access_token.h 8.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239
  1. // Copyright 2021 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef BASE_WIN_ACCESS_TOKEN_H_
  5. #define BASE_WIN_ACCESS_TOKEN_H_
  6. #include <memory>
  7. #include <string>
  8. #include <vector>
  9. #include "base/base_export.h"
  10. #include "base/win/scoped_handle.h"
  11. #include "base/win/sid.h"
  12. #include "base/win/windows_types.h"
  13. #include "third_party/abseil-cpp/absl/types/optional.h"
  14. namespace base {
  15. namespace win {
  16. // This class is used to access the information for a Windows access token.
  17. class BASE_EXPORT AccessToken {
  18. public:
  19. // This class represents an access token group.
  20. class BASE_EXPORT Group {
  21. public:
  22. // Get the group SID.
  23. const Sid& GetSid() const { return sid_; }
  24. // Get the group attribute flags.
  25. DWORD GetAttributes() const { return attributes_; }
  26. // Returns true if the group is an integrity level.
  27. bool IsIntegrity() const;
  28. // Returns true if the group is enabled.
  29. bool IsEnabled() const;
  30. // Returns true if the group is deny only.
  31. bool IsDenyOnly() const;
  32. // Returns true if the group is the logon ID.
  33. bool IsLogonId() const;
  34. Group(Sid&& sid, DWORD attributes);
  35. Group(Group&&);
  36. ~Group();
  37. private:
  38. Sid sid_;
  39. DWORD attributes_;
  40. };
  41. // This class represents an access token privilege.
  42. class BASE_EXPORT Privilege {
  43. public:
  44. // Get the privilege LUID.
  45. CHROME_LUID GetLuid() const { return luid_; }
  46. // Get the privilege attribute flags.
  47. DWORD GetAttributes() const { return attributes_; }
  48. // Get the name of the privilege.
  49. std::wstring GetName() const;
  50. // Returns true if the privilege is enabled.
  51. bool IsEnabled() const;
  52. Privilege(CHROME_LUID luid, DWORD attributes);
  53. private:
  54. CHROME_LUID luid_;
  55. DWORD attributes_;
  56. };
  57. // This class represents an access token default DACL.
  58. class BASE_EXPORT Dacl {
  59. public:
  60. // Constructor, makes a copy of |dacl|.
  61. explicit Dacl(const ACL* dacl);
  62. Dacl(const Dacl&) = delete;
  63. Dacl& operator=(const Dacl&) = delete;
  64. Dacl(Dacl&&);
  65. ~Dacl();
  66. // Get a typed pointer to the ACL.
  67. ACL* GetAcl() const;
  68. private:
  69. std::vector<char> acl_buffer_;
  70. };
  71. // Creates an AccessToken object from a token handle.
  72. // |token| the token handle. This handle will be duplicated for TOKEN_QUERY
  73. // access, therefore the caller must be granted that access to the token
  74. // object. The AccessToken object owns its own copy of the token handle so
  75. // the original can be closed.
  76. static absl::optional<AccessToken> FromToken(HANDLE token);
  77. // Creates an AccessToken object from a process handle.
  78. // |process| the process handle. The handle needs to have
  79. // PROCESS_QUERY_LIMITED_INFORMATION access to the handle and TOKEN_QUERY
  80. // access to the token object.
  81. // |impersonation| if true then the process token will be duplicated to an
  82. // impersonation token. This allows you to call the IsMember API which
  83. // requires an impersonation token. To duplicate TOKEN_DUPLICATE access is
  84. // required.
  85. static absl::optional<AccessToken> FromProcess(HANDLE process,
  86. bool impersonation = false);
  87. // Creates an AccessToken object for the current process.
  88. // |impersonation| if true then the process token will be duplicated to an
  89. // impersonation token. This allows you to call the IsMember API which
  90. // requires an impersonation token. To duplicate TOKEN_DUPLICATE access is
  91. // required.
  92. static absl::optional<AccessToken> FromCurrentProcess(
  93. bool impersonation = false);
  94. // Creates an AccessToken object from a thread handle. The thread must be
  95. // impersonating a token for this to succeed.
  96. // |thread| the thread handle. The handle needs to have
  97. // THREAD_QUERY_LIMITED_INFORMATION access and TOKEN_QUERY access to the
  98. // token object.
  99. // |open_as_self| open the token using the process token rather than the
  100. // current thread's impersonated token.
  101. // If the thread isn't impersonating it will return an empty value and the
  102. // Win32 last error code will be ERROR_NO_TOKEN.
