`StringToUTF16` is deprecated and will panic if given an "invalid"
string (in particular, one that has a null byte in it). The replacement
function is `UTF16FromString`, and it returns an error if there was
a problem.
This change replaces all uses of `StringToUTF16` with `UTF16FromString`.
The `service` struct now no longer stores a `string` name but rather
a `*uint16` pointer to the name.
It should not be possible to panic due to UTF16 string conversion
at this point.
Fixesgolang/go#73006
Change-Id: Idce9cdbb4651fef8481f0cad19b5df0314fd4277
Reviewed-on: https://go-review.googlesource.com/c/sys/+/659936
Reviewed-by: Carlos Amedee <carlos@golang.org>
Auto-Submit: Carlos Amedee <carlos@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Notably, the DisplayName field was set to the same thing in both
sys.TestExample and mrg.TestMyService, which may explain the collision
reported in golang/go#59298.
Moreover, the adjective ”my” conveys no information whatsoever — we
shouldn't use it in tests or examples.
Also skip the tests that install services if GO_BUILDER_NAME is not
set, to reduce the likelihood of 'go test all' in a user's working
directory being mistaken for a malicious or compromised program.
Fixesgolang/go#59298.
Change-Id: Ib00bf7400bfaa34e1a1d49125c43b97019b53c82
Reviewed-on: https://go-review.googlesource.com/c/sys/+/481015
Reviewed-by: Carlos Amedee <carlos@golang.org>
Run-TryBot: Bryan Mills <bcmills@google.com>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Bryan Mills <bcmills@google.com>
This method allows a user to list all Windows services which are
dependent upon a given service.
This commit makes use of the EnumDependentServices Windows API call.
Without this, a user would have to iterate through each service on the
system, and check if the given service is listed in each service's
dependencies list.
The implementation of ListDependentServices is mostly the same as
Mgr.ListServices, as the API calls behave in the same way.
Fixesgolang/go#56766
Change-Id: I9ec18c97afd02f48deef691ccdd5c26d6501add1
Reviewed-on: https://go-review.googlesource.com/c/sys/+/451363
Reviewed-by: Than McIntosh <thanm@google.com>
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Benny Siegert <bsiegert@gmail.com>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
The os/signal package drops signal notifications if the channel is not
ready to receive immediately. To avoid dropping signals (for example,
while processing the other branch of a 'select'), the channel must be
buffered.
This fixes a mistake flagged by 'go vet ./...'.
Change-Id: I2a20dbe2aa27ae8ec009fff5e7be47e4409fdddd
Reviewed-on: https://go-review.googlesource.com/c/sys/+/465595
Auto-Submit: Bryan Mills <bcmills@google.com>
Run-TryBot: Bryan Mills <bcmills@google.com>
Reviewed-by: Quim Muntal <quimmuntal@gmail.com>
Reviewed-by: David Chase <drchase@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
This brings the algorithm more exactly in line with what .NET does for
the identically named function. Specifically, instead of using
OpenProcess, which requires rights that restricted services might not
have, we use NtQuerySystemInformation(SYSTEM_PROCESS_INFORMATION) to
find the parent process image name and session ID.
Fixesgolang/go#44921.
Change-Id: Ie2ad7521cf4c530037d086e61dbc2413e4e7777c
Reviewed-on: https://go-review.googlesource.com/c/sys/+/372554
Trust: Jason Donenfeld <Jason@zx2c4.com>
Run-TryBot: Jason Donenfeld <Jason@zx2c4.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Patrik Nyblom <pnyb@google.com>
Trust: Patrik Nyblom <pnyb@google.com>
Run-TryBot: Patrik Nyblom <pnyb@google.com>
The old service management code was written in assembly and communicated
over Windows events, which resulted in non-obvious control flow.
NewCallback makes it possible to rewrite all of this in vanilla Go. This
also enables the service test on the Go builders, as modifying system
services shouldn't be an issue there.
Change-Id: I8003b57d11d4469f762058c648a4b7733530eeb8
Reviewed-on: https://go-review.googlesource.com/c/sys/+/330010
Trust: Jason A. Donenfeld <Jason@zx2c4.com>
Trust: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Alex copied this from a temporary thing I had written for the runtime
package. In runtime, you can't really access other packages like
syscall, so everything has to be very manual. But in x/sys, we can do
things properly. So this reimplements the function in a more straight
forward way.
Change-Id: I1634904bb1e10f33252954ce02d4b17ae56592e5
Reviewed-on: https://go-review.googlesource.com/c/sys/+/298830
Trust: Jason A. Donenfeld <Jason@zx2c4.com>
Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
One thing the newer notification API does not do is automatically
provide the service exit code in its notifier response. It requires
querying manually. Unfortunately, we weren't propagating this
information up from the lower level struct, so this commit copys that
information over.
Change-Id: I70c683007ce34ffab6196329acefc8443f921ebe
Reviewed-on: https://go-review.googlesource.com/c/sys/+/274577
Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
Trust: Alex Brainman <alex.brainman@gmail.com>
Trust: Jason A. Donenfeld <Jason@zx2c4.com>
Currently, doing s.UpdateConfig(s.Config()) will destroy the service,
because s.Config() fails to populate the SidType member, but
UpdateConfig will set the SidType, so that expression effectively zeros
out the SidType. Fix this by having Config() fetch the SidType in the
same way that it fetches the other additional fields there, such as
DelayedStartUp.
