[FREELDR] Implement 'SeekRelative' mode for the *Seek() methods for disks & filesystems.
[reactos.git] / ntoskrnl / ps / security.c
1 /*
2 * PROJECT: ReactOS Kernel
3 * LICENSE: GPL - See COPYING in the top level directory
4 * FILE: ntoskrnl/ps/security.c
5 * PURPOSE: Process Manager: Process/Thread Security
6 * PROGRAMMERS: Alex Ionescu (alex.ionescu@reactos.org)
7 * Eric Kohl
8 * Thomas Weidenmueller (w3seek@reactos.org)
9 */
10
11 /* INCLUDES ******************************************************************/
12
13 #include <ntoskrnl.h>
14 #define NDEBUG
15 #include <debug.h>
16
17 PTOKEN PspBootAccessToken;
18
19 VOID
20 NTAPI
21 SeAssignPrimaryToken(
22 IN PEPROCESS Process,
23 IN PTOKEN Token
24 );
25
26 /* PRIVATE FUNCTIONS *********************************************************/
27
28 VOID
29 NTAPI
30 PspDeleteProcessSecurity(IN PEPROCESS Process)
31 {
32 PAGED_CODE();
33 PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
34
35 /* Check if we have a token */
36 if (Process->Token.Object)
37 {
38 /* Deassign it */
39 SeDeassignPrimaryToken(Process);
40 Process->Token.Object = NULL;
41 }
42 }
43
44 VOID
45 NTAPI
46 PspDeleteThreadSecurity(IN PETHREAD Thread)
47 {
48 PPS_IMPERSONATION_INFORMATION ImpersonationInfo = Thread->ImpersonationInfo;
49 PAGED_CODE();
50 PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
51
52 /* Check if we have active impersonation info */
53 if (Thread->ActiveImpersonationInfo)
54 {
55 /* Dereference its token */
56 ObDereferenceObject(ImpersonationInfo->Token);
57 }
58
59 /* Check if we have impersonation info */
60 if (ImpersonationInfo)
61 {
62 /* Free it */
63 ExFreePool(ImpersonationInfo);
64 PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
65 Thread->ImpersonationInfo = NULL;
66 }
67 }
68
69 NTSTATUS
70 NTAPI
71 PspInitializeProcessSecurity(IN PEPROCESS Process,
72 IN PEPROCESS Parent OPTIONAL)
73 {
74 NTSTATUS Status = STATUS_SUCCESS;
75 PTOKEN NewToken, ParentToken;
76 PAGED_CODE();
77 PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
78
79 /* If we have a parent, then duplicate the Token */
80 if (Parent)
81 {
82 /* Get the Parent Token */
83 ParentToken = PsReferencePrimaryToken(Parent);
84
85 /* Duplicate it */
86 Status = SeSubProcessToken(ParentToken,
87 &NewToken,
88 TRUE,
89 MmGetSessionId(Process));
90
91 /* Dereference the Parent */
92 ObFastDereferenceObject(&Parent->Token, ParentToken);
93
94 /* Set the new Token */
95 if (NT_SUCCESS(Status))
96 {
97 /* Initailize the fast reference */
98 ObInitializeFastReference(&Process->Token, NewToken);
99 }
100 }
101 else
102 {
103 /* No parent, assign the Boot Token */
104 ObInitializeFastReference(&Process->Token, NULL);
105 SeAssignPrimaryToken(Process, PspBootAccessToken);
106 }
107
108 /* Return to caller */
109 return Status;
110 }
111
112 NTSTATUS
113 NTAPI
114 PspWriteTebImpersonationInfo(IN PETHREAD Thread,
115 IN PETHREAD CurrentThread)
116 {
117 PEPROCESS Process;
118 PTEB Teb;
119 BOOLEAN Attached = FALSE;
120 BOOLEAN IsImpersonating;
121 KAPC_STATE ApcState;
122 PAGED_CODE();
123 PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
124
125 /* Sanity check */
126 ASSERT(CurrentThread == PsGetCurrentThread());
127
128 /* Get process and TEB */
129 Process = Thread->ThreadsProcess;
