ntoskrnl/ps/security.c

   1 /*
   2  * PROJECT:         ReactOS Kernel
   3  * LICENSE:         GPL - See COPYING in the top level directory
   4  * FILE:            ntoskrnl/ps/security.c
   5  * PURPOSE:         Process Manager: Process/Thread Security
   6  * PROGRAMMERS:     Alex Ionescu (alex.ionescu@reactos.org)
   7  *                  Eric Kohl
   8  *                  Thomas Weidenmueller (w3seek@reactos.org)
   9  */
  10
  11 /* INCLUDES ******************************************************************/
  12
  13 #include <ntoskrnl.h>
  14 #define NDEBUG
  15 #include <debug.h>
  16
  17 PTOKEN PspBootAccessToken;
  18
  19 VOID
  20 NTAPI
  21 SeAssignPrimaryToken(
  22     IN PEPROCESS Process,
  23     IN PTOKEN Token
  24 );
  25
  26 /* PRIVATE FUNCTIONS *********************************************************/
  27
  28 VOID
  29 NTAPI
  30 PspDeleteProcessSecurity(IN PEPROCESS Process)
  31 {
  32     PAGED_CODE();
  33     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
  34
  35     /* Check if we have a token */
  36     if (Process->Token.Object)
  37     {
  38         /* Deassign it */
  39         SeDeassignPrimaryToken(Process);
  40         Process->Token.Object = NULL;
  41     }
  42 }
  43
  44 VOID
  45 NTAPI
  46 PspDeleteThreadSecurity(IN PETHREAD Thread)
  47 {
  48     PPS_IMPERSONATION_INFORMATION ImpersonationInfo = Thread->ImpersonationInfo;
  49     PAGED_CODE();
  50     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
  51
  52     /* Check if we have active impersonation info */
  53     if (Thread->ActiveImpersonationInfo)
  54     {
  55         /* Dereference its token */
  56         ObDereferenceObject(ImpersonationInfo->Token);
  57     }
  58
  59     /* Check if we have impersonation info */
  60     if (ImpersonationInfo)
  61     {
  62         /* Free it */
  63         ExFreePool(ImpersonationInfo);
  64         PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
  65         Thread->ImpersonationInfo = NULL;
  66     }
  67 }
  68
  69 NTSTATUS
  70 NTAPI
  71 PspInitializeProcessSecurity(IN PEPROCESS Process,
  72                              IN PEPROCESS Parent OPTIONAL)
  73 {
  74     NTSTATUS Status = STATUS_SUCCESS;
  75     PTOKEN NewToken, ParentToken;
  76     PAGED_CODE();
  77     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
  78
  79     /* If we have a parent, then duplicate the Token */
  80     if (Parent)
  81     {
  82         /* Get the Parent Token */
  83         ParentToken = PsReferencePrimaryToken(Parent);
  84
  85         /* Duplicate it */
  86         Status = SeSubProcessToken(ParentToken,
  87                                    &NewToken,
  88                                    TRUE,
  89                                    MmGetSessionId(Process));
  90
  91         /* Dereference the Parent */
  92         ObFastDereferenceObject(&Parent->Token, ParentToken);
  93
  94         /* Set the new Token */
  95         if (NT_SUCCESS(Status))
  96         {
  97             /* Initailize the fast reference */
  98             ObInitializeFastReference(&Process->Token, NewToken);
  99         }
 100     }
 101     else
 102     {
 103         /* No parent, assign the Boot Token */
 104         ObInitializeFastReference(&Process->Token, NULL);
 105         SeAssignPrimaryToken(Process, PspBootAccessToken);
 106     }
 107
 108     /* Return to caller */
 109     return Status;
 110 }
 111
 112 NTSTATUS
 113 NTAPI
 114 PspWriteTebImpersonationInfo(IN PETHREAD Thread,
 115                              IN PETHREAD CurrentThread)
 116 {
 117     PEPROCESS Process;
 118     PTEB Teb;
 119     BOOLEAN Attached = FALSE;
 120     BOOLEAN IsImpersonating;
 121     KAPC_STATE ApcState;
 122     PAGED_CODE();
 123     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
 124
 125     /* Sanity check */
 126     ASSERT(CurrentThread == PsGetCurrentThread());
 127
 128     /* Get process and TEB */
 129     Process = Thread->ThreadsProcess;
 130     Teb = Thread->Tcb.Teb;
 131     if (Teb)
 132     {
 133         /* Check if we're not in the right process */
 134         if (Thread->Tcb.ApcState.Process != &Process->Pcb)
 135         {
 136             /* Attach to the process */
 137             KeStackAttachProcess(&Process->Pcb, &ApcState);
 138             Attached = TRUE;
 139         }
 140
 141         /* Check if we're in a different thread or acquire rundown */
 142         if ((Thread == CurrentThread) ||
 143             (ExAcquireRundownProtection(&Thread->RundownProtect)))
 144         {
 145             /* Check if the thread is impersonating */
