[NTOSKRNL]: Fix what should be at least 40 KmTest:ob failures, by correctly using the right attributes, security mappings, flags, names, etc... for the object types. This probably fixes countless subtle bugs in applications/drivers that were non-obvious before, especially now that Device names are case insensitive, or that asking for certain GENERIC rights translates correctly.

Thank you thfabba (Thomas Fabber) for one of the most useful, yet ignored, tests in our suite. Hope this makes it up to you.

svn path=/trunk/; revision=57225
This commit is contained in:
Alex Ionescu 2012-09-02 22:06:42 +00:00
parent 3bd32fbc1b
commit fdf0f24838
22 changed files with 108 additions and 48 deletions

View file

@ -82,10 +82,10 @@ extern ULONG NTSYSAPI NtBuildNumber;
//
// Callback Object Access Mask
//
#define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x0001)
#define CALLBACK_EXECUTE (STANDARD_RIGHTS_EXECUTE|SYNCHRONIZE|0x0001)
#define CALLBACK_WRITE (STANDARD_RIGHTS_WRITE|SYNCHRONIZE|0x0001)
#define CALLBACK_READ (STANDARD_RIGHTS_READ|SYNCHRONIZE|0x0001)
#define CALLBACK_MODIFY_STATE 0x0001
#define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
SYNCHRONIZE | \
CALLBACK_MODIFY_STATE)
//
// Event Object Access Masks

View file

@ -44,7 +44,9 @@ extern POBJECT_TYPE NTSYSAPI LpcPortObjectType;
// Port Object Access Masks
//
#define PORT_CONNECT 0x1
#define PORT_ALL_ACCESS 0x1
#define PORT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
SYNCHRONIZE | \
PORT_CONNECT)
//
// Port Object Flags

View file

@ -416,6 +416,21 @@ typedef struct _SEGMENT
MMPTE ThePtes[1];
} SEGMENT, *PSEGMENT;
typedef struct _MAPPED_FILE_SEGMENT
{
struct _CONTROL_AREA *ControlArea;
ULONG TotalNumberOfPtes;
ULONG NonExtendedPtes;
ULONG Spare0;
UINT64 SizeOfSegment;
MMPTE SegmentPteTemplate;
SIZE_T NumberOfCommittedPages;
PMMEXTEND_INFO ExtendInfo;
SEGMENT_FLAGS SegmentFlags;
PVOID BasedAddress;
struct _MSUBSECTION *LastSubsectionHint;
} MAPPED_FILE_SEGMENT, *PMAPPED_FILE_SEGMENT;
//
// Event Counter Structure
//

View file

@ -866,6 +866,7 @@ CmpCreateObjectTypes(VOID)
ObjectTypeInitializer.QueryNameProcedure = CmpQueryKeyName;
ObjectTypeInitializer.CloseProcedure = CmpCloseKeyObject;
ObjectTypeInitializer.SecurityRequired = TRUE;
ObjectTypeInitializer.InvalidAttributes = OBJ_EXCLUSIVE | OBJ_PERMANENT;
/* Create it */
return ObCreateObjectType(&Name, &ObjectTypeInitializer, NULL, &CmpKeyObjectType);

View file

@ -1495,7 +1495,7 @@ DbgkInitialize(VOID)
ObjectTypeInitializer.GenericMapping = DbgkDebugObjectMapping;
ObjectTypeInitializer.PoolType = NonPagedPool;
ObjectTypeInitializer.ValidAccessMask = DEBUG_OBJECT_ALL_ACCESS;
ObjectTypeInitializer.UseDefaultObject = TRUE;
ObjectTypeInitializer.SecurityRequired = TRUE;
ObjectTypeInitializer.CloseProcedure = DbgkpCloseObject;
ObjectTypeInitializer.DeleteProcedure = DbgkpDeleteObject;
ObCreateObjectType(&Name,

View file

@ -17,9 +17,9 @@
/* Mapping for Callback Object */
GENERIC_MAPPING ExpCallbackMapping =
{
CALLBACK_READ,
CALLBACK_WRITE,
CALLBACK_EXECUTE,
STANDARD_RIGHTS_READ,
STANDARD_RIGHTS_WRITE | CALLBACK_MODIFY_STATE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
CALLBACK_ALL_ACCESS
};

