Apply access check when opening a previously pinned program

[poornagmsft]

@shankarseal fyi

[dthaler]

Program [will consume stubs/headers from PAL work]
Create - Alloc
Open - AccessCheck
ProgramInit
GetProperties

LoadMachineCode - allocating a read only executable page
CreateAndAttachToHook

Pin/Unpin
Uninit/Cleanup [ref count hits 0, the rundown logic]

[Alan-Jowett]

Looks like the functions to convert SDDL -> SECURITY_DESCRIPTOR aren't in the DDK. Are we ok with passing a self-relative SECURITY_DESCIPTOR instead of an SDDL?

[Alan-Jowett]

The EbpfIoDevice device object is restricted to:

//
// SDDL_DEVOBJ_SYS_ALL_ADM_ALL allows the kernel, system, and admin complete
// control over the device. No other users may access the device
//

So adding an additional access check here is redundant.

[Alan-Jowett]

Closing this as an additional access check is pointless given that this API can only be called by admin, kernel or local system.

If we ever loosen the restrictions on the device object, revisit this.