 146             IsImpersonating = (BOOLEAN)Thread->ActiveImpersonationInfo;
 147             if (IsImpersonating)
 148             {
 149                 /* Set TEB data */
 150                 Teb->ImpersonationLocale = -1;
 151                 Teb->IsImpersonating = 1;
 152             }
 153             else
 154             {
 155                 /* Set TEB data */
 156                 Teb->ImpersonationLocale = 0;
 157                 Teb->IsImpersonating = 0;
 158             }
 159         }
 160
 161         /* Check if we're in a different thread */
 162         if (Thread != CurrentThread)
 163         {
 164             /* Release protection */
 165             ExReleaseRundownProtection(&Thread->RundownProtect);
 166         }
 167
 168         /* Detach */
 169         if (Attached) KeUnstackDetachProcess(&ApcState);
 170     }
 171
 172     /* Return to caller */
 173     return STATUS_SUCCESS;
 174 }
 175
 176 NTSTATUS
 177 NTAPI
 178 PspAssignPrimaryToken(IN PEPROCESS Process,
 179                       IN HANDLE Token,
 180                       IN PACCESS_TOKEN AccessToken OPTIONAL)
 181 {
 182     PACCESS_TOKEN NewToken = AccessToken, OldToken;
 183     NTSTATUS Status;
 184     PAGED_CODE();
 185     PSTRACE(PS_SECURITY_DEBUG, "Process: %p Token: %p\n", Process, Token);
 186
 187     /* Check if we don't have a pointer */
 188     if (!AccessToken)
 189     {
 190         /* Reference it from the handle */
 191         Status = ObReferenceObjectByHandle(Token,
 192                                            TOKEN_ASSIGN_PRIMARY,
 193                                            SeTokenObjectType,
 194                                            ExGetPreviousMode(),
 195                                            &NewToken,
 196                                            NULL);
 197         if (!NT_SUCCESS(Status)) return Status;
 198     }
 199
 200     /* Exchange tokens */
 201     Status = SeExchangePrimaryToken(Process, NewToken, &OldToken);
 202
 203     /* Acquire and release the lock */
 204     PspLockProcessSecurityExclusive(Process);
 205     PspUnlockProcessSecurityExclusive(Process);
 206
 207     /* Dereference Tokens and Return */
 208     if (NT_SUCCESS(Status)) ObDereferenceObject(OldToken);
 209     if (!AccessToken) ObDereferenceObject(NewToken);
 210     return Status;
 211 }
 212
 213 NTSTATUS
 214 NTAPI
 215 PspSetPrimaryToken(IN PEPROCESS Process,
 216                    IN HANDLE TokenHandle OPTIONAL,
 217                    IN PACCESS_TOKEN Token OPTIONAL)
 218 {
 219     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 220     BOOLEAN IsChild;
 221     PACCESS_TOKEN NewToken = Token;
 222     NTSTATUS Status, AccessStatus;
 223     BOOLEAN Result, SdAllocated;
 224     PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
 225     SECURITY_SUBJECT_CONTEXT SubjectContext;
 226     PSTRACE(PS_SECURITY_DEBUG, "Process: %p Token: %p\n", Process, Token);
 227
 228     /* Make sure we got a handle */
 229     if (TokenHandle)
 230     {
 231         /* Reference it */
 232         Status = ObReferenceObjectByHandle(TokenHandle,
 233                                            TOKEN_ASSIGN_PRIMARY,
 234                                            SeTokenObjectType,
 235                                            PreviousMode,
 236                                            (PVOID*)&NewToken,
 237                                            NULL);
 238         if (!NT_SUCCESS(Status)) return Status;
 239     }
 240
 241     /* Check if this is a child */
 242     Status = SeIsTokenChild(NewToken, &IsChild);
 243     if (!NT_SUCCESS(Status))
 244     {
 245         /* Failed, dereference */
 246         if (TokenHandle) ObDereferenceObject(NewToken);
 247         return Status;
 248     }
 249
 250     /* Check if this was an independent token */
 251     if (!IsChild)
 252     {
 253         /* Make sure we have the privilege to assign a new one */
 254         if (!SeSinglePrivilegeCheck(SeAssignPrimaryTokenPrivilege,
 255                                     PreviousMode))
 256         {
 257             /* Failed, dereference */
 258             if (TokenHandle) ObDereferenceObject(NewToken);
 259             return STATUS_PRIVILEGE_NOT_HELD;
 260         }
 261     }
 262
 263     /* Assign the token */
 264     Status = PspAssignPrimaryToken(Process, NULL, NewToken);
 265     if (NT_SUCCESS(Status))
 266     {
 267         /*
 268          * We need to completely reverify if the process still has access to
 269          * itself under this new token.
