[ADVAPI32_WINETEST]
[reactos.git] / rostests / winetests / advapi32 / security.c
1 /*
2 * Unit tests for security functions
3 *
4 * Copyright (c) 2004 Mike McCormack
5 * Copyright (c) 2011 Dmitry Timoshkov
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
20 */
21
22 #include <stdarg.h>
23 #include <stdio.h>
24
25 #include "ntstatus.h"
26 #define WIN32_NO_STATUS
27 #define WIN32_LEAN_AND_MEAN
28 #include "windef.h"
29 #include "winbase.h"
30 #include "winerror.h"
31 #include "aclapi.h"
32 #include "winnt.h"
33 #include "sddl.h"
34 #include "ntsecapi.h"
35 #include "lmcons.h"
36
37 #include <winsvc.h>
38
39 #include "wine/test.h"
40
41 #ifndef PROCESS_QUERY_LIMITED_INFORMATION
42 #define PROCESS_QUERY_LIMITED_INFORMATION 0x1000
43 #endif
44
45 /* PROCESS_ALL_ACCESS in Vista+ PSDKs is incompatible with older Windows versions */
46 #define PROCESS_ALL_ACCESS_NT4 (PROCESS_ALL_ACCESS & ~0xf000)
47 #define PROCESS_ALL_ACCESS_VISTA (PROCESS_ALL_ACCESS | 0xf000)
48
49 #ifndef EVENT_QUERY_STATE
50 #define EVENT_QUERY_STATE 0x0001
51 #endif
52
53 #ifndef SEMAPHORE_QUERY_STATE
54 #define SEMAPHORE_QUERY_STATE 0x0001
55 #endif
56
57 #ifndef THREAD_SET_LIMITED_INFORMATION
58 #define THREAD_SET_LIMITED_INFORMATION 0x0400
59 #define THREAD_QUERY_LIMITED_INFORMATION 0x0800
60 #endif
61
62 #define THREAD_ALL_ACCESS_NT4 (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3ff)
63 #define THREAD_ALL_ACCESS_VISTA (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff)
64
65 /* copied from Wine winternl.h - not included in the Windows SDK */
66 typedef enum _OBJECT_INFORMATION_CLASS {
67 ObjectBasicInformation,
68 ObjectNameInformation,
69 ObjectTypeInformation,
70 ObjectAllInformation,
71 ObjectDataInformation
72 } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
73
74 typedef struct _OBJECT_BASIC_INFORMATION {
75 ULONG Attributes;
76 ACCESS_MASK GrantedAccess;
77 ULONG HandleCount;
78 ULONG PointerCount;
79 ULONG PagedPoolUsage;
80 ULONG NonPagedPoolUsage;
81 ULONG Reserved[3];
82 ULONG NameInformationLength;
83 ULONG TypeInformationLength;
84 ULONG SecurityDescriptorLength;
85 LARGE_INTEGER CreateTime;
86 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
87
88 #define expect_eq(expr, value, type, format) { type ret_ = expr; ok((value) == ret_, #expr " expected " format " got " format "\n", (value), (ret_)); }
89
90 static BOOL (WINAPI *pAddAccessAllowedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
91 static BOOL (WINAPI *pAddAccessDeniedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
92 static BOOL (WINAPI *pAddAuditAccessAceEx)(PACL, DWORD, DWORD, DWORD, PSID, BOOL, BOOL);
93 static VOID (WINAPI *pBuildTrusteeWithSidA)( PTRUSTEEA pTrustee, PSID pSid );
94 static VOID (WINAPI *pBuildTrusteeWithNameA)( PTRUSTEEA pTrustee, LPSTR pName );
95 static VOID (WINAPI *pBuildTrusteeWithObjectsAndNameA)( PTRUSTEEA pTrustee,
96 POBJECTS_AND_NAME_A pObjName,
97 SE_OBJECT_TYPE ObjectType,
98 LPSTR ObjectTypeName,
99 LPSTR InheritedObjectTypeName,
100 LPSTR Name );
101 static VOID (WINAPI *pBuildTrusteeWithObjectsAndSidA)( PTRUSTEEA pTrustee,
102 POBJECTS_AND_SID pObjSid,
103 GUID* pObjectGuid,
104 GUID* pInheritedObjectGuid,
105 PSID pSid );
106 static LPSTR (WINAPI *pGetTrusteeNameA)( PTRUSTEEA pTrustee );
107 static BOOL (WINAPI *pMakeSelfRelativeSD)( PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR, LPDWORD );
108 static BOOL (WINAPI *pConvertSidToStringSidA)( PSID pSid, LPSTR *str );
109 static BOOL (WINAPI *pConvertStringSidToSidA)( LPCSTR str, PSID pSid );
110 static BOOL (WINAPI *pCheckTokenMembership)(HANDLE, PSID, PBOOL);
111 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorA)(LPCSTR, DWORD,
112 PSECURITY_DESCRIPTOR*, PULONG );
113 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorW)(LPCWSTR, DWORD,
114 PSECURITY_DESCRIPTOR*, PULONG );
115 static BOOL (WINAPI *pConvertSecurityDescriptorToStringSecurityDescriptorA)(PSECURITY_DESCRIPTOR, DWORD,
116 SECURITY_INFORMATION, LPSTR *, PULONG );
117 static BOOL (WINAPI *pGetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
118 PSECURITY_DESCRIPTOR, DWORD, LPDWORD);
119 static BOOL (WINAPI *pSetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
120 PSECURITY_DESCRIPTOR);
121 static DWORD (WINAPI *pGetNamedSecurityInfoA)(LPSTR, SE_OBJECT_TYPE, SECURITY_INFORMATION,
122 PSID*, PSID*, PACL*, PACL*,
123 PSECURITY_DESCRIPTOR*);
124 static DWORD (WINAPI *pSetNamedSecurityInfoA)(LPSTR, SE_OBJECT_TYPE, SECURITY_INFORMATION,
125 PSID, PSID, PACL, PACL);
126 static PDWORD (WINAPI *pGetSidSubAuthority)(PSID, DWORD);
127 static PUCHAR (WINAPI *pGetSidSubAuthorityCount)(PSID);
128 static BOOL (WINAPI *pIsValidSid)(PSID);
129 static DWORD (WINAPI *pRtlAdjustPrivilege)(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
130 static BOOL (WINAPI *pCreateWellKnownSid)(WELL_KNOWN_SID_TYPE,PSID,PSID,DWORD*);
131 static BOOL (WINAPI *pDuplicateTokenEx)(HANDLE,DWORD,LPSECURITY_ATTRIBUTES,
132 SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
133
134 static NTSTATUS (WINAPI *pLsaQueryInformationPolicy)(LSA_HANDLE,POLICY_INFORMATION_CLASS,PVOID*);
135 static NTSTATUS (WINAPI *pLsaClose)(LSA_HANDLE);
136 static NTSTATUS (WINAPI *pLsaFreeMemory)(PVOID);
137 static NTSTATUS (WINAPI *pLsaOpenPolicy)(PLSA_UNICODE_STRING,PLSA_OBJECT_ATTRIBUTES,ACCESS_MASK,PLSA_HANDLE);
138 static NTSTATUS (WINAPI *pNtQueryObject)(HANDLE,OBJECT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
139 static DWORD (WINAPI *pSetEntriesInAclW)(ULONG, PEXPLICIT_ACCESSW, PACL, PACL*);
140 static DWORD (WINAPI *pSetEntriesInAclA)(ULONG, PEXPLICIT_ACCESSA, PACL, PACL*);
141 static BOOL (WINAPI *pSetSecurityDescriptorControl)(PSECURITY_DESCRIPTOR, SECURITY_DESCRIPTOR_CONTROL,
142 SECURITY_DESCRIPTOR_CONTROL);
143 static DWORD (WINAPI *pGetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION,
144 PSID*, PSID*, PACL*, PACL*, PSECURITY_DESCRIPTOR*);
145 static DWORD (WINAPI *pSetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION,
146 PSID, PSID, PACL, PACL);
147 static NTSTATUS (WINAPI *pNtAccessCheck)(PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK, PGENERIC_MAPPING,
148 PPRIVILEGE_SET, PULONG, PULONG, NTSTATUS*);
149 static BOOL (WINAPI *pCreateRestrictedToken)(HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD,
150 PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE);
151 static BOOL (WINAPI *pGetAclInformation)(PACL,LPVOID,DWORD,ACL_INFORMATION_CLASS);
152 static BOOL (WINAPI *pGetAce)(PACL,DWORD,LPVOID*);
153
154 static HMODULE hmod;
155 static int myARGC;
156 static char** myARGV;
157
158 struct strsid_entry
159 {
160 const char *str;
161 DWORD flags;
162 };
163 #define STRSID_OK 0
164 #define STRSID_OPT 1
165
166 struct sidRef
167 {
168 SID_IDENTIFIER_AUTHORITY auth;
169 const char *refStr;
170 };
171
172 static void init(void)
173 {
174 HMODULE hntdll;
175
176 hntdll = GetModuleHandleA("ntdll.dll");
177 pNtQueryObject = (void *)GetProcAddress( hntdll, "NtQueryObject" );
178 pNtAccessCheck = (void *)GetProcAddress( hntdll, "NtAccessCheck" );
179
180 hmod = GetModuleHandleA("advapi32.dll");
181 pAddAccessAllowedAceEx = (void *)GetProcAddress(hmod, "AddAccessAllowedAceEx");
182 pAddAccessDeniedAceEx = (void *)GetProcAddress(hmod, "AddAccessDeniedAceEx");
183 pAddAuditAccessAceEx = (void *)GetProcAddress(hmod, "AddAuditAccessAceEx");
184 pCheckTokenMembership = (void *)GetProcAddress(hmod, "CheckTokenMembership");
185 pConvertStringSecurityDescriptorToSecurityDescriptorA =
186 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
187 pConvertStringSecurityDescriptorToSecurityDescriptorW =
188 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorW" );
189 pConvertSecurityDescriptorToStringSecurityDescriptorA =
190 (void *)GetProcAddress(hmod, "ConvertSecurityDescriptorToStringSecurityDescriptorA" );
191 pGetFileSecurityA = (void *)GetProcAddress(hmod, "GetFileSecurityA" );
192 pSetFileSecurityA = (void *)GetProcAddress(hmod, "SetFileSecurityA" );
193 pCreateWellKnownSid = (void *)GetProcAddress( hmod, "CreateWellKnownSid" );
194 pGetNamedSecurityInfoA = (void *)GetProcAddress(hmod, "GetNamedSecurityInfoA");
195 pSetNamedSecurityInfoA = (void *)GetProcAddress(hmod, "SetNamedSecurityInfoA");
196 pGetSidSubAuthority = (void *)GetProcAddress(hmod, "GetSidSubAuthority");
197 pGetSidSubAuthorityCount = (void *)GetProcAddress(hmod, "GetSidSubAuthorityCount");
198 pIsValidSid = (void *)GetProcAddress(hmod, "IsValidSid");
199 pMakeSelfRelativeSD = (void *)GetProcAddress(hmod, "MakeSelfRelativeSD");
200 pSetEntriesInAclW = (void *)GetProcAddress(hmod, "SetEntriesInAclW");
201 pSetEntriesInAclA = (void *)GetProcAddress(hmod, "SetEntriesInAclA");
202 pSetSecurityDescriptorControl = (void *)GetProcAddress(hmod, "SetSecurityDescriptorControl");
203 pGetSecurityInfo = (void *)GetProcAddress(hmod, "GetSecurityInfo");
204 pSetSecurityInfo = (void *)GetProcAddress(hmod, "SetSecurityInfo");
205 pCreateRestrictedToken = (void *)GetProcAddress(hmod, "CreateRestrictedToken");
206 pConvertSidToStringSidA = (void *)GetProcAddress(hmod, "ConvertSidToStringSidA");
207 pConvertStringSidToSidA = (void *)GetProcAddress(hmod, "ConvertStringSidToSidA");
208 pGetAclInformation = (void *)GetProcAddress(hmod, "GetAclInformation");
209 pGetAce = (void *)GetProcAddress(hmod, "GetAce");
210
211 myARGC = winetest_get_mainargs( &myARGV );
212 }
213
214 static SECURITY_DESCRIPTOR* test_get_security_descriptor(HANDLE handle, int line)
215 {
216 /* use HeapFree(GetProcessHeap(), 0, sd); when done */
217 DWORD ret, length, needed;
218 SECURITY_DESCRIPTOR *sd;
219
220 needed = 0xdeadbeef;
221 SetLastError(0xdeadbeef);
222 ret = GetKernelObjectSecurity(handle, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
223 NULL, 0, &needed);
224 ok_(__FILE__, line)(!ret, "GetKernelObjectSecurity should fail\n");
225 ok_(__FILE__, line)(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
226 ok_(__FILE__, line)(needed != 0xdeadbeef, "GetKernelObjectSecurity should return required buffer length\n");
227
228 length = needed;
229 sd = HeapAlloc(GetProcessHeap(), 0, length);
230
231 needed = 0xdeadbeef;
232 SetLastError(0xdeadbeef);
233 ret = GetKernelObjectSecurity(handle, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
234 sd, length, &needed);
235 ok_(__FILE__, line)(ret, "GetKernelObjectSecurity error %d\n", GetLastError());
236 ok_(__FILE__, line)(needed == length || needed == 0 /* file, pipe */, "GetKernelObjectSecurity should return %u instead of %u\n", length, needed);
237 return sd;
238 }
239
240 static void test_owner_equal(HANDLE Handle, PSID expected, int line)
241 {
242 BOOL res;
243 SECURITY_DESCRIPTOR *queriedSD = NULL;
244 PSID owner;
245 BOOL owner_defaulted;
246
247 queriedSD = test_get_security_descriptor( Handle, line );
248
249 res = GetSecurityDescriptorOwner(queriedSD, &owner, &owner_defaulted);
250 ok_(__FILE__, line)(res, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
251
252 ok_(__FILE__, line)(EqualSid(owner, expected), "Owner SIDs are not equal\n");
253 ok_(__FILE__, line)(!owner_defaulted, "Defaulted is true\n");
254
255 HeapFree(GetProcessHeap(), 0, queriedSD);
256 }
257
258 static void test_group_equal(HANDLE Handle, PSID expected, int line)
259 {
260 BOOL res;
261 SECURITY_DESCRIPTOR *queriedSD = NULL;
262 PSID group;
263 BOOL group_defaulted;
264
265 queriedSD = test_get_security_descriptor( Handle, line );
266
267 res = GetSecurityDescriptorGroup(queriedSD, &group, &group_defaulted);
268 ok_(__FILE__, line)(res, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
269
270 ok_(__FILE__, line)(EqualSid(group, expected), "Group SIDs are not equal\n");
271 ok_(__FILE__, line)(!group_defaulted, "Defaulted is true\n");
272
273 HeapFree(GetProcessHeap(), 0, queriedSD);
274 }
275
276 static void test_sid(void)
277 {
278 struct sidRef refs[] = {
279 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
280 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
281 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
282 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
283 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
284 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
285 };
286 struct strsid_entry strsid_table[] = {
287 {"AO", STRSID_OK}, {"RU", STRSID_OK}, {"AN", STRSID_OK}, {"AU", STRSID_OK},
288 {"BA", STRSID_OK}, {"BG", STRSID_OK}, {"BO", STRSID_OK}, {"BU", STRSID_OK},
289 {"CA", STRSID_OPT}, {"CG", STRSID_OK}, {"CO", STRSID_OK}, {"DA", STRSID_OPT},
290 {"DC", STRSID_OPT}, {"DD", STRSID_OPT}, {"DG", STRSID_OPT}, {"DU", STRSID_OPT},
291 {"EA", STRSID_OPT}, {"ED", STRSID_OK}, {"WD", STRSID_OK}, {"PA", STRSID_OPT},
292 {"IU", STRSID_OK}, {"LA", STRSID_OK}, {"LG", STRSID_OK}, {"LS", STRSID_OK},
293 {"SY", STRSID_OK}, {"NU", STRSID_OK}, {"NO", STRSID_OK}, {"NS", STRSID_OK},
294 {"PO", STRSID_OK}, {"PS", STRSID_OK}, {"PU", STRSID_OK}, {"RS", STRSID_OPT},
295 {"RD", STRSID_OK}, {"RE", STRSID_OK}, {"RC", STRSID_OK}, {"SA", STRSID_OPT},
296 {"SO", STRSID_OK}, {"SU", STRSID_OK}};
297
298 const char noSubAuthStr[] = "S-1-5";
299 unsigned int i;
300 PSID psid = NULL;
301 SID *pisid;
302 BOOL r;
303 LPSTR str = NULL;
304
305 if( !pConvertSidToStringSidA || !pConvertStringSidToSidA )
306 {
307 win_skip("ConvertSidToStringSidA or ConvertStringSidToSidA not available\n");
308 return;
309 }
310
311 r = pConvertStringSidToSidA( NULL, NULL );
312 ok( !r, "expected failure with NULL parameters\n" );
313 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED )
314 return;
315 ok( GetLastError() == ERROR_INVALID_PARAMETER,
316 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
317 GetLastError() );
318
319 r = pConvertStringSidToSidA( refs[0].refStr, NULL );
320 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
321 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
322 GetLastError() );
323
324 r = pConvertStringSidToSidA( NULL, &str );
325 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
326 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
327 GetLastError() );
328
329 r = pConvertStringSidToSidA( noSubAuthStr, &psid );
330 ok( !r,
331 "expected failure with no sub authorities\n" );
332 ok( GetLastError() == ERROR_INVALID_SID,
333 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
334 GetLastError() );
335
336 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid), "ConvertStringSidToSidA failed\n");
337 pisid = psid;
338 ok(pisid->SubAuthorityCount == 4, "Invalid sub authority count - expected 4, got %d\n", pisid->SubAuthorityCount);
339 ok(pisid->SubAuthority[0] == 21, "Invalid subauthority 0 - expected 21, got %d\n", pisid->SubAuthority[0]);
340 ok(pisid->SubAuthority[3] == 4576, "Invalid subauthority 0 - expected 4576, got %d\n", pisid->SubAuthority[3]);
341 LocalFree(str);
342 LocalFree(psid);
343
344 for( i = 0; i < sizeof(refs) / sizeof(refs[0]); i++ )
345 {