130 Teb = Thread->Tcb.Teb;
131 if (Teb)
132 {
133 /* Check if we're not in the right process */
134 if (Thread->Tcb.ApcState.Process != &Process->Pcb)
135 {
136 /* Attach to the process */
137 KeStackAttachProcess(&Process->Pcb, &ApcState);
138 Attached = TRUE;
139 }
140
141 /* Check if we're in a different thread or acquire rundown */
142 if ((Thread == CurrentThread) ||
143 (ExAcquireRundownProtection(&Thread->RundownProtect)))
144 {
145 /* Check if the thread is impersonating */
146 IsImpersonating = (BOOLEAN)Thread->ActiveImpersonationInfo;
147 if (IsImpersonating)
148 {
149 /* Set TEB data */
150 Teb->ImpersonationLocale = -1;
151 Teb->IsImpersonating = 1;
152 }
153 else
154 {
155 /* Set TEB data */
156 Teb->ImpersonationLocale = 0;
157 Teb->IsImpersonating = 0;
158 }
159 }
160
161 /* Check if we're in a different thread */
162 if (Thread != CurrentThread)
163 {
164 /* Release protection */
165 ExReleaseRundownProtection(&Thread->RundownProtect);
166 }
167
168 /* Detach */
169 if (Attached) KeUnstackDetachProcess(&ApcState);
170 }
171
172 /* Return to caller */
173 return STATUS_SUCCESS;
174 }
175
176 NTSTATUS
177 NTAPI
178 PspAssignPrimaryToken(IN PEPROCESS Process,
179 IN HANDLE Token,
180 IN PACCESS_TOKEN AccessToken OPTIONAL)
181 {
182 PACCESS_TOKEN NewToken = AccessToken, OldToken;
183 NTSTATUS Status;
184 PAGED_CODE();
185 PSTRACE(PS_SECURITY_DEBUG, "Process: %p Token: %p\n", Process, Token);
186
187 /* Check if we don't have a pointer */
188 if (!AccessToken)
189 {
190 /* Reference it from the handle */
191 Status = ObReferenceObjectByHandle(Token,
192 TOKEN_ASSIGN_PRIMARY,
193 SeTokenObjectType,
194 ExGetPreviousMode(),
195 &NewToken,
196 NULL);
197 if (!NT_SUCCESS(Status)) return Status;
198 }
199
200 /* Exchange tokens */
201 Status = SeExchangePrimaryToken(Process, NewToken, &OldToken);
202
203 /* Acquire and release the lock */
204 PspLockProcessSecurityExclusive(Process);
205 PspUnlockProcessSecurityExclusive(Process);
206
207 /* Dereference Tokens and Return */
208 if (NT_SUCCESS(Status)) ObDereferenceObject(OldToken);
209 if (!AccessToken) ObDereferenceObject(NewToken);
210 return Status;
211 }
212
213 NTSTATUS
214 NTAPI
215 PspSetPrimaryToken(IN PEPROCESS Process,
216 IN HANDLE TokenHandle OPTIONAL,
217 IN PACCESS_TOKEN Token OPTIONAL)
218 {
219 KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
220 BOOLEAN IsChildOrSibling;
221 PACCESS_TOKEN NewToken = Token;
222 NTSTATUS Status, AccessStatus;
223 BOOLEAN Result, SdAllocated;
224 PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
225 SECURITY_SUBJECT_CONTEXT SubjectContext;
226
227 PSTRACE(PS_SECURITY_DEBUG, "Process: %p Token: %p\n", Process, Token);
228
229 /* Reference the token by handle if we don't already have a token object */
230 if (!Token)
231 {
232 Status = ObReferenceObjectByHandle(TokenHandle,
233 TOKEN_ASSIGN_PRIMARY,
234 SeTokenObjectType,
235 PreviousMode,
236 (PVOID*)&NewToken,
237 NULL);
238 if (!NT_SUCCESS(Status)) return Status;
239 }
240
241 /*
242 * Check whether this token is a child or sibling of the current process token.
243 * NOTE: On Windows Vista+ both of these checks (together with extra steps)
244 * are now performed by a new SeIsTokenAssignableToProcess() helper.
