1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // This file contains unit tests for the RestrictedToken. 6 7 #define _ATL_NO_EXCEPTIONS 8 #include <atlbase.h> 9 #include <atlsecurity.h> 10 #include <vector> 11 #include "sandbox/win/src/restricted_token.h" 12 #include "sandbox/win/src/sid.h" 13 #include "testing/gtest/include/gtest/gtest.h" 14 15 namespace sandbox { 16 17 // Tests the initializatioin with an invalid token handle. 18 TEST(RestrictedTokenTest, InvalidHandle) { 19 RestrictedToken token; 20 ASSERT_EQ(ERROR_INVALID_HANDLE, token.Init(reinterpret_cast<HANDLE>(0x5555))); 21 } 22 23 // Tests the initialization with NULL as parameter. 24 TEST(RestrictedTokenTest, DefaultInit) { 25 // Get the current process token. 26 HANDLE token_handle = INVALID_HANDLE_VALUE; 27 ASSERT_TRUE(::OpenProcessToken(::GetCurrentProcess(), TOKEN_ALL_ACCESS, 28 &token_handle)); 29 30 ASSERT_NE(INVALID_HANDLE_VALUE, token_handle); 31 32 ATL::CAccessToken access_token; 33 access_token.Attach(token_handle); 34 35 // Create the token using the current token. 36 RestrictedToken token_default; 37 ASSERT_EQ(ERROR_SUCCESS, token_default.Init(NULL)); 38 39 // Get the handle to the restricted token. 40 41 HANDLE restricted_token_handle = NULL; 42 ASSERT_EQ(ERROR_SUCCESS, 43 token_default.GetRestrictedTokenHandle(&restricted_token_handle)); 44 45 ATL::CAccessToken restricted_token; 46 restricted_token.Attach(restricted_token_handle); 47 48 ATL::CSid sid_user_restricted; 49 ATL::CSid sid_user_default; 50 ATL::CSid sid_owner_restricted; 51 ATL::CSid sid_owner_default; 52 ASSERT_TRUE(restricted_token.GetUser(&sid_user_restricted)); 53 ASSERT_TRUE(access_token.GetUser(&sid_user_default)); 54 ASSERT_TRUE(restricted_token.GetOwner(&sid_owner_restricted)); 55 ASSERT_TRUE(access_token.GetOwner(&sid_owner_default)); 56 57 // Check if both token have the same owner and user. 58 ASSERT_EQ(sid_user_restricted, sid_user_default); 59 ASSERT_EQ(sid_owner_restricted, sid_owner_default); 60 } 61 62 // Tests the initialization with a custom token as parameter. 63 TEST(RestrictedTokenTest, CustomInit) { 64 // Get the current process token. 65 HANDLE token_handle = INVALID_HANDLE_VALUE; 66 ASSERT_TRUE(::OpenProcessToken(::GetCurrentProcess(), TOKEN_ALL_ACCESS, 67 &token_handle)); 68 69 ASSERT_NE(INVALID_HANDLE_VALUE, token_handle); 70 71 ATL::CAccessToken access_token; 72 access_token.Attach(token_handle); 73 74 // Change the primary group. 75 access_token.SetPrimaryGroup(ATL::Sids::World()); 76 77 // Create the token using the current token. 78 RestrictedToken token; 79 ASSERT_EQ(ERROR_SUCCESS, token.Init(access_token.GetHandle())); 80 81 // Get the handle to the restricted token. 82 83 HANDLE restricted_token_handle = NULL; 84 ASSERT_EQ(ERROR_SUCCESS, 85 token.GetRestrictedTokenHandle(&restricted_token_handle)); 86 87 ATL::CAccessToken restricted_token; 88 restricted_token.Attach(restricted_token_handle); 89 90 ATL::CSid sid_restricted; 91 ATL::CSid sid_default; 92 ASSERT_TRUE(restricted_token.GetPrimaryGroup(&sid_restricted)); 93 ASSERT_TRUE(access_token.GetPrimaryGroup(&sid_default)); 94 95 // Check if both token have the same owner. 