rostests/winetests/advapi32/security.c

   1 /*
   2  * Unit tests for security functions
   3  *
   4  * Copyright (c) 2004 Mike McCormack
   5  * Copyright (c) 2011 Dmitry Timoshkov
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include <stdarg.h>
  23 #include <stdio.h>
  24
  25 #include "ntstatus.h"
  26 #define WIN32_NO_STATUS
  27 #define WIN32_LEAN_AND_MEAN
  28 #include "windef.h"
  29 #include "winbase.h"
  30 #include "winerror.h"
  31 #include "wine/winternl.h"
  32 #include "aclapi.h"
  33 #include "winnt.h"
  34 #include "sddl.h"
  35 #include "ntsecapi.h"
  36 #include "lmcons.h"
  37
  38 #include <winsvc.h>
  39
  40 #include "wine/test.h"
  41
  42 /* FIXME: Inspect */
  43 #define GetCurrentProcessToken() ((HANDLE)~(ULONG_PTR)3)
  44 #define GetCurrentThreadToken() ((HANDLE)~(ULONG_PTR)4)
  45 #define GetCurrentThreadEffectiveToken() ((HANDLE)~(ULONG_PTR)5)
  46
  47 #ifndef PROCESS_QUERY_LIMITED_INFORMATION
  48 #define PROCESS_QUERY_LIMITED_INFORMATION 0x1000
  49 #endif
  50
  51 /* PROCESS_ALL_ACCESS in Vista+ PSDKs is incompatible with older Windows versions */
  52 #define PROCESS_ALL_ACCESS_NT4 (PROCESS_ALL_ACCESS & ~0xf000)
  53 #define PROCESS_ALL_ACCESS_VISTA (PROCESS_ALL_ACCESS | 0xf000)
  54
  55 #ifndef EVENT_QUERY_STATE
  56 #define EVENT_QUERY_STATE 0x0001
  57 #endif
  58
  59 #ifndef SEMAPHORE_QUERY_STATE
  60 #define SEMAPHORE_QUERY_STATE 0x0001
  61 #endif
  62
  63 #ifndef THREAD_SET_LIMITED_INFORMATION
  64 #define THREAD_SET_LIMITED_INFORMATION 0x0400
  65 #define THREAD_QUERY_LIMITED_INFORMATION 0x0800
  66 #endif
  67
  68 #define THREAD_ALL_ACCESS_NT4 (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3ff)
  69 #define THREAD_ALL_ACCESS_VISTA (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff)
  70
  71 #define expect_eq(expr, value, type, format) { type ret_ = expr; ok((value) == ret_, #expr " expected " format "  got " format "\n", (value), (ret_)); }
  72
  73 static BOOL (WINAPI *pAddAccessAllowedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
  74 static BOOL (WINAPI *pAddAccessDeniedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
  75 static BOOL (WINAPI *pAddAuditAccessAceEx)(PACL, DWORD, DWORD, DWORD, PSID, BOOL, BOOL);
  76 static VOID (WINAPI *pBuildTrusteeWithSidA)( PTRUSTEEA pTrustee, PSID pSid );
  77 static VOID (WINAPI *pBuildTrusteeWithNameA)( PTRUSTEEA pTrustee, LPSTR pName );
  78 static VOID (WINAPI *pBuildTrusteeWithObjectsAndNameA)( PTRUSTEEA pTrustee,
  79                                                           POBJECTS_AND_NAME_A pObjName,
  80                                                           SE_OBJECT_TYPE ObjectType,
  81                                                           LPSTR ObjectTypeName,
  82                                                           LPSTR InheritedObjectTypeName,
  83                                                           LPSTR Name );
  84 static VOID (WINAPI *pBuildTrusteeWithObjectsAndSidA)( PTRUSTEEA pTrustee,
  85                                                          POBJECTS_AND_SID pObjSid,
  86                                                          GUID* pObjectGuid,
  87                                                          GUID* pInheritedObjectGuid,
  88                                                          PSID pSid );
  89 static LPSTR (WINAPI *pGetTrusteeNameA)( PTRUSTEEA pTrustee );
  90 static BOOL (WINAPI *pMakeSelfRelativeSD)( PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR, LPDWORD );
  91 static BOOL (WINAPI *pConvertSidToStringSidA)( PSID pSid, LPSTR *str );
  92 static BOOL (WINAPI *pConvertStringSidToSidA)( LPCSTR str, PSID pSid );
  93 static BOOL (WINAPI *pCheckTokenMembership)(HANDLE, PSID, PBOOL);
  94 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorA)(LPCSTR, DWORD,
  95                                                                             PSECURITY_DESCRIPTOR*, PULONG );
  96 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorW)(LPCWSTR, DWORD,
  97                                                                             PSECURITY_DESCRIPTOR*, PULONG );
  98 static BOOL (WINAPI *pConvertSecurityDescriptorToStringSecurityDescriptorA)(PSECURITY_DESCRIPTOR, DWORD,
  99                                                                             SECURITY_INFORMATION, LPSTR *, PULONG );
 100 static BOOL (WINAPI *pGetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
 101                                           PSECURITY_DESCRIPTOR, DWORD, LPDWORD);
 102 static BOOL (WINAPI *pSetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
 103                                           PSECURITY_DESCRIPTOR);
 104 static DWORD (WINAPI *pGetNamedSecurityInfoA)(LPSTR, SE_OBJECT_TYPE, SECURITY_INFORMATION,
 105                                               PSID*, PSID*, PACL*, PACL*,
 106                                               PSECURITY_DESCRIPTOR*);
 107 static DWORD (WINAPI *pSetNamedSecurityInfoA)(LPSTR, SE_OBJECT_TYPE, SECURITY_INFORMATION,
 108                                               PSID, PSID, PACL, PACL);
 109 static PDWORD (WINAPI *pGetSidSubAuthority)(PSID, DWORD);
 110 static PUCHAR (WINAPI *pGetSidSubAuthorityCount)(PSID);
 111 static BOOL (WINAPI *pIsValidSid)(PSID);
 112 static DWORD (WINAPI *pRtlAdjustPrivilege)(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
 113 static BOOL (WINAPI *pCreateWellKnownSid)(WELL_KNOWN_SID_TYPE,PSID,PSID,DWORD*);
 114 static BOOL (WINAPI *pDuplicateTokenEx)(HANDLE,DWORD,LPSECURITY_ATTRIBUTES,
 115                                         SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
 116
 117 static NTSTATUS (WINAPI *pLsaQueryInformationPolicy)(LSA_HANDLE,POLICY_INFORMATION_CLASS,PVOID*);
 118 static NTSTATUS (WINAPI *pLsaClose)(LSA_HANDLE);
 119 static NTSTATUS (WINAPI *pLsaFreeMemory)(PVOID);
 120 static NTSTATUS (WINAPI *pLsaOpenPolicy)(PLSA_UNICODE_STRING,PLSA_OBJECT_ATTRIBUTES,ACCESS_MASK,PLSA_HANDLE);
 121 static NTSTATUS (WINAPI *pNtQueryObject)(HANDLE,OBJECT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
 122 static DWORD (WINAPI *pSetEntriesInAclW)(ULONG, PEXPLICIT_ACCESSW, PACL, PACL*);
 123 static DWORD (WINAPI *pSetEntriesInAclA)(ULONG, PEXPLICIT_ACCESSA, PACL, PACL*);
 124 static BOOL (WINAPI *pSetSecurityDescriptorControl)(PSECURITY_DESCRIPTOR, SECURITY_DESCRIPTOR_CONTROL,
 125                                                     SECURITY_DESCRIPTOR_CONTROL);
 126 static DWORD (WINAPI *pGetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION,
 127                                         PSID*, PSID*, PACL*, PACL*, PSECURITY_DESCRIPTOR*);
 128 static DWORD (WINAPI *pSetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION,
 129                                         PSID, PSID, PACL, PACL);
 130 static NTSTATUS (WINAPI *pNtAccessCheck)(PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK, PGENERIC_MAPPING,
 131                                          PPRIVILEGE_SET, PULONG, PULONG, NTSTATUS*);
 132 static BOOL (WINAPI *pCreateRestrictedToken)(HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD,
 133                                              PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE);
 134 static BOOL (WINAPI *pGetAclInformation)(PACL,LPVOID,DWORD,ACL_INFORMATION_CLASS);
 135 static BOOL (WINAPI *pGetAce)(PACL,DWORD,LPVOID*);
 136 static NTSTATUS (WINAPI *pNtSetSecurityObject)(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
 137 static NTSTATUS (WINAPI *pNtCreateFile)(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
 138 static BOOL     (WINAPI *pRtlDosPathNameToNtPathName_U)(LPCWSTR,PUNICODE_STRING,PWSTR*,CURDIR*);
 139 static NTSTATUS (WINAPI *pRtlAnsiStringToUnicodeString)(PUNICODE_STRING,PCANSI_STRING,BOOLEAN);
 140 static BOOL     (WINAPI *pGetWindowsAccountDomainSid)(PSID,PSID,DWORD*);
 141 static void     (WINAPI *pRtlInitAnsiString)(PANSI_STRING,PCSZ);
 142 static NTSTATUS (WINAPI *pRtlFreeUnicodeString)(PUNICODE_STRING);
 143 static PSID_IDENTIFIER_AUTHORITY (WINAPI *pGetSidIdentifierAuthority)(PSID);
 144
 145 static HMODULE hmod;
 146 static int     myARGC;
 147 static char**  myARGV;
 148
 149 struct strsid_entry
 150 {
 151     const char *str;
 152     DWORD flags;
 153 };
 154 #define STRSID_OK     0
 155 #define STRSID_OPT    1
 156
 157 #define SID_SLOTS 4
 158 static char debugsid_str[SID_SLOTS][256];
 159 static int debugsid_index = 0;
 160 static const char* debugstr_sid(PSID sid)
 161 {
 162     LPSTR sidstr;
 163     DWORD le = GetLastError();
 164     char* res = debugsid_str[debugsid_index];
 165     debugsid_index = (debugsid_index + 1) % SID_SLOTS;
 166     if (!pConvertSidToStringSidA)
 167         strcpy(res, "missing ConvertSidToStringSidA");
 168     else if (!pConvertSidToStringSidA(sid, &sidstr))
 169         sprintf(res, "ConvertSidToStringSidA failed le=%u", GetLastError());
 170     else if (strlen(sidstr) > sizeof(*debugsid_str) - 1)
 171     {
 172         memcpy(res, sidstr, sizeof(*debugsid_str) - 4);
 173         strcpy(res + sizeof(*debugsid_str) - 4, "...");
 174         LocalFree(sidstr);
 175     }
 176     else
 177     {
 178         strcpy(res, sidstr);
 179         LocalFree(sidstr);
 180     }
 181     /* Restore the last error in case ConvertSidToStringSidA() modified it */
 182     SetLastError(le);
 183     return res;
 184 }
 185
 186 struct sidRef
 187 {
 188     SID_IDENTIFIER_AUTHORITY auth;
 189     const char *refStr;
 190 };
 191
 192 static void init(void)
 193 {
 194     HMODULE hntdll;
 195
 196     hntdll = GetModuleHandleA("ntdll.dll");
 197     pNtQueryObject = (void *)GetProcAddress( hntdll, "NtQueryObject" );
 198     pNtAccessCheck = (void *)GetProcAddress( hntdll, "NtAccessCheck" );
 199     pNtSetSecurityObject = (void *)GetProcAddress(hntdll, "NtSetSecurityObject");
 200     pNtCreateFile = (void *)GetProcAddress(hntdll, "NtCreateFile");
 201     pRtlDosPathNameToNtPathName_U = (void *)GetProcAddress(hntdll, "RtlDosPathNameToNtPathName_U");
 202     pRtlAnsiStringToUnicodeString = (void *)GetProcAddress(hntdll, "RtlAnsiStringToUnicodeString");
 203     pRtlInitAnsiString = (void *)GetProcAddress(hntdll, "RtlInitAnsiString");
 204     pRtlFreeUnicodeString = (void *)GetProcAddress(hntdll, "RtlFreeUnicodeString");
 205
 206     hmod = GetModuleHandleA("advapi32.dll");
 207     pAddAccessAllowedAceEx = (void *)GetProcAddress(hmod, "AddAccessAllowedAceEx");
 208     pAddAccessDeniedAceEx = (void *)GetProcAddress(hmod, "AddAccessDeniedAceEx");
 209     pAddAuditAccessAceEx = (void *)GetProcAddress(hmod, "AddAuditAccessAceEx");
 210     pCheckTokenMembership = (void *)GetProcAddress(hmod, "CheckTokenMembership");
 211     pConvertStringSecurityDescriptorToSecurityDescriptorA =
 212         (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
 213     pConvertStringSecurityDescriptorToSecurityDescriptorW =
 214         (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorW" );
 215     pConvertSecurityDescriptorToStringSecurityDescriptorA =
 216         (void *)GetProcAddress(hmod, "ConvertSecurityDescriptorToStringSecurityDescriptorA" );
 217     pGetFileSecurityA = (void *)GetProcAddress(hmod, "GetFileSecurityA" );
 218     pSetFileSecurityA = (void *)GetProcAddress(hmod, "SetFileSecurityA" );
 219     pCreateWellKnownSid = (void *)GetProcAddress( hmod, "CreateWellKnownSid" );
 220     pGetNamedSecurityInfoA = (void *)GetProcAddress(hmod, "GetNamedSecurityInfoA");
 221     pSetNamedSecurityInfoA = (void *)GetProcAddress(hmod, "SetNamedSecurityInfoA");
 222     pGetSidSubAuthority = (void *)GetProcAddress(hmod, "GetSidSubAuthority");
 223     pGetSidSubAuthorityCount = (void *)GetProcAddress(hmod, "GetSidSubAuthorityCount");
 224     pIsValidSid = (void *)GetProcAddress(hmod, "IsValidSid");
 225     pMakeSelfRelativeSD = (void *)GetProcAddress(hmod, "MakeSelfRelativeSD");
 226     pSetEntriesInAclW = (void *)GetProcAddress(hmod, "SetEntriesInAclW");
 227     pSetEntriesInAclA = (void *)GetProcAddress(hmod, "SetEntriesInAclA");
 228     pSetSecurityDescriptorControl = (void *)GetProcAddress(hmod, "SetSecurityDescriptorControl");
 229     pGetSecurityInfo = (void *)GetProcAddress(hmod, "GetSecurityInfo");
 230     pSetSecurityInfo = (void *)GetProcAddress(hmod, "SetSecurityInfo");
 231     pCreateRestrictedToken = (void *)GetProcAddress(hmod, "CreateRestrictedToken");
 232     pConvertSidToStringSidA = (void *)GetProcAddress(hmod, "ConvertSidToStringSidA");
 233     pConvertStringSidToSidA = (void *)GetProcAddress(hmod, "ConvertStringSidToSidA");
 234     pGetAclInformation = (void *)GetProcAddress(hmod, "GetAclInformation");
 235     pGetAce = (void *)GetProcAddress(hmod, "GetAce");
 236     pGetWindowsAccountDomainSid = (void *)GetProcAddress(hmod, "GetWindowsAccountDomainSid");
 237     pGetSidIdentifierAuthority = (void *)GetProcAddress(hmod, "GetSidIdentifierAuthority");
 238
 239     myARGC = winetest_get_mainargs( &myARGV );
 240 }
 241
 242 static SECURITY_DESCRIPTOR* test_get_security_descriptor(HANDLE handle, int line)
 243 {
 244     /* use HeapFree(GetProcessHeap(), 0, sd); when done */
 245     DWORD ret, length, needed;
 246     SECURITY_DESCRIPTOR *sd;
 247
 248     needed = 0xdeadbeef;
 249     SetLastError(0xdeadbeef);
 250     ret = GetKernelObjectSecurity(handle, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
 251                                   NULL, 0, &needed);
 252     ok_(__FILE__, line)(!ret, "GetKernelObjectSecurity should fail\n");
 253     ok_(__FILE__, line)(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
 254     ok_(__FILE__, line)(needed != 0xdeadbeef, "GetKernelObjectSecurity should return required buffer length\n");
 255
 256     length = needed;
 257     sd = HeapAlloc(GetProcessHeap(), 0, length);
 258
 259     needed = 0xdeadbeef;
 260     SetLastError(0xdeadbeef);
 261     ret = GetKernelObjectSecurity(handle, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
 262                                   sd, length, &needed);
 263     ok_(__FILE__, line)(ret, "GetKernelObjectSecurity error %d\n", GetLastError());
 264     ok_(__FILE__, line)(needed == length || needed == 0 /* file, pipe */, "GetKernelObjectSecurity should return %u instead of %u\n", length, needed);
 265     return sd;
 266 }
 267
 268 static void test_owner_equal(HANDLE Handle, PSID expected, int line)
 269 {
 270     BOOL res;
 271     SECURITY_DESCRIPTOR *queriedSD = NULL;
 272     PSID owner;
 273     BOOL owner_defaulted;
 274
 275     queriedSD = test_get_security_descriptor( Handle, line );
 276
 277     res = GetSecurityDescriptorOwner(queriedSD, &owner, &owner_defaulted);
 278     ok_(__FILE__, line)(res, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
 279
 280     ok_(__FILE__, line)(EqualSid(owner, expected), "Owner SIDs are not equal %s != %s\n",
 281                         debugstr_sid(owner), debugstr_sid(expected));
 282     ok_(__FILE__, line)(!owner_defaulted, "Defaulted is true\n");
 283
 284     HeapFree(GetProcessHeap(), 0, queriedSD);
 285 }
 286
 287 static void test_group_equal(HANDLE Handle, PSID expected, int line)
 288 {
 289     BOOL res;
 290     SECURITY_DESCRIPTOR *queriedSD = NULL;
 291     PSID group;
 292     BOOL group_defaulted;
 293
 294     queriedSD = test_get_security_descriptor( Handle, line );
 295
 296     res = GetSecurityDescriptorGroup(queriedSD, &group, &group_defaulted);
 297     ok_(__FILE__, line)(res, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
 298
 299     ok_(__FILE__, line)(EqualSid(group, expected), "Group SIDs are not equal %s != %s\n",
 300                         debugstr_sid(group), debugstr_sid(expected));
 301     ok_(__FILE__, line)(!group_defaulted, "Defaulted is true\n");
 302
 303     HeapFree(GetProcessHeap(), 0, queriedSD);
 304 }
 305
 306 static void test_sid(void)
 307 {
 308     struct sidRef refs[] = {
 309      { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
 310      { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1"  },
 311      { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1"     },
 312      { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1"       },
 313      { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1"         },
 314      { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1"        },
 315     };
 316     struct strsid_entry strsid_table[] = {
 317         {"AO", STRSID_OK},  {"RU", STRSID_OK},  {"AN", STRSID_OK},  {"AU", STRSID_OK},
 318         {"BA", STRSID_OK},  {"BG", STRSID_OK},  {"BO", STRSID_OK},  {"BU", STRSID_OK},
 319         {"CA", STRSID_OPT}, {"CG", STRSID_OK},  {"CO", STRSID_OK},  {"DA", STRSID_OPT},
 320         {"DC", STRSID_OPT}, {"DD", STRSID_OPT}, {"DG", STRSID_OPT}, {"DU", STRSID_OPT},
 321         {"EA", STRSID_OPT}, {"ED", STRSID_OK},  {"WD", STRSID_OK},  {"PA", STRSID_OPT},
 322         {"IU", STRSID_OK},  {"LA", STRSID_OK},  {"LG", STRSID_OK},  {"LS", STRSID_OK},
 323         {"SY", STRSID_OK},  {"NU", STRSID_OK},  {"NO", STRSID_OK},  {"NS", STRSID_OK},
 324         {"PO", STRSID_OK},  {"PS", STRSID_OK},  {"PU", STRSID_OK},  {"RS", STRSID_OPT},
 325         {"RD", STRSID_OK},  {"RE", STRSID_OK},  {"RC", STRSID_OK},  {"SA", STRSID_OPT},
 326         {"SO", STRSID_OK},  {"SU", STRSID_OK}};
 327
 328     const char noSubAuthStr[] = "S-1-5";
 329     unsigned int i;
 330     PSID psid = NULL;
 331     SID *pisid;
 332     BOOL r;
 333     LPSTR str = NULL;
 334
 335     if( !pConvertSidToStringSidA || !pConvertStringSidToSidA )
 336     {
 337         win_skip("ConvertSidToStringSidA or ConvertStringSidToSidA not available\n");
 338         return;
 339     }
 340
 341     r = pConvertStringSidToSidA( NULL, NULL );
 342     ok( !r, "expected failure with NULL parameters\n" );
 343     if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED )
 344         return;
 345     ok( GetLastError() == ERROR_INVALID_PARAMETER,
 346      "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
 347      GetLastError() );
 348
 349     r = pConvertStringSidToSidA( refs[0].refStr, NULL );
 350     ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
 351      "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
 352      GetLastError() );
 353
 354     r = pConvertStringSidToSidA( NULL, &str );
 355     ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
 356      "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
 357      GetLastError() );
 358
 359     r = pConvertStringSidToSidA( noSubAuthStr, &psid );
 360     ok( !r,
 361      "expected failure with no sub authorities\n" );
 362     ok( GetLastError() == ERROR_INVALID_SID,
 363      "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
 364      GetLastError() );
 365
 366     ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid), "ConvertStringSidToSidA failed\n");
 367     pisid = psid;
 368     ok(pisid->SubAuthorityCount == 4, "Invalid sub authority count - expected 4, got %d\n", pisid->SubAuthorityCount);
 369     ok(pisid->SubAuthority[0] == 21, "Invalid subauthority 0 - expected 21, got %d\n", pisid->SubAuthority[0]);
 370     ok(pisid->SubAuthority[3] == 4576, "Invalid subauthority 0 - expected 4576, got %d\n", pisid->SubAuthority[3]);
 371     LocalFree(str);
 372     LocalFree(psid);
 373
 374     for( i = 0; i < sizeof(refs) / sizeof(refs[0]); i++ )
 375     {
 376         r = AllocateAndInitializeSid( &refs[i].auth, 1,1,0,0,0,0,0,0,0,
 377          &psid );
 378         ok( r, "failed to allocate sid\n" );
 379         r = pConvertSidToStringSidA( psid, &str );
 380         ok( r, "failed to convert sid\n" );
 381         if (r)
 382         {
 383             ok( !strcmp( str, refs[i].refStr ),
 384                 "incorrect sid, expected %s, got %s\n", refs[i].refStr, str );
 385             LocalFree( str );
 386         }
 387         if( psid )
 388             FreeSid( psid );
 389
 390         r = pConvertStringSidToSidA( refs[i].refStr, &psid );
 391         ok( r, "failed to parse sid string\n" );
 392         pisid = psid;
 393         ok( pisid &&
 394          !memcmp( pisid->IdentifierAuthority.Value, refs[i].auth.Value,
 395          sizeof(refs[i].auth) ),
 396          "string sid %s didn't parse to expected value\n"
 397          "(got 0x%04x%08x, expected 0x%04x%08x)\n",
 398          refs[i].refStr,
 399          MAKEWORD( pisid->IdentifierAuthority.Value[1],
 400          pisid->IdentifierAuthority.Value[0] ),
 401          MAKELONG( MAKEWORD( pisid->IdentifierAuthority.Value[5],
 402          pisid->IdentifierAuthority.Value[4] ),
 403          MAKEWORD( pisid->IdentifierAuthority.Value[3],
 404          pisid->IdentifierAuthority.Value[2] ) ),
 405          MAKEWORD( refs[i].auth.Value[1], refs[i].auth.Value[0] ),
 406          MAKELONG( MAKEWORD( refs[i].auth.Value[5], refs[i].auth.Value[4] ),
 407          MAKEWORD( refs[i].auth.Value[3], refs[i].auth.Value[2] ) ) );
 408         if( psid )
 409             LocalFree( psid );
 410     }
 411
 412     /* string constant format not supported before XP */
 413     r = pConvertStringSidToSidA(strsid_table[0].str, &psid);
 414     if(!r)
 415     {
 416         win_skip("String constant format not supported\n");
 417         return;
 418     }
 419     LocalFree(psid);
 420
 421     for(i = 0; i < sizeof(strsid_table) / sizeof(strsid_table[0]); i++)
 422     {
 423         char *temp;
 424
 425         SetLastError(0xdeadbeef);
 426         r = pConvertStringSidToSidA(strsid_table[i].str, &psid);
 427
 428         if (!(strsid_table[i].flags & STRSID_OPT))
 429         {
 430             ok(r, "%s: got %u\n", strsid_table[i].str, GetLastError());
 431         }
 432
 433         if (r)
 434         {
 435             if ((winetest_debug > 1) && (pConvertSidToStringSidA(psid, &temp)))
 436             {
 437                 trace(" %s: %s\n", strsid_table[i].str, temp);
 438                 LocalFree(temp);
 439             }
 440             LocalFree(psid);
 441         }
 442         else
 443         {
 444             if (GetLastError() != ERROR_INVALID_SID)
 445                 trace(" %s: couldn't be converted, returned %d\n", strsid_table[i].str, GetLastError());
 446             else
 447                 trace(" %s: couldn't be converted\n", strsid_table[i].str);
 448         }
 449     }
 450 }
 451
 452 static void test_trustee(void)
 453 {
 454     GUID ObjectType = {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
 455     GUID InheritedObjectType = {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
 456     GUID ZeroGuid;
 457     OBJECTS_AND_NAME_A oan;
 458     OBJECTS_AND_SID oas;
 459     TRUSTEEA trustee;
 460     PSID psid;
 461     char szObjectTypeName[] = "ObjectTypeName";
 462     char szInheritedObjectTypeName[] = "InheritedObjectTypeName";
 463     char szTrusteeName[] = "szTrusteeName";
 464     SID_IDENTIFIER_AUTHORITY auth = { {0x11,0x22,0,0,0, 0} };
 465
 466     memset( &ZeroGuid, 0x00, sizeof (ZeroGuid) );
 467
 468     pBuildTrusteeWithSidA = (void *)GetProcAddress( hmod, "BuildTrusteeWithSidA" );
 469     pBuildTrusteeWithNameA = (void *)GetProcAddress( hmod, "BuildTrusteeWithNameA" );
 470     pBuildTrusteeWithObjectsAndNameA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndNameA" );
 471     pBuildTrusteeWithObjectsAndSidA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndSidA" );
 472     pGetTrusteeNameA = (void *)GetProcAddress (hmod, "GetTrusteeNameA" );
 473     if( !pBuildTrusteeWithSidA || !pBuildTrusteeWithNameA ||
 474         !pBuildTrusteeWithObjectsAndNameA || !pBuildTrusteeWithObjectsAndSidA ||
 475         !pGetTrusteeNameA )
 476         return;
 477
 478     if ( ! AllocateAndInitializeSid( &auth, 1, 42, 0,0,0,0,0,0,0,&psid ) )
 479     {
 480         trace( "failed to init SID\n" );
 481        return;
 482     }
 483
 484     /* test BuildTrusteeWithSidA */
 485     memset( &trustee, 0xff, sizeof trustee );
 486     pBuildTrusteeWithSidA( &trustee, psid );
 487
 488     ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 489     ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
 490         "MultipleTrusteeOperation wrong\n");
 491     ok( trustee.TrusteeForm == TRUSTEE_IS_SID, "TrusteeForm wrong\n");
 492     ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 493     ok( trustee.ptstrName == psid, "ptstrName wrong\n" );
 494
 495     /* test BuildTrusteeWithObjectsAndSidA (test 1) */
 496     memset( &trustee, 0xff, sizeof trustee );
 497     memset( &oas, 0xff, sizeof(oas) );
 498     pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, &ObjectType,
 499                                     &InheritedObjectType, psid);
 500
 501     ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 502     ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
 503     ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
 504     ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 505     ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
 506
 507     ok(oas.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
 508     ok(!memcmp(&oas.ObjectTypeGuid, &ObjectType, sizeof(GUID)), "ObjectTypeGuid wrong\n");
 509     ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
 510     ok(oas.pSid == psid, "pSid wrong\n");
 511
 512     /* test GetTrusteeNameA */
 513     ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oas, "GetTrusteeName returned wrong value\n");
 514
 515     /* test BuildTrusteeWithObjectsAndSidA (test 2) */
 516     memset( &trustee, 0xff, sizeof trustee );
 517     memset( &oas, 0xff, sizeof(oas) );
 518     pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, NULL,
 519                                     &InheritedObjectType, psid);
 520
 521     ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 522     ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
 523     ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
 524     ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 525     ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
 526
 527     ok(oas.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
 528     ok(!memcmp(&oas.ObjectTypeGuid, &ZeroGuid, sizeof(GUID)), "ObjectTypeGuid wrong\n");
 529     ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
 530     ok(oas.pSid == psid, "pSid wrong\n");
 531
 532     FreeSid( psid );
 533
 534     /* test BuildTrusteeWithNameA */
 535     memset( &trustee, 0xff, sizeof trustee );
 536     pBuildTrusteeWithNameA( &trustee, szTrusteeName );
 537
 538     ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 539     ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
 540         "MultipleTrusteeOperation wrong\n");
 541     ok( trustee.TrusteeForm == TRUSTEE_IS_NAME, "TrusteeForm wrong\n");