View file

@ -23,10 +23,11 @@ POBJECT_TYPE _ExEventObjectType = NULL;
GENERIC_MAPPING ExpEventMapping =
{
STANDARD_RIGHTS_READ | SYNCHRONIZE | EVENT_QUERY_STATE,
STANDARD_RIGHTS_WRITE | SYNCHRONIZE | EVENT_MODIFY_STATE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE | EVENT_QUERY_STATE,
EVENT_ALL_ACCESS};
STANDARD_RIGHTS_READ | EVENT_QUERY_STATE,
STANDARD_RIGHTS_WRITE | EVENT_MODIFY_STATE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
EVENT_ALL_ACCESS
};
static const INFORMATION_CLASS_INFO ExEventInfoClass[] =
{
@ -53,6 +54,7 @@ ExpInitializeEventImplementation(VOID)
ObjectTypeInitializer.GenericMapping = ExpEventMapping;
ObjectTypeInitializer.PoolType = NonPagedPool;
ObjectTypeInitializer.ValidAccessMask = EVENT_ALL_ACCESS;
ObjectTypeInitializer.InvalidAttributes = OBJ_OPENLINK;
ObCreateObjectType(&Name, &ObjectTypeInitializer, NULL, &ExEventObjectType);
}

View file

@ -23,8 +23,8 @@ POBJECT_TYPE ExEventPairObjectType = NULL;
GENERIC_MAPPING ExEventPairMapping =
{
STANDARD_RIGHTS_READ,
STANDARD_RIGHTS_WRITE,
STANDARD_RIGHTS_READ | SYNCHRONIZE,
STANDARD_RIGHTS_WRITE | SYNCHRONIZE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
EVENT_PAIR_ALL_ACCESS
};
@ -49,6 +49,7 @@ ExpInitializeEventPairImplementation(VOID)
ObjectTypeInitializer.PoolType = NonPagedPool;
ObjectTypeInitializer.ValidAccessMask = EVENT_PAIR_ALL_ACCESS;
ObjectTypeInitializer.UseDefaultObject = TRUE;
ObjectTypeInitializer.InvalidAttributes = OBJ_OPENLINK;
ObCreateObjectType(&Name, &ObjectTypeInitializer, NULL, &ExEventPairObjectType);
}

View file

@ -664,13 +664,12 @@ ExpInitSystemPhase1(VOID)
/* Initialize events and event pairs */
ExpInitializeEventImplementation();
ExpInitializeEventPairImplementation();
ExpInitializeKeyedEventImplementation();
/* Initialize callbacks */
ExpInitializeCallbacks();
/* Initialize mutants */
ExpInitializeMutantImplementation();
/* Initialize callbacks */
ExpInitializeCallbacks();
/* Initialize semaphores */
ExpInitializeSemaphoreImplementation();
@ -683,6 +682,9 @@ ExpInitSystemPhase1(VOID)
/* Initialize UUIDs */
ExpInitUuids();
/* Initialize keyed events */
ExpInitializeKeyedEventImplementation();
/* Initialize Win32K */
ExpWin32kInit();

View file

@ -42,7 +42,7 @@ GENERIC_MAPPING ExpKeyedEventMapping =
{
STANDARD_RIGHTS_READ | EVENT_QUERY_STATE,
STANDARD_RIGHTS_WRITE | EVENT_MODIFY_STATE,
STANDARD_RIGHTS_EXECUTE | EVENT_QUERY_STATE,
STANDARD_RIGHTS_EXECUTE,
EVENT_ALL_ACCESS
};
@ -60,7 +60,8 @@ ExpInitializeKeyedEventImplementation(VOID)
/* Set up the object type initializer */
ObjectTypeInitializer.Length = sizeof(ObjectTypeInitializer);
ObjectTypeInitializer.GenericMapping = ExpKeyedEventMapping;
ObjectTypeInitializer.PoolType = NonPagedPool;
ObjectTypeInitializer.PoolType = PagedPool;
ObjectTypeInitializer.ValidAccessMask = EVENT_ALL_ACCESS;
//ObjectTypeInitializer.DeleteProcedure = ???;
//ObjectTypeInitializer.OkayToCloseProcedure = ???;

