e2285fd29def0ecac334ef3a69fed44787c2ba18
[reactos.git] / ntoskrnl / include / internal / se.h
1 #pragma once
2
3 typedef struct _KNOWN_ACE
4 {
5 ACE_HEADER Header;
6 ACCESS_MASK Mask;
7 ULONG SidStart;
8 } KNOWN_ACE, *PKNOWN_ACE;
9
10 typedef struct _KNOWN_OBJECT_ACE
11 {
12 ACE_HEADER Header;
13 ACCESS_MASK Mask;
14 ULONG Flags;
15 ULONG SidStart;
16 } KNOWN_OBJECT_ACE, *PKNOWN_OBJECT_ACE;
17
18 typedef struct _KNOWN_COMPOUND_ACE
19 {
20 ACE_HEADER Header;
21 ACCESS_MASK Mask;
22 USHORT CompoundAceType;
23 USHORT Reserved;
24 ULONG SidStart;
25 } KNOWN_COMPOUND_ACE, *PKNOWN_COMPOUND_ACE;
26
27 FORCEINLINE
28 PSID
29 SepGetGroupFromDescriptor(PVOID _Descriptor)
30 {
31 PISECURITY_DESCRIPTOR Descriptor = (PISECURITY_DESCRIPTOR)_Descriptor;
32 PISECURITY_DESCRIPTOR_RELATIVE SdRel;
33
34 if (Descriptor->Control & SE_SELF_RELATIVE)
35 {
36 SdRel = (PISECURITY_DESCRIPTOR_RELATIVE)Descriptor;
37 if (!SdRel->Group) return NULL;
38 return (PSID)((ULONG_PTR)Descriptor + SdRel->Group);
39 }
40 else
41 {
42 return Descriptor->Group;
43 }
44 }
45
46 FORCEINLINE
47 PSID
48 SepGetOwnerFromDescriptor(PVOID _Descriptor)
49 {
50 PISECURITY_DESCRIPTOR Descriptor = (PISECURITY_DESCRIPTOR)_Descriptor;
51 PISECURITY_DESCRIPTOR_RELATIVE SdRel;
52
53 if (Descriptor->Control & SE_SELF_RELATIVE)
54 {
55 SdRel = (PISECURITY_DESCRIPTOR_RELATIVE)Descriptor;
56 if (!SdRel->Owner) return NULL;
57 return (PSID)((ULONG_PTR)Descriptor + SdRel->Owner);
58 }
59 else
60 {
61 return Descriptor->Owner;
62 }
63 }
64
65 FORCEINLINE
66 PACL
67 SepGetDaclFromDescriptor(PVOID _Descriptor)
68 {
69 PISECURITY_DESCRIPTOR Descriptor = (PISECURITY_DESCRIPTOR)_Descriptor;
70 PISECURITY_DESCRIPTOR_RELATIVE SdRel;
71
72 if (!(Descriptor->Control & SE_DACL_PRESENT)) return NULL;
73
74 if (Descriptor->Control & SE_SELF_RELATIVE)
75 {
76 SdRel = (PISECURITY_DESCRIPTOR_RELATIVE)Descriptor;
77 if (!SdRel->Dacl) return NULL;
78 return (PACL)((ULONG_PTR)Descriptor + SdRel->Dacl);
79 }
80 else
81 {
82 return Descriptor->Dacl;
83 }
84 }
85
86 FORCEINLINE
87 PACL
88 SepGetSaclFromDescriptor(PVOID _Descriptor)
89 {
90 PISECURITY_DESCRIPTOR Descriptor = (PISECURITY_DESCRIPTOR)_Descriptor;
91 PISECURITY_DESCRIPTOR_RELATIVE SdRel;
92
93 if (!(Descriptor->Control & SE_SACL_PRESENT)) return NULL;
94
95 if (Descriptor->Control & SE_SELF_RELATIVE)
96 {
97 SdRel = (PISECURITY_DESCRIPTOR_RELATIVE)Descriptor;
98 if (!SdRel->Sacl) return NULL;
99 return (PACL)((ULONG_PTR)Descriptor + SdRel->Sacl);
100 }
101 else
102 {
103 return Descriptor->Sacl;
104 }
105 }
106
107 #ifndef RTL_H
108
109 /* SID Authorities */
110 extern SID_IDENTIFIER_AUTHORITY SeNullSidAuthority;
111 extern SID_IDENTIFIER_AUTHORITY SeWorldSidAuthority;
112 extern SID_IDENTIFIER_AUTHORITY SeLocalSidAuthority;
113 extern SID_IDENTIFIER_AUTHORITY SeCreatorSidAuthority;
114 extern SID_IDENTIFIER_AUTHORITY SeNtSidAuthority;
115
116 /* SIDs */
117 extern PSID SeNullSid;
118 extern PSID SeWorldSid;
119 extern PSID SeLocalSid;
120 extern PSID SeCreatorOwnerSid;
121 extern PSID SeCreatorGroupSid;
