0

suppose i receive a handle to a process in a user-mode application. i dont know if it is returned from a CrateProcess or an OpenProcess call. to call GetProcessTimes with this handle i need PROCESS_QUERY_INFORMATION or PROCESS_QUERY_LIMITED_INFORMATION access rights. the easiest approach would be to call DuplicateHandle (with PROCESS_QUERY_INFORMATION or PROCESS_QUERY_LIMITED_INFORMATION), but then again it needs the PROCESS_DUP_HANDLE access right. so to decrease the chance of failure, i could call GetProcessTimes on handle, if it succeeds then everything is ok, othwerwise i duplicate the handle with the needed access right and call GetProcessTimes again.

i was wondering if it is possible to check if a given process has ROCESS_QUERY_INFORMATION or PROCESS_QUERY_LIMITED_INFORMATION access right before i make the first call to GetProcessTimes to further reduce the overhead. looking around on msdn i think i should use GetSecurityInfo? but i have found no examples that i could use.

thank you

user2281752
  • 145
  • 1
  • 9
  • You can use [AccessCheck](http://msdn.microsoft.com/en-us/library/windows/desktop/aa374815%28v=vs.85%29.aspx) for this, but it's kind of a chore to use and introduces even more potential for errors. It's easier to just go the way you have described. – Luke Apr 15 '13 at 14:43

1 Answers1

2

This type of "check if I can access something" is always easiest solved by actually trying to do what it is you actually want to do, carefully checking for errors at each stage.

Anything else is subject to TOCTOU anyway, so it will not really help to "precheck" things - you still need a lot of checking in the code that does the actual work.

Mats Petersson
  • 126,704
  • 14
  • 140
  • 227