servicesid

Documentation

Index

• Constants
• func Encode(name string) string

Constants

const AnubisServiceName = "Anubis"

anubisServiceName is the name the MSI registers the service under. It is the input to the SID derivation below, so it has to match ServiceInstall/@Name in run/windows/anubis.wxs exactly, case aside.

const AnubisServiceSID = "S-1-5-80-765274699-3418405142-632509039-2036741013-1444054785"

anubisServiceSID is the SID of the NT SERVICE\Anubis virtual account the service runs as, spelled out rather than computed so that the value the installer grants access to is visible in a diff and pinned by a test.

Functions

func Encode

func Encode(name string) string

Encode returns the SID of the NT SERVICE account belonging to a Windows service, in the string form icacls and the rest of Windows accept.

Windows derives these rather than allocating them: it uppercases the service name, encodes it as UTF-16LE, takes the SHA-1 of that, and appends the digest to S-1-5-80 as five little-endian uint32 subauthorities. The service does not have to exist for the SID to be meaningful, which is what lets the installer grant access to the config directory before the service is registered.

The SHA-1 here is Windows' choice of construction, not a security decision of ours. Any other hash would produce a SID that names nothing.

This lives outside service_windows.go on purpose. Nothing in the build or in CI runs Windows, so anything behind that build constraint is compiled and never executed; keeping the arithmetic portable is what makes it testable.