ntoskrnl/ps/security.c

   1 /*
   2  * PROJECT:         ReactOS Kernel
   3  * LICENSE:         GPL - See COPYING in the top level directory
   4  * FILE:            ntoskrnl/ps/security.c
   5  * PURPOSE:         Process Manager: Process/Thread Security
   6  * PROGRAMMERS:     Alex Ionescu (alex.ionescu@reactos.org)
   7  *                  Eric Kohl
   8  *                  Thomas Weidenmueller (w3seek@reactos.org)
   9  */
  10
  11 /* INCLUDES ******************************************************************/
  12
  13 #include <ntoskrnl.h>
  14 #define NDEBUG
  15 #include <debug.h>
  16
  17 PTOKEN PspBootAccessToken;
  18
  19 VOID
  20 NTAPI
  21 SeAssignPrimaryToken(
  22     IN PEPROCESS Process,
  23     IN PTOKEN Token
  24 );
  25
  26 /* PRIVATE FUNCTIONS *********************************************************/
  27
  28 VOID
  29 NTAPI
  30 PspDeleteProcessSecurity(IN PEPROCESS Process)
  31 {
  32     PAGED_CODE();
  33     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
  34
  35     /* Check if we have a token */
  36     if (Process->Token.Object)
  37     {
  38         /* Deassign it */
  39         SeDeassignPrimaryToken(Process);
  40         Process->Token.Object = NULL;
  41     }
  42 }
  43
  44 VOID
  45 NTAPI
  46 PspDeleteThreadSecurity(IN PETHREAD Thread)
  47 {
  48     PPS_IMPERSONATION_INFORMATION ImpersonationInfo = Thread->ImpersonationInfo;
  49     PAGED_CODE();
  50     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
  51
  52     /* Check if we have active impersonation info */
  53     if (Thread->ActiveImpersonationInfo)
  54     {
  55         /* Dereference its token */
  56         ObDereferenceObject(ImpersonationInfo->Token);
  57     }
  58
  59     /* Check if we have impersonation info */
  60     if (ImpersonationInfo)
  61     {
  62         /* Free it */
  63         ExFreePool(ImpersonationInfo);
  64         PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
  65         Thread->ImpersonationInfo = NULL;
  66     }
  67 }
  68
  69 NTSTATUS
  70 NTAPI
  71 PspInitializeProcessSecurity(IN PEPROCESS Process,
  72                              IN PEPROCESS Parent OPTIONAL)
  73 {
  74     NTSTATUS Status = STATUS_SUCCESS;
  75     PTOKEN NewToken, ParentToken;
  76     PAGED_CODE();
  77     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
  78
  79     /* If we have a parent, then duplicate the Token */
  80     if (Parent)
  81     {
  82         /* Get the Parent Token */
  83         ParentToken = PsReferencePrimaryToken(Parent);
  84
  85         /* Duplicate it */
  86         Status = SeSubProcessToken(ParentToken,
  87                                    &NewToken,
  88                                    TRUE,
  89                                    MmGetSessionId(Process));
  90
  91         /* Dereference the Parent */
  92         ObFastDereferenceObject(&Parent->Token, ParentToken);
  93
  94         /* Set the new Token */
  95         if (NT_SUCCESS(Status))
  96         {
  97             /* Initailize the fast reference */
  98             ObInitializeFastReference(&Process->Token, NewToken);
  99         }
 100     }
 101     else
 102     {
 103         /* No parent, assign the Boot Token */
 104         ObInitializeFastReference(&Process->Token, NULL);
 105         SeAssignPrimaryToken(Process, PspBootAccessToken);
 106     }
 107
 108     /* Return to caller */
 109     return Status;
 110 }
 111
 112 NTSTATUS
 113 NTAPI
 114 PspWriteTebImpersonationInfo(IN PETHREAD Thread,
 115                              IN PETHREAD CurrentThread)
 116 {
 117     PEPROCESS Process;
 118     PTEB Teb;
 119     BOOLEAN Attached = FALSE;
 120     BOOLEAN IsImpersonating;
 121     KAPC_STATE ApcState;
 122     PAGED_CODE();
 123     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
 124
 125     /* Sanity check */
 126     ASSERT(CurrentThread == PsGetCurrentThread());
 127
 128     /* Get process and TEB */
 129     Process = Thread->ThreadsProcess;
 130     Teb = Thread->Tcb.Teb;
 131     if (Teb)
 132     {
 133         /* Check if we're not in the right process */
 134         if (Thread->Tcb.ApcState.Process != &Process->Pcb)
 135         {
