                                                                                                 *
+*********************************************************************************************************************************/
+#define INTERACTIVE_SID_FLAG 0x1
+#define LOCAL_SID_FLAG       0x2
+#define LOGON_SID_FLAG       0x4
+#define IS_INTERACTIVE       (LOCAL_SID_FLAG|INTERACTIVE_SID_FLAG|LOGON_SID_FLAG)
 
 
@@ -388 +400 @@
         hrc = E_INVALIDARG;
     LogRel2(("VirtualBoxSDS::deregisterVBoxSVC: returns %Rhrc\n", hrc));
+    return hrc;
+}
+
+
+STDMETHODIMP VirtualBoxSDS::LaunchVMProcess(IN_BSTR aMachine, IN_BSTR aComment, IN_BSTR aFrontend, IN_BSTR aEnvironmentChanges,
+                                            IN_BSTR aCmdOptions, ULONG aSessionId, ULONG *aPid)
+{
+    /*
+     * Convert parameters to UTF-8.
+     */
+    Utf8Str strMachine(aMachine);
+    Utf8Str strComment(aComment);
+    Utf8Str strFrontend(aFrontend);
+    Utf8Str strEnvironmentChanges(aEnvironmentChanges);
+    Utf8Str strCmdOptions(aCmdOptions);
+
+    /*
+     * Impersonate the caller.
+     */
+    HRESULT hrc = CoImpersonateClient();
+    if (SUCCEEDED(hrc))
+    {
+        try
+        {
+            /*
+             * Try launch the VM process as the client.
+             */
+            RTPROCESS pid;
+            AssertCompile(sizeof(aSessionId) == sizeof(uint32_t));
+            int vrc = ::MachineLaunchVMCommonWorker(strMachine, strComment, strFrontend, strEnvironmentChanges,
+                                                    strCmdOptions, Utf8Str(),
+                                                    RTPROC_FLAGS_AS_IMPERSONATED_TOKEN | RTPROC_FLAGS_SERVICE
+                                                    | RTPROC_FLAGS_PROFILE | RTPROC_FLAGS_DESIRED_SESSION_ID,
+                                                    &aSessionId, pid);
+            if (RT_SUCCESS(vrc))
+            {
+                *aPid = (ULONG)pid;
+                LogRel(("VirtualBoxSDS::LaunchVMProcess: launchVM succeeded\n"));
+            }
+            else if (vrc == VERR_INVALID_PARAMETER)
+            {
+                hrc = E_INVALIDARG;
+                LogRel(("VirtualBoxSDS::LaunchVMProcess: launchVM failed: %Rhrc\n", hrc));
+            }
+            else
+            {
+                hrc = VBOX_E_IPRT_ERROR;
+                LogRel(("VirtualBoxSDS::LaunchVMProcess: launchVM failed: %Rhrc (%Rrc)\n", hrc));
+            }
+        }
+        catch (...)
+        {
+            hrc = E_UNEXPECTED;
+        }
+        CoRevertToSelf();
+    }
+    else
+        LogRel(("VirtualBoxSDS::LaunchVMProcess: CoImpersonateClient failed: %Rhrc\n", hrc));
     return hrc;
 }
@@ -592 +662 @@
 }
 
+
 #ifdef WITH_WATCHER
 /**

trunk/src/VBox/Main/src-helper-apps/VBoxExtPackHelperApp.cpp

@@ -1548 +1548 @@
          */
         RTPROCESS hProcess;
-        rc = RTProcCreateEx(papszArgs[iSuArg], &papszArgs[iSuArg], RTENV_DEFAULT, 0 /*fFlags*/,
-                            NULL /*phStdIn*/, NULL /*phStdOut*/, NULL /*phStdErr*/, NULL /*pszAsUser*/, NULL /*pszPassword*/,
+        rc = RTProcCreateEx(papszArgs[iSuArg], &papszArgs[iSuArg], RTENV_DEFAULT, 0 /*fFlags*/, NULL /*phStdIn*/,
+                            NULL /*phStdOut*/, NULL /*phStdErr*/, NULL /*pszAsUser*/, NULL /*pszPassword*/, NULL /* pvExtraData*/,
                             &hProcess);
         if (RT_SUCCESS(rc))

trunk/src/VBox/Main/src-server/ClientToken.cpp

@@ -40 +40 @@
 #include "ClientToken.h"
 #include "MachineImpl.h"
+
+#ifdef RT_OS_WINDOWS
+# include <sddl.h>
+#endif
 
