Add missing processor architecture cases
[reactos.git] / reactos / ntoskrnl / se / semgr.c
1 /* $Id$
2 *
3 * COPYRIGHT: See COPYING in the top level directory
4 * PROJECT: ReactOS kernel
5 * FILE: ntoskrnl/se/semgr.c
6 * PURPOSE: Security manager
7 *
8 * PROGRAMMERS: No programmer listed.
9 */
10
11 /* INCLUDES *****************************************************************/
12
13 #include <ntoskrnl.h>
14 #define NDEBUG
15 #include <internal/debug.h>
16
17 /* GLOBALS ******************************************************************/
18
19 PSE_EXPORTS SeExports = NULL;
20 SE_EXPORTS SepExports;
21
22 static ERESOURCE SepSubjectContextLock;
23
24
25 /* PROTOTYPES ***************************************************************/
26
27 static BOOLEAN SepInitExports(VOID);
28
29 #if defined (ALLOC_PRAGMA)
30 #pragma alloc_text(INIT, SeInit1)
31 #pragma alloc_text(INIT, SeInit2)
32 #pragma alloc_text(INIT, SepInitExports)
33 #endif
34
35 /* FUNCTIONS ****************************************************************/
36
37 BOOLEAN
38 INIT_FUNCTION
39 NTAPI
40 SeInit1(VOID)
41 {
42 SepInitLuid();
43
44 if (!SepInitSecurityIDs())
45 return FALSE;
46
47 if (!SepInitDACLs())
48 return FALSE;
49
50 if (!SepInitSDs())
51 return FALSE;
52
53 SepInitPrivileges();
54
55 if (!SepInitExports())
56 return FALSE;
57
58 /* Initialize the subject context lock */
59 ExInitializeResource(&SepSubjectContextLock);
60
61 return TRUE;
62 }
63
64
65 BOOLEAN
66 INIT_FUNCTION
67 NTAPI
68 SeInit2(VOID)
69 {
70 SepInitializeTokenImplementation();
71
72 return TRUE;
73 }
74
75
76 BOOLEAN
77 NTAPI
78 SeInitSRM(VOID)
79 {
80 OBJECT_ATTRIBUTES ObjectAttributes;
81 UNICODE_STRING Name;
82 HANDLE DirectoryHandle;
83 HANDLE EventHandle;
84 NTSTATUS Status;
85
86 /* Create '\Security' directory */
87 RtlInitUnicodeString(&Name,
88 L"\\Security");
89 InitializeObjectAttributes(&ObjectAttributes,
90 &Name,
91 OBJ_PERMANENT,
92 0,
93 NULL);
94 Status = ZwCreateDirectoryObject(&DirectoryHandle,
95 DIRECTORY_ALL_ACCESS,
96 &ObjectAttributes);
97 if (!NT_SUCCESS(Status))
98 {
99 DPRINT1("Failed to create 'Security' directory!\n");
100 return FALSE;
101 }
102
103 /* Create 'LSA_AUTHENTICATION_INITALIZED' event */
104 RtlInitUnicodeString(&Name,
105 L"\\LSA_AUTHENTICATION_INITALIZED");
106 InitializeObjectAttributes(&ObjectAttributes,
107 &Name,
108 OBJ_PERMANENT,
109 DirectoryHandle,
110 SePublicDefaultSd);
111 Status = ZwCreateEvent(&EventHandle,
112 EVENT_ALL_ACCESS,
113 &ObjectAttributes,
114 SynchronizationEvent,
115 FALSE);
116 if (!NT_SUCCESS(Status))
117 {
118 DPRINT1("Failed to create 'LSA_AUTHENTICATION_INITALIZED' event!\n");
119 NtClose(DirectoryHandle);
120 return FALSE;
121 }
122
123 ZwClose(EventHandle);
124 ZwClose(DirectoryHandle);
125
126 /* FIXME: Create SRM port and listener thread */
127
128 return TRUE;
129 }
130
131
132 static BOOLEAN INIT_FUNCTION
133 SepInitExports(VOID)
134 {
135 SepExports.SeCreateTokenPrivilege = SeCreateTokenPrivilege;
136 SepExports.SeAssignPrimaryTokenPrivilege = SeAssignPrimaryTokenPrivilege;
137 SepExports.SeLockMemoryPrivilege = SeLockMemoryPrivilege;
138 SepExports.SeIncreaseQuotaPrivilege = SeIncreaseQuotaPrivilege;
139 SepExports.SeUnsolicitedInputPrivilege = SeUnsolicitedInputPrivilege;
140 SepExports.SeTcbPrivilege = SeTcbPrivilege;
141 SepExports.SeSecurityPrivilege = SeSecurityPrivilege;
142 SepExports.SeTakeOwnershipPrivilege = SeTakeOwnershipPrivilege;
143 SepExports.SeLoadDriverPrivilege = SeLoadDriverPrivilege;
144 SepExports.SeCreatePagefilePrivilege = SeCreatePagefilePrivilege;
145 SepExports.SeIncreaseBasePriorityPrivilege = SeIncreaseBasePriorityPrivilege;
146 SepExports.SeSystemProfilePrivilege = SeSystemProfilePrivilege;
