Changed Windows account to run service.

cloud_print/service/win/cloud_print_service.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cloud_print/service/win/cloud_print_service.h"
 
 #include <atlsecurity.h>
 #include <iomanip>
 #include <iostream>
 
 #include "base/at_exit.h"
 #include "base/command_line.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/path_service.h"
 #include "base/string_util.h"
 #include "base/win/scoped_handle.h"
 #include "chrome/installer/launcher_support/chrome_launcher_support.h"
 #include "cloud_print/service/service_state.h"
 #include "cloud_print/service/service_switches.h"
 #include "cloud_print/service/win/chrome_launcher.h"
+#include "cloud_print/service/win/local_security_policy.h"
 #include "cloud_print/service/win/resource.h"
 
 namespace {
 
 const wchar_t kServiceStateFileName[] = L"Service State";
 
-const wchar_t kUserToRunService[] = L"NT AUTHORITY\\LocalService";
+const wchar_t kUserToRunService[] = L"NT AUTHORITY\\SYSTEM";

[Albert Bodenhamer, 2012/08/14 20:38:18]

I'm a bit nervous running as SYSTEM by default.  Any chance we could pull
credentials for the current user and use that as the default?

[Vitaly Buka (NO REVIEWS), 2012/08/14 20:58:51]

For current user we need to ask password.
Probably for default is better to have something without one.
I can rollback to LocalService but some users reported that they can print with
SYSTEM but not LocalService 
On 2012/08/14 20:38:18, Albert Bodenhamer wrote:

[Vitaly Buka (NO REVIEWS), 2012/08/14 21:51:00]

Removed default user.

On 2012/08/14 20:58:51, Vitaly Buka wrote:

 
 // The traits class for Windows Service.
 class ServiceHandleTraits {
  public:
   typedef SC_HANDLE Handle;
 
   // Closes the handle.
   static bool CloseHandle(Handle handle) {
     return ::CloseServiceHandle(handle) != FALSE;
   }
@@ skipping 25 matching lines @@
   FilePath service_path;
   CHECK(PathService::Get(base::FILE_EXE, &service_path));
 
   std::cout << "Usage: ";
   std::cout << service_path.BaseName().value();
   std::cout << " [";
     std::cout << "[";
       std::cout << "[";
         std::cout << " -" << kInstallSwitch;
         std::cout << " -" << kUserDataDirSwitch << "=DIRECTORY";
+        std::cout << "[";
+          std::cout << " -" << kRunAsUser << "=USERNAME";
+          std::cout << " -" << kRunAsPassword << "=PASSWORD";
+        std::cout << "]";
         std::cout << " [ -" << kQuietSwitch << " ]";
       std::cout << "]";
     std::cout << "]";
     std::cout << " | -" << kUninstallSwitch;
     std::cout << " | -" << kStartSwitch;
     std::cout << " | -" << kStopSwitch;
   std::cout << " ]\n";
   std::cout << "Manages cloud print windows service.\n\n";
 
   static const struct {
     const char* name;
     const char* description;
   } kSwitchHelp[] = {
     { kInstallSwitch, "Installs cloud print as service." },
     { kUserDataDirSwitch, "User data directory with \"Service State\" file." },
     { kQuietSwitch, "Fails without questions if something wrong." },
     { kUninstallSwitch, "Uninstalls service." },
     { kStartSwitch, "Starts service. May be combined with installation." },
     { kStopSwitch, "Stops service." },
+    { kRunAsUser, "Windows user to run the service in form DOMAIN\USERNAME. "
+                  "Default is LocalSystem. Current User is recommended." },
+    { kRunAsPassword, "Password for windows user to run the service" },
   };
 
   for (size_t i = 0; i < arraysize(kSwitchHelp); ++i) {
     std::cout << std::setiosflags(std::ios::left);
     std::cout << "  -" << std::setw(15) << kSwitchHelp[i].name;
     std::cout << kSwitchHelp[i].description << "\n";
   }
   std::cout << "\n";
 }
 
@@ skipping 72 matching lines @@
 
   DECLARE_REGISTRY_APPID_RESOURCEID(IDR_CLOUDPRINTSERVICE,
                                     "{8013FB7C-2E3E-4992-B8BD-05C0C4AB0627}")
 
   HRESULT InitializeSecurity() {
     // TODO(gene): Check if we need to call CoInitializeSecurity and provide
     // the appropriate security settings for service.
     return S_OK;
   }
 
-  HRESULT InstallService() {
+  HRESULT InstallService(const wchar_t* user, const wchar_t* password) {
     using namespace chrome_launcher_support;
 
     // TODO(vitalybuka): consider "lite" version if we don't want unregister
     // printers here.
     HRESULT hr = UninstallService();
     if (FAILED(hr))
       return hr;
 
     if (GetChromePathForInstallationLevel(SYSTEM_LEVEL_INSTALLATION).empty()) {
-      LOG(ERROR) << "Found no Chrome installed for all users.";
-      return HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
+      LOG(WARNING) << "Found no Chrome installed for all users.";
     }
 
     hr = UpdateRegistryAppId(true);
     if (FAILED(hr))
       return hr;
 
