[LSASRV]
[reactos.git] / reactos / dll / win32 / lsasrv / privileges.c
1 /*
2 * COPYRIGHT: See COPYING in the top level directory
3 * PROJECT: Local Security Authority (LSA) Server
4 * FILE: reactos/dll/win32/lsasrv/privileges.c
5 * PURPOSE: Privilege lookup functions
6 *
7 * PROGRAMMERS: Eric Kohl
8 */
9
10 #include "lsasrv.h"
11
12 WINE_DEFAULT_DEBUG_CHANNEL(lsasrv);
13
14
15 typedef struct
16 {
17 LUID Luid;
18 LPCWSTR Name;
19 } PRIVILEGE_DATA;
20
21 typedef struct
22 {
23 ULONG Flag;
24 LPCWSTR Name;
25 } RIGHT_DATA;
26
27
28 /* GLOBALS *****************************************************************/
29
30 static const PRIVILEGE_DATA WellKnownPrivileges[] =
31 {
32 {{SE_CREATE_TOKEN_PRIVILEGE, 0}, SE_CREATE_TOKEN_NAME},
33 {{SE_ASSIGNPRIMARYTOKEN_PRIVILEGE, 0}, SE_ASSIGNPRIMARYTOKEN_NAME},
34 {{SE_LOCK_MEMORY_PRIVILEGE, 0}, SE_LOCK_MEMORY_NAME},
35 {{SE_INCREASE_QUOTA_PRIVILEGE, 0}, SE_INCREASE_QUOTA_NAME},
36 {{SE_MACHINE_ACCOUNT_PRIVILEGE, 0}, SE_MACHINE_ACCOUNT_NAME},
37 {{SE_TCB_PRIVILEGE, 0}, SE_TCB_NAME},
38 {{SE_SECURITY_PRIVILEGE, 0}, SE_SECURITY_NAME},
39 {{SE_TAKE_OWNERSHIP_PRIVILEGE, 0}, SE_TAKE_OWNERSHIP_NAME},
40 {{SE_LOAD_DRIVER_PRIVILEGE, 0}, SE_LOAD_DRIVER_NAME},
41 {{SE_SYSTEM_PROFILE_PRIVILEGE, 0}, SE_SYSTEM_PROFILE_NAME},
42 {{SE_SYSTEMTIME_PRIVILEGE, 0}, SE_SYSTEMTIME_NAME},
43 {{SE_PROF_SINGLE_PROCESS_PRIVILEGE, 0}, SE_PROF_SINGLE_PROCESS_NAME},
44 {{SE_INC_BASE_PRIORITY_PRIVILEGE, 0}, SE_INC_BASE_PRIORITY_NAME},
45 {{SE_CREATE_PAGEFILE_PRIVILEGE, 0}, SE_CREATE_PAGEFILE_NAME},
46 {{SE_CREATE_PERMANENT_PRIVILEGE, 0}, SE_CREATE_PERMANENT_NAME},
47 {{SE_BACKUP_PRIVILEGE, 0}, SE_BACKUP_NAME},
48 {{SE_RESTORE_PRIVILEGE, 0}, SE_RESTORE_NAME},
49 {{SE_SHUTDOWN_PRIVILEGE, 0}, SE_SHUTDOWN_NAME},
50 {{SE_DEBUG_PRIVILEGE, 0}, SE_DEBUG_NAME},
51 {{SE_AUDIT_PRIVILEGE, 0}, SE_AUDIT_NAME},
52 {{SE_SYSTEM_ENVIRONMENT_PRIVILEGE, 0}, SE_SYSTEM_ENVIRONMENT_NAME},
53 {{SE_CHANGE_NOTIFY_PRIVILEGE, 0}, SE_CHANGE_NOTIFY_NAME},
54 {{SE_REMOTE_SHUTDOWN_PRIVILEGE, 0}, SE_REMOTE_SHUTDOWN_NAME},
55 {{SE_UNDOCK_PRIVILEGE, 0}, SE_UNDOCK_NAME},
56 {{SE_SYNC_AGENT_PRIVILEGE, 0}, SE_SYNC_AGENT_NAME},
57 {{SE_ENABLE_DELEGATION_PRIVILEGE, 0}, SE_ENABLE_DELEGATION_NAME},
58 {{SE_MANAGE_VOLUME_PRIVILEGE, 0}, SE_MANAGE_VOLUME_NAME},
59 {{SE_IMPERSONATE_PRIVILEGE, 0}, SE_IMPERSONATE_NAME},
60 {{SE_CREATE_GLOBAL_PRIVILEGE, 0}, SE_CREATE_GLOBAL_NAME}
61 };
62
63 static const RIGHT_DATA WellKnownRights[] =
64 {
65 {SECURITY_ACCESS_INTERACTIVE_LOGON, SE_INTERACTIVE_LOGON_NAME},
66 {SECURITY_ACCESS_NETWORK_LOGON, SE_NETWORK_LOGON_NAME},
67 {SECURITY_ACCESS_BATCH_LOGON, SE_BATCH_LOGON_NAME},
68 {SECURITY_ACCESS_SERVICE_LOGON, SE_SERVICE_LOGON_NAME},
69 {SECURITY_ACCESS_DENY_INTERACTIVE_LOGON, SE_DENY_INTERACTIVE_LOGON_NAME},
70 {SECURITY_ACCESS_DENY_NETWORK_LOGON, SE_DENY_NETWORK_LOGON_NAME},
71 {SECURITY_ACCESS_DENY_BATCH_LOGON, SE_DENY_BATCH_LOGON_NAME},
