Force a rebuild of the partition table if it already exists with a DeviceObject.
[reactos.git] / reactos / ntoskrnl / se / token.c
1 /* $Id: token.c,v 1.36 2004/07/06 22:07:26 gvg Exp $
2 *
3 * COPYRIGHT: See COPYING in the top level directory
4 * PROJECT: ReactOS kernel
5 * PURPOSE: Security manager
6 * FILE: kernel/se/token.c
7 * PROGRAMER: David Welch <welch@cwcom.net>
8 * REVISION HISTORY:
9 * 26/07/98: Added stubs for security functions
10 */
11
12 /* INCLUDES *****************************************************************/
13
14 #include <limits.h>
15 #define NTOS_MODE_KERNEL
16 #include <ntos.h>
17 #include <internal/ob.h>
18 #include <internal/ps.h>
19 #include <internal/se.h>
20 #include <internal/safe.h>
21
22 #define NDEBUG
23 #include <internal/debug.h>
24
25 /* GLOBALS *******************************************************************/
26
27 POBJECT_TYPE SepTokenObjectType = NULL;
28
29 static GENERIC_MAPPING SepTokenMapping = {TOKEN_READ,
30 TOKEN_WRITE,
31 TOKEN_EXECUTE,
32 TOKEN_ALL_ACCESS};
33
34 #define SYSTEM_LUID 0x3E7;
35
36 /* FUNCTIONS *****************************************************************/
37
38 VOID SepFreeProxyData(PVOID ProxyData)
39 {
40 UNIMPLEMENTED;
41 }
42
43 NTSTATUS SepCopyProxyData(PVOID* Dest, PVOID Src)
44 {
45 UNIMPLEMENTED;
46 return(STATUS_NOT_IMPLEMENTED);
47 }
48
49 NTSTATUS SeExchangePrimaryToken(PEPROCESS Process,
50 PACCESS_TOKEN NewToken,
51 PACCESS_TOKEN* OldTokenP)
52 {
53 PACCESS_TOKEN OldToken;
54
55 if (NewToken->TokenType != TokenPrimary)
56 {
57 return(STATUS_UNSUCCESSFUL);
58 }
59 if (NewToken->TokenInUse != 0)
60 {
61 return(STATUS_UNSUCCESSFUL);
62 }
63 OldToken = Process->Token;
64 Process->Token = NewToken;
65 NewToken->TokenInUse = 1;
66 ObReferenceObjectByPointer(NewToken,
67 TOKEN_ALL_ACCESS,
68 SepTokenObjectType,
69 KernelMode);
70 OldToken->TokenInUse = 0;
71 *OldTokenP = OldToken;
72 return(STATUS_SUCCESS);
73 }
74
75 static ULONG
76 RtlLengthSidAndAttributes(ULONG Count,
77 PSID_AND_ATTRIBUTES Src)
78 {
79 ULONG i;
80 ULONG uLength;
81
82 uLength = Count * sizeof(SID_AND_ATTRIBUTES);
83 for (i = 0; i < Count; i++)
84 uLength += RtlLengthSid(Src[i].Sid);
85
86 return(uLength);
87 }
88
89
90 NTSTATUS
91 SepFindPrimaryGroupAndDefaultOwner(PACCESS_TOKEN Token,
92 PSID PrimaryGroup,
93 PSID DefaultOwner)
94 {
95 ULONG i;
96
97 Token->PrimaryGroup = 0;
98
99 if (DefaultOwner)
100 {
101 Token->DefaultOwnerIndex = Token->UserAndGroupCount;
102 }
103
104 /* Validate and set the primary group and user pointers */
105 for (i = 0; i < Token->UserAndGroupCount; i++)
106 {
107 if (DefaultOwner &&
108 RtlEqualSid(Token->UserAndGroups[i].Sid, DefaultOwner))
109 {
110 Token->DefaultOwnerIndex = i;
111 }
112
113 if (RtlEqualSid(Token->UserAndGroups[i].Sid, PrimaryGroup))
114 {
115 Token->PrimaryGroup = Token->UserAndGroups[i].Sid;
116 }
117 }
118
119 if (Token->DefaultOwnerIndex == Token->UserAndGroupCount)
120 {
121 return(STATUS_INVALID_OWNER);
122 }
123
124 if (Token->PrimaryGroup == 0)
125 {
126 return(STATUS_INVALID_PRIMARY_GROUP);
127 }
128
129 return(STATUS_SUCCESS);
130 }
131
132
133 NTSTATUS
134 SepDuplicateToken(PACCESS_TOKEN Token,
135 POBJECT_ATTRIBUTES ObjectAttributes,
136 TOKEN_TYPE TokenType,
137 SECURITY_IMPERSONATION_LEVEL Level,
138 SECURITY_IMPERSONATION_LEVEL ExistingLevel,
139 KPROCESSOR_MODE PreviousMode,
140 PACCESS_TOKEN* NewAccessToken)
141 {
142 NTSTATUS Status;
143 ULONG uLength;
144 ULONG i;
145
146 PVOID EndMem;
147
148 PACCESS_TOKEN AccessToken;
149
150 Status = ObCreateObject(PreviousMode,
151 SepTokenObjectType,
152 ObjectAttributes,
153 PreviousMode,
154 NULL,
155 sizeof(ACCESS_TOKEN),
156 0,
157 0,
158 (PVOID*)&AccessToken);
159 if (!NT_SUCCESS(Status))
160 {
161 DPRINT1("ObCreateObject() failed (Status %lx)\n");
162 return(Status);
163 }
164
165 Status = ZwAllocateLocallyUniqueId(&AccessToken->TokenId);
166 if (!NT_SUCCESS(Status))
167 {
168 ObDereferenceObject(AccessToken);
169 return(Status);
170 }
171
172 Status = ZwAllocateLocallyUniqueId(&AccessToken->ModifiedId);
173 if (!NT_SUCCESS(Status))
174 {
175 ObDereferenceObject(AccessToken);
176 return(Status);
177 }
178
179 AccessToken->TokenInUse = 0;
180 AccessToken->TokenType = TokenType;
181 AccessToken->ImpersonationLevel = Level;
182 AccessToken->AuthenticationId.LowPart = SYSTEM_LUID;
183 AccessToken->AuthenticationId.HighPart = 0;
184
185 AccessToken->TokenSource.SourceIdentifier.LowPart = Token->TokenSource.SourceIdentifier.LowPart;
186 AccessToken->TokenSource.SourceIdentifier.HighPart = Token->TokenSource.SourceIdentifier.HighPart;
187 memcpy(AccessToken->TokenSource.SourceName,
188 Token->TokenSource.SourceName,
189 sizeof(Token->TokenSource.SourceName));
190 AccessToken->ExpirationTime.QuadPart = Token->ExpirationTime.QuadPart;
191 AccessToken->UserAndGroupCount = Token->UserAndGroupCount;
192 AccessToken->DefaultOwnerIndex = Token->DefaultOwnerIndex;
193
194 uLength = sizeof(SID_AND_ATTRIBUTES) * AccessToken->UserAndGroupCount;
195 for (i = 0; i < Token->UserAndGroupCount; i++)