 270          */
 271         Status = ObGetObjectSecurity(Process,
 272                                      &SecurityDescriptor,
 273                                      &SdAllocated);
 274         if (NT_SUCCESS(Status))
 275         {
 276             /* Setup the security context */
 277             SubjectContext.ProcessAuditId = Process;
 278             SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process);
 279             SubjectContext.ClientToken = NULL;
 280
 281             /* Do the access check */
 282             Result = SeAccessCheck(SecurityDescriptor,
 283                                    &SubjectContext,
 284                                    FALSE,
 285                                    MAXIMUM_ALLOWED,
 286                                    0,
 287                                    NULL,
 288                                    &PsProcessType->TypeInfo.GenericMapping,
 289                                    PreviousMode,
 290                                    &Process->GrantedAccess,
 291                                    &AccessStatus);
 292
 293             /* Dereference the token and let go the SD */
 294             ObFastDereferenceObject(&Process->Token,
 295                                     SubjectContext.PrimaryToken);
 296             ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
 297
 298             /* Remove access if it failed */
 299             if (!Result) Process->GrantedAccess = 0;
 300
 301             /* Setup granted access */
 302             Process->GrantedAccess |= (PROCESS_VM_OPERATION |
 303                                        PROCESS_VM_READ |
 304                                        PROCESS_VM_WRITE |
 305                                        PROCESS_QUERY_INFORMATION |
 306                                        PROCESS_TERMINATE |
 307                                        PROCESS_CREATE_THREAD |
 308                                        PROCESS_DUP_HANDLE |
 309                                        PROCESS_CREATE_PROCESS |
 310                                        PROCESS_SET_INFORMATION |
 311                                        STANDARD_RIGHTS_ALL |
 312                                        PROCESS_SET_QUOTA);
 313         }
 314     }
 315
 316     /* Dereference the token */
 317     if (TokenHandle) ObDereferenceObject(NewToken);
 318     return Status;
 319 }
 320
 321 /* FUNCTIONS *****************************************************************/
 322
 323 /*
 324  * @implemented
 325  */
 326 NTSTATUS
 327 NTAPI
 328 NtOpenProcessToken(IN HANDLE ProcessHandle,
 329                    IN ACCESS_MASK DesiredAccess,
 330                    OUT PHANDLE TokenHandle)
 331 {
 332     /* Call the newer API */
 333     return NtOpenProcessTokenEx(ProcessHandle,
 334                                 DesiredAccess,
 335                                 0,
 336                                 TokenHandle);
 337 }
 338
 339 /*
 340  * @implemented
 341  */
 342 NTSTATUS
 343 NTAPI
 344 NtOpenProcessTokenEx(IN HANDLE ProcessHandle,
 345                      IN ACCESS_MASK DesiredAccess,
 346                      IN ULONG HandleAttributes,
 347                      OUT PHANDLE TokenHandle)
 348 {
 349     PACCESS_TOKEN Token;
 350     HANDLE hToken;
 351     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 352     NTSTATUS Status;
 353     PAGED_CODE();
 354     PSTRACE(PS_SECURITY_DEBUG,
 355             "Process: %p DesiredAccess: %lx\n", ProcessHandle, DesiredAccess);
 356
 357     /* Check if caller was user-mode */
 358     if (PreviousMode != KernelMode)
 359     {
 360         /* Enter SEH for probing */
 361         _SEH2_TRY
 362         {
 363             /* Probe the token handle */
 364             ProbeForWriteHandle(TokenHandle);
 365         }
 366         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 367         {
 368             /* Return the exception code */
 369             _SEH2_YIELD(return _SEH2_GetExceptionCode());
 370         }
 371         _SEH2_END;
 372     }
 373
 374     /* Open the process token */
 375     Status = PsOpenTokenOfProcess(ProcessHandle, &Token);
 376     if (NT_SUCCESS(Status))
 377     {
 378         /* Reference it by handle and dereference the pointer */
