ntoskrnl/se/acl.c

   1 /*
   2  * COPYRIGHT:       See COPYING in the top level directory
   3  * PROJECT:         ReactOS kernel
   4  * FILE:            ntoskrnl/se/acl.c
   5  * PURPOSE:         Security manager
   6  *
   7  * PROGRAMMERS:     David Welch <welch@cwcom.net>
   8  */
   9
  10 /* INCLUDES *******************************************************************/
  11
  12 #include <ntoskrnl.h>
  13 #define NDEBUG
  14 #include <debug.h>
  15
  16 #if defined (ALLOC_PRAGMA)
  17 #pragma alloc_text(INIT, SepInitDACLs)
  18 #endif
  19
  20 /* GLOBALS ********************************************************************/
  21
  22 PACL SePublicDefaultDacl = NULL;
  23 PACL SeSystemDefaultDacl = NULL;
  24 PACL SePublicDefaultUnrestrictedDacl = NULL;
  25 PACL SePublicOpenDacl = NULL;
  26 PACL SePublicOpenUnrestrictedDacl = NULL;
  27 PACL SeUnrestrictedDacl = NULL;
  28
  29 /* FUNCTIONS ******************************************************************/
  30
  31 BOOLEAN
  32 INIT_FUNCTION
  33 NTAPI
  34 SepInitDACLs(VOID)
  35 {
  36     ULONG AclLength;
  37
  38     /* create PublicDefaultDacl */
  39     AclLength = sizeof(ACL) +
  40                 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
  41                 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid));
  42
  43     SePublicDefaultDacl = ExAllocatePoolWithTag(PagedPool,
  44                                                 AclLength,
  45                                                 TAG_ACL);
  46     if (SePublicDefaultDacl == NULL)
  47         return FALSE;
  48
  49     RtlCreateAcl(SePublicDefaultDacl,
  50                  AclLength,
  51                  ACL_REVISION);
  52
  53     RtlAddAccessAllowedAce(SePublicDefaultDacl,
  54                            ACL_REVISION,
  55                            GENERIC_EXECUTE,
  56                            SeWorldSid);
  57
  58     RtlAddAccessAllowedAce(SePublicDefaultDacl,
  59                            ACL_REVISION,
  60                            GENERIC_ALL,
  61                            SeLocalSystemSid);
  62
  63     /* create PublicDefaultUnrestrictedDacl */
  64     AclLength = sizeof(ACL) +
  65                 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
  66                 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
  67                 (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) +
  68                 (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid));
  69
  70     SePublicDefaultUnrestrictedDacl = ExAllocatePoolWithTag(PagedPool,
  71                                                             AclLength,
  72                                                             TAG_ACL);
  73     if (SePublicDefaultUnrestrictedDacl == NULL)
  74         return FALSE;
  75
  76     RtlCreateAcl(SePublicDefaultUnrestrictedDacl,
  77                  AclLength,
  78                  ACL_REVISION);
  79
  80     RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl,
  81                            ACL_REVISION,
  82                            GENERIC_EXECUTE,
  83                            SeWorldSid);
  84
  85     RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl,
  86                            ACL_REVISION,
  87                            GENERIC_ALL,
  88                            SeLocalSystemSid);
  89
  90     RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl,
  91                            ACL_REVISION,
  92                            GENERIC_ALL,
  93                            SeAliasAdminsSid);
  94
  95     RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl,
  96                            ACL_REVISION,
  97                            GENERIC_READ | GENERIC_EXECUTE | READ_CONTROL,
  98                            SeRestrictedCodeSid);
  99
 100     /* create PublicOpenDacl */
 101     AclLength = sizeof(ACL) +
 102                 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
 103                 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
 104                 (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid));
 105
 106     SePublicOpenDacl = ExAllocatePoolWithTag(PagedPool,
 107                                              AclLength,
 108                                              TAG_ACL);
 109     if (SePublicOpenDacl == NULL)
 110         return FALSE;
 111
 112     RtlCreateAcl(SePublicOpenDacl,
 113                  AclLength,
 114                  ACL_REVISION);
 115
