On Mon, Mar 17, 2008 at 10:41 AM, Paul Vriens &lt;<a href="mailto:paul.vriens.wine@gmail.com">paul.vriens.wine@gmail.com</a>&gt; wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hi,<br>
<br>
I&#39;m now looking at some of the failures for the security tests on Vista.<br>
Apparently PROCESS_ALL_ACCESS which is defined as:<br>
<br>
#define PROCESS_ALL_ACCESS &nbsp; &nbsp; &nbsp; &nbsp; (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0xfff)<br>
<br>
is changed on Vista:<br>
<br>
#define PROCESS_ALL_ACCESS &nbsp; &nbsp; &nbsp; &nbsp; (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0xffff)<br>
<br>
Should I change the tests (CreateProcess) to check for both possibilities or<br>
should our PROCESS_ALL_ACCESS be changed?<br>
<br>
I&#39;m not sure what implications the latter one has yet. Only that using that mask<br>
on other windows versions will/could fail.<br>
</blockquote><div><br>Windows Vista/Windows Server 2008 have a new permission flag, PROCESS_QUERY_LIMITED_INFORMATION, with a value of 0x1000.&nbsp; That&#39;s why they added the extra nibble.&nbsp;&nbsp; The permission check code isn&#39;t supposed to check bits it doesn&#39;t know about, so it should be harmless to enable the extra nibble even on older versions.<br>
<br>Carl Fongheiser<br></div></div><br>