346 r = AllocateAndInitializeSid( &refs[i].auth, 1,1,0,0,0,0,0,0,0,
347 &psid );
348 ok( r, "failed to allocate sid\n" );
349 r = pConvertSidToStringSidA( psid, &str );
350 ok( r, "failed to convert sid\n" );
351 if (r)
352 {
353 ok( !strcmp( str, refs[i].refStr ),
354 "incorrect sid, expected %s, got %s\n", refs[i].refStr, str );
355 LocalFree( str );
356 }
357 if( psid )
358 FreeSid( psid );
359
360 r = pConvertStringSidToSidA( refs[i].refStr, &psid );
361 ok( r, "failed to parse sid string\n" );
362 pisid = psid;
363 ok( pisid &&
364 !memcmp( pisid->IdentifierAuthority.Value, refs[i].auth.Value,
365 sizeof(refs[i].auth) ),
366 "string sid %s didn't parse to expected value\n"
367 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
368 refs[i].refStr,
369 MAKEWORD( pisid->IdentifierAuthority.Value[1],
370 pisid->IdentifierAuthority.Value[0] ),
371 MAKELONG( MAKEWORD( pisid->IdentifierAuthority.Value[5],
372 pisid->IdentifierAuthority.Value[4] ),
373 MAKEWORD( pisid->IdentifierAuthority.Value[3],
374 pisid->IdentifierAuthority.Value[2] ) ),
375 MAKEWORD( refs[i].auth.Value[1], refs[i].auth.Value[0] ),
376 MAKELONG( MAKEWORD( refs[i].auth.Value[5], refs[i].auth.Value[4] ),
377 MAKEWORD( refs[i].auth.Value[3], refs[i].auth.Value[2] ) ) );
378 if( psid )
379 LocalFree( psid );
380 }
381
382 /* string constant format not supported before XP */
383 r = pConvertStringSidToSidA(strsid_table[0].str, &psid);
384 if(!r)
385 {
386 win_skip("String constant format not supported\n");
387 return;
388 }
389 LocalFree(psid);
390
391 for(i = 0; i < sizeof(strsid_table) / sizeof(strsid_table[0]); i++)
392 {
393 char *temp;
394
395 SetLastError(0xdeadbeef);
396 r = pConvertStringSidToSidA(strsid_table[i].str, &psid);
397
398 if (!(strsid_table[i].flags & STRSID_OPT))
399 {
400 ok(r, "%s: got %u\n", strsid_table[i].str, GetLastError());
401 }
402
403 if (r)
404 {
405 if ((winetest_debug > 1) && (pConvertSidToStringSidA(psid, &temp)))
406 {
407 trace(" %s: %s\n", strsid_table[i].str, temp);
408 LocalFree(temp);
409 }
410 LocalFree(psid);
411 }
412 else
413 {
414 if (GetLastError() != ERROR_INVALID_SID)
415 trace(" %s: couldn't be converted, returned %d\n", strsid_table[i].str, GetLastError());
416 else
417 trace(" %s: couldn't be converted\n", strsid_table[i].str);
418 }
419 }
420 }
421
422 static void test_trustee(void)
423 {
424 GUID ObjectType = {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
425 GUID InheritedObjectType = {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
426 GUID ZeroGuid;
427 OBJECTS_AND_NAME_A oan;
428 OBJECTS_AND_SID oas;
429 TRUSTEEA trustee;
430 PSID psid;
431 char szObjectTypeName[] = "ObjectTypeName";
432 char szInheritedObjectTypeName[] = "InheritedObjectTypeName";
433 char szTrusteeName[] = "szTrusteeName";
434 SID_IDENTIFIER_AUTHORITY auth = { {0x11,0x22,0,0,0, 0} };
435
436 memset( &ZeroGuid, 0x00, sizeof (ZeroGuid) );
437
438 pBuildTrusteeWithSidA = (void *)GetProcAddress( hmod, "BuildTrusteeWithSidA" );
439 pBuildTrusteeWithNameA = (void *)GetProcAddress( hmod, "BuildTrusteeWithNameA" );
440 pBuildTrusteeWithObjectsAndNameA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndNameA" );
441 pBuildTrusteeWithObjectsAndSidA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndSidA" );
442 pGetTrusteeNameA = (void *)GetProcAddress (hmod, "GetTrusteeNameA" );
443 if( !pBuildTrusteeWithSidA || !pBuildTrusteeWithNameA ||
444 !pBuildTrusteeWithObjectsAndNameA || !pBuildTrusteeWithObjectsAndSidA ||
445 !pGetTrusteeNameA )
446 return;
447
448 if ( ! AllocateAndInitializeSid( &auth, 1, 42, 0,0,0,0,0,0,0,&psid ) )
449 {
450 trace( "failed to init SID\n" );
451 return;
452 }
453
454 /* test BuildTrusteeWithSidA */
455 memset( &trustee, 0xff, sizeof trustee );
456 pBuildTrusteeWithSidA( &trustee, psid );
457
458 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
459 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
460 "MultipleTrusteeOperation wrong\n");
461 ok( trustee.TrusteeForm == TRUSTEE_IS_SID, "TrusteeForm wrong\n");
462 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
463 ok( trustee.ptstrName == psid, "ptstrName wrong\n" );
464
465 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
466 memset( &trustee, 0xff, sizeof trustee );
467 memset( &oas, 0xff, sizeof(oas) );
468 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, &ObjectType,
469 &InheritedObjectType, psid);
470
471 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
472 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
473 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
474 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
475 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
476
477 ok(oas.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
478 ok(!memcmp(&oas.ObjectTypeGuid, &ObjectType, sizeof(GUID)), "ObjectTypeGuid wrong\n");
479 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
480 ok(oas.pSid == psid, "pSid wrong\n");
481
482 /* test GetTrusteeNameA */
483 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oas, "GetTrusteeName returned wrong value\n");
484
485 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
486 memset( &trustee, 0xff, sizeof trustee );
487 memset( &oas, 0xff, sizeof(oas) );
488 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, NULL,
489 &InheritedObjectType, psid);
490
491 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
492 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
493 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
494 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
495 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
496
497 ok(oas.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
498 ok(!memcmp(&oas.ObjectTypeGuid, &ZeroGuid, sizeof(GUID)), "ObjectTypeGuid wrong\n");
499 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
500 ok(oas.pSid == psid, "pSid wrong\n");
501
502 FreeSid( psid );
503
504 /* test BuildTrusteeWithNameA */
505 memset( &trustee, 0xff, sizeof trustee );
506 pBuildTrusteeWithNameA( &trustee, szTrusteeName );
507
508 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
509 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
510 "MultipleTrusteeOperation wrong\n");
511 ok( trustee.TrusteeForm == TRUSTEE_IS_NAME, "TrusteeForm wrong\n");
512 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
513 ok( trustee.ptstrName == szTrusteeName, "ptstrName wrong\n" );
514
515 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
516 memset( &trustee, 0xff, sizeof trustee );
517 memset( &oan, 0xff, sizeof(oan) );
518 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
519 szInheritedObjectTypeName, szTrusteeName);
520
521 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
522 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
523 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
524 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
525 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
526
527 ok(oan.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
528 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
529 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
530 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
531
532 /* test GetTrusteeNameA */
533 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oan, "GetTrusteeName returned wrong value\n");
534
535 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
536 memset( &trustee, 0xff, sizeof trustee );
537 memset( &oan, 0xff, sizeof(oan) );
538 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, NULL,
539 szInheritedObjectTypeName, szTrusteeName);
540
541 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
542 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
543 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
544 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
545 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
546
547 ok(oan.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
548 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
549 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
550 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
551
552 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
553 memset( &trustee, 0xff, sizeof trustee );
554 memset( &oan, 0xff, sizeof(oan) );
555 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
556 NULL, szTrusteeName);
557
558 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
559 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
560 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
561 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
562 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
563
564 ok(oan.ObjectsPresent == ACE_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
565 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
566 ok(oan.InheritedObjectTypeName == NULL, "InheritedObjectTypeName wrong\n");
567 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
568 }
569
570 /* If the first isn't defined, assume none is */
571 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
572 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
573 #define SE_CREATE_TOKEN_PRIVILEGE 2L
574 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
575 #define SE_LOCK_MEMORY_PRIVILEGE 4L
576 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
577 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
578 #define SE_TCB_PRIVILEGE 7L
579 #define SE_SECURITY_PRIVILEGE 8L
580 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
581 #define SE_LOAD_DRIVER_PRIVILEGE 10L
582 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
583 #define SE_SYSTEMTIME_PRIVILEGE 12L
584 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
585 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
586 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
587 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
588 #define SE_BACKUP_PRIVILEGE 17L
589 #define SE_RESTORE_PRIVILEGE 18L
590 #define SE_SHUTDOWN_PRIVILEGE 19L
591 #define SE_DEBUG_PRIVILEGE 20L
592 #define SE_AUDIT_PRIVILEGE 21L
593 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
594 #define SE_CHANGE_NOTIFY_PRIVILEGE 23L
595 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
596 #define SE_UNDOCK_PRIVILEGE 25L
597 #define SE_SYNC_AGENT_PRIVILEGE 26L
598 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
599 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
600 #define SE_IMPERSONATE_PRIVILEGE 29L
601 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
602 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
603 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
604
605 static void test_allocateLuid(void)
606 {
607 BOOL (WINAPI *pAllocateLocallyUniqueId)(PLUID);
608 LUID luid1, luid2;
609 BOOL ret;
610
611 pAllocateLocallyUniqueId = (void*)GetProcAddress(hmod, "AllocateLocallyUniqueId");
612 if (!pAllocateLocallyUniqueId) return;
613
614 ret = pAllocateLocallyUniqueId(&luid1);
615 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
616 return;
617
618 ok(ret,
619 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
620 ret = pAllocateLocallyUniqueId(&luid2);
621 ok( ret,
622 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
623 ok(luid1.LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE || luid1.HighPart != 0,
624 "AllocateLocallyUniqueId returned a well-known LUID\n");
625 ok(luid1.LowPart != luid2.LowPart || luid1.HighPart != luid2.HighPart,
626 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
627 ret = pAllocateLocallyUniqueId(NULL);
628 ok( !ret && GetLastError() == ERROR_NOACCESS,
629 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
630 GetLastError());
631 }
632
633 static void test_lookupPrivilegeName(void)
634 {
635 BOOL (WINAPI *pLookupPrivilegeNameA)(LPCSTR, PLUID, LPSTR, LPDWORD);
636 char buf[MAX_PATH]; /* arbitrary, seems long enough */
637 DWORD cchName = sizeof(buf);
638 LUID luid = { 0, 0 };
639 LONG i;
640 BOOL ret;
641
642 /* check whether it's available first */
643 pLookupPrivilegeNameA = (void*)GetProcAddress(hmod, "LookupPrivilegeNameA");
644 if (!pLookupPrivilegeNameA) return;
645 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
646 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
647 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
648 return;
649
650 /* check with a short buffer */
651 cchName = 0;
652 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
653 ret = pLookupPrivilegeNameA(NULL, &luid, NULL, &cchName);
654 ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
655 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
656 GetLastError());
657 ok(cchName == strlen("SeCreateTokenPrivilege") + 1,
658 "LookupPrivilegeNameA returned an incorrect required length for\n"
659 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
660 lstrlenA("SeCreateTokenPrivilege") + 1);
661 /* check a known value and its returned length on success */
662 cchName = sizeof(buf);
663 ok(pLookupPrivilegeNameA(NULL, &luid, buf, &cchName) &&
664 cchName == strlen("SeCreateTokenPrivilege"),
665 "LookupPrivilegeNameA returned an incorrect output length for\n"
666 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
667 (int)strlen("SeCreateTokenPrivilege"));
668 /* check known values */
669 for (i = SE_MIN_WELL_KNOWN_PRIVILEGE; i <= SE_MAX_WELL_KNOWN_PRIVILEGE; i++)
670 {
671 luid.LowPart = i;
672 cchName = sizeof(buf);
673 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
674 ok( ret || GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
675 "LookupPrivilegeNameA(0.%d) failed: %d\n", i, GetLastError());
676 }
677 /* check a bogus LUID */
678 luid.LowPart = 0xdeadbeef;
679 cchName = sizeof(buf);
680 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
681 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
682 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
683 GetLastError());
684 /* check on a bogus system */
685 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
686 cchName = sizeof(buf);
687 ret = pLookupPrivilegeNameA("b0gu5.Nam3", &luid, buf, &cchName);
688 ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
689 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
690 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
691 GetLastError());
692 }
693
694 struct NameToLUID
695 {
696 const char *name;
697 DWORD lowPart;
698 };
699
700 static void test_lookupPrivilegeValue(void)
701 {
702 static const struct NameToLUID privs[] = {
703 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE },
704 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE },
705 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE },
706 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE },
707 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE },
708 { "SeTcbPrivilege", SE_TCB_PRIVILEGE },
709 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE },
710 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE },
711 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE },
712 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE },
713 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE },
714 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE },
715 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE },
716 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE },
717 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE },
718 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE },
719 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE },
720 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE },
721 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE },
722 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE },
723 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE },
724 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILEGE },
725 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE },
726 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE },
727 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE },
728 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE },
729 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE },
730 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE },
731 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE },
732 };
733 BOOL (WINAPI *pLookupPrivilegeValueA)(LPCSTR, LPCSTR, PLUID);
734 unsigned int i;
735 LUID luid;
736 BOOL ret;
737
738 /* check whether it's available first */
739 pLookupPrivilegeValueA = (void*)GetProcAddress(hmod, "LookupPrivilegeValueA");
740 if (!pLookupPrivilegeValueA) return;
741 ret = pLookupPrivilegeValueA(NULL, "SeCreateTokenPrivilege", &luid);
742 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
743 return;
744
745 /* check a bogus system name */
746 ret = pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid);
747 ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
748 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
749 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
750 GetLastError());
751 /* check a NULL string */
752 ret = pLookupPrivilegeValueA(NULL, 0, &luid);
753 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
754 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
755 GetLastError());
756 /* check a bogus privilege name */
757 ret = pLookupPrivilegeValueA(NULL, "SeBogusPrivilege", &luid);
758 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
759 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
760 GetLastError());
761 /* check case insensitive */
762 ret = pLookupPrivilegeValueA(NULL, "sEcREATEtOKENpRIVILEGE", &luid);
763 ok( ret,
764 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
765 GetLastError());
766 for (i = 0; i < sizeof(privs) / sizeof(privs[0]); i++)
767 {
768 /* Not all privileges are implemented on all Windows versions, so
769 * don't worry if the call fails
770 */
771 if (pLookupPrivilegeValueA(NULL, privs[i].name, &luid))
772 {
773 ok(luid.LowPart == privs[i].lowPart,
774 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
775 privs[i].name);
776 }
777 }
778 }
779
780 static void test_luid(void)
781 {
782 test_allocateLuid();
783 test_lookupPrivilegeName();
784 test_lookupPrivilegeValue();
785 }
786
787 static void test_FileSecurity(void)
788 {
789 char wintmpdir [MAX_PATH];
790 char path [MAX_PATH];
791 char file [MAX_PATH];
792 HANDLE fh, token;
793 DWORD sdSize, retSize, rc, granted, priv_set_len;
794 PRIVILEGE_SET priv_set;
795 BOOL status;
796 BYTE *sd;
797 GENERIC_MAPPING mapping = { FILE_READ_DATA, FILE_WRITE_DATA, FILE_EXECUTE, FILE_ALL_ACCESS };
798 const SECURITY_INFORMATION request = OWNER_SECURITY_INFORMATION
799 | GROUP_SECURITY_INFORMATION
800 | DACL_SECURITY_INFORMATION;
801
802 if (!pGetFileSecurityA) {
803 win_skip ("GetFileSecurity is not available\n");
804 return;
805 }
806
807 if (!pSetFileSecurityA) {
808 win_skip ("SetFileSecurity is not available\n");
809 return;
810 }
811
812 if (!GetTempPathA (sizeof (wintmpdir), wintmpdir)) {
813 win_skip ("GetTempPathA failed\n");
814 return;
815 }
816
817 /* Create a temporary directory and in it a temporary file */
818 strcat (strcpy (path, wintmpdir), "rary");
819 SetLastError(0xdeadbeef);
820 rc = CreateDirectoryA (path, NULL);
821 ok (rc || GetLastError() == ERROR_ALREADY_EXISTS, "CreateDirectoryA "
822 "failed for '%s' with %d\n", path, GetLastError());
823
824 strcat (strcpy (file, path), "\\ess");
825 SetLastError(0xdeadbeef);
826 fh = CreateFileA (file, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
827 ok (fh != INVALID_HANDLE_VALUE, "CreateFileA "
828 "failed for '%s' with %d\n", file, GetLastError());
829 CloseHandle (fh);
830
831 /* For the temporary file ... */
832
833 /* Get size needed */
834 retSize = 0;
835 SetLastError(0xdeadbeef);
836 rc = pGetFileSecurityA (file, request, NULL, 0, &retSize);
837 if (!rc && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)) {
838 win_skip("GetFileSecurityA is not implemented\n");
839 goto cleanup;
840 }
841 ok (!rc, "GetFileSecurityA "
842 "was expected to fail for '%s'\n", file);
843 ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
844 "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
845 ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
846
847 sdSize = retSize;
848 sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
849
850 /* Get security descriptor for real */
851 retSize = -1;
852 SetLastError(0xdeadbeef);
853 rc = pGetFileSecurityA (file, request, sd, sdSize, &retSize);
854 ok (rc, "GetFileSecurityA "
855 "was not expected to fail '%s': %d\n", file, GetLastError());
856 ok (retSize == sdSize ||
857 broken(retSize == 0), /* NT4 */
858 "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
859
860 /* Use it to set security descriptor */
861 SetLastError(0xdeadbeef);
862 rc = pSetFileSecurityA (file, request, sd);
863 ok (rc, "SetFileSecurityA "
864 "was not expected to fail '%s': %d\n", file, GetLastError());
865
866 HeapFree (GetProcessHeap (), 0, sd);
867
868 /* Repeat for the temporary directory ... */
869
870 /* Get size needed */
871 retSize = 0;
872 SetLastError(0xdeadbeef);
873 rc = pGetFileSecurityA (path, request, NULL, 0, &retSize);
874 ok (!rc, "GetFileSecurityA "
875 "was expected to fail for '%s'\n", path);
876 ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
877 "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
878 ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
879
880 sdSize = retSize;
881 sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
882
883 /* Get security descriptor for real */
884 retSize = -1;
885 SetLastError(0xdeadbeef);
886 rc = pGetFileSecurityA (path, request, sd, sdSize, &retSize);
887 ok (rc, "GetFileSecurityA "
888 "was not expected to fail '%s': %d\n", path, GetLastError());
889 ok (retSize == sdSize ||
890 broken(retSize == 0), /* NT4 */
891 "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
892
893 /* Use it to set security descriptor */
894 SetLastError(0xdeadbeef);
895 rc = pSetFileSecurityA (path, request, sd);
896 ok (rc, "SetFileSecurityA "
897 "was not expected to fail '%s': %d\n", path, GetLastError());
898 HeapFree (GetProcessHeap (), 0, sd);
899
900 /* Old test */
901 strcpy (wintmpdir, "\\Should not exist");
902 SetLastError(0xdeadbeef);
903 rc = pGetFileSecurityA (wintmpdir, OWNER_SECURITY_INFORMATION, NULL, 0, &sdSize);
904 ok (!rc, "GetFileSecurityA should fail for not existing directories/files\n");
905 ok (GetLastError() == ERROR_FILE_NOT_FOUND,
906 "last error ERROR_FILE_NOT_FOUND expected, got %d\n", GetLastError());
907
908 cleanup:
909 /* Remove temporary file and directory */
910 DeleteFileA(file);
911 RemoveDirectoryA(path);
912
913 /* Test file access permissions for a file with FILE_ATTRIBUTE_ARCHIVE */
914 SetLastError(0xdeadbeef);
915 rc = GetTempPathA(sizeof(wintmpdir), wintmpdir);
916 ok(rc, "GetTempPath error %d\n", GetLastError());
917
918 SetLastError(0xdeadbeef);
919 rc = GetTempFileNameA(wintmpdir, "tmp", 0, file);
920 ok(rc, "GetTempFileName error %d\n", GetLastError());
921
922 rc = GetFileAttributesA(file);
923 rc &= ~(FILE_ATTRIBUTE_NOT_CONTENT_INDEXED|FILE_ATTRIBUTE_COMPRESSED);
924 ok(rc == FILE_ATTRIBUTE_ARCHIVE, "expected FILE_ATTRIBUTE_ARCHIVE got %#x\n", rc);
925
926 retSize = 0xdeadbeef;
927 rc = GetFileSecurityA(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
928 NULL, 0, &sdSize);
929 ok(!rc, "GetFileSecurity should fail\n");
930 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
931 "expected ERROR_INSUFFICIENT_BUFFER got %d\n", GetLastError());
932 ok(sdSize > sizeof(SECURITY_DESCRIPTOR), "got sd size %d\n", sdSize);
933
934 sd = HeapAlloc(GetProcessHeap (), 0, sdSize);
935 retSize = 0xdeadbeef;
936 SetLastError(0xdeadbeef);
937 rc = GetFileSecurityA(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
938 sd, sdSize, &retSize);
939 ok(rc, "GetFileSecurity error %d\n", GetLastError());
940 ok(retSize == sdSize || broken(retSize == 0) /* NT4 */, "expected %d, got %d\n", sdSize, retSize);
941
942 SetLastError(0xdeadbeef);
943 rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
944 ok(!rc, "OpenThreadToken should fail\n");
945 ok(GetLastError() == ERROR_NO_TOKEN, "expected ERROR_NO_TOKEN, got %d\n", GetLastError());
946
947 SetLastError(0xdeadbeef);
948 rc = ImpersonateSelf(SecurityIdentification);
949 ok(rc, "ImpersonateSelf error %d\n", GetLastError());
950
951 SetLastError(0xdeadbeef);
952 rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
953 ok(rc, "OpenThreadToken error %d\n", GetLastError());
954
955 SetLastError(0xdeadbeef);
956 rc = RevertToSelf();
957 ok(rc, "RevertToSelf error %d\n", GetLastError());
958
959 priv_set_len = sizeof(priv_set);
960 granted = 0xdeadbeef;
961 status = 0xdeadbeef;
962 SetLastError(0xdeadbeef);
963 rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
964 ok(rc, "AccessCheck error %d\n", GetLastError());
965 ok(status == 1, "expected 1, got %d\n", status);
966 ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
967
968 granted = 0xdeadbeef;
969 status = 0xdeadbeef;
970 SetLastError(0xdeadbeef);
971 rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
972 ok(rc, "AccessCheck error %d\n", GetLastError());
973 ok(status == 1, "expected 1, got %d\n", status);
974 ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
975
976 granted = 0xdeadbeef;
977 status = 0xdeadbeef;
978 SetLastError(0xdeadbeef);
979 rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
980 ok(rc, "AccessCheck error %d\n", GetLastError());
981 ok(status == 1, "expected 1, got %d\n", status);
982 ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
983
984 granted = 0xdeadbeef;
985 status = 0xdeadbeef;
986 SetLastError(0xdeadbeef);
987 rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status);
988 ok(rc, "AccessCheck error %d\n", GetLastError());
989 ok(status == 1, "expected 1, got %d\n", status);
990 ok(granted == DELETE, "expected DELETE, got %#x\n", granted);
991
992 granted = 0xdeadbeef;
993 status = 0xdeadbeef;
994 SetLastError(0xdeadbeef);
995 rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
996 ok(rc, "AccessCheck error %d\n", GetLastError());
997 ok(status == 1, "expected 1, got %d\n", status);
998 ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
999
1000 granted = 0xdeadbeef;
1001 status = 0xdeadbeef;
1002 SetLastError(0xdeadbeef);
1003 rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
1004 ok(rc, "AccessCheck error %d\n", GetLastError());
1005 ok(status == 1, "expected 1, got %d\n", status);
1006 ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
1007
1008 granted = 0xdeadbeef;
1009 status = 0xdeadbeef;
1010 SetLastError(0xdeadbeef);
1011 rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
1012 ok(rc, "AccessCheck error %d\n", GetLastError());
1013 ok(status == 1, "expected 1, got %d\n", status);
1014 ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
1015
1016 SetLastError(0xdeadbeef);
1017 rc = AccessCheck(sd, token, 0xffffffff, &mapping, &priv_set, &priv_set_len, &granted, &status);
1018 ok(!rc, "AccessCheck should fail\n");
1019 ok(GetLastError() == ERROR_GENERIC_NOT_MAPPED, "expected ERROR_GENERIC_NOT_MAPPED, got %d\n", GetLastError());
1020
1021 /* Test file access permissions for a file with FILE_ATTRIBUTE_READONLY */
1022 SetLastError(0xdeadbeef);
1023 fh = CreateFileA(file, FILE_READ_DATA, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_READONLY, 0);
1024 ok(fh != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
1025 retSize = 0xdeadbeef;
1026 SetLastError(0xdeadbeef);
1027 rc = WriteFile(fh, "1", 1, &retSize, NULL);
1028 ok(!rc, "WriteFile should fail\n");
1029 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1030 ok(retSize == 0, "expected 0, got %d\n", retSize);
1031 CloseHandle(fh);
1032
1033 rc = GetFileAttributesA(file);
1034 rc &= ~(FILE_ATTRIBUTE_NOT_CONTENT_INDEXED|FILE_ATTRIBUTE_COMPRESSED);
1035 todo_wine
1036 ok(rc == (FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY),
1037 "expected FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY got %#x\n", rc);
1038
1039 SetLastError(0xdeadbeef);
1040 rc = SetFileAttributesA(file, FILE_ATTRIBUTE_ARCHIVE);
1041 ok(rc, "SetFileAttributes error %d\n", GetLastError());
1042 SetLastError(0xdeadbeef);
1043 rc = DeleteFileA(file);
1044 ok(rc, "DeleteFile error %d\n", GetLastError());
1045
1046 SetLastError(0xdeadbeef);
1047 fh = CreateFileA(file, FILE_READ_DATA, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_READONLY, 0);
1048 ok(fh != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
1049 retSize = 0xdeadbeef;
1050 SetLastError(0xdeadbeef);
1051 rc = WriteFile(fh, "1", 1, &retSize, NULL);
1052 ok(!rc, "WriteFile should fail\n");
1053 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1054 ok(retSize == 0, "expected 0, got %d\n", retSize);
1055 CloseHandle(fh);
1056
1057 rc = GetFileAttributesA(file);
1058 rc &= ~(FILE_ATTRIBUTE_NOT_CONTENT_INDEXED|FILE_ATTRIBUTE_COMPRESSED);
1059 ok(rc == (FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY),
1060 "expected FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY got %#x\n", rc);
1061
1062 retSize = 0xdeadbeef;
1063 SetLastError(0xdeadbeef);
1064 rc = GetFileSecurityA(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
1065 sd, sdSize, &retSize);
1066 ok(rc, "GetFileSecurity error %d\n", GetLastError());
1067 ok(retSize == sdSize || broken(retSize == 0) /* NT4 */, "expected %d, got %d\n", sdSize, retSize);
1068
1069 priv_set_len = sizeof(priv_set);
1070 granted = 0xdeadbeef;
1071 status = 0xdeadbeef;
1072 SetLastError(0xdeadbeef);
1073 rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
1074 ok(rc, "AccessCheck error %d\n", GetLastError());
1075 ok(status == 1, "expected 1, got %d\n", status);
1076 ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
1077
