[PATCH v2 0/4] MR5228: Administrator tokens, part 2: Create Wine processes with a limited token.

[Zebediah Figura (＠zfigura)]

Second half of https://gitlab.winehq.org/wine/wine/-/merge_requests/5118.

This uses a different approach, setting the process token from within the
process after it is created. This avoids the need to always relay through
start.exe.

--
  v2: server: Create processes using a limited administrator token by default.
      ntdll: Elevate processes if requested in the manifest.

https://gitlab.winehq.org/wine/wine/-/merge_requests/5228

[PATCH v2 1/4] winetest: Elevate test processes on Wine.

[Zebediah Figura]

From: Zebediah Figura

---
 programs/winetest/main.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/programs/winetest/main.c b/programs/winetest/main.c
index a939034e8b9..dc4fc4b3581 100644
--- a/programs/winetest/main.c
+++ b/programs/winetest/main.c
@@ -687,6 +687,21 @@ extract_test (struct wine_test *test, const char *dir, LPSTR res_name)
     CloseHandle(hfile);
 }

+static HANDLE get_admin_token(void)
+{
+    TOKEN_ELEVATION_TYPE type;
+    TOKEN_LINKED_TOKEN linked;
+    DWORD size;
+
+    if (!GetTokenInformation(GetCurrentThreadEffectiveToken(), TokenElevationType, &type, sizeof(type), &size)
+            || type == TokenElevationTypeFull)
+        return NULL;
+
+    if (!GetTokenInformation(GetCurrentThreadEffectiveToken(), TokenLinkedToken, &linked, sizeof(linked), &size))
+        return NULL;
+    return linked.LinkedToken;
+}
+
 static DWORD wait_process( HANDLE process, DWORD timeout )
 {
     DWORD wait, diff = 0, start = GetTickCount();
@@ -722,6 +737,7 @@ run_ex (char *cmd, HANDLE out_file, const char *tempdir, DWORD ms, BOOL nocritic
     PROCESS_INFORMATION pi;
     DWORD wait, status, flags;
     UINT old_errmode;
+    HANDLE token = NULL;

GetStartupInfoA (&si);
     si.dwFlags    = STARTF_USESTDHANDLES;
@@ -737,8 +753,16 @@ run_ex (char *cmd, HANDLE out_file, const char *tempdir, DWORD ms, BOOL nocritic
     else
         flags = CREATE_DEFAULT_ERROR_MODE;

-    if (!CreateProcessA (NULL, cmd, NULL, NULL, TRUE, flags,
-                         NULL, tempdir, &si, &pi))
+    /* Some tests cause a UAC prompt on Windows if the user is not elevated,
+     * so to allow them to run unattended the relevant test units need to skip
+     * the tests if so.
+     *
+     * However, we still want Wine to run as many tests as possible, so always
+     * elevate ourselves. On Wine elevation isn't interactive. */
+    if (running_under_wine())
+        token = get_admin_token();
+
+    if (!CreateProcessAsUserA(token, NULL, cmd, NULL, NULL, TRUE, flags, NULL, tempdir, &si, &pi))
     {
         if (nocritical) SetErrorMode(old_errmode);
         if (pid) *pid = 0;

[PATCH v2 2/4] ntdll: Implement NtSetInformationProcess(ProcessAccessToken).

[Zebediah Figura]

From: Zebediah Figura

---
 dlls/ntdll/tests/info.c   | 74 +++++++++++++++++++++++++++++++++++++++
 dlls/ntdll/unix/process.c | 17 +++++++++
 dlls/wow64/process.c      | 13 +++++++
 dlls/wow64/struct32.h     |  6 ++++
 include/ddk/ntddk.h       |  6 ++++
 server/process.c          | 16 +++++++++
 server/protocol.def       |  7 ++++
 7 files changed, 139 insertions(+)

diff --git a/dlls/ntdll/tests/info.c b/dlls/ntdll/tests/info.c
index 70d566df3c6..5028dd11e99 100644
--- a/dlls/ntdll/tests/info.c
+++ b/dlls/ntdll/tests/info.c
@@ -20,6 +20,7 @@

#include "ntdll_test.h"
 #include <winnls.h>
+#include <ddk/ntddk.h>
 #include <stdio.h>

static NTSTATUS (WINAPI * pNtQuerySystemInformation)(SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG);
@@ -3758,6 +3759,78 @@ static void test_system_debug_control(void)
     }
 }

