reactos/ntoskrnl/se/semgr.c

   1 /*
   2  * COPYRIGHT:       See COPYING in the top level directory
   3  * PROJECT:         ReactOS kernel
   4  * FILE:            ntoskrnl/se/semgr.c
   5  * PURPOSE:         Security manager
   6  *
   7  * PROGRAMMERS:     No programmer listed.
   8  */
   9
  10 /* INCLUDES *******************************************************************/
  11
  12 #include <ntoskrnl.h>
  13 #define NDEBUG
  14 #include <debug.h>
  15
  16 /* GLOBALS ********************************************************************/
  17
  18 PSE_EXPORTS SeExports = NULL;
  19 SE_EXPORTS SepExports;
  20
  21 extern ULONG ExpInitializationPhase;
  22 extern ERESOURCE SepSubjectContextLock;
  23
  24 /* PRIVATE FUNCTIONS **********************************************************/
  25
  26 static BOOLEAN INIT_FUNCTION
  27 SepInitExports(VOID)
  28 {
  29     SepExports.SeCreateTokenPrivilege = SeCreateTokenPrivilege;
  30     SepExports.SeAssignPrimaryTokenPrivilege = SeAssignPrimaryTokenPrivilege;
  31     SepExports.SeLockMemoryPrivilege = SeLockMemoryPrivilege;
  32     SepExports.SeIncreaseQuotaPrivilege = SeIncreaseQuotaPrivilege;
  33     SepExports.SeUnsolicitedInputPrivilege = SeUnsolicitedInputPrivilege;
  34     SepExports.SeTcbPrivilege = SeTcbPrivilege;
  35     SepExports.SeSecurityPrivilege = SeSecurityPrivilege;
  36     SepExports.SeTakeOwnershipPrivilege = SeTakeOwnershipPrivilege;
  37     SepExports.SeLoadDriverPrivilege = SeLoadDriverPrivilege;
  38     SepExports.SeCreatePagefilePrivilege = SeCreatePagefilePrivilege;
  39     SepExports.SeIncreaseBasePriorityPrivilege = SeIncreaseBasePriorityPrivilege;
  40     SepExports.SeSystemProfilePrivilege = SeSystemProfilePrivilege;
  41     SepExports.SeSystemtimePrivilege = SeSystemtimePrivilege;
  42     SepExports.SeProfileSingleProcessPrivilege = SeProfileSingleProcessPrivilege;
  43     SepExports.SeCreatePermanentPrivilege = SeCreatePermanentPrivilege;
  44     SepExports.SeBackupPrivilege = SeBackupPrivilege;
  45     SepExports.SeRestorePrivilege = SeRestorePrivilege;
  46     SepExports.SeShutdownPrivilege = SeShutdownPrivilege;
  47     SepExports.SeDebugPrivilege = SeDebugPrivilege;
  48     SepExports.SeAuditPrivilege = SeAuditPrivilege;
  49     SepExports.SeSystemEnvironmentPrivilege = SeSystemEnvironmentPrivilege;
  50     SepExports.SeChangeNotifyPrivilege = SeChangeNotifyPrivilege;
  51     SepExports.SeRemoteShutdownPrivilege = SeRemoteShutdownPrivilege;
  52
  53     SepExports.SeNullSid = SeNullSid;
  54     SepExports.SeWorldSid = SeWorldSid;
  55     SepExports.SeLocalSid = SeLocalSid;
  56     SepExports.SeCreatorOwnerSid = SeCreatorOwnerSid;
  57     SepExports.SeCreatorGroupSid = SeCreatorGroupSid;
  58     SepExports.SeNtAuthoritySid = SeNtAuthoritySid;
  59     SepExports.SeDialupSid = SeDialupSid;
  60     SepExports.SeNetworkSid = SeNetworkSid;
  61     SepExports.SeBatchSid = SeBatchSid;
  62     SepExports.SeInteractiveSid = SeInteractiveSid;
  63     SepExports.SeLocalSystemSid = SeLocalSystemSid;
  64     SepExports.SeAliasAdminsSid = SeAliasAdminsSid;
  65     SepExports.SeAliasUsersSid = SeAliasUsersSid;
  66     SepExports.SeAliasGuestsSid = SeAliasGuestsSid;
  67     SepExports.SeAliasPowerUsersSid = SeAliasPowerUsersSid;
  68     SepExports.SeAliasAccountOpsSid = SeAliasAccountOpsSid;
  69     SepExports.SeAliasSystemOpsSid = SeAliasSystemOpsSid;
  70     SepExports.SeAliasPrintOpsSid = SeAliasPrintOpsSid;
  71     SepExports.SeAliasBackupOpsSid = SeAliasBackupOpsSid;
  72     SepExports.SeAuthenticatedUsersSid = SeAuthenticatedUsersSid;
  73     SepExports.SeRestrictedSid = SeRestrictedSid;
  74     SepExports.SeAnonymousLogonSid = SeAnonymousLogonSid;
  75
  76     SepExports.SeUndockPrivilege = SeUndockPrivilege;
  77     SepExports.SeSyncAgentPrivilege = SeSyncAgentPrivilege;
  78     SepExports.SeEnableDelegationPrivilege = SeEnableDelegationPrivilege;
  79
  80     SeExports = &SepExports;
  81     return TRUE;
  82 }
  83
  84
  85 BOOLEAN
  86 NTAPI
  87 SepInitializationPhase0(VOID)
  88 {
  89     PAGED_CODE();
  90
  91     ExpInitLuid();
  92     if (!SepInitSecurityIDs()) return FALSE;
  93     if (!SepInitDACLs()) return FALSE;
  94     if (!SepInitSDs()) return FALSE;
  95     SepInitPrivileges();
  96     if (!SepInitExports()) return FALSE;
  97
  98     /* Initialize the subject context lock */
  99     ExInitializeResource(&SepSubjectContextLock);
 100
 101     /* Initialize token objects */
 102     SepInitializeTokenImplementation();
 103
 104     /* Clear impersonation info for the idle thread */
 105     PsGetCurrentThread()->ImpersonationInfo = NULL;
 106     PspClearCrossThreadFlag(PsGetCurrentThread(),
 107                             CT_ACTIVE_IMPERSONATION_INFO_BIT);
 108
 109     /* Initialize the boot token */
 110     ObInitializeFastReference(&PsGetCurrentProcess()->Token, NULL);
 111     ObInitializeFastReference(&PsGetCurrentProcess()->Token,
 112                               SepCreateSystemProcessToken());
 113     return TRUE;
 114 }