1078 granted = 0xdeadbeef;
1079 status = 0xdeadbeef;
1080 SetLastError(0xdeadbeef);
1081 rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
1082 ok(rc, "AccessCheck error %d\n", GetLastError());
1083 todo_wine {
1084 ok(status == 1, "expected 1, got %d\n", status);
1085 ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
1086 }
1087 granted = 0xdeadbeef;
1088 status = 0xdeadbeef;
1089 SetLastError(0xdeadbeef);
1090 rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
1091 ok(rc, "AccessCheck error %d\n", GetLastError());
1092 ok(status == 1, "expected 1, got %d\n", status);
1093 ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
1094
1095 granted = 0xdeadbeef;
1096 status = 0xdeadbeef;
1097 SetLastError(0xdeadbeef);
1098 rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status);
1099 ok(rc, "AccessCheck error %d\n", GetLastError());
1100 todo_wine {
1101 ok(status == 1, "expected 1, got %d\n", status);
1102 ok(granted == DELETE, "expected DELETE, got %#x\n", granted);
1103 }
1104 granted = 0xdeadbeef;
1105 status = 0xdeadbeef;
1106 SetLastError(0xdeadbeef);
1107 rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
1108 ok(rc, "AccessCheck error %d\n", GetLastError());
1109 todo_wine {
1110 ok(status == 1, "expected 1, got %d\n", status);
1111 ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
1112 }
1113 granted = 0xdeadbeef;
1114 status = 0xdeadbeef;
1115 SetLastError(0xdeadbeef);
1116 rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
1117 ok(rc, "AccessCheck error %d\n", GetLastError());
1118 todo_wine {
1119 ok(status == 1, "expected 1, got %d\n", status);
1120 ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
1121 }
1122 granted = 0xdeadbeef;
1123 status = 0xdeadbeef;
1124 SetLastError(0xdeadbeef);
1125 rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
1126 ok(rc, "AccessCheck error %d\n", GetLastError());
1127 todo_wine {
1128 ok(status == 1, "expected 1, got %d\n", status);
1129 ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
1130 }
1131 SetLastError(0xdeadbeef);
1132 rc = DeleteFileA(file);
1133 ok(!rc, "DeleteFile should fail\n");
1134 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1135 SetLastError(0xdeadbeef);
1136 rc = SetFileAttributesA(file, FILE_ATTRIBUTE_ARCHIVE);
1137 ok(rc, "SetFileAttributes error %d\n", GetLastError());
1138 SetLastError(0xdeadbeef);
1139 rc = DeleteFileA(file);
1140 ok(rc, "DeleteFile error %d\n", GetLastError());
1141
1142 CloseHandle(token);
1143 HeapFree(GetProcessHeap(), 0, sd);
1144 }
1145
1146 static void test_AccessCheck(void)
1147 {
1148 PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL;
1149 PACL Acl = NULL;
1150 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
1151 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
1152 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1153 GENERIC_MAPPING Mapping = { KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS };
1154 ACCESS_MASK Access;
1155 BOOL AccessStatus;
1156 HANDLE Token;
1157 HANDLE ProcessToken;
1158 BOOL ret;
1159 DWORD PrivSetLen;
1160 PRIVILEGE_SET *PrivSet;
1161 BOOL res;
1162 HMODULE NtDllModule;
1163 BOOLEAN Enabled;
1164 DWORD err;
1165 NTSTATUS ntret, ntAccessStatus;
1166
1167 NtDllModule = GetModuleHandleA("ntdll.dll");
1168 if (!NtDllModule)
1169 {
1170 skip("not running on NT, skipping test\n");
1171 return;
1172 }
1173 pRtlAdjustPrivilege = (void *)GetProcAddress(NtDllModule, "RtlAdjustPrivilege");
1174 if (!pRtlAdjustPrivilege)
1175 {
1176 win_skip("missing RtlAdjustPrivilege, skipping test\n");
1177 return;
1178 }
1179
1180 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
1181 res = InitializeAcl(Acl, 256, ACL_REVISION);
1182 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
1183 {
1184 skip("ACLs not implemented - skipping tests\n");
1185 HeapFree(GetProcessHeap(), 0, Acl);
1186 return;
1187 }
1188 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
1189
1190 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
1191 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1192
1193 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1194 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdminSid);
1195 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1196
1197 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1198 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
1199 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1200
1201 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
1202
1203 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
1204 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1205
1206 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1207 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1208
1209 PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
1210 PrivSet = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PrivSetLen);
1211 PrivSet->PrivilegeCount = 16;
1212
1213 res = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &ProcessToken);
1214 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
1215
1216 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, FALSE, TRUE, &Enabled);
1217
1218 res = DuplicateToken(ProcessToken, SecurityImpersonation, &Token);
1219 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1220
1221 /* SD without owner/group */
1222 SetLastError(0xdeadbeef);
1223 Access = AccessStatus = 0x1abe11ed;
1224 ret = AccessCheck(SecurityDescriptor, Token, KEY_QUERY_VALUE, &Mapping,
1225 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1226 err = GetLastError();
1227 ok(!ret && err == ERROR_INVALID_SECURITY_DESCR, "AccessCheck should have "
1228 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err);
1229 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1230 "Access and/or AccessStatus were changed!\n");
1231
1232 /* Set owner and group */
1233 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
1234 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1235 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, TRUE);
1236 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1237
1238 /* Generic access mask */
1239 SetLastError(0xdeadbeef);
1240 Access = AccessStatus = 0x1abe11ed;
1241 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1242 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1243 err = GetLastError();
1244 ok(!ret && err == ERROR_GENERIC_NOT_MAPPED, "AccessCheck should have failed "
1245 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err);
1246 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1247 "Access and/or AccessStatus were changed!\n");
1248
1249 /* Generic access mask - no privilegeset buffer */
1250 SetLastError(0xdeadbeef);
1251 Access = AccessStatus = 0x1abe11ed;
1252 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1253 NULL, &PrivSetLen, &Access, &AccessStatus);
1254 err = GetLastError();
1255 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1256 "with ERROR_NOACCESS, instead of %d\n", err);
1257 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1258 "Access and/or AccessStatus were changed!\n");
1259
1260 /* Generic access mask - no returnlength */
1261 SetLastError(0xdeadbeef);
1262 Access = AccessStatus = 0x1abe11ed;
1263 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1264 PrivSet, NULL, &Access, &AccessStatus);
1265 err = GetLastError();
1266 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1267 "with ERROR_NOACCESS, instead of %d\n", err);
1268 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1269 "Access and/or AccessStatus were changed!\n");
1270
1271 /* Generic access mask - no privilegeset buffer, no returnlength */
1272 SetLastError(0xdeadbeef);
1273 Access = AccessStatus = 0x1abe11ed;
1274 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1275 NULL, NULL, &Access, &AccessStatus);
1276 err = GetLastError();
1277 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1278 "with ERROR_NOACCESS, instead of %d\n", err);
1279 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1280 "Access and/or AccessStatus were changed!\n");
1281
1282 /* sd with no dacl present */
1283 Access = AccessStatus = 0x1abe11ed;
1284 ret = SetSecurityDescriptorDacl(SecurityDescriptor, FALSE, NULL, FALSE);
1285 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1286 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1287 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1288 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1289 ok(AccessStatus && (Access == KEY_READ),
1290 "AccessCheck failed to grant access with error %d\n",
1291 GetLastError());
1292
1293 /* sd with no dacl present - no privilegeset buffer */
1294 SetLastError(0xdeadbeef);
1295 Access = AccessStatus = 0x1abe11ed;
1296 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1297 NULL, &PrivSetLen, &Access, &AccessStatus);
1298 err = GetLastError();
1299 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1300 "with ERROR_NOACCESS, instead of %d\n", err);
1301 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1302 "Access and/or AccessStatus were changed!\n");
1303
1304 if(pNtAccessCheck)
1305 {
1306 /* Generic access mask - no privilegeset buffer */
1307 SetLastError(0xdeadbeef);
1308 Access = ntAccessStatus = 0x1abe11ed;
1309 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1310 NULL, &PrivSetLen, &Access, &ntAccessStatus);
1311 err = GetLastError();
1312 ok(ntret == STATUS_ACCESS_VIOLATION,
1313 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1314 ok(err == 0xdeadbeef,
1315 "NtAccessCheck shouldn't set last error, got %d\n", err);
1316 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1317 "Access and/or AccessStatus were changed!\n");
1318
1319 /* Generic access mask - no returnlength */
1320 SetLastError(0xdeadbeef);
1321 Access = ntAccessStatus = 0x1abe11ed;
1322 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1323 PrivSet, NULL, &Access, &ntAccessStatus);
1324 err = GetLastError();
1325 ok(ntret == STATUS_ACCESS_VIOLATION,
1326 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1327 ok(err == 0xdeadbeef,
1328 "NtAccessCheck shouldn't set last error, got %d\n", err);
1329 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1330 "Access and/or AccessStatus were changed!\n");
1331
1332 /* Generic access mask - no privilegeset buffer, no returnlength */
1333 SetLastError(0xdeadbeef);
1334 Access = ntAccessStatus = 0x1abe11ed;
1335 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1336 NULL, NULL, &Access, &ntAccessStatus);
1337 err = GetLastError();
1338 ok(ntret == STATUS_ACCESS_VIOLATION,
1339 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1340 ok(err == 0xdeadbeef,
1341 "NtAccessCheck shouldn't set last error, got %d\n", err);
1342 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1343 "Access and/or AccessStatus were changed!\n");
1344 }
1345 else
1346 win_skip("NtAccessCheck unavailable. Skipping.\n");
1347
1348 /* sd with NULL dacl */
1349 Access = AccessStatus = 0x1abe11ed;
1350 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, NULL, FALSE);
1351 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1352 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1353 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1354 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1355 ok(AccessStatus && (Access == KEY_READ),
1356 "AccessCheck failed to grant access with error %d\n",
1357 GetLastError());
1358
1359 /* sd with blank dacl */
1360 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1361 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1362 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1363 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1364 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1365 err = GetLastError();
1366 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1367 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1368 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1369
1370 res = AddAccessAllowedAce(Acl, ACL_REVISION, KEY_READ, EveryoneSid);
1371 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
1372
1373 res = AddAccessDeniedAce(Acl, ACL_REVISION, KEY_SET_VALUE, AdminSid);
1374 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1375
1376 /* sd with dacl */
1377 Access = AccessStatus = 0x1abe11ed;
1378 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1379 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1380 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1381 ok(AccessStatus && (Access == KEY_READ),
1382 "AccessCheck failed to grant access with error %d\n",
1383 GetLastError());
1384
1385 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1386 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1387 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1388 ok(AccessStatus,
1389 "AccessCheck failed to grant any access with error %d\n",
1390 GetLastError());
1391 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access);
1392
1393 /* Access denied by SD */
1394 SetLastError(0xdeadbeef);
1395 Access = AccessStatus = 0x1abe11ed;
1396 ret = AccessCheck(SecurityDescriptor, Token, KEY_WRITE, &Mapping,
1397 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1398 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1399 err = GetLastError();
1400 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1401 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1402 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1403
1404 SetLastError(0);
1405 PrivSet->PrivilegeCount = 16;
1406 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1407 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1408 ok(ret && !AccessStatus && GetLastError() == ERROR_PRIVILEGE_NOT_HELD,
1409 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
1410 GetLastError());
1411
1412 ret = ImpersonateLoggedOnUser(Token);
1413 ok(ret, "ImpersonateLoggedOnUser failed with error %d\n", GetLastError());
1414 ret = pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, TRUE, TRUE, &Enabled);
1415 if (!ret)
1416 {
1417 SetLastError(0);
1418 PrivSet->PrivilegeCount = 16;
1419 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1420 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1421 ok(ret && AccessStatus && GetLastError() == 0,
1422 "AccessCheck should have succeeded, error %d\n",
1423 GetLastError());
1424 ok(Access == ACCESS_SYSTEM_SECURITY,
1425 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
1426 Access);
1427 }
1428 else
1429 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
1430 ret);
1431 ret = RevertToSelf();
1432 ok(ret, "RevertToSelf failed with error %d\n", GetLastError());
1433
1434 /* test INHERIT_ONLY_ACE */
1435 ret = InitializeAcl(Acl, 256, ACL_REVISION);
1436 ok(ret, "InitializeAcl failed with error %d\n", GetLastError());
1437
1438 /* NT doesn't have AddAccessAllowedAceEx. Skipping this call/test doesn't influence
1439 * the next ones.