View file

@ -23,9 +23,9 @@ POBJECT_TYPE ExMutantObjectType = NULL;
GENERIC_MAPPING ExpMutantMapping =
{
STANDARD_RIGHTS_READ | SYNCHRONIZE | MUTANT_QUERY_STATE,
STANDARD_RIGHTS_WRITE | SYNCHRONIZE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE | MUTANT_QUERY_STATE,
STANDARD_RIGHTS_READ | MUTANT_QUERY_STATE,
STANDARD_RIGHTS_WRITE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
MUTANT_ALL_ACCESS
};

View file

@ -82,6 +82,7 @@ ExpInitializeProfileImplementation(VOID)
ObjectTypeInitializer.PoolType = NonPagedPool;
ObjectTypeInitializer.DeleteProcedure = ExpDeleteProfile;
ObjectTypeInitializer.ValidAccessMask = PROFILE_ALL_ACCESS;
ObjectTypeInitializer.InvalidAttributes = OBJ_OPENLINK;
ObCreateObjectType(&Name, &ObjectTypeInitializer, NULL, &ExProfileObjectType);
}

View file

@ -23,9 +23,9 @@ POBJECT_TYPE _ExSemaphoreObjectType;
GENERIC_MAPPING ExSemaphoreMapping =
{
STANDARD_RIGHTS_READ | SEMAPHORE_QUERY_STATE,
STANDARD_RIGHTS_WRITE | SEMAPHORE_MODIFY_STATE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE | SEMAPHORE_QUERY_STATE,
STANDARD_RIGHTS_READ | SEMAPHORE_QUERY_STATE,
STANDARD_RIGHTS_WRITE | SEMAPHORE_MODIFY_STATE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
SEMAPHORE_ALL_ACCESS
};

View file

@ -151,6 +151,11 @@ ExpWin32kInit(VOID)
ObjectTypeInitializer.DeleteProcedure = ExpWinStaObjectDelete;
ObjectTypeInitializer.ParseProcedure = ExpWinStaObjectParse;
ObjectTypeInitializer.OkayToCloseProcedure = ExpWindowStationOkToClose;
ObjectTypeInitializer.MaintainHandleCount = TRUE;
ObjectTypeInitializer.SecurityRequired = TRUE;
ObjectTypeInitializer.InvalidAttributes = OBJ_OPENLINK |
OBJ_PERMANENT |
OBJ_EXCLUSIVE;
ObCreateObjectType(&Name,
&ObjectTypeInitializer,
NULL,

View file

@ -19,9 +19,9 @@ GENERAL_LOOKASIDE IoCompletionPacketLookaside;
GENERIC_MAPPING IopCompletionMapping =
{
STANDARD_RIGHTS_READ | IO_COMPLETION_QUERY_STATE,
STANDARD_RIGHTS_WRITE | IO_COMPLETION_MODIFY_STATE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE | IO_COMPLETION_QUERY_STATE,
STANDARD_RIGHTS_READ | IO_COMPLETION_QUERY_STATE,
STANDARD_RIGHTS_WRITE | IO_COMPLETION_MODIFY_STATE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
IO_COMPLETION_ALL_ACCESS
};

View file

@ -273,6 +273,7 @@ IopCreateObjectTypes(VOID)
ObjectTypeInitializer.DeleteProcedure = IopDeleteDevice;
ObjectTypeInitializer.ParseProcedure = IopParseDevice;
ObjectTypeInitializer.SecurityProcedure = IopSecurityFile;
ObjectTypeInitializer.CaseInsensitive = TRUE;
if (!NT_SUCCESS(ObCreateObjectType(&Name,
&ObjectTypeInitializer,
NULL,