 Machine::ClientToken::ClientToken()
@@ -83 +87 @@
 #if defined(RT_OS_WINDOWS)
     NOREF(pSessionMachine);
-    Bstr tokenId = pMachine->mData->m_strConfigFileFull;
-    for (size_t i = 0; i < tokenId.length(); i++)
-        if (tokenId.raw()[i] == '\\')
-            tokenId.raw()[i] = '/';
-    mClientToken = ::CreateMutex(NULL, FALSE, tokenId.raw());
+
+    /* Get user's SID to use it as part of the mutex name to distinguish shared machine instances
+     * between users
+     */
+    Utf8Str strUserSid;
+    HANDLE  hProcessToken = INVALID_HANDLE_VALUE;
+    if (::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &hProcessToken))
+    {
+        DWORD dwSize = 0;
+        BOOL fRc = ::GetTokenInformation(hProcessToken, TokenUser, NULL, 0, &dwSize);
+        DWORD dwErr = ::GetLastError();
+        if (!fRc && dwErr == ERROR_INSUFFICIENT_BUFFER && dwSize > 0)
+        {
+            PTOKEN_USER pTokenUser = (PTOKEN_USER)RTMemTmpAllocZ(dwSize);
+            if (pTokenUser)
+            {
+                if (::GetTokenInformation(hProcessToken, TokenUser, pTokenUser, dwSize, &dwSize))
+                {
+                    PRTUTF16 wstrSid = NULL;
+                    if (::ConvertSidToStringSid(pTokenUser->User.Sid, &wstrSid))
+                    {
+                        strUserSid = wstrSid;
+                        ::LocalFree(wstrSid);
+                    }
+                    else
+                        AssertMsgFailed(("Cannot convert SID to string, err=%u", ::GetLastError()));
+                }
+                else
+                    AssertMsgFailed(("Cannot get thread access token information, err=%u", ::GetLastError()));
+                RTMemFree(pTokenUser);
+            }
+            else
+                AssertMsgFailed(("No memory"));
+        }
+        else
+            AssertMsgFailed(("Cannot get thread access token information, err=%u", ::GetLastError()));
+        CloseHandle(hProcessToken);
+    }
+    else
+        AssertMsgFailed(("Cannot get thread access token, err=%u", ::GetLastError()));
+
+    Bstr tokenId = Bstr(Utf8Str("Global\\") + strUserSid + "/" + pMachine->mData->mUuid.toString());
+
+    /* create security descriptor to allow SYNCHRONIZE access from any windows sessions and users.
+     * otherwise VM can't open the mutex if VBoxSVC and VM are in different session (e.g. some VM
+     * started by autostart service)
+     *
+     * SDDL string contains following ACEs:
+     *   CreateOwner           : MUTEX_ALL_ACCESS
+     *   System                : MUTEX_ALL_ACCESS
+     *   BuiltInAdministrators : MUTEX_ALL_ACCESS
+     *   Everyone              : SYNCHRONIZE|MUTEX_MODIFY_STATE
+     */
+
+    //static const RTUTF16 s_wszSecDesc[] = L"D:(A;;0x1F0001;;;CO)(A;;0x1F0001;;;SY)(A;;0x1F0001;;;BA)(A;;0x100001;;;WD)";
+    com::BstrFmt bstrSecDesc("O:%sD:(A;;0x1F0001;;;CO)(A;;0x1F0001;;;SY)(A;;0x1F0001;;;BA)", strUserSid.c_str());
+    PSECURITY_DESCRIPTOR pSecDesc = NULL;
+    //AssertMsgStmt(::ConvertStringSecurityDescriptorToSecurityDescriptor(s_wszSecDesc, SDDL_REVISION_1, &pSecDesc, NULL),
+    AssertMsgStmt(::ConvertStringSecurityDescriptorToSecurityDescriptor(bstrSecDesc.raw(), SDDL_REVISION_1, &pSecDesc, NULL),
+                  ("Cannot create security descriptor for token '%ls', err=%u", tokenId.raw(), GetLastError()),
+                  pSecDesc = NULL);
+
+    SECURITY_ATTRIBUTES SecAttr;
+    SecAttr.lpSecurityDescriptor = pSecDesc;
+    SecAttr.nLength              = sizeof(SecAttr);
+    SecAttr.bInheritHandle       = FALSE;
+    mClientToken = ::CreateMutex(&SecAttr, FALSE, tokenId.raw());
     mClientTokenId = tokenId;
-    AssertMsg(mClientToken,
-              ("Cannot create token '%s', err=%d",
-               mClientTokenId.c_str(), ::GetLastError()));
+    AssertMsg(mClientToken, ("Cannot create token '%s', err=%d", mClientTokenId.c_str(), ::GetLastError()));
+
+    if (pSecDesc)
+        ::LocalFree(pSecDesc);
+
 #elif defined(RT_OS_OS2)
     NOREF(pSessionMachine);