1440 */
1441 if (pAddAccessAllowedAceEx)
1442 {
1443 ret = pAddAccessAllowedAceEx(Acl, ACL_REVISION, INHERIT_ONLY_ACE, KEY_READ, EveryoneSid);
1444 ok(ret, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1445 }
1446 else
1447 win_skip("AddAccessAllowedAceEx is not available\n");
1448
1449 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1450 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1451 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1452 err = GetLastError();
1453 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1454 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1455 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1456
1457 CloseHandle(Token);
1458
1459 res = DuplicateToken(ProcessToken, SecurityAnonymous, &Token);
1460 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1461
1462 SetLastError(0xdeadbeef);
1463 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1464 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1465 err = GetLastError();
1466 ok(!ret && err == ERROR_BAD_IMPERSONATION_LEVEL, "AccessCheck should have failed "
1467 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err);
1468
1469 CloseHandle(Token);
1470
1471 SetLastError(0xdeadbeef);
1472 ret = AccessCheck(SecurityDescriptor, ProcessToken, KEY_READ, &Mapping,
1473 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1474 err = GetLastError();
1475 ok(!ret && err == ERROR_NO_IMPERSONATION_TOKEN, "AccessCheck should have failed "
1476 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err);
1477
1478 CloseHandle(ProcessToken);
1479
1480 if (EveryoneSid)
1481 FreeSid(EveryoneSid);
1482 if (AdminSid)
1483 FreeSid(AdminSid);
1484 if (UsersSid)
1485 FreeSid(UsersSid);
1486 HeapFree(GetProcessHeap(), 0, Acl);
1487 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
1488 HeapFree(GetProcessHeap(), 0, PrivSet);
1489 }
1490
1491 /* test GetTokenInformation for the various attributes */
1492 static void test_token_attr(void)
1493 {
1494 HANDLE Token, ImpersonationToken;
1495 DWORD Size, Size2;
1496 TOKEN_PRIVILEGES *Privileges;
1497 TOKEN_GROUPS *Groups;
1498 TOKEN_USER *User;
1499 TOKEN_DEFAULT_DACL *Dacl;
1500 BOOL ret;
1501 DWORD i, GLE;
1502 LPSTR SidString;
1503 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1504 ACL *acl;
1505
1506 /* cygwin-like use case */
1507 SetLastError(0xdeadbeef);
1508 ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &Token);
1509 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1510 {
1511 win_skip("OpenProcessToken is not implemented\n");
1512 return;
1513 }
1514 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1515 if (ret)
1516 {
1517 DWORD buf[256]; /* GetTokenInformation wants a dword-aligned buffer */
1518 Size = sizeof(buf);
1519 ret = GetTokenInformation(Token, TokenUser,(void*)buf, Size, &Size);
1520 ok(ret, "GetTokenInformation failed with error %d\n", GetLastError());
1521 Size = sizeof(ImpersonationLevel);
1522 ret = GetTokenInformation(Token, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1523 GLE = GetLastError();
1524 ok(!ret && (GLE == ERROR_INVALID_PARAMETER), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE);
1525 CloseHandle(Token);
1526 }
1527
1528 if(!pConvertSidToStringSidA)
1529 {
1530 win_skip("ConvertSidToStringSidA is not available\n");
1531 return;
1532 }
1533
1534 SetLastError(0xdeadbeef);
1535 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &Token);
1536 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1537
1538 /* groups */
1539 /* insufficient buffer length */
1540 SetLastError(0xdeadbeef);
1541 Size2 = 0;
1542 ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size2);
1543 ok(Size2 > 1, "got %d\n", Size2);
1544 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1545 "%d with error %d\n", ret, GetLastError());
1546 Size2 -= 1;
1547 Groups = HeapAlloc(GetProcessHeap(), 0, Size2);
1548 memset(Groups, 0xcc, Size2);
1549 Size = 0;
1550 ret = GetTokenInformation(Token, TokenGroups, Groups, Size2, &Size);
1551 ok(Size > 1, "got %d\n", Size);
1552 ok((!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER) || broken(ret) /* wow64 */,
1553 "%d with error %d\n", ret, GetLastError());
1554 if(!ret)
1555 ok(*((BYTE*)Groups) == 0xcc, "buffer altered\n");
1556
1557 HeapFree(GetProcessHeap(), 0, Groups);
1558
1559 SetLastError(0xdeadbeef);
1560 ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size);
1561 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1562 "GetTokenInformation(TokenGroups) %s with error %d\n",
1563 ret ? "succeeded" : "failed", GetLastError());
1564 Groups = HeapAlloc(GetProcessHeap(), 0, Size);
1565 SetLastError(0xdeadbeef);
1566 ret = GetTokenInformation(Token, TokenGroups, Groups, Size, &Size);
1567 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
1568 ok(GetLastError() == 0xdeadbeef,
1569 "GetTokenInformation shouldn't have set last error to %d\n",
1570 GetLastError());
1571 trace("TokenGroups:\n");
1572 for (i = 0; i < Groups->GroupCount; i++)
1573 {
1574 DWORD NameLength = 255;
1575 CHAR Name[255];
1576 DWORD DomainLength = 255;
1577 CHAR Domain[255];
1578 SID_NAME_USE SidNameUse;
1579 Name[0] = '\0';
1580 Domain[0] = '\0';
1581 ret = LookupAccountSidA(NULL, Groups->Groups[i].Sid, Name, &NameLength, Domain, &DomainLength, &SidNameUse);
1582 if (ret)
1583 {
1584 pConvertSidToStringSidA(Groups->Groups[i].Sid, &SidString);
1585 trace("%s, %s\\%s use: %d attr: 0x%08x\n", SidString, Domain, Name, SidNameUse, Groups->Groups[i].Attributes);
1586 LocalFree(SidString);
1587 }
1588 else trace("attr: 0x%08x LookupAccountSid failed with error %d\n", Groups->Groups[i].Attributes, GetLastError());
1589 }
1590 HeapFree(GetProcessHeap(), 0, Groups);
1591
1592 /* user */
1593 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
1594 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1595 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1596 User = HeapAlloc(GetProcessHeap(), 0, Size);
1597 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
1598 ok(ret,
1599 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1600
1601 pConvertSidToStringSidA(User->User.Sid, &SidString);
1602 trace("TokenUser: %s attr: 0x%08x\n", SidString, User->User.Attributes);
1603 LocalFree(SidString);
1604 HeapFree(GetProcessHeap(), 0, User);
1605
1606 /* privileges */
1607 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
1608 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1609 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1610 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
1611 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
1612 ok(ret,
1613 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1614 trace("TokenPrivileges:\n");
1615 for (i = 0; i < Privileges->PrivilegeCount; i++)
1616 {
1617 CHAR Name[256];
1618 DWORD NameLen = sizeof(Name)/sizeof(Name[0]);
1619 LookupPrivilegeNameA(NULL, &Privileges->Privileges[i].Luid, Name, &NameLen);
1620 trace("\t%s, 0x%x\n", Name, Privileges->Privileges[i].Attributes);
1621 }
1622 HeapFree(GetProcessHeap(), 0, Privileges);
1623
1624 ret = DuplicateToken(Token, SecurityAnonymous, &ImpersonationToken);
1625 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
1626
1627 Size = sizeof(ImpersonationLevel);
1628 ret = GetTokenInformation(ImpersonationToken, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1629 ok(ret, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
1630 ok(ImpersonationLevel == SecurityAnonymous, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel);
1631
1632 CloseHandle(ImpersonationToken);
1633
1634 /* default dacl */
1635 ret = GetTokenInformation(Token, TokenDefaultDacl, NULL, 0, &Size);
1636 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1637 "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1638
1639 Dacl = HeapAlloc(GetProcessHeap(), 0, Size);
1640 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size);
1641 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1642
1643 SetLastError(0xdeadbeef);
1644 ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, 0);
1645 GLE = GetLastError();
1646 ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1647 ok(GLE == ERROR_BAD_LENGTH, "expected ERROR_BAD_LENGTH got %u\n", GLE);
1648
1649 SetLastError(0xdeadbeef);
1650 ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, Size);
1651 GLE = GetLastError();
1652 ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1653 ok(GLE == ERROR_NOACCESS, "expected ERROR_NOACCESS got %u\n", GLE);
1654
1655 acl = Dacl->DefaultDacl;
1656 Dacl->DefaultDacl = NULL;
1657
1658 ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1659 ok(ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1660
1661 Size2 = 0;
1662 Dacl->DefaultDacl = (ACL *)0xdeadbeef;
1663 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1664 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1665 ok(Dacl->DefaultDacl == NULL, "expected NULL, got %p\n", Dacl->DefaultDacl);
1666 ok(Size2 == sizeof(TOKEN_DEFAULT_DACL) || broken(Size2 == 2*sizeof(TOKEN_DEFAULT_DACL)), /* WoW64 */
1667 "got %u expected sizeof(TOKEN_DEFAULT_DACL)\n", Size2);
1668
1669 Dacl->DefaultDacl = acl;
1670 ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1671 ok(ret, "SetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1672
1673 if (Size2 == sizeof(TOKEN_DEFAULT_DACL)) {
1674 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1675 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1676 } else
1677 win_skip("TOKEN_DEFAULT_DACL size too small on WoW64\n");
1678
1679 HeapFree(GetProcessHeap(), 0, Dacl);
1680 CloseHandle(Token);
1681 }
1682
1683 typedef union _MAX_SID
1684 {
1685 SID sid;
1686 char max[SECURITY_MAX_SID_SIZE];
1687 } MAX_SID;
1688
1689 static void test_sid_str(PSID * sid)
1690 {
1691 char *str_sid;
1692 BOOL ret = pConvertSidToStringSidA(sid, &str_sid);
1693 ok(ret, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
1694 if (ret)
1695 {
1696 char account[MAX_PATH], domain[MAX_PATH];
1697 SID_NAME_USE use;
1698 DWORD acc_size = MAX_PATH;
1699 DWORD dom_size = MAX_PATH;
1700 ret = LookupAccountSidA (NULL, sid, account, &acc_size, domain, &dom_size, &use);
1701 ok(ret || (!ret && (GetLastError() == ERROR_NONE_MAPPED)),
1702 "LookupAccountSid(%s) failed: %d\n", str_sid, GetLastError());
1703 if (ret)
1704 trace(" %s %s\\%s %d\n", str_sid, domain, account, use);
1705 else if (GetLastError() == ERROR_NONE_MAPPED)
1706 trace(" %s couldn't be mapped\n", str_sid);
1707 LocalFree(str_sid);
1708 }
1709 }
1710
1711 static const struct well_known_sid_value
1712 {
1713 BOOL without_domain;
1714 const char *sid_string;
1715 } well_known_sid_values[] = {
1716 /* 0 */ {TRUE, "S-1-0-0"}, {TRUE, "S-1-1-0"}, {TRUE, "S-1-2-0"}, {TRUE, "S-1-3-0"},
1717 /* 4 */ {TRUE, "S-1-3-1"}, {TRUE, "S-1-3-2"}, {TRUE, "S-1-3-3"}, {TRUE, "S-1-5"},
1718 /* 8 */ {FALSE, "S-1-5-1"}, {TRUE, "S-1-5-2"}, {TRUE, "S-1-5-3"}, {TRUE, "S-1-5-4"},
1719 /* 12 */ {TRUE, "S-1-5-6"}, {TRUE, "S-1-5-7"}, {TRUE, "S-1-5-8"}, {TRUE, "S-1-5-9"},
1720 /* 16 */ {TRUE, "S-1-5-10"}, {TRUE, "S-1-5-11"}, {TRUE, "S-1-5-12"}, {TRUE, "S-1-5-13"},
1721 /* 20 */ {TRUE, "S-1-5-14"}, {FALSE, NULL}, {TRUE, "S-1-5-18"}, {TRUE, "S-1-5-19"},
1722 /* 24 */ {TRUE, "S-1-5-20"}, {TRUE, "S-1-5-32"},
1723 /* 26 */ {FALSE, "S-1-5-32-544"}, {TRUE, "S-1-5-32-545"}, {TRUE, "S-1-5-32-546"},
1724 /* 29 */ {TRUE, "S-1-5-32-547"}, {TRUE, "S-1-5-32-548"}, {TRUE, "S-1-5-32-549"},
1725 /* 32 */ {TRUE, "S-1-5-32-550"}, {TRUE, "S-1-5-32-551"}, {TRUE, "S-1-5-32-552"},
1726 /* 35 */ {TRUE, "S-1-5-32-554"}, {TRUE, "S-1-5-32-555"}, {TRUE, "S-1-5-32-556"},
1727 /* 38 */ {FALSE, "S-1-5-21-12-23-34-45-56-500"}, {FALSE, "S-1-5-21-12-23-34-45-56-501"},
1728 /* 40 */ {FALSE, "S-1-5-21-12-23-34-45-56-502"}, {FALSE, "S-1-5-21-12-23-34-45-56-512"},
1729 /* 42 */ {FALSE, "S-1-5-21-12-23-34-45-56-513"}, {FALSE, "S-1-5-21-12-23-34-45-56-514"},