72 {SECURITY_ACCESS_DENY_SERVICE_LOGON, SE_DENY_SERVICE_LOGON_NAME},
73 {SECURITY_ACCESS_REMOTE_INTERACTIVE_LOGON, SE_REMOTE_INTERACTIVE_LOGON_NAME},
74 {SECURITY_ACCESS_DENY_REMOTE_INTERACTIVE_LOGON, SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME}
75 };
76
77
78 /* FUNCTIONS ***************************************************************/
79
80 NTSTATUS
81 LsarpLookupPrivilegeName(PLUID Value,
82 PRPC_UNICODE_STRING *Name)
83 {
84 PRPC_UNICODE_STRING NameBuffer;
85 ULONG Priv;
86
87 if (Value->HighPart != 0 ||
88 (Value->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
89 Value->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE))
90 {
91 return STATUS_NO_SUCH_PRIVILEGE;
92 }
93
94 for (Priv = 0; Priv < sizeof(WellKnownPrivileges) / sizeof(WellKnownPrivileges[0]); Priv++)
95 {
96 if (Value->LowPart == WellKnownPrivileges[Priv].Luid.LowPart &&
97 Value->HighPart == WellKnownPrivileges[Priv].Luid.HighPart)
98 {
99 NameBuffer = MIDL_user_allocate(sizeof(RPC_UNICODE_STRING));
100 if (NameBuffer == NULL)
101 return STATUS_NO_MEMORY;
102
103 NameBuffer->Length = wcslen(WellKnownPrivileges[Priv].Name) * sizeof(WCHAR);
104 NameBuffer->MaximumLength = NameBuffer->Length + sizeof(WCHAR);
105
106 NameBuffer->Buffer = MIDL_user_allocate(NameBuffer->MaximumLength);
107 if (NameBuffer == NULL)
108 {
109 MIDL_user_free(NameBuffer);
110 return STATUS_NO_MEMORY;
111 }
112
113 wcscpy(NameBuffer->Buffer, WellKnownPrivileges[Priv].Name);
114
115 *Name = NameBuffer;
116
117 return STATUS_SUCCESS;
118 }
119 }
120
121 return STATUS_NO_SUCH_PRIVILEGE;
122 }
123
124
125 NTSTATUS
126 LsarpLookupPrivilegeValue(PRPC_UNICODE_STRING Name,
127 PLUID Value)
128 {
129 ULONG Priv;
130
131 if (Name->Length == 0 || Name->Buffer == NULL)
132 return STATUS_NO_SUCH_PRIVILEGE;
133
134 for (Priv = 0; Priv < sizeof(WellKnownPrivileges) / sizeof(WellKnownPrivileges[0]); Priv++)
135 {
136 if (_wcsicmp(Name->Buffer, WellKnownPrivileges[Priv].Name) == 0)
137 {
138 *Value = WellKnownPrivileges[Priv].Luid;
139 return STATUS_SUCCESS;
140 }
141 }
142
143 return STATUS_NO_SUCH_PRIVILEGE;
144 }
145
146
147 NTSTATUS
148 LsarpEnumeratePrivileges(DWORD *EnumerationContext,
149 PLSAPR_PRIVILEGE_ENUM_BUFFER EnumerationBuffer,
150 DWORD PreferedMaximumLength)
151 {
152 PLSAPR_POLICY_PRIVILEGE_DEF Privileges = NULL;
153 ULONG EnumIndex;
154 ULONG EnumCount = 0;
155 ULONG RequiredLength = 0;
156 ULONG i;
157 BOOLEAN MoreEntries = FALSE;
158 NTSTATUS Status = STATUS_SUCCESS;
159
160 EnumIndex = *EnumerationContext;
161
162 for (; EnumIndex < sizeof(WellKnownPrivileges) / sizeof(WellKnownPrivileges[0]); EnumIndex++)
163 {
164 TRACE("EnumIndex: %lu\n", EnumIndex);
165 TRACE("Privilege Name: %S\n", WellKnownPrivileges[EnumIndex].Name);
166 TRACE("Name Length: %lu\n", wcslen(WellKnownPrivileges[EnumIndex].Name));
167
168 if ((RequiredLength +
169 wcslen(WellKnownPrivileges[EnumIndex].Name) * sizeof(WCHAR) +
170 sizeof(UNICODE_NULL) +
171 sizeof(LSAPR_POLICY_PRIVILEGE_DEF)) > PreferedMaximumLength)
172 {
173 MoreEntries = TRUE;
174 break;
175 }
176
177 RequiredLength += (wcslen(WellKnownPrivileges[EnumIndex].Name) * sizeof(WCHAR) +
178 sizeof(UNICODE_NULL) + sizeof(LSAPR_POLICY_PRIVILEGE_DEF));
179 EnumCount++;
180 }
181
182 TRACE("EnumCount: %lu\n", EnumCount);
183 TRACE("RequiredLength: %lu\n", RequiredLength);
184
185 if (EnumCount == 0)
186 goto done;
187
188 Privileges = MIDL_user_allocate(EnumCount * sizeof(LSAPR_POLICY_PRIVILEGE_DEF));
189 if (Privileges == NULL)
190 {
191 Status = STATUS_INSUFFICIENT_RESOURCES;
192 goto done;
193 }
194
195 EnumIndex = *EnumerationContext;
196
197 for (i = 0; i < EnumCount; i++, EnumIndex++)
198 {
199 Privileges[i].LocalValue = WellKnownPrivileges[EnumIndex].Luid;
200
201 Privileges[i].Name.Length = (USHORT)wcslen(WellKnownPrivileges[EnumIndex].Name) * sizeof(WCHAR);
202 Privileges[i].Name.MaximumLength = (USHORT)Privileges[i].Name.Length + sizeof(UNICODE_NULL);
203
204 Privileges[i].Name.Buffer = MIDL_user_allocate(Privileges[i].Name.MaximumLength);
205 if (Privileges[i].Name.Buffer == NULL)
206 {
207 Status = STATUS_INSUFFICIENT_RESOURCES;
208 goto done;
209 }
210
211 memcpy(Privileges[i].Name.Buffer,
212 WellKnownPrivileges[EnumIndex].Name,
213 Privileges[i].Name.Length);
214 }
215
216 done:
217 if (NT_SUCCESS(Status))
218 {
219 EnumerationBuffer->Entries = EnumCount;
220 EnumerationBuffer->Privileges = Privileges;
221 *EnumerationContext += EnumCount;
222 }
223 else
224 {
225 if (Privileges != NULL)
226 {
227 for (i = 0; i < EnumCount; i++)
228 {
229 if (Privileges[i].Name.Buffer != NULL)
230 MIDL_user_free(Privileges[i].Name.Buffer);
231 }
232
233 MIDL_user_free(Privileges);
234 }
235 }
236
237 if ((Status == STATUS_SUCCESS) && (MoreEntries == TRUE))
238 Status = STATUS_MORE_ENTRIES;
239
240 return Status;
241 }
242
243
244 NTSTATUS
245 LsapLookupAccountRightName(ULONG RightValue,
246 PRPC_UNICODE_STRING *Name)
247 {
248 PRPC_UNICODE_STRING NameBuffer;
249 ULONG i;
250
251 for (i = 0; i < sizeof(WellKnownRights) / sizeof(WellKnownRights[0]); i++)
252 {
253 if (WellKnownRights[i].Flag == RightValue)
254 {
255 NameBuffer = MIDL_user_allocate(sizeof(RPC_UNICODE_STRING));
256 if (NameBuffer == NULL)
257 return STATUS_NO_MEMORY;
258
259 NameBuffer->Length = wcslen(WellKnownRights[i].Name) * sizeof(WCHAR);
260 NameBuffer->MaximumLength = NameBuffer->Length + sizeof(WCHAR);
261
262 NameBuffer->Buffer = MIDL_user_allocate(NameBuffer->MaximumLength);
263 if (NameBuffer == NULL)
264 {
265 MIDL_user_free(NameBuffer);
266 return STATUS_INSUFFICIENT_RESOURCES;
267 }
268
269 wcscpy(NameBuffer->Buffer, WellKnownRights[i].Name);
270
271 *Name = NameBuffer;
272
273 return STATUS_SUCCESS;
274 }
275 }
276
277 return STATUS_NO_SUCH_PRIVILEGE;
278 }
279
280 /* EOF */