147 SepExports.SeSystemtimePrivilege = SeSystemtimePrivilege;
148 SepExports.SeProfileSingleProcessPrivilege = SeProfileSingleProcessPrivilege;
149 SepExports.SeCreatePermanentPrivilege = SeCreatePermanentPrivilege;
150 SepExports.SeBackupPrivilege = SeBackupPrivilege;
151 SepExports.SeRestorePrivilege = SeRestorePrivilege;
152 SepExports.SeShutdownPrivilege = SeShutdownPrivilege;
153 SepExports.SeDebugPrivilege = SeDebugPrivilege;
154 SepExports.SeAuditPrivilege = SeAuditPrivilege;
155 SepExports.SeSystemEnvironmentPrivilege = SeSystemEnvironmentPrivilege;
156 SepExports.SeChangeNotifyPrivilege = SeChangeNotifyPrivilege;
157 SepExports.SeRemoteShutdownPrivilege = SeRemoteShutdownPrivilege;
158
159 SepExports.SeNullSid = SeNullSid;
160 SepExports.SeWorldSid = SeWorldSid;
161 SepExports.SeLocalSid = SeLocalSid;
162 SepExports.SeCreatorOwnerSid = SeCreatorOwnerSid;
163 SepExports.SeCreatorGroupSid = SeCreatorGroupSid;
164 SepExports.SeNtAuthoritySid = SeNtAuthoritySid;
165 SepExports.SeDialupSid = SeDialupSid;
166 SepExports.SeNetworkSid = SeNetworkSid;
167 SepExports.SeBatchSid = SeBatchSid;
168 SepExports.SeInteractiveSid = SeInteractiveSid;
169 SepExports.SeLocalSystemSid = SeLocalSystemSid;
170 SepExports.SeAliasAdminsSid = SeAliasAdminsSid;
171 SepExports.SeAliasUsersSid = SeAliasUsersSid;
172 SepExports.SeAliasGuestsSid = SeAliasGuestsSid;
173 SepExports.SeAliasPowerUsersSid = SeAliasPowerUsersSid;
174 SepExports.SeAliasAccountOpsSid = SeAliasAccountOpsSid;
175 SepExports.SeAliasSystemOpsSid = SeAliasSystemOpsSid;
176 SepExports.SeAliasPrintOpsSid = SeAliasPrintOpsSid;
177 SepExports.SeAliasBackupOpsSid = SeAliasBackupOpsSid;
178 SepExports.SeAuthenticatedUsersSid = SeAuthenticatedUsersSid;
179 SepExports.SeRestrictedSid = SeRestrictedSid;
180 SepExports.SeAnonymousLogonSid = SeAnonymousLogonSid;
181
182 SepExports.SeUndockPrivilege = SeUndockPrivilege;
183 SepExports.SeSyncAgentPrivilege = SeSyncAgentPrivilege;
184 SepExports.SeEnableDelegationPrivilege = SeEnableDelegationPrivilege;
185
186 SeExports = &SepExports;
187 return TRUE;
188 }
189
190
191 VOID SepReferenceLogonSession(PLUID AuthenticationId)
192 {
193 UNIMPLEMENTED;
194 }
195
196 VOID SepDeReferenceLogonSession(PLUID AuthenticationId)
197 {
198 UNIMPLEMENTED;
199 }
200
201 NTSTATUS
202 STDCALL
203 SeDefaultObjectMethod(PVOID Object,
204 SECURITY_OPERATION_CODE OperationType,
205 SECURITY_INFORMATION SecurityInformation,
206 PSECURITY_DESCRIPTOR _SecurityDescriptor,
207 PULONG ReturnLength,
208 PSECURITY_DESCRIPTOR *OldSecurityDescriptor,
209 POOL_TYPE PoolType,
210 PGENERIC_MAPPING GenericMapping)
211 {
212 PISECURITY_DESCRIPTOR ObjectSd;
213 PISECURITY_DESCRIPTOR NewSd;
214 PISECURITY_DESCRIPTOR SecurityDescriptor = _SecurityDescriptor;
215 POBJECT_HEADER Header = BODY_TO_HEADER(Object);
216 PSID Owner = 0;
217 PSID Group = 0;
218 PACL Dacl = 0;
219 PACL Sacl = 0;
220 ULONG OwnerLength = 0;
221 ULONG GroupLength = 0;
222 ULONG DaclLength = 0;
223 ULONG SaclLength = 0;
224 ULONG Control = 0;
225 ULONG_PTR Current;
226 NTSTATUS Status;
227
228 if (OperationType == SetSecurityDescriptor)
229 {
230 ObjectSd = Header->SecurityDescriptor;
231
232 /* Get owner and owner size */
233 if (SecurityInformation & OWNER_SECURITY_INFORMATION)
234 {
235 if (SecurityDescriptor->Owner != NULL)
236 {
237 if( SecurityDescriptor->Control & SE_SELF_RELATIVE )
238 Owner = (PSID)((ULONG_PTR)SecurityDescriptor->Owner +
239 (ULONG_PTR)SecurityDescriptor);
240 else
241 Owner = (PSID)SecurityDescriptor->Owner;
242 OwnerLength = ROUND_UP(RtlLengthSid(Owner), 4);
243 }
244 Control |= (SecurityDescriptor->Control & SE_OWNER_DEFAULTED);
245 }
246 else
247 {