 115
 116 BOOLEAN
 117 NTAPI
 118 SepInitializationPhase1(VOID)
 119 {
 120     NTSTATUS Status;
 121     PAGED_CODE();
 122
 123     /* Insert the system token into the tree */
 124     Status = ObInsertObject((PVOID)(PsGetCurrentProcess()->Token.Value &
 125                                     ~MAX_FAST_REFS),
 126                             NULL,
 127                             0,
 128                             0,
 129                             NULL,
 130                             NULL);
 131     ASSERT(NT_SUCCESS(Status));
 132
 133     /* FIXME: TODO \\ Security directory */
 134     return TRUE;
 135 }
 136
 137 BOOLEAN
 138 NTAPI
 139 SeInitSystem(VOID)
 140 {
 141     /* Check the initialization phase */
 142     switch (ExpInitializationPhase)
 143     {
 144         case 0:
 145
 146             /* Do Phase 0 */
 147             return SepInitializationPhase0();
 148
 149         case 1:
 150
 151             /* Do Phase 1 */
 152             return SepInitializationPhase1();
 153
 154         default:
 155
 156             /* Don't know any other phase! Bugcheck! */
 157             KeBugCheckEx(UNEXPECTED_INITIALIZATION_CALL,
 158                          0,
 159                          ExpInitializationPhase,
 160                          0,
 161                          0);
 162             return FALSE;
 163     }
 164 }
 165
 166 BOOLEAN
 167 NTAPI
 168 SeInitSRM(VOID)
 169 {
 170     OBJECT_ATTRIBUTES ObjectAttributes;
 171     UNICODE_STRING Name;
 172     HANDLE DirectoryHandle;
 173     HANDLE EventHandle;
 174     NTSTATUS Status;
 175
 176     /* Create '\Security' directory */
 177     RtlInitUnicodeString(&Name,
 178                          L"\\Security");
 179     InitializeObjectAttributes(&ObjectAttributes,
 180                                &Name,
 181                                OBJ_PERMANENT,
 182                                0,
 183                                NULL);
 184     Status = ZwCreateDirectoryObject(&DirectoryHandle,
 185                                      DIRECTORY_ALL_ACCESS,
 186                                      &ObjectAttributes);
 187     if (!NT_SUCCESS(Status))
 188     {
 189         DPRINT1("Failed to create 'Security' directory!\n");
 190         return FALSE;
 191     }
 192
 193     /* Create 'LSA_AUTHENTICATION_INITALIZED' event */
 194     RtlInitUnicodeString(&Name,
 195                          L"\\LSA_AUTHENTICATION_INITALIZED");
 196     InitializeObjectAttributes(&ObjectAttributes,
 197                                &Name,
 198                                OBJ_PERMANENT,
 199                                DirectoryHandle,
 200                                SePublicDefaultSd);
 201     Status = ZwCreateEvent(&EventHandle,
 202                            EVENT_ALL_ACCESS,
 203                            &ObjectAttributes,
 204                            SynchronizationEvent,
 205                            FALSE);
 206     if (!NT_SUCCESS(Status))
 207     {
 208         DPRINT1("Failed to create 'LSA_AUTHENTICATION_INITALIZED' event!\n");
 209         NtClose(DirectoryHandle);
 210         return FALSE;
 211     }
 212
 213     ZwClose(EventHandle);
 214     ZwClose(DirectoryHandle);
 215
 216     /* FIXME: Create SRM port and listener thread */
 217
 218     return TRUE;
 219 }
 220
 221 NTSTATUS
 222 NTAPI
 223 SeDefaultObjectMethod(IN PVOID Object,
 224                       IN SECURITY_OPERATION_CODE OperationType,
 225                       IN PSECURITY_INFORMATION SecurityInformation,
 226                       IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
 227                       IN OUT PULONG ReturnLength OPTIONAL,
 228                       IN OUT PSECURITY_DESCRIPTOR *OldSecurityDescriptor,
 229                       IN POOL_TYPE PoolType,
 230                       IN PGENERIC_MAPPING GenericMapping)
 231 {
 232     PAGED_CODE();
 233
 234     /* Select the operation type */
 235     switch (OperationType)
 236     {
 237             /* Setting a new descriptor */
 238         case SetSecurityDescriptor:
 239
 240             /* Sanity check */
 241             ASSERT((PoolType == PagedPool) || (PoolType == NonPagedPool));
 242
 243             /* Set the information */
 244             return ObSetSecurityDescriptorInfo(Object,
 245                                                SecurityInformation,
 246                                                SecurityDescriptor,
 247                                                OldSecurityDescriptor,
 248                                                PoolType,
 249                                                GenericMapping);
 250
 251         case QuerySecurityDescriptor:
 252
 253             /* Query the information */
 254             return ObQuerySecurityDescriptorInfo(Object,
 255                                                  SecurityInformation,
 256                                                  SecurityDescriptor,
 257                                                  ReturnLength,