196 uLength += RtlLengthSid(Token->UserAndGroups[i].Sid);
197
198 AccessToken->UserAndGroups =
199 (PSID_AND_ATTRIBUTES)ExAllocatePoolWithTag(NonPagedPool,
200 uLength,
201 TAG('T', 'O', 'K', 'u'));
202
203 EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount];
204
205 Status = RtlCopySidAndAttributesArray(AccessToken->UserAndGroupCount,
206 Token->UserAndGroups,
207 uLength,
208 AccessToken->UserAndGroups,
209 EndMem,
210 &EndMem,
211 &uLength);
212 if (NT_SUCCESS(Status))
213 {
214 Status = SepFindPrimaryGroupAndDefaultOwner(
215 AccessToken,
216 Token->PrimaryGroup,
217 0);
218 }
219
220 if (NT_SUCCESS(Status))
221 {
222 AccessToken->PrivilegeCount = Token->PrivilegeCount;
223
224 uLength = AccessToken->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
225 AccessToken->Privileges =
226 (PLUID_AND_ATTRIBUTES)ExAllocatePoolWithTag(NonPagedPool,
227 uLength,
228 TAG('T', 'O', 'K', 'p'));
229
230 for (i = 0; i < AccessToken->PrivilegeCount; i++)
231 {
232 RtlCopyLuid(&AccessToken->Privileges[i].Luid,
233 &Token->Privileges[i].Luid);
234 AccessToken->Privileges[i].Attributes =
235 Token->Privileges[i].Attributes;
236 }
237
238 if ( Token->DefaultDacl )
239 {
240 AccessToken->DefaultDacl =
241 (PACL) ExAllocatePoolWithTag(NonPagedPool,
242 Token->DefaultDacl->AclSize,
243 TAG('T', 'O', 'K', 'd'));
244 memcpy(AccessToken->DefaultDacl,
245 Token->DefaultDacl,
246 Token->DefaultDacl->AclSize);
247 }
248 else
249 {
250 AccessToken->DefaultDacl = 0;
251 }
252 }
253
254 if ( NT_SUCCESS(Status) )
255 {
256 *NewAccessToken = AccessToken;
257 return(STATUS_SUCCESS);
258 }
259
260 ObDereferenceObject(AccessToken);
261 return(Status);
262 }
263
264
265 NTSTATUS
266 SepInitializeNewProcess(struct _EPROCESS* NewProcess,
267 struct _EPROCESS* ParentProcess)
268 {
269 NTSTATUS Status;
270 PACCESS_TOKEN pNewToken;
271 PACCESS_TOKEN pParentToken;
272
273 OBJECT_ATTRIBUTES ObjectAttributes;
274
275 pParentToken = (PACCESS_TOKEN) ParentProcess->Token;
276
277 InitializeObjectAttributes(&ObjectAttributes,
278 NULL,
279 0,
280 NULL,
281 NULL);
282
283 Status = SepDuplicateToken(pParentToken,
284 &ObjectAttributes,
285 TokenPrimary,
286 pParentToken->ImpersonationLevel,
287 pParentToken->ImpersonationLevel,
288 KernelMode,
289 &pNewToken);
290 if ( ! NT_SUCCESS(Status) )
291 return Status;
292
293 NewProcess->Token = pNewToken;
294 return(STATUS_SUCCESS);
295 }
296
297
298 NTSTATUS SeCopyClientToken(PACCESS_TOKEN Token,
299 SECURITY_IMPERSONATION_LEVEL Level,
300 KPROCESSOR_MODE PreviousMode,
301 PACCESS_TOKEN* NewToken)
302 {
303 NTSTATUS Status;
304 OBJECT_ATTRIBUTES ObjectAttributes;
305
306 InitializeObjectAttributes(&ObjectAttributes,
307 NULL,
308 0,
309 NULL,
310 NULL);
311 Status = SepDuplicateToken(Token,
312 &ObjectAttributes,
313 0,
314 SecurityIdentification,
315 Level,
316 PreviousMode,
317 NewToken);
318 return(Status);
319 }
320
321
322 /*
323 * @implemented
324 */
325 NTSTATUS STDCALL
326 SeCreateClientSecurity(IN struct _ETHREAD *Thread,
327 IN PSECURITY_QUALITY_OF_SERVICE Qos,
328 IN BOOLEAN RemoteClient,
329 OUT PSECURITY_CLIENT_CONTEXT ClientContext)
330 {
331 TOKEN_TYPE TokenType;
332 UCHAR b;
333 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
334 PACCESS_TOKEN Token;
335 ULONG g;
336 PACCESS_TOKEN NewToken;
337
338 Token = PsReferenceEffectiveToken(Thread,
339 &TokenType,
340 &b,
341 &ImpersonationLevel);
342 if (TokenType != 2)
343 {
344 ClientContext->DirectAccessEffectiveOnly = Qos->EffectiveOnly;
345 }
346 else
347 {
348 if (Qos->ImpersonationLevel > ImpersonationLevel)
349 {
350 if (Token != NULL)
351 {
352 ObDereferenceObject(Token);
353 }
354 return(STATUS_UNSUCCESSFUL);
355 }
356 if (ImpersonationLevel == 0 ||
357 ImpersonationLevel == 1 ||
358 (RemoteClient != FALSE && ImpersonationLevel != 3))
359 {
360 if (Token != NULL)
361 {
362 ObDereferenceObject(Token);
363 }
364 return(STATUS_UNSUCCESSFUL);
365 }
366 if (b != 0 ||
367 Qos->EffectiveOnly != 0)
368 {
369 ClientContext->DirectAccessEffectiveOnly = TRUE;
370 }
371 else
372 {
373 ClientContext->DirectAccessEffectiveOnly = FALSE;
374 }
375 }
376
377 if (Qos->ContextTrackingMode == 0)
378 {
379 ClientContext->DirectlyAccessClientToken = FALSE;
380 g = SeCopyClientToken(Token, ImpersonationLevel, 0, &NewToken);
381 if (g >= 0)
382 {
383 // ObDeleteCapturedInsertInfo(NewToken);
384 }
385 if (TokenType == TokenPrimary || Token != NULL)
386 {
387 ObDereferenceObject(Token);
388 }
389 if (g < 0)
390 {
391 return(g);
392 }
393 }
394 else
395 {
396 ClientContext->DirectlyAccessClientToken = TRUE;
397 if (RemoteClient != FALSE)
398 {
399 // SeGetTokenControlInformation(Token, &ClientContext->Unknown11);
400 }
401 NewToken = Token;
402 }
403 ClientContext->SecurityQos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
404 ClientContext->SecurityQos.ImpersonationLevel = Qos->ImpersonationLevel;
405 ClientContext->SecurityQos.ContextTrackingMode = Qos->ContextTrackingMode;
406 ClientContext->SecurityQos.EffectiveOnly = Qos->EffectiveOnly;
407 ClientContext->ServerIsRemote = RemoteClient;
408 ClientContext->Token = NewToken;
