X-Git-Url: http://git.iain.cx/?a=blobdiff_plain;f=service.cpp;h=d402ab32f751e77e8e4fb25ecbe9da204350ce0a;hb=73dbba7a2e6150dea8f58dd2c25ab914a0636308;hp=09fbe1f0073f1523fcf54523663194c18b838d5c;hpb=69df8a039d4a5c6e3e955fe75167bb472292fc1d;p=nssm.git diff --git a/service.cpp b/service.cpp index 09fbe1f..d402ab3 100644 --- a/service.cpp +++ b/service.cpp @@ -1,5 +1,10 @@ #include "nssm.h" +/* This is explicitly a wide string. */ +#define NSSM_LOGON_AS_SERVICE_RIGHT L"SeServiceLogonRight" + +extern const TCHAR *exit_action_strings[]; + bool is_admin; bool use_critical_section; @@ -32,6 +37,297 @@ SC_HANDLE open_service_manager() { return ret; } +QUERY_SERVICE_CONFIG *query_service_config(const TCHAR *service_name, SC_HANDLE service_handle) { + QUERY_SERVICE_CONFIG *qsc; + unsigned long bufsize; + unsigned long error; + + QueryServiceConfig(service_handle, 0, 0, &bufsize); + error = GetLastError(); + if (error == ERROR_INSUFFICIENT_BUFFER) { + qsc = (QUERY_SERVICE_CONFIG *) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, bufsize); + if (! qsc) { + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("QUERY_SERVICE_CONFIG"), _T("query_service_config()"), 0); + return 0; + } + } + else { + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG_FAILED, service_name, error_string(error), 0); + return 0; + } + + if (! QueryServiceConfig(service_handle, qsc, bufsize, &bufsize)) { + HeapFree(GetProcessHeap(), 0, qsc); + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG_FAILED, service_name, error_string(GetLastError()), 0); + return 0; + } + + return qsc; +} + +int set_service_description(const TCHAR *service_name, SC_HANDLE service_handle, TCHAR *buffer) { + SERVICE_DESCRIPTION description; + ZeroMemory(&description, sizeof(description)); + /* + lpDescription must be NULL if we aren't changing, the new description + or "". + */ + if (buffer && buffer[0]) description.lpDescription = buffer; + else description.lpDescription = _T(""); + + if (ChangeServiceConfig2(service_handle, SERVICE_CONFIG_DESCRIPTION, &description)) return 0; + + log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_SERVICE_CONFIG_DESCRIPTION_FAILED, service_name, error_string(GetLastError()), 0); + return 1; +} + +int get_service_description(const TCHAR *service_name, SC_HANDLE service_handle, unsigned long len, TCHAR *buffer) { + if (! buffer) return 1; + + unsigned long bufsize; + QueryServiceConfig2(service_handle, SERVICE_CONFIG_DESCRIPTION, 0, 0, &bufsize); + unsigned long error = GetLastError(); + if (error == ERROR_INSUFFICIENT_BUFFER) { + SERVICE_DESCRIPTION *description = (SERVICE_DESCRIPTION *) HeapAlloc(GetProcessHeap(), 0, bufsize); + if (! description) { + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("SERVICE_CONFIG_DESCRIPTION"), _T("get_service_description()")); + return 2; + } + + if (QueryServiceConfig2(service_handle, SERVICE_CONFIG_DESCRIPTION, (unsigned char *) description, bufsize, &bufsize)) { + if (description->lpDescription) _sntprintf_s(buffer, len, _TRUNCATE, _T("%s"), description->lpDescription); + else ZeroMemory(buffer, len * sizeof(TCHAR)); + HeapFree(GetProcessHeap(), 0, description); + return 0; + } + else { + HeapFree(GetProcessHeap(), 0, description); + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG2_FAILED, service_name, _T("SERVICE_CONFIG_DESCRIPTION"), error_string(error)); + return 3; + } + } + else { + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG2_FAILED, service_name, _T("SERVICE_CONFIG_DESCRIPTION"), error_string(error)); + return 4; + } + + return 0; +} + +int get_service_startup(const TCHAR *service_name, SC_HANDLE service_handle, const QUERY_SERVICE_CONFIG *qsc, unsigned long *startup) { + if (! qsc) return 1; + + switch (qsc->dwStartType) { + case SERVICE_DEMAND_START: *startup = NSSM_STARTUP_MANUAL; break; + case SERVICE_DISABLED: *startup = NSSM_STARTUP_DISABLED; break; + default: *startup = NSSM_STARTUP_AUTOMATIC; + } + + if (*startup != NSSM_STARTUP_AUTOMATIC) return 0; + + /* Check for delayed start. */ + unsigned long bufsize; + unsigned long error; + QueryServiceConfig2(service_handle, SERVICE_CONFIG_DELAYED_AUTO_START_INFO, 0, 0, &bufsize); + error = GetLastError(); + if (error == ERROR_INSUFFICIENT_BUFFER) { + SERVICE_DELAYED_AUTO_START_INFO *info = (SERVICE_DELAYED_AUTO_START_INFO *) HeapAlloc(GetProcessHeap(), 0, bufsize); + if (! info) { + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("SERVICE_DELAYED_AUTO_START_INFO"), _T("get_service_startup()")); + return 2; + } + + if (QueryServiceConfig2(service_handle, SERVICE_CONFIG_DELAYED_AUTO_START_INFO, (unsigned char *) info, bufsize, &bufsize)) { + if (info->fDelayedAutostart) *startup = NSSM_STARTUP_DELAYED; + HeapFree(GetProcessHeap(), 0, info); + return 0; + } + else { + error = GetLastError(); + if (error != ERROR_INVALID_LEVEL) { + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG2_FAILED, service_name, _T("SERVICE_CONFIG_DELAYED_AUTO_START_INFO"), error_string(error)); + return 3; + } + } + } + else if (error != ERROR_INVALID_LEVEL) { + print_message(stderr, NSSM_MESSAGE_QUERYSERVICECONFIG2_FAILED, service_name, _T("SERVICE_DELAYED_AUTO_START_INFO"), error_string(error)); + return 3; + } + + return 0; +} + +int get_service_username(const TCHAR *service_name, const QUERY_SERVICE_CONFIG *qsc, TCHAR **username, size_t *usernamelen) { + if (! username) return 1; + if (! usernamelen) return 1; + + *username = 0; + *usernamelen = 0; + + if (! qsc) return 1; + + if (str_equiv(qsc->lpServiceStartName, NSSM_LOCALSYSTEM_ACCOUNT)) return 0; + + size_t len = _tcslen(qsc->lpServiceStartName); + *username = (TCHAR *) HeapAlloc(GetProcessHeap(), 0, (len + 1) * sizeof(TCHAR)); + if (! *username) { + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("username"), _T("get_service_username()")); + return 2; + } + + memmove(*username, qsc->lpServiceStartName, (len + 1) * sizeof(TCHAR)); + *usernamelen = len; + + return 0; +} + +static int grant_logon_as_service(const TCHAR *username) { + if (str_equiv(username, NSSM_LOCALSYSTEM_ACCOUNT)) return 0; + + /* Open Policy object. */ + LSA_OBJECT_ATTRIBUTES attributes; + ZeroMemory(&attributes, sizeof(attributes)); + + LSA_HANDLE policy; + + NTSTATUS status = LsaOpenPolicy(0, &attributes, POLICY_ALL_ACCESS, &policy); + if (status) { + print_message(stderr, NSSM_MESSAGE_LSAOPENPOLICY_FAILED, error_string(LsaNtStatusToWinError(status))); + return 1; + } + + /* Look up SID for the account. */ + LSA_UNICODE_STRING lsa_username; +#ifdef UNICODE + lsa_username.Buffer = (wchar_t *) username; + lsa_username.Length = (unsigned short) _tcslen(username) * sizeof(TCHAR); + lsa_username.MaximumLength = lsa_username.Length + sizeof(TCHAR); +#else + size_t buflen; + mbstowcs_s(&buflen, NULL, 0, username, _TRUNCATE); + lsa_username.MaximumLength = buflen * sizeof(wchar_t); + lsa_username.Length = lsa_username.MaximumLength - sizeof(wchar_t); + lsa_username.Buffer = (wchar_t *) HeapAlloc(GetProcessHeap(), 0, lsa_username.MaximumLength); + if (lsa_username.Buffer) mbstowcs_s(&buflen, lsa_username.Buffer, lsa_username.MaximumLength, username, _TRUNCATE); + else { + LsaClose(policy); + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("LSA_UNICODE_STRING"), _T("grant_logon_as_service()")); + return 2; + } +#endif + + LSA_REFERENCED_DOMAIN_LIST *translated_domains; + LSA_TRANSLATED_SID *translated_sid; + status = LsaLookupNames(policy, 1, &lsa_username, &translated_domains, &translated_sid); +#ifndef UNICODE + HeapFree(GetProcessHeap(), 0, lsa_username.Buffer); +#endif + if (status) { + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + LsaClose(policy); + print_message(stderr, NSSM_MESSAGE_LSALOOKUPNAMES_FAILED, username, error_string(LsaNtStatusToWinError(status))); + return 3; + } + + if (translated_sid->Use != SidTypeUser) { + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + LsaClose(policy); + print_message(stderr, NSSM_GUI_INVALID_USERNAME, username); + return 4; + } + + LSA_TRUST_INFORMATION *trust = &translated_domains->Domains[translated_sid->DomainIndex]; + if (! trust || ! IsValidSid(trust->Sid)) { + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + LsaClose(policy); + print_message(stderr, NSSM_GUI_INVALID_USERNAME, username); + return 4; + } + + /* GetSidSubAuthority*() return pointers! */ + unsigned char *n = GetSidSubAuthorityCount(trust->Sid); + + /* Convert translated SID to SID. */ + SID *sid = (SID *) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, GetSidLengthRequired(*n + 1)); + if (! sid) { + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + LsaClose(policy); + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("SID"), _T("grant_logon_as_service")); + return 4; + } + + unsigned long error; + if (! InitializeSid(sid, GetSidIdentifierAuthority(trust->Sid), *n + 1)) { + error = GetLastError(); + HeapFree(GetProcessHeap(), 0, sid); + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + LsaClose(policy); + print_message(stderr, NSSM_MESSAGE_INITIALIZESID_FAILED, username, error_string(error)); + return 5; + } + + for (unsigned char i = 0; i <= *n; i++) { + unsigned long *sub = GetSidSubAuthority(sid, i); + if (i < *n) *sub = *GetSidSubAuthority(trust->Sid, i); + else *sub = translated_sid->RelativeId; + } + + LsaFreeMemory(translated_domains); + LsaFreeMemory(translated_sid); + + /* Check if the SID has the "Log on as a service" right. */ + LSA_UNICODE_STRING lsa_right; + lsa_right.Buffer = NSSM_LOGON_AS_SERVICE_RIGHT; + lsa_right.Length = (unsigned short) wcslen(lsa_right.Buffer) * sizeof(wchar_t); + lsa_right.MaximumLength = lsa_right.Length + sizeof(wchar_t); + + LSA_UNICODE_STRING *rights; + unsigned long count = ~0; + status = LsaEnumerateAccountRights(policy, sid, &rights, &count); + if (status) { + /* + If the account has no rights set LsaEnumerateAccountRights() will return + STATUS_OBJECT_NAME_NOT_FOUND and set count to 0. + */ + error = LsaNtStatusToWinError(status); + if (error != ERROR_FILE_NOT_FOUND) { + HeapFree(GetProcessHeap(), 0, sid); + LsaClose(policy); + print_message(stderr, NSSM_MESSAGE_LSAENUMERATEACCOUNTRIGHTS_FAILED, username, error_string(error)); + return 4; + } + } + + for (unsigned long i = 0; i < count; i++) { + if (rights[i].Length != lsa_right.Length) continue; + if (_wcsnicmp(rights[i].Buffer, lsa_right.Buffer, lsa_right.MaximumLength)) continue; + /* The SID has the right. */ + HeapFree(GetProcessHeap(), 0, sid); + LsaFreeMemory(rights); + LsaClose(policy); + return 0; + } + LsaFreeMemory(rights); + + /* Add the right. */ + status = LsaAddAccountRights(policy, sid, &lsa_right, 1); + HeapFree(GetProcessHeap(), 0, sid); + LsaClose(policy); + if (status) { + print_message(stderr, NSSM_MESSAGE_LSAADDACCOUNTRIGHTS_FAILED, error_string(LsaNtStatusToWinError(status))); + return 5; + } + + print_message(stdout, NSSM_MESSAGE_GRANTED_LOGON_AS_SERVICE, username); + return 0; +} + /* Set default values which aren't zero. */ void set_nssm_service_defaults(nssm_service_t *service) { if (! service) return; @@ -88,7 +384,7 @@ int pre_install_service(int argc, TCHAR **argv) { if (argc < 2) return nssm_gui(IDD_INSTALL, service); if (! service) { - print_message(stderr, NSSM_EVENT_OUT_OF_MEMORY, _T("service"), _T("pre_install_service()")); + print_message(stderr, NSSM_MESSAGE_OUT_OF_MEMORY, _T("service"), _T("pre_install_service()")); return 1; } _sntprintf_s(service->exe, _countof(service->exe), _TRUNCATE, _T("%s"), argv[1]); @@ -120,6 +416,93 @@ int pre_install_service(int argc, TCHAR **argv) { return ret; } +/* About to edit the service. */ +int pre_edit_service(int argc, TCHAR **argv) { + /* Require service name. */ + if (argc < 1) return usage(1); + + nssm_service_t *service = alloc_nssm_service(); + _sntprintf_s(service->name, _countof(service->name), _TRUNCATE, _T("%s"), argv[0]); + + /* Open service manager */ + SC_HANDLE services = open_service_manager(); + if (! services) { + print_message(stderr, NSSM_MESSAGE_OPEN_SERVICE_MANAGER_FAILED); + return 2; + } + + /* Try to open the service */ + service->handle = OpenService(services, service->name, SC_MANAGER_ALL_ACCESS); + if (! service->handle) { + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_OPENSERVICE_FAILED); + return 3; + } + + /* Get system details. */ + unsigned long bufsize; + QUERY_SERVICE_CONFIG *qsc = query_service_config(service->name, service->handle); + if (! qsc) { + CloseHandle(service->handle); + CloseServiceHandle(services); + return 4; + } + + service->type = qsc->dwServiceType; + if (! (service->type & SERVICE_WIN32_OWN_PROCESS)) { + HeapFree(GetProcessHeap(), 0, qsc); + CloseHandle(service->handle); + CloseServiceHandle(services); + print_message(stderr, NSSM_MESSAGE_CANNOT_EDIT, service->name, _T("SERVICE_WIN32_OWN_PROCESS"), 0); + return 3; + } + + if (get_service_startup(service->name, service->handle, qsc, &service->startup)) { + HeapFree(GetProcessHeap(), 0, qsc); + CloseHandle(service->handle); + CloseServiceHandle(services); + return 4; + } + + if (get_service_username(service->name, qsc, &service->username, &service->usernamelen)) { + HeapFree(GetProcessHeap(), 0, qsc); + CloseHandle(service->handle); + CloseServiceHandle(services); + return 5; + } + + _sntprintf_s(service->displayname, _countof(service->displayname), _TRUNCATE, _T("%s"), qsc->lpDisplayName); + + /* Get the canonical service name. We open it case insensitively. */ + bufsize = _countof(service->name); + GetServiceKeyName(services, service->displayname, service->name, &bufsize); + + /* Remember the executable in case it isn't NSSM. */ + _sntprintf_s(service->image, _countof(service->image), _TRUNCATE, _T("%s"), qsc->lpBinaryPathName); + HeapFree(GetProcessHeap(), 0, qsc); + + /* Get extended system details. */ + if (get_service_description(service->name, service->handle, _countof(service->description), service->description)) { + CloseHandle(service->handle); + CloseServiceHandle(services); + return 6; + } + + /* Get NSSM details. */ + get_parameters(service, 0); + + CloseServiceHandle(services); + + if (! service->exe[0]) { + print_message(stderr, NSSM_MESSAGE_INVALID_SERVICE, service->name, NSSM, service->image); + service->native = true; + } + + nssm_gui(IDD_EDIT, service); + + return 0; +} + /* About to remove the service */ int pre_remove_service(int argc, TCHAR **argv) { nssm_service_t *service = alloc_nssm_service(); @@ -150,8 +533,33 @@ int install_service(nssm_service_t *service) { } /* Get path of this program */ - TCHAR command[MAX_PATH]; - GetModuleFileName(0, command, _countof(command)); + GetModuleFileName(0, service->image, _countof(service->image)); + + /* Create the service - settings will be changed in edit_service() */ + service->handle = CreateService(services, service->name, service->name, SC_MANAGER_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS, SERVICE_AUTO_START, SERVICE_ERROR_NORMAL, service->image, 0, 0, 0, 0, 0); + if (! service->handle) { + print_message(stderr, NSSM_MESSAGE_CREATESERVICE_FAILED); + CloseServiceHandle(services); + return 5; + } + + if (edit_service(service, false)) { + DeleteService(service->handle); + CloseServiceHandle(services); + return 6; + } + + print_message(stdout, NSSM_MESSAGE_SERVICE_INSTALLED, service->name); + + /* Cleanup */ + CloseServiceHandle(services); + + return 0; +} + +/* Edit the service. */ +int edit_service(nssm_service_t *service, bool editing) { + if (! service) return 1; /* The only two valid flags for service type are SERVICE_WIN32_OWN_PROCESS @@ -171,51 +579,58 @@ int install_service(nssm_service_t *service) { /* Display name. */ if (! service->displayname[0]) _sntprintf_s(service->displayname, _countof(service->displayname), _TRUNCATE, _T("%s"), service->name); - /* Create the service */ - service->handle = CreateService(services, service->name, service->displayname, SC_MANAGER_ALL_ACCESS, service->type, startup, SERVICE_ERROR_NORMAL, command, 0, 0, 0, service->username, service->password); - if (! service->handle) { - print_message(stderr, NSSM_MESSAGE_CREATESERVICE_FAILED); - CloseServiceHandle(services); - return 5; + /* + Username must be NULL if we aren't changing or an account name. + We must explicitly user LOCALSYSTEM to change it when we are editing. + Password must be NULL if we aren't changing, a password or "". + Empty passwords are valid but we won't allow them in the GUI. + */ + TCHAR *username = 0; + TCHAR *password = 0; + if (service->usernamelen) { + username = service->username; + if (service->passwordlen) password = service->password; + else password = _T(""); } + else if (editing) username = NSSM_LOCALSYSTEM_ACCOUNT; - if (service->description[0]) { - SERVICE_DESCRIPTION description; - ZeroMemory(&description, sizeof(description)); - description.lpDescription = service->description; - if (! ChangeServiceConfig2(service->handle, SERVICE_CONFIG_DESCRIPTION, &description)) { - log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_SERVICE_CONFIG_DESCRIPTION_FAILED, service->name, error_string(GetLastError()), 