reactos/dll/win32/advapi32/sec/misc.c

   1 /*
   2  * COPYRIGHT:       See COPYING in the top level directory
   3  * WINE COPYRIGHT:
   4  * Copyright 1999, 2000 Juergen Schmied <juergen.schmied@debitel.net>
   5  * Copyright 2003 CodeWeavers Inc. (Ulrich Czekalla)
   6  * Copyright 2006 Robert Reif
   7  *
   8  * PROJECT:         ReactOS system libraries
   9  * FILE:            dll/win32/advapi32/sec/misc.c
  10  * PURPOSE:         Miscellaneous security functions (some ported from Wine)
  11  */
  12
  13 #include <advapi32.h>
  14
  15 WINE_DEFAULT_DEBUG_CHANNEL(advapi);
  16
  17 /* Interface to ntmarta.dll ***************************************************/
  18
  19 NTMARTA NtMartaStatic = { 0 };
  20 static PNTMARTA NtMarta = NULL;
  21
  22 #define FindNtMartaProc(Name)                                                  \
  23     NtMartaStatic.Name = (PVOID)GetProcAddress(NtMartaStatic.hDllInstance,     \
  24                                                "Acc" # Name );                 \
  25     if (NtMartaStatic.Name == NULL)                                            \
  26     {                                                                          \
  27         return GetLastError();                                                 \
  28     }
  29
  30
  31 static DWORD
  32 LoadAndInitializeNtMarta(VOID)
  33 {
  34     /* this code may be executed simultaneously by multiple threads in case they're
  35        trying to initialize the interface at the same time, but that's no problem
  36        because the pointers returned by GetProcAddress will be the same. However,
  37        only one of the threads will change the NtMarta pointer to the NtMartaStatic
  38        structure, the others threads will detect that there were other threads
  39        initializing the structure faster and will release the reference to the
  40        DLL */
  41
  42     NtMartaStatic.hDllInstance = LoadLibraryW(L"ntmarta.dll");
  43     if (NtMartaStatic.hDllInstance == NULL)
  44     {
  45         return GetLastError();
  46     }
  47
  48 #if 0
  49     FindNtMartaProc(LookupAccountTrustee);
  50     FindNtMartaProc(LookupAccountName);
  51     FindNtMartaProc(LookupAccountSid);
  52     FindNtMartaProc(SetEntriesInAList);
  53     FindNtMartaProc(ConvertAccessToSecurityDescriptor);
  54     FindNtMartaProc(ConvertSDToAccess);
  55     FindNtMartaProc(ConvertAclToAccess);
  56     FindNtMartaProc(GetAccessForTrustee);
  57     FindNtMartaProc(GetExplicitEntries);
  58 #endif
  59     FindNtMartaProc(RewriteGetNamedRights);
  60     FindNtMartaProc(RewriteSetNamedRights);
  61     FindNtMartaProc(RewriteGetHandleRights);
  62     FindNtMartaProc(RewriteSetHandleRights);
  63     FindNtMartaProc(RewriteSetEntriesInAcl);
  64     FindNtMartaProc(RewriteGetExplicitEntriesFromAcl);
  65     FindNtMartaProc(TreeResetNamedSecurityInfo);
  66     FindNtMartaProc(GetInheritanceSource);
  67     FindNtMartaProc(FreeIndexArray);
  68
  69     return ERROR_SUCCESS;
  70 }
  71
  72
  73 DWORD
  74 CheckNtMartaPresent(VOID)
  75 {
  76     DWORD ErrorCode;
  77
  78     if (InterlockedCompareExchangePointer((PVOID)&NtMarta,
  79                                           NULL,
  80                                           NULL) == NULL)
  81     {
  82         /* we're the first one trying to use ntmarta, initialize it and change
  83            the pointer after initialization */
  84         ErrorCode = LoadAndInitializeNtMarta();
  85
  86         if (ErrorCode == ERROR_SUCCESS)
  87         {
  88             /* try change the NtMarta pointer */
  89             if (InterlockedCompareExchangePointer((PVOID)&NtMarta,
  90                                                   &NtMartaStatic,
  91                                                   NULL) != NULL)
  92             {
  93                 /* another thread initialized ntmarta in the meanwhile, release
  94                    the reference of the dll loaded. */
  95                 FreeLibrary(NtMartaStatic.hDllInstance);
  96             }
  97         }
  98 #if DBG
  99         else
 100         {
 101             ERR("Failed to initialize ntmarta.dll! Error: 0x%x", ErrorCode);
 102         }
 103 #endif
 104     }
 105     else
 106     {
 107         /* ntmarta was already initialized */
 108         ErrorCode = ERROR_SUCCESS;
 109     }
 110
 111     return ErrorCode;
 112 }
 113
 114
 115 VOID
 116 UnloadNtMarta(VOID)
 117 {
 118     if (InterlockedExchangePointer((PVOID)&NtMarta,
 119                                    NULL) != NULL)
 120     {
 121         FreeLibrary(NtMartaStatic.hDllInstance);
 122     }
 123 }
 124
 125
 126 /******************************************************************************/
 127
 128 /*
 129  * @implemented
 130  */
 131 BOOL
 132 WINAPI
 133 ImpersonateAnonymousToken(IN HANDLE ThreadHandle)
 134 {
 135     NTSTATUS Status;
 136
 137     Status = NtImpersonateAnonymousToken(ThreadHandle);
 138     if (!NT_SUCCESS(Status))
 139     {
 140         SetLastError(RtlNtStatusToDosError(Status));
 141         return FALSE;
 142     }
 143
 144     return TRUE;
 145 }
 146
 147 /*
 148  * @implemented
 149  */
 150 BOOL
 151 WINAPI
 152 ImpersonateLoggedOnUser(HANDLE hToken)
 153 {
 154     SECURITY_QUALITY_OF_SERVICE Qos;
 155     OBJECT_ATTRIBUTES ObjectAttributes;
 156     HANDLE NewToken;
 157     TOKEN_TYPE Type;
 158     ULONG ReturnLength;
 159     BOOL Duplicated;
 160     NTSTATUS Status;
 161
 162     /* Get the token type */
 163     Status = NtQueryInformationToken(hToken,
 164                                      TokenType,
 165                                      &Type,
 166                                      sizeof(TOKEN_TYPE),
 167                                      &ReturnLength);
 168     if (!NT_SUCCESS(Status))
 169     {
 170         SetLastError(RtlNtStatusToDosError(Status));
 171         return FALSE;
 172     }
 173
 174     if (Type == TokenPrimary)
 175     {
 176         /* Create a duplicate impersonation token */
 177         Qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
 178         Qos.ImpersonationLevel = SecurityImpersonation;
 179         Qos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
 180         Qos.EffectiveOnly = FALSE;
 181
 182         ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
 183         ObjectAttributes.RootDirectory = NULL;
 184         ObjectAttributes.ObjectName = NULL;
 185         ObjectAttributes.Attributes = 0;
 186         ObjectAttributes.SecurityDescriptor = NULL;
 187         ObjectAttributes.SecurityQualityOfService = &Qos;
 188
 189         Status = NtDuplicateToken(hToken,
 190                                   TOKEN_IMPERSONATE | TOKEN_QUERY,
 191                                   &ObjectAttributes,
 192                                   FALSE,
 193                                   TokenImpersonation,
 194                                   &NewToken);
 195         if (!NT_SUCCESS(Status))
 196         {
 197             ERR("NtDuplicateToken failed: Status %08x\n", Status);
 198             SetLastError(RtlNtStatusToDosError(Status));
 199             return FALSE;
 200         }
 201
 202         Duplicated = TRUE;
 203     }
 204     else
 205     {
 206         /* User the original impersonation token */
 207         NewToken = hToken;
 208         Duplicated = FALSE;
 209     }
 210
 211     /* Impersonate the the current thread */
 212     Status = NtSetInformationThread(NtCurrentThread(),
 213                                     ThreadImpersonationToken,
 214                                     &NewToken,
 215                                     sizeof(HANDLE));
 216
 217     if (Duplicated == TRUE)
 218     {
 219         NtClose(NewToken);
 220     }
 221
 222     if (!NT_SUCCESS(Status))
 223     {
 224         ERR("NtSetInformationThread failed: Status %08x\n", Status);
 225         SetLastError(RtlNtStatusToDosError(Status));
 226         return FALSE;
 227     }
 228
 229     return TRUE;
 230 }
 231
 232 /******************************************************************************
 233  * GetUserNameA [ADVAPI32.@]
 234  *
 235  * Get the current user name.