 258                                                  OldSecurityDescriptor);
 259
 260         case DeleteSecurityDescriptor:
 261
 262             /* De-assign it */
 263             return ObDeassignSecurity(OldSecurityDescriptor);
 264
 265         case AssignSecurityDescriptor:
 266
 267             /* Assign it */
 268             ObAssignObjectSecurityDescriptor(Object, SecurityDescriptor, PoolType);
 269             return STATUS_SUCCESS;
 270
 271         default:
 272
 273             /* Bug check */
 274             KeBugCheckEx(SECURITY_SYSTEM, 0, STATUS_INVALID_PARAMETER, 0, 0);
 275     }
 276
 277     /* Should never reach here */
 278     ASSERT(FALSE);
 279     return STATUS_SUCCESS;
 280 }
 281
 282 ULONG SidInTokenCalls = 0;
 283
 284 static BOOLEAN
 285 SepSidInToken(PACCESS_TOKEN _Token,
 286               PSID Sid)
 287 {
 288     ULONG i;
 289     PTOKEN Token = (PTOKEN)_Token;
 290
 291     PAGED_CODE();
 292
 293     SidInTokenCalls++;
 294     if (!(SidInTokenCalls % 10000)) DPRINT1("SidInToken Calls: %d\n", SidInTokenCalls);
 295
 296     if (Token->UserAndGroupCount == 0)
 297     {
 298         return FALSE;
 299     }
 300
 301     for (i=0; i<Token->UserAndGroupCount; i++)
 302     {
 303         if (RtlEqualSid(Sid, Token->UserAndGroups[i].Sid))
 304         {
 305             if ((i == 0)|| (Token->UserAndGroups[i].Attributes & SE_GROUP_ENABLED))
 306             {
 307                 return TRUE;
 308             }
 309
 310             return FALSE;
 311         }
 312     }
 313
 314     return FALSE;
 315 }
 316
 317 static BOOLEAN
 318 SepTokenIsOwner(PACCESS_TOKEN Token,
 319                 PSECURITY_DESCRIPTOR SecurityDescriptor)
 320 {
 321     NTSTATUS Status;
 322     PSID Sid = NULL;
 323     BOOLEAN Defaulted;
 324
 325     Status = RtlGetOwnerSecurityDescriptor(SecurityDescriptor,
 326                                            &Sid,
 327                                            &Defaulted);
 328     if (!NT_SUCCESS(Status))
 329     {
 330         DPRINT1("RtlGetOwnerSecurityDescriptor() failed (Status %lx)\n", Status);
 331         return FALSE;
 332     }
 333
 334     if (Sid == NULL)
 335     {
 336         DPRINT1("Owner Sid is NULL\n");
 337         return FALSE;
 338     }
 339
 340     return SepSidInToken(Token, Sid);
 341 }
 342
 343 VOID NTAPI
 344 SeQuerySecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
 345                           OUT PACCESS_MASK DesiredAccess)
 346 {
 347     *DesiredAccess = 0;
 348
 349     if (SecurityInformation & (OWNER_SECURITY_INFORMATION |
 350                                GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION))
 351     {
 352         *DesiredAccess |= READ_CONTROL;
 353     }
 354     if (SecurityInformation & SACL_SECURITY_INFORMATION)
 355     {
 356         *DesiredAccess |= ACCESS_SYSTEM_SECURITY;
 357     }
 358 }
 359
 360 VOID NTAPI
 361 SeSetSecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
 362                         OUT PACCESS_MASK DesiredAccess)
 363 {
 364     *DesiredAccess = 0;
 365
 366     if (SecurityInformation & (OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION))
 367     {
 368         *DesiredAccess |= WRITE_OWNER;
 369     }
 370     if (SecurityInformation & DACL_SECURITY_INFORMATION)
 371     {
 372         *DesiredAccess |= WRITE_DAC;
 373     }
 374     if (SecurityInformation & SACL_SECURITY_INFORMATION)
 375     {
 376         *DesiredAccess |= ACCESS_SYSTEM_SECURITY;
 377     }
 378 }
 379
 380 BOOLEAN NTAPI
 381 SepAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
 382                IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
 383                IN ACCESS_MASK DesiredAccess,
 384                IN ACCESS_MASK PreviouslyGrantedAccess,
 385                OUT PPRIVILEGE_SET* Privileges,
 386                IN PGENERIC_MAPPING GenericMapping,
 387                IN KPROCESSOR_MODE AccessMode,
 388                OUT PACCESS_MASK GrantedAccess,
 389                OUT PNTSTATUS AccessStatus)
 390 {
 391     LUID_AND_ATTRIBUTES Privilege;
 392     ACCESS_MASK CurrentAccess, AccessMask;
 393     ACCESS_MASK RemainingAccess;
 394     PACCESS_TOKEN Token;
 395     ULONG i;
 396     PACL Dacl;
 397     BOOLEAN Present;
 398     BOOLEAN Defaulted;
 399     PACE CurrentAce;
 400     PSID Sid;
 401     NTSTATUS Status;
 402     PAGED_CODE();
 403
 404     /* Check for no access desired */
 405     if (!DesiredAccess)
 406     {
 407         /* Check if we had no previous access */
 408         if (!PreviouslyGrantedAccess)
 409         {
 410             /* Then there's nothing to give */
 411             *AccessStatus = STATUS_ACCESS_DENIED;
 412             return FALSE;
 413         }
 414
 415         /* Return the previous access only */
 416         *GrantedAccess = PreviouslyGrantedAccess;
 417         *AccessStatus = STATUS_SUCCESS;
 418         *Privileges = NULL;
 419         return TRUE;
 420     }
 421
 422     /* Map given accesses */
 423     RtlMapGenericMask(&DesiredAccess, GenericMapping);
 424     if (PreviouslyGrantedAccess)