122 extern PSID SeCreatorOwnerServerSid;
123 extern PSID SeCreatorGroupServerSid;
124 extern PSID SeNtAuthoritySid;
125 extern PSID SeDialupSid;
126 extern PSID SeNetworkSid;
127 extern PSID SeBatchSid;
128 extern PSID SeInteractiveSid;
129 extern PSID SeServiceSid;
130 extern PSID SeAnonymousLogonSid;
131 extern PSID SePrincipalSelfSid;
132 extern PSID SeLocalSystemSid;
133 extern PSID SeAuthenticatedUserSid;
134 extern PSID SeRestrictedCodeSid;
135 extern PSID SeAliasAdminsSid;
136 extern PSID SeAliasUsersSid;
137 extern PSID SeAliasGuestsSid;
138 extern PSID SeAliasPowerUsersSid;
139 extern PSID SeAliasAccountOpsSid;
140 extern PSID SeAliasSystemOpsSid;
141 extern PSID SeAliasPrintOpsSid;
142 extern PSID SeAliasBackupOpsSid;
143 extern PSID SeAuthenticatedUsersSid;
144 extern PSID SeRestrictedSid;
145 extern PSID SeAnonymousLogonSid;
146 extern PSID SeLocalServiceSid;
147 extern PSID SeNetworkServiceSid;
148
149 /* Privileges */
150 extern const LUID SeCreateTokenPrivilege;
151 extern const LUID SeAssignPrimaryTokenPrivilege;
152 extern const LUID SeLockMemoryPrivilege;
153 extern const LUID SeIncreaseQuotaPrivilege;
154 extern const LUID SeUnsolicitedInputPrivilege;
155 extern const LUID SeTcbPrivilege;
156 extern const LUID SeSecurityPrivilege;
157 extern const LUID SeTakeOwnershipPrivilege;
158 extern const LUID SeLoadDriverPrivilege;
159 extern const LUID SeSystemProfilePrivilege;
160 extern const LUID SeSystemtimePrivilege;
161 extern const LUID SeProfileSingleProcessPrivilege;
162 extern const LUID SeIncreaseBasePriorityPrivilege;
163 extern const LUID SeCreatePagefilePrivilege;
164 extern const LUID SeCreatePermanentPrivilege;
165 extern const LUID SeBackupPrivilege;
166 extern const LUID SeRestorePrivilege;
167 extern const LUID SeShutdownPrivilege;
168 extern const LUID SeDebugPrivilege;
169 extern const LUID SeAuditPrivilege;
170 extern const LUID SeSystemEnvironmentPrivilege;
171 extern const LUID SeChangeNotifyPrivilege;
172 extern const LUID SeRemoteShutdownPrivilege;
173 extern const LUID SeUndockPrivilege;
174 extern const LUID SeSyncAgentPrivilege;
175 extern const LUID SeEnableDelegationPrivilege;
176 extern const LUID SeManageVolumePrivilege;
177 extern const LUID SeImpersonatePrivilege;
178 extern const LUID SeCreateGlobalPrivilege;
179 extern const LUID SeTrustedCredmanPrivilege;
180 extern const LUID SeRelabelPrivilege;
181 extern const LUID SeIncreaseWorkingSetPrivilege;
182 extern const LUID SeTimeZonePrivilege;
183 extern const LUID SeCreateSymbolicLinkPrivilege;
184
185 /* DACLs */
186 extern PACL SePublicDefaultUnrestrictedDacl;
187 extern PACL SePublicOpenDacl;
188 extern PACL SePublicOpenUnrestrictedDacl;
189 extern PACL SeUnrestrictedDacl;
190
191 /* SDs */
192 extern PSECURITY_DESCRIPTOR SePublicDefaultSd;
193 extern PSECURITY_DESCRIPTOR SePublicDefaultUnrestrictedSd;
194 extern PSECURITY_DESCRIPTOR SePublicOpenSd;
195 extern PSECURITY_DESCRIPTOR SePublicOpenUnrestrictedSd;
196 extern PSECURITY_DESCRIPTOR SeSystemDefaultSd;
197 extern PSECURITY_DESCRIPTOR SeUnrestrictedSd;
