aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorOdd Stranne <odd@mullvad.net>2019-03-06 14:58:25 +0100
committerSimon Rozman <simon@rozman.si>2019-03-08 10:03:56 +0100
commita6d5ef82f4d90f3e997aa2ed4bf61414d6c39ee6 (patch)
tree3b5bd8d10285d7b02f2b5a8107b6e24e358a9095
parentuapi: windows: work out pipe semantics (diff)
downloadwireguard-go-a6d5ef82f4d90f3e997aa2ed4bf61414d6c39ee6.tar.xz
wireguard-go-a6d5ef82f4d90f3e997aa2ed4bf61414d6c39ee6.zip
Windows: Apply strict security descriptor on pipe server
Signed-off-by: Odd Stranne <odd@mullvad.net>
-rw-r--r--ipc/uapi_windows.go13
1 files changed, 12 insertions, 1 deletions
diff --git a/ipc/uapi_windows.go b/ipc/uapi_windows.go
index 158c5a8..8f0268d 100644
--- a/ipc/uapi_windows.go
+++ b/ipc/uapi_windows.go
@@ -46,9 +46,20 @@ func (l *UAPIListener) Addr() net.Addr {
return l.listener.Addr()
}
+func GetSystemSecurityDescriptor() string {
+ //
+ // SDDL encoded.
+ //
+ // (system = SECURITY_NT_AUTHORITY | SECURITY_LOCAL_SYSTEM_RID)
+ // owner: system
+ // grant: GENERIC_ALL to system
+ //
+ return "O:SYD:(A;;GA;;;SY)"
+}
+
func UAPIListen(name string) (net.Listener, error) {
config := winio.PipeConfig{
- SecurityDescriptor: "O:SYD:P(A;;GA;;;SY)", /* Local System only, not inheritable */
+ SecurityDescriptor: GetSystemSecurityDescriptor(),
}
listener, err := winio.ListenPipe("\\\\.\\pipe\\WireGuard\\"+name, &config)
if err != nil {