X-Git-Url: http://git.iain.cx/?a=blobdiff_plain;f=service.cpp;h=2f1ceb02d91b775a6f4f6e355159eff3c0b570f2;hb=1c7716c9a9bf3e8dd844fd27d1351dab6ceaf510;hp=94cca765d5e6239a992f636b61cd09c4d41d90c9;hpb=2294db794e6dfd5698fe57d135cd0da67aca95b0;p=nssm.git diff --git a/service.cpp b/service.cpp index 94cca76..2f1ceb0 100644 --- a/service.cpp +++ b/service.cpp @@ -1,5 +1,10 @@ #include "nssm.h" +/* This is explicitly a wide string. */ +#define NSSM_LOGON_AS_SERVICE_RIGHT L"SeServiceLogonRight" + +extern const TCHAR *exit_action_strings[]; + bool is_admin; bool use_critical_section; @@ -32,10 +37,157 @@ SC_HANDLE open_service_manager() { return ret; } +static int grant_logon_as_service(const TCHAR *username) { + if (str_equiv(username, NSSM_LOCALSYSTEM_ACCOUNT)) return 0; + + /* Open Policy object. */ + LSA_OBJECT_ATTRIBUTES attributes; + ZeroMemory(&attributes, sizeof(attributes)); + + LSA_HANDLE policy; + + NTSTATUS status = LsaOpenPolicy(0, &attributes, POLICY_ALL_ACCESS, &policy); + if (status) { + print_message(stderr, NSSM_MESSAGE_LSAOPENPOLICY_FAILED, error_string(LsaNtStatusToWinError(status))); + return 1; + } + + /* Look up SID for the account. */ + LSA_UNICODE_STRING lsa_username; +#ifdef UNICODE + lsa_username.Buffer = (wchar_t *) username; + lsa_username.Length = (unsigned short) _tcslen(username) * sizeof(TCHAR); + lsa_username.MaximumLength = lsa_username.Length + sizeof(TCHAR); +#else + size_t buflen; + mbstowcs_s(&buflen, NULL, 0, username, _TRUNCATE); + lsa_username.MaximumLength = buflen * sizeof(wchar_t); + lsa_username.Length = lsa_username.MaximumLength - sizeof(wchar_t); + lsa_username.Buffer = (wchar_t *) HeapAlloc(GetProcessHeap(), 0, lsa_username.MaximumLength); + if (lsa_username.Buffer) mbstowcs_s(&buflen, lsa_username.Buffer, lsa_username.MaximumLength, username, _TRUNCATE); + else { + LsaClose(policy); + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("LSA_UNICODE_STRING"), _T("grant_logon_as_service()")); + return 2; + } +#endif + + LSA_REFERENCED_DOMAIN_LIST *translated_domains; + LSA_TRANSLATED_SID *translated_sid; + status = LsaLookupNames(policy, 1, &lsa_username, &translated_domains, &translated_sid); +#ifndef UNICODE + HeapFree(GetProcessHeap(), 0, lsa_username.Buffer); +#endif + if (status) { + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + LsaClose(policy); + print_message(stderr, NSSM_MESSAGE_LSALOOKUPNAMES_FAILED, username, error_string(LsaNtStatusToWinError(status))); + return 3; + } + + if (translated_sid->Use != SidTypeUser) { + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + LsaClose(policy); + print_message(stderr, NSSM_GUI_INVALID_USERNAME, username); + return 4; + } + + LSA_TRUST_INFORMATION *trust = &translated_domains->Domains[translated_sid->DomainIndex]; + if (! trust || ! IsValidSid(trust->Sid)) { + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + LsaClose(policy); + print_message(stderr, NSSM_GUI_INVALID_USERNAME, username); + return 4; + } + + /* GetSidSubAuthority*() return pointers! */ + unsigned char *n = GetSidSubAuthorityCount(trust->Sid); + + /* Convert translated SID to SID. */ + SID *sid = (SID *) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, GetSidLengthRequired(*n + 1)); + if (! sid) { + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + LsaClose(policy); + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("SID"), _T("grant_logon_as_service")); + return 4; + } + + unsigned long error; + if (! InitializeSid(sid, GetSidIdentifierAuthority(trust->Sid), *n + 1)) { + error = GetLastError(); + HeapFree(GetProcessHeap(), 0, sid); + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + LsaClose(policy); + print_message(stderr, NSSM_MESSAGE_INITIALIZESID_FAILED, username, error_string(error)); + return 5; + } + + for (unsigned char i = 0; i <= *n; i++) { + unsigned long *sub = GetSidSubAuthority(sid, i); + if (i < *n) *sub = *GetSidSubAuthority(trust->Sid, i); + else *sub = translated_sid->RelativeId; + } + + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + + /* Check if the SID has the "Log on as a service" right. */ + LSA_UNICODE_STRING lsa_right; + lsa_right.Buffer = NSSM_LOGON_AS_SERVICE_RIGHT; + lsa_right.Length = (unsigned short) wcslen(lsa_right.Buffer) * sizeof(wchar_t); + lsa_right.MaximumLength = lsa_right.Length + sizeof(wchar_t); + + LSA_UNICODE_STRING *rights; + unsigned long count = ~0; + status = LsaEnumerateAccountRights(policy, sid, &rights, &count); + if (status) { + /* + If the account has no rights set LsaEnumerateAccountRights() will return + STATUS_OBJECT_NAME_NOT_FOUND and set count to 0. + */ + error = LsaNtStatusToWinError(status); + if (error != ERROR_FILE_NOT_FOUND) { + HeapFree(GetProcessHeap(), 0, sid); + LsaClose(policy); + print_message(stderr, NSSM_MESSAGE_LSAENUMERATEACCOUNTRIGHTS_FAILED, username, error_string(error)); + return 4; + } + } + + for (unsigned long i = 0; i < count; i++) { + if (rights[i].Length != lsa_right.Length) continue; + if (_wcsnicmp(rights[i].Buffer, lsa_right.Buffer, lsa_right.MaximumLength)) continue; + /* The SID has the right. */ + HeapFree(GetProcessHeap(), 0, sid); + LsaFreeMemory(rights); + LsaClose(policy); + return 0; + } + LsaFreeMemory(rights); + + /* Add the right. */ + status = LsaAddAccountRights(policy, sid, &lsa_right, 1); + HeapFree(GetProcessHeap(), 0, sid); + LsaClose(policy); + if (status) { + print_message(stderr, NSSM_MESSAGE_LSAADDACCOUNTRIGHTS_FAILED, error_string(LsaNtStatusToWinError(status))); + return 5; + } + + print_message(stdout, NSSM_MESSAGE_GRANTED_LOGON_AS_SERVICE, username); + return 0; +} + /* Set default values which aren't zero. */ void set_nssm_service_defaults(nssm_service_t *service) { if (! service) return; + service->type = SERVICE_WIN32_OWN_PROCESS; service->stdin_sharing = NSSM_STDIN_SHARING; service->stdin_disposition = NSSM_STDIN_DISPOSITION; service->stdin_flags = NSSM_STDIN_FLAGS; @@ -62,6 +214,11 @@ nssm_service_t *alloc_nssm_service() { /* Free memory for a service. */ void cleanup_nssm_service(nssm_service_t *service) { if (! service) return; + if (service->username) HeapFree(GetProcessHeap(), 0, service->username); + if (service->password) { + SecureZeroMemory(service->password, service->passwordlen); + HeapFree(GetProcessHeap(), 0, service->password); + } if (service->env) HeapFree(GetProcessHeap(), 0, service->env); if (service->env_extra) HeapFree(GetProcessHeap(), 0, service->env_extra); if (service->handle) CloseServiceHandle(service->handle); @@ -74,17 +231,17 @@ void cleanup_nssm_service(nssm_service_t *service) { /* About to install the service */ int pre_install_service(int argc, TCHAR **argv) { + nssm_service_t *service = alloc_nssm_service(); + set_nssm_service_defaults(service); + if (argc) _sntprintf_s(service->name, _countof(service->name), _TRUNCATE, _T("%s"), argv[0]); + /* Show the dialogue box if we didn't give the service name and path */ - if (argc < 2) return nssm_gui(IDD_INSTALL, argv[0]); + if (argc < 2) return nssm_gui(IDD_INSTALL, service); - nssm_service_t *service = alloc_nssm_service(); if (! service) { - print_message(stderr, NSSM_EVENT_OUT_OF_MEMORY, _T("service"), _T("pre_install_service()")); + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("service"), _T("pre_install_service()")); return 1; } - - set_nssm_service_defaults(service); - _sntprintf_s(service->name, _countof(service->name), _TRUNCATE, _T("%s"), argv[0]); _sntprintf_s(service->exe, _countof(service->exe), _TRUNCATE, _T("%s"), argv[1]); /* Arguments are optional */ @@ -114,13 +271,185 @@ int pre_install_service(int argc, TCHAR **argv) { return ret; } +/* About to edit the service. */ +int pre_edit_service(int argc, TCHAR **argv) { + /* Require service name. */ + if (argc < 1) return usage(1); + + nssm_service_t *service = alloc_nssm_service(); + _sntprintf_s(service->name, _countof(service->name), _TRUNCATE, _T("%s"), argv[0]); + + /* Open service manager */ + SC_HANDLE services = open_service_manager(); + if (! services) { + print_message(stderr, NSSM_MESSAGE_OPEN_SERVICE_MANAGER_FAILED); + return 2; + } + + /* Try to open the service */ + service->handle = OpenService(services, service->name, SC_MANAGER_ALL_ACCESS); + if (! service->handle) { + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_OPENSERVICE_FAILED); + return 3; + } + + /* Get system details. */ + unsigned long bufsize; + unsigned long error; + QUERY_SERVICE_CONFIG *qsc; + + QueryServiceConfig(service->handle, 0, 0, &bufsize); + error = GetLastError(); + if (error == ERROR_INSUFFICIENT_BUFFER) { + qsc = (QUERY_SERVICE_CONFIG *) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, bufsize); + if (! qsc) { + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("QUERY_SERVICE_CONFIG"), _T("pre_edit_service()"), 0); + return 4; + } + } + else { + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG_FAILED, service->name, error_string(error), 0); + return 4; + } + + if (! QueryServiceConfig(service->handle, qsc, bufsize, &bufsize)) { + HeapFree(GetProcessHeap(), 0, qsc); + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG_FAILED, service->name, error_string(GetLastError()), 0); + return 4; + } + + service->type = qsc->dwServiceType; + if (! (service->type & SERVICE_WIN32_OWN_PROCESS)) { + HeapFree(GetProcessHeap(), 0, qsc); + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_CANNOT_EDIT, service->name, _T("SERVICE_WIN32_OWN_PROCESS"), 0); + return 3; + } + + switch (qsc->dwStartType) { + case SERVICE_DEMAND_START: service->startup = NSSM_STARTUP_MANUAL; break; + case SERVICE_DISABLED: service->startup = NSSM_STARTUP_DISABLED; break; + default: service->startup = NSSM_STARTUP_AUTOMATIC; + } + if (! str_equiv(qsc->lpServiceStartName, NSSM_LOCALSYSTEM_ACCOUNT)) { + size_t len = _tcslen(qsc->lpServiceStartName); + service->username = (TCHAR *) HeapAlloc(GetProcessHeap(), 0, (len + 1) * sizeof(TCHAR)); + if (service->username) { + memmove(service->username, qsc->lpServiceStartName, (len + 1) * sizeof(TCHAR)); + service->usernamelen = (unsigned long) len; + } + else { + HeapFree(GetProcessHeap(), 0, qsc); + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("username"), _T("pre_edit_service()")); + return 4; + } + } + _sntprintf_s(service->displayname, _countof(service->displayname), _TRUNCATE, _T("%s"), qsc->lpDisplayName); + + /* Get the canonical service name. We open it case insensitively. */ + bufsize = _countof(service->name); + GetServiceKeyName(services, service->displayname, service->name, &bufsize); + + /* Remember the executable in case it isn't NSSM. */ + _sntprintf_s(service->image, _countof(service->image), _TRUNCATE, _T("%s"), qsc->lpBinaryPathName); + HeapFree(GetProcessHeap(), 0, qsc); + + /* Get extended system details. */ + if (service->startup == NSSM_STARTUP_AUTOMATIC) { + QueryServiceConfig2(service->handle, SERVICE_CONFIG_DELAYED_AUTO_START_INFO, 0, 0, &bufsize); + error = GetLastError(); + if (error == ERROR_INSUFFICIENT_BUFFER) { + SERVICE_DELAYED_AUTO_START_INFO *info = (SERVICE_DELAYED_AUTO_START_INFO *) HeapAlloc(GetProcessHeap(), 0, bufsize); + if (! info) { + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("SERVICE_DELAYED_AUTO_START_INFO"), _T("pre_edit_service()")); + return 5; + } + + if (QueryServiceConfig2(service->handle, SERVICE_CONFIG_DELAYED_AUTO_START_INFO, (unsigned char *) info, bufsize, &bufsize)) { + if (info->fDelayedAutostart) service->startup = NSSM_STARTUP_DELAYED; + } + else { + error = GetLastError(); + if (error != ERROR_INVALID_LEVEL) { + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG2_FAILED, service->name, _T("SERVICE_CONFIG_DELAYED_AUTO_START_INFO"), error_string(error)); + return 5; + } + } + } + else if (error != ERROR_INVALID_LEVEL) { + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG2_FAILED, service->name, _T("SERVICE_DELAYED_AUTO_START_INFO"), error_string(error)); + return 5; + } + } + + QueryServiceConfig2(service->handle, SERVICE_CONFIG_DESCRIPTION, 0, 0, &bufsize); + error = GetLastError(); + if (error == ERROR_INSUFFICIENT_BUFFER) { + SERVICE_DESCRIPTION *description = (SERVICE_DESCRIPTION *) HeapAlloc(GetProcessHeap(), 0, bufsize); + if (! description) { + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("SERVICE_CONFIG_DESCRIPTION"), _T("pre_edit_service()")); + return 6; + } + + if (QueryServiceConfig2(service->handle, SERVICE_CONFIG_DESCRIPTION, (unsigned char *) description, bufsize, &bufsize)) { + if (description->lpDescription) _sntprintf_s(service->description, _countof(service->description), _TRUNCATE, _T("%s"), description->lpDescription); + HeapFree(GetProcessHeap(), 0, description); + } + else { + HeapFree(GetProcessHeap(), 0, description); + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG2_FAILED, service->name, _T("SERVICE_CONFIG_DELAYED_AUTO_START_INFO"), error_string(error)); + return 6; + } + } + else { + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG2_FAILED, service->name, _T("SERVICE_CONFIG_DELAYED_AUTO_START_INFO"), error_string(error)); + return 6; + } + + /* Get NSSM details. */ + get_parameters(service, 0); + + CloseServiceHandle(services); + + if (! service->exe[0]) { + print_message(stderr, NSSM_MESSAGE_INVALID_SERVICE, service->name, NSSM, service->image); + service->native = true; + } + + nssm_gui(IDD_EDIT, service); + + return 0; +} + /* About to remove the service */ int pre_remove_service(int argc, TCHAR **argv) { + nssm_service_t *service = alloc_nssm_service(); + set_nssm_service_defaults(service); + if (argc) _sntprintf_s(service->name, _countof(service->name), _TRUNCATE, _T("%s"), argv[0]); + /* Show dialogue box if we didn't pass service name and "confirm" */ - if (argc < 2) return nssm_gui(IDD_REMOVE, argv[0]); + if (argc < 2) return nssm_gui(IDD_REMOVE, service); if (str_equiv(argv[1], _T("confirm"))) { - nssm_service_t *service = alloc_nssm_service(); - _sntprintf_s(service->name, _countof(service->name), _TRUNCATE, _T("%s"), argv[0]); int ret = remove_service(service); cleanup_nssm_service(service); return ret; @@ -142,27 +471,22 @@ int install_service(nssm_service_t *service) { } /* Get path of this program */ - TCHAR command[MAX_PATH]; - GetModuleFileName(0, command, _countof(command)); + GetModuleFileName(0, service->image, _countof(service->image)); - /* Create the service */ - service->handle = CreateService(services, service->name, service->name, SC_MANAGER_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS, SERVICE_AUTO_START, SERVICE_ERROR_NORMAL, command, 0, 0, 0, 0, 0); + /* Create the service - settings will be changed in edit_service() */ + service->handle = CreateService(services, service->name, service->name, SC_MANAGER_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS, SERVICE_AUTO_START, SERVICE_ERROR_NORMAL, service->image, 0, 0, 0, 0, 0); if (! service->handle) { print_message(stderr, NSSM_MESSAGE_CREATESERVICE_FAILED); CloseServiceHandle(services); return 5; } - /* Now we need to put the parameters into the registry */ - if (create_parameters(service)) { - print_message(stderr, NSSM_MESSAGE_CREATE_PARAMETERS_FAILED); + if (edit_service(service, false)) { DeleteService(service->handle); CloseServiceHandle(services); return 6; } - set_service_recovery(service); - print_message(stdout, NSSM_MESSAGE_SERVICE_INSTALLED, service->name); /* Cleanup */ @@ -171,6 +495,90 @@ int install_service(nssm_service_t *service) { return 0; } +/* Edit the service. */ +int edit_service(nssm_service_t *service, bool editing) { + if (! service) return 1; + + /* + The only two valid flags for service type are SERVICE_WIN32_OWN_PROCESS + and SERVICE_INTERACTIVE_PROCESS. + */ + service->type &= SERVICE_INTERACTIVE_PROCESS; + service->type |= SERVICE_WIN32_OWN_PROCESS; + + /* Startup type. */ + unsigned long startup; + switch (service->startup) { + case NSSM_STARTUP_MANUAL: startup = SERVICE_DEMAND_START; break; + case NSSM_STARTUP_DISABLED: startup = SERVICE_DISABLED; break; + default: startup = SERVICE_AUTO_START; + } + + /* Display name. */ + if (! service->displayname[0]) _sntprintf_s(service->displayname, _countof(service->displayname), _TRUNCATE, _T("%s"), service->name); + + /* + Username must be NULL if we aren't changing or an account name. + We must explicitly user LOCALSYSTEM to change it when we are editing. + Password must be NULL if we aren't changing, a password or "". + Empty passwords are valid but we won't allow them in the GUI. + */ + TCHAR *username = 0; + TCHAR *password = 0; + if (service->usernamelen) { + username = service->username; + if (service->passwordlen) password = service->password; + else password = _T(""); + } + else if (editing) username = NSSM_LOCALSYSTEM_ACCOUNT; + + if (grant_logon_as_service(username)) { + print_message(stderr, NSSM_MESSAGE_GRANT_LOGON_AS_SERVICE_FAILED, username); + return 5; + } + + if (! ChangeServiceConfig(service->handle, service->type, startup, SERVICE_NO_CHANGE, 0, 0, 0, 0, username, password, service->displayname)) { + print_message(stderr, NSSM_MESSAGE_CHANGESERVICECONFIG_FAILED, error_string(GetLastError())); + return 5; + } + + if (service->description[0] || editing) { + SERVICE_DESCRIPTION description; + ZeroMemory(&description, sizeof(description)); + if (service->description[0]) description.lpDescription = service->description; + else description.lpDescription = 0; + if (! ChangeServiceConfig2(service->handle, SERVICE_CONFIG_DESCRIPTION, &description)) { + log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_SERVICE_CONFIG_DESCRIPTION_FAILED, service->name, error_string(GetLastError()), 0); + } + } + + SERVICE_DELAYED_AUTO_START_INFO delayed; + ZeroMemory(&delayed, sizeof(delayed)); + if (service->startup == NSSM_STARTUP_DELAYED) delayed.fDelayedAutostart = 1; + else delayed.fDelayedAutostart = 0; + /* Delayed startup isn't supported until Vista. */ + if (! ChangeServiceConfig2(service->handle, SERVICE_CONFIG_DELAYED_AUTO_START_INFO, &delayed)) { + unsigned long error = GetLastError(); + /* Pre-Vista we expect to fail with ERROR_INVALID_LEVEL */ + if (error != ERROR_INVALID_LEVEL) { + log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_SERVICE_CONFIG_DELAYED_AUTO_START_INFO_FAILED, service->name, error_string(error), 0); + } + } + + /* Don't mess with parameters which aren't ours. */ + if (! service->native) { + /* Now we need to put the parameters into the registry */ + if (create_parameters(service, editing)) { + print_message(stderr, NSSM_MESSAGE_CREATE_PARAMETERS_FAILED); + return 6; + } + + set_service_recovery(service); + } + + return 0; +} + /* Remove the service */ int remove_service(nssm_service_t *service) { if (! service) return 1; @@ -190,6 +598,12 @@ int remove_service(nssm_service_t *service) { return 3; } + /* Get the canonical service name. We open it case insensitively. */ + unsigned long bufsize = _countof(service->displayname); + GetServiceDisplayName(services, service->name, service->displayname, &bufsize); + bufsize = _countof(service->name); + GetServiceKeyName(services, service->displayname, service->name, &bufsize); + /* Try to delete the service */ if (! DeleteService(service->handle)) { print_message(stderr, NSSM_MESSAGE_DELETESERVICE_FAILED); @@ -246,7 +660,7 @@ void WINAPI service_main(unsigned long argc, TCHAR **argv) { if (is_admin) { /* Try to create the exit action parameters; we don't care if it fails */ - create_exit_action(service->name, exit_action_strings[0]); + create_exit_action(service->name, exit_action_strings[0], false); SC_HANDLE services = open_service_manager(); if (services) { @@ -282,7 +696,7 @@ void set_service_recovery(nssm_service_t *service) { unsigned long error = GetLastError(); /* Pre-Vista we expect to fail with ERROR_INVALID_LEVEL */ if (error != ERROR_INVALID_LEVEL) { - log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_CHANGESERVICECONFIG2_FAILED, service->name, error_string(error), 0); + log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_SERVICE_CONFIG_FAILURE_ACTIONS_FAILED, service->name, error_string(error), 0); } } }