1730 /* 44 */ {FALSE, "S-1-5-21-12-23-34-45-56-515"}, {FALSE, "S-1-5-21-12-23-34-45-56-516"},
1731 /* 46 */ {FALSE, "S-1-5-21-12-23-34-45-56-517"}, {FALSE, "S-1-5-21-12-23-34-45-56-518"},
1732 /* 48 */ {FALSE, "S-1-5-21-12-23-34-45-56-519"}, {FALSE, "S-1-5-21-12-23-34-45-56-520"},
1733 /* 50 */ {FALSE, "S-1-5-21-12-23-34-45-56-553"},
1734 /* Added in Windows Server 2003 */
1735 /* 51 */ {TRUE, "S-1-5-64-10"}, {TRUE, "S-1-5-64-21"}, {TRUE, "S-1-5-64-14"},
1736 /* 54 */ {TRUE, "S-1-5-15"}, {TRUE, "S-1-5-1000"}, {FALSE, "S-1-5-32-557"},
1737 /* 57 */ {TRUE, "S-1-5-32-558"}, {TRUE, "S-1-5-32-559"}, {TRUE, "S-1-5-32-560"},
1738 /* 60 */ {TRUE, "S-1-5-32-561"}, {TRUE, "S-1-5-32-562"},
1739 /* Added in Windows Vista: */
1740 /* 62 */ {TRUE, "S-1-5-32-568"},
1741 /* 63 */ {TRUE, "S-1-5-17"}, {FALSE, "S-1-5-32-569"}, {TRUE, "S-1-16-0"},
1742 /* 66 */ {TRUE, "S-1-16-4096"}, {TRUE, "S-1-16-8192"}, {TRUE, "S-1-16-12288"},
1743 /* 69 */ {TRUE, "S-1-16-16384"}, {TRUE, "S-1-5-33"}, {TRUE, "S-1-3-4"},
1744 /* 72 */ {FALSE, "S-1-5-21-12-23-34-45-56-571"}, {FALSE, "S-1-5-21-12-23-34-45-56-572"},
1745 /* 74 */ {TRUE, "S-1-5-22"}, {FALSE, "S-1-5-21-12-23-34-45-56-521"}, {TRUE, "S-1-5-32-573"},
1746 /* 77 */ {FALSE, "S-1-5-21-12-23-34-45-56-498"}, {TRUE, "S-1-5-32-574"}, {TRUE, "S-1-16-8448"}
1747 };
1748
1749 static void test_CreateWellKnownSid(void)
1750 {
1751 SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
1752 PSID domainsid, sid;
1753 DWORD size, error;
1754 BOOL ret;
1755 unsigned int i;
1756
1757 if (!pCreateWellKnownSid)
1758 {
1759 win_skip("CreateWellKnownSid not available\n");
1760 return;
1761 }
1762
1763 size = 0;
1764 SetLastError(0xdeadbeef);
1765 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1766 error = GetLastError();
1767 ok(!ret, "CreateWellKnownSid succeeded\n");
1768 ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
1769 ok(size, "expected size > 0\n");
1770
1771 SetLastError(0xdeadbeef);
1772 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1773 error = GetLastError();
1774 ok(!ret, "CreateWellKnownSid succeeded\n");
1775 ok(error == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %u\n", error);
1776
1777 sid = HeapAlloc(GetProcessHeap(), 0, size);
1778 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, sid, &size);
1779 ok(ret, "CreateWellKnownSid failed %u\n", GetLastError());
1780 HeapFree(GetProcessHeap(), 0, sid);
1781
1782 /* a domain sid usually have three subauthorities but we test that CreateWellKnownSid doesn't check it */
1783 AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
1784
1785 for (i = 0; i < sizeof(well_known_sid_values)/sizeof(well_known_sid_values[0]); i++)
1786 {
1787 const struct well_known_sid_value *value = &well_known_sid_values[i];
1788 char sid_buffer[SECURITY_MAX_SID_SIZE];
1789 LPSTR str;
1790 DWORD cb;
1791
1792 if (value->sid_string == NULL)
1793 continue;
1794
1795 if (i > WinAccountRasAndIasServersSid)
1796 {
1797 /* These SIDs aren't implemented by all Windows versions - detect it and break the loop */
1798 cb = sizeof(sid_buffer);
1799 if (!pCreateWellKnownSid(i, domainsid, sid_buffer, &cb))
1800 {
1801 skip("Well known SIDs starting from %u are not implemented\n", i);
1802 break;
1803 }
1804 }
1805
1806 cb = sizeof(sid_buffer);
1807 ok(pCreateWellKnownSid(i, value->without_domain ? NULL : domainsid, sid_buffer, &cb), "Couldn't create well known sid %u\n", i);
1808 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
1809 ok(IsValidSid(sid_buffer), "The sid is not valid\n");
1810 ok(pConvertSidToStringSidA(sid_buffer, &str), "Couldn't convert SID to string\n");
1811 ok(strcmp(str, value->sid_string) == 0, "%d: SID mismatch - expected %s, got %s\n", i,
1812 value->sid_string, str);
1813 LocalFree(str);
1814
1815 if (value->without_domain)
1816 {
1817 char buf2[SECURITY_MAX_SID_SIZE];
1818 cb = sizeof(buf2);
1819 ok(pCreateWellKnownSid(i, domainsid, buf2, &cb), "Couldn't create well known sid %u with optional domain\n", i);
1820 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
1821 ok(memcmp(buf2, sid_buffer, cb) == 0, "SID create with domain is different than without (%u)\n", i);
1822 }
1823 }
1824
1825 FreeSid(domainsid);
1826 }
1827
1828 static void test_LookupAccountSid(void)
1829 {
1830 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1831 CHAR accountA[MAX_PATH], domainA[MAX_PATH], usernameA[MAX_PATH];
1832 DWORD acc_sizeA, dom_sizeA, user_sizeA;
1833 DWORD real_acc_sizeA, real_dom_sizeA;
1834 WCHAR accountW[MAX_PATH], domainW[MAX_PATH];
1835 DWORD acc_sizeW, dom_sizeW;
1836 DWORD real_acc_sizeW, real_dom_sizeW;
1837 PSID pUsersSid = NULL;
1838 SID_NAME_USE use;
1839 BOOL ret;
1840 DWORD error, size, cbti = 0;
1841 MAX_SID max_sid;
1842 CHAR *str_sidA;
1843 int i;
1844 HANDLE hToken;
1845 PTOKEN_USER ptiUser = NULL;
1846
1847 /* native windows crashes if account size, domain size, or name use is NULL */
1848
1849 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1850 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &pUsersSid);
1851 ok(ret || (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED),
1852 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1853
1854 /* not running on NT so give up */
1855 if (!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1856 return;
1857
1858 real_acc_sizeA = MAX_PATH;
1859 real_dom_sizeA = MAX_PATH;
1860 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1861 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1862
1863 /* try NULL account */
1864 acc_sizeA = MAX_PATH;
1865 dom_sizeA = MAX_PATH;
1866 ret = LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1867 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1868
1869 /* try NULL domain */
1870 acc_sizeA = MAX_PATH;
1871 dom_sizeA = MAX_PATH;
1872 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1873 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1874
1875 /* try a small account buffer */
1876 acc_sizeA = 1;
1877 dom_sizeA = MAX_PATH;
1878 accountA[0] = 0;
1879 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1880 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1881 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1882 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1883
1884 /* try a 0 sized account buffer */
1885 acc_sizeA = 0;
1886 dom_sizeA = MAX_PATH;
1887 accountA[0] = 0;
1888 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1889 /* this can fail or succeed depending on OS version but the size will always be returned */
1890 ok(acc_sizeA == real_acc_sizeA + 1,
1891 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1892 real_acc_sizeA + 1, acc_sizeA);
1893
1894 /* try a 0 sized account buffer */
1895 acc_sizeA = 0;
1896 dom_sizeA = MAX_PATH;
1897 LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1898 /* this can fail or succeed depending on OS version but the size will always be returned */
1899 ok(acc_sizeA == real_acc_sizeA + 1,
1900 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1901 real_acc_sizeA + 1, acc_sizeA);
1902
1903 /* try a small domain buffer */
1904 dom_sizeA = 1;
1905 acc_sizeA = MAX_PATH;
1906 accountA[0] = 0;
1907 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1908 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1909 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1910 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1911
1912 /* try a 0 sized domain buffer */
1913 dom_sizeA = 0;
1914 acc_sizeA = MAX_PATH;
1915 accountA[0] = 0;
1916 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1917 /* this can fail or succeed depending on OS version but the size will always be returned */
1918 ok(dom_sizeA == real_dom_sizeA + 1,
1919 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1920 real_dom_sizeA + 1, dom_sizeA);
1921
1922 /* try a 0 sized domain buffer */
1923 dom_sizeA = 0;
1924 acc_sizeA = MAX_PATH;
1925 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1926 /* this can fail or succeed depending on OS version but the size will always be returned */
1927 ok(dom_sizeA == real_dom_sizeA + 1,
1928 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1929 real_dom_sizeA + 1, dom_sizeA);
1930
1931 real_acc_sizeW = MAX_PATH;
1932 real_dom_sizeW = MAX_PATH;
1933 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &real_acc_sizeW, domainW, &real_dom_sizeW, &use);
1934 ok(ret, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1935
1936 /* try an invalid system name */
1937 real_acc_sizeA = MAX_PATH;
1938 real_dom_sizeA = MAX_PATH;
1939 ret = LookupAccountSidA("deepthought", pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1940 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1941 ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
1942 "LookupAccountSidA() Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %u\n", GetLastError());
1943
1944 /* native windows crashes if domainW or accountW is NULL */
1945
1946 /* try a small account buffer */
1947 acc_sizeW = 1;
1948 dom_sizeW = MAX_PATH;
1949 accountW[0] = 0;
1950 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1951 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1952 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1953 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1954
1955 /* try a 0 sized account buffer */
1956 acc_sizeW = 0;
1957 dom_sizeW = MAX_PATH;
1958 accountW[0] = 0;
1959 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1960 /* this can fail or succeed depending on OS version but the size will always be returned */
1961 ok(acc_sizeW == real_acc_sizeW + 1,
1962 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1963 real_acc_sizeW + 1, acc_sizeW);
1964
1965 /* try a 0 sized account buffer */
1966 acc_sizeW = 0;
1967 dom_sizeW = MAX_PATH;
1968 LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, domainW, &dom_sizeW, &use);
1969 /* this can fail or succeed depending on OS version but the size will always be returned */
1970 ok(acc_sizeW == real_acc_sizeW + 1,
1971 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1972 real_acc_sizeW + 1, acc_sizeW);
1973
1974 /* try a small domain buffer */
1975 dom_sizeW = 1;
1976 acc_sizeW = MAX_PATH;
1977 accountW[0] = 0;
1978 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1979 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1980 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1981 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1982
1983 /* try a 0 sized domain buffer */
1984 dom_sizeW = 0;
1985 acc_sizeW = MAX_PATH;
1986 accountW[0] = 0;
1987 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1988 /* this can fail or succeed depending on OS version but the size will always be returned */
1989 ok(dom_sizeW == real_dom_sizeW + 1,
1990 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1991 real_dom_sizeW + 1, dom_sizeW);
1992
1993 /* try a 0 sized domain buffer */
1994 dom_sizeW = 0;
1995 acc_sizeW = MAX_PATH;
1996 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, NULL, &dom_sizeW, &use);
1997 /* this can fail or succeed depending on OS version but the size will always be returned */
1998 ok(dom_sizeW == real_dom_sizeW + 1,
1999 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
2000 real_dom_sizeW + 1, dom_sizeW);
2001
2002 acc_sizeW = dom_sizeW = use = 0;
2003 SetLastError(0xdeadbeef);
2004 ret = LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, NULL, &dom_sizeW, &use);
2005 error = GetLastError();
2006 ok(!ret, "LookupAccountSidW failed %u\n", GetLastError());
2007 ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
2008 ok(acc_sizeW, "expected non-zero account size\n");
2009 ok(dom_sizeW, "expected non-zero domain size\n");
2010 ok(!use, "expected zero use %u\n", use);
2011
2012 FreeSid(pUsersSid);
2013
2014 /* Test LookupAccountSid with Sid retrieved from token information.
