mirror of
https://github.com/reactos/reactos.git
synced 2024-08-20 02:13:29 +00:00
1569 lines
49 KiB
C
1569 lines
49 KiB
C
/*
|
|
* COPYRIGHT: See COPYING in the top level directory
|
|
* PROJECT: ReactOS kernel
|
|
* FILE: ntoskrnl/se/audit.c
|
|
* PURPOSE: Audit functions
|
|
*
|
|
* PROGRAMMERS: Eric Kohl
|
|
* Timo Kreuzer (timo.kreuzer@reactos.org)
|
|
*/
|
|
|
|
/* INCLUDES *******************************************************************/
|
|
|
|
#include <ntoskrnl.h>
|
|
#define NDEBUG
|
|
#include <debug.h>
|
|
|
|
#define SEP_PRIVILEGE_SET_MAX_COUNT 60
|
|
|
|
UNICODE_STRING SeSubsystemName = RTL_CONSTANT_STRING(L"Security");
|
|
|
|
/* PRIVATE FUNCTIONS***********************************************************/
|
|
|
|
BOOLEAN
|
|
NTAPI
|
|
SeDetailedAuditingWithToken(IN PTOKEN Token)
|
|
{
|
|
/* FIXME */
|
|
return FALSE;
|
|
}
|
|
|
|
VOID
|
|
NTAPI
|
|
SeAuditProcessCreate(IN PEPROCESS Process)
|
|
{
|
|
/* FIXME */
|
|
}
|
|
|
|
VOID
|
|
NTAPI
|
|
SeAuditProcessExit(IN PEPROCESS Process)
|
|
{
|
|
/* FIXME */
|
|
}
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
SeInitializeProcessAuditName(IN PFILE_OBJECT FileObject,
|
|
IN BOOLEAN DoAudit,
|
|
OUT POBJECT_NAME_INFORMATION *AuditInfo)
|
|
{
|
|
OBJECT_NAME_INFORMATION LocalNameInfo;
|
|
POBJECT_NAME_INFORMATION ObjectNameInfo = NULL;
|
|
ULONG ReturnLength = 8;
|
|
NTSTATUS Status;
|
|
|
|
PAGED_CODE();
|
|
ASSERT(AuditInfo);
|
|
|
|
/* Check if we should do auditing */
|
|
if (DoAudit)
|
|
{
|
|
/* FIXME: TODO */
|
|
}
|
|
|
|
/* Now query the name */
|
|
Status = ObQueryNameString(FileObject,
|
|
&LocalNameInfo,
|
|
sizeof(LocalNameInfo),
|
|
&ReturnLength);
|
|
if (((Status == STATUS_BUFFER_OVERFLOW) ||
|
|
(Status == STATUS_BUFFER_TOO_SMALL) ||
|
|
(Status == STATUS_INFO_LENGTH_MISMATCH)) &&
|
|
(ReturnLength != sizeof(LocalNameInfo)))
|
|
{
|
|
/* Allocate required size */
|
|
ObjectNameInfo = ExAllocatePoolWithTag(NonPagedPool,
|
|
ReturnLength,
|
|
TAG_SEPA);
|
|
if (ObjectNameInfo)
|
|
{
|
|
/* Query the name again */
|
|
Status = ObQueryNameString(FileObject,
|
|
ObjectNameInfo,
|
|
ReturnLength,
|
|
&ReturnLength);
|
|
}
|
|
}
|
|
|
|
/* Check if we got here due to failure */
|
|
if ((ObjectNameInfo) &&
|
|
(!(NT_SUCCESS(Status)) || (ReturnLength == sizeof(LocalNameInfo))))
|
|
{
|
|
/* First, free any buffer we might've allocated */
|
|
ASSERT(FALSE);
|
|
if (ObjectNameInfo) ExFreePool(ObjectNameInfo);
|
|
|
|
/* Now allocate a temporary one */
|
|
ReturnLength = sizeof(OBJECT_NAME_INFORMATION);
|
|
ObjectNameInfo = ExAllocatePoolWithTag(NonPagedPool,
|
|
sizeof(OBJECT_NAME_INFORMATION),
|
|
TAG_SEPA);
|
|
if (ObjectNameInfo)
|
|
{
|
|
/* Clear it */
|
|
RtlZeroMemory(ObjectNameInfo, ReturnLength);
|
|
Status = STATUS_SUCCESS;
|
|
}
|
|
}
|
|
|
|
/* Check if memory allocation failed */
|
|
if (!ObjectNameInfo) Status = STATUS_NO_MEMORY;
|
|
|
|
/* Return the audit name */
|
|
*AuditInfo = ObjectNameInfo;
|
|
|
|
/* Return status */
|
|
return Status;
|
|
}
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
SeLocateProcessImageName(IN PEPROCESS Process,
|
|
OUT PUNICODE_STRING *ProcessImageName)
|
|
{
|
|
POBJECT_NAME_INFORMATION AuditName;
|
|
PUNICODE_STRING ImageName;
|
|
PFILE_OBJECT FileObject;
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
|
|
PAGED_CODE();
|
|
|
|
/* Assume failure */
|
|
*ProcessImageName = NULL;
|
|
|
|
/* Check if we have audit info */
|
|
AuditName = Process->SeAuditProcessCreationInfo.ImageFileName;
|
|
if (!AuditName)
|
|
{
|
|
/* Get the file object */
|
|
Status = PsReferenceProcessFilePointer(Process, &FileObject);
|
|
if (!NT_SUCCESS(Status)) return Status;
|
|
|
|
/* Initialize the audit structure */
|
|
Status = SeInitializeProcessAuditName(FileObject, TRUE, &AuditName);
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
/* Set it */
|
|
if (InterlockedCompareExchangePointer((PVOID*)&Process->
|
|
SeAuditProcessCreationInfo.ImageFileName,
|
|
AuditName,
|
|
NULL))
|
|
{
|
|
/* Someone beat us to it, deallocate our copy */
|
|
ExFreePool(AuditName);
|
|
}
|
|
}
|
|
|
|
/* Dereference the file object */
|
|
ObDereferenceObject(FileObject);
|
|
if (!NT_SUCCESS(Status)) return Status;
|
|
}
|
|
|
|
/* Get audit info again, now we have it for sure */
|
|
AuditName = Process->SeAuditProcessCreationInfo.ImageFileName;
|
|
|
|
/* Allocate the output string */
|
|
ImageName = ExAllocatePoolWithTag(NonPagedPool,
|
|
AuditName->Name.MaximumLength +
|
|
sizeof(UNICODE_STRING),
|
|
TAG_SEPA);
|
|
if (!ImageName) return STATUS_NO_MEMORY;
|
|
|
|
/* Make a copy of it */
|
|
RtlCopyMemory(ImageName,
|
|
&AuditName->Name,
|
|
AuditName->Name.MaximumLength + sizeof(UNICODE_STRING));
|
|
|
|
/* Fix up the buffer */
|
|
ImageName->Buffer = (PWSTR)(ImageName + 1);
