Using smartcards in a service - SCardAccessStartedEvent

# 1

Dear all,

Migrating our core development platform to Windows Vista, one of our Windows services using smartcards is failing.

We have debugged the problem and found that the event provided by the function ScardAccessStartedEvent does not receive notification. This event is supposed to signal when the SmartCard Resource Manager starts. As we have a WaitForSingleObject(event,INFINITE), the service hungs.

Testing the same service as an ordinary executable ( registering with -regserver ) I can see it works properly. In XP it works properly both as an executable and service.

I have read something about Service Hardening in Vista and I guess it may be caused by privilege reduction. So, I've created some code to enumerate the existing privileges when the application is launched as an executable and as a service. These are the results:

COMSERVER registered with -REGSERVER

-

PrivilegeName[SeIncreaseQuotaPrivilege]=Disabled

PrivilegeName[SeSecurityPrivilege]=Disabled

PrivilegeName[SeTakeOwnershipPrivilege]=Disabled

PrivilegeName[SeLoadDriverPrivilege]=Disabled

PrivilegeName[SeSystemProfilePrivilege]=Disabled

PrivilegeName[SeSystemtimePrivilege]=Disabled

PrivilegeName[SeProfileSingleProcessPrivilege]=Disabled

PrivilegeName[SeIncreaseBasePriorityPrivilege]=Disabled

PrivilegeName[SeCreatePagefilePrivilege]=Disabled

PrivilegeName[SeBackupPrivilege]=Disabled

PrivilegeName[SeRestorePrivilege]=Disabled

PrivilegeName[SeShutdownPrivilege]=Disabled

PrivilegeName[SeDebugPrivilege]=Disabled

PrivilegeName[SeSystemEnvironmentPrivilege]=Disabled

PrivilegeName[SeChangeNotifyPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeRemoteShutdownPrivilege]=Disabled

PrivilegeName[SeUndockPrivilege]=Disabled

PrivilegeName[SeManageVolumePrivilege]=Disabled

PrivilegeName[SeImpersonatePrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeCreateGlobalPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeIncreaseWorkingSetPrivilege]=Disabled

PrivilegeName[SeTimeZonePrivilege]=Disabled

PrivilegeName[SeCreateSymbolicLinkPrivilege]=Disabled

COMSERVER registered with -SERVICE

--

PrivilegeName[SeAssignPrimaryTokenPrivilege]=Disabled

PrivilegeName[SeLockMemoryPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeIncreaseQuotaPrivilege]=Disabled

PrivilegeName[SeTcbPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeSecurityPrivilege]=Disabled

PrivilegeName[SeTakeOwnershipPrivilege]=Disabled

PrivilegeName[SeLoadDriverPrivilege]=Disabled

PrivilegeName[SeSystemProfilePrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeSystemtimePrivilege]=Disabled

PrivilegeName[SeProfileSingleProcessPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeIncreaseBasePriorityPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeCreatePagefilePrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeCreatePermanentPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeBackupPrivilege]=Disabled

PrivilegeName[SeRestorePrivilege]=Disabled

PrivilegeName[SeShutdownPrivilege]=Disabled

PrivilegeName[SeDebugPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeAuditPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeSystemEnvironmentPrivilege]=Disabled

PrivilegeName[SeChangeNotifyPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeUndockPrivilege]=Disabled

PrivilegeName[SeManageVolumePrivilege]=Disabled

PrivilegeName[SeImpersonatePrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeCreateGlobalPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeIncreaseWorkingSetPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeTimeZonePrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeCreateSymbolicLinkPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_DEFAULT

Do you have any idea about this strange behaviour of ScardAccessStartedEvent function?

Thanks in advance

SergioOrtiz at 2007-10-8 >

top of Msdn Tech,Software Development for Windows Vista,Application Compatibility for Windows Vista...

# 3

Hello Sergio,

Just to let you know we are looking into this, I will follow up soon with more information.

Thanks,
Louis Shanks

Microsoft AppCompat

LouSha at 2007-10-8 >

# 5

Sergio,

In order to ‘talk to’ the smart card resource manger from a service you must hold the Service SID or the Local System SID or another option is to impersonate a user.

The fact you see this working under the user context would indicate you could get this working as a service by impersonating a user if this is a method you would like to use.

Thanks,
Louis Shanks

Microsoft AppCompat

LouSha at 2007-10-8 >

# 7

Dear Bill,

Thanks for you information. Unfortunately, I'll be out of office for two weeks. People in the office is testing different approaches. I'll report on them when I come back.

Best regards,

SergioOrtiz at 2007-10-8 >

# 9

I have a service that runs under LocalSystem, depends on SCardSvr and
tries to establish a context using:

LONG rv = SCardEstablishContext( SCARD_SCOPE_SYSTEM, NULL, NULL,
&m_handle );

The call returns with SCARD_E_NO_SERVICE...
Am I overlooking something obvious ?
(I do a LoadLibrary on winscard.dll and it loads successfully. It has returned a valid address to all the scard* calls.)

Additional Info:

I start the Service manually after SCardSvr is already running. The
above code works if I call it from a normal EXE that runs under the
current user account. I also tried to establish the context under
SCARD_SCOPE_USER, with the same result. And I also tried to install the
service under LocalService (like SCardSvr), with again the same result.

Any ideas?

Thanks,

Deepak Chawla.

dchawla at 2007-10-8 >

# 11

Hi,

A solution was proposed in the security forum. It seems there was a bug in Beta 2 which prevented access to the smartcard resource managers unless impersonating a user. This was the solution we intuitively tested - impersonating Terminal Services User. RC1 is supposed to solve this issue - no need to impersonate. However, to take full advantage of TS redirection a user must be impersonated - if not, you have only access to local resource manager.

Hope this helps

SergioOrtiz at 2007-10-8 >

Question about 'Using smartcards in a service - SCardAccessStartedEvent', No.772783,Posted by SergioOrtiz

Using smartcards in a service - SCardAccessStartedEvent

Software Development for Windows Vista Hot Topic

Software Development for Windows Vista New Topic

Software Development for Windows Vista

Site Classified