1e8f09c40edd5132eb57d30b1168b2af1c61d177
[reactos.git] / reactos / ntoskrnl / se / semgr.c
1 /* $Id: semgr.c,v 1.43 2004/09/08 11:39:59 ekohl Exp $
2 *
3 * COPYRIGHT: See COPYING in the top level directory
4 * PROJECT: ReactOS kernel
5 * PURPOSE: Security manager
6 * FILE: kernel/se/semgr.c
7 * PROGRAMER: ?
8 * REVISION HISTORY:
9 * 26/07/98: Added stubs for security functions
10 */
11
12 /* INCLUDES *****************************************************************/
13
14 #include <ntoskrnl.h>
15 #define NDEBUG
16 #include <internal/debug.h>
17
18 #define TAG_SXPT TAG('S', 'X', 'P', 'T')
19
20
21 /* GLOBALS ******************************************************************/
22
23 PSE_EXPORTS EXPORTED SeExports = NULL;
24
25
26 /* PROTOTYPES ***************************************************************/
27
28 static BOOLEAN SepInitExports(VOID);
29
30 /* FUNCTIONS ****************************************************************/
31
32
33 BOOLEAN INIT_FUNCTION
34 SeInit1(VOID)
35 {
36 SepInitLuid();
37
38 if (!SepInitSecurityIDs())
39 return FALSE;
40
41 if (!SepInitDACLs())
42 return FALSE;
43
44 if (!SepInitSDs())
45 return FALSE;
46
47 SepInitPrivileges();
48
49 if (!SepInitExports())
50 return FALSE;
51
52 return TRUE;
53 }
54
55
56 BOOLEAN INIT_FUNCTION
57 SeInit2(VOID)
58 {
59 SepInitializeTokenImplementation();
60
61 return TRUE;
62 }
63
64
65 BOOLEAN
66 SeInitSRM(VOID)
67 {
68 OBJECT_ATTRIBUTES ObjectAttributes;
69 UNICODE_STRING Name;
70 HANDLE DirectoryHandle;
71 HANDLE EventHandle;
72 NTSTATUS Status;
73
74 /* Create '\Security' directory */
75 RtlInitUnicodeString(&Name,
76 L"\\Security");
77 InitializeObjectAttributes(&ObjectAttributes,
78 &Name,
79 OBJ_PERMANENT,
80 0,
81 NULL);
82 Status = NtCreateDirectoryObject(&DirectoryHandle,
83 DIRECTORY_ALL_ACCESS,
84 &ObjectAttributes);
85 if (!NT_SUCCESS(Status))
86 {
87 DPRINT1("Failed to create 'Security' directory!\n");
88 return FALSE;
89 }
90
91 /* Create 'LSA_AUTHENTICATION_INITALIZED' event */
92 RtlInitUnicodeString(&Name,
93 L"\\LSA_AUTHENTICATION_INITALIZED");
94 InitializeObjectAttributes(&ObjectAttributes,
95 &Name,
96 OBJ_PERMANENT,
97 DirectoryHandle,
98 SePublicDefaultSd);
99 Status = NtCreateEvent(&EventHandle,
100 EVENT_ALL_ACCESS,
101 &ObjectAttributes,
102 FALSE,
103 FALSE);
104 if (!NT_SUCCESS(Status))
105 {
106 DPRINT1("Failed to create 'LSA_AUTHENTICATION_INITALIZED' event!\n");
107 NtClose(DirectoryHandle);
108 return FALSE;
109 }
110
111 NtClose(EventHandle);
112 NtClose(DirectoryHandle);
113
114 /* FIXME: Create SRM port and listener thread */
115
116 return TRUE;
117 }
118
119
120 static BOOLEAN INIT_FUNCTION
121 SepInitExports(VOID)
122 {
