[cpp-sp] branch main updated: SSPCPP-961 Shibboleth SP - Windows - possible Privilege Escalation

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=21759df8d5d2bcbb908e1442857ef68d87515c4e

The following commit(s) were added to refs/heads/main by this push:
     new 21759df8 SSPCPP-961 Shibboleth SP - Windows - possible Privilege Escalation
21759df8 is described below

commit 21759df8d5d2bcbb908e1442857ef68d87515c4e
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Wed Nov 16 14:01:12 2022 +0000

    SSPCPP-961 Shibboleth SP - Windows - possible Privilege Escalation
    
    https://shibboleth.atlassian.net/browse/SSPCPP-961
    
    Lock down the installation dir (default: \opt\shibboleth-sp)
    to be GENERIC_ALL access for Administrators and LocalSystem
    and nothing for anybody else.
    
    We don't touch installs to PF and PF86 because they inherit from the
    parent folder which should be locked down already (and if it isn't that's
---
 msi/WiX/ShibbolethSP-defs-x86.wxi | 1 +
 msi/WiX/ShibbolethSP-noarch.wxs   | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/msi/WiX/ShibbolethSP-defs-x86.wxi b/msi/WiX/ShibbolethSP-defs-x86.wxi
index 39d56b47..d4865152 100644
--- a/msi/WiX/ShibbolethSP-defs-x86.wxi
+++ b/msi/WiX/ShibbolethSP-defs-x86.wxi
@@ -2,6 +2,7 @@
 <Include xmlns="http://schemas.microsoft.com/wix/2006/wi">
   <!-- ShibbolethSP-noarch -->
 
+  <ComponentRef Id="ProtectInstallDir"/>
   <ComponentRef Id="main.css" />
   <ComponentRef Id="CREDITS.txt" />
   <ComponentRef Id="LICENSE.txt" />
diff --git a/msi/WiX/ShibbolethSP-noarch.wxs b/msi/WiX/ShibbolethSP-noarch.wxs
index 9b814108..c9ced978 100644
--- a/msi/WiX/ShibbolethSP-noarch.wxs
+++ b/msi/WiX/ShibbolethSP-noarch.wxs
@@ -26,6 +26,12 @@
     <!-- Configuration, licenses and documentation -->
 
     <DirectoryRef Id="INSTALLDIR">
+      <Component Id="ProtectInstallDir" Guid="{9F695B93-0575-4D91-9E22-35A8D6966F1B}">
+        <CreateFolder>
+          <Permission  User="Administrators" GenericAll="yes" />
+          <Permission  User="SYSTEM" GenericAll="yes" />
+        </CreateFolder>
+      </Component>
       <Directory Id="doc" Name="doc">
         <Directory Id="doc_shibboleth" Name="shibboleth" FileSource="$(var.SPBuildDirectory)\cpp-sp\doc">
           <Component Id="main.css" Guid="{EA1366EE-0FD1-42E7-9F3F-C19E6C0D12D6}">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.