View
4
Download
0
Category
Preview:
Citation preview
Best Practices for
User Account Control (UAC) in
Windows Vista
蔡孟儒 (Raymond)
Consultant
Microsoft Technology Center
Session Objectives
User Account Control (UAC) Overview
The new Shield paradigm
Running application in UAC environment
Coding in UAC environment
Summary
Microsoft
Confidential
Session Objectives
User Account Control (UAC) Overview
The new Shield paradigm
Running application in UAC environment
Coding in UAC environment
Summary
Microsoft
Confidential
Why User Account Control?
Most user accounts have Administrator privileges.
Code running without Administrator privileges is safer for the system.
Enterprises realize significant TCO reductions when running with managed systems.
Enterprises migrating to software that runs as Standard User
Microsoft
Confidential
Microsoft
Confidential
Windows Vista UAC goals
All users run as Standard User by default
Filtered token created during logon
Only specially marked apps get the unfiltered token
Explicit consent required for elevation
Predictable shell elevation paths
High application compatibility
Data Redirection
Enabling legacy apps to run as standard user
Installer Detection
UAC Architecture Standard User Rights
Administrative Rights
Admin logon
“Standard User” Token
Admin Token
User Process
• Change Time
Zone
• Run IT Approved
Applications
• Install Fonts
• Install Printers
• Run MSN
Messenger
• Etc.
Standard User ModeSplit TokenAdmin Privileges
Admin Privilege
Standard User Privilege
Admin Privilege
Admin Privilege
Abby
Microsoft
Confidential
DEMO:Standard User Rights vs. Administrative Rights
Microsoft
Confidential
Data Redirection for Legacy Apps
Legacy apps write to admin locations
HKLM\Software;
%SystemDrive%\Program Files
%WinDir%\System32
Redirection removes need for elevation
Writes to HKLM go to HKCU redirected store
Writes to system directories redirected to per-user store
Copy-on-write
This is a crutch for legacy applications.
Files, registry keys are redirected when written to privileged areas
This is not a feature!
Only a mitigation for UAC, WRP
Redirection is per user
Redirection
Files, registry keys are redirected when written to privileged areas
This is not a feature!
Only a mitigation for UAC, WRP
Redirection is per user
APP A
WRITE
Redirection
HKLM
HKCU
APP A
WRITE
REDIRECT
APP A
WRITE
HKLM
Files, registry keys are redirected when written to privileged areas
This is not a feature!
Only a mitigation for UAC, WRP
Redirection is per user
Redirection
HKCU
HKCU
APP A
WRITE
REDIRECT
APP A
WRITE
HKLM
HKCU
Files, registry keys are redirected when written to privileged areas
This is not a feature!
Only a mitigation for UAC, WRP
Redirection is per user
READ/
WRITE
Redirection
APP B
HKCU
APP A
WRITE
REDIRECT
APP A
WRITE
HKLM
HKCU
READ/
WRITE
APP B
Files, registry keys are redirected when written to privileged areas
This is not a feature!
Only a mitigation for UAC, WRP
Redirection is per user
READ/WRITE
Redirection
APP C
DEMO:Data Redirection
Session Objectives
User Account Control (UAC) Overview
The new Shield paradigm
Running application in UAC environment
Coding in UAC environment
Summary and future direction
Microsoft
Confidential
Microsoft
Confidential
UX: The Shield
Goal is to make your application simple & predictable
Attached to controls which, if clicked, will require elevation as the next step
Has only one state (I.e. no hover, disabled etc.)
Does not remember elevated state
Not an unlock operation
Microsoft
Confidential
Shield UI Examples
Microsoft
Confidential
Elevation Prompts
Microsoft
Confidential
Consent UIOS Application
Unsigned ApplicationSigned Application
Session Objectives
User Account Control (UAC) Overview
The new Shield paradigm
Running application in UAC environment
Coding in UAC environment
Summary
Microsoft
Confidential
Microsoft
Confidential
How to Run Code Elevated
Mark application as requiring Administrator privileges using manifest
Heuristic Installer detection
Application Compatibility shims
Compatibility Tab on Program Properties
Right-click Run as administrator
Sample Manifest
MyAdminApp.exe.manifest
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" processorArchitecture="X86“
name="MyAdminApp" type="win32"/>
<!-- Identify the application security requirements. -->
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
RequestedExecutionLevels
Level = asInvoker
Launch with the same token as the parent process
Level = highestAvailable
Launch with the highest token this user possesses
Level = requireAdministrator
Highest token of the User provided User is a member of Administrators group
Marking managed codeManifest can be added after .exe is built
Use tool MT.exe, part of the Windows SDK
(add in link)
Steps:
Create manifest file
Use mt.exe to embed manifestMt.exe –manifest yourapp.manifest
-outputresource:yourapp.exe;
DEMO:Manifest
Compatibility Tab
Session Objectives
User Account Control (UAC) Overview
The new Shield paradigm
Running application in UAC environment
Coding in UAC environment
Summary
Microsoft
Confidential
UAC Architecture
Microsoft
Confidential
Microsoft
Confidential
UX Goals: Simple & Predictable
1st Choice: Make application Standard user only
2nd Choice: Clearly identify Administrative tasks
Ensure Standard users can be fully productive
Identify tasks that need elevation with a “shield”
Microsoft
Confidential
Shield Implementation APIs
Microsoft
Confidential
Separation of Admin CodeCannot elevate a running process
Communication: Two Design Patterns
Service Broker Model
RPC
Globally mapped shared memory
Side by Side Processes
RPC
Named pipes
Global or locally mapped shared memory
Creation of an Administrator COM object to perform elevated task.