409
410 return(STATUS_SUCCESS);
411 }
412
413
414 /*
415 * @implemented
416 */
417 VOID STDCALL
418 SeImpersonateClient(IN PSECURITY_CLIENT_CONTEXT ClientContext,
419 IN PETHREAD ServerThread OPTIONAL)
420 {
421 UCHAR b;
422
423 if (ClientContext->DirectlyAccessClientToken == FALSE)
424 {
425 b = ClientContext->SecurityQos.EffectiveOnly;
426 }
427 else
428 {
429 b = ClientContext->DirectAccessEffectiveOnly;
430 }
431 if (ServerThread == NULL)
432 {
433 ServerThread = PsGetCurrentThread();
434 }
435 PsImpersonateClient(ServerThread,
436 ClientContext->Token,
437 1,
438 (ULONG)b,
439 ClientContext->SecurityQos.ImpersonationLevel);
440 }
441
442
443 VOID STDCALL
444 SepDeleteToken(PVOID ObjectBody)
445 {
446 PACCESS_TOKEN AccessToken = (PACCESS_TOKEN)ObjectBody;
447
448 if (AccessToken->UserAndGroups)
449 ExFreePool(AccessToken->UserAndGroups);
450
451 if (AccessToken->Privileges)
452 ExFreePool(AccessToken->Privileges);
453
454 if (AccessToken->DefaultDacl)
455 ExFreePool(AccessToken->DefaultDacl);
456 }
457
458
459 VOID INIT_FUNCTION
460 SepInitializeTokenImplementation(VOID)
461 {
462 SepTokenObjectType = ExAllocatePool(NonPagedPool, sizeof(OBJECT_TYPE));
463
464 SepTokenObjectType->Tag = TAG('T', 'O', 'K', 'T');
465 SepTokenObjectType->MaxObjects = ULONG_MAX;
466 SepTokenObjectType->MaxHandles = ULONG_MAX;
467 SepTokenObjectType->TotalObjects = 0;
468 SepTokenObjectType->TotalHandles = 0;
469 SepTokenObjectType->PagedPoolCharge = 0;
470 SepTokenObjectType->NonpagedPoolCharge = sizeof(ACCESS_TOKEN);
471 SepTokenObjectType->Mapping = &SepTokenMapping;
472 SepTokenObjectType->Dump = NULL;
473 SepTokenObjectType->Open = NULL;
474 SepTokenObjectType->Close = NULL;
475 SepTokenObjectType->Delete = SepDeleteToken;
476 SepTokenObjectType->Parse = NULL;
477 SepTokenObjectType->Security = NULL;
478 SepTokenObjectType->QueryName = NULL;
479 SepTokenObjectType->OkayToClose = NULL;
480 SepTokenObjectType->Create = NULL;
481 SepTokenObjectType->DuplicationNotify = NULL;
482
483 RtlCreateUnicodeString(&SepTokenObjectType->TypeName,
484 L"Token");
485 ObpCreateTypeObject (SepTokenObjectType);
486 }
487
488
489 /*
490 * @implemented
491 */
492 NTSTATUS STDCALL
493 NtQueryInformationToken(IN HANDLE TokenHandle,
494 IN TOKEN_INFORMATION_CLASS TokenInformationClass,
495 OUT PVOID TokenInformation,
496 IN ULONG TokenInformationLength,
497 OUT PULONG ReturnLength)
498 {
499 NTSTATUS Status;
500 PVOID UnusedInfo;
501 PVOID EndMem;
502 PACCESS_TOKEN Token;
503 ULONG Length;
504 PTOKEN_GROUPS PtrTokenGroups;
505 PTOKEN_DEFAULT_DACL PtrDefaultDacl;
506 PTOKEN_STATISTICS PtrTokenStatistics;
507
508 Status = ObReferenceObjectByHandle(TokenHandle,
509 (TokenInformationClass == TokenSource) ? TOKEN_QUERY_SOURCE : TOKEN_QUERY,
510 SepTokenObjectType,
511 UserMode,
512 (PVOID*)&Token,
513 NULL);
514 if (!NT_SUCCESS(Status))
515 {
516 return(Status);
517 }
518
519 switch (TokenInformationClass)
520 {
521 case TokenUser:
522 DPRINT("NtQueryInformationToken(TokenUser)\n");
523 Length = RtlLengthSidAndAttributes(1, Token->UserAndGroups);
524 if (TokenInformationLength < Length)
525 {
526 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
527 if (NT_SUCCESS(Status))
528 Status = STATUS_BUFFER_TOO_SMALL;
529 }
530 else
531 {
532 Status = RtlCopySidAndAttributesArray(1,
533 Token->UserAndGroups,
534 TokenInformationLength,
535 TokenInformation,
536 (char*)TokenInformation + 8,
537 &UnusedInfo,
538 &Length);
539 if (NT_SUCCESS(Status))
540 {
541 Length = TokenInformationLength - Length;
542 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
543 }
544 }
545 break;
546
547 case TokenGroups:
548 DPRINT("NtQueryInformationToken(TokenGroups)\n");
549 Length = RtlLengthSidAndAttributes(Token->UserAndGroupCount - 1, &Token->UserAndGroups[1]) + sizeof(ULONG);
550 if (TokenInformationLength < Length)
551 {
552 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
553 if (NT_SUCCESS(Status))
554 Status = STATUS_BUFFER_TOO_SMALL;
555 }
556 else
557 {
558 EndMem = (char*)TokenInformation + Token->UserAndGroupCount * sizeof(SID_AND_ATTRIBUTES);
559 PtrTokenGroups = (PTOKEN_GROUPS)TokenInformation;
560 PtrTokenGroups->GroupCount = Token->UserAndGroupCount - 1;
561 Status = RtlCopySidAndAttributesArray(Token->UserAndGroupCount - 1,
562 &Token->UserAndGroups[1],
563 TokenInformationLength,
564 PtrTokenGroups->Groups,
565 EndMem,
566 &UnusedInfo,
567 &Length);
568 if (NT_SUCCESS(Status))
569 {
570 Length = TokenInformationLength - Length;
571 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
572 }
573 }
574 break;
575
576 case TokenPrivileges:
577 DPRINT("NtQueryInformationToken(TokenPrivileges)\n");
578 Length = sizeof(ULONG) + Token->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
579 if (TokenInformationLength < Length)
580 {
581 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
582 if (NT_SUCCESS(Status))
583 Status = STATUS_BUFFER_TOO_SMALL;
584 }
585 else
586 {
587 ULONG i;
588 TOKEN_PRIVILEGES* pPriv = (TOKEN_PRIVILEGES*)TokenInformation;
589
590 pPriv->PrivilegeCount = Token->PrivilegeCount;
