ntoskrnl/ps/security.c

   1 /*
   2  * PROJECT:         ReactOS Kernel
   3  * LICENSE:         GPL - See COPYING in the top level directory
   4  * FILE:            ntoskrnl/ps/security.c
   5  * PURPOSE:         Process Manager: Process/Thread Security
   6  * PROGRAMMERS:     Alex Ionescu (alex.ionescu@reactos.org)
   7  *                  Eric Kohl
   8  *                  Thomas Weidenmueller (w3seek@reactos.org)
   9  */
  10
  11 /* INCLUDES ******************************************************************/
  12
  13 #include <ntoskrnl.h>
  14 #define NDEBUG
  15 #include <debug.h>
  16
  17 PTOKEN PspBootAccessToken;
  18
  19 VOID
  20 NTAPI
  21 SeAssignPrimaryToken(
  22     IN PEPROCESS Process,
  23     IN PTOKEN Token
  24 );
  25
  26 /* PRIVATE FUNCTIONS *********************************************************/
  27
  28 VOID
  29 NTAPI
  30 PspDeleteProcessSecurity(IN PEPROCESS Process)
  31 {
  32     PAGED_CODE();
  33     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
  34
  35     /* Check if we have a token */
  36     if (Process->Token.Object)
  37     {
  38         /* Deassign it */
  39         SeDeassignPrimaryToken(Process);
  40         Process->Token.Object = NULL;
  41     }
  42 }
  43
  44 VOID
  45 NTAPI
  46 PspDeleteThreadSecurity(IN PETHREAD Thread)
  47 {
  48     PPS_IMPERSONATION_INFORMATION ImpersonationInfo = Thread->ImpersonationInfo;
  49     PAGED_CODE();
  50     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
  51
  52     /* Check if we have active impersonation info */
  53     if (Thread->ActiveImpersonationInfo)
  54     {
  55         /* Dereference its token */
  56         ObDereferenceObject(ImpersonationInfo->Token);
  57     }
  58
  59     /* Check if we have impersonation info */
  60     if (ImpersonationInfo)
  61     {
  62         /* Free it */
  63         ExFreePool(ImpersonationInfo);
  64         PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
  65         Thread->ImpersonationInfo = NULL;
  66     }
  67 }
  68
  69 NTSTATUS
  70 NTAPI
  71 PspInitializeProcessSecurity(IN PEPROCESS Process,
  72                              IN PEPROCESS Parent OPTIONAL)
  73 {
  74     NTSTATUS Status = STATUS_SUCCESS;
  75     PTOKEN NewToken, ParentToken;
  76     PAGED_CODE();
  77     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
  78
  79     /* If we have a parent, then duplicate the Token */
  80     if (Parent)
  81     {
  82         /* Get the Parent Token */
  83         ParentToken = PsReferencePrimaryToken(Parent);
  84
  85         /* Duplicate it */
  86         Status = SeSubProcessToken(ParentToken,
  87                                    &NewToken,
  88                                    TRUE,
  89                                    MmGetSessionId(Process));
  90
  91         /* Dereference the Parent */
  92         ObFastDereferenceObject(&Parent->Token, ParentToken);
  93
  94         /* Set the new Token */
  95         if (NT_SUCCESS(Status))
  96         {
  97             /* Initailize the fast reference */
  98             ObInitializeFastReference(&Process->Token, NewToken);
  99         }
 100     }
 101     else
 102     {
 103         /* No parent, assign the Boot Token */
 104         ObInitializeFastReference(&Process->Token, NULL);
 105         SeAssignPrimaryToken(Process, PspBootAccessToken);
 106     }
 107
 108     /* Return to caller */
 109     return Status;
 110 }
 111
 112 NTSTATUS
 113 NTAPI
 114 PspWriteTebImpersonationInfo(IN PETHREAD Thread,
 115                              IN PETHREAD CurrentThread)
 116 {
 117     PEPROCESS Process;
 118     PTEB Teb;
 119     BOOLEAN Attached = FALSE;
 120     BOOLEAN IsImpersonating;
 121     KAPC_STATE ApcState;
 122     PAGED_CODE();
 123     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
 124
 125     /* Sanity check */
 126     ASSERT(CurrentThread == PsGetCurrentThread());
 127
 128     /* Get process and TEB */
 129     Process = Thread->ThreadsProcess;
 130     Teb = Thread->Tcb.Teb;
 131     if (Teb)
 132     {
 133         /* Check if we're not in the right process */
 134         if (Thread->Tcb.ApcState.Process != &Process->Pcb)
 135         {
 136             /* Attach to the process */
 137             KeStackAttachProcess(&Process->Pcb, &ApcState);
 138             Attached = TRUE;
 139         }
 140
 141         /* Check if we're in a different thread or acquire rundown */
 142         if ((Thread == CurrentThread) ||
 143             (ExAcquireRundownProtection(&Thread->RundownProtect)))
 144         {
 145             /* Check if the thread is impersonating */