 236  *
 237  * PARAMS
 238  *  lpszName [O]   Destination for the user name.
 239  *  lpSize   [I/O] Size of lpszName.
 240  *
 241  *
 242  * @implemented
 243  */
 244 BOOL
 245 WINAPI
 246 GetUserNameA(LPSTR lpszName,
 247              LPDWORD lpSize)
 248 {
 249     UNICODE_STRING NameW;
 250     ANSI_STRING NameA;
 251     BOOL Ret;
 252
 253     /* apparently Win doesn't check whether lpSize is valid at all! */
 254
 255     NameW.MaximumLength = (*lpSize) * sizeof(WCHAR);
 256     NameW.Buffer = LocalAlloc(LMEM_FIXED, NameW.MaximumLength);
 257     if(NameW.Buffer == NULL)
 258     {
 259         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
 260         return FALSE;
 261     }
 262
 263     NameA.Length = 0;
 264     NameA.MaximumLength = ((*lpSize) < 0xFFFF ? (USHORT)(*lpSize) : 0xFFFF);
 265     NameA.Buffer = lpszName;
 266
 267     Ret = GetUserNameW(NameW.Buffer,
 268                        lpSize);
 269     if(Ret)
 270     {
 271         NameW.Length = (*lpSize - 1) * sizeof(WCHAR);
 272         RtlUnicodeStringToAnsiString(&NameA, &NameW, FALSE);
 273
 274         *lpSize = NameA.Length + 1;
 275     }
 276
 277     LocalFree(NameW.Buffer);
 278
 279     return Ret;
 280 }
 281
 282 /******************************************************************************
 283  * GetUserNameW [ADVAPI32.@]
 284  *
 285  * See GetUserNameA.
 286  *
 287  * @implemented
 288  */
 289 BOOL
 290 WINAPI
 291 GetUserNameW(LPWSTR lpszName,
 292              LPDWORD lpSize)
 293 {
 294     HANDLE hToken = INVALID_HANDLE_VALUE;
 295     DWORD tu_len = 0;
 296     char* tu_buf = NULL;
 297     TOKEN_USER* token_user = NULL;
 298     DWORD an_len = 0;
 299     SID_NAME_USE snu = SidTypeUser;
 300     WCHAR* domain_name = NULL;
 301     DWORD dn_len = 0;
 302
 303     if (!OpenThreadToken (GetCurrentThread(), TOKEN_QUERY, FALSE, &hToken))
 304     {
 305         DWORD dwLastError = GetLastError();
 306         if (dwLastError != ERROR_NO_TOKEN
 307             && dwLastError != ERROR_NO_IMPERSONATION_TOKEN)
 308         {
 309             /* don't call SetLastError(),
 310                as OpenThreadToken() ought to have set one */
 311             return FALSE;
 312         }
 313
 314         if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
 315         {
 316             /* don't call SetLastError(),
 317                as OpenProcessToken() ought to have set one */
 318             return FALSE;
 319         }
 320     }
 321
 322     tu_buf = LocalAlloc(LMEM_FIXED, 36);
 323     if (!tu_buf)
 324     {
 325         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
 326         CloseHandle(hToken);
 327         return FALSE;
 328     }
 329
 330     if (!GetTokenInformation(hToken, TokenUser, tu_buf, 36, &tu_len) || tu_len > 36)
 331     {
 332         LocalFree(tu_buf);
 333         tu_buf = LocalAlloc(LMEM_FIXED, tu_len);
 334         if (!tu_buf)
 335         {
 336             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
 337             CloseHandle(hToken);
 338             return FALSE;
 339         }
 340
 341         if (!GetTokenInformation(hToken, TokenUser, tu_buf, tu_len, &tu_len))
 342         {
 343             /* don't call SetLastError(),
 344                as GetTokenInformation() ought to have set one */
 345             LocalFree(tu_buf);
 346             CloseHandle(hToken);
 347             return FALSE;
 348         }
 349     }
 350
 351     CloseHandle(hToken);
 352     token_user = (TOKEN_USER*)tu_buf;
 353
 354     an_len = *lpSize;
 355     dn_len = 32;
 356     domain_name = LocalAlloc(LMEM_FIXED, dn_len * sizeof(WCHAR));
 357     if (!domain_name)
 358     {
 359         LocalFree(tu_buf);
 360         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
 361         return FALSE;
 362     }
 363
 364     if (!LookupAccountSidW(NULL, token_user->User.Sid, lpszName, &an_len, domain_name, &dn_len, &snu)
 365         || dn_len > 32)
 366     {
 367         if (dn_len > 32)
 368         {
 369             LocalFree(domain_name);
 370             domain_name = LocalAlloc(LMEM_FIXED, dn_len * sizeof(WCHAR));
 371             if (!domain_name)
 372             {
 373                 LocalFree(tu_buf);
 374                 SetLastError(ERROR_NOT_ENOUGH_MEMORY);
 375                 return FALSE;
 376             }
 377         }
 378
 379         an_len = *lpSize;
 380         if (!LookupAccountSidW(NULL, token_user->User.Sid, lpszName, &an_len, domain_name, &dn_len, &snu))
 381         {
 382             /* don't call SetLastError(),
 383                as LookupAccountSid() ought to have set one */
 384             LocalFree(domain_name);
 385             LocalFree(tu_buf);
 386             *lpSize = an_len;
 387             return FALSE;
 388         }
 389     }
 390
 391     LocalFree(domain_name);
 392     LocalFree(tu_buf);
 393     *lpSize = an_len + 1;
 394     return TRUE;
 395 }
 396
 397
 398 /******************************************************************************
 399  * LookupAccountSidA [ADVAPI32.@]
 400  *
 401  * @implemented
 402  */
 403 BOOL
 404 WINAPI
 405 LookupAccountSidA(LPCSTR lpSystemName,
 406                   PSID lpSid,
 407                   LPSTR lpName,
 408                   LPDWORD cchName,
 409                   LPSTR lpReferencedDomainName,
 410                   LPDWORD cchReferencedDomainName,
 411                   PSID_NAME_USE peUse)
 412 {
 413     UNICODE_STRING NameW, ReferencedDomainNameW, SystemNameW;
 414     LPWSTR NameBuffer = NULL;
 415     LPWSTR ReferencedDomainNameBuffer = NULL;
 416     DWORD dwName, dwReferencedDomainName;
 417     BOOL Ret;
 418
 419     /*
 420      * save the buffer sizes the caller passed to us, as they may get modified and
 421      * we require the original values when converting back to ansi
 422      */
 423     dwName = *cchName;
 424     dwReferencedDomainName = *cchReferencedDomainName;
 425
 426     /* allocate buffers for the unicode strings to receive */
 427     if (dwName > 0)
 428     {
 429         NameBuffer = LocalAlloc(LMEM_FIXED, dwName * sizeof(WCHAR));
 430         if (NameBuffer == NULL)
 431         {
 432             SetLastError(ERROR_OUTOFMEMORY);
 433             return FALSE;
 434         }
 435     }
 436     else
 437         NameBuffer = NULL;
 438
 439     if (dwReferencedDomainName > 0)
 440     {
 441         ReferencedDomainNameBuffer = LocalAlloc(LMEM_FIXED, dwReferencedDomainName * sizeof(WCHAR));
 442         if (ReferencedDomainNameBuffer == NULL)
 443         {
 444             if (dwName > 0)
 445             {
 446                 LocalFree(NameBuffer);
 447             }
 448
 449             SetLastError(ERROR_OUTOFMEMORY);
 450             return FALSE;
 451         }
 452     }
 453     else
 454         ReferencedDomainNameBuffer = NULL;
 455
 456
 457     /* convert the system name to unicode - if present */
 458     if (lpSystemName != NULL)
 459     {
 460         ANSI_STRING SystemNameA;
 461
 462         RtlInitAnsiString(&SystemNameA, lpSystemName);
 463         RtlAnsiStringToUnicodeString(&SystemNameW, &SystemNameA, TRUE);
 464     }
 465     else
 466         SystemNameW.Buffer = NULL;
 467
 468     /* it's time to call the unicode version */
 469     Ret = LookupAccountSidW(SystemNameW.Buffer,
 470                             lpSid,
 471                             NameBuffer,
 472                             cchName,
 473                             ReferencedDomainNameBuffer,
 474                             cchReferencedDomainName,
 475                             peUse);
 476     if (Ret)
 477     {
 478         /*
 479          * convert unicode strings back to ansi, don't forget that we can't convert
 480          * more than 0xFFFF (USHORT) characters! Also don't forget to explicitly
 481          * terminate the converted string, the Rtl functions don't do that!