 425         RtlMapGenericMask(&PreviouslyGrantedAccess, GenericMapping);
 426
 427
 428     CurrentAccess = PreviouslyGrantedAccess;
 429     RemainingAccess = DesiredAccess;
 430
 431
 432     Token = SubjectSecurityContext->ClientToken ?
 433     SubjectSecurityContext->ClientToken : SubjectSecurityContext->PrimaryToken;
 434
 435     /* Check for system security access */
 436     if (RemainingAccess & ACCESS_SYSTEM_SECURITY)
 437     {
 438         Privilege.Luid = SeSecurityPrivilege;
 439         Privilege.Attributes = SE_PRIVILEGE_ENABLED;
 440
 441         /* Fail if we do not the SeSecurityPrivilege */
 442         if (!SepPrivilegeCheck(Token,
 443                                &Privilege,
 444                                1,
 445                                PRIVILEGE_SET_ALL_NECESSARY,
 446                                AccessMode))
 447         {
 448             *AccessStatus = STATUS_PRIVILEGE_NOT_HELD;
 449             return FALSE;
 450         }
 451
 452         /* Adjust access rights */
 453         RemainingAccess &= ~ACCESS_SYSTEM_SECURITY;
 454         PreviouslyGrantedAccess |= ACCESS_SYSTEM_SECURITY;
 455
 456         /* Succeed if there are no more rights to grant */
 457         if (RemainingAccess == 0)
 458         {
 459             *GrantedAccess = PreviouslyGrantedAccess;
 460             *AccessStatus = STATUS_SUCCESS;
 461             return TRUE;
 462         }
 463     }
 464
 465     /* Get the DACL */
 466     Status = RtlGetDaclSecurityDescriptor(SecurityDescriptor,
 467                                           &Present,
 468                                           &Dacl,
 469                                           &Defaulted);
 470     if (!NT_SUCCESS(Status))
 471     {
 472         *AccessStatus = Status;
 473         return FALSE;
 474     }
 475
 476     /* RULE 1: Grant desired access if the object is unprotected */
 477     if (Present == FALSE || Dacl == NULL)
 478     {
 479         if (DesiredAccess & MAXIMUM_ALLOWED)
 480         {
 481             *GrantedAccess = GenericMapping->GenericAll;
 482             *GrantedAccess |= (DesiredAccess & ~MAXIMUM_ALLOWED);
 483         }
 484         else
 485         {
 486             *GrantedAccess = DesiredAccess | PreviouslyGrantedAccess;
 487         }
 488
 489         *AccessStatus = STATUS_SUCCESS;
 490         return TRUE;
 491     }
 492
 493     CurrentAccess = PreviouslyGrantedAccess;
 494
 495     /* RULE 2: Check token for 'take ownership' privilege */
 496     if (DesiredAccess & WRITE_OWNER)
 497     {
 498         Privilege.Luid = SeTakeOwnershipPrivilege;
 499         Privilege.Attributes = SE_PRIVILEGE_ENABLED;
 500
 501         if (SepPrivilegeCheck(Token,
 502                               &Privilege,
 503                               1,
 504                               PRIVILEGE_SET_ALL_NECESSARY,
 505                               AccessMode))
 506         {
 507             /* Adjust access rights */
 508             RemainingAccess &= ~WRITE_OWNER;
 509             PreviouslyGrantedAccess |= WRITE_OWNER;
 510             CurrentAccess |= WRITE_OWNER;
 511
 512             /* Succeed if there are no more rights to grant */
 513             if (RemainingAccess == 0)
 514             {
 515                 *GrantedAccess = PreviouslyGrantedAccess;
 516                 *AccessStatus = STATUS_SUCCESS;
 517                 return TRUE;
 518             }
 519         }
 520     }
 521
 522     /* Deny access if the DACL is empty */
 523     if (Dacl->AceCount == 0)
 524     {
 525         if (RemainingAccess == MAXIMUM_ALLOWED && PreviouslyGrantedAccess != 0)
 526         {
 527             *GrantedAccess = PreviouslyGrantedAccess;
 528             *AccessStatus = STATUS_SUCCESS;
 529             return TRUE;
 530         }
 531         else
 532         {
 533             *GrantedAccess = 0;
 534             *AccessStatus = STATUS_ACCESS_DENIED;
 535             return FALSE;
 536         }
 537     }
 538
 539     /* Fail if DACL is absent */
 540     if (Present == FALSE)
 541     {
 542         *GrantedAccess = 0;
 543         *AccessStatus = STATUS_ACCESS_DENIED;
 544         return FALSE;
 545     }
 546
 547     /* RULE 4: Grant rights according to the DACL */
 548     CurrentAce = (PACE)(Dacl + 1);
 549     for (i = 0; i < Dacl->AceCount; i++)
 550     {
 551         Sid = (PSID)(CurrentAce + 1);
 552         if (CurrentAce->Header.AceType == ACCESS_DENIED_ACE_TYPE)
 553         {
 554             if (SepSidInToken(Token, Sid))
 555             {
 556                 *GrantedAccess = 0;
 557                 *AccessStatus = STATUS_ACCESS_DENIED;
 558                 return FALSE;
 559             }
 560         }
 561
 562         else if (CurrentAce->Header.AceType == ACCESS_ALLOWED_ACE_TYPE)