123 SeExports = ExAllocatePoolWithTag(NonPagedPool,
124 sizeof(SE_EXPORTS),
125 TAG_SXPT);
126 if (SeExports == NULL)
127 return FALSE;
128
129 SeExports->SeCreateTokenPrivilege = SeCreateTokenPrivilege;
130 SeExports->SeAssignPrimaryTokenPrivilege = SeAssignPrimaryTokenPrivilege;
131 SeExports->SeLockMemoryPrivilege = SeLockMemoryPrivilege;
132 SeExports->SeIncreaseQuotaPrivilege = SeIncreaseQuotaPrivilege;
133 SeExports->SeUnsolicitedInputPrivilege = SeUnsolicitedInputPrivilege;
134 SeExports->SeTcbPrivilege = SeTcbPrivilege;
135 SeExports->SeSecurityPrivilege = SeSecurityPrivilege;
136 SeExports->SeTakeOwnershipPrivilege = SeTakeOwnershipPrivilege;
137 SeExports->SeLoadDriverPrivilege = SeLoadDriverPrivilege;
138 SeExports->SeCreatePagefilePrivilege = SeCreatePagefilePrivilege;
139 SeExports->SeIncreaseBasePriorityPrivilege = SeIncreaseBasePriorityPrivilege;
140 SeExports->SeSystemProfilePrivilege = SeSystemProfilePrivilege;
141 SeExports->SeSystemtimePrivilege = SeSystemtimePrivilege;
142 SeExports->SeProfileSingleProcessPrivilege = SeProfileSingleProcessPrivilege;
143 SeExports->SeCreatePermanentPrivilege = SeCreatePermanentPrivilege;
144 SeExports->SeBackupPrivilege = SeBackupPrivilege;
145 SeExports->SeRestorePrivilege = SeRestorePrivilege;
146 SeExports->SeShutdownPrivilege = SeShutdownPrivilege;
147 SeExports->SeDebugPrivilege = SeDebugPrivilege;
148 SeExports->SeAuditPrivilege = SeAuditPrivilege;
149 SeExports->SeSystemEnvironmentPrivilege = SeSystemEnvironmentPrivilege;
150 SeExports->SeChangeNotifyPrivilege = SeChangeNotifyPrivilege;
151 SeExports->SeRemoteShutdownPrivilege = SeRemoteShutdownPrivilege;
152
153 SeExports->SeNullSid = SeNullSid;
154 SeExports->SeWorldSid = SeWorldSid;
155 SeExports->SeLocalSid = SeLocalSid;
156 SeExports->SeCreatorOwnerSid = SeCreatorOwnerSid;
157 SeExports->SeCreatorGroupSid = SeCreatorGroupSid;
158 SeExports->SeNtAuthoritySid = SeNtAuthoritySid;
159 SeExports->SeDialupSid = SeDialupSid;
160 SeExports->SeNetworkSid = SeNetworkSid;
161 SeExports->SeBatchSid = SeBatchSid;
162 SeExports->SeInteractiveSid = SeInteractiveSid;
163 SeExports->SeLocalSystemSid = SeLocalSystemSid;
164 SeExports->SeAliasAdminsSid = SeAliasAdminsSid;
165 SeExports->SeAliasUsersSid = SeAliasUsersSid;
166 SeExports->SeAliasGuestsSid = SeAliasGuestsSid;
167 SeExports->SeAliasPowerUsersSid = SeAliasPowerUsersSid;
168 SeExports->SeAliasAccountOpsSid = SeAliasAccountOpsSid;
169 SeExports->SeAliasSystemOpsSid = SeAliasSystemOpsSid;
170 SeExports->SeAliasPrintOpsSid = SeAliasPrintOpsSid;
171 SeExports->SeAliasBackupOpsSid = SeAliasBackupOpsSid;
172
173 return TRUE;
174 }
175
176
177 VOID SepReferenceLogonSession(PLUID AuthenticationId)
178 {
179 UNIMPLEMENTED;