 542     ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 543     ok( trustee.ptstrName == szTrusteeName, "ptstrName wrong\n" );
 544
 545     /* test BuildTrusteeWithObjectsAndNameA (test 1) */
 546     memset( &trustee, 0xff, sizeof trustee );
 547     memset( &oan, 0xff, sizeof(oan) );
 548     pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
 549                                      szInheritedObjectTypeName, szTrusteeName);
 550
 551     ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 552     ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
 553     ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
 554     ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 555     ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
 556
 557     ok(oan.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
 558     ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
 559     ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
 560     ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
 561
 562     /* test GetTrusteeNameA */
 563     ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oan, "GetTrusteeName returned wrong value\n");
 564
 565     /* test BuildTrusteeWithObjectsAndNameA (test 2) */
 566     memset( &trustee, 0xff, sizeof trustee );
 567     memset( &oan, 0xff, sizeof(oan) );
 568     pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, NULL,
 569                                      szInheritedObjectTypeName, szTrusteeName);
 570
 571     ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 572     ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
 573     ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
 574     ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 575     ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
 576
 577     ok(oan.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
 578     ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
 579     ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
 580     ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
 581
 582     /* test BuildTrusteeWithObjectsAndNameA (test 3) */
 583     memset( &trustee, 0xff, sizeof trustee );
 584     memset( &oan, 0xff, sizeof(oan) );
 585     pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
 586                                      NULL, szTrusteeName);
 587
 588     ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 589     ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
 590     ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
 591     ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 592     ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
 593
 594     ok(oan.ObjectsPresent == ACE_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
 595     ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
 596     ok(oan.InheritedObjectTypeName == NULL, "InheritedObjectTypeName wrong\n");
 597     ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
 598 }
 599
 600 /* If the first isn't defined, assume none is */
 601 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
 602 #define SE_MIN_WELL_KNOWN_PRIVILEGE       2L
 603 #define SE_CREATE_TOKEN_PRIVILEGE         2L
 604 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE   3L
 605 #define SE_LOCK_MEMORY_PRIVILEGE          4L
 606 #define SE_INCREASE_QUOTA_PRIVILEGE       5L
 607 #define SE_MACHINE_ACCOUNT_PRIVILEGE      6L
 608 #define SE_TCB_PRIVILEGE                  7L
 609 #define SE_SECURITY_PRIVILEGE             8L
 610 #define SE_TAKE_OWNERSHIP_PRIVILEGE       9L
 611 #define SE_LOAD_DRIVER_PRIVILEGE         10L
 612 #define SE_SYSTEM_PROFILE_PRIVILEGE      11L
 613 #define SE_SYSTEMTIME_PRIVILEGE          12L
 614 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
 615 #define SE_INC_BASE_PRIORITY_PRIVILEGE   14L
 616 #define SE_CREATE_PAGEFILE_PRIVILEGE     15L
 617 #define SE_CREATE_PERMANENT_PRIVILEGE    16L
 618 #define SE_BACKUP_PRIVILEGE              17L
 619 #define SE_RESTORE_PRIVILEGE             18L
 620 #define SE_SHUTDOWN_PRIVILEGE            19L
 621 #define SE_DEBUG_PRIVILEGE               20L
 622 #define SE_AUDIT_PRIVILEGE               21L
 623 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE  22L
 624 #define SE_CHANGE_NOTIFY_PRIVILEGE       23L
 625 #define SE_REMOTE_SHUTDOWN_PRIVILEGE     24L
 626 #define SE_UNDOCK_PRIVILEGE              25L
 627 #define SE_SYNC_AGENT_PRIVILEGE          26L
 628 #define SE_ENABLE_DELEGATION_PRIVILEGE   27L
 629 #define SE_MANAGE_VOLUME_PRIVILEGE       28L
 630 #define SE_IMPERSONATE_PRIVILEGE         29L
 631 #define SE_CREATE_GLOBAL_PRIVILEGE       30L
 632 #define SE_MAX_WELL_KNOWN_PRIVILEGE      SE_CREATE_GLOBAL_PRIVILEGE
 633 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
 634
 635 static void test_allocateLuid(void)
 636 {
 637     BOOL (WINAPI *pAllocateLocallyUniqueId)(PLUID);
 638     LUID luid1, luid2;
 639     BOOL ret;
 640
 641     pAllocateLocallyUniqueId = (void*)GetProcAddress(hmod, "AllocateLocallyUniqueId");
 642     if (!pAllocateLocallyUniqueId) return;
 643
 644     ret = pAllocateLocallyUniqueId(&luid1);
 645     if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
 646         return;
 647
 648     ok(ret,
 649      "AllocateLocallyUniqueId failed: %d\n", GetLastError());
 650     ret = pAllocateLocallyUniqueId(&luid2);
 651     ok( ret,
 652      "AllocateLocallyUniqueId failed: %d\n", GetLastError());
 653     ok(luid1.LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE || luid1.HighPart != 0,
 654      "AllocateLocallyUniqueId returned a well-known LUID\n");
 655     ok(luid1.LowPart != luid2.LowPart || luid1.HighPart != luid2.HighPart,
 656      "AllocateLocallyUniqueId returned non-unique LUIDs\n");
 657     ret = pAllocateLocallyUniqueId(NULL);
 658     ok( !ret && GetLastError() == ERROR_NOACCESS,
 659      "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
 660      GetLastError());
 661 }
 662
 663 static void test_lookupPrivilegeName(void)
 664 {
 665     BOOL (WINAPI *pLookupPrivilegeNameA)(LPCSTR, PLUID, LPSTR, LPDWORD);
 666     char buf[MAX_PATH]; /* arbitrary, seems long enough */
 667     DWORD cchName = sizeof(buf);
 668     LUID luid = { 0, 0 };
 669     LONG i;
 670     BOOL ret;
 671
 672     /* check whether it's available first */
 673     pLookupPrivilegeNameA = (void*)GetProcAddress(hmod, "LookupPrivilegeNameA");
 674     if (!pLookupPrivilegeNameA) return;
 675     luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
 676     ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
 677     if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
 678         return;
 679
 680     /* check with a short buffer */
 681     cchName = 0;
 682     luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
 683     ret = pLookupPrivilegeNameA(NULL, &luid, NULL, &cchName);
 684     ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
 685      "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
 686      GetLastError());
 687     ok(cchName == strlen("SeCreateTokenPrivilege") + 1,
 688      "LookupPrivilegeNameA returned an incorrect required length for\n"
 689      "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
 690      lstrlenA("SeCreateTokenPrivilege") + 1);
 691     /* check a known value and its returned length on success */
 692     cchName = sizeof(buf);
 693     ok(pLookupPrivilegeNameA(NULL, &luid, buf, &cchName) &&
 694      cchName == strlen("SeCreateTokenPrivilege"),
 695      "LookupPrivilegeNameA returned an incorrect output length for\n"
 696      "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
 697      (int)strlen("SeCreateTokenPrivilege"));
 698     /* check known values */
 699     for (i = SE_MIN_WELL_KNOWN_PRIVILEGE; i <= SE_MAX_WELL_KNOWN_PRIVILEGE; i++)
 700     {
 701         luid.LowPart = i;
 702         cchName = sizeof(buf);
 703         ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
 704         ok( ret || GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
 705          "LookupPrivilegeNameA(0.%d) failed: %d\n", i, GetLastError());
 706     }
 707     /* check a bogus LUID */
 708     luid.LowPart = 0xdeadbeef;
 709     cchName = sizeof(buf);
 710     ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
 711     ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
 712      "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
 713      GetLastError());
 714     /* check on a bogus system */
 715     luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
 716     cchName = sizeof(buf);
 717     ret = pLookupPrivilegeNameA("b0gu5.Nam3", &luid, buf, &cchName);
 718     ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
 719                  GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
 720      "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
 721      GetLastError());
 722 }
 723
 724 struct NameToLUID
 725 {
 726     const char *name;
 727     DWORD lowPart;
 728 };
 729
 730 static void test_lookupPrivilegeValue(void)
 731 {
 732     static const struct NameToLUID privs[] = {
 733      { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE },
 734      { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE },
 735      { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE },
 736      { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE },
 737      { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE },
 738      { "SeTcbPrivilege", SE_TCB_PRIVILEGE },
 739      { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE },
 740      { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE },
 741      { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE },
 742      { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE },
 743      { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE },
 744      { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE },
 745      { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE },
 746      { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE },
 747      { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE },
 748      { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE },
 749      { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE },
 750      { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE },
 751      { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE },
 752      { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE },
 753      { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE },
 754      { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILEGE },
 755      { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE },
 756      { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE },
 757      { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE },
 758      { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE },
 759      { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE },
 760      { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE },
 761      { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE },
 762     };
 763     BOOL (WINAPI *pLookupPrivilegeValueA)(LPCSTR, LPCSTR, PLUID);
 764     unsigned int i;
 765     LUID luid;
 766     BOOL ret;
 767
 768     /* check whether it's available first */
 769     pLookupPrivilegeValueA = (void*)GetProcAddress(hmod, "LookupPrivilegeValueA");
 770     if (!pLookupPrivilegeValueA) return;
 771     ret = pLookupPrivilegeValueA(NULL, "SeCreateTokenPrivilege", &luid);
 772     if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
 773         return;
 774
 775     /* check a bogus system name */
 776     ret = pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid);
 777     ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
 778                 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
 779      "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
 780      GetLastError());
 781     /* check a NULL string */
 782     ret = pLookupPrivilegeValueA(NULL, 0, &luid);
 783     ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
 784      "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
 785      GetLastError());
 786     /* check a bogus privilege name */
 787     ret = pLookupPrivilegeValueA(NULL, "SeBogusPrivilege", &luid);
 788     ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
 789      "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
 790      GetLastError());
 791     /* check case insensitive */
 792     ret = pLookupPrivilegeValueA(NULL, "sEcREATEtOKENpRIVILEGE", &luid);
 793     ok( ret,
 794      "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
 795      GetLastError());
 796     for (i = 0; i < sizeof(privs) / sizeof(privs[0]); i++)
 797     {
 798         /* Not all privileges are implemented on all Windows versions, so
 799          * don't worry if the call fails
 800          */
 801         if (pLookupPrivilegeValueA(NULL, privs[i].name, &luid))
 802         {
 803             ok(luid.LowPart == privs[i].lowPart,
 804              "LookupPrivilegeValueA returned an invalid LUID for %s\n",
 805              privs[i].name);
 806         }
 807     }
 808 }
 809
 810 static void test_luid(void)
 811 {
 812     test_allocateLuid();
 813     test_lookupPrivilegeName();
 814     test_lookupPrivilegeValue();
 815 }
 816
 817 static void test_FileSecurity(void)
 818 {
 819     char wintmpdir [MAX_PATH];
 820     char path [MAX_PATH];
 821     char file [MAX_PATH];
 822     HANDLE fh, token;
 823     DWORD sdSize, retSize, rc, granted, priv_set_len;
 824     PRIVILEGE_SET priv_set;
 825     BOOL status;
 826     BYTE *sd;
 827     GENERIC_MAPPING mapping = { FILE_READ_DATA, FILE_WRITE_DATA, FILE_EXECUTE, FILE_ALL_ACCESS };
 828     const SECURITY_INFORMATION request = OWNER_SECURITY_INFORMATION
 829                                        | GROUP_SECURITY_INFORMATION
 830                                        | DACL_SECURITY_INFORMATION;
 831
 832     if (!pGetFileSecurityA) {
 833         win_skip ("GetFileSecurity is not available\n");
 834         return;
 835     }
 836
 837     if (!pSetFileSecurityA) {
 838         win_skip ("SetFileSecurity is not available\n");
 839         return;
 840     }
 841
 842     if (!GetTempPathA (sizeof (wintmpdir), wintmpdir)) {
 843         win_skip ("GetTempPathA failed\n");
 844         return;
 845     }
 846
 847     /* Create a temporary directory and in it a temporary file */
 848     strcat (strcpy (path, wintmpdir), "rary");
 849     SetLastError(0xdeadbeef);
 850     rc = CreateDirectoryA (path, NULL);
 851     ok (rc || GetLastError() == ERROR_ALREADY_EXISTS, "CreateDirectoryA "
 852         "failed for '%s' with %d\n", path, GetLastError());
 853
 854     strcat (strcpy (file, path), "\\ess");
 855     SetLastError(0xdeadbeef);
 856     fh = CreateFileA (file, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
 857     ok (fh != INVALID_HANDLE_VALUE, "CreateFileA "
 858         "failed for '%s' with %d\n", file, GetLastError());
 859     CloseHandle (fh);
 860
 861     /* For the temporary file ... */
 862
 863     /* Get size needed */
 864     retSize = 0;
 865     SetLastError(0xdeadbeef);
 866     rc = pGetFileSecurityA (file, request, NULL, 0, &retSize);
 867     if (!rc && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)) {
 868         win_skip("GetFileSecurityA is not implemented\n");
 869         goto cleanup;
 870     }
 871     ok (!rc, "GetFileSecurityA "
 872         "was expected to fail for '%s'\n", file);
 873     ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
 874         "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
 875     ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
 876
 877     sdSize = retSize;
 878     sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
 879
 880     /* Get security descriptor for real */
 881     retSize = -1;
 882     SetLastError(0xdeadbeef);
 883     rc = pGetFileSecurityA (file, request, sd, sdSize, &retSize);
 884     ok (rc, "GetFileSecurityA "
 885         "was not expected to fail '%s': %d\n", file, GetLastError());
 886     ok (retSize == sdSize ||
 887         broken(retSize == 0), /* NT4 */
 888         "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
 889
 890     /* Use it to set security descriptor */
 891     SetLastError(0xdeadbeef);
 892     rc = pSetFileSecurityA (file, request, sd);
 893     ok (rc, "SetFileSecurityA "
 894         "was not expected to fail '%s': %d\n", file, GetLastError());
 895
 896     HeapFree (GetProcessHeap (), 0, sd);
 897
 898     /* Repeat for the temporary directory ... */
 899
 900     /* Get size needed */
 901     retSize = 0;
 902     SetLastError(0xdeadbeef);
 903     rc = pGetFileSecurityA (path, request, NULL, 0, &retSize);
 904     ok (!rc, "GetFileSecurityA "
 905         "was expected to fail for '%s'\n", path);
 906     ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
 907         "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
 908     ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
 909
 910     sdSize = retSize;
 911     sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
 912
 913     /* Get security descriptor for real */
 914     retSize = -1;
 915     SetLastError(0xdeadbeef);
 916     rc = pGetFileSecurityA (path, request, sd, sdSize, &retSize);
 917     ok (rc, "GetFileSecurityA "
 918         "was not expected to fail '%s': %d\n", path, GetLastError());
 919     ok (retSize == sdSize ||
 920         broken(retSize == 0), /* NT4 */
 921         "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
 922
 923     /* Use it to set security descriptor */
 924     SetLastError(0xdeadbeef);
 925     rc = pSetFileSecurityA (path, request, sd);
 926     ok (rc, "SetFileSecurityA "
 927         "was not expected to fail '%s': %d\n", path, GetLastError());
 928     HeapFree (GetProcessHeap (), 0, sd);
 929
 930     /* Old test */
 931     strcpy (wintmpdir, "\\Should not exist");
 932     SetLastError(0xdeadbeef);
 933     rc = pGetFileSecurityA (wintmpdir, OWNER_SECURITY_INFORMATION, NULL, 0, &sdSize);
 934     ok (!rc, "GetFileSecurityA should fail for not existing directories/files\n");
 935     ok (GetLastError() == ERROR_FILE_NOT_FOUND,
 936         "last error ERROR_FILE_NOT_FOUND expected, got %d\n", GetLastError());
 937
 938 cleanup:
 939     /* Remove temporary file and directory */
 940     DeleteFileA(file);
 941     RemoveDirectoryA(path);
 942
 943     /* Test file access permissions for a file with FILE_ATTRIBUTE_ARCHIVE */
 944     SetLastError(0xdeadbeef);
 945     rc = GetTempPathA(sizeof(wintmpdir), wintmpdir);
 946     ok(rc, "GetTempPath error %d\n", GetLastError());
 947
 948     SetLastError(0xdeadbeef);
 949     rc = GetTempFileNameA(wintmpdir, "tmp", 0, file);
 950     ok(rc, "GetTempFileName error %d\n", GetLastError());
 951
 952     rc = GetFileAttributesA(file);
 953     rc &= ~(FILE_ATTRIBUTE_NOT_CONTENT_INDEXED|FILE_ATTRIBUTE_COMPRESSED);
 954     ok(rc == FILE_ATTRIBUTE_ARCHIVE, "expected FILE_ATTRIBUTE_ARCHIVE got %#x\n", rc);
 955
 956     rc = GetFileSecurityA(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
 957                           NULL, 0, &sdSize);
 958     ok(!rc, "GetFileSecurity should fail\n");
 959     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
 960        "expected ERROR_INSUFFICIENT_BUFFER got %d\n", GetLastError());
 961     ok(sdSize > sizeof(SECURITY_DESCRIPTOR), "got sd size %d\n", sdSize);
 962
 963     sd = HeapAlloc(GetProcessHeap (), 0, sdSize);
 964     retSize = 0xdeadbeef;
 965     SetLastError(0xdeadbeef);
 966     rc = GetFileSecurityA(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
 967                           sd, sdSize, &retSize);
 968     ok(rc, "GetFileSecurity error %d\n", GetLastError());
 969     ok(retSize == sdSize || broken(retSize == 0) /* NT4 */, "expected %d, got %d\n", sdSize, retSize);
 970
 971     SetLastError(0xdeadbeef);
 972     rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
 973     ok(!rc, "OpenThreadToken should fail\n");
 974     ok(GetLastError() == ERROR_NO_TOKEN, "expected ERROR_NO_TOKEN, got %d\n", GetLastError());
 975
 976     SetLastError(0xdeadbeef);
 977     rc = ImpersonateSelf(SecurityIdentification);
 978     ok(rc, "ImpersonateSelf error %d\n", GetLastError());
 979
 980     SetLastError(0xdeadbeef);
 981     rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
 982     ok(rc, "OpenThreadToken error %d\n", GetLastError());
 983
 984     SetLastError(0xdeadbeef);
 985     rc = RevertToSelf();
 986     ok(rc, "RevertToSelf error %d\n", GetLastError());
 987
 988     priv_set_len = sizeof(priv_set);
 989     granted = 0xdeadbeef;
 990     status = 0xdeadbeef;
 991     SetLastError(0xdeadbeef);
 992     rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
 993     ok(rc, "AccessCheck error %d\n", GetLastError());
 994     ok(status == 1, "expected 1, got %d\n", status);
 995     ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
 996
 997     granted = 0xdeadbeef;
 998     status = 0xdeadbeef;
 999     SetLastError(0xdeadbeef);
1000     rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
1001     ok(rc, "AccessCheck error %d\n", GetLastError());
1002     ok(status == 1, "expected 1, got %d\n", status);
1003     ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
1004
1005     granted = 0xdeadbeef;
1006     status = 0xdeadbeef;
1007     SetLastError(0xdeadbeef);
1008     rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
1009     ok(rc, "AccessCheck error %d\n", GetLastError());
1010     ok(status == 1, "expected 1, got %d\n", status);
1011     ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
1012
1013     granted = 0xdeadbeef;
1014     status = 0xdeadbeef;
1015     SetLastError(0xdeadbeef);
1016     rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status);
1017     ok(rc, "AccessCheck error %d\n", GetLastError());
1018     ok(status == 1, "expected 1, got %d\n", status);
1019     ok(granted == DELETE, "expected DELETE, got %#x\n", granted);
1020
1021     granted = 0xdeadbeef;
1022     status = 0xdeadbeef;
1023     SetLastError(0xdeadbeef);
1024     rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
1025     ok(rc, "AccessCheck error %d\n", GetLastError());
1026     ok(status == 1, "expected 1, got %d\n", status);
1027     ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
1028
1029     granted = 0xdeadbeef;
1030     status = 0xdeadbeef;
1031     SetLastError(0xdeadbeef);
1032     rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
1033     ok(rc, "AccessCheck error %d\n", GetLastError());
1034     ok(status == 1, "expected 1, got %d\n", status);
1035     ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
1036
1037     granted = 0xdeadbeef;
1038     status = 0xdeadbeef;
1039     SetLastError(0xdeadbeef);
1040     rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
1041     ok(rc, "AccessCheck error %d\n", GetLastError());
1042     ok(status == 1, "expected 1, got %d\n", status);
1043     ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
1044
1045     SetLastError(0xdeadbeef);
1046     rc = AccessCheck(sd, token, 0xffffffff, &mapping, &priv_set, &priv_set_len, &granted, &status);
1047     ok(!rc, "AccessCheck should fail\n");
1048     ok(GetLastError() == ERROR_GENERIC_NOT_MAPPED, "expected ERROR_GENERIC_NOT_MAPPED, got %d\n", GetLastError());
1049
1050     /* Test file access permissions for a file with FILE_ATTRIBUTE_READONLY */
1051     SetLastError(0xdeadbeef);
1052     fh = CreateFileA(file, FILE_READ_DATA, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_READONLY, 0);
1053     ok(fh != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
1054     retSize = 0xdeadbeef;
1055     SetLastError(0xdeadbeef);
1056     rc = WriteFile(fh, "1", 1, &retSize, NULL);
1057     ok(!rc, "WriteFile should fail\n");
1058     ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1059     ok(retSize == 0, "expected 0, got %d\n", retSize);
1060     CloseHandle(fh);
1061
1062     rc = GetFileAttributesA(file);
1063     rc &= ~(FILE_ATTRIBUTE_NOT_CONTENT_INDEXED|FILE_ATTRIBUTE_COMPRESSED);
1064 todo_wine
1065     ok(rc == (FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY),
1066        "expected FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY got %#x\n", rc);
1067
1068     SetLastError(0xdeadbeef);
1069     rc = SetFileAttributesA(file, FILE_ATTRIBUTE_ARCHIVE);
1070     ok(rc, "SetFileAttributes error %d\n", GetLastError());
1071     SetLastError(0xdeadbeef);
1072     rc = DeleteFileA(file);
1073     ok(rc, "DeleteFile error %d\n", GetLastError());
1074
1075     SetLastError(0xdeadbeef);
1076     fh = CreateFileA(file, FILE_READ_DATA, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_READONLY, 0);
1077     ok(fh != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
1078     retSize = 0xdeadbeef;
1079     SetLastError(0xdeadbeef);
1080     rc = WriteFile(fh, "1", 1, &retSize, NULL);
1081     ok(!rc, "WriteFile should fail\n");
1082     ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1083     ok(retSize == 0, "expected 0, got %d\n", retSize);
1084     CloseHandle(fh);
1085
1086     rc = GetFileAttributesA(file);
1087     rc &= ~(FILE_ATTRIBUTE_NOT_CONTENT_INDEXED|FILE_ATTRIBUTE_COMPRESSED);
1088     ok(rc == (FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY),
1089        "expected FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY got %#x\n", rc);
1090
1091     retSize = 0xdeadbeef;
1092     SetLastError(0xdeadbeef);
1093     rc = GetFileSecurityA(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
1094                           sd, sdSize, &retSize);
1095     ok(rc, "GetFileSecurity error %d\n", GetLastError());
1096     ok(retSize == sdSize || broken(retSize == 0) /* NT4 */, "expected %d, got %d\n", sdSize, retSize);
1097
1098     priv_set_len = sizeof(priv_set);
1099     granted = 0xdeadbeef;
1100     status = 0xdeadbeef;
1101     SetLastError(0xdeadbeef);
1102     rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
1103     ok(rc, "AccessCheck error %d\n", GetLastError());
1104     ok(status == 1, "expected 1, got %d\n", status);
1105     ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
1106
1107     granted = 0xdeadbeef;
1108     status = 0xdeadbeef;
1109     SetLastError(0xdeadbeef);
1110     rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
1111     ok(rc, "AccessCheck error %d\n", GetLastError());
1112 todo_wine {
1113     ok(status == 1, "expected 1, got %d\n", status);
1114     ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
1115 }
1116     granted = 0xdeadbeef;
1117     status = 0xdeadbeef;
1118     SetLastError(0xdeadbeef);
