dotfiles: let the group read the kernel logger ACL it was granted

[dotfiles] / README.md

diff --git a/README.md b/README.md
index aea40620d1cc29d4cb713a6039b6cdbd573edf25..9615defe39c8ea04d48933b99551275328671610 100644 (file)
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ throwaway VM reachable from a Linux host.
 | --- | --- |
 | `setup-windows.bat` | Entry point. Runs the winget installs, then launches the elevated half and prints its log, then runs the non-elevated script. |
 | `setup-windows-no-uac.ps1` | The non-elevated, per-user half: WinMerge and BinSkim on the user `PATH`, and the global git config (identity, plus `core.sshCommand`). Can also be run directly from an ordinary prompt. |
 | --- | --- |
 | `setup-windows.bat` | Entry point. Runs the winget installs, then launches the elevated half and prints its log, then runs the non-elevated script. |
 | `setup-windows-no-uac.ps1` | The non-elevated, per-user half: WinMerge and BinSkim on the user `PATH`, and the global git config (identity, plus `core.sshCommand`). Can also be run directly from an ordinary prompt. |

-| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs the OpenSSH Client and Server capabilities and starts `sshd`, unpacks the `rsync-windows` release zip for this architecture (`rsync.exe` plus the `ssh.exe` it runs) into `C:\Tools\rsync` on the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit, and finally grants one ordinary account the rights to collect ETW traces without elevation. Can also be run directly from an Administrator prompt — pass `-TraceUser DOMAIN\user` to say who gets those rights. |
+| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs the OpenSSH Client and Server capabilities and starts `sshd`, unpacks the `rsync-windows` release zip for this architecture (`rsync.exe` plus the `ssh.exe` it runs) into `C:\Tools\rsync` on the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit, and finally grants one ordinary account the rights to collect ETW traces without elevation. Can also be run directly from an Administrator prompt — pass `-TraceUser DOMAIN\user` to say who gets those rights, and `-EtwRightsOnly` to do that step alone. |

 | `setup-windows-7-test-env.bat` | Prepares a **Windows 7 VM** as a test target driven from the host by `VBoxManage guestcontrol`. Copy it into the guest and run it there; it is idempotent, so re-run it after any snapshot restore. The per-user half needs no UAC (crash-dialog suppression, no screen blanking, a staging directory, the shared folder on `Z:`); the machine-wide half is skipped with a notice unless run elevated inside the guest. It then reports what the box can actually test: DWM composition, printers, audio capture devices. |
 
 ## Usage
 | `setup-windows-7-test-env.bat` | Prepares a **Windows 7 VM** as a test target driven from the host by `VBoxManage guestcontrol`. Copy it into the guest and run it there; it is idempotent, so re-run it after any snapshot restore. The per-user half needs no UAC (crash-dialog suppression, no screen blanking, a staging directory, the shared folder on `Z:`); the machine-wide half is skipped with a notice unless run elevated inside the guest. It then reports what the box can actually test: DWM composition, printers, audio capture devices. |
 
 ## Usage


@@ -145,27 +145,48 @@ throwaway VM reachable from a Linux host.
   wpr -start GeneralProfile  -> Failed to enable the policy to profile system performance.
   ```
 
   wpr -start GeneralProfile  -> Failed to enable the policy to profile system performance.
   ```
 