View file

@ -14,17 +14,17 @@
/* GLOBALS *******************************************************************/
POBJECT_TYPE LpcPortObjectType;
POBJECT_TYPE LpcPortObjectType, LpcWaitablePortObjectType;
ULONG LpcpMaxMessageSize;
PAGED_LOOKASIDE_LIST LpcpMessagesLookaside;
KGUARDED_MUTEX LpcpLock;
ULONG LpcpTraceLevel = 0;
ULONG LpcpNextMessageId = 1, LpcpNextCallbackId = 1;
static GENERIC_MAPPING LpcpPortMapping =
static GENERIC_MAPPING LpcpPortMapping =
{
STANDARD_RIGHTS_READ,
STANDARD_RIGHTS_WRITE,
READ_CONTROL | PORT_CONNECT,
DELETE | PORT_CONNECT,
0,
PORT_ALL_ACCESS
};
@ -46,19 +46,30 @@ LpcInitSystem(VOID)
RtlZeroMemory(&ObjectTypeInitializer, sizeof(ObjectTypeInitializer));
RtlInitUnicodeString(&Name, L"Port");
ObjectTypeInitializer.Length = sizeof(ObjectTypeInitializer);
ObjectTypeInitializer.DefaultNonPagedPoolCharge = sizeof(LPCP_PORT_OBJECT);
ObjectTypeInitializer.DefaultPagedPoolCharge = sizeof(LPCP_NONPAGED_PORT_QUEUE);
ObjectTypeInitializer.DefaultNonPagedPoolCharge = sizeof(LPCP_NONPAGED_PORT_QUEUE);
ObjectTypeInitializer.DefaultPagedPoolCharge = FIELD_OFFSET(LPCP_PORT_OBJECT, WaitEvent);
ObjectTypeInitializer.GenericMapping = LpcpPortMapping;
ObjectTypeInitializer.PoolType = PagedPool;
ObjectTypeInitializer.UseDefaultObject = TRUE;
ObjectTypeInitializer.CloseProcedure = LpcpClosePort;
ObjectTypeInitializer.DeleteProcedure = LpcpDeletePort;
ObjectTypeInitializer.ValidAccessMask = PORT_ALL_ACCESS;
ObjectTypeInitializer.InvalidAttributes = OBJ_VALID_ATTRIBUTES & ~OBJ_CASE_INSENSITIVE;
ObCreateObjectType(&Name,
&ObjectTypeInitializer,
NULL,
&LpcPortObjectType);
RtlInitUnicodeString(&Name, L"WaitablePort");
ObjectTypeInitializer.PoolType = NonPagedPool;
ObjectTypeInitializer.DefaultNonPagedPoolCharge += sizeof(LPCP_PORT_OBJECT);
ObjectTypeInitializer.DefaultPagedPoolCharge = 0;
ObjectTypeInitializer.UseDefaultObject = FALSE;
ObCreateObjectType(&Name,
&ObjectTypeInitializer,
NULL,
&LpcWaitablePortObjectType);
/* Allocate the LPC lookaside list */
LpcpMaxMessageSize = LPCP_MAX_MESSAGE_SIZE;
ExInitializePagedLookasideList(&LpcpMessagesLookaside,

View file

@ -2766,6 +2766,7 @@ MmInitSectionImplementation(VOID)
ObjectTypeInitializer.DeleteProcedure = MmpDeleteSection;
ObjectTypeInitializer.CloseProcedure = MmpCloseSection;
ObjectTypeInitializer.ValidAccessMask = SECTION_ALL_ACCESS;
ObjectTypeInitializer.InvalidAttributes = OBJ_OPENLINK;
ObCreateObjectType(&Name, &ObjectTypeInitializer, NULL, &MmSectionObjectType);
MmCreatePhysicalMemorySection();

View file

@ -202,6 +202,7 @@ ObInitSystem(VOID)
/* Create the Directory Type */
RtlInitUnicodeString(&Name, L"Directory");
ObjectTypeInitializer.PoolType = PagedPool;
ObjectTypeInitializer.ValidAccessMask = DIRECTORY_ALL_ACCESS;
ObjectTypeInitializer.CaseInsensitive = TRUE;
ObjectTypeInitializer.MaintainTypeList = FALSE;
@ -209,6 +210,7 @@ ObInitSystem(VOID)
ObjectTypeInitializer.DeleteProcedure = NULL;
ObjectTypeInitializer.DefaultNonPagedPoolCharge = sizeof(OBJECT_DIRECTORY);
ObCreateObjectType(&Name, &ObjectTypeInitializer, NULL, &ObDirectoryType);
ObDirectoryType->TypeInfo.ValidAccessMask &= ~SYNCHRONIZE;
/* Create 'symbolic link' object type */
RtlInitUnicodeString(&Name, L"SymbolicLink");
@ -218,6 +220,7 @@ ObInitSystem(VOID)
ObjectTypeInitializer.ParseProcedure = ObpParseSymbolicLink;
ObjectTypeInitializer.DeleteProcedure = ObpDeleteSymbolicLink;
ObCreateObjectType(&Name, &ObjectTypeInitializer, NULL, &ObSymbolicLinkType);
ObSymbolicLinkType->TypeInfo.ValidAccessMask &= ~SYNCHRONIZE;
/* Phase 0 initialization complete */
ObpInitializationPhase++;