 563         {
 564             if (SepSidInToken(Token, Sid))
 565             {
 566                 AccessMask = CurrentAce->AccessMask;
 567                 RtlMapGenericMask(&AccessMask, GenericMapping);
 568                 CurrentAccess |= AccessMask;
 569             }
 570         }
 571         else
 572         {
 573             DPRINT1("Unknown Ace type 0x%lx\n", CurrentAce->Header.AceType);
 574         }
 575         CurrentAce = (PACE)((ULONG_PTR)CurrentAce + CurrentAce->Header.AceSize);
 576     }
 577
 578     DPRINT("CurrentAccess %08lx\n DesiredAccess %08lx\n",
 579            CurrentAccess, DesiredAccess);
 580
 581     *GrantedAccess = CurrentAccess & DesiredAccess;
 582
 583     if (DesiredAccess & MAXIMUM_ALLOWED)
 584     {
 585         *GrantedAccess = CurrentAccess;
 586         *AccessStatus = STATUS_SUCCESS;
 587         return TRUE;
 588     }
 589     else if ((*GrantedAccess & ~VALID_INHERIT_FLAGS) ==
 590              (DesiredAccess & ~VALID_INHERIT_FLAGS))
 591     {
 592         *AccessStatus = STATUS_SUCCESS;
 593         return TRUE;
 594     }
 595     else
 596     {
 597         DPRINT1("HACK: Should deny access for caller: granted 0x%lx, desired 0x%lx (generic mapping %p).\n",
 598                 *GrantedAccess, DesiredAccess, GenericMapping);
 599         //*AccessStatus = STATUS_ACCESS_DENIED;
 600         //return FALSE;
 601         *AccessStatus = STATUS_SUCCESS;
 602         return TRUE;
 603     }
 604 }
 605
 606 static PSID
 607 SepGetSDOwner(IN PSECURITY_DESCRIPTOR _SecurityDescriptor)
 608 {
 609     PISECURITY_DESCRIPTOR SecurityDescriptor = _SecurityDescriptor;
 610     PSID Owner;
 611
 612     if (SecurityDescriptor->Control & SE_SELF_RELATIVE)
 613         Owner = (PSID)((ULONG_PTR)SecurityDescriptor->Owner +
 614                        (ULONG_PTR)SecurityDescriptor);
 615     else
 616         Owner = (PSID)SecurityDescriptor->Owner;
 617
 618     return Owner;
 619 }
 620
 621 static PSID
 622 SepGetSDGroup(IN PSECURITY_DESCRIPTOR _SecurityDescriptor)
 623 {
 624     PISECURITY_DESCRIPTOR SecurityDescriptor = _SecurityDescriptor;
 625     PSID Group;
 626
 627     if (SecurityDescriptor->Control & SE_SELF_RELATIVE)
 628         Group = (PSID)((ULONG_PTR)SecurityDescriptor->Group +
 629                        (ULONG_PTR)SecurityDescriptor);
 630     else
 631         Group = (PSID)SecurityDescriptor->Group;
 632
 633     return Group;
 634 }
 635
 636
 637 /* PUBLIC FUNCTIONS ***********************************************************/
 638
 639 /*
 640  * @implemented
 641  */
 642 BOOLEAN NTAPI
 643 SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
 644               IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
 645               IN BOOLEAN SubjectContextLocked,
 646               IN ACCESS_MASK DesiredAccess,
 647               IN ACCESS_MASK PreviouslyGrantedAccess,
 648               OUT PPRIVILEGE_SET* Privileges,
 649               IN PGENERIC_MAPPING GenericMapping,
 650               IN KPROCESSOR_MODE AccessMode,
 651               OUT PACCESS_MASK GrantedAccess,
 652               OUT PNTSTATUS AccessStatus)
 653 {
 654     BOOLEAN ret;
 655
 656     PAGED_CODE();
 657
 658     /* Check if this is kernel mode */
 659     if (AccessMode == KernelMode)
 660     {
 661         /* Check if kernel wants everything */
 662         if (DesiredAccess & MAXIMUM_ALLOWED)
 663         {
 664             /* Give it */
 665             *GrantedAccess = GenericMapping->GenericAll;
 666             *GrantedAccess |= (DesiredAccess &~ MAXIMUM_ALLOWED);
 667             *GrantedAccess |= PreviouslyGrantedAccess;
 668         }
 669         else
 670         {
 671             /* Give the desired and previous access */
 672             *GrantedAccess = DesiredAccess | PreviouslyGrantedAccess;
 673         }
 674
 675         /* Success */
 676         *AccessStatus = STATUS_SUCCESS;
 677         return TRUE;
 678     }
 679
 680     /* Check if we didn't get an SD */
 681     if (!SecurityDescriptor)
 682     {
 683         /* Automatic failure */
 684         *AccessStatus = STATUS_ACCESS_DENIED;
 685         return FALSE;
 686     }
 687
 688     /* Check for invalid impersonation */
 689     if ((SubjectSecurityContext->ClientToken) &&
 690         (SubjectSecurityContext->ImpersonationLevel < SecurityImpersonation))
 691     {
 692         *AccessStatus = STATUS_BAD_IMPERSONATION_LEVEL;
 693         return FALSE;
 694     }
 695
 696     /* Acquire the lock if needed */
 697     if (!SubjectContextLocked)
 698         SeLockSubjectContext(SubjectSecurityContext);
 699
 700     /* Check if the token is the owner and grant WRITE_DAC and READ_CONTROL rights */
 701     if (DesiredAccess & (WRITE_DAC | READ_CONTROL | MAXIMUM_ALLOWED))
