[NTOSKRNL]
[reactos.git] / reactos / ntoskrnl / se / semgr.c
1 /*
2 * COPYRIGHT: See COPYING in the top level directory
3 * PROJECT: ReactOS kernel
4 * FILE: ntoskrnl/se/semgr.c
5 * PURPOSE: Security manager
6 *
7 * PROGRAMMERS: No programmer listed.
8 */
9
10 /* INCLUDES *******************************************************************/
11
12 #include <ntoskrnl.h>
13 #define NDEBUG
14 #include <debug.h>
15
16 /* GLOBALS ********************************************************************/
17
18 PSE_EXPORTS SeExports = NULL;
19 SE_EXPORTS SepExports;
20
21 extern ULONG ExpInitializationPhase;
22 extern ERESOURCE SepSubjectContextLock;
23
24 /* PRIVATE FUNCTIONS **********************************************************/
25
26 static BOOLEAN INIT_FUNCTION
27 SepInitExports(VOID)
28 {
29 SepExports.SeCreateTokenPrivilege = SeCreateTokenPrivilege;
30 SepExports.SeAssignPrimaryTokenPrivilege = SeAssignPrimaryTokenPrivilege;
31 SepExports.SeLockMemoryPrivilege = SeLockMemoryPrivilege;
32 SepExports.SeIncreaseQuotaPrivilege = SeIncreaseQuotaPrivilege;
33 SepExports.SeUnsolicitedInputPrivilege = SeUnsolicitedInputPrivilege;
34 SepExports.SeTcbPrivilege = SeTcbPrivilege;
35 SepExports.SeSecurityPrivilege = SeSecurityPrivilege;
36 SepExports.SeTakeOwnershipPrivilege = SeTakeOwnershipPrivilege;
37 SepExports.SeLoadDriverPrivilege = SeLoadDriverPrivilege;
38 SepExports.SeCreatePagefilePrivilege = SeCreatePagefilePrivilege;
39 SepExports.SeIncreaseBasePriorityPrivilege = SeIncreaseBasePriorityPrivilege;
40 SepExports.SeSystemProfilePrivilege = SeSystemProfilePrivilege;
41 SepExports.SeSystemtimePrivilege = SeSystemtimePrivilege;
42 SepExports.SeProfileSingleProcessPrivilege = SeProfileSingleProcessPrivilege;
43 SepExports.SeCreatePermanentPrivilege = SeCreatePermanentPrivilege;
44 SepExports.SeBackupPrivilege = SeBackupPrivilege;
45 SepExports.SeRestorePrivilege = SeRestorePrivilege;
46 SepExports.SeShutdownPrivilege = SeShutdownPrivilege;
47 SepExports.SeDebugPrivilege = SeDebugPrivilege;
48 SepExports.SeAuditPrivilege = SeAuditPrivilege;
49 SepExports.SeSystemEnvironmentPrivilege = SeSystemEnvironmentPrivilege;
50 SepExports.SeChangeNotifyPrivilege = SeChangeNotifyPrivilege;
51 SepExports.SeRemoteShutdownPrivilege = SeRemoteShutdownPrivilege;
52
53 SepExports.SeNullSid = SeNullSid;
54 SepExports.SeWorldSid = SeWorldSid;
55 SepExports.SeLocalSid = SeLocalSid;
56 SepExports.SeCreatorOwnerSid = SeCreatorOwnerSid;
57 SepExports.SeCreatorGroupSid = SeCreatorGroupSid;
58 SepExports.SeNtAuthoritySid = SeNtAuthoritySid;
59 SepExports.SeDialupSid = SeDialupSid;
60 SepExports.SeNetworkSid = SeNetworkSid;
61 SepExports.SeBatchSid = SeBatchSid;
62 SepExports.SeInteractiveSid = SeInteractiveSid;
63 SepExports.SeLocalSystemSid = SeLocalSystemSid;
64 SepExports.SeAliasAdminsSid = SeAliasAdminsSid;
65 SepExports.SeAliasUsersSid = SeAliasUsersSid;
66 SepExports.SeAliasGuestsSid = SeAliasGuestsSid;
67 SepExports.SeAliasPowerUsersSid = SeAliasPowerUsersSid;
68 SepExports.SeAliasAccountOpsSid = SeAliasAccountOpsSid;
69 SepExports.SeAliasSystemOpsSid = SeAliasSystemOpsSid;
70 SepExports.SeAliasPrintOpsSid = SeAliasPrintOpsSid;
71 SepExports.SeAliasBackupOpsSid = SeAliasBackupOpsSid;
72 SepExports.SeAuthenticatedUsersSid = SeAuthenticatedUsersSid;
73 SepExports.SeRestrictedSid = SeRestrictedSid;
74 SepExports.SeAnonymousLogonSid = SeAnonymousLogonSid;
75
76 SepExports.SeUndockPrivilege = SeUndockPrivilege;
77 SepExports.SeSyncAgentPrivilege = SeSyncAgentPrivilege;
78 SepExports.SeEnableDelegationPrivilege = SeEnableDelegationPrivilege;
79