245 */
246 Status = SeIsTokenChild(NewToken, &IsChildOrSibling);
247 if (!NT_SUCCESS(Status))
248 {
249 /* Failed, dereference */
250 if (!Token) ObDereferenceObject(NewToken);
251 return Status;
252 }
253 if (!IsChildOrSibling)
254 {
255 Status = SeIsTokenSibling(NewToken, &IsChildOrSibling);
256 if (!NT_SUCCESS(Status))
257 {
258 /* Failed, dereference */
259 if (!Token) ObDereferenceObject(NewToken);
260 return Status;
261 }
262 }
263
264 /* Check if this was an independent token */
265 if (!IsChildOrSibling)
266 {
267 /* Make sure we have the privilege to assign a new one */
268 if (!SeSinglePrivilegeCheck(SeAssignPrimaryTokenPrivilege,
269 PreviousMode))
270 {
271 /* Failed, dereference */
272 if (!Token) ObDereferenceObject(NewToken);
273 return STATUS_PRIVILEGE_NOT_HELD;
274 }
275 }
276
277 /* Assign the token */
278 Status = PspAssignPrimaryToken(Process, NULL, NewToken);
279 if (NT_SUCCESS(Status))
280 {
281 /*
282 * We need to completely reverify if the process still has access to
283 * itself under this new token.
284 */
285 Status = ObGetObjectSecurity(Process,
286 &SecurityDescriptor,
287 &SdAllocated);
288 if (NT_SUCCESS(Status))
289 {
290 /* Setup the security context */
291 SubjectContext.ProcessAuditId = Process;
292 SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process);
293 SubjectContext.ClientToken = NULL;
294
295 /* Do the access check */
296 Result = SeAccessCheck(SecurityDescriptor,
297 &SubjectContext,
298 FALSE,
299 MAXIMUM_ALLOWED,
300 0,
301 NULL,
302 &PsProcessType->TypeInfo.GenericMapping,
303 PreviousMode,
304 &Process->GrantedAccess,
305 &AccessStatus);
306
307 /* Dereference the token and let go the SD */
308 ObFastDereferenceObject(&Process->Token,
309 SubjectContext.PrimaryToken);
310 ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
311
312 /* Remove access if it failed */
313 if (!Result) Process->GrantedAccess = 0;
314
315 /* Setup granted access */
316 Process->GrantedAccess |= (PROCESS_VM_OPERATION |
317 PROCESS_VM_READ |
318 PROCESS_VM_WRITE |
319 PROCESS_QUERY_INFORMATION |
320 PROCESS_TERMINATE |
321 PROCESS_CREATE_THREAD |
322 PROCESS_DUP_HANDLE |
323 PROCESS_CREATE_PROCESS |
324 PROCESS_SET_INFORMATION |
325 STANDARD_RIGHTS_ALL |
326 PROCESS_SET_QUOTA);
327 }
328
329 /*
330 * In case LUID device maps are enable, we may not be using
331 * system device map for this process, but a logon LUID based
332 * device map. Because we change primary token, this usage is
333 * no longer valid, so dereference the process device map
334 */
335 if (ObIsLUIDDeviceMapsEnabled()) ObDereferenceDeviceMap(Process);
336 }
337
338 /* Dereference the token */
339 if (!Token) ObDereferenceObject(NewToken);
340 return Status;
341 }
342
343 /* FUNCTIONS *****************************************************************/
344
345 /*
346 * @implemented
347 */
348 NTSTATUS
349 NTAPI
350 NtOpenProcessToken(IN HANDLE ProcessHandle,
351 IN ACCESS_MASK DesiredAccess,
352 OUT PHANDLE TokenHandle)
353 {
354 /* Call the newer API */
355 return NtOpenProcessTokenEx(ProcessHandle,
356 DesiredAccess,
357 0,
358 TokenHandle);
359 }
360
361 /*
362 * @implemented
363 */
364 NTSTATUS
365 NTAPI
366 NtOpenProcessTokenEx(IN HANDLE ProcessHandle,
367 IN ACCESS_MASK DesiredAccess,
368 IN ULONG HandleAttributes,
369 OUT PHANDLE TokenHandle)
370 {
371 PACCESS_TOKEN Token;
372 HANDLE hToken;