591 for (i = 0; i < Token->PrivilegeCount; i++)
592 {
593 RtlCopyLuid(&pPriv->Privileges[i].Luid, &Token->Privileges[i].Luid);
594 pPriv->Privileges[i].Attributes = Token->Privileges[i].Attributes;
595 }
596 Status = STATUS_SUCCESS;
597 }
598 break;
599
600 case TokenOwner:
601 DPRINT("NtQueryInformationToken(TokenOwner)\n");
602 Length = RtlLengthSid(Token->UserAndGroups[Token->DefaultOwnerIndex].Sid) + sizeof(TOKEN_OWNER);
603 if (TokenInformationLength < Length)
604 {
605 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
606 if (NT_SUCCESS(Status))
607 Status = STATUS_BUFFER_TOO_SMALL;
608 }
609 else
610 {
611 ((PTOKEN_OWNER)TokenInformation)->Owner =
612 (PSID)(((PTOKEN_OWNER)TokenInformation) + 1);
613 RtlCopySid(TokenInformationLength - sizeof(TOKEN_OWNER),
614 ((PTOKEN_OWNER)TokenInformation)->Owner,
615 Token->UserAndGroups[Token->DefaultOwnerIndex].Sid);
616 Status = STATUS_SUCCESS;
617 }
618 break;
619
620 case TokenPrimaryGroup:
621 DPRINT("NtQueryInformationToken(TokenPrimaryGroup),"
622 "Token->PrimaryGroup = 0x%08x\n", Token->PrimaryGroup);
623 Length = RtlLengthSid(Token->PrimaryGroup) + sizeof(TOKEN_PRIMARY_GROUP);
624 if (TokenInformationLength < Length)
625 {
626 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
627 if (NT_SUCCESS(Status))
628 Status = STATUS_BUFFER_TOO_SMALL;
629 }
630 else
631 {
632 ((PTOKEN_PRIMARY_GROUP)TokenInformation)->PrimaryGroup =
633 (PSID)(((PTOKEN_PRIMARY_GROUP)TokenInformation) + 1);
634 RtlCopySid(TokenInformationLength - sizeof(TOKEN_PRIMARY_GROUP),
635 ((PTOKEN_PRIMARY_GROUP)TokenInformation)->PrimaryGroup,
636 Token->PrimaryGroup);
637 Status = STATUS_SUCCESS;
638 }
639 break;
640
641 case TokenDefaultDacl:
642 DPRINT("NtQueryInformationToken(TokenDefaultDacl)\n");
643 PtrDefaultDacl = (PTOKEN_DEFAULT_DACL) TokenInformation;
644 Length = (Token->DefaultDacl ? Token->DefaultDacl->AclSize : 0) + sizeof(TOKEN_DEFAULT_DACL);
645 if (TokenInformationLength < Length)
646 {
647 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
648 if (NT_SUCCESS(Status))
649 Status = STATUS_BUFFER_TOO_SMALL;
650 }
651 else if (!Token->DefaultDacl)
652 {
653 PtrDefaultDacl->DefaultDacl = 0;
654 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
655 }
656 else
657 {
658 PtrDefaultDacl->DefaultDacl = (PACL) (PtrDefaultDacl + 1);
659 memmove(PtrDefaultDacl->DefaultDacl,
660 Token->DefaultDacl,
661 Token->DefaultDacl->AclSize);
662 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
663 }
664 break;
665
666 case TokenSource:
667 DPRINT("NtQueryInformationToken(TokenSource)\n");
668 if (TokenInformationLength < sizeof(TOKEN_SOURCE))
669 {
670 Length = sizeof(TOKEN_SOURCE);
671 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
672 if (NT_SUCCESS(Status))
673 Status = STATUS_BUFFER_TOO_SMALL;
674 }
675 else
676 {
677 Status = MmCopyToCaller(TokenInformation, &Token->TokenSource, sizeof(TOKEN_SOURCE));
678 }
679 break;
680
681 case TokenType:
682 DPRINT("NtQueryInformationToken(TokenType)\n");
683 if (TokenInformationLength < sizeof(TOKEN_TYPE))
684 {
685 Length = sizeof(TOKEN_TYPE);
686 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
687 if (NT_SUCCESS(Status))
688 Status = STATUS_BUFFER_TOO_SMALL;
689 }
690 else
691 {
692 Status = MmCopyToCaller(TokenInformation, &Token->TokenType, sizeof(TOKEN_TYPE));
693 }
694 break;
695
696 case TokenImpersonationLevel:
697 DPRINT("NtQueryInformationToken(TokenImpersonationLevel)\n");
698 if (TokenInformationLength < sizeof(SECURITY_IMPERSONATION_LEVEL))
699 {
700 Length = sizeof(SECURITY_IMPERSONATION_LEVEL);
701 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
702 if (NT_SUCCESS(Status))
703 Status = STATUS_BUFFER_TOO_SMALL;
704 }
705 else
706 {
707 Status = MmCopyToCaller(TokenInformation, &Token->ImpersonationLevel, sizeof(SECURITY_IMPERSONATION_LEVEL));
708 }
709 break;
710
711 case TokenStatistics:
712 DPRINT("NtQueryInformationToken(TokenStatistics)\n");
713 if (TokenInformationLength < sizeof(TOKEN_STATISTICS))
714 {
715 Length = sizeof(TOKEN_STATISTICS);
716 Status = MmCopyToCaller(ReturnLength, &Length, sizeof(ULONG));
717 if (NT_SUCCESS(Status))
718 Status = STATUS_BUFFER_TOO_SMALL;
719 }
720 else
721 {
722 PtrTokenStatistics = (PTOKEN_STATISTICS)TokenInformation;
723 PtrTokenStatistics->TokenId = Token->TokenId;
724 PtrTokenStatistics->AuthenticationId = Token->AuthenticationId;
725 PtrTokenStatistics->ExpirationTime = Token->ExpirationTime;
726 PtrTokenStatistics->TokenType = Token->TokenType;
727 PtrTokenStatistics->ImpersonationLevel = Token->ImpersonationLevel;
728 PtrTokenStatistics->DynamicCharged = Token->DynamicCharged;
729 PtrTokenStatistics->DynamicAvailable = Token->DynamicAvailable;
730 PtrTokenStatistics->GroupCount = Token->UserAndGroupCount - 1;
731 PtrTokenStatistics->PrivilegeCount = Token->PrivilegeCount;
732 PtrTokenStatistics->ModifiedId = Token->ModifiedId;
733
734 Status = STATUS_SUCCESS;
735 }
736 break;
737 }
738
739 ObDereferenceObject(Token);
740
741 return(Status);
742 }
743
744 /*
745 * NtSetTokenInformation: Partly implemented.