 136             /* Attach to the process */
 137             KeStackAttachProcess(&Process->Pcb, &ApcState);
 138             Attached = TRUE;
 139         }
 140
 141         /* Check if we're in a different thread or acquire rundown */
 142         if ((Thread == CurrentThread) ||
 143             (ExAcquireRundownProtection(&Thread->RundownProtect)))
 144         {
 145             /* Check if the thread is impersonating */
 146             IsImpersonating = (BOOLEAN)Thread->ActiveImpersonationInfo;
 147             if (IsImpersonating)
 148             {
 149                 /* Set TEB data */
 150                 Teb->ImpersonationLocale = -1;
 151                 Teb->IsImpersonating = 1;
 152             }
 153             else
 154             {
 155                 /* Set TEB data */
 156                 Teb->ImpersonationLocale = 0;
 157                 Teb->IsImpersonating = 0;
 158             }
 159         }
 160
 161         /* Check if we're in a different thread */
 162         if (Thread != CurrentThread)
 163         {
 164             /* Release protection */
 165             ExReleaseRundownProtection(&Thread->RundownProtect);
 166         }
 167
 168         /* Detach */
 169         if (Attached) KeUnstackDetachProcess(&ApcState);
 170     }
 171
 172     /* Return to caller */
 173     return STATUS_SUCCESS;
 174 }
 175
 176 NTSTATUS
 177 NTAPI
 178 PspAssignPrimaryToken(IN PEPROCESS Process,
 179                       IN HANDLE Token,
 180                       IN PACCESS_TOKEN AccessToken OPTIONAL)
 181 {
 182     PACCESS_TOKEN NewToken = AccessToken, OldToken;
 183     NTSTATUS Status;
 184     PAGED_CODE();
 185     PSTRACE(PS_SECURITY_DEBUG, "Process: %p Token: %p\n", Process, Token);
 186
 187     /* Check if we don't have a pointer */
 188     if (!AccessToken)
 189     {
 190         /* Reference it from the handle */
 191         Status = ObReferenceObjectByHandle(Token,
 192                                            TOKEN_ASSIGN_PRIMARY,
 193                                            SeTokenObjectType,
 194                                            ExGetPreviousMode(),
 195                                            &NewToken,
 196                                            NULL);
 197         if (!NT_SUCCESS(Status)) return Status;
 198     }
 199
 200     /* Exchange tokens */
 201     Status = SeExchangePrimaryToken(Process, NewToken, &OldToken);
 202
 203     /* Acquire and release the lock */
 204     PspLockProcessSecurityExclusive(Process);
 205     PspUnlockProcessSecurityExclusive(Process);
 206
 207     /* Dereference Tokens and Return */
 208     if (NT_SUCCESS(Status)) ObDereferenceObject(OldToken);
 209     if (!AccessToken) ObDereferenceObject(NewToken);
 210     return Status;
 211 }
 212
 213 NTSTATUS
 214 NTAPI
 215 PspSetPrimaryToken(IN PEPROCESS Process,
 216                    IN HANDLE TokenHandle OPTIONAL,
 217                    IN PACCESS_TOKEN Token OPTIONAL)
 218 {
 219     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 220     BOOLEAN IsChildOrSibling;
 221     PACCESS_TOKEN NewToken = Token;
 222     NTSTATUS Status, AccessStatus;
 223     BOOLEAN Result, SdAllocated;
 224     PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
 225     SECURITY_SUBJECT_CONTEXT SubjectContext;
 226
 227     PSTRACE(PS_SECURITY_DEBUG, "Process: %p Token: %p\n", Process, Token);
 228
 229     /* Reference the token by handle if we don't already have a token object */
 230     if (!Token)
 231     {
 232         Status = ObReferenceObjectByHandle(TokenHandle,
 233                                            TOKEN_ASSIGN_PRIMARY,
 234                                            SeTokenObjectType,
 235                                            PreviousMode,
 236                                            (PVOID*)&NewToken,
 237                                            NULL);
 238         if (!NT_SUCCESS(Status)) return Status;
 239     }
 240
 241     /*
 242      * Check whether this token is a child or sibling of the current process token.
 243      * NOTE: On Windows Vista+ both of these checks (together with extra steps)
 244      * are now performed by a new SeIsTokenAssignableToProcess() helper.
