2 files changed, 72 insertions, 0 deletions
diff --git a/toolkit/components/maintenanceservice/tests/gtest/ServiceStartInteractiveOnly.cpp b/toolkit/components/maintenanceservice/tests/gtest/ServiceStartInteractiveOnly.cpp
new file mode 100644
index 0000000000..beff8e8e47
--- /dev/null
+++ b/toolkit/components/maintenanceservice/tests/gtest/ServiceStartInteractiveOnly.cpp
@@ -0,0 +1,52 @@
+#include "gtest/gtest.h"
+
+#include <stdio.h>
+#include <windows.h>
+#include <sddl.h>
+
+#include "nsWindowsHelpers.h"
+
+TEST(MaintenanceServiceTest, ServiceStartInteractiveOnly)
+{
+  // First, make a restricted token that excludes the Interactive group.
+  SID_AND_ATTRIBUTES sid;
+  DWORD SIDSize = SECURITY_MAX_SID_SIZE;
+  sid.Sid = LocalAlloc(LMEM_FIXED, SIDSize);
+  // Automatically free the SID when we are done with it.
+  UniqueSidPtr uniqueSid(sid.Sid);
+  ASSERT_TRUE(sid.Sid);
+
+  BOOL success =
+      CreateWellKnownSid(WinInteractiveSid, nullptr, sid.Sid, &SIDSize);
+  ASSERT_TRUE(success);
+
+  HANDLE primaryToken;
+  success =
+      OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &primaryToken);
+  // Automatically close the token when we are done with it.
+  nsAutoHandle uniquePrimaryToken(primaryToken);
+  ASSERT_TRUE(success);
+
+  HANDLE restrictedToken;
+  success = CreateRestrictedToken(primaryToken, 0, 1, &sid, 0, nullptr, 0,
+                                  nullptr, &restrictedToken);
+  // Automatically close the token when we are done with it.
+  nsAutoHandle uniqueRestrictedToken(restrictedToken);
+  ASSERT_TRUE(success);
+
+  success = ImpersonateLoggedOnUser(restrictedToken);
+  ASSERT_TRUE(success);
+
+  SC_HANDLE scmHandle =
+      OpenSCManagerW(L"127.0.0.1", nullptr, SC_MANAGER_CONNECT);
+  // Automatically close the SCM when we are done with it.
+  nsAutoServiceHandle uniqueScmHandle(scmHandle);
+  ASSERT_TRUE(scmHandle);
+
+  SC_HANDLE serviceHandle =
+      OpenServiceW(scmHandle, L"MozillaMaintenance", SERVICE_START);
+  // Automatically close the SCM when we are done with it.
+  nsAutoServiceHandle uniqueServiceHandle(serviceHandle);
+  ASSERT_FALSE(serviceHandle);
+  ASSERT_EQ(GetLastError(), static_cast<DWORD>(ERROR_ACCESS_DENIED));
+}
diff --git a/toolkit/components/maintenanceservice/tests/gtest/moz.build b/toolkit/components/maintenanceservice/tests/gtest/moz.build
new file mode 100644
index 0000000000..201f67a69d
--- /dev/null
+++ b/toolkit/components/maintenanceservice/tests/gtest/moz.build
@@ -0,0 +1,20 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+Library("MaintenanceServiceTest")
+
+UNIFIED_SOURCES += [
+    "ServiceStartInteractiveOnly.cpp",
+]
+
+DisableStlWrapping()
+
+OS_LIBS += [
+    "advapi32",
+    "kernel32",
+]
+
+FINAL_LIBRARY = "xul-gtest"