373 KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
374 NTSTATUS Status;
375 PAGED_CODE();
376 PSTRACE(PS_SECURITY_DEBUG,
377 "Process: %p DesiredAccess: %lx\n", ProcessHandle, DesiredAccess);
378
379 /* Check if caller was user-mode */
380 if (PreviousMode != KernelMode)
381 {
382 /* Enter SEH for probing */
383 _SEH2_TRY
384 {
385 /* Probe the token handle */
386 ProbeForWriteHandle(TokenHandle);
387 }
388 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
389 {
390 /* Return the exception code */
391 _SEH2_YIELD(return _SEH2_GetExceptionCode());
392 }
393 _SEH2_END;
394 }
395
396 /* Validate object attributes */
397 HandleAttributes = ObpValidateAttributes(HandleAttributes, PreviousMode);
398
399 /* Open the process token */
400 Status = PsOpenTokenOfProcess(ProcessHandle, &Token);
401 if (NT_SUCCESS(Status))
402 {
403 /* Reference it by handle and dereference the pointer */
404 Status = ObOpenObjectByPointer(Token,
405 HandleAttributes,
406 NULL,
407 DesiredAccess,
408 SeTokenObjectType,
409 PreviousMode,
410 &hToken);
411 ObDereferenceObject(Token);
412
413 /* Make sure we got a handle */
414 if (NT_SUCCESS(Status))
415 {
416 /* Enter SEH for write */
417 _SEH2_TRY
418 {
419 /* Return the handle */
420 *TokenHandle = hToken;
421 }
422 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
423 {
424 /* Get exception code */
425 Status = _SEH2_GetExceptionCode();
426 }
427 _SEH2_END;
428 }
429 }
430
431 /* Return status */
432 return Status;
433 }
434
435 /*
436 * @implemented
437 */
438 PACCESS_TOKEN
439 NTAPI
440 PsReferencePrimaryToken(PEPROCESS Process)
441 {
442 PACCESS_TOKEN Token;
443 PAGED_CODE();
444 PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
445
446 /* Fast Reference the Token */
447 Token = ObFastReferenceObject(&Process->Token);
448
449 /* Check if we got the Token or if we got locked */
450 if (!Token)
451 {
452 /* Lock the Process */
453 PspLockProcessSecurityShared(Process);
454
455 /* Do a Locked Fast Reference */
456 Token = ObFastReferenceObjectLocked(&Process->Token);
457
458 /* Unlock the Process */
459 PspUnlockProcessSecurityShared(Process);
460 }
461
462 /* Return the Token */
463 return Token;
464 }
465
466 /*
467 * @implemented
468 */
469 NTSTATUS
470 NTAPI
471 PsOpenTokenOfProcess(IN HANDLE ProcessHandle,
472 OUT PACCESS_TOKEN* Token)
473 {
474 PEPROCESS Process;
475 NTSTATUS Status;
476 PAGED_CODE();
477 PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", ProcessHandle);
478
479 /* Get the Token */
480 Status = ObReferenceObjectByHandle(ProcessHandle,
481 PROCESS_QUERY_INFORMATION,
482 PsProcessType,
483 ExGetPreviousMode(),
484 (PVOID*)&Process,
485 NULL);
486 if (NT_SUCCESS(Status))
487 {
488 /* Reference the token and dereference the process */
489 *Token = PsReferencePrimaryToken(Process);
490 ObDereferenceObject(Process);
491 }
492
493 /* Return */
494 return Status;
495 }
496
497 /*
498 * @implemented
499 */
500 NTSTATUS
501 NTAPI
502 PsAssignImpersonationToken(IN PETHREAD Thread,
503 IN HANDLE TokenHandle)
504 {
505 PACCESS_TOKEN Token;
506 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
507 NTSTATUS Status;
508 PAGED_CODE();
509 PSTRACE(PS_SECURITY_DEBUG, "Thread: %p Token: %p\n", Thread, TokenHandle);
510
511 /* Check if we were given a handle */
512 if (!TokenHandle)
513 {
514 /* Undo impersonation */
