Changeset 95274 in vbox for trunk/src/VBox/Main/src-global

Timestamp:

Jun 14, 2022 10:48:33 AM (3 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

151855

Message:

FE/VBoxAutostart/adi: Added experimental support for running VBoxSVC session 0 (service session). Did some minor cleanup for the patch posted at comment 95. Disabled by default for now. bugref:9341

File:

• trunk/src/VBox/Main/src-global/win/VirtualBoxSDSImpl.cpp (modified) (12 diffs)

trunk/src/VBox/Main/src-global/win/VirtualBoxSDSImpl.cpp

@@ -22 +22 @@
 #define LOG_GROUP LOG_GROUP_MAIN_VIRTUALBOXSDS
 #include <VBox/com/VirtualBox.h>
+#include <VBox/com/utils.h>
 #include "VirtualBoxSDSImpl.h"
 
@@ -31 +32 @@
 #include <iprt/asm.h>
 #include <iprt/critsect.h>
+#include <iprt/env.h>
+#include <iprt/err.h>
 #include <iprt/mem.h>
+#include <iprt/path.h>
 #include <iprt/process.h>
 #include <iprt/system.h>
@@ -71 +75 @@
     /** The PID of the chosen one. */
     RTPROCESS                       m_pidTheChosenOne;
+    /** The tick count when the process in Windows session 0 started */
+    uint32_t                        m_tickTheChosenOne;
     /** The current watcher thread index, UINT32_MAX if not watched. */
     uint32_t                        m_iWatcher;
@@ -89 +95 @@
         , m_strUsername(a_rStrUsername)
         , m_pidTheChosenOne(NIL_RTPROCESS)
+        , m_tickTheChosenOne(0)
 #ifdef WITH_WATCHER
         , m_iWatcher(UINT32_MAX)
@@ -146 +153 @@
         }
         m_pidTheChosenOne = NIL_RTPROCESS;
+        m_tickTheChosenOne = 0;
     }
 
@@ -250 +258 @@
     {
         *aExistingVirtualBox = NULL;
-
         /*
          * Get the client user SID and name.
@@ -263 +270 @@
                 /*
                  * If there already is a chosen one, ask it for a IVirtualBox instance
-                 * to return to the caller.  Should it be dead or unresponsive, the caller
+                 * to return to the caller. Should it be dead or unresponsive, the caller
                  * takes its place.
-                 */
+                */
                 if (pUserData->m_ptrTheChosenOne.isNotNull())
                 {
@@ -271 +278 @@
                     {
                         hrc = pUserData->m_ptrTheChosenOne->GetVirtualBox(aExistingVirtualBox);
+                        /* seems the VBoxSVC in windows session 0 is not yet finished object creation.
+                         * Give it a time. */
+                        if (FAILED(hrc) && GetTickCount() - pUserData->m_tickTheChosenOne < 60 * 1000)
+                            hrc = E_PENDING;
                     }
                     catch (...)
@@ -284 +295 @@
 #endif
                         pUserData->i_unchooseTheOne(true /*fIrregular*/);
+                        hrc = S_OK;
                     }
                 }
@@ -289 +301 @@
                     hrc = S_OK;
 