248 if (ObjectSd->Owner != NULL)
249 {
250 Owner = (PSID)((ULONG_PTR)ObjectSd->Owner + (ULONG_PTR)ObjectSd);
251 OwnerLength = ROUND_UP(RtlLengthSid(Owner), 4);
252 }
253 Control |= (ObjectSd->Control & SE_OWNER_DEFAULTED);
254 }
255
256 /* Get group and group size */
257 if (SecurityInformation & GROUP_SECURITY_INFORMATION)
258 {
259 if (SecurityDescriptor->Group != NULL)
260 {
261 if( SecurityDescriptor->Control & SE_SELF_RELATIVE )
262 Group = (PSID)((ULONG_PTR)SecurityDescriptor->Group +
263 (ULONG_PTR)SecurityDescriptor);
264 else
265 Group = (PSID)SecurityDescriptor->Group;
266 GroupLength = ROUND_UP(RtlLengthSid(Group), 4);
267 }
268 Control |= (SecurityDescriptor->Control & SE_GROUP_DEFAULTED);
269 }
270 else
271 {
272 if (ObjectSd->Group != NULL)
273 {
274 Group = (PSID)((ULONG_PTR)ObjectSd->Group + (ULONG_PTR)ObjectSd);
275 GroupLength = ROUND_UP(RtlLengthSid(Group), 4);
276 }
277 Control |= (ObjectSd->Control & SE_GROUP_DEFAULTED);
278 }
279
280 /* Get DACL and DACL size */
281 if (SecurityInformation & DACL_SECURITY_INFORMATION)
282 {
283 if ((SecurityDescriptor->Control & SE_DACL_PRESENT) &&
284 (SecurityDescriptor->Dacl != NULL))
285 {
286 if( SecurityDescriptor->Control & SE_SELF_RELATIVE )
287 Dacl = (PACL)((ULONG_PTR)SecurityDescriptor->Dacl +
288 (ULONG_PTR)SecurityDescriptor);
289 else
290 Dacl = (PACL)SecurityDescriptor->Dacl;
291
292 DaclLength = ROUND_UP((ULONG)Dacl->AclSize, 4);
293 }
294 Control |= (SecurityDescriptor->Control & (SE_DACL_DEFAULTED | SE_DACL_PRESENT));
295 }
296 else
297 {
298 if ((ObjectSd->Control & SE_DACL_PRESENT) &&
299 (ObjectSd->Dacl != NULL))
300 {
301 Dacl = (PACL)((ULONG_PTR)ObjectSd->Dacl + (ULONG_PTR)ObjectSd);
302 DaclLength = ROUND_UP((ULONG)Dacl->AclSize, 4);
303 }
304 Control |= (ObjectSd->Control & (SE_DACL_DEFAULTED | SE_DACL_PRESENT));
305 }
306
307 /* Get SACL and SACL size */
308 if (SecurityInformation & SACL_SECURITY_INFORMATION)
309 {
310 if ((SecurityDescriptor->Control & SE_SACL_PRESENT) &&
311 (SecurityDescriptor->Sacl != NULL))
312 {
313 if( SecurityDescriptor->Control & SE_SELF_RELATIVE )
314 Sacl = (PACL)((ULONG_PTR)SecurityDescriptor->Sacl +
315 (ULONG_PTR)SecurityDescriptor);
316 else
317 Sacl = (PACL)SecurityDescriptor->Sacl;
318 SaclLength = ROUND_UP((ULONG)Sacl->AclSize, 4);
319 }
320 Control |= (SecurityDescriptor->Control & (SE_SACL_DEFAULTED | SE_SACL_PRESENT));
321 }
322 else
323 {
324 if ((ObjectSd->Control & SE_SACL_PRESENT) &&
325 (ObjectSd->Sacl != NULL))
326 {
327 Sacl = (PACL)((ULONG_PTR)ObjectSd->Sacl + (ULONG_PTR)ObjectSd);
328 SaclLength = ROUND_UP((ULONG)Sacl->AclSize, 4);
329 }
330 Control |= (ObjectSd->Control & (SE_SACL_DEFAULTED | SE_SACL_PRESENT));
331 }
332
333 NewSd = ExAllocatePool(NonPagedPool,
334 sizeof(SECURITY_DESCRIPTOR) + OwnerLength + GroupLength +
335 DaclLength + SaclLength);
336 if (NewSd == NULL)
337 {
338 ObDereferenceObject(Object);
339 return STATUS_INSUFFICIENT_RESOURCES;
340 }
341
342 RtlCreateSecurityDescriptor(NewSd,
343 SECURITY_DESCRIPTOR_REVISION1);
344 /* We always build a self-relative descriptor */
345 NewSd->Control = Control | SE_SELF_RELATIVE;
346
347 Current = (ULONG_PTR)NewSd + sizeof(SECURITY_DESCRIPTOR);
348
349 if (OwnerLength != 0)
350 {
351 RtlCopyMemory((PVOID)Current,
352 Owner,
353 OwnerLength);
354 NewSd->Owner = (PSID)(Current - (ULONG_PTR)NewSd);
355 Current += OwnerLength;
356 }
357
358 if (GroupLength != 0)
359 {
360 RtlCopyMemory((PVOID)Current,
361 Group,
362 GroupLength);
363 NewSd->Group = (PSID)(Current - (ULONG_PTR)NewSd);
364 Current += GroupLength;
365 }
366
367 if (DaclLength != 0)
368 {
369 RtlCopyMemory((PVOID)Current,
370 Dacl,
371 DaclLength);
372 NewSd->Dacl = (PACL)(Current - (ULONG_PTR)NewSd);