 482          */
 483         if (lpName != NULL)
 484         {
 485             ANSI_STRING NameA;
 486
 487             NameA.Length = 0;
 488             NameA.MaximumLength = ((dwName <= 0xFFFF) ? (USHORT)dwName : 0xFFFF);
 489             NameA.Buffer = lpName;
 490
 491             RtlInitUnicodeString(&NameW, NameBuffer);
 492             RtlUnicodeStringToAnsiString(&NameA, &NameW, FALSE);
 493             NameA.Buffer[NameA.Length] = '\0';
 494         }
 495
 496         if (lpReferencedDomainName != NULL)
 497         {
 498             ANSI_STRING ReferencedDomainNameA;
 499
 500             ReferencedDomainNameA.Length = 0;
 501             ReferencedDomainNameA.MaximumLength = ((dwReferencedDomainName <= 0xFFFF) ?
 502                                                    (USHORT)dwReferencedDomainName : 0xFFFF);
 503             ReferencedDomainNameA.Buffer = lpReferencedDomainName;
 504
 505             RtlInitUnicodeString(&ReferencedDomainNameW, ReferencedDomainNameBuffer);
 506             RtlUnicodeStringToAnsiString(&ReferencedDomainNameA, &ReferencedDomainNameW, FALSE);
 507             ReferencedDomainNameA.Buffer[ReferencedDomainNameA.Length] = '\0';
 508         }
 509     }
 510
 511     /* free previously allocated buffers */
 512     if (SystemNameW.Buffer != NULL)
 513     {
 514         RtlFreeUnicodeString(&SystemNameW);
 515     }
 516
 517     if (NameBuffer != NULL)
 518     {
 519         LocalFree(NameBuffer);
 520     }
 521
 522     if (ReferencedDomainNameBuffer != NULL)
 523     {
 524         LocalFree(ReferencedDomainNameBuffer);
 525     }
 526
 527     return Ret;
 528 }
 529
 530
 531 /******************************************************************************
 532  * LookupAccountSidW [ADVAPI32.@]
 533  *
 534  * @implemented
 535  */
 536 BOOL WINAPI
 537 LookupAccountSidW(LPCWSTR pSystemName,
 538                   PSID pSid,
 539                   LPWSTR pAccountName,
 540                   LPDWORD pdwAccountName,
 541                   LPWSTR pDomainName,
 542                   LPDWORD pdwDomainName,
 543                   PSID_NAME_USE peUse)
 544 {
 545     LSA_UNICODE_STRING SystemName;
 546     LSA_OBJECT_ATTRIBUTES ObjectAttributes = {0};
 547     LSA_HANDLE PolicyHandle = NULL;
 548     NTSTATUS Status;
 549     PLSA_REFERENCED_DOMAIN_LIST ReferencedDomain = NULL;
 550     PLSA_TRANSLATED_NAME TranslatedName = NULL;
 551     BOOL ret;
 552     DWORD dwAccountName, dwDomainName;
 553
 554     RtlInitUnicodeString(&SystemName, pSystemName);
 555     Status = LsaOpenPolicy(&SystemName, &ObjectAttributes, POLICY_LOOKUP_NAMES, &PolicyHandle);
 556     if (!NT_SUCCESS(Status))
 557     {
 558         SetLastError(LsaNtStatusToWinError(Status));
 559         return FALSE;
 560     }
 561
 562     Status = LsaLookupSids(PolicyHandle, 1, &pSid, &ReferencedDomain, &TranslatedName);
 563
 564     LsaClose(PolicyHandle);
 565
 566     if (!NT_SUCCESS(Status) || Status == STATUS_SOME_NOT_MAPPED)
 567     {
 568         SetLastError(LsaNtStatusToWinError(Status));
 569         ret = FALSE;
 570     }
 571     else
 572     {
 573         ret = TRUE;
 574
 575         dwAccountName = TranslatedName->Name.Length / sizeof(WCHAR);
 576         if (ReferencedDomain && ReferencedDomain->Entries > 0)
 577             dwDomainName = ReferencedDomain->Domains[0].Name.Length / sizeof(WCHAR);
 578         else
 579             dwDomainName = 0;
 580
 581         if (*pdwAccountName <= dwAccountName || *pdwDomainName <= dwDomainName)
 582         {
 583             /* One or two buffers are insufficient, add up a char for NULL termination */
 584             *pdwAccountName = dwAccountName + 1;
 585             *pdwDomainName = dwDomainName + 1;
 586             ret = FALSE;
 587         }
 588         else
 589         {
 590             /* Lengths are sufficient, copy the data */
 591             if (dwAccountName)
 592                 RtlCopyMemory(pAccountName, TranslatedName->Name.Buffer, dwAccountName * sizeof(WCHAR));
 593             pAccountName[dwAccountName] = L'\0';
 594
 595             if (dwDomainName)
 596                 RtlCopyMemory(pDomainName, ReferencedDomain->Domains[0].Name.Buffer, dwDomainName * sizeof(WCHAR));
 597             pDomainName[dwDomainName] = L'\0';
 598
 599             *pdwAccountName = dwAccountName;
 600             *pdwDomainName = dwDomainName;
 601
 602             if (peUse)
 603                 *peUse = TranslatedName->Use;
 604         }
 605
 606         if (!ret)
 607             SetLastError(ERROR_INSUFFICIENT_BUFFER);
 608     }
 609
 610     if (ReferencedDomain)
 611         LsaFreeMemory(ReferencedDomain);
 612
 613     if (TranslatedName)
 614         LsaFreeMemory(TranslatedName);
 615
 616     return ret;
 617 }
 618
 619 /******************************************************************************
 620  * LookupAccountNameW [ADVAPI32.@]
 621  *
 622  * @implemented
 623  */
 624 BOOL
 625 WINAPI
 626 LookupAccountNameW(LPCWSTR lpSystemName,
 627                    LPCWSTR lpAccountName,
 628                    PSID Sid,
 629                    LPDWORD cbSid,
 630                    LPWSTR ReferencedDomainName,
 631                    LPDWORD cchReferencedDomainName,
 632                    PSID_NAME_USE peUse)
 633 {
 634     OBJECT_ATTRIBUTES ObjectAttributes = {0};
 635     UNICODE_STRING SystemName;
 636     UNICODE_STRING AccountName;
 637     LSA_HANDLE PolicyHandle = NULL;
 638     PLSA_REFERENCED_DOMAIN_LIST ReferencedDomains = NULL;
 639     PLSA_TRANSLATED_SID TranslatedSid = NULL;
 640     PSID pDomainSid;
 641     DWORD dwDomainNameLength;
 642     DWORD dwSidLength;
 643     UCHAR nSubAuthorities;
 644     BOOL bResult;
 645     NTSTATUS Status;
 646
 647     TRACE("%s %s %p %p %p %p %p\n", lpSystemName, lpAccountName,
 648           Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse);
 649
 650     RtlInitUnicodeString(&SystemName,
 651                          lpSystemName);
 652
 653     Status = LsaOpenPolicy(lpSystemName ? &SystemName : NULL,
 654                            &ObjectAttributes,
 655                            POLICY_LOOKUP_NAMES,
 656                            &PolicyHandle);
 657     if (!NT_SUCCESS(Status))
 658     {
 659         SetLastError(LsaNtStatusToWinError(Status));
 660         return FALSE;
 661     }
 662
 663     RtlInitUnicodeString(&AccountName,
 664                          lpAccountName);
 665
 666     Status = LsaLookupNames(PolicyHandle,
 667                             1,
 668                             &AccountName,
 669                             &ReferencedDomains,
 670                             &TranslatedSid);
 671
 672     LsaClose(PolicyHandle);
 673
 674     if (!NT_SUCCESS(Status) || Status == STATUS_SOME_NOT_MAPPED)
 675     {
 676         SetLastError(LsaNtStatusToWinError(Status));
 677         bResult = FALSE;
 678     }
 679     else
 680     {
 681         pDomainSid = ReferencedDomains->Domains[TranslatedSid->DomainIndex].Sid;
