security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-05-19 09:02:22 +02:00
Code Activity

Simplify the access control.

Browse Source 
PIPE_REJECT_REMOTE_CLIENTS would be enough.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
This commit is contained in:
NIIBE Yutaka 2022-07-28 15:56:33 +09:00
parent eb8725b195
commit 30df964607
1 changed files with 4 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
agent/gpg-agent.c
View File

@ -2765,8 +2765,6 @@ putty_message_thread (void *arg)
/* FIXME: it would be good to be specified by an option. */ /* FIXME: it would be good to be specified by an option. */
#define AGENT_PIPE_NAME "\\\\.\\pipe\\openssh-ssh-agent" #define AGENT_PIPE_NAME "\\\\.\\pipe\\openssh-ssh-agent"
/* FIXME: Don't know exact semantics, but copied from Win32-Openssh */
#define SDDL_STR "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;0x12019b;;;AU)"
#define BUFSIZE 5 * 1024 #define BUFSIZE 5 * 1024
/* The thread handling Win32-OpenSSH requests through NamedPipe. */ /* The thread handling Win32-OpenSSH requests through NamedPipe. */
@ -2774,24 +2772,12 @@ static void *
win32_openssh_thread (void *arg) win32_openssh_thread (void *arg)
{ {
HANDLE pipe; HANDLE pipe;
SECURITY_ATTRIBUTES sa;
(void)arg; (void)arg;
if (opt.verbose) if (opt.verbose)
log_info ("Win32-OpenSSH thread started\n"); log_info ("Win32-OpenSSH thread started\n");
memset(&sa, 0, sizeof (SECURITY_ATTRIBUTES));
sa.nLength = sizeof (sa);
if (!ConvertStringSecurityDescriptorToSecurityDescriptorA
(SDDL_STR, SDDL_REVISION_1, &sa.lpSecurityDescriptor, &sa.nLength))
{
log_error ("cannot convert sddl: %ld\n", GetLastError ());
return NULL;
}
sa.bInheritHandle = FALSE;
while (1) while (1)
{ {
ctrl_t ctrl = NULL; ctrl_t ctrl = NULL;
@ -2799,11 +2785,11 @@ win32_openssh_thread (void *arg)
es_syshd_t syshd; es_syshd_t syshd;
npth_unprotect (); npth_unprotect ();
pipe = CreateNamedPipeA (AGENT_PIPE_NAME, pipe = CreateNamedPipeA (AGENT_PIPE_NAME, PIPE_ACCESS_DUPLEX,
PIPE_ACCESS_DUPLEX, // | FILE_FLAG_OVERLAPPED (PIPE_TYPE_BYTE | PIPE_READMODE_BYTE
PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT, | PIPE_WAIT | PIPE_REJECT_REMOTE_CLIENTS),
PIPE_UNLIMITED_INSTANCES, PIPE_UNLIMITED_INSTANCES,
BUFSIZE, BUFSIZE, 0, &sa); BUFSIZE, BUFSIZE, 0, NULL);
if (pipe == INVALID_HANDLE_VALUE) if (pipe == INVALID_HANDLE_VALUE)
{ {