ipc: allow admins but require high integrity label

Might be more reasonable.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

diff --git a/ipc/uapi_windows.go b/ipc/uapi_windows.go
index 3e2709cee64ac9c73d460cec27365e34f9e6b1a3..a4d68da81b8ce7aa2eb1ac85af1e32079ebc8ab2 100644 (file)
--- a/ipc/uapi_windows.go
+++ b/ipc/uapi_windows.go
@@ -54,8 +54,7 @@ var UAPISecurityDescriptor *windows.SECURITY_DESCRIPTOR
 
 func init() {
        var err error
-       /* SDDL_DEVOBJ_SYS_ALL from the WDK */
-       UAPISecurityDescriptor, err = windows.SecurityDescriptorFromString("O:SYD:P(A;;GA;;;SY)")
+       UAPISecurityDescriptor, err = windows.SecurityDescriptorFromString("O:SYD:P(A;;GA;;;SY)(A;;GA;;;BA)S:(ML;;NWNRNX;;;HI)")
        if err != nil {
                panic(err)
        }