reactos/ntoskrnl/se/semgr.c

   1 /* $Id: semgr.c,v 1.17 2000/09/03 14:53:13 ekohl Exp $
   2  *
   3  * COPYRIGHT:         See COPYING in the top level directory
   4  * PROJECT:           ReactOS kernel
   5  * PURPOSE:           Security manager
   6  * FILE:              kernel/se/semgr.c
   7  * PROGRAMER:         ?
   8  * REVISION HISTORY:
   9  *                 26/07/98: Added stubs for security functions
  10  */
  11
  12 /* INCLUDES *****************************************************************/
  13
  14 #include <ddk/ntddk.h>
  15 #include <internal/ps.h>
  16
  17 #include <internal/debug.h>
  18
  19 /* FUNCTIONS ***************************************************************/
  20
  21 VOID SepReferenceLogonSession(PLUID AuthenticationId)
  22 {
  23    UNIMPLEMENTED;
  24 }
  25
  26 VOID SepDeReferenceLogonSession(PLUID AuthenticationId)
  27 {
  28    UNIMPLEMENTED;
  29 }
  30
  31 NTSTATUS STDCALL NtPrivilegedServiceAuditAlarm(
  32                                              IN PUNICODE_STRING SubsystemName,
  33                                              IN PUNICODE_STRING ServiceName,
  34                                              IN HANDLE          ClientToken,
  35                                              IN PPRIVILEGE_SET  Privileges,
  36                                              IN BOOLEAN         AccessGranted)
  37 {
  38    UNIMPLEMENTED;
  39 }
  40
  41
  42 NTSTATUS
  43 STDCALL
  44 NtPrivilegeObjectAuditAlarm (
  45         IN      PUNICODE_STRING SubsystemName,
  46         IN      PVOID           HandleId,
  47         IN      HANDLE          ClientToken,
  48         IN      ULONG           DesiredAccess,
  49         IN      PPRIVILEGE_SET  Privileges,
  50         IN      BOOLEAN         AccessGranted
  51         )
  52 {
  53         UNIMPLEMENTED;
  54 }
  55
  56
  57 NTSTATUS
  58 STDCALL
  59 NtOpenObjectAuditAlarm (
  60         IN      PUNICODE_STRING         SubsystemName,
  61         IN      PVOID                   HandleId,
  62         IN      POBJECT_ATTRIBUTES      ObjectAttributes,
  63         IN      HANDLE                  ClientToken,
  64         IN      ULONG                   DesiredAccess,
  65         IN      ULONG                   GrantedAccess,
  66         IN      PPRIVILEGE_SET          Privileges,
  67         IN      BOOLEAN                 ObjectCreation,
  68         IN      BOOLEAN                 AccessGranted,
  69         OUT     PBOOLEAN                GenerateOnClose
  70         )
  71 {
  72         UNIMPLEMENTED;
  73 }
  74
  75 NTSTATUS
  76 STDCALL
  77 NtAccessCheckAndAuditAlarm (
  78         IN PUNICODE_STRING SubsystemName,
  79         IN PHANDLE ObjectHandle,
  80         IN POBJECT_ATTRIBUTES ObjectAttributes,
  81         IN ACCESS_MASK DesiredAccess,
  82         IN PGENERIC_MAPPING GenericMapping,
  83         IN BOOLEAN ObjectCreation,
  84         OUT PULONG GrantedAccess,
  85         OUT PBOOLEAN AccessStatus,
  86         OUT PBOOLEAN GenerateOnClose
  87         )
  88 {
  89    UNIMPLEMENTED;
  90 }
  91
  92
  93 NTSTATUS
  94 STDCALL
  95 NtAllocateUuids (
  96         PULARGE_INTEGER Time,
  97         PULONG          Range,
  98         PULONG          Sequence
  99         )
 100 {
 101    UNIMPLEMENTED;
 102 }
 103
 104
 105 NTSTATUS STDCALL NtCloseObjectAuditAlarm(IN PUNICODE_STRING SubsystemName,
 106                                          IN PVOID HandleId,
 107                                          IN BOOLEAN GenerateOnClose)
 108 {
 109    UNIMPLEMENTED;
 110 }
 111
 112 NTSTATUS STDCALL NtAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
 113                                IN HANDLE ClientToken,
 114                                IN ACCESS_MASK DesiredAccess,
 115                                IN PGENERIC_MAPPING GenericMapping,
 116                                OUT PPRIVILEGE_SET PrivilegeSet,
 117                                OUT PULONG ReturnLength,
 118                                OUT PULONG GrantedAccess,
 119                                OUT PBOOLEAN AccessStatus)
 120 {
 121    UNIMPLEMENTED;
 122 }
 123
 124
 125 NTSTATUS
 126 STDCALL
 127 NtDeleteObjectAuditAlarm (
 128         IN PUNICODE_STRING SubsystemName,
 129         IN PVOID HandleId,
 130         IN BOOLEAN GenerateOnClose
 131         )
 132 {
 133  UNIMPLEMENTED;
 134 }
 135
 136
 137
 138 VOID STDCALL SeReleaseSubjectContext (PSECURITY_SUBJECT_CONTEXT SubjectContext)
 139 {
 140    ObDereferenceObject(SubjectContext->PrimaryToken);
