Adding the HasAdminRights function

Let us determine if the user is able to elevate without a password.

Bug: 717696
Change-Id: I8e5fa4e8de348eac32cd27a046840930d7f5dff8
Reviewed-on: https://chromium-review.googlesource.com/927356
Commit-Queue: Patrick Monette <pmonette@chromium.org>
Reviewed-by: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Greg Thompson <grt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#540952}

chrome/browser/BUILD.gn

@@ -2969,6 +2969,8 @@ jumbo_split_static_library("browser") {
         "conflicts/registry_key_watcher_win.h",
         "conflicts/third_party_conflicts_manager_win.cc",
         "conflicts/third_party_conflicts_manager_win.h",
+        "conflicts/token_util_win.cc",
+        "conflicts/token_util_win.h",
         "conflicts/uninstall_application_win.cc",
         "conflicts/uninstall_application_win.h",
         "google/google_update_win.cc",

chrome/browser/conflicts/token_util_win.cc

+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/conflicts/token_util_win.h"
+
+#include <windows.h>
+
+#include <stdint.h>
+
+#include "base/win/scoped_handle.h"
+
+namespace {
+
+// Checks if the |token| is member of |group_sid|. |token| must be an
+// impersonating token. Use a null handle to check for the token of the current
+// thread. Returns false on error.
+bool IsMemberOfGroupSID(SID* group_sid, HANDLE token) {
+  BOOL is_member = FALSE;
+  return ::CheckTokenMembership(token, group_sid, &is_member) && !!is_member;
+}
+
+}  // namespace
+
+bool HasAdminRights() {
+  // Get the SID for the administrators group.
+  DWORD sid_size = SECURITY_MAX_SID_SIZE;
+  uint8_t sid_bytes[SECURITY_MAX_SID_SIZE];
+  SID* administrators_sid = reinterpret_cast<SID*>(sid_bytes);
+  if (!::CreateWellKnownSid(WinBuiltinAdministratorsSid, nullptr,
+                            administrators_sid, &sid_size)) {
+    return false;
+  }
+
+  // Check if the current token is member of the built-in Administrators group.
+  if (IsMemberOfGroupSID(administrators_sid, nullptr))
+    return true;
+
+  // In the case that UAC is enabled, it's possible that the current token is
+  // filtered. So check the linked token in case it is a member of the built-in
+  // Administrators group.
+  HANDLE current_token = nullptr;
+  if (!::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &current_token))
+    return false;
+  base::win::ScopedHandle scoped_current_token(current_token);
+
+  HANDLE linked_token = nullptr;
+  DWORD linked_token_size = sizeof(linked_token);
+  if (!::GetTokenInformation(scoped_current_token.Get(), TokenLinkedToken,
+                             &linked_token, linked_token_size,
+                             &linked_token_size)) {
+    return false;
+  }
+  base::win::ScopedHandle scoped_linked_token(linked_token);
+
+  return IsMemberOfGroupSID(administrators_sid, scoped_linked_token.Get());
+}

chrome/browser/conflicts/token_util_win.h

+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CONFLICTS_TOKEN_UTIL_WIN_H_
+#define CHROME_BROWSER_CONFLICTS_TOKEN_UTIL_WIN_H_
+
+// Returns true if the current thread token is part of the built-in
+// Administrators group, which is a proxy for determining if the current user
+// has administrator rights.
+bool HasAdminRights();
+
+#endif  // CHROME_BROWSER_CONFLICTS_TOKEN_UTIL_WIN_H_

chrome/browser/ui/startup/startup_browser_creator_impl.cc

@@ -686,22 +686,18 @@ StartupTabs StartupBrowserCreatorImpl::DetermineStartupTabs(
     bool has_incompatible_applications,
     bool are_startup_urls_managed) {
   // Only the New Tab Page or command line URLs may be shown in incognito mode.
-  if (is_incognito_or_guest) {
-    if (!cmd_line_tabs.empty())
-      return cmd_line_tabs;
-
-    return StartupTabs({StartupTab(GURL(chrome::kChromeUINewTabURL), false)});
-  }
-
   // A similar policy exists for crash recovery launches, to prevent getting the
   // user stuck in a crash loop.
-  if (is_post_crash_launch) {
+  if (is_incognito_or_guest || is_post_crash_launch) {
     if (!cmd_line_tabs.empty())
       return cmd_line_tabs;
 
-    StartupTabs tabs = provider.GetPostCrashTabs(has_incompatible_applications);
-    if (!tabs.empty())
-      return tabs;
+    if (is_post_crash_launch) {
+      const StartupTabs tabs =
+          provider.GetPostCrashTabs(has_incompatible_applications);
+      if (!tabs.empty())
+        return tabs;
+    }
 
     return StartupTabs({StartupTab(GURL(chrome::kChromeUINewTabURL), false)});
   }

chrome/browser/ui/startup/startup_browser_creator_impl.h

@@ -148,7 +148,7 @@ class StartupBrowserCreatorImpl {
                                    bool process_startup,
                                    bool is_ephemeral_profile,
                                    bool is_post_crash_launch,
-                                   bool has_problem_applications,
+                                   bool has_incompatible_applications,
                                    bool are_startup_urls_managed);
 
   // Begins an asynchronous session restore if current state allows it (e.g.,

chrome/browser/ui/startup/startup_browser_creator_impl_unittest.cc

@@ -136,7 +136,6 @@ TEST(StartupBrowserCreatorImplTest, DetermineStartupTabs_Incognito) {
                base::CommandLine(base::CommandLine::NO_PROGRAM),
                chrome::startup::IS_FIRST_RUN);
 
-  // Incognito case:
   StartupTabs output = impl.DetermineStartupTabs(provider, StartupTabs(), true,
                                                  true, false, false, false);
   ASSERT_EQ(1U, output.size());

chrome/browser/ui/startup/startup_tab_provider.h

@@ -56,7 +56,7 @@ class StartupTabProvider {
                                         Profile* profile) const = 0;
 
   // Returns the Incompatible Applications settings subpage if any incompatible
-  // applications exists.
+  // applications exist.
   virtual StartupTabs GetPostCrashTabs(
       bool has_incompatible_applications) const = 0;
 };

chrome/browser/ui/webui/settings/md_settings_ui.cc

@@ -55,6 +55,7 @@
 #include "chrome/browser/ui/webui/settings/chrome_cleanup_handler.h"
 #if defined(GOOGLE_CHROME_BUILD)
 #include "chrome/browser/conflicts/problematic_programs_updater_win.h"
+#include "chrome/browser/conflicts/token_util_win.h"
 #include "chrome/browser/ui/webui/settings/incompatible_applications_handler_win.h"
 #include "chrome/grit/chrome_unscaled_resources.h"
 #endif
@@ -232,8 +233,7 @@ MdSettingsUI::MdSettingsUI(content::WebUI* web_ui)
       ProblematicProgramsUpdater::HasCachedPrograms();
   html_source->AddBoolean("showIncompatibleApplications",
                           has_incompatible_applications);
-  // TODO(pmonette): Implement a function to determine hasAdminRights.
-  html_source->AddBoolean("hasAdminRights", true);
+  html_source->AddBoolean("hasAdminRights", HasAdminRights());
 
   if (has_incompatible_applications)
     AddSettingsPageUIHandler(