pub struct Token { /* private fields */ }Expand description
Borrowed, zero‑cost view of a token HANDLE (like Path).
Implementations§
Source§impl Token
impl Token
pub unsafe fn new(handle: &HANDLE) -> &Self
Sourcepub fn duplicate(
&self,
access: TOKEN_ACCESS_MASK,
token_type: TOKEN_TYPE,
imp_level: SECURITY_IMPERSONATION_LEVEL,
) -> Result<OwnedToken>
pub fn duplicate( &self, access: TOKEN_ACCESS_MASK, token_type: TOKEN_TYPE, imp_level: SECURITY_IMPERSONATION_LEVEL, ) -> Result<OwnedToken>
Duplicate the referenced token.
Sourcepub fn is_elevated(&self) -> Result<bool>
pub fn is_elevated(&self) -> Result<bool>
Is the token elevated (Vista+ UAC)?
Sourcepub fn integrity_level(&self) -> Result<Sid>
pub fn integrity_level(&self) -> Result<Sid>
Return the integrity-level SID.
Sourcepub fn capabilities(&self) -> Result<Vec<Group>>
pub fn capabilities(&self) -> Result<Vec<Group>>
Enumerate capability SIDs (TokenCapabilities).
Sourcepub fn logon_sid(&self) -> Result<Vec<Group>>
pub fn logon_sid(&self) -> Result<Vec<Group>>
Enumerate the logon SID (TokenLogonSid). Typically returns a single entry.
Sourcepub fn restricted_sids(&self) -> Result<Vec<Group>>
pub fn restricted_sids(&self) -> Result<Vec<Group>>
Enumerate restricted SIDs (TokenRestrictedSids).
Sourcepub fn device_groups(&self) -> Result<Vec<Group>>
pub fn device_groups(&self) -> Result<Vec<Group>>
Enumerate device group SIDs (TokenDeviceGroups).
Sourcepub fn restricted_device_groups(&self) -> Result<Vec<Group>>
pub fn restricted_device_groups(&self) -> Result<Vec<Group>>
Enumerate restricted device group SIDs (TokenRestrictedDeviceGroups).
Sourcepub fn linked_token(&self) -> Result<OwnedToken>
pub fn linked_token(&self) -> Result<OwnedToken>
For filtered admin tokens, return the linked administrator token.
Sourcepub fn elevation_type(&self) -> Result<TOKEN_ELEVATION_TYPE>
pub fn elevation_type(&self) -> Result<TOKEN_ELEVATION_TYPE>
Retrieve the token’s elevation type (default, limited, or full).
Sourcepub fn impersonation_level(&self) -> Result<SECURITY_IMPERSONATION_LEVEL>
pub fn impersonation_level(&self) -> Result<SECURITY_IMPERSONATION_LEVEL>
Retrieve the impersonation level (only valid for impersonation tokens).
Sourcepub fn has_restrictions(&self) -> Result<bool>
pub fn has_restrictions(&self) -> Result<bool>
Does the token have any restrictions (sandboxed / filtered token)?
Sourcepub fn virtualization_allowed(&self) -> Result<bool>
pub fn virtualization_allowed(&self) -> Result<bool>
Is process virtualization allowed for this token (UAC file/registry virtualization)?
Sourcepub fn virtualization_enabled(&self) -> Result<bool>
pub fn virtualization_enabled(&self) -> Result<bool>
Is process virtualization currently enabled for this token?
Sourcepub fn is_app_container(&self) -> Result<bool>
pub fn is_app_container(&self) -> Result<bool>
Is this token an AppContainer token?
Sourcepub fn is_primary(&self) -> Result<bool>
pub fn is_primary(&self) -> Result<bool>
Is this a primary token (TokenPrimary) as opposed to an impersonation token?
Sourcepub fn primary_group(&self) -> Result<Sid>
pub fn primary_group(&self) -> Result<Sid>
Return the token’s primary group SID.
Sourcepub fn privileges(&self) -> Result<Vec<Privilege>>
pub fn privileges(&self) -> Result<Vec<Privilege>>
Enumerate privileges contained in the token.
Sourcepub fn adjust_privileges(&self, privs: &[Privilege]) -> Result<()>
pub fn adjust_privileges(&self, privs: &[Privilege]) -> Result<()>
Adjust multiple privileges in one go. The token must have
TOKEN_ADJUST_PRIVILEGES access. Each Privilege decides whether
it should be enabled (Privilege::new(name, true)) or disabled
(Privilege::new(name, false)).
Sourcepub fn check_membership(&self, sid: &Sid) -> Result<bool>
pub fn check_membership(&self, sid: &Sid) -> Result<bool>
Check whether this token contains the specified SID (group membership).
Sourcepub fn ui_access(&self) -> Result<bool>
pub fn ui_access(&self) -> Result<bool>
Does the token have UIAccess privilege (non-elevated UI automation)?
Sourcepub fn app_container_sid(&self) -> Result<Option<Sid>>
pub fn app_container_sid(&self) -> Result<Option<Sid>>
Return the app-container SID associated with this token, or None if the token is not an AppContainer.
Sourcepub fn app_container_number(&self) -> Result<u32>
pub fn app_container_number(&self) -> Result<u32>
Return the app-container number assigned by the system.
Sourcepub fn adjust_groups(&self, groups: &[Group]) -> Result<()>
pub fn adjust_groups(&self, groups: &[Group]) -> Result<()>
Adjust multiple group states in one go. The token must have
TOKEN_ADJUST_GROUPS access. Each Group instance specifies the
desired attribute flags for an existing SID in the token. For
example, to enable a group, include the SE_GROUP_ENABLED attribute;
to disable it, omit that flag. Analogous to adjust_privileges.
Sourcepub fn create_restricted_token(
&self,
flags: CREATE_RESTRICTED_TOKEN_FLAGS,
sids_to_disable: &[Group],
privileges_to_delete: &[Privilege],
sids_to_restrict: &[Group],
) -> Result<OwnedToken>
pub fn create_restricted_token( &self, flags: CREATE_RESTRICTED_TOKEN_FLAGS, sids_to_disable: &[Group], privileges_to_delete: &[Privilege], sids_to_restrict: &[Group], ) -> Result<OwnedToken>
Create a restricted token derived from this token.
flags is a bitmask of CREATE_RESTRICTED_TOKEN_* constants (e.g.
DISABLE_MAX_PRIVILEGE). The various slices correspond to the
parameters of the Win32 CreateRestrictedToken API.