80 SeExports = &SepExports;
81 return TRUE;
82 }
83
84
85 BOOLEAN
86 NTAPI
87 SepInitializationPhase0(VOID)
88 {
89 PAGED_CODE();
90
91 ExpInitLuid();
92 if (!SepInitSecurityIDs()) return FALSE;
93 if (!SepInitDACLs()) return FALSE;
94 if (!SepInitSDs()) return FALSE;
95 SepInitPrivileges();
96 if (!SepInitExports()) return FALSE;
97
98 /* Initialize the subject context lock */
99 ExInitializeResource(&SepSubjectContextLock);
100
101 /* Initialize token objects */
102 SepInitializeTokenImplementation();
103
104 /* Clear impersonation info for the idle thread */
105 PsGetCurrentThread()->ImpersonationInfo = NULL;
106 PspClearCrossThreadFlag(PsGetCurrentThread(),
107 CT_ACTIVE_IMPERSONATION_INFO_BIT);
108
109 /* Initialize the boot token */
110 ObInitializeFastReference(&PsGetCurrentProcess()->Token, NULL);
111 ObInitializeFastReference(&PsGetCurrentProcess()->Token,
112 SepCreateSystemProcessToken());
113 return TRUE;
114 }
115
116 BOOLEAN
117 NTAPI
118 SepInitializationPhase1(VOID)
119 {
120 NTSTATUS Status;
121 PAGED_CODE();
122
123 /* Insert the system token into the tree */
124 Status = ObInsertObject((PVOID)(PsGetCurrentProcess()->Token.Value &
125 ~MAX_FAST_REFS),
126 NULL,
127 0,
128 0,
129 NULL,
130 NULL);
131 ASSERT(NT_SUCCESS(Status));
132
133 /* FIXME: TODO \\ Security directory */
134 return TRUE;
135 }
136
137 BOOLEAN
138 NTAPI
139 SeInitSystem(VOID)
140 {
141 /* Check the initialization phase */
142 switch (ExpInitializationPhase)
143 {
144 case 0:
145
146 /* Do Phase 0 */
147 return SepInitializationPhase0();
148
149 case 1:
150
151 /* Do Phase 1 */
152 return SepInitializationPhase1();
153
154 default:
155
156 /* Don't know any other phase! Bugcheck! */
157 KeBugCheckEx(UNEXPECTED_INITIALIZATION_CALL,
158 0,
159 ExpInitializationPhase,
160 0,
161 0);
162 return FALSE;
163 }
164 }
165
166 BOOLEAN
167 NTAPI
168 SeInitSRM(VOID)
169 {
170 OBJECT_ATTRIBUTES ObjectAttributes;
171 UNICODE_STRING Name;
172 HANDLE DirectoryHandle;
173 HANDLE EventHandle;
174 NTSTATUS Status;
175
176 /* Create '\Security' directory */
177 RtlInitUnicodeString(&Name,
178 L"\\Security");
179 InitializeObjectAttributes(&ObjectAttributes,
180 &Name,
181 OBJ_PERMANENT,
182 0,
183 NULL);
184 Status = ZwCreateDirectoryObject(&DirectoryHandle,
185 DIRECTORY_ALL_ACCESS,
186 &ObjectAttributes);
187 if (!NT_SUCCESS(Status))
188 {
189 DPRINT1("Failed to create 'Security' directory!\n");
190 return FALSE;
191 }
192
193 /* Create 'LSA_AUTHENTICATION_INITALIZED' event */
194 RtlInitUnicodeString(&Name,
195 L"\\LSA_AUTHENTICATION_INITALIZED");
196 InitializeObjectAttributes(&ObjectAttributes,
197 &Name,
198 OBJ_PERMANENT,
199 DirectoryHandle,
200 SePublicDefaultSd);
201 Status = ZwCreateEvent(&EventHandle,
202 EVENT_ALL_ACCESS,
203 &ObjectAttributes,
204 SynchronizationEvent,
205 FALSE);
206 if (!NT_SUCCESS(Status))
207 {
208 DPRINT1("Failed to create 'LSA_AUTHENTICATION_INITALIZED' event!\n");
209 NtClose(DirectoryHandle);
210 return FALSE;
211 }
212
213 ZwClose(EventHandle);
214 ZwClose(DirectoryHandle);
215
216 /* FIXME: Create SRM port and listener thread */
217
218 return TRUE;
219 }
220
221 NTSTATUS
222 NTAPI
223 SeDefaultObjectMethod(IN PVOID Object,
224 IN SECURITY_OPERATION_CODE OperationType,
225 IN PSECURITY_INFORMATION SecurityInformation,
226 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
227 IN OUT PULONG ReturnLength OPTIONAL,
228 IN OUT PSECURITY_DESCRIPTOR *OldSecurityDescriptor,
229 IN POOL_TYPE PoolType,
230 IN PGENERIC_MAPPING GenericMapping)
231 {
232 PAGED_CODE();
233
234 /* Select the operation type */
