Skip to content

Commit 1f2ee94

Browse files
AenBleiddAenBleidd
committed
Add test_boinccas_CARevokeBOINCAdminsRights
Signed-off-by: Vitalii Koshura <[email protected]>
1 parent f50d9d7 commit 1f2ee94

File tree

6 files changed

+197
-195
lines changed

6 files changed

+197
-195
lines changed

‎clientsetup/win/CARestoreSetupState.cpp‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,6 @@ class CARestoreSetupState : public BOINCCABase {
180180
SetProperty(_T("ENABLEUSEBYALLUSERS"), _T(""));
181181
SetProperty(_T("ALLUSERS"), _T(""));
182182
}
183-
184183
}
185184
}
186185

‎clientsetup/win/CARevokeBOINCAdminsRights.cpp‎

Lines changed: 75 additions & 156 deletions
Original file line numberDiff line numberDiff line change
@@ -1,171 +1,90 @@
1-
// Berkeley Open Infrastructure for Network Computing
2-
// http://boinc.berkeley.edu
3-
// Copyright (C) 2014 University of California
1+
// This file is part of BOINC.
2+
// https://boinc.berkeley.edu
3+
// Copyright (C) 2026 University of California
44
//
5-
// This is free software; you can redistribute it and/or
6-
// modify it under the terms of the GNU Lesser General Public
7-
// License as published by the Free Software Foundation;
8-
// either version 2.1 of the License, or (at your option) any later version.
5+
// BOINC is free software; you can redistribute it and/or modify it
6+
// under the terms of the GNU Lesser General Public License
7+
// as published by the Free Software Foundation,
8+
// either version 3 of the License, or (at your option) any later version.
99
//
10-
// This software is distributed in the hope that it will be useful,
10+
// BOINC is distributed in the hope that it will be useful,
1111
// but WITHOUT ANY WARRANTY; without even the implied warranty of
1212
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
1313
// See the GNU Lesser General Public License for more details.
1414
//
15-
// To view the GNU Lesser General Public License visit
16-
// http://www.gnu.org/copyleft/lesser.html
17-
// or write to the Free Software Foundation, Inc.,
18-
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19-
//
15+
// You should have received a copy of the GNU Lesser General Public License
16+
// along with BOINC. If not, see <http://www.gnu.org/licenses/>.
2017

2118
#include "stdafx.h"
2219
#include "boinccas.h"
23-
#include "CARevokeBOINCAdminsRights.h"
2420
#include "lsaprivs.h"
2521