 146             IsImpersonating = (BOOLEAN)Thread->ActiveImpersonationInfo;
 147             if (IsImpersonating)
 148             {
 149                 /* Set TEB data */
 150                 Teb->ImpersonationLocale = -1;
 151                 Teb->IsImpersonating = 1;
 152             }
 153             else
 154             {
 155                 /* Set TEB data */
 156                 Teb->ImpersonationLocale = 0;
 157                 Teb->IsImpersonating = 0;
 158             }
 159         }
 160
 161         /* Check if we're in a different thread */
 162         if (Thread != CurrentThread)
 163         {
 164             /* Release protection */
 165             ExReleaseRundownProtection(&Thread->RundownProtect);
 166         }
 167
 168         /* Detach */
 169         if (Attached) KeUnstackDetachProcess(&ApcState);
 170     }
 171
 172     /* Return to caller */
 173     return STATUS_SUCCESS;
 174 }
 175
 176 NTSTATUS
 177 NTAPI
 178 PspAssignPrimaryToken(IN PEPROCESS Process,
 179                       IN HANDLE Token,
 180                       IN PACCESS_TOKEN AccessToken OPTIONAL)
 181 {
 182     PACCESS_TOKEN NewToken = AccessToken, OldToken;
 183     NTSTATUS Status;
 184     PAGED_CODE();
 185     PSTRACE(PS_SECURITY_DEBUG, "Process: %p Token: %p\n", Process, Token);
 186
 187     /* Check if we don't have a pointer */
 188     if (!AccessToken)
 189     {
 190         /* Reference it from the handle */
 191         Status = ObReferenceObjectByHandle(Token,
 192                                            TOKEN_ASSIGN_PRIMARY,
 193                                            SeTokenObjectType,
 194                                            ExGetPreviousMode(),
 195                                            &NewToken,
 196                                            NULL);
 197         if (!NT_SUCCESS(Status)) return Status;
 198     }
 199
 200     /* Exchange tokens */
 201     Status = SeExchangePrimaryToken(Process, NewToken, &OldToken);
 202
 203     /* Acquire and release the lock */
 204     PspLockProcessSecurityExclusive(Process);
 205     PspUnlockProcessSecurityExclusive(Process);
 206
 207     /* Dereference Tokens and Return */
 208     if (NT_SUCCESS(Status)) ObDereferenceObject(OldToken);
 209     if (!AccessToken) ObDereferenceObject(NewToken);
 210     return Status;
 211 }
 212
 213 NTSTATUS
 214 NTAPI
 215 PspSetPrimaryToken(IN PEPROCESS Process,
 216                    IN HANDLE TokenHandle OPTIONAL,
 217                    IN PACCESS_TOKEN Token OPTIONAL)
 218 {
 219     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 220     BOOLEAN IsChild;
 221     PACCESS_TOKEN NewToken = Token;
 222     NTSTATUS Status, AccessStatus;
 223     BOOLEAN Result, SdAllocated;
 224     PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
 225     SECURITY_SUBJECT_CONTEXT SubjectContext;
 226     PSTRACE(PS_SECURITY_DEBUG, "Process: %p Token: %p\n", Process, Token);
 227
 228     /* Make sure we got a handle */
 229     if (TokenHandle)
 230     {
 231         /* Reference it */
 232         Status = ObReferenceObjectByHandle(TokenHandle,
 233                                            TOKEN_ASSIGN_PRIMARY,
 234                                            SeTokenObjectType,
 235                                            PreviousMode,
 236                                            (PVOID*)&NewToken,
 237                                            NULL);
 238         if (!NT_SUCCESS(Status)) return Status;
 239     }
 240
 241     /* Check if this is a child */
 242     Status = SeIsTokenChild(NewToken, &IsChild);
 243     if (!NT_SUCCESS(Status))
 244     {
 245         /* Failed, dereference */
 246         if (TokenHandle) ObDereferenceObject(NewToken);
 247         return Status;
 248     }
 249
 250     /* Check if this was an independent token */
 251     if (!IsChild)
 252     {
 253         /* Make sure we have the privilege to assign a new one */
 254         if (!SeSinglePrivilegeCheck(SeAssignPrimaryTokenPrivilege,
 255                                     PreviousMode))
 256         {
 257             /* Failed, dereference */
 258             if (TokenHandle) ObDereferenceObject(NewToken);
 259             return STATUS_PRIVILEGE_NOT_HELD;
 260         }
 261     }
 262
 263     /* Assign the token */
 264     Status = PspAssignPrimaryToken(Process, NULL, NewToken);
 265     if (NT_SUCCESS(Status))
 266     {
 267         /*
 268          * We need to completely reverify if the process still has access to
 269          * itself under this new token.