 141    if (SubjectContext->ClientToken != NULL)
 142      {
 143         ObDereferenceObject(SubjectContext->ClientToken);
 144      }
 145 }
 146
 147 VOID STDCALL SeCaptureSubjectContext (PSECURITY_SUBJECT_CONTEXT SubjectContext)
 148 {
 149    PEPROCESS Process;
 150    ULONG a;
 151    ULONG b;
 152
 153    Process = PsGetCurrentThread()->ThreadsProcess;
 154
 155    SubjectContext->ProcessAuditId = Process;
 156    SubjectContext->ClientToken =
 157      PsReferenceImpersonationToken(PsGetCurrentThread(),
 158                                    &a,
 159                                    &b,
 160                                    &SubjectContext->ImpersonationLevel);
 161    SubjectContext->PrimaryToken = PsReferencePrimaryToken(Process);
 162 }
 163
 164 NTSTATUS STDCALL SeDeassignSecurity(PSECURITY_DESCRIPTOR* SecurityDescriptor)
 165 {
 166    if ((*SecurityDescriptor) != NULL)
 167      {
 168         ExFreePool(*SecurityDescriptor);
 169         (*SecurityDescriptor) = NULL;
 170      }
 171    return(STATUS_SUCCESS);
 172 }
 173
 174 #if 0
 175 VOID SepGetDefaultsSubjectContext(PSECURITY_SUBJECT_CONTEXT SubjectContext,
 176                                   PSID* Owner,
 177                                   PSID* PrimaryGroup,
 178                                   PSID* ProcessOwner,
 179                                   PSID* ProcessPrimaryGroup,
 180                                   PACL* DefaultDacl)
 181 {
 182    PACCESS_TOKEN Token;
 183
 184    if (SubjectContext->ClientToken != NULL)
 185      {
 186         Token = SubjectContext->ClientToken;
 187      }
 188    else
 189      {
 190         Token = SubjectContext->PrimaryToken;
 191      }
 192    *Owner = Token->UserAndGroups[Token->DefaultOwnerIndex].Sid;
 193    *PrimaryGroup = Token->PrimaryGroup;
 194    *DefaultDacl = Token->DefaultDacl;
 195    *ProcessOwner = SubjectContext->PrimaryToken->
 196      UserAndGroups[Token->DefaultOwnerIndex].Sid;
 197    *ProcessPrimaryGroup = SubjectContext->PrimaryToken->PrimaryGroup;
 198 }
 199
 200 NTSTATUS SepInheritAcl(PACL Acl,
 201                        BOOLEAN IsDirectoryObject,
 202                        PSID Owner,
 203                        PSID PrimaryGroup,
 204                        PACL DefaultAcl,
 205                        PSID ProcessOwner,
 206                        PSID ProcessGroup,
 207                        PGENERIC_MAPPING GenericMapping)
 208 {
 209    if (Acl == NULL)
 210      {
 211         return(STATUS_UNSUCCESSFUL);
 212      }
 213    if (Acl->AclRevision != 2 &&
 214        Acl->AclRevision != 3 )
 215      {
 216         return(STATUS_UNSUCCESSFUL);
 217      }
 218
 219 }
 220 #endif
 221
 222 NTSTATUS STDCALL SeAssignSecurity(PSECURITY_DESCRIPTOR ParentDescriptor,
 223                                   PSECURITY_DESCRIPTOR ExplicitDescriptor,
 224                                   PSECURITY_DESCRIPTOR* NewDescriptor,
 225                                   BOOLEAN IsDirectoryObject,
 226                                   PSECURITY_SUBJECT_CONTEXT SubjectContext,
 227                                   PGENERIC_MAPPING GenericMapping,
 228                                   POOL_TYPE PoolType)
 229 {
 230 #if 0
 231    PSECURITY_DESCRIPTOR Descriptor;
 232    PSID Owner;
 233    PSID PrimaryGroup;
 234    PACL DefaultDacl;
 235    PSID ProcessOwner;
 236    PSID ProcessPrimaryGroup;
 237    PACL Sacl;
 238
 239    if (ExplicitDescriptor == NULL)
 240      {
 241         RtlCreateSecurityDescriptor(&Descriptor, 1);
 242      }
 243    else
 244      {
 245         Descriptor = ExplicitDescriptor;
 246      }
 247    SeLockSubjectContext(SubjectContext);
 248    SepGetDefaultsSubjectContext(SubjectContext,
 249                                 &Owner,
 250                                 &PrimaryGroup,
 251                                 &DefaultDacl,
 252                                 &ProcessOwner,
 253                                 &ProcessPrimaryGroup);
 254    if (Descriptor->Control & SE_SACL_PRESENT ||
 255        Descriptor->Control & SE_SACL_DEFAULTED)
 256      {
 257         if (ParentDescriptor == NULL)
 258           {
 259           }
 260         if (Descriptor->Control & SE_SACL_PRESENT ||
 261             Descriptor->Sacl == NULL ||)
 262           {
 263              Sacl = NULL;
 264           }
 265         else
 266           {
 267              Sacl = Descriptor->Sacl;
 268              if (Descriptor->Control & SE_SELF_RELATIVE)
 269                {
 270                   Sacl = (PACL)(((PVOID)Sacl) + (PVOID)Descriptor);