180 }
181
182 VOID SepDeReferenceLogonSession(PLUID AuthenticationId)
183 {
184 UNIMPLEMENTED;
185 }
186
187
188
189 /*
190 * @unimplemented
191 */
192 NTSTATUS STDCALL
193 NtAllocateUuids(PULARGE_INTEGER Time,
194 PULONG Range,
195 PULONG Sequence)
196 {
197 UNIMPLEMENTED;
198 return(STATUS_NOT_IMPLEMENTED);
199 }
200
201
202 /*
203 * @implemented
204 */
205 VOID STDCALL
206 SeCaptureSubjectContext(OUT PSECURITY_SUBJECT_CONTEXT SubjectContext)
207 {
208 PETHREAD Thread;
209 BOOLEAN CopyOnOpen;
210 BOOLEAN EffectiveOnly;
211
212 Thread = PsGetCurrentThread();
213 if (Thread == NULL)
214 {
215 SubjectContext->ProcessAuditId = 0;
216 SubjectContext->PrimaryToken = NULL;
217 SubjectContext->ClientToken = NULL;
218 SubjectContext->ImpersonationLevel = 0;
219 }
220 else
221 {
222 SubjectContext->ProcessAuditId = Thread->ThreadsProcess;
223 SubjectContext->ClientToken =
224 PsReferenceImpersonationToken(Thread,
225 &CopyOnOpen,
226 &EffectiveOnly,
227 &SubjectContext->ImpersonationLevel);
228 SubjectContext->PrimaryToken = PsReferencePrimaryToken(Thread->ThreadsProcess);
229 }
230 }
231
232
233 /*
234 * @unimplemented
235 */
236 VOID STDCALL
237 SeLockSubjectContext(IN PSECURITY_SUBJECT_CONTEXT SubjectContext)
238 {
239 UNIMPLEMENTED;
240 }
241
242
243 /*
244 * @implemented
245 */
246 VOID STDCALL
247 SeReleaseSubjectContext(IN PSECURITY_SUBJECT_CONTEXT SubjectContext)
248 {
249 if (SubjectContext->PrimaryToken != NULL)
250 {
251 ObDereferenceObject(SubjectContext->PrimaryToken);
252 }
253
254 if (SubjectContext->ClientToken != NULL)
255 {
256 ObDereferenceObject(SubjectContext->ClientToken);
257 }
258 }
259
260
261 /*
262 * @unimplemented
263 */
264 VOID STDCALL
265 SeUnlockSubjectContext(IN PSECURITY_SUBJECT_CONTEXT SubjectContext)
266 {
267 UNIMPLEMENTED;
268 }
269
270
271 /*
272 * @implemented
273 */
274 NTSTATUS STDCALL
275 SeDeassignSecurity(PSECURITY_DESCRIPTOR *SecurityDescriptor)
276 {
277 if (*SecurityDescriptor != NULL)
278 {
279 ExFreePool(*SecurityDescriptor);
280 *SecurityDescriptor = NULL;
281 }
282
283 return STATUS_SUCCESS;
284 }
285
286
287 /*
288 * @unimplemented
289 */
290 NTSTATUS STDCALL
291 SeAssignSecurityEx(IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL,
292 IN PSECURITY_DESCRIPTOR ExplicitDescriptor OPTIONAL,
293 OUT PSECURITY_DESCRIPTOR *NewDescriptor,
294 IN GUID *ObjectType OPTIONAL,
295 IN BOOLEAN IsDirectoryObject,
296 IN ULONG AutoInheritFlags,
297 IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
298 IN PGENERIC_MAPPING GenericMapping,
299 IN POOL_TYPE PoolType)
300 {
301 UNIMPLEMENTED;
302 return STATUS_NOT_IMPLEMENTED;
303 }
304
305
306 /*
307 * FUNCTION: Creates a security descriptor for a new object.
