Add SeCreateSymbolicLinkPrivilege (#4649)

blakerouse · web-flow · commit 5fe8debfade5 · 2024-05-01T15:39:29.000Z
diff --git a/internal/pkg/agent/install/user_windows.go b/internal/pkg/agent/install/user_windows.go
@@ -39,6 +39,8 @@ const (
 	USER_UF_SCRIPT             = 1
 	USER_UF_NORMAL_ACCOUNT     = 512
 	USER_UF_DONT_EXPIRE_PASSWD = 65536
+
+	accountRightCreateSymbolicLink gowin32.AccountRightName = "SeCreateSymbolicLinkPrivilege"
 )
 
 // FindGID returns the group's GID on the machine.
@@ -151,6 +153,10 @@ func CreateUser(name string, _ string) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("failed to set service logon: %w", err)
 	}
+	err = sp.AddAccountRight(sid, accountRightCreateSymbolicLink)
+	if err != nil {
+		return "", fmt.Errorf("failed to add right to create symbolic link: %w", err)
+	}
 
 	return FindUID(name)
 }

Original file line number	Diff line number	Diff line change
`@@ -39,6 +39,8 @@ const (`
`39`	`39`	`USER_UF_SCRIPT = 1`
`40`	`40`	`USER_UF_NORMAL_ACCOUNT = 512`
`41`	`41`	`USER_UF_DONT_EXPIRE_PASSWD = 65536`
	`42`	`+`
	`43`	`+ accountRightCreateSymbolicLink gowin32.AccountRightName = "SeCreateSymbolicLinkPrivilege"`
`42`	`44`	`)`
`43`	`45`
`44`	`46`	`// FindGID returns the group's GID on the machine.`
`@@ -151,6 +153,10 @@ func CreateUser(name string, _ string) (string, error) {`
`151`	`153`	`if err != nil {`
`152`	`154`	`return "", fmt.Errorf("failed to set service logon: %w", err)`
`153`	`155`	`}`
	`156`	`+ err = sp.AddAccountRight(sid, accountRightCreateSymbolicLink)`
	`157`	`+ if err != nil {`
	`158`	`+ return "", fmt.Errorf("failed to add right to create symbolic link: %w", err)`
	`159`	`+ }`
`154`	`160`
`155`	`161`	`return FindUID(name)`
`156`	`162`	`}`