trunk/src/VBox/Main/src-server/MachineImpl.cpp

@@ -49 +49 @@
 #include "MachineImplMoveVM.h"
 #include "ExtPackManagerImpl.h"
+#include "MachineLaunchVMCommonWorker.h"
 
 // generated header
@@ -7409 +7410 @@
     }
 
-    /* get the path to the executable */
-    char szPath[RTPATH_MAX];
-    RTPathAppPrivateArch(szPath, sizeof(szPath) - 1);
-    size_t cchBufLeft = strlen(szPath);
-    szPath[cchBufLeft++] = RTPATH_DELIMITER;
-    szPath[cchBufLeft] = 0;
-    char *pszNamePart = szPath + cchBufLeft;
-    cchBufLeft = sizeof(szPath) - cchBufLeft;
-
-    int vrc = VINF_SUCCESS;
-    RTPROCESS pid = NIL_RTPROCESS;
-
-    RTENV env = RTENV_DEFAULT;
-
-    if (!strEnvironment.isEmpty())
-    {
-        char *newEnvStr = NULL;
-
-        do
-        {
-            /* clone the current environment */
-            int vrc2 = RTEnvClone(&env, RTENV_DEFAULT);
-            AssertRCBreakStmt(vrc2, vrc = vrc2);
-
-            newEnvStr = RTStrDup(strEnvironment.c_str());
-            AssertPtrBreakStmt(newEnvStr, vrc = vrc2);
-
-            /* put new variables to the environment
-             * (ignore empty variable names here since RTEnv API
-             * intentionally doesn't do that) */
-            char *var = newEnvStr;
-            for (char *p = newEnvStr; *p; ++p)
-            {
-                if (*p == '\n' && (p == newEnvStr || *(p - 1) != '\\'))
-                {
-                    *p = '\0';
-                    if (*var)
-                    {
-                        char *val = strchr(var, '=');
-                        if (val)
-                        {
-                            *val++ = '\0';
-                            vrc2 = RTEnvSetEx(env, var, val);
-                        }
-                        else
-                            vrc2 = RTEnvUnsetEx(env, var);
-                        if (RT_FAILURE(vrc2))
-                            break;
-                    }
-                    var = p + 1;
-                }
-            }
-            if (RT_SUCCESS(vrc2) && *var)
-                vrc2 = RTEnvPutEx(env, var);
-
-            AssertRCBreakStmt(vrc2, vrc = vrc2);
-        }
-        while (0);
-
-        if (newEnvStr != NULL)
-            RTStrFree(newEnvStr);
-    }
-
     /* Hardening logging */
 #if defined(RT_OS_WINDOWS) && defined(VBOX_WITH_HARDENING)
@@ -7493 +7431 @@
         RTFileDelete(strOldStartupLogFile.c_str());
     }
-    const char *pszSupHardeningLogArg = strSupHardeningLogArg.c_str();
 #else
-    const char *pszSupHardeningLogArg = NULL;
+    Utf8Str strSupHardeningLogArg;
 #endif
 
+    Utf8Str strAppOverride;
+#ifdef RT_OS_DARWIN /* Avoid Launch Services confusing this with the selector by using a helper app. */
+    strAppOverride = i_getExtraData(Utf8Str("VBoxInternal2/VirtualBoxVMAppOverride"));
+#endif
+
+    bool fUseVBoxSDS = false;
     Utf8Str strCanonicalName;
-
+    if (false)
+    { }
 #ifdef VBOX_WITH_QTGUI
-    if (   !strFrontend.compare("gui", Utf8Str::CaseInsensitive)
-        || !strFrontend.compare("GUI/Qt", Utf8Str::CaseInsensitive)
-        || !strFrontend.compare("separate", Utf8Str::CaseInsensitive)
-        || !strFrontend.compare("gui/separate", Utf8Str::CaseInsensitive)
-        || !strFrontend.compare("GUI/Qt/separate", Utf8Str::CaseInsensitive))
+    else if (   !strFrontend.compare("gui", Utf8Str::CaseInsensitive)
+             || !strFrontend.compare("GUI/Qt", Utf8Str::CaseInsensitive)
+             || !strFrontend.compare("separate", Utf8Str::CaseInsensitive)
+             || !strFrontend.compare("gui/separate", Utf8Str::CaseInsensitive)
+             || !strFrontend.compare("GUI/Qt/separate", Utf8Str::CaseInsensitive))
     {
         strCanonicalName = "GUI/Qt";
-# ifdef RT_OS_DARWIN /* Avoid Launch Services confusing this with the selector by using a helper app. */
-        /* Modify the base path so that we don't need to use ".." below. */
-        RTPathStripTrailingSlash(szPath);
-        RTPathStripFilename(szPath);
-        cchBufLeft = strlen(szPath);
-        pszNamePart = szPath + cchBufLeft;
-        cchBufLeft = sizeof(szPath) - cchBufLeft;
-
-#  define OSX_APP_NAME "VirtualBoxVM"
-#  define OSX_APP_PATH_FMT "/Resources/%s.app/Contents/MacOS/VirtualBoxVM"
-
-        Utf8Str strAppOverride = i_getExtraData(Utf8Str("VBoxInternal2/VirtualBoxVMAppOverride"));
-        if (   strAppOverride.contains(".")
-            || strAppOverride.contains("/")
-            || strAppOverride.contains("\\")
-            || strAppOverride.contains(":"))
-            strAppOverride.setNull();
-        Utf8Str strAppPath;
-        if (!strAppOverride.isEmpty())
-        {
-            strAppPath = Utf8StrFmt(OSX_APP_PATH_FMT, strAppOverride.c_str());
-            Utf8Str strFullPath(szPath);
-            strFullPath.append(strAppPath);
-            /* there is a race, but people using this deserve the failure */
-            if (!RTFileExists(strFullPath.c_str()))
-                strAppOverride.setNull();
-        }
-        if (strAppOverride.isEmpty())
-            strAppPath = Utf8StrFmt(OSX_APP_PATH_FMT, OSX_APP_NAME);
-        AssertReturn(cchBufLeft > strAppPath.length(), E_UNEXPECTED);
-        strcpy(pszNamePart, strAppPath.c_str());
-# else
-        static const char s_szVirtualBox_exe[] = "VirtualBoxVM" HOSTSUFF_EXE;
-        Assert(cchBufLeft >= sizeof(s_szVirtualBox_exe));
-        strcpy(pszNamePart, s_szVirtualBox_exe);
-# endif
-
-        Utf8Str idStr = mData->mUuid.toString();
-        const char *apszArgs[] =
-        {
-            szPath,
-            "--comment", mUserData->s.strName.c_str(),
-            "--startvm", idStr.c_str(),
-            "--no-startvm-errormsgbox",
-            NULL, /* For "--separate". */
-            NULL, /* For "--sup-startup-log". */
-            NULL
-        };
-        unsigned iArg = 6;
-        if (fSeparate)
-            apszArgs[iArg++] = "--separate";
-        apszArgs[iArg++] = pszSupHardeningLogArg;
-
-        vrc = RTProcCreate(szPath, apszArgs, env, 0, &pid);
-    }
-#else /* !VBOX_WITH_QTGUI */
-    if (0)
-        ;
-#endif /* VBOX_WITH_QTGUI */
-
+        fUseVBoxSDS = true;
+    }
+#endif
+#ifdef VBOX_WITH_VBOXSDL
+    else if (   !strFrontend.compare("sdl", Utf8Str::CaseInsensitive)
+             || !strFrontend.compare("GUI/SDL", Utf8Str::CaseInsensitive)
+             || !strFrontend.compare("sdl/separate", Utf8Str::CaseInsensitive)
+             || !strFrontend.compare("GUI/SDL/separate", Utf8Str::CaseInsensitive))
+    {
