ExternalVendorCode/ZeroTierOne
1
0
Fork 0
mirror of https://github.com/zerotier/ZeroTierOne.git synced 2025-04-19 08:26:14 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Windows file permissions fix (#1887)

Browse Source
This commit is contained in:
Grant Limberg 2023-03-04 00:43:00 -08:00 committed by GitHub
parent 8d74d34f2a
commit cc4251c5b7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
one.cpp
View File

@ -2235,6 +2235,27 @@ int main(int argc,char **argv)
}
}
// Check and fix permissions on critical files at startup
try {
char p[4096];
OSUtils::ztsnprintf(p, sizeof(p), "%s" ZT_PATH_SEPARATOR_S "identity.secret", homeDir.c_str());
if (OSUtils::fileExists(p)) {
OSUtils::lockDownFile(p, false);
}
}
catch (...) {
}
try {
char p[4096];
OSUtils::ztsnprintf(p, sizeof(p), "%s" ZT_PATH_SEPARATOR_S "authtoken.secret", homeDir.c_str());
if (OSUtils::fileExists(p)) {
OSUtils::lockDownFile(p, false);
}
}
catch (...) {
}
// This can be removed once the new controller code has been around for many versions
if (OSUtils::fileExists((homeDir + ZT_PATH_SEPARATOR_S + "controller.db").c_str(),true)) {
fprintf(stderr,"%s: FATAL: an old controller.db exists in %s -- see instructions in controller/README.md for how to migrate!" ZT_EOL_S,argv[0],homeDir.c_str());

10
osdep/OSUtils.cpp
View File

@ -257,6 +257,16 @@ void OSUtils::lockDownFile(const char *path,bool isDir)
CloseHandle(processInfo.hProcess);
CloseHandle(processInfo.hThread);
}
// Remove 'Everyone' group from R/RX access
startupInfo.cb = sizeof(startupInfo);
memset(&startupInfo, 0, sizeof(STARTUPINFOA));
memset(&processInfo, 0, sizeof(PROCESS_INFORMATION));
if (CreateProcessA(NULL, (LPSTR)(std::string("C:\\Windows\\System32\\icacls.exe \"") + path + "\" /remove:g Everyone /t /c /Q").c_str(), NULL, NULL, FALSE, CREATE_NO_WINDOW, NULL, NULL, &startupInfo, &processInfo)) {
WaitForSingleObject(processInfo.hProcess, INFINITE);
CloseHandle(processInfo.hProcess);
CloseHandle(processInfo.hThread);
}
}
#endif
#endif