198
199
200 #define SepAcquireTokenLockExclusive(Token) \
201 { \
202 KeEnterCriticalRegion(); \
203 ExAcquireResourceExclusiveLite(((PTOKEN)Token)->TokenLock, TRUE); \
204 }
205 #define SepAcquireTokenLockShared(Token) \
206 { \
207 KeEnterCriticalRegion(); \
208 ExAcquireResourceSharedLite(((PTOKEN)Token)->TokenLock, TRUE); \
209 }
210
211 #define SepReleaseTokenLock(Token) \
212 { \
213 ExReleaseResourceLite(((PTOKEN)Token)->TokenLock); \
214 KeLeaveCriticalRegion(); \
215 }
216
217 //
218 // Token Functions
219 //
220 BOOLEAN
221 NTAPI
222 SepTokenIsOwner(
223 IN PACCESS_TOKEN _Token,
224 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
225 IN BOOLEAN TokenLocked
226 );
227
228 BOOLEAN
229 NTAPI
230 SepSidInToken(
231 IN PACCESS_TOKEN _Token,
232 IN PSID Sid
233 );
234
235 BOOLEAN
236 NTAPI
237 SepSidInTokenEx(
238 IN PACCESS_TOKEN _Token,
239 IN PSID PrincipalSelfSid,
240 IN PSID _Sid,
241 IN BOOLEAN Deny,
242 IN BOOLEAN Restricted
243 );
244
245 /* Functions */
246 INIT_FUNCTION
247 BOOLEAN
248 NTAPI
249 SeInitSystem(VOID);
250
251 INIT_FUNCTION
252 VOID
253 NTAPI
254 ExpInitLuid(VOID);
255
256 INIT_FUNCTION
257 VOID
258 NTAPI
259 SepInitPrivileges(VOID);
260
261 INIT_FUNCTION
262 BOOLEAN
263 NTAPI
264 SepInitSecurityIDs(VOID);
265
266 INIT_FUNCTION
267 BOOLEAN
268 NTAPI
269 SepInitDACLs(VOID);
270
271 INIT_FUNCTION
272 BOOLEAN
273 NTAPI
274 SepInitSDs(VOID);
275
276 BOOLEAN
277 NTAPI
278 SeRmInitPhase0(VOID);
279
280 BOOLEAN
281 NTAPI
282 SeRmInitPhase1(VOID);
283
284 VOID
285 NTAPI
286 SeDeassignPrimaryToken(struct _EPROCESS *Process);
287
288 NTSTATUS
289 NTAPI
290 SeSubProcessToken(
291 IN PTOKEN Parent,
292 OUT PTOKEN *Token,
293 IN BOOLEAN InUse,
294 IN ULONG SessionId
295 );
296
297 NTSTATUS
298 NTAPI
299 SeInitializeProcessAuditName(
300 IN PFILE_OBJECT FileObject,
301 IN BOOLEAN DoAudit,
302 OUT POBJECT_NAME_INFORMATION *AuditInfo
303 );
304
305 NTSTATUS
306 NTAPI
307 SeCreateAccessStateEx(
308 IN PETHREAD Thread,
309 IN PEPROCESS Process,
310 IN OUT PACCESS_STATE AccessState,
311 IN PAUX_ACCESS_DATA AuxData,
312 IN ACCESS_MASK Access,
313 IN PGENERIC_MAPPING GenericMapping
314 );
315
316 NTSTATUS
317 NTAPI
318 SeIsTokenChild(
319 IN PTOKEN Token,
320 OUT PBOOLEAN IsChild
321 );
322
323 NTSTATUS
324 NTAPI
325 SeIsTokenSibling(
326 IN PTOKEN Token,
327 OUT PBOOLEAN IsSibling
328 );
329
330 NTSTATUS
331 NTAPI
332 SepCreateImpersonationTokenDacl(
333 _In_ PTOKEN Token,
334 _In_ PTOKEN PrimaryToken,
335 _Out_ PACL* Dacl
336 );
337
338 INIT_FUNCTION
339 VOID
340 NTAPI
341 SepInitializeTokenImplementation(VOID);
342
343 PTOKEN
344 NTAPI
345 SepCreateSystemProcessToken(VOID);
346
347 BOOLEAN
348 NTAPI
349 SeDetailedAuditingWithToken(IN PTOKEN Token);
350
351 VOID
352 NTAPI
353 SeAuditProcessExit(IN PEPROCESS Process);
354
355 VOID
356 NTAPI
357 SeAuditProcessCreate(IN PEPROCESS Process);
358
359 NTSTATUS
360 NTAPI
361 SeExchangePrimaryToken(
362 _In_ PEPROCESS Process,
363 _In_ PACCESS_TOKEN NewAccessToken,
364 _Out_ PACCESS_TOKEN* OldAccessToken
365 );
366
367 VOID
368 NTAPI