96 ASSERT_EQ(sid_restricted, sid_default); 97 } 98 99 // Verifies that the token created by the object are valid. 100 TEST(RestrictedTokenTest, ResultToken) { 101 RestrictedToken token; 102 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 103 104 ASSERT_EQ(ERROR_SUCCESS, 105 token.AddRestrictingSid(ATL::Sids::World().GetPSID())); 106 107 HANDLE restricted_token; 108 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&restricted_token)); 109 110 ASSERT_TRUE(::IsTokenRestricted(restricted_token)); 111 112 DWORD length = 0; 113 TOKEN_TYPE type; 114 ASSERT_TRUE(::GetTokenInformation(restricted_token, 115 ::TokenType, 116 &type, 117 sizeof(type), 118 &length)); 119 120 ASSERT_EQ(type, TokenPrimary); 121 122 HANDLE impersonation_token; 123 ASSERT_EQ(ERROR_SUCCESS, 124 token.GetRestrictedTokenHandleForImpersonation(&impersonation_token)); 125 126 ASSERT_TRUE(::IsTokenRestricted(impersonation_token)); 127 128 ASSERT_TRUE(::GetTokenInformation(impersonation_token, 129 ::TokenType, 130 &type, 131 sizeof(type), 132 &length)); 133 134 ASSERT_EQ(type, TokenImpersonation); 135 136 ::CloseHandle(impersonation_token); 137 ::CloseHandle(restricted_token); 138 } 139 140 // Verifies that the token created has "Restricted" in its default dacl. 141 TEST(RestrictedTokenTest, DefaultDacl) { 142 RestrictedToken token; 143 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 144 145 ASSERT_EQ(ERROR_SUCCESS, 146 token.AddRestrictingSid(ATL::Sids::World().GetPSID())); 147 148 HANDLE handle; 149 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&handle)); 150 151 ATL::CAccessToken restricted_token; 152 restricted_token.Attach(handle); 153 154 ATL::CDacl dacl; 155 ASSERT_TRUE(restricted_token.GetDefaultDacl(&dacl)); 156 157 bool restricted_found = false; 158 159 unsigned int ace_count = dacl.GetAceCount(); 160 for (unsigned int i = 0; i < ace_count ; ++i) { 161 ATL::CSid sid; 162 ACCESS_MASK mask = 0; 163 dacl.GetAclEntry(i, &sid, &mask); 164 if (sid == ATL::Sids::RestrictedCode() && mask == GENERIC_ALL) { 165 restricted_found = true; 166 break; 167 } 168 } 169 170 ASSERT_TRUE(restricted_found); 171 } 172 173 // Tests the method "AddSidForDenyOnly". 174 TEST(RestrictedTokenTest, DenySid) { 175 RestrictedToken token; 176 HANDLE token_handle = NULL; 177 178 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 179 ASSERT_EQ(ERROR_SUCCESS, token.AddSidForDenyOnly(Sid(WinWorldSid))); 180 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 181 182 ATL::CAccessToken restricted_token; 183 restricted_token.Attach(token_handle); 184 185 ATL::CTokenGroups groups; 186 ASSERT_TRUE(restricted_token.GetGroups(&groups)); 187 188 ATL::CSid::CSidArray sids; 189 ATL::CAtlArray<DWORD> attributes; 190 groups.GetSidsAndAttributes(&sids, &attributes); 191 192 for (unsigned int i = 0; i < sids.GetCount(); i++) { 193 if (ATL::Sids::World() == sids[i]) { 194 ASSERT_EQ(SE_GROUP_USE_FOR_DENY_ONLY, 195 attributes[i] & SE_GROUP_USE_FOR_DENY_ONLY); 196 } 197 } 198 } 199 200 // Tests the method "AddAllSidsForDenyOnly". 