-                /*
-                 * No chosen one?  Make the caller the new chosen one!
-                 */
-                if (pUserData->m_ptrTheChosenOne.isNull())
+                /* No chosen one?  Make the caller the new chosen one! */
+                if (SUCCEEDED(hrc) && pUserData->m_ptrTheChosenOne.isNull())
                 {
-                    LogRel(("registerVBoxSVC: Making aPid=%u (%#x) the chosen one for user %s (%s)!\n",
-                            aPid, aPid, pUserData->m_strUserSid.c_str(), pUserData->m_strUsername.c_str()));
+#ifdef VBOX_WITH_VBOXSVC_SESSION_0
+                    /* Get user token. */
+                    HANDLE hThreadToken = NULL;
+                    hrc = CoImpersonateClient();
+                    if (SUCCEEDED(hrc))
+                    {
+                        hrc = E_FAIL;
+                        if (OpenThreadToken(GetCurrentThread(),
+                                              TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE
+                                            | TOKEN_ASSIGN_PRIMARY | TOKEN_ADJUST_SESSIONID | TOKEN_READ | TOKEN_WRITE,
+                                            TRUE /* OpenAsSelf - for impersonation at SecurityIdentification level */,
+                                            &hThreadToken))
+                        {
+                            HANDLE hNewToken;
+                            if (DuplicateTokenEx(hThreadToken, MAXIMUM_ALLOWED, NULL /*SecurityAttribs*/,
+                                                    SecurityIdentification, TokenPrimary, &hNewToken))
+                            {
+                                CloseHandle(hThreadToken);
+                                hThreadToken = hNewToken;
+                                hrc = S_OK;
+                            }
+                            else
+                                LogRel(("registerVBoxSVC: DuplicateTokenEx failed: %ld\n", GetLastError()));
+                        }
+                        else
+                            LogRel(("registerVBoxSVC: OpenThreadToken failed: %ld\n", GetLastError()));
+
+                        CoRevertToSelf();
+                    }
+                    else
+                        LogRel(("registerVBoxSVC: CoImpersonateClient failed: %Rhrc\n", hrc));
+
+                    /* check windows session */
+                    DWORD dwSessionId = 0;
+                    if (SUCCEEDED(hrc) && hThreadToken != NULL)
+                    {
+                        hrc = E_FAIL;
+                        DWORD cbSessionId = sizeof(DWORD);
+                        if (GetTokenInformation(hThreadToken, TokenSessionId, (LPVOID)&dwSessionId, cbSessionId, &cbSessionId))
+                        {
+                            if (cbSessionId == sizeof(DWORD))
+                                hrc = S_OK;
+                            else
+                                LogRel(("registerVBoxSVC: GetTokenInformation return value has invalid size\n"));
+                        }
+                        else
+                            LogRel(("registerVBoxSVC: GetTokenInformation failed: %ld\n", GetLastError()));
+                    }
+                    if (SUCCEEDED(hrc) && dwSessionId != 0)
+                    {
+                        /* if VBoxSVC in the Windows session 0 is not started or if it did not
+                            * registered during a minute, start new one */
+                        if (   pUserData->m_pidTheChosenOne == NIL_RTPROCESS
+                            || GetTickCount() - pUserData->m_tickTheChosenOne > 60 * 1000)
+                        {
+                            uint32_t uSessionId = 0;
+                            if (SetTokenInformation(hThreadToken, TokenSessionId, &uSessionId, sizeof(uint32_t)))
+                            {
+                                /* start VBoxSVC process */
+                                /* Get the path to the executable directory w/ trailing slash: */
+                                char szPath[RTPATH_MAX];
+                                int vrc = RTPathAppPrivateArch(szPath, sizeof(szPath));
+                                AssertRCReturn(vrc, vrc);
+                                size_t cbBufLeft = RTPathEnsureTrailingSeparator(szPath, sizeof(szPath));
+                                AssertReturn(cbBufLeft > 0, VERR_FILENAME_TOO_LONG);
+                                char *pszNamePart = &szPath[cbBufLeft]; NOREF(pszNamePart);
+                                cbBufLeft = sizeof(szPath) - cbBufLeft;
+                                static const char s_szVirtualBox_exe[] = "VBoxSVC.exe";
+                                vrc = RTStrCopy(pszNamePart, cbBufLeft, s_szVirtualBox_exe);
+                                AssertRCReturn(vrc, vrc);
+                                const char *apszArgs[] =
+                                {
+                                    szPath,
+                                    "--registervbox",
+                                    NULL
