Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-09-28 05:26:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

[NTOSKRNL] Implement access check for secure open

Browse source
This commit is contained in:
Pierre Schweitzer 2018-09-30 10:49:13 +02:00
parent 0c122589d2
commit 6d0c07c44f
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B
1 changed files with 64 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

65
ntoskrnl/io/iomgr/file.c
View file

@ -641,7 +641,70 @@ IopParseDevice(IN PVOID ParseObject,
((OpenPacket->RelatedFileObject) || (RemainingName->Length)) &&
(!VolumeOpen))
{
DPRINT("Fix Secure FSD support!!!\n");
Privileges = NULL;
GrantedAccess = 0;
KeEnterCriticalRegion();
ExAcquireResourceSharedLite(&IopSecurityResource, TRUE);
/* Lock the subject context */
SeLockSubjectContext(&AccessState->SubjectSecurityContext);
/* Do access check */
AccessGranted = SeAccessCheck(OriginalDeviceObject->SecurityDescriptor,
&AccessState->SubjectSecurityContext,
TRUE,
DesiredAccess,
0,
&Privileges,
&IoFileObjectType->TypeInfo.GenericMapping,
UserMode,
&GrantedAccess,
&Status);
if (Privileges != NULL)
{
/* Append and free the privileges */
SeAppendPrivileges(AccessState, Privileges);
SeFreePrivileges(Privileges);
}
/* Check if we got access */
if (GrantedAccess)
{
AccessState->PreviouslyGrantedAccess |= GrantedAccess;
AccessState->RemainingDesiredAccess &= ~(GrantedAccess | MAXIMUM_ALLOWED);
}
FileString.Length = 8;
FileString.MaximumLength = 8;
FileString.Buffer = L"File";
/* Do Audit/Alarm for open operation
* NOTA: we audit target device object
*/
SeOpenObjectAuditAlarm(&FileString,
DeviceObject,
CompleteName,
OriginalDeviceObject->SecurityDescriptor,
AccessState,
FALSE,
AccessGranted,
UserMode,
&AccessState->GenerateOnClose);
SeUnlockSubjectContext(&AccessState->SubjectSecurityContext);
ExReleaseResourceLite(&IopSecurityResource);
KeLeaveCriticalRegion();
/* Check if access failed */
if (!AccessGranted)
{
/* Dereference the device and fail */
IopDereferenceDeviceObject(OriginalDeviceObject, FALSE);
if (Vpb) IopDereferenceVpbAndFree(Vpb);
return STATUS_ACCESS_DENIED;
}
}
/* Allocate the IRP */