- Implement access masks and optional inheritability for console handles. Currently, only CsrDuplicateHandle actually checks the access mask.

- CreateFileW: Pass CONIN$/CONOUT$ opens to OpenConsoleW.
- DuplicateConsoleHandle: Remove ProcessId from request structure, since console handles can only be duplicated in the calling process.
                          Don't check low bits of handle (Windows ignores them), but do check options and (if DUPLICATE_SAME_ACCESS is not specified) access mode. 
- OpenConsoleW: Make wsName parameter const; allow any combination of GENERIC_READ and GENERIC_WRITE, don't require both.
- CreateConsoleScreenBuffer: Add parameter checks; return INVALID_HANDLE_VALUE (not FALSE) on failure.
- Remove remnants of unnecessary handle in Get/SetConsoleTitle.
- CsrDuplicateHandle: Implement DUPLICATE_CLOSE_SOURCE and DUPLICATE_SAME_ACCESS options.

svn path=/trunk/; revision=34685

reactos/dll/win32/kernel32/file/create.c

@@ -99,12 +99,21 @@ HANDLE STDCALL CreateFileW (LPCWSTR			lpFileName,
    HANDLE FileHandle;
    NTSTATUS Status;
    ULONG FileAttributes, Flags = 0;
-   CSR_API_MESSAGE Request;
    PVOID EaBuffer = NULL;
    ULONG EaLength = 0;
 
    TRACE("CreateFileW(lpFileName %S)\n",lpFileName);
 
+   /* check for console input/output */
+   if (0 == _wcsicmp(L"CONOUT$", lpFileName)
+       || 0 == _wcsicmp(L"CONIN$", lpFileName))
+   {
+      return OpenConsoleW(lpFileName,
+                          dwDesiredAccess, 
+                          lpSecurityAttributes ? lpSecurityAttributes->bInheritHandle : FALSE,
+                          dwCreationDisposition);
+   }
+
    /* validate & translate the creation disposition */
    switch (dwCreationDisposition)
      {
@@ -187,44 +196,6 @@ HANDLE STDCALL CreateFileW (LPCWSTR			lpFileName,
 
    /* FILE_FLAG_POSIX_SEMANTICS is handled later */
 
-   /* check for console output */
-   if (0 == _wcsicmp(L"CONOUT$", lpFileName))
-   {
-      /* FIXME: Send required access rights to Csrss */
-      Status = CsrClientCallServer(&Request,
-			           NULL,
-			           MAKE_CSR_API(GET_OUTPUT_HANDLE, CSR_NATIVE),
-			           sizeof(CSR_API_MESSAGE));
-      if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = Request.Status))
-      {
-         SetLastErrorByStatus(Status);
-	 return INVALID_HANDLE_VALUE;
-      }
-      else
-      {
-         return Request.Data.GetOutputHandleRequest.OutputHandle;
-      }
-   }
-
-   /* check for console input */
-   if (0 == _wcsicmp(L"CONIN$", lpFileName))
-   {
-      /* FIXME: Send required access rights to Csrss */
-      Status = CsrClientCallServer(&Request,
-			           NULL,
-			           MAKE_CSR_API(GET_INPUT_HANDLE, CSR_NATIVE),
-			           sizeof(CSR_API_MESSAGE));
-      if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = Request.Status))
-      {
-         SetLastErrorByStatus(Status);
-	 return INVALID_HANDLE_VALUE;
-      }
-      else
-      {
-         return Request.Data.GetInputHandleRequest.InputHandle;
-      }
-   }
-
    /* validate & translate the filename */
    if (!RtlDosPathNameToNtPathName_U (lpFileName,
 				      &NtPathU,

reactos/dll/win32/kernel32/include/kernel32.h

@@ -66,7 +66,7 @@ BOOL STDCALL CloseConsoleHandle(HANDLE Handle);
 HANDLE STDCALL
 GetConsoleInputWaitHandle (VOID);
 
