On Mon, Mar 17, 2008 at 10:41 AM, Paul Vriens <<a href="mailto:paul.vriens.wine@gmail.com">paul.vriens.wine@gmail.com</a>> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hi,<br>
<br>
I'm now looking at some of the failures for the security tests on Vista.<br>
Apparently PROCESS_ALL_ACCESS which is defined as:<br>
<br>
#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0xfff)<br>
<br>
is changed on Vista:<br>
<br>
#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0xffff)<br>
<br>
Should I change the tests (CreateProcess) to check for both possibilities or<br>
should our PROCESS_ALL_ACCESS be changed?<br>
<br>
I'm not sure what implications the latter one has yet. Only that using that mask<br>
on other windows versions will/could fail.<br>
</blockquote><div><br>Windows Vista/Windows Server 2008 have a new permission flag, PROCESS_QUERY_LIMITED_INFORMATION, with a value of 0x1000. That's why they added the extra nibble. The permission check code isn't supposed to check bits it doesn't know about, so it should be harmless to enable the extra nibble even on older versions.<br>
<br>Carl Fongheiser<br></div></div><br>