235 switch (OperationType)
236 {
237 /* Setting a new descriptor */
238 case SetSecurityDescriptor:
239
240 /* Sanity check */
241 ASSERT((PoolType == PagedPool) || (PoolType == NonPagedPool));
242
243 /* Set the information */
244 return ObSetSecurityDescriptorInfo(Object,
245 SecurityInformation,
246 SecurityDescriptor,
247 OldSecurityDescriptor,
248 PoolType,
249 GenericMapping);
250
251 case QuerySecurityDescriptor:
252
253 /* Query the information */
254 return ObQuerySecurityDescriptorInfo(Object,
255 SecurityInformation,
256 SecurityDescriptor,
257 ReturnLength,
258 OldSecurityDescriptor);
259
260 case DeleteSecurityDescriptor:
261
262 /* De-assign it */
263 return ObDeassignSecurity(OldSecurityDescriptor);
264
265 case AssignSecurityDescriptor:
266
267 /* Assign it */
268 ObAssignObjectSecurityDescriptor(Object, SecurityDescriptor, PoolType);
269 return STATUS_SUCCESS;
270
271 default:
272
273 /* Bug check */
274 KeBugCheckEx(SECURITY_SYSTEM, 0, STATUS_INVALID_PARAMETER, 0, 0);
275 }
276
277 /* Should never reach here */
278 ASSERT(FALSE);
279 return STATUS_SUCCESS;
280 }
281
282 ULONG SidInTokenCalls = 0;
283
284 static BOOLEAN
285 SepSidInToken(PACCESS_TOKEN _Token,
286 PSID Sid)
287 {
288 ULONG i;
289 PTOKEN Token = (PTOKEN)_Token;
290
291 PAGED_CODE();
292
293 SidInTokenCalls++;
294 if (!(SidInTokenCalls % 10000)) DPRINT1("SidInToken Calls: %d\n", SidInTokenCalls);
295
296 if (Token->UserAndGroupCount == 0)
297 {
298 return FALSE;
299 }
300
301 for (i=0; i<Token->UserAndGroupCount; i++)
302 {
303 if (RtlEqualSid(Sid, Token->UserAndGroups[i].Sid))
304 {
305 if ((i == 0)|| (Token->UserAndGroups[i].Attributes & SE_GROUP_ENABLED))
306 {
307 return TRUE;
308 }
309
310 return FALSE;
311 }
312 }
313
314 return FALSE;
315 }
316
317 static BOOLEAN
318 SepTokenIsOwner(PACCESS_TOKEN Token,
319 PSECURITY_DESCRIPTOR SecurityDescriptor)
320 {
321 NTSTATUS Status;
322 PSID Sid = NULL;
323 BOOLEAN Defaulted;
324
325 Status = RtlGetOwnerSecurityDescriptor(SecurityDescriptor,
326 &Sid,
327 &Defaulted);
328 if (!NT_SUCCESS(Status))
329 {
330 DPRINT1("RtlGetOwnerSecurityDescriptor() failed (Status %lx)\n", Status);
331 return FALSE;
332 }
333
334 if (Sid == NULL)
335 {
336 DPRINT1("Owner Sid is NULL\n");
337 return FALSE;
338 }
339
340 return SepSidInToken(Token, Sid);
341 }
342
343 VOID NTAPI
344 SeQuerySecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
345 OUT PACCESS_MASK DesiredAccess)
346 {
347 *DesiredAccess = 0;
348
349 if (SecurityInformation & (OWNER_SECURITY_INFORMATION |
350 GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION))
351 {
352 *DesiredAccess |= READ_CONTROL;
353 }
354 if (SecurityInformation & SACL_SECURITY_INFORMATION)
355 {
356 *DesiredAccess |= ACCESS_SYSTEM_SECURITY;
357 }
358 }
359
360 VOID NTAPI
361 SeSetSecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
362 OUT PACCESS_MASK DesiredAccess)
363 {
364 *DesiredAccess = 0;
365
366 if (SecurityInformation & (OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION))
367 {
368 *DesiredAccess |= WRITE_OWNER;
369 }
370 if (SecurityInformation & DACL_SECURITY_INFORMATION)
371 {
372 *DesiredAccess |= WRITE_DAC;
373 }
374 if (SecurityInformation & SACL_SECURITY_INFORMATION)
375 {
376 *DesiredAccess |= ACCESS_SYSTEM_SECURITY;
377 }
378 }
379
380 BOOLEAN NTAPI
381 SepAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
382 IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
383 IN ACCESS_MASK DesiredAccess,
384 IN ACCESS_MASK PreviouslyGrantedAccess,
385 OUT PPRIVILEGE_SET* Privileges,
386 IN PGENERIC_MAPPING GenericMapping,
387 IN KPROCESSOR_MODE AccessMode,