 270          */
 271         Status = ObGetObjectSecurity(Process,
 272                                      &SecurityDescriptor,
 273                                      &SdAllocated);
 274         if (NT_SUCCESS(Status))
 275         {
 276             /* Setup the security context */
 277             SubjectContext.ProcessAuditId = Process;
 278             SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process);
 279             SubjectContext.ClientToken = NULL;
 280
 281             /* Do the access check */
 282             Result = SeAccessCheck(SecurityDescriptor,
 283                                    &SubjectContext,
 284                                    FALSE,
 285                                    MAXIMUM_ALLOWED,
 286                                    0,
 287                                    NULL,
 288                                    &PsProcessType->TypeInfo.GenericMapping,
 289                                    PreviousMode,
 290                                    &Process->GrantedAccess,
 291                                    &AccessStatus);
 292
 293             /* Dereference the token and let go the SD */
 294             ObFastDereferenceObject(&Process->Token,
 295                                     SubjectContext.PrimaryToken);
 296             ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
 297
 298             /* Remove access if it failed */
 299             if (!Result) Process->GrantedAccess = 0;
 300
 301             /* Setup granted access */
 302             Process->GrantedAccess |= (PROCESS_VM_OPERATION |
 303                                        PROCESS_VM_READ |
 304                                        PROCESS_VM_WRITE |
 305                                        PROCESS_QUERY_INFORMATION |
 306                                        PROCESS_TERMINATE |
 307                                        PROCESS_CREATE_THREAD |
 308                                        PROCESS_DUP_HANDLE |
 309                                        PROCESS_CREATE_PROCESS |
 310                                        PROCESS_SET_INFORMATION |
 311                                        STANDARD_RIGHTS_ALL |
 312                                        PROCESS_SET_QUOTA);
 313         }
 314     }
 315
 316     /* Dereference the token */
 317     if (TokenHandle) ObDereferenceObject(NewToken);
 318     return Status;
 319 }
 320
 321 /* FUNCTIONS *****************************************************************/
 322
 323 /*
 324  * @implemented
 325  */
 326 NTSTATUS
 327 NTAPI
 328 NtOpenProcessToken(IN HANDLE ProcessHandle,
 329                    IN ACCESS_MASK DesiredAccess,
 330                    OUT PHANDLE TokenHandle)
 331 {
 332     /* Call the newer API */
 333     return NtOpenProcessTokenEx(ProcessHandle,
 334                                 DesiredAccess,
 335                                 0,
 336                                 TokenHandle);
 337 }
 338
 339 /*
 340  * @implemented
 341  */
 342 NTSTATUS
 343 NTAPI
 344 NtOpenProcessTokenEx(IN HANDLE ProcessHandle,
 345                      IN ACCESS_MASK DesiredAccess,
 346                      IN ULONG HandleAttributes,
 347                      OUT PHANDLE TokenHandle)
 348 {
 349     PACCESS_TOKEN Token;
 350     HANDLE hToken;
 351     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 352     NTSTATUS Status;
 353     PAGED_CODE();
 354     PSTRACE(PS_SECURITY_DEBUG,
 355             "Process: %p DesiredAccess: %lx\n", ProcessHandle, DesiredAccess);
 356
 357     /* Check if caller was user-mode */
 358     if (PreviousMode != KernelMode)
 359     {
 360         /* Enter SEH for probing */
 361         _SEH2_TRY
 362         {
 363             /* Probe the token handle */
 364             ProbeForWriteHandle(TokenHandle);
 365         }
 366         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 367         {
 368             /* Return the exception code */
 369             _SEH2_YIELD(return _SEH2_GetExceptionCode());
 370         }
 371         _SEH2_END;
 372     }
 373
 374     /* Validate object attributes */
 375     HandleAttributes = ObpValidateAttributes(HandleAttributes, PreviousMode);
 376
 377     /* Open the process token */
 378     Status = PsOpenTokenOfProcess(ProcessHandle, &Token);