201 TEST(RestrictedTokenTest, DenySids) { 202 RestrictedToken token; 203 HANDLE token_handle = NULL; 204 205 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 206 ASSERT_EQ(ERROR_SUCCESS, token.AddAllSidsForDenyOnly(NULL)); 207 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 208 209 ATL::CAccessToken restricted_token; 210 restricted_token.Attach(token_handle); 211 212 ATL::CTokenGroups groups; 213 ASSERT_TRUE(restricted_token.GetGroups(&groups)); 214 215 ATL::CSid::CSidArray sids; 216 ATL::CAtlArray<DWORD> attributes; 217 groups.GetSidsAndAttributes(&sids, &attributes); 218 219 // Verify that all sids are really gone. 220 for (unsigned int i = 0; i < sids.GetCount(); i++) { 221 if ((attributes[i] & SE_GROUP_LOGON_ID) == 0 && 222 (attributes[i] & SE_GROUP_INTEGRITY) == 0) { 223 ASSERT_EQ(SE_GROUP_USE_FOR_DENY_ONLY, 224 attributes[i] & SE_GROUP_USE_FOR_DENY_ONLY); 225 } 226 } 227 } 228 229 // Tests the method "AddAllSidsForDenyOnly" using an exception list. 230 TEST(RestrictedTokenTest, DenySidsException) { 231 RestrictedToken token; 232 HANDLE token_handle = NULL; 233 234 std::vector<Sid> sids_exception; 235 sids_exception.push_back(Sid(WinWorldSid)); 236 237 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 238 ASSERT_EQ(ERROR_SUCCESS, token.AddAllSidsForDenyOnly(&sids_exception)); 239 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 240 241 ATL::CAccessToken restricted_token; 242 restricted_token.Attach(token_handle); 243 244 ATL::CTokenGroups groups; 245 ASSERT_TRUE(restricted_token.GetGroups(&groups)); 246 247 ATL::CSid::CSidArray sids; 248 ATL::CAtlArray<DWORD> attributes; 249 groups.GetSidsAndAttributes(&sids, &attributes); 250 251 // Verify that all sids are really gone. 252 for (unsigned int i = 0; i < sids.GetCount(); i++) { 253 if ((attributes[i] & SE_GROUP_LOGON_ID) == 0 && 254 (attributes[i] & SE_GROUP_INTEGRITY) == 0) { 255 if (ATL::Sids::World() == sids[i]) { 256 ASSERT_EQ(NULL, attributes[i] & SE_GROUP_USE_FOR_DENY_ONLY); 257 } else { 258 ASSERT_EQ(SE_GROUP_USE_FOR_DENY_ONLY, 259 attributes[i] & SE_GROUP_USE_FOR_DENY_ONLY); 260 } 261 } 262 } 263 } 264 265 // Tests test method AddOwnerSidForDenyOnly. 266 TEST(RestrictedTokenTest, DenyOwnerSid) { 267 RestrictedToken token; 268 HANDLE token_handle = NULL; 269 270 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 271 ASSERT_EQ(ERROR_SUCCESS, token.AddUserSidForDenyOnly()); 272 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 273 274 ATL::CAccessToken restricted_token; 275 restricted_token.Attach(token_handle); 276 277 ATL::CTokenGroups groups; 278 ASSERT_TRUE(restricted_token.GetGroups(&groups)); 279 280 ATL::CSid::CSidArray sids; 281 ATL::CAtlArray<DWORD> attributes; 282 groups.GetSidsAndAttributes(&sids, &attributes); 283 284 ATL::CSid user_sid; 285 ASSERT_TRUE(restricted_token.GetUser(&user_sid)); 286 287 for (unsigned int i = 0; i < sids.GetCount(); ++i) { 288 if (user_sid == sids[i]) { 289 ASSERT_EQ(SE_GROUP_USE_FOR_DENY_ONLY, 290 attributes[i] & SE_GROUP_USE_FOR_DENY_ONLY); 291 } 292 } 293 } 294 295 // Tests test method AddOwnerSidForDenyOnly with a custom effective token. 296 TEST(RestrictedTokenTest, DenyOwnerSidCustom) { 297 // Get the current process token. 298 HANDLE token_handle = INVALID_HANDLE_VALUE; 299 ASSERT_TRUE(::OpenProcessToken(::GetCurrentProcess(), TOKEN_ALL_ACCESS, 300 &token_handle)); 301 302 ASSERT_NE(INVALID_HANDLE_VALUE, token_handle); 303 304 ATL::CAccessToken access_token; 305 access_token.Attach(token_handle); 306 307 RestrictedToken token; 308 ASSERT_EQ(ERROR_SUCCESS, token.Init(access_token.GetHandle())); 309 ASSERT_EQ(ERROR_SUCCESS, token.AddUserSidForDenyOnly()); 310 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 311 312 ATL::CAccessToken restricted_token; 313 restricted_token.Attach(token_handle); 314 315 ATL::CTokenGroups groups; 316 ASSERT_TRUE(restricted_token.GetGroups(&groups)); 317 318 ATL::CSid::CSidArray sids; 319 ATL::CAtlArray<DWORD> attributes; 320 groups.GetSidsAndAttributes(&sids, &attributes); 321 322 ATL::CSid user_sid; 323 ASSERT_TRUE(restricted_token.GetUser(&user_sid)); 324 325 for (unsigned int i = 0; i < sids.GetCount(); ++i) { 326 if (user_sid == sids[i]) { 327 ASSERT_EQ(SE_GROUP_USE_FOR_DENY_ONLY, 328 attributes[i] & SE_GROUP_USE_FOR_DENY_ONLY); 329 } 330 } 331 } 332 333 // Tests the method DeleteAllPrivileges. 334 TEST(RestrictedTokenTest, DeleteAllPrivileges) { 335 RestrictedToken token; 336 HANDLE token_handle = NULL; 337 338 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 339 ASSERT_EQ(ERROR_SUCCESS, token.DeleteAllPrivileges(NULL)); 340 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 341 342 ATL::CAccessToken restricted_token; 343 restricted_token.Attach(token_handle); 344 345 ATL::CTokenPrivileges privileges; 346 ASSERT_TRUE(restricted_token.GetPrivileges(&privileges)); 347 348 ASSERT_EQ(0, privileges.GetCount()); 349 } 350 351 // Tests the method DeleteAllPrivileges with an exception list. 352 TEST(RestrictedTokenTest, DeleteAllPrivilegesException) { 353 RestrictedToken token; 354 HANDLE token_handle = NULL; 355 356 std::vector<base::string16> exceptions; 357 exceptions.push_back(SE_CHANGE_NOTIFY_NAME); 358 359 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 360 ASSERT_EQ(ERROR_SUCCESS, token.DeleteAllPrivileges(&exceptions)); 361 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 362 363 ATL::CAccessToken restricted_token; 364 restricted_token.Attach(token_handle); 365 366 ATL::CTokenPrivileges privileges; 367 ASSERT_TRUE(restricted_token.GetPrivileges(&privileges)); 368 369 ATL::CTokenPrivileges::CNames privilege_names; 370 ATL::CTokenPrivileges::CAttributes privilege_name_attributes; 371 privileges.GetNamesAndAttributes(&privilege_names, 372 &privilege_name_attributes); 373 374 ASSERT_EQ(1, privileges.GetCount()); 375 376 for (unsigned int i = 0; i < privileges.GetCount(); ++i) { 377 ASSERT_EQ(privilege_names[i], SE_CHANGE_NOTIFY_NAME); 378 } 379 } 380 381 // Tests the method DeletePrivilege. 382 TEST(RestrictedTokenTest, DeletePrivilege) { 383 RestrictedToken token; 384 HANDLE token_handle = NULL; 385 386 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 387 ASSERT_EQ(ERROR_SUCCESS, token.DeletePrivilege(SE_CHANGE_NOTIFY_NAME)); 388 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 389 390 ATL::CAccessToken restricted_token; 391 restricted_token.Attach(token_handle); 392 393 ATL::CTokenPrivileges privileges; 394 ASSERT_TRUE(restricted_token.GetPrivileges(&privileges)); 395 396 ATL::CTokenPrivileges::CNames privilege_names; 397 ATL::CTokenPrivileges::CAttributes privilege_name_attributes; 398 privileges.GetNamesAndAttributes(&privilege_names, 399 &privilege_name_attributes); 400 401 for (unsigned int i = 0; i < privileges.GetCount(); ++i) { 402 ASSERT_NE(privilege_names[i], SE_CHANGE_NOTIFY_NAME); 403 } 404 } 405 406 // Checks if a sid is in the restricting list of the restricted token. 