373 Current += DaclLength;
374 }
375
376 if (SaclLength != 0)
377 {
378 RtlCopyMemory((PVOID)Current,
379 Sacl,
380 SaclLength);
381 NewSd->Sacl = (PACL)(Current - (ULONG_PTR)NewSd);
382 Current += SaclLength;
383 }
384
385 /* Add the new SD */
386 Status = ObpAddSecurityDescriptor(NewSd,
387 &Header->SecurityDescriptor);
388 if (NT_SUCCESS(Status))
389 {
390 /* Remove the old security descriptor */
391 ObpRemoveSecurityDescriptor(ObjectSd);
392 }
393 else
394 {
395 /* Restore the old security descriptor */
396 Header->SecurityDescriptor = ObjectSd;
397 }
398
399 ExFreePool(NewSd);
400 }
401 else if (OperationType == QuerySecurityDescriptor)
402 {
403 Status = SeQuerySecurityDescriptorInfo(&SecurityInformation,
404 SecurityDescriptor,
405 ReturnLength,
406 &Header->SecurityDescriptor);
407 }
408 else if (OperationType == AssignSecurityDescriptor)
409 {
410 /* Assign the security descriptor to the object header */
411 Status = ObpAddSecurityDescriptor(SecurityDescriptor,
412 &Header->SecurityDescriptor);
413 }
414
415
416 return STATUS_SUCCESS;
417 }
418
419 /*
420 * @implemented
421 */
422 VOID STDCALL
423 SeCaptureSubjectContext(OUT PSECURITY_SUBJECT_CONTEXT SubjectContext)
424 {
425 PETHREAD Thread;
426 BOOLEAN CopyOnOpen;
427 BOOLEAN EffectiveOnly;
428
429 PAGED_CODE();
430
431 Thread = PsGetCurrentThread();
432 if (Thread == NULL)
433 {
434 SubjectContext->ProcessAuditId = 0;
435 SubjectContext->PrimaryToken = NULL;
436 SubjectContext->ClientToken = NULL;
437 SubjectContext->ImpersonationLevel = 0;
438 }
439 else
440 {
441 SubjectContext->ProcessAuditId = Thread->ThreadsProcess;
442 SubjectContext->ClientToken =
443 PsReferenceImpersonationToken(Thread,
444 &CopyOnOpen,
445 &EffectiveOnly,
446 &SubjectContext->ImpersonationLevel);
447 SubjectContext->PrimaryToken = PsReferencePrimaryToken(Thread->ThreadsProcess);
448 }
449 }
450
451
452 /*
453 * @implemented
454 */
455 VOID STDCALL
456 SeLockSubjectContext(IN PSECURITY_SUBJECT_CONTEXT SubjectContext)
457 {
458 PAGED_CODE();
459
460 KeEnterCriticalRegion();
461 ExAcquireResourceExclusiveLite(&SepSubjectContextLock, TRUE);
462 }
463
464
465 /*
466 * @implemented
467 */
468 VOID STDCALL
469 SeUnlockSubjectContext(IN PSECURITY_SUBJECT_CONTEXT SubjectContext)
470 {
471 PAGED_CODE();
472
473 ExReleaseResourceLite(&SepSubjectContextLock);
474 KeLeaveCriticalRegion();
475 }
476
477
478 /*
479 * @implemented
480 */
481 VOID STDCALL
482 SeReleaseSubjectContext(IN PSECURITY_SUBJECT_CONTEXT SubjectContext)
483 {
484 PAGED_CODE();
485
486 if (SubjectContext->PrimaryToken != NULL)
487 {
488 ObDereferenceObject(SubjectContext->PrimaryToken);
489 }
490
491 if (SubjectContext->ClientToken != NULL)
492 {
493 ObDereferenceObject(SubjectContext->ClientToken);
494 }
495 }
496
497
498 /*
499 * @implemented
500 */
501 NTSTATUS STDCALL
502 SeDeassignSecurity(PSECURITY_DESCRIPTOR *SecurityDescriptor)
503 {
504 PAGED_CODE();
505
506 if (*SecurityDescriptor != NULL)
507 {
508 ExFreePool(*SecurityDescriptor);
509 *SecurityDescriptor = NULL;
510 }
511
512 return STATUS_SUCCESS;
513 }
514
515
516 /*
517 * @unimplemented
518 */
519 NTSTATUS STDCALL
520 SeAssignSecurityEx(IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL,
521 IN PSECURITY_DESCRIPTOR ExplicitDescriptor OPTIONAL,
522 OUT PSECURITY_DESCRIPTOR *NewDescriptor,
523 IN GUID *ObjectType OPTIONAL,
524 IN BOOLEAN IsDirectoryObject,
525 IN ULONG AutoInheritFlags,
526 IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
527 IN PGENERIC_MAPPING GenericMapping,
528 IN POOL_TYPE PoolType)
529 {
530 UNIMPLEMENTED;
531 return STATUS_NOT_IMPLEMENTED;
532 }
533
534
535 /*
536 * FUNCTION: Creates a security descriptor for a new object.
