From f0910f33d3adc470720e329e939d8c2d1325811d Mon Sep 17 00:00:00 2001 From: Eric Kohl Date: Fri, 28 May 2010 16:28:27 +0000 Subject: [PATCH] [FORMATTING] No code changes. svn path=/trunk/; revision=47383 --- reactos/ntoskrnl/se/access.c | 48 ++- reactos/ntoskrnl/se/acl.c | 149 ++++--- reactos/ntoskrnl/se/audit.c | 50 +-- reactos/ntoskrnl/se/lsa.c | 12 +- reactos/ntoskrnl/se/priv.c | 235 +++++------ reactos/ntoskrnl/se/sd.c | 368 ++++++++--------- reactos/ntoskrnl/se/semgr.c | 23 +- reactos/ntoskrnl/se/sid.c | 40 +- reactos/ntoskrnl/se/token.c | 758 ++++++++++++++++++----------------- 9 files changed, 856 insertions(+), 827 deletions(-) diff --git a/reactos/ntoskrnl/se/access.c b/reactos/ntoskrnl/se/access.c index 953166f98b3..fdf4f1376b3 100644 --- a/reactos/ntoskrnl/se/access.c +++ b/reactos/ntoskrnl/se/access.c @@ -30,11 +30,12 @@ SeCaptureSubjectContextEx(IN PETHREAD Thread, OUT PSECURITY_SUBJECT_CONTEXT SubjectContext) { BOOLEAN CopyOnOpen, EffectiveOnly; + PAGED_CODE(); - + /* Save the unique ID */ SubjectContext->ProcessAuditId = Process->UniqueProcessId; - + /* Check if we have a thread */ if (!Thread) { @@ -49,7 +50,7 @@ SeCaptureSubjectContextEx(IN PETHREAD Thread, &EffectiveOnly, &SubjectContext->ImpersonationLevel); } - + /* Get the primary token */ SubjectContext->PrimaryToken = PsReferencePrimaryToken(Process); } @@ -75,7 +76,7 @@ NTAPI SeLockSubjectContext(IN PSECURITY_SUBJECT_CONTEXT SubjectContext) { PAGED_CODE(); - + KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite(&SepSubjectContextLock, TRUE); } @@ -88,7 +89,7 @@ NTAPI SeUnlockSubjectContext(IN PSECURITY_SUBJECT_CONTEXT SubjectContext) { PAGED_CODE(); - + ExReleaseResourceLite(&SepSubjectContextLock); KeLeaveCriticalRegion(); } @@ -101,12 +102,12 @@ NTAPI SeReleaseSubjectContext(IN PSECURITY_SUBJECT_CONTEXT SubjectContext) { PAGED_CODE(); - + if (SubjectContext->PrimaryToken != NULL) { ObFastDereferenceObject(&PsGetCurrentProcess()->Token, SubjectContext->PrimaryToken); } - + if (SubjectContext->ClientToken != NULL) { ObDereferenceObject(SubjectContext->ClientToken); @@ -127,6 +128,7 @@ SeCreateAccessStateEx(IN PETHREAD Thread, { ACCESS_MASK AccessMask = Access; PTOKEN Token; + PAGED_CODE(); /* Map the Generic Acess to Specific Access if we have a Mapping */ @@ -150,9 +152,9 @@ SeCreateAccessStateEx(IN PETHREAD Thread, ExpAllocateLocallyUniqueId(&AccessState->OperationID); /* Get the Token to use */ - Token = AccessState->SubjectSecurityContext.ClientToken ? - (PTOKEN)&AccessState->SubjectSecurityContext.ClientToken : - (PTOKEN)&AccessState->SubjectSecurityContext.PrimaryToken; + Token = AccessState->SubjectSecurityContext.ClientToken ? + (PTOKEN)&AccessState->SubjectSecurityContext.ClientToken : + (PTOKEN)&AccessState->SubjectSecurityContext.PrimaryToken; /* Check for Travers Privilege */ if (Token->TokenFlags & TOKEN_HAS_TRAVERSE_PRIVILEGE) @@ -200,6 +202,7 @@ NTAPI SeDeleteAccessState(IN PACCESS_STATE AccessState) { PAUX_ACCESS_DATA AuxData; + PAGED_CODE(); /* Get the Auxiliary Data */ @@ -213,7 +216,8 @@ SeDeleteAccessState(IN PACCESS_STATE AccessState) { ExFreePool(AccessState->ObjectName.Buffer); } - if (AccessState->ObjectTypeName.Buffer) + + if (AccessState->ObjectTypeName.Buffer) { ExFreePool(AccessState->ObjectTypeName.Buffer); } @@ -252,8 +256,9 @@ SeCreateClientSecurity(IN PETHREAD Thread, PACCESS_TOKEN Token; NTSTATUS Status; PACCESS_TOKEN NewToken; + PAGED_CODE(); - + Token = PsReferenceEffectiveToken(Thread, &TokenType, &ThreadEffectiveOnly, @@ -269,7 +274,7 @@ SeCreateClientSecurity(IN PETHREAD Thread, if (Token) ObDereferenceObject(Token); return STATUS_BAD_IMPERSONATION_LEVEL; } - + if ((ImpersonationLevel == SecurityAnonymous) || (ImpersonationLevel == SecurityIdentification) || ((RemoteClient) && (ImpersonationLevel != SecurityDelegation))) @@ -277,12 +282,11 @@ SeCreateClientSecurity(IN PETHREAD Thread, if (Token) ObDereferenceObject(Token); return STATUS_BAD_IMPERSONATION_LEVEL; } - + ClientContext->DirectAccessEffectiveOnly = ((ThreadEffectiveOnly) || - (Qos->EffectiveOnly)) ? - TRUE : FALSE; + (Qos->EffectiveOnly)) ? TRUE : FALSE; } - + if (Qos->ContextTrackingMode == SECURITY_STATIC_TRACKING) { ClientContext->DirectlyAccessClientToken = FALSE; @@ -299,10 +303,10 @@ SeCreateClientSecurity(IN PETHREAD Thread, &ClientContext->ClientTokenControl); #endif } - + NewToken = Token; } - + ClientContext->SecurityQos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE); ClientContext->SecurityQos.ImpersonationLevel = Qos->ImpersonationLevel; ClientContext->SecurityQos.ContextTrackingMode = Qos->ContextTrackingMode; @@ -347,9 +351,9 @@ SeImpersonateClient(IN PSECURITY_CLIENT_CONTEXT ClientContext, IN PETHREAD ServerThread OPTIONAL) { UCHAR b; - + PAGED_CODE(); - + if (ClientContext->DirectlyAccessClientToken == FALSE) { b = ClientContext->SecurityQos.EffectiveOnly; @@ -358,10 +362,12 @@ SeImpersonateClient(IN PSECURITY_CLIENT_CONTEXT ClientContext, { b = ClientContext->DirectAccessEffectiveOnly; } + if (ServerThread == NULL) { ServerThread = PsGetCurrentThread(); } + PsImpersonateClient(ServerThread, ClientContext->ClientToken, 1, diff --git a/reactos/ntoskrnl/se/acl.c b/reactos/ntoskrnl/se/acl.c index 5280ef4a888..35e4a7520e9 100644 --- a/reactos/ntoskrnl/se/acl.c +++ b/reactos/ntoskrnl/se/acl.c @@ -34,189 +34,188 @@ NTAPI SepInitDACLs(VOID) { ULONG AclLength; - + /* create PublicDefaultDacl */ AclLength = sizeof(ACL) + - (sizeof(ACE) + RtlLengthSid(SeWorldSid)) + - (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)); - + (sizeof(ACE) + RtlLengthSid(SeWorldSid)) + + (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)); + SePublicDefaultDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL); if (SePublicDefaultDacl == NULL) return FALSE; - + RtlCreateAcl(SePublicDefaultDacl, AclLength, ACL_REVISION); - + RtlAddAccessAllowedAce(SePublicDefaultDacl, ACL_REVISION, GENERIC_EXECUTE, SeWorldSid); - + RtlAddAccessAllowedAce(SePublicDefaultDacl, ACL_REVISION, GENERIC_ALL, SeLocalSystemSid); - - + /* create PublicDefaultUnrestrictedDacl */ AclLength = sizeof(ACL) + - (sizeof(ACE) + RtlLengthSid(SeWorldSid)) + - (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + - (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) + - (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)); - + (sizeof(ACE) + RtlLengthSid(SeWorldSid)) + + (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + + (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) + + (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)); + SePublicDefaultUnrestrictedDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL); if (SePublicDefaultUnrestrictedDacl == NULL) return FALSE; - + RtlCreateAcl(SePublicDefaultUnrestrictedDacl, AclLength, ACL_REVISION); - + RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl, ACL_REVISION, GENERIC_EXECUTE, SeWorldSid); - + RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl, ACL_REVISION, GENERIC_ALL, SeLocalSystemSid); - + RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl, ACL_REVISION, GENERIC_ALL, SeAliasAdminsSid); - + RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl, ACL_REVISION, GENERIC_READ | GENERIC_EXECUTE | READ_CONTROL, SeRestrictedCodeSid); - + /* create PublicOpenDacl */ AclLength = sizeof(ACL) + - (sizeof(ACE) + RtlLengthSid(SeWorldSid)) + - (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + - (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)); - + (sizeof(ACE) + RtlLengthSid(SeWorldSid)) + + (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + + (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)); + SePublicOpenDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL); if (SePublicOpenDacl == NULL) return FALSE; - + RtlCreateAcl(SePublicOpenDacl, AclLength, ACL_REVISION); - + RtlAddAccessAllowedAce(SePublicOpenDacl, ACL_REVISION, GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE, SeWorldSid); - + RtlAddAccessAllowedAce(SePublicOpenDacl, ACL_REVISION, GENERIC_ALL, SeLocalSystemSid); - + RtlAddAccessAllowedAce(SePublicOpenDacl, ACL_REVISION, GENERIC_ALL, SeAliasAdminsSid); - + /* create PublicOpenUnrestrictedDacl */ AclLength = sizeof(ACL) + - (sizeof(ACE) + RtlLengthSid(SeWorldSid)) + - (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + - (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) + - (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)); - + (sizeof(ACE) + RtlLengthSid(SeWorldSid)) + + (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + + (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) + + (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)); + SePublicOpenUnrestrictedDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL); if (SePublicOpenUnrestrictedDacl == NULL) return FALSE; - + RtlCreateAcl(SePublicOpenUnrestrictedDacl, AclLength, ACL_REVISION); - + RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl, ACL_REVISION, GENERIC_ALL, SeWorldSid); - + RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl, ACL_REVISION, GENERIC_ALL, SeLocalSystemSid); - + RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl, ACL_REVISION, GENERIC_ALL, SeAliasAdminsSid); - + RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl, ACL_REVISION, GENERIC_READ | GENERIC_EXECUTE, SeRestrictedCodeSid); - + /* create SystemDefaultDacl */ AclLength = sizeof(ACL) + - (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + - (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)); - + (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + + (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)); + SeSystemDefaultDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL); if (SeSystemDefaultDacl == NULL) return FALSE; - + RtlCreateAcl(SeSystemDefaultDacl, AclLength, ACL_REVISION); - + RtlAddAccessAllowedAce(SeSystemDefaultDacl, ACL_REVISION, GENERIC_ALL, SeLocalSystemSid); - + RtlAddAccessAllowedAce(SeSystemDefaultDacl, ACL_REVISION, GENERIC_READ | GENERIC_EXECUTE | READ_CONTROL, SeAliasAdminsSid); - + /* create UnrestrictedDacl */ AclLength = sizeof(ACL) + - (sizeof(ACE) + RtlLengthSid(SeWorldSid)) + - (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)); - + (sizeof(ACE) + RtlLengthSid(SeWorldSid)) + + (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)); + SeUnrestrictedDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL); if (SeUnrestrictedDacl == NULL) return FALSE; - + RtlCreateAcl(SeUnrestrictedDacl, AclLength, ACL_REVISION); - + RtlAddAccessAllowedAce(SeUnrestrictedDacl, ACL_REVISION, GENERIC_ALL, SeWorldSid); - + RtlAddAccessAllowedAce(SeUnrestrictedDacl, ACL_REVISION, GENERIC_READ | GENERIC_EXECUTE, SeRestrictedCodeSid); - - return(TRUE); + + return TRUE; } NTSTATUS NTAPI @@ -226,22 +225,22 @@ SepCreateImpersonationTokenDacl(PTOKEN Token, { ULONG AclLength; PVOID TokenDacl; - + PAGED_CODE(); - + AclLength = sizeof(ACL) + (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) + (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)) + (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + (sizeof(ACE) + RtlLengthSid(Token->UserAndGroups->Sid)) + (sizeof(ACE) + RtlLengthSid(PrimaryToken->UserAndGroups->Sid)); - + TokenDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL); if (TokenDacl == NULL) { return STATUS_INSUFFICIENT_RESOURCES; } - + RtlCreateAcl(TokenDacl, AclLength, ACL_REVISION); RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL, Token->UserAndGroups->Sid); @@ -251,7 +250,7 @@ SepCreateImpersonationTokenDacl(PTOKEN Token, SeAliasAdminsSid); RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL, SeLocalSystemSid); - + /* FIXME */ #if 0 if (Token->RestrictedSids != NULL || PrimaryToken->RestrictedSids != NULL) @@ -260,7 +259,7 @@ SepCreateImpersonationTokenDacl(PTOKEN Token, SeRestrictedCodeSid); } #endif - + return STATUS_SUCCESS; } @@ -275,9 +274,9 @@ SepCaptureAcl(IN PACL InputAcl, PACL NewAcl; ULONG AclSize = 0; NTSTATUS Status = STATUS_SUCCESS; - + PAGED_CODE(); - + if (AccessMode != KernelMode) { _SEH2_TRY @@ -296,10 +295,10 @@ SepCaptureAcl(IN PACL InputAcl, _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; - + NewAcl = ExAllocatePool(PoolType, AclSize); - if(NewAcl != NULL) + if (NewAcl != NULL) { _SEH2_TRY { @@ -322,23 +321,23 @@ SepCaptureAcl(IN PACL InputAcl, Status = STATUS_INSUFFICIENT_RESOURCES; } } - else if(!CaptureIfKernel) + else if (!CaptureIfKernel) { *CapturedAcl = InputAcl; } else { AclSize = InputAcl->AclSize; - + NewAcl = ExAllocatePool(PoolType, AclSize); - - if(NewAcl != NULL) + + if (NewAcl != NULL) { RtlCopyMemory(NewAcl, InputAcl, AclSize); - + *CapturedAcl = NewAcl; } else @@ -346,7 +345,7 @@ SepCaptureAcl(IN PACL InputAcl, Status = STATUS_INSUFFICIENT_RESOURCES; } } - + return Status; } @@ -357,10 +356,10 @@ SepReleaseAcl(IN PACL CapturedAcl, IN BOOLEAN CaptureIfKernel) { PAGED_CODE(); - - if(CapturedAcl != NULL && - (AccessMode != KernelMode || - (AccessMode == KernelMode && CaptureIfKernel))) + + if (CapturedAcl != NULL && + (AccessMode != KernelMode || + (AccessMode == KernelMode && CaptureIfKernel))) { ExFreePool(CapturedAcl); } diff --git a/reactos/ntoskrnl/se/audit.c b/reactos/ntoskrnl/se/audit.c index bdd7f93d77a..92b87fa8377 100644 --- a/reactos/ntoskrnl/se/audit.c +++ b/reactos/ntoskrnl/se/audit.c @@ -4,7 +4,7 @@ * FILE: ntoskrnl/se/audit.c * PURPOSE: Audit functions * - * PROGRAMMERS: Eric Kohl + * PROGRAMMERS: Eric Kohl */ /* INCLUDES *******************************************************************/ @@ -47,6 +47,7 @@ SeInitializeProcessAuditName(IN PFILE_OBJECT FileObject, POBJECT_NAME_INFORMATION ObjectNameInfo = NULL; ULONG ReturnLength = 8; NTSTATUS Status; + PAGED_CODE(); ASSERT(AuditInfo); @@ -120,6 +121,7 @@ SeLocateProcessImageName(IN PEPROCESS Process, PUNICODE_STRING ImageName; PFILE_OBJECT FileObject; NTSTATUS Status = STATUS_SUCCESS; + PAGED_CODE(); /* Assume failure */ @@ -189,7 +191,7 @@ SeAuditHardLinkCreation(IN PUNICODE_STRING FileName, IN PUNICODE_STRING LinkName, IN BOOLEAN bSuccess) { - UNIMPLEMENTED; + UNIMPLEMENTED; } /* @@ -200,8 +202,8 @@ NTAPI SeAuditingFileEvents(IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor) { - UNIMPLEMENTED; - return FALSE; + UNIMPLEMENTED; + return FALSE; } /* @@ -213,8 +215,8 @@ SeAuditingFileEventsWithContext(IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL) { - UNIMPLEMENTED; - return FALSE; + UNIMPLEMENTED; + return FALSE; } /* @@ -225,8 +227,8 @@ NTAPI SeAuditingHardLinkEvents(IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor) { - UNIMPLEMENTED; - return FALSE; + UNIMPLEMENTED; + return FALSE; } /* @@ -238,8 +240,8 @@ SeAuditingHardLinkEventsWithContext(IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL) { - UNIMPLEMENTED; - return FALSE; + UNIMPLEMENTED; + return FALSE; } /* @@ -251,8 +253,8 @@ SeAuditingFileOrGlobalEvents(IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext) { - UNIMPLEMENTED; - return FALSE; + UNIMPLEMENTED; + return FALSE; } /* @@ -260,13 +262,11 @@ SeAuditingFileOrGlobalEvents(IN BOOLEAN AccessGranted, */ VOID NTAPI -SeCloseObjectAuditAlarm( - IN PVOID Object, +SeCloseObjectAuditAlarm(IN PVOID Object, IN HANDLE Handle, - IN BOOLEAN PerformAction - ) + IN BOOLEAN PerformAction) { - UNIMPLEMENTED; + UNIMPLEMENTED; } /* @@ -295,10 +295,10 @@ SeOpenObjectAuditAlarm(IN PUNICODE_STRING ObjectTypeName, OUT PBOOLEAN GenerateOnClose) { PAGED_CODE(); - + /* Audits aren't done on kernel-mode access */ if (AccessMode == KernelMode) return; - + /* Otherwise, unimplemented! */ //UNIMPLEMENTED; return; @@ -333,7 +333,7 @@ SePrivilegeObjectAuditAlarm(IN HANDLE Handle, IN BOOLEAN AccessGranted, IN KPROCESSOR_MODE CurrentMode) { - UNIMPLEMENTED; + UNIMPLEMENTED; } /* SYSTEM CALLS ***************************************************************/ @@ -363,7 +363,7 @@ NtCloseObjectAuditAlarm(IN PUNICODE_STRING SubsystemName, IN BOOLEAN GenerateOnClose) { UNIMPLEMENTED; - return(STATUS_NOT_IMPLEMENTED); + return STATUS_NOT_IMPLEMENTED; } @@ -373,7 +373,7 @@ NtDeleteObjectAuditAlarm(IN PUNICODE_STRING SubsystemName, IN BOOLEAN GenerateOnClose) { UNIMPLEMENTED; - return(STATUS_NOT_IMPLEMENTED); + return STATUS_NOT_IMPLEMENTED; } @@ -392,7 +392,7 @@ NtOpenObjectAuditAlarm(IN PUNICODE_STRING SubsystemName, OUT PBOOLEAN GenerateOnClose) { UNIMPLEMENTED; - return(STATUS_NOT_IMPLEMENTED); + return STATUS_NOT_IMPLEMENTED; } @@ -404,7 +404,7 @@ NtPrivilegedServiceAuditAlarm(IN PUNICODE_STRING SubsystemName, IN BOOLEAN AccessGranted) { UNIMPLEMENTED; - return(STATUS_NOT_IMPLEMENTED); + return STATUS_NOT_IMPLEMENTED; } @@ -417,7 +417,7 @@ NtPrivilegeObjectAuditAlarm(IN PUNICODE_STRING SubsystemName, IN BOOLEAN AccessGranted) { UNIMPLEMENTED; - return(STATUS_NOT_IMPLEMENTED); + return STATUS_NOT_IMPLEMENTED; } /* EOF */ diff --git a/reactos/ntoskrnl/se/lsa.c b/reactos/ntoskrnl/se/lsa.c index 15726ad1aa1..b6b36ad6647 100644 --- a/reactos/ntoskrnl/se/lsa.c +++ b/reactos/ntoskrnl/se/lsa.c @@ -110,8 +110,8 @@ NTSTATUS NTAPI SeMarkLogonSessionForTerminationNotification(IN PLUID LogonId) { - UNIMPLEMENTED; - return STATUS_NOT_IMPLEMENTED; + UNIMPLEMENTED; + return STATUS_NOT_IMPLEMENTED; } /* @@ -121,8 +121,8 @@ NTSTATUS NTAPI SeRegisterLogonSessionTerminatedRoutine(IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine) { - UNIMPLEMENTED; - return STATUS_NOT_IMPLEMENTED; + UNIMPLEMENTED; + return STATUS_NOT_IMPLEMENTED; } /* @@ -132,8 +132,8 @@ NTSTATUS NTAPI SeUnregisterLogonSessionTerminatedRoutine(IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine) { - UNIMPLEMENTED; - return STATUS_NOT_IMPLEMENTED; + UNIMPLEMENTED; + return STATUS_NOT_IMPLEMENTED; } /* EOF */ diff --git a/reactos/ntoskrnl/se/priv.c b/reactos/ntoskrnl/se/priv.c index 0766492106a..7cdbd613d1d 100644 --- a/reactos/ntoskrnl/se/priv.c +++ b/reactos/ntoskrnl/se/priv.c @@ -51,7 +51,7 @@ LUID SeEnableDelegationPrivilege; VOID INIT_FUNCTION NTAPI -SepInitPrivileges (VOID) +SepInitPrivileges(VOID) { SeCreateTokenPrivilege.LowPart = SE_CREATE_TOKEN_PRIVILEGE; SeCreateTokenPrivilege.HighPart = 0; @@ -110,25 +110,25 @@ SepInitPrivileges (VOID) BOOLEAN NTAPI -SepPrivilegeCheck (PTOKEN Token, - PLUID_AND_ATTRIBUTES Privileges, - ULONG PrivilegeCount, - ULONG PrivilegeControl, - KPROCESSOR_MODE PreviousMode) +SepPrivilegeCheck(PTOKEN Token, + PLUID_AND_ATTRIBUTES Privileges, + ULONG PrivilegeCount, + ULONG PrivilegeControl, + KPROCESSOR_MODE PreviousMode) { ULONG i; ULONG j; ULONG k; - - DPRINT ("SepPrivilegeCheck() called\n"); - + + DPRINT("SepPrivilegeCheck() called\n"); + PAGED_CODE(); - + if (PreviousMode == KernelMode) { return TRUE; } - + k = 0; if (PrivilegeCount > 0) { @@ -139,10 +139,10 @@ SepPrivilegeCheck (PTOKEN Token, if (Token->Privileges[i].Luid.LowPart == Privileges[j].Luid.LowPart && Token->Privileges[i].Luid.HighPart == Privileges[j].Luid.HighPart) { - DPRINT ("Found privilege\n"); - DPRINT ("Privilege attributes %lx\n", - Token->Privileges[i].Attributes); - + DPRINT("Found privilege\n"); + DPRINT("Privilege attributes %lx\n", + Token->Privileges[i].Attributes); + if (Token->Privileges[i].Attributes & SE_PRIVILEGE_ENABLED) { Privileges[j].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS; @@ -152,58 +152,58 @@ SepPrivilegeCheck (PTOKEN Token, } } } - + if ((PrivilegeControl & PRIVILEGE_SET_ALL_NECESSARY) && PrivilegeCount == k) { return TRUE; } - + if (k > 0 && !(PrivilegeControl & PRIVILEGE_SET_ALL_NECESSARY)) { return TRUE; } - + return FALSE; } NTSTATUS NTAPI -SeCaptureLuidAndAttributesArray (PLUID_AND_ATTRIBUTES Src, - ULONG PrivilegeCount, - KPROCESSOR_MODE PreviousMode, - PLUID_AND_ATTRIBUTES AllocatedMem, - ULONG AllocatedLength, - POOL_TYPE PoolType, - BOOLEAN CaptureIfKernel, - PLUID_AND_ATTRIBUTES* Dest, - PULONG Length) +SeCaptureLuidAndAttributesArray(PLUID_AND_ATTRIBUTES Src, + ULONG PrivilegeCount, + KPROCESSOR_MODE PreviousMode, + PLUID_AND_ATTRIBUTES AllocatedMem, + ULONG AllocatedLength, + POOL_TYPE PoolType, + BOOLEAN CaptureIfKernel, + PLUID_AND_ATTRIBUTES *Dest, + PULONG Length) { ULONG BufferSize; NTSTATUS Status = STATUS_SUCCESS; - + PAGED_CODE(); - + if (PrivilegeCount == 0) { *Dest = 0; *Length = 0; return STATUS_SUCCESS; } - + if (PreviousMode == KernelMode && !CaptureIfKernel) { *Dest = Src; return STATUS_SUCCESS; } - + /* FIXME - check PrivilegeCount for a valid number so we don't cause an integer overflow or exhaust system resources! */ - + BufferSize = PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES); *Length = ROUND_UP(BufferSize, 4); /* round up to a 4 byte alignment */ - + /* probe the buffer */ if (PreviousMode != KernelMode) { @@ -220,7 +220,7 @@ SeCaptureLuidAndAttributesArray (PLUID_AND_ATTRIBUTES Src, } _SEH2_END; } - + /* allocate enough memory or check if the provided buffer is large enough to hold the array */ if (AllocatedMem != NULL) @@ -229,14 +229,13 @@ SeCaptureLuidAndAttributesArray (PLUID_AND_ATTRIBUTES Src, { return STATUS_BUFFER_TOO_SMALL; } - + *Dest = AllocatedMem; } else { *Dest = ExAllocatePool(PoolType, BufferSize); - if (*Dest == NULL) { return STATUS_INSUFFICIENT_RESOURCES; @@ -255,23 +254,23 @@ SeCaptureLuidAndAttributesArray (PLUID_AND_ATTRIBUTES Src, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + if (!NT_SUCCESS(Status) && AllocatedMem == NULL) { ExFreePool(*Dest); } - + return Status; } VOID NTAPI -SeReleaseLuidAndAttributesArray (PLUID_AND_ATTRIBUTES Privilege, - KPROCESSOR_MODE PreviousMode, - BOOLEAN CaptureIfKernel) +SeReleaseLuidAndAttributesArray(PLUID_AND_ATTRIBUTES Privilege, + KPROCESSOR_MODE PreviousMode, + BOOLEAN CaptureIfKernel) { PAGED_CODE(); - + if (Privilege != NULL && (PreviousMode != KernelMode || CaptureIfKernel)) { @@ -307,15 +306,16 @@ SeFreePrivileges(IN PPRIVILEGE_SET Privileges) /* * @implemented */ -BOOLEAN NTAPI -SePrivilegeCheck (PPRIVILEGE_SET Privileges, - PSECURITY_SUBJECT_CONTEXT SubjectContext, - KPROCESSOR_MODE PreviousMode) +BOOLEAN +NTAPI +SePrivilegeCheck(PPRIVILEGE_SET Privileges, + PSECURITY_SUBJECT_CONTEXT SubjectContext, + KPROCESSOR_MODE PreviousMode) { PACCESS_TOKEN Token = NULL; - + PAGED_CODE(); - + if (SubjectContext->ClientToken == NULL) { Token = SubjectContext->PrimaryToken; @@ -328,58 +328,60 @@ SePrivilegeCheck (PPRIVILEGE_SET Privileges, return FALSE; } } - - return SepPrivilegeCheck (Token, - Privileges->Privilege, - Privileges->PrivilegeCount, - Privileges->Control, - PreviousMode); + + return SepPrivilegeCheck(Token, + Privileges->Privilege, + Privileges->PrivilegeCount, + Privileges->Control, + PreviousMode); } /* * @implemented */ -BOOLEAN NTAPI -SeSinglePrivilegeCheck (IN LUID PrivilegeValue, - IN KPROCESSOR_MODE PreviousMode) +BOOLEAN +NTAPI +SeSinglePrivilegeCheck(IN LUID PrivilegeValue, + IN KPROCESSOR_MODE PreviousMode) { SECURITY_SUBJECT_CONTEXT SubjectContext; PRIVILEGE_SET Priv; BOOLEAN Result; - + PAGED_CODE(); - - SeCaptureSubjectContext (&SubjectContext); - + + SeCaptureSubjectContext(&SubjectContext); + Priv.PrivilegeCount = 1; Priv.Control = PRIVILEGE_SET_ALL_NECESSARY; Priv.Privilege[0].Luid = PrivilegeValue; Priv.Privilege[0].Attributes = SE_PRIVILEGE_ENABLED; - - Result = SePrivilegeCheck (&Priv, - &SubjectContext, - PreviousMode); - + + Result = SePrivilegeCheck(&Priv, + &SubjectContext, + PreviousMode); + if (PreviousMode != KernelMode) { #if 0 - SePrivilegedServiceAuditAlarm (0, - &SubjectContext, - &PrivilegeValue); + SePrivilegedServiceAuditAlarm(0, + &SubjectContext, + &PrivilegeValue); #endif } - - SeReleaseSubjectContext (&SubjectContext); - + + SeReleaseSubjectContext(&SubjectContext); + return Result; } /* SYSTEM CALLS ***************************************************************/ -NTSTATUS NTAPI -NtPrivilegeCheck (IN HANDLE ClientToken, - IN PPRIVILEGE_SET RequiredPrivileges, - OUT PBOOLEAN Result) +NTSTATUS +NTAPI +NtPrivilegeCheck(IN HANDLE ClientToken, + IN PPRIVILEGE_SET RequiredPrivileges, + OUT PBOOLEAN Result) { PLUID_AND_ATTRIBUTES Privileges; PTOKEN Token; @@ -389,11 +391,11 @@ NtPrivilegeCheck (IN HANDLE ClientToken, BOOLEAN CheckResult; KPROCESSOR_MODE PreviousMode; NTSTATUS Status; - + PAGED_CODE(); - + PreviousMode = KeGetPreviousMode(); - + /* probe the buffers */ if (PreviousMode != KernelMode) { @@ -403,10 +405,10 @@ NtPrivilegeCheck (IN HANDLE ClientToken, FIELD_OFFSET(PRIVILEGE_SET, Privilege), sizeof(ULONG)); - + PrivilegeCount = RequiredPrivileges->PrivilegeCount; PrivilegeControl = RequiredPrivileges->Control; - + /* Check PrivilegeCount to avoid an integer overflow! */ if (FIELD_OFFSET(PRIVILEGE_SET, Privilege[PrivilegeCount]) / @@ -414,13 +416,13 @@ NtPrivilegeCheck (IN HANDLE ClientToken, { _SEH2_YIELD(return STATUS_INVALID_PARAMETER); } - + /* probe all of the array */ ProbeForWrite(RequiredPrivileges, FIELD_OFFSET(PRIVILEGE_SET, Privilege[PrivilegeCount]), sizeof(ULONG)); - + ProbeForWriteBoolean(Result); } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) @@ -435,51 +437,51 @@ NtPrivilegeCheck (IN HANDLE ClientToken, PrivilegeCount = RequiredPrivileges->PrivilegeCount; PrivilegeControl = RequiredPrivileges->Control; } - + /* reference the token and make sure we're not doing an anonymous impersonation */ - Status = ObReferenceObjectByHandle (ClientToken, - TOKEN_QUERY, - SepTokenObjectType, - PreviousMode, - (PVOID*)&Token, - NULL); + Status = ObReferenceObjectByHandle(ClientToken, + TOKEN_QUERY, + SepTokenObjectType, + PreviousMode, + (PVOID*)&Token, + NULL); if (!NT_SUCCESS(Status)) { return Status; } - + if (Token->TokenType == TokenImpersonation && Token->ImpersonationLevel < SecurityIdentification) { - ObDereferenceObject (Token); + ObDereferenceObject(Token); return STATUS_BAD_IMPERSONATION_LEVEL; } - + /* capture the privileges */ - Status = SeCaptureLuidAndAttributesArray (RequiredPrivileges->Privilege, - PrivilegeCount, - PreviousMode, - NULL, - 0, - PagedPool, - TRUE, - &Privileges, - &Length); + Status = SeCaptureLuidAndAttributesArray(RequiredPrivileges->Privilege, + PrivilegeCount, + PreviousMode, + NULL, + 0, + PagedPool, + TRUE, + &Privileges, + &Length); if (!NT_SUCCESS(Status)) { ObDereferenceObject (Token); return Status; } - - CheckResult = SepPrivilegeCheck (Token, - Privileges, - PrivilegeCount, - PrivilegeControl, - PreviousMode); - - ObDereferenceObject (Token); - + + CheckResult = SepPrivilegeCheck(Token, + Privileges, + PrivilegeCount, + PrivilegeControl, + PreviousMode); + + ObDereferenceObject(Token); + /* return the array */ _SEH2_TRY { @@ -494,13 +496,12 @@ NtPrivilegeCheck (IN HANDLE ClientToken, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - - SeReleaseLuidAndAttributesArray (Privileges, - PreviousMode, - TRUE); - + + SeReleaseLuidAndAttributesArray(Privileges, + PreviousMode, + TRUE); + return Status; } - /* EOF */ diff --git a/reactos/ntoskrnl/se/sd.c b/reactos/ntoskrnl/se/sd.c index fded835b6af..a0cb2cc5595 100644 --- a/reactos/ntoskrnl/se/sd.c +++ b/reactos/ntoskrnl/se/sd.c @@ -38,79 +38,79 @@ SepInitSDs(VOID) sizeof(SECURITY_DESCRIPTOR), TAG_SD); if (SePublicDefaultSd == NULL) return FALSE; - + RtlCreateSecurityDescriptor(SePublicDefaultSd, SECURITY_DESCRIPTOR_REVISION); RtlSetDaclSecurityDescriptor(SePublicDefaultSd, TRUE, SePublicDefaultDacl, FALSE); - + /* Create PublicDefaultUnrestrictedSd */ SePublicDefaultUnrestrictedSd = ExAllocatePoolWithTag(PagedPool, sizeof(SECURITY_DESCRIPTOR), TAG_SD); if (SePublicDefaultUnrestrictedSd == NULL) return FALSE; - + RtlCreateSecurityDescriptor(SePublicDefaultUnrestrictedSd, SECURITY_DESCRIPTOR_REVISION); RtlSetDaclSecurityDescriptor(SePublicDefaultUnrestrictedSd, TRUE, SePublicDefaultUnrestrictedDacl, FALSE); - + /* Create PublicOpenSd */ SePublicOpenSd = ExAllocatePoolWithTag(PagedPool, sizeof(SECURITY_DESCRIPTOR), TAG_SD); if (SePublicOpenSd == NULL) return FALSE; - + RtlCreateSecurityDescriptor(SePublicOpenSd, SECURITY_DESCRIPTOR_REVISION); RtlSetDaclSecurityDescriptor(SePublicOpenSd, TRUE, SePublicOpenDacl, FALSE); - + /* Create PublicOpenUnrestrictedSd */ SePublicOpenUnrestrictedSd = ExAllocatePoolWithTag(PagedPool, sizeof(SECURITY_DESCRIPTOR), TAG_SD); if (SePublicOpenUnrestrictedSd == NULL) return FALSE; - + RtlCreateSecurityDescriptor(SePublicOpenUnrestrictedSd, SECURITY_DESCRIPTOR_REVISION); RtlSetDaclSecurityDescriptor(SePublicOpenUnrestrictedSd, TRUE, SePublicOpenUnrestrictedDacl, FALSE); - + /* Create SystemDefaultSd */ SeSystemDefaultSd = ExAllocatePoolWithTag(PagedPool, sizeof(SECURITY_DESCRIPTOR), TAG_SD); if (SeSystemDefaultSd == NULL) return FALSE; - + RtlCreateSecurityDescriptor(SeSystemDefaultSd, SECURITY_DESCRIPTOR_REVISION); RtlSetDaclSecurityDescriptor(SeSystemDefaultSd, TRUE, SeSystemDefaultDacl, FALSE); - + /* Create UnrestrictedSd */ SeUnrestrictedSd = ExAllocatePoolWithTag(PagedPool, sizeof(SECURITY_DESCRIPTOR), TAG_SD); if (SeUnrestrictedSd == NULL) return FALSE; - + RtlCreateSecurityDescriptor(SeUnrestrictedSd, SECURITY_DESCRIPTOR_REVISION); RtlSetDaclSecurityDescriptor(SeUnrestrictedSd, TRUE, SeUnrestrictedDacl, FALSE); - + return TRUE; } @@ -125,14 +125,14 @@ SeSetWorldSecurityDescriptor(SECURITY_INFORMATION SecurityInformation, ULONG SdSize; NTSTATUS Status; PISECURITY_DESCRIPTOR_RELATIVE SdRel = (PISECURITY_DESCRIPTOR_RELATIVE)SecurityDescriptor; - + DPRINT("SeSetWorldSecurityDescriptor() called\n"); - + if (SecurityInformation == 0) { return STATUS_ACCESS_DENIED; } - + /* calculate the minimum size of the buffer */ SidSize = RtlLengthSid(SeWorldSid); SdSize = sizeof(SECURITY_DESCRIPTOR_RELATIVE); @@ -144,24 +144,24 @@ SeSetWorldSecurityDescriptor(SECURITY_INFORMATION SecurityInformation, { SdSize += sizeof(ACL) + sizeof(ACE) + SidSize; } - + if (*BufferLength < SdSize) { *BufferLength = SdSize; return STATUS_BUFFER_TOO_SMALL; } - + *BufferLength = SdSize; - + Status = RtlCreateSecurityDescriptorRelative(SdRel, SECURITY_DESCRIPTOR_REVISION); if (!NT_SUCCESS(Status)) { return Status; } - + Current = (ULONG_PTR)(SdRel + 1); - + if (SecurityInformation & OWNER_SECURITY_INFORMATION) { RtlCopyMemory((PVOID)Current, @@ -170,7 +170,7 @@ SeSetWorldSecurityDescriptor(SECURITY_INFORMATION SecurityInformation, SdRel->Owner = (ULONG)((ULONG_PTR)Current - (ULONG_PTR)SdRel); Current += SidSize; } - + if (SecurityInformation & GROUP_SECURITY_INFORMATION) { RtlCopyMemory((PVOID)Current, @@ -179,33 +179,33 @@ SeSetWorldSecurityDescriptor(SECURITY_INFORMATION SecurityInformation, SdRel->Group = (ULONG)((ULONG_PTR)Current - (ULONG_PTR)SdRel); Current += SidSize; } - + if (SecurityInformation & DACL_SECURITY_INFORMATION) { PACL Dacl = (PACL)Current; SdRel->Control |= SE_DACL_PRESENT; - + Status = RtlCreateAcl(Dacl, sizeof(ACL) + sizeof(ACE) + SidSize, ACL_REVISION); if (!NT_SUCCESS(Status)) return Status; - + Status = RtlAddAccessAllowedAce(Dacl, ACL_REVISION, GENERIC_ALL, SeWorldSid); if (!NT_SUCCESS(Status)) return Status; - + SdRel->Dacl = (ULONG)((ULONG_PTR)Current - (ULONG_PTR)SdRel); } - + if (SecurityInformation & SACL_SECURITY_INFORMATION) { /* FIXME - SdRel->Control |= SE_SACL_PRESENT; */ } - + return STATUS_SUCCESS; } @@ -221,33 +221,33 @@ SepCaptureSecurityQualityOfService(IN POBJECT_ATTRIBUTES ObjectAttributes OPTIO { PSECURITY_QUALITY_OF_SERVICE CapturedQos; NTSTATUS Status = STATUS_SUCCESS; - + PAGED_CODE(); - + ASSERT(CapturedSecurityQualityOfService); ASSERT(Present); - - if(ObjectAttributes != NULL) + + if (ObjectAttributes != NULL) { - if(AccessMode != KernelMode) + if (AccessMode != KernelMode) { SECURITY_QUALITY_OF_SERVICE SafeQos; - + _SEH2_TRY { ProbeForRead(ObjectAttributes, sizeof(OBJECT_ATTRIBUTES), sizeof(ULONG)); - if(ObjectAttributes->Length == sizeof(OBJECT_ATTRIBUTES)) + if (ObjectAttributes->Length == sizeof(OBJECT_ATTRIBUTES)) { - if(ObjectAttributes->SecurityQualityOfService != NULL) + if (ObjectAttributes->SecurityQualityOfService != NULL) { ProbeForRead(ObjectAttributes->SecurityQualityOfService, sizeof(SECURITY_QUALITY_OF_SERVICE), sizeof(ULONG)); - if(((PSECURITY_QUALITY_OF_SERVICE)ObjectAttributes->SecurityQualityOfService)->Length == - sizeof(SECURITY_QUALITY_OF_SERVICE)) + if (((PSECURITY_QUALITY_OF_SERVICE)ObjectAttributes->SecurityQualityOfService)->Length == + sizeof(SECURITY_QUALITY_OF_SERVICE)) { /* don't allocate memory here because ExAllocate should bugcheck the system if it's buggy, SEH would catch that! So make a local @@ -278,14 +278,14 @@ SepCaptureSecurityQualityOfService(IN POBJECT_ATTRIBUTES ObjectAttributes OPTIO Status = _SEH2_GetExceptionCode(); } _SEH2_END; - - if(NT_SUCCESS(Status)) + + if (NT_SUCCESS(Status)) { - if(*Present) + if (*Present) { CapturedQos = ExAllocatePool(PoolType, sizeof(SECURITY_QUALITY_OF_SERVICE)); - if(CapturedQos != NULL) + if (CapturedQos != NULL) { RtlCopyMemory(CapturedQos, &SafeQos, @@ -305,18 +305,18 @@ SepCaptureSecurityQualityOfService(IN POBJECT_ATTRIBUTES ObjectAttributes OPTIO } else { - if(ObjectAttributes->Length == sizeof(OBJECT_ATTRIBUTES)) + if (ObjectAttributes->Length == sizeof(OBJECT_ATTRIBUTES)) { - if(CaptureIfKernel) + if (CaptureIfKernel) { - if(ObjectAttributes->SecurityQualityOfService != NULL) + if (ObjectAttributes->SecurityQualityOfService != NULL) { - if(((PSECURITY_QUALITY_OF_SERVICE)ObjectAttributes->SecurityQualityOfService)->Length == - sizeof(SECURITY_QUALITY_OF_SERVICE)) + if (((PSECURITY_QUALITY_OF_SERVICE)ObjectAttributes->SecurityQualityOfService)->Length == + sizeof(SECURITY_QUALITY_OF_SERVICE)) { CapturedQos = ExAllocatePool(PoolType, sizeof(SECURITY_QUALITY_OF_SERVICE)); - if(CapturedQos != NULL) + if (CapturedQos != NULL) { RtlCopyMemory(CapturedQos, ObjectAttributes->SecurityQualityOfService, @@ -357,7 +357,7 @@ SepCaptureSecurityQualityOfService(IN POBJECT_ATTRIBUTES ObjectAttributes OPTIO *CapturedSecurityQualityOfService = NULL; *Present = FALSE; } - + return Status; } @@ -369,9 +369,9 @@ SepReleaseSecurityQualityOfService(IN PSECURITY_QUALITY_OF_SERVICE CapturedSecur IN BOOLEAN CaptureIfKernel) { PAGED_CODE(); - - if(CapturedSecurityQualityOfService != NULL && - (AccessMode != KernelMode || CaptureIfKernel)) + + if (CapturedSecurityQualityOfService != NULL && + (AccessMode != KernelMode || CaptureIfKernel)) { ExFreePool(CapturedSecurityQualityOfService); } @@ -398,13 +398,13 @@ SeCaptureSecurityDescriptor(IN PSECURITY_DESCRIPTOR _OriginalSecurityDescriptor, ULONG SaclSize = 0, DaclSize = 0; ULONG DescriptorSize = 0; NTSTATUS Status; - - if(OriginalSecurityDescriptor != NULL) + + if (OriginalSecurityDescriptor != NULL) { - if(CurrentMode != KernelMode) + if (CurrentMode != KernelMode) { RtlZeroMemory(&DescriptorCopy, sizeof(DescriptorCopy)); - + _SEH2_TRY { /* first only probe and copy until the control field of the descriptor @@ -414,25 +414,25 @@ SeCaptureSecurityDescriptor(IN PSECURITY_DESCRIPTOR _OriginalSecurityDescriptor, ProbeForRead(OriginalSecurityDescriptor, DescriptorSize, sizeof(ULONG)); - - if(OriginalSecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION1) + + if (OriginalSecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION1) { _SEH2_YIELD(return STATUS_UNKNOWN_REVISION); } - + /* make a copy on the stack */ DescriptorCopy.Revision = OriginalSecurityDescriptor->Revision; DescriptorCopy.Sbz1 = OriginalSecurityDescriptor->Sbz1; DescriptorCopy.Control = OriginalSecurityDescriptor->Control; DescriptorSize = ((DescriptorCopy.Control & SE_SELF_RELATIVE) ? sizeof(SECURITY_DESCRIPTOR_RELATIVE) : sizeof(SECURITY_DESCRIPTOR)); - + /* probe and copy the entire security descriptor structure. The SIDs and ACLs will be probed and copied later though */ ProbeForRead(OriginalSecurityDescriptor, DescriptorSize, sizeof(ULONG)); - if(DescriptorCopy.Control & SE_SELF_RELATIVE) + if (DescriptorCopy.Control & SE_SELF_RELATIVE) { PISECURITY_DESCRIPTOR_RELATIVE RelSD = (PISECURITY_DESCRIPTOR_RELATIVE)OriginalSecurityDescriptor; @@ -456,13 +456,13 @@ SeCaptureSecurityDescriptor(IN PSECURITY_DESCRIPTOR _OriginalSecurityDescriptor, } _SEH2_END; } - else if(!CaptureIfKernel) + else if (!CaptureIfKernel) { - if(OriginalSecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION1) + if (OriginalSecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION1) { return STATUS_UNKNOWN_REVISION; } - + *CapturedSecurityDescriptor = OriginalSecurityDescriptor; return STATUS_SUCCESS; } @@ -472,14 +472,14 @@ SeCaptureSecurityDescriptor(IN PSECURITY_DESCRIPTOR _OriginalSecurityDescriptor, { return STATUS_UNKNOWN_REVISION; } - + /* make a copy on the stack */ DescriptorCopy.Revision = OriginalSecurityDescriptor->Revision; DescriptorCopy.Sbz1 = OriginalSecurityDescriptor->Sbz1; DescriptorCopy.Control = OriginalSecurityDescriptor->Control; DescriptorSize = ((DescriptorCopy.Control & SE_SELF_RELATIVE) ? sizeof(SECURITY_DESCRIPTOR_RELATIVE) : sizeof(SECURITY_DESCRIPTOR)); - if(DescriptorCopy.Control & SE_SELF_RELATIVE) + if (DescriptorCopy.Control & SE_SELF_RELATIVE) { PISECURITY_DESCRIPTOR_RELATIVE RelSD = (PISECURITY_DESCRIPTOR_RELATIVE)OriginalSecurityDescriptor; @@ -496,31 +496,31 @@ SeCaptureSecurityDescriptor(IN PSECURITY_DESCRIPTOR _OriginalSecurityDescriptor, DescriptorCopy.Dacl = OriginalSecurityDescriptor->Dacl; } } - - if(DescriptorCopy.Control & SE_SELF_RELATIVE) + + if (DescriptorCopy.Control & SE_SELF_RELATIVE) { /* in case we're dealing with a self-relative descriptor, do a basic convert to an absolute descriptor. We do this so we can simply access the data using the pointers without calculating them again. */ DescriptorCopy.Control &= ~SE_SELF_RELATIVE; - if(DescriptorCopy.Owner != NULL) + if (DescriptorCopy.Owner != NULL) { DescriptorCopy.Owner = (PSID)((ULONG_PTR)OriginalSecurityDescriptor + (ULONG_PTR)DescriptorCopy.Owner); } - if(DescriptorCopy.Group != NULL) + if (DescriptorCopy.Group != NULL) { DescriptorCopy.Group = (PSID)((ULONG_PTR)OriginalSecurityDescriptor + (ULONG_PTR)DescriptorCopy.Group); } - if(DescriptorCopy.Dacl != NULL) + if (DescriptorCopy.Dacl != NULL) { DescriptorCopy.Dacl = (PACL)((ULONG_PTR)OriginalSecurityDescriptor + (ULONG_PTR)DescriptorCopy.Dacl); } - if(DescriptorCopy.Sacl != NULL) + if (DescriptorCopy.Sacl != NULL) { DescriptorCopy.Sacl = (PACL)((ULONG_PTR)OriginalSecurityDescriptor + (ULONG_PTR)DescriptorCopy.Sacl); } } - + /* determine the size of the SIDs */ #define DetermineSIDSize(SidType) \ do { \ @@ -555,12 +555,12 @@ DescriptorSize += ROUND_UP(SidType##Size, sizeof(ULONG)); \ } \ } \ } while(0) - + DetermineSIDSize(Owner); DetermineSIDSize(Group); - + #undef DetermineSIDSize - + /* determine the size of the ACLs */ #define DetermineACLSize(AclType, AclFlag) \ do { \ @@ -598,12 +598,12 @@ else \ DescriptorCopy.AclType = NULL; \ } \ } while(0) - + DetermineACLSize(Sacl, SACL); DetermineACLSize(Dacl, DACL); - + #undef DetermineACLSize - + /* allocate enough memory to store a complete copy of a self-relative security descriptor */ NewDescriptor = ExAllocatePoolWithTag(PoolType, @@ -642,12 +642,12 @@ RtlRaiseStatus(STATUS_INVALID_SID); \ Offset += ROUND_UP(Type##Size, sizeof(ULONG)); \ } \ } while(0) - + CopySID(Owner); CopySID(Group); - + #undef CopySID - + #define CopyACL(Type) \ do { \ if(DescriptorCopy.Type != NULL) \ @@ -665,10 +665,10 @@ RtlRaiseStatus(STATUS_INVALID_ACL); \ Offset += ROUND_UP(Type##Size, sizeof(ULONG)); \ } \ } while(0) - + CopyACL(Sacl); CopyACL(Dacl); - + #undef CopyACL } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) @@ -678,12 +678,11 @@ Offset += ROUND_UP(Type##Size, sizeof(ULONG)); \ _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; - + /* we're finally done! copy the pointer to the captured descriptor to to the caller */ *CapturedSecurityDescriptor = NewDescriptor; return STATUS_SUCCESS; - } else { @@ -695,7 +694,7 @@ Offset += ROUND_UP(Type##Size, sizeof(ULONG)); \ /* nothing to do... */ *CapturedSecurityDescriptor = NULL; } - + return Status; } @@ -721,9 +720,9 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, ULONG Control = 0; ULONG_PTR Current; ULONG SdLength; - + RelSD = (PISECURITY_DESCRIPTOR_RELATIVE)SecurityDescriptor; - + if (*ObjectsSecurityDescriptor == NULL) { if (*Length < sizeof(SECURITY_DESCRIPTOR_RELATIVE)) @@ -731,15 +730,15 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, *Length = sizeof(SECURITY_DESCRIPTOR_RELATIVE); return STATUS_BUFFER_TOO_SMALL; } - + *Length = sizeof(SECURITY_DESCRIPTOR_RELATIVE); RtlCreateSecurityDescriptorRelative(RelSD, SECURITY_DESCRIPTOR_REVISION); return STATUS_SUCCESS; } - + ObjectSd = *ObjectsSecurityDescriptor; - + /* Calculate the required security descriptor length */ Control = SE_SELF_RELATIVE; if ((*SecurityInformation & OWNER_SECURITY_INFORMATION) && @@ -749,7 +748,7 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, OwnerLength = ROUND_UP(RtlLengthSid(Owner), 4); Control |= (ObjectSd->Control & SE_OWNER_DEFAULTED); } - + if ((*SecurityInformation & GROUP_SECURITY_INFORMATION) && (ObjectSd->Group != NULL)) { @@ -757,7 +756,7 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, GroupLength = ROUND_UP(RtlLengthSid(Group), 4); Control |= (ObjectSd->Control & SE_GROUP_DEFAULTED); } - + if ((*SecurityInformation & DACL_SECURITY_INFORMATION) && (ObjectSd->Control & SE_DACL_PRESENT)) { @@ -768,7 +767,7 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, } Control |= (ObjectSd->Control & (SE_DACL_DEFAULTED | SE_DACL_PRESENT)); } - + if ((*SecurityInformation & SACL_SECURITY_INFORMATION) && (ObjectSd->Control & SE_SACL_PRESENT)) { @@ -779,7 +778,7 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, } Control |= (ObjectSd->Control & (SE_SACL_DEFAULTED | SE_SACL_PRESENT)); } - + SdLength = OwnerLength + GroupLength + DaclLength + SaclLength + sizeof(SECURITY_DESCRIPTOR_RELATIVE); if (*Length < SdLength) @@ -787,14 +786,14 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, *Length = SdLength; return STATUS_BUFFER_TOO_SMALL; } - + /* Build the new security descrtiptor */ RtlCreateSecurityDescriptorRelative(RelSD, SECURITY_DESCRIPTOR_REVISION); RelSD->Control = (USHORT)Control; - + Current = (ULONG_PTR)(RelSD + 1); - + if (OwnerLength != 0) { RtlCopyMemory((PVOID)Current, @@ -803,7 +802,7 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, RelSD->Owner = (ULONG)(Current - (ULONG_PTR)SecurityDescriptor); Current += OwnerLength; } - + if (GroupLength != 0) { RtlCopyMemory((PVOID)Current, @@ -812,7 +811,7 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, RelSD->Group = (ULONG)(Current - (ULONG_PTR)SecurityDescriptor); Current += GroupLength; } - + if (DaclLength != 0) { RtlCopyMemory((PVOID)Current, @@ -821,7 +820,7 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, RelSD->Dacl = (ULONG)(Current - (ULONG_PTR)SecurityDescriptor); Current += DaclLength; } - + if (SaclLength != 0) { RtlCopyMemory((PVOID)Current, @@ -830,9 +829,9 @@ SeQuerySecurityDescriptorInfo(IN PSECURITY_INFORMATION SecurityInformation, RelSD->Sacl = (ULONG)(Current - (ULONG_PTR)SecurityDescriptor); Current += SaclLength; } - + *Length = SdLength; - + return STATUS_SUCCESS; } @@ -846,7 +845,7 @@ SeReleaseSecurityDescriptor(IN PSECURITY_DESCRIPTOR CapturedSecurityDescriptor, IN BOOLEAN CaptureIfKernelMode) { PAGED_CODE(); - + /* WARNING! You need to call this function with the same value for CurrentMode and CaptureIfKernelMode that you previously passed to SeCaptureSecurityDescriptor() in order to avoid memory leaks! */ @@ -857,7 +856,7 @@ SeReleaseSecurityDescriptor(IN PSECURITY_DESCRIPTOR CapturedSecurityDescriptor, /* only delete the descriptor when SeCaptureSecurityDescriptor() allocated one! */ ExFreePoolWithTag(CapturedSecurityDescriptor, TAG_SD); } - + return STATUS_SUCCESS; } @@ -886,26 +885,27 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, ULONG Control = 0; ULONG_PTR Current; SECURITY_INFORMATION SecurityInformation; - + ObjectSd = *ObjectsSecurityDescriptor; - + if (!ObjectSd) return STATUS_NO_SECURITY_ON_OBJECT; // The object does not have a security descriptor. - + SecurityInformation = *_SecurityInformation; - + /* Get owner and owner size */ if (SecurityInformation & OWNER_SECURITY_INFORMATION) { if (SecurityDescriptor->Owner != NULL) { - if( SecurityDescriptor->Control & SE_SELF_RELATIVE ) + if (SecurityDescriptor->Control & SE_SELF_RELATIVE) Owner = (PSID)((ULONG_PTR)SecurityDescriptor->Owner + (ULONG_PTR)SecurityDescriptor); else Owner = (PSID)SecurityDescriptor->Owner; OwnerLength = ROUND_UP(RtlLengthSid(Owner), 4); } + Control |= (SecurityDescriptor->Control & SE_OWNER_DEFAULTED); } else @@ -915,6 +915,7 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, Owner = (PSID)((ULONG_PTR)ObjectSd->Owner + (ULONG_PTR)ObjectSd); OwnerLength = ROUND_UP(RtlLengthSid(Owner), 4); } + Control |= (ObjectSd->Control & SE_OWNER_DEFAULTED); } @@ -930,6 +931,7 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, Group = (PSID)SecurityDescriptor->Group; GroupLength = ROUND_UP(RtlLengthSid(Group), 4); } + Control |= (SecurityDescriptor->Control & SE_GROUP_DEFAULTED); } else @@ -939,9 +941,10 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, Group = (PSID)((ULONG_PTR)ObjectSd->Group + (ULONG_PTR)ObjectSd); GroupLength = ROUND_UP(RtlLengthSid(Group), 4); } + Control |= (ObjectSd->Control & SE_GROUP_DEFAULTED); } - + /* Get DACL and DACL size */ if (SecurityInformation & DACL_SECURITY_INFORMATION) { @@ -953,9 +956,10 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, (ULONG_PTR)SecurityDescriptor); else Dacl = (PACL)SecurityDescriptor->Dacl; - + DaclLength = ROUND_UP((ULONG)Dacl->AclSize, 4); } + Control |= (SecurityDescriptor->Control & (SE_DACL_DEFAULTED | SE_DACL_PRESENT)); } else @@ -966,6 +970,7 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, Dacl = (PACL)((ULONG_PTR)ObjectSd->Dacl + (ULONG_PTR)ObjectSd); DaclLength = ROUND_UP((ULONG)Dacl->AclSize, 4); } + Control |= (ObjectSd->Control & (SE_DACL_DEFAULTED | SE_DACL_PRESENT)); } @@ -982,6 +987,7 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, Sacl = (PACL)SecurityDescriptor->Sacl; SaclLength = ROUND_UP((ULONG)Sacl->AclSize, 4); } + Control |= (SecurityDescriptor->Control & (SE_SACL_DEFAULTED | SE_SACL_PRESENT)); } else @@ -992,9 +998,10 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, Sacl = (PACL)((ULONG_PTR)ObjectSd->Sacl + (ULONG_PTR)ObjectSd); SaclLength = ROUND_UP((ULONG)Sacl->AclSize, 4); } + Control |= (ObjectSd->Control & (SE_SACL_DEFAULTED | SE_SACL_PRESENT)); } - + NewSd = ExAllocatePool(NonPagedPool, sizeof(SECURITY_DESCRIPTOR) + OwnerLength + GroupLength + DaclLength + SaclLength); @@ -1003,14 +1010,15 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, ObDereferenceObject(Object); return STATUS_INSUFFICIENT_RESOURCES; } - + RtlCreateSecurityDescriptor(NewSd, SECURITY_DESCRIPTOR_REVISION1); + /* We always build a self-relative descriptor */ NewSd->Control = (USHORT)Control | SE_SELF_RELATIVE; - + Current = (ULONG_PTR)NewSd + sizeof(SECURITY_DESCRIPTOR); - + if (OwnerLength != 0) { RtlCopyMemory((PVOID)Current, @@ -1019,7 +1027,7 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, NewSd->Owner = (PSID)(Current - (ULONG_PTR)NewSd); Current += OwnerLength; } - + if (GroupLength != 0) { RtlCopyMemory((PVOID)Current, @@ -1028,7 +1036,7 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, NewSd->Group = (PSID)(Current - (ULONG_PTR)NewSd); Current += GroupLength; } - + if (DaclLength != 0) { RtlCopyMemory((PVOID)Current, @@ -1037,7 +1045,7 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, NewSd->Dacl = (PACL)(Current - (ULONG_PTR)NewSd); Current += DaclLength; } - + if (SaclLength != 0) { RtlCopyMemory((PVOID)Current, @@ -1045,8 +1053,8 @@ SeSetSecurityDescriptorInfo(IN PVOID Object OPTIONAL, SaclLength); NewSd->Sacl = (PACL)(Current - (ULONG_PTR)NewSd); Current += SaclLength; - } - + } + *ObjectsSecurityDescriptor = NewSd; return STATUS_SUCCESS; } @@ -1065,12 +1073,12 @@ SeSetSecurityDescriptorInfoEx(IN PVOID Object OPTIONAL, IN PGENERIC_MAPPING GenericMapping) { PISECURITY_DESCRIPTOR ObjectSd = *ObjectsSecurityDescriptor; - + if (!ObjectSd) return STATUS_NO_SECURITY_ON_OBJECT; // The object does not have a security descriptor. - - UNIMPLEMENTED; - return STATUS_NOT_IMPLEMENTED; + + UNIMPLEMENTED; + return STATUS_NOT_IMPLEMENTED; } @@ -1085,54 +1093,54 @@ SeValidSecurityDescriptor(IN ULONG Length, PISID Sid; PACL Acl; PISECURITY_DESCRIPTOR SecurityDescriptor = _SecurityDescriptor; - + if (Length < SECURITY_DESCRIPTOR_MIN_LENGTH) { DPRINT1("Invalid Security Descriptor revision\n"); return FALSE; } - + if (SecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION1) { DPRINT1("Invalid Security Descriptor revision\n"); return FALSE; } - + if (!(SecurityDescriptor->Control & SE_SELF_RELATIVE)) { DPRINT1("No self-relative Security Descriptor\n"); return FALSE; } - + SdLength = sizeof(SECURITY_DESCRIPTOR); - + /* Check Owner SID */ if (SecurityDescriptor->Owner == NULL) { DPRINT1("No Owner SID\n"); return FALSE; } - + if ((ULONG_PTR)SecurityDescriptor->Owner % sizeof(ULONG)) { DPRINT1("Invalid Owner SID alignment\n"); return FALSE; } - + Sid = (PISID)((ULONG_PTR)SecurityDescriptor + (ULONG_PTR)SecurityDescriptor->Owner); if (Sid->Revision != SID_REVISION) { DPRINT1("Invalid Owner SID revision\n"); return FALSE; } - + SdLength += (sizeof(SID) + (Sid->SubAuthorityCount - 1) * sizeof(ULONG)); if (Length < SdLength) { DPRINT1("Invalid Owner SID size\n"); return FALSE; } - + /* Check Group SID */ if (SecurityDescriptor->Group != NULL) { @@ -1141,14 +1149,14 @@ SeValidSecurityDescriptor(IN ULONG Length, DPRINT1("Invalid Group SID alignment\n"); return FALSE; } - + Sid = (PSID)((ULONG_PTR)SecurityDescriptor + (ULONG_PTR)SecurityDescriptor->Group); if (Sid->Revision != SID_REVISION) { DPRINT1("Invalid Group SID revision\n"); return FALSE; } - + SdLength += (sizeof(SID) + (Sid->SubAuthorityCount - 1) * sizeof(ULONG)); if (Length < SdLength) { @@ -1156,7 +1164,7 @@ SeValidSecurityDescriptor(IN ULONG Length, return FALSE; } } - + /* Check DACL */ if (SecurityDescriptor->Dacl != NULL) { @@ -1165,7 +1173,7 @@ SeValidSecurityDescriptor(IN ULONG Length, DPRINT1("Invalid DACL alignment\n"); return FALSE; } - + Acl = (PACL)((ULONG_PTR)SecurityDescriptor + (ULONG_PTR)SecurityDescriptor->Dacl); if ((Acl->AclRevision < MIN_ACL_REVISION) && (Acl->AclRevision > MAX_ACL_REVISION)) @@ -1173,7 +1181,7 @@ SeValidSecurityDescriptor(IN ULONG Length, DPRINT1("Invalid DACL revision\n"); return FALSE; } - + SdLength += Acl->AclSize; if (Length < SdLength) { @@ -1181,7 +1189,7 @@ SeValidSecurityDescriptor(IN ULONG Length, return FALSE; } } - + /* Check SACL */ if (SecurityDescriptor->Sacl != NULL) { @@ -1190,7 +1198,7 @@ SeValidSecurityDescriptor(IN ULONG Length, DPRINT1("Invalid SACL alignment\n"); return FALSE; } - + Acl = (PACL)((ULONG_PTR)SecurityDescriptor + (ULONG_PTR)SecurityDescriptor->Sacl); if ((Acl->AclRevision < MIN_ACL_REVISION) || (Acl->AclRevision > MAX_ACL_REVISION)) @@ -1198,7 +1206,7 @@ SeValidSecurityDescriptor(IN ULONG Length, DPRINT1("Invalid SACL revision\n"); return FALSE; } - + SdLength += Acl->AclSize; if (Length < SdLength) { @@ -1206,7 +1214,7 @@ SeValidSecurityDescriptor(IN ULONG Length, return FALSE; } } - + return TRUE; } @@ -1217,13 +1225,13 @@ NTSTATUS NTAPI SeDeassignSecurity(PSECURITY_DESCRIPTOR *SecurityDescriptor) { PAGED_CODE(); - + if (*SecurityDescriptor != NULL) { ExFreePool(*SecurityDescriptor); *SecurityDescriptor = NULL; } - + return STATUS_SUCCESS; } @@ -1273,12 +1281,12 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, PSID Group = NULL; PACL Dacl = NULL; PACL Sacl = NULL; - + PAGED_CODE(); - + /* Lock subject context */ SeLockSubjectContext(SubjectContext); - + if (SubjectContext->ClientToken != NULL) { Token = SubjectContext->ClientToken; @@ -1287,18 +1295,16 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, { Token = SubjectContext->PrimaryToken; } - - + /* Inherit the Owner SID */ if (ExplicitDescriptor != NULL && ExplicitDescriptor->Owner != NULL) { DPRINT("Use explicit owner sid!