 379     if (NT_SUCCESS(Status))
 380     {
 381         /* Reference it by handle and dereference the pointer */
 382         Status = ObOpenObjectByPointer(Token,
 383                                        HandleAttributes,
 384                                        NULL,
 385                                        DesiredAccess,
 386                                        SeTokenObjectType,
 387                                        PreviousMode,
 388                                        &hToken);
 389         ObDereferenceObject(Token);
 390
 391         /* Make sure we got a handle */
 392         if (NT_SUCCESS(Status))
 393         {
 394             /* Enter SEH for write */
 395             _SEH2_TRY
 396             {
 397                 /* Return the handle */
 398                 *TokenHandle = hToken;
 399             }
 400             _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 401             {
 402                 /* Get exception code */
 403                 Status = _SEH2_GetExceptionCode();
 404             }
 405             _SEH2_END;
 406         }
 407     }
 408
 409     /* Return status */
 410     return Status;
 411 }
 412
 413 /*
 414  * @implemented
 415  */
 416 PACCESS_TOKEN
 417 NTAPI
 418 PsReferencePrimaryToken(PEPROCESS Process)
 419 {
 420     PACCESS_TOKEN Token;
 421     PAGED_CODE();
 422     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
 423
 424     /* Fast Reference the Token */
 425     Token = ObFastReferenceObject(&Process->Token);
 426
 427     /* Check if we got the Token or if we got locked */
 428     if (!Token)
 429     {
 430         /* Lock the Process */
 431         PspLockProcessSecurityShared(Process);
 432
 433         /* Do a Locked Fast Reference */
 434         Token = ObFastReferenceObjectLocked(&Process->Token);
 435
 436         /* Unlock the Process */
 437         PspUnlockProcessSecurityShared(Process);
 438     }
 439
 440     /* Return the Token */
 441     return Token;
 442 }
 443
 444 /*
 445  * @implemented
 446  */
 447 NTSTATUS
 448 NTAPI
 449 PsOpenTokenOfProcess(IN HANDLE ProcessHandle,
 450                      OUT PACCESS_TOKEN* Token)
 451 {
 452     PEPROCESS Process;
 453     NTSTATUS Status;
 454     PAGED_CODE();
 455     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", ProcessHandle);
 456
 457     /* Get the Token */
 458     Status = ObReferenceObjectByHandle(ProcessHandle,
 459                                        PROCESS_QUERY_INFORMATION,
 460                                        PsProcessType,
 461                                        ExGetPreviousMode(),
 462                                        (PVOID*)&Process,
 463                                        NULL);
 464     if (NT_SUCCESS(Status))
 465     {
 466         /* Reference the token and dereference the process */
 467         *Token = PsReferencePrimaryToken(Process);
 468         ObDereferenceObject(Process);
 469     }
 470
 471     /* Return */
 472     return Status;
 473 }
 474
 475 /*
 476  * @implemented
 477  */
 478 NTSTATUS
 479 NTAPI
 480 PsAssignImpersonationToken(IN PETHREAD Thread,
 481                            IN HANDLE TokenHandle)
 482 {
 483     PACCESS_TOKEN Token;
 484     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
 485     NTSTATUS Status;
 486     PAGED_CODE();
 487     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p Token: %p\n", Thread, TokenHandle);
 488
 489     /* Check if we were given a handle */
 490     if (!TokenHandle)
 491     {
 492         /* Undo impersonation */
 493         PsRevertThreadToSelf(Thread);
 494         return STATUS_SUCCESS;
 495     }
 496
 497     /* Get the token object */
 498     Status = ObReferenceObjectByHandle(TokenHandle,
 499                                        TOKEN_IMPERSONATE,
 500                                        SeTokenObjectType,
 501                                        KeGetPreviousMode(),
 502                                        (PVOID*)&Token,
 503                                        NULL);
 504     if (!NT_SUCCESS(Status)) return(Status);
 505
 506     /* Make sure it's an impersonation token */
 507     if (SeTokenType(Token) != TokenImpersonation)
 508     {
 509         /* Fail */
 510         ObDereferenceObject(Token);
 511         return STATUS_BAD_TOKEN_TYPE;