 245      */
 246     Status = SeIsTokenChild(NewToken, &IsChildOrSibling);
 247     if (!NT_SUCCESS(Status))
 248     {
 249         /* Failed, dereference */
 250         if (!Token) ObDereferenceObject(NewToken);
 251         return Status;
 252     }
 253     if (!IsChildOrSibling)
 254     {
 255         Status = SeIsTokenSibling(NewToken, &IsChildOrSibling);
 256         if (!NT_SUCCESS(Status))
 257         {
 258             /* Failed, dereference */
 259             if (!Token) ObDereferenceObject(NewToken);
 260             return Status;
 261         }
 262     }
 263
 264     /* Check if this was an independent token */
 265     if (!IsChildOrSibling)
 266     {
 267         /* Make sure we have the privilege to assign a new one */
 268         if (!SeSinglePrivilegeCheck(SeAssignPrimaryTokenPrivilege,
 269                                     PreviousMode))
 270         {
 271             /* Failed, dereference */
 272             if (!Token) ObDereferenceObject(NewToken);
 273             return STATUS_PRIVILEGE_NOT_HELD;
 274         }
 275     }
 276
 277     /* Assign the token */
 278     Status = PspAssignPrimaryToken(Process, NULL, NewToken);
 279     if (NT_SUCCESS(Status))
 280     {
 281         /*
 282          * We need to completely reverify if the process still has access to
 283          * itself under this new token.
 284          */
 285         Status = ObGetObjectSecurity(Process,
 286                                      &SecurityDescriptor,
 287                                      &SdAllocated);
 288         if (NT_SUCCESS(Status))
 289         {
 290             /* Setup the security context */
 291             SubjectContext.ProcessAuditId = Process;
 292             SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process);
 293             SubjectContext.ClientToken = NULL;
 294
 295             /* Do the access check */
 296             Result = SeAccessCheck(SecurityDescriptor,
 297                                    &SubjectContext,
 298                                    FALSE,
 299                                    MAXIMUM_ALLOWED,
 300                                    0,
 301                                    NULL,
 302                                    &PsProcessType->TypeInfo.GenericMapping,
 303                                    PreviousMode,
 304                                    &Process->GrantedAccess,
 305                                    &AccessStatus);
 306
 307             /* Dereference the token and let go the SD */
 308             ObFastDereferenceObject(&Process->Token,
 309                                     SubjectContext.PrimaryToken);
 310             ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
 311
 312             /* Remove access if it failed */
 313             if (!Result) Process->GrantedAccess = 0;
 314
 315             /* Setup granted access */
 316             Process->GrantedAccess |= (PROCESS_VM_OPERATION |
 317                                        PROCESS_VM_READ |
 318                                        PROCESS_VM_WRITE |
 319                                        PROCESS_QUERY_INFORMATION |
 320                                        PROCESS_TERMINATE |
 321                                        PROCESS_CREATE_THREAD |
 322                                        PROCESS_DUP_HANDLE |
 323                                        PROCESS_CREATE_PROCESS |
 324                                        PROCESS_SET_INFORMATION |
 325                                        STANDARD_RIGHTS_ALL |
 326                                        PROCESS_SET_QUOTA);
 327         }
 328     }
 329
 330     /* Dereference the token */
 331     if (!Token) ObDereferenceObject(NewToken);
 332     return Status;
 333 }
 334
 335 /* FUNCTIONS *****************************************************************/
 336
 337 /*
 338  * @implemented
 339  */
 340 NTSTATUS
 341 NTAPI
 342 NtOpenProcessToken(IN HANDLE ProcessHandle,
 343                    IN ACCESS_MASK DesiredAccess,
 344                    OUT PHANDLE TokenHandle)
 345 {
 346     /* Call the newer API */
 347     return NtOpenProcessTokenEx(ProcessHandle,
 348                                 DesiredAccess,
 349                                 0,
 350                                 TokenHandle);
 351 }
 352
 353 /*
 354  * @implemented
 355  */
 356 NTSTATUS
 357 NTAPI
 358 NtOpenProcessTokenEx(IN HANDLE ProcessHandle,
 359                      IN ACCESS_MASK DesiredAccess,
 360                      IN ULONG HandleAttributes,
 361                      OUT PHANDLE TokenHandle)