 379         Status = ObOpenObjectByPointer(Token,
 380                                        HandleAttributes,
 381                                        NULL,
 382                                        DesiredAccess,
 383                                        SeTokenObjectType,
 384                                        PreviousMode,
 385                                        &hToken);
 386         ObDereferenceObject(Token);
 387
 388         /* Make sure we got a handle */
 389         if (NT_SUCCESS(Status))
 390         {
 391             /* Enter SEH for write */
 392             _SEH2_TRY
 393             {
 394                 /* Return the handle */
 395                 *TokenHandle = hToken;
 396             }
 397             _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 398             {
 399                 /* Get exception code */
 400                 Status = _SEH2_GetExceptionCode();
 401             }
 402             _SEH2_END;
 403         }
 404     }
 405
 406     /* Return status */
 407     return Status;
 408 }
 409
 410 /*
 411  * @implemented
 412  */
 413 PACCESS_TOKEN
 414 NTAPI
 415 PsReferencePrimaryToken(PEPROCESS Process)
 416 {
 417     PACCESS_TOKEN Token;
 418     PAGED_CODE();
 419     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
 420
 421     /* Fast Reference the Token */
 422     Token = ObFastReferenceObject(&Process->Token);
 423
 424     /* Check if we got the Token or if we got locked */
 425     if (!Token)
 426     {
 427         /* Lock the Process */
 428         PspLockProcessSecurityShared(Process);
 429
 430         /* Do a Locked Fast Reference */
 431         Token = ObFastReferenceObjectLocked(&Process->Token);
 432
 433         /* Unlock the Process */
 434         PspUnlockProcessSecurityShared(Process);
 435     }
 436
 437     /* Return the Token */
 438     return Token;
 439 }
 440
 441 /*
 442  * @implemented
 443  */
 444 NTSTATUS
 445 NTAPI
 446 PsOpenTokenOfProcess(IN HANDLE ProcessHandle,
 447                      OUT PACCESS_TOKEN* Token)
 448 {
 449     PEPROCESS Process;
 450     NTSTATUS Status;
 451     PAGED_CODE();
 452     PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", ProcessHandle);
 453
 454     /* Get the Token */
 455     Status = ObReferenceObjectByHandle(ProcessHandle,
 456                                        PROCESS_QUERY_INFORMATION,
 457                                        PsProcessType,
 458                                        ExGetPreviousMode(),
 459                                        (PVOID*)&Process,
 460                                        NULL);
 461     if (NT_SUCCESS(Status))
 462     {
 463         /* Reference the token and dereference the process */
 464         *Token = PsReferencePrimaryToken(Process);
 465         ObDereferenceObject(Process);
 466     }
 467
 468     /* Return */
 469     return Status;
 470 }
 471
 472 /*
 473  * @implemented
 474  */
 475 NTSTATUS
 476 NTAPI
 477 PsAssignImpersonationToken(IN PETHREAD Thread,
 478                            IN HANDLE TokenHandle)
 479 {
 480     PACCESS_TOKEN Token;
 481     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
 482     NTSTATUS Status;
 483     PAGED_CODE();
 484     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p Token: %p\n", Thread, TokenHandle);
 485
 486     /* Check if we were given a handle */
 487     if (!TokenHandle)
 488     {
 489         /* Undo impersonation */
 490         PsRevertThreadToSelf(Thread);
 491         return STATUS_SUCCESS;
 492     }
 493
 494     /* Get the token object */
 495     Status = ObReferenceObjectByHandle(TokenHandle,
 496                                        TOKEN_IMPERSONATE,
 497                                        SeTokenObjectType,
 498                                        KeGetPreviousMode(),
 499                                        (PVOID*)&Token,
 500                                        NULL);
 501     if (!NT_SUCCESS(Status)) return(Status);
 502
 503     /* Make sure it's an impersonation token */
 504     if (SeTokenType(Token) != TokenImpersonation)
 505     {
 506         /* Fail */
 507         ObDereferenceObject(Token);
 508         return STATUS_BAD_TOKEN_TYPE;
 509     }
 510
 511     /* Get the impersonation level */