746 * Unimplemented:
747 * TokenOrigin, TokenDefaultDacl, TokenSessionId
748 */
749
750 NTSTATUS STDCALL
751 NtSetInformationToken(IN HANDLE TokenHandle,
752 IN TOKEN_INFORMATION_CLASS TokenInformationClass,
753 OUT PVOID TokenInformation,
754 IN ULONG TokenInformationLength)
755 {
756 NTSTATUS Status;
757 PACCESS_TOKEN Token;
758 TOKEN_OWNER TokenOwnerSet = { 0 };
759 TOKEN_PRIMARY_GROUP TokenPrimaryGroupSet = { 0 };
760 DWORD NeededAccess = 0;
761
762 switch (TokenInformationClass)
763 {
764 case TokenOwner:
765 case TokenPrimaryGroup:
766 NeededAccess = TOKEN_ADJUST_DEFAULT;
767 break;
768
769 default:
770 return STATUS_NOT_IMPLEMENTED;
771 }
772
773 Status = ObReferenceObjectByHandle(TokenHandle,
774 NeededAccess,
775 SepTokenObjectType,
776 UserMode,
777 (PVOID*)&Token,
778 NULL);
779 if (!NT_SUCCESS(Status))
780 {
781 return(Status);
782 }
783
784 switch (TokenInformationClass)
785 {
786 case TokenOwner:
787 MmCopyFromCaller( &TokenOwnerSet, TokenInformation,
788 min(sizeof(TokenOwnerSet),TokenInformationLength) );
789 RtlCopySid(TokenInformationLength - sizeof(TOKEN_OWNER),
790 Token->UserAndGroups[Token->DefaultOwnerIndex].Sid,
791 TokenOwnerSet.Owner);
792 Status = STATUS_SUCCESS;
793 DPRINT("NtSetInformationToken(TokenOwner)\n");
794 break;
795
796 case TokenPrimaryGroup:
797 MmCopyFromCaller( &TokenPrimaryGroupSet, TokenInformation,
798 min(sizeof(TokenPrimaryGroupSet),
799 TokenInformationLength) );
800 RtlCopySid(TokenInformationLength - sizeof(TOKEN_PRIMARY_GROUP),
801 Token->PrimaryGroup,
802 TokenPrimaryGroupSet.PrimaryGroup);
803 Status = STATUS_SUCCESS;
804 DPRINT("NtSetInformationToken(TokenPrimaryGroup),"
805 "Token->PrimaryGroup = 0x%08x\n", Token->PrimaryGroup);
806 break;
807
808 default:
809 Status = STATUS_NOT_IMPLEMENTED;
810 break;
811 }
812
813 ObDereferenceObject(Token);
814
815 return(Status);
816 }
817
818
819 /*
820 * @implemented
821 */
822 NTSTATUS STDCALL
823 NtDuplicateToken(IN HANDLE ExistingTokenHandle,
824 IN ACCESS_MASK DesiredAccess,
825 IN POBJECT_ATTRIBUTES ObjectAttributes,
826 IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
827 IN TOKEN_TYPE TokenType,
828 OUT PHANDLE NewTokenHandle)
829 {
830 PACCESS_TOKEN Token;
831 PACCESS_TOKEN NewToken;
832 NTSTATUS Status;
833 ULONG ExistingImpersonationLevel;
834
835 Status = ObReferenceObjectByHandle(ExistingTokenHandle,
836 TOKEN_DUPLICATE,
837 SepTokenObjectType,
838 UserMode,
839 (PVOID*)&Token,
840 NULL);
841 if (!NT_SUCCESS(Status))
842 {
843 DPRINT1 ("Failed to reference token (Status %lx)\n", Status);
844 return Status;
845 }
846
847 ExistingImpersonationLevel = Token->ImpersonationLevel;
848 Status = SepDuplicateToken(Token,
849 ObjectAttributes,
850 ImpersonationLevel,
851 TokenType,
852 ExistingImpersonationLevel,
853 KeGetPreviousMode(),
854 &NewToken);
855 if (!NT_SUCCESS(Status))
856 {
857 DPRINT1 ("Failed to duplicate token (Status %lx)\n", Status);
858 return Status;
859 }
860
861 return STATUS_SUCCESS;
862 }
863
864 VOID SepAdjustGroups(PACCESS_TOKEN Token,
865 ULONG a,
866 BOOLEAN ResetToDefault,
867 PSID_AND_ATTRIBUTES Groups,
868 ULONG b,
869 KPROCESSOR_MODE PreviousMode,
870 ULONG c,
871 PULONG d,
872 PULONG e,
873 PULONG f)
874 {
875 UNIMPLEMENTED;
876 }
877
878
879 NTSTATUS STDCALL
880 NtAdjustGroupsToken(IN HANDLE TokenHandle,
881 IN BOOLEAN ResetToDefault,
882 IN PTOKEN_GROUPS NewState,
883 IN ULONG BufferLength,
884 OUT PTOKEN_GROUPS PreviousState OPTIONAL,
885 OUT PULONG ReturnLength)
886 {
887 #if 0
888 NTSTATUS Status;
889 PACCESS_TOKEN Token;
890 ULONG a;
891 ULONG b;
892 ULONG c;
893
894 Status = ObReferenceObjectByHandle(TokenHandle,
895 ?,
896 SepTokenObjectType,
897 UserMode,
898 (PVOID*)&Token,
899 NULL);
900
901
902 SepAdjustGroups(Token,
903 0,
904 ResetToDefault,
905 NewState->Groups,
906 ?,
907 PreviousState,
908 0,
909 &a,
910 &b,
911 &c);
912 #else
913 UNIMPLEMENTED;
914 return(STATUS_NOT_IMPLEMENTED);
915 #endif
916 }
917
918
919 #if 0
920 NTSTATUS
921 SepAdjustPrivileges(PACCESS_TOKEN Token,
922 ULONG a,
923 KPROCESSOR_MODE PreviousMode,
924 ULONG PrivilegeCount,
925 PLUID_AND_ATTRIBUTES Privileges,
926 PTOKEN_PRIVILEGES* PreviousState,
927 PULONG b,
928 PULONG c,
929 PULONG d)
930 {
931 ULONG i;
932
933 *c = 0;
934
935 if (Token->PrivilegeCount > 0)
936 {
937 for (i = 0; i < Token->PrivilegeCount; i++)
938 {
939 if (PreviousMode != KernelMode)
940 {
941 if (Token->Privileges[i]->Attributes & SE_PRIVILEGE_ENABLED == 0)
942 {
943 if (a != 0)
944 {
945 if (PreviousState != NULL)
946 {
947 memcpy(&PreviousState[i],
948 &Token->Privileges[i],
949 sizeof(LUID_AND_ATTRIBUTES));
950 }
951 Token->Privileges[i].Attributes &= (~SE_PRIVILEGE_ENABLED);
952 }
953 }
954 }
955 }
956 }
957
958 if (PreviousMode != KernelMode)
959 {
960 Token->TokenFlags = Token->TokenFlags & (~1);
961 }
962 else
963 {
964 if (PrivilegeCount <= ?)