 362 {
 363     PACCESS_TOKEN Token;
 364     HANDLE hToken;
 365     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 366     NTSTATUS Status;
 367     PAGED_CODE();
 368     PSTRACE(PS_SECURITY_DEBUG,
 369             "Process: %p DesiredAccess: %lx\n", ProcessHandle, DesiredAccess);
 370
 371     /* Check if caller was user-mode */
 372     if (PreviousMode != KernelMode)
 373     {
 374         /* Enter SEH for probing */
 375         _SEH2_TRY
 376         {
 377             /* Probe the token handle */
 378             ProbeForWriteHandle(TokenHandle);
 379         }
 380         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 381         {
 382             /* Return the exception code */
 383             _SEH2_YIELD(return _SEH2_GetExceptionCode());
 384         }
 385         _SEH2_END;
 386     }
 387
 388     /* Validate object attributes */
 389     HandleAttributes = ObpValidateAttributes(HandleAttributes, PreviousMode);
 390
 391     /* Open the process token */
 392     Status = PsOpenTokenOfProcess(ProcessHandle, &Token);
 393     if (NT_SUCCESS(Status))
 394     {
 395         /* Reference it by handle and dereference the pointer */
 396         Status = ObOpenObjectByPointer(Token,
 397                                        HandleAttributes,
 398                                        NULL,
 399                                        DesiredAccess,
 400                                        SeTokenObjectType,
 401                                        PreviousMode,
 402                                        &hToken);
 403         ObDereferenceObject(Token);
 404
 405         /* Make sure we got a handle */
 406         if (NT_SUCCESS(Status))
 407         {
 408             /* Enter SEH for write */
 409             _SEH2_TRY
 410             {
 411                 /* Return the handle */
 412                 *TokenHandle = hToken;
 413             }
 414             _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 415             {
 416                 /* Get exception code */
 417                 Status = _SEH2_GetExceptionCode();
 418             }
 419             _SEH2_END;
 420         }
 421     }
 422
 423     /* Return status */
 424     return Status;
 425 }
 426
 427 /*
 428  * @implemented
 429  */
 430 PACCESS_TOKEN
 431 NTAPI
 432 PsReferencePrimaryToken(PEPROCESS Process)
 433 {
 434     PACCESS_TOKEN Token;
 435     PAGED_CODE();
 436     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
 437
 438     /* Fast Reference the Token */
 439     Token = ObFastReferenceObject(&Process->Token);
 440
 441     /* Check if we got the Token or if we got locked */
 442     if (!Token)
 443     {
 444         /* Lock the Process */
 445         PspLockProcessSecurityShared(Process);
 446
 447         /* Do a Locked Fast Reference */
 448         Token = ObFastReferenceObjectLocked(&Process->Token);
 449
 450         /* Unlock the Process */
 451         PspUnlockProcessSecurityShared(Process);
 452     }
 453
 454     /* Return the Token */
 455     return Token;
 456 }
 457
 458 /*
 459  * @implemented
 460  */
 461 NTSTATUS
 462 NTAPI
 463 PsOpenTokenOfProcess(IN HANDLE ProcessHandle,
 464                      OUT PACCESS_TOKEN* Token)
 465 {
 466     PEPROCESS Process;
 467     NTSTATUS Status;
 468     PAGED_CODE();
 469     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", ProcessHandle);
 470
 471     /* Get the Token */
 472     Status = ObReferenceObjectByHandle(ProcessHandle,
 473                                        PROCESS_QUERY_INFORMATION,
 474                                        PsProcessType,
 475                                        ExGetPreviousMode(),
 476                                        (PVOID*)&Process,
 477                                        NULL);
 478     if (NT_SUCCESS(Status))
 479     {
 480         /* Reference the token and dereference the process */
 481         *Token = PsReferencePrimaryToken(Process);
 482         ObDereferenceObject(Process);
 483     }
 484
 485     /* Return */
 486     return Status;
 487 }
 488
 489 /*
 490  * @implemented
 491  */
 492 NTSTATUS
 493 NTAPI
 494 PsAssignImpersonationToken(IN PETHREAD Thread,
 495                            IN HANDLE TokenHandle)
 496 {
 497     PACCESS_TOKEN Token;
 498     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
 499     NTSTATUS Status;
 500     PAGED_CODE();
 501     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p Token: %p\n", Thread, TokenHandle);
 502
 503     /* Check if we were given a handle */