+                                };
+
+                                RTPROCESS pid;
+                                vrc = RTProcCreateEx(szPath,
+                                                     apszArgs,
+                                                     RTENV_DEFAULT,
+                                                     RTPROC_FLAGS_TOKEN_SUPPLIED,
+                                                     NULL, NULL, NULL, NULL, NULL, &hThreadToken, &pid);
+
+                                if (RT_SUCCESS(vrc))
+                                {
+                                    pUserData->m_pidTheChosenOne = pid;
+                                    pUserData->m_tickTheChosenOne = GetTickCount();
+                                    hrc = E_PENDING;
+                                }
+                                else
+                                    LogRel(("registerVBoxSVC: Create VBoxSVC process failed: %Rrc\n", vrc));
+                            }
+                            else
+                            {
+                                hrc = E_FAIL;
+                                LogRel(("registerVBoxSVC: SetTokenInformation failed: %ld\n", GetLastError()));
+                            }
+                        }
+                        else /* the VBoxSVC in Windows session 0 already started */
+                            hrc = E_PENDING;
+                    }
+                    CloseHandle(hThreadToken);
+
+                    if (SUCCEEDED(hrc) && dwSessionId == 0)
+                    {
+#endif
+                        LogRel(("registerVBoxSVC: Making aPid=%u (%#x) the chosen one for user %s (%s)!\n",
+                                aPid, aPid, pUserData->m_strUserSid.c_str(), pUserData->m_strUsername.c_str()));
 #ifdef WITH_WATCHER
-                    /* Open the process so we can watch it. */
-                    HANDLE hProcess = OpenProcess(SYNCHRONIZE | PROCESS_QUERY_INFORMATION, FALSE /*fInherit*/, aPid);
-                    if (hProcess == NULL)
-                        hProcess = OpenProcess(SYNCHRONIZE | PROCESS_QUERY_LIMITED_INFORMATION, FALSE /*fInherit*/, aPid);
-                    if (hProcess == NULL)
-                        hProcess = OpenProcess(SYNCHRONIZE, FALSE /*fInherit*/, aPid);
-                    if (hProcess != NULL)
-                    {
-                        if (i_watchIt(pUserData, hProcess, aPid))
+                        /* Open the process so we can watch it. */
+                        HANDLE hProcess = OpenProcess(SYNCHRONIZE | PROCESS_QUERY_INFORMATION, FALSE /*fInherit*/, aPid);
+                        if (hProcess == NULL)
+                            hProcess = OpenProcess(SYNCHRONIZE | PROCESS_QUERY_LIMITED_INFORMATION, FALSE /*fInherit*/, aPid);
+                        if (hProcess == NULL)
+                            hProcess = OpenProcess(SYNCHRONIZE, FALSE /*fInherit*/, aPid);
+                        if (hProcess != NULL)
+                        {
+                            if (i_watchIt(pUserData, hProcess, aPid))
 #endif
-                        {
-                            /* Make it official... */
-                            pUserData->m_ptrTheChosenOne = aVBoxSVC;
-                            pUserData->m_pidTheChosenOne = aPid;
-                            hrc = S_OK;
+                            {
+                                /* Make it official... */
+                                pUserData->m_ptrTheChosenOne = aVBoxSVC;
+                                pUserData->m_pidTheChosenOne = aPid;
+                                hrc = S_OK;
+                            }
+#ifdef WITH_WATCHER
+                            else
+                            {
+
+                                LogRel(("registerVBoxSVC: i_watchIt failed!\n"));
+                                hrc = RPC_E_OUT_OF_RESOURCES;
+                            }
                         }
-#ifdef WITH_WATCHER
                         else
                         {
-
-                            LogRel(("registerVBoxSVC: i_watchIt failed!\n"));
-                            hrc = RPC_E_OUT_OF_RESOURCES;
+                            LogRel(("registerVBoxSVC: OpenProcess() failed: %ld\n", GetLastError()));
+                            hrc = E_ACCESSDENIED;
                         }
-                    }
-                    else
-                    {
-                        LogRel(("registerVBoxSVC: OpenProcess failed: %u\n", GetLastError()));
-                        hrc = E_ACCESSDENIED;
+#endif
+#ifdef VBOX_WITH_VBOXSVC_SESSION_0
                     }
 #endif
                 }
-
                 pUserData->i_unlock();
                 pUserData->i_release();
@@ -474 +593 @@
     a_pStrUsername->setNull();
 
-    CoInitializeEx(NULL, COINIT_MULTITHREADED); // is this necessary?
     HRESULT hrc = CoImpersonateClient();
     if (SUCCEEDED(hrc))
@@ -555 +673 @@
     else
         LogRel(("i_GetClientUserSID: CoImpersonateClient failed: %Rhrc\n", hrc));
-    CoUninitialize();
     return fRet;
 }