diff options
| author | weitaosu <weitaosu@chromium.org> | 2015-09-18 10:30:52 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-09-18 17:31:27 +0000 |
| commit | e09928dae0a3f48d6686fddf52bf22951384d105 (patch) | |
| tree | 28052668833994c5e1ab0f66bee937db5462dec4 /remoting/host/setup | |
| parent | 8f3768781792d088730de219b8abbc23c2d259d1 (diff) | |
| download | chromium_src-e09928dae0a3f48d6686fddf52bf22951384d105.zip chromium_src-e09928dae0a3f48d6686fddf52bf22951384d105.tar.gz chromium_src-e09928dae0a3f48d6686fddf52bf22951384d105.tar.bz2 | |
Allow local admins access to the pipe created by the unprivileged native messaging host process. If not, the privileged NM host process won't be able to connect to the named pipe created by the unprivileged NM host process.
BUG=477471
Review URL: https://codereview.chromium.org/1351453005
Cr-Commit-Position: refs/heads/master@{#349703}
Diffstat (limited to 'remoting/host/setup')
| -rw-r--r-- | remoting/host/setup/me2me_native_messaging_host.cc | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/remoting/host/setup/me2me_native_messaging_host.cc b/remoting/host/setup/me2me_native_messaging_host.cc index 49d2b74..37c004d 100644 --- a/remoting/host/setup/me2me_native_messaging_host.cc +++ b/remoting/host/setup/me2me_native_messaging_host.cc @@ -588,11 +588,14 @@ void Me2MeNativeMessagingHost::EnsureElevatedHostCreated() { } // Create a security descriptor that gives full access to the caller and - // denies access by anyone else. + // BUILTIN_ADMINISTRATORS and denies access by anyone else. + // Local admins need access because the privileged host process will run + // as a local admin which may not be the same user as the current user. std::string user_sid_ascii = base::UTF16ToASCII(user_sid); std::string security_descriptor = - base::StringPrintf("O:%sG:%sD:(A;;GA;;;%s)", user_sid_ascii.c_str(), - user_sid_ascii.c_str(), user_sid_ascii.c_str()); + base::StringPrintf("O:%sG:%sD:(A;;GA;;;%s)(A;;GA;;;BA)", + user_sid_ascii.c_str(), user_sid_ascii.c_str(), + user_sid_ascii.c_str()); ScopedSd sd = ConvertSddlToSd(security_descriptor); if (!sd) { |