Change-Id: Idb917ef1e942020499b411b7777b995c29f0e7d2
Reviewed-on: https://go-review.googlesource.com/c/sys/+/270897
Trust: Jason A. Donenfeld <Jason@zx2c4.com>
Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
TestMyService uses the same service name as service in
golang.org/x/sys/windows/svc.TestExample.
https://build.golang.org sometimes schedules TestMyService and
TestExample to run at the same time. If that happens, tests fail,
because they were not designed to run in parallel.
This CL renames service in TestMyService, so it does not clash with
TestExample.
Fixesgolang/go#42211
Change-Id: I928c2ebbae77de3540f5ce16948fb96eeeed836d
Reviewed-on: https://go-review.googlesource.com/c/sys/+/267604
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Go Bot <gobot@golang.org>
Trust: Alex Brainman <alex.brainman@gmail.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
TestExample normally stops and deletes test service at the end of the
test. But, if TestExample does not complete for some reason, test
service might remain running and installed.
There is some code that deletes "left over" test service before starting
the test. But that code fails, if service is running. Deletion only
works, if service is not running. This CL adds code to stop the "left
over" service so it can be deleted.
Update golang/go#42211
Change-Id: I826dd587063265c5b96076668c3704c0a7eaa3d8
Reviewed-on: https://go-review.googlesource.com/c/sys/+/267603
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Go Bot <gobot@golang.org>
Trust: Alex Brainman <alex.brainman@gmail.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
CL 244958 includes isWindowsService function that determines if a
process is running as a service. The code of the function is based on
public .Net implementation.
IsAnInteractiveSession function implements similar functionality, but
is based on an old Stackoverflow post., which is not as authoritative
as code written by Microsoft for their official product.
This change copies CL 244958 isWindowsService function into svc package
and makes it public. The intention is that future users will prefer
IsWindowsService to IsAnInteractiveSession.
Also this change adds "Deprecated" comment to IsAnInteractiveSession to
point future users to IsWindowsService.
Call to IsAnInteractiveSession is also replaced with IsWindowsService
in golang.org/x/sys/windows/svc/example package.
Change-Id: I4a33b7f590ee8161d1134d8e83668e9da4e6b434
Reviewed-on: https://go-review.googlesource.com/c/sys/+/259397
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Trust: Brad Fitzpatrick <bradfitz@golang.org>
Trust: Alex Brainman <alex.brainman@gmail.com>
I noticed that we call syscall in servicemain without aligning stack.
That is against Windows rules, so align the stack as required.
I tried running this code with specifically non-aligned stack (I aligned
stack, and then subtracted 1 from SP) on my Windows 10 to test this
change. But it makes no difference on my Windows 10 PC - I built and run
golang.org/x/sys/windows/svc/example, and it runs successfully
regardless of stack alignment. But alignment might make difference on
other computers.
Maybe fixesgolang/go#40160
Change-Id: I351f7f730fba4aa6dc409a79de4ad737b4a0a7d4
Reviewed-on: https://go-review.googlesource.com/c/sys/+/246317
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
This CL fixes unsafe casts to slices that are missing length or capacity.
Running tests with -d=checkptr enabled may panic on casting unsafe.Pointer to a static array of large predefined length, that is most likely much bigger than the size of the actual array in memory. Checkptr check is not satisfied if slicing operator misses length and capacity arguments `(*[(1 << 30) - 1]uint16)(unsafe.Pointer(p))[:]`, or when there is no slicing at all `(*[(1 << 30) - 1]uint16)(unsafe.Pointer(p))`.
To find all potential cases I used `grep -nr ")(unsafe.Pointer(" ./windows`, then filtered out safe casts when object size is always static and known at compile time.
To reproduce the issue run tests with checkptr enabled `go test -a -gcflags=all=-d=checkptr ./windows/...`.
Updates golang/go#34972Fixesgolang/go#38355
Change-Id: I9dd2084b4f9fb7618cdb140fb2f38b56b6d6cc04
GitHub-Last-Rev: 73288ad18a
GitHub-Pull-Request: golang/sys#65
Reviewed-on: https://go-review.googlesource.com/c/sys/+/225418
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
From MSDN on CreateServiceW:
The returned handle is only valid for the process that called
CreateService. It can be closed by calling the CloseServiceHandle
function.
This isn't an actual kernel object to be closed with CloseHandle.
Change-Id: Iee225a666576d57a6c4864abef20206d54cbbce2
Reviewed-on: https://go-review.googlesource.com/c/sys/+/198298
Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
The SCM can be locked by NT. While traditionally any process could lock
the SCM using "LockServiceDatabase", Microsoft removed this
functionality because it created so many bugs, and that function now
does nothing. However, the system itself, via the "NT Service Control
Manager", is still allowed to lock the SCM.
For example, at boot time on Windows 8.1, the SCM is locked after a
service is started until that service reports itself in a running state.