+static void test_process_token(int argc, char **argv)
+{
+    STARTUPINFOA si = {.cb = sizeof(si)};
+    PROCESS_ACCESS_TOKEN token_info = {0};
+    TOKEN_STATISTICS stats1, stats2;
+    HANDLE token, their_token;
+    PROCESS_INFORMATION pi;
+    char cmdline[MAX_PATH];
+    NTSTATUS status;
+    DWORD size;
+    BOOL ret;
+
+    token_info.Thread = (HANDLE)0xdeadbeef;
+
+    sprintf( cmdline, "%s %s dummy", argv[0], argv[1] );
+
+    ret = CreateProcessA( NULL, cmdline, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi );
+    ok( ret, "got error %lu\n", GetLastError() );
+
+    status = pNtSetInformationProcess( pi.hProcess, ProcessAccessToken, &token_info, sizeof(token_info) - 1 );
+    ok( status == STATUS_INFO_LENGTH_MISMATCH, "got %#lx\n", status );
+
+    status = pNtSetInformationProcess( pi.hProcess, ProcessAccessToken, &token_info, sizeof(token_info) );
+    ok( status == STATUS_INVALID_HANDLE, "got %#lx\n", status );
+
+    ret = OpenProcessToken( GetCurrentProcess(), TOKEN_QUERY | READ_CONTROL | TOKEN_DUPLICATE
+            | TOKEN_ASSIGN_PRIMARY | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_DEFAULT, &token );
+    ok( ret, "got error %lu\n", GetLastError() );
+
+    token_info.Token = token;
+    status = pNtSetInformationProcess( pi.hProcess, ProcessAccessToken, &token_info, sizeof(token_info) );
+    todo_wine ok( status == STATUS_TOKEN_ALREADY_IN_USE, "got %#lx\n", status );
+
+    ret = DuplicateTokenEx( token, TOKEN_ALL_ACCESS, NULL, SecurityAnonymous, TokenImpersonation, &token_info.Token );
+    ok( ret, "got error %lu\n", GetLastError() );
+    status = pNtSetInformationProcess( pi.hProcess, ProcessAccessToken, &token_info, sizeof(token_info) );
+    todo_wine ok( status == STATUS_BAD_IMPERSONATION_LEVEL, "got %#lx\n", status );
+    CloseHandle( token_info.Token );
+
+    ret = DuplicateTokenEx( token, TOKEN_QUERY, NULL, SecurityAnonymous, TokenPrimary, &token_info.Token );
+    ok( ret, "got error %lu\n", GetLastError() );
+    status = pNtSetInformationProcess( pi.hProcess, ProcessAccessToken, &token_info, sizeof(token_info) );
+    ok( status == STATUS_ACCESS_DENIED, "got %#lx\n", status );
+    CloseHandle( token_info.Token );
+
+    ret = DuplicateTokenEx( token, TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY, NULL, SecurityAnonymous, TokenPrimary, &token_info.Token );
+    ok(ret, "got error %lu\n", GetLastError());
+    status = pNtSetInformationProcess( pi.hProcess, ProcessAccessToken, &token_info, sizeof(token_info) );
+    ok( status == STATUS_SUCCESS, "got %#lx\n", status );
+
+    ret = OpenProcessToken( pi.hProcess, TOKEN_QUERY, &their_token );
+    ok( ret, "got error %lu\n", GetLastError() );
+
+    /* The tokens should be the same. */
+    ret = GetTokenInformation( token_info.Token, TokenStatistics, &stats1, sizeof(stats1), &size );
+    ok( ret, "got error %lu\n", GetLastError() );
+    ret = GetTokenInformation( their_token, TokenStatistics, &stats2, sizeof(stats2), &size );
+    ok( ret, "got error %lu\n", GetLastError() );
+    ok( !memcmp( &stats1.TokenId, &stats2.TokenId, sizeof(LUID) ), "expected same IDs\n" );
+
+    CloseHandle( token_info.Token );
+    CloseHandle( their_token );
+
+    ResumeThread( pi.hThread );
+    ret = WaitForSingleObject( pi.hProcess, 1000 );
+    ok( !ret, "got %d\n", ret );
+
+    CloseHandle( pi.hProcess );
+    CloseHandle( pi.hThread );
+    CloseHandle( token );
+}
+
 START_TEST(info)
 {
     char **argv;
@@ -3834,4 +3907,5 @@ START_TEST(info)
     test_ThreadEnableAlignmentFaultFixup();
     test_process_instrumentation_callback();
     test_system_debug_control();
+    test_process_token(argc, argv);
 }
diff --git a/dlls/ntdll/unix/process.c b/dlls/ntdll/unix/process.c
index bf24161fedb..43dca59eb3a 100644
--- a/dlls/ntdll/unix/process.c
+++ b/dlls/ntdll/unix/process.c
@@ -65,6 +65,7 @@
 #include "windef.h"
 #include "winternl.h"
 #include "winioctl.h"
+#include "ddk/ntddk.h"
 #include "unix_private.h"
 #include "wine/condrv.h"
 #include "wine/server.h"
@@ -1600,6 +1601,22 @@ NTSTATUS WINAPI NtSetInformationProcess( HANDLE handle, PROCESSINFOCLASS class,