537 * ARGUMENTS:
538 * ParentDescriptor =
539 * ExplicitDescriptor =
540 * NewDescriptor =
541 * IsDirectoryObject =
542 * SubjectContext =
543 * GeneralMapping =
544 * PoolType =
545 * RETURNS: Status
546 *
547 * @implemented
548 */
549 NTSTATUS STDCALL
550 SeAssignSecurity(PSECURITY_DESCRIPTOR _ParentDescriptor OPTIONAL,
551 PSECURITY_DESCRIPTOR _ExplicitDescriptor OPTIONAL,
552 PSECURITY_DESCRIPTOR *NewDescriptor,
553 BOOLEAN IsDirectoryObject,
554 PSECURITY_SUBJECT_CONTEXT SubjectContext,
555 PGENERIC_MAPPING GenericMapping,
556 POOL_TYPE PoolType)
557 {
558 PISECURITY_DESCRIPTOR ParentDescriptor = _ParentDescriptor;
559 PISECURITY_DESCRIPTOR ExplicitDescriptor = _ExplicitDescriptor;
560 PISECURITY_DESCRIPTOR Descriptor;
561 PTOKEN Token;
562 ULONG OwnerLength = 0;
563 ULONG GroupLength = 0;
564 ULONG DaclLength = 0;
565 ULONG SaclLength = 0;
566 ULONG Length = 0;
567 ULONG Control = 0;
568 ULONG_PTR Current;
569 PSID Owner = NULL;
570 PSID Group = NULL;
571 PACL Dacl = NULL;
572 PACL Sacl = NULL;
573
574 PAGED_CODE();
575
576 /* Lock subject context */
577 SeLockSubjectContext(SubjectContext);
578
579 if (SubjectContext->ClientToken != NULL)
580 {
581 Token = SubjectContext->ClientToken;
582 }
583 else
584 {
585 Token = SubjectContext->PrimaryToken;
586 }
587
588
589 /* Inherit the Owner SID */
590 if (ExplicitDescriptor != NULL && ExplicitDescriptor->Owner != NULL)
591 {
592 DPRINT("Use explicit owner sid!\n");
593 Owner = ExplicitDescriptor->Owner;
594
595 if (ExplicitDescriptor->Control & SE_SELF_RELATIVE)
596 {
597 Owner = (PSID)(((ULONG_PTR)Owner) + (ULONG_PTR)ExplicitDescriptor);
598
599 }
600 }
601 else
602 {
603 if (Token != NULL)
604 {
605 DPRINT("Use token owner sid!\n");
606 Owner = Token->UserAndGroups[Token->DefaultOwnerIndex].Sid;
607 }
608 else
609 {
610 DPRINT("Use default owner sid!\n");
611 Owner = SeLocalSystemSid;
612 }
613
614 Control |= SE_OWNER_DEFAULTED;
615 }
616
617 OwnerLength = ROUND_UP(RtlLengthSid(Owner), 4);
618
619
620 /* Inherit the Group SID */
621 if (ExplicitDescriptor != NULL && ExplicitDescriptor->Group != NULL)
622 {
623 DPRINT("Use explicit group sid!\n");
624 Group = ExplicitDescriptor->Group;
625 if (ExplicitDescriptor->Control & SE_SELF_RELATIVE)
626 {
627 Group = (PSID)(((ULONG_PTR)Group) + (ULONG_PTR)ExplicitDescriptor);
628 }
629 }
630 else
631 {
632 if (Token != NULL)
633 {
634 DPRINT("Use token group sid!\n");
635 Group = Token->PrimaryGroup;
636 }
637 else
638 {
639 DPRINT("Use default group sid!\n");
640 Group = SeLocalSystemSid;
641 }
642
643 Control |= SE_OWNER_DEFAULTED;
644 }
645
646 GroupLength = ROUND_UP(RtlLengthSid(Group), 4);
647
648
649 /* Inherit the DACL */
650 if (ExplicitDescriptor != NULL &&
651 (ExplicitDescriptor->Control & SE_DACL_PRESENT) &&
652 !(ExplicitDescriptor->Control & SE_DACL_DEFAULTED))
653 {
654 DPRINT("Use explicit DACL!\n");
655 Dacl = ExplicitDescriptor->Dacl;
656 if (Dacl != NULL && (ExplicitDescriptor->Control & SE_SELF_RELATIVE))
657 {
658 Dacl = (PACL)(((ULONG_PTR)Dacl) + (ULONG_PTR)ExplicitDescriptor);
659 }
660
661 Control |= SE_DACL_PRESENT;
662 }
663 else if (ParentDescriptor != NULL &&
664 (ParentDescriptor->Control & SE_DACL_PRESENT))
665 {
666 DPRINT("Use parent DACL!\n");
667 /* FIXME: Inherit */
668 Dacl = ParentDescriptor->Dacl;
669 if (Dacl != NULL && (ParentDescriptor->Control & SE_SELF_RELATIVE))
670 {
671 Dacl = (PACL)(((ULONG_PTR)Dacl) + (ULONG_PTR)ParentDescriptor);
672 }
673 Control |= (SE_DACL_PRESENT | SE_DACL_DEFAULTED);
674 }
675 else if (Token != NULL && Token->DefaultDacl != NULL)
676 {
677 DPRINT("Use token default DACL!\n");
678 /* FIXME: Inherit */
679 Dacl = Token->DefaultDacl;
680 Control |= (SE_DACL_PRESENT | SE_DACL_DEFAULTED);
681 }
682 else
683 {
684 DPRINT("Use NULL DACL!\n");
685 Dacl = NULL;
686 Control |= (SE_DACL_PRESENT | SE_DACL_DEFAULTED);
687 }
688
689 DaclLength = (Dacl != NULL) ? ROUND_UP(Dacl->AclSize, 4) : 0;
690
691
692 /* Inherit the SACL */
693 if (ExplicitDescriptor != NULL &&
