Eryk Sun <eryk...@gmail.com> added the comment:
> processtoken = win32security.OpenProcessToken(process,
> win32con.MAXIMUM_ALLOWED)
> win32security.GetTokenInformation(processtoken,
> win32security.TokenMandatoryPolicy)
FYI, starting with Windows 8, the system supports pseudo-handles for the access
token of the current process -- (HANDLE)-4 -- and the current thread --
(HANDLE)-5, which don't have to be opened and closed. In the API, they're
available as the inlined functions GetCurrentProcessToken() and
GetCurrentThreadToken(). These pseudo-handles have TOKEN_QUERY and
TOKEN_QUERY_SOURCE access, so they can be used with token queries, i.e.
GetTokenInformation(-4, TokenInformationClass).
> As the shell is started with medium integrity level and the file is set to
> low
> integrity level the process would get created with low integrity level.
Yes, because the access token of shell, which is a limited medium-integrity
logon, has a mandatory policy that includes
TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN.
> "C:\Program Files", "C:\Users" and "C:\Windows" seem to have their own DACL's.
Those directories have protected DACLs with custom security, so they don't
inherit the inheritable entries from the root directory. For example:
>>> sd = GetNamedSecurityInfo(r'C:\Program Files', SE_FILE_OBJECT,
... DACL_SECURITY_INFORMATION)
>>> sd.GetSecurityDescriptorControl()[0] & SE_DACL_PROTECTED
4096
That said, Python's installer doesn't set custom security on the installation
directory, and that's not likely to change. It just relies on inheritance. If
you install in "C:\Python38-32", and the inheritable security from the root
directory is problematic, then you need to resolve the problem manually, as you
have done.
> win32security.GetFileSecurity("C:\\",
> win32security.SACL_SECURITY_INFORMATION)
> fails on me even on an elevated prompt.
Querying audit entries in the SACL of an object (SACL_SECURITY_INFORMATION)
requires ACCESS_SYSTEM_SECURITY access, which requires SeSecurityPrivilege to
be enabled. Administrators have this privilege, but it's disabled by default.
Some entries in the SACL can be read with just READ_CONTROL access: the
mandatory label (LABEL_SECURITY_INFORMATION -- WRITE_OWNER access to set),
security resource attributes (ATTRIBUTE_SECURITY_INFORMATION -- WRITE_DAC
access to set), and the central access policy identifier
(SCOPE_SECURITY_INFORMATION -- ACCESS_SYSTEM_SECURITY access to set).
> "(NW)" is not directly mentioned. I'm assuming "(NR)" and "(NX)" might be the
> missing integrity policy options for an integrity level entry.
I don't think icacls.exe allows setting no-read-up and no-execute-up access
control. "NR" and "NX" appear to be ignored. For example:
>>> cmd = r'icacls C:\Temp\spam.txt /setintegritylevel H:(NW)(NR)(NX)'
>>> subprocess.call(cmd)
processed file: C:\Temp\spam.txt
Successfully processed 1 files; Failed processing 0 files
0
>>> sd = GetNamedSecurityInfo(r'C:\Temp\spam.txt', SE_FILE_OBJECT,
... LABEL_SECURITY_INFORMATION)
>>> sacl = sd.GetSecurityDescriptorSacl()
>>> (acetype, aceflags), mask, sid = sacl.GetAce(0)
>>> acetype == SYSTEM_MANDATORY_LABEL_ACE_TYPE
True
>>> aceflags == 0
True
>>> LookupAccountSid(None, sid)
('High Mandatory Level', 'Mandatory Label', 10)
But only the no-write-up access control is set:
>>> mask == SYSTEM_MANDATORY_LABEL_NO_WRITE_UP
True
----------
resolution: -> not a bug
stage: -> resolved
status: open -> closed
_______________________________________
Python tracker <rep...@bugs.python.org>
<https://bugs.python.org/issue42046>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