407 // Asserts if it's not the case. If count is a positive number, the number of 408 // elements in the restricting sids list has to be equal. 409 void CheckRestrictingSid(const ATL::CAccessToken &restricted_token, 410 ATL::CSid sid, int count) { 411 DWORD length = 1000; 412 BYTE *memory = new BYTE[1000]; 413 TOKEN_GROUPS *groups = reinterpret_cast<TOKEN_GROUPS*>(memory); 414 ASSERT_TRUE(::GetTokenInformation(restricted_token.GetHandle(), 415 TokenRestrictedSids, 416 groups, 417 length, 418 &length)); 419 420 ATL::CTokenGroups atl_groups(*groups); 421 delete[] memory; 422 423 if (count >= 0) 424 ASSERT_EQ(count, atl_groups.GetCount()); 425 426 ATL::CSid::CSidArray sids; 427 ATL::CAtlArray<DWORD> attributes; 428 atl_groups.GetSidsAndAttributes(&sids, &attributes); 429 430 bool present = false; 431 for (unsigned int i = 0; i < sids.GetCount(); ++i) { 432 if (sids[i] == sid) { 433 present = true; 434 break; 435 } 436 } 437 438 ASSERT_TRUE(present); 439 } 440 441 // Tests the method AddRestrictingSid. 442 TEST(RestrictedTokenTest, AddRestrictingSid) { 443 RestrictedToken token; 444 HANDLE token_handle = NULL; 445 446 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 447 ASSERT_EQ(ERROR_SUCCESS, 448 token.AddRestrictingSid(ATL::Sids::World().GetPSID())); 449 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 450 451 ATL::CAccessToken restricted_token; 452 restricted_token.Attach(token_handle); 453 454 CheckRestrictingSid(restricted_token, ATL::Sids::World(), 1); 455 } 456 457 // Tests the method AddRestrictingSidCurrentUser. 458 TEST(RestrictedTokenTest, AddRestrictingSidCurrentUser) { 459 RestrictedToken token; 460 HANDLE token_handle = NULL; 461 462 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 463 ASSERT_EQ(ERROR_SUCCESS, token.AddRestrictingSidCurrentUser()); 464 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 465 466 ATL::CAccessToken restricted_token; 467 restricted_token.Attach(token_handle); 468 ATL::CSid user; 469 restricted_token.GetUser(&user); 470 471 CheckRestrictingSid(restricted_token, user, 1); 472 } 473 474 // Tests the method AddRestrictingSidCurrentUser with a custom effective token. 475 TEST(RestrictedTokenTest, AddRestrictingSidCurrentUserCustom) { 476 // Get the current process token. 477 HANDLE token_handle = INVALID_HANDLE_VALUE; 478 ASSERT_TRUE(::OpenProcessToken(::GetCurrentProcess(), TOKEN_ALL_ACCESS, 479 &token_handle)); 480 481 ASSERT_NE(INVALID_HANDLE_VALUE, token_handle); 482 483 ATL::CAccessToken access_token; 484 access_token.Attach(token_handle); 485 486 RestrictedToken token; 487 ASSERT_EQ(ERROR_SUCCESS, token.Init(access_token.GetHandle())); 488 ASSERT_EQ(ERROR_SUCCESS, token.AddRestrictingSidCurrentUser()); 489 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 490 491 ATL::CAccessToken restricted_token; 492 restricted_token.Attach(token_handle); 493 ATL::CSid user; 494 restricted_token.GetUser(&user); 495 496 CheckRestrictingSid(restricted_token, user, 1); 497 } 498 499 // Tests the method AddRestrictingSidLogonSession. 