-HANDLE STDCALL OpenConsoleW (LPWSTR wsName,
+HANDLE STDCALL OpenConsoleW (LPCWSTR wsName,
 			     DWORD  dwDesiredAccess,
 			     BOOL   bInheritHandle,
 			     DWORD  dwCreationDistribution);

reactos/dll/win32/kernel32/misc/console.c

@@ -264,7 +264,9 @@ DuplicateConsoleHandle (HANDLE	hConsole,
   ULONG CsrRequest;
   NTSTATUS Status;
 
-  if (IsConsoleHandle (hConsole) == FALSE)
+  if (dwOptions & ~(DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)
+      || (!(dwOptions & DUPLICATE_SAME_ACCESS)
+          && dwDesiredAccess & ~(GENERIC_READ | GENERIC_WRITE)))
     {
       SetLastError (ERROR_INVALID_PARAMETER);
       return INVALID_HANDLE_VALUE;
@@ -272,7 +274,9 @@ DuplicateConsoleHandle (HANDLE	hConsole,
 
   CsrRequest = MAKE_CSR_API(DUPLICATE_HANDLE, CSR_NATIVE);
   Request.Data.DuplicateHandleRequest.Handle = hConsole;
-  Request.Data.DuplicateHandleRequest.ProcessId = GetTeb()->Cid.UniqueProcess;
+  Request.Data.DuplicateHandleRequest.Access = dwDesiredAccess;
+  Request.Data.DuplicateHandleRequest.Inheritable = bInheritHandle;
+  Request.Data.DuplicateHandleRequest.Options = dwOptions;
   Status = CsrClientCallServer(&Request,
 			       NULL,
 			       CsrRequest,
@@ -899,7 +903,7 @@ InvalidateConsoleDIBits (DWORD	Unknown0,
  * @unimplemented
  */
 HANDLE STDCALL
-OpenConsoleW (LPWSTR  wsName,
+OpenConsoleW (LPCWSTR  wsName,
 	      DWORD   dwDesiredAccess,
 	      BOOL    bInheritHandle,
 	      DWORD   dwCreationDistribution)
@@ -909,25 +913,22 @@ OpenConsoleW (LPWSTR  wsName,
 {
   CSR_API_MESSAGE Request; ULONG CsrRequest;
   
-  PHANDLE           phConsole = NULL;
   NTSTATUS          Status = STATUS_SUCCESS;
 
   if(0 == _wcsicmp(wsName, L"CONIN$"))
   {
     CsrRequest = MAKE_CSR_API(GET_INPUT_HANDLE, CSR_NATIVE);
-    phConsole = & Request.Data.GetInputHandleRequest.InputHandle;
   }
   else if (0 == _wcsicmp(wsName, L"CONOUT$"))
   {
     CsrRequest = MAKE_CSR_API(GET_OUTPUT_HANDLE, CSR_NATIVE);
-    phConsole = & Request.Data.GetOutputHandleRequest.OutputHandle;
   }
   else
   {
     SetLastError(ERROR_INVALID_PARAMETER);
     return(INVALID_HANDLE_VALUE);
   }
-  if ((GENERIC_READ|GENERIC_WRITE) != dwDesiredAccess)
+  if (dwDesiredAccess & ~(GENERIC_READ|GENERIC_WRITE))
   {
     SetLastError(ERROR_INVALID_PARAMETER);
     return(INVALID_HANDLE_VALUE);
@@ -937,6 +938,9 @@ OpenConsoleW (LPWSTR  wsName,
     SetLastError(ERROR_INVALID_PARAMETER);
     return(INVALID_HANDLE_VALUE);
   }
+  /* Structures for GET_INPUT_HANDLE and GET_OUTPUT_HANDLE requests are identical */
+  Request.Data.GetInputHandleRequest.Access = dwDesiredAccess;
+  Request.Data.GetInputHandleRequest.Inheritable = bInheritHandle;
   Status = CsrClientCallServer(& Request,
 			       NULL,
 			       CsrRequest,
@@ -946,7 +950,7 @@ OpenConsoleW (LPWSTR  wsName,
     SetLastErrorByStatus(Status);
     return INVALID_HANDLE_VALUE;
   }
-  return(*phConsole);
+  return Request.Data.GetInputHandleRequest.InputHandle;
 }
 