 512     ImpersonationLevel = SeTokenImpersonationLevel(Token);
 513
 514     /* Call the impersonation API */
 515     Status = PsImpersonateClient(Thread,
 516                                  Token,
 517                                  FALSE,
 518                                  FALSE,
 519                                  ImpersonationLevel);
 520
 521     /* Dereference the token and return status */
 522     ObDereferenceObject(Token);
 523     return Status;
 524 }
 525
 526 /*
 527  * @implemented
 528  */
 529 VOID
 530 NTAPI
 531 PsRevertToSelf(VOID)
 532 {
 533     /* Call the per-thread API */
 534     PAGED_CODE();
 535     PsRevertThreadToSelf(PsGetCurrentThread());
 536 }
 537
 538 /*
 539  * @implemented
 540  */
 541 VOID
 542 NTAPI
 543 PsRevertThreadToSelf(IN PETHREAD Thread)
 544 {
 545     PTOKEN Token = NULL;
 546     PAGED_CODE();
 547     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
 548
 549     /* Make sure we had impersonation information */
 550     if (Thread->ActiveImpersonationInfo)
 551     {
 552         /* Lock the thread security */
 553         PspLockThreadSecurityExclusive(Thread);
 554
 555         /* Make sure it's still active */
 556         if (Thread->ActiveImpersonationInfo)
 557         {
 558             /* Disable impersonation */
 559             PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 560
 561             /* Get the token */
 562             Token = Thread->ImpersonationInfo->Token;
 563         }
 564
 565         /* Release thread security */
 566         PspUnlockThreadSecurityExclusive(Thread);
 567
 568         /* Check if we had a token */
 569         if (Token)
 570         {
 571             /* Dereference the impersonation token */
 572             ObDereferenceObject(Token);
 573
 574             /* Write impersonation info to the TEB */
 575             PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
 576         }
 577     }
 578 }
 579
 580 /*
 581  * @implemented
 582  */
 583 NTSTATUS
 584 NTAPI
 585 PsImpersonateClient(IN PETHREAD Thread,
 586                     IN PACCESS_TOKEN Token,
 587                     IN BOOLEAN CopyOnOpen,
 588                     IN BOOLEAN EffectiveOnly,
 589                     IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
 590 {
 591     PPS_IMPERSONATION_INFORMATION Impersonation, OldData;
 592     PTOKEN OldToken = NULL;
 593     PAGED_CODE();
 594     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p, Token: %p\n", Thread, Token);
 595
 596     /* Check if we don't have a token */
 597     if (!Token)
 598     {
 599         /* Make sure we're impersonating */
 600         if (Thread->ActiveImpersonationInfo)
 601         {
 602             /* We seem to be, lock the thread */
 603             PspLockThreadSecurityExclusive(Thread);
 604
 605             /* Make sure we're still impersonating */
 606             if (Thread->ActiveImpersonationInfo)
 607             {
 608                 /* Disable impersonation */
 609                 PspClearCrossThreadFlag(Thread,
 610                                         CT_ACTIVE_IMPERSONATION_INFO_BIT);
 611
 612                 /* Get the token */
 613                 OldToken = Thread->ImpersonationInfo->Token;
 614             }
 615
 616             /* Unlock the process and write TEB information */
 617             PspUnlockThreadSecurityExclusive(Thread);
 618             PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
 619         }
 620     }
 621     else
 622     {
 623         /* Check if we have impersonation info */
 624         Impersonation = Thread->ImpersonationInfo;
 625         if (!Impersonation)
 626         {
 627             /* We need to allocate a new one */
 628             Impersonation = ExAllocatePoolWithTag(PagedPool,
 629                                                   sizeof(*Impersonation),
 630                                                   TAG_PS_IMPERSONATION);
 631             if (!Impersonation) return STATUS_INSUFFICIENT_RESOURCES;
 632
 633             /* Update the pointer */
 634             OldData = InterlockedCompareExchangePointer((PVOID*)&Thread->
 635                                                         ImpersonationInfo,
 636                                                         Impersonation,