|
|
|
|
/* Return it */
|
|
*ProcessImageName = ImageName;
|
|
|
|
/* Return status */
|
|
return Status;
|
|
}
|
|
|
|
VOID
|
|
NTAPI
|
|
SepAdtCloseObjectAuditAlarm(
|
|
PUNICODE_STRING SubsystemName,
|
|
PVOID HandleId,
|
|
PSID Sid)
|
|
{
|
|
UNIMPLEMENTED;
|
|
}
|
|
|
|
VOID
|
|
NTAPI
|
|
SepAdtPrivilegedServiceAuditAlarm(
|
|
PSECURITY_SUBJECT_CONTEXT SubjectContext,
|
|
_In_opt_ PUNICODE_STRING SubsystemName,
|
|
_In_opt_ PUNICODE_STRING ServiceName,
|
|
_In_ PTOKEN Token,
|
|
_In_ PTOKEN PrimaryToken,
|
|
_In_ PPRIVILEGE_SET Privileges,
|
|
_In_ BOOLEAN AccessGranted)
|
|
{
|
|
DPRINT("SepAdtPrivilegedServiceAuditAlarm is unimplemented\n");
|
|
}
|
|
|
|
VOID
|
|
NTAPI
|
|
SePrivilegedServiceAuditAlarm(
|
|
_In_opt_ PUNICODE_STRING ServiceName,
|
|
_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext,
|
|
_In_ PPRIVILEGE_SET PrivilegeSet,
|
|
_In_ BOOLEAN AccessGranted)
|
|
{
|
|
PTOKEN EffectiveToken;
|
|
PSID UserSid;
|
|
PAGED_CODE();
|
|
|
|
/* Get the effective token */
|
|
if (SubjectContext->ClientToken != NULL)
|
|
EffectiveToken = SubjectContext->ClientToken;
|
|
else
|
|
EffectiveToken = SubjectContext->PrimaryToken;
|
|
|
|
/* Get the user SID */
|
|
UserSid = EffectiveToken->UserAndGroups->Sid;
|
|
|
|
/* Check if this is the local system SID */
|
|
if (RtlEqualSid(UserSid, SeLocalSystemSid))
|
|
{
|
|
/* Nothing to do */
|
|
return;
|
|
}
|
|
|
|
/* Check if this is the network service or local service SID */
|
|
if (RtlEqualSid(UserSid, SeExports->SeNetworkServiceSid) ||
|
|
RtlEqualSid(UserSid, SeExports->SeLocalServiceSid))
|
|
{
|
|
// FIXME: should continue for a certain set of privileges
|
|
return;
|
|
}
|
|
|
|
/* Call the worker function */
|
|
SepAdtPrivilegedServiceAuditAlarm(SubjectContext,
|
|
&SeSubsystemName,
|
|
ServiceName,
|
|
SubjectContext->ClientToken,
|
|
SubjectContext->PrimaryToken,
|
|
PrivilegeSet,
|
|
AccessGranted);
|
|
|
|
}
|
|
|
|
|
|
static
|
|
NTSTATUS
|
|
SeCaptureObjectTypeList(
|
|
_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
_In_ ULONG ObjectTypeListLength,
|
|
_In_ KPROCESSOR_MODE PreviousMode,
|
|
_Out_ POBJECT_TYPE_LIST *CapturedObjectTypeList)
|
|
{
|
|
SIZE_T Size;
|
|
|
|
if (PreviousMode == KernelMode)
|
|
{
|
|
return STATUS_NOT_IMPLEMENTED;
|
|
}
|
|
|
|
if (ObjectTypeListLength == 0)
|
|
{
|
|
*CapturedObjectTypeList = NULL;
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
if (ObjectTypeList == NULL)
|
|
{
|
|
return STATUS_INVALID_PARAMETER;
|
|
}
|
|
|
|
/* Calculate the list size and check for integer overflow */
|
|
Size = ObjectTypeListLength * sizeof(OBJECT_TYPE_LIST);
|
|
if (Size == 0)
|
|
{
|
|
return STATUS_INVALID_PARAMETER;
|
|
}
|
|
|
|
/* Allocate a new list */
|
|
*CapturedObjectTypeList = ExAllocatePoolWithTag(PagedPool, Size, TAG_SEPA);
|
|
if (*CapturedObjectTypeList == NULL)
|
|
{
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
_SEH2_TRY
|
|
{
|
|
ProbeForRead(ObjectTypeList, Size, sizeof(ULONG));
|
|
RtlCopyMemory(*CapturedObjectTypeList, ObjectTypeList, Size);
|
|
}
|
|
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
ExFreePoolWithTag(*CapturedObjectTypeList, TAG_SEPA);
|
|
*CapturedObjectTypeList = NULL;
|
|
_SEH2_YIELD(return _SEH2_GetExceptionCode());
|
|
}
|
|
_SEH2_END;
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
static
|
|
VOID
|
|
SeReleaseObjectTypeList(
|
|
_In_ _Post_invalid_ POBJECT_TYPE_LIST CapturedObjectTypeList,
|
|
_In_ KPROCESSOR_MODE PreviousMode)
|
|
{
|
|
if ((PreviousMode != KernelMode) && (CapturedObjectTypeList != NULL))
|
|
ExFreePoolWithTag(CapturedObjectTypeList, TAG_SEPA);
|
|
}
|
|
|
|
_Must_inspect_result_
|
|
static
|
|
NTSTATUS
|
|
SepAccessCheckAndAuditAlarmWorker(
|
|
_In_ PUNICODE_STRING SubsystemName,
|
|
_In_opt_ PVOID HandleId,
|
|
_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext,
|
|
_In_ PUNICODE_STRING ObjectTypeName,
|
|
_In_ PUNICODE_STRING ObjectName,
|
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
_In_opt_ PSID PrincipalSelfSid,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ AUDIT_EVENT_TYPE AuditType,
|
|
_In_ BOOLEAN HaveAuditPrivilege,
|
|
_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
_In_ ULONG ObjectTypeListLength,
|
|
_In_ PGENERIC_MAPPING GenericMapping,
|
|
_Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccessList,
|
|
_Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatusList,
|
|
_Out_ PBOOLEAN GenerateOnClose,
|
|
_In_ BOOLEAN UseResultList)
|
|
{
|
|
ULONG ResultListLength, i;
|
|
|
|
/* Get the length of the result list */
|
|
ResultListLength = UseResultList ? ObjectTypeListLength : 1;
|
|
|
|
/// FIXME: we should do some real work here...
|
|
UNIMPLEMENTED;
|
|
|
|
/// HACK: we just pretend all access is granted!
|
|
for (i = 0; i < ResultListLength; i++)
|
|
{
|
|
GrantedAccessList[i] = DesiredAccess;
|
|
AccessStatusList[i] = STATUS_SUCCESS;
|
|
}
|
|
|
|
*GenerateOnClose = FALSE;
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
_Must_inspect_result_
|
|
NTSTATUS
|
|
NTAPI
|
|
SepAccessCheckAndAuditAlarm(
|
|
_In_ PUNICODE_STRING SubsystemName,
|
|
_In_opt_ PVOID HandleId,
|
|
_In_ PHANDLE ClientTokenHandle,
|
|
_In_ PUNICODE_STRING ObjectTypeName,
|
|
_In_ PUNICODE_STRING ObjectName,
|
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
_In_opt_ PSID PrincipalSelfSid,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ AUDIT_EVENT_TYPE AuditType,
|
|
_In_ ULONG Flags,
|
|
_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
_In_ ULONG ObjectTypeListLength,
|
|
_In_ PGENERIC_MAPPING GenericMapping,
|
|
_Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccessList,
|
|
_Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatusList,
|
|
_Out_ PBOOLEAN GenerateOnClose,
|
|
_In_ BOOLEAN UseResultList)
|
|
{
|
|
SECURITY_SUBJECT_CONTEXT SubjectContext;
|
|
ULONG ResultListLength;
|
|
GENERIC_MAPPING LocalGenericMapping;
|
|
PTOKEN SubjectContextToken, ClientToken;
|
|
BOOLEAN AllocatedResultLists;
|
|
BOOLEAN HaveAuditPrivilege;
|
|
PSECURITY_DESCRIPTOR CapturedSecurityDescriptor;
|
|
UNICODE_STRING CapturedSubsystemName, CapturedObjectTypeName, CapturedObjectName;
|
|
ACCESS_MASK GrantedAccess, *SafeGrantedAccessList;
|
|
NTSTATUS AccessStatus, *SafeAccessStatusList;
|
|
PSID CapturedPrincipalSelfSid;
|
|
POBJECT_TYPE_LIST CapturedObjectTypeList;
|
|
ULONG i;
|
|
BOOLEAN LocalGenerateOnClose;
|
|
NTSTATUS Status;
|
|
PAGED_CODE();
|
|
|
|
/* Only user mode is supported! */
|
|
ASSERT(ExGetPreviousMode() != KernelMode);
|
|
|
|
/* Start clean */
|
|
AllocatedResultLists = FALSE;
|
|
ClientToken = NULL;
|
|
CapturedSecurityDescriptor = NULL;
|
|
CapturedSubsystemName.Buffer = NULL;
|
|
CapturedObjectTypeName.Buffer = NULL;
|
|
CapturedObjectName.Buffer = NULL;
|
|
CapturedPrincipalSelfSid = NULL;
|
|
CapturedObjectTypeList = NULL;
|
|
|
|
/* Validate AuditType */
|
|
if ((AuditType != AuditEventObjectAccess) &&
|
|
(AuditType != AuditEventDirectoryServiceAccess))
|
|
{
|
|
DPRINT1("Invalid audit type: %u\n", AuditType);
|
|
return STATUS_INVALID_PARAMETER;
|
|
}
|
|
|
|
/* Capture the security subject context */
|
|
SeCaptureSubjectContext(&SubjectContext);
|
|
|
|
/* Did the caller pass a token handle? */
|
|
if (ClientTokenHandle == NULL)
|
|
{
|
|
/* Check if we have a token in the subject context */
|
|
if (SubjectContext.ClientToken == NULL)
|
|
{
|
|
Status = STATUS_NO_IMPERSONATION_TOKEN;
|
|
DPRINT1("No token\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Check if we have a valid impersonation level */
|
|
if (SubjectContext.ImpersonationLevel < SecurityIdentification)
|
|
{
|
|
Status = STATUS_BAD_IMPERSONATION_LEVEL;
|
|
DPRINT1("Invalid impersonation level 0x%lx\n",
|
|
SubjectContext.ImpersonationLevel);
|
|
goto Cleanup;
|
|
}
|
|
}
|
|
|
|
/* Are we using a result list? */
|
|
if (UseResultList)
|
|
{
|
|
/* The list length equals the object type list length */
|
|
ResultListLength = ObjectTypeListLength;
|
|
if ((ResultListLength == 0) || (ResultListLength > 0x1000))
|
|
{
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
DPRINT1("Invalid ResultListLength: 0x%lx\n", ResultListLength);
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Allocate a safe buffer from paged pool */
|
|
SafeGrantedAccessList = ExAllocatePoolWithTag(PagedPool,
|
|
2 * ResultListLength * sizeof(ULONG),
|
|
TAG_SEPA);
|
|
if (SafeGrantedAccessList == NULL)
|
|
{
|
|
Status = STATUS_INSUFFICIENT_RESOURCES;
|
|
DPRINT1("Failed to allocate access lists\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
SafeAccessStatusList = (PNTSTATUS)&SafeGrantedAccessList[ResultListLength];
|
|
AllocatedResultLists = TRUE;
|
|
}
|
|
else
|
|
{
|
|
/* List length is 1 */
|
|
ResultListLength = 1;
|
|
SafeGrantedAccessList = &GrantedAccess;
|
|
SafeAccessStatusList = &AccessStatus;
|
|
}
|
|
|
|
_SEH2_TRY
|
|
{
|
|
/* Probe output buffers */
|
|
ProbeForWrite(AccessStatusList,
|
|
ResultListLength * sizeof(*AccessStatusList),
|
|
sizeof(*AccessStatusList));
|
|
ProbeForWrite(GrantedAccessList,
|
|
ResultListLength * sizeof(*GrantedAccessList),
|
|
sizeof(*GrantedAccessList));
|
|
|
|
/* Probe generic mapping and make a local copy */
|
|
ProbeForRead(GenericMapping, sizeof(*GenericMapping), sizeof(ULONG));
|
|
LocalGenericMapping = * GenericMapping;
|
|
}
|
|
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
Status = _SEH2_GetExceptionCode();
|
|
DPRINT1("Exception while probing parameters: 0x%lx\n", Status);
|
|
_SEH2_YIELD(goto Cleanup);
|
|
}
|
|
_SEH2_END;
|
|
|
|
/* Do we have a client token? */
|
|
if (ClientTokenHandle != NULL)
|
|
{
|
|
/* Reference the client token */
|
|
Status = ObReferenceObjectByHandle(*ClientTokenHandle,
|
|
TOKEN_QUERY,
|
|
SeTokenObjectType,
|
|
UserMode,
|
|
(PVOID*)&ClientToken,
|
|
NULL);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to reference token handle %p: %lx\n",
|
|
*ClientTokenHandle, Status);
|
|
goto Cleanup;
|
|
}
|
|
|
|
SubjectContextToken = SubjectContext.ClientToken;
|
|
SubjectContext.ClientToken = ClientToken;
|
|
}
|
|
|
|
/* Check for audit privilege */
|
|
HaveAuditPrivilege = SeCheckAuditPrivilege(&SubjectContext, UserMode);
|
|
if (!HaveAuditPrivilege && !(Flags & AUDIT_ALLOW_NO_PRIVILEGE))
|
|
{
|
|
DPRINT1("Caller does not have SeAuditPrivilege\n");
|
|
Status = STATUS_PRIVILEGE_NOT_HELD;
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Generic access must already be mapped to non-generic access types! */
|
|
if (DesiredAccess & (GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL))
|
|
{
|
|
DPRINT1("Generic access rights requested: 0x%lx\n", DesiredAccess);
|
|
Status = STATUS_GENERIC_NOT_MAPPED;
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Capture the security descriptor */
|
|
Status = SeCaptureSecurityDescriptor(SecurityDescriptor,
|
|
UserMode,
|
|
PagedPool,
|
|
FALSE,
|
|
&CapturedSecurityDescriptor);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture security descriptor!\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Validate the Security descriptor */
|
|
if ((SepGetOwnerFromDescriptor(CapturedSecurityDescriptor) == NULL) ||
|
|
(SepGetGroupFromDescriptor(CapturedSecurityDescriptor) == NULL))
|
|
{
|
|
Status = STATUS_INVALID_SECURITY_DESCR;
|
|
DPRINT1("Invalid security descriptor\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Probe and capture the subsystem name */
|
|
Status = ProbeAndCaptureUnicodeString(&CapturedSubsystemName,
|
|
UserMode,
|
|
SubsystemName);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture subsystem name!\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Probe and capture the object type name */
|
|
Status = ProbeAndCaptureUnicodeString(&CapturedObjectTypeName,
|
|
UserMode,
|
|
ObjectTypeName);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture object type name!\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Probe and capture the object name */
|
|
Status = ProbeAndCaptureUnicodeString(&CapturedObjectName,
|
|
UserMode,
|
|
ObjectName);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture object name!\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Check if we have a PrincipalSelfSid */
|
|
if (PrincipalSelfSid != NULL)
|
|
{
|
|
/* Capture it */
|
|
Status = SepCaptureSid(PrincipalSelfSid,
|
|
UserMode,
|
|
PagedPool,
|
|
FALSE,
|
|
&CapturedPrincipalSelfSid);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture PrincipalSelfSid!\n");
|
|
goto Cleanup;
|
|
}
|
|
}
|
|
|
|
/* Capture the object type list */
|
|
Status = SeCaptureObjectTypeList(ObjectTypeList,
|
|
ObjectTypeListLength,
|
|
UserMode,
|
|
&CapturedObjectTypeList);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture object type list!\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Call the worker routine with the captured buffers */
|
|
SepAccessCheckAndAuditAlarmWorker(&CapturedSubsystemName,
|
|
HandleId,
|
|
&SubjectContext,
|
|
&CapturedObjectTypeName,
|
|
&CapturedObjectName,
|
|
CapturedSecurityDescriptor,
|
|
CapturedPrincipalSelfSid,
|
|
DesiredAccess,
|
|
AuditType,
|
|
HaveAuditPrivilege,
|
|
CapturedObjectTypeList,
|
|
ObjectTypeListLength,
|
|
&LocalGenericMapping,
|
|
SafeGrantedAccessList,
|
|
SafeAccessStatusList,
|
|
&LocalGenerateOnClose,
|
|
UseResultList);
|
|
|
|
/* Enter SEH to copy the data back to user mode */
|
|
_SEH2_TRY
|
|
{
|
|
/* Loop all result entries (only 1 when no list was requested) */
|
|
ASSERT(UseResultList || (ResultListLength == 1));
|
|
for (i = 0; i < ResultListLength; i++)
|
|
{
|
|
AccessStatusList[i] = SafeAccessStatusList[i];
|
|
GrantedAccessList[i] = SafeGrantedAccessList[i];
|
|
}
|
|
|
|
*GenerateOnClose = LocalGenerateOnClose;
|
|
}
|
|
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
Status = _SEH2_GetExceptionCode();
|
|
DPRINT1("Exception while copying back data: 0x%lx\n", Status);
|
|
}
|
|
_SEH2_END;
|
|
|
|
Cleanup:
|
|
|
|
if (CapturedObjectTypeList != NULL)
|
|
SeReleaseObjectTypeList(CapturedObjectTypeList, UserMode);
|
|
|
|
if (CapturedPrincipalSelfSid != NULL)
|
|
SepReleaseSid(CapturedPrincipalSelfSid, UserMode, FALSE);
|
|
|
|
if (CapturedObjectName.Buffer != NULL)
|
|
ReleaseCapturedUnicodeString(&CapturedObjectName, UserMode);
|
|
|
|
if (CapturedObjectTypeName.Buffer != NULL)
|
|
ReleaseCapturedUnicodeString(&CapturedObjectTypeName, UserMode);
|
|
|
|
if (CapturedSubsystemName.Buffer != NULL)
|
|
ReleaseCapturedUnicodeString(&CapturedSubsystemName, UserMode);
|
|
|
|
if (CapturedSecurityDescriptor != NULL)
|
|
SeReleaseSecurityDescriptor(CapturedSecurityDescriptor, UserMode, FALSE);
|
|
|
|
if (ClientToken != NULL)
|
|
{
|
|
ObDereferenceObject(ClientToken);
|
|
SubjectContext.ClientToken = SubjectContextToken;
|
|
}
|
|
|
|
if (AllocatedResultLists)
|
|
ExFreePoolWithTag(SafeGrantedAccessList, TAG_SEPA);
|
|
|
|
/* Release the security subject context */
|
|
SeReleaseSubjectContext(&SubjectContext);
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
/* PUBLIC FUNCTIONS ***********************************************************/
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
VOID
|
|
NTAPI
|
|
SeAuditHardLinkCreation(IN PUNICODE_STRING FileName,
|
|
IN PUNICODE_STRING LinkName,
|
|
IN BOOLEAN bSuccess)
|
|
{
|
|
UNIMPLEMENTED;
|
|
}
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
BOOLEAN
|
|
NTAPI
|
|
SeAuditingFileEvents(IN BOOLEAN AccessGranted,
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor)
|
|
{
|
|
UNIMPLEMENTED;
|
|
return FALSE;
|
|
}
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
BOOLEAN
|
|
NTAPI
|
|
SeAuditingFileEventsWithContext(IN BOOLEAN AccessGranted,
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL)
|
|
{
|
|
UNIMPLEMENTED;
|
|
return FALSE;
|
|
}
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
BOOLEAN
|
|
NTAPI
|
|
SeAuditingHardLinkEvents(IN BOOLEAN AccessGranted,
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor)
|
|
{
|
|
UNIMPLEMENTED;
|
|
return FALSE;
|
|
}
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
BOOLEAN
|
|
NTAPI
|
|
SeAuditingHardLinkEventsWithContext(IN BOOLEAN AccessGranted,
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL)
|
|
{
|
|
UNIMPLEMENTED;
|
|
return FALSE;
|
|
}
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
BOOLEAN
|
|
NTAPI
|
|
SeAuditingFileOrGlobalEvents(IN BOOLEAN AccessGranted,
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext)
|
|
{
|
|
UNIMPLEMENTED;
|
|
return FALSE;
|
|
}
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
VOID
|
|
NTAPI
|
|
SeCloseObjectAuditAlarm(IN PVOID Object,
|
|
IN HANDLE Handle,
|
|
IN BOOLEAN PerformAction)
|
|
{
|
|
UNIMPLEMENTED;
|
|
}
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
VOID NTAPI
|
|
SeDeleteObjectAuditAlarm(IN PVOID Object,
|
|
IN HANDLE Handle)
|
|
{
|
|
UNIMPLEMENTED;
|
|
}
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
VOID
|
|
NTAPI
|
|
SeOpenObjectAuditAlarm(IN PUNICODE_STRING ObjectTypeName,
|
|
IN PVOID Object OPTIONAL,
|
|
IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN PACCESS_STATE AccessState,
|
|
IN BOOLEAN ObjectCreated,
|
|
IN BOOLEAN AccessGranted,
|
|
IN KPROCESSOR_MODE AccessMode,
|
|
OUT PBOOLEAN GenerateOnClose)
|
|
{
|
|
PAGED_CODE();
|
|
|
|
/* Audits aren't done on kernel-mode access */
|
|
if (AccessMode == KernelMode) return;
|
|
|
|
/* Otherwise, unimplemented! */
|
|
//UNIMPLEMENTED;
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
VOID NTAPI
|
|
SeOpenObjectForDeleteAuditAlarm(IN PUNICODE_STRING ObjectTypeName,
|
|
IN PVOID Object OPTIONAL,
|
|
IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN PACCESS_STATE AccessState,
|
|
IN BOOLEAN ObjectCreated,
|
|
IN BOOLEAN AccessGranted,
|
|
IN KPROCESSOR_MODE AccessMode,
|
|
OUT PBOOLEAN GenerateOnClose)
|
|
{
|
|
UNIMPLEMENTED;
|
|
}
|
|
|
|
/*
|
|
* @unimplemented
|
|
*/
|
|
VOID
|
|
NTAPI
|
|
SePrivilegeObjectAuditAlarm(IN HANDLE Handle,
|
|
IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN PPRIVILEGE_SET Privileges,
|
|
IN BOOLEAN AccessGranted,
|
|
IN KPROCESSOR_MODE CurrentMode)
|
|
{
|
|
UNIMPLEMENTED;
|
|
}
|
|
|
|
/* SYSTEM CALLS ***************************************************************/
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCloseObjectAuditAlarm(
|
|
PUNICODE_STRING SubsystemName,
|
|
PVOID HandleId,
|
|
BOOLEAN GenerateOnClose)
|
|
{
|
|
SECURITY_SUBJECT_CONTEXT SubjectContext;
|
|
UNICODE_STRING CapturedSubsystemName;
|
|
KPROCESSOR_MODE PreviousMode;
|
|
BOOLEAN UseImpersonationToken;
|
|
PETHREAD CurrentThread;
|
|
BOOLEAN CopyOnOpen, EffectiveOnly;
|
|
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
|
|
NTSTATUS Status;
|
|
PTOKEN Token;
|
|
PAGED_CODE();
|
|
|
|
/* Get the previous mode (only user mode is supported!) */
|
|
PreviousMode = ExGetPreviousMode();
|
|
ASSERT(PreviousMode != KernelMode);
|
|
|
|
/* Do we even need to do anything? */
|
|
if (!GenerateOnClose)
|
|
{
|
|
/* Nothing to do, return success */
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
/* Capture the security subject context */
|
|
SeCaptureSubjectContext(&SubjectContext);
|
|
|
|
/* Check for audit privilege */
|
|
if (!SeCheckAuditPrivilege(&SubjectContext, PreviousMode))
|
|
{
|
|
DPRINT1("Caller does not have SeAuditPrivilege\n");
|
|
Status = STATUS_PRIVILEGE_NOT_HELD;
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Probe and capture the subsystem name */
|
|
Status = ProbeAndCaptureUnicodeString(&CapturedSubsystemName,
|
|
PreviousMode,
|
|
SubsystemName);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture subsystem name!\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Get the current thread and check if it's impersonating */
|
|
CurrentThread = PsGetCurrentThread();
|
|
if (PsIsThreadImpersonating(CurrentThread))
|
|
{
|
|
/* Get the impersonation token */
|
|
Token = PsReferenceImpersonationToken(CurrentThread,
|
|
&CopyOnOpen,
|
|
&EffectiveOnly,
|
|
&ImpersonationLevel);
|
|
UseImpersonationToken = TRUE;
|
|
}
|
|
else
|
|
{
|
|
/* Get the primary token */
|
|
Token = PsReferencePrimaryToken(PsGetCurrentProcess());
|
|
UseImpersonationToken = FALSE;
|
|
}
|
|
|
|
/* Call the internal function */
|
|
SepAdtCloseObjectAuditAlarm(&CapturedSubsystemName,
|
|
HandleId,
|
|
Token->UserAndGroups->Sid);
|
|
|
|
/* Release the captured subsystem name */
|
|
ReleaseCapturedUnicodeString(&CapturedSubsystemName, PreviousMode);
|
|
|
|
/* Check what token we used */
|
|
if (UseImpersonationToken)
|
|
{
|
|
/* Release impersonation token */
|
|
PsDereferenceImpersonationToken(Token);
|
|
}
|
|
else
|
|
{
|
|
/* Release primary token */
|
|
PsDereferencePrimaryToken(Token);
|
|
}
|
|
|
|
Status = STATUS_SUCCESS;
|
|
|
|
Cleanup:
|
|
|
|
/* Release the security subject context */
|
|
SeReleaseSubjectContext(&SubjectContext);
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
NTSTATUS NTAPI
|
|
NtDeleteObjectAuditAlarm(IN PUNICODE_STRING SubsystemName,
|
|
IN PVOID HandleId,
|
|
IN BOOLEAN GenerateOnClose)
|
|
{
|
|
UNIMPLEMENTED;
|
|
return STATUS_NOT_IMPLEMENTED;
|
|
}
|
|
|
|
VOID
|
|
NTAPI
|
|
SepOpenObjectAuditAlarm(
|
|
_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext,
|
|
_In_ PUNICODE_STRING SubsystemName,
|
|
_In_opt_ PVOID HandleId,
|
|
_In_ PUNICODE_STRING ObjectTypeName,
|
|
_In_ PUNICODE_STRING ObjectName,
|
|
_In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
_In_ PTOKEN ClientToken,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ ACCESS_MASK GrantedAccess,
|
|
_In_opt_ PPRIVILEGE_SET Privileges,
|
|
_In_ BOOLEAN ObjectCreation,
|
|
_In_ BOOLEAN AccessGranted,
|
|
_Out_ PBOOLEAN GenerateOnClose)
|
|
{
|
|
DBG_UNREFERENCED_PARAMETER(SubjectContext);
|
|
DBG_UNREFERENCED_PARAMETER(SubsystemName);
|
|
DBG_UNREFERENCED_PARAMETER(HandleId);
|
|
DBG_UNREFERENCED_PARAMETER(ObjectTypeName);
|
|
DBG_UNREFERENCED_PARAMETER(ObjectName);
|
|
DBG_UNREFERENCED_PARAMETER(SecurityDescriptor);
|
|
DBG_UNREFERENCED_PARAMETER(ClientToken);
|
|
DBG_UNREFERENCED_PARAMETER(DesiredAccess);
|
|
DBG_UNREFERENCED_PARAMETER(GrantedAccess);
|
|
DBG_UNREFERENCED_PARAMETER(Privileges);
|
|
DBG_UNREFERENCED_PARAMETER(ObjectCreation);
|
|
DBG_UNREFERENCED_PARAMETER(AccessGranted);
|
|
UNIMPLEMENTED;
|
|
*GenerateOnClose = FALSE;
|
|
}
|
|
|
|
__kernel_entry
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenObjectAuditAlarm(
|
|
_In_ PUNICODE_STRING SubsystemName,
|
|
_In_opt_ PVOID HandleId,
|
|
_In_ PUNICODE_STRING ObjectTypeName,
|
|
_In_ PUNICODE_STRING ObjectName,
|
|
_In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
_In_ HANDLE ClientTokenHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ ACCESS_MASK GrantedAccess,
|
|
_In_opt_ PPRIVILEGE_SET PrivilegeSet,
|
|
_In_ BOOLEAN ObjectCreation,
|
|
_In_ BOOLEAN AccessGranted,
|
|
_Out_ PBOOLEAN GenerateOnClose)
|
|
{
|
|
PTOKEN ClientToken;
|
|
PSECURITY_DESCRIPTOR CapturedSecurityDescriptor;
|
|
UNICODE_STRING CapturedSubsystemName, CapturedObjectTypeName, CapturedObjectName;
|
|
ULONG PrivilegeCount, PrivilegeSetSize;
|
|
volatile PPRIVILEGE_SET CapturedPrivilegeSet;
|
|
BOOLEAN LocalGenerateOnClose;
|
|
PVOID CapturedHandleId;
|
|
SECURITY_SUBJECT_CONTEXT SubjectContext;
|
|
NTSTATUS Status;
|
|
PAGED_CODE();
|
|
|
|
/* Only user mode is supported! */
|
|
ASSERT(ExGetPreviousMode() != KernelMode);
|
|
|
|
/* Start clean */
|
|
ClientToken = NULL;
|
|
CapturedSecurityDescriptor = NULL;
|
|
CapturedPrivilegeSet = NULL;
|
|
CapturedSubsystemName.Buffer = NULL;
|
|
CapturedObjectTypeName.Buffer = NULL;
|
|
CapturedObjectName.Buffer = NULL;
|
|
|
|
/* Reference the client token */
|
|
Status = ObReferenceObjectByHandle(ClientTokenHandle,
|
|
TOKEN_QUERY,
|
|
SeTokenObjectType,
|
|
UserMode,
|
|
(PVOID*)&ClientToken,
|
|
NULL);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to reference token handle %p: %lx\n",
|
|
ClientTokenHandle, Status);
|
|
return Status;
|
|
}
|
|
|
|
/* Capture the security subject context */
|
|
SeCaptureSubjectContext(&SubjectContext);
|
|
|
|
/* Validate the token's impersonation level */
|
|
if ((ClientToken->TokenType == TokenImpersonation) &&
|
|
(ClientToken->ImpersonationLevel < SecurityIdentification))
|
|
{
|
|
DPRINT1("Invalid impersonation level (%u)\n", ClientToken->ImpersonationLevel);
|
|
Status = STATUS_BAD_IMPERSONATION_LEVEL;
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Check for audit privilege */
|
|
if (!SeCheckAuditPrivilege(&SubjectContext, UserMode))
|
|
{
|
|
DPRINT1("Caller does not have SeAuditPrivilege\n");
|
|
Status = STATUS_PRIVILEGE_NOT_HELD;
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Check for NULL SecurityDescriptor */
|
|
if (SecurityDescriptor == NULL)
|
|
{
|
|
/* Nothing to do */
|
|
Status = STATUS_SUCCESS;
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Capture the security descriptor */
|
|
Status = SeCaptureSecurityDescriptor(SecurityDescriptor,
|
|
UserMode,
|
|
PagedPool,
|
|
FALSE,
|
|
&CapturedSecurityDescriptor);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture security descriptor!\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
_SEH2_TRY
|
|
{
|
|
/* Check if we have a privilege set */
|
|
if (PrivilegeSet != NULL)
|
|
{
|
|
/* Probe the basic privilege set structure */
|
|
ProbeForRead(PrivilegeSet, sizeof(PRIVILEGE_SET), sizeof(ULONG));
|
|
|
|
/* Validate privilege count */
|
|
PrivilegeCount = PrivilegeSet->PrivilegeCount;
|
|
if (PrivilegeCount > SEP_PRIVILEGE_SET_MAX_COUNT)
|
|
{
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
_SEH2_YIELD(goto Cleanup);
|
|
}
|
|
|
|
/* Calculate the size of the PrivilegeSet structure */
|
|
PrivilegeSetSize = FIELD_OFFSET(PRIVILEGE_SET, Privilege[PrivilegeCount]);
|
|
|
|
/* Probe the whole structure */
|
|
ProbeForRead(PrivilegeSet, PrivilegeSetSize, sizeof(ULONG));
|
|
|
|
/* Allocate a temp buffer */
|
|
CapturedPrivilegeSet = ExAllocatePoolWithTag(PagedPool,
|
|
PrivilegeSetSize,
|
|
TAG_PRIVILEGE_SET);
|
|
if (CapturedPrivilegeSet == NULL)
|
|
{
|
|
DPRINT1("Failed to allocate %u bytes\n", PrivilegeSetSize);
|
|
Status = STATUS_INSUFFICIENT_RESOURCES;
|
|
_SEH2_YIELD(goto Cleanup);
|
|
}
|
|
|
|
/* Copy the privileges */
|
|
RtlCopyMemory(CapturedPrivilegeSet, PrivilegeSet, PrivilegeSetSize);
|
|
}
|
|
|
|
if (HandleId != NULL)
|
|
{
|
|
ProbeForRead(HandleId, sizeof(PVOID), sizeof(PVOID));
|
|
CapturedHandleId = *(PVOID*)HandleId;
|
|
}
|
|
|
|
ProbeForWrite(GenerateOnClose, sizeof(BOOLEAN), sizeof(BOOLEAN));
|
|
}
|
|
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
Status = _SEH2_GetExceptionCode();
|
|
DPRINT1("Exception while probing parameters: 0x%lx\n", Status);
|
|
_SEH2_YIELD(goto Cleanup);
|
|
}
|
|
_SEH2_END;
|
|
|
|
/* Probe and capture the subsystem name */
|
|
Status = ProbeAndCaptureUnicodeString(&CapturedSubsystemName,
|
|
UserMode,
|
|
SubsystemName);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture subsystem name!\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Probe and capture the object type name */
|
|
Status = ProbeAndCaptureUnicodeString(&CapturedObjectTypeName,
|
|
UserMode,
|
|
ObjectTypeName);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture object type name!\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Probe and capture the object name */
|
|
Status = ProbeAndCaptureUnicodeString(&CapturedObjectName,
|
|
UserMode,
|
|
ObjectName);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture object name!\n");
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Call the internal function */
|
|
SepOpenObjectAuditAlarm(&SubjectContext,
|
|
&CapturedSubsystemName,
|
|
CapturedHandleId,
|
|
&CapturedObjectTypeName,
|
|
&CapturedObjectName,
|
|
CapturedSecurityDescriptor,
|
|
ClientToken,
|
|
DesiredAccess,
|
|
GrantedAccess,
|
|
CapturedPrivilegeSet,
|
|
ObjectCreation,
|
|
AccessGranted,
|
|
&LocalGenerateOnClose);
|
|
|
|
Status = STATUS_SUCCESS;
|
|
|
|
/* Enter SEH to copy the data back to user mode */
|
|
_SEH2_TRY
|
|
{
|
|
*GenerateOnClose = LocalGenerateOnClose;
|
|
}
|
|
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
Status = _SEH2_GetExceptionCode();
|
|
DPRINT1("Exception while copying back data: 0x%lx\n", Status);
|
|
}
|
|
_SEH2_END;
|
|
|
|
Cleanup:
|
|
|
|
if (CapturedObjectName.Buffer != NULL)
|
|
ReleaseCapturedUnicodeString(&CapturedObjectName, UserMode);
|
|
|
|
if (CapturedObjectTypeName.Buffer != NULL)
|
|
ReleaseCapturedUnicodeString(&CapturedObjectTypeName, UserMode);
|
|
|
|
if (CapturedSubsystemName.Buffer != NULL)
|
|
ReleaseCapturedUnicodeString(&CapturedSubsystemName, UserMode);
|
|
|
|
if (CapturedSecurityDescriptor != NULL)
|
|
SeReleaseSecurityDescriptor(CapturedSecurityDescriptor, UserMode, FALSE);
|
|
|
|
if (CapturedPrivilegeSet != NULL)
|
|
ExFreePoolWithTag(CapturedPrivilegeSet, TAG_PRIVILEGE_SET);
|
|
|
|
/* Release the security subject context */
|
|
SeReleaseSubjectContext(&SubjectContext);
|
|
|
|
ObDereferenceObject(ClientToken);
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
__kernel_entry
|
|
NTSTATUS
|
|
NTAPI
|
|
NtPrivilegedServiceAuditAlarm(
|
|
_In_opt_ PUNICODE_STRING SubsystemName,
|
|
_In_opt_ PUNICODE_STRING ServiceName,
|
|
_In_ HANDLE ClientTokenHandle,
|
|
_In_ PPRIVILEGE_SET Privileges,
|
|
_In_ BOOLEAN AccessGranted )
|
|
{
|
|
KPROCESSOR_MODE PreviousMode;
|
|
PTOKEN ClientToken;
|
|
volatile PPRIVILEGE_SET CapturedPrivileges = NULL;
|
|
UNICODE_STRING CapturedSubsystemName;
|
|
UNICODE_STRING CapturedServiceName;
|
|
ULONG PrivilegeCount, PrivilegesSize;
|
|
SECURITY_SUBJECT_CONTEXT SubjectContext;
|
|
NTSTATUS Status;
|
|
PAGED_CODE();
|
|
|
|
/* Get the previous mode (only user mode is supported!) */
|
|
PreviousMode = ExGetPreviousMode();
|
|
ASSERT(PreviousMode != KernelMode);
|
|
|
|
CapturedSubsystemName.Buffer = NULL;
|
|
CapturedServiceName.Buffer = NULL;
|
|
|
|
/* Reference the client token */
|
|
Status = ObReferenceObjectByHandle(ClientTokenHandle,
|
|
TOKEN_QUERY,
|
|
SeTokenObjectType,
|
|
PreviousMode,
|
|
(PVOID*)&ClientToken,
|
|
NULL);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to reference client token: 0x%lx\n", Status);
|
|
return Status;
|
|
}
|
|
|
|
/* Validate the token's impersonation level */
|
|
if ((ClientToken->TokenType == TokenImpersonation) &&
|
|
(ClientToken->ImpersonationLevel < SecurityIdentification))
|
|
{
|
|
DPRINT1("Invalid impersonation level (%u)\n", ClientToken->ImpersonationLevel);
|
|
ObDereferenceObject(ClientToken);
|
|
return STATUS_BAD_IMPERSONATION_LEVEL;
|
|
}
|
|
|
|
/* Capture the security subject context */
|
|
SeCaptureSubjectContext(&SubjectContext);
|
|
|
|
/* Check for audit privilege */
|
|
if (!SeCheckAuditPrivilege(&SubjectContext, PreviousMode))
|
|
{
|
|
DPRINT1("Caller does not have SeAuditPrivilege\n");
|
|
Status = STATUS_PRIVILEGE_NOT_HELD;
|
|
goto Cleanup;
|
|
}
|
|
|
|
/* Do we have a subsystem name? */
|
|
if (SubsystemName != NULL)
|
|
{
|
|
/* Probe and capture the subsystem name */
|
|
Status = ProbeAndCaptureUnicodeString(&CapturedSubsystemName,
|
|
PreviousMode,
|
|
SubsystemName);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture subsystem name!\n");
|
|
goto Cleanup;
|
|
}
|
|
}
|
|
|
|
/* Do we have a service name? */
|
|
if (ServiceName != NULL)
|
|
{
|
|
/* Probe and capture the service name */
|
|
Status = ProbeAndCaptureUnicodeString(&CapturedServiceName,
|
|
PreviousMode,
|
|
ServiceName);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
DPRINT1("Failed to capture service name!\n");
|
|
goto Cleanup;
|
|
}
|
|
}
|
|
|
|
_SEH2_TRY
|
|
{
|
|
/* Probe the basic privilege set structure */
|
|
ProbeForRead(Privileges, sizeof(PRIVILEGE_SET), sizeof(ULONG));
|
|
|
|
/* Validate privilege count */
|
|
PrivilegeCount = Privileges->PrivilegeCount;
|
|
if (PrivilegeCount > SEP_PRIVILEGE_SET_MAX_COUNT)
|
|
{
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
_SEH2_YIELD(goto Cleanup);
|
|
}
|
|
|
|
/* Calculate the size of the Privileges structure */
|
|
PrivilegesSize = FIELD_OFFSET(PRIVILEGE_SET, Privilege[PrivilegeCount]);
|
|
|
|
/* Probe the whole structure */
|
|
ProbeForRead(Privileges, PrivilegesSize, sizeof(ULONG));
|
|
|
|
/* Allocate a temp buffer */
|
|
CapturedPrivileges = ExAllocatePoolWithTag(PagedPool,
|
|
PrivilegesSize,
|
|
TAG_PRIVILEGE_SET);
|
|
if (CapturedPrivileges == NULL)
|
|
{
|
|
DPRINT1("Failed to allocate %u bytes\n", PrivilegesSize);
|
|
Status = STATUS_INSUFFICIENT_RESOURCES;
|
|
_SEH2_YIELD(goto Cleanup);
|
|
}
|
|
|
|
/* Copy the privileges */
|
|
RtlCopyMemory(CapturedPrivileges, Privileges, PrivilegesSize);
|
|
}
|
|
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
Status = _SEH2_GetExceptionCode();
|
|
DPRINT1("Got exception 0x%lx\n", Status);
|
|
_SEH2_YIELD(goto Cleanup);
|
|
}
|
|
_SEH2_END;
|
|
|
|
/* Call the internal function */
|
|
SepAdtPrivilegedServiceAuditAlarm(&SubjectContext,
|
|
SubsystemName ? &CapturedSubsystemName : NULL,
|
|
ServiceName ? &CapturedServiceName : NULL,
|
|
ClientToken,
|
|
SubjectContext.PrimaryToken,
|
|
CapturedPrivileges,
|
|
AccessGranted);
|
|
|
|
Status = STATUS_SUCCESS;
|
|
|
|
Cleanup:
|
|
/* Cleanup resources */
|
|
if (CapturedSubsystemName.Buffer != NULL)
|
|
ReleaseCapturedUnicodeString(&CapturedSubsystemName, PreviousMode);
|
|
|
|
if (CapturedServiceName.Buffer != NULL)
|
|
ReleaseCapturedUnicodeString(&CapturedServiceName, PreviousMode);
|
|
|
|
if (CapturedPrivileges != NULL)
|
|
ExFreePoolWithTag(CapturedPrivileges, TAG_PRIVILEGE_SET);
|
|
|
|
/* Release the security subject context */
|
|
SeReleaseSubjectContext(&SubjectContext);
|
|
|
|
ObDereferenceObject(ClientToken);
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
NTSTATUS NTAPI
|
|
NtPrivilegeObjectAuditAlarm(IN PUNICODE_STRING SubsystemName,
|
|
IN PVOID HandleId,
|
|
IN HANDLE ClientToken,
|
|
IN ULONG DesiredAccess,
|
|
IN PPRIVILEGE_SET Privileges,
|
|
IN BOOLEAN AccessGranted)
|
|
{
|
|
UNIMPLEMENTED;
|
|
return STATUS_NOT_IMPLEMENTED;
|
|
}
|
|
|
|
|
|
_Must_inspect_result_
|
|
__kernel_entry
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheckAndAuditAlarm(
|
|
_In_ PUNICODE_STRING SubsystemName,
|
|
_In_opt_ PVOID HandleId,
|
|
_In_ PUNICODE_STRING ObjectTypeName,
|
|
_In_ PUNICODE_STRING ObjectName,
|
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ PGENERIC_MAPPING GenericMapping,
|
|
_In_ BOOLEAN ObjectCreation,
|
|
_Out_ PACCESS_MASK GrantedAccess,
|
|
_Out_ PNTSTATUS AccessStatus,
|
|
_Out_ PBOOLEAN GenerateOnClose)
|
|
{
|
|
/* Call the internal function */
|
|
return SepAccessCheckAndAuditAlarm(SubsystemName,
|
|
HandleId,
|
|
NULL,
|
|
ObjectTypeName,
|
|
ObjectName,
|
|
SecurityDescriptor,
|
|
NULL,
|
|
DesiredAccess,
|
|
AuditEventObjectAccess,
|
|
0,
|
|
NULL,
|
|
0,
|
|
GenericMapping,
|
|
GrantedAccess,
|
|
AccessStatus,
|
|
GenerateOnClose,
|
|
FALSE);
|
|
}
|
|
|
|
_Must_inspect_result_
|
|
__kernel_entry
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheckByTypeAndAuditAlarm(
|
|
_In_ PUNICODE_STRING SubsystemName,
|
|
_In_opt_ PVOID HandleId,
|
|
_In_ PUNICODE_STRING ObjectTypeName,
|
|
_In_ PUNICODE_STRING ObjectName,
|
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
_In_opt_ PSID PrincipalSelfSid,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ AUDIT_EVENT_TYPE AuditType,
|
|
_In_ ULONG Flags,
|
|
_In_reads_opt_(ObjectTypeLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
_In_ ULONG ObjectTypeLength,
|
|
_In_ PGENERIC_MAPPING GenericMapping,
|
|
_In_ BOOLEAN ObjectCreation,
|
|
_Out_ PACCESS_MASK GrantedAccess,
|
|
_Out_ PNTSTATUS AccessStatus,
|
|
_Out_ PBOOLEAN GenerateOnClose)
|
|
{
|
|
/* Call the internal function */
|
|
return SepAccessCheckAndAuditAlarm(SubsystemName,
|
|
HandleId,
|
|
NULL,
|
|
ObjectTypeName,
|
|
ObjectName,
|
|
SecurityDescriptor,
|
|
PrincipalSelfSid,
|
|
DesiredAccess,
|
|
AuditType,
|
|
Flags,
|
|
ObjectTypeList,
|
|
ObjectTypeLength,
|
|
GenericMapping,
|
|
GrantedAccess,
|
|
AccessStatus,
|
|
GenerateOnClose,
|
|
FALSE);
|
|
}
|
|
|
|
_Must_inspect_result_
|
|
__kernel_entry
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheckByTypeResultListAndAuditAlarm(
|
|
_In_ PUNICODE_STRING SubsystemName,
|
|
_In_opt_ PVOID HandleId,
|
|
_In_ PUNICODE_STRING ObjectTypeName,
|
|
_In_ PUNICODE_STRING ObjectName,
|
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
_In_opt_ PSID PrincipalSelfSid,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ AUDIT_EVENT_TYPE AuditType,
|
|
_In_ ULONG Flags,
|
|
_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
_In_ ULONG ObjectTypeListLength,
|
|
_In_ PGENERIC_MAPPING GenericMapping,
|
|
_In_ BOOLEAN ObjectCreation,
|
|
_Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccessList,
|
|
_Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatusList,
|
|
_Out_ PBOOLEAN GenerateOnClose)
|
|
{
|
|
/* Call the internal function */
|
|
return SepAccessCheckAndAuditAlarm(SubsystemName,
|
|
HandleId,
|
|
NULL,
|
|
ObjectTypeName,
|
|
ObjectName,
|
|
SecurityDescriptor,
|
|
PrincipalSelfSid,
|
|
DesiredAccess,
|
|
AuditType,
|
|
Flags,
|
|
ObjectTypeList,
|
|
ObjectTypeListLength,
|
|
GenericMapping,
|
|
GrantedAccessList,
|
|
AccessStatusList,
|
|
GenerateOnClose,
|
|
TRUE);
|
|
}
|
|
|
|
_Must_inspect_result_
|
|
__kernel_entry
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
|
|
_In_ PUNICODE_STRING SubsystemName,
|
|
_In_opt_ PVOID HandleId,
|
|
_In_ HANDLE ClientToken,
|
|
_In_ PUNICODE_STRING ObjectTypeName,
|
|
_In_ PUNICODE_STRING ObjectName,
|
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
_In_opt_ PSID PrincipalSelfSid,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ AUDIT_EVENT_TYPE AuditType,
|
|
_In_ ULONG Flags,
|
|
_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
_In_ ULONG ObjectTypeListLength,
|
|
_In_ PGENERIC_MAPPING GenericMapping,
|
|
_In_ BOOLEAN ObjectCreation,
|
|
_Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccessList,
|
|
_Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatusList,
|
|
_Out_ PBOOLEAN GenerateOnClose)
|
|
{
|
|
UNREFERENCED_PARAMETER(ObjectCreation);
|
|
|
|
/* Call the internal function */
|
|
return SepAccessCheckAndAuditAlarm(SubsystemName,
|
|
HandleId,
|
|
&ClientToken,
|
|
ObjectTypeName,
|
|
ObjectName,
|
|
SecurityDescriptor,
|
|
PrincipalSelfSid,
|
|
DesiredAccess,
|
|
AuditType,
|
|
Flags,
|
|
ObjectTypeList,
|
|
ObjectTypeListLength,
|
|
GenericMapping,
|
|
GrantedAccessList,
|
|
AccessStatusList,
|
|
GenerateOnClose,
|
|
TRUE);
|
|
}
|
|
|
|
/* EOF */
|