 512     }
 513
 514     /* Get the impersonation level */
 515     ImpersonationLevel = SeTokenImpersonationLevel(Token);
 516
 517     /* Call the impersonation API */
 518     Status = PsImpersonateClient(Thread,
 519                                  Token,
 520                                  FALSE,
 521                                  FALSE,
 522                                  ImpersonationLevel);
 523
 524     /* Dereference the token and return status */
 525     ObDereferenceObject(Token);
 526     return Status;
 527 }
 528
 529 /*
 530  * @implemented
 531  */
 532 VOID
 533 NTAPI
 534 PsRevertToSelf(VOID)
 535 {
 536     /* Call the per-thread API */
 537     PAGED_CODE();
 538     PsRevertThreadToSelf(PsGetCurrentThread());
 539 }
 540
 541 /*
 542  * @implemented
 543  */
 544 VOID
 545 NTAPI
 546 PsRevertThreadToSelf(IN PETHREAD Thread)
 547 {
 548     PTOKEN Token = NULL;
 549     PAGED_CODE();
 550     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
 551
 552     /* Make sure we had impersonation information */
 553     if (Thread->ActiveImpersonationInfo)
 554     {
 555         /* Lock the thread security */
 556         PspLockThreadSecurityExclusive(Thread);
 557
 558         /* Make sure it's still active */
 559         if (Thread->ActiveImpersonationInfo)
 560         {
 561             /* Disable impersonation */
 562             PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 563
 564             /* Get the token */
 565             Token = Thread->ImpersonationInfo->Token;
 566         }
 567
 568         /* Release thread security */
 569         PspUnlockThreadSecurityExclusive(Thread);
 570
 571         /* Check if we had a token */
 572         if (Token)
 573         {
 574             /* Dereference the impersonation token */
 575             ObDereferenceObject(Token);
 576
 577             /* Write impersonation info to the TEB */
 578             PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
 579         }
 580     }
 581 }
 582
 583 /*
 584  * @implemented
 585  */
 586 NTSTATUS
 587 NTAPI
 588 PsImpersonateClient(IN PETHREAD Thread,
 589                     IN PACCESS_TOKEN Token,
 590                     IN BOOLEAN CopyOnOpen,
 591                     IN BOOLEAN EffectiveOnly,
 592                     IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
 593 {
 594     PPS_IMPERSONATION_INFORMATION Impersonation, OldData;
 595     PTOKEN OldToken = NULL;
 596     PAGED_CODE();
 597     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p, Token: %p\n", Thread, Token);
 598
 599     /* Check if we don't have a token */
 600     if (!Token)
 601     {
 602         /* Make sure we're impersonating */
 603         if (Thread->ActiveImpersonationInfo)
 604         {
 605             /* We seem to be, lock the thread */
 606             PspLockThreadSecurityExclusive(Thread);
 607
 608             /* Make sure we're still impersonating */
 609             if (Thread->ActiveImpersonationInfo)
 610             {
 611                 /* Disable impersonation */
 612                 PspClearCrossThreadFlag(Thread,
 613                                         CT_ACTIVE_IMPERSONATION_INFO_BIT);
 614
 615                 /* Get the token */
 616                 OldToken = Thread->ImpersonationInfo->Token;
 617             }
 618
 619             /* Unlock the process and write TEB information */
 620             PspUnlockThreadSecurityExclusive(Thread);
 621             PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
 622         }
 623     }
 624     else
 625     {
 626         /* Check if we have impersonation info */
 627         Impersonation = Thread->ImpersonationInfo;
 628         if (!Impersonation)
 629         {
 630             /* We need to allocate a new one */
 631             Impersonation = ExAllocatePoolWithTag(PagedPool,
 632                                                   sizeof(*Impersonation),
 633                                                   TAG_PS_IMPERSONATION);
 634             if (!Impersonation) return STATUS_INSUFFICIENT_RESOURCES;
 635
 636             /* Update the pointer */
 637             OldData = InterlockedCompareExchangePointer((PVOID*)&Thread->
 638                                                         ImpersonationInfo,
