[NTOS:SE] Overhaul the token management code.

- Overhaul SepCreateToken() and SepDuplicateToken() so that they
  implement the "variable information area" of the token, where
  immutable lists of user & groups and privileges reside, and the
  "dynamic information area" (allocated separately in paged pool),
  where mutable data such as the token's default DACL is stored.
  Perform the necessary adaptations in SepDeleteToken() and in
  NtSetInformationToken().

- Actually dereference the token's logon session, when needed, in the
  'TokenSessionReference' case in NtSetInformationToken().

- Overhaul SepFindPrimaryGroupAndDefaultOwner() so that it returns
  the indices of candidate primary group and default owner within the
  token's user & groups array. This allows for fixing the 'TokenOwner'
  and 'TokenPrimaryGroup' cases of NtSetInformationToken(), since the
  owner or primary group being set *MUST* already exist in the token's
  user & groups array (as a by-product, memory corruptions that existed
  before due to the broken way of setting these properties disappear too).

- Lock tokens every time operations are performed on them (NOTE: we
  still use a global token lock!).

- Touch the ModifiedId LUID member of tokens everytime a write operation
  (property change, etc...) is made on them.

- Fix some group attributes in the SYSTEM process token, SepCreateSystemProcessToken().

- Make the SeCreateTokenPrivilege mandatory when calling NtCreateToken().

- Update the token pool tags.

- Explicitly use the Ex*ResourceLite() versions of the locking functions
  in the token locking macros.

ntoskrnl/include/internal/se.h

@@ -200,17 +200,17 @@ extern PSECURITY_DESCRIPTOR SeUnrestrictedSd;
 #define SepAcquireTokenLockExclusive(Token)                                    \
 {                                                                              \
     KeEnterCriticalRegion();                                                   \
-    ExAcquireResourceExclusive(((PTOKEN)Token)->TokenLock, TRUE);              \
+    ExAcquireResourceExclusiveLite(((PTOKEN)Token)->TokenLock, TRUE);          \
 }
 #define SepAcquireTokenLockShared(Token)                                       \
 {                                                                              \
     KeEnterCriticalRegion();                                                   \
-    ExAcquireResourceShared(((PTOKEN)Token)->TokenLock, TRUE);                 \
+    ExAcquireResourceSharedLite(((PTOKEN)Token)->TokenLock, TRUE);             \
 }
 
 #define SepReleaseTokenLock(Token)                                             \
 {                                                                              \
-    ExReleaseResource(((PTOKEN)Token)->TokenLock);                             \
+    ExReleaseResourceLite(((PTOKEN)Token)->TokenLock);                         \
     KeLeaveCriticalRegion();                                                   \
 }
 
@@ -345,9 +345,9 @@ SeAuditProcessCreate(IN PEPROCESS Process);
 NTSTATUS
 NTAPI
 SeExchangePrimaryToken(
-    struct _EPROCESS* Process,
+    _In_ PEPROCESS Process,
-    PACCESS_TOKEN NewToken,
+    _In_ PACCESS_TOKEN NewAccessToken,
-    PACCESS_TOKEN* OldTokenP
+    _Out_ PACCESS_TOKEN* OldAccessToken
 );
 
 VOID

ntoskrnl/include/internal/tag.h

@@ -177,9 +177,7 @@
 #define TAG_QOS               'sQeS'
 #define TAG_LUID              'uLeS'
 #define TAG_PRIVILEGE_SET     'rPeS'
-#define TAG_TOKEN_USERS       'uKOT'
+#define TAG_TOKEN_DYNAMIC     'dTeS'
-#define TAG_TOKEN_PRIVILAGES  'pKOT'
-#define TAG_TOKEN_ACL         'kDOT'
 
 /* LPC Tags */
 #define TAG_LPC_MESSAGE   'McpL'

sdk/include/ndk/sefuncs.h

@@ -201,6 +201,7 @@ NtCompareTokens(
     _In_ HANDLE SecondTokenHandle,
     _Out_ PBOOLEAN Equal);
 
+__kernel_entry
 NTSYSCALLAPI
 NTSTATUS
 NTAPI