2015 This assumes this process is running under the account of the current user.*/
2016 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY|TOKEN_DUPLICATE, &hToken);
2017 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
2018 ret = GetTokenInformation(hToken, TokenUser, NULL, 0, &cbti);
2019 ok(!ret, "GetTokenInformation failed with error %d\n", GetLastError());
2020 ptiUser = HeapAlloc(GetProcessHeap(), 0, cbti);
2021 if (GetTokenInformation(hToken, TokenUser, ptiUser, cbti, &cbti))
2022 {
2023 acc_sizeA = dom_sizeA = MAX_PATH;
2024 ret = LookupAccountSidA(NULL, ptiUser->User.Sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
2025 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
2026 user_sizeA = MAX_PATH;
2027 ret = GetUserNameA(usernameA , &user_sizeA);
2028 ok(ret, "GetUserNameA() Expected TRUE, got FALSE\n");
2029 ok(lstrcmpA(usernameA, accountA) == 0, "LookupAccountSidA() Expected account name: %s got: %s\n", usernameA, accountA );
2030 }
2031 HeapFree(GetProcessHeap(), 0, ptiUser);
2032
2033 if (pCreateWellKnownSid && pConvertSidToStringSidA)
2034 {
2035 trace("Well Known SIDs:\n");
2036 for (i = 0; i <= 60; i++)
2037 {
2038 size = SECURITY_MAX_SID_SIZE;
2039 if (pCreateWellKnownSid(i, NULL, &max_sid.sid, &size))
2040 {
2041 if (pConvertSidToStringSidA(&max_sid.sid, &str_sidA))
2042 {
2043 acc_sizeA = MAX_PATH;
2044 dom_sizeA = MAX_PATH;
2045 if (LookupAccountSidA(NULL, &max_sid.sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use))
2046 trace(" %d: %s %s\\%s %d\n", i, str_sidA, domainA, accountA, use);
2047 LocalFree(str_sidA);
2048 }
2049 }
2050 else
2051 {
2052 if (GetLastError() != ERROR_INVALID_PARAMETER)
2053 trace(" CreateWellKnownSid(%d) failed: %d\n", i, GetLastError());
2054 else
2055 trace(" %d: not supported\n", i);
2056 }
2057 }
2058
2059 pLsaQueryInformationPolicy = (void *)GetProcAddress( hmod, "LsaQueryInformationPolicy");
2060 pLsaOpenPolicy = (void *)GetProcAddress( hmod, "LsaOpenPolicy");
2061 pLsaFreeMemory = (void *)GetProcAddress( hmod, "LsaFreeMemory");
2062 pLsaClose = (void *)GetProcAddress( hmod, "LsaClose");
2063
2064 if (pLsaQueryInformationPolicy && pLsaOpenPolicy && pLsaFreeMemory && pLsaClose)
2065 {
2066 NTSTATUS status;
2067 LSA_HANDLE handle;
2068 LSA_OBJECT_ATTRIBUTES object_attributes;
2069
2070 ZeroMemory(&object_attributes, sizeof(object_attributes));
2071 object_attributes.Length = sizeof(object_attributes);
2072
2073 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_ALL_ACCESS, &handle);
2074 ok(status == STATUS_SUCCESS || status == STATUS_ACCESS_DENIED,
2075 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status);
2076
2077 /* try a more restricted access mask if necessary */
2078 if (status == STATUS_ACCESS_DENIED) {
2079 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
2080 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_VIEW_LOCAL_INFORMATION, &handle);
2081 ok(status == STATUS_SUCCESS, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status);
2082 }
2083
2084 if (status == STATUS_SUCCESS)
2085 {
2086 PPOLICY_ACCOUNT_DOMAIN_INFO info;
2087 status = pLsaQueryInformationPolicy(handle, PolicyAccountDomainInformation, (PVOID*)&info);
2088 ok(status == STATUS_SUCCESS, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status);
2089 if (status == STATUS_SUCCESS)
2090 {
2091 ok(info->DomainSid!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
2092 if (info->DomainSid)
2093 {
2094 int count = *GetSidSubAuthorityCount(info->DomainSid);
2095 CopySid(GetSidLengthRequired(count), &max_sid, info->DomainSid);
2096 test_sid_str((PSID)&max_sid.sid);
2097 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_ADMIN;
2098 max_sid.sid.SubAuthorityCount = count + 1;
2099 test_sid_str((PSID)&max_sid.sid);
2100 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_GUEST;
2101 test_sid_str((PSID)&max_sid.sid);
2102 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ADMINS;
2103 test_sid_str((PSID)&max_sid.sid);
2104 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_USERS;
2105 test_sid_str((PSID)&max_sid.sid);
2106 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_GUESTS;
2107 test_sid_str((PSID)&max_sid.sid);
2108 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_COMPUTERS;
2109 test_sid_str((PSID)&max_sid.sid);
2110 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CONTROLLERS;
2111 test_sid_str((PSID)&max_sid.sid);
2112 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CERT_ADMINS;
2113 test_sid_str((PSID)&max_sid.sid);
2114 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_SCHEMA_ADMINS;
2115 test_sid_str((PSID)&max_sid.sid);
2116 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS;
2117 test_sid_str((PSID)&max_sid.sid);
2118 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_POLICY_ADMINS;
2119 test_sid_str((PSID)&max_sid.sid);
2120 max_sid.sid.SubAuthority[count] = DOMAIN_ALIAS_RID_RAS_SERVERS;
2121 test_sid_str((PSID)&max_sid.sid);
2122 max_sid.sid.SubAuthority[count] = 1000; /* first user account */
2123 test_sid_str((PSID)&max_sid.sid);
2124 }
2125
2126 pLsaFreeMemory((LPVOID)info);
2127 }
2128
2129 status = pLsaClose(handle);
2130 ok(status == STATUS_SUCCESS, "LsaClose() failed, returned 0x%08x\n", status);
2131 }
2132 }
2133 }
2134 }
2135
2136 static BOOL get_sid_info(PSID psid, LPSTR *user, LPSTR *dom)
2137 {
2138 static CHAR account[UNLEN + 1];
2139 static CHAR domain[UNLEN + 1];
2140 DWORD size, dom_size;
2141 SID_NAME_USE use;
2142
2143 *user = account;
2144 *dom = domain;
2145
2146 size = dom_size = UNLEN + 1;
2147 account[0] = '\0';
2148 domain[0] = '\0';
2149 SetLastError(0xdeadbeef);
2150 return LookupAccountSidA(NULL, psid, account, &size, domain, &dom_size, &use);
2151 }
2152
2153 static void check_wellknown_name(const char* name, WELL_KNOWN_SID_TYPE result)
2154 {
2155 SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
2156 PSID domainsid = NULL;
2157 char wk_sid[SECURITY_MAX_SID_SIZE];
2158 DWORD cb;
2159
2160 DWORD sid_size, domain_size;
2161 SID_NAME_USE sid_use;
2162 LPSTR domain, account, sid_domain, wk_domain, wk_account;
2163 PSID psid;
2164 BOOL ret ,ret2;
2165
2166 sid_size = 0;
2167 domain_size = 0;
2168 ret = LookupAccountNameA(NULL, name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2169 ok(!ret, " %s Should have failed to lookup account name\n", name);
2170 psid = HeapAlloc(GetProcessHeap(),0,sid_size);
2171 domain = HeapAlloc(GetProcessHeap(),0,domain_size);
2172 ret = LookupAccountNameA(NULL, name, psid, &sid_size, domain, &domain_size, &sid_use);
2173
2174 if (!result)
2175 {
2176 ok(!ret, " %s Should have failed to lookup account name\n",name);
2177 goto cleanup;
2178 }
2179
2180 AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
2181 cb = sizeof(wk_sid);
2182 if (!pCreateWellKnownSid(result, domainsid, wk_sid, &cb))
2183 {
2184 win_skip("SID %i is not available on the system\n",result);
2185 goto cleanup;
2186 }
2187
2188 ret2 = get_sid_info(wk_sid, &wk_account, &wk_domain);
2189 if (!ret2 && GetLastError() == ERROR_NONE_MAPPED)
2190 {
2191 win_skip("CreateWellKnownSid() succeeded but the account '%s' is not present (W2K)\n", name);
2192 goto cleanup;
2193 }
2194
2195 get_sid_info(psid, &account, &sid_domain);
2196
2197 ok(ret, "Failed to lookup account name %s\n",name);
2198 ok(sid_size != 0, "sid_size was zero\n");
2199
2200 ok(EqualSid(psid,wk_sid),"(%s) Sids fail to match well known sid!\n",name);
2201
2202 ok(!lstrcmpA(account, wk_account), "Expected %s , got %s\n", account, wk_account);
2203 ok(!lstrcmpA(domain, wk_domain), "Expected %s, got %s\n", wk_domain, domain);
2204 ok(sid_use == SidTypeWellKnownGroup , "Expected Use (5), got %d\n", sid_use);
2205
2206 cleanup:
2207 FreeSid(domainsid);
2208 HeapFree(GetProcessHeap(),0,psid);
2209 HeapFree(GetProcessHeap(),0,domain);
2210 }
2211
2212 static void test_LookupAccountName(void)
2213 {
2214 DWORD sid_size, domain_size, user_size;
2215 DWORD sid_save, domain_save;
2216 CHAR user_name[UNLEN + 1];
2217 CHAR computer_name[UNLEN + 1];
2218 SID_NAME_USE sid_use;
2219 LPSTR domain, account, sid_dom;
2220 PSID psid;
2221 BOOL ret;
2222
2223 /* native crashes if (assuming all other parameters correct):
2224 * - peUse is NULL
2225 * - Sid is NULL and cbSid is > 0
2226 * - cbSid or cchReferencedDomainName are NULL
2227 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
2228 */
2229
2230 user_size = UNLEN + 1;
2231 SetLastError(0xdeadbeef);
2232 ret = GetUserNameA(user_name, &user_size);
2233 ok(ret, "Failed to get user name : %d\n", GetLastError());
2234
2235 /* get sizes */
2236 sid_size = 0;
2237 domain_size = 0;
2238 sid_use = 0xcafebabe;
2239 SetLastError(0xdeadbeef);
2240 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2241 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2242 {
2243 win_skip("LookupAccountNameA is not implemented\n");
2244 return;
2245 }
2246 ok(!ret, "Expected 0, got %d\n", ret);
2247 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2248 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2249 ok(sid_size != 0, "Expected non-zero sid size\n");
2250 ok(domain_size != 0, "Expected non-zero domain size\n");
2251 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2252
2253 sid_save = sid_size;
2254 domain_save = domain_size;
2255
2256 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2257 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2258
2259 /* try valid account name */
2260 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, domain, &domain_size, &sid_use);
2261 get_sid_info(psid, &account, &sid_dom);
2262 ok(ret, "Failed to lookup account name\n");
2263 ok(sid_size == GetLengthSid(psid), "Expected %d, got %d\n", GetLengthSid(psid), sid_size);
2264 ok(!lstrcmpA(account, user_name), "Expected %s, got %s\n", user_name, account);
2265 ok(!lstrcmpA(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2266 ok(domain_size == domain_save - 1, "Expected %d, got %d\n", domain_save - 1, domain_size);
2267 ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlenA(domain), domain_size);
2268 ok(sid_use == SidTypeUser, "Expected SidTypeUser (%d), got %d\n", SidTypeUser, sid_use);
2269 domain_size = domain_save;
2270 sid_size = sid_save;
2271
2272 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2273 {
2274 skip("Non-English locale (test with hardcoded 'Everyone')\n");
2275 }
2276 else
2277 {
2278 ret = LookupAccountNameA(NULL, "Everyone", psid, &sid_size, domain, &domain_size, &sid_use);
2279 get_sid_info(psid, &account, &sid_dom);
2280 ok(ret, "Failed to lookup account name\n");
2281 ok(sid_size != 0, "sid_size was zero\n");
2282 ok(!lstrcmpA(account, "Everyone"), "Expected Everyone, got %s\n", account);
2283 ok(!lstrcmpA(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2284 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2285 ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlenA(domain), domain_size);
2286 ok(sid_use == SidTypeWellKnownGroup, "Expected SidTypeWellKnownGroup (%d), got %d\n", SidTypeWellKnownGroup, sid_use);
2287 domain_size = domain_save;
2288 }
2289
2290 /* NULL Sid with zero sid size */
2291 SetLastError(0xdeadbeef);
2292 sid_size = 0;
2293 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2294 ok(!ret, "Expected 0, got %d\n", ret);
2295 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2296 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2297 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2298 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2299
2300 /* try cchReferencedDomainName - 1 */
2301 SetLastError(0xdeadbeef);
2302 domain_size--;
2303 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2304 ok(!ret, "Expected 0, got %d\n", ret);
2305 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2306 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2307 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2308 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2309
2310 /* NULL ReferencedDomainName with zero domain name size */
2311 SetLastError(0xdeadbeef);
2312 domain_size = 0;
2313 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, NULL, &domain_size, &sid_use);
2314 ok(!ret, "Expected 0, got %d\n", ret);
2315 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2316 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2317 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2318 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2319
2320 HeapFree(GetProcessHeap(), 0, psid);
2321 HeapFree(GetProcessHeap(), 0, domain);
2322
2323 /* get sizes for NULL account name */
2324 sid_size = 0;
2325 domain_size = 0;
2326 sid_use = 0xcafebabe;
2327 SetLastError(0xdeadbeef);