  103. static absl::optional<AccessToken> FromThread(HANDLE thread,
  104. bool open_as_self = true);
  105. // Creates an AccessToken object from the current thread. The thread must be
  106. // impersonating a token for this to succeed.
  107. // |open_as_self| open the thread handle using the process token rather
  108. // than the current thread's impersonated token.
  109. // If the thread isn't impersonating it will return an empty value and the
  110. // Win32 last error code will be ERROR_NO_TOKEN.
  111. static absl::optional<AccessToken> FromCurrentThread(
  112. bool open_as_self = true);
  113. // Creates an AccessToken object for the current thread's effective token.
  114. // If the thread is impersonating then it'll try and open the thread token,
  115. // otherwise it'll open the process token.
  116. static absl::optional<AccessToken> FromEffective();
  117. AccessToken(const AccessToken&) = delete;
  118. AccessToken& operator=(const AccessToken&) = delete;
  119. AccessToken(AccessToken&&);
  120. AccessToken& operator=(AccessToken&&);
  121. ~AccessToken();
  122. // Get the token's user SID.
  123. Sid User() const;
  124. // Get the token's user group.
  125. Group UserGroup() const;
  126. // Get the token's owner SID. This can be different to the user SID, it's
  127. // used as the default owner for new secured objects.
  128. Sid Owner() const;
  129. // Get the token's primary group SID.
  130. Sid PrimaryGroup() const;
  131. // Get the token logon SID. Returns an empty value if the token doesn't have
  132. // a logon SID. If the logon SID doesn't exist then the Win32 last error code
  133. // will be ERROR_NOT_FOUND.
  134. absl::optional<Sid> LogonId() const;
  135. // Get the token's integrity level. Returns MAXDWORD if the token doesn't
  136. // have an integrity level.
  137. DWORD IntegrityLevel() const;
  138. // Get the token's session ID. Returns MAXDWORD if the token if the session
  139. // ID can't be queried.
  140. DWORD SessionId() const;
  141. // The token's group list.
  142. std::vector<Group> Groups() const;
  143. // Get whether the token is a restricted.
  144. bool IsRestricted() const;
  145. // The token's restricted SIDs list. If not a restricted token this will
  146. // return an empty vector.
  147. std::vector<Group> RestrictedSids() const;
  148. // Get whether the token is an appcontainer.
  149. bool IsAppContainer() const;
  150. // Get the token's appcontainer SID. If not an appcontainer token this will
  151. // return an empty value.
  152. absl::optional<Sid> AppContainerSid() const;
  153. // The token's capabilities. If not an appcontainer token this will return an
  154. // empty vector.
  155. std::vector<Group> Capabilities() const;
  156. // Get the UAC linked token.
  157. absl::optional<AccessToken> LinkedToken() const;
  158. // Get the default DACL for the token. Returns an empty value if the token
  159. // doesn't have a default DACL.
  160. absl::optional<Dacl> DefaultDacl() const;
  161. // Get the token's ID.
  162. CHROME_LUID Id() const;
  163. // Get the token's authentication ID.
  164. CHROME_LUID AuthenticationId() const;
  165. // Get the token's privileges.
  166. std::vector<Privilege> Privileges() const;
  167. // Get whether the token is elevated.
  168. bool IsElevated() const;
  169. // Checks if the sid is a member of the token's groups. The token must be
  170. // an impersonation token rather than a primary token. If the token is not an
  171. // impersonation token then it returns false and the Win32 last error will be
  172. // set to ERROR_NO_IMPERSONATION_TOKEN.
  173. bool IsMember(const Sid& sid) const;
  174. // Checks if the well known sid is a member of the token's groups. The token
  175. // must be an impersonation token rather than a primary token. If the token
  176. // is not an impersonation token then it returns false and the Win32 last
  177. // error will be set to ERROR_NO_IMPERSONATION_TOKEN.
  178. bool IsMember(WellKnownSid known_sid) const;
  179. // Checks if the token is an impersonation token. If false then it's a primary
  180. // token.
  181. bool IsImpersonation() const;
  182. // Checks if the token can only be used for identification. This is based on
  183. // the security impersonation level of the token. If the level is less than
  184. // or equal to SecurityIdentification this function returns true. Always
  185. // returns false for a primary token.
  186. bool IsIdentification() const;
  187. private:
  188. explicit AccessToken(HANDLE token);
  189. ScopedHandle token_;
  190. };
  191. } // namespace win
  192. } // namespace base
  193. #endif // BASE_WIN_ACCESS_TOKEN_H_