Merge branch 'win-fix-service-config'

4 files changed, 38 insertions, 14 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bf615a4d24..6822c5ac70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,10 @@ Line wrap the file at 100 chars.                                              Th
 ### Fixed
 - Fix improved WireGuard port selection
 
+#### Windows
+- Register 'NSI' service as a dependency of the daemon service.
+- Set daemon service SID type as 'unrestricted'.
+
 ### Security
 #### Linux
 - Stop [CVE-2019-14899](https://seclists.org/oss-sec/2019/q4/122) by dropping all packets destined
diff --git a/Cargo.lock b/Cargo.lock
index 6bed345f76..60c648291d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1284,7 +1284,7 @@ dependencies = [
  "tokio-timer 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)",
  "uuid 0.7.4 (registry+https://github.com/rust-lang/crates.io-index)",
  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
- "windows-service 0.2.0 (git+https://github.com/mullvad/windows-service-rs.git?rev=48d755b0afbf259ba547d4defc3e9340d1436cf6)",
+ "windows-service 0.2.0 (git+https://github.com/mullvad/windows-service-rs.git?rev=1d5f9cc65658429414f2d62e4581e5a3e2532b99)",
  "winres 0.1.11 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
@@ -3096,7 +3096,7 @@ dependencies = [
 [[package]]
 name = "windows-service"
 version = "0.2.0"
-source = "git+https://github.com/mullvad/windows-service-rs.git?rev=48d755b0afbf259ba547d4defc3e9340d1436cf6#48d755b0afbf259ba547d4defc3e9340d1436cf6"
+source = "git+https://github.com/mullvad/windows-service-rs.git?rev=1d5f9cc65658429414f2d62e4581e5a3e2532b99#1d5f9cc65658429414f2d62e4581e5a3e2532b99"
 dependencies = [
  "bitflags 1.2.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "err-derive 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -3455,7 +3455,7 @@ dependencies = [
 "checksum winapi-x86_64-pc-windows-gnu 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 "checksum wincolor 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)" = "96f5016b18804d24db43cebf3c77269e7569b8954a8464501c216cc5e070eaa9"
 "checksum winconsole 0.10.0 (registry+https://github.com/rust-lang/crates.io-index)" = "3ef84b96d10db72dd980056666d7f1e7663ce93d82fa33b63e71c966f4cf5032"
-"checksum windows-service 0.2.0 (git+https://github.com/mullvad/windows-service-rs.git?rev=48d755b0afbf259ba547d4defc3e9340d1436cf6)" = "<none>"
+"checksum windows-service 0.2.0 (git+https://github.com/mullvad/windows-service-rs.git?rev=1d5f9cc65658429414f2d62e4581e5a3e2532b99)" = "<none>"
 "checksum winreg 0.6.2 (registry+https://github.com/rust-lang/crates.io-index)" = "b2986deb581c4fe11b621998a5e53361efe6b48a151178d0cd9eeffa4dc6acc9"
 "checksum winres 0.1.11 (registry+https://github.com/rust-lang/crates.io-index)" = "ff4fb510bbfe5b8992ff15f77a2e6fe6cf062878f0eda00c0f44963a807ca5dc"
 "checksum ws2_32-sys 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "d59cefebd0c892fa2dd6de581e937301d8552cb44489cdff035c6187cb63fa5e"
diff --git a/mullvad-daemon/Cargo.toml b/mullvad-daemon/Cargo.toml
index f536cc6ba6..e01f93aa7f 100644
--- a/mullvad-daemon/Cargo.toml
+++ b/mullvad-daemon/Cargo.toml
@@ -55,7 +55,7 @@ simple-signal = "1.1"
 
 [target.'cfg(windows)'.dependencies]
 ctrlc = "3.0"
-windows-service = { git = "https://github.com/mullvad/windows-service-rs.git", rev = "48d755b0afbf259ba547d4defc3e9340d1436cf6" }
+windows-service = { git = "https://github.com/mullvad/windows-service-rs.git", rev = "1d5f9cc65658429414f2d62e4581e5a3e2532b99" }
 winapi = { version = "0.3", features = ["errhandlingapi", "handleapi", "libloaderapi", "synchapi", "tlhelp32", "winbase", "winerror", "winuser"] }
 