     FilePath service_path;
     CHECK(PathService::Get(base::FILE_EXE, &service_path));
     CommandLine command_line(service_path);
     command_line.AppendSwitch(kServiceSwitch);
     command_line.AppendSwitchPath(kUserDataDirSwitch, user_data_dir_);
 
+    LocalSecurityPolicy local_security_policy;
+    if (local_security_policy.Open()) {
+      if (!local_security_policy.IsPrivilegeSet(user, kSeServiceLogonRight)) {
+        LOG(WARNING) << "Setting " << kSeServiceLogonRight << " for " << user;
+        if (!local_security_policy.SetPrivilege(user, kSeServiceLogonRight)) {
+          LOG(ERROR) << "Failed to set" << kSeServiceLogonRight;
+          LOG(ERROR) << "Make sure you can run the service with this user.";
+        }
+      }
+    } else {
+      LOG(ERROR) << "Failed to open security policy.";
+    }
+
     ServiceHandle scm;
     hr = OpenServiceManager(&scm);
     if (FAILED(hr))
       return hr;
 
     ServiceHandle service(
         ::CreateService(
             scm, m_szServiceName, m_szServiceName, SERVICE_ALL_ACCESS,
             SERVICE_WIN32_OWN_PROCESS, SERVICE_AUTO_START, SERVICE_ERROR_NORMAL,
             command_line.GetCommandLineString().c_str(), NULL, NULL, NULL,
-            kUserToRunService, NULL));
+            user, password));
 
     if (!service.IsValid())
       return HResultFromLastError();
 
     return S_OK;
   }
 
   HRESULT UninstallService() {
     if (!Uninstall())
       return E_FAIL;
@@ skipping 45 matching lines @@
 
     if (command_line.HasSwitch(kUninstallSwitch))
       return UninstallService();
 
     if (command_line.HasSwitch(kInstallSwitch)) {
       if (!command_line.HasSwitch(kUserDataDirSwitch)) {
         InvalidUsage();
         return S_FALSE;
       }
 
-      HRESULT hr = ValidateUserDataDir();
-      if (FAILED(hr))
-        return hr;
+      CommandLine::StringType run_as_user =
+          command_line.GetSwitchValueNative(kRunAsUser);
+      CommandLine::StringType run_as_password =
+          command_line.GetSwitchValueNative(kRunAsPassword);
+      if (run_as_user.empty())
+        run_as_user = kUserToRunService;
+
+      HRESULT hr = ValidateUserDataDir(run_as_user.c_str());
 
       hr = ProcessServiceState(command_line.HasSwitch(kQuietSwitch));
       if (FAILED(hr))
         return hr;
 
-      hr = InstallService();
+      hr = InstallService(run_as_user.c_str(), run_as_password.c_str());
       if (SUCCEEDED(hr) && command_line.HasSwitch(kStartSwitch))
         return StartService();
 
       return hr;
     }
 
     if (command_line.HasSwitch(kStartSwitch))
       return StartService();
 
     if (command_line.HasSwitch(kServiceSwitch)) {
       *is_service = true;
       return S_OK;
     }
 
     if (command_line.HasSwitch(kConsoleSwitch)) {
       ::SetConsoleCtrlHandler(&ConsoleCtrlHandler, TRUE);
       HRESULT hr = Run();
       ::SetConsoleCtrlHandler(NULL, FALSE);
       return hr;
     }
 
     InvalidUsage();
     return S_FALSE;
   }
 
-  HRESULT ValidateUserDataDir() {
+  HRESULT ValidateUserDataDir(const wchar_t* user) {
     FilePath temp_file;
     const char some_data[] = "1234";
     if (!file_util::CreateTemporaryFileInDir(user_data_dir_, &temp_file))
       return E_FAIL;
-    HRESULT hr = WriteFileAsUser(temp_file, kUserToRunService, some_data,
+    HRESULT hr = WriteFileAsUser(temp_file, user, some_data,
                                  sizeof(some_data));
     if (FAILED(hr)) {
       LOG(ERROR) << "Failed to write user data. Make sure that account \'" <<
-          kUserToRunService << "\'has full access to \'" <<
+          user << "\' has full access to \'" <<
           user_data_dir_.value() << "\'.";
     }
     file_util::Delete(temp_file, false);
     return hr;
   }
 
   HRESULT ProcessServiceState(bool quiet) {
     FilePath file = user_data_dir_.Append(kServiceStateFileName);
 
     for (;;) {
       std::string contents;
       ServiceState service_state;
 
       bool is_valid = file_util::ReadFileToString(file, &contents) &&
                       service_state.FromString(contents);
 
       if (!quiet) {
+        std::cout << "\n";
         std::cout << file.value() << ":\n";
         std::cout << contents << "\n";
       }
 
       if (!is_valid)
         LOG(ERROR) << "Invalid file: " << file.value();
 
       if (quiet)
         return is_valid ? S_OK : HRESULT_FROM_WIN32(ERROR_FILE_INVALID);
 
@@ skipping 103 matching lines @@
 
 BOOL CloudPrintServiceModule::ConsoleCtrlHandler(DWORD type) {
   PostThreadMessage(_AtlModule.m_dwThreadID, WM_QUIT, 0, 0);
   return TRUE;
 }
 
 int main() {
   base::AtExitManager at_exit;
   return _AtlModule.WinMain(0);
 }