Problem - Kevin Tafuro

which the service is running. The token contains a list of all of the groups to which
the user belongs (the user and each group in the list is represented by a Security ID or
SID), as well as a set of privileges that any thread running with the token has. The set
of privileges is initialized from the privileges assigned by the system administrator to
the user and the groups to which the user belongs.
Beginning with Windows 2000, it is possible to create a restricted token and force
threads to run using that token. Once a restricted token has been applied to a running
thread, any restrictions imposed by the restricted token cannot be lifted; however,
it is possible to revert the thread back to its original unrestricted token. With
restricted tokens, it’s possible to remove privileges, restrict the SIDs that are used in
access checking, and deny SIDs access. The use of restricted tokens is more useful
when combined with the CreateProcessAsUser( ) API to create a new process with a
restricted token that cannot be reverted to a more permissive token.
Beginning with Windows .NET Server 2003, it is possible to permanently remove
privileges from a process’s token. Once the privileges have been removed, they cannot
be added back. Any new processes created by a process running with a modified
token will inherit the modified token; therefore, the same restrictions imposed upon
the parent process are also imposed upon the child process. Note that modifying a
token is quite different from creating a restricted token. In particular, only privileges
can be removed; SIDs can be neither restricted nor denied.
Discussion
Tokens contain a list of SIDs, composed of the user’s SID and one SID for each
group of which the user is a member. SIDs are assigned by the system when users
and groups are created. In addition to the SIDs, tokens also contain a list of restricted
SIDs. When access checks are performed and the token contains a list of restricted
SIDs, the intersection of the two lists of SIDs contained in the token is used to perform
the access check. Finally, tokens also contain a list of privileges. Privileges
define specific access rights. For example, for a process to use the Win32 debugging
API, the process’s token must contain the SeDebugPrivilege privilege.
The primary list of SIDs contained in a token cannot be modified. The token is created
for a particular user, and the token must always contain the user’s SID along
with the SIDs for each group of which the user is a member. However, each SID in
the primary list can be marked with a “deny” attribute, which causes access to be
denied when an access control list (ACL) contains a SID that is marked as “deny” in
the active token.
Creating restricted tokens
Using the CreateRestrictedToken( ) API, a restricted token can be created from an
existing token. The resulting token can then be used to create a new process or to set
8 | Chapter 1: Safe Initialization
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.