 637                                                         NULL);
 638             if (OldData)
 639             {
 640                 /* Someone beat us to it, free our copy */
 641                 ExFreePoolWithTag(Impersonation, TAG_PS_IMPERSONATION);
 642                 Impersonation = OldData;
 643             }
 644         }
 645
 646         /* Check if this is a job, which we don't support yet */
 647         if (Thread->ThreadsProcess->Job) ASSERT(FALSE);
 648
 649         /* Lock thread security */
 650         PspLockThreadSecurityExclusive(Thread);
 651
 652         /* Check if we're impersonating */
 653         if (Thread->ActiveImpersonationInfo)
 654         {
 655             /* Get the token */
 656             OldToken = Impersonation->Token;
 657         }
 658         else
 659         {
 660             /* Otherwise, enable impersonation */
 661             PspSetCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 662         }
 663
 664         /* Now fill it out */
 665         Impersonation->ImpersonationLevel = ImpersonationLevel;
 666         Impersonation->CopyOnOpen = CopyOnOpen;
 667         Impersonation->EffectiveOnly = EffectiveOnly;
 668         Impersonation->Token = Token;
 669         ObReferenceObject(Token);
 670
 671         /* Unlock the thread */
 672         PspUnlockThreadSecurityExclusive(Thread);
 673
 674         /* Write impersonation info to the TEB */
 675         PspWriteTebImpersonationInfo(Thread, PsGetCurrentThread());
 676     }
 677
 678     /* Dereference the token and return success */
 679     if (OldToken) PsDereferenceImpersonationToken(OldToken);
 680     return STATUS_SUCCESS;
 681 }
 682
 683 /*
 684  * @implemented
 685  */
 686 PACCESS_TOKEN
 687 NTAPI
 688 PsReferenceEffectiveToken(IN PETHREAD Thread,
 689                           OUT IN PTOKEN_TYPE TokenType,
 690                           OUT PBOOLEAN EffectiveOnly,
 691                           OUT PSECURITY_IMPERSONATION_LEVEL Level)
 692 {
 693     PEPROCESS Process;
 694     PACCESS_TOKEN Token = NULL;
 695     PAGED_CODE();
 696     PSTRACE(PS_SECURITY_DEBUG,
 697             "Thread: %p, TokenType: %p\n", Thread, TokenType);
 698
 699     /* Check if we don't have impersonation info */
 700     Process = Thread->ThreadsProcess;
 701     if (Thread->ActiveImpersonationInfo)
 702     {
 703         /* Lock the Process */
 704         PspLockProcessSecurityShared(Process);
 705
 706         /* Make sure impersonation is still active */
 707         if (Thread->ActiveImpersonationInfo)
 708         {
 709             /* Get the token */
 710             Token = Thread->ImpersonationInfo->Token;
 711             ObReferenceObject(Token);
 712
 713             /* Return data to caller */
 714             *TokenType = TokenImpersonation;
 715             *EffectiveOnly = Thread->ImpersonationInfo->EffectiveOnly;
 716             *Level = Thread->ImpersonationInfo->ImpersonationLevel;
 717
 718             /* Unlock the Process */
 719             PspUnlockProcessSecurityShared(Process);
 720             return Token;
 721         }
 722
 723         /* Unlock the Process */
 724         PspUnlockProcessSecurityShared(Process);
 725     }
 726
 727     /* Fast Reference the Token */
 728     Token = ObFastReferenceObject(&Process->Token);
 729
 730     /* Check if we got the Token or if we got locked */
 731     if (!Token)
 732     {
 733         /* Lock the Process */
 734         PspLockProcessSecurityShared(Process);
 735
 736         /* Do a Locked Fast Reference */
 737         Token = ObFastReferenceObjectLocked(&Process->Token);
 738
 739         /* Unlock the Process */
 740         PspUnlockProcessSecurityShared(Process);
 741     }
 742
 743     /* Return the token */
 744     *TokenType = TokenPrimary;
 745     *EffectiveOnly = FALSE;
 746     return Token;
 747 }
 748
 749 /*
 750  * @implemented
 751  */
 752 PACCESS_TOKEN
 753 NTAPI
 754 PsReferenceImpersonationToken(IN PETHREAD Thread,
 755                               OUT PBOOLEAN CopyOnOpen,
 756                               OUT PBOOLEAN EffectiveOnly,
 757                               OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
 758 {
 759     PTOKEN Token = NULL;
 760     PAGED_CODE();
 761     PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
