Restrict options/configs for startup through interactive service

Restrict options/configs for startup through interactive service

Windows only:

- Allow only a set of whitelisted options in the command line options
passed by
  interactive service clients unless
   (i) user is the local Adminsitrator group
      AND/OR
   (ii) in a predefined group (see below)
  Only the group membership is checked, the client process need not be
running with
  any elevated privileges available to those groups.

- Restrict config files to config_dir or it sub directories unless (i)
and/or (ii) above
  is true (config_dir is as defined in HKLM\Software\OpenVPN\config_dir)

- The predefined group may be set in the registry
HKLM\Software\OpenVPN\ovpn_admin_group
  (default: "OpenVPN Administrators")

- The white-list of options is a simple flat array of option strings
(without leading --)
  defined in validate.c

- Further options may be added to the whitelist without breaking the GUI
-- the startup
  data is passed from the GUI to the service the same way as before.

Notes to GUI developers:
(i) If the user is an administrator, the service will grant all privileges
even if
the GUI is not running elevated. This is practically equivalent to
'highestAvailable' without the risks of running the GUI elevated.

(ii) If the option checks fail, openvpn is not started, but an error
message
is passed back to the service pipe and written to event log. Currently the
GUI does
not read from the service pipe -- this needs fixing.

v2 changes:
  - checked non-unicode build and fixed an error -- in case anyone builds
non-unicode
  - added an info message to event log when user auth succeeds

Signed-off-by: Selva Nair <selva.nair@gmail.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1455937988-12414-1-git-send-email-selva.nair@gmail.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/11225
Signed-off-by: Gert Doering <gert@greenie.muc.de>