+        strCanonicalName = "GUI/SDL";
+        fUseVBoxSDS = true;
+    }
+#endif
+#ifdef VBOX_WITH_HEADLESS
+    else if (   !strFrontend.compare("headless", Utf8Str::CaseInsensitive)
+             || !strFrontend.compare("capture", Utf8Str::CaseInsensitive)
+             || !strFrontend.compare("vrdp", Utf8Str::CaseInsensitive) /* Deprecated. Same as headless. */)
+    {
+        strCanonicalName = "headless";
+    }
+#endif
     else
-
-#ifdef VBOX_WITH_VBOXSDL
-    if (   !strFrontend.compare("sdl", Utf8Str::CaseInsensitive)
-        || !strFrontend.compare("GUI/SDL", Utf8Str::CaseInsensitive)
-        || !strFrontend.compare("sdl/separate", Utf8Str::CaseInsensitive)
-        || !strFrontend.compare("GUI/SDL/separate", Utf8Str::CaseInsensitive))
-    {
-        strCanonicalName = "GUI/SDL";
-        static const char s_szVBoxSDL_exe[] = "VBoxSDL" HOSTSUFF_EXE;
-        Assert(cchBufLeft >= sizeof(s_szVBoxSDL_exe));
-        strcpy(pszNamePart, s_szVBoxSDL_exe);
-
-        Utf8Str idStr = mData->mUuid.toString();
-        const char *apszArgs[] =
-        {
-            szPath,
-            "--comment", mUserData->s.strName.c_str(),
-            "--startvm", idStr.c_str(),
-            NULL, /* For "--separate". */
-            NULL, /* For "--sup-startup-log". */
-            NULL
-        };
-        unsigned iArg = 5;
-        if (fSeparate)
-            apszArgs[iArg++] = "--separate";
-        apszArgs[iArg++] = pszSupHardeningLogArg;
-
-        vrc = RTProcCreate(szPath, apszArgs, env, 0, &pid);
-    }
-#else /* !VBOX_WITH_VBOXSDL */
-    if (0)
-        ;
-#endif /* !VBOX_WITH_VBOXSDL */
-
+        return setError(E_INVALIDARG, tr("Invalid frontend name: '%s'"), strFrontend.c_str());
+
+    Utf8Str idStr = mData->mUuid.toString();
+    Utf8Str const &strMachineName = mUserData->s.strName;
+    RTPROCESS pid = NIL_RTPROCESS;
+
+#if !defined(VBOX_WITH_SDS) || !defined(RT_OS_WINDOWS)
+    RT_NOREF(fUseVBoxSDS);
+#else
+    DWORD idCallerSession = ~(DWORD)0;
+    if (fUseVBoxSDS)
+    {
+        /*
+         * The VBoxSDS should be used for process launching the VM with
+         * GUI only if the caller and the VBoxSDS are in different Windows
+         * sessions and the caller in the interactive one.
+         */
+        fUseVBoxSDS = false; 
+
+        /* Get windows session of the current process.  The process token used
+           due to several reasons:
+           1. The token is absent for the current thread except someone set it
+              for us.
+           2. Needs to get the id of the session where the process is started. 
+           We only need to do this once, though. */
+        static DWORD s_idCurrentSession = ~(DWORD)0;
+        DWORD idCurrentSession = s_idCurrentSession;
+        if (idCurrentSession == ~(DWORD)0)
+        {
+            HANDLE hCurrentProcessToken = NULL;
+            if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_READ, &hCurrentProcessToken))
+            {
+                DWORD cbIgn = 0;
+                if (GetTokenInformation(hCurrentProcessToken, TokenSessionId, &idCurrentSession, sizeof(idCurrentSession), &cbIgn))
+                    s_idCurrentSession = idCurrentSession;
+                else
+                {
+                    idCurrentSession = ~(DWORD)0;
+                    LogRelFunc(("GetTokenInformation/TokenSessionId on self failed: %u\n", GetLastError()));
+                }
+                CloseHandle(hCurrentProcessToken);
+            }
+            else
+                LogRelFunc(("OpenProcessToken/self failed: %u\n", GetLastError()));
+        }
+
+        /* get the caller's session */
+        HRESULT hrc = CoImpersonateClient();
+        if (SUCCEEDED(hrc))
+        {
+            HANDLE hCallerThreadToken;
+            if (OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_READ,
+                                FALSE /* OpenAsSelf - for impersonation at SecurityIdentification level */,