965 {
966 }
967 }
968 if (
969 }
970 #endif
971
972
973 /*
974 * @implemented
975 */
976 NTSTATUS STDCALL
977 NtAdjustPrivilegesToken (IN HANDLE TokenHandle,
978 IN BOOLEAN DisableAllPrivileges,
979 IN PTOKEN_PRIVILEGES NewState,
980 IN ULONG BufferLength,
981 OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL,
982 OUT PULONG ReturnLength OPTIONAL)
983 {
984 // PLUID_AND_ATTRIBUTES Privileges;
985 KPROCESSOR_MODE PreviousMode;
986 // ULONG PrivilegeCount;
987 PACCESS_TOKEN Token;
988 // ULONG Length;
989 ULONG i;
990 ULONG j;
991 ULONG k;
992 ULONG Count;
993 #if 0
994 ULONG a;
995 ULONG b;
996 ULONG c;
997 #endif
998 NTSTATUS Status;
999
1000 DPRINT ("NtAdjustPrivilegesToken() called\n");
1001
1002 // PrivilegeCount = NewState->PrivilegeCount;
1003 PreviousMode = KeGetPreviousMode ();
1004 // SeCaptureLuidAndAttributesArray(NewState->Privileges,
1005 // PrivilegeCount,
1006 // PreviousMode,
1007 // NULL,
1008 // 0,
1009 // NonPagedPool,
1010 // 1,
1011 // &Privileges,
1012 // &Length);
1013
1014 Status = ObReferenceObjectByHandle (TokenHandle,
1015 TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
1016 SepTokenObjectType,
1017 PreviousMode,
1018 (PVOID*)&Token,
1019 NULL);
1020 if (!NT_SUCCESS(Status))
1021 {
1022 DPRINT1 ("Failed to reference token (Status %lx)\n", Status);
1023 // SeReleaseLuidAndAttributesArray(Privileges,
1024 // PreviousMode,
1025 // 0);
1026 return Status;
1027 }
1028
1029
1030 #if 0
1031 SepAdjustPrivileges(Token,
1032 0,
1033 PreviousMode,
1034 PrivilegeCount,
1035 Privileges,
1036 PreviousState,
1037 &a,
1038 &b,
1039 &c);
1040 #endif
1041
1042 k = 0;
1043 if (DisableAllPrivileges == TRUE)
1044 {
1045 for (i = 0; i < Token->PrivilegeCount; i++)
1046 {
1047 if (Token->Privileges[i].Attributes != 0)
1048 {
1049 DPRINT ("Attributes differ\n");
1050
1051 /* Save current privilege */
1052 if (PreviousState != NULL && k < PreviousState->PrivilegeCount)
1053 {
1054 PreviousState->Privileges[k].Luid = Token->Privileges[i].Luid;
1055 PreviousState->Privileges[k].Attributes = Token->Privileges[i].Attributes;
1056 k++;
1057 }
1058
1059 /* Update current privlege */
1060 Token->Privileges[i].Attributes &= ~SE_PRIVILEGE_ENABLED;
1061 }
1062 }
1063 Status = STATUS_SUCCESS;
1064 }
1065 else
1066 {
1067 Count = 0;
1068 for (i = 0; i < Token->PrivilegeCount; i++)
1069 {
1070 for (j = 0; j < NewState->PrivilegeCount; j++)
1071 {
1072 if (Token->Privileges[i].Luid.LowPart == NewState->Privileges[j].Luid.LowPart &&
1073 Token->Privileges[i].Luid.HighPart == NewState->Privileges[j].Luid.HighPart)
1074 {
1075 DPRINT ("Found privilege\n");
1076
1077 if ((Token->Privileges[i].Attributes & SE_PRIVILEGE_ENABLED) !=
1078 (NewState->Privileges[j].Attributes & SE_PRIVILEGE_ENABLED))
1079 {
1080 DPRINT ("Attributes differ\n");
1081 DPRINT ("Current attributes %lx desired attributes %lx\n",
1082 Token->Privileges[i].Attributes,
1083 NewState->Privileges[j].Attributes);
1084
1085 /* Save current privilege */
1086 if (PreviousState != NULL && k < PreviousState->PrivilegeCount)
1087 {
1088 PreviousState->Privileges[k].Luid = Token->Privileges[i].Luid;
1089 PreviousState->Privileges[k].Attributes = Token->Privileges[i].Attributes;
1090 k++;
1091 }
1092
1093 /* Update current privlege */
1094 Token->Privileges[i].Attributes &= ~SE_PRIVILEGE_ENABLED;
1095 Token->Privileges[i].Attributes |=
1096 (NewState->Privileges[j].Attributes & SE_PRIVILEGE_ENABLED);
1097 DPRINT ("New attributes %lx\n",
1098 Token->Privileges[i].Attributes);
1099 }
1100 Count++;
1101 }
1102 }
1103 }
1104 Status = Count < NewState->PrivilegeCount ? STATUS_NOT_ALL_ASSIGNED : STATUS_SUCCESS;
1105 }
1106
1107 if (ReturnLength != NULL)
1108 {
1109 *ReturnLength = sizeof(TOKEN_PRIVILEGES) +
1110 (sizeof(LUID_AND_ATTRIBUTES) * (k - 1));
1111 }
1112
1113 ObDereferenceObject (Token);
1114
1115 // SeReleaseLuidAndAttributesArray(Privileges,
1116 // PreviousMode,
1117 // 0);
1118
1119 DPRINT ("NtAdjustPrivilegesToken() done\n");
1120
1121 return Status;
1122 }
1123
1124
1125 NTSTATUS
1126 SepCreateSystemProcessToken(struct _EPROCESS* Process)
1127 {
1128 NTSTATUS Status;
1129 ULONG uSize;
1130 ULONG i;
1131
1132 ULONG uLocalSystemLength = RtlLengthSid(SeLocalSystemSid);
1133 ULONG uWorldLength = RtlLengthSid(SeWorldSid);
1134 ULONG uAuthUserLength = RtlLengthSid(SeAuthenticatedUserSid);
1135 ULONG uAdminsLength = RtlLengthSid(SeAliasAdminsSid);
1136
1137 PACCESS_TOKEN AccessToken;
1138
1139 PVOID SidArea;
1140
1141 /*
1142 * Initialize the token
1143 */
1144 Status = ObCreateObject(KernelMode,
1145 SepTokenObjectType,
1146 NULL,
1147 KernelMode,
1148 NULL,
1149 sizeof(ACCESS_TOKEN),
1150 0,
1151 0,
1152 (PVOID*)&AccessToken);
1153 if (!NT_SUCCESS(Status))
1154 {
1155 return(Status);
1156 }
1157
1158 Status = NtAllocateLocallyUniqueId(&AccessToken->TokenId);
1159 if (!NT_SUCCESS(Status))
1160 {
1161 ObDereferenceObject(AccessToken);
1162 return(Status);
1163 }
1164
1165 Status = NtAllocateLocallyUniqueId(&AccessToken->ModifiedId);
1166 if (!NT_SUCCESS(Status))
1167 {
1168 ObDereferenceObject(AccessToken);
1169 return(Status);
1170 }
1171
1172 AccessToken->AuthenticationId.LowPart = SYSTEM_LUID;
1173 AccessToken->AuthenticationId.HighPart = 0;
1174
1175 AccessToken->TokenType = TokenPrimary;
1176 AccessToken->ImpersonationLevel = SecurityDelegation;
1177 AccessToken->TokenSource.SourceIdentifier.LowPart = 0;
1178 AccessToken->TokenSource.SourceIdentifier.HighPart = 0;
1179 memcpy(AccessToken->TokenSource.SourceName, "SeMgr\0\0\0", 8);
1180 AccessToken->ExpirationTime.QuadPart = -1;
1181 AccessToken->UserAndGroupCount = 4;
1182
1183 uSize = sizeof(SID_AND_ATTRIBUTES) * AccessToken->UserAndGroupCount;
1184 uSize += uLocalSystemLength;
1185 uSize += uWorldLength;
1186 uSize += uAuthUserLength;
1187 uSize += uAdminsLength;
1188
1189 AccessToken->UserAndGroups =
1190 (PSID_AND_ATTRIBUTES)ExAllocatePoolWithTag(NonPagedPool,
1191 uSize,
1192 TAG('T', 'O', 'K', 'u'));
1193 SidArea = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount];
1194
1195 i = 0;
1196 AccessToken->UserAndGroups[i].Sid = (PSID) SidArea;
1197 AccessToken->UserAndGroups[i++].Attributes = 0;
1198 RtlCopySid(uLocalSystemLength, SidArea, SeLocalSystemSid);
1199 SidArea = (char*)SidArea + uLocalSystemLength;
1200
1201 AccessToken->DefaultOwnerIndex = i;
1202 AccessToken->UserAndGroups[i].Sid = (PSID) SidArea;
1203 AccessToken->PrimaryGroup = (PSID) SidArea;
1204 AccessToken->UserAndGroups[i++].Attributes = SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT;
1205 Status = RtlCopySid(uAdminsLength, SidArea, SeAliasAdminsSid);
1206 SidArea = (char*)SidArea + uAdminsLength;
1207
1208 AccessToken->UserAndGroups[i].Sid = (PSID) SidArea;
1209 AccessToken->UserAndGroups[i++].Attributes = SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY;
1210 RtlCopySid(uWorldLength, SidArea, SeWorldSid);
1211 SidArea = (char*)SidArea + uWorldLength;
1212
1213 AccessToken->UserAndGroups[i].Sid = (PSID) SidArea;
1214 AccessToken->UserAndGroups[i++].Attributes = SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY;
1215 RtlCopySid(uAuthUserLength, SidArea, SeAuthenticatedUserSid);
1216 SidArea = (char*)SidArea + uAuthUserLength;
1217
1218 AccessToken->PrivilegeCount = 20;
1219
1220 uSize = AccessToken->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
1221 AccessToken->Privileges =
1222 (PLUID_AND_ATTRIBUTES)ExAllocatePoolWithTag(NonPagedPool,
1223 uSize,
1224 TAG('T', 'O', 'K', 'p'));
1225
1226 i = 0;
1227 AccessToken->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
1228 AccessToken->Privileges[i++].Luid = SeTcbPrivilege;
1229
1230 AccessToken->Privileges[i].Attributes = 0;
1231 AccessToken->Privileges[i++].Luid = SeCreateTokenPrivilege;
1232
1233 AccessToken->Privileges[i].Attributes = 0;
1234 AccessToken->Privileges[i++].Luid = SeTakeOwnershipPrivilege;
1235
1236 AccessToken->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
1237 AccessToken->Privileges[i++].Luid = SeCreatePagefilePrivilege;
1238
1239 AccessToken->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
1240 AccessToken->Privileges[i++].Luid = SeLockMemoryPrivilege;
1241
1242 AccessToken->Privileges[i].Attributes = 0;
1243 AccessToken->Privileges[i++].Luid = SeAssignPrimaryTokenPrivilege;
1244
1245 AccessToken->Privileges[i].Attributes = 0;
1246 AccessToken->Privileges[i++].Luid = SeIncreaseQuotaPrivilege;
1247
1248 AccessToken->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
1249 AccessToken->Privileges[i++].Luid = SeIncreaseBasePriorityPrivilege;
1250
1251 AccessToken->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
1252 AccessToken->Privileges[i++].Luid = SeCreatePermanentPrivilege;
1253
1254 AccessToken->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
1255 AccessToken->Privileges[i++].Luid = SeDebugPrivilege;
1256
1257 AccessToken->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
1258 AccessToken->Privileges[i++].Luid = SeAuditPrivilege;
1259
1260 AccessToken->Privileges[i].Attributes = 0;
1261 AccessToken->Privileges[i++].Luid = SeSecurityPrivilege;
1262
1263 AccessToken->Privileges[i].Attributes = 0;
1264 AccessToken->Privileges[i++].Luid = SeSystemEnvironmentPrivilege;
1265
1266 AccessToken->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
1267 AccessToken->Privileges[i++].Luid = SeChangeNotifyPrivilege;
1268
1269 AccessToken->Privileges[i].Attributes = 0;
1270 AccessToken->Privileges[i++].Luid = SeBackupPrivilege;
1271
1272 AccessToken->Privileges[i].Attributes = 0;
1273 AccessToken->Privileges[i++].Luid = SeRestorePrivilege;
1274
1275 AccessToken->Privileges[i].Attributes = 0;
1276 AccessToken->Privileges[i++].Luid = SeShutdownPrivilege;
1277
1278 AccessToken->Privileges[i].Attributes = 0;
1279 AccessToken->Privileges[i++].Luid = SeLoadDriverPrivilege;
1280
1281 AccessToken->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
1282 AccessToken->Privileges[i++].Luid = SeProfileSingleProcessPrivilege;
1283
1284 AccessToken->Privileges[i].Attributes = 0;
1285 AccessToken->Privileges[i++].Luid = SeSystemtimePrivilege;
1286 #if 0
1287 AccessToken->Privileges[i].Attributes = 0;
1288 AccessToken->Privileges[i++].Luid = SeUndockPrivilege;
1289
1290 AccessToken->Privileges[i].Attributes = 0;
1291 AccessToken->Privileges[i++].Luid = SeManageVolumePrivilege;
1292 #endif
1293
1294 assert( i == 20 );
1295
1296 uSize = sizeof(ACL);
1297 uSize += sizeof(ACE) + uLocalSystemLength;
1298 uSize += sizeof(ACE) + uAdminsLength;
1299 uSize = (uSize & (~3)) + 8;
1300 AccessToken->DefaultDacl =
1301 (PACL) ExAllocatePoolWithTag(NonPagedPool,
1302 uSize,
1303 TAG('T', 'O', 'K', 'd'));
1304 Status = RtlCreateAcl(AccessToken->DefaultDacl, uSize, ACL_REVISION);
1305 if ( NT_SUCCESS(Status) )
1306 {
1307 Status = RtlAddAccessAllowedAce(AccessToken->DefaultDacl, ACL_REVISION, GENERIC_ALL, SeLocalSystemSid);
1308 }
1309
1310 if ( NT_SUCCESS(Status) )
1311 {
1312 Status = RtlAddAccessAllowedAce(AccessToken->DefaultDacl, ACL_REVISION, GENERIC_READ|GENERIC_EXECUTE|READ_CONTROL, SeAliasAdminsSid);
1313 }
1314
1315 if ( ! NT_SUCCESS(Status) )
1316 {
1317 ObDereferenceObject(AccessToken);
1318 return Status;
1319 }
1320
1321 Process->Token = AccessToken;
1322 return(STATUS_SUCCESS);
1323 }
1324
1325
1326 NTSTATUS STDCALL
1327 NtCreateToken(OUT PHANDLE UnsafeTokenHandle,
1328 IN ACCESS_MASK DesiredAccess,
1329 IN POBJECT_ATTRIBUTES UnsafeObjectAttributes,