switch (class)
     {
+    case ProcessAccessToken:
+    {
+        const PROCESS_ACCESS_TOKEN *token = info;
+
+        if (size != sizeof(PROCESS_ACCESS_TOKEN)) return STATUS_INFO_LENGTH_MISMATCH;
+
+        SERVER_START_REQ( set_process_token )
+        {
+            req->process = wine_server_obj_handle( handle );
+            req->token = wine_server_obj_handle( token->Token );
+            ret = wine_server_call( req );
+        }
+        SERVER_END_REQ;
+        break;
+    }
+
     case ProcessDefaultHardErrorMode:
         if (size != sizeof(UINT)) return STATUS_INVALID_PARAMETER;
         process_error_mode = *(UINT *)info;
diff --git a/dlls/wow64/process.c b/dlls/wow64/process.c
index 817926d0f13..8b543d2a859 100644
--- a/dlls/wow64/process.c
+++ b/dlls/wow64/process.c
@@ -26,6 +26,7 @@
 #include "winbase.h"
 #include "winnt.h"
 #include "winternl.h"
+#include "ddk/ntddk.h"
 #include "wow64_private.h"
 #include "wine/asm.h"
 #include "wine/exception.h"
@@ -835,6 +836,18 @@ NTSTATUS WINAPI wow64_NtSetInformationProcess( UINT *args )
     case ProcessLeapSecondInformation:   /* PROCESS_LEAP_SECOND_INFO */
         return NtSetInformationProcess( handle, class, ptr, len );

+    case ProcessAccessToken: /* PROCESS_ACCESS_TOKEN */
+        if (len == sizeof(PROCESS_ACCESS_TOKEN32))
+        {
+            PROCESS_ACCESS_TOKEN32 *stack = ptr;
+            PROCESS_ACCESS_TOKEN info;
+
+            info.Thread = ULongToHandle( stack->Thread );
+            info.Token = ULongToHandle( stack->Token );
+            return NtSetInformationProcess( handle, class, &info, sizeof(info) );
+        }
+        else return STATUS_INFO_LENGTH_MISMATCH;
+
     case ProcessAffinityMask:   /* ULONG_PTR */
         if (len == sizeof(ULONG))
         {
diff --git a/dlls/wow64/struct32.h b/dlls/wow64/struct32.h
index 482f1297b28..2c4cf4f9e3c 100644
--- a/dlls/wow64/struct32.h
+++ b/dlls/wow64/struct32.h
@@ -722,4 +722,10 @@ typedef struct DECLSPEC_ALIGN(8)
     };
 } MEM_EXTENDED_PARAMETER32;

+typedef struct
+{
+    ULONG Token;
+    ULONG Thread;
+} PROCESS_ACCESS_TOKEN32;
+
 #endif /* __WOW64_STRUCT32_H */
diff --git a/include/ddk/ntddk.h b/include/ddk/ntddk.h
index 471c27c27ba..c705958e147 100644
--- a/include/ddk/ntddk.h
+++ b/include/ddk/ntddk.h
@@ -146,6 +146,12 @@ typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION
   LARGE_INTEGER ValidDataLength;
 } FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;

+typedef struct _PROCESS_ACCESS_TOKEN
+{
+    HANDLE Token;
+    HANDLE Thread;
+} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
+
 typedef enum _RTL_GENERIC_COMPARE_RESULTS
 {
     GenericLessThan,
diff --git a/server/process.c b/server/process.c
index c9ab161e3fb..1a49821bef1 100644
--- a/server/process.c
+++ b/server/process.c
@@ -1630,6 +1630,22 @@ DECL_HANDLER(set_process_info)
     }
 }

+/* set the process's primary token */
+DECL_HANDLER(set_process_token)
+{
+    struct process *process;
+    struct token *token;
+
+    if (!(process = get_process_from_handle( req->process, PROCESS_SET_INFORMATION ))) return;
+
+    if ((token = get_token_obj( current->process, req->token, TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY )))
+    {
+        release_object( process->token );
+        process->token = token;
+    }
+    release_object( process );
+}
+
 /* read data from a process address space */
 DECL_HANDLER(read_process_memory)
 {
diff --git a/server/protocol.def b/server/protocol.def
index fa78e0487f8..4b911260bbd 100644
--- a/server/protocol.def
+++ b/server/protocol.def
@@ -3607,6 +3607,13 @@ struct handle_info
 @END

+/* Set the process's primary token */
+@REQ(set_process_token)
+    obj_handle_t process;         /* handle to the process */
+    obj_handle_t token;           /* handle to the token */
+@END
+
+
 /* Create I/O completion port */
 @REQ(create_completion)
     unsigned int access;          /* desired access to a port */

[PATCH v2 3/4] ntdll: Elevate processes if requested in the manifest.

