Apply access check when opening a previously pinned program about ebpf-for-windows HOT 4 CLOSED

Program [will consume stubs/headers from PAL work]
Create - Alloc
Open - AccessCheck
ProgramInit
GetProperties

LoadMachineCode - allocating a read only executable page
CreateAndAttachToHook

Pin/Unpin
Uninit/Cleanup [ref count hits 0, the rundown logic]

from ebpf-for-windows.

Looks like the functions to convert SDDL -> SECURITY_DESCRIPTOR aren't in the DDK. Are we ok with passing a self-relative SECURITY_DESCIPTOR instead of an SDDL?

from ebpf-for-windows.

The EbpfIoDevice device object is restricted to:

//
// SDDL_DEVOBJ_SYS_ALL_ADM_ALL allows the kernel, system, and admin complete
// control over the device. No other users may access the device
//

So adding an additional access check here is redundant.

from ebpf-for-windows.

Closing this as an additional access check is pointless given that this API can only be called by admin, kernel or local system.

If we ever loosen the restrictions on the device object, revisit this.

from ebpf-for-windows.