1330 IN TOKEN_TYPE TokenType,
1331 IN PLUID AuthenticationId,
1332 IN PLARGE_INTEGER ExpirationTime,
1333 IN PTOKEN_USER TokenUser,
1334 IN PTOKEN_GROUPS TokenGroups,
1335 IN PTOKEN_PRIVILEGES TokenPrivileges,
1336 IN PTOKEN_OWNER TokenOwner,
1337 IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,
1338 IN PTOKEN_DEFAULT_DACL TokenDefaultDacl,
1339 IN PTOKEN_SOURCE TokenSource)
1340 {
1341 HANDLE TokenHandle;
1342 PACCESS_TOKEN AccessToken;
1343 NTSTATUS Status;
1344 OBJECT_ATTRIBUTES SafeObjectAttributes;
1345 POBJECT_ATTRIBUTES ObjectAttributes;
1346 LUID TokenId;
1347 LUID ModifiedId;
1348 PVOID EndMem;
1349 ULONG uLength;
1350 ULONG i;
1351
1352 Status = MmCopyFromCaller(&SafeObjectAttributes,
1353 UnsafeObjectAttributes,
1354 sizeof(OBJECT_ATTRIBUTES));
1355 if (!NT_SUCCESS(Status))
1356 return(Status);
1357
1358 ObjectAttributes = &SafeObjectAttributes;
1359
1360 Status = ZwAllocateLocallyUniqueId(&TokenId);
1361 if (!NT_SUCCESS(Status))
1362 return(Status);
1363
1364 Status = ZwAllocateLocallyUniqueId(&ModifiedId);
1365 if (!NT_SUCCESS(Status))
1366 return(Status);
1367
1368 Status = ObCreateObject(ExGetPreviousMode(),
1369 SepTokenObjectType,
1370 ObjectAttributes,
1371 ExGetPreviousMode(),
1372 NULL,
1373 sizeof(ACCESS_TOKEN),
1374 0,
1375 0,
1376 (PVOID*)&AccessToken);
1377 if (!NT_SUCCESS(Status))
1378 {
1379 DPRINT1("ObCreateObject() failed (Status %lx)\n");
1380 return(Status);
1381 }
1382
1383 Status = ObInsertObject ((PVOID)AccessToken,
1384 NULL,
1385 DesiredAccess,
1386 0,
1387 NULL,
1388 &TokenHandle);
1389 if (!NT_SUCCESS(Status))
1390 {
1391 DPRINT1("ObInsertObject() failed (Status %lx)\n");
1392 ObDereferenceObject (AccessToken);
1393 return Status;
1394 }
1395
1396 RtlCopyLuid(&AccessToken->TokenSource.SourceIdentifier,
1397 &TokenSource->SourceIdentifier);
1398 memcpy(AccessToken->TokenSource.SourceName,
1399 TokenSource->SourceName,
1400 sizeof(TokenSource->SourceName));
1401
1402 RtlCopyLuid(&AccessToken->TokenId, &TokenId);
1403 RtlCopyLuid(&AccessToken->AuthenticationId, AuthenticationId);
1404 AccessToken->ExpirationTime = *ExpirationTime;
1405 RtlCopyLuid(&AccessToken->ModifiedId, &ModifiedId);
1406
1407 AccessToken->UserAndGroupCount = TokenGroups->GroupCount + 1;
1408 AccessToken->PrivilegeCount = TokenPrivileges->PrivilegeCount;
1409 AccessToken->UserAndGroups = 0;
1410 AccessToken->Privileges = 0;
1411
1412 AccessToken->TokenType = TokenType;
1413 AccessToken->ImpersonationLevel = ObjectAttributes->SecurityQualityOfService->ImpersonationLevel;
1414
1415 /*
1416 * Normally we would just point these members into the variable information
1417 * area; however, our ObCreateObject() call can't allocate a variable information
1418 * area, so we allocate them seperately and provide a destroy function.
1419 */
1420
1421 uLength = sizeof(SID_AND_ATTRIBUTES) * AccessToken->UserAndGroupCount;
1422 uLength += RtlLengthSid(TokenUser->User.Sid);
1423 for (i = 0; i < TokenGroups->GroupCount; i++)
1424 uLength += RtlLengthSid(TokenGroups->Groups[i].Sid);
1425
1426 AccessToken->UserAndGroups =
1427 (PSID_AND_ATTRIBUTES)ExAllocatePoolWithTag(NonPagedPool,
1428 uLength,
1429 TAG('T', 'O', 'K', 'u'));
1430
1431 EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount];
1432
1433 Status = RtlCopySidAndAttributesArray(1,
1434 &TokenUser->User,
1435 uLength,
1436 AccessToken->UserAndGroups,
1437 EndMem,
1438 &EndMem,
1439 &uLength);
1440 if (NT_SUCCESS(Status))
1441 {
1442 Status = RtlCopySidAndAttributesArray(TokenGroups->GroupCount,
1443 TokenGroups->Groups,
1444 uLength,
1445 &AccessToken->UserAndGroups[1],
1446 EndMem,
1447 &EndMem,
1448 &uLength);
1449 }
1450
1451 if (NT_SUCCESS(Status))
1452 {
1453 Status = SepFindPrimaryGroupAndDefaultOwner(
1454 AccessToken,
1455 TokenPrimaryGroup->PrimaryGroup,
1456 TokenOwner->Owner);
1457 }
1458
1459 if (NT_SUCCESS(Status))
1460 {
1461 uLength = TokenPrivileges->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
1462 AccessToken->Privileges =
1463 (PLUID_AND_ATTRIBUTES)ExAllocatePoolWithTag(NonPagedPool,
1464 uLength,
1465 TAG('T', 'O', 'K', 'p'));
1466
1467 for (i = 0; i < TokenPrivileges->PrivilegeCount; i++)
1468 {
1469 Status = MmCopyFromCaller(&AccessToken->Privileges[i],
1470 &TokenPrivileges->Privileges[i],
1471 sizeof(LUID_AND_ATTRIBUTES));
1472 if (!NT_SUCCESS(Status))
1473 break;
1474 }
1475 }
1476
1477 if (NT_SUCCESS(Status))
1478 {
1479 AccessToken->DefaultDacl =
1480 (PACL) ExAllocatePoolWithTag(NonPagedPool,
1481 TokenDefaultDacl->DefaultDacl->AclSize,
1482 TAG('T', 'O', 'K', 'd'));
1483 memcpy(AccessToken->DefaultDacl,
1484 TokenDefaultDacl->DefaultDacl,
1485 TokenDefaultDacl->DefaultDacl->AclSize);
1486 }
1487
1488 ObDereferenceObject(AccessToken);
1489
1490 if (NT_SUCCESS(Status))
1491 {
1492 Status = MmCopyToCaller(UnsafeTokenHandle,
1493 &TokenHandle,
1494 sizeof(HANDLE));
1495 }
1496
1497 if (!NT_SUCCESS(Status))
1498 {
1499 ZwClose(TokenHandle);
1500 return(Status);
1501 }
1502
1503 return(STATUS_SUCCESS);
1504 }
1505
1506
1507 /*
1508 * @implemented
1509 */
1510 NTSTATUS STDCALL
1511 SeQueryAuthenticationIdToken(IN PACCESS_TOKEN Token,
1512 OUT PLUID LogonId)
1513 {
1514 LogonId->LowPart = Token->AuthenticationId.LowPart;
1515 LogonId->HighPart = Token->AuthenticationId.HighPart;
1516
1517 return STATUS_SUCCESS;
1518 }
1519
1520
1521 /*
1522 * @implemented
1523 */
1524 SECURITY_IMPERSONATION_LEVEL STDCALL
1525 SeTokenImpersonationLevel(IN PACCESS_TOKEN Token)
1526 {
1527 return Token->ImpersonationLevel;
1528 }
1529
1530
1531 /*
1532 * @implemented
1533 */
1534 TOKEN_TYPE STDCALL
1535 SeTokenType(IN PACCESS_TOKEN Token)
1536 {
1537 return Token->TokenType;
1538 }
1539
1540
1541
1542 /* EOF */