ipc: allow admins but require high integrity label

Might be more reasonable. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
WireGuard · Jun 24, 2021 · 15b24b6 · 15b24b6
1 parent f9b48a9
commit 15b24b6
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/ipc/uapi_windows.go b/ipc/uapi_windows.go
@@ -54,8 +54,7 @@ var UAPISecurityDescriptor *windows.SECURITY_DESCRIPTOR
 
 func init() {
 	var err error
-	/* SDDL_DEVOBJ_SYS_ALL from the WDK */
-	UAPISecurityDescriptor, err = windows.SecurityDescriptorFromString("O:SYD:P(A;;GA;;;SY)")
+	UAPISecurityDescriptor, err = windows.SecurityDescriptorFromString("O:SYD:P(A;;GA;;;SY)(A;;GA;;;BA)S:(ML;;NWNRNX;;;HI)")
 	if err != nil {
 		panic(err)
 	}