microsoft / microsoft/ebpf-for-windows

netebpfext needs to expose helper functions to return the user access token

Open
#4,801 3 comments 0 reactions 1 assignee Assigned to @shankarseal View on GitHub
enhancement P2 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the feature you'd like supported

Our product requires the PACCESS_TOKEN when a connection is connected/accepted - thus we need a helper function from netebpfext we can call from our attached bpf programs.

### Proposed solution

This should call the SeCaptureSubjectContextEx API: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-secapturesubjectcontextex. From that, it needs to call SeQuerySubjectContextToken https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-sequerysubjectcontexttoken -- to get the PACCESS_TOKEN. It then will ObRef that kernel object to be used through the life of the connection.

We will track the lifetime of this pointer (until the connection goes away) - so will need to drop the ObRef when the connection closes.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.