26-
27-
#define CUSTOMACTION_NAME _T("CARevokeBOINCAdminsRights")
28-
#define CUSTOMACTION_PROGRESSTITLE _T("Validating the BOINC Administrators group privilege levels")
29-
30-
31-
/////////////////////////////////////////////////////////////////////
32-
//
33-
// Function:
34-
//
35-
// Description:
36-
//
37-
/////////////////////////////////////////////////////////////////////
38-
CARevokeBOINCAdminsRights::CARevokeBOINCAdminsRights(MSIHANDLE hMSIHandle) :
39-
BOINCCABase(hMSIHandle, CUSTOMACTION_NAME, CUSTOMACTION_PROGRESSTITLE)
40-
{}
41-
42-
43-
/////////////////////////////////////////////////////////////////////
44-
//
45-
// Function:
46-
//
47-
// Description:
48-
//
49-
/////////////////////////////////////////////////////////////////////
50-
CARevokeBOINCAdminsRights::~CARevokeBOINCAdminsRights()
51-
{
52-
BOINCCABase::~BOINCCABase();
53-
}
54-
55-
56-
/////////////////////////////////////////////////////////////////////
57-
//
58-
// Function:
59-
//
60-
// Description:
61-
//
62-
/////////////////////////////////////////////////////////////////////
63-
UINT CARevokeBOINCAdminsRights::OnExecution()
64-
{
65-
PSID pSid;
66-
67-
//
68-
// Obtain the SID of the user/group.
69-
// Note that we could target a specific machine, but we don't.
70-
// Specifying NULL for target machine searches for the SID in the
71-
// following order: well-known, Built-in and local, primary domain,
72-
// trusted domains.
73-
//
74-
if(
75-
GetAccountSid(
76-
NULL, // default lookup logic
77-
L"boinc_admins", // account to obtain SID
78-
&pSid // buffer to allocate to contain resultant SID
79-
)
80-
)
81-
{
82-
83-
//
84-
// We only grant the privilege if we succeeded in obtaining the
85-
// SID. We can actually add SIDs which cannot be looked up, but
86-
// looking up the SID is a good sanity check which is suitable for
87-
// most cases.
88-
89-
// User Rights
90-
GrantUserRight(pSid, L"SeNetworkLogonRight", FALSE);
91-
GrantUserRight(pSid, L"SeRemoteInteractiveLogonRight", FALSE);
92-
GrantUserRight(pSid, L"SeBatchLogonRight", FALSE);
93-
GrantUserRight(pSid, L"SeInteractiveLogonRight", FALSE);
94-
GrantUserRight(pSid, L"SeServiceLogonRight", FALSE);
95-
GrantUserRight(pSid, L"SeDenyNetworkLogonRight", FALSE);
96-
GrantUserRight(pSid, L"SeDenyInteractiveLogonRight", FALSE);
97-
GrantUserRight(pSid, L"SeDenyBatchLogonRight", FALSE);
98-
GrantUserRight(pSid, L"SeDenyServiceLogonRight", FALSE);
99-
GrantUserRight(pSid, L"SeDenyRemoteInteractiveLogonRight", FALSE);
100-
101-
// Privileges
102-
GrantUserRight(pSid, L"SeTcbPrivilege", FALSE);
103-
GrantUserRight(pSid, L"SeMachineAccountPrivilege", FALSE);
104-
GrantUserRight(pSid, L"SeIncreaseQuotaPrivilege", FALSE);
105-
GrantUserRight(pSid, L"SeBackupPrivilege", FALSE);
106-
GrantUserRight(pSid, L"SeChangeNotifyPrivilege", FALSE);
107-
GrantUserRight(pSid, L"SeSystemTimePrivilege", FALSE);
108-
GrantUserRight(pSid, L"SeCreateTokenPrivilege", FALSE);
109-
GrantUserRight(pSid, L"SeCreatePagefilePrivilege", FALSE);
110-
GrantUserRight(pSid, L"SeCreateGlobalPrivilege", FALSE);
111-
GrantUserRight(pSid, L"SeDebugPrivilege", FALSE);
112-
GrantUserRight(pSid, L"SeEnableDelegationPrivilege", FALSE);
113-
GrantUserRight(pSid, L"SeRemoteShutdownPrivilege", FALSE);
114-
GrantUserRight(pSid, L"SeAuditPrivilege", FALSE);
115-
GrantUserRight(pSid, L"SeImpersonatePrivilege", FALSE);
116-
GrantUserRight(pSid, L"SeIncreaseBasePriorityPrivilege", FALSE);
117-
GrantUserRight(pSid, L"SeLoadDriverPrivilege", FALSE);
118-
GrantUserRight(pSid, L"SeLockMemoryPrivilege", FALSE);
119-
GrantUserRight(pSid, L"SeSecurityPrivilege", FALSE);
120-
GrantUserRight(pSid, L"SeSystemEnvironmentPrivilege", FALSE);
121-
GrantUserRight(pSid, L"SeManageVolumePrivilege", FALSE);
122-
GrantUserRight(pSid, L"SeProfileSingleProcessPrivilege", FALSE);
123-
GrantUserRight(pSid, L"SeSystemProfilePrivilege", FALSE);
124-
GrantUserRight(pSid, L"SeUndockPrivilege", FALSE);
125-
GrantUserRight(pSid, L"SeAssignPrimaryTokenPrivilege", FALSE);
126-
GrantUserRight(pSid, L"SeRestorePrivilege", FALSE);
127-
GrantUserRight(pSid, L"SeShutdownPrivilege", FALSE);
128-
GrantUserRight(pSid, L"SeSynchAgentPrivilege", FALSE);
129-
GrantUserRight(pSid, L"SeTakeOwnershipPrivilege", FALSE);
130-
}
131-
else
132-
{
133-
LogMessage(
134-
INSTALLMESSAGE_ERROR,
135-
NULL,
136-
NULL,
137-
NULL,
138-
NULL,
139-
_T("Failed to be able to obtain the SID for the selected user on the localhost")
140-
);
141-
return ERROR_INSTALL_FAILURE;
22+
class CARevokeBOINCAdminsRights : public BOINCCABase {
23+
public:
24+
virtual ~CARevokeBOINCAdminsRights() = default;
25+
explicit CARevokeBOINCAdminsRights(MSIHANDLE hMSIHandle) :
26+
BOINCCABase(hMSIHandle, _T("CARevokeBOINCAdminsRights"),
27+
_T("Validating the BOINC Administrators group privilege levels")) {
14228
}
14329