 
@@ -3476,17 +3480,29 @@ CreateConsoleScreenBuffer(
 	LPVOID				 lpScreenBufferData
 	)
 {
-   // FIXME: don't ignore access, share mode, and security
    CSR_API_MESSAGE Request; ULONG CsrRequest;
 
    NTSTATUS Status;
 
+   if (dwDesiredAccess & ~(GENERIC_READ | GENERIC_WRITE)
+       || dwShareMode & ~(FILE_SHARE_READ | FILE_SHARE_WRITE)
+       || dwFlags != CONSOLE_TEXTMODE_BUFFER)
+   {
+      SetLastError(ERROR_INVALID_PARAMETER);
+      return INVALID_HANDLE_VALUE;
+   }
+
+   Request.Data.CreateScreenBufferRequest.Access = dwDesiredAccess;
+   Request.Data.CreateScreenBufferRequest.ShareMode = dwShareMode;
+   Request.Data.CreateScreenBufferRequest.Inheritable =
+      lpSecurityAttributes ? lpSecurityAttributes->bInheritHandle : FALSE;
+
    CsrRequest = MAKE_CSR_API(CREATE_SCREEN_BUFFER, CSR_CONSOLE);
    Status = CsrClientCallServer( &Request, NULL, CsrRequest, sizeof( CSR_API_MESSAGE ) );
    if( !NT_SUCCESS( Status ) || !NT_SUCCESS( Status = Request.Status ) )
       {
 	 SetLastErrorByStatus ( Status );
-	 return FALSE;
+	 return INVALID_HANDLE_VALUE;
       }
    return Request.Data.CreateScreenBufferRequest.OutputHandle;
 }

reactos/include/reactos/subsys/csrss/csrss.h

@@ -180,7 +180,9 @@ typedef struct
 
 typedef struct
 {
-  /* may want to add some parameters here someday */
+   DWORD Access;
+   DWORD ShareMode;
+   BOOL Inheritable;
    HANDLE OutputHandle;  /* handle to newly created screen buffer */
 } CSRSS_CREATE_SCREEN_BUFFER, *PCSRSS_CREATE_SCREEN_BUFFER;
 
@@ -197,14 +199,12 @@ typedef struct
 
 typedef struct
 {
-  HANDLE Console;
   DWORD Length;
   WCHAR Title[0];
 } CSRSS_SET_TITLE, *PCSRSS_SET_TITLE;
 
 typedef struct
 {
-  HANDLE ConsoleHandle;
   DWORD Length;
   WCHAR Title[0];
 } CSRSS_GET_TITLE, *PCSRSS_GET_TITLE;
@@ -312,11 +312,15 @@ typedef struct
 
 typedef struct
 {
+  DWORD Access;
+  BOOL Inheritable;
   HANDLE InputHandle;
 } CSRSS_GET_INPUT_HANDLE, *PCSRSS_GET_INPUT_HANDLE;
 
 typedef struct
 {
+  DWORD Access;
+  BOOL Inheritable;
   HANDLE OutputHandle;
 } CSRSS_GET_OUTPUT_HANDLE, *PCSRSS_GET_OUTPUT_HANDLE;
 
@@ -333,7 +337,9 @@ typedef struct
 typedef struct
 {
   HANDLE Handle;
-  HANDLE ProcessId;
+  DWORD Access;
+  BOOL Inheritable;
+  DWORD Options;
 } CSRSS_DUPLICATE_HANDLE, *PCSRSS_DUPLICATE_HANDLE;
 
 #define CONSOLE_HARDWARE_STATE_GET 0

reactos/subsystems/win32/csrss/api/handle.c

@@ -61,7 +61,7 @@ CsrRegisterObjectDefinitions(PCSRSS_OBJECT_DEFINITION NewDefinitions)
   return STATUS_SUCCESS;
 }
 
