Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-27 04:38:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Backed out changeset a608c5cc4ff8 (bug 1321725) for landing with wrong bug number

Browse Source 
--HG--
extra : rebase_source : 1d7b5b836c1e67507c6592c11d1bfe50623eee84
This commit is contained in:
Carsten "Tomcat" Book 2017-02-07 11:50:54 +01:00
parent caa1468d26
commit ac8a2fb906
4 changed files with 8 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
security/sandbox/chromium/sandbox/win/src/restricted_token.cc
View File

@ -250,39 +250,6 @@ DWORD RestrictedToken::AddAllSidsForDenyOnly(std::vector<Sid> *exceptions) {
return ERROR_SUCCESS;
}
DWORD RestrictedToken::AddDenyOnlySids(const std::vector<Sid>& deny_only_sids) {
DCHECK(init_);
if (!init_) {
return ERROR_NO_TOKEN;
}
DWORD error;
scoped_ptr<BYTE[]> buffer = GetTokenInfo(effective_token_, TokenGroups, &error);
if (!buffer) {
return error;
}
TOKEN_GROUPS* token_groups = reinterpret_cast<TOKEN_GROUPS*>(buffer.get());
// Build the list of the deny only group SIDs
for (unsigned int i = 0; i < token_groups->GroupCount ; ++i) {
if ((token_groups->Groups[i].Attributes & SE_GROUP_INTEGRITY) == 0 &&
(token_groups->Groups[i].Attributes & SE_GROUP_LOGON_ID) == 0) {
for (unsigned int j = 0; j < deny_only_sids.size(); ++j) {
if (::EqualSid(const_cast<SID*>(deny_only_sids[j].GetPSID()),
token_groups->Groups[i].Sid)) {
sids_for_deny_only_.push_back(
reinterpret_cast<SID*>(token_groups->Groups[i].Sid));
break;
}
}
}
}
return ERROR_SUCCESS;
}
DWORD RestrictedToken::AddSidForDenyOnly(const Sid &sid) {
DCHECK(init_);
if (!init_)

11
security/sandbox/chromium/sandbox/win/src/restricted_token.h
View File

@ -88,17 +88,6 @@ class RestrictedToken {
// access to any resource. It can only be used to deny access.
DWORD AddAllSidsForDenyOnly(std::vector<Sid> *exceptions);
// Lists all sids in the token and mark them as Deny Only if present in the
// deny_only_sids parameter.
//
// If the function succeeds, the return value is ERROR_SUCCESS. If the
// function fails, the return value is the win32 error code corresponding to
// the error.
//
// Note: A Sid marked for Deny Only in a token cannot be used to grant
// access to any resource. It can only be used to deny access.
DWORD AddDenyOnlySids(const std::vector<Sid>& deny_only_sids);
// Adds a user or group SID for Deny Only in the restricted token.
// Parameter: sid is the SID to add in the Deny Only list.
// The return value is always ERROR_SUCCESS.

20
security/sandbox/chromium/sandbox/win/src/restricted_token_utils.cc
View File

@ -27,7 +27,6 @@ DWORD CreateRestrictedToken(TokenLevel security_level,
std::vector<base::string16> privilege_exceptions;
std::vector<Sid> sid_exceptions;
std::vector<Sid> deny_only_sids;
bool deny_sids = true;
bool remove_privileges = true;
@ -49,16 +48,10 @@ DWORD CreateRestrictedToken(TokenLevel security_level,
break;
}
case USER_NON_ADMIN: {
deny_sids = false;
deny_only_sids.push_back(WinBuiltinAdministratorsSid);
deny_only_sids.push_back(WinAccountAdministratorSid);
deny_only_sids.push_back(WinAccountDomainAdminsSid);
deny_only_sids.push_back(WinAccountCertAdminsSid);
deny_only_sids.push_back(WinAccountSchemaAdminsSid);
deny_only_sids.push_back(WinAccountEnterpriseAdminsSid);
deny_only_sids.push_back(WinAccountPolicyAdminsSid);
deny_only_sids.push_back(WinBuiltinHyperVAdminsSid);
deny_only_sids.push_back(WinLocalAccountAndAdministratorSid);
sid_exceptions.push_back(WinBuiltinUsersSid);
sid_exceptions.push_back(WinWorldSid);
sid_exceptions.push_back(WinInteractiveSid);
sid_exceptions.push_back(WinAuthenticatedUserSid);
privilege_exceptions.push_back(SE_CHANGE_NOTIFY_NAME);
break;
}
@ -114,11 +107,6 @@ DWORD CreateRestrictedToken(TokenLevel security_level,
err_code = restricted_token.AddAllSidsForDenyOnly(&sid_exceptions);
if (ERROR_SUCCESS != err_code)
return err_code;
} else if (!deny_only_sids.empty()) {
err_code = restricted_token.AddDenyOnlySids(deny_only_sids);
if (ERROR_SUCCESS != err_code) {
return err_code;
}
}
if (remove_privileges) {

9
security/sandbox/modifications-to-chromium-to-reapply-after-upstream-merge.txt
View File

@ -1,9 +1,8 @@
Please add a link to the bugzilla bug and patch name that should be re-applied.
Also, please update any existing links to their actual mozilla-central changeset.
https://hg.mozilla.org/mozilla-central/rev/a05726163a79
https://bugzilla.mozilla.org/show_bug.cgi?id=1287426 bug1287426part5.patch
https://hg.mozilla.org/mozilla-central/rev/7df8d6639971
https://hg.mozilla.org/mozilla-central/rev/e834e810a3fa
https://hg.mozilla.org/mozilla-central/rev/c70d06fa5302
https://hg.mozilla.org/mozilla-central/rev/d24db55deb85
https://bugzilla.mozilla.org/show_bug.cgi?id=1321724 bug1321724.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=1287426 bug1287426part7.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=1273372 bug1273372part2.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=1273372 bug1273372part3.patch