From: Iain Patterson <me@iain.cx>
Date: Tue, 15 May 2012 10:08:34 +0000 (+0100)
Subject: Handle running without administrator privileges.
X-Git-Tag: v2.13~4
X-Git-Url: http://git.iain.cx/?a=commitdiff_plain;h=fb6318bf814fd7f3445de8c83b7620e1b6b3c197;p=nssm.git

Handle running without administrator privileges.

If the service is configured to run as an unprivileged user NSSM will
not be able to perform certain tasks which are not critical and will
therefore log some errors which can be ignored.

It will not be able to register itself as an event log source.
It will not be able to create a default AppExit key.
It will not be able to configure service failure handling.

Try to perform these tasks where first installing the service (which
we are guaranteed to do with administrator rights) as well as at
runtime, and don't log the errors if the runtime actions can't be
performed.
---

diff --git a/nssm.cpp b/nssm.cpp
index d543c46..7a73114 100644
--- a/nssm.cpp
+++ b/nssm.cpp
@@ -1,6 +1,7 @@
 #include "nssm.h"
 
 extern unsigned long tls_index;
+extern bool is_admin;
 
 /* String function */
 int str_equiv(const char *a, const char *b) {
@@ -27,30 +28,28 @@ int usage(int ret) {
   return(ret);
 }
 
-int check_admin(char *action) {
+void check_admin() {
+  is_admin = false;
+
   /* Lifted from MSDN examples */
   PSID AdministratorsGroup;
   SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
-  BOOL ok = AllocateAndInitializeSid(&NtAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdministratorsGroup);
-  if (ok) {
-    if (! CheckTokenMembership(0, AdministratorsGroup, &ok)) ok = 0;
-    FreeSid(AdministratorsGroup);
-
-    if (ok) return 0;
-
-    fprintf(stderr, "Administator access is needed to %s a service.\n", action);
-    return 1;
-  }
-
-  /* Can't tell if we are admin or not; later operations may fail */
-  return 0;
+  if (! AllocateAndInitializeSid(&NtAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdministratorsGroup)) return;
+  CheckTokenMembership(0, AdministratorsGroup, /*XXX*/(PBOOL) &is_admin);
+  FreeSid(AdministratorsGroup);
 }
 
 int main(int argc, char **argv) {
+  /* Remember if we are admin */
+  check_admin();
+
   /* Elevate */
   if (argc > 1) {
     if (str_equiv(argv[1], "install") || str_equiv(argv[1], "remove")) {
-      if (check_admin(argv[1])) exit(100);
+      if (! is_admin) {
+        fprintf(stderr, "Administrator access is needed to %s a service.\n", argv[1]);
+        exit(100);
+      }
     }
 
     /* Valid commands are install or remove */
@@ -66,7 +65,7 @@ int main(int argc, char **argv) {
   tls_index = TlsAlloc();
 
   /* Register messages */
-  create_messages();
+  if (is_admin) create_messages();
 
   /* Start service magic */
   SERVICE_TABLE_ENTRY table[] = { { NSSM, service_main }, { 0, 0 } };
diff --git a/service.cpp b/service.cpp
index 7e9a9d7..d44998a 100644
--- a/service.cpp
+++ b/service.cpp
@@ -1,5 +1,6 @@
 #include "nssm.h"
 
+bool is_admin;
 SERVICE_STATUS service_status;
 SERVICE_STATUS_HANDLE service_handle;
 HANDLE process_handle;
@@ -29,7 +30,7 @@ static inline int throttle_milliseconds() {
 SC_HANDLE open_service_manager() {
   SC_HANDLE ret = OpenSCManager(0, SERVICES_ACTIVE_DATABASE, SC_MANAGER_ALL_ACCESS);
   if (! ret) {
-    log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_OPENSCMANAGER_FAILED, 0);
+    if (is_admin) log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_OPENSCMANAGER_FAILED, 0);
     return 0;
   }
 
@@ -130,6 +131,8 @@ int install_service(char *name, char *exe, char *flags) {
     return 6;
   }
 
+  set_service_recovery(service, name);
+
   /* Cleanup */
   CloseServiceHandle(service);
   CloseServiceHandle(services);
@@ -204,10 +207,12 @@ void WINAPI service_main(unsigned long argc, char **argv) {
   service_status.dwWaitHint = throttle_delay + NSSM_WAITHINT_MARGIN;
   SetServiceStatus(service_handle, &service_status);
 
-  /* Try to create the exit action parameters; we don't care if it fails */
-  create_exit_action(argv[0], exit_action_strings[0]);
+  if (is_admin) {
+    /* Try to create the exit action parameters; we don't care if it fails */
+    create_exit_action(argv[0], exit_action_strings[0]);
 
-  set_service_recovery(service_name);
+    set_service_recovery(0, service_name);
+  }
 
   /* Used for signalling a resume if the service pauses when throttled. */
   throttle_timer = CreateWaitableTimer(0, 1, 0);
@@ -219,12 +224,16 @@ void WINAPI service_main(unsigned long argc, char **argv) {
 }
 
 /* Make sure service recovery actions are taken where necessary */
-void set_service_recovery(char *service_name) {
-  SC_HANDLE services = open_service_manager();
-  if (! services) return;
+void set_service_recovery(SC_HANDLE service, char *service_name) {
+  SC_HANDLE services = 0;
+
+  if (! service) {
+    services = open_service_manager();
+    if (! services) return;
 
-  SC_HANDLE service = OpenService(services, service_name, SC_MANAGER_ALL_ACCESS);
-  if (! service) return;
+    service = OpenService(services, service_name, SC_MANAGER_ALL_ACCESS);
+    if (! service) return;
+  }
 
   SERVICE_FAILURE_ACTIONS_FLAG flag;
   ZeroMemory(&flag, sizeof(flag));
@@ -238,6 +247,11 @@ void set_service_recovery(char *service_name) {
       log_event(EVENTLOG_ERROR_TYPE, NSSM_EVENT_CHANGESERVICECONFIG2_FAILED, service_name, error_string(error), 0);
     }
   }
+
+  if (services) {
+    CloseServiceHandle(service);
+    CloseServiceHandle(services);
+  }
 }
 
 int monitor_service() {
diff --git a/service.h b/service.h
index 3838700..2db92fd 100644
--- a/service.h
+++ b/service.h
@@ -13,7 +13,7 @@ int pre_install_service(int, char **);
 int pre_remove_service(int, char **);
 int install_service(char *, char *, char *);
 int remove_service(char *);
-void set_service_recovery(char *);
+void set_service_recovery(SC_HANDLE, char *);
 int monitor_service();
 int start_service();
 int stop_service(unsigned long, bool, bool);