369 SeCaptureSubjectContextEx(
370 IN PETHREAD Thread,
371 IN PEPROCESS Process,
372 OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
373 );
374
375 NTSTATUS
376 NTAPI
377 SeCaptureLuidAndAttributesArray(
378 PLUID_AND_ATTRIBUTES Src,
379 ULONG PrivilegeCount,
380 KPROCESSOR_MODE PreviousMode,
381 PLUID_AND_ATTRIBUTES AllocatedMem,
382 ULONG AllocatedLength,
383 POOL_TYPE PoolType,
384 BOOLEAN CaptureIfKernel,
385 PLUID_AND_ATTRIBUTES* Dest,
386 PULONG Length
387 );
388
389 VOID
390 NTAPI
391 SeReleaseLuidAndAttributesArray(
392 PLUID_AND_ATTRIBUTES Privilege,
393 KPROCESSOR_MODE PreviousMode,
394 BOOLEAN CaptureIfKernel
395 );
396
397 BOOLEAN
398 NTAPI
399 SepPrivilegeCheck(
400 PTOKEN Token,
401 PLUID_AND_ATTRIBUTES Privileges,
402 ULONG PrivilegeCount,
403 ULONG PrivilegeControl,
404 KPROCESSOR_MODE PreviousMode
405 );
406
407 NTSTATUS
408 NTAPI
409 SePrivilegePolicyCheck(
410 _Inout_ PACCESS_MASK DesiredAccess,
411 _Inout_ PACCESS_MASK GrantedAccess,
412 _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext,
413 _In_ PTOKEN Token,
414 _Out_opt_ PPRIVILEGE_SET *OutPrivilegeSet,
415 _In_ KPROCESSOR_MODE PreviousMode);
416
417 BOOLEAN
418 NTAPI
419 SeCheckPrivilegedObject(
420 IN LUID PrivilegeValue,
421 IN HANDLE ObjectHandle,
422 IN ACCESS_MASK DesiredAccess,
423 IN KPROCESSOR_MODE PreviousMode
424 );
425
426 NTSTATUS
427 NTAPI
428 SepDuplicateToken(
429 _In_ PTOKEN Token,
430 _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
431 _In_ BOOLEAN EffectiveOnly,
432 _In_ TOKEN_TYPE TokenType,
433 _In_ SECURITY_IMPERSONATION_LEVEL Level,
434 _In_ KPROCESSOR_MODE PreviousMode,
435 _Out_ PTOKEN* NewAccessToken
436 );
437
438 NTSTATUS
439 NTAPI
440 SepCaptureSecurityQualityOfService(
441 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
442 IN KPROCESSOR_MODE AccessMode,
443 IN POOL_TYPE PoolType,
444 IN BOOLEAN CaptureIfKernel,
445 OUT PSECURITY_QUALITY_OF_SERVICE *CapturedSecurityQualityOfService,
446 OUT PBOOLEAN Present
447 );
448
449 VOID
450 NTAPI
451 SepReleaseSecurityQualityOfService(
452 IN PSECURITY_QUALITY_OF_SERVICE CapturedSecurityQualityOfService OPTIONAL,
453 IN KPROCESSOR_MODE AccessMode,
454 IN BOOLEAN CaptureIfKernel
455 );
456
457 NTSTATUS
458 NTAPI
459 SepCaptureSid(
460 IN PSID InputSid,
461 IN KPROCESSOR_MODE AccessMode,
462 IN POOL_TYPE PoolType,
463 IN BOOLEAN CaptureIfKernel,
464 OUT PSID *CapturedSid
465 );
466
467 VOID
468 NTAPI
469 SepReleaseSid(
470 IN PSID CapturedSid,
471 IN KPROCESSOR_MODE AccessMode,
472 IN BOOLEAN CaptureIfKernel
473 );
474
475 NTSTATUS
476 NTAPI
477 SeCaptureSidAndAttributesArray(
478 _In_ PSID_AND_ATTRIBUTES SrcSidAndAttributes,
479 _In_ ULONG AttributeCount,
480 _In_ KPROCESSOR_MODE PreviousMode,
481 _In_opt_ PVOID AllocatedMem,
482 _In_ ULONG AllocatedLength,
483 _In_ POOL_TYPE PoolType,
484 _In_ BOOLEAN CaptureIfKernel,
485 _Out_ PSID_AND_ATTRIBUTES *CapturedSidAndAttributes,
486 _Out_ PULONG ResultLength);
487
488 VOID
489 NTAPI
490 SeReleaseSidAndAttributesArray(
491 _In_ _Post_invalid_ PSID_AND_ATTRIBUTES CapturedSidAndAttributes,