[Zebediah Figura]

From: Zebediah Figura

Rufus 3.13 Portable requires administrator privileges, and uses a manifest to
elevate itself.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=51000
---
 dlls/ntdll/loader.c | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/dlls/ntdll/loader.c b/dlls/ntdll/loader.c
index cf9f4ac9a84..765fb5b1617 100644
--- a/dlls/ntdll/loader.c
+++ b/dlls/ntdll/loader.c
@@ -35,6 +35,7 @@
 #include "wine/debug.h"
 #include "wine/list.h"
 #include "ntdll_misc.h"
+#include "ddk/ntddk.h"
 #include "ddk/wdm.h"

WINE_DEFAULT_DEBUG_CHANNEL(module);
@@ -4104,7 +4105,40 @@ static void load_global_options(void)
     }
 }

+static BOOL needs_elevation(void)
+{
+    ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION run_level;
+
+    if (!RtlQueryInformationActivationContext( 0, NULL, NULL, RunlevelInformationInActivationContext,
+                                               &run_level, sizeof(run_level), NULL ))
+    {
+        TRACE( "image requested run level %#x\n", run_level.RunLevel );
+        if (run_level.RunLevel == ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE
+                || run_level.RunLevel == ACTCTX_RUN_LEVEL_REQUIRE_ADMIN)
+            return TRUE;
+    }
+    return FALSE;
+}

+static void elevate_token(void)
+{
+    PROCESS_ACCESS_TOKEN token;
+    TOKEN_ELEVATION_TYPE type;
+    TOKEN_LINKED_TOKEN linked;
+
+    NtQueryInformationToken( GetCurrentThreadEffectiveToken(),
+                             TokenElevationType, &type, sizeof(type), NULL );
+
+    if (type == TokenElevationTypeFull) return;
+
+    NtQueryInformationToken( GetCurrentThreadEffectiveToken(),
+                             TokenLinkedToken, &linked, sizeof(linked), NULL );
+
+    token.Thread = NULL;
+    token.Token = linked.LinkedToken;
+    NtSetInformationProcess( GetCurrentProcess(), ProcessAccessToken, &token, sizeof(token) );
+    NtClose( linked.LinkedToken );
+}

#ifdef _WIN64

@@ -4290,6 +4324,8 @@ void loader_init( CONTEXT *context, void **entry )

actctx_init();
         locale_init();
+        if (needs_elevation())
+            elevate_token();
         get_env_var( L"WINESYSTEMDLLPATH", 0, &system_dll_path );
         if (wm->ldr.Flags & LDR_COR_ILONLY)
             status = fixup_imports_ilonly( wm, NULL, entry );

[PATCH v2 4/4] server: Create processes using a limited administrator token by default.

[Zebediah Figura]

From: Zebediah Figura

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=40613
---
 server/process.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/process.c b/server/process.c
index 1a49821bef1..6187002f2e9 100644
--- a/server/process.c
+++ b/server/process.c
@@ -711,7 +711,7 @@ struct process *create_process( int fd, struct process *parent, unsigned int fla
     if (!parent)
     {
         process->handles = alloc_handle_table( process, 0 );
-        process->token = token_create_admin( TRUE, -1, TokenElevationTypeFull, default_session_id );
+        process->token = token_create_admin( TRUE, -1, TokenElevationTypeLimited, default_session_id );
         process->affinity = ~0;
     }
     else

[Zebediah Figura (＠zfigura)]

v2: Fix a leak in elevate_token().

[Alexandre Julliard (＠julliard)]

Alexandre Julliard (@julliard) commented about dlls/ntdll/unix/process.c:
>  switch (class)
>  {
> - case ProcessAccessToken:
> - {
> -
>    const PROCESS_ACCESS_TOKEN *token = info;
> -
> -
>    if (size != sizeof(PROCESS_ACCESS_TOKEN)) return STATUS_INFO_LENGTH_MISMATCH;
> -
> -
>    SERVER_START_REQ( set_process_token )
> -
>    {
> -
>        req->process = wine_server_obj_handle( handle );
> -
>        req->token = wine_server_obj_handle( token->Token );
> -
>        ret = wine_server_call( req );
> -
>    }

This could be added to the `set_process_info` request, to follow the existing pattern.