515 PsRevertThreadToSelf(Thread);
516 return STATUS_SUCCESS;
517 }
518
519 /* Get the token object */
520 Status = ObReferenceObjectByHandle(TokenHandle,
521 TOKEN_IMPERSONATE,
522 SeTokenObjectType,
523 KeGetPreviousMode(),
524 (PVOID*)&Token,
525 NULL);
526 if (!NT_SUCCESS(Status)) return(Status);
527
528 /* Make sure it's an impersonation token */
529 if (SeTokenType(Token) != TokenImpersonation)
530 {
531 /* Fail */
532 ObDereferenceObject(Token);
533 return STATUS_BAD_TOKEN_TYPE;
534 }
535
536 /* Get the impersonation level */
537 ImpersonationLevel = SeTokenImpersonationLevel(Token);
538
539 /* Call the impersonation API */
540 Status = PsImpersonateClient(Thread,
541 Token,
542 FALSE,
543 FALSE,
544 ImpersonationLevel);
545
546 /* Dereference the token and return status */
547 ObDereferenceObject(Token);
548 return Status;
549 }
550
551 /*
552 * @implemented
553 */
554 VOID
555 NTAPI
556 PsRevertToSelf(VOID)
557 {
558 /* Call the per-thread API */
559 PAGED_CODE();
560 PsRevertThreadToSelf(PsGetCurrentThread());
561 }
562
563 /*
564 * @implemented
565 */
566 VOID
567 NTAPI
568 PsRevertThreadToSelf(IN PETHREAD Thread)
569 {
570 PTOKEN Token = NULL;
571 PAGED_CODE();
572 PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
573
574 /* Make sure we had impersonation information */
575 if (Thread->ActiveImpersonationInfo)
576 {
577 /* Lock the thread security */
578 PspLockThreadSecurityExclusive(Thread);
579
580 /* Make sure it's still active */
581 if (Thread->ActiveImpersonationInfo)
582 {
583 /* Disable impersonation */
584 PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
585
586 /* Get the token */
587 Token = Thread->ImpersonationInfo->Token;
588 }
589
590 /* Release thread security */
591 PspUnlockThreadSecurityExclusive(Thread);
592
593 /* Check if we had a token */
594 if (Token)
595 {
596 /* Dereference the impersonation token */
597 ObDereferenceObject(Token);
598
599 /* Write impersonation info to the TEB */
600 PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
601 }
602 }
603 }
604
605 /*
606 * @implemented
607 */
608 NTSTATUS
609 NTAPI
610 PsImpersonateClient(IN PETHREAD Thread,
611 IN PACCESS_TOKEN Token,
612 IN BOOLEAN CopyOnOpen,
613 IN BOOLEAN EffectiveOnly,
614 IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
615 {
616 PPS_IMPERSONATION_INFORMATION Impersonation, OldData;
617 PTOKEN OldToken = NULL;
618 PAGED_CODE();
619 PSTRACE(PS_SECURITY_DEBUG, "Thread: %p, Token: %p\n", Thread, Token);
620
621 /* Check if we don't have a token */
622 if (!Token)
623 {
624 /* Make sure we're impersonating */
625 if (Thread->ActiveImpersonationInfo)
626 {
627 /* We seem to be, lock the thread */
628 PspLockThreadSecurityExclusive(Thread);
629
630 /* Make sure we're still impersonating */
631 if (Thread->ActiveImpersonationInfo)
632 {
633 /* Disable impersonation */
634 PspClearCrossThreadFlag(Thread,
635 CT_ACTIVE_IMPERSONATION_INFO_BIT);
636
637 /* Get the token */
638 OldToken = Thread->ImpersonationInfo->Token;
639 }
640
641 /* Unlock the process and write TEB information */
642 PspUnlockThreadSecurityExclusive(Thread);
643 PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
644 }
645 }
646 else
647 {
648 /* Check if we have impersonation info */
649 Impersonation = Thread->ImpersonationInfo;
650 if (!Impersonation)
651 {
652 /* We need to allocate a new one */