 702     {
 703          PACCESS_TOKEN Token = SubjectSecurityContext->ClientToken ?
 704              SubjectSecurityContext->ClientToken : SubjectSecurityContext->PrimaryToken;
 705
 706         if (SepTokenIsOwner(Token,
 707                             SecurityDescriptor))
 708         {
 709             if (DesiredAccess & MAXIMUM_ALLOWED)
 710                 PreviouslyGrantedAccess |= (WRITE_DAC | READ_CONTROL);
 711             else
 712                 PreviouslyGrantedAccess |= (DesiredAccess & (WRITE_DAC | READ_CONTROL));
 713
 714             DesiredAccess &= ~(WRITE_DAC | READ_CONTROL);
 715         }
 716     }
 717
 718     if (DesiredAccess == 0)
 719     {
 720         *GrantedAccess = PreviouslyGrantedAccess;
 721         *AccessStatus = STATUS_SUCCESS;
 722         ret = TRUE;
 723     }
 724     else
 725     {
 726         /* Call the internal function */
 727         ret = SepAccessCheck(SecurityDescriptor,
 728                              SubjectSecurityContext,
 729                              DesiredAccess,
 730                              PreviouslyGrantedAccess,
 731                              Privileges,
 732                              GenericMapping,
 733                              AccessMode,
 734                              GrantedAccess,
 735                              AccessStatus);
 736     }
 737
 738     /* Release the lock if needed */
 739     if (!SubjectContextLocked)
 740         SeUnlockSubjectContext(SubjectSecurityContext);
 741
 742     return ret;
 743 }
 744
 745 /* SYSTEM CALLS ***************************************************************/
 746
 747 /*
 748  * @implemented
 749  */
 750 NTSTATUS
 751 NTAPI
 752 NtAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
 753               IN HANDLE TokenHandle,
 754               IN ACCESS_MASK DesiredAccess,
 755               IN PGENERIC_MAPPING GenericMapping,
 756               OUT PPRIVILEGE_SET PrivilegeSet OPTIONAL,
 757               IN OUT PULONG PrivilegeSetLength,
 758               OUT PACCESS_MASK GrantedAccess,
 759               OUT PNTSTATUS AccessStatus)
 760 {
 761     PSECURITY_DESCRIPTOR CapturedSecurityDescriptor = NULL;
 762     SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
 763     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
 764     ACCESS_MASK PreviouslyGrantedAccess = 0;
 765     PTOKEN Token;
 766     NTSTATUS Status;
 767     PAGED_CODE();
 768
 769     /* Check if this is kernel mode */
 770     if (PreviousMode == KernelMode)
 771     {
 772         /* Check if kernel wants everything */
 773         if (DesiredAccess & MAXIMUM_ALLOWED)
 774         {
 775             /* Give it */
 776             *GrantedAccess = GenericMapping->GenericAll;
 777             *GrantedAccess |= (DesiredAccess &~ MAXIMUM_ALLOWED);
 778         }
 779         else
 780         {
 781             /* Just give the desired access */
 782             *GrantedAccess = DesiredAccess;
 783         }
 784
 785         /* Success */
 786         *AccessStatus = STATUS_SUCCESS;
 787         return STATUS_SUCCESS;
 788     }
 789
 790     /* Protect probe in SEH */
 791     _SEH2_TRY
 792     {
 793         /* Probe all pointers */
 794         ProbeForRead(GenericMapping, sizeof(GENERIC_MAPPING), sizeof(ULONG));
 795         ProbeForRead(PrivilegeSetLength, sizeof(ULONG), sizeof(ULONG));
 796         ProbeForWrite(PrivilegeSet, *PrivilegeSetLength, sizeof(ULONG));
 797         ProbeForWrite(GrantedAccess, sizeof(ACCESS_MASK), sizeof(ULONG));
 798         ProbeForWrite(AccessStatus, sizeof(NTSTATUS), sizeof(ULONG));
 799     }
 800     _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
 801     {
 802         /* Return the exception code */
 803         _SEH2_YIELD(return _SEH2_GetExceptionCode());
 804     }
 805     _SEH2_END;
 806
 807     /* Check for unmapped access rights */
 808     if (DesiredAccess & (GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL))
 809         return STATUS_GENERIC_NOT_MAPPED;
 810
 811     /* Reference the token */
 812     Status = ObReferenceObjectByHandle(TokenHandle,
 813                                        TOKEN_QUERY,
 814                                        SepTokenObjectType,
 815                                        PreviousMode,
 816                                        (PVOID*)&Token,
 817                                        NULL);
 818     if (!NT_SUCCESS(Status))
 819     {
 820         DPRINT("Failed to reference token (Status %lx)\n", Status);
 821         return Status;
 822     }
 823
 824     /* Check token type */
 825     if (Token->TokenType != TokenImpersonation)
 826     {
 827         DPRINT("No impersonation token\n");
 828         ObDereferenceObject(Token);
 829         return STATUS_NO_IMPERSONATION_TOKEN;
 830     }
 831