+                                &hCallerThreadToken))
+            {
+                SetLastError(NO_ERROR);
+                DWORD cbIgn = 0;
+                if (GetTokenInformation(hCallerThreadToken, TokenSessionId, &idCallerSession, sizeof(DWORD), &cbIgn))
+                {
+                    /* Only need to use SDS if the session ID differs: */
+                    if (idCurrentSession != idCallerSession)
+                    {
+                        fUseVBoxSDS = false;
+
+                        /* Obtain the groups the access token belongs to so we can see if the session is interactive: */
+                        DWORD         cbTokenGroups = 0;
+                        PTOKEN_GROUPS pTokenGroups  = NULL;
+                        if (   !GetTokenInformation(hCallerThreadToken, TokenGroups, pTokenGroups, 0, &cbTokenGroups)
+                            && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
+                            pTokenGroups = (PTOKEN_GROUPS)RTMemTmpAllocZ(cbTokenGroups);
+                        if (GetTokenInformation(hCallerThreadToken, TokenGroups, pTokenGroups, cbTokenGroups, &cbTokenGroups))
+                        {
+                            /* Well-known interactive SID: SECURITY_INTERACTIVE_RID, S-1-5-4: */
+                            SID_IDENTIFIER_AUTHORITY sidIdNTAuthority = SECURITY_NT_AUTHORITY;
+                            PSID                     pInteractiveSid = NULL;
+                            if (AllocateAndInitializeSid(&sidIdNTAuthority, 1, 4, 0, 0, 0, 0, 0, 0, 0, &pInteractiveSid))
+                            {
+                                /* Iterate over the groups looking for the interactive SID: */
+                                fUseVBoxSDS = false;
+                                for (DWORD dwIndex = 0; dwIndex < pTokenGroups->GroupCount; dwIndex++)
+                                    if (EqualSid(pTokenGroups->Groups[dwIndex].Sid, pInteractiveSid))
+                                    {
+                                        fUseVBoxSDS = true;
+                                        break;
+                                    }
+                                FreeSid(pInteractiveSid);
+                            }
+                        }
+                        else
+                            LogRelFunc(("GetTokenInformation/TokenGroups failed: %u\n", GetLastError()));
+                        RTMemTmpFree(pTokenGroups);
+                    }
+                }
+                else
+                    LogRelFunc(("GetTokenInformation/TokenSessionId failed: %u\n", GetLastError()));
+                CloseHandle(hCallerThreadToken);
+            }
+            else
+                LogRelFunc(("OpenThreadToken/client failed: %u\n", GetLastError()));
+            CoRevertToSelf();
+        }
+        else
+            LogRelFunc(("CoImpersonateClient failed: %Rhrc\n", hrc));
+    }
+    if (fUseVBoxSDS)
+    {
+        /* connect to VBoxSDS */
+        ComPtr<IVirtualBoxSDS> pVBoxSDS;
+        HRESULT rc = pVBoxSDS.createLocalObject(CLSID_VirtualBoxSDS);
+        if (FAILED(rc))
+            return setError(rc, tr("Failed to start the machine '%s'. A connection to VBoxSDS cannot be established"),
+                            strMachineName.c_str());
+
+        /* By default the RPC_C_IMP_LEVEL_IDENTIFY is used for impersonation the client. It allows
+           ACL checking but restricts an access to system objects e.g. files. Call to CoSetProxyBlanket
+           elevates the impersonation level up to RPC_C_IMP_LEVEL_IMPERSONATE allowing the VBoxSDS
+           service to access the files. */
+        rc = CoSetProxyBlanket(pVBoxSDS,
+                               RPC_C_AUTHN_DEFAULT,
+                               RPC_C_AUTHZ_DEFAULT,
+                               COLE_DEFAULT_PRINCIPAL,
+                               RPC_C_AUTHN_LEVEL_DEFAULT,