308 * ARGUMENTS:
309 * ParentDescriptor =
310 * ExplicitDescriptor =
311 * NewDescriptor =
312 * IsDirectoryObject =
313 * SubjectContext =
314 * GeneralMapping =
315 * PoolType =
316 * RETURNS: Status
317 *
318 * @implemented
319 */
320 NTSTATUS STDCALL
321 SeAssignSecurity(PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL,
322 PSECURITY_DESCRIPTOR ExplicitDescriptor OPTIONAL,
323 PSECURITY_DESCRIPTOR *NewDescriptor,
324 BOOLEAN IsDirectoryObject,
325 PSECURITY_SUBJECT_CONTEXT SubjectContext,
326 PGENERIC_MAPPING GenericMapping,
327 POOL_TYPE PoolType)
328 {
329 PSECURITY_DESCRIPTOR Descriptor;
330 PACCESS_TOKEN Token;
331 ULONG OwnerLength = 0;
332 ULONG GroupLength = 0;
333 ULONG DaclLength = 0;
334 ULONG SaclLength = 0;
335 ULONG Length = 0;
336 ULONG Control = 0;
337 ULONG_PTR Current;
338 PSID Owner = NULL;
339 PSID Group = NULL;
340 PACL Dacl = NULL;
341 PACL Sacl = NULL;
342
343 /* FIXME: Lock subject context */
344
345 if (SubjectContext->ClientToken != NULL)
346 {
347 Token = SubjectContext->ClientToken;
348 }
349 else
350 {
351 Token = SubjectContext->PrimaryToken;
352 }
353
354
355 /* Inherit the Owner SID */
356 if (ExplicitDescriptor != NULL && ExplicitDescriptor->Owner != NULL)
357 {
358 DPRINT("Use explicit owner sid!\n");
359 Owner = ExplicitDescriptor->Owner;
360 if (ExplicitDescriptor->Control & SE_SELF_RELATIVE)
361 {
362 Owner = (PSID)(((ULONG_PTR)Owner) + (ULONG_PTR)ExplicitDescriptor);
363 }
364 }
365 else
366 {
367 if (Token != NULL)
368 {
369 DPRINT("Use token owner sid!\n");
370 Owner = Token->UserAndGroups[Token->DefaultOwnerIndex].Sid;
371 }
372 else
373 {
374 DPRINT("Use default owner sid!\n");
375 Owner = SeLocalSystemSid;
376 }
377
378 Control |= SE_OWNER_DEFAULTED;
379 }
380
381 OwnerLength = ROUND_UP(RtlLengthSid(Owner), 4);
382
383
384 /* Inherit the Group SID */
385 if (ExplicitDescriptor != NULL && ExplicitDescriptor->Group != NULL)
386 {
387 DPRINT("Use explicit group sid!\n");
388 Group = ExplicitDescriptor->Group;
389 if (ExplicitDescriptor->Control & SE_SELF_RELATIVE)
390 {
391 Group = (PSID)(((ULONG_PTR)Group) + (ULONG_PTR)ExplicitDescriptor);
392 }
393 }
394 else
395 {
396 if (Token != NULL)
397 {
398 DPRINT("Use token group sid!\n");
399 Group = Token->PrimaryGroup;
400 }
401 else
402 {
403 DPRINT("Use default group sid!\n");
404 Group = SeLocalSystemSid;
405 }
406
407 Control |= SE_OWNER_DEFAULTED;
408 }
409
410 GroupLength = ROUND_UP(RtlLengthSid(Group), 4);
411
412
413 /* Inherit the DACL */
414 if (ExplicitDescriptor != NULL &&
415 (ExplicitDescriptor->Control & SE_DACL_PRESENT) &&
416 !(ExplicitDescriptor->Control & SE_DACL_DEFAULTED))
417 {
418 DPRINT("Use explicit DACL!\n");
419 Dacl = ExplicitDescriptor->Dacl;
420 if (Dacl != NULL && (ExplicitDescriptor->Control & SE_SELF_RELATIVE))
421 {
422 Dacl = (PACL)(((ULONG_PTR)Dacl) + (ULONG_PTR)ExplicitDescriptor);
423 }
424
425 Control |= SE_DACL_PRESENT;
426 }
427 else if (ParentDescriptor != NULL &&
428 (ParentDescriptor->Control & SE_DACL_PRESENT))
429 {
430 DPRINT("Use parent DACL!\n");
431 /* FIXME: Inherit */
432 Dacl = ParentDescriptor->Dacl;
433 if (Dacl != NULL && (ParentDescriptor->Control & SE_SELF_RELATIVE))
434 {
435 Dacl = (PACL)(((ULONG_PTR)Dacl) + (ULONG_PTR)ParentDescriptor);
436 }
437 Control |= (SE_DACL_PRESENT & SE_DACL_DEFAULTED);
438 }
439 else if (Token != NULL && Token->DefaultDacl != NULL)
440 {
441 DPRINT("Use token default DACL!\n");
442 /* FIXME: Inherit */
443 Dacl = Token->DefaultDacl;
444 Control |= (SE_DACL_PRESENT & SE_DACL_DEFAULTED);
445 }
446 else
447 {
448 DPRINT("Use NULL DACL!\n");
449 Dacl = NULL;
450 Control |= (SE_DACL_PRESENT & SE_DACL_DEFAULTED);
451 }
452
453 DaclLength = (Dacl != NULL) ? ROUND_UP(Dacl->AclSize, 4) : 0;
454
455
456 /* Inherit the SACL */
457 if (ExplicitDescriptor != NULL &&
458 (ExplicitDescriptor->Control & SE_SACL_PRESENT) &&
459 !(ExplicitDescriptor->Control & SE_SACL_DEFAULTED))
460 {
461 DPRINT("Use explicit SACL!\n");
462 Sacl = ExplicitDescriptor->Sacl;
463 if (Sacl != NULL && (ExplicitDescriptor->Control & SE_SELF_RELATIVE))
464 {
465 Sacl = (PACL)(((ULONG_PTR)Sacl) + (ULONG_PTR)ExplicitDescriptor);
466 }
467
468 Control |= SE_SACL_PRESENT;
469 }
470 else if (ParentDescriptor != NULL &&
471 (ParentDescriptor->Control & SE_SACL_PRESENT))
472 {
473 DPRINT("Use parent SACL!\n");
474 /* FIXME: Inherit */
475 Sacl = ParentDescriptor->Sacl;
476 if (Sacl != NULL && (ParentDescriptor->Control & SE_SELF_RELATIVE))
477 {
478 Sacl = (PACL)(((ULONG_PTR)Sacl) + (ULONG_PTR)ParentDescriptor);
479 }
480 Control |= (SE_SACL_PRESENT & SE_SACL_DEFAULTED);
481 }
482
483 SaclLength = (Sacl != NULL) ? ROUND_UP(Sacl->AclSize, 4) : 0;
484
485
486 /* Allocate and initialize the new security descriptor */
487 Length = sizeof(SECURITY_DESCRIPTOR) + OwnerLength + GroupLength + DaclLength + SaclLength;
488
489 Descriptor = ExAllocatePool(NonPagedPool,
490 Length);
491 if (Descriptor == NULL)
492 {
493 DPRINT1("ExAlloctePool() failed\n");
494 /* FIXME: Unlock subject context */
495 return STATUS_INSUFFICIENT_RESOURCES;
496 }
497
498 RtlCreateSecurityDescriptor(Descriptor,
499 SECURITY_DESCRIPTOR_REVISION);
500
501 Descriptor->Control = Control | SE_SELF_RELATIVE;
502
503 Current = (ULONG_PTR)Descriptor + sizeof(SECURITY_DESCRIPTOR);
504
505 if (SaclLength != 0)
506 {
507 RtlCopyMemory((PVOID)Current,
508 Sacl,
509 SaclLength);
510 Descriptor->Sacl = (PACL)((ULONG_PTR)Current - (ULONG_PTR)Descriptor);
511 Current += SaclLength;
512 }
513
514 if (DaclLength != 0)
515 {
516 RtlCopyMemory((PVOID)Current,
517 Dacl,
518 DaclLength);
519 Descriptor->Dacl = (PACL)((ULONG_PTR)Current - (ULONG_PTR)Descriptor);
520 Current += DaclLength;
521 }
522
523 if (OwnerLength != 0)
524 {
525 RtlCopyMemory((PVOID)Current,
526 Owner,
527 OwnerLength);
528 Descriptor->Owner = (PSID)((ULONG_PTR)Current - (ULONG_PTR)Descriptor);
529 Current += OwnerLength;
530 }
531
532 if (GroupLength != 0)
533 {
534 memmove((PVOID)Current,
535 Group,
536 GroupLength);
537 Descriptor->Group = (PSID)((ULONG_PTR)Current - (ULONG_PTR)Descriptor);
538 }
539
540 /* FIXME: Unlock subject context */
541
542 *NewDescriptor = Descriptor;
543
544 return STATUS_SUCCESS;
545 }
546
547
548 static BOOLEAN
549 SepSidInToken(PACCESS_TOKEN Token,
550 PSID Sid)
551 {
552 ULONG i;
553
554 if (Token->UserAndGroupCount == 0)
555 {
556 return FALSE;
557 }
558
559 for (i=0; i<Token->UserAndGroupCount; i++)
560 {
561 if (RtlEqualSid(Sid, Token->UserAndGroups[i].Sid))
562 {
563 if (Token->UserAndGroups[i].Attributes & SE_GROUP_ENABLED)
564 {
565 return TRUE;
566 }
567
568 return FALSE;
569 }
570 }
571
572 return FALSE;
573 }
574
575
576 /*
577 * FUNCTION: Determines whether the requested access rights can be granted
578 * to an object protected by a security descriptor and an object owner
579 * ARGUMENTS:
580 * SecurityDescriptor = Security descriptor protecting the object
581 * SubjectSecurityContext = Subject's captured security context
582 * SubjectContextLocked = Indicates the user's subject context is locked
583 * DesiredAccess = Access rights the caller is trying to acquire
584 * PreviouslyGrantedAccess = Specified the access rights already granted
585 * Privileges = ?
586 * GenericMapping = Generic mapping associated with the object
587 * AccessMode = Access mode used for the check
588 * GrantedAccess (OUT) = On return specifies the access granted
589 * AccessStatus (OUT) = Status indicating why access was denied
590 * RETURNS: If access was granted, returns TRUE
591 *
592 * @implemented
593 */
594 BOOLEAN STDCALL
595 SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
596 IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
597 IN BOOLEAN SubjectContextLocked,
598 IN ACCESS_MASK DesiredAccess,
599 IN ACCESS_MASK PreviouslyGrantedAccess,
600 OUT PPRIVILEGE_SET* Privileges,
601 IN PGENERIC_MAPPING GenericMapping,
602 IN KPROCESSOR_MODE AccessMode,
603 OUT PACCESS_MASK GrantedAccess,
604 OUT PNTSTATUS AccessStatus)
605 {
606 LUID_AND_ATTRIBUTES Privilege;
607 ACCESS_MASK CurrentAccess;
608 PACCESS_TOKEN Token;
609 ULONG i;
610 PACL Dacl;
611 BOOLEAN Present;
612 BOOLEAN Defaulted;
613 PACE CurrentAce;
614 PSID Sid;
615 NTSTATUS Status;
616
617 CurrentAccess = PreviouslyGrantedAccess;
618
619 Token = SubjectSecurityContext->ClientToken ?
620 SubjectSecurityContext->ClientToken : SubjectSecurityContext->PrimaryToken;
621
622 /* Get the DACL */
623 Status = RtlGetDaclSecurityDescriptor(SecurityDescriptor,
624 &Present,
625 &Dacl,
626 &Defaulted);
627 if (!NT_SUCCESS(Status))
628 {
629 *AccessStatus = Status;
630 return FALSE;
631 }
632
633 /* RULE 1: Grant desired access if the object is unprotected */
634 if (Dacl == NULL)
635 {
636 *GrantedAccess = DesiredAccess;
637 *AccessStatus = STATUS_SUCCESS;
638 return TRUE;
639 }
640
641 CurrentAccess = PreviouslyGrantedAccess;
642
643 /* RULE 2: Check token for 'take ownership' privilege */
644 Privilege.Luid = SeTakeOwnershipPrivilege;
645 Privilege.Attributes = SE_PRIVILEGE_ENABLED;
646
647 if (SepPrivilegeCheck(Token,
648 &Privilege,
649 1,
650 PRIVILEGE_SET_ALL_NECESSARY,
651 AccessMode))
652 {
653 CurrentAccess |= WRITE_OWNER;
654 if (DesiredAccess == CurrentAccess)
655 {
656 *GrantedAccess = CurrentAccess;
657 *AccessStatus = STATUS_SUCCESS;
658 return TRUE;
659 }
660 }
661
662 /* RULE 3: Check whether the token is the owner */
663 Status = RtlGetOwnerSecurityDescriptor(SecurityDescriptor,
664 &Sid,
665 &Defaulted);
666 if (!NT_SUCCESS(Status))
667 {
668 DPRINT1("RtlGetOwnerSecurityDescriptor() failed (Status %lx)\n", Status);
669 *AccessStatus = Status;
670 return FALSE;
671 }
672
673 if (SepSidInToken(Token, Sid))
674 {
675 CurrentAccess |= (READ_CONTROL | WRITE_DAC);
676 if (DesiredAccess == CurrentAccess)
677 {
678 *GrantedAccess = CurrentAccess;
679 *AccessStatus = STATUS_SUCCESS;
680 return TRUE;
681 }
682 }
683
684 /* RULE 4: Grant rights according to the DACL */
685 CurrentAce = (PACE)(Dacl + 1);
686 for (i = 0; i < Dacl->AceCount; i++)
687 {
688 Sid = (PSID)(CurrentAce + 1);