 639                                                         Impersonation,
 640                                                         NULL);
 641             if (OldData)
 642             {
 643                 /* Someone beat us to it, free our copy */
 644                 ExFreePoolWithTag(Impersonation, TAG_PS_IMPERSONATION);
 645                 Impersonation = OldData;
 646             }
 647         }
 648
 649         /* Check if this is a job, which we don't support yet */
 650         if (Thread->ThreadsProcess->Job) ASSERT(FALSE);
 651
 652         /* Lock thread security */
 653         PspLockThreadSecurityExclusive(Thread);
 654
 655         /* Check if we're impersonating */
 656         if (Thread->ActiveImpersonationInfo)
 657         {
 658             /* Get the token */
 659             OldToken = Impersonation->Token;
 660         }
 661         else
 662         {
 663             /* Otherwise, enable impersonation */
 664             PspSetCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 665         }
 666
 667         /* Now fill it out */
 668         Impersonation->ImpersonationLevel = ImpersonationLevel;
 669         Impersonation->CopyOnOpen = CopyOnOpen;
 670         Impersonation->EffectiveOnly = EffectiveOnly;
 671         Impersonation->Token = Token;
 672         ObReferenceObject(Token);
 673
 674         /* Unlock the thread */
 675         PspUnlockThreadSecurityExclusive(Thread);
 676
 677         /* Write impersonation info to the TEB */
 678         PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
 679     }
 680
 681     /* Dereference the token and return success */
 682     if (OldToken) PsDereferenceImpersonationToken(OldToken);
 683     return STATUS_SUCCESS;
 684 }
 685
 686 /*
 687  * @implemented
 688  */
 689 PACCESS_TOKEN
 690 NTAPI
 691 PsReferenceEffectiveToken(IN PETHREAD Thread,
 692                           OUT IN PTOKEN_TYPE TokenType,
 693                           OUT PBOOLEAN EffectiveOnly,
 694                           OUT PSECURITY_IMPERSONATION_LEVEL Level)
 695 {
 696     PEPROCESS Process;
 697     PACCESS_TOKEN Token = NULL;
 698     PAGED_CODE();
 699     PSTRACE(PS_SECURITY_DEBUG,
 700             "Thread: %p, TokenType: %p\n", Thread, TokenType);
 701
 702     /* Check if we don't have impersonation info */
 703     Process = Thread->ThreadsProcess;
 704     if (Thread->ActiveImpersonationInfo)
 705     {
 706         /* Lock the Process */
 707         PspLockProcessSecurityShared(Process);
 708
 709         /* Make sure impersonation is still active */
 710         if (Thread->ActiveImpersonationInfo)
 711         {
 712             /* Get the token */
 713             Token = Thread->ImpersonationInfo->Token;
 714             ObReferenceObject(Token);
 715
 716             /* Return data to caller */
 717             *TokenType = TokenImpersonation;
 718             *EffectiveOnly = Thread->ImpersonationInfo->EffectiveOnly;
 719             *Level = Thread->ImpersonationInfo->ImpersonationLevel;
 720
 721             /* Unlock the Process */
 722             PspUnlockProcessSecurityShared(Process);
 723             return Token;
 724         }
 725
 726         /* Unlock the Process */
 727         PspUnlockProcessSecurityShared(Process);
 728     }
 729
 730     /* Fast Reference the Token */
 731     Token = ObFastReferenceObject(&Process->Token);
 732
 733     /* Check if we got the Token or if we got locked */
 734     if (!Token)
 735     {
 736         /* Lock the Process */
 737         PspLockProcessSecurityShared(Process);
 738
 739         /* Do a Locked Fast Reference */
 740         Token = ObFastReferenceObjectLocked(&Process->Token);
 741
 742         /* Unlock the Process */
 743         PspUnlockProcessSecurityShared(Process);
 744     }
 745
 746     /* Return the token */
 747     *TokenType = TokenPrimary;
 748     *EffectiveOnly = FALSE;
 749     return Token;
 750 }
 751
 752 /*
 753  * @implemented
 754  */
 755 PACCESS_TOKEN
 756 NTAPI
 757 PsReferenceImpersonationToken(IN PETHREAD Thread,
 758                               OUT PBOOLEAN CopyOnOpen,
 759                               OUT PBOOLEAN EffectiveOnly,
 760                               OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
 761 {
 762     PTOKEN Token = NULL;
