microsoft / microsoft/ebpf-for-windows
netebpfext needs to expose helper functions to return the user access token
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
### Describe the feature you'd like supported
Our product requires the PACCESS_TOKEN when a connection is connected/accepted - thus we need a helper function from netebpfext we can call from our attached bpf programs.
### Proposed solution
This should call the SeCaptureSubjectContextEx API: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-secapturesubjectcontextex. From that, it needs to call SeQuerySubjectContextToken https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-sequerysubjectcontexttoken -- to get the PACCESS_TOKEN. It then will ObRef that kernel object to be used through the life of the connection.
We will track the lifetime of this pointer (until the connection goes away) - so will need to drop the ObRef when the connection closes.
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.