Commits nvaccess/nvda - SemanticDiff

michaelDCurran committed 82 days ago

4d961c36

SaschaCowley committed 84 days ago

c595067c

secureProcess: add support for launching a process unelevated when called from an elevated process. Use 'removeElevation=True' on SecurePopen to do this.

michaelDCurran committed 84 days ago

657187cf

update test_secureProcess.py to support reworked SecureProcess keyword arguments. Including support for ui restrictions.

michaelDCurran committed 84 days ago

7fea43f3

Update ART design document to reflect switch to secureProcess.

michaelDCurran committed 84 days ago

c5f0e232

Update art-sandbox design document to talk about secureProcess.

michaelDCurran committed 84 days ago

a0bd86a1

SecureProcess: If cwd is not given (and therefore should be inherited from parnet), check if the token allows access to the directory, and if not, uses the temp directory. this is better than just globbering the inherited parent CWD for no need if it actually can be accessed fine.

michaelDCurran committed 84 days ago

ba36e03e

secureProcess: a restricted token now always is restricted to he base interactive groups + Restricted + the Logon SID. a retainuser boolean argument can be set to true to also include the User in the list of restricted SIDs. A separate createLeastPrivilegedPtoken function ahs been added which just todes token removal if a restricted token is not wanted. The SecureProcess constructor now takes a new restrictToken boolean argument which is True by default meaning a restricted token will be used. The allowUser argument has been renamed to retainuserInRestrictedToken. All this means that now there are conceptually several modes ART processes can be run in: 1. fully restricted (just enough for basic interaction / ability to read / execute program files and system binaries - essentially a generic interactive user with no access to any actual user files). 2. Restricted with access to the user's files. 3. Unrestricted - access to other groups the user is a part of.

michaelDCurran committed 84 days ago

1f046781

secureProcess.token.restrictedToken: disable some more dangerous SIDs, including domain ones.

michaelDCurran committed 84 days ago

77f97fde

secureProcess: implement maximum UI restrictions via the job object.

michaelDCurran committed 84 days ago

f9828393

ART manager: remove old import

michaelDCurran committed 84 days ago

8fe060fc

Replace the ART sandbox with a more official and complete secureProcess papckage, which supports integrity levels, restricted tokens, temporary windows tations /d esktops, running as local service etc.

michaelDCurran committed 84 days ago

b72b6574

shlobj: add LOCAL_APP_DATA_LOW to FolderID constants, required by processmanager.

michaelDCurran committed 84 days ago

17535d19

Revert "setup.py: no longer build nvda_art as part of NVDA itself. The runtime should be always used fully externally."

michaelDCurran committed 84 days ago

956c9799

sandbox.py: Use our formatting.

michaelDCurran committed 84 days ago

590a1017

The 'runtime' key in an add-on's manifest now provides the nameof the particular runtime the add-on will run in. For now the only supported runtime is 'x86'. Runtimes are registered in art.manager._runtimeRegistry.

michaelDCurran committed 84 days ago

ff2b0224

Processmanager: remove specific support for running from source. This over-complicated things and was not necessary for ART in the real world. If really needed, the paths can be maanged by the caller instead.

michaelDCurran committed 84 days ago

dd06ac61

setup.py: no longer build nvda_art as part of NVDA itself. The runtime should be always used fully externally.

michaelDCurran committed 84 days ago

b3c225a3

setup.py: copy x86 art-runtime into x86 lib dir in dist.

michaelDCurran committed 84 days ago

24794ae5

art-runtime-builder-x86: place art-runtime into NVDA's arch-specific lib directory in source rather than in dist.

michaelDCurran committed 84 days ago

edd0f7c5

processManager: store NVDA sandbox temp dirs just in localLow, not localLow/temp as temp does not always exist.

michaelDCurran committed 84 days ago

c6257340

ART sandboxing is now low integrity. Previous issues running were that sambox temp dir needed to also be low integrity. We cna do this by using a directory within appData\localLow.

michaelDCurran committed 84 days ago

8d0024e2

Remove very noisy debug logging from ART crypto serialiser. Not necessary anymore and make it almost imposible to debug other features.

michaelDCurran committed 84 days ago

d9f414dc

Add an isolated uv / py2exe sub-project (art-runtime-builder-x86) which can build an x86 version of the ART runtime, placing it in dist\art-runtime-x86.

michaelDCurran committed 84 days ago

c68beb30

diffHandler: revert back to master. diffMatchPatch is now run within NVDA so no need for handling separate processes.

michaelDCurran committed 84 days ago

7de6c65b

When setting up proxies for the available services from an ART process, specifically set the serializer to the specific encrypted serializer created for that ART process. Otherwise, Pyro5 will try using its default serializer, which is unencrypted, and would now fail anyway as ART processes now specifically only accept their specific encryption serializer.

michaelDCurran committed 84 days ago

55b14658

nvda:art runtime: deregister all other possible serializers, leaving just our specific encrypted serializer. This ensures that the ART process can only be communicated with via an encrypted channel. Previously it was possible it could use serpant etc.

michaelDCurran committed 84 days ago

3124f866

Log to show encryption happening

ctoth committed 84 days ago

382f7681

More ART design doc fixes

ctoth committed 84 days ago

48c8eb9c

Clean up docs

ctoth committed 84 days ago

dd5d7cf1