 682         nSubAuthorities = *GetSidSubAuthorityCount(pDomainSid);
 683         dwSidLength = GetSidLengthRequired(nSubAuthorities + 1);
 684
 685         dwDomainNameLength = ReferencedDomains->Domains->Name.Length / sizeof(WCHAR);
 686
 687         if (*cbSid < dwSidLength ||
 688             *cchReferencedDomainName < dwDomainNameLength + 1)
 689         {
 690             *cbSid = dwSidLength;
 691             *cchReferencedDomainName = dwDomainNameLength + 1;
 692
 693             bResult = FALSE;
 694         }
 695         else
 696         {
 697             CopySid(*cbSid, Sid, pDomainSid);
 698             *GetSidSubAuthorityCount(Sid) = nSubAuthorities + 1;
 699             *GetSidSubAuthority(Sid, (DWORD)nSubAuthorities) = TranslatedSid->RelativeId;
 700
 701             RtlCopyMemory(ReferencedDomainName, ReferencedDomains->Domains->Name.Buffer, dwDomainNameLength * sizeof(WCHAR));
 702             ReferencedDomainName[dwDomainNameLength] = L'\0';
 703
 704             *cchReferencedDomainName = dwDomainNameLength;
 705
 706             *peUse = TranslatedSid->Use;
 707
 708             bResult = TRUE;
 709         }
 710
 711         if (bResult == FALSE)
 712             SetLastError(ERROR_INSUFFICIENT_BUFFER);
 713     }
 714
 715     if (ReferencedDomains != NULL)
 716         LsaFreeMemory(ReferencedDomains);
 717
 718     if (TranslatedSid != NULL)
 719         LsaFreeMemory(TranslatedSid);
 720
 721     return bResult;
 722 }
 723
 724
 725 /**********************************************************************
 726  * LookupPrivilegeValueA                                EXPORTED
 727  *
 728  * @implemented
 729  */
 730 BOOL
 731 WINAPI
 732 LookupPrivilegeValueA(LPCSTR lpSystemName,
 733                       LPCSTR lpName,
 734                       PLUID lpLuid)
 735 {
 736     UNICODE_STRING SystemName;
 737     UNICODE_STRING Name;
 738     BOOL Result;
 739
 740     /* Remote system? */
 741     if (lpSystemName != NULL)
 742     {
 743         RtlCreateUnicodeStringFromAsciiz(&SystemName,
 744                                          (LPSTR)lpSystemName);
 745     }
 746     else
 747         SystemName.Buffer = NULL;
 748
 749     /* Check the privilege name is not NULL */
 750     if (lpName == NULL)
 751     {
 752         SetLastError(ERROR_NO_SUCH_PRIVILEGE);
 753         return FALSE;
 754     }
 755
 756     RtlCreateUnicodeStringFromAsciiz(&Name,
 757                                      (LPSTR)lpName);
 758
 759     Result = LookupPrivilegeValueW(SystemName.Buffer,
 760                                    Name.Buffer,
 761                                    lpLuid);
 762
 763     RtlFreeUnicodeString(&Name);
 764
 765     /* Remote system? */
 766     if (SystemName.Buffer != NULL)
 767     {
 768         RtlFreeUnicodeString(&SystemName);
 769     }
 770
 771     return Result;
 772 }
 773
 774
 775 /**********************************************************************
 776  * LookupPrivilegeValueW
 777  *
 778  * @implemented
 779  */
 780 BOOL
 781 WINAPI
 782 LookupPrivilegeValueW(LPCWSTR lpSystemName,
 783                       LPCWSTR lpPrivilegeName,
 784                       PLUID lpLuid)
 785 {
 786     OBJECT_ATTRIBUTES ObjectAttributes = {0};
 787     UNICODE_STRING SystemName;
 788     UNICODE_STRING PrivilegeName;
 789     LSA_HANDLE PolicyHandle = NULL;
 790     NTSTATUS Status;
 791
 792     TRACE("%S,%S,%p\n", lpSystemName, lpPrivilegeName, lpLuid);
 793
 794     RtlInitUnicodeString(&SystemName,
 795                          lpSystemName);
 796
 797     Status = LsaOpenPolicy(lpSystemName ? &SystemName : NULL,
 798                            &ObjectAttributes,
 799                            POLICY_LOOKUP_NAMES,
 800                            &PolicyHandle);
 801     if (!NT_SUCCESS(Status))
 802     {
 803         SetLastError(LsaNtStatusToWinError(Status));
 804         return FALSE;
 805     }
 806
 807     RtlInitUnicodeString(&PrivilegeName,
 808                          lpPrivilegeName);
 809
 810     Status = LsaLookupPrivilegeValue(PolicyHandle,
 811                                      &PrivilegeName,
 812                                      lpLuid);
 813
 814     LsaClose(PolicyHandle);
 815
 816     if (!NT_SUCCESS(Status))
 817     {
 818         SetLastError(LsaNtStatusToWinError(Status));
 819         return FALSE;
 820     }
 821
 822     return TRUE;
 823 }
 824
 825 /**********************************************************************
 826  * LookupPrivilegeNameW                         EXPORTED
 827  *
 828  * @implemented
 829  */
 830 BOOL
 831 WINAPI
 832 LookupPrivilegeNameW(LPCWSTR lpSystemName,
 833                      PLUID lpLuid,
 834                      LPWSTR lpName,
 835                      LPDWORD cchName)
 836 {
 837     OBJECT_ATTRIBUTES ObjectAttributes = {0};
 838     UNICODE_STRING SystemName;
 839     PUNICODE_STRING PrivilegeName = NULL;
 840     LSA_HANDLE PolicyHandle = NULL;
 841     NTSTATUS Status;
 842
 843     TRACE("%S,%p,%p,%p\n", lpSystemName, lpLuid, lpName, cchName);
 844
 845     RtlInitUnicodeString(&SystemName,
 846                          lpSystemName);
 847
 848     Status = LsaOpenPolicy(lpSystemName ? &SystemName : NULL,
 849                            &ObjectAttributes,
 850                            POLICY_LOOKUP_NAMES,
 851                            &PolicyHandle);
 852     if (!NT_SUCCESS(Status))
 853     {
 854         SetLastError(LsaNtStatusToWinError(Status));
 855         return FALSE;
 856     }
 857
 858     Status = LsaLookupPrivilegeName(PolicyHandle,
 859                                     lpLuid,
 860                                     &PrivilegeName);
 861     if (NT_SUCCESS(Status))
 862     {
 863         if (PrivilegeName->Length + sizeof(WCHAR) > *cchName * sizeof(WCHAR))
 864         {
 865             Status = STATUS_BUFFER_TOO_SMALL;
 866
 867             *cchName = (PrivilegeName->Length + sizeof(WCHAR)) / sizeof(WCHAR);
 868         }
 869         else
 870         {
 871             RtlMoveMemory(lpName,
 872                           PrivilegeName->Buffer,
 873                           PrivilegeName->Length);
 874             lpName[PrivilegeName->Length / sizeof(WCHAR)] = 0;
 875
 876             *cchName = PrivilegeName->Length / sizeof(WCHAR);
 877         }
 878
 879         LsaFreeMemory(PrivilegeName->Buffer);
 880         LsaFreeMemory(PrivilegeName);
 881     }
 882
 883     LsaClose(PolicyHandle);
 884
 885     if (!NT_SUCCESS(Status))
 886     {
 887         SetLastError(LsaNtStatusToWinError(Status));
 888         return FALSE;
 889     }
 890
 891     return TRUE;
 892 }
 893
 894 /**********************************************************************
 895  * LookupPrivilegeDisplayNameW                  EXPORTED
 896  *
 897  * @unimplemented
 898  */
 899 BOOL
 900 WINAPI
 901 LookupPrivilegeDisplayNameW(LPCWSTR lpSystemName,
 902                             LPCWSTR lpName,
 903                             LPWSTR lpDisplayName,