 [target.'cfg(windows)'.build-dependencies]
diff --git a/mullvad-daemon/src/system_service.rs b/mullvad-daemon/src/system_service.rs
index 9dcb56efb3..73c5039b5b 100644
--- a/mullvad-daemon/src/system_service.rs
+++ b/mullvad-daemon/src/system_service.rs
@@ -13,10 +13,10 @@ use std::{
 use talpid_types::ErrorExt;
 use windows_service::{
     service::{
-        ServiceAccess, ServiceAction, ServiceActionType, ServiceControl, ServiceControlAccept,
+        Service, ServiceAccess, ServiceAction, ServiceActionType, ServiceControl, ServiceControlAccept,
         ServiceDependency, ServiceErrorControl, ServiceExitCode, ServiceFailureActions,
-        ServiceFailureResetPeriod, ServiceInfo, ServiceStartType, ServiceState, ServiceStatus,
-        ServiceType,
+        ServiceFailureResetPeriod, ServiceInfo, ServiceSidType, ServiceStartType, ServiceState,
+        ServiceStatus, ServiceType,
     },
     service_control_handler::{self, ServiceControlHandlerResult, ServiceStatusHandle},
     service_dispatcher,
@@ -30,6 +30,13 @@ static SERVICE_TYPE: ServiceType = ServiceType::OWN_PROCESS;
 const SERVICE_RECOVERY_LAST_RESTART_DELAY: Duration = Duration::from_secs(60 * 10);
 const SERVICE_FAILURE_RESET_PERIOD: Duration = Duration::from_secs(60 * 15);
 
+lazy_static::lazy_static! {
+    static ref SERVICE_ACCESS: ServiceAccess = ServiceAccess::QUERY_CONFIG
+    | ServiceAccess::CHANGE_CONFIG
+    | ServiceAccess::START
+    | ServiceAccess::DELETE;
+}
+
 pub fn run() -> Result<(), String> {
     // Start the service dispatcher.
     // This will block current thread until the service stopped and spawn `service_main` on a
@@ -250,14 +257,10 @@ pub fn install_service() -> Result<(), InstallError> {
     let manager_access = ServiceManagerAccess::CONNECT | ServiceManagerAccess::CREATE_SERVICE;
     let service_manager = ServiceManager::local_computer(None::<&str>, manager_access)
         .map_err(InstallError::ConnectServiceManager)?;
-    let service_access = ServiceAccess::QUERY_CONFIG
-        | ServiceAccess::CHANGE_CONFIG
-        | ServiceAccess::START
-        | ServiceAccess::DELETE;
 
     let service = service_manager
-        .create_service(get_service_info(), service_access)
-        .or(service_manager.open_service(SERVICE_NAME, service_access))
+        .create_service(&get_service_info(), *SERVICE_ACCESS)
+        .or(open_update_service(&service_manager))
         .map_err(InstallError::CreateService)?;
 
     let recovery_actions = vec![
@@ -287,7 +290,21 @@ pub fn install_service() -> Result<(), InstallError> {
         .map_err(InstallError::CreateService)?;
     service
         .set_failure_actions_on_non_crash_failures(true)
-        .map_err(InstallError::CreateService)
+        .map_err(InstallError::CreateService)?;
+
+    // Change how the service SID is added to the service process token.
+    // WireGuard needs this.
+    service
+        .set_config_service_sid_info(ServiceSidType::Unrestricted)
+        .map_err(InstallError::CreateService)?;
+
+    Ok(())
+}
+
+fn open_update_service(service_manager: &ServiceManager) -> Result<Service, windows_service::Error> {
+    let service = service_manager.open_service(SERVICE_NAME, *SERVICE_ACCESS)?;
+    service.change_config(&get_service_info())?;
+    Ok(service)
 }
 
 fn get_service_info() -> ServiceInfo {
@@ -302,6 +319,9 @@ fn get_service_info() -> ServiceInfo {
         dependencies: vec![
             // Base Filter Engine
             ServiceDependency::Service(OsString::from("BFE")),
+            // Network Store Interface Service
+            // This service delivers network notifications (e.g. interface addition/deleting etc).
+            ServiceDependency::Service(OsString::from("NSI")),
         ],
         account_name: None, // run as System
         account_password: None,