 504     if (!TokenHandle)
 505     {
 506         /* Undo impersonation */
 507         PsRevertThreadToSelf(Thread);
 508         return STATUS_SUCCESS;
 509     }
 510
 511     /* Get the token object */
 512     Status = ObReferenceObjectByHandle(TokenHandle,
 513                                        TOKEN_IMPERSONATE,
 514                                        SeTokenObjectType,
 515                                        KeGetPreviousMode(),
 516                                        (PVOID*)&Token,
 517                                        NULL);
 518     if (!NT_SUCCESS(Status)) return(Status);
 519
 520     /* Make sure it's an impersonation token */
 521     if (SeTokenType(Token) != TokenImpersonation)
 522     {
 523         /* Fail */
 524         ObDereferenceObject(Token);
 525         return STATUS_BAD_TOKEN_TYPE;
 526     }
 527
 528     /* Get the impersonation level */
 529     ImpersonationLevel = SeTokenImpersonationLevel(Token);
 530
 531     /* Call the impersonation API */
 532     Status = PsImpersonateClient(Thread,
 533                                  Token,
 534                                  FALSE,
 535                                  FALSE,
 536                                  ImpersonationLevel);
 537
 538     /* Dereference the token and return status */
 539     ObDereferenceObject(Token);
 540     return Status;
 541 }
 542
 543 /*
 544  * @implemented
 545  */
 546 VOID
 547 NTAPI
 548 PsRevertToSelf(VOID)
 549 {
 550     /* Call the per-thread API */
 551     PAGED_CODE();
 552     PsRevertThreadToSelf(PsGetCurrentThread());
 553 }
 554
 555 /*
 556  * @implemented
 557  */
 558 VOID
 559 NTAPI
 560 PsRevertThreadToSelf(IN PETHREAD Thread)
 561 {
 562     PTOKEN Token = NULL;
 563     PAGED_CODE();
 564     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
 565
 566     /* Make sure we had impersonation information */
 567     if (Thread->ActiveImpersonationInfo)
 568     {
 569         /* Lock the thread security */
 570         PspLockThreadSecurityExclusive(Thread);
 571
 572         /* Make sure it's still active */
 573         if (Thread->ActiveImpersonationInfo)
 574         {
 575             /* Disable impersonation */
 576             PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 577
 578             /* Get the token */
 579             Token = Thread->ImpersonationInfo->Token;
 580         }
 581
 582         /* Release thread security */
 583         PspUnlockThreadSecurityExclusive(Thread);
 584
 585         /* Check if we had a token */
 586         if (Token)
 587         {
 588             /* Dereference the impersonation token */
 589             ObDereferenceObject(Token);
 590
 591             /* Write impersonation info to the TEB */
 592             PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
 593         }
 594     }
 595 }
 596
 597 /*
 598  * @implemented
 599  */
 600 NTSTATUS
 601 NTAPI
 602 PsImpersonateClient(IN PETHREAD Thread,
 603                     IN PACCESS_TOKEN Token,
 604                     IN BOOLEAN CopyOnOpen,
 605                     IN BOOLEAN EffectiveOnly,
 606                     IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
 607 {
 608     PPS_IMPERSONATION_INFORMATION Impersonation, OldData;
 609     PTOKEN OldToken = NULL;
 610     PAGED_CODE();
 611     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p, Token: %p\n", Thread, Token);
 612
 613     /* Check if we don't have a token */
 614     if (!Token)
 615     {
 616         /* Make sure we're impersonating */
 617         if (Thread->ActiveImpersonationInfo)
 618         {
 619             /* We seem to be, lock the thread */
 620             PspLockThreadSecurityExclusive(Thread);
 621
 622             /* Make sure we're still impersonating */
 623             if (Thread->ActiveImpersonationInfo)
 624             {
 625                 /* Disable impersonation */
 626                 PspClearCrossThreadFlag(Thread,
 627                                         CT_ACTIVE_IMPERSONATION_INFO_BIT);
 628
 629                 /* Get the token */
 630                 OldToken = Thread->ImpersonationInfo->Token;
 631             }
 632
 633             /* Unlock the process and write TEB information */
 634             PspUnlockThreadSecurityExclusive(Thread);
 635             PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
 636         }
 637     }
 638     else
 639     {
 640         /* Check if we have impersonation info */
 641         Impersonation = Thread->ImpersonationInfo;
 642         if (!Impersonation)