653 Impersonation = ExAllocatePoolWithTag(PagedPool,
654 sizeof(*Impersonation),
655 TAG_PS_IMPERSONATION);
656 if (!Impersonation) return STATUS_INSUFFICIENT_RESOURCES;
657
658 /* Update the pointer */
659 OldData = InterlockedCompareExchangePointer((PVOID*)&Thread->
660 ImpersonationInfo,
661 Impersonation,
662 NULL);
663 if (OldData)
664 {
665 /* Someone beat us to it, free our copy */
666 ExFreePoolWithTag(Impersonation, TAG_PS_IMPERSONATION);
667 Impersonation = OldData;
668 }
669 }
670
671 /* Check if this is a job, which we don't support yet */
672 if (Thread->ThreadsProcess->Job) ASSERT(FALSE);
673
674 /* Lock thread security */
675 PspLockThreadSecurityExclusive(Thread);
676
677 /* Check if we're impersonating */
678 if (Thread->ActiveImpersonationInfo)
679 {
680 /* Get the token */
681 OldToken = Impersonation->Token;
682 }
683 else
684 {
685 /* Otherwise, enable impersonation */
686 PspSetCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
687 }
688
689 /* Now fill it out */
690 Impersonation->ImpersonationLevel = ImpersonationLevel;
691 Impersonation->CopyOnOpen = CopyOnOpen;
692 Impersonation->EffectiveOnly = EffectiveOnly;
693 Impersonation->Token = Token;
694 ObReferenceObject(Token);
695
696 /* Unlock the thread */
697 PspUnlockThreadSecurityExclusive(Thread);
698
699 /* Write impersonation info to the TEB */
700 PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
701 }
702
703 /* Dereference the token and return success */
704 if (OldToken) PsDereferenceImpersonationToken(OldToken);
705 return STATUS_SUCCESS;
706 }
707
708 /*
709 * @implemented
710 */
711 PACCESS_TOKEN
712 NTAPI
713 PsReferenceEffectiveToken(IN PETHREAD Thread,
714 OUT IN PTOKEN_TYPE TokenType,
715 OUT PBOOLEAN EffectiveOnly,
716 OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
717 {
718 PEPROCESS Process;
719 PACCESS_TOKEN Token = NULL;
720
721 PAGED_CODE();
722
723 PSTRACE(PS_SECURITY_DEBUG,
724 "Thread: %p, TokenType: %p\n", Thread, TokenType);
725
726 /* Check if we don't have impersonation info */
727 Process = Thread->ThreadsProcess;
728 if (Thread->ActiveImpersonationInfo)
729 {
730 /* Lock the Process */
731 PspLockProcessSecurityShared(Process);
732
733 /* Make sure impersonation is still active */
734 if (Thread->ActiveImpersonationInfo)
735 {
736 /* Get the token */
737 Token = Thread->ImpersonationInfo->Token;
738 ObReferenceObject(Token);
739
740 /* Return data to caller */
741 *TokenType = TokenImpersonation;
742 *EffectiveOnly = Thread->ImpersonationInfo->EffectiveOnly;
743 *ImpersonationLevel = Thread->ImpersonationInfo->ImpersonationLevel;
744
745 /* Unlock the Process */
746 PspUnlockProcessSecurityShared(Process);
747 return Token;
748 }
749
750 /* Unlock the Process */
751 PspUnlockProcessSecurityShared(Process);
752 }
753
754 /* Fast Reference the Token */
755 Token = ObFastReferenceObject(&Process->Token);
756
757 /* Check if we got the Token or if we got locked */
758 if (!Token)
759 {
760 /* Lock the Process */
761 PspLockProcessSecurityShared(Process);
762
763 /* Do a Locked Fast Reference */
764 Token = ObFastReferenceObjectLocked(&Process->Token);
765
766 /* Unlock the Process */
767 PspUnlockProcessSecurityShared(Process);
768 }
769
770 /* Return the token */
771 *TokenType = TokenPrimary;
772 *EffectiveOnly = FALSE;
773 // NOTE: ImpersonationLevel is left untouched on purpose!
