sys: IoCreateDeviceSecure: tighten down who can open the device

src/sys/driver.c

@@ -22,16 +22,20 @@ DriverEntry(
     FSP_ENTER();
 
     /* create the file system control device objects */
+    UNICODE_STRING DeviceSddl;
     UNICODE_STRING DeviceName;
+    RtlInitUnicodeString(&DeviceSddl, L"" DRIVER_SDDL);
     RtlInitUnicodeString(&DeviceName, L"\\Device\\" FSP_FSCTL_DISK_DEVICE_NAME);
-    Result = IoCreateDevice(DriverObject,
+    Result = IoCreateDeviceSecure(DriverObject,
         sizeof(FSP_FSCTL_DEVICE_EXTENSION), &DeviceName, FILE_DEVICE_DISK_FILE_SYSTEM, 0, FALSE,
+        &DeviceSddl, &FspDeviceClassGuid,
         &FspFsctlDiskDeviceObject);
     if (!NT_SUCCESS(Result))
         FSP_RETURN();
     RtlInitUnicodeString(&DeviceName, L"\\Device\\" FSP_FSCTL_NET_DEVICE_NAME);
-    Result = IoCreateDevice(DriverObject,
+    Result = IoCreateDeviceSecure(DriverObject,
         sizeof(FSP_FSCTL_DEVICE_EXTENSION), &DeviceName, FILE_DEVICE_NETWORK_FILE_SYSTEM, 0, FALSE,
+        &DeviceSddl, &FspDeviceClassGuid,
         &FspFsctlNetDeviceObject);
     if (!NT_SUCCESS(Result))
         FSP_RETURN(IoDeleteDevice(FspFsctlDiskDeviceObject));

src/sys/driver.h

@@ -8,9 +8,12 @@
 #define WINFSP_SYS_DRIVER_H_INCLUDED
 
 #include <ntifs.h>
-#include <fsctl.h>
+#include <wdmsec.h>
+#include <winfsp/fsctl.h>
 
 #define DRIVER_NAME                     "WinFsp"
+#define DRIVER_SDDL                     "D:P(A;;GA;;;SY)(A;;GA;;;BA)"
+    /* system and builtin administrators have full access */
 
 /* DEBUGLOG */
 #if DBG