694 (ExplicitDescriptor->Control & SE_SACL_PRESENT) &&
695 !(ExplicitDescriptor->Control & SE_SACL_DEFAULTED))
696 {
697 DPRINT("Use explicit SACL!\n");
698 Sacl = ExplicitDescriptor->Sacl;
699 if (Sacl != NULL && (ExplicitDescriptor->Control & SE_SELF_RELATIVE))
700 {
701 Sacl = (PACL)(((ULONG_PTR)Sacl) + (ULONG_PTR)ExplicitDescriptor);
702 }
703
704 Control |= SE_SACL_PRESENT;
705 }
706 else if (ParentDescriptor != NULL &&
707 (ParentDescriptor->Control & SE_SACL_PRESENT))
708 {
709 DPRINT("Use parent SACL!\n");
710 /* FIXME: Inherit */
711 Sacl = ParentDescriptor->Sacl;
712 if (Sacl != NULL && (ParentDescriptor->Control & SE_SELF_RELATIVE))
713 {
714 Sacl = (PACL)(((ULONG_PTR)Sacl) + (ULONG_PTR)ParentDescriptor);
715 }
716 Control |= (SE_SACL_PRESENT | SE_SACL_DEFAULTED);
717 }
718
719 SaclLength = (Sacl != NULL) ? ROUND_UP(Sacl->AclSize, 4) : 0;
720
721
722 /* Allocate and initialize the new security descriptor */
723 Length = sizeof(SECURITY_DESCRIPTOR) +
724 OwnerLength + GroupLength + DaclLength + SaclLength;
725
726 DPRINT("L: sizeof(SECURITY_DESCRIPTOR) %d OwnerLength %d GroupLength %d DaclLength %d SaclLength %d\n",
727 sizeof(SECURITY_DESCRIPTOR),
728 OwnerLength,
729 GroupLength,
730 DaclLength,
731 SaclLength);
732
733 Descriptor = ExAllocatePool(PagedPool,
734 Length);
735 if (Descriptor == NULL)
736 {
737 DPRINT1("ExAlloctePool() failed\n");
738 /* FIXME: Unlock subject context */
739 return STATUS_INSUFFICIENT_RESOURCES;
740 }
741
742 RtlZeroMemory( Descriptor, Length );
743 RtlCreateSecurityDescriptor(Descriptor,
744 SECURITY_DESCRIPTOR_REVISION);
745
746 Descriptor->Control = Control | SE_SELF_RELATIVE;
747
748 Current = (ULONG_PTR)Descriptor + sizeof(SECURITY_DESCRIPTOR);
749
750 if (SaclLength != 0)
751 {
752 RtlCopyMemory((PVOID)Current,
753 Sacl,
754 SaclLength);
755 Descriptor->Sacl = (PACL)((ULONG_PTR)Current - (ULONG_PTR)Descriptor);
756 Current += SaclLength;
757 }
758
759 if (DaclLength != 0)
760 {
761 RtlCopyMemory((PVOID)Current,
762 Dacl,
763 DaclLength);
764 Descriptor->Dacl = (PACL)((ULONG_PTR)Current - (ULONG_PTR)Descriptor);
765 Current += DaclLength;
766 }
767
768 if (OwnerLength != 0)
769 {
770 RtlCopyMemory((PVOID)Current,
771 Owner,
772 OwnerLength);
773 Descriptor->Owner = (PSID)((ULONG_PTR)Current - (ULONG_PTR)Descriptor);
774 Current += OwnerLength;
775 DPRINT("Owner of %x at %x\n", Descriptor, Descriptor->Owner);
776 }
777 else
778 DPRINT("Owner of %x is zero length\n", Descriptor);
779
780 if (GroupLength != 0)
781 {
782 memmove((PVOID)Current,
783 Group,
784 GroupLength);
785 Descriptor->Group = (PSID)((ULONG_PTR)Current - (ULONG_PTR)Descriptor);
786 }
787
788 /* Unlock subject context */
789 SeUnlockSubjectContext(SubjectContext);
790
791 *NewDescriptor = Descriptor;
792
793 DPRINT("Descrptor %x\n", Descriptor);
794 ASSERT(RtlLengthSecurityDescriptor(Descriptor));
795
796 return STATUS_SUCCESS;
797 }
798
799
800 static BOOLEAN
801 SepSidInToken(PACCESS_TOKEN _Token,
802 PSID Sid)
803 {
804 ULONG i;
805 PTOKEN Token = (PTOKEN)_Token;
806
807 PAGED_CODE();
808
809 if (Token->UserAndGroupCount == 0)
810 {
811 return FALSE;
812 }
813
814 for (i=0; i<Token->UserAndGroupCount; i++)
815 {
816 if (RtlEqualSid(Sid, Token->UserAndGroups[i].Sid))
817 {
818 if (Token->UserAndGroups[i].Attributes & SE_GROUP_ENABLED)
819 {
820 return TRUE;
821 }
822
823 return FALSE;
824 }
825 }
826
827 return FALSE;
828 }
829
830
831 /*
832 * FUNCTION: Determines whether the requested access rights can be granted
833 * to an object protected by a security descriptor and an object owner
834 * ARGUMENTS:
835 * SecurityDescriptor = Security descriptor protecting the object
836 * SubjectSecurityContext = Subject's captured security context
837 * SubjectContextLocked = Indicates the user's subject context is locked
838 * DesiredAccess = Access rights the caller is trying to acquire
839 * PreviouslyGrantedAccess = Specified the access rights already granted
840 * Privileges = ?
