commit 2219a0101f92f8e5e75ba49c3cf34258e8545517
author Jason A. Donenfeld <Jason@zx2c4.com> Tue May 21 17:33:12 2019 +0200
committer Alex Brainman <alex.brainman@gmail.com> Sun May 26 03:56:09 2019 +0000
tree 70a47e1b92534ede49b105b4555bea40aa0d7fa1
parent e44a3b55db15331fb6497c80630cc276086855f8

windows: add SID getter functions for the various components

These allow actual inspection of SIDs. For example, it might be
desirable to iterate through the group SIDs in order to find one set by
SERVICE_CONFIG_SERVICE_SID_INFO:

    for _, g := range groups {
        if g.Attributes != windows.SE_GROUP_ENABLED|windows.SE_GROUP_ENABLED_BY_DEFAULT|windows.SE_GROUP_OWNER {
            continue
        }
        if !g.Sid.IsValid() {
            continue
        }
        if g.Sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
            continue
        }
        if g.Sid.SubAuthorityCount() < 6 || g.Sid.SubAuthority(0) != 80 {
            continue
        }
        sid = g.Sid
        break
    }

Another usage of the APIs added would be to find if a user is in the
administrator group with either an elevated or unelevated token:

    isAdmin := false
    for _, g := range groups {
        if g.Attributes&(windows.SE_GROUP_ENABLED|windows.SE_GROUP_USE_FOR_DENY_ONLY) == 0 {
            continue
	}
        if !g.Sid.IsWellKnown(windows.WinBuiltinAdministratorsSid) {
            continue
	}
        isAdmin = true
        break
    }

Change-Id: I8f8dc8d37b71ec58fd51e21ea1f1b3aada6d66b0
Reviewed-on: https://go-review.googlesource.com/c/sys/+/177841
Run-TryBot: Jason Donenfeld <Jason@zx2c4.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>