-NTSTATUS STDCALL CsrGetObject( PCSRSS_PROCESS_DATA ProcessData, HANDLE Handle, Object_t **Object )
+NTSTATUS STDCALL CsrGetObject( PCSRSS_PROCESS_DATA ProcessData, HANDLE Handle, Object_t **Object, DWORD Access )
 {
   ULONG h = (ULONG)Handle >> 2;
   DPRINT("CsrGetObject, Object: %x, %x, %x\n", Object, Handle, ProcessData ? ProcessData->HandleTableSize : 0);
@@ -72,7 +72,8 @@ NTSTATUS STDCALL CsrGetObject( PCSRSS_PROCESS_DATA ProcessData, HANDLE Handle, O
     }
   RtlEnterCriticalSection(&ProcessData->HandleTableLock);
   if (!CsrIsConsoleHandle(Handle) || h >= ProcessData->HandleTableSize
-      || (*Object = ProcessData->HandleTable[h]) == NULL)
+      || (*Object = ProcessData->HandleTable[h].Object) == NULL
+      || ~ProcessData->HandleTable[h].Access & Access)
     {
       DPRINT1("CsrGetObject returning invalid handle (%x)\n", Handle);
       RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
@@ -127,18 +128,22 @@ CsrReleaseObject(PCSRSS_PROCESS_DATA ProcessData,
     }
   RtlEnterCriticalSection(&ProcessData->HandleTableLock);
   if (!CsrIsConsoleHandle(Handle) || h >= ProcessData->HandleTableSize
-      || (Object = ProcessData->HandleTable[h]) == NULL)
+      || (Object = ProcessData->HandleTable[h].Object) == NULL)
     {
       RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
       return STATUS_INVALID_HANDLE;
     }
-  ProcessData->HandleTable[h] = NULL;
+  ProcessData->HandleTable[h].Object = NULL;
   RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
 
   return CsrReleaseObjectByPointer(Object);
 }
 
-NTSTATUS STDCALL CsrInsertObject( PCSRSS_PROCESS_DATA ProcessData, PHANDLE Handle, Object_t *Object )
+NTSTATUS STDCALL CsrInsertObject(PCSRSS_PROCESS_DATA ProcessData,
+                                 PHANDLE Handle,
+                                 Object_t *Object,
+                                 DWORD Access,
+                                 BOOL Inheritable)
 {
    ULONG i;
    PVOID* Block;
@@ -152,7 +157,7 @@ NTSTATUS STDCALL CsrInsertObject( PCSRSS_PROCESS_DATA ProcessData, PHANDLE Handl
 
    for (i = 0; i < ProcessData->HandleTableSize; i++)
      {
-	if (ProcessData->HandleTable[i] == NULL)
+	if (ProcessData->HandleTable[i].Object == NULL)
 	  {
             break;
 	  }
@@ -161,7 +166,7 @@ NTSTATUS STDCALL CsrInsertObject( PCSRSS_PROCESS_DATA ProcessData, PHANDLE Handl
      {
        Block = RtlAllocateHeap(CsrssApiHeap,
 			       HEAP_ZERO_MEMORY,
-			       (ProcessData->HandleTableSize + 64) * sizeof(HANDLE));
+			       (ProcessData->HandleTableSize + 64) * sizeof(CSRSS_HANDLE));
        if (Block == NULL)
          {
            RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
@@ -169,12 +174,14 @@ NTSTATUS STDCALL CsrInsertObject( PCSRSS_PROCESS_DATA ProcessData, PHANDLE Handl
          }
        RtlCopyMemory(Block,
 		     ProcessData->HandleTable,
-		     ProcessData->HandleTableSize * sizeof(HANDLE));
+		     ProcessData->HandleTableSize * sizeof(CSRSS_HANDLE));
        Block = _InterlockedExchangePointer((volatile void*)&ProcessData->HandleTable, Block);
        RtlFreeHeap( CsrssApiHeap, 0, Block );
        ProcessData->HandleTableSize += 64;
      }
-   ProcessData->HandleTable[i] = Object;
+   ProcessData->HandleTable[i].Object = Object;
+   ProcessData->HandleTable[i].Access = Access;
+   ProcessData->HandleTable[i].Inheritable = Inheritable;
    *Handle = (HANDLE)((i << 2) | 0x3);
    _InterlockedIncrement( &Object->ReferenceCount );
    RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
@@ -199,7 +206,7 @@ NTSTATUS STDCALL CsrDuplicateHandleTable(PCSRSS_PROCESS_DATA SourceProcessData,
 