0); - } + if (grant_logon_as_service(username)) { + print_message(stderr, NSSM_MESSAGE_GRANT_LOGON_AS_SERVICE_FAILED, username); + return 5; } - if (service->startup == NSSM_STARTUP_DELAYED) { - SERVICE_DELAYED_AUTO_START_INFO delayed; - ZeroMemory(&delayed, sizeof(delayed)); - delayed.fDelayedAutostart = 1; - /* Delayed startup isn't supported until Vista. */ - if (! ChangeServiceConfig2(service->handle, SERVICE_CONFIG_DELAYED_AUTO_START_INFO, &delayed)) { - unsigned long error = GetLastError(); - /* Pre-Vista we expect to fail with ERROR_INVALID_LEVEL */ - if (error != ERROR_INVALID_LEVEL) { - log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_SERVICE_CONFIG_DELAYED_AUTO_START_INFO_FAILED, service->name, error_string(error), 0); - } - } + if (! ChangeServiceConfig(service->handle, service->type, startup, SERVICE_NO_CHANGE, 0, 0, 0, 0, username, password, service->displayname)) { + print_message(stderr, NSSM_MESSAGE_CHANGESERVICECONFIG_FAILED, error_string(GetLastError())); + return 5; } - /* Now we need to put the parameters into the registry */ - if (create_parameters(service)) { - print_message(stderr, NSSM_MESSAGE_CREATE_PARAMETERS_FAILED); - DeleteService(service->handle); - CloseServiceHandle(services); - return 6; + if (service->description[0] || editing) { + set_service_description(service->name, service->handle, service->description); } - set_service_recovery(service); + SERVICE_DELAYED_AUTO_START_INFO delayed; + ZeroMemory(&delayed, sizeof(delayed)); + if (service->startup == NSSM_STARTUP_DELAYED) delayed.fDelayedAutostart = 1; + else delayed.fDelayedAutostart = 0; + /* Delayed startup isn't supported until Vista. */ + if (! ChangeServiceConfig2(service->handle, SERVICE_CONFIG_DELAYED_AUTO_START_INFO, &delayed)) { + unsigned long error = GetLastError(); + /* Pre-Vista we expect to fail with ERROR_INVALID_LEVEL */ + if (error != ERROR_INVALID_LEVEL) { + log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_SERVICE_CONFIG_DELAYED_AUTO_START_INFO_FAILED, service->name, error_string(error), 0); + } + } - print_message(stdout, NSSM_MESSAGE_SERVICE_INSTALLED, service->name); + /* Don't mess with parameters which aren't ours. */ + if (! service->native) { + /* Now we need to put the parameters into the registry */ + if (create_parameters(service, editing)) { + print_message(stderr, NSSM_MESSAGE_CREATE_PARAMETERS_FAILED); + return 6; + } - /* Cleanup */ - CloseServiceHandle(services); + set_service_recovery(service); + } return 0; } @@ -239,6 +654,12 @@ int remove_service(nssm_service_t *service) { return 3; } + /* Get the canonical service name. We open it case insensitively. */ + unsigned long bufsize = _countof(service->displayname); + GetServiceDisplayName(services, service->name, service->displayname, &bufsize); + bufsize = _countof(service->name); + GetServiceKeyName(services, service->displayname, service->name, &bufsize); + /* Try to delete the service */ if (! DeleteService(service->handle)) { print_message(stderr, NSSM_MESSAGE_DELETESERVICE_FAILED); @@ -295,7 +716,7 @@ void WINAPI service_main(unsigned long argc, TCHAR **argv) { if (is_admin) { /* Try to create the exit action parameters; we don't care if it fails */ - create_exit_action(service->name, exit_action_strings[0]); + create_exit_action(service->name, exit_action_strings[0], false); SC_HANDLE services = open_service_manager(); if (services) {