From ae7e375a4d5d9074113172e3edede7c1759746a9 Mon Sep 17 00:00:00 2001
From: Eric Kohl <eric.kohl@reactos.org>
Date: Sun, 22 Dec 2024 11:15:37 +0100
Subject: [PATCH] [LSALIB][SECURE32][LSASRV] Improve the check for
 trusted/untrusted callers

- A caller of LsaRegisterLogonProcess is a trusted caller if the calling process has got the Tcb privilege, otherwise it is an untrusted caller.
- A caller of LsaConnectUntrusted is always an untrusted caller.
- A caller of LsapOpenLsaPort is always a trusted caller.
---
 dll/win32/lsasrv/authport.c              | 20 +++++++++++++++++---
 dll/win32/secur32/lsalpc.c               |  4 ++--
 sdk/include/reactos/subsys/lsass/lsass.h |  8 +++++++-
 sdk/lib/lsalib/lsa.c                     |  1 +
 4 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/dll/win32/lsasrv/authport.c b/dll/win32/lsasrv/authport.c
index e8140c0930f..f15faecbde1 100644
--- a/dll/win32/lsasrv/authport.c
+++ b/dll/win32/lsasrv/authport.c
@@ -135,10 +135,24 @@ LsapCheckLogonProcess(PLSA_API_MSG RequestMsg,
     TRACE("New LogonContext: %p\n", Context);
 
     Context->ClientProcessHandle = ProcessHandle;
-    Context->TrustedCaller = RequestMsg->ConnectInfo.TrustedCaller;
 
-    if (Context->TrustedCaller)
-        Context->TrustedCaller = LsapIsTrustedClient(ProcessHandle);
+    switch (RequestMsg->ConnectInfo.TrustedCaller)
+    {
+        case NO:
+            Context->TrustedCaller = FALSE;
+            break;
+
+        case YES:
+            Context->TrustedCaller = TRUE;
+            break;
+
+        case CHECK:
+        default:
+            Context->TrustedCaller = LsapIsTrustedClient(ProcessHandle);
+            break;
+    }
+
+    TRACE("TrustedCaller: %u\n", Context->TrustedCaller);
 
     *LogonContext = Context;
 
diff --git a/dll/win32/secur32/lsalpc.c b/dll/win32/secur32/lsalpc.c
index 131538103c3..1103e6f6f6b 100644
--- a/dll/win32/secur32/lsalpc.c
+++ b/dll/win32/secur32/lsalpc.c
@@ -74,7 +74,7 @@ LsapOpenLsaPort(VOID)
                   sizeof(ConnectInfo));
 
     ConnectInfo.CreateContext = FALSE;
-    ConnectInfo.TrustedCaller = TRUE;
+    ConnectInfo.TrustedCaller = YES;
 
     ConnectInfoLength = sizeof(LSA_CONNECTION_INFO);
     Status = NtConnectPort(&LsaPortHandle,
@@ -175,7 +175,7 @@ LsaConnectUntrusted(
                   ConnectInfoLength);
 
     ConnectInfo.CreateContext = TRUE;
-    ConnectInfo.TrustedCaller = FALSE;
+    ConnectInfo.TrustedCaller = NO;
 
     Status = NtConnectPort(LsaHandle,
                            &PortName,
diff --git a/sdk/include/reactos/subsys/lsass/lsass.h b/sdk/include/reactos/subsys/lsass/lsass.h
index 5522b0ef85f..ad2df3ee2d9 100644
--- a/sdk/include/reactos/subsys/lsass/lsass.h
+++ b/sdk/include/reactos/subsys/lsass/lsass.h
@@ -27,6 +27,12 @@ typedef enum _LSA_API_NUMBER
     LSASS_REQUEST_MAXIMUM
 } LSA_API_NUMBER, *PLSA_API_NUMBER;
 
+typedef enum _LSA_TRUSTED_CALLER
+{
+    NO,
+    YES,
+    CHECK
+} LSA_TRUSTED_CALLER;
 
 typedef struct _LSA_CONNECTION_INFO
 {
@@ -35,7 +41,7 @@ typedef struct _LSA_CONNECTION_INFO
     ULONG Length;
     CHAR LogonProcessNameBuffer[LSASS_MAX_LOGON_PROCESS_NAME_LENGTH + 1];
     BOOL CreateContext;
-    BOOL TrustedCaller;
+    LSA_TRUSTED_CALLER TrustedCaller;
 } LSA_CONNECTION_INFO, *PLSA_CONNECTION_INFO;
 
 
diff --git a/sdk/lib/lsalib/lsa.c b/sdk/lib/lsalib/lsa.c
index 95a02f41cd7..321797e066b 100644
--- a/sdk/lib/lsalib/lsa.c
+++ b/sdk/lib/lsalib/lsa.c
@@ -317,6 +317,7 @@ LsaRegisterLogonProcess(IN PLSA_STRING LogonProcessName,
     ConnectInfo.Length = LogonProcessName->Length;
     ConnectInfo.LogonProcessNameBuffer[ConnectInfo.Length] = ANSI_NULL;
     ConnectInfo.CreateContext = TRUE;
+    ConnectInfo.TrustedCaller = CHECK;
 
     Status = ZwConnectPort(LsaHandle,
                            &PortName,