 116     RtlAddAccessAllowedAce(SePublicOpenDacl,
 117                            ACL_REVISION,
 118                            GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE,
 119                            SeWorldSid);
 120
 121     RtlAddAccessAllowedAce(SePublicOpenDacl,
 122                            ACL_REVISION,
 123                            GENERIC_ALL,
 124                            SeLocalSystemSid);
 125
 126     RtlAddAccessAllowedAce(SePublicOpenDacl,
 127                            ACL_REVISION,
 128                            GENERIC_ALL,
 129                            SeAliasAdminsSid);
 130
 131     /* create PublicOpenUnrestrictedDacl */
 132     AclLength = sizeof(ACL) +
 133                 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
 134                 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
 135                 (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) +
 136                 (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid));
 137
 138     SePublicOpenUnrestrictedDacl = ExAllocatePoolWithTag(PagedPool,
 139                                                          AclLength,
 140                                                          TAG_ACL);
 141     if (SePublicOpenUnrestrictedDacl == NULL)
 142         return FALSE;
 143
 144     RtlCreateAcl(SePublicOpenUnrestrictedDacl,
 145                  AclLength,
 146                  ACL_REVISION);
 147
 148     RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl,
 149                            ACL_REVISION,
 150                            GENERIC_ALL,
 151                            SeWorldSid);
 152
 153     RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl,
 154                            ACL_REVISION,
 155                            GENERIC_ALL,
 156                            SeLocalSystemSid);
 157
 158     RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl,
 159                            ACL_REVISION,
 160                            GENERIC_ALL,
 161                            SeAliasAdminsSid);
 162
 163     RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl,
 164                            ACL_REVISION,
 165                            GENERIC_READ | GENERIC_EXECUTE,
 166                            SeRestrictedCodeSid);
 167
 168     /* create SystemDefaultDacl */
 169     AclLength = sizeof(ACL) +
 170                 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
 171                 (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid));
 172
 173     SeSystemDefaultDacl = ExAllocatePoolWithTag(PagedPool,
 174                                                 AclLength,
 175                                                 TAG_ACL);
 176     if (SeSystemDefaultDacl == NULL)
 177         return FALSE;
 178
 179     RtlCreateAcl(SeSystemDefaultDacl,
 180                  AclLength,
 181                  ACL_REVISION);
 182
 183     RtlAddAccessAllowedAce(SeSystemDefaultDacl,
 184                            ACL_REVISION,
 185                            GENERIC_ALL,
 186                            SeLocalSystemSid);
 187
 188     RtlAddAccessAllowedAce(SeSystemDefaultDacl,
 189                            ACL_REVISION,
 190                            GENERIC_READ | GENERIC_EXECUTE | READ_CONTROL,
 191                            SeAliasAdminsSid);
 192
 193     /* create UnrestrictedDacl */
 194     AclLength = sizeof(ACL) +
 195                 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
 196                 (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid));
 197
 198     SeUnrestrictedDacl = ExAllocatePoolWithTag(PagedPool,
 199                                                AclLength,
 200                                                TAG_ACL);
 201     if (SeUnrestrictedDacl == NULL)
 202         return FALSE;
 203
 204     RtlCreateAcl(SeUnrestrictedDacl,
 205                  AclLength,
 206                  ACL_REVISION);
 207
 208     RtlAddAccessAllowedAce(SeUnrestrictedDacl,
 209                            ACL_REVISION,
 210                            GENERIC_ALL,
 211                            SeWorldSid);
 212
 213     RtlAddAccessAllowedAce(SeUnrestrictedDacl,
 214                            ACL_REVISION,
 215                            GENERIC_READ | GENERIC_EXECUTE,
 216                            SeRestrictedCodeSid);
 217
 218     return TRUE;
 219 }
 220
 221 NTSTATUS NTAPI
 222 SepCreateImpersonationTokenDacl(PTOKEN Token,
 223                                 PTOKEN PrimaryToken,
