Changeset 99365 in vbox

Timestamp:

Apr 10, 2023 5:28:33 PM (2 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

156776

Message:

Additions/Win: Distinguish between normal/privileged users in VBoxGuest.sys (see bugref:10363).

File:

• trunk/src/VBox/Additions/common/VBoxGuest/VBoxGuest-win.cpp (modified) (2 diffs)

trunk/src/VBox/Additions/common/VBoxGuest/VBoxGuest-win.cpp

@@ -2648 +2648 @@
             {
                 if (fUsersMember)
-                    fRequestor = (fRequestor & ~VMMDEV_REQUESTOR_USR_MASK) | VMMDEV_REQUESTOR_USR_GUEST;
+                    fRequestor = (fRequestor & ~VMMDEV_REQUESTOR_USR_MASK) | VMMDEV_REQUESTOR_USR_USER;
                 else if (fGuestsMember)
                     fRequestor = (fRequestor & ~VMMDEV_REQUESTOR_USR_MASK) | VMMDEV_REQUESTOR_USR_GUEST;
@@ -2658 +2658 @@
         RTMemTmpFree(pCurGroupsFree);
         ZwClose(hToken);
+
+        /*
+         * Determine whether we should set VMMDEV_REQUESTOR_USER_DEVICE or not.
+         *
+         * The purpose here is to differentiate VBoxService accesses
+         * from VBoxTray and VBoxControl, as VBoxService should be allowed to
+         * do more than the latter two.  VBoxService normally runs under the
+         * system account which is easily detected, but for debugging and
+         * similar purposes we also allow an elevated admin to run it as well.
+         */
+        if (   (fRequestor & VMMDEV_REQUESTOR_TRUST_MASK) == VMMDEV_REQUESTOR_TRUST_UNTRUSTED /* general paranoia wrt system account */
+            || (fRequestor & VMMDEV_REQUESTOR_TRUST_MASK) == VMMDEV_REQUESTOR_TRUST_LOW       /* ditto */
+            || (fRequestor & VMMDEV_REQUESTOR_TRUST_MASK) == VMMDEV_REQUESTOR_TRUST_MEDIUM    /* ditto */
+            || !(   (fRequestor & VMMDEV_REQUESTOR_USR_MASK) == VMMDEV_REQUESTOR_USR_SYSTEM
+                 || (   (   (fRequestor & VMMDEV_REQUESTOR_GRP_WHEEL)
+                         || (fRequestor & VMMDEV_REQUESTOR_USR_MASK) == VMMDEV_REQUESTOR_USR_ROOT)
+                     && (   (fRequestor & VMMDEV_REQUESTOR_TRUST_MASK) >= VMMDEV_REQUESTOR_TRUST_HIGH
+                         || (fRequestor & VMMDEV_REQUESTOR_TRUST_MASK) == VMMDEV_REQUESTOR_TRUST_NOT_GIVEN)) ))
+            fRequestor |= VMMDEV_REQUESTOR_USER_DEVICE;
     }
     else
+    {
         LogRel(("vgdrvNtCalcRequestorFlags: NtOpenProcessToken query failed: %#x\n", rcNt));
+        fRequestor |= VMMDEV_REQUESTOR_USER_DEVICE;
+    }
 
     Log5(("vgdrvNtCalcRequestorFlags: returns %#x\n", fRequestor));