 904                             LPDWORD cchDisplayName,
 905                             LPDWORD lpLanguageId)
 906 {
 907     OBJECT_ATTRIBUTES ObjectAttributes = {0};
 908     UNICODE_STRING SystemName, Name;
 909     PUNICODE_STRING DisplayName;
 910     LSA_HANDLE PolicyHandle = NULL;
 911     USHORT LanguageId;
 912     NTSTATUS Status;
 913
 914     TRACE("%S,%S,%p,%p,%p\n", lpSystemName, lpName, lpDisplayName, cchDisplayName, lpLanguageId);
 915
 916     RtlInitUnicodeString(&SystemName, lpSystemName);
 917     RtlInitUnicodeString(&Name, lpName);
 918
 919     Status = LsaOpenPolicy(lpSystemName ? &SystemName : NULL,
 920                            &ObjectAttributes,
 921                            POLICY_LOOKUP_NAMES,
 922                            &PolicyHandle);
 923     if (!NT_SUCCESS(Status))
 924     {
 925         SetLastError(LsaNtStatusToWinError(Status));
 926         return FALSE;
 927     }
 928
 929     Status = LsaLookupPrivilegeDisplayName(PolicyHandle, &Name, &DisplayName, &LanguageId);
 930     if (NT_SUCCESS(Status))
 931     {
 932         *lpLanguageId = LanguageId;
 933         if (DisplayName->Length + sizeof(WCHAR) > *cchDisplayName * sizeof(WCHAR))
 934         {
 935             Status = STATUS_BUFFER_TOO_SMALL;
 936
 937             *cchDisplayName = (DisplayName->Length + sizeof(WCHAR)) / sizeof(WCHAR);
 938         }
 939         else
 940         {
 941             RtlMoveMemory(lpDisplayName,
 942                           DisplayName->Buffer,
 943                           DisplayName->Length);
 944             lpDisplayName[DisplayName->Length / sizeof(WCHAR)] = 0;
 945
 946             *cchDisplayName = DisplayName->Length / sizeof(WCHAR);
 947         }
 948
 949         LsaFreeMemory(DisplayName->Buffer);
 950         LsaFreeMemory(DisplayName);
 951     }
 952
 953     LsaClose(PolicyHandle);
 954
 955     if (!NT_SUCCESS(Status))
 956     {
 957         SetLastError(LsaNtStatusToWinError(Status));
 958         return FALSE;
 959     }
 960
 961     return TRUE;
 962 }
 963
 964 static DWORD
 965 pGetSecurityInfoCheck(SECURITY_INFORMATION SecurityInfo,
 966                       PSID *ppsidOwner,
 967                       PSID *ppsidGroup,
 968                       PACL *ppDacl,
 969                       PACL *ppSacl,
 970                       PSECURITY_DESCRIPTOR* ppSecurityDescriptor)
 971 {
 972     if ((SecurityInfo & (OWNER_SECURITY_INFORMATION |
 973                          GROUP_SECURITY_INFORMATION |
 974                          DACL_SECURITY_INFORMATION |
 975                          SACL_SECURITY_INFORMATION)) &&
 976         ppSecurityDescriptor == NULL)
 977     {
 978         /* if one of the SIDs or ACLs are present, the security descriptor
 979            most not be NULL */
 980         return ERROR_INVALID_PARAMETER;
 981     }
 982     else
 983     {
 984         /* reset the pointers unless they're ignored */
 985         if ((SecurityInfo & OWNER_SECURITY_INFORMATION) &&
 986             ppsidOwner != NULL)
 987         {
 988             *ppsidOwner = NULL;
 989         }
 990         if ((SecurityInfo & GROUP_SECURITY_INFORMATION) &&
 991             ppsidGroup != NULL)
 992         {
 993             *ppsidGroup = NULL;
 994         }
 995         if ((SecurityInfo & DACL_SECURITY_INFORMATION) &&
 996             ppDacl != NULL)
 997         {
 998             *ppDacl = NULL;
 999         }
1000         if ((SecurityInfo & SACL_SECURITY_INFORMATION) &&
1001             ppSacl != NULL)
1002         {
1003             *ppSacl = NULL;
1004         }
1005
1006         if (SecurityInfo & (OWNER_SECURITY_INFORMATION |
1007                             GROUP_SECURITY_INFORMATION |
1008                             DACL_SECURITY_INFORMATION |
1009                             SACL_SECURITY_INFORMATION))
1010         {
1011             *ppSecurityDescriptor = NULL;
1012         }
1013
1014         return ERROR_SUCCESS;
1015     }
1016 }
1017
1018
1019 static DWORD
1020 pSetSecurityInfoCheck(PSECURITY_DESCRIPTOR pSecurityDescriptor,
1021                       SECURITY_INFORMATION SecurityInfo,
1022                       PSID psidOwner,
1023                       PSID psidGroup,
1024                       PACL pDacl,
1025                       PACL pSacl)
1026 {
1027     /* initialize a security descriptor on the stack */
1028     if (!InitializeSecurityDescriptor(pSecurityDescriptor,
1029                                       SECURITY_DESCRIPTOR_REVISION))
1030     {
1031         return GetLastError();
1032     }
1033
1034     if (SecurityInfo & OWNER_SECURITY_INFORMATION)
1035     {
1036         if (RtlValidSid(psidOwner))
1037         {
1038             if (!SetSecurityDescriptorOwner(pSecurityDescriptor,
1039                                             psidOwner,
1040                                             FALSE))
1041             {
1042                 return GetLastError();
1043             }
1044         }
1045         else
1046         {
1047             return ERROR_INVALID_PARAMETER;
1048         }
1049     }
1050
1051     if (SecurityInfo & GROUP_SECURITY_INFORMATION)
1052     {
1053         if (RtlValidSid(psidGroup))
1054         {
1055             if (!SetSecurityDescriptorGroup(pSecurityDescriptor,
1056                                             psidGroup,
1057                                             FALSE))
1058             {
1059                 return GetLastError();
1060             }
1061         }
1062         else
1063         {
1064             return ERROR_INVALID_PARAMETER;
1065         }
1066     }
1067
1068     if (SecurityInfo & DACL_SECURITY_INFORMATION)
1069     {
1070         if (pDacl != NULL)
1071         {
1072             if (SetSecurityDescriptorDacl(pSecurityDescriptor,
1073                                           TRUE,
1074                                           pDacl,
1075                                           FALSE))
1076             {
1077                 /* check if the DACL needs to be protected from being
1078                    modified by inheritable ACEs */
1079                 if (SecurityInfo & PROTECTED_DACL_SECURITY_INFORMATION)
1080                 {
1081                     goto ProtectDacl;
1082                 }
1083             }
1084             else
1085             {
1086                 return GetLastError();
1087             }
1088         }
1089         else
1090         {
1091 ProtectDacl:
1092             /* protect the DACL from being modified by inheritable ACEs */
1093             if (!SetSecurityDescriptorControl(pSecurityDescriptor,
1094                                               SE_DACL_PROTECTED,
1095                                               SE_DACL_PROTECTED))
1096             {
1097                 return GetLastError();
1098             }
1099         }
1100     }
1101
1102     if (SecurityInfo & SACL_SECURITY_INFORMATION)
1103     {
1104         if (pSacl != NULL)
1105         {