 643         {
 644             /* We need to allocate a new one */
 645             Impersonation = ExAllocatePoolWithTag(PagedPool,
 646                                                   sizeof(*Impersonation),
 647                                                   TAG_PS_IMPERSONATION);
 648             if (!Impersonation) return STATUS_INSUFFICIENT_RESOURCES;
 649
 650             /* Update the pointer */
 651             OldData = InterlockedCompareExchangePointer((PVOID*)&Thread->
 652                                                         ImpersonationInfo,
 653                                                         Impersonation,
 654                                                         NULL);
 655             if (OldData)
 656             {
 657                 /* Someone beat us to it, free our copy */
 658                 ExFreePoolWithTag(Impersonation, TAG_PS_IMPERSONATION);
 659                 Impersonation = OldData;
 660             }
 661         }
 662
 663         /* Check if this is a job, which we don't support yet */
 664         if (Thread->ThreadsProcess->Job) ASSERT(FALSE);
 665
 666         /* Lock thread security */
 667         PspLockThreadSecurityExclusive(Thread);
 668
 669         /* Check if we're impersonating */
 670         if (Thread->ActiveImpersonationInfo)
 671         {
 672             /* Get the token */
 673             OldToken = Impersonation->Token;
 674         }
 675         else
 676         {
 677             /* Otherwise, enable impersonation */
 678             PspSetCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 679         }
 680
 681         /* Now fill it out */
 682         Impersonation->ImpersonationLevel = ImpersonationLevel;
 683         Impersonation->CopyOnOpen = CopyOnOpen;
 684         Impersonation->EffectiveOnly = EffectiveOnly;
 685         Impersonation->Token = Token;
 686         ObReferenceObject(Token);
 687
 688         /* Unlock the thread */
 689         PspUnlockThreadSecurityExclusive(Thread);
 690
 691         /* Write impersonation info to the TEB */
 692         PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
 693     }
 694
 695     /* Dereference the token and return success */
 696     if (OldToken) PsDereferenceImpersonationToken(OldToken);
 697     return STATUS_SUCCESS;
 698 }
 699
 700 /*
 701  * @implemented
 702  */
 703 PACCESS_TOKEN
 704 NTAPI
 705 PsReferenceEffectiveToken(IN PETHREAD Thread,
 706                           OUT IN PTOKEN_TYPE TokenType,
 707                           OUT PBOOLEAN EffectiveOnly,
 708                           OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
 709 {
 710     PEPROCESS Process;
 711     PACCESS_TOKEN Token = NULL;
 712
 713     PAGED_CODE();
 714
 715     PSTRACE(PS_SECURITY_DEBUG,
 716             "Thread: %p, TokenType: %p\n", Thread, TokenType);
 717
 718     /* Check if we don't have impersonation info */
 719     Process = Thread->ThreadsProcess;
 720     if (Thread->ActiveImpersonationInfo)
 721     {
 722         /* Lock the Process */
 723         PspLockProcessSecurityShared(Process);
 724
 725         /* Make sure impersonation is still active */
 726         if (Thread->ActiveImpersonationInfo)
 727         {
 728             /* Get the token */
 729             Token = Thread->ImpersonationInfo->Token;
 730             ObReferenceObject(Token);
 731
 732             /* Return data to caller */
 733             *TokenType = TokenImpersonation;
 734             *EffectiveOnly = Thread->ImpersonationInfo->EffectiveOnly;
 735             *ImpersonationLevel = Thread->ImpersonationInfo->ImpersonationLevel;
 736
 737             /* Unlock the Process */
 738             PspUnlockProcessSecurityShared(Process);
 739             return Token;
 740         }
 741
 742         /* Unlock the Process */
 743         PspUnlockProcessSecurityShared(Process);
 744     }
 745
 746     /* Fast Reference the Token */
 747     Token = ObFastReferenceObject(&Process->Token);
 748
 749     /* Check if we got the Token or if we got locked */
 750     if (!Token)
 751     {
 752         /* Lock the Process */
 753         PspLockProcessSecurityShared(Process);
 754
 755         /* Do a Locked Fast Reference */
 756         Token = ObFastReferenceObjectLocked(&Process->Token);
 757
 758         /* Unlock the Process */
 759         PspUnlockProcessSecurityShared(Process);
 760     }
 761
 762     /* Return the token */
 763     *TokenType = TokenPrimary;
 764     *EffectiveOnly = FALSE;
 765     // NOTE: ImpersonationLevel is left untouched on purpose!