1119     rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
1120     ok(rc, "AccessCheck error %d\n", GetLastError());
1121     ok(status == 1, "expected 1, got %d\n", status);
1122     ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
1123
1124     granted = 0xdeadbeef;
1125     status = 0xdeadbeef;
1126     SetLastError(0xdeadbeef);
1127     rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status);
1128     ok(rc, "AccessCheck error %d\n", GetLastError());
1129 todo_wine {
1130     ok(status == 1, "expected 1, got %d\n", status);
1131     ok(granted == DELETE, "expected DELETE, got %#x\n", granted);
1132 }
1133     granted = 0xdeadbeef;
1134     status = 0xdeadbeef;
1135     SetLastError(0xdeadbeef);
1136     rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
1137     ok(rc, "AccessCheck error %d\n", GetLastError());
1138 todo_wine {
1139     ok(status == 1, "expected 1, got %d\n", status);
1140     ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
1141 }
1142     granted = 0xdeadbeef;
1143     status = 0xdeadbeef;
1144     SetLastError(0xdeadbeef);
1145     rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
1146     ok(rc, "AccessCheck error %d\n", GetLastError());
1147 todo_wine {
1148     ok(status == 1, "expected 1, got %d\n", status);
1149     ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
1150 }
1151     granted = 0xdeadbeef;
1152     status = 0xdeadbeef;
1153     SetLastError(0xdeadbeef);
1154     rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
1155     ok(rc, "AccessCheck error %d\n", GetLastError());
1156 todo_wine {
1157     ok(status == 1, "expected 1, got %d\n", status);
1158     ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
1159 }
1160     SetLastError(0xdeadbeef);
1161     rc = DeleteFileA(file);
1162     ok(!rc, "DeleteFile should fail\n");
1163     ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1164     SetLastError(0xdeadbeef);
1165     rc = SetFileAttributesA(file, FILE_ATTRIBUTE_ARCHIVE);
1166     ok(rc, "SetFileAttributes error %d\n", GetLastError());
1167     SetLastError(0xdeadbeef);
1168     rc = DeleteFileA(file);
1169     ok(rc, "DeleteFile error %d\n", GetLastError());
1170
1171     CloseHandle(token);
1172     HeapFree(GetProcessHeap(), 0, sd);
1173 }
1174
1175 static void test_AccessCheck(void)
1176 {
1177     PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL;
1178     PACL Acl = NULL;
1179     SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
1180     SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
1181     SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1182     GENERIC_MAPPING Mapping = { KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS };
1183     ACCESS_MASK Access;
1184     BOOL AccessStatus;
1185     HANDLE Token;
1186     HANDLE ProcessToken;
1187     BOOL ret;
1188     DWORD PrivSetLen;
1189     PRIVILEGE_SET *PrivSet;
1190     BOOL res;
1191     HMODULE NtDllModule;
1192     BOOLEAN Enabled;
1193     DWORD err;
1194     NTSTATUS ntret, ntAccessStatus;
1195
1196     NtDllModule = GetModuleHandleA("ntdll.dll");
1197     if (!NtDllModule)
1198     {
1199         skip("not running on NT, skipping test\n");
1200         return;
1201     }
1202     pRtlAdjustPrivilege = (void *)GetProcAddress(NtDllModule, "RtlAdjustPrivilege");
1203     if (!pRtlAdjustPrivilege)
1204     {
1205         win_skip("missing RtlAdjustPrivilege, skipping test\n");
1206         return;
1207     }
1208
1209     Acl = HeapAlloc(GetProcessHeap(), 0, 256);
1210     res = InitializeAcl(Acl, 256, ACL_REVISION);
1211     if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
1212     {
1213         skip("ACLs not implemented - skipping tests\n");
1214         HeapFree(GetProcessHeap(), 0, Acl);
1215         return;
1216     }
1217     ok(res, "InitializeAcl failed with error %d\n", GetLastError());
1218
1219     res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
1220     ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1221
1222     res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1223         DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdminSid);
1224     ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1225
1226     res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1227         DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
1228     ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1229
1230     SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
1231
1232     res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
1233     ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1234
1235     res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1236     ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1237
1238     PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
1239     PrivSet = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PrivSetLen);
1240     PrivSet->PrivilegeCount = 16;
1241
1242     res = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &ProcessToken);
1243     ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
1244
1245     pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, FALSE, TRUE, &Enabled);
1246
1247     res = DuplicateToken(ProcessToken, SecurityImpersonation, &Token);
1248     ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1249
1250     /* SD without owner/group */
1251     SetLastError(0xdeadbeef);
1252     Access = AccessStatus = 0x1abe11ed;
1253     ret = AccessCheck(SecurityDescriptor, Token, KEY_QUERY_VALUE, &Mapping,
1254                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1255     err = GetLastError();
1256     ok(!ret && err == ERROR_INVALID_SECURITY_DESCR, "AccessCheck should have "
1257        "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err);
1258     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1259        "Access and/or AccessStatus were changed!\n");
1260
1261     /* Set owner and group */
1262     res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
1263     ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1264     res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, TRUE);
1265     ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1266
1267     /* Generic access mask */
1268     SetLastError(0xdeadbeef);
1269     Access = AccessStatus = 0x1abe11ed;
1270     ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1271                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1272     err = GetLastError();
1273     ok(!ret && err == ERROR_GENERIC_NOT_MAPPED, "AccessCheck should have failed "
1274        "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err);
1275     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1276        "Access and/or AccessStatus were changed!\n");
1277
1278     /* Generic access mask - no privilegeset buffer */
1279     SetLastError(0xdeadbeef);
1280     Access = AccessStatus = 0x1abe11ed;
1281     ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1282                       NULL, &PrivSetLen, &Access, &AccessStatus);
1283     err = GetLastError();
1284     ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1285        "with ERROR_NOACCESS, instead of %d\n", err);
1286     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1287        "Access and/or AccessStatus were changed!\n");
1288
1289     /* Generic access mask - no returnlength */
1290     SetLastError(0xdeadbeef);
1291     Access = AccessStatus = 0x1abe11ed;
1292     ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1293                       PrivSet, NULL, &Access, &AccessStatus);
1294     err = GetLastError();
1295     ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1296        "with ERROR_NOACCESS, instead of %d\n", err);
1297     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1298        "Access and/or AccessStatus were changed!\n");
1299
1300     /* Generic access mask - no privilegeset buffer, no returnlength */
1301     SetLastError(0xdeadbeef);
1302     Access = AccessStatus = 0x1abe11ed;
1303     ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1304                       NULL, NULL, &Access, &AccessStatus);
1305     err = GetLastError();
1306     ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1307        "with ERROR_NOACCESS, instead of %d\n", err);
1308     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1309        "Access and/or AccessStatus were changed!\n");
1310
1311     /* sd with no dacl present */
1312     Access = AccessStatus = 0x1abe11ed;
1313     ret = SetSecurityDescriptorDacl(SecurityDescriptor, FALSE, NULL, FALSE);
1314     ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1315     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1316                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1317     ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1318     ok(AccessStatus && (Access == KEY_READ),
1319         "AccessCheck failed to grant access with error %d\n",
1320         GetLastError());
1321
1322     /* sd with no dacl present - no privilegeset buffer */
1323     SetLastError(0xdeadbeef);
1324     Access = AccessStatus = 0x1abe11ed;
1325     ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1326                       NULL, &PrivSetLen, &Access, &AccessStatus);
1327     err = GetLastError();
1328     ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1329        "with ERROR_NOACCESS, instead of %d\n", err);
1330     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1331        "Access and/or AccessStatus were changed!\n");
1332
1333     if(pNtAccessCheck)
1334     {
1335        /* Generic access mask - no privilegeset buffer */
1336        SetLastError(0xdeadbeef);
1337        Access = ntAccessStatus = 0x1abe11ed;
1338        ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1339                               NULL, &PrivSetLen, &Access, &ntAccessStatus);
1340        err = GetLastError();
1341        ok(ntret == STATUS_ACCESS_VIOLATION,
1342           "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1343        ok(err == 0xdeadbeef,
1344           "NtAccessCheck shouldn't set last error, got %d\n", err);
1345        ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1346           "Access and/or AccessStatus were changed!\n");
1347
1348       /* Generic access mask - no returnlength */
1349       SetLastError(0xdeadbeef);
1350       Access = ntAccessStatus = 0x1abe11ed;
1351       ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1352                              PrivSet, NULL, &Access, &ntAccessStatus);
1353       err = GetLastError();
1354       ok(ntret == STATUS_ACCESS_VIOLATION,
1355          "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1356       ok(err == 0xdeadbeef,
1357          "NtAccessCheck shouldn't set last error, got %d\n", err);
1358       ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1359          "Access and/or AccessStatus were changed!\n");
1360
1361       /* Generic access mask - no privilegeset buffer, no returnlength */
1362       SetLastError(0xdeadbeef);
1363       Access = ntAccessStatus = 0x1abe11ed;
1364       ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1365                              NULL, NULL, &Access, &ntAccessStatus);
1366       err = GetLastError();
1367       ok(ntret == STATUS_ACCESS_VIOLATION,
1368          "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1369       ok(err == 0xdeadbeef,
1370          "NtAccessCheck shouldn't set last error, got %d\n", err);
1371       ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1372          "Access and/or AccessStatus were changed!\n");
1373     }
1374     else
1375        win_skip("NtAccessCheck unavailable. Skipping.\n");
1376
1377     /* sd with NULL dacl */
1378     Access = AccessStatus = 0x1abe11ed;
1379     ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, NULL, FALSE);
1380     ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1381     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1382                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1383     ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1384     ok(AccessStatus && (Access == KEY_READ),
1385         "AccessCheck failed to grant access with error %d\n",
1386         GetLastError());
1387
1388     /* sd with blank dacl */
1389     ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1390     ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1391     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1392                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1393     ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1394     err = GetLastError();
1395     ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1396        "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1397     ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1398
1399     res = AddAccessAllowedAce(Acl, ACL_REVISION, KEY_READ, EveryoneSid);
1400     ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
1401
1402     res = AddAccessDeniedAce(Acl, ACL_REVISION, KEY_SET_VALUE, AdminSid);
1403     ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1404
1405     /* sd with dacl */
1406     Access = AccessStatus = 0x1abe11ed;
1407     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1408                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1409     ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1410     ok(AccessStatus && (Access == KEY_READ),
1411         "AccessCheck failed to grant access with error %d\n",
1412         GetLastError());
1413
1414     ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1415                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1416     ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1417     ok(AccessStatus,
1418         "AccessCheck failed to grant any access with error %d\n",
1419         GetLastError());
1420     trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access);
1421
1422     /* Null PrivSet with null PrivSetLen pointer */
1423     SetLastError(0xdeadbeef);
1424     Access = AccessStatus = 0x1abe11ed;
1425     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1426                       NULL, NULL, &Access, &AccessStatus);
1427     err = GetLastError();
1428     ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have "
1429        "failed with ERROR_NOACCESS, instead of %d\n", err);
1430     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1431        "Access and/or AccessStatus were changed!\n");
1432
1433     /* Null PrivSet with zero PrivSetLen */
1434     SetLastError(0xdeadbeef);
1435     Access = AccessStatus = 0x1abe11ed;
1436     PrivSetLen = 0;
1437     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1438                       0, &PrivSetLen, &Access, &AccessStatus);
1439     err = GetLastError();
1440     ok(!ret && err == ERROR_INSUFFICIENT_BUFFER, "AccessCheck should have "
1441        "failed with ERROR_INSUFFICIENT_BUFFER, instead of %d\n", err);
1442     ok(PrivSetLen == sizeof(PRIVILEGE_SET), "PrivSetLen returns %d\n", PrivSetLen);
1443     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1444        "Access and/or AccessStatus were changed!\n");
1445
1446     /* Null PrivSet with insufficient PrivSetLen */
1447     SetLastError(0xdeadbeef);
1448     Access = AccessStatus = 0x1abe11ed;
1449     PrivSetLen = 1;
1450     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1451                       0, &PrivSetLen, &Access, &AccessStatus);
1452     err = GetLastError();
1453     ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have "
1454        "failed with ERROR_NOACCESS, instead of %d\n", err);
1455     ok(PrivSetLen == 1, "PrivSetLen returns %d\n", PrivSetLen);
1456     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1457        "Access and/or AccessStatus were changed!\n");
1458
1459     /* Null PrivSet with insufficient PrivSetLen */
1460     SetLastError(0xdeadbeef);
1461     Access = AccessStatus = 0x1abe11ed;
1462     PrivSetLen = sizeof(PRIVILEGE_SET) - 1;
1463     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1464                       0, &PrivSetLen, &Access, &AccessStatus);
1465     err = GetLastError();
1466     ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have "
1467        "failed with ERROR_NOACCESS, instead of %d\n", err);
1468     ok(PrivSetLen == sizeof(PRIVILEGE_SET) - 1, "PrivSetLen returns %d\n", PrivSetLen);
1469     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1470        "Access and/or AccessStatus were changed!\n");
1471
1472     /* Null PrivSet with minimal sufficient PrivSetLen */
1473     SetLastError(0xdeadbeef);
1474     Access = AccessStatus = 0x1abe11ed;
1475     PrivSetLen = sizeof(PRIVILEGE_SET);
1476     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1477                       0, &PrivSetLen, &Access, &AccessStatus);
1478     err = GetLastError();
1479     ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have "
1480        "failed with ERROR_NOACCESS, instead of %d\n", err);
1481     ok(PrivSetLen == sizeof(PRIVILEGE_SET), "PrivSetLen returns %d\n", PrivSetLen);
1482     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1483        "Access and/or AccessStatus were changed!\n");
1484
1485     /* Valid PrivSet with zero PrivSetLen */
1486     SetLastError(0xdeadbeef);
1487     Access = AccessStatus = 0x1abe11ed;
1488     PrivSetLen = 0;
1489     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1490                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1491     err = GetLastError();
1492     ok(!ret && err == ERROR_INSUFFICIENT_BUFFER, "AccessCheck should have "
1493        "failed with ERROR_INSUFFICIENT_BUFFER, instead of %d\n", err);
1494     ok(PrivSetLen == sizeof(PRIVILEGE_SET), "PrivSetLen returns %d\n", PrivSetLen);
1495     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1496        "Access and/or AccessStatus were changed!\n");
1497
1498     /* Valid PrivSet with insufficient PrivSetLen */
1499     SetLastError(0xdeadbeef);
1500     Access = AccessStatus = 0x1abe11ed;
1501     PrivSetLen = 1;
1502     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1503                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1504     err = GetLastError();
1505 todo_wine
1506     ok(!ret && err == ERROR_INSUFFICIENT_BUFFER, "AccessCheck should have "
1507        "failed with ERROR_INSUFFICIENT_BUFFER, instead of %d\n", err);
1508 todo_wine
1509     ok(PrivSetLen == sizeof(PRIVILEGE_SET), "PrivSetLen returns %d\n", PrivSetLen);
1510     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1511        "Access and/or AccessStatus were changed!\n");
1512
1513     /* Valid PrivSet with insufficient PrivSetLen */
1514     SetLastError(0xdeadbeef);
1515     Access = AccessStatus = 0x1abe11ed;
1516     PrivSetLen = sizeof(PRIVILEGE_SET) - 1;
1517     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1518                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1519     err = GetLastError();
1520 todo_wine
1521     ok(!ret && err == ERROR_INSUFFICIENT_BUFFER, "AccessCheck should have "
1522        "failed with ERROR_INSUFFICIENT_BUFFER, instead of %d\n", err);
1523 todo_wine
1524     ok(PrivSetLen == sizeof(PRIVILEGE_SET), "PrivSetLen returns %d\n", PrivSetLen);
1525 todo_wine
1526     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1527        "Access and/or AccessStatus were changed!\n");
1528
1529     /* Valid PrivSet with minimal sufficient PrivSetLen */
1530     SetLastError(0xdeadbeef);
1531     Access = AccessStatus = 0x1abe11ed;
1532     PrivSetLen = sizeof(PRIVILEGE_SET);
1533     memset(PrivSet, 0xcc, PrivSetLen);
1534     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1535                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1536     err = GetLastError();
1537     ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1538 todo_wine
1539     ok(PrivSetLen == sizeof(PRIVILEGE_SET), "PrivSetLen returns %d\n", PrivSetLen);
1540     ok(AccessStatus && (Access == KEY_READ),
1541         "AccessCheck failed to grant access with error %d\n", GetLastError());
1542     ok(PrivSet->PrivilegeCount == 0, "PrivilegeCount returns %d, expects 0\n",
1543         PrivSet->PrivilegeCount);
1544
1545     /* Valid PrivSet with sufficient PrivSetLen */
1546     SetLastError(0xdeadbeef);
1547     Access = AccessStatus = 0x1abe11ed;
1548     PrivSetLen = sizeof(PRIVILEGE_SET) + 1;
1549     memset(PrivSet, 0xcc, PrivSetLen);
1550     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1551                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1552     err = GetLastError();
1553     ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1554 todo_wine
1555     ok(PrivSetLen == sizeof(PRIVILEGE_SET) + 1, "PrivSetLen returns %d\n", PrivSetLen);
1556     ok(AccessStatus && (Access == KEY_READ),
1557         "AccessCheck failed to grant access with error %d\n", GetLastError());
1558     ok(PrivSet->PrivilegeCount == 0, "PrivilegeCount returns %d, expects 0\n",
1559         PrivSet->PrivilegeCount);
1560
1561     PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
1562
1563     /* Null PrivSet with valid PrivSetLen */
1564     SetLastError(0xdeadbeef);
1565     Access = AccessStatus = 0x1abe11ed;
1566     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1567                       0, &PrivSetLen, &Access, &AccessStatus);
1568     err = GetLastError();
1569     ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have "
1570        "failed with ERROR_NOACCESS, instead of %d\n", err);
1571     ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1572        "Access and/or AccessStatus were changed!\n");
1573
1574     /* Access denied by SD */
1575     SetLastError(0xdeadbeef);
1576     Access = AccessStatus = 0x1abe11ed;
1577     ret = AccessCheck(SecurityDescriptor, Token, KEY_WRITE, &Mapping,
1578                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1579     ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1580     err = GetLastError();
1581     ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1582        "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1583     ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1584
1585     SetLastError(0xdeadbeef);
1586     PrivSet->PrivilegeCount = 16;
1587     ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1588                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1589     ok(ret && !AccessStatus && GetLastError() == ERROR_PRIVILEGE_NOT_HELD,
1590         "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
1591         GetLastError());
1592
1593     ret = ImpersonateLoggedOnUser(Token);
1594     ok(ret, "ImpersonateLoggedOnUser failed with error %d\n", GetLastError());
1595     ret = pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, TRUE, TRUE, &Enabled);
1596     if (!ret)
1597     {
1598         /* Valid PrivSet with zero PrivSetLen */
1599         SetLastError(0xdeadbeef);
1600         Access = AccessStatus = 0x1abe11ed;
1601         PrivSetLen = 0;
1602         ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1603                           PrivSet, &PrivSetLen, &Access, &AccessStatus);
1604         err = GetLastError();
1605         ok(!ret && err == ERROR_INSUFFICIENT_BUFFER, "AccessCheck should have "
1606            "failed with ERROR_INSUFFICIENT_BUFFER, instead of %d\n", err);
1607         ok(PrivSetLen == sizeof(PRIVILEGE_SET), "PrivSetLen returns %d\n", PrivSetLen);
1608         ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1609            "Access and/or AccessStatus were changed!\n");
1610
1611         /* Valid PrivSet with insufficient PrivSetLen */
1612         SetLastError(0xdeadbeef);
1613         Access = AccessStatus = 0x1abe11ed;
1614         PrivSetLen = sizeof(PRIVILEGE_SET) - 1;
1615         ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1616                           PrivSet, &PrivSetLen, &Access, &AccessStatus);
1617         err = GetLastError();
1618     todo_wine
1619         ok(!ret && err == ERROR_INSUFFICIENT_BUFFER, "AccessCheck should have "
1620            "failed with ERROR_INSUFFICIENT_BUFFER, instead of %d\n", err);
1621     todo_wine
1622         ok(PrivSetLen == sizeof(PRIVILEGE_SET), "PrivSetLen returns %d\n", PrivSetLen);
1623     todo_wine
1624         ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1625            "Access and/or AccessStatus were changed!\n");
1626
1627         /* Valid PrivSet with minimal sufficient PrivSetLen */
1628         SetLastError(0xdeadbeef);
1629         Access = AccessStatus = 0x1abe11ed;
1630         PrivSetLen = sizeof(PRIVILEGE_SET);
1631         memset(PrivSet, 0xcc, PrivSetLen);
1632         ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1633                           PrivSet, &PrivSetLen, &Access, &AccessStatus);
1634         ok(ret && AccessStatus && GetLastError() == 0xdeadbeef,
1635             "AccessCheck should have succeeded, error %d\n",
1636             GetLastError());
1637         ok(Access == ACCESS_SYSTEM_SECURITY,
1638             "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
1639             Access);
1640         ok(PrivSet->PrivilegeCount == 1, "PrivilegeCount returns %d, expects 1\n",
1641             PrivSet->PrivilegeCount);
1642
1643         /* Valid PrivSet with large PrivSetLen */
1644         SetLastError(0xdeadbeef);
1645         Access = AccessStatus = 0x1abe11ed;
1646         PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
1647         memset(PrivSet, 0xcc, PrivSetLen);
1648         ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1649                           PrivSet, &PrivSetLen, &Access, &AccessStatus);
1650         ok(ret && AccessStatus && GetLastError() == 0xdeadbeef,
1651             "AccessCheck should have succeeded, error %d\n",
1652             GetLastError());
1653         ok(Access == ACCESS_SYSTEM_SECURITY,
1654             "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
1655             Access);
1656         ok(PrivSet->PrivilegeCount == 1, "PrivilegeCount returns %d, expects 1\n",
1657             PrivSet->PrivilegeCount);
1658     }
1659     else
1660         trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
1661             ret);
1662     ret = RevertToSelf();
1663     ok(ret, "RevertToSelf failed with error %d\n", GetLastError());
1664
1665     /* test INHERIT_ONLY_ACE */
1666     ret = InitializeAcl(Acl, 256, ACL_REVISION);
1667     ok(ret, "InitializeAcl failed with error %d\n", GetLastError());
1668
1669     /* NT doesn't have AddAccessAllowedAceEx. Skipping this call/test doesn't influence
1670      * the next ones.