1106             if (SetSecurityDescriptorSacl(pSecurityDescriptor,
1107                                           TRUE,
1108                                           pSacl,
1109                                           FALSE))
1110             {
1111                 /* check if the SACL needs to be protected from being
1112                    modified by inheritable ACEs */
1113                 if (SecurityInfo & PROTECTED_SACL_SECURITY_INFORMATION)
1114                 {
1115                     goto ProtectSacl;
1116                 }
1117             }
1118             else
1119             {
1120                 return GetLastError();
1121             }
1122         }
1123         else
1124         {
1125 ProtectSacl:
1126             /* protect the SACL from being modified by inheritable ACEs */
1127             if (!SetSecurityDescriptorControl(pSecurityDescriptor,
1128                                               SE_SACL_PROTECTED,
1129                                               SE_SACL_PROTECTED))
1130             {
1131                 return GetLastError();
1132             }
1133         }
1134     }
1135
1136     return ERROR_SUCCESS;
1137 }
1138
1139
1140 /**********************************************************************
1141  * GetNamedSecurityInfoW                        EXPORTED
1142  *
1143  * @implemented
1144  */
1145 DWORD
1146 WINAPI
1147 GetNamedSecurityInfoW(LPWSTR pObjectName,
1148                       SE_OBJECT_TYPE ObjectType,
1149                       SECURITY_INFORMATION SecurityInfo,
1150                       PSID *ppsidOwner,
1151                       PSID *ppsidGroup,
1152                       PACL *ppDacl,
1153                       PACL *ppSacl,
1154                       PSECURITY_DESCRIPTOR *ppSecurityDescriptor)
1155 {
1156     DWORD ErrorCode;
1157
1158     if (pObjectName != NULL)
1159     {
1160         ErrorCode = CheckNtMartaPresent();
1161         if (ErrorCode == ERROR_SUCCESS)
1162         {
1163             ErrorCode = pGetSecurityInfoCheck(SecurityInfo,
1164                                               ppsidOwner,
1165                                               ppsidGroup,
1166                                               ppDacl,
1167                                               ppSacl,
1168                                               ppSecurityDescriptor);
1169
1170             if (ErrorCode == ERROR_SUCCESS)
1171             {
1172                 /* call the MARTA provider */
1173                 ErrorCode = AccRewriteGetNamedRights(pObjectName,
1174                                                      ObjectType,
1175                                                      SecurityInfo,
1176                                                      ppsidOwner,
1177                                                      ppsidGroup,
1178                                                      ppDacl,
1179                                                      ppSacl,
1180                                                      ppSecurityDescriptor);
1181             }
1182         }
1183     }
1184     else
1185         ErrorCode = ERROR_INVALID_PARAMETER;
1186
1187     return ErrorCode;
1188 }
1189
1190 /**********************************************************************
1191  * SetNamedSecurityInfoW                        EXPORTED
1192  *
1193  * @implemented
1194  */
1195 DWORD
1196 WINAPI
1197 SetNamedSecurityInfoW(LPWSTR pObjectName,
1198                       SE_OBJECT_TYPE ObjectType,
1199                       SECURITY_INFORMATION SecurityInfo,
1200                       PSID psidOwner,
1201                       PSID psidGroup,
1202                       PACL pDacl,
1203                       PACL pSacl)
1204 {
1205     DWORD ErrorCode;
1206
1207     if (pObjectName != NULL)
1208     {
1209         ErrorCode = CheckNtMartaPresent();
1210         if (ErrorCode == ERROR_SUCCESS)
1211         {
1212             SECURITY_DESCRIPTOR SecurityDescriptor;
1213
1214             ErrorCode = pSetSecurityInfoCheck(&SecurityDescriptor,
1215                                               SecurityInfo,
1216                                               psidOwner,
1217                                               psidGroup,
1218                                               pDacl,
1219                                               pSacl);
1220
1221             if (ErrorCode == ERROR_SUCCESS)
1222             {
1223                 /* call the MARTA provider */
1224                 ErrorCode = AccRewriteSetNamedRights(pObjectName,
1225                                                      ObjectType,
1226                                                      SecurityInfo,
1227                                                      &SecurityDescriptor);
1228             }
1229         }
1230     }
1231     else
1232         ErrorCode = ERROR_INVALID_PARAMETER;
1233
1234     return ErrorCode;
1235 }
1236
1237 /**********************************************************************
1238  * GetSecurityInfo                              EXPORTED
1239  *
1240  * @implemented
1241  */
1242 DWORD
1243 WINAPI
1244 GetSecurityInfo(HANDLE handle,
1245                 SE_OBJECT_TYPE ObjectType,
1246                 SECURITY_INFORMATION SecurityInfo,
1247                 PSID *ppsidOwner,
1248                 PSID *ppsidGroup,
1249                 PACL *ppDacl,
1250                 PACL *ppSacl,
1251                 PSECURITY_DESCRIPTOR *ppSecurityDescriptor)
1252 {
1253     DWORD ErrorCode;
1254
1255     if (handle != NULL)
1256     {
1257         ErrorCode = CheckNtMartaPresent();
1258         if (ErrorCode == ERROR_SUCCESS)
1259         {
1260             ErrorCode = pGetSecurityInfoCheck(SecurityInfo,
1261                                               ppsidOwner,
1262                                               ppsidGroup,
1263                                               ppDacl,
1264                                               ppSacl,
1265                                               ppSecurityDescriptor);
1266
1267             if (ErrorCode == ERROR_SUCCESS)
1268             {
1269                 /* call the MARTA provider */
1270                 ErrorCode = AccRewriteGetHandleRights(handle,
1271                                                       ObjectType,
1272                                                       SecurityInfo,
1273                                                       ppsidOwner,
1274                                                       ppsidGroup,
1275                                                       ppDacl,
1276                                                       ppSacl,
1277                                                       ppSecurityDescriptor);
1278             }
1279         }
1280     }
1281     else
1282         ErrorCode = ERROR_INVALID_HANDLE;
1283
1284     return ErrorCode;
1285 }
1286
1287
1288 /**********************************************************************
1289  * SetSecurityInfo                              EXPORTED