     TargetProcessData->HandleTable = RtlAllocateHeap(CsrssApiHeap,
 			                             HEAP_ZERO_MEMORY,
-			                             SourceProcessData->HandleTableSize * sizeof(HANDLE));
+			                             SourceProcessData->HandleTableSize * sizeof(CSRSS_HANDLE));
     if (TargetProcessData->HandleTable == NULL)
     {
         RtlLeaveCriticalSection(&SourceProcessData->HandleTableLock);
@@ -208,10 +215,11 @@ NTSTATUS STDCALL CsrDuplicateHandleTable(PCSRSS_PROCESS_DATA SourceProcessData,
     TargetProcessData->HandleTableSize = SourceProcessData->HandleTableSize;
     for (i = 0; i < SourceProcessData->HandleTableSize; i++)
     {
-        if (SourceProcessData->HandleTable[i])
+        if (SourceProcessData->HandleTable[i].Object != NULL
+            && SourceProcessData->HandleTable[i].Inheritable)
         {
             TargetProcessData->HandleTable[i] = SourceProcessData->HandleTable[i];
-            _InterlockedIncrement( &SourceProcessData->HandleTable[i]->ReferenceCount );
+            _InterlockedIncrement( &SourceProcessData->HandleTable[i].Object->ReferenceCount );
         }
     }
    RtlLeaveCriticalSection(&SourceProcessData->HandleTableLock);
@@ -226,12 +234,13 @@ NTSTATUS STDCALL CsrVerifyObject( PCSRSS_PROCESS_DATA ProcessData, HANDLE Handle
     {
       return STATUS_INVALID_PARAMETER;
     }
-  if (!CsrIsConsoleHandle(Handle) || h >= ProcessData->HandleTableSize)
+  if (!CsrIsConsoleHandle(Handle) || h >= ProcessData->HandleTableSize
+      || ProcessData->HandleTable[h].Object == NULL)
     {
       return STATUS_INVALID_HANDLE;
     }
 
-  return ProcessData->HandleTable[h] ? STATUS_SUCCESS : STATUS_INVALID_HANDLE;
+  return STATUS_SUCCESS;
 }
 
 /* EOF */

reactos/subsystems/win32/csrss/api/process.c

@@ -158,9 +158,9 @@ NTSTATUS STDCALL CsrFreeProcessData(HANDLE Pid)
         {
           for (c = 0; c < pProcessData->HandleTableSize; c++)
             {
-              if (pProcessData->HandleTable[c])
+              if (pProcessData->HandleTable[c].Object)
                 {
-                  CsrReleaseObjectByPointer(pProcessData->HandleTable[c]);
+                  CsrReleaseObjectByPointer(pProcessData->HandleTable[c].Object);
                 }
             }
           RtlFreeHeap(CsrssApiHeap, 0, pProcessData->HandleTable);
@@ -337,7 +337,9 @@ CSR_API(CsrGetInputHandle)
    {
       Request->Status = CsrInsertObject(ProcessData,
 		                      &Request->Data.GetInputHandleRequest.InputHandle,
-		                      (Object_t *)ProcessData->Console);
+		                      (Object_t *)ProcessData->Console,
+		                      Request->Data.GetInputHandleRequest.Access,
+		                      Request->Data.GetInputHandleRequest.Inheritable);
    }
    else
    {
@@ -363,7 +365,9 @@ CSR_API(CsrGetOutputHandle)
       RtlEnterCriticalSection(&ProcessDataLock);
       Request->Status = CsrInsertObject(ProcessData,
                                       &Request->Data.GetOutputHandleRequest.OutputHandle,
-                                      &(ProcessData->Console->ActiveBuffer->Header));
+                                      &ProcessData->Console->ActiveBuffer->Header,
+                                      Request->Data.GetOutputHandleRequest.Access,
+                                      Request->Data.GetOutputHandleRequest.Inheritable);
       RtlLeaveCriticalSection(&ProcessDataLock);
    }
    else
@@ -407,31 +411,63 @@ CSR_API(CsrVerifyHandle)
 
