service: drop all privileges for tunnel service

Signed-off-by: Odd Stranne <odd@mullvad.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

1 files changed, 66 insertions, 0 deletions

diff --git a/service/securityapi.go b/service/securityapi.go
index 497f43ce..989b4ac3 100644
--- a/service/securityapi.go
+++ b/service/securityapi.go
@@ -55,6 +55,35 @@ type WTS_SESSION_INFO struct {
 //sys	wtsEnumerateSessions(handle windows.Handle, reserved uint32, version uint32, sessions **WTS_SESSION_INFO, count *uint32) (err error) = wtsapi32.WTSEnumerateSessionsW
 //sys	wtsFreeMemory(ptr uintptr) = wtsapi32.WTSFreeMemory
 
+// TEMP //
+
+type LUID struct {
+	LowPart  uint32
+	HighPart int32
+}
+
+type LUID_AND_ATTRIBUTES struct {
+	Luid       LUID
+	Attributes uint32
+}
+
+type TOKEN_PRIVILEGES struct {
+	PrivilegeCount uint32
+	Privileges     [1]LUID_AND_ATTRIBUTES
+}
+
+const (
+	SE_PRIVILEGE_REMOVED uint32 = 0X00000004
+	TOKEN_READ uint32 = 0x00020008
+	TOKEN_WRITE uint32 = 0x000200e0
+	TokenPrivileges uint32 = 3
+)
+
+//sys adjustTokenPrivileges(token windows.Token, disableAllPrivileges bool, newstate *TOKEN_PRIVILEGES, buflen uint32, prevstate *TOKEN_PRIVILEGES, returnlen *uint32) (err error) = advapi32.AdjustTokenPrivileges
+//sys openProcessToken(processHandle windows.Handle, accessFlags uint32, token *windows.Token) (err error) = advapi32.OpenProcessToken
+
+// END TEMP //
+
 const (
 	SE_GROUP_ENABLED           = 0x00000004
 	SE_GROUP_USE_FOR_DENY_ONLY = 0x00000010
@@ -107,3 +136,40 @@ func tokenIsMemberOfBuiltInAdministrator(token windows.Token) bool {
 	runtime.KeepAlive(gs)
 	return isAdmin
 }
+
+func dropAllPrivileges() error {
+	processHandle, err := windows.GetCurrentProcess()
+	if err != nil {
+		return err
+	}
+	var processToken windows.Token
+	err = openProcessToken(processHandle, TOKEN_READ | TOKEN_WRITE, (*windows.Token)(unsafe.Pointer(&processToken)))
+	if err != nil {
+		return err
+	}
+	defer processToken.Close()
+	var bufferSizeRequired uint32
+	_ = windows.GetTokenInformation(processToken, TokenPrivileges, nil, 0, (*uint32)(unsafe.Pointer(&bufferSizeRequired)))
+	if bufferSizeRequired == 0  {
+		return errors.New("GetTokenInformation failed to provide a buffer size")
+	}
+	buffer := make([]uint8, bufferSizeRequired)
+	var bytesWritten uint32
+	err = windows.GetTokenInformation(processToken, TokenPrivileges, (*uint8)(unsafe.Pointer(&buffer[0])), (uint32)(len(buffer)), (*uint32)(unsafe.Pointer(&bytesWritten)))
+	if err != nil {
+		return err
+	}
+	if bytesWritten != bufferSizeRequired {
+		return errors.New("GetTokenInformation returned incomplete data")
+	}
+	tokenPrivileges := (*TOKEN_PRIVILEGES)(unsafe.Pointer(&buffer[0]))
+	privs := (*[1024]LUID_AND_ATTRIBUTES)(unsafe.Pointer(&buffer[unsafe.Sizeof(tokenPrivileges.PrivilegeCount)]))
+	for i := uint32(0); i < tokenPrivileges.PrivilegeCount; i++ {
+		privs[i].Attributes = SE_PRIVILEGE_REMOVED
+	}
+	err = adjustTokenPrivileges(processToken, false, tokenPrivileges, 0, nil, nil)
+	if err != nil {
+		return err
+	}
+	return nil
+}