2

Background

I have 2 windows services (running on WinServer2016) communicating over shared memory. The mapping is propagated with DuplicateHandle windows API from one service to the other (there are reasons why this is the preferred method).

While services are running under Local System account everything is fine, but if we run them under a dedicated Admin account the mapping passing fails: OpenProcess reports access denied.

Looking at the Properties/Security/Permissions/Advanced panel of the receiver process in ProcessExplorer I indeed see that PROCESS_DUP_HANLDE is allowed for local system and disallowed for the Admin group. I see exactly the same if I dump the security descriptor of the process with CppCheckSD:

O:BAG:SYD:(A;;0x1fffff;;;SY)(A;;0x121411;;;BA)S:AI(ML;;NWNR;;;SI)

Question

I would like to add an ACE to the receiver process that allows PROCESS_DUP_HANDLE to any process ran by the creator account (both services are running with the same account). I would like to do this at service creation time.

sc has options to get and set the security descriptor (SD) of a service, but I can't really interpret the result of sc sdshow:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

This DACL has 4 entries (compared to the 2 above), and the admin group has more rights than system.

  • For me it seems process SD != service SD, is this right?
  • What does the SD set by sc correspond?
  • Can I add the required permission with sc sdset?
Gyorgy Szekely
  • 2,654
  • 3
  • 23
  • 32

1 Answers1

0

Process SD and service SD are not the same things. The former defines permissions on the process (PROCESS_DUP_HANDLE is on of these). Service SD defines a different set of permissions on the service, like Start, Stop, Query status (see: Setting Windows service permissions). So it tells who can do what with your service. It is not possible to modify the process SD with sc sdset.

What makes this bit confusing is that the interpretation of the access mask bits in the ACE entry depend on type of the object whose SD we're inspecting. For example 0x0040 means PROCESS_DUP_HANLDE for a process, but it means SERVICE_PAUSE_CONTINUE for a service (Access rights for Windows objects).

On top of that MS defined the SDDL as the easily readable (duh!) representation of the SD. The SDDL maps each access mask bit to a 2 letter abbreviation of a filesystem related permission, and it does not reflect the object dependent interpretation at all. That's why sc sdshow displays permissions like LIST_CHILDREN(LC) or DELETE_TREE(DT) which have no meaning in the context of a service.

Regarding the original problem (using DuplicateHandle API) I ended up adding permissions in the client process to the server user with GetSecurityInfo/SetEntriesInAcl/SetSecurityInfo API's.

Gyorgy Szekely
  • 2,654
  • 3
  • 23
  • 32