 224                                 PACL *Dacl)
 225 {
 226     ULONG AclLength;
 227     PVOID TokenDacl;
 228
 229     PAGED_CODE();
 230
 231     AclLength = sizeof(ACL) +
 232     (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) +
 233     (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)) +
 234     (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
 235     (sizeof(ACE) + RtlLengthSid(Token->UserAndGroups->Sid)) +
 236     (sizeof(ACE) + RtlLengthSid(PrimaryToken->UserAndGroups->Sid));
 237
 238     TokenDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL);
 239     if (TokenDacl == NULL)
 240     {
 241         return STATUS_INSUFFICIENT_RESOURCES;
 242     }
 243
 244     RtlCreateAcl(TokenDacl, AclLength, ACL_REVISION);
 245     RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
 246                            Token->UserAndGroups->Sid);
 247     RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
 248                            PrimaryToken->UserAndGroups->Sid);
 249     RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
 250                            SeAliasAdminsSid);
 251     RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
 252                            SeLocalSystemSid);
 253
 254     /* FIXME */
 255 #if 0
 256     if (Token->RestrictedSids != NULL || PrimaryToken->RestrictedSids != NULL)
 257     {
 258         RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
 259                                SeRestrictedCodeSid);
 260     }
 261 #endif
 262
 263     return STATUS_SUCCESS;
 264 }
 265
 266 NTSTATUS
 267 NTAPI
 268 SepCaptureAcl(IN PACL InputAcl,
 269               IN KPROCESSOR_MODE AccessMode,
 270               IN POOL_TYPE PoolType,
 271               IN BOOLEAN CaptureIfKernel,
 272               OUT PACL *CapturedAcl)
 273 {
 274     PACL NewAcl;
 275     ULONG AclSize = 0;
 276     NTSTATUS Status = STATUS_SUCCESS;
 277
 278     PAGED_CODE();
 279
 280     if (AccessMode != KernelMode)
 281     {
 282         _SEH2_TRY
 283         {
 284             ProbeForRead(InputAcl,
 285                          sizeof(ACL),
 286                          sizeof(ULONG));
 287             AclSize = InputAcl->AclSize;
 288             ProbeForRead(InputAcl,
 289                          AclSize,
 290                          sizeof(ULONG));
 291         }
 292         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 293         {
 294             /* Return the exception code */
 295             _SEH2_YIELD(return _SEH2_GetExceptionCode());
 296         }
 297         _SEH2_END;
 298
 299         NewAcl = ExAllocatePool(PoolType,
 300                                 AclSize);
 301         if (NewAcl != NULL)
 302         {
 303             _SEH2_TRY
 304             {
 305                 RtlCopyMemory(NewAcl,
 306                               InputAcl,
 307                               AclSize);
 308
 309                 *CapturedAcl = NewAcl;
 310             }
 311             _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 312             {
 313                 /* Free the ACL and return the exception code */
 314                 ExFreePoolWithTag(NewAcl, TAG_ACL);
 315                 _SEH2_YIELD(return _SEH2_GetExceptionCode());
 316             }
 317             _SEH2_END;
 318         }
 319         else
 320         {
 321             Status = STATUS_INSUFFICIENT_RESOURCES;
 322         }
 323     }
 324     else if (!CaptureIfKernel)
 325     {
 326         *CapturedAcl = InputAcl;
 327     }
 328     else
 329     {
 330         AclSize = InputAcl->AclSize;
 331
 332         NewAcl = ExAllocatePool(PoolType,
 333                                 AclSize);
 334
 335         if (NewAcl != NULL)
 336         {
 337             RtlCopyMemory(NewAcl,
 338                           InputAcl,
 339                           AclSize);
 340
 341             *CapturedAcl = NewAcl;
 342         }
 343         else
 344         {
 345             Status = STATUS_INSUFFICIENT_RESOURCES;
 346         }
 347     }
 348
 349     return Status;
 350 }
 351
 352 VOID
 353 NTAPI
 354 SepReleaseAcl(IN PACL CapturedAcl,
 355               IN KPROCESSOR_MODE AccessMode,
 356               IN BOOLEAN CaptureIfKernel)
 357 {
 358     PAGED_CODE();
 359
 360     if (CapturedAcl != NULL &&
 361         (AccessMode != KernelMode ||
 362          (AccessMode == KernelMode && CaptureIfKernel)))
 363     {
 364         ExFreePoolWithTag(CapturedAcl, TAG_ACL);
 365     }
 366 }
 367
 368 /* EOF */