Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wcow: scope security descriptor for the npipe and make it configurable #4873

Closed
profnandaa opened this issue Apr 24, 2024 · 2 comments
Closed

Comments

@profnandaa
Copy link
Collaborator

profnandaa commented Apr 24, 2024

We need to check if this isn't relaxing security too much for default value and implement --group per #4864 (comment) , but I guess for testing experimental feature this is fine for now.

Originally posted by @tonistiigi in #4872 (review)

--

accesschk.exe -d \\.\pipe\\buildkitd

Accesschk v6.15 - Reports effective permissions for securable objects
Copyright (C) 2006-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

\\.\pipe\buildkitd
  RW NT AUTHORITY\Authenticated Users
  RW NT AUTHORITY\SYSTEM
  RW BUILTIN\Administrators

pc := &winio.PipeConfig{
// Allow generic read and generic write access to authenticated users
// and system users. On Linux, this pipe seems to be given rw access to
// user, group and others (666).
// TODO(gabriel-samfira): should we restrict access to this pipe to just
// authenticated users? Or Administrators group?
SecurityDescriptor: "D:P(A;;GRGW;;;AU)(A;;GRGW;;;SY)",
}

@profnandaa
Copy link
Collaborator Author

Cross linking - #4864 (comment)

@profnandaa
Copy link
Collaborator Author

fixed in #4875

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant