35a239c7e631f42dd3c5da1cd1db7dc5c8b4096e
[reactos.git] / reactos / ntoskrnl / se / acl.c
1 /*
2 * COPYRIGHT: See COPYING in the top level directory
3 * PROJECT: ReactOS kernel
4 * FILE: ntoskrnl/se/acl.c
5 * PURPOSE: Security manager
6 *
7 * PROGRAMMERS: David Welch <welch@cwcom.net>
8 */
9
10 /* INCLUDES *******************************************************************/
11
12 #include <ntoskrnl.h>
13 #define NDEBUG
14 #include <debug.h>
15
16 #if defined (ALLOC_PRAGMA)
17 #pragma alloc_text(INIT, SepInitDACLs)
18 #endif
19
20 /* GLOBALS ********************************************************************/
21
22 PACL SePublicDefaultDacl = NULL;
23 PACL SeSystemDefaultDacl = NULL;
24 PACL SePublicDefaultUnrestrictedDacl = NULL;
25 PACL SePublicOpenDacl = NULL;
26 PACL SePublicOpenUnrestrictedDacl = NULL;
27 PACL SeUnrestrictedDacl = NULL;
28
29 /* FUNCTIONS ******************************************************************/
30
31 BOOLEAN
32 INIT_FUNCTION
33 NTAPI
34 SepInitDACLs(VOID)
35 {
36 ULONG AclLength;
37
38 /* create PublicDefaultDacl */
39 AclLength = sizeof(ACL) +
40 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
41 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid));
42
43 SePublicDefaultDacl = ExAllocatePoolWithTag(PagedPool,
44 AclLength,
45 TAG_ACL);
46 if (SePublicDefaultDacl == NULL)
47 return FALSE;
48
49 RtlCreateAcl(SePublicDefaultDacl,
50 AclLength,
51 ACL_REVISION);
52
53 RtlAddAccessAllowedAce(SePublicDefaultDacl,
54 ACL_REVISION,
55 GENERIC_EXECUTE,
56 SeWorldSid);
57
58 RtlAddAccessAllowedAce(SePublicDefaultDacl,
59 ACL_REVISION,
60 GENERIC_ALL,
61 SeLocalSystemSid);
62
63 /* create PublicDefaultUnrestrictedDacl */
64 AclLength = sizeof(ACL) +
65 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
66 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
67 (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) +
68 (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid));
69
70 SePublicDefaultUnrestrictedDacl = ExAllocatePoolWithTag(PagedPool,
71 AclLength,
72 TAG_ACL);
73 if (SePublicDefaultUnrestrictedDacl == NULL)
74 return FALSE;
75
76 RtlCreateAcl(SePublicDefaultUnrestrictedDacl,
77 AclLength,
78 ACL_REVISION);
79
80 RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl,
81 ACL_REVISION,
82 GENERIC_EXECUTE,
83 SeWorldSid);
84
85 RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl,
86 ACL_REVISION,
87 GENERIC_ALL,
88 SeLocalSystemSid);
89
90 RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl,
91 ACL_REVISION,
92 GENERIC_ALL,
93 SeAliasAdminsSid);
94
95 RtlAddAccessAllowedAce(SePublicDefaultUnrestrictedDacl,
96 ACL_REVISION,
97 GENERIC_READ | GENERIC_EXECUTE | READ_CONTROL,
98 SeRestrictedCodeSid);
99
100 /* create PublicOpenDacl */
101 AclLength = sizeof(ACL) +
102 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
103 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
104 (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid));
105
106 SePublicOpenDacl = ExAllocatePoolWithTag(PagedPool,
107 AclLength,
108 TAG_ACL);
109 if (SePublicOpenDacl == NULL)
110 return FALSE;
111
112 RtlCreateAcl(SePublicOpenDacl,
113 AclLength,
114 ACL_REVISION);
115
116 RtlAddAccessAllowedAce(SePublicOpenDacl,
117 ACL_REVISION,
118 GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE,
119 SeWorldSid);
120
121 RtlAddAccessAllowedAce(SePublicOpenDacl,
122 ACL_REVISION,
123 GENERIC_ALL,
124 SeLocalSystemSid);
125
126 RtlAddAccessAllowedAce(SePublicOpenDacl,
127 ACL_REVISION,
128 GENERIC_ALL,
129 SeAliasAdminsSid);
130
131 /* create PublicOpenUnrestrictedDacl */
132 AclLength = sizeof(ACL) +
133 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
134 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
135 (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) +
136 (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid));
137
138 SePublicOpenUnrestrictedDacl = ExAllocatePoolWithTag(PagedPool,
139 AclLength,
140 TAG_ACL);
141 if (SePublicOpenUnrestrictedDacl == NULL)
142 return FALSE;
143
144 RtlCreateAcl(SePublicOpenUnrestrictedDacl,
145 AclLength,
146 ACL_REVISION);
147
148 RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl,
149 ACL_REVISION,
150 GENERIC_ALL,
151 SeWorldSid);
152
153 RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl,
154 ACL_REVISION,
155 GENERIC_ALL,
156 SeLocalSystemSid);
157
158 RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl,
159 ACL_REVISION,
160 GENERIC_ALL,
161 SeAliasAdminsSid);
162
163 RtlAddAccessAllowedAce(SePublicOpenUnrestrictedDacl,
164 ACL_REVISION,
165 GENERIC_READ | GENERIC_EXECUTE,
166 SeRestrictedCodeSid);
167
168 /* create SystemDefaultDacl */
169 AclLength = sizeof(ACL) +
170 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
171 (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid));
172
173 SeSystemDefaultDacl = ExAllocatePoolWithTag(PagedPool,
174 AclLength,
175 TAG_ACL);
176 if (SeSystemDefaultDacl == NULL)
177 return FALSE;
178
179 RtlCreateAcl(SeSystemDefaultDacl,
180 AclLength,
181 ACL_REVISION);
182
183 RtlAddAccessAllowedAce(SeSystemDefaultDacl,
184 ACL_REVISION,
185 GENERIC_ALL,
186 SeLocalSystemSid);
187
188 RtlAddAccessAllowedAce(SeSystemDefaultDacl,
189 ACL_REVISION,
190 GENERIC_READ | GENERIC_EXECUTE | READ_CONTROL,
191 SeAliasAdminsSid);
192
193 /* create UnrestrictedDacl */
194 AclLength = sizeof(ACL) +
195 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
196 (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid));
197
198 SeUnrestrictedDacl = ExAllocatePoolWithTag(PagedPool,
199 AclLength,
200 TAG_ACL);
201 if (SeUnrestrictedDacl == NULL)
202 return FALSE;
203
204 RtlCreateAcl(SeUnrestrictedDacl,
205 AclLength,
206 ACL_REVISION);
207
208 RtlAddAccessAllowedAce(SeUnrestrictedDacl,
209 ACL_REVISION,
210 GENERIC_ALL,
211 SeWorldSid);
212
213 RtlAddAccessAllowedAce(SeUnrestrictedDacl,
214 ACL_REVISION,
215 GENERIC_READ | GENERIC_EXECUTE,
216 SeRestrictedCodeSid);
217
218 return TRUE;
219 }
220
221 NTSTATUS NTAPI
222 SepCreateImpersonationTokenDacl(PTOKEN Token,
223 PTOKEN PrimaryToken,
224 PACL *Dacl)
225 {
226 ULONG AclLength;
227 PVOID TokenDacl;
228
229 PAGED_CODE();
230
231 AclLength = sizeof(ACL) +
232 (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) +
233 (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)) +
234 (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
235 (sizeof(ACE) + RtlLengthSid(Token->UserAndGroups->Sid)) +
236 (sizeof(ACE) + RtlLengthSid(PrimaryToken->UserAndGroups->Sid));
237
238 TokenDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL);
239 if (TokenDacl == NULL)
240 {
241 return STATUS_INSUFFICIENT_RESOURCES;
242 }
243
244 RtlCreateAcl(TokenDacl, AclLength, ACL_REVISION);
245 RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
246 Token->UserAndGroups->Sid);
247 RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
248 PrimaryToken->UserAndGroups->Sid);
249 RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
250 SeAliasAdminsSid);
251 RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
252 SeLocalSystemSid);
253
254 /* FIXME */
255 #if 0
256 if (Token->RestrictedSids != NULL || PrimaryToken->RestrictedSids != NULL)
257 {
258 RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
259 SeRestrictedCodeSid);
260 }
261 #endif
262
263 return STATUS_SUCCESS;
264 }
265
266 NTSTATUS
267 NTAPI
268 SepCaptureAcl(IN PACL InputAcl,
269 IN KPROCESSOR_MODE AccessMode,
270 IN POOL_TYPE PoolType,
271 IN BOOLEAN CaptureIfKernel,
272 OUT PACL *CapturedAcl)
273 {
274 PACL NewAcl;
275 ULONG AclSize = 0;
276 NTSTATUS Status = STATUS_SUCCESS;
277
278 PAGED_CODE();
279
280 if (AccessMode != KernelMode)
281 {
282 _SEH2_TRY
283 {
284 ProbeForRead(InputAcl,
285 sizeof(ACL),
286 sizeof(ULONG));
287 AclSize = InputAcl->AclSize;
288 ProbeForRead(InputAcl,
289 AclSize,
290 sizeof(ULONG));
291 }
292 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
293 {
294 /* Return the exception code */
295 _SEH2_YIELD(return _SEH2_GetExceptionCode());
296 }
297 _SEH2_END;
298
299 NewAcl = ExAllocatePoolWithTag(PoolType,
300 AclSize,
301 TAG_ACL);
302 if (NewAcl != NULL)
303 {
304 _SEH2_TRY
305 {
306 RtlCopyMemory(NewAcl,
307 InputAcl,
308 AclSize);
309
310 *CapturedAcl = NewAcl;
311 }
312 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
313 {
314 /* Free the ACL and return the exception code */
315 ExFreePoolWithTag(NewAcl, TAG_ACL);
316 _SEH2_YIELD(return _SEH2_GetExceptionCode());
317 }
318 _SEH2_END;
319 }
320 else
321 {
322 Status = STATUS_INSUFFICIENT_RESOURCES;
323 }
324 }
325 else if (!CaptureIfKernel)
326 {
327 *CapturedAcl = InputAcl;
328 }
329 else
330 {
331 AclSize = InputAcl->AclSize;
332
333 NewAcl = ExAllocatePoolWithTag(PoolType,
334 AclSize,
335 TAG_ACL);
336
337 if (NewAcl != NULL)
338 {
339 RtlCopyMemory(NewAcl,
340 InputAcl,
341 AclSize);
342
343 *CapturedAcl = NewAcl;
344 }
345 else
346 {
347 Status = STATUS_INSUFFICIENT_RESOURCES;
348 }
349 }
350
351 return Status;
352 }
353
354 VOID
355 NTAPI
356 SepReleaseAcl(IN PACL CapturedAcl,
357 IN KPROCESSOR_MODE AccessMode,
358 IN BOOLEAN CaptureIfKernel)
359 {
360 PAGED_CODE();
361
362 if (CapturedAcl != NULL &&
363 (AccessMode != KernelMode ||
364 (AccessMode == KernelMode && CaptureIfKernel)))
365 {
366 ExFreePoolWithTag(CapturedAcl, TAG_ACL);
367 }
368 }
369
370 BOOLEAN
371 SepShouldPropagateAce(
372 _In_ UCHAR AceFlags,
373 _Out_ PUCHAR NewAceFlags,
374 _In_ BOOLEAN IsInherited,
375 _In_ BOOLEAN IsDirectoryObject)
376 {
377 if (!IsInherited)
378 {
379 *NewAceFlags = AceFlags;
380 return TRUE;
381 }
382
383 if (!IsDirectoryObject)
384 {
385 if (AceFlags & OBJECT_INHERIT_ACE)
386 {
387 *NewAceFlags = AceFlags & ~VALID_INHERIT_FLAGS;
388 return TRUE;
389 }
390 return FALSE;
391 }
392
393 if (AceFlags & NO_PROPAGATE_INHERIT_ACE)
394 {
395 if (AceFlags & CONTAINER_INHERIT_ACE)
396 {
397 *NewAceFlags = AceFlags & ~VALID_INHERIT_FLAGS;
398 return TRUE;
399 }
400 return FALSE;
401 }
402
403 if (AceFlags & CONTAINER_INHERIT_ACE)
404 {
405 *NewAceFlags = CONTAINER_INHERIT_ACE | (AceFlags & OBJECT_INHERIT_ACE) | (AceFlags & ~VALID_INHERIT_FLAGS);
406 return TRUE;
407 }
408
409 if (AceFlags & OBJECT_INHERIT_ACE)
410 {
411 *NewAceFlags = INHERIT_ONLY_ACE | OBJECT_INHERIT_ACE | (AceFlags & ~VALID_INHERIT_FLAGS);
412 return TRUE;
413 }
414
415 return FALSE;
416 }
417
418 NTSTATUS
419 SepPropagateAcl(
420 _Out_writes_bytes_opt_(AclLength) PACL AclDest,
421 _Inout_ PULONG AclLength,
422 _In_reads_bytes_(AclSource->AclSize) PACL AclSource,
423 _In_ PSID Owner,
424 _In_ PSID Group,
425 _In_ BOOLEAN IsInherited,
426 _In_ BOOLEAN IsDirectoryObject,
427 _In_ PGENERIC_MAPPING GenericMapping)
428 {
429 ACCESS_MASK Mask;
430 PACCESS_ALLOWED_ACE AceSource;
431 PACCESS_ALLOWED_ACE AceDest;
432 PUCHAR CurrentDest;
433 PUCHAR CurrentSource;
434 ULONG i;
435 ULONG Written;
436 UCHAR AceFlags;
437 USHORT AceSize;
438 USHORT AceCount = 0;
439 PSID Sid;
440 BOOLEAN WriteTwoAces;
441
442 ASSERT(RtlValidAcl(AclSource));
443 ASSERT(AclSource->AclSize % sizeof(ULONG) == 0);
444 ASSERT(AclSource->Sbz1 == 0);
445 ASSERT(AclSource->Sbz2 == 0);
446
447 Written = 0;
448 if (*AclLength >= Written + sizeof(ACL))
449 {
450 RtlCopyMemory(AclDest,
451 AclSource,
452 sizeof(ACL));
453 }
454 Written += sizeof(ACL);
455
456 CurrentDest = (PUCHAR)(AclDest + 1);
457 CurrentSource = (PUCHAR)(AclSource + 1);
458 for (i = 0; i < AclSource->AceCount; i++)
459 {
460 ASSERT((ULONG_PTR)CurrentDest % sizeof(ULONG) == 0);
461 ASSERT((ULONG_PTR)CurrentSource % sizeof(ULONG) == 0);
462 AceDest = (PACCESS_ALLOWED_ACE)CurrentDest;
463 AceSource = (PACCESS_ALLOWED_ACE)CurrentSource;
464
465 /* These all have the same structure */
466 ASSERT(AceSource->Header.AceType == ACCESS_ALLOWED_ACE_TYPE ||
467 AceSource->Header.AceType == ACCESS_DENIED_ACE_TYPE ||
468 AceSource->Header.AceType == SYSTEM_AUDIT_ACE_TYPE);
469
470 ASSERT(AceSource->Header.AceSize % sizeof(ULONG) == 0);
471 ASSERT(AceSource->Header.AceSize >= sizeof(*AceSource));
472 if (!SepShouldPropagateAce(AceSource->Header.AceFlags,
473 &AceFlags,
474 IsInherited,
475 IsDirectoryObject))
476 {
477 CurrentSource += AceSource->Header.AceSize;
478 continue;
479 }
480
481 /* FIXME: filter out duplicate ACEs */
482 AceSize = AceSource->Header.AceSize;
483 Mask = AceSource->Mask;
484 Sid = (PSID)&AceSource->SidStart;
485 ASSERT(AceSize >= FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart) + RtlLengthSid(Sid));
486
487 WriteTwoAces = FALSE;
488 /* Map effective ACE to specific rights */
489 if (!(AceFlags & INHERIT_ONLY_ACE))
490 {
491 RtlMapGenericMask(&Mask, GenericMapping);
492 Mask &= GenericMapping->GenericAll;
493
494 if (IsInherited)
495 {
496 if (RtlEqualSid(Sid, SeCreatorOwnerSid))
497 Sid = Owner;
498 else if (RtlEqualSid(Sid, SeCreatorGroupSid))
499 Sid = Group;
500 AceSize = FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart) + RtlLengthSid(Sid);
501
502 /*
503 * A generic container ACE becomes two ACEs:
504 * - a specific effective ACE with no inheritance flags
505 * - an inherit-only ACE that keeps the generic rights
506 */
507 if (IsDirectoryObject &&
508 (AceFlags & CONTAINER_INHERIT_ACE) &&
509 (Mask != AceSource->Mask || Sid != (PSID)&AceSource->SidStart))
510 {
511 WriteTwoAces = TRUE;
512 }
513 }
514 }
515
516 while (1)
517 {
518 if (*AclLength >= Written + AceSize)
519 {
520 AceDest->Header.AceType = AceSource->Header.AceType;
521 AceDest->Header.AceFlags = WriteTwoAces ? AceFlags & ~VALID_INHERIT_FLAGS
522 : AceFlags;
523 AceDest->Header.AceSize = AceSize;
524 AceDest->Mask = Mask;
525 RtlCopySid(AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart),
526 (PSID)&AceDest->SidStart,
527 Sid);
528 }
529 Written += AceSize;
530
531 AceCount++;
532 CurrentDest += AceSize;
533
534 if (!WriteTwoAces)
535 break;
536
537 /* Second ACE keeps all the generics from the source ACE */
538 WriteTwoAces = FALSE;
539 AceDest = (PACCESS_ALLOWED_ACE)CurrentDest;
540 AceSize = AceSource->Header.AceSize;
541 Mask = AceSource->Mask;
542 Sid = (PSID)&AceSource->SidStart;
543 AceFlags |= INHERIT_ONLY_ACE;
544 }
545
546 CurrentSource += AceSource->Header.AceSize;
547 }
548
549 if (*AclLength >= sizeof(ACL))
550 {
551 AclDest->AceCount = AceCount;
552 AclDest->AclSize = Written;
553 }
554
555 if (Written > *AclLength)
556 {
557 *AclLength = Written;
558 return STATUS_BUFFER_TOO_SMALL;
559 }
560 *AclLength = Written;
561 return STATUS_SUCCESS;
562 }
563
564 PACL
565 SepSelectAcl(
566 _In_opt_ PACL ExplicitAcl,
567 _In_ BOOLEAN ExplicitPresent,
568 _In_ BOOLEAN ExplicitDefaulted,
569 _In_opt_ PACL ParentAcl,
570 _In_opt_ PACL DefaultAcl,
571 _Out_ PULONG AclLength,
572 _In_ PSID Owner,
573 _In_ PSID Group,
574 _Out_ PBOOLEAN AclPresent,
575 _Out_ PBOOLEAN IsInherited,
576 _In_ BOOLEAN IsDirectoryObject,
577 _In_ PGENERIC_MAPPING GenericMapping)
578 {
579 PACL Acl;
580 NTSTATUS Status;
581
582 *AclPresent = TRUE;
583 if (ExplicitPresent && !ExplicitDefaulted)
584 {
585 Acl = ExplicitAcl;
586 }
587 else
588 {
589 if (ParentAcl)
590 {
591 *IsInherited = TRUE;
592 *AclLength = 0;
593 Status = SepPropagateAcl(NULL,
594 AclLength,
595 ParentAcl,
596 Owner,
597 Group,
598 *IsInherited,
599 IsDirectoryObject,
600 GenericMapping);
601 ASSERT(Status == STATUS_BUFFER_TOO_SMALL);
602
603 /* Use the parent ACL only if it's not empty */
604 if (*AclLength != sizeof(ACL))
605 return ParentAcl;
606 }
607
608 if (ExplicitPresent)
609 {
610 Acl = ExplicitAcl;
611 }
612 else if (DefaultAcl)
613 {
614 Acl = DefaultAcl;
615 }
616 else
617 {
618 *AclPresent = FALSE;
619 Acl = NULL;
620 }
621 }
622
623 *IsInherited = FALSE;
624 *AclLength = 0;
625 if (Acl)
626 {
627 /* Get the length */
628 Status = SepPropagateAcl(NULL,
629 AclLength,
630 Acl,
631 Owner,
632 Group,
633 *IsInherited,
634 IsDirectoryObject,
635 GenericMapping);
636 ASSERT(Status == STATUS_BUFFER_TOO_SMALL);
637 }
638 return Acl;
639 }
640
641 /* EOF */