\n"); Owner = ExplicitDescriptor->Owner; - + if (ExplicitDescriptor->Control & SE_SELF_RELATIVE) { Owner = (PSID)(((ULONG_PTR)Owner) + (ULONG_PTR)ExplicitDescriptor); - } } else @@ -1313,13 +1319,12 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, DPRINT("Use default owner sid!\n"); Owner = SeLocalSystemSid; } - + Control |= SE_OWNER_DEFAULTED; } - + OwnerLength = ROUND_UP(RtlLengthSid(Owner), 4); - - + /* Inherit the Group SID */ if (ExplicitDescriptor != NULL && ExplicitDescriptor->Group != NULL) { @@ -1342,13 +1347,12 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, DPRINT("Use default group sid!\n"); Group = SeLocalSystemSid; } - + Control |= SE_OWNER_DEFAULTED; } - + GroupLength = ROUND_UP(RtlLengthSid(Group), 4); - - + /* Inherit the DACL */ if (ExplicitDescriptor != NULL && (ExplicitDescriptor->Control & SE_DACL_PRESENT) && @@ -1360,7 +1364,7 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, { Dacl = (PACL)(((ULONG_PTR)Dacl) + (ULONG_PTR)ExplicitDescriptor); } - + Control |= SE_DACL_PRESENT; } else if (ParentDescriptor != NULL && @@ -1373,6 +1377,7 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, { Dacl = (PACL)(((ULONG_PTR)Dacl) + (ULONG_PTR)ParentDescriptor); } + Control |= (SE_DACL_PRESENT | SE_DACL_DEFAULTED); } else if (Token != NULL && Token->DefaultDacl != NULL) @@ -1388,10 +1393,9 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, Dacl = NULL; Control |= (SE_DACL_PRESENT | SE_DACL_DEFAULTED); } - + DaclLength = (Dacl != NULL) ? ROUND_UP(Dacl->AclSize, 4) : 0; - - + /* Inherit the SACL */ if (ExplicitDescriptor != NULL && (ExplicitDescriptor->Control & SE_SACL_PRESENT) && @@ -1403,7 +1407,7 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, { Sacl = (PACL)(((ULONG_PTR)Sacl) + (ULONG_PTR)ExplicitDescriptor); } - + Control |= SE_SACL_PRESENT; } else if (ParentDescriptor != NULL && @@ -1416,23 +1420,23 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, { Sacl = (PACL)(((ULONG_PTR)Sacl) + (ULONG_PTR)ParentDescriptor); } + Control |= (SE_SACL_PRESENT | SE_SACL_DEFAULTED); } - + SaclLength = (Sacl != NULL) ? ROUND_UP(Sacl->AclSize, 4) : 0; - - + /* Allocate and initialize the new security descriptor */ Length = sizeof(SECURITY_DESCRIPTOR) + OwnerLength + GroupLength + DaclLength + SaclLength; - + DPRINT("L: sizeof(SECURITY_DESCRIPTOR) %d OwnerLength %d GroupLength %d DaclLength %d SaclLength %d\n", sizeof(SECURITY_DESCRIPTOR), OwnerLength, GroupLength, DaclLength, SaclLength); - + Descriptor = ExAllocatePoolWithTag(PagedPool, Length, TAG_SD); @@ -1442,15 +1446,15 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, /* FIXME: Unlock subject context */ return STATUS_INSUFFICIENT_RESOURCES; } - + RtlZeroMemory( Descriptor, Length ); RtlCreateSecurityDescriptor(Descriptor, SECURITY_DESCRIPTOR_REVISION); - + Descriptor->Control = (USHORT)Control | SE_SELF_RELATIVE; - + Current = (ULONG_PTR)Descriptor + sizeof(SECURITY_DESCRIPTOR); - + if (SaclLength != 0) { RtlCopyMemory((PVOID)Current, @@ -1459,7 +1463,7 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, Descriptor->Sacl = (PACL)((ULONG_PTR)Current - (ULONG_PTR)Descriptor); Current += SaclLength; } - + if (DaclLength != 0) { RtlCopyMemory((PVOID)Current, @@ -1468,7 +1472,7 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, Descriptor->Dacl = (PACL)((ULONG_PTR)Current - (ULONG_PTR)Descriptor); Current += DaclLength; } - + if (OwnerLength != 0) { RtlCopyMemory((PVOID)Current, @@ -1479,8 +1483,10 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, DPRINT("Owner of %x at %x\n", Descriptor, Descriptor->Owner); } else + { DPRINT("Owner of %x is zero length\n", Descriptor); - + } + if (GroupLength != 0) { memmove((PVOID)Current, @@ -1488,15 +1494,15 @@ SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL, GroupLength); Descriptor->Group = (PSID)((ULONG_PTR)Current - (ULONG_PTR)Descriptor); } - + /* Unlock subject context */ SeUnlockSubjectContext(SubjectContext); - + *NewDescriptor = Descriptor; - + DPRINT("Descrptor %x\n", Descriptor); ASSERT(RtlLengthSecurityDescriptor(Descriptor)); - + return STATUS_SUCCESS; } diff --git a/reactos/ntoskrnl/se/semgr.c b/reactos/ntoskrnl/se/semgr.c index de374473139..406003b0af9 100644 --- a/reactos/ntoskrnl/se/semgr.c +++ b/reactos/ntoskrnl/se/semgr.c @@ -17,13 +17,15 @@ PSE_EXPORTS SeExports = NULL; SE_EXPORTS SepExports; +ULONG SidInTokenCalls = 0; extern ULONG ExpInitializationPhase; extern ERESOURCE SepSubjectContextLock; /* PRIVATE FUNCTIONS **********************************************************/ -static BOOLEAN INIT_FUNCTION +static BOOLEAN +INIT_FUNCTION SepInitExports(VOID) { SepExports.SeCreateTokenPrivilege = SeCreateTokenPrivilege; @@ -118,6 +120,7 @@ NTAPI SepInitializationPhase1(VOID) { NTSTATUS Status; + PAGED_CODE(); /* Insert the system token into the tree */ @@ -279,8 +282,6 @@ SeDefaultObjectMethod(IN PVOID Object, return STATUS_SUCCESS; } -ULONG SidInTokenCalls = 0; - static BOOLEAN SepSidInToken(PACCESS_TOKEN _Token, PSID Sid) @@ -292,7 +293,7 @@ SepSidInToken(PACCESS_TOKEN _Token, SidInTokenCalls++; if (!(SidInTokenCalls % 10000)) DPRINT1("SidInToken Calls: %d\n", SidInTokenCalls); - + if (Token->UserAndGroupCount == 0) { return FALSE; @@ -340,7 +341,8 @@ SepTokenIsOwner(PACCESS_TOKEN Token, return SepSidInToken(Token, Sid); } -VOID NTAPI +VOID +NTAPI SeQuerySecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation, OUT PACCESS_MASK DesiredAccess) { @@ -351,13 +353,15 @@ SeQuerySecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation, { *DesiredAccess |= READ_CONTROL; } + if (SecurityInformation & SACL_SECURITY_INFORMATION) { *DesiredAccess |= ACCESS_SYSTEM_SECURITY; } } -VOID NTAPI +VOID +NTAPI SeSetSecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation, OUT PACCESS_MASK DesiredAccess) { @@ -367,10 +371,12 @@ SeSetSecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation, { *DesiredAccess |= WRITE_OWNER; } + if (SecurityInformation & DACL_SECURITY_INFORMATION) { *DesiredAccess |= WRITE_DAC; } + if (SecurityInformation & SACL_SECURITY_INFORMATION) { *DesiredAccess |= ACCESS_SYSTEM_SECURITY; @@ -494,7 +500,7 @@ SepAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor, { *GrantedAccess = DesiredAccess | PreviouslyGrantedAccess; } - + *AccessStatus = STATUS_SUCCESS; return TRUE; } @@ -763,7 +769,8 @@ SepGetSDGroup(IN PSECURITY_DESCRIPTOR _SecurityDescriptor) /* * @implemented */ -BOOLEAN NTAPI +BOOLEAN +NTAPI SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN BOOLEAN SubjectContextLocked, diff --git a/reactos/ntoskrnl/se/sid.c b/reactos/ntoskrnl/se/sid.c index d70a743135a..93b8bde6d16 100644 --- a/reactos/ntoskrnl/se/sid.c +++ b/reactos/ntoskrnl/se/sid.c @@ -99,11 +99,11 @@ SepInitSecurityIDs(VOID) ULONG SidLength1; ULONG SidLength2; PULONG SubAuthority; - + SidLength0 = RtlLengthRequiredSid(0); SidLength1 = RtlLengthRequiredSid(1); SidLength2 = RtlLengthRequiredSid(2); - + /* create NullSid */ SeNullSid = ExAllocatePoolWithTag(PagedPool, SidLength1, TAG_SID); SeWorldSid = ExAllocatePoolWithTag(PagedPool, SidLength1, TAG_SID); @@ -150,9 +150,9 @@ SepInitSecurityIDs(VOID) SeAnonymousLogonSid == NULL) { FreeInitializedSids(); - return(FALSE); + return FALSE; } - + RtlInitializeSid(SeNullSid, &SeNullSidAuthority, 1); RtlInitializeSid(SeWorldSid, &SeWorldSidAuthority, 1); RtlInitializeSid(SeLocalSid, &SeLocalSidAuthority, 1); @@ -181,7 +181,7 @@ SepInitSecurityIDs(VOID) RtlInitializeSid(SeAuthenticatedUsersSid, &SeNtSidAuthority, 1); RtlInitializeSid(SeRestrictedSid, &SeNtSidAuthority, 1); RtlInitializeSid(SeAnonymousLogonSid, &SeNtSidAuthority, 1); - + SubAuthority = RtlSubAuthoritySid(SeNullSid, 0); *SubAuthority = SECURITY_NULL_RID; SubAuthority = RtlSubAuthoritySid(SeWorldSid, 0); @@ -252,8 +252,8 @@ SepInitSecurityIDs(VOID) *SubAuthority = SECURITY_RESTRICTED_CODE_RID; SubAuthority = RtlSubAuthoritySid(SeAnonymousLogonSid, 0); *SubAuthority = SECURITY_ANONYMOUS_LOGON_RID; - - return(TRUE); + + return TRUE; } NTSTATUS @@ -267,9 +267,9 @@ SepCaptureSid(IN PSID InputSid, ULONG SidSize = 0; PISID NewSid, Sid = (PISID)InputSid; NTSTATUS Status; - + PAGED_CODE(); - + if (AccessMode != KernelMode) { _SEH2_TRY @@ -289,11 +289,11 @@ SepCaptureSid(IN PSID InputSid, _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; - + /* allocate a SID and copy it */ NewSid = ExAllocatePool(PoolType, SidSize); - if(NewSid != NULL) + if (NewSid != NULL) { _SEH2_TRY { @@ -316,7 +316,7 @@ SepCaptureSid(IN PSID InputSid, Status = STATUS_INSUFFICIENT_RESOURCES; } } - else if(!CaptureIfKernel) + else if (!CaptureIfKernel) { *CapturedSid = InputSid; return STATUS_SUCCESS; @@ -324,16 +324,16 @@ SepCaptureSid(IN PSID InputSid, else { SidSize = RtlLengthRequiredSid(Sid->SubAuthorityCount); - + /* allocate a SID and copy it */ NewSid = ExAllocatePool(PoolType, SidSize); - if(NewSid != NULL) + if (NewSid != NULL) { RtlCopyMemory(NewSid, Sid, SidSize); - + *CapturedSid = NewSid; } else @@ -341,7 +341,7 @@ SepCaptureSid(IN PSID InputSid, Status = STATUS_INSUFFICIENT_RESOURCES; } } - + return Status; } @@ -352,10 +352,10 @@ SepReleaseSid(IN PSID CapturedSid, IN BOOLEAN CaptureIfKernel) { PAGED_CODE(); - - if(CapturedSid != NULL && - (AccessMode != KernelMode || - (AccessMode == KernelMode && CaptureIfKernel))) + + if (CapturedSid != NULL && + (AccessMode != KernelMode || + (AccessMode == KernelMode && CaptureIfKernel))) { ExFreePool(CapturedSid); } diff --git a/reactos/ntoskrnl/se/token.c b/reactos/ntoskrnl/se/token.c index 8f73312fde4..7bb2d95bb54 100644 --- a/reactos/ntoskrnl/se/token.c +++ b/reactos/ntoskrnl/se/token.c @@ -25,16 +25,18 @@ ERESOURCE SepTokenLock; TOKEN_SOURCE SeSystemTokenSource = {"*SYSTEM*", {0}}; LUID SeSystemAuthenticationId = SYSTEM_LUID; -static GENERIC_MAPPING SepTokenMapping = {TOKEN_READ, +static GENERIC_MAPPING SepTokenMapping = { + TOKEN_READ, TOKEN_WRITE, TOKEN_EXECUTE, -TOKEN_ALL_ACCESS}; + TOKEN_ALL_ACCESS +}; static const INFORMATION_CLASS_INFO SeTokenInformationClass[] = { - + /* Class 0 not used, blame M$! */ ICI_SQ_SAME( 0, 0, 0), - + /* TokenUser */ ICI_SQ_SAME( sizeof(TOKEN_USER), sizeof(ULONG), ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE | ICIF_SET | ICIF_SET_SIZE_VARIABLE ), /* TokenGroups */ @@ -79,11 +81,11 @@ SepCompareTokens(IN PTOKEN FirstToken, OUT PBOOLEAN Equal) { BOOLEAN Restricted, IsEqual = FALSE; - + ASSERT(FirstToken != SecondToken); - + /* FIXME: Check if every SID that is present in either token is also present in the other one */ - + Restricted = SeTokenIsRestricted(FirstToken); if (Restricted == SeTokenIsRestricted(SecondToken)) { @@ -91,10 +93,10 @@ SepCompareTokens(IN PTOKEN FirstToken, { /* FIXME: Check if every SID that is restricted in either token is also restricted in the other one */ } - + /* FIXME: Check if every privilege that is present in either token is also present in the other one */ } - + *Equal = IsEqual; return STATUS_SUCCESS; } @@ -108,10 +110,11 @@ SepFreeProxyData(PVOID ProxyData) NTSTATUS NTAPI -SepCopyProxyData(PVOID* Dest, PVOID Src) +SepCopyProxyData(PVOID* Dest, + PVOID Src) { UNIMPLEMENTED; - return(STATUS_NOT_IMPLEMENTED); + return STATUS_NOT_IMPLEMENTED; } NTSTATUS @@ -122,24 +125,24 @@ SeExchangePrimaryToken(PEPROCESS Process, { PTOKEN OldToken; PTOKEN NewToken = (PTOKEN)NewTokenP; - + PAGED_CODE(); - + if (NewToken->TokenType != TokenPrimary) return(STATUS_BAD_TOKEN_TYPE); if (NewToken->TokenInUse) return(STATUS_TOKEN_ALREADY_IN_USE); - + /* Mark new token in use */ NewToken->TokenInUse = 1; - + /* Reference the New Token */ ObReferenceObject(NewToken); - + /* Replace the old with the new */ OldToken = ObFastReplaceObject(&Process->Token, NewToken); - + /* Mark the Old Token as free */ OldToken->TokenInUse = 0; - + *OldTokenP = (PACCESS_TOKEN)OldToken; return STATUS_SUCCESS; } @@ -149,10 +152,10 @@ NTAPI SeDeassignPrimaryToken(PEPROCESS Process) { PTOKEN OldToken; - + /* Remove the Token */ OldToken = ObFastReplaceObject(&Process->Token, NULL); - + /* Mark the Old Token as free */ OldToken->TokenInUse = 0; } @@ -163,14 +166,14 @@ RtlLengthSidAndAttributes(ULONG Count, { ULONG i; ULONG uLength; - + PAGED_CODE(); - + uLength = Count * sizeof(SID_AND_ATTRIBUTES); for (i = 0; i < Count; i++) uLength += RtlLengthSid(Src[i].Sid); - - return(uLength); + + return uLength; } @@ -181,14 +184,14 @@ SepFindPrimaryGroupAndDefaultOwner(PTOKEN Token, PSID DefaultOwner) { ULONG i; - + Token->PrimaryGroup = 0; - + if (DefaultOwner) { Token->DefaultOwnerIndex = Token->UserAndGroupCount; } - + /* Validate and set the primary group and user pointers */ for (i = 0; i < Token->UserAndGroupCount; i++) { @@ -197,24 +200,24 @@ SepFindPrimaryGroupAndDefaultOwner(PTOKEN Token, { Token->DefaultOwnerIndex = i; } - + if (RtlEqualSid(Token->UserAndGroups[i].Sid, PrimaryGroup)) { Token->PrimaryGroup = Token->UserAndGroups[i].Sid; } } - + if (Token->DefaultOwnerIndex == Token->UserAndGroupCount) { return(STATUS_INVALID_OWNER); } - + if (Token->PrimaryGroup == 0) { return(STATUS_INVALID_PRIMARY_GROUP); } - - return(STATUS_SUCCESS); + + return STATUS_SUCCESS; } @@ -233,9 +236,9 @@ SepDuplicateToken(PTOKEN Token, PVOID EndMem; PTOKEN AccessToken; NTSTATUS Status; - + PAGED_CODE(); - + Status = ObCreateObject(PreviousMode, SepTokenObjectType, ObjectAttributes, @@ -248,7 +251,7 @@ SepDuplicateToken(PTOKEN Token, if (!NT_SUCCESS(Status)) { DPRINT1("ObCreateObject() failed (Status %lx)\n", Status); - return(Status); + return Status; } /* Zero out the buffer */ @@ -258,22 +261,22 @@ SepDuplicateToken(PTOKEN Token, if (!NT_SUCCESS(Status)) { ObDereferenceObject(AccessToken); - return(Status); + return Status; } - + Status = ZwAllocateLocallyUniqueId(&AccessToken->ModifiedId); if (!NT_SUCCESS(Status)) { ObDereferenceObject(AccessToken); - return(Status); + return Status; } - + AccessToken->TokenLock = &SepTokenLock; - + AccessToken->TokenType = TokenType; AccessToken->ImpersonationLevel = Level; RtlCopyLuid(&AccessToken->AuthenticationId, &Token->AuthenticationId); - + AccessToken->TokenSource.SourceIdentifier.LowPart = Token->TokenSource.SourceIdentifier.LowPart; AccessToken->TokenSource.SourceIdentifier.HighPart = Token->TokenSource.SourceIdentifier.HighPart; memcpy(AccessToken->TokenSource.SourceName, @@ -282,18 +285,18 @@ SepDuplicateToken(PTOKEN Token, AccessToken->ExpirationTime.QuadPart = Token->ExpirationTime.QuadPart; AccessToken->UserAndGroupCount = Token->UserAndGroupCount; AccessToken->DefaultOwnerIndex = Token->DefaultOwnerIndex; - + uLength = sizeof(SID_AND_ATTRIBUTES) * AccessToken->UserAndGroupCount; for (i = 0; i < Token->UserAndGroupCount; i++) uLength += RtlLengthSid(Token->UserAndGroups[i].Sid); - + AccessToken->UserAndGroups = (PSID_AND_ATTRIBUTES)ExAllocatePoolWithTag(PagedPool, uLength, 'uKOT'); - + EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount]; - + Status = RtlCopySidAndAttributesArray(AccessToken->UserAndGroupCount, Token->UserAndGroups, uLength, @@ -308,17 +311,17 @@ SepDuplicateToken(PTOKEN Token, Token->PrimaryGroup, 0); } - + if (NT_SUCCESS(Status)) { AccessToken->PrivilegeCount = Token->PrivilegeCount; - + uLength = AccessToken->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES); AccessToken->Privileges = (PLUID_AND_ATTRIBUTES)ExAllocatePoolWithTag(PagedPool, uLength, 'pKOT'); - + for (i = 0; i < AccessToken->PrivilegeCount; i++) { RtlCopyLuid(&AccessToken->Privileges[i].Luid, @@ -326,8 +329,8 @@ SepDuplicateToken(PTOKEN Token, AccessToken->Privileges[i].Attributes = Token->Privileges[i].Attributes; } - - if ( Token->DefaultDacl ) + + if (Token->DefaultDacl) { AccessToken->DefaultDacl = (PACL) ExAllocatePoolWithTag(PagedPool, @@ -338,14 +341,14 @@ SepDuplicateToken(PTOKEN Token, Token->DefaultDacl->AclSize); } } - - if ( NT_SUCCESS(Status) ) + + if (NT_SUCCESS(Status)) { *NewAccessToken = AccessToken; return(STATUS_SUCCESS); } - - return(Status); + + return Status; } NTSTATUS @@ -358,7 +361,7 @@ SeSubProcessToken(IN PTOKEN ParentToken, PTOKEN NewToken; OBJECT_ATTRIBUTES ObjectAttributes; NTSTATUS Status; - + /* Initialize the attributes and duplicate it */ InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL); Status = SepDuplicateToken(ParentToken, @@ -382,12 +385,12 @@ SeSubProcessToken(IN PTOKEN ParentToken, /* Set the session ID */ NewToken->SessionId = SessionId; NewToken->TokenInUse = InUse; - + /* Return the token */ *Token = NewToken; } } - + /* Return status */ return Status; } @@ -399,25 +402,25 @@ SeIsTokenChild(IN PTOKEN Token, { PTOKEN ProcessToken; LUID ProcessLuid, CallerLuid; - + /* Assume failure */ *IsChild = FALSE; - + /* Reference the process token */ ProcessToken = PsReferencePrimaryToken(PsGetCurrentProcess()); - + /* Get the ID */ ProcessLuid = ProcessToken->TokenId; - + /* Dereference the token */ ObFastDereferenceObject(&PsGetCurrentProcess()->Token, ProcessToken); - + /* Get our LUID */ CallerLuid = Token->TokenId; - + /* Compare the LUIDs */ if (RtlEqualLuid(&CallerLuid, &ProcessLuid)) *IsChild = TRUE; - + /* Return success */ return STATUS_SUCCESS; } @@ -431,9 +434,9 @@ SeCopyClientToken(IN PACCESS_TOKEN Token, { NTSTATUS Status; OBJECT_ATTRIBUTES ObjectAttributes; - + PAGED_CODE(); - + InitializeObjectAttributes(&ObjectAttributes, NULL, 0, @@ -446,21 +449,22 @@ SeCopyClientToken(IN PACCESS_TOKEN Token, Level, PreviousMode, (PTOKEN*)NewToken); - - return(Status); + + return Status; } -VOID NTAPI +VOID +NTAPI SepDeleteToken(PVOID ObjectBody) { PTOKEN AccessToken = (PTOKEN)ObjectBody; - + if (AccessToken->UserAndGroups) ExFreePool(AccessToken->UserAndGroups); - + if (AccessToken->Privileges) ExFreePool(AccessToken->Privileges); - + if (AccessToken->DefaultDacl) ExFreePool(AccessToken->DefaultDacl); } @@ -473,12 +477,12 @@ SepInitializeTokenImplementation(VOID) { UNICODE_STRING Name; OBJECT_TYPE_INITIALIZER ObjectTypeInitializer; - + ExInitializeResource(&SepTokenLock); - + DPRINT("Creating Token Object Type\n"); - - /* Initialize the Token type */ + + /* Initialize the Token type */ RtlZeroMemory(&ObjectTypeInitializer, sizeof(ObjectTypeInitializer)); RtlInitUnicodeString(&Name, L"Token"); ObjectTypeInitializer.Length = sizeof(ObjectTypeInitializer); @@ -499,14 +503,14 @@ SeAssignPrimaryToken(IN PEPROCESS Process, IN PTOKEN Token) { PAGED_CODE(); - + /* Sanity checks */ ASSERT(Token->TokenType == TokenPrimary); ASSERT(!Token->TokenInUse); - + /* Clean any previous token */ if (Process->Token.Object) SeDeassignPrimaryToken(Process); - + /* Set the new token */ ObReferenceObject(Token); Token->TokenInUse = TRUE; @@ -517,25 +521,25 @@ SeAssignPrimaryToken(IN PEPROCESS Process, NTSTATUS NTAPI SepCreateToken(OUT PHANDLE TokenHandle, - IN KPROCESSOR_MODE PreviousMode, - IN ACCESS_MASK DesiredAccess, - IN POBJECT_ATTRIBUTES ObjectAttributes, - IN TOKEN_TYPE TokenType, - IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, - IN PLUID AuthenticationId, - IN PLARGE_INTEGER ExpirationTime, - IN PSID_AND_ATTRIBUTES User, - IN ULONG GroupCount, - IN PSID_AND_ATTRIBUTES Groups, - IN ULONG GroupLength, - IN ULONG PrivilegeCount, - IN PLUID_AND_ATTRIBUTES Privileges, - IN PSID Owner, - IN PSID PrimaryGroup, - IN PACL DefaultDacl, - IN PTOKEN_SOURCE TokenSource, - IN BOOLEAN SystemToken) -{ + IN KPROCESSOR_MODE PreviousMode, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN TOKEN_TYPE TokenType, + IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, + IN PLUID AuthenticationId, + IN PLARGE_INTEGER ExpirationTime, + IN PSID_AND_ATTRIBUTES User, + IN ULONG GroupCount, + IN PSID_AND_ATTRIBUTES Groups, + IN ULONG GroupLength, + IN ULONG PrivilegeCount, + IN PLUID_AND_ATTRIBUTES Privileges, + IN PSID Owner, + IN PSID PrimaryGroup, + IN PACL DefaultDacl, + IN PTOKEN_SOURCE TokenSource, + IN BOOLEAN SystemToken) +{ PTOKEN AccessToken; LUID TokenId; LUID ModifiedId; @@ -544,7 +548,7 @@ SepCreateToken(OUT PHANDLE TokenHandle, ULONG i; NTSTATUS Status; ULONG TokenFlags = 0; - + /* Loop all groups */ for (i = 0; i < GroupCount; i++) { @@ -554,7 +558,7 @@ SepCreateToken(OUT PHANDLE TokenHandle, /* Force them to be enabled */ Groups[i].Attributes |= (SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT); } - + /* Check of the group is an admin group */ if (RtlEqualSid(SeAliasAdminsSid, Groups[i].Sid)) { @@ -562,7 +566,7 @@ SepCreateToken(OUT PHANDLE TokenHandle, TokenFlags |= TOKEN_HAS_ADMIN_GROUP; } } - + /* Loop all privileges */ for (i = 0; i < PrivilegeCount; i++) { @@ -577,12 +581,12 @@ SepCreateToken(OUT PHANDLE TokenHandle, Status = ZwAllocateLocallyUniqueId(&TokenId); if (!NT_SUCCESS(Status)) - return(Status); - + return Status; + Status = ZwAllocateLocallyUniqueId(&ModifiedId); if (!NT_SUCCESS(Status)) - return(Status); - + return Status; + Status = ObCreateObject(PreviousMode, SepTokenObjectType, ObjectAttributes, @@ -595,50 +599,50 @@ SepCreateToken(OUT PHANDLE TokenHandle, if (!NT_SUCCESS(Status)) { DPRINT1("ObCreateObject() failed (Status %lx)\n"); - return(Status); + return Status; } /* Zero out the buffer */ RtlZeroMemory(AccessToken, sizeof(TOKEN)); - + AccessToken->TokenLock = &SepTokenLock; - + RtlCopyLuid(&AccessToken->TokenSource.SourceIdentifier, &TokenSource->SourceIdentifier); memcpy(AccessToken->TokenSource.SourceName, TokenSource->SourceName, sizeof(TokenSource->SourceName)); - + RtlCopyLuid(&AccessToken->TokenId, &TokenId); RtlCopyLuid(&AccessToken->AuthenticationId, AuthenticationId); AccessToken->ExpirationTime = *ExpirationTime; RtlCopyLuid(&AccessToken->ModifiedId, &ModifiedId); - + AccessToken->UserAndGroupCount = GroupCount + 1; AccessToken->PrivilegeCount = PrivilegeCount; - + AccessToken->TokenFlags = TokenFlags; AccessToken->TokenType = TokenType; AccessToken->ImpersonationLevel = ImpersonationLevel; - + /* * Normally we would just point these members into the variable information * area; however, our ObCreateObject() call can't allocate a variable information * area, so we allocate them seperately and provide a destroy function. */ - + uLength = sizeof(SID_AND_ATTRIBUTES) * AccessToken->UserAndGroupCount; uLength += RtlLengthSid(User); for (i = 0; i < GroupCount; i++) uLength += RtlLengthSid(Groups[i].Sid); - + AccessToken->UserAndGroups = (PSID_AND_ATTRIBUTES)ExAllocatePoolWithTag(PagedPool, uLength, 'uKOT'); - + EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount]; - + Status = RtlCopySidAndAttributesArray(1, User, uLength, @@ -656,7 +660,7 @@ SepCreateToken(OUT PHANDLE TokenHandle, &EndMem, &uLength); } - + if (NT_SUCCESS(Status)) { Status = SepFindPrimaryGroupAndDefaultOwner( @@ -664,7 +668,7 @@ SepCreateToken(OUT PHANDLE TokenHandle, PrimaryGroup, Owner); } - + if (NT_SUCCESS(Status)) { uLength = PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES); @@ -672,7 +676,7 @@ SepCreateToken(OUT PHANDLE TokenHandle, (PLUID_AND_ATTRIBUTES)ExAllocatePoolWithTag(PagedPool, uLength, 'pKOT'); - + if (PreviousMode != KernelMode) { _SEH2_TRY @@ -694,7 +698,7 @@ SepCreateToken(OUT PHANDLE TokenHandle, PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES)); } } - + if (NT_SUCCESS(Status)) { AccessToken->DefaultDacl = @@ -705,16 +709,15 @@ SepCreateToken(OUT PHANDLE TokenHandle, DefaultDacl, DefaultDacl->AclSize); } - + if (!SystemToken) { - - Status = ObInsertObject ((PVOID)AccessToken, - NULL, - DesiredAccess, - 0, - NULL, - TokenHandle); + Status = ObInsertObject((PVOID)AccessToken, + NULL, + DesiredAccess, + 0, + NULL, + TokenHandle); if (!NT_SUCCESS(Status)) { DPRINT1("ObInsertObject() failed (Status %lx)\n", Status); @@ -745,24 +748,24 @@ SepCreateSystemProcessToken(VOID) ULONG i; PTOKEN Token; NTSTATUS Status; - + /* Don't ever expire */ Expiration.QuadPart = -1; - + /* All groups mandatory and enabled */ GroupAttributes = SE_GROUP_ENABLED | SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT; OwnerAttributes = SE_GROUP_ENABLED | SE_GROUP_OWNER | SE_GROUP_ENABLED_BY_DEFAULT; - + /* User is system */ UserSid.Sid = SeLocalSystemSid; UserSid.Attributes = 0; - + /* Primary group is local system */ PrimaryGroup = SeLocalSystemSid; - + /* Owner is admins */ Owner = SeAliasAdminsSid; - + /* Groups are admins, world, and authenticated users */ Groups[0].Sid = SeAliasAdminsSid; Groups[0].Attributes = OwnerAttributes; @@ -780,69 +783,69 @@ SepCreateSystemProcessToken(VOID) i = 0; Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED; Privileges[i++].Luid = SeTcbPrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeCreateTokenPrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeTakeOwnershipPrivilege; - + Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED; Privileges[i++].Luid = SeCreatePagefilePrivilege; - + Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED; Privileges[i++].Luid = SeLockMemoryPrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeAssignPrimaryTokenPrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeIncreaseQuotaPrivilege; - + Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED; Privileges[i++].Luid = SeIncreaseBasePriorityPrivilege; - + Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED; Privileges[i++].Luid = SeCreatePermanentPrivilege; - + Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED; Privileges[i++].Luid = SeDebugPrivilege; - + Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED; Privileges[i++].Luid = SeAuditPrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeSecurityPrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeSystemEnvironmentPrivilege; - + Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED; Privileges[i++].Luid = SeChangeNotifyPrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeBackupPrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeRestorePrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeShutdownPrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeLoadDriverPrivilege; - + Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED; Privileges[i++].Luid = SeProfileSingleProcessPrivilege; - + Privileges[i].Attributes = 0; Privileges[i++].Luid = SeSystemtimePrivilege; ASSERT(i == 20); - + /* Setup the object attributes */ InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL); ASSERT(SeSystemDefaultDacl != NULL); - + /* Create the token */ Status = SepCreateToken((PHANDLE)&Token, KernelMode, @@ -864,13 +867,13 @@ SepCreateSystemProcessToken(VOID) &SeSystemTokenSource, TRUE); ASSERT(Status == STATUS_SUCCESS); - + /* Return the token */ return Token; } /* PUBLIC FUNCTIONS ***********************************************************/ - + /* * @unimplemented */ @@ -915,14 +918,15 @@ SeQuerySessionIdToken(IN PACCESS_TOKEN Token, /* * @implemented */ -NTSTATUS NTAPI +NTSTATUS +NTAPI SeQueryAuthenticationIdToken(IN PACCESS_TOKEN Token, OUT PLUID LogonId) { PAGED_CODE(); - + *LogonId = ((PTOKEN)Token)->AuthenticationId; - + return STATUS_SUCCESS; } @@ -935,7 +939,7 @@ NTAPI SeTokenImpersonationLevel(IN PACCESS_TOKEN Token) { PAGED_CODE(); - + return ((PTOKEN)Token)->ImpersonationLevel; } @@ -947,7 +951,7 @@ TOKEN_TYPE NTAPI SeTokenType(IN PACCESS_TOKEN Token) { PAGED_CODE(); - + return ((PTOKEN)Token)->TokenType; } @@ -960,6 +964,7 @@ NTAPI SeTokenIsAdmin(IN PACCESS_TOKEN Token) { PAGED_CODE(); + return (((PTOKEN)Token)->TokenFlags & TOKEN_WRITE_RESTRICTED) != 0; } @@ -971,6 +976,7 @@ NTAPI SeTokenIsRestricted(IN PACCESS_TOKEN Token) { PAGED_CODE(); + return (((PTOKEN)Token)->TokenFlags & TOKEN_IS_RESTRICTED) != 0; } @@ -982,6 +988,7 @@ NTAPI SeTokenIsWriteRestricted(IN PACCESS_TOKEN Token) { PAGED_CODE(); + return (((PTOKEN)Token)->TokenFlags & TOKEN_HAS_RESTORE_PRIVILEGE) != 0; } @@ -1006,11 +1013,11 @@ NtQueryInformationToken(IN HANDLE TokenHandle, ULONG RequiredLength; KPROCESSOR_MODE PreviousMode; NTSTATUS Status = STATUS_SUCCESS; - + PAGED_CODE(); - + PreviousMode = ExGetPreviousMode(); - + /* Check buffers and class validity */ Status = DefaultQueryInfoBufferCheck(TokenInformationClass, SeTokenInformationClass, @@ -1020,13 +1027,12 @@ NtQueryInformationToken(IN HANDLE TokenHandle, ReturnLength, NULL, PreviousMode); - - if(!NT_SUCCESS(Status)) + if (!NT_SUCCESS(Status)) { DPRINT("NtQueryInformationToken() failed, Status: 0x%x\n", Status); return Status; } - + Status = ObReferenceObjectByHandle(TokenHandle, (TokenInformationClass == TokenSource) ? TOKEN_QUERY_SOURCE : TOKEN_QUERY, SepTokenObjectType, @@ -1040,14 +1046,14 @@ NtQueryInformationToken(IN HANDLE TokenHandle, case TokenUser: { PTOKEN_USER tu = (PTOKEN_USER)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenUser)\n"); RequiredLength = sizeof(TOKEN_USER) + RtlLengthSid(Token->UserAndGroups[0].Sid); - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { Status = RtlCopySidAndAttributesArray(1, &Token->UserAndGroups[0], @@ -1061,8 +1067,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1072,27 +1078,27 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenGroups: { PTOKEN_GROUPS tg = (PTOKEN_GROUPS)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenGroups)\n"); RequiredLength = sizeof(tg->GroupCount) + RtlLengthSidAndAttributes(Token->UserAndGroupCount - 1, &Token->UserAndGroups[1]); - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { ULONG SidLen = RequiredLength - sizeof(tg->GroupCount) - ((Token->UserAndGroupCount - 1) * sizeof(SID_AND_ATTRIBUTES)); PSID_AND_ATTRIBUTES Sid = (PSID_AND_ATTRIBUTES)((ULONG_PTR)TokenInformation + sizeof(tg->GroupCount) + ((Token->UserAndGroupCount - 1) * sizeof(SID_AND_ATTRIBUTES))); - + tg->GroupCount = Token->UserAndGroupCount - 1; Status = RtlCopySidAndAttributesArray(Token->UserAndGroupCount - 1, &Token->UserAndGroups[1], @@ -1106,8 +1112,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1117,21 +1123,21 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenPrivileges: { PTOKEN_PRIVILEGES tp = (PTOKEN_PRIVILEGES)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenPrivileges)\n"); RequiredLength = sizeof(tp->PrivilegeCount) + (Token->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES)); - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { tp->PrivilegeCount = Token->PrivilegeCount; RtlCopyLuidAndAttributesArray(Token->PrivilegeCount, @@ -1142,8 +1148,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1153,22 +1159,22 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenOwner: { ULONG SidLen; PTOKEN_OWNER to = (PTOKEN_OWNER)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenOwner)\n"); SidLen = RtlLengthSid(Token->UserAndGroups[Token->DefaultOwnerIndex].Sid); RequiredLength = sizeof(TOKEN_OWNER) + SidLen; - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { to->Owner = (PSID)(to + 1); Status = RtlCopySid(SidLen, @@ -1179,8 +1185,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1190,22 +1196,22 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenPrimaryGroup: { ULONG SidLen; PTOKEN_PRIMARY_GROUP tpg = (PTOKEN_PRIMARY_GROUP)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenPrimaryGroup)\n"); SidLen = RtlLengthSid(Token->PrimaryGroup); RequiredLength = sizeof(TOKEN_PRIMARY_GROUP) + SidLen; - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { tpg->PrimaryGroup = (PSID)(tpg + 1); Status = RtlCopySid(SidLen, @@ -1216,8 +1222,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1227,27 +1233,27 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenDefaultDacl: { PTOKEN_DEFAULT_DACL tdd = (PTOKEN_DEFAULT_DACL)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenDefaultDacl)\n"); RequiredLength = sizeof(TOKEN_DEFAULT_DACL); - - if(Token->DefaultDacl != NULL) + + if (Token->DefaultDacl != NULL) { RequiredLength += Token->DefaultDacl->AclSize; } - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { - if(Token->DefaultDacl != NULL) + if (Token->DefaultDacl != NULL) { tdd->DefaultDacl = (PACL)(tdd + 1); RtlCopyMemory(tdd->DefaultDacl, @@ -1263,8 +1269,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1274,20 +1280,20 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenSource: { PTOKEN_SOURCE ts = (PTOKEN_SOURCE)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenSource)\n"); RequiredLength = sizeof(TOKEN_SOURCE); - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { *ts = Token->TokenSource; } @@ -1295,8 +1301,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1306,20 +1312,20 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenType: { PTOKEN_TYPE tt = (PTOKEN_TYPE)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenType)\n"); RequiredLength = sizeof(TOKEN_TYPE); - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { *tt = Token->TokenType; } @@ -1327,8 +1333,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1338,14 +1344,14 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenImpersonationLevel: { PSECURITY_IMPERSONATION_LEVEL sil = (PSECURITY_IMPERSONATION_LEVEL)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenImpersonationLevel)\n"); /* Fail if the token is not an impersonation token */ @@ -1356,10 +1362,10 @@ NtQueryInformationToken(IN HANDLE TokenHandle, } RequiredLength = sizeof(SECURITY_IMPERSONATION_LEVEL); - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { *sil = Token->ImpersonationLevel; } @@ -1367,8 +1373,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1378,20 +1384,20 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenStatistics: { PTOKEN_STATISTICS ts = (PTOKEN_STATISTICS)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenStatistics)\n"); RequiredLength = sizeof(TOKEN_STATISTICS); - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { ts->TokenId = Token->TokenId; ts->AuthenticationId = Token->AuthenticationId; @@ -1408,8 +1414,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1419,20 +1425,20 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenOrigin: { PTOKEN_ORIGIN to = (PTOKEN_ORIGIN)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenOrigin)\n"); RequiredLength = sizeof(TOKEN_ORIGIN); - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { RtlCopyLuid(&to->OriginatingLogonSession, &Token->AuthenticationId); @@ -1441,8 +1447,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1452,32 +1458,32 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenGroupsAndPrivileges: DPRINT1("NtQueryInformationToken(TokenGroupsAndPrivileges) not implemented\n"); Status = STATUS_NOT_IMPLEMENTED; break; - + case TokenRestrictedSids: { PTOKEN_GROUPS tg = (PTOKEN_GROUPS)TokenInformation; - + DPRINT("NtQueryInformationToken(TokenRestrictedSids)\n"); RequiredLength = sizeof(tg->GroupCount) + RtlLengthSidAndAttributes(Token->RestrictedSidCount, Token->RestrictedSids); - + _SEH2_TRY { - if(TokenInformationLength >= RequiredLength) + if (TokenInformationLength >= RequiredLength) { ULONG SidLen = RequiredLength - sizeof(tg->GroupCount) - (Token->RestrictedSidCount * sizeof(SID_AND_ATTRIBUTES)); PSID_AND_ATTRIBUTES Sid = (PSID_AND_ATTRIBUTES)((ULONG_PTR)TokenInformation + sizeof(tg->GroupCount) + (Token->RestrictedSidCount * sizeof(SID_AND_ATTRIBUTES))); - + tg->GroupCount = Token->RestrictedSidCount; Status = RtlCopySidAndAttributesArray(Token->RestrictedSidCount, Token->RestrictedSids, @@ -1491,8 +1497,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, { Status = STATUS_BUFFER_TOO_SMALL; } - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = RequiredLength; } @@ -1502,32 +1508,32 @@ NtQueryInformationToken(IN HANDLE TokenHandle, Status = _SEH2_GetExceptionCode(); } _SEH2_END; - + break; } - + case TokenSandBoxInert: DPRINT1("NtQueryInformationToken(TokenSandboxInert) not implemented\n"); Status = STATUS_NOT_IMPLEMENTED; break; - + case TokenSessionId: { ULONG SessionId = 0; - + DPRINT("NtQueryInformationToken(TokenSessionId)\n"); - + Status = SeQuerySessionIdToken(Token, &SessionId); - - if(NT_SUCCESS(Status)) + + if (NT_SUCCESS(Status)) { _SEH2_TRY { /* buffer size was already verified, no need to check here again */ *(PULONG)TokenInformation = SessionId; - - if(ReturnLength != NULL) + + if (ReturnLength != NULL) { *ReturnLength = sizeof(ULONG); } @@ -1538,20 +1544,20 @@ NtQueryInformationToken(IN HANDLE TokenHandle, } _SEH2_END; } - + break; } - + default: DPRINT1("NtQueryInformationToken(%d) invalid information class\n", TokenInformationClass); Status = STATUS_INVALID_INFO_CLASS; break; } - + ObDereferenceObject(Token); } - - return(Status); + + return Status; } @@ -1571,30 +1577,29 @@ NtSetInformationToken(IN HANDLE TokenHandle, KPROCESSOR_MODE PreviousMode; ULONG NeededAccess = TOKEN_ADJUST_DEFAULT; NTSTATUS Status; - + PAGED_CODE(); - + PreviousMode = ExGetPreviousMode(); - + Status = DefaultSetInfoBufferCheck(TokenInformationClass, SeTokenInformationClass, sizeof(SeTokenInformationClass) / sizeof(SeTokenInformationClass[0]), TokenInformation, TokenInformationLength, PreviousMode); - - if(!NT_SUCCESS(Status)) + if (!NT_SUCCESS(Status)) { /* Invalid buffers */ DPRINT("NtSetInformationToken() failed, Status: 0x%x\n", Status); return Status; } - - if(TokenInformationClass == TokenSessionId) + + if (TokenInformationClass == TokenSessionId) { NeededAccess |= TOKEN_ADJUST_SESSIONID; } - + Status = ObReferenceObjectByHandle(TokenHandle, NeededAccess, SepTokenObjectType, @@ -1607,11 +1612,11 @@ NtSetInformationToken(IN HANDLE TokenHandle, { case TokenOwner: { - if(TokenInformationLength >= sizeof(TOKEN_OWNER)) + if (TokenInformationLength >= sizeof(TOKEN_OWNER)) { PTOKEN_OWNER to = (PTOKEN_OWNER)TokenInformation; PSID InputSid = NULL, CapturedSid; - + _SEH2_TRY { InputSid = to->Owner; @@ -1621,13 +1626,13 @@ NtSetInformationToken(IN HANDLE TokenHandle, _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; - + Status = SepCaptureSid(InputSid, PreviousMode, PagedPool, FALSE, &CapturedSid); - if(NT_SUCCESS(Status)) + if (NT_SUCCESS(Status)) { RtlCopySid(RtlLengthSid(CapturedSid), Token->UserAndGroups[Token->DefaultOwnerIndex].Sid, @@ -1643,14 +1648,14 @@ NtSetInformationToken(IN HANDLE TokenHandle, } break; } - + case TokenPrimaryGroup: { - if(TokenInformationLength >= sizeof(TOKEN_PRIMARY_GROUP)) + if (TokenInformationLength >= sizeof(TOKEN_PRIMARY_GROUP)) { PTOKEN_PRIMARY_GROUP tpg = (PTOKEN_PRIMARY_GROUP)TokenInformation; PSID InputSid = NULL, CapturedSid; - + _SEH2_TRY { InputSid = tpg->PrimaryGroup; @@ -1660,13 +1665,13 @@ NtSetInformationToken(IN HANDLE TokenHandle, _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; - + Status = SepCaptureSid(InputSid, PreviousMode, PagedPool, FALSE, &CapturedSid); - if(NT_SUCCESS(Status)) + if (NT_SUCCESS(Status)) { RtlCopySid(RtlLengthSid(CapturedSid), Token->PrimaryGroup, @@ -1682,14 +1687,14 @@ NtSetInformationToken(IN HANDLE TokenHandle, } break; } - + case TokenDefaultDacl: { - if(TokenInformationLength >= sizeof(TOKEN_DEFAULT_DACL)) + if (TokenInformationLength >= sizeof(TOKEN_DEFAULT_DACL)) { PTOKEN_DEFAULT_DACL tdd = (PTOKEN_DEFAULT_DACL)TokenInformation; PACL InputAcl = NULL; - + _SEH2_TRY { InputAcl = tdd->DefaultDacl; @@ -1700,7 +1705,7 @@ NtSetInformationToken(IN HANDLE TokenHandle, } _SEH2_END; - if(InputAcl != NULL) + if (InputAcl != NULL) { PACL CapturedAcl; @@ -1710,7 +1715,7 @@ NtSetInformationToken(IN HANDLE TokenHandle, PagedPool, TRUE, &CapturedAcl); - if(NT_SUCCESS(Status)) + if (NT_SUCCESS(Status)) { /* free the previous dacl if present */ if(Token->DefaultDacl != NULL) @@ -1725,7 +1730,7 @@ NtSetInformationToken(IN HANDLE TokenHandle, else { /* clear and free the default dacl if present */ - if(Token->DefaultDacl != NULL) + if (Token->DefaultDacl != NULL) { ExFreePool(Token->DefaultDacl); Token->DefaultDacl = NULL; @@ -1738,11 +1743,11 @@ NtSetInformationToken(IN HANDLE TokenHandle, } break; } - + case TokenSessionId: { ULONG SessionId = 0; - + _SEH2_TRY { /* buffer size was already verified, no need to check here again */ @@ -1753,9 +1758,9 @@ NtSetInformationToken(IN HANDLE TokenHandle, _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; - - if(!SeSinglePrivilegeCheck(SeTcbPrivilege, - PreviousMode)) + + if (!SeSinglePrivilegeCheck(SeTcbPrivilege, + PreviousMode)) { Status = STATUS_PRIVILEGE_NOT_HELD; break; @@ -1764,18 +1769,18 @@ NtSetInformationToken(IN HANDLE TokenHandle, Token->SessionId = SessionId; break; } - + default: { Status = STATUS_NOT_IMPLEMENTED; break; } } - + ObDereferenceObject(Token); } - - return(Status); + + return Status; } @@ -1802,11 +1807,11 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle, PSECURITY_QUALITY_OF_SERVICE CapturedSecurityQualityOfService; BOOLEAN QoSPresent; NTSTATUS Status; - + PAGED_CODE(); - + PreviousMode = KeGetPreviousMode(); - + if (PreviousMode != KernelMode) { _SEH2_TRY @@ -1820,19 +1825,19 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle, } _SEH2_END; } - + Status = SepCaptureSecurityQualityOfService(ObjectAttributes, PreviousMode, PagedPool, FALSE, &CapturedSecurityQualityOfService, &QoSPresent); - if(!NT_SUCCESS(Status)) + if (!NT_SUCCESS(Status)) { DPRINT1("NtDuplicateToken() failed to capture QoS! Status: 0x%x\n", Status); return Status; } - + Status = ObReferenceObjectByHandle(ExistingTokenHandle, TOKEN_DUPLICATE, SepTokenObjectType, @@ -1848,9 +1853,9 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle, (QoSPresent ? CapturedSecurityQualityOfService->ImpersonationLevel : SecurityAnonymous), PreviousMode, &NewToken); - + ObDereferenceObject(Token); - + if (NT_SUCCESS(Status)) { Status = ObInsertObject((PVOID)NewToken, @@ -1859,7 +1864,7 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle, 0, NULL, &hToken); - + if (NT_SUCCESS(Status)) { _SEH2_TRY @@ -1874,12 +1879,12 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle, } } } - + /* free the captured structure */ SepReleaseSecurityQualityOfService(CapturedSecurityQualityOfService, PreviousMode, FALSE); - + return Status; } @@ -1899,12 +1904,12 @@ NtAdjustGroupsToken(IN HANDLE TokenHandle, * @implemented */ NTSTATUS NTAPI -NtAdjustPrivilegesToken (IN HANDLE TokenHandle, - IN BOOLEAN DisableAllPrivileges, - IN PTOKEN_PRIVILEGES NewState, - IN ULONG BufferLength, - OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL, - OUT PULONG ReturnLength OPTIONAL) +NtAdjustPrivilegesToken(IN HANDLE TokenHandle, + IN BOOLEAN DisableAllPrivileges, + IN PTOKEN_PRIVILEGES NewState, + IN ULONG BufferLength, + OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL, + OUT PULONG ReturnLength OPTIONAL) { // PLUID_AND_ATTRIBUTES Privileges; KPROCESSOR_MODE PreviousMode; @@ -1921,11 +1926,11 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle, ULONG c; #endif NTSTATUS Status; - + PAGED_CODE(); - + DPRINT ("NtAdjustPrivilegesToken() called\n"); - + // PrivilegeCount = NewState->PrivilegeCount; PreviousMode = KeGetPreviousMode (); // SeCaptureLuidAndAttributesArray(NewState->Privileges, @@ -1937,7 +1942,7 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle, // 1, // &Privileges, // &Length); - + Status = ObReferenceObjectByHandle (TokenHandle, TOKEN_ADJUST_PRIVILEGES | (PreviousState != NULL ? TOKEN_QUERY : 0), SepTokenObjectType, @@ -1952,8 +1957,8 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle, // 0); return Status; } - - + + #if 0 SepAdjustPrivileges(Token, 0, @@ -1965,13 +1970,13 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle, &b, &c); #endif - + PrivilegeCount = (BufferLength - FIELD_OFFSET(TOKEN_PRIVILEGES, Privileges)) / sizeof(LUID_AND_ATTRIBUTES); - + if (PreviousState != NULL) PreviousState->PrivilegeCount = 0; - + k = 0; if (DisableAllPrivileges == TRUE) { @@ -1980,7 +1985,7 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle, if (Token->Privileges[i].Attributes != 0) { DPRINT ("Attributes differ\n"); - + /* Save current privilege */ if (PreviousState != NULL) { @@ -1997,13 +2002,15 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle, * accordingly and fail. */ } + k++; } - + /* Update current privlege */ Token->Privileges[i].Attributes &= ~SE_PRIVILEGE_ENABLED; } } + Status = STATUS_SUCCESS; } else @@ -2017,7 +2024,7 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle, Token->Privileges[i].Luid.HighPart == NewState->Privileges[j].Luid.HighPart) { DPRINT ("Found privilege\n"); - + if ((Token->Privileges[i].Attributes & SE_PRIVILEGE_ENABLED) != (NewState->Privileges[j].Attributes & SE_PRIVILEGE_ENABLED)) { @@ -2025,7 +2032,7 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle, DPRINT ("Current attributes %lx desired attributes %lx\n", Token->Privileges[i].Attributes, NewState->Privileges[j].Attributes); - + /* Save current privilege */ if (PreviousState != NULL) { @@ -2042,9 +2049,10 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle, * accordingly and fail. */ } + k++; } - + /* Update current privlege */ Token->Privileges[i].Attributes &= ~SE_PRIVILEGE_ENABLED; Token->Privileges[i].Attributes |= @@ -2052,27 +2060,29 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle, DPRINT ("New attributes %lx\n", Token->Privileges[i].Attributes); } + Count++; } } } + Status = Count < NewState->PrivilegeCount ? STATUS_NOT_ALL_ASSIGNED : STATUS_SUCCESS; } - + if (ReturnLength != NULL) { *ReturnLength = sizeof(TOKEN_PRIVILEGES) + (sizeof(LUID_AND_ATTRIBUTES) * (k - 1)); } - + ObDereferenceObject (Token); - + // SeReleaseLuidAndAttributesArray(Privileges, // PreviousMode, // 0); - + DPRINT ("NtAdjustPrivilegesToken() done\n"); - + return Status; } @@ -2097,12 +2107,12 @@ NtCreateToken(OUT PHANDLE TokenHandle, ULONG nTokenPrivileges = 0; LARGE_INTEGER LocalExpirationTime = {{0, 0}}; NTSTATUS Status; - + PAGED_CODE(); - + PreviousMode = ExGetPreviousMode(); - - if(PreviousMode != KernelMode) + + if (PreviousMode != KernelMode) { _SEH2_TRY { @@ -2146,7 +2156,7 @@ NtCreateToken(OUT PHANDLE TokenHandle, nTokenPrivileges = TokenPrivileges->PrivilegeCount; LocalExpirationTime = *ExpirationTime; } - + Status = SepCreateToken(&hToken, PreviousMode, DesiredAccess, @@ -2178,7 +2188,7 @@ NtCreateToken(OUT PHANDLE TokenHandle, } _SEH2_END; } - + return Status; } @@ -2204,11 +2214,11 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, PACL Dacl = NULL; KPROCESSOR_MODE PreviousMode; NTSTATUS Status; - + PAGED_CODE(); - + PreviousMode = ExGetPreviousMode(); - + if (PreviousMode != KernelMode) { _SEH2_TRY @@ -2222,12 +2232,12 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, } _SEH2_END; } - + /* * At first open the thread token for information access and verify * that the token associated with thread is valid. */ - + Status = ObReferenceObjectByHandle(ThreadHandle, THREAD_QUERY_INFORMATION, PsThreadType, PreviousMode, (PVOID*)&Thread, NULL); @@ -2235,7 +2245,7 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, { return Status; } - + Token = PsReferenceImpersonationToken(Thread, &CopyOnOpen, &EffectiveOnly, &ImpersonationLevel); if (Token == NULL) @@ -2243,23 +2253,23 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, ObDereferenceObject(Thread); return STATUS_NO_TOKEN; } - + if (ImpersonationLevel == SecurityAnonymous) { PsDereferenceImpersonationToken(Token); ObDereferenceObject(Thread); return STATUS_CANT_OPEN_ANONYMOUS; } - + /* * Revert to self if OpenAsSelf is specified. */ - + if (OpenAsSelf) { PsDisableImpersonation(PsGetCurrentThread(), &ImpersonationState); } - + if (CopyOnOpen) { Status = ObReferenceObjectByHandle(ThreadHandle, THREAD_ALL_ACCESS, @@ -2268,11 +2278,11 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, if (NT_SUCCESS(Status)) { PrimaryToken = PsReferencePrimaryToken(NewThread->ThreadsProcess); - + Status = SepCreateImpersonationTokenDacl(Token, PrimaryToken, &Dacl); ObFastDereferenceObject(&NewThread->ThreadsProcess->Token, PrimaryToken); - + if (NT_SUCCESS(Status)) { if (Dacl) @@ -2282,10 +2292,10 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, RtlSetDaclSecurityDescriptor(&SecurityDescriptor, TRUE, Dacl, FALSE); } - + InitializeObjectAttributes(&ObjectAttributes, NULL, HandleAttributes, NULL, Dacl ? &SecurityDescriptor : NULL); - + Status = SepDuplicateToken(Token, &ObjectAttributes, EffectiveOnly, TokenImpersonation, ImpersonationLevel, @@ -2305,26 +2315,26 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, NULL, DesiredAccess, SepTokenObjectType, PreviousMode, &hToken); } - + if (Dacl) ExFreePool(Dacl); - + if (OpenAsSelf) { PsRestoreImpersonation(PsGetCurrentThread(), &ImpersonationState); } - + ObDereferenceObject(Token); - + if (NT_SUCCESS(Status) && CopyOnOpen) { PsImpersonateClient(Thread, NewToken, FALSE, EffectiveOnly, ImpersonationLevel); } - + if (NewToken) ObDereferenceObject(NewToken); if (CopyOnOpen && NewThread) ObDereferenceObject(NewThread); - if(NT_SUCCESS(Status)) + if (NT_SUCCESS(Status)) { _SEH2_TRY { @@ -2336,7 +2346,7 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, } _SEH2_END; } - + return Status; } @@ -2368,11 +2378,11 @@ NtCompareTokens(IN HANDLE FirstTokenHandle, PTOKEN FirstToken, SecondToken; BOOLEAN IsEqual; NTSTATUS Status; - + PAGED_CODE(); - + PreviousMode = ExGetPreviousMode(); - + if (PreviousMode != KernelMode) { _SEH2_TRY @@ -2386,7 +2396,7 @@ NtCompareTokens(IN HANDLE FirstTokenHandle, } _SEH2_END; } - + Status = ObReferenceObjectByHandle(FirstTokenHandle, TOKEN_QUERY, SepTokenObjectType, @@ -2395,7 +2405,7 @@ NtCompareTokens(IN HANDLE FirstTokenHandle, NULL); if (!NT_SUCCESS(Status)) return Status; - + Status = ObReferenceObjectByHandle(SecondTokenHandle, TOKEN_QUERY, SepTokenObjectType, @@ -2407,7 +2417,7 @@ NtCompareTokens(IN HANDLE FirstTokenHandle, ObDereferenceObject(FirstToken); return Status; } - + if (FirstToken != SecondToken) { Status = SepCompareTokens(FirstToken, @@ -2416,10 +2426,10 @@ NtCompareTokens(IN HANDLE FirstTokenHandle, } else IsEqual = TRUE; - + ObDereferenceObject(FirstToken); ObDereferenceObject(SecondToken); - + if (NT_SUCCESS(Status)) { _SEH2_TRY @@ -2432,7 +2442,7 @@ NtCompareTokens(IN HANDLE FirstTokenHandle, } _SEH2_END; } - + return Status; }