388 OUT PACCESS_MASK GrantedAccess,
389 OUT PNTSTATUS AccessStatus)
390 {
391 LUID_AND_ATTRIBUTES Privilege;
392 ACCESS_MASK CurrentAccess, AccessMask;
393 ACCESS_MASK RemainingAccess;
394 PACCESS_TOKEN Token;
395 ULONG i;
396 PACL Dacl;
397 BOOLEAN Present;
398 BOOLEAN Defaulted;
399 PACE CurrentAce;
400 PSID Sid;
401 NTSTATUS Status;
402 PAGED_CODE();
403
404 /* Check for no access desired */
405 if (!DesiredAccess)
406 {
407 /* Check if we had no previous access */
408 if (!PreviouslyGrantedAccess)
409 {
410 /* Then there's nothing to give */
411 *AccessStatus = STATUS_ACCESS_DENIED;
412 return FALSE;
413 }
414
415 /* Return the previous access only */
416 *GrantedAccess = PreviouslyGrantedAccess;
417 *AccessStatus = STATUS_SUCCESS;
418 *Privileges = NULL;
419 return TRUE;
420 }
421
422 /* Map given accesses */
423 RtlMapGenericMask(&DesiredAccess, GenericMapping);
424 if (PreviouslyGrantedAccess)
425 RtlMapGenericMask(&PreviouslyGrantedAccess, GenericMapping);
426
427
428 CurrentAccess = PreviouslyGrantedAccess;
429 RemainingAccess = DesiredAccess;
430
431
432 Token = SubjectSecurityContext->ClientToken ?
433 SubjectSecurityContext->ClientToken : SubjectSecurityContext->PrimaryToken;
434
435 /* Check for system security access */
436 if (RemainingAccess & ACCESS_SYSTEM_SECURITY)
437 {
438 Privilege.Luid = SeSecurityPrivilege;
439 Privilege.Attributes = SE_PRIVILEGE_ENABLED;
440
441 /* Fail if we do not the SeSecurityPrivilege */
442 if (!SepPrivilegeCheck(Token,
443 &Privilege,
444 1,
445 PRIVILEGE_SET_ALL_NECESSARY,
446 AccessMode))
447 {
448 *AccessStatus = STATUS_PRIVILEGE_NOT_HELD;
449 return FALSE;
450 }
451
452 /* Adjust access rights */
453 RemainingAccess &= ~ACCESS_SYSTEM_SECURITY;
454 PreviouslyGrantedAccess |= ACCESS_SYSTEM_SECURITY;
455
456 /* Succeed if there are no more rights to grant */
457 if (RemainingAccess == 0)
458 {
459 *GrantedAccess = PreviouslyGrantedAccess;
460 *AccessStatus = STATUS_SUCCESS;
461 return TRUE;
462 }
463 }
464
465 /* Get the DACL */
466 Status = RtlGetDaclSecurityDescriptor(SecurityDescriptor,
467 &Present,
468 &Dacl,
469 &Defaulted);
470 if (!NT_SUCCESS(Status))
471 {
472 *AccessStatus = Status;
473 return FALSE;
474 }
475
476 /* RULE 1: Grant desired access if the object is unprotected */
477 if (Present == FALSE || Dacl == NULL)
478 {
479 if (DesiredAccess & MAXIMUM_ALLOWED)
480 {
481 *GrantedAccess = GenericMapping->GenericAll;
482 *GrantedAccess |= (DesiredAccess & ~MAXIMUM_ALLOWED);
483 }
484 else
485 {
486 *GrantedAccess = DesiredAccess | PreviouslyGrantedAccess;
487 }
488
489 *AccessStatus = STATUS_SUCCESS;
490 return TRUE;
491 }
492
493 CurrentAccess = PreviouslyGrantedAccess;
494
495 /* RULE 2: Check token for 'take ownership' privilege */
496 if (DesiredAccess & WRITE_OWNER)
497 {
498 Privilege.Luid = SeTakeOwnershipPrivilege;
499 Privilege.Attributes = SE_PRIVILEGE_ENABLED;
500
501 if (SepPrivilegeCheck(Token,
502 &Privilege,
503 1,
504 PRIVILEGE_SET_ALL_NECESSARY,
505 AccessMode))
506 {
507 /* Adjust access rights */
508 RemainingAccess &= ~WRITE_OWNER;
509 PreviouslyGrantedAccess |= WRITE_OWNER;
510 CurrentAccess |= WRITE_OWNER;
511
512 /* Succeed if there are no more rights to grant */
513 if (RemainingAccess == 0)
514 {
515 *GrantedAccess = PreviouslyGrantedAccess;
516 *AccessStatus = STATUS_SUCCESS;
517 return TRUE;
518 }
519 }
520 }
521
522 /* Deny access if the DACL is empty */
523 if (Dacl->AceCount == 0)
524 {
525 if (RemainingAccess == MAXIMUM_ALLOWED && PreviouslyGrantedAccess != 0)
526 {
527 *GrantedAccess = PreviouslyGrantedAccess;