CoCreateInstanceAsAdmin
Coding for UAC in a nutshell
Design code to not require any Administrative privileges whenever possible.
Per-machine settings during install
Place Per-Machine (Shared) data into %ALLUSERSPROFILE%
Place Per-Machine registry setting in HKLM
Per-user settings at first run
Place per-user data into %LOCALAPPDATA%
Place per-user registry settings in HKCU
Store user shared data in User\Public
Coding for UAC in a nutshell
Examples of what not to do:
Do not perform admin configuration at first run
Do your admin operations during setup
Do not rely on explicit Admin checks for Standard User applications
Summary
Microsoft
Confidential
Application Impact SummaryWorks on Windows XP as Standard User?
It will just work on Windows Vista
Fails on Windows XP as Standard User?Mitigated by Redirection
Mitigated by App Comp Shim via ACT
Simple app with Admin dependencies
Admin app on Windows XP? Needs to be marked!
Web apps need special attention due to Protected Mode IE
Use the Standard User Analyzer to fix your appTool Location: http://www.microsoft.com/windows/appcompatibility/default.mspx
Microsoft
Confidential
Process Isolation
Administrative and Standard User applications share the same desktop
Security challenges
Cross-process Window messages
DLL injection and create remote thread
Process Isolation mechanisms
Integrity level for processes
“Lower” cannot interfere with “Higher”
DEMO:User Interface Privilege Isolation (UIPI)
Microsoft
Confidential
UAC Blog: http://blogs.msdn.com/uac
Deck from PDC2005:
http://commnet.microsoftpdc.com/content/downloads.aspx
General Security Info: http://msdn.microsoft.com/windowsvista/security/
Getting Started with UAC:
http://www.microsoft.com/technet/windowsvista/evaluate/feat/uaprot.mspx
UAP Developer Guidelines:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnlong/html/AccProtVista.asp
UAC Question on Update:
http://forums.microsoft.com/msdn/showpost.aspx?postid=111453&siteid=1
Aaron’s Blog: “Not running as administrator” http://blogs.msdn.com/Aaron_Margosis
More Information on UAC
Microsoft
Confidential
FAQIf I mark my app as “admin”, can I skip the elevation consent dialog? – No
Can you modify the privilege of a running application? - No
Will UAC elevate whenever a privileged API is used? – No, the entire process is either elevated or not
How long does the elevated process last? Can it time out? – Life of the process
Can I enable which users will use UAC? – Currently this is a per machine setting
Does UAC apply to all processes and services? – Interactive processes only
What areas of the Registry and File system get redirected? –HKLM\Software, %SystemRoot%, %ProgramFiles%
Won’t Redirection de-motivate developers to fix their code? – Yes, it is a short term mitigation, not in 64bit
What happens when installer detection fails? – The app runs as non-admin
Will UAC be going down-level? - No
Q&A
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not
be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation.
MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
User Control Policies
Admin Approval Mode for the built-in Administrator account
Default: Not Defined
Behavior of the elevation prompt for administrators in Admin Approval Mode
Default: Prompt for consent
Behavior of the elevation prompt for standard users:
Default: Prompt for credentials
Detect application installations and prompt for elevation
Default: Enabled
Microsoft
Confidential
User Control Policies (conti.)
Only elevate executables that are signed and trusted
Default: Disabled
Run all administrators in Admin Approval Mode
Default: Enabled
Switch to the secure desktop when prompting for elevation
Default: Enabled
Virtualized file and registry write failures to per-user locations
Microsoft
Confidential
Recommended