774 return Token;
775 }
776
777 /*
778 * @implemented
779 */
780 PACCESS_TOKEN
781 NTAPI
782 PsReferenceImpersonationToken(IN PETHREAD Thread,
783 OUT PBOOLEAN CopyOnOpen,
784 OUT PBOOLEAN EffectiveOnly,
785 OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
786 {
787 PTOKEN Token = NULL;
788 PAGED_CODE();
789 PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
790
791 /* If we don't have impersonation info, just quit */
792 if (!Thread->ActiveImpersonationInfo) return NULL;
793
794 /* Lock the thread */
795 PspLockThreadSecurityShared(Thread);
796
797 /* Make sure we still have active impersonation */
798 if (Thread->ActiveImpersonationInfo)
799 {
800 /* Return data from caller */
801 ObReferenceObject(Thread->ImpersonationInfo->Token);
802 *ImpersonationLevel = Thread->ImpersonationInfo->ImpersonationLevel;
803 *CopyOnOpen = Thread->ImpersonationInfo->CopyOnOpen;
804 *EffectiveOnly = Thread->ImpersonationInfo->EffectiveOnly;
805
806 /* Set the token */
807 Token = Thread->ImpersonationInfo->Token;
808 }
809
810 /* Unlock thread and return impersonation token */
811 PspUnlockThreadSecurityShared(Thread);
812 return Token;
813 }
814
815 #undef PsDereferenceImpersonationToken
816 /*
817 * @implemented
818 */
819 VOID
820 NTAPI
821 PsDereferenceImpersonationToken(IN PACCESS_TOKEN ImpersonationToken)
822 {
823 PAGED_CODE();
824
825 /* If we got a token, dereference it */
826 if (ImpersonationToken) ObDereferenceObject(ImpersonationToken);
827 }
828
829 #undef PsDereferencePrimaryToken
830 /*
831 * @implemented
832 */
833 VOID
834 NTAPI
835 PsDereferencePrimaryToken(IN PACCESS_TOKEN PrimaryToken)
836 {
837 PAGED_CODE();
838
839 /* Dereference the token*/
840 ObDereferenceObject(PrimaryToken);
841 }
842
843 /*
844 * @implemented
845 */
846 BOOLEAN
847 NTAPI
848 PsDisableImpersonation(IN PETHREAD Thread,
849 OUT PSE_IMPERSONATION_STATE ImpersonationState)
850 {
851 PPS_IMPERSONATION_INFORMATION Impersonation = NULL;
852 LONG OldFlags;
853 PAGED_CODE();
854 PSTRACE(PS_SECURITY_DEBUG,
855 "Thread: %p State: %p\n", Thread, ImpersonationState);
856
857 /* Check if we don't have impersonation */
858 if (Thread->ActiveImpersonationInfo)
859 {
860 /* Lock thread security */
861 PspLockThreadSecurityExclusive(Thread);
862
863 /* Disable impersonation */
864 OldFlags = PspClearCrossThreadFlag(Thread,
865 CT_ACTIVE_IMPERSONATION_INFO_BIT);
866
867 /* Make sure nobody disabled it behind our back */
868 if (OldFlags & CT_ACTIVE_IMPERSONATION_INFO_BIT)
869 {
870 /* Copy the old state */
871 Impersonation = Thread->ImpersonationInfo;
872 ImpersonationState->Token = Impersonation->Token;
873 ImpersonationState->CopyOnOpen = Impersonation->CopyOnOpen;
874 ImpersonationState->EffectiveOnly = Impersonation->EffectiveOnly;
875 ImpersonationState->Level = Impersonation->ImpersonationLevel;
876 }
877
878 /* Unlock thread security */
879 PspUnlockThreadSecurityExclusive(Thread);
880
881 /* If we had impersonation info, return true */
882 if (Impersonation) return TRUE;
883 }
884
885 /* Clear everything */
886 ImpersonationState->Token = NULL;
887 ImpersonationState->CopyOnOpen = FALSE;
888 ImpersonationState->EffectiveOnly = FALSE;
889 ImpersonationState->Level = SecurityAnonymous;
890 return FALSE;
891 }
892
893 /*
894 * @implemented
895 */
896 VOID
897 NTAPI
898 PsRestoreImpersonation(IN PETHREAD Thread,
899 IN PSE_IMPERSONATION_STATE ImpersonationState)
900 {
901 PTOKEN Token = NULL;
902 PPS_IMPERSONATION_INFORMATION Impersonation;