1290  *
1291  * @implemented
1292  */
1293 DWORD
1294 WINAPI
1295 SetSecurityInfo(HANDLE handle,
1296                 SE_OBJECT_TYPE ObjectType,
1297                 SECURITY_INFORMATION SecurityInfo,
1298                 PSID psidOwner,
1299                 PSID psidGroup,
1300                 PACL pDacl,
1301                 PACL pSacl)
1302 {
1303     DWORD ErrorCode;
1304
1305     if (handle != NULL)
1306     {
1307         ErrorCode = CheckNtMartaPresent();
1308         if (ErrorCode == ERROR_SUCCESS)
1309         {
1310             SECURITY_DESCRIPTOR SecurityDescriptor;
1311
1312             ErrorCode = pSetSecurityInfoCheck(&SecurityDescriptor,
1313                                               SecurityInfo,
1314                                               psidOwner,
1315                                               psidGroup,
1316                                               pDacl,
1317                                               pSacl);
1318
1319             if (ErrorCode == ERROR_SUCCESS)
1320             {
1321                 /* call the MARTA provider */
1322                 ErrorCode = AccRewriteSetHandleRights(handle,
1323                                                       ObjectType,
1324                                                       SecurityInfo,
1325                                                       &SecurityDescriptor);
1326             }
1327         }
1328     }
1329     else
1330         ErrorCode = ERROR_INVALID_HANDLE;
1331
1332     return ErrorCode;
1333 }
1334
1335 /*
1336  * @implemented
1337  */
1338 BOOL
1339 WINAPI
1340 CreatePrivateObjectSecurity(PSECURITY_DESCRIPTOR ParentDescriptor,
1341                             PSECURITY_DESCRIPTOR CreatorDescriptor,
1342                             PSECURITY_DESCRIPTOR *NewDescriptor,
1343                             BOOL IsDirectoryObject,
1344                             HANDLE Token,
1345                             PGENERIC_MAPPING GenericMapping)
1346 {
1347     NTSTATUS Status;
1348
1349     Status = RtlNewSecurityObject(ParentDescriptor,
1350                                   CreatorDescriptor,
1351                                   NewDescriptor,
1352                                   IsDirectoryObject,
1353                                   Token,
1354                                   GenericMapping);
1355     if (!NT_SUCCESS(Status))
1356     {
1357         SetLastError(RtlNtStatusToDosError(Status));
1358         return FALSE;
1359     }
1360
1361     return TRUE;
1362 }
1363
1364
1365 /*
1366  * @unimplemented
1367  */
1368 BOOL
1369 WINAPI
1370 CreatePrivateObjectSecurityEx(PSECURITY_DESCRIPTOR ParentDescriptor,
1371                               PSECURITY_DESCRIPTOR CreatorDescriptor,
1372                               PSECURITY_DESCRIPTOR* NewDescriptor,
1373                               GUID* ObjectType,
1374                               BOOL IsContainerObject,
1375                               ULONG AutoInheritFlags,
1376                               HANDLE Token,
1377                               PGENERIC_MAPPING GenericMapping)
1378 {
1379     FIXME("%s() not implemented!\n", __FUNCTION__);
1380     return FALSE;
1381 }
1382
1383
1384 /*
1385  * @unimplemented
1386  */
1387 BOOL
1388 WINAPI
1389 CreatePrivateObjectSecurityWithMultipleInheritance(PSECURITY_DESCRIPTOR ParentDescriptor,
1390                                                    PSECURITY_DESCRIPTOR CreatorDescriptor,
1391                                                    PSECURITY_DESCRIPTOR* NewDescriptor,
1392                                                    GUID** ObjectTypes,
1393                                                    ULONG GuidCount,
1394                                                    BOOL IsContainerObject,
1395                                                    ULONG AutoInheritFlags,
1396                                                    HANDLE Token,
1397                                                    PGENERIC_MAPPING GenericMapping)
1398 {
1399     FIXME("%s() not implemented!\n", __FUNCTION__);
1400     return FALSE;
1401 }
1402
1403
1404 /*
1405  * @implemented
1406  */
1407 BOOL
1408 WINAPI
1409 DestroyPrivateObjectSecurity(PSECURITY_DESCRIPTOR *ObjectDescriptor)
1410 {
1411     NTSTATUS Status;
1412
1413     Status = RtlDeleteSecurityObject(ObjectDescriptor);
1414     if (!NT_SUCCESS(Status))
1415     {
1416         SetLastError(RtlNtStatusToDosError(Status));
1417         return FALSE;
1418     }
1419
1420     return TRUE;
1421 }
1422
1423
1424 /*
1425  * @implemented
1426  */
1427 BOOL
1428 WINAPI
1429 GetPrivateObjectSecurity(IN PSECURITY_DESCRIPTOR ObjectDescriptor,
1430                          IN SECURITY_INFORMATION SecurityInformation,
1431                          OUT PSECURITY_DESCRIPTOR ResultantDescriptor OPTIONAL,
1432                          IN DWORD DescriptorLength,
1433                          OUT PDWORD ReturnLength)
1434 {
1435     NTSTATUS Status;
1436
1437     /* Call RTL */
1438     Status = RtlQuerySecurityObject(ObjectDescriptor,
1439                                     SecurityInformation,
1440                                     ResultantDescriptor,
1441                                     DescriptorLength,
1442                                     ReturnLength);
1443     if (!NT_SUCCESS(Status))
1444     {
1445         /* Fail */
1446         SetLastError(RtlNtStatusToDosError(Status));
1447         return FALSE;
1448     }
1449
1450     /* Success */
1451     return TRUE;
1452 }
1453
1454
1455 /*
1456  * @implemented
1457  */
1458 BOOL
1459 WINAPI
1460 SetPrivateObjectSecurity(SECURITY_INFORMATION SecurityInformation,
1461                          PSECURITY_DESCRIPTOR ModificationDescriptor,
1462                          PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
1463                          PGENERIC_MAPPING GenericMapping,
1464                          HANDLE Token)
1465 {
1466     NTSTATUS Status;
1467
1468     Status = RtlSetSecurityObject(SecurityInformation,
1469                                   ModificationDescriptor,
1470                                   ObjectsSecurityDescriptor,
1471                                   GenericMapping,
1472                                   Token);
1473     if (!NT_SUCCESS(Status))
1474     {
1475         SetLastError(RtlNtStatusToDosError(Status));
1476         return FALSE;
1477     }
1478
1479     return TRUE;
1480 }
1481
1482
1483 /*
1484  * @implemented
1485  */
1486 DWORD
1487 WINAPI
1488 TreeResetNamedSecurityInfoW(LPWSTR pObjectName,
1489                             SE_OBJECT_TYPE ObjectType,
1490                             SECURITY_INFORMATION SecurityInfo,
1491                             PSID pOwner,
1492                             PSID pGroup,
1493                             PACL pDacl,
1494                             PACL pSacl,
1495                             BOOL KeepExplicit,
1496                             FN_PROGRESSW fnProgress,