30+
UINT OnExecution() override final {
31+
PSID pSid;
32+
if (!GetAccountSid(nullptr, L"boinc_admins", &pSid)) {
33+
LogMessage(INSTALLMESSAGE_ERROR, 0, 0, 0, 0,
34+
_T("Failed to be able to obtain the SID "
35+
"for the selected user on the localhost"));
36+
return ERROR_INSTALL_FAILURE;
37+
}
38+
wil::unique_process_heap pSidDeleter(pSid);
39+
40+
constexpr std::array rightsToRemove = {
41+
L"SeNetworkLogonRight",
42+
L"SeRemoteInteractiveLogonRight",
43+
L"SeBatchLogonRight",
44+
L"SeInteractiveLogonRight",
45+
L"SeServiceLogonRight",
46+
L"SeDenyNetworkLogonRight",
47+
L"SeDenyInteractiveLogonRight",
48+
L"SeDenyBatchLogonRight",
49+
L"SeDenyServiceLogonRight",
50+
L"SeDenyRemoteInteractiveLogonRight",
51+
L"SeTcbPrivilege",
52+
L"SeMachineAccountPrivilege",
53+
L"SeIncreaseQuotaPrivilege",
54+
L"SeBackupPrivilege",
55+
L"SeChangeNotifyPrivilege",
56+
L"SeSystemTimePrivilege",
57+
L"SeCreateTokenPrivilege",
58+
L"SeCreatePagefilePrivilege",
59+
L"SeCreateGlobalPrivilege",
60+
L"SeDebugPrivilege",
61+
L"SeEnableDelegationPrivilege",
62+
L"SeRemoteShutdownPrivilege",
63+
L"SeAuditPrivilege",
64+
L"SeImpersonatePrivilege",
65+
L"SeIncreaseBasePriorityPrivilege",
66+
L"SeLoadDriverPrivilege",
67+
L"SeLockMemoryPrivilege",
68+
L"SeSecurityPrivilege",
69+
L"SeSystemEnvironmentPrivilege",
70+
L"SeManageVolumePrivilege",
71+
L"SeProfileSingleProcessPrivilege",
72+
L"SeSystemProfilePrivilege",
73+
L"SeUndockPrivilege",
74+
L"SeAssignPrimaryTokenPrivilege",
75+
L"SeRestorePrivilege",
76+
L"SeShutdownPrivilege",
77+
L"SeSynchAgentPrivilege",
78+
L"SeTakeOwnershipPrivilege"
79+
};
80+
for (auto& right : rightsToRemove) {
81+
GrantUserRight(pSid, const_cast<wchar_t*>(right), FALSE);
82+
}
83+
84+
return ERROR_SUCCESS;
85+
}
86+
};
14487

145-
//
146-
// Cleanup any handles and memory allocated during the custom action
147-
//
148-
if(pSid != NULL) HeapFree(GetProcessHeap(), 0, pSid);
149-
150-
return ERROR_SUCCESS;
151-
}
152-
153-
154-
/////////////////////////////////////////////////////////////////////
155-
//
156-
// Function: RevokeBOINCAdminsRights
157-
//
158-
// Description: This custom action revokes the 'boinc_admins' group the
159-
// required rights.
160-
//
161-
/////////////////////////////////////////////////////////////////////
162-
UINT __stdcall RevokeBOINCAdminsRights(MSIHANDLE hInstall)
163-
{
164-
UINT uiReturnValue = 0;
165-
166-
CARevokeBOINCAdminsRights* pCA = new CARevokeBOINCAdminsRights(hInstall);
167-
uiReturnValue = pCA->Execute();
168-
delete pCA;
169-
170-
return uiReturnValue;
88+
UINT __stdcall RevokeBOINCAdminsRights(MSIHANDLE hInstall) {
89+
return CARevokeBOINCAdminsRights(hInstall).Execute();
17190
}

‎clientsetup/win/CARevokeBOINCAdminsRights.h‎

Lines changed: 0 additions & 37 deletions
This file was deleted.

0 commit comments

Comments
 (0)