 766     return Token;
 767 }
 768
 769 /*
 770  * @implemented
 771  */
 772 PACCESS_TOKEN
 773 NTAPI
 774 PsReferenceImpersonationToken(IN PETHREAD Thread,
 775                               OUT PBOOLEAN CopyOnOpen,
 776                               OUT PBOOLEAN EffectiveOnly,
 777                               OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
 778 {
 779     PTOKEN Token = NULL;
 780     PAGED_CODE();
 781     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
 782
 783     /* If we don't have impersonation info, just quit */
 784     if (!Thread->ActiveImpersonationInfo) return NULL;
 785
 786     /* Lock the thread */
 787     PspLockThreadSecurityShared(Thread);
 788
 789     /* Make sure we still have active impersonation */
 790     if (Thread->ActiveImpersonationInfo)
 791     {
 792         /* Return data from caller */
 793         ObReferenceObject(Thread->ImpersonationInfo->Token);
 794         *ImpersonationLevel = Thread->ImpersonationInfo->ImpersonationLevel;
 795         *CopyOnOpen = Thread->ImpersonationInfo->CopyOnOpen;
 796         *EffectiveOnly = Thread->ImpersonationInfo->EffectiveOnly;
 797
 798         /* Set the token */
 799         Token = Thread->ImpersonationInfo->Token;
 800     }
 801
 802     /* Unlock thread and return impersonation token */
 803     PspUnlockThreadSecurityShared(Thread);
 804     return Token;
 805 }
 806
 807 #undef PsDereferenceImpersonationToken
 808 /*
 809  * @implemented
 810  */
 811 VOID
 812 NTAPI
 813 PsDereferenceImpersonationToken(IN PACCESS_TOKEN ImpersonationToken)
 814 {
 815     PAGED_CODE();
 816
 817     /* If we got a token, dereference it */
 818     if (ImpersonationToken) ObDereferenceObject(ImpersonationToken);
 819 }
 820
 821 #undef PsDereferencePrimaryToken
 822 /*
 823  * @implemented
 824  */
 825 VOID
 826 NTAPI
 827 PsDereferencePrimaryToken(IN PACCESS_TOKEN PrimaryToken)
 828 {
 829     PAGED_CODE();
 830
 831     /* Dereference the token*/
 832     ObDereferenceObject(PrimaryToken);
 833 }
 834
 835 /*
 836  * @implemented
 837  */
 838 BOOLEAN
 839 NTAPI
 840 PsDisableImpersonation(IN PETHREAD Thread,
 841                        OUT PSE_IMPERSONATION_STATE ImpersonationState)
 842 {
 843     PPS_IMPERSONATION_INFORMATION Impersonation = NULL;
 844     LONG OldFlags;
 845     PAGED_CODE();
 846     PSTRACE(PS_SECURITY_DEBUG,
 847             "Thread: %p State: %p\n", Thread, ImpersonationState);
 848
 849     /* Check if we don't have impersonation */
 850     if (Thread->ActiveImpersonationInfo)
 851     {
 852         /* Lock thread security */
 853         PspLockThreadSecurityExclusive(Thread);
 854
 855         /* Disable impersonation */
 856         OldFlags = PspClearCrossThreadFlag(Thread,
 857                                            CT_ACTIVE_IMPERSONATION_INFO_BIT);
 858
 859         /* Make sure nobody disabled it behind our back */
 860         if (OldFlags & CT_ACTIVE_IMPERSONATION_INFO_BIT)
 861         {
 862             /* Copy the old state */
 863             Impersonation = Thread->ImpersonationInfo;
 864             ImpersonationState->Token = Impersonation->Token;
 865             ImpersonationState->CopyOnOpen = Impersonation->CopyOnOpen;
 866             ImpersonationState->EffectiveOnly = Impersonation->EffectiveOnly;
 867             ImpersonationState->Level = Impersonation->ImpersonationLevel;
 868         }
 869
 870         /* Unlock thread security */
 871         PspUnlockThreadSecurityExclusive(Thread);
 872
 873         /* If we had impersonation info, return true */
 874         if (Impersonation) return TRUE;
 875     }
 876
 877     /* Clear everything */
 878     ImpersonationState->Token = NULL;
 879     ImpersonationState->CopyOnOpen = FALSE;
 880     ImpersonationState->EffectiveOnly = FALSE;
 881     ImpersonationState->Level = SecurityAnonymous;
 882     return FALSE;
 883 }
 884
 885 /*
 886  * @implemented
 887  */
 888 VOID
 889 NTAPI
 890 PsRestoreImpersonation(IN PETHREAD Thread,
 891                        IN PSE_IMPERSONATION_STATE ImpersonationState)
 892 {
 893     PTOKEN Token = NULL;
 894     PPS_IMPERSONATION_INFORMATION Impersonation;
 895     PAGED_CODE();
 896     PSTRACE(PS_SECURITY_DEBUG,
 897             "Thread: %p State: %p\n", Thread, ImpersonationState);
 898
 899     /* Lock thread security */
 900     PspLockThreadSecurityExclusive(Thread);
 901
 902     /* Get the impersonation info */
 903     Impersonation = Thread->ImpersonationInfo;
 904
 905     /* Check if we're impersonating */