528 *AccessStatus = STATUS_SUCCESS;
529 return TRUE;
530 }
531 else
532 {
533 *GrantedAccess = 0;
534 *AccessStatus = STATUS_ACCESS_DENIED;
535 return FALSE;
536 }
537 }
538
539 /* Fail if DACL is absent */
540 if (Present == FALSE)
541 {
542 *GrantedAccess = 0;
543 *AccessStatus = STATUS_ACCESS_DENIED;
544 return FALSE;
545 }
546
547 /* RULE 4: Grant rights according to the DACL */
548 CurrentAce = (PACE)(Dacl + 1);
549 for (i = 0; i < Dacl->AceCount; i++)
550 {
551 Sid = (PSID)(CurrentAce + 1);
552 if (CurrentAce->Header.AceType == ACCESS_DENIED_ACE_TYPE)
553 {
554 if (SepSidInToken(Token, Sid))
555 {
556 *GrantedAccess = 0;
557 *AccessStatus = STATUS_ACCESS_DENIED;
558 return FALSE;
559 }
560 }
561
562 else if (CurrentAce->Header.AceType == ACCESS_ALLOWED_ACE_TYPE)
563 {
564 if (SepSidInToken(Token, Sid))
565 {
566 AccessMask = CurrentAce->AccessMask;
567 RtlMapGenericMask(&AccessMask, GenericMapping);
568 CurrentAccess |= AccessMask;
569 }
570 }
571 else
572 {
573 DPRINT1("Unknown Ace type 0x%lx\n", CurrentAce->Header.AceType);
574 }
575 CurrentAce = (PACE)((ULONG_PTR)CurrentAce + CurrentAce->Header.AceSize);
576 }
577
578 DPRINT("CurrentAccess %08lx\n DesiredAccess %08lx\n",
579 CurrentAccess, DesiredAccess);
580
581 *GrantedAccess = CurrentAccess & DesiredAccess;
582
583 if (DesiredAccess & MAXIMUM_ALLOWED)
584 {
585 *GrantedAccess = CurrentAccess;
586 *AccessStatus = STATUS_SUCCESS;
587 return TRUE;
588 }
589 else if ((*GrantedAccess & ~VALID_INHERIT_FLAGS) ==
590 (DesiredAccess & ~VALID_INHERIT_FLAGS))
591 {
592 *AccessStatus = STATUS_SUCCESS;
593 return TRUE;
594 }
595 else
596 {
597 DPRINT1("HACK: Should deny access for caller: granted 0x%lx, desired 0x%lx (generic mapping %p).\n",
598 *GrantedAccess, DesiredAccess, GenericMapping);
599 //*AccessStatus = STATUS_ACCESS_DENIED;
600 //return FALSE;
601 *AccessStatus = STATUS_SUCCESS;
602 return TRUE;
603 }
604 }
605
606 static PSID
607 SepGetSDOwner(IN PSECURITY_DESCRIPTOR _SecurityDescriptor)
608 {
609 PISECURITY_DESCRIPTOR SecurityDescriptor = _SecurityDescriptor;
610 PSID Owner;
611
612 if (SecurityDescriptor->Control & SE_SELF_RELATIVE)
613 Owner = (PSID)((ULONG_PTR)SecurityDescriptor->Owner +
614 (ULONG_PTR)SecurityDescriptor);
615 else
616 Owner = (PSID)SecurityDescriptor->Owner;
617
618 return Owner;
619 }
620
621 static PSID
622 SepGetSDGroup(IN PSECURITY_DESCRIPTOR _SecurityDescriptor)
623 {
624 PISECURITY_DESCRIPTOR SecurityDescriptor = _SecurityDescriptor;
625 PSID Group;
626
627 if (SecurityDescriptor->Control & SE_SELF_RELATIVE)
628 Group = (PSID)((ULONG_PTR)SecurityDescriptor->Group +
629 (ULONG_PTR)SecurityDescriptor);
630 else
631 Group = (PSID)SecurityDescriptor->Group;
632
633 return Group;
634 }
635
636
637 /* PUBLIC FUNCTIONS ***********************************************************/
638
639 /*
640 * @implemented
641 */
642 BOOLEAN NTAPI
643 SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
644 IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
645 IN BOOLEAN SubjectContextLocked,
646 IN ACCESS_MASK DesiredAccess,
647 IN ACCESS_MASK PreviouslyGrantedAccess,
648 OUT PPRIVILEGE_SET* Privileges,
649 IN PGENERIC_MAPPING GenericMapping,
650 IN KPROCESSOR_MODE AccessMode,
651 OUT PACCESS_MASK GrantedAccess,
652 OUT PNTSTATUS AccessStatus)
653 {
654 BOOLEAN ret;
655
656 PAGED_CODE();
657
658 /* Check if this is kernel mode */
659 if (AccessMode == KernelMode)
660 {
661 /* Check if kernel wants everything */
662 if (DesiredAccess & MAXIMUM_ALLOWED)
663 {
664 /* Give it */
665 *GrantedAccess = GenericMapping->GenericAll;
