Container Manager initial draft

Author: Pooja Trivedi

msipackage/package.wix.in

@@ -263,7 +263,13 @@
                     <RegistryValue Name="AppId" Value="{E9B79997-57E3-4201-AECC-6A464E530DD2}" Type="string" />
                     <RegistryValue Value="WSLAVirtualMachine" Type="string" />
                 </RegistryKey>
-
+                
+                <!-- WSLASession -->
+                <RegistryKey Root="HKCR" Key="CLSID\{4877FEFC-4977-4929-A958-9F36AA1892A4}">
+                    <RegistryValue Name="AppId" Value="{E9B79997-57E3-4201-AECC-6A464E530DD2}" Type="string" />
+                    <RegistryValue Value="WSLASession" Type="string" />
+                </RegistryKey>
+                
                 <!-- IWSLAUserSession-->
                 <RegistryKey Root="HKCR" Key="Interface\{82A7ABC8-6B50-43FC-AB96-15FBBE7E8760}">
                     <RegistryValue Value="IWSLAUserSession" Type="string" />
@@ -288,7 +294,14 @@
                     </RegistryKey>
                 </RegistryKey>
 
-
+                <!-- IWSLASession-->
+                <RegistryKey Root="HKCR" Key="Interface\{EF0661E4-6364-40EA-B433-E2FDF11F3519}">
+                    <RegistryValue Value="IWSLASession" Type="string" />
+                    <RegistryKey Key="ProxyStubClsid32">
+                        <RegistryValue Value="{4EA0C6DD-E9FF-48E7-994E-13A31D10DC61}" Type="string" />
+                    </RegistryKey>
+                </RegistryKey>
+                
                 <File Id="wslaservice.exe" Source="${BIN}/wslaservice.exe"  KeyPath="yes" />
                 <File Id="wslaserviceproxystub.dll" Name="wslaserviceproxystub.dll" Source="${BIN}/wslaserviceproxystub.dll" />
 

src/windows/common/WslSecurity.cpp

@@ -99,6 +99,21 @@ wil::unique_handle wsl::windows::common::security::CreateRestrictedToken(_In_ HA
     return restrictedToken;
 }
 
+void wsl::windows::common::security::ConfigureForCOMImpersonation(IUnknown* Instance)
+{
+    wil::com_ptr_nothrow<IClientSecurity> clientSecurity;
+    THROW_IF_FAILED(Instance->QueryInterface(IID_PPV_ARGS(&clientSecurity)));
+
+    // Get the current proxy blanket settings.
+    DWORD authnSvc, authzSvc, authnLvl, capabilites;
+    THROW_IF_FAILED(clientSecurity->QueryBlanket(Instance, &authnSvc, &authzSvc, NULL, &authnLvl, NULL, NULL, &capabilites));
+
+    // Make sure that dynamic cloaking is used.
+    WI_ClearFlag(capabilites, EOAC_STATIC_CLOAKING);
+    WI_SetFlag(capabilites, EOAC_DYNAMIC_CLOAKING);
+    THROW_IF_FAILED(clientSecurity->SetBlanket(Instance, authnSvc, authzSvc, NULL, authnLvl, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, capabilites));
+}
+
 LUID wsl::windows::common::security::EnableTokenPrivilege(_Inout_ HANDLE token, _In_ LPCWSTR privilegeName)
 {
     // Convert privilege name to an LUID.

src/windows/common/WslSecurity.h

@@ -87,6 +87,11 @@ std::pair<PSID, std::vector<char>> CreateSid(SID_IDENTIFIER_AUTHORITY Authority,
 /// </summary>
 wil::unique_handle CreateRestrictedToken(_In_ HANDLE token);
 
+/// <summary>
+/// Configures a COM object for impersonation.
+/// <summary>
+void ConfigureForCOMImpersonation(IUnknown* instance);
+
 /// <summary>
 /// Enables a privilege on the token.
 /// </summary>

src/windows/wslaclient/DllMain.cpp

@@ -18,7 +18,7 @@ Module Name:
 #include "wslrelay.h"
 #include "wslInstall.h"
 
-namespace {
+/* namespace {
 
 void ConfigureComSecurity(IUnknown* Instance)
 {
@@ -34,7 +34,7 @@ void ConfigureComSecurity(IUnknown* Instance)
     WI_SetFlag(capabilites, EOAC_DYNAMIC_CLOAKING);
     THROW_IF_FAILED(clientSecurity->SetBlanket(Instance, authnSvc, authzSvc, NULL, authnLvl, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, capabilites));
 }
-} // namespace
+} // namespace */
 
 class DECLSPEC_UUID("7BC4E198-6531-4FA6-ADE2-5EF3D2A04DFF") CallbackInstance
     : public Microsoft::WRL::RuntimeClass<Microsoft::WRL::RuntimeClassFlags<Microsoft::WRL::ClassicCom>, ITerminationCallback, IFastRundown>
@@ -74,9 +74,10 @@ try
     wil::com_ptr<IWSLAUserSession> session;
 
     THROW_IF_FAILED(CoCreateInstance(__uuidof(WSLAUserSession), nullptr, CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&session)));
-    ConfigureComSecurity(session.get());
+    // ConfigureComSecurity(session.get());
+    wsl::windows::common::security::ConfigureForCOMImpersonation(session.get());
 
-    wil::com_ptr<IWSLAVirtualMachine> virtualMachineInstance;
+    /* wil::com_ptr<IWSLAVirtualMachine> virtualMachineInstance;
 
     VIRTUAL_MACHINE_SETTINGS settings{};
     settings.DisplayName = UserSettings->DisplayName;
@@ -91,7 +92,8 @@ try
     settings.EnableGPU = UserSettings->GPU.Enable;
 
     THROW_IF_FAILED(session->CreateVirtualMachine(&settings, &virtualMachineInstance));
-    ConfigureComSecurity(virtualMachineInstance.get());
+    // ConfigureComSecurity(virtualMachineInstance.get());
+    wsl::windows::common::security::ConfigureForCOMImpersonation(virtualMachineInstance.get());
 
     // Register termination callback, if specified
     if (UserSettings->Options.TerminationCallback != nullptr)
@@ -104,7 +106,7 @@ try
         // Callback instance is now owned by the service.
     }
 
-    *reinterpret_cast<IWSLAVirtualMachine**>(VirtualMachine) = virtualMachineInstance.detach();
+    *reinterpret_cast<IWSLAVirtualMachine**>(VirtualMachine) = virtualMachineInstance.detach();*/
     return S_OK;
 }
 CATCH_RETURN();

src/windows/wslaservice/exe/CMakeLists.txt

@@ -2,12 +2,14 @@ set(SOURCES
     application.manifest
     main.rc
     ServiceMain.cpp
+    WSLASession.cpp
     WSLAUserSession.cpp
     WSLAUserSessionFactory.cpp
     WSLAVirtualMachine.cpp
     )
 
 set(HEADERS
+    WSLASession.h
     WSLAUserSession.h
     WSLAUserSessionFactory.h
     WSLAVirtualMachine.h)
@@ -31,4 +33,4 @@ target_link_libraries(wslaservice
                       Synchronization.lib)
 
 target_precompile_headers(wslaservice REUSE_FROM common)
-set_target_properties(wslaservice PROPERTIES FOLDER windows)
+set_target_properties(wslaservice PROPERTIES FOLDER windows)