841 * GenericMapping = Generic mapping associated with the object
842 * AccessMode = Access mode used for the check
843 * GrantedAccess (OUT) = On return specifies the access granted
844 * AccessStatus (OUT) = Status indicating why access was denied
845 * RETURNS: If access was granted, returns TRUE
846 *
847 * @implemented
848 */
849 BOOLEAN STDCALL
850 SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
851 IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
852 IN BOOLEAN SubjectContextLocked,
853 IN ACCESS_MASK DesiredAccess,
854 IN ACCESS_MASK PreviouslyGrantedAccess,
855 OUT PPRIVILEGE_SET* Privileges,
856 IN PGENERIC_MAPPING GenericMapping,
857 IN KPROCESSOR_MODE AccessMode,
858 OUT PACCESS_MASK GrantedAccess,
859 OUT PNTSTATUS AccessStatus)
860 {
861 LUID_AND_ATTRIBUTES Privilege;
862 ACCESS_MASK CurrentAccess;
863 PACCESS_TOKEN Token;
864 ULONG i;
865 PACL Dacl;
866 BOOLEAN Present;
867 BOOLEAN Defaulted;
868 PACE CurrentAce;
869 PSID Sid;
870 NTSTATUS Status;
871
872 PAGED_CODE();
873
874 CurrentAccess = PreviouslyGrantedAccess;
875
876 if (SubjectContextLocked == FALSE)
877 {
878 SeLockSubjectContext(SubjectSecurityContext);
879 }
880
881 Token = SubjectSecurityContext->ClientToken ?
882 SubjectSecurityContext->ClientToken : SubjectSecurityContext->PrimaryToken;
883
884 /* Get the DACL */
885 Status = RtlGetDaclSecurityDescriptor(SecurityDescriptor,
886 &Present,
887 &Dacl,
888 &Defaulted);
889 if (!NT_SUCCESS(Status))
890 {
891 if (SubjectContextLocked == FALSE)
892 {
893 SeUnlockSubjectContext(SubjectSecurityContext);
894 }
895
896 *AccessStatus = Status;
897 return FALSE;
898 }
899
900 /* RULE 1: Grant desired access if the object is unprotected */
901 if (Present == TRUE && Dacl == NULL)
902 {
903 if (SubjectContextLocked == FALSE)
904 {
905 SeUnlockSubjectContext(SubjectSecurityContext);
906 }
907
908 *GrantedAccess = DesiredAccess;
909 *AccessStatus = STATUS_SUCCESS;
910 return TRUE;
911 }
912
913 CurrentAccess = PreviouslyGrantedAccess;
914
915 /* RULE 2: Check token for 'take ownership' privilege */
916 Privilege.Luid = SeTakeOwnershipPrivilege;
917 Privilege.Attributes = SE_PRIVILEGE_ENABLED;
918
919 if (SepPrivilegeCheck(Token,
920 &Privilege,
921 1,
922 PRIVILEGE_SET_ALL_NECESSARY,
923 AccessMode))
924 {
925 CurrentAccess |= WRITE_OWNER;
926 if (DesiredAccess == CurrentAccess)
927 {
928 if (SubjectContextLocked == FALSE)
929 {
930 SeUnlockSubjectContext(SubjectSecurityContext);
931 }
932
933 *GrantedAccess = CurrentAccess;
934 *AccessStatus = STATUS_SUCCESS;
935 return TRUE;
936 }
937 }
938
939 /* RULE 3: Check whether the token is the owner */
940 Status = RtlGetOwnerSecurityDescriptor(SecurityDescriptor,
941 &Sid,
942 &Defaulted);
943 if (!NT_SUCCESS(Status))
944 {
945 DPRINT1("RtlGetOwnerSecurityDescriptor() failed (Status %lx)\n", Status);
946 if (SubjectContextLocked == FALSE)
947 {
948 SeUnlockSubjectContext(SubjectSecurityContext);
949 }
950
951 *AccessStatus = Status;
952 return FALSE;
953 }
954
955 if (SepSidInToken(Token, Sid))
956 {
957 CurrentAccess |= (READ_CONTROL | WRITE_DAC);
958 if (DesiredAccess == CurrentAccess)
959 {
960 if (SubjectContextLocked == FALSE)
961 {
962 SeUnlockSubjectContext(SubjectSecurityContext);
963 }
964
965 *GrantedAccess = CurrentAccess;
966 *AccessStatus = STATUS_SUCCESS;
967 return TRUE;
968 }
969 }
970
971 /* Fail if DACL is absent */
972 if (Present == FALSE)
973 {
974 if (SubjectContextLocked == FALSE)
975 {
976 SeUnlockSubjectContext(SubjectSecurityContext);
977 }
978
979 *GrantedAccess = 0;
980 *AccessStatus = STATUS_ACCESS_DENIED;
981 return TRUE;
982 }
983
984 /* RULE 4: Grant rights according to the DACL */
985 CurrentAce = (PACE)(Dacl + 1);
986 for (i = 0; i < Dacl->AceCount; i++)
987 {
988 Sid = (PSID)(CurrentAce + 1);
989 if (CurrentAce->Header.AceType == ACCESS_DENIED_ACE_TYPE)
990 {
991 if (SepSidInToken(Token, Sid))
992 {
993 if (SubjectContextLocked == FALSE)
994 {
