[WIP] windows: Enable default security parameters on file creation to avoid named pipe exploit

[mattico]

Fixes #42036

As noted in this paper, the threat model for the exploit is a privileged Rust process which accepts a file path from a malicious program. With this exploit, the malicious program can pass a named pipe to the privileged process and gain its elevated privileges.

The fix is to change the default fs::OpenOptions to contain the proper security flags. The .NET FileStream has this same behavior. We're using the SecurityIdentification security level which is more permissive, but still blocks the exploit.

This is technically a breaking change. If someone were using a named pipe to impersonate a program on purpose, they would have to add .security_qos_flags(0) to their OpenOptions to keep working.

[rust-highfive]

r? @aturon

(rust_highfive has picked a reviewer for you, use r? to override)

[pitdicker]

c::SECURITY_SQOS_PRESENT is set automatically when security_qos_flags is not 0 (see line 251).
I wrote the first version of this code, but have not tested these flags. Can you confirm it works?

[mattico]

c::SECURITY_SQOS_PRESENT is set automatically when security_qos_flags is not 0 (see line 251).

I'm aware. I thought that settings both flags at the start was more clear. Don't care much either way.

Can you confirm it works?

Yes. Creating files and named pipes both works fine. I suppose I could add a test for the positive case (creating a named pipe with fs::File::create still works). I thought about adding a test for the negative case (who doesn't want to add an exploit implementation to their test suite?) The exploit paper mentioned that it can be flaky, however:

Additionally, at times the privilege to assign a primary token to a new process will be disabled. This more advanced exploitation will be covered in a future paper.

I can't find the future paper.

[mattico]

Adding [WIP] so this doesn't get merged before I write a test of some sort.

[carols10cents]

Friendly ping @mattico to make sure this doesn't get lost! Do you know when you'll be getting back to this PR?

[mattico]

I haven't forgotten about this PR, but writing tests has exposed some potential issues that warrant a deeper investigation than I have time for at the moment.