Integrity Levels

Integrity Levels

强制完整性控制 (MIC) 提供了一种机制，用于控制对安全对象的访问。 这种机制是对全权访问控制的补充，在根据对象的全权访问控制列表 (DACL) 进行访问检查之前对访问进行评估。

MIC 使用完整性级别和强制策略来评估访问。 安全主体和安全对象被分配完整性级别，用于确定其保护或访问级别。 例如，具有低完整性级别的主体无法写入具有中等完整性级别的对象，即使该对象的 DACL 允许对主体进行写入访问。

Windows 定义了四个完整性级别：低、中、高和系统。 标准用户接收中级别，提升用户接收高级别。 您启动的进程和创建的对象会接收您的完整性级别（中或高），如果可执行文件的级别较低，则接收低级别；系统服务会接收系统完整性。 缺少完整性标签的对象作系统视为中等；这可以防止低完整性代码修改未标记的对象。 此外，Windows 可确保运行完整性较低的进程无法访问与应用容器关联的进程。

A key rule is that objects can't be modified by processes with a lower integrity level than the object's level. The integrity levels are:

• Untrusted: This level is for processes with anonymous logins. %%%Example: Chrome%%%
• Low: Mainly for internet interactions, especially in Internet Explorer's Protected Mode, affecting associated files and processes, and certain folders like the Temporary Internet Folder. Low integrity processes face significant restrictions, including no registry write access and limited user profile write access.
• Medium: The default level for most activities, assigned to standard users and objects without specific integrity levels. Even members of the Administrators group operate at this level by default.
• High: Reserved for administrators, allowing them to modify objects at lower integrity levels, including those at the high level itself.
• System: The highest operational level for the Windows kernel and core services, out of reach even for administrators, ensuring protection of vital system functions.
• Installer: A unique level that stands above all others, enabling objects at this level to uninstall any other object.

You can get the integrity level of a process using Process Explorer from Sysinternals, accessing the properties of the process and viewing the "Security" tab:

You can also get your current integrity level using whoami /groups

一般用户默认为medium，system和administrator用户默认为high

Integrity Levels in File-system

A object inside the file-system may need an minimum integrity level requirement and if a process doesn't have this integrity process it won't be able to interact with it. For example, lets create a regular from a regular user console file and check the permissions:

Text Only

echo asd >asd.txt
icacls asd.txt
asd.txt BUILTIN\Administrators:(I)(F)
        DESKTOP-IDJHTKP\user:(I)(F)
        NT AUTHORITY\SYSTEM:(I)(F)
        NT AUTHORITY\INTERACTIVE:(I)(M,DC)
        NT AUTHORITY\SERVICE:(I)(M,DC)
        NT AUTHORITY\BATCH:(I)(M,DC)

Now, lets assign a minimum integrity level of High to the file. This must be done from a console running as administrator as a regular console will be running in Medium Integrity level and won't be allowed to assign High Integrity level to an object:

Text Only

icacls asd.txt /setintegritylevel(oi)(ci) High
processed file: asd.txt
Successfully processed 1 files; Failed processing 0 files

C:\Users\Public>icacls asd.txt
asd.txt BUILTIN\Administrators:(I)(F)
        DESKTOP-IDJHTKP\user:(I)(F)
        NT AUTHORITY\SYSTEM:(I)(F)
        NT AUTHORITY\INTERACTIVE:(I)(M,DC)
        NT AUTHORITY\SERVICE:(I)(M,DC)
        NT AUTHORITY\BATCH:(I)(M,DC)
        Mandatory Label\High Mandatory Level:(NW)

This is where things get interesting. You can see that the user DESKTOP-IDJHTKP\user has FULL privileges over the file (indeed this was the user that created the file), however, due to the minimum integrity level implemented he won't be able to modify the file anymore unless he is running inside a High Integrity Level (note that he will be able to read it):

Text Only

echo 1234 > asd.txt
Access is denied.

del asd.txt
C:\Users\Public\asd.txt
Access is denied.

Note

Therefore, when a file has a minimum integrity level, in order to modify it you need to be running at least in that integrity level.

Integrity Levels in Binaries

I made a copy of cmd.exe in C:\Windows\System32\cmd-low.exe and set it an integrity level of low from an administrator console:

Text Only

icacls C:\Windows\System32\cmd-low.exe
C:\Windows\System32\cmd-low.exe NT AUTHORITY\SYSTEM:(I)(F)
                                BUILTIN\Administrators:(I)(F)
                                BUILTIN\Users:(I)(RX)
                                APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:(I)(RX)
                                Mandatory Label\Low Mandatory Level:(NW)

Now, when I run cmd-low.exe it will run under a low-integrity level instead of a medium one:

For curious people, if you assign high integrity level to a binary (icacls C:\Windows\System32\cmd-high.exe /setintegritylevel high) it won't run with high integrity level automatically (if you invoke it from a medium integrity level --by default-- it will run under a medium integrity level).

Integrity Levels in Processes

Not all files and folders have a minimum integrity level, but all processes are running under an integrity level. And similar to what happened with the file-system, if a process wants to write inside another process it must have at least the same integrity level. This means that a process with low integrity level can’t open a handle with full access to a process with medium integrity level.

当用户尝试启动可执行文件时，会创建一个新进程，并且至少具有用户完整性级别和文件完整性级别。 这意味着新进程的执行完整性永远不会高于可执行文件。 如果管理员用户执行低完整性程序，则新进程令牌具有低完整性级别。 这有助于保护启动不可信代码的用户免受该代码执行的恶意行为的影响。 用户数据处于典型的用户完整性级别，可针对此新进程进行写入保护。

Due to the restrictions commented in this and the previous section, from a security point of view, it's always recommended to run a process in the lower level of integrity possible.