i have portions of my program that require administrative access (settings that affect all users, stored in HKLM, and are limited to administrative access).
i've changed my software to indicate that elevation is required:
In response i am going to launch my executable while prompting for elevation:
SHELLEXECUTEINFO shExecInfo;
shExecInfo.cbSize = sizeof(SHELLEXECUTEINFO);
shExecInfo.fMask = NULL;
shExecInfo.hwnd = NULL;
shExecInfo.lpVerb = L"runas";
shExecInfo.lpFile = L"myapp.exe";
shExecInfo.lpParameters = NULL;
shExecInfo.lpDirectory = NULL;
shExecInfo.nShow = SW_MAXIMIZE;
shExecInfo.hInstApp = NULL;
ShellExecuteEx(&shExecInfo);
What i was going to do is pass the name of a named pipe on the command line, telling myself where it can connect back to in order to get instructions on what it's supposed to be doing:
myapp.exe /uac 6C844671-E262-46DD-939E-47517F105FB6
(Yes, using a GUID as the name of the pipe).
Through this pipe i would tell my elevated clone what database, e.g.:
- what server database it's supposed to be connecting to
- the user it should say it making the changes
- the thing it should add/edit/delete
My concern was then that anyone could launch myapp.exe, and then feed it all kinds of requests - things i don't want it to do cause i didn't launch it, e.g.:
MaliciousProgram.exe:
ShellExecute("myapp.exe /uac HahaYouDoWhatISayNow")
i remember during the Longhorn beta there was a Channel9 video, or an article, talking about UAC and the dangers of the wrong of doing IPC (Inter-process communication).
i don't want to re-invent the wheel, making security mistakes that have already been solved. But i cannot find any existing guidance on the "correct" way to do IPC with UAC elevation.
What't he accepted pattern for doing IPC to communicate with spawned elevated process for temporary elevated actions?
Edit: Combined followers of uac and ipc tags: 53