1671      */
1672     if (pAddAccessAllowedAceEx)
1673     {
1674         ret = pAddAccessAllowedAceEx(Acl, ACL_REVISION, INHERIT_ONLY_ACE, KEY_READ, EveryoneSid);
1675         ok(ret, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1676     }
1677     else
1678         win_skip("AddAccessAllowedAceEx is not available\n");
1679
1680     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1681                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1682     ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1683     err = GetLastError();
1684     ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1685        "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1686     ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1687
1688     CloseHandle(Token);
1689
1690     res = DuplicateToken(ProcessToken, SecurityAnonymous, &Token);
1691     ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1692
1693     SetLastError(0xdeadbeef);
1694     ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1695                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1696     err = GetLastError();
1697     ok(!ret && err == ERROR_BAD_IMPERSONATION_LEVEL, "AccessCheck should have failed "
1698        "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err);
1699
1700     CloseHandle(Token);
1701
1702     SetLastError(0xdeadbeef);
1703     ret = AccessCheck(SecurityDescriptor, ProcessToken, KEY_READ, &Mapping,
1704                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
1705     err = GetLastError();
1706     ok(!ret && err == ERROR_NO_IMPERSONATION_TOKEN, "AccessCheck should have failed "
1707        "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err);
1708
1709     CloseHandle(ProcessToken);
1710
1711     if (EveryoneSid)
1712         FreeSid(EveryoneSid);
1713     if (AdminSid)
1714         FreeSid(AdminSid);
1715     if (UsersSid)
1716         FreeSid(UsersSid);
1717     HeapFree(GetProcessHeap(), 0, Acl);
1718     HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
1719     HeapFree(GetProcessHeap(), 0, PrivSet);
1720 }
1721
1722 /* test GetTokenInformation for the various attributes */
1723 static void test_token_attr(void)
1724 {
1725     HANDLE Token, ImpersonationToken;
1726     DWORD Size, Size2;
1727     TOKEN_PRIVILEGES *Privileges;
1728     TOKEN_GROUPS *Groups;
1729     TOKEN_USER *User;
1730     TOKEN_DEFAULT_DACL *Dacl;
1731     BOOL ret;
1732     DWORD i, GLE;
1733     LPSTR SidString;
1734     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1735     ACL *acl;
1736
1737     /* cygwin-like use case */
1738     SetLastError(0xdeadbeef);
1739     ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &Token);
1740     if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1741     {
1742         win_skip("OpenProcessToken is not implemented\n");
1743         return;
1744     }
1745     ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1746     if (ret)
1747     {
1748         DWORD buf[256]; /* GetTokenInformation wants a dword-aligned buffer */
1749         Size = sizeof(buf);
1750         ret = GetTokenInformation(Token, TokenUser,(void*)buf, Size, &Size);
1751         ok(ret, "GetTokenInformation failed with error %d\n", GetLastError());
1752         Size = sizeof(ImpersonationLevel);
1753         ret = GetTokenInformation(Token, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1754         GLE = GetLastError();
1755         ok(!ret && (GLE == ERROR_INVALID_PARAMETER), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE);
1756         CloseHandle(Token);
1757     }
1758
1759     if(!pConvertSidToStringSidA)
1760     {
1761         win_skip("ConvertSidToStringSidA is not available\n");
1762         return;
1763     }
1764
1765     SetLastError(0xdeadbeef);
1766     ret = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &Token);
1767     ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1768
1769     /* groups */
1770     /* insufficient buffer length */
1771     SetLastError(0xdeadbeef);
1772     Size2 = 0;
1773     ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size2);
1774     ok(Size2 > 1, "got %d\n", Size2);
1775     ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1776         "%d with error %d\n", ret, GetLastError());
1777     Size2 -= 1;
1778     Groups = HeapAlloc(GetProcessHeap(), 0, Size2);
1779     memset(Groups, 0xcc, Size2);
1780     Size = 0;
1781     ret = GetTokenInformation(Token, TokenGroups, Groups, Size2, &Size);
1782     ok(Size > 1, "got %d\n", Size);
1783     ok((!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER) || broken(ret) /* wow64 */,
1784         "%d with error %d\n", ret, GetLastError());
1785     if(!ret)
1786         ok(*((BYTE*)Groups) == 0xcc, "buffer altered\n");
1787
1788     HeapFree(GetProcessHeap(), 0, Groups);
1789
1790     SetLastError(0xdeadbeef);
1791     ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size);
1792     ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1793         "GetTokenInformation(TokenGroups) %s with error %d\n",
1794         ret ? "succeeded" : "failed", GetLastError());
1795     Groups = HeapAlloc(GetProcessHeap(), 0, Size);
1796     SetLastError(0xdeadbeef);
1797     ret = GetTokenInformation(Token, TokenGroups, Groups, Size, &Size);
1798     ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
1799     ok(GetLastError() == 0xdeadbeef,
1800        "GetTokenInformation shouldn't have set last error to %d\n",
1801        GetLastError());
1802     trace("TokenGroups:\n");
1803     for (i = 0; i < Groups->GroupCount; i++)
1804     {
1805         DWORD NameLength = 255;
1806         CHAR Name[255];
1807         DWORD DomainLength = 255;
1808         CHAR Domain[255];
1809         SID_NAME_USE SidNameUse;
1810         Name[0] = '\0';
1811         Domain[0] = '\0';
1812         ret = LookupAccountSidA(NULL, Groups->Groups[i].Sid, Name, &NameLength, Domain, &DomainLength, &SidNameUse);
1813         if (ret)
1814         {
1815             pConvertSidToStringSidA(Groups->Groups[i].Sid, &SidString);
1816             trace("%s, %s\\%s use: %d attr: 0x%08x\n", SidString, Domain, Name, SidNameUse, Groups->Groups[i].Attributes);
1817             LocalFree(SidString);
1818         }
1819         else trace("attr: 0x%08x LookupAccountSid failed with error %d\n", Groups->Groups[i].Attributes, GetLastError());
1820     }
1821     HeapFree(GetProcessHeap(), 0, Groups);
1822
1823     /* user */
1824     ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
1825     ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1826         "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1827     User = HeapAlloc(GetProcessHeap(), 0, Size);
1828     ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
1829     ok(ret,
1830         "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1831
1832     pConvertSidToStringSidA(User->User.Sid, &SidString);
1833     trace("TokenUser: %s attr: 0x%08x\n", SidString, User->User.Attributes);
1834     LocalFree(SidString);
1835     HeapFree(GetProcessHeap(), 0, User);
1836
1837     /* privileges */
1838     ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
1839     ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1840         "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1841     Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
1842     ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
1843     ok(ret,
1844         "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1845     trace("TokenPrivileges:\n");
1846     for (i = 0; i < Privileges->PrivilegeCount; i++)
1847     {
1848         CHAR Name[256];
1849         DWORD NameLen = sizeof(Name)/sizeof(Name[0]);
1850         LookupPrivilegeNameA(NULL, &Privileges->Privileges[i].Luid, Name, &NameLen);
1851         trace("\t%s, 0x%x\n", Name, Privileges->Privileges[i].Attributes);
1852     }
1853     HeapFree(GetProcessHeap(), 0, Privileges);
1854
1855     ret = DuplicateToken(Token, SecurityAnonymous, &ImpersonationToken);
1856     ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
1857
1858     Size = sizeof(ImpersonationLevel);
1859     ret = GetTokenInformation(ImpersonationToken, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1860     ok(ret, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
1861     ok(ImpersonationLevel == SecurityAnonymous, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel);
1862
1863     CloseHandle(ImpersonationToken);
1864
1865     /* default dacl */
1866     ret = GetTokenInformation(Token, TokenDefaultDacl, NULL, 0, &Size);
1867     ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1868         "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1869
1870     Dacl = HeapAlloc(GetProcessHeap(), 0, Size);
1871     ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size);
1872     ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1873
1874     SetLastError(0xdeadbeef);
1875     ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, 0);
1876     GLE = GetLastError();
1877     ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1878     ok(GLE == ERROR_BAD_LENGTH, "expected ERROR_BAD_LENGTH got %u\n", GLE);
1879
1880     SetLastError(0xdeadbeef);
1881     ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, Size);
1882     GLE = GetLastError();
1883     ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1884     ok(GLE == ERROR_NOACCESS, "expected ERROR_NOACCESS got %u\n", GLE);
1885
1886     acl = Dacl->DefaultDacl;
1887     Dacl->DefaultDacl = NULL;
1888
1889     ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1890     ok(ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1891
1892     Size2 = 0;
1893     Dacl->DefaultDacl = (ACL *)0xdeadbeef;
1894     ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1895     ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1896     ok(Dacl->DefaultDacl == NULL, "expected NULL, got %p\n", Dacl->DefaultDacl);
1897     ok(Size2 == sizeof(TOKEN_DEFAULT_DACL) || broken(Size2 == 2*sizeof(TOKEN_DEFAULT_DACL)), /* WoW64 */
1898        "got %u expected sizeof(TOKEN_DEFAULT_DACL)\n", Size2);
1899
1900     Dacl->DefaultDacl = acl;
1901     ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1902     ok(ret, "SetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1903
1904     if (Size2 == sizeof(TOKEN_DEFAULT_DACL)) {
1905         ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1906         ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1907     } else
1908         win_skip("TOKEN_DEFAULT_DACL size too small on WoW64\n");
1909
1910     HeapFree(GetProcessHeap(), 0, Dacl);
1911     CloseHandle(Token);
1912 }
1913
1914 typedef union _MAX_SID
1915 {
1916     SID sid;
1917     char max[SECURITY_MAX_SID_SIZE];
1918 } MAX_SID;
1919
1920 static void test_sid_str(PSID * sid)
1921 {
1922     char *str_sid;
1923     BOOL ret = pConvertSidToStringSidA(sid, &str_sid);
1924     ok(ret, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
1925     if (ret)
1926     {
1927         char account[MAX_PATH], domain[MAX_PATH];
1928         SID_NAME_USE use;
1929         DWORD acc_size = MAX_PATH;
1930         DWORD dom_size = MAX_PATH;
1931         ret = LookupAccountSidA (NULL, sid, account, &acc_size, domain, &dom_size, &use);
1932         ok(ret || GetLastError() == ERROR_NONE_MAPPED,
1933            "LookupAccountSid(%s) failed: %d\n", str_sid, GetLastError());
1934         if (ret)
1935             trace(" %s %s\\%s %d\n", str_sid, domain, account, use);
1936         else if (GetLastError() == ERROR_NONE_MAPPED)
1937             trace(" %s couldn't be mapped\n", str_sid);
1938         LocalFree(str_sid);
1939     }
1940 }
1941
1942 static const struct well_known_sid_value
1943 {
1944     BOOL without_domain;
1945     const char *sid_string;
1946 } well_known_sid_values[] = {
1947 /*  0 */ {TRUE, "S-1-0-0"},  {TRUE, "S-1-1-0"},  {TRUE, "S-1-2-0"},  {TRUE, "S-1-3-0"},
1948 /*  4 */ {TRUE, "S-1-3-1"},  {TRUE, "S-1-3-2"},  {TRUE, "S-1-3-3"},  {TRUE, "S-1-5"},
1949 /*  8 */ {FALSE, "S-1-5-1"}, {TRUE, "S-1-5-2"},  {TRUE, "S-1-5-3"},  {TRUE, "S-1-5-4"},
1950 /* 12 */ {TRUE, "S-1-5-6"},  {TRUE, "S-1-5-7"},  {TRUE, "S-1-5-8"},  {TRUE, "S-1-5-9"},
1951 /* 16 */ {TRUE, "S-1-5-10"}, {TRUE, "S-1-5-11"}, {TRUE, "S-1-5-12"}, {TRUE, "S-1-5-13"},
1952 /* 20 */ {TRUE, "S-1-5-14"}, {FALSE, NULL},      {TRUE, "S-1-5-18"}, {TRUE, "S-1-5-19"},
1953 /* 24 */ {TRUE, "S-1-5-20"}, {TRUE, "S-1-5-32"},
1954 /* 26 */ {FALSE, "S-1-5-32-544"}, {TRUE, "S-1-5-32-545"}, {TRUE, "S-1-5-32-546"},
1955 /* 29 */ {TRUE, "S-1-5-32-547"},  {TRUE, "S-1-5-32-548"}, {TRUE, "S-1-5-32-549"},
1956 /* 32 */ {TRUE, "S-1-5-32-550"},  {TRUE, "S-1-5-32-551"}, {TRUE, "S-1-5-32-552"},
1957 /* 35 */ {TRUE, "S-1-5-32-554"},  {TRUE, "S-1-5-32-555"}, {TRUE, "S-1-5-32-556"},
1958 /* 38 */ {FALSE, "S-1-5-21-12-23-34-45-56-500"}, {FALSE, "S-1-5-21-12-23-34-45-56-501"},
1959 /* 40 */ {FALSE, "S-1-5-21-12-23-34-45-56-502"}, {FALSE, "S-1-5-21-12-23-34-45-56-512"},
1960 /* 42 */ {FALSE, "S-1-5-21-12-23-34-45-56-513"}, {FALSE, "S-1-5-21-12-23-34-45-56-514"},
1961 /* 44 */ {FALSE, "S-1-5-21-12-23-34-45-56-515"}, {FALSE, "S-1-5-21-12-23-34-45-56-516"},
1962 /* 46 */ {FALSE, "S-1-5-21-12-23-34-45-56-517"}, {FALSE, "S-1-5-21-12-23-34-45-56-518"},
1963 /* 48 */ {FALSE, "S-1-5-21-12-23-34-45-56-519"}, {FALSE, "S-1-5-21-12-23-34-45-56-520"},
1964 /* 50 */ {FALSE, "S-1-5-21-12-23-34-45-56-553"},
1965 /* Added in Windows Server 2003 */
1966 /* 51 */ {TRUE, "S-1-5-64-10"},   {TRUE, "S-1-5-64-21"},   {TRUE, "S-1-5-64-14"},
1967 /* 54 */ {TRUE, "S-1-5-15"},      {TRUE, "S-1-5-1000"},    {FALSE, "S-1-5-32-557"},
1968 /* 57 */ {TRUE, "S-1-5-32-558"},  {TRUE, "S-1-5-32-559"},  {TRUE, "S-1-5-32-560"},
1969 /* 60 */ {TRUE, "S-1-5-32-561"}, {TRUE, "S-1-5-32-562"},
1970 /* Added in Windows Vista: */
1971 /* 62 */ {TRUE, "S-1-5-32-568"},
1972 /* 63 */ {TRUE, "S-1-5-17"},      {FALSE, "S-1-5-32-569"}, {TRUE, "S-1-16-0"},
1973 /* 66 */ {TRUE, "S-1-16-4096"},   {TRUE, "S-1-16-8192"},   {TRUE, "S-1-16-12288"},
1974 /* 69 */ {TRUE, "S-1-16-16384"},  {TRUE, "S-1-5-33"},      {TRUE, "S-1-3-4"},
1975 /* 72 */ {FALSE, "S-1-5-21-12-23-34-45-56-571"},  {FALSE, "S-1-5-21-12-23-34-45-56-572"},
1976 /* 74 */ {TRUE, "S-1-5-22"}, {FALSE, "S-1-5-21-12-23-34-45-56-521"}, {TRUE, "S-1-5-32-573"},
1977 /* 77 */ {FALSE, "S-1-5-21-12-23-34-45-56-498"}, {TRUE, "S-1-5-32-574"}, {TRUE, "S-1-16-8448"},
1978 /* 80 */ {FALSE, NULL}, {TRUE, "S-1-2-1"}, {TRUE, "S-1-5-65-1"}, {FALSE, NULL},
1979 /* 84 */ {TRUE, "S-1-15-2-1"},
1980 };
1981
1982 static void test_CreateWellKnownSid(void)
1983 {
1984     SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
1985     PSID domainsid, sid;
1986     DWORD size, error;
1987     BOOL ret;
1988     unsigned int i;
1989
1990     if (!pCreateWellKnownSid)
1991     {
1992         win_skip("CreateWellKnownSid not available\n");
1993         return;
1994     }
1995
1996     size = 0;
1997     SetLastError(0xdeadbeef);
1998     ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1999     error = GetLastError();
2000     ok(!ret, "CreateWellKnownSid succeeded\n");
2001     ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
2002     ok(size, "expected size > 0\n");
2003
2004     SetLastError(0xdeadbeef);
2005     ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
2006     error = GetLastError();
2007     ok(!ret, "CreateWellKnownSid succeeded\n");
2008     ok(error == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %u\n", error);
2009
2010     sid = HeapAlloc(GetProcessHeap(), 0, size);
2011     ret = pCreateWellKnownSid(WinInteractiveSid, NULL, sid, &size);
2012     ok(ret, "CreateWellKnownSid failed %u\n", GetLastError());
2013     HeapFree(GetProcessHeap(), 0, sid);
2014
2015     /* a domain sid usually have three subauthorities but we test that CreateWellKnownSid doesn't check it */
2016     AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
2017
2018     for (i = 0; i < sizeof(well_known_sid_values)/sizeof(well_known_sid_values[0]); i++)
2019     {
2020         const struct well_known_sid_value *value = &well_known_sid_values[i];
2021         char sid_buffer[SECURITY_MAX_SID_SIZE];
2022         LPSTR str;
2023         DWORD cb;
2024
2025         if (value->sid_string == NULL)
2026             continue;
2027
2028         /* some SIDs aren't implemented by all Windows versions - detect it */
2029         cb = sizeof(sid_buffer);
2030         if (!pCreateWellKnownSid(i, NULL, sid_buffer, &cb))
2031         {
2032             skip("Well known SID %u not implemented\n", i);
2033             continue;
2034         }
2035
2036         cb = sizeof(sid_buffer);
2037         ok(pCreateWellKnownSid(i, value->without_domain ? NULL : domainsid, sid_buffer, &cb), "Couldn't create well known sid %u\n", i);
2038         expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
2039         ok(IsValidSid(sid_buffer), "The sid is not valid\n");
2040         ok(pConvertSidToStringSidA(sid_buffer, &str), "Couldn't convert SID to string\n");
2041         ok(strcmp(str, value->sid_string) == 0, "%d: SID mismatch - expected %s, got %s\n", i,
2042             value->sid_string, str);
2043         LocalFree(str);
2044
2045         if (value->without_domain)
2046         {
2047             char buf2[SECURITY_MAX_SID_SIZE];
2048             cb = sizeof(buf2);
2049             ok(pCreateWellKnownSid(i, domainsid, buf2, &cb), "Couldn't create well known sid %u with optional domain\n", i);
2050             expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
2051             ok(memcmp(buf2, sid_buffer, cb) == 0, "SID create with domain is different than without (%u)\n", i);
2052         }
2053     }
2054
2055     FreeSid(domainsid);
2056 }
2057
2058 static void test_LookupAccountSid(void)
2059 {
2060     SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
2061     CHAR accountA[MAX_PATH], domainA[MAX_PATH], usernameA[MAX_PATH];
2062     DWORD acc_sizeA, dom_sizeA, user_sizeA;
2063     DWORD real_acc_sizeA, real_dom_sizeA;
2064     WCHAR accountW[MAX_PATH], domainW[MAX_PATH];
2065     DWORD acc_sizeW, dom_sizeW;
2066     DWORD real_acc_sizeW, real_dom_sizeW;
2067     PSID pUsersSid = NULL;
2068     SID_NAME_USE use;
2069     BOOL ret;
2070     DWORD error, size, cbti = 0;
2071     MAX_SID  max_sid;
2072     CHAR *str_sidA;
2073     int i;
2074     HANDLE hToken;
2075     PTOKEN_USER ptiUser = NULL;
2076
2077     /* native windows crashes if account size, domain size, or name use is NULL */
2078
2079     ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
2080         DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &pUsersSid);
2081     ok(ret || (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED),
2082        "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2083
2084     /* not running on NT so give up */
2085     if (!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2086         return;
2087
2088     real_acc_sizeA = MAX_PATH;
2089     real_dom_sizeA = MAX_PATH;
2090     ret = LookupAccountSidA(NULL, pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
2091     ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
2092
2093     /* try NULL account */
2094     acc_sizeA = MAX_PATH;
2095     dom_sizeA = MAX_PATH;
2096     ret = LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
2097     ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
2098
2099     /* try NULL domain */
2100     acc_sizeA = MAX_PATH;
2101     dom_sizeA = MAX_PATH;
2102     ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
2103     ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
2104
2105     /* try a small account buffer */
2106     acc_sizeA = 1;
2107     dom_sizeA = MAX_PATH;
2108     accountA[0] = 0;
2109     ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
2110     ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
2111     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2112        "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
2113
2114     /* try a 0 sized account buffer */
2115     acc_sizeA = 0;
2116     dom_sizeA = MAX_PATH;
2117     accountA[0] = 0;
2118     LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
2119     /* this can fail or succeed depending on OS version but the size will always be returned */
2120     ok(acc_sizeA == real_acc_sizeA + 1,
2121        "LookupAccountSidA() Expected acc_size = %u, got %u\n",
2122        real_acc_sizeA + 1, acc_sizeA);
2123
2124     /* try a 0 sized account buffer */
2125     acc_sizeA = 0;
2126     dom_sizeA = MAX_PATH;
2127     LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
2128     /* this can fail or succeed depending on OS version but the size will always be returned */
2129     ok(acc_sizeA == real_acc_sizeA + 1,
2130        "LookupAccountSid() Expected acc_size = %u, got %u\n",
2131        real_acc_sizeA + 1, acc_sizeA);
2132
2133     /* try a small domain buffer */
2134     dom_sizeA = 1;
2135     acc_sizeA = MAX_PATH;
2136     accountA[0] = 0;
2137     ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
2138     ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
2139     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2140        "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
2141
2142     /* try a 0 sized domain buffer */
2143     dom_sizeA = 0;
2144     acc_sizeA = MAX_PATH;
2145     accountA[0] = 0;
2146     LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
2147     /* this can fail or succeed depending on OS version but the size will always be returned */
2148     ok(dom_sizeA == real_dom_sizeA + 1,
2149        "LookupAccountSidA() Expected dom_size = %u, got %u\n",
2150        real_dom_sizeA + 1, dom_sizeA);
2151
2152     /* try a 0 sized domain buffer */
2153     dom_sizeA = 0;
2154     acc_sizeA = MAX_PATH;
2155     LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
2156     /* this can fail or succeed depending on OS version but the size will always be returned */
2157     ok(dom_sizeA == real_dom_sizeA + 1,
2158        "LookupAccountSidA() Expected dom_size = %u, got %u\n",
2159        real_dom_sizeA + 1, dom_sizeA);
2160
2161     real_acc_sizeW = MAX_PATH;
2162     real_dom_sizeW = MAX_PATH;
2163     ret = LookupAccountSidW(NULL, pUsersSid, accountW, &real_acc_sizeW, domainW, &real_dom_sizeW, &use);
2164     ok(ret, "LookupAccountSidW() Expected TRUE, got FALSE\n");
2165
2166     /* try an invalid system name */
2167     real_acc_sizeA = MAX_PATH;
2168     real_dom_sizeA = MAX_PATH;
2169     ret = LookupAccountSidA("deepthought", pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
2170     ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
2171     ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
2172        "LookupAccountSidA() Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %u\n", GetLastError());
2173
2174     /* native windows crashes if domainW or accountW is NULL */
2175
2176     /* try a small account buffer */
2177     acc_sizeW = 1;
2178     dom_sizeW = MAX_PATH;
2179     accountW[0] = 0;
2180     ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
2181     ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
2182     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2183        "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
2184
2185     /* try a 0 sized account buffer */
2186     acc_sizeW = 0;
2187     dom_sizeW = MAX_PATH;
2188     accountW[0] = 0;
2189     LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
2190     /* this can fail or succeed depending on OS version but the size will always be returned */
2191     ok(acc_sizeW == real_acc_sizeW + 1,
2192        "LookupAccountSidW() Expected acc_size = %u, got %u\n",
2193        real_acc_sizeW + 1, acc_sizeW);
2194
2195     /* try a 0 sized account buffer */
2196     acc_sizeW = 0;
2197     dom_sizeW = MAX_PATH;
2198     LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, domainW, &dom_sizeW, &use);
2199     /* this can fail or succeed depending on OS version but the size will always be returned */
2200     ok(acc_sizeW == real_acc_sizeW + 1,
2201        "LookupAccountSidW() Expected acc_size = %u, got %u\n",
2202        real_acc_sizeW + 1, acc_sizeW);
2203
2204     /* try a small domain buffer */
2205     dom_sizeW = 1;
2206     acc_sizeW = MAX_PATH;
2207     accountW[0] = 0;
2208     ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
2209     ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
2210     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2211        "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
2212
2213     /* try a 0 sized domain buffer */
2214     dom_sizeW = 0;
2215     acc_sizeW = MAX_PATH;
2216     accountW[0] = 0;
2217     LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
2218     /* this can fail or succeed depending on OS version but the size will always be returned */
2219     ok(dom_sizeW == real_dom_sizeW + 1,
2220        "LookupAccountSidW() Expected dom_size = %u, got %u\n",
2221        real_dom_sizeW + 1, dom_sizeW);
2222
2223     /* try a 0 sized domain buffer */
2224     dom_sizeW = 0;
2225     acc_sizeW = MAX_PATH;
2226     LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, NULL, &dom_sizeW, &use);
2227     /* this can fail or succeed depending on OS version but the size will always be returned */
2228     ok(dom_sizeW == real_dom_sizeW + 1,
2229        "LookupAccountSidW() Expected dom_size = %u, got %u\n",
2230        real_dom_sizeW + 1, dom_sizeW);
2231
2232     acc_sizeW = dom_sizeW = use = 0;
2233     SetLastError(0xdeadbeef);
2234     ret = LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, NULL, &dom_sizeW, &use);
2235     error = GetLastError();
2236     ok(!ret, "LookupAccountSidW failed %u\n", GetLastError());
2237     ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
2238     ok(acc_sizeW, "expected non-zero account size\n");
2239     ok(dom_sizeW, "expected non-zero domain size\n");
2240     ok(!use, "expected zero use %u\n", use);
2241
2242     FreeSid(pUsersSid);
2243
2244     /* Test LookupAccountSid with Sid retrieved from token information.