 763     PAGED_CODE();
 764     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
 765
 766     /* If we don't have impersonation info, just quit */
 767     if (!Thread->ActiveImpersonationInfo) return NULL;
 768
 769     /* Lock the thread */
 770     PspLockThreadSecurityShared(Thread);
 771
 772     /* Make sure we still have active impersonation */
 773     if (Thread->ActiveImpersonationInfo)
 774     {
 775         /* Return data from caller */
 776         ObReferenceObject(Thread->ImpersonationInfo->Token);
 777         *ImpersonationLevel = Thread->ImpersonationInfo->ImpersonationLevel;
 778         *CopyOnOpen = Thread->ImpersonationInfo->CopyOnOpen;
 779         *EffectiveOnly = Thread->ImpersonationInfo->EffectiveOnly;
 780
 781         /* Set the token */
 782         Token = Thread->ImpersonationInfo->Token;
 783     }
 784
 785     /* Unlock thread and return impersonation token */
 786     PspUnlockThreadSecurityShared(Thread);
 787     return Token;
 788 }
 789
 790 #undef PsDereferenceImpersonationToken
 791 /*
 792  * @implemented
 793  */
 794 VOID
 795 NTAPI
 796 PsDereferenceImpersonationToken(IN PACCESS_TOKEN ImpersonationToken)
 797 {
 798     PAGED_CODE();
 799
 800     /* If we got a token, dereference it */
 801     if (ImpersonationToken) ObDereferenceObject(ImpersonationToken);
 802 }
 803
 804 #undef PsDereferencePrimaryToken
 805 /*
 806  * @implemented
 807  */
 808 VOID
 809 NTAPI
 810 PsDereferencePrimaryToken(IN PACCESS_TOKEN PrimaryToken)
 811 {
 812     PAGED_CODE();
 813
 814     /* Dereference the token*/
 815     ObDereferenceObject(PrimaryToken);
 816 }
 817
 818 /*
 819  * @implemented
 820  */
 821 BOOLEAN
 822 NTAPI
 823 PsDisableImpersonation(IN PETHREAD Thread,
 824                        OUT PSE_IMPERSONATION_STATE ImpersonationState)
 825 {
 826     PPS_IMPERSONATION_INFORMATION Impersonation = NULL;
 827     LONG OldFlags;
 828     PAGED_CODE();
 829     PSTRACE(PS_SECURITY_DEBUG,
 830             "Thread: %p State: %p\n", Thread, ImpersonationState);
 831
 832     /* Check if we don't have impersonation */
 833     if (Thread->ActiveImpersonationInfo)
 834     {
 835         /* Lock thread security */
 836         PspLockThreadSecurityExclusive(Thread);
 837
 838         /* Disable impersonation */
 839         OldFlags = PspClearCrossThreadFlag(Thread,
 840                                            CT_ACTIVE_IMPERSONATION_INFO_BIT);
 841
 842         /* Make sure nobody disabled it behind our back */
 843         if (OldFlags & CT_ACTIVE_IMPERSONATION_INFO_BIT)
 844         {
 845             /* Copy the old state */
 846             Impersonation = Thread->ImpersonationInfo;
 847             ImpersonationState->Token = Impersonation->Token;
 848             ImpersonationState->CopyOnOpen = Impersonation->CopyOnOpen;
 849             ImpersonationState->EffectiveOnly = Impersonation->EffectiveOnly;
 850             ImpersonationState->Level = Impersonation->ImpersonationLevel;
 851         }
 852
 853         /* Unlock thread security */
 854         PspUnlockThreadSecurityExclusive(Thread);
 855
 856         /* If we had impersonation info, return true */
 857         if (Impersonation) return TRUE;
 858     }
 859
 860     /* Clear everything */
 861     ImpersonationState->Token = NULL;
 862     ImpersonationState->CopyOnOpen = FALSE;
 863     ImpersonationState->EffectiveOnly = FALSE;
 864     ImpersonationState->Level = SecurityAnonymous;
 865     return FALSE;
 866 }
 867
 868 /*
 869  * @implemented
 870  */
 871 VOID
 872 NTAPI
 873 PsRestoreImpersonation(IN PETHREAD Thread,
 874                        IN PSE_IMPERSONATION_STATE ImpersonationState)
 875 {
 876     PTOKEN Token = NULL;
 877     PPS_IMPERSONATION_INFORMATION Impersonation;
 878     PAGED_CODE();
 879     PSTRACE(PS_SECURITY_DEBUG,
 880             "Thread: %p State: %p\n", Thread, ImpersonationState);
 881
 882     /* Lock thread security */
 883     PspLockThreadSecurityExclusive(Thread);
 884
 885     /* Get the impersonation info */
 886     Impersonation = Thread->ImpersonationInfo;
 887
 888     /* Check if we're impersonating */
 889     if (Thread->ActiveImpersonationInfo)
 890     {
 891         /* Get the token */
 892         Token = Impersonation->Token;
 893     }
 894
 895     /* Check if we have an impersonation state */
