Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-06-05 17:30:32 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:SE] Mark the token as no longer belonging to admin group upon effective duplication

Browse source 
A scenario where it happens that an access token belongs to an administrators group but it's disabled (that is, SeAliasAdminsSid has no attributes or it doesn't have SE_GROUP_ENABLED turn ON), the function removes this group from the token but still has TOKEN_HAS_ADMIN_GROUP flag which can lead to erratic behavior across the kernel and security modules -- implying that the token still belongs to administrators group.

This is an oversight from my part.
This commit is contained in:
George Bișoc 2021-11-01 20:35:21 +01:00
parent 17ec81eab8
commit 0129de218b
No known key found for this signature in database
GPG key ID: 688C4FBE25D7DEF6
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
ntoskrnl/se/token.c
View file

@ -1196,6 +1196,20 @@ SepDuplicateToken(
if (AccessToken->UserAndGroups[GroupsIndex].Attributes == 0 || if (AccessToken->UserAndGroups[GroupsIndex].Attributes == 0 ||
(AccessToken->UserAndGroups[GroupsIndex].Attributes & SE_GROUP_ENABLED) == 0) (AccessToken->UserAndGroups[GroupsIndex].Attributes & SE_GROUP_ENABLED) == 0)
{ {
/*
* If this group is an administrators group
* and the token belongs to such group,
* we've to take away TOKEN_HAS_ADMIN_GROUP
* for the fact that's not enabled and as
* such the token no longer belongs to
* this group.
*/
if (RtlEqualSid(SeAliasAdminsSid,
&AccessToken->UserAndGroups[GroupsIndex].Sid))
{
AccessToken->TokenFlags &= ~TOKEN_HAS_ADMIN_GROUP;
}
/* /*
* A group is not enabled, it's time to remove * A group is not enabled, it's time to remove
* from the token and update the groups index * from the token and update the groups index
@ -1203,6 +1217,7 @@ SepDuplicateToken(
*/ */
SepRemoveUserGroupToken(AccessToken, GroupsIndex); SepRemoveUserGroupToken(AccessToken, GroupsIndex);
GroupsIndex--; GroupsIndex--;
continue;
} }
} }
@ -1228,6 +1243,7 @@ SepDuplicateToken(
*/ */
SepRemovePrivilegeToken(AccessToken, PrivilegesIndex); SepRemovePrivilegeToken(AccessToken, PrivilegesIndex);
PrivilegesIndex--; PrivilegesIndex--;
continue;
} }
} }
} }