 CSR_API(CsrDuplicateHandle)
 {
-  Object_t *Object;
+    ULONG Index;
+    PCSRSS_HANDLE Entry;
+    DWORD DesiredAccess;
 
     Request->Header.u1.s1.TotalLength = sizeof(CSR_API_MESSAGE);
     Request->Header.u1.s1.DataLength = sizeof(CSR_API_MESSAGE) - sizeof(PORT_MESSAGE);
 
-  ProcessData = CsrGetProcessData(Request->Data.DuplicateHandleRequest.ProcessId);
+    if (NULL == ProcessData)
-  if (NULL == ProcessData || ProcessData->Terminated)
     {
-      DPRINT1("Invalid source process %d\n", Request->Data.DuplicateHandleRequest.ProcessId);
+        DPRINT1("Invalid source process\n");
         Request->Status = STATUS_INVALID_PARAMETER;
         return Request->Status;
     }
 
-  Request->Status = CsrGetObject(ProcessData, Request->Data.DuplicateHandleRequest.Handle, &Object);
+    Index = (ULONG)Request->Data.DuplicateHandleRequest.Handle >> 2;
-  if (! NT_SUCCESS(Request->Status))
+    RtlEnterCriticalSection(&ProcessData->HandleTableLock);
+    if (Index >= ProcessData->HandleTableSize
+        || (Entry = &ProcessData->HandleTable[Index])->Object == NULL)
     {
-      DPRINT("CsrGetObject failed, status=%x\n", Request->Status);
+        DPRINT1("Couldn't dup invalid handle %p\n", Request->Data.DuplicateHandleRequest.Handle);
+        Request->Status = STATUS_INVALID_HANDLE;
+        RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
+        return Request->Status;
+    }
+
+    if (Request->Data.DuplicateHandleRequest.Options & DUPLICATE_SAME_ACCESS)
+    {
+        DesiredAccess = Entry->Access;
     }
     else
     {
+        DesiredAccess = Request->Data.DuplicateHandleRequest.Access;
+        /* Make sure the source handle has all the desired flags */
+        if (~Entry->Access & DesiredAccess)
+        {
+            DPRINT1("Handle %p only has access %X; requested %X\n",
+                Request->Data.DuplicateHandleRequest.Handle, Entry->Access, DesiredAccess);
+            Request->Status = STATUS_INVALID_PARAMETER;
+            RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
+            return Request->Status;
+        }
+    }
+    
     Request->Status = CsrInsertObject(ProcessData,
                                       &Request->Data.DuplicateHandleRequest.Handle,
-                                      Object);
+                                      Entry->Object,
-      CsrReleaseObjectByPointer(Object);
+                                      DesiredAccess,
+                                      Request->Data.DuplicateHandleRequest.Inheritable);
+    if (NT_SUCCESS(Request->Status)
+        && Request->Data.DuplicateHandleRequest.Options & DUPLICATE_CLOSE_SOURCE)
+    {
+        /* Close the original handle. This cannot drop the count to 0, since a new handle now exists */
+        _InterlockedDecrement(&Entry->Object->ReferenceCount);
+        Entry->Object = NULL;
     }
+
+    RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
     return Request->Status;
 }
 

reactos/subsystems/win32/csrss/include/api.h

@@ -32,6 +32,13 @@ typedef struct ConsoleInput_t
 
 typedef struct tagCSRSS_CONSOLE *PCSRSS_CONSOLE;
 