2328 ret = LookupAccountNameA(NULL, NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2329 if (!ret && GetLastError() == ERROR_NONE_MAPPED)
2330 win_skip("NULL account name doesn't work on NT4\n");
2331 else
2332 {
2333 ok(!ret, "Expected 0, got %d\n", ret);
2334 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2335 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2336 ok(sid_size != 0, "Expected non-zero sid size\n");
2337 ok(domain_size != 0, "Expected non-zero domain size\n");
2338 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2339
2340 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2341 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2342
2343 /* try NULL account name */
2344 ret = LookupAccountNameA(NULL, NULL, psid, &sid_size, domain, &domain_size, &sid_use);
2345 get_sid_info(psid, &account, &sid_dom);
2346 ok(ret, "Failed to lookup account name\n");
2347 /* Using a fixed string will not work on different locales */
2348 ok(!lstrcmpA(account, domain),
2349 "Got %s for account and %s for domain, these should be the same\n",
2350 account, domain);
2351 ok(sid_use == SidTypeDomain, "Expected SidTypeDomain (%d), got %d\n", SidTypeDomain, sid_use);
2352
2353 HeapFree(GetProcessHeap(), 0, psid);
2354 HeapFree(GetProcessHeap(), 0, domain);
2355 }
2356
2357 /* try an invalid account name */
2358 SetLastError(0xdeadbeef);
2359 sid_size = 0;
2360 domain_size = 0;
2361 ret = LookupAccountNameA(NULL, "oogabooga", NULL, &sid_size, NULL, &domain_size, &sid_use);
2362 ok(!ret, "Expected 0, got %d\n", ret);
2363 ok(GetLastError() == ERROR_NONE_MAPPED ||
2364 broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE),
2365 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
2366 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2367 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2368
2369 /* try an invalid system name */
2370 SetLastError(0xdeadbeef);
2371 sid_size = 0;
2372 domain_size = 0;
2373 ret = LookupAccountNameA("deepthought", NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2374 ok(!ret, "Expected 0, got %d\n", ret);
2375 ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
2376 "Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %d\n", GetLastError());
2377 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2378 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2379
2380 /* try with the computer name as the account name */
2381 domain_size = sizeof(computer_name);
2382 GetComputerNameA(computer_name, &domain_size);
2383 sid_size = 0;
2384 domain_size = 0;
2385 ret = LookupAccountNameA(NULL, computer_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2386 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER ||
2387 GetLastError() == ERROR_NONE_MAPPED /* in a domain */ ||
2388 broken(GetLastError() == ERROR_TRUSTED_DOMAIN_FAILURE) ||
2389 broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE)),
2390 "LookupAccountNameA failed: %d\n", GetLastError());
2391 if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
2392 {
2393 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2394 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2395 ret = LookupAccountNameA(NULL, computer_name, psid, &sid_size, domain, &domain_size, &sid_use);
2396 ok(ret, "LookupAccountNameA failed: %d\n", GetLastError());
2397 ok(sid_use == SidTypeDomain ||
2398 (sid_use == SidTypeUser && ! strcmp(computer_name, user_name)), "expected SidTypeDomain for %s, got %d\n", computer_name, sid_use);
2399 HeapFree(GetProcessHeap(), 0, domain);
2400 HeapFree(GetProcessHeap(), 0, psid);
2401 }
2402
2403 /* Well Known names */
2404 if (!pCreateWellKnownSid)
2405 {
2406 win_skip("CreateWellKnownSid not available\n");
2407 return;
2408 }
2409
2410 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2411 {
2412 skip("Non-English locale (skipping well known name creation tests)\n");
2413 return;
2414 }
2415
2416 check_wellknown_name("LocalService", WinLocalServiceSid);
2417 check_wellknown_name("Local Service", WinLocalServiceSid);
2418 /* 2 spaces */
2419 check_wellknown_name("Local Service", 0);
2420 check_wellknown_name("NetworkService", WinNetworkServiceSid);
2421 check_wellknown_name("Network Service", WinNetworkServiceSid);
2422
2423 /* example of some names where the spaces are not optional */
2424 check_wellknown_name("Terminal Server User", WinTerminalServerSid);
2425 check_wellknown_name("TerminalServer User", 0);
2426 check_wellknown_name("TerminalServerUser", 0);
2427 check_wellknown_name("Terminal ServerUser", 0);
2428
2429 check_wellknown_name("enterprise domain controllers",WinEnterpriseControllersSid);
2430 check_wellknown_name("enterprisedomain controllers", 0);
2431 check_wellknown_name("enterprise domaincontrollers", 0);
2432 check_wellknown_name("enterprisedomaincontrollers", 0);
2433
2434 /* case insensitivity */
2435 check_wellknown_name("lOCAlServICE", WinLocalServiceSid);
2436
2437 /* fully qualified account names */
2438 check_wellknown_name("NT AUTHORITY\\LocalService", WinLocalServiceSid);
2439 check_wellknown_name("nt authority\\Network Service", WinNetworkServiceSid);
2440 check_wellknown_name("nt authority test\\Network Service", 0);
2441 check_wellknown_name("Dummy\\Network Service", 0);
2442 check_wellknown_name("ntauthority\\Network Service", 0);
2443 }
2444
2445 static void test_security_descriptor(void)
2446 {
2447 SECURITY_DESCRIPTOR sd;
2448 char buf[8192];
2449 DWORD size;
2450 BOOL isDefault, isPresent, ret;
2451 PACL pacl;
2452 PSID psid;
2453
2454 SetLastError(0xdeadbeef);
2455 ret = InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION);
2456 if (ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2457 {
2458 win_skip("InitializeSecurityDescriptor is not implemented\n");
2459 return;
2460 }
2461
2462 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2463 expect_eq(psid, NULL, PSID, "%p");
2464 expect_eq(isDefault, FALSE, BOOL, "%d");
2465 sd.Control |= SE_DACL_PRESENT | SE_SACL_PRESENT;
2466
2467 SetLastError(0xdeadbeef);
2468 size = 5;
2469 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), FALSE, BOOL, "%d");
2470 expect_eq(GetLastError(), ERROR_INSUFFICIENT_BUFFER, DWORD, "%u");
2471 ok(size > 5, "Size not increased\n");
2472 if (size <= 8192)
2473 {
2474 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), TRUE, BOOL, "%d");
2475 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2476 expect_eq(psid, NULL, PSID, "%p");
2477 expect_eq(isDefault, FALSE, BOOL, "%d");
2478 ok(GetSecurityDescriptorGroup(&sd, &psid, &isDefault), "GetSecurityDescriptorGroup failed\n");
2479 expect_eq(psid, NULL, PSID, "%p");
2480 expect_eq(isDefault, FALSE, BOOL, "%d");
2481 ok(GetSecurityDescriptorDacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorDacl failed\n");
2482 expect_eq(isPresent, TRUE, BOOL, "%d");
2483 expect_eq(psid, NULL, PSID, "%p");
2484 expect_eq(isDefault, FALSE, BOOL, "%d");
2485 ok(GetSecurityDescriptorSacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorSacl failed\n");
2486 expect_eq(isPresent, TRUE, BOOL, "%d");
2487 expect_eq(psid, NULL, PSID, "%p");
2488 expect_eq(isDefault, FALSE, BOOL, "%d");
2489 }
2490 }
2491
2492 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,0,__LINE__)
2493 #define TEST_GRANTED_ACCESS2(a,b,c) test_granted_access(a,b,c,__LINE__)
2494 static void test_granted_access(HANDLE handle, ACCESS_MASK access,
2495 ACCESS_MASK alt, int line)
2496 {
2497 OBJECT_BASIC_INFORMATION obj_info;
2498 NTSTATUS status;
2499
2500 if (!pNtQueryObject)
2501 {
2502 skip_(__FILE__, line)("Not NT platform - skipping tests\n");
2503 return;
2504 }
2505
2506 status = pNtQueryObject( handle, ObjectBasicInformation, &obj_info,
2507 sizeof(obj_info), NULL );
2508 ok_(__FILE__, line)(!status, "NtQueryObject with err: %08x\n", status);
2509 if (alt)
2510 ok_(__FILE__, line)(obj_info.GrantedAccess == access ||
2511 obj_info.GrantedAccess == alt, "Granted access should be 0x%08x "
2512 "or 0x%08x, instead of 0x%08x\n", access, alt, obj_info.GrantedAccess);
2513 else
2514 ok_(__FILE__, line)(obj_info.GrantedAccess == access, "Granted access should "
2515 "be 0x%08x, instead of 0x%08x\n", access, obj_info.GrantedAccess);
2516 }
2517
2518 #define CHECK_SET_SECURITY(o,i,e) \
2519 do{ \
2520 BOOL res_; \
2521 DWORD err; \
2522 SetLastError( 0xdeadbeef ); \
2523 res_ = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
2524 err = GetLastError(); \
2525 if (e == ERROR_SUCCESS) \
2526 ok(res_, "SetKernelObjectSecurity failed with %d\n", err); \
2527 else \
2528 ok(!res_ && err == e, "SetKernelObjectSecurity should have failed " \
2529 "with %s, instead of %d\n", #e, err); \
2530 }while(0)
2531
2532 static void test_process_security(void)
2533 {
2534 BOOL res;
2535 PTOKEN_OWNER owner;
2536 PTOKEN_PRIMARY_GROUP group;
2537 PSID AdminSid = NULL, UsersSid = NULL;
2538 PACL Acl = NULL;
2539 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
2540 char buffer[MAX_PATH];
2541 PROCESS_INFORMATION info;
2542 STARTUPINFOA startup;
2543 SECURITY_ATTRIBUTES psa;
2544 HANDLE token, event;
2545 DWORD size;
2546 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2547 PSID EveryoneSid = NULL;
2548
2549 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
2550 res = InitializeAcl(Acl, 256, ACL_REVISION);
2551 if (!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2552 {
2553 win_skip("ACLs not implemented - skipping tests\n");
2554 HeapFree(GetProcessHeap(), 0, Acl);
2555 return;
2556 }
2557 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2558
2559 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
2560 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2561
2562 /* get owner from the token we might be running as a user not admin */
2563 res = OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED, &token );
2564 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
2565 if (!res)
2566 {
2567 HeapFree(GetProcessHeap(), 0, Acl);
2568 return;
2569 }
2570
2571 res = GetTokenInformation( token, TokenOwner, NULL, 0, &size );
2572 ok(!res, "Expected failure, got %d\n", res);
2573 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2574 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2575
2576 owner = HeapAlloc(GetProcessHeap(), 0, size);
2577 res = GetTokenInformation( token, TokenOwner, owner, size, &size );
2578 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2579 AdminSid = ((TOKEN_OWNER*)owner)->Owner;
2580
2581 res = GetTokenInformation( token, TokenPrimaryGroup, NULL, 0, &size );
2582 ok(!res, "Expected failure, got %d\n", res);
2583 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2584 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2585
2586 group = HeapAlloc(GetProcessHeap(), 0, size);
2587 res = GetTokenInformation( token, TokenPrimaryGroup, group, size, &size );
2588 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2589 UsersSid = ((TOKEN_PRIMARY_GROUP*)group)->PrimaryGroup;
2590
2591 CloseHandle( token );
2592 if (!res)
2593 {
2594 HeapFree(GetProcessHeap(), 0, group);
2595 HeapFree(GetProcessHeap(), 0, owner);
2596 HeapFree(GetProcessHeap(), 0, Acl);
2597 return;
2598 }
2599
2600 res = AddAccessDeniedAce(Acl, ACL_REVISION, PROCESS_VM_READ, AdminSid);
2601 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
2602 res = AddAccessAllowedAce(Acl, ACL_REVISION, PROCESS_ALL_ACCESS, AdminSid);
2603 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2604
2605 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
2606 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
2607 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
2608
2609 event = CreateEventA( NULL, TRUE, TRUE, "test_event" );
2610 ok(event != NULL, "CreateEvent %d\n", GetLastError());
2611
2612 SecurityDescriptor->Revision = 0;
2613 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_UNKNOWN_REVISION );
2614 SecurityDescriptor->Revision = SECURITY_DESCRIPTOR_REVISION;
2615
2616 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2617 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2618 CHECK_SET_SECURITY( event, SACL_SECURITY_INFORMATION, ERROR_ACCESS_DENIED );
2619 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2620 /* NULL DACL is valid and means that everyone has access */
2621 SecurityDescriptor->Control |= SE_DACL_PRESENT;
2622 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2623
2624 /* Set owner and group and dacl */
2625 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
2626 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
2627 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_SUCCESS );
2628 test_owner_equal( event, AdminSid, __LINE__ );
2629
2630 res = SetSecurityDescriptorGroup(SecurityDescriptor,