View file

@ -1027,11 +1027,11 @@ ObCreateObjectType(IN PUNICODE_STRING TypeName,
POBJECT_TYPE LocalObjectType;
ULONG HeaderSize;
NTSTATUS Status;
CHAR Tag[4];
OBP_LOOKUP_CONTEXT Context;
PWCHAR p;
ULONG i;
UNICODE_STRING ObjectName;
ANSI_STRING AnsiName;
POBJECT_HEADER_CREATOR_INFO CreatorInfo;
/* Verify parameters */
@ -1136,12 +1136,22 @@ ObCreateObjectType(IN PUNICODE_STRING TypeName,
}
else
{
/* Set Tag */
Tag[0] = (CHAR)TypeName->Buffer[0];
Tag[1] = (CHAR)TypeName->Buffer[1];
Tag[2] = (CHAR)TypeName->Buffer[2];
Tag[3] = (CHAR)TypeName->Buffer[3];
LocalObjectType->Key = *(PULONG)Tag;
/* Convert the tag to ASCII */
Status = RtlUnicodeStringToAnsiString(&AnsiName, TypeName, TRUE);
if (NT_SUCCESS(Status))
{
/* For every missing character, use a space */
for (i = 3; i >= AnsiName.Length; i--) AnsiName.Buffer[i] = ' ';
/* Set the key and free the converted name */
LocalObjectType->Key = *(PULONG)AnsiName.Buffer;
ExFreePool(AnsiName.Buffer);
}
else
{
/* Just copy the characters */
LocalObjectType->Key = *(PULONG)TypeName->Buffer;
}
}
/* Set up the type information */

View file

@ -40,9 +40,13 @@ CHAR PspJobSchedulingClasses[PSP_JOB_SCHEDULING_CLASSES] =
GENERIC_MAPPING PspJobMapping =
{
STANDARD_RIGHTS_READ | JOB_OBJECT_QUERY,
STANDARD_RIGHTS_WRITE | JOB_OBJECT_ASSIGN_PROCESS | JOB_OBJECT_SET_ATTRIBUTES | JOB_OBJECT_TERMINATE | JOB_OBJECT_SET_SECURITY_ATTRIBUTES,
STANDARD_RIGHTS_WRITE | JOB_OBJECT_ASSIGN_PROCESS |
JOB_OBJECT_SET_ATTRIBUTES | JOB_OBJECT_TERMINATE,
STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
STANDARD_RIGHTS_ALL | JOB_OBJECT_ALL_ACCESS
STANDARD_RIGHTS_ALL | THREAD_ALL_ACCESS // bug fixed only in vista
};
/* FUNCTIONS *****************************************************************/

View file

@ -500,8 +500,7 @@ PspInitPhase0(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
/* Initialize Object Initializer */
RtlZeroMemory(&ObjectTypeInitializer, sizeof(ObjectTypeInitializer));
ObjectTypeInitializer.Length = sizeof(ObjectTypeInitializer);
ObjectTypeInitializer.InvalidAttributes = OBJ_OPENLINK |
OBJ_PERMANENT |
ObjectTypeInitializer.InvalidAttributes = OBJ_PERMANENT |
OBJ_EXCLUSIVE |
OBJ_OPENIF;
ObjectTypeInitializer.PoolType = NonPagedPool;
@ -529,6 +528,7 @@ PspInitPhase0(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
ObjectTypeInitializer.Length = sizeof(ObjectTypeInitializer);
ObjectTypeInitializer.DefaultNonPagedPoolCharge = sizeof(EJOB);
ObjectTypeInitializer.GenericMapping = PspJobMapping;
ObjectTypeInitializer.InvalidAttributes = 0;
ObjectTypeInitializer.ValidAccessMask = JOB_OBJECT_ALL_ACCESS;
ObjectTypeInitializer.DeleteProcedure = PspDeleteJob;
ObCreateObjectType(&Name, &ObjectTypeInitializer, NULL, &PsJobType);