asked on

Registry Security

What security issues are involved with writing to the registry in an app (on NT4)? My RegCreateKey call fails when a user without administrative rights runs my app. I'm sure I need to do something with a security descriptor object, but I'd appreciate if someone could point me in the right direction.

ASKER CERTIFIED SOLUTION

jkr

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

cdickerson

ASKER

Can you further summarize what this code is doing? I'm adding the user himself to an access list??

Also, I'm not sure I understand what you mean by "When these keys were created by an admin, only members of the admin group are allowed to access them". The key is created at run-time.

Thanks for your response.

jkr

The above code adds an 'access allowed ACE' for a certain group to the security descriptor of a registry, causing this group to be able to access the key.

I assumed that your 'runtime-created' keys were created by a process running under the 'admin' account, thus setting the default 'admin' access rights on these keys...

cdickerson

ASKER

Ok, perhaps I'm going about this wrong. With each run of the application, I create a key (in case it wasn't there), and write to it.

Should I instead create that key with the install program (running under admin), and at *that* time grant the current user permission to write to it (which is what your code is doing)??

jkr

>>and at *that* time grant the current user permission to
>>write to it

That's the idea - however, you could change the access rights later, also, but the program changing the rights must have access to these keys (i.e. run under the admin account also)

An alternative would be to use 'RegCreateKeyEx()' supplying an appropriate 'SECURITY_ATTRIBUTES' struct, e.g.

SECURITY_ATTRIBUTES sa;
PSID psidWorldSid; // a SID representing "everyone"
SID_IDENTIFIER_AUTHORITY siaWorldSidAuthority = SECURITY_WORLD_SID_AUTHORITY;

psidWorldSid = (PSID) LocalAlloc(LPTR, GetSidLengthRequired(1));
InitializeSid(psidWorldSid, &siaWorldSidAuthority, 1);
*(GetSidSubAuthority(psidWorldSid, 0)) = SECURITY_WORLD_RID;

SECURITY_DESCRIPTOR         sd;

if  (   !InitializeSecurityDescriptor   (   &sd,    SECURITY_DESCRIPTOR_REVISION)
    )
    {
        //  error
    }

// here I set the _group_ to 'world', but you could also use
// 'owner'...
if  (   !SetSecurityDescriptorGroup (   &sd,    psidWorldSid,   TRUE)
    )
    {
        //  error
    }

sa.nLength = sizeof ( SECURITY_ATTRIBUTES );
sa.lpSecurityDescriptor = & sd;
sa.bInheritHandle = FALSE;

cdickerson

ASKER

Thanks a lot.