689 if (CurrentAce->Header.AceType == ACCESS_DENIED_ACE_TYPE)
690 {
691 if (SepSidInToken(Token, Sid))
692 {
693 *GrantedAccess = 0;
694 *AccessStatus = STATUS_ACCESS_DENIED;
695 return TRUE;
696 }
697 }
698
699 if (CurrentAce->Header.AceType == ACCESS_ALLOWED_ACE_TYPE)
700 {
701 if (SepSidInToken(Token, Sid))
702 {
703 CurrentAccess |= CurrentAce->AccessMask;
704 }
705 }
706 }
707
708 DPRINT("CurrentAccess %08lx\n DesiredAccess %08lx\n",
709 CurrentAccess, DesiredAccess);
710
711 *GrantedAccess = CurrentAccess & DesiredAccess;
712
713 *AccessStatus =
714 (*GrantedAccess == DesiredAccess) ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
715
716 return TRUE;
717 }
718
719
720 NTSTATUS STDCALL
721 NtAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
722 IN HANDLE TokenHandle,
723 IN ACCESS_MASK DesiredAccess,
724 IN PGENERIC_MAPPING GenericMapping,
725 OUT PPRIVILEGE_SET PrivilegeSet,
726 OUT PULONG ReturnLength,
727 OUT PACCESS_MASK GrantedAccess,
728 OUT PNTSTATUS AccessStatus)
729 {
730 SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
731 KPROCESSOR_MODE PreviousMode;
732 PACCESS_TOKEN Token;
733 NTSTATUS Status;
734
735 DPRINT("NtAccessCheck() called\n");
736
737 PreviousMode = KeGetPreviousMode();
738 if (PreviousMode == KernelMode)
739 {
740 *GrantedAccess = DesiredAccess;
741 *AccessStatus = STATUS_SUCCESS;
742 return STATUS_SUCCESS;
743 }
744
745 Status = ObReferenceObjectByHandle(TokenHandle,
746 TOKEN_QUERY,
747 SepTokenObjectType,
748 PreviousMode,
749 (PVOID*)&Token,
750 NULL);
751 if (!NT_SUCCESS(Status))
752 {
753 DPRINT1("Failed to reference token (Status %lx)\n", Status);
754 return Status;
755 }
756
757 /* Check token type */
758 if (Token->TokenType != TokenImpersonation)
759 {
760 DPRINT1("No impersonation token\n");
761 ObDereferenceObject(Token);
762 return STATUS_ACCESS_VIOLATION;
763 }
764
765 /* Check impersonation level */
766 if (Token->ImpersonationLevel < SecurityAnonymous)
767 {
768 DPRINT1("Invalid impersonation level\n");
769 ObDereferenceObject(Token);
770 return STATUS_ACCESS_VIOLATION;
771 }
772
773 RtlZeroMemory(&SubjectSecurityContext,
774 sizeof(SECURITY_SUBJECT_CONTEXT));
775 SubjectSecurityContext.ClientToken = Token;
776 SubjectSecurityContext.ImpersonationLevel = Token->ImpersonationLevel;
777
778 /* FIXME: Lock subject context */
779
780 if (!SeAccessCheck(SecurityDescriptor,
781 &SubjectSecurityContext,
782 TRUE,
783 DesiredAccess,
784 0,
785 &PrivilegeSet,
786 GenericMapping,
787 PreviousMode,
788 GrantedAccess,
789 AccessStatus))
790 {
791 Status = *AccessStatus;
792 }
793 else
794 {
795 Status = STATUS_ACCESS_DENIED;
796 }
797
798 /* FIXME: Unlock subject context */
799
800 ObDereferenceObject(Token);
801
802 DPRINT("NtAccessCheck() done\n");
803
804 return Status;
805 }
806
807 /* EOF */