2245      This assumes this process is running under the account of the current user.*/
2246     ret = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY|TOKEN_DUPLICATE, &hToken);
2247     ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
2248     ret = GetTokenInformation(hToken, TokenUser, NULL, 0, &cbti);
2249     ok(!ret, "GetTokenInformation failed with error %d\n", GetLastError());
2250     ptiUser = HeapAlloc(GetProcessHeap(), 0, cbti);
2251     if (GetTokenInformation(hToken, TokenUser, ptiUser, cbti, &cbti))
2252     {
2253         acc_sizeA = dom_sizeA = MAX_PATH;
2254         ret = LookupAccountSidA(NULL, ptiUser->User.Sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
2255         ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
2256         user_sizeA = MAX_PATH;
2257         ret = GetUserNameA(usernameA , &user_sizeA);
2258         ok(ret, "GetUserNameA() Expected TRUE, got FALSE\n");
2259         ok(lstrcmpA(usernameA, accountA) == 0, "LookupAccountSidA() Expected account name: %s got: %s\n", usernameA, accountA );
2260     }
2261     HeapFree(GetProcessHeap(), 0, ptiUser);
2262
2263     if (pCreateWellKnownSid && pConvertSidToStringSidA)
2264     {
2265         trace("Well Known SIDs:\n");
2266         for (i = 0; i <= 60; i++)
2267         {
2268             size = SECURITY_MAX_SID_SIZE;
2269             if (pCreateWellKnownSid(i, NULL, &max_sid.sid, &size))
2270             {
2271                 if (pConvertSidToStringSidA(&max_sid.sid, &str_sidA))
2272                 {
2273                     acc_sizeA = MAX_PATH;
2274                     dom_sizeA = MAX_PATH;
2275                     if (LookupAccountSidA(NULL, &max_sid.sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use))
2276                         trace(" %d: %s %s\\%s %d\n", i, str_sidA, domainA, accountA, use);
2277                     LocalFree(str_sidA);
2278                 }
2279             }
2280             else
2281             {
2282                 if (GetLastError() != ERROR_INVALID_PARAMETER)
2283                     trace(" CreateWellKnownSid(%d) failed: %d\n", i, GetLastError());
2284                 else
2285                     trace(" %d: not supported\n", i);
2286             }
2287         }
2288
2289         pLsaQueryInformationPolicy = (void *)GetProcAddress( hmod, "LsaQueryInformationPolicy");
2290         pLsaOpenPolicy = (void *)GetProcAddress( hmod, "LsaOpenPolicy");
2291         pLsaFreeMemory = (void *)GetProcAddress( hmod, "LsaFreeMemory");
2292         pLsaClose = (void *)GetProcAddress( hmod, "LsaClose");
2293
2294         if (pLsaQueryInformationPolicy && pLsaOpenPolicy && pLsaFreeMemory && pLsaClose)
2295         {
2296             NTSTATUS status;
2297             LSA_HANDLE handle;
2298             LSA_OBJECT_ATTRIBUTES object_attributes;
2299
2300             ZeroMemory(&object_attributes, sizeof(object_attributes));
2301             object_attributes.Length = sizeof(object_attributes);
2302
2303             status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_ALL_ACCESS, &handle);
2304             ok(status == STATUS_SUCCESS || status == STATUS_ACCESS_DENIED,
2305                "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status);
2306
2307             /* try a more restricted access mask if necessary */
2308             if (status == STATUS_ACCESS_DENIED) {
2309                 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
2310                 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_VIEW_LOCAL_INFORMATION, &handle);
2311                 ok(status == STATUS_SUCCESS, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status);
2312             }
2313
2314             if (status == STATUS_SUCCESS)
2315             {
2316                 PPOLICY_ACCOUNT_DOMAIN_INFO info;
2317                 status = pLsaQueryInformationPolicy(handle, PolicyAccountDomainInformation, (PVOID*)&info);
2318                 ok(status == STATUS_SUCCESS, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status);
2319                 if (status == STATUS_SUCCESS)
2320                 {
2321                     ok(info->DomainSid!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
2322                     if (info->DomainSid)
2323                     {
2324                         int count = *GetSidSubAuthorityCount(info->DomainSid);
2325                         CopySid(GetSidLengthRequired(count), &max_sid, info->DomainSid);
2326                         test_sid_str((PSID)&max_sid.sid);
2327                         max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_ADMIN;
2328                         max_sid.sid.SubAuthorityCount = count + 1;
2329                         test_sid_str((PSID)&max_sid.sid);
2330                         max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_GUEST;
2331                         test_sid_str((PSID)&max_sid.sid);
2332                         max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ADMINS;
2333                         test_sid_str((PSID)&max_sid.sid);
2334                         max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_USERS;
2335                         test_sid_str((PSID)&max_sid.sid);
2336                         max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_GUESTS;
2337                         test_sid_str((PSID)&max_sid.sid);
2338                         max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_COMPUTERS;
2339                         test_sid_str((PSID)&max_sid.sid);
2340                         max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CONTROLLERS;
2341                         test_sid_str((PSID)&max_sid.sid);
2342                         max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CERT_ADMINS;
2343                         test_sid_str((PSID)&max_sid.sid);
2344                         max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_SCHEMA_ADMINS;
2345                         test_sid_str((PSID)&max_sid.sid);
2346                         max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS;
2347                         test_sid_str((PSID)&max_sid.sid);
2348                         max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_POLICY_ADMINS;
2349                         test_sid_str((PSID)&max_sid.sid);
2350                         max_sid.sid.SubAuthority[count] = DOMAIN_ALIAS_RID_RAS_SERVERS;
2351                         test_sid_str((PSID)&max_sid.sid);
2352                         max_sid.sid.SubAuthority[count] = 1000; /* first user account */
2353                         test_sid_str((PSID)&max_sid.sid);
2354                     }
2355
2356                     pLsaFreeMemory((LPVOID)info);
2357                 }
2358
2359                 status = pLsaClose(handle);
2360                 ok(status == STATUS_SUCCESS, "LsaClose() failed, returned 0x%08x\n", status);
2361             }
2362         }
2363     }
2364 }
2365
2366 static BOOL get_sid_info(PSID psid, LPSTR *user, LPSTR *dom)
2367 {
2368     static CHAR account[UNLEN + 1];
2369     static CHAR domain[UNLEN + 1];
2370     DWORD size, dom_size;
2371     SID_NAME_USE use;
2372
2373     *user = account;
2374     *dom = domain;
2375
2376     size = dom_size = UNLEN + 1;
2377     account[0] = '\0';
2378     domain[0] = '\0';
2379     SetLastError(0xdeadbeef);
2380     return LookupAccountSidA(NULL, psid, account, &size, domain, &dom_size, &use);
2381 }
2382
2383 static void check_wellknown_name(const char* name, WELL_KNOWN_SID_TYPE result)
2384 {
2385     SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
2386     PSID domainsid = NULL;
2387     char wk_sid[SECURITY_MAX_SID_SIZE];
2388     DWORD cb;
2389
2390     DWORD sid_size, domain_size;
2391     SID_NAME_USE sid_use;
2392     LPSTR domain, account, sid_domain, wk_domain, wk_account;
2393     PSID psid;
2394     BOOL ret ,ret2;
2395
2396     sid_size = 0;
2397     domain_size = 0;
2398     ret = LookupAccountNameA(NULL, name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2399     ok(!ret, " %s Should have failed to lookup account name\n", name);
2400     psid = HeapAlloc(GetProcessHeap(),0,sid_size);
2401     domain = HeapAlloc(GetProcessHeap(),0,domain_size);
2402     ret = LookupAccountNameA(NULL, name, psid, &sid_size, domain, &domain_size, &sid_use);
2403
2404     if (!result)
2405     {
2406         ok(!ret, " %s Should have failed to lookup account name\n",name);
2407         goto cleanup;
2408     }
2409
2410     AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
2411     cb = sizeof(wk_sid);
2412     if (!pCreateWellKnownSid(result, domainsid, wk_sid, &cb))
2413     {
2414         win_skip("SID %i is not available on the system\n",result);
2415         goto cleanup;
2416     }
2417
2418     ret2 = get_sid_info(wk_sid, &wk_account, &wk_domain);
2419     if (!ret2 && GetLastError() == ERROR_NONE_MAPPED)
2420     {
2421         win_skip("CreateWellKnownSid() succeeded but the account '%s' is not present (W2K)\n", name);
2422         goto cleanup;
2423     }
2424
2425     get_sid_info(psid, &account, &sid_domain);
2426
2427     ok(ret, "Failed to lookup account name %s\n",name);
2428     ok(sid_size != 0, "sid_size was zero\n");
2429
2430     ok(EqualSid(psid,wk_sid),"%s Sid %s fails to match well known sid %s!\n",
2431        name, debugstr_sid(psid), debugstr_sid(wk_sid));
2432
2433     ok(!lstrcmpA(account, wk_account), "Expected %s , got %s\n", account, wk_account);
2434     ok(!lstrcmpA(domain, wk_domain), "Expected %s, got %s\n", wk_domain, domain);
2435     ok(sid_use == SidTypeWellKnownGroup , "Expected Use (5), got %d\n", sid_use);
2436
2437 cleanup:
2438     FreeSid(domainsid);
2439     HeapFree(GetProcessHeap(),0,psid);
2440     HeapFree(GetProcessHeap(),0,domain);
2441 }
2442
2443 static void test_LookupAccountName(void)
2444 {
2445     DWORD sid_size, domain_size, user_size;
2446     DWORD sid_save, domain_save;
2447     CHAR user_name[UNLEN + 1];
2448     CHAR computer_name[UNLEN + 1];
2449     SID_NAME_USE sid_use;
2450     LPSTR domain, account, sid_dom;
2451     PSID psid;
2452     BOOL ret;
2453
2454     /* native crashes if (assuming all other parameters correct):
2455      *  - peUse is NULL
2456      *  - Sid is NULL and cbSid is > 0
2457      *  - cbSid or cchReferencedDomainName are NULL
2458      *  - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
2459      */
2460
2461     user_size = UNLEN + 1;
2462     SetLastError(0xdeadbeef);
2463     ret = GetUserNameA(user_name, &user_size);
2464     ok(ret, "Failed to get user name : %d\n", GetLastError());
2465
2466     /* get sizes */
2467     sid_size = 0;
2468     domain_size = 0;
2469     sid_use = 0xcafebabe;
2470     SetLastError(0xdeadbeef);
2471     ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2472     if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2473     {
2474         win_skip("LookupAccountNameA is not implemented\n");
2475         return;
2476     }
2477     ok(!ret, "Expected 0, got %d\n", ret);
2478     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2479        "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2480     ok(sid_size != 0, "Expected non-zero sid size\n");
2481     ok(domain_size != 0, "Expected non-zero domain size\n");
2482     ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2483
2484     sid_save = sid_size;
2485     domain_save = domain_size;
2486
2487     psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2488     domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2489
2490     /* try valid account name */
2491     ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, domain, &domain_size, &sid_use);
2492     get_sid_info(psid, &account, &sid_dom);
2493     ok(ret, "Failed to lookup account name\n");
2494     ok(sid_size == GetLengthSid(psid), "Expected %d, got %d\n", GetLengthSid(psid), sid_size);
2495     ok(!lstrcmpA(account, user_name), "Expected %s, got %s\n", user_name, account);
2496     ok(!lstrcmpiA(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2497     ok(domain_size == domain_save - 1, "Expected %d, got %d\n", domain_save - 1, domain_size);
2498     ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlenA(domain), domain_size);
2499     ok(sid_use == SidTypeUser, "Expected SidTypeUser (%d), got %d\n", SidTypeUser, sid_use);
2500     domain_size = domain_save;
2501     sid_size = sid_save;
2502
2503     if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2504     {
2505         skip("Non-English locale (test with hardcoded 'Everyone')\n");
2506     }
2507     else
2508     {
2509         ret = LookupAccountNameA(NULL, "Everyone", psid, &sid_size, domain, &domain_size, &sid_use);
2510         get_sid_info(psid, &account, &sid_dom);
2511         ok(ret, "Failed to lookup account name\n");
2512         ok(sid_size != 0, "sid_size was zero\n");
2513         ok(!lstrcmpA(account, "Everyone"), "Expected Everyone, got %s\n", account);
2514         ok(!lstrcmpiA(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2515         ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2516         ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlenA(domain), domain_size);
2517         ok(sid_use == SidTypeWellKnownGroup, "Expected SidTypeWellKnownGroup (%d), got %d\n", SidTypeWellKnownGroup, sid_use);
2518         domain_size = domain_save;
2519     }
2520
2521     /* NULL Sid with zero sid size */
2522     SetLastError(0xdeadbeef);
2523     sid_size = 0;
2524     ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2525     ok(!ret, "Expected 0, got %d\n", ret);
2526     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2527        "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2528     ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2529     ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2530
2531     /* try cchReferencedDomainName - 1 */
2532     SetLastError(0xdeadbeef);
2533     domain_size--;
2534     ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2535     ok(!ret, "Expected 0, got %d\n", ret);
2536     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2537        "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2538     ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2539     ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2540
2541     /* NULL ReferencedDomainName with zero domain name size */
2542     SetLastError(0xdeadbeef);
2543     domain_size = 0;
2544     ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, NULL, &domain_size, &sid_use);
2545     ok(!ret, "Expected 0, got %d\n", ret);
2546     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2547        "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2548     ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2549     ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2550
2551     HeapFree(GetProcessHeap(), 0, psid);
2552     HeapFree(GetProcessHeap(), 0, domain);
2553
2554     /* get sizes for NULL account name */
2555     sid_size = 0;
2556     domain_size = 0;
2557     sid_use = 0xcafebabe;
2558     SetLastError(0xdeadbeef);
2559     ret = LookupAccountNameA(NULL, NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2560     if (!ret && GetLastError() == ERROR_NONE_MAPPED)
2561         win_skip("NULL account name doesn't work on NT4\n");
2562     else
2563     {
2564         ok(!ret, "Expected 0, got %d\n", ret);
2565         ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2566            "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2567         ok(sid_size != 0, "Expected non-zero sid size\n");
2568         ok(domain_size != 0, "Expected non-zero domain size\n");
2569         ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2570
2571         psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2572         domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2573
2574         /* try NULL account name */
2575         ret = LookupAccountNameA(NULL, NULL, psid, &sid_size, domain, &domain_size, &sid_use);
2576         get_sid_info(psid, &account, &sid_dom);
2577         ok(ret, "Failed to lookup account name\n");
2578         /* Using a fixed string will not work on different locales */
2579         ok(!lstrcmpiA(account, domain),
2580            "Got %s for account and %s for domain, these should be the same\n", account, domain);
2581         ok(sid_use == SidTypeDomain, "Expected SidTypeDomain (%d), got %d\n", SidTypeDomain, sid_use);
2582
2583         HeapFree(GetProcessHeap(), 0, psid);
2584         HeapFree(GetProcessHeap(), 0, domain);
2585     }
2586
2587     /* try an invalid account name */
2588     SetLastError(0xdeadbeef);
2589     sid_size = 0;
2590     domain_size = 0;
2591     ret = LookupAccountNameA(NULL, "oogabooga", NULL, &sid_size, NULL, &domain_size, &sid_use);
2592     ok(!ret, "Expected 0, got %d\n", ret);
2593     ok(GetLastError() == ERROR_NONE_MAPPED ||
2594        broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE),
2595        "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
2596     ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2597     ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2598
2599     /* try an invalid system name */
2600     SetLastError(0xdeadbeef);
2601     sid_size = 0;
2602     domain_size = 0;
2603     ret = LookupAccountNameA("deepthought", NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2604     ok(!ret, "Expected 0, got %d\n", ret);
2605     ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
2606        "Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %d\n", GetLastError());
2607     ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2608     ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2609
2610     /* try with the computer name as the account name */
2611     domain_size = sizeof(computer_name);
2612     GetComputerNameA(computer_name, &domain_size);
2613     sid_size = 0;
2614     domain_size = 0;
2615     ret = LookupAccountNameA(NULL, computer_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2616     ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER ||
2617        GetLastError() == ERROR_NONE_MAPPED /* in a domain */ ||
2618        broken(GetLastError() == ERROR_TRUSTED_DOMAIN_FAILURE) ||
2619        broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE)),
2620        "LookupAccountNameA failed: %d\n", GetLastError());
2621     if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
2622     {
2623         psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2624         domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2625         ret = LookupAccountNameA(NULL, computer_name, psid, &sid_size, domain, &domain_size, &sid_use);
2626         ok(ret, "LookupAccountNameA failed: %d\n", GetLastError());
2627         ok(sid_use == SidTypeDomain ||
2628            (sid_use == SidTypeUser && ! strcmp(computer_name, user_name)), "expected SidTypeDomain for %s, got %d\n", computer_name, sid_use);
2629         HeapFree(GetProcessHeap(), 0, domain);
2630         HeapFree(GetProcessHeap(), 0, psid);
2631     }
2632
2633     /* Well Known names */
2634     if (!pCreateWellKnownSid)
2635     {
2636         win_skip("CreateWellKnownSid not available\n");
2637         return;
2638     }
2639
2640     if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2641     {
2642         skip("Non-English locale (skipping well known name creation tests)\n");
2643         return;
2644     }
2645
2646     check_wellknown_name("LocalService", WinLocalServiceSid);
2647     check_wellknown_name("Local Service", WinLocalServiceSid);
2648     /* 2 spaces */
2649     check_wellknown_name("Local  Service", 0);
2650     check_wellknown_name("NetworkService", WinNetworkServiceSid);
2651     check_wellknown_name("Network Service", WinNetworkServiceSid);
2652
2653     /* example of some names where the spaces are not optional */
2654     check_wellknown_name("Terminal Server User", WinTerminalServerSid);
2655     check_wellknown_name("TerminalServer User", 0);
2656     check_wellknown_name("TerminalServerUser", 0);
2657     check_wellknown_name("Terminal ServerUser", 0);
2658
2659     check_wellknown_name("enterprise domain controllers",WinEnterpriseControllersSid);
2660     check_wellknown_name("enterprisedomain controllers", 0);
2661     check_wellknown_name("enterprise domaincontrollers", 0);
2662     check_wellknown_name("enterprisedomaincontrollers", 0);
2663
2664     /* case insensitivity */
2665     check_wellknown_name("lOCAlServICE", WinLocalServiceSid);
2666
2667     /* fully qualified account names */
2668     check_wellknown_name("NT AUTHORITY\\LocalService", WinLocalServiceSid);
2669     check_wellknown_name("nt authority\\Network Service", WinNetworkServiceSid);
2670     check_wellknown_name("nt authority test\\Network Service", 0);
2671     check_wellknown_name("Dummy\\Network Service", 0);
2672     check_wellknown_name("ntauthority\\Network Service", 0);
2673 }
2674
2675 static void test_security_descriptor(void)
2676 {
2677     SECURITY_DESCRIPTOR sd;
2678     char buf[8192];
2679     DWORD size;
2680     BOOL isDefault, isPresent, ret;
2681     PACL pacl;
2682     PSID psid;
2683
2684     SetLastError(0xdeadbeef);
2685     ret = InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION);
2686     if (ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2687     {
2688         win_skip("InitializeSecurityDescriptor is not implemented\n");
2689         return;
2690     }
2691
2692     ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2693     expect_eq(psid, NULL, PSID, "%p");
2694     expect_eq(isDefault, FALSE, BOOL, "%d");
2695     sd.Control |= SE_DACL_PRESENT | SE_SACL_PRESENT;
2696
2697     SetLastError(0xdeadbeef);
2698     size = 5;
2699     expect_eq(MakeSelfRelativeSD(&sd, buf, &size), FALSE, BOOL, "%d");
2700     expect_eq(GetLastError(), ERROR_INSUFFICIENT_BUFFER, DWORD, "%u");
2701     ok(size > 5, "Size not increased\n");
2702     if (size <= 8192)
2703     {
2704         expect_eq(MakeSelfRelativeSD(&sd, buf, &size), TRUE, BOOL, "%d");
2705         ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2706         expect_eq(psid, NULL, PSID, "%p");
2707         expect_eq(isDefault, FALSE, BOOL, "%d");
2708         ok(GetSecurityDescriptorGroup(&sd, &psid, &isDefault), "GetSecurityDescriptorGroup failed\n");
2709         expect_eq(psid, NULL, PSID, "%p");
2710         expect_eq(isDefault, FALSE, BOOL, "%d");
2711         ok(GetSecurityDescriptorDacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorDacl failed\n");
2712         expect_eq(isPresent, TRUE, BOOL, "%d");
2713         expect_eq(psid, NULL, PSID, "%p");
2714         expect_eq(isDefault, FALSE, BOOL, "%d");
2715         ok(GetSecurityDescriptorSacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorSacl failed\n");
2716         expect_eq(isPresent, TRUE, BOOL, "%d");
2717         expect_eq(psid, NULL, PSID, "%p");
2718         expect_eq(isDefault, FALSE, BOOL, "%d");
2719     }
2720 }
2721
2722 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,0,__LINE__)
2723 #define TEST_GRANTED_ACCESS2(a,b,c) test_granted_access(a,b,c,__LINE__)
2724 static void test_granted_access(HANDLE handle, ACCESS_MASK access,
2725                                 ACCESS_MASK alt, int line)
2726 {
2727     OBJECT_BASIC_INFORMATION obj_info;
2728     NTSTATUS status;
2729
2730     if (!pNtQueryObject)
2731     {
2732         skip_(__FILE__, line)("Not NT platform - skipping tests\n");
2733         return;
2734     }
2735
2736     status = pNtQueryObject( handle, ObjectBasicInformation, &obj_info,
2737                              sizeof(obj_info), NULL );
2738     ok_(__FILE__, line)(!status, "NtQueryObject with err: %08x\n", status);
2739     if (alt)
2740         ok_(__FILE__, line)(obj_info.GrantedAccess == access ||
2741             obj_info.GrantedAccess == alt, "Granted access should be 0x%08x "
2742             "or 0x%08x, instead of 0x%08x\n", access, alt, obj_info.GrantedAccess);
2743     else
2744         ok_(__FILE__, line)(obj_info.GrantedAccess == access, "Granted access should "
2745             "be 0x%08x, instead of 0x%08x\n", access, obj_info.GrantedAccess);
2746 }
2747
2748 #define CHECK_SET_SECURITY(o,i,e) \
2749     do{ \
2750         BOOL res_; \
2751         DWORD err; \
2752         SetLastError( 0xdeadbeef ); \
2753         res_ = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
2754         err = GetLastError(); \
2755         if (e == ERROR_SUCCESS) \
2756             ok(res_, "SetKernelObjectSecurity failed with %d\n", err); \
