9 lines
1.3 KiB
JavaScript
9 lines
1.3 KiB
JavaScript
import {execFileSync} from 'node:child_process';
|
|
import {join,isAbsolute} from 'node:path';
|
|
export function assertPrivateEvidenceKey(file){
|
|
if(process.platform!=='win32')return;
|
|
if(!isAbsolute(file))throw Error('Evidence key requires an absolute protected path');
|
|
const script=`$ErrorActionPreference='Stop'; $a=Get-Acl -LiteralPath $env:SAFETYNET_EVIDENCE_KEY_PATH; $me=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value; $allowed=@($me,'S-1-5-18','S-1-5-32-544'); if($allowed -notcontains $a.GetOwner([System.Security.Principal.SecurityIdentifier]).Value){exit 2}; foreach($r in $a.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])){if($r.AccessControlType -eq 'Allow' -and $allowed -notcontains $r.IdentityReference.Value -and (([int]$r.FileSystemRights -band 0xD013F) -ne 0)){exit 3}}; Write-Output 'protected'`;
|
|
try{const result=execFileSync(join(process.env.SystemRoot||'C:/Windows','System32/WindowsPowerShell/v1.0/powershell.exe'),['-NoProfile','-NonInteractive','-Command',script],{encoding:'utf8',windowsHide:true,timeout:10000,env:{SystemRoot:process.env.SystemRoot,SAFETYNET_EVIDENCE_KEY_PATH:file},stdio:['ignore','pipe','pipe']});if(result.trim()!=='protected')throw Error();}catch{throw Error('Evidence key must be restricted to its service owner, SYSTEM and Administrators');}
|
|
}
|