From baff5c160cf7f1ac0011bf8f55d506bf0346e1fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
Date: Mon, 7 Aug 2017 02:53:06 +0200
Subject: [PATCH] user32: Start explorer.exe using limited rights.

---
 dlls/advapi32/tests/security.c |  4 ++--
 dlls/user32/win.c              | 12 ++++++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c
index f27642e7a7..0271cd72e0 100644
--- a/dlls/advapi32/tests/security.c
+++ b/dlls/advapi32/tests/security.c
@@ -7313,7 +7313,7 @@ static void test_token_security_descriptor(void)
             ret = GetTokenInformation(token4, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size);
             ok(ret, "GetTokenInformation failed with error %u\n", GetLastError());
             tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity;
-            todo_wine ok(EqualSid(tml->Label.Sid, &medium_level), "Expected medium integrity level\n");
+            ok(EqualSid(tml->Label.Sid, &medium_level), "Expected medium integrity level\n");
 
             size = 0;
             ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size);
@@ -7768,7 +7768,7 @@ static void test_child_token_sd_medium(void)
     ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size);
     ok(ret, "GetTokenInformation failed with error %u\n", GetLastError());
     tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity;
-    todo_wine ok(EqualSid(tml->Label.Sid, &medium_level), "Expected medium integrity level\n");
+    ok(EqualSid(tml->Label.Sid, &medium_level), "Expected medium integrity level\n");
 
     HeapFree(GetProcessHeap(), 0, sd);
 }
diff --git a/dlls/user32/win.c b/dlls/user32/win.c
index cbfd8bb14a..8039f54fb0 100644
--- a/dlls/user32/win.c
+++ b/dlls/user32/win.c
@@ -43,6 +43,8 @@ WINE_DEFAULT_DEBUG_CHANNEL(win);
 #define NB_USER_HANDLES  ((LAST_USER_HANDLE - FIRST_USER_HANDLE + 1) >> 1)
 #define USER_HANDLE_TO_INDEX(hwnd) ((LOWORD(hwnd) - FIRST_USER_HANDLE) >> 1)
 
+extern HANDLE CDECL __wine_create_default_token(BOOL admin);
+
 static DWORD process_layout = ~0u;
 
 static struct list window_surfaces = LIST_INIT( window_surfaces );
@@ -2052,6 +2054,7 @@ HWND WINAPI GetDesktopWindow(void)
         WCHAR app[MAX_PATH + ARRAY_SIZE( explorer )];
         WCHAR cmdline[MAX_PATH + ARRAY_SIZE( explorer ) + ARRAY_SIZE( args )];
         WCHAR desktop[MAX_PATH];
+        HANDLE token;
         void *redir;
 
         SERVER_START_REQ( set_user_object_info )
@@ -2084,9 +2087,12 @@ HWND WINAPI GetDesktopWindow(void)
         strcpyW( cmdline, app );
         strcatW( cmdline, args );
 
+        if (!(token = __wine_create_default_token( FALSE )))
+            ERR( "Failed to create limited token\n" );
+
         Wow64DisableWow64FsRedirection( &redir );
-        if (CreateProcessW( app, cmdline, NULL, NULL, FALSE, DETACHED_PROCESS,
-                            NULL, windir, &si, &pi ))
+        if (CreateProcessAsUserW( token, app, cmdline, NULL, NULL, FALSE, DETACHED_PROCESS,
+                                  NULL, windir, &si, &pi ))
         {
             TRACE( "started explorer pid %04x tid %04x\n", pi.dwProcessId, pi.dwThreadId );
             WaitForInputIdle( pi.hProcess, 10000 );
@@ -2096,6 +2102,8 @@ HWND WINAPI GetDesktopWindow(void)
         else WARN( "failed to start explorer, err %d\n", GetLastError() );
         Wow64RevertWow64FsRedirection( redir );
 
+        if (token) CloseHandle( token );
+
         SERVER_START_REQ( get_desktop_window )
         {
             req->force = 1;
-- 
2.18.0

