Merge pull request #323 from gerardog/fix/cache-as-system

Fix issue in system/trusted-installer credentials cache support
gerardog · Dec 18, 2023 · c23b102 · c23b102
2 parents 71d84a1 + 49738f0
commit c23b102
Show file tree

Hide file tree

Showing 6 changed files with 11 additions and 70 deletions.
diff --git a/src/gsudo/AppSettings/Settings.cs b/src/gsudo/AppSettings/Settings.cs
@@ -82,7 +82,7 @@ class Settings
 
  public static RegistrySetting<string> ExceptionList { get; } =
  new RegistrySetting<string>(nameof(ExceptionList),
- defaultValue: "notepad.exe;powershell.exe;",
+ defaultValue: "notepad.exe;powershell.exe;whoami.exe;",
  deserializer: (string s)=>s,
  scope: RegistrySettingScope.GlobalOnly);
 

diff --git a/src/gsudo/Commands/AttachRunCommand.cs b/src/gsudo/Commands/AttachRunCommand.cs
diff --git a/src/gsudo/Commands/RunCommand.cs b/src/gsudo/Commands/RunCommand.cs
@@ -120,15 +120,15 @@ private async Task<int> RunUsingService(ElevationRequest elevationRequest)
  serviceLocation = await ServiceHelper.WaitForNewService(callingPid).ConfigureAwait(false);
  }
 
+ if (serviceLocation==null)
+ throw new ApplicationException("Unable to connect to the elevated service.");
+
  if (!InputArguments.IntegrityLevel.HasValue)
  {
  // This is the edge case where user does `gsudo -u SomeOne` and we dont know if SomeOne can elevate or not.
  elevationRequest.IntegrityLevel = serviceLocation.IsHighIntegrity ? IntegrityLevel.High : IntegrityLevel.Medium;
  }
 
- if (serviceLocation==null)
- throw new ApplicationException("Unable to connect to the elevated service.");
-
  connection = await ServiceHelper.Connect(serviceLocation).ConfigureAwait(false);
  if (connection == null) // service is not running or listening.
  {

diff --git a/src/gsudo/Helpers/CommandLineParser.cs b/src/gsudo/Helpers/CommandLineParser.cs
@@ -274,9 +274,6 @@ private ICommand ParseVerb()
  if (arg.In("run"))
  return new RunCommand(commandToRun: args.ToArray());
 
- if (arg.In("AttachRun"))
- return new AttachRunCommand(commandToRun: args.ToArray());
-
  args.AddFirst(arg);
 
  if (arg == "!!" || arg.StartsWith("!", StringComparison.InvariantCulture))

diff --git a/src/gsudo/Helpers/ServiceHelper.cs b/src/gsudo/Helpers/ServiceHelper.cs
@@ -71,9 +71,12 @@ private static ServiceLocation FindServiceByIntegrity(int? clientPid, string use
  var anyIntegrity = InputArguments.UserName != null;
  var tryHighIntegrity = !InputArguments.IntegrityLevel.HasValue || InputArguments.IntegrityLevel.Value >= IntegrityLevel.High;
  var tryLowIntegrity = !InputArguments.IntegrityLevel.HasValue || InputArguments.IntegrityLevel.Value < IntegrityLevel.High;
+
+ var targetUserSid = InputArguments.RunAsSystem ? "S-1-5-18" : InputArguments.UserSid;
+
  if (tryHighIntegrity)
  {
- var pipeName = NamedPipeClient.TryGetServicePipe(user, clientPid.Value, true);
+ var pipeName = NamedPipeClient.TryGetServicePipe(user, clientPid.Value, true, null);
  if (pipeName != null)
  {
  return new ServiceLocation

diff --git a/src/gsudo/Rpc/NamedPipeNameFactory.cs b/src/gsudo/Rpc/NamedPipeNameFactory.cs
@@ -13,9 +13,10 @@ public static string GetPipeName(string allowedSid, int allowedPid, string targe
  if (allowedPid < 0) allowedPid = 0;
 
  var ti = InputArguments.TrustedInstaller ? "_TI" : string.Empty;
- var admin = !isAdmin ? "_NonAdmin" : string.Empty;
+ var s = InputArguments.RunAsSystem ? "_S" : string.Empty;
+ var admin = !isAdmin ? "_NonAdmin" : string.Empty;
 
- var data = $"{allowedSid}_{targetSid}_{allowedPid}_{ti}{admin}";
+ var data = $"allowedSid-{allowedSid}_targetSid-{targetSid}{allowedPid}{s}{ti}{admin}";
 #if !DEBUG
  data = GetHash(data);
 #endif