{"id":93447,"date":"2016-05-12T07:00:00","date_gmt":"2016-05-12T21:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/?p=93447"},"modified":"2019-03-13T11:02:58","modified_gmt":"2019-03-13T18:02:58","slug":"20160512-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20160512-00\/?p=93447","title":{"rendered":"How come a duplicated token doesn’t behave identically to the original?"},"content":{"rendered":"

A customer was experimenting with tokens and discovered that things fall apart when they have a thread impersonate itself. Shouldn’t that have no effect? Here’s what they discovered. Error checking and cleanup have been elided for expository purposes. <\/p>\n

\n\/\/ This call succeeds\nCComPtr<IUnknown> something;\nCoCreateInstance(CLSID_Something, nullptr,\n                 CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&something));\n\n\/\/ Get the current token for the thread.\n\/\/ This call also succeeds. (Note that OpenThreadToken\n\/\/ fails if the thread is not impersonating<\/a>.)\nHANDLE token;\nOpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, &token);\n\n\/\/ Duplicate the token. This call succeeds.\nHANDLE dupToken;\nDuplicateToken(token, SecurityImpersonation, &dupToken);\n\n\/\/ Impersonate the duplicate. This call succeeds.\nImpersonateLoggedOnUser(dupToken);\n\n\/\/ But now, CoCreateInstance fails with E_ACCESSDENIED!\nCComPtr<IUnknown> something2;\nCoCreateInstance(CLSID_Something, nullptr,\n                 CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&something2));\n<\/pre>\n
The Duplicate­Token<\/code> function<\/a> says that the new token duplicates the original, but it does not appear to be a true duplicate because when we swap out the original thread token for the duplicate, things stop working. What’s going on? <\/p>\n
There are a lot of things in a token<\/a>. But there’s something important that’s not in the token. <\/p>\n
One of my colleagues from the kernel team explains: When you duplicate a token with the Duplicate­Token<\/code> function, it creates a new kernel object, namely the token, and the new token is a duplicate of the original. But the new token has its own properties, and the important one here is the security descriptor. <\/p>\n
When a new kernel object is created, and you don’t provide an explicit security descriptor for the new object, then the object is given a default security descriptor. And that default security descriptor comes from the default DACL of the token that is in effect at the point of the call. <\/p>\n
When you apply this rule to tokens, you find that, even though the behavior is consistent with other kernel objects, it also means that it is very easy to create a token that doesn’t have access to itself. When you impersonate with that token, bad things happen. <\/p>\n
It’s like going to the FedEx Office store and giving them a DHL envelope with the instructions, “Please make a copy of this letter.” They take the letter out of the envelope, make a copy, and then take the copy and give it to you in a FedEx Office envelope<\/i>. They copied the letter, like you instructed, but it’s in a different envelope. <\/p>\n
If you also want to duplicate the security descriptor, you can get the original token’s security descriptor with Get­Kernel­Object­Security<\/code> or Get­Security­Info<\/code>, and then pass that security descriptor to Duplicate­Token­Ex<\/code>. <\/p>\n
The customer confirmed that the recommendation worked. <\/p>\n
\n\/\/ This call succeeds\nCComPtr<IUnknown> something;\nCoCreateInstance(CLSID_Something, nullptr,\n                 CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&something));\n\n\/\/ Get the current token for the thread.\n\/\/ This call also succeeds. (Note that OpenThreadToken\n\/\/ fails if the thread is not impersonating.)\nHANDLE token;\nOpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, &token);\n\n\/\/Get the security descriptor for the token.\n\/\/ This call succeeds.\nPACL dacl;\nPSECURITY_DESCRIPTOR sd;\nGetSecurityInfo(token, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION,\n    nullptr, &dacl, &sd);\n\n\/\/ Duplicate the token with that security descriptor.\n\/\/ This call succeeds.\nSECURITY_ATTRIBUTES sa = { sizeof(sa), sd, TRUE };\nHANDLE dupToken;\nDuplicateTokenEx(token, MAXIMUM_ALLOWED, &sa, SecurityImpersonation,\n    TokenImpersonation, &dupToken);<\/font>\n\n\/\/ Impersonate the duplicate. This call succeeds.\nImpersonateLoggedOnUser(dupToken);\n\n\/\/ CoCreateInstance now succeeds.\nCComPtr<IUnknown> something2;\nCoCreateInstance(CLSID_Something, nullptr,\n                 CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&something2));\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
The inside’s the same, but the outside is different.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-93447","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
The inside’s the same, but the outside is different.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/93447","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=93447"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/93447\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=93447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=93447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=93447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}