+typedef struct _CSRSS_HANDLE
+{
+  Object_t *Object;
+  DWORD Access;
+  BOOL Inheritable;
+} CSRSS_HANDLE, *PCSRSS_HANDLE;
+
 typedef struct _CSRSS_PROCESS_DATA
 {
   PCSRSS_CONSOLE Console;
@@ -39,7 +46,7 @@ typedef struct _CSRSS_PROCESS_DATA
   BOOL bInheritHandles;
   RTL_CRITICAL_SECTION HandleTableLock;
   ULONG HandleTableSize;
-  Object_t ** HandleTable;
+  PCSRSS_HANDLE HandleTable;
   HANDLE ProcessId;
   HANDLE Process;
   ULONG ShutdownLevel;
@@ -125,9 +132,9 @@ NTSTATUS STDCALL CsrEnumProcesses(CSRSS_ENUM_PROCESS_PROC EnumProc, PVOID Contex
 
 /* api/handle.c */
 NTSTATUS FASTCALL CsrRegisterObjectDefinitions(PCSRSS_OBJECT_DEFINITION NewDefinitions);
-NTSTATUS STDCALL CsrInsertObject( PCSRSS_PROCESS_DATA ProcessData, PHANDLE Handle, Object_t *Object );
+NTSTATUS STDCALL CsrInsertObject( PCSRSS_PROCESS_DATA ProcessData, PHANDLE Handle, Object_t *Object, DWORD Access, BOOL Inheritable );
 NTSTATUS STDCALL CsrDuplicateHandleTable(PCSRSS_PROCESS_DATA SourceProcessData, PCSRSS_PROCESS_DATA TargetProcessData);
-NTSTATUS STDCALL CsrGetObject( PCSRSS_PROCESS_DATA ProcessData, HANDLE Handle, Object_t **Object );
+NTSTATUS STDCALL CsrGetObject( PCSRSS_PROCESS_DATA ProcessData, HANDLE Handle, Object_t **Object, DWORD Access );
 BOOL STDCALL CsrServerInitialization (int,char**,char**);
 NTSTATUS STDCALL CsrReleaseObjectByPointer(Object_t *Object);
 NTSTATUS STDCALL CsrReleaseObject( PCSRSS_PROCESS_DATA ProcessData, HANDLE Object );

reactos/subsystems/win32/csrss/include/csrplugin.h

@@ -24,10 +24,13 @@
 
 typedef NTSTATUS (STDCALL *CSRSS_INSERT_OBJECT_PROC)(PCSRSS_PROCESS_DATA ProcessData,
                                                      PHANDLE Handle,
-                                                     Object_t *Object);
+                                                     Object_t *Object,
+                                                     DWORD Access,
+                                                     BOOL Inheritable);
 typedef NTSTATUS (STDCALL *CSRSS_GET_OBJECT_PROC)(PCSRSS_PROCESS_DATA ProcessData,
                                                   HANDLE Handle,
-                                                  Object_t **Object);
+                                                  Object_t **Object,
+                                                  DWORD Access);
 typedef NTSTATUS (STDCALL *CSRSS_RELEASE_OBJECT_BY_POINTER_PROC)(Object_t *Object);
 typedef NTSTATUS (STDCALL *CSRSS_RELEASE_OBJECT_PROC)(PCSRSS_PROCESS_DATA ProcessData,
                                                       HANDLE Object );

reactos/subsystems/win32/csrss/include/win32csr.h

@@ -18,7 +18,9 @@ extern HINSTANCE Win32CsrDllHandle;
 