2757         else \
2758             ok(!res_ && err == e, "SetKernelObjectSecurity should have failed " \
2759                "with %s, instead of %d\n", #e, err); \
2760     }while(0)
2761
2762 static void test_process_security(void)
2763 {
2764     BOOL res;
2765     PTOKEN_USER user;
2766     PTOKEN_OWNER owner;
2767     PTOKEN_PRIMARY_GROUP group;
2768     PSID AdminSid = NULL, UsersSid = NULL, UserSid = NULL;
2769     PACL Acl = NULL, ThreadAcl = NULL;
2770     SECURITY_DESCRIPTOR *SecurityDescriptor = NULL, *ThreadSecurityDescriptor = NULL;
2771     char buffer[MAX_PATH], account[MAX_PATH], domain[MAX_PATH];
2772     PROCESS_INFORMATION info;
2773     STARTUPINFOA startup;
2774     SECURITY_ATTRIBUTES psa, tsa;
2775     HANDLE token, event;
2776     DWORD size, acc_size, dom_size, ret;
2777     SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2778     PSID EveryoneSid = NULL;
2779     SID_NAME_USE use;
2780
2781     Acl = HeapAlloc(GetProcessHeap(), 0, 256);
2782     res = InitializeAcl(Acl, 256, ACL_REVISION);
2783     if (!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2784     {
2785         win_skip("ACLs not implemented - skipping tests\n");
2786         HeapFree(GetProcessHeap(), 0, Acl);
2787         return;
2788     }
2789     ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2790
2791     res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
2792     ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2793
2794     /* get owner from the token we might be running as a user not admin */
2795     res = OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED, &token );
2796     ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
2797     if (!res)
2798     {
2799         HeapFree(GetProcessHeap(), 0, Acl);
2800         return;
2801     }
2802
2803     res = GetTokenInformation( token, TokenOwner, NULL, 0, &size );
2804     ok(!res, "Expected failure, got %d\n", res);
2805     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2806        "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2807
2808     owner = HeapAlloc(GetProcessHeap(), 0, size);
2809     res = GetTokenInformation( token, TokenOwner, owner, size, &size );
2810     ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2811     AdminSid = owner->Owner;
2812     test_sid_str(AdminSid);
2813
2814     res = GetTokenInformation( token, TokenPrimaryGroup, NULL, 0, &size );
2815     ok(!res, "Expected failure, got %d\n", res);
2816     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2817        "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2818
2819     group = HeapAlloc(GetProcessHeap(), 0, size);
2820     res = GetTokenInformation( token, TokenPrimaryGroup, group, size, &size );
2821     ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2822     UsersSid = group->PrimaryGroup;
2823     test_sid_str(UsersSid);
2824
2825     acc_size = sizeof(account);
2826     dom_size = sizeof(domain);
2827     ret = LookupAccountSidA( NULL, UsersSid, account, &acc_size, domain, &dom_size, &use );
2828     ok(ret, "LookupAccountSid failed with %d\n", ret);
2829     ok(use == SidTypeGroup, "expect SidTypeGroup, got %d\n", use);
2830     ok(!strcmp(account, "None"), "expect None, got %s\n", account);
2831
2832     res = GetTokenInformation( token, TokenUser, NULL, 0, &size );
2833     ok(!res, "Expected failure, got %d\n", res);
2834     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2835        "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2836
2837     user = HeapAlloc(GetProcessHeap(), 0, size);
2838     res = GetTokenInformation( token, TokenUser, user, size, &size );
2839     ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2840     UserSid = user->User.Sid;
2841     test_sid_str(UserSid);
2842     ok(EqualPrefixSid(UsersSid, UserSid), "TokenPrimaryGroup Sid and TokenUser Sid don't match.\n");
2843
2844     CloseHandle( token );
2845     if (!res)
2846     {
2847         HeapFree(GetProcessHeap(), 0, group);
2848         HeapFree(GetProcessHeap(), 0, owner);
2849         HeapFree(GetProcessHeap(), 0, user);
2850         HeapFree(GetProcessHeap(), 0, Acl);
2851         return;
2852     }
2853
2854     res = AddAccessDeniedAce(Acl, ACL_REVISION, PROCESS_VM_READ, AdminSid);
2855     ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
2856     res = AddAccessAllowedAce(Acl, ACL_REVISION, PROCESS_ALL_ACCESS, AdminSid);
2857     ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2858
2859     SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
2860     res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
2861     ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
2862
2863     event = CreateEventA( NULL, TRUE, TRUE, "test_event" );
2864     ok(event != NULL, "CreateEvent %d\n", GetLastError());
2865
2866     SecurityDescriptor->Revision = 0;
2867     CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_UNKNOWN_REVISION );
2868     SecurityDescriptor->Revision = SECURITY_DESCRIPTOR_REVISION;
2869
2870     CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2871     CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2872     CHECK_SET_SECURITY( event, SACL_SECURITY_INFORMATION, ERROR_ACCESS_DENIED );
2873     CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2874     /* NULL DACL is valid and means that everyone has access */
2875     SecurityDescriptor->Control |= SE_DACL_PRESENT;
2876     CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2877
2878     /* Set owner and group and dacl */
2879     res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
2880     ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
2881     CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_SUCCESS );
2882     test_owner_equal( event, AdminSid, __LINE__ );
2883
2884     res = SetSecurityDescriptorGroup(SecurityDescriptor, EveryoneSid, FALSE);
2885     ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2886     CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_SUCCESS );
2887     test_group_equal( event, EveryoneSid, __LINE__ );
2888
2889     res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
2890     ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
2891     CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2892     /* setting a dacl should not change the owner or group */
2893     test_owner_equal( event, AdminSid, __LINE__ );
2894     test_group_equal( event, EveryoneSid, __LINE__ );
2895
2896     /* Test again with a different SID in case the previous SID also happens to
2897      * be the one that is incorrectly replacing the group. */
2898     res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, FALSE);
2899     ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2900     CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_SUCCESS );
2901     test_group_equal( event, UsersSid, __LINE__ );
2902
2903     res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
2904     ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
2905     CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2906     test_group_equal( event, UsersSid, __LINE__ );
2907
2908     sprintf(buffer, "%s tests/security.c test", myARGV[0]);
2909     memset(&startup, 0, sizeof(startup));
2910     startup.cb = sizeof(startup);
2911     startup.dwFlags = STARTF_USESHOWWINDOW;
2912     startup.wShowWindow = SW_SHOWNORMAL;
2913
2914     psa.nLength = sizeof(psa);
2915     psa.lpSecurityDescriptor = SecurityDescriptor;
2916     psa.bInheritHandle = TRUE;
2917
2918     ThreadSecurityDescriptor = HeapAlloc( GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH );
2919     res = InitializeSecurityDescriptor( ThreadSecurityDescriptor, SECURITY_DESCRIPTOR_REVISION );
2920     ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
2921
2922     ThreadAcl = HeapAlloc( GetProcessHeap(), 0, 256 );
2923     res = InitializeAcl( ThreadAcl, 256, ACL_REVISION );
2924     ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2925     res = AddAccessDeniedAce( ThreadAcl, ACL_REVISION, THREAD_SET_THREAD_TOKEN, AdminSid );
2926     ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError() );
2927     res = AddAccessAllowedAce( ThreadAcl, ACL_REVISION, THREAD_ALL_ACCESS, AdminSid );
2928     ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2929
2930     res = SetSecurityDescriptorOwner( ThreadSecurityDescriptor, AdminSid, FALSE );
2931     ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
2932     res = SetSecurityDescriptorGroup( ThreadSecurityDescriptor, UsersSid, FALSE );
2933     ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2934     res = SetSecurityDescriptorDacl( ThreadSecurityDescriptor, TRUE, ThreadAcl, FALSE );
2935     ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
2936
2937     tsa.nLength = sizeof(tsa);
2938     tsa.lpSecurityDescriptor = ThreadSecurityDescriptor;
2939     tsa.bInheritHandle = TRUE;
2940
2941     /* Doesn't matter what ACL say we should get full access for ourselves */
2942     res = CreateProcessA( NULL, buffer, &psa, &tsa, FALSE, 0, NULL, NULL, &startup, &info );
2943     ok(res, "CreateProcess with err:%d\n", GetLastError());
2944     TEST_GRANTED_ACCESS2( info.hProcess, PROCESS_ALL_ACCESS_NT4,
2945                           STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
2946     TEST_GRANTED_ACCESS2( info.hThread, THREAD_ALL_ACCESS_NT4,
2947                           STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
2948     winetest_wait_child_process( info.hProcess );
2949
2950     FreeSid(EveryoneSid);
2951     CloseHandle( info.hProcess );
2952     CloseHandle( info.hThread );
2953     CloseHandle( event );
2954     HeapFree(GetProcessHeap(), 0, group);
2955     HeapFree(GetProcessHeap(), 0, owner);
2956     HeapFree(GetProcessHeap(), 0, user);
2957     HeapFree(GetProcessHeap(), 0, Acl);
2958     HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
2959     HeapFree(GetProcessHeap(), 0, ThreadAcl);
2960     HeapFree(GetProcessHeap(), 0, ThreadSecurityDescriptor);
2961 }
2962
2963 static void test_process_security_child(void)
2964 {
2965     HANDLE handle, handle1;
2966     BOOL ret;
2967     DWORD err;
2968
2969     handle = OpenProcess( PROCESS_TERMINATE, FALSE, GetCurrentProcessId() );
2970     ok(handle != NULL, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
2971     TEST_GRANTED_ACCESS( handle, PROCESS_TERMINATE );
2972
2973     ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2974                            &handle1, 0, TRUE, DUPLICATE_SAME_ACCESS );
2975     ok(ret, "duplicating handle err:%d\n", GetLastError());
2976     TEST_GRANTED_ACCESS( handle1, PROCESS_TERMINATE );
2977
2978     CloseHandle( handle1 );
2979
2980     SetLastError( 0xdeadbeef );
2981     ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2982                            &handle1, PROCESS_ALL_ACCESS, TRUE, 0 );
2983     err = GetLastError();
2984     ok(!ret && err == ERROR_ACCESS_DENIED, "duplicating handle should have failed "
2985        "with STATUS_ACCESS_DENIED, instead of err:%d\n", err);
2986
2987     CloseHandle( handle );
2988
2989     /* These two should fail - they are denied by ACL */
2990     handle = OpenProcess( PROCESS_VM_READ, FALSE, GetCurrentProcessId() );
2991     ok(handle == NULL, "OpenProcess(PROCESS_VM_READ) should have failed\n");
2992     handle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId() );
2993     ok(handle == NULL, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
2994
2995     /* Documented privilege elevation */
2996     ret = DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
2997                            &handle, 0, TRUE, DUPLICATE_SAME_ACCESS );
2998     ok(ret, "duplicating handle err:%d\n", GetLastError());
2999     TEST_GRANTED_ACCESS2( handle, PROCESS_ALL_ACCESS_NT4,
3000                           STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
3001
3002     CloseHandle( handle );
3003
3004     /* Same only explicitly asking for all access rights */
3005     ret = DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
3006                            &handle, PROCESS_ALL_ACCESS, TRUE, 0 );
3007     ok(ret, "duplicating handle err:%d\n", GetLastError());
3008     TEST_GRANTED_ACCESS2( handle, PROCESS_ALL_ACCESS_NT4,
3009                           PROCESS_ALL_ACCESS | PROCESS_QUERY_LIMITED_INFORMATION );
3010     ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
3011                            &handle1, PROCESS_VM_READ, TRUE, 0 );
3012     ok(ret, "duplicating handle err:%d\n", GetLastError());
3013     TEST_GRANTED_ACCESS( handle1, PROCESS_VM_READ );
3014     CloseHandle( handle1 );
3015     CloseHandle( handle );
3016
3017     /* Test thread security */
3018     handle = OpenThread( THREAD_TERMINATE, FALSE, GetCurrentThreadId() );
3019     ok(handle != NULL, "OpenThread(THREAD_TERMINATE) with err:%d\n", GetLastError());
3020     TEST_GRANTED_ACCESS( handle, PROCESS_TERMINATE );
3021     CloseHandle( handle );
3022
3023     handle = OpenThread( THREAD_SET_THREAD_TOKEN, FALSE, GetCurrentThreadId() );
3024     ok(handle == NULL, "OpenThread(THREAD_SET_THREAD_TOKEN) should have failed\n");
3025 }
3026
3027 static void test_impersonation_level(void)
3028 {
3029     HANDLE Token, ProcessToken;
3030     HANDLE Token2;
3031     DWORD Size;
3032     TOKEN_PRIVILEGES *Privileges;
3033     TOKEN_USER *User;
3034     PRIVILEGE_SET *PrivilegeSet;
3035     BOOL AccessGranted;
3036     BOOL ret;
3037     HKEY hkey;
3038     DWORD error;
3039
3040     pDuplicateTokenEx = (void *)GetProcAddress(hmod, "DuplicateTokenEx");
3041     if( !pDuplicateTokenEx ) {
3042         win_skip("DuplicateTokenEx is not available\n");
3043         return;
3044     }
3045     SetLastError(0xdeadbeef);
3046     ret = ImpersonateSelf(SecurityAnonymous);
3047     if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3048     {
3049         win_skip("ImpersonateSelf is not implemented\n");
3050         return;
3051     }
3052     ok(ret, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
3053     ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
3054     ok(!ret, "OpenThreadToken should have failed\n");
3055     error = GetLastError();
3056     ok(error == ERROR_CANT_OPEN_ANONYMOUS, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error);
3057     /* can't perform access check when opening object against an anonymous impersonation token */
3058     todo_wine {
3059     error = RegOpenKeyExA(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
3060     ok(error == ERROR_INVALID_HANDLE || error == ERROR_CANT_OPEN_ANONYMOUS || error == ERROR_BAD_IMPERSONATION_LEVEL,
3061        "RegOpenKeyEx failed with %d\n", error);
3062     }
3063     RevertToSelf();
3064
3065     ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &ProcessToken);
3066     ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
3067
3068     ret = pDuplicateTokenEx(ProcessToken,
3069         TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE, NULL,
3070         SecurityAnonymous, TokenImpersonation, &Token);
3071     ok(ret, "DuplicateTokenEx failed with error %d\n", GetLastError());
3072     /* can't increase the impersonation level */
3073     ret = DuplicateToken(Token, SecurityIdentification, &Token2);
3074     error = GetLastError();
3075     ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL,
3076         "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
3077     /* we can query anything from an anonymous token, including the user */
3078     ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
3079     error = GetLastError();
3080     ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
3081     User = HeapAlloc(GetProcessHeap(), 0, Size);
3082     ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
3083     ok(ret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
3084     HeapFree(GetProcessHeap(), 0, User);
3085
3086     /* PrivilegeCheck fails with SecurityAnonymous level */
3087     ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
3088     error = GetLastError();
3089     ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
3090     Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
3091     ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
3092     ok(ret, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
3093
3094     PrivilegeSet = HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET, Privilege[Privileges->PrivilegeCount]));
3095     PrivilegeSet->PrivilegeCount = Privileges->PrivilegeCount;
3096     memcpy(PrivilegeSet->Privilege, Privileges->Privileges, PrivilegeSet->PrivilegeCount * sizeof(PrivilegeSet->Privilege[0]));
3097     PrivilegeSet->Control = PRIVILEGE_SET_ALL_NECESSARY;
3098     HeapFree(GetProcessHeap(), 0, Privileges);
3099
3100     ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
3101     error = GetLastError();
3102     ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
3103
3104     CloseHandle(Token);
3105
3106     ret = ImpersonateSelf(SecurityIdentification);
3107     ok(ret, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
3108     ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
3109     ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
3110
3111     /* can't perform access check when opening object against an identification impersonation token */
3112     error = RegOpenKeyExA(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
3113     todo_wine {
3114     ok(error == ERROR_INVALID_HANDLE || error == ERROR_BAD_IMPERSONATION_LEVEL,
3115        "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE or ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
3116     }
3117     ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
3118     ok(ret, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
3119     CloseHandle(Token);
3120     RevertToSelf();
3121
3122     ret = ImpersonateSelf(SecurityImpersonation);
3123     ok(ret, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
3124     ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
3125     ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
3126     error = RegOpenKeyExA(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
3127     ok(error == ERROR_SUCCESS, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error);
3128     RegCloseKey(hkey);
3129     ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
3130     ok(ret, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
3131     RevertToSelf();
3132
3133     CloseHandle(Token);
3134     CloseHandle(ProcessToken);
3135
3136     HeapFree(GetProcessHeap(), 0, PrivilegeSet);
3137 }
3138
3139 static void test_SetEntriesInAclW(void)
3140 {
3141     DWORD res;
3142     PSID EveryoneSid = NULL, UsersSid = NULL;
3143     PACL OldAcl = NULL, NewAcl;
3144     SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
3145     SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
3146     EXPLICIT_ACCESSW ExplicitAccess;
3147     static const WCHAR wszEveryone[] = {'E','v','e','r','y','o','n','e',0};
3148     static const WCHAR wszCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
3149
3150     if (!pSetEntriesInAclW)
3151     {
3152         win_skip("SetEntriesInAclW is not available\n");
3153         return;
3154     }
3155
3156     NewAcl = (PACL)0xdeadbeef;
3157     res = pSetEntriesInAclW(0, NULL, NULL, &NewAcl);
3158     if(res == ERROR_CALL_NOT_IMPLEMENTED)
3159     {
3160         win_skip("SetEntriesInAclW is not implemented\n");
3161         return;
3162     }
3163     ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
3164     ok(NewAcl == NULL ||
3165         broken(NewAcl != NULL), /* NT4 */
3166         "NewAcl=%p, expected NULL\n", NewAcl);
3167     LocalFree(NewAcl);
3168
3169     OldAcl = HeapAlloc(GetProcessHeap(), 0, 256);
3170     res = InitializeAcl(OldAcl, 256, ACL_REVISION);
3171     if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
3172     {
3173         win_skip("ACLs not implemented - skipping tests\n");
3174         HeapFree(GetProcessHeap(), 0, OldAcl);
3175         return;
3176     }
3177     ok(res, "InitializeAcl failed with error %d\n", GetLastError());
3178
3179     res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
3180     ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3181
3182     res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
3183         DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
3184     ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3185
3186     res = AddAccessAllowedAce(OldAcl, ACL_REVISION, KEY_READ, UsersSid);
3187     ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
3188
3189     ExplicitAccess.grfAccessPermissions = KEY_WRITE;
3190     ExplicitAccess.grfAccessMode = GRANT_ACCESS;
3191     ExplicitAccess.grfInheritance = NO_INHERITANCE;
3192     ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
3193     ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
3194     ExplicitAccess.Trustee.ptstrName = EveryoneSid;
3195     ExplicitAccess.Trustee.MultipleTrusteeOperation = 0xDEADBEEF;
3196     ExplicitAccess.Trustee.pMultipleTrustee = (PVOID)0xDEADBEEF;
3197     res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
3198     ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
3199     ok(NewAcl != NULL, "returned acl was NULL\n");
3200     LocalFree(NewAcl);
3201
3202     ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3203     ExplicitAccess.Trustee.pMultipleTrustee = NULL;
3204     ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3205     res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
3206     ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
3207     ok(NewAcl != NULL, "returned acl was NULL\n");
3208     LocalFree(NewAcl);
3209
3210     if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
3211     {
3212         skip("Non-English locale (test with hardcoded 'Everyone')\n");
3213     }
3214     else
3215     {
3216         ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3217         ExplicitAccess.Trustee.ptstrName = (LPWSTR)wszEveryone;
3218         res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
3219         ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
3220         ok(NewAcl != NULL, "returned acl was NULL\n");
3221         LocalFree(NewAcl);
3222
3223         ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_BAD_FORM;
3224         res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
3225         ok(res == ERROR_INVALID_PARAMETER ||
3226             broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
3227             "SetEntriesInAclW failed: %u\n", res);
3228         ok(NewAcl == NULL ||
3229             broken(NewAcl != NULL), /* NT4 */
3230             "returned acl wasn't NULL: %p\n", NewAcl);
3231
3232         ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3233         ExplicitAccess.Trustee.MultipleTrusteeOperation = TRUSTEE_IS_IMPERSONATE;
3234         res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
3235         ok(res == ERROR_INVALID_PARAMETER ||
3236             broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
3237             "SetEntriesInAclW failed: %u\n", res);
3238         ok(NewAcl == NULL ||
3239             broken(NewAcl != NULL), /* NT4 */
3240             "returned acl wasn't NULL: %p\n", NewAcl);
3241
3242         ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3243         ExplicitAccess.grfAccessMode = SET_ACCESS;
3244         res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
3245         ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
3246         ok(NewAcl != NULL, "returned acl was NULL\n");
3247         LocalFree(NewAcl);
3248     }
3249
3250     ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3251     ExplicitAccess.Trustee.ptstrName = (LPWSTR)wszCurrentUser;
3252     res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
3253     ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
3254     ok(NewAcl != NULL, "returned acl was NULL\n");
3255     LocalFree(NewAcl);
3256
3257     ExplicitAccess.grfAccessMode = REVOKE_ACCESS;
3258     ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
3259     ExplicitAccess.Trustee.ptstrName = UsersSid;
3260     res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
3261     ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
3262     ok(NewAcl != NULL, "returned acl was NULL\n");
3263     LocalFree(NewAcl);
3264
3265     FreeSid(UsersSid);
3266     FreeSid(EveryoneSid);
3267     HeapFree(GetProcessHeap(), 0, OldAcl);
3268 }
3269
3270 static void test_SetEntriesInAclA(void)