+                               RPC_C_IMP_LEVEL_IMPERSONATE,
+                               NULL,
+                               EOAC_DEFAULT);
+        if (FAILED(rc))
+            return setError(rc, tr("Failed to start the machine '%s'. CoSetProxyBlanket failed"), strMachineName.c_str());
+        ULONG uPid = 0;
+        rc = pVBoxSDS->LaunchVMProcess(Bstr(idStr).raw(), Bstr(strMachineName).raw(), Bstr(strFrontend).raw(),
+                                       Bstr(strEnvironment).raw(), Bstr(strSupHardeningLogArg).raw(),
+                                       idCallerSession, &uPid);
+        if (FAILED(rc))
+            return setError(rc, tr("Failed to start the machine '%s'. Process creation failed"), strMachineName.c_str());
+        pid = (RTPROCESS)uPid;
+    }
     else
-
-#ifdef VBOX_WITH_HEADLESS
-    if (   !strFrontend.compare("headless", Utf8Str::CaseInsensitive)
-        || !strFrontend.compare("capture", Utf8Str::CaseInsensitive)
-        || !strFrontend.compare("vrdp", Utf8Str::CaseInsensitive) /* Deprecated. Same as headless. */
-       )
-    {
-        strCanonicalName = "headless";
-        /* On pre-4.0 the "headless" type was used for passing "--vrdp off" to VBoxHeadless to let it work in OSE,
-         * which did not contain VRDP server. In VBox 4.0 the remote desktop server (VRDE) is optional,
-         * and a VM works even if the server has not been installed.
-         * So in 4.0 the "headless" behavior remains the same for default VBox installations.
-         * Only if a VRDE has been installed and the VM enables it, the "headless" will work
-         * differently in 4.0 and 3.x.
-         */
-        static const char s_szVBoxHeadless_exe[] = "VBoxHeadless" HOSTSUFF_EXE;
-        Assert(cchBufLeft >= sizeof(s_szVBoxHeadless_exe));
-        strcpy(pszNamePart, s_szVBoxHeadless_exe);
-
-        Utf8Str idStr = mData->mUuid.toString();
-        const char *apszArgs[] =
-        {
-            szPath,
-            "--comment", mUserData->s.strName.c_str(),
-            "--startvm", idStr.c_str(),
-            "--vrde", "config",
-            NULL, /* For "--capture". */
-            NULL, /* For "--sup-startup-log". */
-            NULL
-        };
-        unsigned iArg = 7;
-        if (!strFrontend.compare("capture", Utf8Str::CaseInsensitive))
-            apszArgs[iArg++] = "--capture";
-        apszArgs[iArg++] = pszSupHardeningLogArg;
-
-# ifdef RT_OS_WINDOWS
-        vrc = RTProcCreate(szPath, apszArgs, env, RTPROC_FLAGS_NO_WINDOW, &pid);
-# else
-        vrc = RTProcCreate(szPath, apszArgs, env, 0, &pid);
-# endif
-    }
-#else /* !VBOX_WITH_HEADLESS */
-    if (0)
-        ;
-#endif /* !VBOX_WITH_HEADLESS */
-    else
-    {
-        RTEnvDestroy(env);
-        return setError(E_INVALIDARG,
-                        tr("Invalid frontend name: '%s'"),
-                        strFrontend.c_str());
-    }
-
-    RTEnvDestroy(env);
-
-    if (RT_FAILURE(vrc))
-        return setErrorBoth(VBOX_E_IPRT_ERROR, vrc,
-                            tr("Could not launch a process for the machine '%s' (%Rrc)"),
-                            mUserData->s.strName.c_str(), vrc);
-
-    LogFlowThisFunc(("launched.pid=%d(0x%x)\n", pid, pid));
+#endif /* VBOX_WITH_VBOXSDS && RT_OS_WINDOWS */
+    {
+        int vrc = MachineLaunchVMCommonWorker(idStr, strMachineName, strFrontend, strEnvironment, strSupHardeningLogArg,
+                                              strAppOverride, 0 /*fFlags*/, NULL /*pvExtraData*/, pid);
+        if (RT_FAILURE(vrc))
+            return setErrorBoth(VBOX_E_IPRT_ERROR, vrc,
+                                tr("Could not launch the VM process for the machine '%s' (%Rrc)"), strMachineName.c_str(), vrc);
+    }
+
+    LogRel(("Launched VM: %u pid: %u (%#x) frontend: %s name: %s\n",
+            idStr.c_str(), pid, pid, strFrontend.c_str(), strMachineName.c_str()));
 