903 PAGED_CODE();
904 PSTRACE(PS_SECURITY_DEBUG,
905 "Thread: %p State: %p\n", Thread, ImpersonationState);
906
907 /* Lock thread security */
908 PspLockThreadSecurityExclusive(Thread);
909
910 /* Get the impersonation info */
911 Impersonation = Thread->ImpersonationInfo;
912
913 /* Check if we're impersonating */
914 if (Thread->ActiveImpersonationInfo)
915 {
916 /* Get the token */
917 Token = Impersonation->Token;
918 }
919
920 /* Check if we have an impersonation state */
921 if (ImpersonationState)
922 {
923 /* Fill out the impersonation info */
924 Impersonation->ImpersonationLevel = ImpersonationState->Level;
925 Impersonation->CopyOnOpen = ImpersonationState->CopyOnOpen;
926 Impersonation->EffectiveOnly = ImpersonationState->EffectiveOnly;
927 Impersonation->Token = ImpersonationState->Token;
928
929 /* Enable impersonation */
930 PspSetCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
931 }
932 else
933 {
934 /* Disable impersonation */
935 PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
936 }
937
938 /* Unlock the thread */
939 PspUnlockThreadSecurityExclusive(Thread);
940
941 /* Dereference the token */
942 if (Token) ObDereferenceObject(Token);
943 }
944
945 NTSTATUS
946 NTAPI
947 NtImpersonateThread(IN HANDLE ThreadHandle,
948 IN HANDLE ThreadToImpersonateHandle,
949 IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService)
950 {
951 SECURITY_QUALITY_OF_SERVICE SafeServiceQoS;
952 SECURITY_CLIENT_CONTEXT ClientContext;
953 PETHREAD Thread;
954 PETHREAD ThreadToImpersonate;
955 KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
956 NTSTATUS Status;
957 PAGED_CODE();
958 PSTRACE(PS_SECURITY_DEBUG,
959 "Threads: %p %p\n", ThreadHandle, ThreadToImpersonateHandle);
960
961 /* Check if call came from user mode */
962 if (PreviousMode != KernelMode)
963 {
964 /* Enter SEH for probing */
965 _SEH2_TRY
966 {
967 /* Probe QoS */
968 ProbeForRead(SecurityQualityOfService,
969 sizeof(SECURITY_QUALITY_OF_SERVICE),
970 sizeof(ULONG));
971
972 /* Capture it */
973 SafeServiceQoS = *SecurityQualityOfService;
974 SecurityQualityOfService = &SafeServiceQoS;
975 }
976 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
977 {
978 /* Return the exception code */
979 _SEH2_YIELD(return _SEH2_GetExceptionCode());
980 }
981 _SEH2_END;
982 }
983
984 /* Reference the thread */
985 Status = ObReferenceObjectByHandle(ThreadHandle,
986 THREAD_DIRECT_IMPERSONATION,
987 PsThreadType,
988 PreviousMode,
989 (PVOID*)&Thread,
990 NULL);
991 if (NT_SUCCESS(Status))
992 {
993 /* Reference the impersonating thead */
994 Status = ObReferenceObjectByHandle(ThreadToImpersonateHandle,
995 THREAD_IMPERSONATE,
996 PsThreadType,
997 PreviousMode,
998 (PVOID*)&ThreadToImpersonate,
999 NULL);
1000 if (NT_SUCCESS(Status))
1001 {
1002 /* Create a client security context */
1003 Status = SeCreateClientSecurity(ThreadToImpersonate,
1004 SecurityQualityOfService,
1005 0,
1006 &ClientContext);
1007 if (NT_SUCCESS(Status))
1008 {
1009 /* Do the impersonation */
1010 SeImpersonateClient(&ClientContext, Thread);
1011 if (ClientContext.ClientToken)
1012 {
1013 /* Dereference the client token if we had one */
1014 ObDereferenceObject(ClientContext.ClientToken);
1015 }
1016 }
1017
1018 /* Dereference the thread to impersonate */
1019 ObDereferenceObject(ThreadToImpersonate);
1020 }
1021
1022 /* Dereference the main thread */
1023 ObDereferenceObject(Thread);
1024 }
1025
1026 /* Return status */
1027 return Status;
1028 }
1029 /* EOF */