500 TEST(RestrictedTokenTest, AddRestrictingSidLogonSession) { 501 RestrictedToken token; 502 HANDLE token_handle = NULL; 503 504 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 505 ASSERT_EQ(ERROR_SUCCESS, token.AddRestrictingSidLogonSession()); 506 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 507 508 ATL::CAccessToken restricted_token; 509 restricted_token.Attach(token_handle); 510 ATL::CSid session; 511 restricted_token.GetLogonSid(&session); 512 513 CheckRestrictingSid(restricted_token, session, 1); 514 } 515 516 // Tests adding a lot of restricting sids. 517 TEST(RestrictedTokenTest, AddMultipleRestrictingSids) { 518 RestrictedToken token; 519 HANDLE token_handle = NULL; 520 521 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 522 ASSERT_EQ(ERROR_SUCCESS, token.AddRestrictingSidCurrentUser()); 523 ASSERT_EQ(ERROR_SUCCESS, token.AddRestrictingSidLogonSession()); 524 ASSERT_EQ(ERROR_SUCCESS, 525 token.AddRestrictingSid(ATL::Sids::World().GetPSID())); 526 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 527 528 ATL::CAccessToken restricted_token; 529 restricted_token.Attach(token_handle); 530 ATL::CSid session; 531 restricted_token.GetLogonSid(&session); 532 533 DWORD length = 1000; 534 BYTE *memory = new BYTE[1000]; 535 TOKEN_GROUPS *groups = reinterpret_cast<TOKEN_GROUPS*>(memory); 536 ASSERT_TRUE(::GetTokenInformation(restricted_token.GetHandle(), 537 TokenRestrictedSids, 538 groups, 539 length, 540 &length)); 541 542 ATL::CTokenGroups atl_groups(*groups); 543 delete[] memory; 544 545 ASSERT_EQ(3, atl_groups.GetCount()); 546 } 547 548 // Tests the method "AddRestrictingSidAllSids". 549 TEST(RestrictedTokenTest, AddAllSidToRestrictingSids) { 550 RestrictedToken token; 551 HANDLE token_handle = NULL; 552 553 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 554 ASSERT_EQ(ERROR_SUCCESS, token.AddRestrictingSidAllSids()); 555 ASSERT_EQ(ERROR_SUCCESS, token.GetRestrictedTokenHandle(&token_handle)); 556 557 ATL::CAccessToken restricted_token; 558 restricted_token.Attach(token_handle); 559 560 ATL::CTokenGroups groups; 561 ASSERT_TRUE(restricted_token.GetGroups(&groups)); 562 563 ATL::CSid::CSidArray sids; 564 ATL::CAtlArray<DWORD> attributes; 565 groups.GetSidsAndAttributes(&sids, &attributes); 566 567 // Verify that all group sids are in the restricting sid list. 568 for (unsigned int i = 0; i < sids.GetCount(); i++) { 569 if ((attributes[i] & SE_GROUP_INTEGRITY) == 0) { 570 CheckRestrictingSid(restricted_token, sids[i], -1); 571 } 572 } 573 574 // Verify that the user is in the restricting sid list. 575 ATL::CSid user; 576 restricted_token.GetUser(&user); 577 CheckRestrictingSid(restricted_token, user, -1); 578 } 579 580 // Test to be executed only in release because they are triggering DCHECKs. 581 #ifndef _DEBUG 582 583 // Checks the error code when the object is initialized twice. 584 TEST(RestrictedTokenTest, DoubleInit) { 585 RestrictedToken token; 586 ASSERT_EQ(ERROR_SUCCESS, token.Init(NULL)); 587 588 ASSERT_EQ(ERROR_ALREADY_INITIALIZED, token.Init(NULL)); 589 } 590 591 #endif 592 593 } // namespace sandbox 594