 762
 763     /* If we don't have impersonation info, just quit */
 764     if (!Thread->ActiveImpersonationInfo) return NULL;
 765
 766     /* Lock the thread */
 767     PspLockThreadSecurityShared(Thread);
 768
 769     /* Make sure we still have active impersonation */
 770     if (Thread->ActiveImpersonationInfo)
 771     {
 772         /* Return data from caller */
 773         ObReferenceObject(Thread->ImpersonationInfo->Token);
 774         *ImpersonationLevel = Thread->ImpersonationInfo->ImpersonationLevel;
 775         *CopyOnOpen = Thread->ImpersonationInfo->CopyOnOpen;
 776         *EffectiveOnly = Thread->ImpersonationInfo->EffectiveOnly;
 777
 778         /* Set the token */
 779         Token = Thread->ImpersonationInfo->Token;
 780     }
 781
 782     /* Unlock thread and return impersonation token */
 783     PspUnlockThreadSecurityShared(Thread);
 784     return Token;
 785 }
 786
 787 #undef PsDereferenceImpersonationToken
 788 /*
 789  * @implemented
 790  */
 791 VOID
 792 NTAPI
 793 PsDereferenceImpersonationToken(IN PACCESS_TOKEN ImpersonationToken)
 794 {
 795     PAGED_CODE();
 796
 797     /* If we got a token, dereference it */
 798     if (ImpersonationToken) ObDereferenceObject(ImpersonationToken);
 799 }
 800
 801 #undef PsDereferencePrimaryToken
 802 /*
 803  * @implemented
 804  */
 805 VOID
 806 NTAPI
 807 PsDereferencePrimaryToken(IN PACCESS_TOKEN PrimaryToken)
 808 {
 809     PAGED_CODE();
 810
 811     /* Dereference the token*/
 812     ObDereferenceObject(PrimaryToken);
 813 }
 814
 815 /*
 816  * @implemented
 817  */
 818 BOOLEAN
 819 NTAPI
 820 PsDisableImpersonation(IN PETHREAD Thread,
 821                        OUT PSE_IMPERSONATION_STATE ImpersonationState)
 822 {
 823     PPS_IMPERSONATION_INFORMATION Impersonation = NULL;
 824     LONG OldFlags;
 825     PAGED_CODE();
 826     PSTRACE(PS_SECURITY_DEBUG,
 827             "Thread: %p State: %p\n", Thread, ImpersonationState);
 828
 829     /* Check if we don't have impersonation */
 830     if (Thread->ActiveImpersonationInfo)
 831     {
 832         /* Lock thread security */
 833         PspLockThreadSecurityExclusive(Thread);
 834
 835         /* Disable impersonation */
 836         OldFlags = PspClearCrossThreadFlag(Thread,
 837                                            CT_ACTIVE_IMPERSONATION_INFO_BIT);
 838
 839         /* Make sure nobody disabled it behind our back */
 840         if (OldFlags & CT_ACTIVE_IMPERSONATION_INFO_BIT)
 841         {
 842             /* Copy the old state */
 843             Impersonation = Thread->ImpersonationInfo;
 844             ImpersonationState->Token = Impersonation->Token;
 845             ImpersonationState->CopyOnOpen = Impersonation->CopyOnOpen;
 846             ImpersonationState->EffectiveOnly = Impersonation->EffectiveOnly;
 847             ImpersonationState->Level = Impersonation->ImpersonationLevel;
 848         }
 849
 850         /* Unlock thread security */
 851         PspUnlockThreadSecurityExclusive(Thread);
 852
 853         /* If we had impersonation info, return true */
 854         if (Impersonation) return TRUE;
 855     }
 856
 857     /* Clear everything */
 858     ImpersonationState->Token = NULL;
 859     ImpersonationState->CopyOnOpen = FALSE;
 860     ImpersonationState->EffectiveOnly = FALSE;
 861     ImpersonationState->Level = SecurityAnonymous;
 862     return FALSE;
 863 }
 864
 865 /*
 866  * @implemented
 867  */
 868 VOID
 869 NTAPI
 870 PsRestoreImpersonation(IN PETHREAD Thread,
 871                        IN PSE_IMPERSONATION_STATE ImpersonationState)
 872 {
 873     PTOKEN Token = NULL;
 874     PPS_IMPERSONATION_INFORMATION Impersonation;
 875     PAGED_CODE();
 876     PSTRACE(PS_SECURITY_DEBUG,
 877             "Thread: %p State: %p\n", Thread, ImpersonationState);
 878
 879     /* Lock thread security */
 880     PspLockThreadSecurityExclusive(Thread);
 881
 882     /* Get the impersonation info */
 883     Impersonation = Thread->ImpersonationInfo;
 884
 885     /* Check if we're impersonating */
 886     if (Thread->ActiveImpersonationInfo)
 887     {
 888         /* Get the token */
 889         Token = Impersonation->Token;
 890     }
 891
 892     /* Check if we have an impersonation state */
 893     if (ImpersonationState)
