diff options
Diffstat (limited to 'src/port/exec.c')
| -rw-r--r-- | src/port/exec.c | 32 |
1 files changed, 10 insertions, 22 deletions
diff --git a/src/port/exec.c b/src/port/exec.c index 5e7fb3e5b48..65a7c491e8c 100644 --- a/src/port/exec.c +++ b/src/port/exec.c @@ -9,7 +9,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/port/exec.c,v 1.43.2.2 2008/03/31 01:32:17 tgl Exp $ + * $PostgreSQL: pgsql/src/port/exec.c,v 1.43.2.3 2009/11/15 09:08:46 mha Exp $ * *------------------------------------------------------------------------- */ @@ -649,11 +649,10 @@ set_pglocale_pgservice(const char *argv0, const char *app) #ifdef WIN32 /* - * AddUserToDacl(HANDLE hProcess) + * AddUserToTokenDacl(HANDLE hToken) * - * This function adds the current user account to the default DACL - * which gets attached to the restricted token used when we create - * a restricted process. + * This function adds the current user account to the restricted + * token used when we create a restricted process. * * This is required because of some security changes in Windows * that appeared in patches to XP/2K3 and in Vista/2008. @@ -666,13 +665,13 @@ set_pglocale_pgservice(const char *argv0, const char *app) * and CreateProcess() calls when running as Administrator. * * This function fixes this problem by modifying the DACL of the - * specified process and explicitly re-adding the current user account. - * This is still secure because the Administrator account inherits it's - * privileges from the Administrators group - it doesn't have any of - * it's own. + * token the process will use, and explicitly re-adding the current + * user account. This is still secure because the Administrator account + * inherits its privileges from the Administrators group - it doesn't + * have any of its own. */ BOOL -AddUserToDacl(HANDLE hProcess) +AddUserToTokenDacl(HANDLE hToken) { int i; ACL_SIZE_INFORMATION asi; @@ -681,7 +680,6 @@ AddUserToDacl(HANDLE hProcess) DWORD dwSize = 0; DWORD dwTokenInfoLength = 0; DWORD dwResult = 0; - HANDLE hToken = NULL; PACL pacl = NULL; PSID psidUser = NULL; TOKEN_DEFAULT_DACL tddNew; @@ -689,13 +687,6 @@ AddUserToDacl(HANDLE hProcess) TOKEN_INFORMATION_CLASS tic = TokenDefaultDacl; BOOL ret = FALSE; - /* Get the token for the process */ - if (!OpenProcessToken(hProcess, TOKEN_QUERY | TOKEN_ADJUST_DEFAULT, &hToken)) - { - log_error("could not open process token: %ui", GetLastError()); - goto cleanup; - } - /* Figure out the buffer size for the DACL info */ if (!GetTokenInformation(hToken, tic, (LPVOID) NULL, dwTokenInfoLength, &dwSize)) { @@ -771,7 +762,7 @@ AddUserToDacl(HANDLE hProcess) } /* Add the new ACE for the current user */ - if (!AddAccessAllowedAce(pacl, ACL_REVISION, GENERIC_ALL, psidUser)) + if (!AddAccessAllowedAceEx(pacl, ACL_REVISION, OBJECT_INHERIT_ACE, GENERIC_ALL, psidUser)) { log_error("could not add access allowed ACE: %ui", GetLastError()); goto cleanup; @@ -798,9 +789,6 @@ cleanup: if (ptdd) LocalFree((HLOCAL) ptdd); - if (hToken) - CloseHandle(hToken); - return ret; } |