1497                             PROG_INVOKE_SETTING ProgressInvokeSetting,
1498                             PVOID Args)
1499 {
1500     DWORD ErrorCode;
1501
1502     if (pObjectName != NULL)
1503     {
1504         ErrorCode = CheckNtMartaPresent();
1505         if (ErrorCode == ERROR_SUCCESS)
1506         {
1507             switch (ObjectType)
1508             {
1509                 case SE_FILE_OBJECT:
1510                 case SE_REGISTRY_KEY:
1511                 {
1512                     /* check the SecurityInfo flags for sanity (both, the protected
1513                        and unprotected dacl/sacl flag must not be passed together) */
1514                     if (((SecurityInfo & DACL_SECURITY_INFORMATION) &&
1515                          (SecurityInfo & (PROTECTED_DACL_SECURITY_INFORMATION | UNPROTECTED_DACL_SECURITY_INFORMATION)) ==
1516                              (PROTECTED_DACL_SECURITY_INFORMATION | UNPROTECTED_DACL_SECURITY_INFORMATION))
1517
1518                         ||
1519
1520                         ((SecurityInfo & SACL_SECURITY_INFORMATION) &&
1521                          (SecurityInfo & (PROTECTED_SACL_SECURITY_INFORMATION | UNPROTECTED_SACL_SECURITY_INFORMATION)) ==
1522                              (PROTECTED_SACL_SECURITY_INFORMATION | UNPROTECTED_SACL_SECURITY_INFORMATION)))
1523                     {
1524                         ErrorCode = ERROR_INVALID_PARAMETER;
1525                         break;
1526                     }
1527
1528                     /* call the MARTA provider */
1529                     ErrorCode = AccTreeResetNamedSecurityInfo(pObjectName,
1530                                                               ObjectType,
1531                                                               SecurityInfo,
1532                                                               pOwner,
1533                                                               pGroup,
1534                                                               pDacl,
1535                                                               pSacl,
1536                                                               KeepExplicit,
1537                                                               fnProgress,
1538                                                               ProgressInvokeSetting,
1539                                                               Args);
1540                     break;
1541                 }
1542
1543                 default:
1544                     /* object type not supported */
1545                     ErrorCode = ERROR_INVALID_PARAMETER;
1546                     break;
1547             }
1548         }
1549     }
1550     else
1551         ErrorCode = ERROR_INVALID_PARAMETER;
1552
1553     return ErrorCode;
1554 }
1555
1556 #ifdef HAS_FN_PROGRESSW
1557
1558 typedef struct _INERNAL_FNPROGRESSW_DATA
1559 {
1560     FN_PROGRESSA fnProgress;
1561     PVOID Args;
1562 } INERNAL_FNPROGRESSW_DATA, *PINERNAL_FNPROGRESSW_DATA;
1563
1564 static VOID WINAPI
1565 InternalfnProgressW(LPWSTR pObjectName,
1566                     DWORD Status,
1567                     PPROG_INVOKE_SETTING pInvokeSetting,
1568                     PVOID Args,
1569                     BOOL SecuritySet)
1570 {
1571     PINERNAL_FNPROGRESSW_DATA pifnProgressData = (PINERNAL_FNPROGRESSW_DATA)Args;
1572     INT ObjectNameSize;
1573     LPSTR pObjectNameA;
1574
1575     ObjectNameSize = WideCharToMultiByte(CP_ACP,
1576                                          0,
1577                                          pObjectName,
1578                                          -1,
1579                                          NULL,
1580                                          0,
1581                                          NULL,
1582                                          NULL);
1583
1584     if (ObjectNameSize > 0)
1585     {
1586         pObjectNameA = RtlAllocateHeap(RtlGetProcessHeap(),
1587                                        0,
1588                                        ObjectNameSize);
1589         if (pObjectNameA != NULL)
1590         {
1591             pObjectNameA[0] = '\0';
1592             WideCharToMultiByte(CP_ACP,
1593                                 0,
1594                                 pObjectName,
1595                                 -1,
1596                                 pObjectNameA,
1597                                 ObjectNameSize,
1598                                 NULL,
1599                                 NULL);
1600
1601             pifnProgressData->fnProgress((LPWSTR)pObjectNameA, /* FIXME: wrong cast!! */
1602                                          Status,
1603                                          pInvokeSetting,
1604                                          pifnProgressData->Args,
1605                                          SecuritySet);
1606
1607             RtlFreeHeap(RtlGetProcessHeap(),
1608                         0,
1609                         pObjectNameA);
1610         }
1611     }
1612 }
1613 #endif
1614
1615
1616 /*
1617  * @implemented
1618  */
1619 DWORD
1620 WINAPI
1621 TreeResetNamedSecurityInfoA(LPSTR pObjectName,
1622                             SE_OBJECT_TYPE ObjectType,
1623                             SECURITY_INFORMATION SecurityInfo,
1624                             PSID pOwner,
1625                             PSID pGroup,
1626                             PACL pDacl,
1627                             PACL pSacl,
1628                             BOOL KeepExplicit,
1629                             FN_PROGRESSA fnProgress,
1630                             PROG_INVOKE_SETTING ProgressInvokeSetting,
1631                             PVOID Args)
1632 {
1633 #ifndef HAS_FN_PROGRESSW
1634     /* That's all this function does, at least up to w2k3... Even MS was too
1635        lazy to implement it... */
1636     return ERROR_CALL_NOT_IMPLEMENTED;
1637 #else
1638     INERNAL_FNPROGRESSW_DATA ifnProgressData;
1639     UNICODE_STRING ObjectName;
1640     DWORD Ret;
1641
1642     if (!RtlCreateUnicodeStringFromAsciiz(&ObjectName, pObjectName))
1643     {
1644         return ERROR_NOT_ENOUGH_MEMORY;
1645     }
1646
1647     ifnProgressData.fnProgress = fnProgress;
1648     ifnProgressData.Args = Args;
1649
1650     Ret = TreeResetNamedSecurityInfoW(ObjectName.Buffer,
1651                                       ObjectType,
1652                                       SecurityInfo,
1653                                       pOwner,
1654                                       pGroup,
1655                                       pDacl,
1656                                       pSacl,
1657                                       KeepExplicit,
1658                                       (fnProgress != NULL ? InternalfnProgressW : NULL),
1659                                       ProgressInvokeSetting,
1660                                       &ifnProgressData);
1661
1662     RtlFreeUnicodeString(&ObjectName);
1663
1664     return Ret;
1665 #endif
1666 }
1667
1668 /* EOF */