-  Creating or controlling *any* ETW session — even a user-mode one naming a
-  single provider — is checked against the security descriptor ETW keeps per
-  provider GUID under `HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security`, whose
-  default grants the session-control rights to SYSTEM, Administrators, the
-  service accounts and `BUILTIN\Performance Log Users`, and to nobody else.
-  Switching on the *kernel* provider on top of that additionally needs the
-  `SeSystemProfilePrivilege` user right ("Profile system performance"), held by
-  default only by Administrators and `NT SERVICE\WdiServiceHost` — that is the
-  one `wpr` names. So the elevated half grants the privilege to the **group** and
-  puts the account in the group; enabling another account afterwards is just
-  `net localgroup "Performance Log Users" <user> /add`. `SeDebugPrivilege` is
-  deliberately *not* granted: CPU sampling and stack walks of your own processes
-  do not need it, and it is equivalent to handing out administrator.
-
-  Two consequences worth knowing. Both a privilege and a group membership are
+  Three separate things are in the way, and all three have to be dealt with:
+
+  1. Creating or controlling *any* ETW session — even a user-mode one naming a
+     single provider — is checked against the security descriptor ETW keeps per
+     provider GUID under `HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security`,
+     whose **default** grants the session-control rights to SYSTEM,
+     Administrators, the service accounts and `BUILTIN\Performance Log Users`,
+     and to nobody else.
+  2. Switching on the *kernel* provider needs the `SeSystemProfilePrivilege` user
+     right ("Profile system performance"), held by default only by
+     Administrators and `NT SERVICE\WdiServiceHost` — that is the one `wpr`
+     names.
+  3. The kernel logger is not covered by that default descriptor.
+     `SystemTraceControlGuid` — the session both `xperf -on` and `wpr` drive —
+     carries an explicit one that does not mention Performance Log Users. With
+     1 and 2 in place a user-mode session starts and the privilege is held, and
+     `xperf -on base` *still* answers "NT Kernel Logger: Access is denied" while
+     `wpr`'s error changes to a bare `0x80070005`; even reading that descriptor
+     comes back access-denied, which is the tell. So an ACE for the group is
+     added with `EventAccessControl`, `TRACELOG_ACCESS_KERNEL_LOGGER` included.
+
+  The privilege and the ACE both go to the **group**, and the account then goes
+  into the group, so membership alone is the switch and enabling another account
+  afterwards is just `net localgroup "Performance Log Users" <user> /add`.
+  `SeDebugPrivilege` is deliberately *not* granted: CPU sampling and stack walks
+  of your own processes do not need it, and it is equivalent to handing out
+  administrator. Worth being clear about the cost: a member of that group can
+  capture system-wide kernel traces — process, image, file and registry activity
+  across every account on the box, paths and command lines included.
+
+  Two consequences worth knowing. A privilege and a group membership are both

   read into the access token **at logon**, so the account must sign out and back
   read into the access token **at logon**, so the account must sign out and back

-  in — any new logon does it, and an `ssh` login into the box is the quick way to
-  check without dropping the desktop. And this only helps a **non-admin**
-  account: UAC hands an administrator a filtered token carrying just five
-  harmless privileges, so an admin's ordinary shell still cannot trace however
-  the policy reads. Verify from the target account, unelevated:
+  in for 1 and 2 — any new logon does it, and an `ssh` login into the box is the
+  quick way to check without dropping the desktop. The ACE in 3 is machine state
+  instead, and a logon does nothing for it: ETW reads these descriptors into a
+  cache, so it takes a **reboot** — with the ACE written and readable, `xperf -on
+  base` was still denied from a fresh shell on the running system. Plan on both
+  on a first run. And this only
+  helps a **non-admin** account: UAC hands an administrator a filtered token
+  carrying just five harmless privileges, so an admin's ordinary shell still
+  cannot trace however the policy reads. Verify from the target account,
+  unelevated:

 
   ```powershell
   whoami /priv | findstr SeSystemProfilePrivilege
 
   ```powershell
   whoami /priv | findstr SeSystemProfilePrivilege


@@ -174,6 +195,16 @@ throwaway VM reachable from a Linux host.
 
   Analysis never needed any of this — `wpa.exe` opens an existing `.etl` as a
   plain user. This is only about collection.
 
   Analysis never needed any of this — `wpa.exe` opens an existing `.etl` as a
   plain user. This is only about collection.

+
+  The rights step runs **first** in the elevated half, and `-EtwRightsOnly` runs
+  it and nothing else. It is seconds of LSA and registry work where a full run is
+  dominated by the three Visual Studio passes, which take minutes even with
+  nothing to do:
+
+  ```powershell
+  Start-Process powershell -Verb RunAs -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass',
+      '-File','<repo>\setup-windows-with-uac.ps1','-TraceUser','DOMAIN\user','-EtwRightsOnly'
+  ```

 - The scripts were extracted from a native Windows project, so the component
   selection is tuned for that: Spectre-mitigated runtimes, the v141/XP toolset,
   and driver-kit headers. Trim the component lists in the `.ps1` if you don't
 - The scripts were extracted from a native Windows project, so the component
   selection is tuned for that: Spectre-mitigated runtimes, the v141/XP toolset,
   and driver-kit headers. Trim the component lists in the `.ps1` if you don't