This poses a bit of a problem: it's useful to install device drivers
from inside services as part of their initialization, and mark the
service as having started only after the device has installed. But
device installation might potentially load new drivers, and drivers
themselves exist as a special type of service. This means that if a
driver is installed before marking the service as started, the entire
SCM will deadlock, and the OS will be partially unresponsive for a
minute or two.
Fortunately Microsoft supplies an API for exactly this purpose. The
solution is to mark the service as started before installing device
drivers, only under the circumstance that the SCM is locked. So, this
commit adds the proper API for determining this. It can be used like
this:
if m, err := mgr.Connect(); err == nil {
if lockStatus, err := m.LockStatus(); err == nil && lockStatus.IsLocked {
log.Printf("SCM locked for %v by %s, marking service as started", lockStatus.Age, lockStatus.Owner)
changes <- svc.Status{State: svc.Running}
}
m.Disconnect()
}
deviceDriver.Install()
This creates messages like the following, indicating that this API
works:
SCM locked for 1s by .\NT Service Control Manager, marking service as started
Change-Id: Ic2f5b387e23efc3a287b2ab96ff84b357b712e36
Reviewed-on: https://go-review.googlesource.com/c/sys/+/180977
Run-TryBot: Jason Donenfeld <Jason@zx2c4.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
Many service attributes are settable using the ordinary CreateService
function, but ones added later in Windows need to be set using the
ChangeServiceConfig2 function. One of these is the Description field,
which is nicely plumbed behind the scenes, so that users of the API can
set it, and the mgr package will just figure out what to do with it.
Another one that works exactly the same way is SidType. Support for its
constants was added in 30999d6 ("windows: add missing service
constants"), but it wasn't actually built into the mgr package's
configuration struct, creating inconstancies in interface.
This commit rectifies that by adding proper support to mgr's config
struct.
Change-Id: I4f148f2d2477a03a65e8a571a8401392f6fe9f28
Reviewed-on: https://go-review.googlesource.com/c/sys/+/180978
Run-TryBot: Jason Donenfeld <Jason@zx2c4.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Matt Layher <mdlayher@gmail.com>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
The two functions have the same levels of compatibility, but this latter
one gives us access to the process ID, which is important for things
like WFP whitelisting. The change required is fairly trivial too.
Change-Id: Ifb6b3ee3e897202b9cffa1388c53c25cbcfede61
Reviewed-on: https://go-review.googlesource.com/c/sys/+/173666
Run-TryBot: Jason Donenfeld <Jason@zx2c4.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
While the types_windows file previously had a small handful of types,
this forced application code to have an awkward mixture of artisanal
error constants and factory-ready ones. This commit adds the missing
ones and separates them into a new file, since they are quite numerous.
These also preserve the order of winerr.h, which should make it somewhat
easier to import new ones in the future.
Fixesgolang/go#31360
Change-Id: If2abc507a8884ec1641f0b17fe0c612a950d3644
Reviewed-on: https://go-review.googlesource.com/c/sys/+/170918
Reviewed-by: Jason Donenfeld <Jason@zx2c4.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Jason Donenfeld <Jason@zx2c4.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
These DLLs, well advapi32.dll in particular, are vulnerable to classic
DLL directory injection attacks. The rest of x/sys/windows moved over to
the safe system loader, but apparently the svc package was forgotten.
This tidies up that oversight.
Change-Id: I330fa752cf2d49ccc5cf1bd60fb4bd612bd2b6b0
Reviewed-on: https://go-review.googlesource.com/c/sys/+/165758
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
ctlHandler is passed to RegisterServiceCtrlHandlerEx as a callback
function. But all ctlHandler parameters have to be uintptr aligned
regardless of their type.
Adjust ctlHandler parameters, so they are aligned accordingly.
Also uncomment part of TestExample that verifies passing of
ChangeRequest.Context.
Fixesgolang/go#25660
Change-Id: Ie96fa5c78b911ad9df6775f5c49e7f6d56464f6b
Reviewed-on: https://go-review.googlesource.com/c/158698
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
New Context field will be used in the following CL to test
ctlHandler parameter alignments.
Also adjust TestExample to pass hard coded Context value of 123456
to test service, and verify that correct value is logged. Final
part of the test is commented out, and will be adjusted in the next
CL.
Updates golang/go#25660
Change-Id: Iad2896ae497ee1edc0d62655eaf08671ec2651c5
Reviewed-on: https://go-review.googlesource.com/c/158697
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Added configuration options for a windows service recovery settings.
New configurations include modifying the reboot message, or command
to be run when a service fails, and getting the current reboot message
or command.
Fixesgolang/go#23239
Change-Id: I3e501d66e97745b7536fd654aee2bba488083e6d
Reviewed-on: https://go-review.googlesource.com/122579
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
Added configuration options for a windows service recovery settings.
Current configurations include modifying actions taken when a service
fails, setting the reset period, and getting the current recovery
settings.
Updates golang/go#23239
Change-Id: I4e91b2068122731e6eba3332afb0fe300b298c97
Reviewed-on: https://go-review.googlesource.com/104635
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