 896     if (ImpersonationState)
 897     {
 898         /* Fill out the impersonation info */
 899         Impersonation->ImpersonationLevel = ImpersonationState->Level;
 900         Impersonation->CopyOnOpen = ImpersonationState->CopyOnOpen;
 901         Impersonation->EffectiveOnly = ImpersonationState->EffectiveOnly;
 902         Impersonation->Token = ImpersonationState->Token;
 903
 904         /* Enable impersonation */
 905         PspSetCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 906     }
 907     else
 908     {
 909         /* Disable impersonation */
 910         PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 911     }
 912
 913     /* Unlock the thread */
 914     PspUnlockThreadSecurityExclusive(Thread);
 915
 916     /* Dereference the token */
 917     if (Token) ObDereferenceObject(Token);
 918 }
 919
 920 NTSTATUS
 921 NTAPI
 922 NtImpersonateThread(IN HANDLE ThreadHandle,
 923                     IN HANDLE ThreadToImpersonateHandle,
 924                     IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService)
 925 {
 926     SECURITY_QUALITY_OF_SERVICE SafeServiceQoS;
 927     SECURITY_CLIENT_CONTEXT ClientContext;
 928     PETHREAD Thread;
 929     PETHREAD ThreadToImpersonate;
 930     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 931     NTSTATUS Status;
 932     PAGED_CODE();
 933     PSTRACE(PS_SECURITY_DEBUG,
 934             "Threads: %p %p\n", ThreadHandle, ThreadToImpersonateHandle);
 935
 936     /* Check if call came from user mode */
 937     if (PreviousMode != KernelMode)
 938     {
 939         /* Enter SEH for probing */
 940         _SEH2_TRY
 941         {
 942             /* Probe QoS */
 943             ProbeForRead(SecurityQualityOfService,
 944                          sizeof(SECURITY_QUALITY_OF_SERVICE),
 945                          sizeof(ULONG));
 946
 947             /* Capture it */
 948             SafeServiceQoS = *SecurityQualityOfService;
 949             SecurityQualityOfService = &SafeServiceQoS;
 950         }
 951         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 952         {
 953             /* Return the exception code */
 954             _SEH2_YIELD(return _SEH2_GetExceptionCode());
 955         }
 956         _SEH2_END;
 957     }
 958
 959     /* Reference the thread */
 960     Status = ObReferenceObjectByHandle(ThreadHandle,
 961                                        THREAD_DIRECT_IMPERSONATION,
 962                                        PsThreadType,
 963                                        PreviousMode,
 964                                        (PVOID*)&Thread,
 965                                        NULL);
 966     if (NT_SUCCESS(Status))
 967     {
 968         /* Reference the impersonating thead */
 969         Status = ObReferenceObjectByHandle(ThreadToImpersonateHandle,
 970                                            THREAD_IMPERSONATE,
 971                                            PsThreadType,
 972                                            PreviousMode,
 973                                            (PVOID*)&ThreadToImpersonate,
 974                                            NULL);
 975         if (NT_SUCCESS(Status))
 976         {
 977             /* Create a client security context */
 978             Status = SeCreateClientSecurity(ThreadToImpersonate,
 979                                             SecurityQualityOfService,
 980                                             0,
 981                                             &ClientContext);
 982             if (NT_SUCCESS(Status))
 983             {
 984                 /* Do the impersonation */
 985                 SeImpersonateClient(&ClientContext, Thread);
 986                 if (ClientContext.ClientToken)
 987                 {
 988                     /* Dereference the client token if we had one */
 989                     ObDereferenceObject(ClientContext.ClientToken);
 990                 }
 991             }
 992
 993             /* Dereference the thread to impersonate */
 994             ObDereferenceObject(ThreadToImpersonate);
 995         }
 996
 997         /* Dereference the main thread */
 998         ObDereferenceObject(Thread);
 999     }
1000
1001     /* Return status */
1002     return Status;
1003 }
1004 /* EOF */