995 SeUnlockSubjectContext(SubjectSecurityContext);
996 }
997
998 *GrantedAccess = 0;
999 *AccessStatus = STATUS_ACCESS_DENIED;
1000 return TRUE;
1001 }
1002 }
1003
1004 if (CurrentAce->Header.AceType == ACCESS_ALLOWED_ACE_TYPE)
1005 {
1006 if (SepSidInToken(Token, Sid))
1007 {
1008 CurrentAccess |= CurrentAce->AccessMask;
1009 }
1010 }
1011 }
1012
1013 if (SubjectContextLocked == FALSE)
1014 {
1015 SeUnlockSubjectContext(SubjectSecurityContext);
1016 }
1017
1018 DPRINT("CurrentAccess %08lx\n DesiredAccess %08lx\n",
1019 CurrentAccess, DesiredAccess);
1020
1021 *GrantedAccess = CurrentAccess & DesiredAccess;
1022
1023 *AccessStatus =
1024 (*GrantedAccess == DesiredAccess) ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1025
1026 return TRUE;
1027 }
1028
1029
1030 NTSTATUS STDCALL
1031 NtAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
1032 IN HANDLE TokenHandle,
1033 IN ACCESS_MASK DesiredAccess,
1034 IN PGENERIC_MAPPING GenericMapping,
1035 OUT PPRIVILEGE_SET PrivilegeSet,
1036 OUT PULONG ReturnLength,
1037 OUT PACCESS_MASK GrantedAccess,
1038 OUT PNTSTATUS AccessStatus)
1039 {
1040 SECURITY_SUBJECT_CONTEXT SubjectSecurityContext = {0};
1041 KPROCESSOR_MODE PreviousMode;
1042 PTOKEN Token;
1043 NTSTATUS Status;
1044
1045 PAGED_CODE();
1046
1047 DPRINT("NtAccessCheck() called\n");
1048
1049 PreviousMode = KeGetPreviousMode();
1050 if (PreviousMode == KernelMode)
1051 {
1052 *GrantedAccess = DesiredAccess;
1053 *AccessStatus = STATUS_SUCCESS;
1054 return STATUS_SUCCESS;
1055 }
1056
1057 Status = ObReferenceObjectByHandle(TokenHandle,
1058 TOKEN_QUERY,
1059 SepTokenObjectType,
1060 PreviousMode,
1061 (PVOID*)&Token,
1062 NULL);
1063 if (!NT_SUCCESS(Status))
1064 {
1065 DPRINT1("Failed to reference token (Status %lx)\n", Status);
1066 return Status;
1067 }
1068
1069 /* Check token type */
1070 if (Token->TokenType != TokenImpersonation)
1071 {
1072 DPRINT1("No impersonation token\n");
1073 ObDereferenceObject(Token);
1074 return STATUS_ACCESS_VIOLATION;
1075 }
1076
1077 /* Check impersonation level */
1078 if (Token->ImpersonationLevel < SecurityAnonymous)
1079 {
1080 DPRINT1("Invalid impersonation level\n");
1081 ObDereferenceObject(Token);
1082 return STATUS_ACCESS_VIOLATION;
1083 }
1084
1085 SubjectSecurityContext.ClientToken = Token;
1086 SubjectSecurityContext.ImpersonationLevel = Token->ImpersonationLevel;
1087
1088 /* Lock subject context */
1089 SeLockSubjectContext(&SubjectSecurityContext);
1090
1091 if (SeAccessCheck(SecurityDescriptor,
1092 &SubjectSecurityContext,
1093 TRUE,
1094 DesiredAccess,
1095 0,
1096 &PrivilegeSet,
1097 GenericMapping,
1098 PreviousMode,
1099 GrantedAccess,
1100 AccessStatus))
1101 {
1102 Status = *AccessStatus;
1103 }
1104 else
1105 {
1106 Status = STATUS_ACCESS_DENIED;
1107 }
1108
1109 /* Unlock subject context */
1110 SeUnlockSubjectContext(&SubjectSecurityContext);
1111
1112 ObDereferenceObject(Token);
1113
1114 DPRINT("NtAccessCheck() done\n");
1115
1116 return Status;
1117 }
1118
1119 VOID STDCALL
1120 SeQuerySecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
1121 OUT PACCESS_MASK DesiredAccess)
1122 {
1123 if (SecurityInformation & (OWNER_SECURITY_INFORMATION |
1124 GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION))
1125 {
1126 *DesiredAccess |= READ_CONTROL;
1127 }
1128 if (SecurityInformation & SACL_SECURITY_INFORMATION)
1129 {
1130 *DesiredAccess |= ACCESS_SYSTEM_SECURITY;
1131 }
1132 }
1133
1134 VOID STDCALL
1135 SeSetSecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
1136 OUT PACCESS_MASK DesiredAccess)
1137 {
1138 if (SecurityInformation & (OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION))
1139 {
1140 *DesiredAccess |= WRITE_OWNER;
1141 }
1142 if (SecurityInformation & DACL_SECURITY_INFORMATION)
1143 {
1144 *DesiredAccess |= WRITE_DAC;
1145 }
1146 if (SecurityInformation & SACL_SECURITY_INFORMATION)
1147 {
1148 *DesiredAccess |= ACCESS_SYSTEM_SECURITY;
1149 }
1150 }
1151
1152 /* EOF */