666 *GrantedAccess |= (DesiredAccess &~ MAXIMUM_ALLOWED);
667 *GrantedAccess |= PreviouslyGrantedAccess;
668 }
669 else
670 {
671 /* Give the desired and previous access */
672 *GrantedAccess = DesiredAccess | PreviouslyGrantedAccess;
673 }
674
675 /* Success */
676 *AccessStatus = STATUS_SUCCESS;
677 return TRUE;
678 }
679
680 /* Check if we didn't get an SD */
681 if (!SecurityDescriptor)
682 {
683 /* Automatic failure */
684 *AccessStatus = STATUS_ACCESS_DENIED;
685 return FALSE;
686 }
687
688 /* Check for invalid impersonation */
689 if ((SubjectSecurityContext->ClientToken) &&
690 (SubjectSecurityContext->ImpersonationLevel < SecurityImpersonation))
691 {
692 *AccessStatus = STATUS_BAD_IMPERSONATION_LEVEL;
693 return FALSE;
694 }
695
696 /* Acquire the lock if needed */
697 if (!SubjectContextLocked)
698 SeLockSubjectContext(SubjectSecurityContext);
699
700 /* Check if the token is the owner and grant WRITE_DAC and READ_CONTROL rights */
701 if (DesiredAccess & (WRITE_DAC | READ_CONTROL | MAXIMUM_ALLOWED))
702 {
703 PACCESS_TOKEN Token = SubjectSecurityContext->ClientToken ?
704 SubjectSecurityContext->ClientToken : SubjectSecurityContext->PrimaryToken;
705
706 if (SepTokenIsOwner(Token,
707 SecurityDescriptor))
708 {
709 if (DesiredAccess & MAXIMUM_ALLOWED)
710 PreviouslyGrantedAccess |= (WRITE_DAC | READ_CONTROL);
711 else
712 PreviouslyGrantedAccess |= (DesiredAccess & (WRITE_DAC | READ_CONTROL));
713
714 DesiredAccess &= ~(WRITE_DAC | READ_CONTROL);
715 }
716 }
717
718 if (DesiredAccess == 0)
719 {
720 *GrantedAccess = PreviouslyGrantedAccess;
721 *AccessStatus = STATUS_SUCCESS;
722 ret = TRUE;
723 }
724 else
725 {
726 /* Call the internal function */
727 ret = SepAccessCheck(SecurityDescriptor,
728 SubjectSecurityContext,
729 DesiredAccess,
730 PreviouslyGrantedAccess,
731 Privileges,
732 GenericMapping,
733 AccessMode,
734 GrantedAccess,
735 AccessStatus);
736 }
737
738 /* Release the lock if needed */
739 if (!SubjectContextLocked)
740 SeUnlockSubjectContext(SubjectSecurityContext);
741
742 return ret;
743 }
744
745 /* SYSTEM CALLS ***************************************************************/
746
747 /*
748 * @implemented
749 */
750 NTSTATUS
751 NTAPI
752 NtAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
753 IN HANDLE TokenHandle,
754 IN ACCESS_MASK DesiredAccess,
755 IN PGENERIC_MAPPING GenericMapping,
756 OUT PPRIVILEGE_SET PrivilegeSet OPTIONAL,
757 IN OUT PULONG PrivilegeSetLength,
758 OUT PACCESS_MASK GrantedAccess,
759 OUT PNTSTATUS AccessStatus)
760 {
761 PSECURITY_DESCRIPTOR CapturedSecurityDescriptor = NULL;
762 SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
763 KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
764 ACCESS_MASK PreviouslyGrantedAccess = 0;
765 PTOKEN Token;
766 NTSTATUS Status;
767 PAGED_CODE();
768
769 /* Check if this is kernel mode */
770 if (PreviousMode == KernelMode)
771 {
772 /* Check if kernel wants everything */
773 if (DesiredAccess & MAXIMUM_ALLOWED)
774 {
775 /* Give it */
776 *GrantedAccess = GenericMapping->GenericAll;
777 *GrantedAccess |= (DesiredAccess &~ MAXIMUM_ALLOWED);
778 }
779 else
780 {
781 /* Just give the desired access */
782 *GrantedAccess = DesiredAccess;
783 }
784
785 /* Success */
786 *AccessStatus = STATUS_SUCCESS;
787 return STATUS_SUCCESS;
788 }
789
790 /* Protect probe in SEH */
791 _SEH2_TRY
792 {
793 /* Probe all pointers */
794 ProbeForRead(GenericMapping, sizeof(GENERIC_MAPPING), sizeof(ULONG));
795 ProbeForRead(PrivilegeSetLength, sizeof(ULONG), sizeof(ULONG));
796 ProbeForWrite(PrivilegeSet, *PrivilegeSetLength, sizeof(ULONG));