 271                }
 272           }
 273         SepInheritAcl(Sacl,
 274                       IsDirectoryObject,
 275                       Owner,
 276                       PrimaryGroup,
 277                       DefaultDacl,
 278                       ProcessOwner,
 279                       GenericMapping);
 280      }
 281 #else
 282   UNIMPLEMENTED;
 283 #endif
 284 }
 285
 286 BOOLEAN SepSidInToken(PACCESS_TOKEN Token,
 287                       PSID Sid)
 288 {
 289    ULONG i;
 290
 291    if (Token->UserAndGroupCount == 0)
 292      {
 293         return(FALSE);
 294      }
 295
 296    for (i=0; i<Token->UserAndGroupCount; i++)
 297      {
 298         if (RtlEqualSid(Sid, Token->UserAndGroups[i].Sid))
 299           {
 300              if (i == 0 ||
 301                  (!(Token->UserAndGroups[i].Attributes & SE_GROUP_ENABLED)))
 302                {
 303                   return(TRUE);
 304                }
 305              return(FALSE);
 306           }
 307      }
 308    return(FALSE);
 309 }
 310
 311 BOOLEAN STDCALL SeAccessCheck (IN PSECURITY_DESCRIPTOR SecurityDescriptor,
 312                       IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
 313                       IN BOOLEAN SubjectContextLocked,
 314                       IN ACCESS_MASK DesiredAccess,
 315                       IN ACCESS_MASK PreviouslyGrantedAccess,
 316                       OUT PPRIVILEGE_SET* Privileges,
 317                       IN PGENERIC_MAPPING GenericMapping,
 318                       IN KPROCESSOR_MODE AccessMode,
 319                       OUT PACCESS_MODE GrantedAccess,
 320                       OUT PNTSTATUS AccessStatus)
 321 /*
 322  * FUNCTION: Determines whether the requested access rights can be granted
 323  * to an object protected by a security descriptor and an object owner
 324  * ARGUMENTS:
 325  *      SecurityDescriptor = Security descriptor protecting the object
 326  *      SubjectSecurityContext = Subject's captured security context
 327  *      SubjectContextLocked = Indicates the user's subject context is locked
 328  *      DesiredAccess = Access rights the caller is trying to acquire
 329  *      PreviouslyGrantedAccess = Specified the access rights already granted
 330  *      Privileges = ?
 331  *      GenericMapping = Generic mapping associated with the object
 332  *      AccessMode = Access mode used for the check
 333  *      GrantedAccess (OUT) = On return specifies the access granted
 334  *      AccessStatus (OUT) = Status indicating why access was denied
 335  * RETURNS: If access was granted, returns TRUE
 336  */
 337 {
 338    ULONG i;
 339    PACL Dacl;
 340    BOOLEAN Present;
 341    BOOLEAN Defaulted;
 342    NTSTATUS Status;
 343    PACE CurrentAce;
 344    PSID Sid;
 345    ACCESS_MASK CurrentAccess;
 346
 347    CurrentAccess = PreviouslyGrantedAccess;
 348
 349    /*
 350     * Ignore the SACL for now
 351     */
 352
 353    /*
 354     * Check the DACL
 355     */
 356    Status = RtlGetDaclSecurityDescriptor(SecurityDescriptor,
 357                                          &Present,
 358                                          &Dacl,
 359                                          &Defaulted);
 360    if (!NT_SUCCESS(Status))
 361      {
 362         return(Status);
 363      }
 364
 365    CurrentAce = (PACE)(Dacl + 1);
 366    for (i = 0; i < Dacl->AceCount; i++)
 367      {
 368         Sid = (PSID)(CurrentAce + 1);
 369         if (CurrentAce->Header.AceType == ACCESS_DENIED_ACE_TYPE)
 370           {
 371              if (SepSidInToken(SubjectSecurityContext->ClientToken, Sid))
 372                {
 373                   *AccessStatus = STATUS_ACCESS_DENIED;
 374                   *GrantedAccess = 0;
 375                   return(STATUS_SUCCESS);
 376                }
 377           }
 378         if (CurrentAce->Header.AceType == ACCESS_ALLOWED_ACE_TYPE)
 379           {
 380              if (SepSidInToken(SubjectSecurityContext->ClientToken, Sid))
 381                {
 382                   CurrentAccess = CurrentAccess |
 383                     CurrentAce->Header.AccessMask;
 384                }
 385           }
 386      }
 387    if (!(CurrentAccess & DesiredAccess) &&
 388        !((~CurrentAccess) & DesiredAccess))
 389      {
 390         *AccessStatus = STATUS_ACCESS_DENIED;
 391      }
 392    else
 393      {
 394         *AccessStatus = STATUS_SUCCESS;
 395      }
 396    *GrantedAccess = CurrentAccess;
 397
 398    return(STATUS_SUCCESS);
 399 }
 400
 401
 402 /* EOF */