     if (!fSeparate)

trunk/src/VBox/Main/src-server/generic/AutostartDb-generic.cpp

@@ -190 +190 @@
     rc = autostartModifyDb(true /* fAutostart */, true /* fAddVM */);
     RTCritSectLeave(&this->CritSect);
-#elif defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS)
+#elif defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS) || defined(RT_OS_WINDOWS)
     NOREF(pszVMId); /* Not needed */
     rc = VINF_SUCCESS;
@@ -210 +210 @@
     rc = autostartModifyDb(true /* fAutostart */, false /* fAddVM */);
     RTCritSectLeave(&this->CritSect);
-#elif defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS)
+#elif defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS) || defined(RT_OS_WINDOWS)
     NOREF(pszVMId); /* Not needed */
     rc = VINF_SUCCESS;
@@ -230 +230 @@
     rc = autostartModifyDb(false /* fAutostart */, true /* fAddVM */);
     RTCritSectLeave(&this->CritSect);
-#elif defined(RT_OS_DARWIN)
+#elif defined(RT_OS_DARWIN) || defined(RT_OS_WINDOWS)
     NOREF(pszVMId); /* Not needed */
     rc = VINF_SUCCESS;
@@ -250 +250 @@
     rc = autostartModifyDb(false /* fAutostart */, false /* fAddVM */);
     RTCritSectLeave(&this->CritSect);
-#elif defined(RT_OS_DARWIN)
-    NOREF(pszVMId); /* Not needed */
-    rc = VINF_SUCCESS;
-#else
-    NOREF(pszVMId);
-    rc = VERR_NOT_SUPPORTED;
-#endif
-
-    return rc;
-}
-
+#elif defined(RT_OS_DARWIN) || defined (RT_OS_WINDOWS)
+    NOREF(pszVMId); /* Not needed */
+    rc = VINF_SUCCESS;
+#else
+    NOREF(pszVMId);
+    rc = VERR_NOT_SUPPORTED;
+#endif
+
+    return rc;
+}
+