492 _In_ KPROCESSOR_MODE AccessMode,
493 _In_ BOOLEAN CaptureIfKernel);
494
495 NTSTATUS
496 NTAPI
497 SeComputeQuotaInformationSize(
498 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
499 _Out_ PULONG QuotaInfoSize);
500
501 NTSTATUS
502 NTAPI
503 SepCaptureAcl(
504 IN PACL InputAcl,
505 IN KPROCESSOR_MODE AccessMode,
506 IN POOL_TYPE PoolType,
507 IN BOOLEAN CaptureIfKernel,
508 OUT PACL *CapturedAcl
509 );
510
511 VOID
512 NTAPI
513 SepReleaseAcl(
514 IN PACL CapturedAcl,
515 IN KPROCESSOR_MODE AccessMode,
516 IN BOOLEAN CaptureIfKernel
517 );
518
519 NTSTATUS
520 SepPropagateAcl(
521 _Out_writes_bytes_opt_(DaclLength) PACL AclDest,
522 _Inout_ PULONG AclLength,
523 _In_reads_bytes_(AclSource->AclSize) PACL AclSource,
524 _In_ PSID Owner,
525 _In_ PSID Group,
526 _In_ BOOLEAN IsInherited,
527 _In_ BOOLEAN IsDirectoryObject,
528 _In_ PGENERIC_MAPPING GenericMapping);
529
530 PACL
531 SepSelectAcl(
532 _In_opt_ PACL ExplicitAcl,
533 _In_ BOOLEAN ExplicitPresent,
534 _In_ BOOLEAN ExplicitDefaulted,
535 _In_opt_ PACL ParentAcl,
536 _In_opt_ PACL DefaultAcl,
537 _Out_ PULONG AclLength,
538 _In_ PSID Owner,
539 _In_ PSID Group,
540 _Out_ PBOOLEAN AclPresent,
541 _Out_ PBOOLEAN IsInherited,
542 _In_ BOOLEAN IsDirectoryObject,
543 _In_ PGENERIC_MAPPING GenericMapping);
544
545 NTSTATUS
546 NTAPI
547 SeDefaultObjectMethod(
548 PVOID Object,
549 SECURITY_OPERATION_CODE OperationType,
550 PSECURITY_INFORMATION SecurityInformation,
551 PSECURITY_DESCRIPTOR NewSecurityDescriptor,
552 PULONG ReturnLength,
553 PSECURITY_DESCRIPTOR *OldSecurityDescriptor,
554 POOL_TYPE PoolType,
555 PGENERIC_MAPPING GenericMapping
556 );
557
558 NTSTATUS
559 NTAPI
560 SeSetWorldSecurityDescriptor(
561 SECURITY_INFORMATION SecurityInformation,
562 PISECURITY_DESCRIPTOR SecurityDescriptor,
563 PULONG BufferLength
564 );
565
566 NTSTATUS
567 NTAPI
568 SeCopyClientToken(
569 IN PACCESS_TOKEN Token,
570 IN SECURITY_IMPERSONATION_LEVEL Level,
571 IN KPROCESSOR_MODE PreviousMode,
572 OUT PACCESS_TOKEN* NewToken
573 );
574
575 VOID NTAPI
576 SeQuerySecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
577 OUT PACCESS_MASK DesiredAccess);
578
579 VOID NTAPI
580 SeSetSecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
581 OUT PACCESS_MASK DesiredAccess);
582
583 BOOLEAN
584 NTAPI
585 SeFastTraverseCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
586 IN PACCESS_STATE AccessState,
587 IN ACCESS_MASK DesiredAccess,
588 IN KPROCESSOR_MODE AccessMode);
589
590 BOOLEAN
591 NTAPI
592 SeCheckAuditPrivilege(
593 _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext,
594 _In_ KPROCESSOR_MODE PreviousMode);
595
596 VOID
597 NTAPI
598 SePrivilegedServiceAuditAlarm(
599 _In_opt_ PUNICODE_STRING ServiceName,
600 _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext,
601 _In_ PPRIVILEGE_SET PrivilegeSet,
602 _In_ BOOLEAN AccessGranted);
603
604 NTSTATUS
605 SepRmReferenceLogonSession(
606 PLUID LogonLuid);
607
608 NTSTATUS
609 SepRmDereferenceLogonSession(
610 PLUID LogonLuid);
611
612 #endif
613
614 /* EOF */