3271 {
3272     DWORD res;
3273     PSID EveryoneSid = NULL, UsersSid = NULL;
3274     PACL OldAcl = NULL, NewAcl;
3275     SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
3276     SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
3277     EXPLICIT_ACCESSA ExplicitAccess;
3278     static const CHAR szEveryone[] = {'E','v','e','r','y','o','n','e',0};
3279     static const CHAR szCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
3280
3281     if (!pSetEntriesInAclA)
3282     {
3283         win_skip("SetEntriesInAclA is not available\n");
3284         return;
3285     }
3286
3287     NewAcl = (PACL)0xdeadbeef;
3288     res = pSetEntriesInAclA(0, NULL, NULL, &NewAcl);
3289     if(res == ERROR_CALL_NOT_IMPLEMENTED)
3290     {
3291         win_skip("SetEntriesInAclA is not implemented\n");
3292         return;
3293     }
3294     ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3295     ok(NewAcl == NULL ||
3296         broken(NewAcl != NULL), /* NT4 */
3297         "NewAcl=%p, expected NULL\n", NewAcl);
3298     LocalFree(NewAcl);
3299
3300     OldAcl = HeapAlloc(GetProcessHeap(), 0, 256);
3301     res = InitializeAcl(OldAcl, 256, ACL_REVISION);
3302     if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
3303     {
3304         win_skip("ACLs not implemented - skipping tests\n");
3305         HeapFree(GetProcessHeap(), 0, OldAcl);
3306         return;
3307     }
3308     ok(res, "InitializeAcl failed with error %d\n", GetLastError());
3309
3310     res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
3311     ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3312
3313     res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
3314         DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
3315     ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3316
3317     res = AddAccessAllowedAce(OldAcl, ACL_REVISION, KEY_READ, UsersSid);
3318     ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
3319
3320     ExplicitAccess.grfAccessPermissions = KEY_WRITE;
3321     ExplicitAccess.grfAccessMode = GRANT_ACCESS;
3322     ExplicitAccess.grfInheritance = NO_INHERITANCE;
3323     ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
3324     ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
3325     ExplicitAccess.Trustee.ptstrName = EveryoneSid;
3326     ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3327     ExplicitAccess.Trustee.pMultipleTrustee = NULL;
3328     res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3329     ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3330     ok(NewAcl != NULL, "returned acl was NULL\n");
3331     LocalFree(NewAcl);
3332
3333     ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3334     ExplicitAccess.Trustee.pMultipleTrustee = NULL;
3335     ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3336     res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3337     ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3338     ok(NewAcl != NULL, "returned acl was NULL\n");
3339     LocalFree(NewAcl);
3340
3341     if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
3342     {
3343         skip("Non-English locale (test with hardcoded 'Everyone')\n");
3344     }
3345     else
3346     {
3347         ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3348         ExplicitAccess.Trustee.ptstrName = (LPSTR)szEveryone;
3349         res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3350         ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3351         ok(NewAcl != NULL, "returned acl was NULL\n");
3352         LocalFree(NewAcl);
3353
3354         ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_BAD_FORM;
3355         res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3356         ok(res == ERROR_INVALID_PARAMETER ||
3357             broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
3358             "SetEntriesInAclA failed: %u\n", res);
3359         ok(NewAcl == NULL ||
3360             broken(NewAcl != NULL), /* NT4 */
3361             "returned acl wasn't NULL: %p\n", NewAcl);
3362
3363         ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3364         ExplicitAccess.Trustee.MultipleTrusteeOperation = TRUSTEE_IS_IMPERSONATE;
3365         res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3366         ok(res == ERROR_INVALID_PARAMETER ||
3367             broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
3368             "SetEntriesInAclA failed: %u\n", res);
3369         ok(NewAcl == NULL ||
3370             broken(NewAcl != NULL), /* NT4 */
3371             "returned acl wasn't NULL: %p\n", NewAcl);
3372
3373         ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3374         ExplicitAccess.grfAccessMode = SET_ACCESS;
3375         res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3376         ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3377         ok(NewAcl != NULL, "returned acl was NULL\n");
3378         LocalFree(NewAcl);
3379     }
3380
3381     ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3382     ExplicitAccess.Trustee.ptstrName = (LPSTR)szCurrentUser;
3383     res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3384     ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3385     ok(NewAcl != NULL, "returned acl was NULL\n");
3386     LocalFree(NewAcl);
3387
3388     ExplicitAccess.grfAccessMode = REVOKE_ACCESS;
3389     ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
3390     ExplicitAccess.Trustee.ptstrName = UsersSid;
3391     res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3392     ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3393     ok(NewAcl != NULL, "returned acl was NULL\n");
3394     LocalFree(NewAcl);
3395
3396     FreeSid(UsersSid);
3397     FreeSid(EveryoneSid);
3398     HeapFree(GetProcessHeap(), 0, OldAcl);
3399 }
3400
3401 /* helper function for test_CreateDirectoryA */
3402 static void get_nt_pathW(const char *name, UNICODE_STRING *nameW)
3403 {
3404     UNICODE_STRING strW;
3405     ANSI_STRING str;
3406     NTSTATUS status;
3407     BOOLEAN ret;
3408
3409     pRtlInitAnsiString(&str, name);
3410
3411     status = pRtlAnsiStringToUnicodeString(&strW, &str, TRUE);
3412     ok(!status, "RtlAnsiStringToUnicodeString failed with %08x\n", status);
3413
3414     ret = pRtlDosPathNameToNtPathName_U(strW.Buffer, nameW, NULL, NULL);
3415     ok(ret, "RtlDosPathNameToNtPathName_U failed\n");
3416
3417     pRtlFreeUnicodeString(&strW);
3418 }
3419
3420 static void test_inherited_dacl(PACL dacl, PSID admin_sid, PSID user_sid, DWORD flags, DWORD mask,
3421                                 BOOL todo_count, BOOL todo_sid, BOOL todo_flags, int line)
3422 {
3423     ACL_SIZE_INFORMATION acl_size;
3424     ACCESS_ALLOWED_ACE *ace;
3425     BOOL bret;
3426
3427     bret = pGetAclInformation(dacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3428     ok_(__FILE__, line)(bret, "GetAclInformation failed\n");
3429
3430     todo_wine_if (todo_count)
3431         ok_(__FILE__, line)(acl_size.AceCount == 2,
3432             "GetAclInformation returned unexpected entry count (%d != 2)\n",
3433             acl_size.AceCount);
3434
3435     if (acl_size.AceCount > 0)
3436     {
3437         bret = pGetAce(dacl, 0, (VOID **)&ace);
3438         ok_(__FILE__, line)(bret, "Failed to get Current User ACE\n");
3439
3440         bret = EqualSid(&ace->SidStart, user_sid);
3441         todo_wine_if (todo_sid)
3442             ok_(__FILE__, line)(bret, "Current User ACE (%s) != Current User SID (%s)\n", debugstr_sid(&ace->SidStart), debugstr_sid(user_sid));
3443
3444         todo_wine_if (todo_flags)
3445             ok_(__FILE__, line)(((ACE_HEADER *)ace)->AceFlags == flags,
3446                 "Current User ACE has unexpected flags (0x%x != 0x%x)\n",
3447                 ((ACE_HEADER *)ace)->AceFlags, flags);
3448
3449         ok_(__FILE__, line)(ace->Mask == mask,
3450             "Current User ACE has unexpected mask (0x%x != 0x%x)\n",
3451             ace->Mask, mask);
3452     }
3453     if (acl_size.AceCount > 1)
3454     {
3455         bret = pGetAce(dacl, 1, (VOID **)&ace);
3456         ok_(__FILE__, line)(bret, "Failed to get Administators Group ACE\n");
3457
3458         bret = EqualSid(&ace->SidStart, admin_sid);
3459         todo_wine_if (todo_sid)
3460             ok_(__FILE__, line)(bret, "Administators Group ACE (%s) != Administators Group SID (%s)\n", debugstr_sid(&ace->SidStart), debugstr_sid(admin_sid));
3461
3462         todo_wine_if (todo_flags)
3463             ok_(__FILE__, line)(((ACE_HEADER *)ace)->AceFlags == flags,
3464                 "Administators Group ACE has unexpected flags (0x%x != 0x%x)\n",
3465                 ((ACE_HEADER *)ace)->AceFlags, flags);
3466
3467         ok_(__FILE__, line)(ace->Mask == mask,
3468             "Administators Group ACE has unexpected mask (0x%x != 0x%x)\n",
3469             ace->Mask, mask);
3470     }
3471 }
3472
3473 static void test_CreateDirectoryA(void)
3474 {
3475     char admin_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES], *user;
3476     DWORD sid_size = sizeof(admin_ptr), user_size;
3477     PSID admin_sid = (PSID) admin_ptr, user_sid;
3478     char sd[SECURITY_DESCRIPTOR_MIN_LENGTH];
3479     PSECURITY_DESCRIPTOR pSD = &sd;
3480     ACL_SIZE_INFORMATION acl_size;
3481     UNICODE_STRING tmpfileW;
3482     SECURITY_ATTRIBUTES sa;
3483     OBJECT_ATTRIBUTES attr;
3484     char tmpfile[MAX_PATH];
3485     char tmpdir[MAX_PATH];
3486     HANDLE token, hTemp;
3487     IO_STATUS_BLOCK io;
3488     struct _SID *owner;
3489     BOOL bret = TRUE;
3490     NTSTATUS status;
3491     DWORD error;
3492     PACL pDacl;
3493
3494     if (!pGetSecurityInfo || !pGetNamedSecurityInfoA || !pCreateWellKnownSid)
3495     {
3496         win_skip("Required functions are not available\n");
3497         return;
3498     }
3499
3500     if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
3501     {
3502         if (GetLastError() != ERROR_NO_TOKEN) bret = FALSE;
3503         else if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) bret = FALSE;
3504     }
3505     if (!bret)
3506     {
3507         win_skip("Failed to get current user token\n");
3508         return;
3509     }
3510     bret = GetTokenInformation(token, TokenUser, NULL, 0, &user_size);
3511     ok(!bret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
3512         "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
3513     user = HeapAlloc(GetProcessHeap(), 0, user_size);
3514     bret = GetTokenInformation(token, TokenUser, user, user_size, &user_size);
3515     ok(bret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
3516     CloseHandle( token );
3517     user_sid = ((TOKEN_USER *)user)->User.Sid;
3518
3519     sa.nLength = sizeof(sa);
3520     sa.lpSecurityDescriptor = pSD;
3521     sa.bInheritHandle = TRUE;
3522     InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3523     pCreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, admin_sid, &sid_size);
3524     pDacl = HeapAlloc(GetProcessHeap(), 0, 100);
3525     bret = InitializeAcl(pDacl, 100, ACL_REVISION);
3526     ok(bret, "Failed to initialize ACL.\n");
3527     bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE,
3528                                   GENERIC_ALL, user_sid);
3529     ok(bret, "Failed to add Current User to ACL.\n");
3530     bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE,
3531                                   GENERIC_ALL, admin_sid);
3532     ok(bret, "Failed to add Administrator Group to ACL.\n");
3533     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3534     ok(bret, "Failed to add ACL to security descriptor.\n");
3535
3536     GetTempPathA(MAX_PATH, tmpdir);
3537     lstrcatA(tmpdir, "Please Remove Me");
3538     bret = CreateDirectoryA(tmpdir, &sa);
3539     ok(bret == TRUE, "CreateDirectoryA(%s) failed err=%d\n", tmpdir, GetLastError());
3540     HeapFree(GetProcessHeap(), 0, pDacl);
3541
3542     SetLastError(0xdeadbeef);
3543     error = pGetNamedSecurityInfoA(tmpdir, SE_FILE_OBJECT,
3544                                    OWNER_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, (PSID*)&owner,
3545                                    NULL, &pDacl, NULL, &pSD);
3546     if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3547     {
3548         win_skip("GetNamedSecurityInfoA is not implemented\n");
3549         goto done;
3550     }
3551     ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3552     test_inherited_dacl(pDacl, admin_sid, user_sid, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE,
3553                         0x1f01ff, FALSE, FALSE, FALSE, __LINE__);
3554     LocalFree(pSD);
3555
3556     /* Test inheritance of ACLs in CreateFile without security descriptor */
3557     strcpy(tmpfile, tmpdir);
3558     lstrcatA(tmpfile, "/tmpfile");
3559
3560     hTemp = CreateFileA(tmpfile, GENERIC_WRITE, FILE_SHARE_READ, NULL,
3561                         CREATE_NEW, FILE_FLAG_DELETE_ON_CLOSE, NULL);
3562     ok(hTemp != INVALID_HANDLE_VALUE, "CreateFile error %u\n", GetLastError());
3563
3564     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3565                                    OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3566                                    (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3567     ok(error == ERROR_SUCCESS, "Failed to get permissions on file\n");
3568     test_inherited_dacl(pDacl, admin_sid, user_sid, INHERITED_ACE,
3569                         0x1f01ff, FALSE, FALSE, FALSE, __LINE__);
3570     LocalFree(pSD);
3571     CloseHandle(hTemp);
3572
3573     /* Test inheritance of ACLs in CreateFile with security descriptor -
3574      * When a security descriptor is set, then inheritance doesn't take effect */
3575     pSD = &sd;
3576     InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3577     pDacl = HeapAlloc(GetProcessHeap(), 0, sizeof(ACL));
3578     bret = InitializeAcl(pDacl, sizeof(ACL), ACL_REVISION);
3579     ok(bret, "Failed to initialize ACL\n");
3580     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3581     ok(bret, "Failed to add ACL to security descriptor\n");
3582
3583     strcpy(tmpfile, tmpdir);
3584     lstrcatA(tmpfile, "/tmpfile");
3585
3586     sa.nLength = sizeof(sa);
3587     sa.lpSecurityDescriptor = pSD;
3588     sa.bInheritHandle = TRUE;
3589     hTemp = CreateFileA(tmpfile, GENERIC_WRITE, FILE_SHARE_READ, &sa,
3590                         CREATE_NEW, FILE_FLAG_DELETE_ON_CLOSE, NULL);
3591     ok(hTemp != INVALID_HANDLE_VALUE, "CreateFile error %u\n", GetLastError());
3592     HeapFree(GetProcessHeap(), 0, pDacl);
3593
3594     error = pGetSecurityInfo(hTemp, SE_FILE_OBJECT,
3595                              OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3596                              (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3597     ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3598     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3599     ok(bret, "GetAclInformation failed\n");
3600     ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3601                                acl_size.AceCount);
3602     LocalFree(pSD);
3603
3604     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3605                                    OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3606                                    (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3607     ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3608     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3609     ok(bret, "GetAclInformation failed\n");
3610     ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3611                                acl_size.AceCount);
3612     LocalFree(pSD);
3613     CloseHandle(hTemp);
3614
3615     /* Test inheritance of ACLs in NtCreateFile without security descriptor */
3616     strcpy(tmpfile, tmpdir);
3617     lstrcatA(tmpfile, "/tmpfile");
3618     get_nt_pathW(tmpfile, &tmpfileW);
3619
3620     attr.Length = sizeof(attr);
3621     attr.RootDirectory = 0;
3622     attr.ObjectName = &tmpfileW;
3623     attr.Attributes = OBJ_CASE_INSENSITIVE;
3624     attr.SecurityDescriptor = NULL;
3625     attr.SecurityQualityOfService = NULL;
3626
3627     status = pNtCreateFile(&hTemp, GENERIC_WRITE | DELETE, &attr, &io, NULL, 0,
3628                            FILE_SHARE_READ, FILE_CREATE, FILE_DELETE_ON_CLOSE, NULL, 0);
3629     ok(!status, "NtCreateFile failed with %08x\n", status);
3630     pRtlFreeUnicodeString(&tmpfileW);
3631
3632     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3633                                    OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3634                                    (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3635     ok(error == ERROR_SUCCESS, "Failed to get permissions on file\n");
3636     test_inherited_dacl(pDacl, admin_sid, user_sid, INHERITED_ACE,
3637                         0x1f01ff, FALSE, FALSE, FALSE, __LINE__);
3638     LocalFree(pSD);
3639     CloseHandle(hTemp);
3640
3641     /* Test inheritance of ACLs in NtCreateFile with security descriptor -
3642      * When a security descriptor is set, then inheritance doesn't take effect */
3643     pSD = &sd;
3644     InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3645     pDacl = HeapAlloc(GetProcessHeap(), 0, sizeof(ACL));
3646     bret = InitializeAcl(pDacl, sizeof(ACL), ACL_REVISION);
3647     ok(bret, "Failed to initialize ACL\n");
3648     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3649     ok(bret, "Failed to add ACL to security descriptor\n");
3650
3651     strcpy(tmpfile, tmpdir);
3652     lstrcatA(tmpfile, "/tmpfile");
3653     get_nt_pathW(tmpfile, &tmpfileW);
3654
3655     attr.Length = sizeof(attr);
3656     attr.RootDirectory = 0;
3657     attr.ObjectName = &tmpfileW;
3658     attr.Attributes = OBJ_CASE_INSENSITIVE;
3659     attr.SecurityDescriptor = pSD;
3660     attr.SecurityQualityOfService = NULL;
3661
3662     status = pNtCreateFile(&hTemp, GENERIC_WRITE | DELETE, &attr, &io, NULL, 0,
3663                            FILE_SHARE_READ, FILE_CREATE, FILE_DELETE_ON_CLOSE, NULL, 0);
3664     ok(!status, "NtCreateFile failed with %08x\n", status);
3665     pRtlFreeUnicodeString(&tmpfileW);
3666     HeapFree(GetProcessHeap(), 0, pDacl);
3667
3668     error = pGetSecurityInfo(hTemp, SE_FILE_OBJECT,
3669                              OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3670                              (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3671     ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3672     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3673     ok(bret, "GetAclInformation failed\n");
3674     todo_wine
3675     ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3676                                acl_size.AceCount);
3677     LocalFree(pSD);
3678
3679     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3680                                    OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3681                                    (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3682     ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3683     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3684     ok(bret, "GetAclInformation failed\n");
3685     todo_wine
3686     ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3687                                acl_size.AceCount);
3688     LocalFree(pSD);
3689     CloseHandle(hTemp);
3690
3691     /* Test inheritance of ACLs in CreateDirectory without security descriptor */
3692     strcpy(tmpfile, tmpdir);
3693     lstrcatA(tmpfile, "/tmpdir");
3694     bret = CreateDirectoryA(tmpfile, NULL);
3695     ok(bret == TRUE, "CreateDirectoryA failed with error %u\n", GetLastError());
3696
3697     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3698                                    OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3699                                    (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3700     ok(error == ERROR_SUCCESS, "Failed to get permissions on file\n");
3701     test_inherited_dacl(pDacl, admin_sid, user_sid,
3702                         OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERITED_ACE,
3703                         0x1f01ff, FALSE, FALSE, FALSE, __LINE__);
3704     LocalFree(pSD);
3705     bret = RemoveDirectoryA(tmpfile);
3706     ok(bret == TRUE, "RemoveDirectoryA failed with error %u\n", GetLastError());
3707
3708     /* Test inheritance of ACLs in CreateDirectory with security descriptor */
3709     pSD = &sd;
3710     InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3711     pDacl = HeapAlloc(GetProcessHeap(), 0, sizeof(ACL));
3712     bret = InitializeAcl(pDacl, sizeof(ACL), ACL_REVISION);
3713     ok(bret, "Failed to initialize ACL\n");
3714     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3715     ok(bret, "Failed to add ACL to security desciptor\n");
3716
3717     strcpy(tmpfile, tmpdir);
3718     lstrcatA(tmpfile, "/tmpdir1");
3719
3720     sa.nLength = sizeof(sa);
3721     sa.lpSecurityDescriptor = pSD;
3722     sa.bInheritHandle = TRUE;
3723     bret = CreateDirectoryA(tmpfile, &sa);
3724     ok(bret == TRUE, "CreateDirectoryA failed with error %u\n", GetLastError());
3725     HeapFree(GetProcessHeap(), 0, pDacl);
3726
3727     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3728                                    OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3729                                    (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3730     ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3731     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3732     ok(bret, "GetAclInformation failed\n");
3733     ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3734                                acl_size.AceCount);
3735     LocalFree(pSD);
3736
3737     SetLastError(0xdeadbeef);
3738     bret = RemoveDirectoryA(tmpfile);
3739     error = GetLastError();
3740     ok(bret == FALSE, "RemoveDirectoryA unexpected succeeded\n");
3741     ok(error == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %u\n", error);
3742
3743     pSD = &sd;
3744     InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3745     pDacl = HeapAlloc(GetProcessHeap(), 0, 100);
3746     bret = InitializeAcl(pDacl, 100, ACL_REVISION);
3747     ok(bret, "Failed to initialize ACL.\n");
3748     bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
3749     ok(bret, "Failed to add Current User to ACL.\n");
3750     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3751     ok(bret, "Failed to add ACL to security desciptor.\n");
3752     error = pSetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL,
3753                                    NULL, pDacl, NULL);
3754     ok(error == ERROR_SUCCESS, "SetNamedSecurityInfoA failed with error %u\n", error);
3755     HeapFree(GetProcessHeap(), 0, pDacl);
3756
3757     bret = RemoveDirectoryA(tmpfile);
3758     ok(bret == TRUE, "RemoveDirectoryA failed with error %u\n", GetLastError());
3759
3760     /* Test inheritance of ACLs in NtCreateFile(..., FILE_DIRECTORY_FILE, ...) without security descriptor */
3761     strcpy(tmpfile, tmpdir);
3762     lstrcatA(tmpfile, "/tmpdir");
3763     get_nt_pathW(tmpfile, &tmpfileW);
3764
3765     attr.Length = sizeof(attr);
3766     attr.RootDirectory = 0;
3767     attr.ObjectName = &tmpfileW;
3768     attr.Attributes = OBJ_CASE_INSENSITIVE;
3769     attr.SecurityDescriptor = NULL;
3770     attr.SecurityQualityOfService = NULL;
3771
3772     status = pNtCreateFile(&hTemp, GENERIC_READ | DELETE, &attr, &io, NULL, FILE_ATTRIBUTE_NORMAL,
3773                            FILE_SHARE_READ, FILE_CREATE, FILE_DIRECTORY_FILE | FILE_DELETE_ON_CLOSE, NULL, 0);
3774     ok(!status, "NtCreateFile failed with %08x\n", status);
3775     RtlFreeUnicodeString(&tmpfileW);
3776
3777     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3778                                    OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3779                                    (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3780     ok(error == ERROR_SUCCESS, "Failed to get permissions on file\n");
3781     test_inherited_dacl(pDacl, admin_sid, user_sid,
3782                         OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERITED_ACE,
3783                         0x1f01ff, FALSE, FALSE, FALSE, __LINE__);
3784     LocalFree(pSD);
3785     CloseHandle(hTemp);
3786
