Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix runas function for System Account #34292

Merged
merged 3 commits into from
Jun 30, 2016
Merged

Fix runas function for System Account #34292

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e9d2402
Fix runas function for System Account
twangboy Jun 24, 2016
5584cc2
Handle users that aren't admin
twangboy Jun 28, 2016
433f300
Enable all privileges
twangboy Jun 29, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 28 additions & 2 deletions salt/utils/win_runas.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
import win32profile
import msvcrt
import ctypes
import winerror
from ctypes import wintypes
HAS_WIN32 = True
except ImportError:
Expand Down Expand Up @@ -298,6 +299,31 @@ def runas_system(cmd, username, password):
win32con.LOGON32_LOGON_INTERACTIVE,
win32con.LOGON32_PROVIDER_DEFAULT)

try:
# Get Unrestricted Token (UAC) if this is an Admin Account
elevated_token = win32security.GetTokenInformation(
token, win32security.TokenLinkedToken)

# Get list of privileges this token contains
privileges = win32security.GetTokenInformation(
elevated_token, win32security.TokenPrivileges)

# Create a set of all privileges to be enabled
enable_privs = set()
for luid, flags in privileges:
enable_privs.add((luid, win32con.SE_PRIVILEGE_ENABLED))

# Enable the privileges
win32security.AdjustTokenPrivileges(elevated_token, 0, enable_privs)

except win32security.error as exc:
# User doesn't have admin, use existing token
if exc[0] == winerror.ERROR_NO_SUCH_LOGON_SESSION \
or exc[0] == winerror.ERROR_PRIVILEGE_NOT_HELD:
elevated_token = token
else:
raise

# Get Security Attributes
security_attributes = win32security.SECURITY_ATTRIBUTES()
security_attributes.bInheritHandle = 1
Expand Down Expand Up @@ -337,8 +363,8 @@ def runas_system(cmd, username, password):
None,
startup_info)

hProcess, hThread, PId, TId = win32process.CreateProcessAsUser(token,
*procArgs)
hProcess, hThread, PId, TId = \
win32process.CreateProcessAsUser(elevated_token, *procArgs)

if stdin_read is not None:
stdin_read.Close()
Expand Down