797 ProbeForWrite(GrantedAccess, sizeof(ACCESS_MASK), sizeof(ULONG));
798 ProbeForWrite(AccessStatus, sizeof(NTSTATUS), sizeof(ULONG));
799 }
800 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
801 {
802 /* Return the exception code */
803 _SEH2_YIELD(return _SEH2_GetExceptionCode());
804 }
805 _SEH2_END;
806
807 /* Check for unmapped access rights */
808 if (DesiredAccess & (GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL))
809 return STATUS_GENERIC_NOT_MAPPED;
810
811 /* Reference the token */
812 Status = ObReferenceObjectByHandle(TokenHandle,
813 TOKEN_QUERY,
814 SepTokenObjectType,
815 PreviousMode,
816 (PVOID*)&Token,
817 NULL);
818 if (!NT_SUCCESS(Status))
819 {
820 DPRINT("Failed to reference token (Status %lx)\n", Status);
821 return Status;
822 }
823
824 /* Check token type */
825 if (Token->TokenType != TokenImpersonation)
826 {
827 DPRINT("No impersonation token\n");
828 ObDereferenceObject(Token);
829 return STATUS_NO_IMPERSONATION_TOKEN;
830 }
831
832 /* Check the impersonation level */
833 if (Token->ImpersonationLevel < SecurityIdentification)
834 {
835 DPRINT("Impersonation level < SecurityIdentification\n");
836 ObDereferenceObject(Token);
837 return STATUS_BAD_IMPERSONATION_LEVEL;
838 }
839
840 /* Capture the security descriptor */
841 Status = SeCaptureSecurityDescriptor(SecurityDescriptor,
842 PreviousMode,
843 PagedPool,
844 FALSE,
845 &CapturedSecurityDescriptor);
846 if (!NT_SUCCESS(Status))
847 {
848 DPRINT("Failed to capture the Security Descriptor\n");
849 ObDereferenceObject(Token);
850 return Status;
851 }
852
853 /* Check the captured security descriptor */
854 if (CapturedSecurityDescriptor == NULL)
855 {
856 DPRINT("Security Descriptor is NULL\n");
857 ObDereferenceObject(Token);
858 return STATUS_INVALID_SECURITY_DESCR;
859 }
860
861 /* Check security descriptor for valid owner and group */
862 if (SepGetSDOwner(SecurityDescriptor) == NULL || // FIXME: use CapturedSecurityDescriptor
863 SepGetSDGroup(SecurityDescriptor) == NULL) // FIXME: use CapturedSecurityDescriptor
864 {
865 DPRINT("Security Descriptor does not have a valid group or owner\n");
866 SeReleaseSecurityDescriptor(CapturedSecurityDescriptor,
867 PreviousMode,
868 FALSE);
869 ObDereferenceObject(Token);
870 return STATUS_INVALID_SECURITY_DESCR;
871 }
872
873 /* Set up the subject context, and lock it */
874 SubjectSecurityContext.ClientToken = Token;
875 SubjectSecurityContext.ImpersonationLevel = Token->ImpersonationLevel;
876 SubjectSecurityContext.PrimaryToken = NULL;
877 SubjectSecurityContext.ProcessAuditId = NULL;
878 SeLockSubjectContext(&SubjectSecurityContext);
879
880 /* Check if the token is the owner and grant WRITE_DAC and READ_CONTROL rights */
881 if (DesiredAccess & (WRITE_DAC | READ_CONTROL | MAXIMUM_ALLOWED))
882 {
883 if (SepTokenIsOwner(Token, SecurityDescriptor)) // FIXME: use CapturedSecurityDescriptor
884 {
885 if (DesiredAccess & MAXIMUM_ALLOWED)
886 PreviouslyGrantedAccess |= (WRITE_DAC | READ_CONTROL);
887 else
888 PreviouslyGrantedAccess |= (DesiredAccess & (WRITE_DAC | READ_CONTROL));
889
890 DesiredAccess &= ~(WRITE_DAC | READ_CONTROL);
891 }
892 }
893
894 if (DesiredAccess == 0)
895 {
896 *GrantedAccess = PreviouslyGrantedAccess;
897 *AccessStatus = STATUS_SUCCESS;
898 }
899 else
900 {
901 /* Now perform the access check */
902 SepAccessCheck(SecurityDescriptor, // FIXME: use CapturedSecurityDescriptor
903 &SubjectSecurityContext,
904 DesiredAccess,
905 PreviouslyGrantedAccess,
906 &PrivilegeSet, //FIXME
907 GenericMapping,
908 PreviousMode,
909 GrantedAccess,
910 AccessStatus);
911 }
912
913 /* Unlock subject context */
914 SeUnlockSubjectContext(&SubjectSecurityContext);
915
916 /* Release the captured security descriptor */
917 SeReleaseSecurityDescriptor(CapturedSecurityDescriptor,
918 PreviousMode,
919 FALSE);
920
921 /* Dereference the token */
922 ObDereferenceObject(Token);
923
924 /* Check succeeded */
925 return STATUS_SUCCESS;
926 }
927
928
929 NTSTATUS
930 NTAPI
931 NtAccessCheckByType(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
932 IN PSID PrincipalSelfSid,
933 IN HANDLE ClientToken,
934 IN ACCESS_MASK DesiredAccess,
935 IN POBJECT_TYPE_LIST ObjectTypeList,
936 IN ULONG ObjectTypeLength,
937 IN PGENERIC_MAPPING GenericMapping,
938 IN PPRIVILEGE_SET PrivilegeSet,
939 IN ULONG PrivilegeSetLength,
940 OUT PACCESS_MASK GrantedAccess,
941 OUT PNTSTATUS AccessStatus)
942 {
943 UNIMPLEMENTED;
944 return STATUS_NOT_IMPLEMENTED;
945 }
946
947 NTSTATUS
948 NTAPI
949 NtAccessCheckByTypeAndAuditAlarm(IN PUNICODE_STRING SubsystemName,
950 IN HANDLE HandleId,
951 IN PUNICODE_STRING ObjectTypeName,
952 IN PUNICODE_STRING ObjectName,
953 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
954 IN PSID PrincipalSelfSid,
955 IN ACCESS_MASK DesiredAccess,
956 IN AUDIT_EVENT_TYPE AuditType,
957 IN ULONG Flags,
958 IN POBJECT_TYPE_LIST ObjectTypeList,
959 IN ULONG ObjectTypeLength,
960 IN PGENERIC_MAPPING GenericMapping,
961 IN BOOLEAN ObjectCreation,
962 OUT PACCESS_MASK GrantedAccess,
963 OUT PNTSTATUS AccessStatus,
964 OUT PBOOLEAN GenerateOnClose)
965 {
966 UNIMPLEMENTED;
967 return STATUS_NOT_IMPLEMENTED;
968 }
969
970 NTSTATUS
971 NTAPI
972 NtAccessCheckByTypeResultList(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
973 IN PSID PrincipalSelfSid,
974 IN HANDLE ClientToken,
975 IN ACCESS_MASK DesiredAccess,
976 IN POBJECT_TYPE_LIST ObjectTypeList,
977 IN ULONG ObjectTypeLength,
978 IN PGENERIC_MAPPING GenericMapping,
979 IN PPRIVILEGE_SET PrivilegeSet,
980 IN ULONG PrivilegeSetLength,
981 OUT PACCESS_MASK GrantedAccess,
982 OUT PNTSTATUS AccessStatus)
983 {
984 UNIMPLEMENTED;
985 return STATUS_NOT_IMPLEMENTED;
986 }
987
988 NTSTATUS
989 NTAPI
990 NtAccessCheckByTypeResultListAndAuditAlarm(IN PUNICODE_STRING SubsystemName,
991 IN HANDLE HandleId,
992 IN PUNICODE_STRING ObjectTypeName,
993 IN PUNICODE_STRING ObjectName,
994 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
995 IN PSID PrincipalSelfSid,
996 IN ACCESS_MASK DesiredAccess,
997 IN AUDIT_EVENT_TYPE AuditType,
998 IN ULONG Flags,
999 IN POBJECT_TYPE_LIST ObjectTypeList,
1000 IN ULONG ObjectTypeLength,
1001 IN PGENERIC_MAPPING GenericMapping,
1002 IN BOOLEAN ObjectCreation,
1003 OUT PACCESS_MASK GrantedAccess,
1004 OUT PNTSTATUS AccessStatus,
1005 OUT PBOOLEAN GenerateOnClose)
1006 {
1007 UNIMPLEMENTED;
1008 return STATUS_NOT_IMPLEMENTED;
1009 }
1010
1011 NTSTATUS
1012 NTAPI
1013 NtAccessCheckByTypeResultListAndAuditAlarmByHandle(IN PUNICODE_STRING SubsystemName,
1014 IN HANDLE HandleId,
1015 IN HANDLE ClientToken,
1016 IN PUNICODE_STRING ObjectTypeName,
1017 IN PUNICODE_STRING ObjectName,
1018 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
1019 IN PSID PrincipalSelfSid,
1020 IN ACCESS_MASK DesiredAccess,
1021 IN AUDIT_EVENT_TYPE AuditType,
1022 IN ULONG Flags,
1023 IN POBJECT_TYPE_LIST ObjectTypeList,
1024 IN ULONG ObjectTypeLength,
1025 IN PGENERIC_MAPPING GenericMapping,
1026 IN BOOLEAN ObjectCreation,
1027 OUT PACCESS_MASK GrantedAccess,
1028 OUT PNTSTATUS AccessStatus,
1029 OUT PBOOLEAN GenerateOnClose)
1030 {
1031 UNIMPLEMENTED;
1032 return STATUS_NOT_IMPLEMENTED;
1033 }
1034
1035 /* EOF */