Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update NamedPipe handling to allow callback to Service Accounts #1616

Merged
merged 1 commit into from
Apr 20, 2024

Conversation

FelixMarxIBM
Copy link
Contributor

@FelixMarxIBM FelixMarxIBM commented Apr 19, 2024

While testing attachment via byte-buddy on Windows, we noticed that the NamedPipe is not able to report back the current state if the attachment was started from a service account.
This is possible with the normal attach-tools.jar so I investigated what the difference is and it turns out that the hotspot attachment uses named pipes with a SecurityDescriptor.
See VirtualMachineImpl.c how that is done.
This PR does the same thing in JNA and in our test the attachment works afterwards when started from a service account against a JVM started from a user.

VirtualMachineImpl.c:

    // Custom Security Descriptor is required here to "get" Medium Integrity Level.
    // In order to allow Medium Integrity Level clients to open
    // and use a NamedPipe created by an High Integrity Level process.
    TCHAR *szSD = TEXT("D:")                  // Discretionary ACL
                  TEXT("(A;OICI;GRGW;;;WD)")  // Allow read/write to Everybody
                  TEXT("(A;OICI;GA;;;SY)")    // Allow full control to System
                  TEXT("(A;OICI;GA;;;BA)");   // Allow full control to Administrators

@FelixMarxIBM
Copy link
Contributor Author

@raphw should I create an Issue for that or is a PR enough?

@raphw
Copy link
Owner

raphw commented Apr 19, 2024

Thanks, I come across windows so rarely, great you could contribute this! I'll merge it obce the checks complete.

@raphw raphw self-assigned this Apr 19, 2024
@raphw raphw added the bug label Apr 19, 2024
@raphw raphw added this to the 1.12.14 milestone Apr 19, 2024
@raphw raphw merged commit 0a91a85 into raphw:master Apr 20, 2024
10 checks passed
@FelixMarxIBM FelixMarxIBM deleted the windows-named-pipe-security-attributes branch April 22, 2024 11:34
@FelixMarxIBM
Copy link
Contributor Author

FelixMarxIBM commented Apr 22, 2024

Hi @raphw I saw that the build failed here
with the error

Error:  /home/runner/work/byte-buddy/byte-buddy/byte-buddy-agent/src/main/java/net/bytebuddy/agent/VirtualMachine.java:1083: @return tag should be present and have description. [JavadocMethod]

I'll quickly create a follow up PR to fix that at #1621

@FelixMarxIBM
Copy link
Contributor Author

Hi @raphw I think the milestone is wrong here and should be 1.14.14, not 1.12.14

@raphw raphw modified the milestones: 1.12.14, 1.14.14 Apr 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants