[GDI32_APITEST] Fix MSVC build
[reactos.git] / modules / rostests / kmtests / ntos_cm / CmSecurity.c
1 /*
2 * PROJECT: ReactOS kernel-mode tests
3 * LICENSE: LGPLv2+ - See COPYING.LIB in the top level directory
4 * PURPOSE: Kernel-Mode Test Suite NPFS security test
5 * PROGRAMMER: Thomas Faber <thomas.faber@reactos.org>
6 */
7
8 #include <kmt_test.h>
9 #include "../ntos_se/se.h"
10
11 #define CheckKeySecurity(name, AceCount, ...) CheckKeySecurity_(name, AceCount, __FILE__, __LINE__, ##__VA_ARGS__)
12 #define CheckKeySecurity_(name, AceCount, file, line, ...) CheckKeySecurity__(name, AceCount, file ":" KMT_STRINGIZE(line), ##__VA_ARGS__)
13 static
14 VOID
15 CheckKeySecurity__(
16 _In_ PCWSTR KeyName,
17 _In_ ULONG AceCount,
18 _In_ PCSTR FileAndLine,
19 ...)
20 {
21 NTSTATUS Status;
22 UNICODE_STRING KeyNameString;
23 OBJECT_ATTRIBUTES ObjectAttributes;
24 HANDLE KeyHandle;
25 PSECURITY_DESCRIPTOR SecurityDescriptor;
26 ULONG SecurityDescriptorSize;
27 PSID Owner;
28 PSID Group;
29 PACL Dacl;
30 PACL Sacl;
31 BOOLEAN Present;
32 BOOLEAN Defaulted;
33 va_list Arguments;
34
35 RtlInitUnicodeString(&KeyNameString, KeyName);
36 InitializeObjectAttributes(&ObjectAttributes,
37 &KeyNameString,
38 OBJ_KERNEL_HANDLE,
39 NULL,
40 NULL);
41 Status = ZwOpenKey(&KeyHandle,
42 READ_CONTROL | ACCESS_SYSTEM_SECURITY,
43 &ObjectAttributes);
44 ok_eq_hex(Status, STATUS_SUCCESS);
45 if (skip(NT_SUCCESS(Status), "No key (%ls)\n", KeyName))
46 {
47 return;
48 }
49
50 Status = ZwQuerySecurityObject(KeyHandle,
51 OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION,
52 NULL,
53 0,
54 &SecurityDescriptorSize);
55 ok_eq_hex(Status, STATUS_BUFFER_TOO_SMALL);
56 if (skip(Status == STATUS_BUFFER_TOO_SMALL, "No security size (%ls)\n", KeyName))
57 {
58 ObCloseHandle(KeyHandle, KernelMode);
59 return;
60 }
61
62 SecurityDescriptor = ExAllocatePoolWithTag(PagedPool,
63 SecurityDescriptorSize,
64 'dSmK');
65 ok(SecurityDescriptor != NULL, "Failed to allocate %lu bytes\n", SecurityDescriptorSize);
66 if (skip(SecurityDescriptor != NULL, "No memory for descriptor (%ls)\n", KeyName))
67 {
68 ObCloseHandle(KeyHandle, KernelMode);
69 return;
70 }
71
72 Status = ZwQuerySecurityObject(KeyHandle,
73 OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION,
74 SecurityDescriptor,
75 SecurityDescriptorSize,
76 &SecurityDescriptorSize);
77 ok_eq_hex(Status, STATUS_SUCCESS);
78 if (NT_SUCCESS(Status))
79 {
80 Owner = NULL;
81 Status = RtlGetOwnerSecurityDescriptor(SecurityDescriptor,
82 &Owner,
83 &Defaulted);
84 CheckSid(Owner, NO_SIZE, SeExports->SeAliasAdminsSid);
85 ok(Defaulted == FALSE, "Owner defaulted for %ls\n", KeyName);
86
87 Group = NULL;
88 Status = RtlGetGroupSecurityDescriptor(SecurityDescriptor,
89 &Group,
90 &Defaulted);
91 CheckSid(Group, NO_SIZE, SeExports->SeLocalSystemSid);
92 ok(Defaulted == FALSE, "Group defaulted for %ls\n", KeyName);
93
94 Dacl = NULL;
95 Status = RtlGetDaclSecurityDescriptor(SecurityDescriptor,
96 &Present,
97 &Dacl,
98 &Defaulted);
99 ok_eq_hex(Status, STATUS_SUCCESS);
100 ok(Present == TRUE, "DACL not present for %ls\n", KeyName);
101 ok(Defaulted == FALSE, "DACL defaulted for %ls\n", KeyName);
102 va_start(Arguments, FileAndLine);
103 VCheckAcl__(Dacl, AceCount, FileAndLine, Arguments);
104 va_end(Arguments);
105
106 Sacl = NULL;
107 Status = RtlGetSaclSecurityDescriptor(SecurityDescriptor,
108 &Present,
109 &Sacl,
110 &Defaulted);
111 ok_eq_hex(Status, STATUS_SUCCESS);
112 ok(Present == FALSE, "SACL present for %ls\n", KeyName);
113 ok(Defaulted == FALSE, "SACL defaulted for %ls\n", KeyName);
114 ok(Sacl == NULL, "Sacl is %p for %ls\n", Sacl, KeyName);
115 }
116 ExFreePoolWithTag(SecurityDescriptor, 'dSmK');
117 ObCloseHandle(KeyHandle, KernelMode);
118 }
119
120 START_TEST(CmSecurity)
121 {
122 SID_IDENTIFIER_AUTHORITY NtSidAuthority = {SECURITY_NT_AUTHORITY};
123 PSID TerminalServerSid;
124
125 TerminalServerSid = ExAllocatePoolWithTag(PagedPool,
126 RtlLengthRequiredSid(1),
127 'iSmK');
128 if (TerminalServerSid != NULL)
129 {
130 RtlInitializeSid(TerminalServerSid, &NtSidAuthority, 1);
131 *RtlSubAuthoritySid(TerminalServerSid, 0) = SECURITY_TERMINAL_SERVER_RID;
132 }
133 CheckKeySecurity(L"\\REGISTRY",
134 4, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
135 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
136 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeWorldSid, KEY_READ,
137 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeRestrictedSid, KEY_READ);
138
139 CheckKeySecurity(L"\\REGISTRY\\MACHINE",
140 4, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
141 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
142 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeWorldSid, KEY_READ,
143 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeRestrictedSid, KEY_READ);
144
145 CheckKeySecurity(L"\\REGISTRY\\MACHINE\\HARDWARE",
146 4, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
147 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
148 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeWorldSid, KEY_READ,
149 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeRestrictedSid, KEY_READ);
150
151 CheckKeySecurity(L"\\REGISTRY\\MACHINE\\SAM",
152 4, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
153 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
154 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeWorldSid, KEY_READ,
155 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeRestrictedSid, KEY_READ);
156
157 CheckKeySecurity(L"\\REGISTRY\\MACHINE\\SECURITY",
158 2, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
159 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeAliasAdminsSid, WRITE_DAC | READ_CONTROL);
160
161 CheckKeySecurity(L"\\REGISTRY\\MACHINE\\SOFTWARE",
162 12, ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasUsersSid, KEY_READ,
163 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
164 CONTAINER_INHERIT_ACE, SeExports->SeAliasUsersSid, GENERIC_READ,
165 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasPowerUsersSid, KEY_READ | KEY_WRITE | DELETE,
166 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
167 CONTAINER_INHERIT_ACE, SeExports->SeAliasPowerUsersSid, GENERIC_READ | GENERIC_WRITE | DELETE,
168 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
169 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
170 CONTAINER_INHERIT_ACE, SeExports->SeAliasAdminsSid, GENERIC_ALL,
171 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
172 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
173 CONTAINER_INHERIT_ACE, SeExports->SeLocalSystemSid, GENERIC_ALL,
174 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
175 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
176 CONTAINER_INHERIT_ACE, SeExports->SeCreatorOwnerSid, GENERIC_ALL,
177 ACCESS_ALLOWED_ACE_TYPE, 0, TerminalServerSid, KEY_READ | KEY_WRITE | DELETE,
178 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
179 CONTAINER_INHERIT_ACE, TerminalServerSid, GENERIC_READ | GENERIC_WRITE | DELETE);
180
181 CheckKeySecurity(L"\\REGISTRY\\MACHINE\\SYSTEM",
182 10, ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasUsersSid, KEY_READ,
183 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
184 CONTAINER_INHERIT_ACE, SeExports->SeAliasUsersSid, GENERIC_READ,
185 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasPowerUsersSid, KEY_READ,
186 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
187 CONTAINER_INHERIT_ACE, SeExports->SeAliasPowerUsersSid, GENERIC_READ,
188 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
189 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
190 CONTAINER_INHERIT_ACE, SeExports->SeAliasAdminsSid, GENERIC_ALL,
191 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
192 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
193 CONTAINER_INHERIT_ACE, SeExports->SeLocalSystemSid, GENERIC_ALL,
194 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
195 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
196 CONTAINER_INHERIT_ACE, SeExports->SeCreatorOwnerSid, GENERIC_ALL);
197
198 CheckKeySecurity(L"\\REGISTRY\\USER",
199 4, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
200 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
201 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeWorldSid, KEY_READ,
202 ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE, SeExports->SeRestrictedSid, KEY_READ);
203
204 CheckKeySecurity(L"\\REGISTRY\\USER\\.DEFAULT",
205 10, ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasUsersSid, KEY_READ,
206 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
207 CONTAINER_INHERIT_ACE, SeExports->SeAliasUsersSid, GENERIC_READ,
208 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasPowerUsersSid, KEY_READ,
209 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
210 CONTAINER_INHERIT_ACE, SeExports->SeAliasPowerUsersSid, GENERIC_READ,
211 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
212 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
213 CONTAINER_INHERIT_ACE, SeExports->SeAliasAdminsSid, GENERIC_ALL,
214 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
215 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
216 CONTAINER_INHERIT_ACE, SeExports->SeLocalSystemSid, GENERIC_ALL,
217 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
218 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
219 CONTAINER_INHERIT_ACE, SeExports->SeCreatorOwnerSid, GENERIC_ALL);
220
221 CheckKeySecurity(L"\\REGISTRY\\USER\\S-1-5-18",
222 10, ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasUsersSid, KEY_READ,
223 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
224 CONTAINER_INHERIT_ACE, SeExports->SeAliasUsersSid, GENERIC_READ,
225 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasPowerUsersSid, KEY_READ,
226 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
227 CONTAINER_INHERIT_ACE, SeExports->SeAliasPowerUsersSid, GENERIC_READ,
228 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
229 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
230 CONTAINER_INHERIT_ACE, SeExports->SeAliasAdminsSid, GENERIC_ALL,
231 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
232 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
233 CONTAINER_INHERIT_ACE, SeExports->SeLocalSystemSid, GENERIC_ALL,
234 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
235 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
236 CONTAINER_INHERIT_ACE, SeExports->SeCreatorOwnerSid, GENERIC_ALL);
237
238 CheckKeySecurity(L"\\REGISTRY\\USER\\S-1-5-20",
239 8, ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeNetworkServiceSid, KEY_ALL_ACCESS,
240 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
241 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
242 ACCESS_ALLOWED_ACE_TYPE, 0, SeExports->SeRestrictedSid, KEY_READ,
243 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
244 CONTAINER_INHERIT_ACE |
245 OBJECT_INHERIT_ACE, SeExports->SeNetworkServiceSid, GENERIC_ALL,
246 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
247 CONTAINER_INHERIT_ACE |
248 OBJECT_INHERIT_ACE, SeExports->SeLocalSystemSid, GENERIC_ALL,
249 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
250 CONTAINER_INHERIT_ACE |
251 OBJECT_INHERIT_ACE, SeExports->SeAliasAdminsSid, GENERIC_ALL,
252 ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
253 CONTAINER_INHERIT_ACE |
254 OBJECT_INHERIT_ACE, SeExports->SeRestrictedSid, GENERIC_READ);
255
256 if (TerminalServerSid != NULL)
257 {
258 ExFreePoolWithTag(TerminalServerSid, 'iSmK');
259 }
260 }