 832     /* Check the impersonation level */
 833     if (Token->ImpersonationLevel < SecurityIdentification)
 834     {
 835         DPRINT("Impersonation level < SecurityIdentification\n");
 836         ObDereferenceObject(Token);
 837         return STATUS_BAD_IMPERSONATION_LEVEL;
 838     }
 839
 840     /* Capture the security descriptor */
 841     Status = SeCaptureSecurityDescriptor(SecurityDescriptor,
 842                                          PreviousMode,
 843                                          PagedPool,
 844                                          FALSE,
 845                                          &CapturedSecurityDescriptor);
 846     if (!NT_SUCCESS(Status))
 847     {
 848         DPRINT("Failed to capture the Security Descriptor\n");
 849         ObDereferenceObject(Token);
 850         return Status;
 851     }
 852
 853     /* Check the captured security descriptor */
 854     if (CapturedSecurityDescriptor == NULL)
 855     {
 856         DPRINT("Security Descriptor is NULL\n");
 857         ObDereferenceObject(Token);
 858         return STATUS_INVALID_SECURITY_DESCR;
 859     }
 860
 861     /* Check security descriptor for valid owner and group */
 862     if (SepGetSDOwner(SecurityDescriptor) == NULL ||  // FIXME: use CapturedSecurityDescriptor
 863         SepGetSDGroup(SecurityDescriptor) == NULL)    // FIXME: use CapturedSecurityDescriptor
 864     {
 865         DPRINT("Security Descriptor does not have a valid group or owner\n");
 866         SeReleaseSecurityDescriptor(CapturedSecurityDescriptor,
 867                                     PreviousMode,
 868                                     FALSE);
 869         ObDereferenceObject(Token);
 870         return STATUS_INVALID_SECURITY_DESCR;
 871     }
 872
 873     /* Set up the subject context, and lock it */
 874     SubjectSecurityContext.ClientToken = Token;
 875     SubjectSecurityContext.ImpersonationLevel = Token->ImpersonationLevel;
 876     SubjectSecurityContext.PrimaryToken = NULL;
 877     SubjectSecurityContext.ProcessAuditId = NULL;
 878     SeLockSubjectContext(&SubjectSecurityContext);
 879
 880     /* Check if the token is the owner and grant WRITE_DAC and READ_CONTROL rights */
 881     if (DesiredAccess & (WRITE_DAC | READ_CONTROL | MAXIMUM_ALLOWED))
 882     {
 883         if (SepTokenIsOwner(Token, SecurityDescriptor)) // FIXME: use CapturedSecurityDescriptor
 884         {
 885             if (DesiredAccess & MAXIMUM_ALLOWED)
 886                 PreviouslyGrantedAccess |= (WRITE_DAC | READ_CONTROL);
 887             else
 888                 PreviouslyGrantedAccess |= (DesiredAccess & (WRITE_DAC | READ_CONTROL));
 889
 890             DesiredAccess &= ~(WRITE_DAC | READ_CONTROL);
 891         }
 892     }
 893
 894     if (DesiredAccess == 0)
 895     {
 896         *GrantedAccess = PreviouslyGrantedAccess;
 897         *AccessStatus = STATUS_SUCCESS;
 898     }
 899     else
 900     {
 901         /* Now perform the access check */
 902         SepAccessCheck(SecurityDescriptor, // FIXME: use CapturedSecurityDescriptor
 903                        &SubjectSecurityContext,
 904                        DesiredAccess,
 905                        PreviouslyGrantedAccess,
 906                        &PrivilegeSet, //FIXME
 907                        GenericMapping,
 908                        PreviousMode,
 909                        GrantedAccess,
 910                        AccessStatus);
 911     }
 912
 913     /* Unlock subject context */
 914     SeUnlockSubjectContext(&SubjectSecurityContext);
 915
 916     /* Release the captured security descriptor */
 917     SeReleaseSecurityDescriptor(CapturedSecurityDescriptor,
 918                                 PreviousMode,
 919                                 FALSE);
 920
 921     /* Dereference the token */
 922     ObDereferenceObject(Token);
 923
 924     /* Check succeeded */
 925     return STATUS_SUCCESS;
 926 }
 927
 928
 929 NTSTATUS
 930 NTAPI
 931 NtAccessCheckByType(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
 932                     IN PSID PrincipalSelfSid,
 933                     IN HANDLE ClientToken,
 934                     IN ACCESS_MASK DesiredAccess,
 935                     IN POBJECT_TYPE_LIST ObjectTypeList,
 936                     IN ULONG ObjectTypeLength,
 937                     IN PGENERIC_MAPPING GenericMapping,
 938                     IN PPRIVILEGE_SET PrivilegeSet,
 939                     IN ULONG PrivilegeSetLength,
 940                     OUT PACCESS_MASK GrantedAccess,
 941                     OUT PNTSTATUS AccessStatus)
 942 {
 943     UNIMPLEMENTED;
 944     return STATUS_NOT_IMPLEMENTED;
 945 }
 946
 947 NTSTATUS
 948 NTAPI
 949 NtAccessCheckByTypeAndAuditAlarm(IN PUNICODE_STRING SubsystemName,
 950                                  IN HANDLE HandleId,