 NTSTATUS FASTCALL Win32CsrInsertObject(PCSRSS_PROCESS_DATA ProcessData,
                                        PHANDLE Handle,
-                                       Object_t *Object);
+                                       Object_t *Object,
+                                       DWORD Access,
+                                       BOOL Inheritable);
 NTSTATUS FASTCALL Win32CsrLockObject(PCSRSS_PROCESS_DATA ProcessData,
                                      HANDLE Handle,
                                      Object_t **Object,

reactos/subsystems/win32/csrss/win32csr/conio.c

@@ -320,7 +320,9 @@ CSR_API(CsrAllocConsole)
         /* Insert the Objects */
         Status = Win32CsrInsertObject(ProcessData,
                                       &Request->Data.AllocConsoleRequest.InputHandle,
-                                      &Console->Header);
+                                      &Console->Header,
+                                      GENERIC_READ | GENERIC_WRITE,
+                                      TRUE);
         if (! NT_SUCCESS(Status))
         {
             DPRINT1("Failed to insert object\n");
@@ -331,7 +333,9 @@ CSR_API(CsrAllocConsole)
 
         Status = Win32CsrInsertObject(ProcessData,
                                       &Request->Data.AllocConsoleRequest.OutputHandle,
-                                      &Console->ActiveBuffer->Header);
+                                      &Console->ActiveBuffer->Header,
+                                      GENERIC_READ | GENERIC_WRITE,
+                                      TRUE);
         if (!NT_SUCCESS(Status))
         {
             DPRINT1("Failed to insert object\n");
@@ -2048,7 +2052,11 @@ CSR_API(CsrCreateScreenBuffer)
         }
       else
         {
-          Request->Status = Win32CsrInsertObject(ProcessData, &Request->Data.CreateScreenBufferRequest.OutputHandle, &Buff->Header);
+          Request->Status = Win32CsrInsertObject(ProcessData,
+            &Request->Data.CreateScreenBufferRequest.OutputHandle,
+            &Buff->Header,
+            Request->Data.CreateScreenBufferRequest.Access,
+            Request->Data.CreateScreenBufferRequest.Inheritable);
         }
     }
   else
@@ -2182,7 +2190,6 @@ CSR_API(CsrGetTitle)
 
   /* Copy title of the console to the user title buffer */
   RtlZeroMemory(&Request->Data.GetTitleRequest, sizeof(CSRSS_GET_TITLE));
-  Request->Data.GetTitleRequest.ConsoleHandle = Request->Data.GetTitleRequest.ConsoleHandle;
   Request->Data.GetTitleRequest.Length = Console->Title.Length;
   memcpy (Request->Data.GetTitleRequest.Title, Console->Title.Buffer,
           Console->Title.Length);

reactos/subsystems/win32/csrss/win32csr/dllmain.c

@@ -96,9 +96,11 @@ DllMain(HANDLE hDll,
 NTSTATUS FASTCALL
 Win32CsrInsertObject(PCSRSS_PROCESS_DATA ProcessData,
                       PHANDLE Handle,
-                      Object_t *Object)
+                      Object_t *Object,
+                      DWORD Access,
+                      BOOL Inheritable)
 {
-  return (CsrExports.CsrInsertObjectProc)(ProcessData, Handle, Object);
+  return (CsrExports.CsrInsertObjectProc)(ProcessData, Handle, Object, Access, Inheritable);
 }
 
 NTSTATUS FASTCALL
@@ -106,7 +108,7 @@ Win32CsrGetObject(PCSRSS_PROCESS_DATA ProcessData,
                  HANDLE Handle,
                  Object_t **Object)
 {
-  return (CsrExports.CsrGetObjectProc)(ProcessData, Handle, Object);
+  return (CsrExports.CsrGetObjectProc)(ProcessData, Handle, Object, 0);
 }
 
 NTSTATUS FASTCALL
@@ -117,7 +119,7 @@ Win32CsrLockObject(PCSRSS_PROCESS_DATA ProcessData,
 {
   NTSTATUS Status;
 
-  Status = (CsrExports.CsrGetObjectProc)(ProcessData, Handle, Object);
+  Status = (CsrExports.CsrGetObjectProc)(ProcessData, Handle, Object, 0);
   if (! NT_SUCCESS(Status))
     {
       return Status;