 894     {
 895         /* Fill out the impersonation info */
 896         Impersonation->ImpersonationLevel = ImpersonationState->Level;
 897         Impersonation->CopyOnOpen = ImpersonationState->CopyOnOpen;
 898         Impersonation->EffectiveOnly = ImpersonationState->EffectiveOnly;
 899         Impersonation->Token = ImpersonationState->Token;
 900
 901         /* Enable impersonation */
 902         PspSetCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 903     }
 904     else
 905     {
 906         /* Disable impersonation */
 907         PspClearCrossThreadFlag(Thread, CT_ACTIVE_IMPERSONATION_INFO_BIT);
 908     }
 909
 910     /* Unlock the thread */
 911     PspUnlockThreadSecurityExclusive(Thread);
 912
 913     /* Dereference the token */
 914     if (Token) ObDereferenceObject(Token);
 915 }
 916
 917 NTSTATUS
 918 NTAPI
 919 NtImpersonateThread(IN HANDLE ThreadHandle,
 920                     IN HANDLE ThreadToImpersonateHandle,
 921                     IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService)
 922 {
 923     SECURITY_QUALITY_OF_SERVICE SafeServiceQoS;
 924     SECURITY_CLIENT_CONTEXT ClientContext;
 925     PETHREAD Thread;
 926     PETHREAD ThreadToImpersonate;
 927     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 928     NTSTATUS Status;
 929     PAGED_CODE();
 930     PSTRACE(PS_SECURITY_DEBUG,
 931             "Threads: %p %p\n", ThreadHandle, ThreadToImpersonateHandle);
 932
 933     /* Check if call came from user mode */
 934     if (PreviousMode != KernelMode)
 935     {
 936         /* Enter SEH for probing */
 937         _SEH2_TRY
 938         {
 939             /* Probe QoS */
 940             ProbeForRead(SecurityQualityOfService,
 941                          sizeof(SECURITY_QUALITY_OF_SERVICE),
 942                          sizeof(ULONG));
 943
 944             /* Capture it */
 945             SafeServiceQoS = *SecurityQualityOfService;
 946             SecurityQualityOfService = &SafeServiceQoS;
 947         }
 948         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 949         {
 950             /* Return the exception code */
 951             _SEH2_YIELD(return _SEH2_GetExceptionCode());
 952         }
 953         _SEH2_END;
 954     }
 955
 956     /* Reference the thread */
 957     Status = ObReferenceObjectByHandle(ThreadHandle,
 958                                        THREAD_DIRECT_IMPERSONATION,
 959                                        PsThreadType,
 960                                        PreviousMode,
 961                                        (PVOID*)&Thread,
 962                                        NULL);
 963     if (NT_SUCCESS(Status))
 964     {
 965         /* Reference the impersonating thead */
 966         Status = ObReferenceObjectByHandle(ThreadToImpersonateHandle,
 967                                            THREAD_IMPERSONATE,
 968                                            PsThreadType,
 969                                            PreviousMode,
 970                                            (PVOID*)&ThreadToImpersonate,
 971                                            NULL);
 972         if (NT_SUCCESS(Status))
 973         {
 974             /* Create a client security context */
 975             Status = SeCreateClientSecurity(ThreadToImpersonate,
 976                                             SecurityQualityOfService,
 977                                             0,
 978                                             &ClientContext);
 979             if (NT_SUCCESS(Status))
 980             {
 981                 /* Do the impersonation */
 982                 SeImpersonateClient(&ClientContext, Thread);
 983                 if (ClientContext.ClientToken)
 984                 {
 985                     /* Dereference the client token if we had one */
 986                     ObDereferenceObject(ClientContext.ClientToken);
 987                 }
 988             }
 989
 990             /* Dereference the thread to impersonate */
 991             ObDereferenceObject(ThreadToImpersonate);
 992         }
 993
 994         /* Dereference the main thread */
 995         ObDereferenceObject(Thread);
 996     }
 997
 998     /* Return status */
 999     return Status;
1000 }
1001 /* EOF */