 906     if (Thread->ActiveImpersonationInfo)
 907     {
 908         /* Get the token */
 909         Token = Impersonation->Token;
 910     }
 911
 912     /* Check if we have an impersonation state */
 913     if (ImpersonationState)
 914     {
 915         /* Fill out the impersonation info */
 916         Impersonation->ImpersonationLevel = ImpersonationState->Level;
 917         Impersonation->CopyOnOpen = ImpersonationState->CopyOnOpen;
 918         Impersonation->EffectiveOnly = ImpersonationState->EffectiveOnly;
 919         Impersonation->Token = ImpersonationState->Token;
 920
 921         /* Enable impersonation */
 922         PspSetCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 923     }
 924     else
 925     {
 926         /* Disable impersonation */
 927         PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 928     }
 929
 930     /* Unlock the thread */
 931     PspUnlockThreadSecurityExclusive(Thread);
 932
 933     /* Dereference the token */
 934     if (Token) ObDereferenceObject(Token);
 935 }
 936
 937 NTSTATUS
 938 NTAPI
 939 NtImpersonateThread(IN HANDLE ThreadHandle,
 940                     IN HANDLE ThreadToImpersonateHandle,
 941                     IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService)
 942 {
 943     SECURITY_QUALITY_OF_SERVICE SafeServiceQoS;
 944     SECURITY_CLIENT_CONTEXT ClientContext;
 945     PETHREAD Thread;
 946     PETHREAD ThreadToImpersonate;
 947     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 948     NTSTATUS Status;
 949     PAGED_CODE();
 950     PSTRACE(PS_SECURITY_DEBUG,
 951             "Threads: %p %p\n", ThreadHandle, ThreadToImpersonateHandle);
 952
 953     /* Check if call came from user mode */
 954     if (PreviousMode != KernelMode)
 955     {
 956         /* Enter SEH for probing */
 957         _SEH2_TRY
 958         {
 959             /* Probe QoS */
 960             ProbeForRead(SecurityQualityOfService,
 961                          sizeof(SECURITY_QUALITY_OF_SERVICE),
 962                          sizeof(ULONG));
 963
 964             /* Capture it */
 965             SafeServiceQoS = *SecurityQualityOfService;
 966             SecurityQualityOfService = &SafeServiceQoS;
 967         }
 968         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 969         {
 970             /* Return the exception code */
 971             _SEH2_YIELD(return _SEH2_GetExceptionCode());
 972         }
 973         _SEH2_END;
 974     }
 975
 976     /* Reference the thread */
 977     Status = ObReferenceObjectByHandle(ThreadHandle,
 978                                        THREAD_DIRECT_IMPERSONATION,
 979                                        PsThreadType,
 980                                        PreviousMode,
 981                                        (PVOID*)&Thread,
 982                                        NULL);
 983     if (NT_SUCCESS(Status))
 984     {
 985         /* Reference the impersonating thead */
 986         Status = ObReferenceObjectByHandle(ThreadToImpersonateHandle,
 987                                            THREAD_IMPERSONATE,
 988                                            PsThreadType,
 989                                            PreviousMode,
 990                                            (PVOID*)&ThreadToImpersonate,
 991                                            NULL);
 992         if (NT_SUCCESS(Status))
 993         {
 994             /* Create a client security context */
 995             Status = SeCreateClientSecurity(ThreadToImpersonate,
 996                                             SecurityQualityOfService,
 997                                             0,
 998                                             &ClientContext);
 999             if (NT_SUCCESS(Status))
1000             {
1001                 /* Do the impersonation */
1002                 SeImpersonateClient(&ClientContext, Thread);
1003                 if (ClientContext.ClientToken)
1004                 {
1005                     /* Dereference the client token if we had one */
1006                     ObDereferenceObject(ClientContext.ClientToken);
1007                 }
1008             }
1009
1010             /* Dereference the thread to impersonate */
1011             ObDereferenceObject(ThreadToImpersonate);
1012         }
1013
1014         /* Dereference the main thread */
1015         ObDereferenceObject(Thread);
1016     }
1017
1018     /* Return status */
1019     return Status;
1020 }
1021 /* EOF */