 951                                  IN PUNICODE_STRING ObjectTypeName,
 952                                  IN PUNICODE_STRING ObjectName,
 953                                  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
 954                                  IN PSID PrincipalSelfSid,
 955                                  IN ACCESS_MASK DesiredAccess,
 956                                  IN AUDIT_EVENT_TYPE AuditType,
 957                                  IN ULONG Flags,
 958                                  IN POBJECT_TYPE_LIST ObjectTypeList,
 959                                  IN ULONG ObjectTypeLength,
 960                                  IN PGENERIC_MAPPING GenericMapping,
 961                                  IN BOOLEAN ObjectCreation,
 962                                  OUT PACCESS_MASK GrantedAccess,
 963                                  OUT PNTSTATUS AccessStatus,
 964                                  OUT PBOOLEAN GenerateOnClose)
 965 {
 966     UNIMPLEMENTED;
 967     return STATUS_NOT_IMPLEMENTED;
 968 }
 969
 970 NTSTATUS
 971 NTAPI
 972 NtAccessCheckByTypeResultList(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
 973                               IN PSID PrincipalSelfSid,
 974                               IN HANDLE ClientToken,
 975                               IN ACCESS_MASK DesiredAccess,
 976                               IN POBJECT_TYPE_LIST ObjectTypeList,
 977                               IN ULONG ObjectTypeLength,
 978                               IN PGENERIC_MAPPING GenericMapping,
 979                               IN PPRIVILEGE_SET PrivilegeSet,
 980                               IN ULONG PrivilegeSetLength,
 981                               OUT PACCESS_MASK GrantedAccess,
 982                               OUT PNTSTATUS AccessStatus)
 983 {
 984     UNIMPLEMENTED;
 985     return STATUS_NOT_IMPLEMENTED;
 986 }
 987
 988 NTSTATUS
 989 NTAPI
 990 NtAccessCheckByTypeResultListAndAuditAlarm(IN PUNICODE_STRING SubsystemName,
 991                                            IN HANDLE HandleId,
 992                                            IN PUNICODE_STRING ObjectTypeName,
 993                                            IN PUNICODE_STRING ObjectName,
 994                                            IN PSECURITY_DESCRIPTOR SecurityDescriptor,
 995                                            IN PSID PrincipalSelfSid,
 996                                            IN ACCESS_MASK DesiredAccess,
 997                                            IN AUDIT_EVENT_TYPE AuditType,
 998                                            IN ULONG Flags,
 999                                            IN POBJECT_TYPE_LIST ObjectTypeList,
1000                                            IN ULONG ObjectTypeLength,
1001                                            IN PGENERIC_MAPPING GenericMapping,
1002                                            IN BOOLEAN ObjectCreation,
1003                                            OUT PACCESS_MASK GrantedAccess,
1004                                            OUT PNTSTATUS AccessStatus,
1005                                            OUT PBOOLEAN GenerateOnClose)
1006 {
1007     UNIMPLEMENTED;
1008     return STATUS_NOT_IMPLEMENTED;
1009 }
1010
1011 NTSTATUS
1012 NTAPI
1013 NtAccessCheckByTypeResultListAndAuditAlarmByHandle(IN PUNICODE_STRING SubsystemName,
1014                                                    IN HANDLE HandleId,
1015                                                    IN HANDLE ClientToken,
1016                                                    IN PUNICODE_STRING ObjectTypeName,
1017                                                    IN PUNICODE_STRING ObjectName,
1018                                                    IN PSECURITY_DESCRIPTOR SecurityDescriptor,
1019                                                    IN PSID PrincipalSelfSid,
1020                                                    IN ACCESS_MASK DesiredAccess,
1021                                                    IN AUDIT_EVENT_TYPE AuditType,
1022                                                    IN ULONG Flags,
1023                                                    IN POBJECT_TYPE_LIST ObjectTypeList,
1024                                                    IN ULONG ObjectTypeLength,
1025                                                    IN PGENERIC_MAPPING GenericMapping,
1026                                                    IN BOOLEAN ObjectCreation,
1027                                                    OUT PACCESS_MASK GrantedAccess,
1028                                                    OUT PNTSTATUS AccessStatus,
1029                                                    OUT PBOOLEAN GenerateOnClose)
1030 {
1031     UNIMPLEMENTED;
1032     return STATUS_NOT_IMPLEMENTED;
1033 }
1034
1035 /* EOF */