Re: [PATCH] wbemprox: Return WBEM_E_ACCESS_DENIED from IEnumWbemClassObject::Next() if the object is empty.

[Hans Leidekker]

On Mon, 2019-07-08 at 20:56 +0800, Dmitry Timoshkov wrote:
> Hans Leidekker  wrote:
> > On Mon, 2019-07-08 at 20:09 +0800, Dmitry Timoshkov wrote:
> > > Dmitry Timoshkov  wrote:
> > > > > > Could you suggest a place in Wine where a permission check could be added?
> > > > >
> > > > > It's not clear to me if this is a general WMI thing or if it depends on the
> > > > > object being queried.
> > > >
> > > > I'll copy WMI tests from dlls/wbemprox/tests to the MSI custom action tests
> > > > to get a picture how it works under Windows.
> > >
> > > I've ported dlls/wbemprox/query.c to run from the MSI custom action,
> > > added strict checks for ::Next() return values everywhere, and while
> > > some of the queries fail ::Next() never returns WBEM_E_ACCESS_DENIED.
> > > It turned out that commenting out CoSetProxyBlanket() made the ::Next()
> > > calls for empty objects always return WBEM_E_ACCESS_DENIED instead of
> > > WBEM_S_FALSE/WBEM_S_TIMEDOUT. It's not obvious to me where the proposed
> > > access check should be added. Hans, do the test results add any clue to you?
> >
> > Commenting out the CoSetProxyBlanket call in the wbemprox tests doesn't change
> > anything however.
>
> Yes, sorry for not mentioning that, since I'm testing on both sides.
> > We still don't know what's different when running as a custom
> > action.
>
> What exactly you would like to know? Also if you have suggestions for
> further tests and things to examine that would help a lot.

Check the process token, for example, and compare properties/privileges.