Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-03-30 17:10:22 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:SE] Set up an ACL and SD for the anonymous logon

Browse source
This commit is contained in:
George Bișoc 2021-03-13 14:33:15 +01:00 committed by Victor Perevertkin
parent d5c72a2e09
commit b28530d4ac
3 changed files with 42 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ntoskrnl/include/internal/se.h
View file

@ -187,6 +187,7 @@ extern PACL SePublicDefaultUnrestrictedDacl;
extern PACL SePublicOpenDacl; extern PACL SePublicOpenDacl;
extern PACL SePublicOpenUnrestrictedDacl; extern PACL SePublicOpenUnrestrictedDacl;
extern PACL SeUnrestrictedDacl; extern PACL SeUnrestrictedDacl;
extern PACL SeSystemAnonymousLogonDacl;
/* SDs */ /* SDs */
extern PSECURITY_DESCRIPTOR SePublicDefaultSd; extern PSECURITY_DESCRIPTOR SePublicDefaultSd;
@ -195,6 +196,7 @@ extern PSECURITY_DESCRIPTOR SePublicOpenSd;
extern PSECURITY_DESCRIPTOR SePublicOpenUnrestrictedSd; extern PSECURITY_DESCRIPTOR SePublicOpenUnrestrictedSd;
extern PSECURITY_DESCRIPTOR SeSystemDefaultSd; extern PSECURITY_DESCRIPTOR SeSystemDefaultSd;
extern PSECURITY_DESCRIPTOR SeUnrestrictedSd; extern PSECURITY_DESCRIPTOR SeUnrestrictedSd;
extern PSECURITY_DESCRIPTOR SeSystemAnonymousLogonSd;
#define SepAcquireTokenLockExclusive(Token) \ #define SepAcquireTokenLockExclusive(Token) \

26
ntoskrnl/se/acl.c
View file

@ -21,6 +21,7 @@ PACL SePublicDefaultUnrestrictedDacl = NULL;
PACL SePublicOpenDacl = NULL; PACL SePublicOpenDacl = NULL;
PACL SePublicOpenUnrestrictedDacl = NULL; PACL SePublicOpenUnrestrictedDacl = NULL;
PACL SeUnrestrictedDacl = NULL; PACL SeUnrestrictedDacl = NULL;
PACL SeSystemAnonymousLogonDacl = NULL;
/* FUNCTIONS ******************************************************************/ /* FUNCTIONS ******************************************************************/
@ -217,6 +218,31 @@ SepInitDACLs(VOID)
GENERIC_READ | GENERIC_EXECUTE, GENERIC_READ | GENERIC_EXECUTE,
SeRestrictedCodeSid); SeRestrictedCodeSid);
/* create SystemAnonymousLogonDacl */
AclLength = sizeof(ACL) +
(sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
(sizeof(ACE) + RtlLengthSid(SeAnonymousLogonSid));
SeSystemAnonymousLogonDacl = ExAllocatePoolWithTag(PagedPool,
AclLength,
TAG_ACL);
if (SeSystemAnonymousLogonDacl == NULL)
return FALSE;
RtlCreateAcl(SeSystemAnonymousLogonDacl,
AclLength,
ACL_REVISION);
RtlAddAccessAllowedAce(SeSystemAnonymousLogonDacl,
ACL_REVISION,
GENERIC_ALL,
SeWorldSid);
RtlAddAccessAllowedAce(SeSystemAnonymousLogonDacl,
ACL_REVISION,
GENERIC_ALL,
SeAnonymousLogonSid);
return TRUE; return TRUE;
} }

14
ntoskrnl/se/sd.c
View file

@ -21,6 +21,7 @@ PSECURITY_DESCRIPTOR SePublicOpenSd = NULL;
PSECURITY_DESCRIPTOR SePublicOpenUnrestrictedSd = NULL; PSECURITY_DESCRIPTOR SePublicOpenUnrestrictedSd = NULL;
PSECURITY_DESCRIPTOR SeSystemDefaultSd = NULL; PSECURITY_DESCRIPTOR SeSystemDefaultSd = NULL;
PSECURITY_DESCRIPTOR SeUnrestrictedSd = NULL; PSECURITY_DESCRIPTOR SeUnrestrictedSd = NULL;
PSECURITY_DESCRIPTOR SeSystemAnonymousLogonSd = NULL;
/* PRIVATE FUNCTIONS **********************************************************/ /* PRIVATE FUNCTIONS **********************************************************/
@ -107,6 +108,19 @@ SepInitSDs(VOID)
SeUnrestrictedDacl, SeUnrestrictedDacl,
FALSE); FALSE);
/* Create SystemAnonymousLogonSd */
SeSystemAnonymousLogonSd = ExAllocatePoolWithTag(PagedPool,
sizeof(SECURITY_DESCRIPTOR), TAG_SD);
if (SeSystemAnonymousLogonSd == NULL)
return FALSE;
RtlCreateSecurityDescriptor(SeSystemAnonymousLogonSd,
SECURITY_DESCRIPTOR_REVISION);
RtlSetDaclSecurityDescriptor(SeSystemAnonymousLogonSd,
TRUE,
SeSystemAnonymousLogonDacl,
FALSE);
return TRUE; return TRUE;
} }