3787     /* Test inheritance of ACLs in NtCreateFile(..., FILE_DIRECTORY_FILE, ...) with security descriptor */
3788     pSD = &sd;
3789     InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3790     pDacl = HeapAlloc(GetProcessHeap(), 0, sizeof(ACL));
3791     bret = InitializeAcl(pDacl, sizeof(ACL), ACL_REVISION);
3792     ok(bret, "Failed to initialize ACL\n");
3793     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3794     ok(bret, "Failed to add ACL to security desciptor\n");
3795
3796     strcpy(tmpfile, tmpdir);
3797     lstrcatA(tmpfile, "/tmpdir2");
3798     get_nt_pathW(tmpfile, &tmpfileW);
3799
3800     attr.Length = sizeof(attr);
3801     attr.RootDirectory = 0;
3802     attr.ObjectName = &tmpfileW;
3803     attr.Attributes = OBJ_CASE_INSENSITIVE;
3804     attr.SecurityDescriptor = pSD;
3805     attr.SecurityQualityOfService = NULL;
3806
3807     status = pNtCreateFile(&hTemp, GENERIC_READ | DELETE, &attr, &io, NULL, FILE_ATTRIBUTE_NORMAL,
3808                            FILE_SHARE_READ, FILE_CREATE, FILE_DIRECTORY_FILE | FILE_DELETE_ON_CLOSE, NULL, 0);
3809     ok(!status, "NtCreateFile failed with %08x\n", status);
3810     RtlFreeUnicodeString(&tmpfileW);
3811     HeapFree(GetProcessHeap(), 0, pDacl);
3812
3813     error = pGetSecurityInfo(hTemp, SE_FILE_OBJECT,
3814                              OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3815                              (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3816     ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3817     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3818     ok(bret, "GetAclInformation failed\n");
3819     todo_wine
3820     ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3821                                acl_size.AceCount);
3822     LocalFree(pSD);
3823
3824     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3825                                    OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3826                                    (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3827     ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3828     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3829     ok(bret, "GetAclInformation failed\n");
3830     todo_wine
3831     ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3832                                acl_size.AceCount);
3833     LocalFree(pSD);
3834     CloseHandle(hTemp);
3835
3836 done:
3837     HeapFree(GetProcessHeap(), 0, user);
3838     bret = RemoveDirectoryA(tmpdir);
3839     ok(bret == TRUE, "RemoveDirectoryA should always succeed\n");
3840 }
3841
3842 static void test_GetNamedSecurityInfoA(void)
3843 {
3844     char admin_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES], *user;
3845     char system_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES];
3846     char users_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES];
3847     PSID admin_sid = (PSID) admin_ptr, users_sid = (PSID) users_ptr;
3848     PSID system_sid = (PSID) system_ptr, user_sid;
3849     DWORD sid_size = sizeof(admin_ptr), user_size;
3850     char invalid_path[] = "/an invalid file path";
3851     int users_ace_id = -1, admins_ace_id = -1, i;
3852     char software_key[] = "MACHINE\\Software";
3853     char sd[SECURITY_DESCRIPTOR_MIN_LENGTH+sizeof(void*)];
3854     SECURITY_DESCRIPTOR_CONTROL control;
3855     ACL_SIZE_INFORMATION acl_size;
3856     CHAR windows_dir[MAX_PATH];
3857     PSECURITY_DESCRIPTOR pSD;
3858     ACCESS_ALLOWED_ACE *ace;
3859     BOOL bret = TRUE, isNT4;
3860     char tmpfile[MAX_PATH];
3861     DWORD error, revision;
3862     BOOL owner_defaulted;
3863     BOOL group_defaulted;
3864     BOOL dacl_defaulted;
3865     HANDLE token, hTemp, h;
3866     PSID owner, group;
3867     BOOL dacl_present;
3868     PACL pDacl;
3869     BYTE flags;
3870     NTSTATUS status;
3871
3872     if (!pSetNamedSecurityInfoA || !pGetNamedSecurityInfoA || !pCreateWellKnownSid)
3873     {
3874         win_skip("Required functions are not available\n");
3875         return;
3876     }
3877
3878     if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
3879     {
3880         if (GetLastError() != ERROR_NO_TOKEN) bret = FALSE;
3881         else if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) bret = FALSE;
3882     }
3883     if (!bret)
3884     {
3885         win_skip("Failed to get current user token\n");
3886         return;
3887     }
3888     bret = GetTokenInformation(token, TokenUser, NULL, 0, &user_size);
3889     ok(!bret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
3890         "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
3891     user = HeapAlloc(GetProcessHeap(), 0, user_size);
3892     bret = GetTokenInformation(token, TokenUser, user, user_size, &user_size);
3893     ok(bret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
3894     CloseHandle( token );
3895     user_sid = ((TOKEN_USER *)user)->User.Sid;
3896
3897     bret = GetWindowsDirectoryA(windows_dir, MAX_PATH);
3898     ok(bret, "GetWindowsDirectory failed with error %d\n", GetLastError());
3899
3900     SetLastError(0xdeadbeef);
3901     error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,
3902         OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
3903         NULL, NULL, NULL, NULL, &pSD);
3904     if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3905     {
3906         win_skip("GetNamedSecurityInfoA is not implemented\n");
3907         HeapFree(GetProcessHeap(), 0, user);
3908         return;
3909     }
3910     ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3911
3912     bret = GetSecurityDescriptorControl(pSD, &control, &revision);
3913     ok(bret, "GetSecurityDescriptorControl failed with error %d\n", GetLastError());
3914     ok((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == (SE_SELF_RELATIVE|SE_DACL_PRESENT) ||
3915         broken((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == SE_DACL_PRESENT), /* NT4 */
3916         "control (0x%x) doesn't have (SE_SELF_RELATIVE|SE_DACL_PRESENT) flags set\n", control);
3917     ok(revision == SECURITY_DESCRIPTOR_REVISION1, "revision was %d instead of 1\n", revision);
3918
3919     isNT4 = (control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == SE_DACL_PRESENT;
3920
3921     bret = GetSecurityDescriptorOwner(pSD, &owner, &owner_defaulted);
3922     ok(bret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
3923     ok(owner != NULL, "owner should not be NULL\n");
3924
3925     bret = GetSecurityDescriptorGroup(pSD, &group, &group_defaulted);
3926     ok(bret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
3927     ok(group != NULL, "group should not be NULL\n");
3928     LocalFree(pSD);
3929
3930
3931     /* NULL descriptor tests */
3932     if(isNT4)
3933     {
3934         win_skip("NT4 does not support GetNamedSecutityInfo with a NULL descriptor\n");
3935         HeapFree(GetProcessHeap(), 0, user);
3936         return;
3937     }
3938
3939     error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,
3940         NULL, NULL, NULL, NULL, NULL);
3941     ok(error==ERROR_INVALID_PARAMETER, "GetNamedSecurityInfo failed with error %d\n", error);
3942
3943     pDacl = NULL;
3944     error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,
3945         NULL, NULL, &pDacl, NULL, &pSD);
3946     ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3947     ok(pDacl != NULL, "DACL should not be NULL\n");
3948     LocalFree(pSD);
3949
3950     error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,OWNER_SECURITY_INFORMATION,
3951         NULL, NULL, &pDacl, NULL, NULL);
3952     ok(error==ERROR_INVALID_PARAMETER, "GetNamedSecurityInfo failed with error %d\n", error);
3953
3954     /* Test behavior of SetNamedSecurityInfo with an invalid path */
3955     SetLastError(0xdeadbeef);
3956     error = pSetNamedSecurityInfoA(invalid_path, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL,
3957                                    NULL, NULL, NULL);
3958     ok(error == ERROR_FILE_NOT_FOUND, "Unexpected error returned: 0x%x\n", error);
3959     ok(GetLastError() == 0xdeadbeef, "Expected last error to remain unchanged.\n");
3960
3961     /* Create security descriptor information and test that it comes back the same */
3962     pSD = &sd;
3963     pDacl = HeapAlloc(GetProcessHeap(), 0, 100);
3964     InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3965     pCreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, admin_sid, &sid_size);
3966     bret = InitializeAcl(pDacl, 100, ACL_REVISION);
3967     ok(bret, "Failed to initialize ACL.\n");
3968     bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
3969     ok(bret, "Failed to add Current User to ACL.\n");
3970     bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, admin_sid);
3971     ok(bret, "Failed to add Administrator Group to ACL.\n");
3972     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3973     ok(bret, "Failed to add ACL to security descriptor.\n");
3974     GetTempFileNameA(".", "foo", 0, tmpfile);
3975     hTemp = CreateFileA(tmpfile, WRITE_DAC|GENERIC_WRITE, FILE_SHARE_DELETE|FILE_SHARE_READ,
3976                         NULL, OPEN_EXISTING, FILE_FLAG_DELETE_ON_CLOSE, NULL);
3977     SetLastError(0xdeadbeef);
3978     error = pSetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL,
3979                                    NULL, pDacl, NULL);
3980     HeapFree(GetProcessHeap(), 0, pDacl);
3981     if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3982     {
3983         win_skip("SetNamedSecurityInfoA is not implemented\n");
3984         HeapFree(GetProcessHeap(), 0, user);
3985         CloseHandle(hTemp);
3986         return;
3987     }
3988     ok(!error, "SetNamedSecurityInfoA failed with error %d\n", error);
3989     SetLastError(0xdeadbeef);
3990     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
3991                                    NULL, NULL, &pDacl, NULL, &pSD);
3992     if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3993     {
3994         win_skip("GetNamedSecurityInfoA is not implemented\n");
3995         HeapFree(GetProcessHeap(), 0, user);
3996         CloseHandle(hTemp);
3997         return;
3998     }
3999     ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
4000
4001     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
4002     ok(bret, "GetAclInformation failed\n");
4003     if (acl_size.AceCount > 0)
4004     {
4005         bret = pGetAce(pDacl, 0, (VOID **)&ace);
4006         ok(bret, "Failed to get Current User ACE.\n");
4007         bret = EqualSid(&ace->SidStart, user_sid);
4008         ok(bret, "Current User ACE (%s) != Current User SID (%s).\n",
4009            debugstr_sid(&ace->SidStart), debugstr_sid(user_sid));
4010         ok(((ACE_HEADER *)ace)->AceFlags == 0,
4011            "Current User ACE has unexpected flags (0x%x != 0x0)\n", ((ACE_HEADER *)ace)->AceFlags);
4012         ok(ace->Mask == 0x1f01ff,
4013            "Current User ACE has unexpected mask (0x%x != 0x1f01ff)\n", ace->Mask);
4014     }
4015     if (acl_size.AceCount > 1)
4016     {
4017         bret = pGetAce(pDacl, 1, (VOID **)&ace);
4018         ok(bret, "Failed to get Administators Group ACE.\n");
4019         bret = EqualSid(&ace->SidStart, admin_sid);
4020         ok(bret || broken(!bret) /* win2k */, "Administators Group ACE (%s) != Administators Group SID (%s).\n",
4021            debugstr_sid(&ace->SidStart), debugstr_sid(admin_sid));
4022         ok(((ACE_HEADER *)ace)->AceFlags == 0,
4023            "Administators Group ACE has unexpected flags (0x%x != 0x0)\n", ((ACE_HEADER *)ace)->AceFlags);
4024         ok(ace->Mask == 0x1f01ff || broken(ace->Mask == GENERIC_ALL) /* win2k */,
4025            "Administators Group ACE has unexpected mask (0x%x != 0x1f01ff)\n", ace->Mask);
4026     }
4027     LocalFree(pSD);
4028
4029     /* show that setting empty DACL is not removing all file permissions */
4030     pDacl = HeapAlloc(GetProcessHeap(), 0, sizeof(ACL));
4031     bret = InitializeAcl(pDacl, sizeof(ACL), ACL_REVISION);
4032     ok(bret, "Failed to initialize ACL.\n");
4033     error =  pSetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
4034             NULL, NULL, pDacl, NULL);
4035     ok(!error, "SetNamedSecurityInfoA failed with error %d\n", error);
4036     HeapFree(GetProcessHeap(), 0, pDacl);
4037
4038     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
4039             NULL, NULL, &pDacl, NULL, &pSD);
4040     ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
4041
4042     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
4043     ok(bret, "GetAclInformation failed\n");
4044     if (acl_size.AceCount > 0)
4045     {
4046         bret = pGetAce(pDacl, 0, (VOID **)&ace);
4047         ok(bret, "Failed to get ACE.\n");
4048         ok(((ACE_HEADER *)ace)->AceFlags & INHERITED_ACE,
4049            "ACE has unexpected flags: 0x%x\n", ((ACE_HEADER *)ace)->AceFlags);
4050     }
4051     LocalFree(pSD);
4052
4053     h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
4054             NULL, OPEN_EXISTING, 0, NULL);
4055     ok(h != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
4056     CloseHandle(h);
4057
4058     /* test setting NULL DACL */
4059     error = pSetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
4060             DACL_SECURITY_INFORMATION, NULL, NULL, NULL, NULL);
4061     ok(!error, "SetNamedSecurityInfoA failed with error %d\n", error);
4062
4063     error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
4064                 NULL, NULL, &pDacl, NULL, &pSD);
4065     ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
4066     todo_wine ok(!pDacl, "pDacl != NULL\n");
4067     LocalFree(pSD);
4068
4069     h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
4070             NULL, OPEN_EXISTING, 0, NULL);
4071     ok(h != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
4072     CloseHandle(h);
4073
4074     /* NtSetSecurityObject doesn't inherit DACL entries */
4075     pSD = sd+sizeof(void*)-((ULONG_PTR)sd)%sizeof(void*);
4076     InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
4077     pDacl = HeapAlloc(GetProcessHeap(), 0, 100);
4078     bret = InitializeAcl(pDacl, sizeof(ACL), ACL_REVISION);
4079     ok(bret, "Failed to initialize ACL.\n");
4080     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
4081     ok(bret, "Failed to add ACL to security descriptor.\n");
4082     status = pNtSetSecurityObject(hTemp, DACL_SECURITY_INFORMATION, pSD);
4083     ok(status == ERROR_SUCCESS, "NtSetSecurityObject returned %x\n", status);
4084
4085     h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
4086             NULL, OPEN_EXISTING, 0, NULL);
4087     ok(h == INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
4088     CloseHandle(h);
4089
4090     pSetSecurityDescriptorControl(pSD, SE_DACL_AUTO_INHERIT_REQ, SE_DACL_AUTO_INHERIT_REQ);
4091     status = pNtSetSecurityObject(hTemp, DACL_SECURITY_INFORMATION, pSD);
4092     ok(status == ERROR_SUCCESS, "NtSetSecurityObject returned %x\n", status);
4093
4094     h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
4095             NULL, OPEN_EXISTING, 0, NULL);
4096     ok(h == INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
4097     CloseHandle(h);
4098
4099     pSetSecurityDescriptorControl(pSD, SE_DACL_AUTO_INHERIT_REQ|SE_DACL_AUTO_INHERITED,
4100             SE_DACL_AUTO_INHERIT_REQ|SE_DACL_AUTO_INHERITED);
4101     status = pNtSetSecurityObject(hTemp, DACL_SECURITY_INFORMATION, pSD);
4102     ok(status == ERROR_SUCCESS, "NtSetSecurityObject returned %x\n", status);
4103
4104     h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
4105             NULL, OPEN_EXISTING, 0, NULL);
4106     ok(h == INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
4107     CloseHandle(h);
4108
4109     /* test if DACL is properly mapped to permission */
4110     bret = InitializeAcl(pDacl, 100, ACL_REVISION);
4111     ok(bret, "Failed to initialize ACL.\n");
4112     bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
4113     ok(bret, "Failed to add Current User to ACL.\n");
4114     bret = pAddAccessDeniedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
4115     ok(bret, "Failed to add Current User to ACL.\n");
4116     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
4117     ok(bret, "Failed to add ACL to security descriptor.\n");
4118     status = pNtSetSecurityObject(hTemp, DACL_SECURITY_INFORMATION, pSD);
4119     ok(status == ERROR_SUCCESS, "NtSetSecurityObject returned %x\n", status);
4120
4121     h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
4122             NULL, OPEN_EXISTING, 0, NULL);
4123     ok(h != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
4124     CloseHandle(h);
4125
4126     bret = InitializeAcl(pDacl, 100, ACL_REVISION);
4127     ok(bret, "Failed to initialize ACL.\n");
4128     bret = pAddAccessDeniedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
4129     ok(bret, "Failed to add Current User to ACL.\n");
4130     bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
4131     ok(bret, "Failed to add Current User to ACL.\n");
4132     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
4133     ok(bret, "Failed to add ACL to security descriptor.\n");
4134     status = pNtSetSecurityObject(hTemp, DACL_SECURITY_INFORMATION, pSD);
4135     ok(status == ERROR_SUCCESS, "NtSetSecurityObject returned %x\n", status);
4136
4137     h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
4138             NULL, OPEN_EXISTING, 0, NULL);
4139     ok(h == INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
4140     HeapFree(GetProcessHeap(), 0, pDacl);
4141     HeapFree(GetProcessHeap(), 0, user);
4142     CloseHandle(hTemp);
4143
4144     /* Test querying the ownership of a built-in registry key */
4145     sid_size = sizeof(system_ptr);
4146     pCreateWellKnownSid(WinLocalSystemSid, NULL, system_sid, &sid_size);
4147     error = pGetNamedSecurityInfoA(software_key, SE_REGISTRY_KEY,
4148                                    OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION,
4149                                    NULL, NULL, NULL, NULL, &pSD);
4150     ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
4151
4152     bret = GetSecurityDescriptorOwner(pSD, &owner, &owner_defaulted);
4153     ok(bret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
4154     ok(owner != NULL, "owner should not be NULL\n");
4155     ok(EqualSid(owner, admin_sid), "MACHINE\\Software owner SID (%s) != Administrators SID (%s).\n", debugstr_sid(owner), debugstr_sid(admin_sid));
4156
4157     bret = GetSecurityDescriptorGroup(pSD, &group, &group_defaulted);
4158     ok(bret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
4159     ok(group != NULL, "group should not be NULL\n");
4160     ok(EqualSid(group, admin_sid) || broken(EqualSid(group, system_sid)) /* before Win7 */
4161        || broken(((SID*)group)->SubAuthority[0] == SECURITY_NT_NON_UNIQUE) /* Vista */,
4162        "MACHINE\\Software group SID (%s) != Local System SID (%s or %s)\n",
4163        debugstr_sid(group), debugstr_sid(admin_sid), debugstr_sid(system_sid));
4164     LocalFree(pSD);
4165
4166     /* Test querying the DACL of a built-in registry key */
4167     sid_size = sizeof(users_ptr);
4168     pCreateWellKnownSid(WinBuiltinUsersSid, NULL, users_sid, &sid_size);
4169     error = pGetNamedSecurityInfoA(software_key, SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION,
4170                                    NULL, NULL, NULL, NULL, &pSD);
4171     ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
4172
4173     bret = GetSecurityDescriptorDacl(pSD, &dacl_present, &pDacl, &dacl_defaulted);
4174     ok(bret, "GetSecurityDescriptorDacl failed with error %d\n", GetLastError());
4175     ok(dacl_present, "DACL should be present\n");
4176     ok(pDacl && IsValidAcl(pDacl), "GetSecurityDescriptorDacl returned invalid DACL.\n");
4177     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
4178     ok(bret, "GetAclInformation failed\n");
4179     ok(acl_size.AceCount != 0, "GetAclInformation returned no ACLs\n");
4180     for (i=0; i<acl_size.AceCount; i++)
4181     {
4182         bret = pGetAce(pDacl, i, (VOID **)&ace);
4183         ok(bret, "Failed to get ACE %d.\n", i);
4184         bret = EqualSid(&ace->SidStart, users_sid);
4185         if (bret) users_ace_id = i;
4186         bret = EqualSid(&ace->SidStart, admin_sid);
4187         if (bret) admins_ace_id = i;
4188     }
4189     ok(users_ace_id != -1 || broken(users_ace_id == -1) /* win2k */,
4190        "Bultin Users ACE not found.\n");
4191     if (users_ace_id != -1)
4192     {
4193         bret = pGetAce(pDacl, users_ace_id, (VOID **)&ace);
4194         ok(bret, "Failed to get Builtin Users ACE.\n");
4195         flags = ((ACE_HEADER *)ace)->AceFlags;
4196         ok(flags == (INHERIT_ONLY_ACE|CONTAINER_INHERIT_ACE)
4197            || broken(flags == (INHERIT_ONLY_ACE|CONTAINER_INHERIT_ACE|INHERITED_ACE)) /* w2k8 */,
4198            "Builtin Users ACE has unexpected flags (0x%x != 0x%x)\n", flags,
4199            INHERIT_ONLY_ACE|CONTAINER_INHERIT_ACE);
4200         ok(ace->Mask == GENERIC_READ, "Builtin Users ACE has unexpected mask (0x%x != 0x%x)\n",
4201                                       ace->Mask, GENERIC_READ);
4202     }
4203     ok(admins_ace_id != -1, "Bultin Admins ACE not found.\n");
4204     if (admins_ace_id != -1)
4205     {
4206         bret = pGetAce(pDacl, admins_ace_id, (VOID **)&ace);
4207         ok(bret, "Failed to get Builtin Admins ACE.\n");
4208         flags = ((ACE_HEADER *)ace)->AceFlags;
4209         ok(flags == 0x0
4210            || broken(flags == (INHERIT_ONLY_ACE|CONTAINER_INHERIT_ACE|INHERITED_ACE)) /* w2k8 */
4211            || broken(flags == (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE)), /* win7 */
4212            "Builtin Admins ACE has unexpected flags (0x%x != 0x0)\n", flags);
4213         ok(ace->Mask == KEY_ALL_ACCESS || broken(ace->Mask == GENERIC_ALL) /* w2k8 */,
4214            "Builtin Admins ACE has unexpected mask (0x%x != 0x%x)\n", ace->Mask, KEY_ALL_ACCESS);
4215     }
4216     LocalFree(pSD);
4217 }
4218
4219 static void test_ConvertStringSecurityDescriptor(void)
4220 {
4221     BOOL ret;
4222     PSECURITY_DESCRIPTOR pSD;
4223     static const WCHAR Blank[] = { 0 };
4224     unsigned int i;
4225     static const struct
4226     {
4227         const char *sidstring;
4228         DWORD      revision;
4229         BOOL       ret;
4230         DWORD      GLE;
4231         DWORD      altGLE;
4232     } cssd[] =
4233     {
4234         { "D:(A;;GA;;;WD)",                  0xdeadbeef,      FALSE, ERROR_UNKNOWN_REVISION },
4235         /* test ACE string type */
4236         { "D:(A;;GA;;;WD)",                  SDDL_REVISION_1, TRUE },
4237         { "D:(D;;GA;;;WD)",                  SDDL_REVISION_1, TRUE },
4238         { "ERROR:(D;;GA;;;WD)",              SDDL_REVISION_1, FALSE, ERROR_INVALID_PARAMETER },
4239         /* test ACE string with spaces */
4240         { " D:(D;;GA;;;WD)",                SDDL_REVISION_1, TRUE },
4241         { "D: (D;;GA;;;WD)",                SDDL_REVISION_1, TRUE },
4242         { "D:( D;;GA;;;WD)",                SDDL_REVISION_1, TRUE },
4243         { "D:(D ;;GA;;;WD)",                SDDL_REVISION_1, FALSE, RPC_S_INVALID_STRING_UUID, ERROR_INVALID_ACL }, /* Vista+ */
4244         { "D:(D; ;GA;;;WD)",                SDDL_REVISION_1, TRUE },
4245         { "D:(D;; GA;;;WD)",                SDDL_REVISION_1, TRUE },
4246         { "D:(D;;GA ;;;WD)",                SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL },
4247         { "D:(D;;GA; ;;WD)",                SDDL_REVISION_1, TRUE },
4248         { "D:(D;;GA;; ;WD)",                SDDL_REVISION_1, TRUE },
4249         { "D:(D;;GA;;; WD)",                SDDL_REVISION_1, TRUE },
4250         { "D:(D;;GA;;;WD )",                SDDL_REVISION_1, TRUE },
4251         /* test ACE string access rights */
4252         { "D:(A;;GA;;;WD)",                  SDDL_REVISION_1, TRUE },
4253         { "D:(A;;GRGWGX;;;WD)",              SDDL_REVISION_1, TRUE },
4254         { "D:(A;;RCSDWDWO;;;WD)",            SDDL_REVISION_1, TRUE },
4255         { "D:(A;;RPWPCCDCLCSWLODTCR;;;WD)",  SDDL_REVISION_1, TRUE },
4256         { "D:(A;;FAFRFWFX;;;WD)",            SDDL_REVISION_1, TRUE },
4257         { "D:(A;;KAKRKWKX;;;WD)",            SDDL_REVISION_1, TRUE },
4258         { "D:(A;;0xFFFFFFFF;;;WD)",          SDDL_REVISION_1, TRUE },
4259         { "S:(AU;;0xFFFFFFFF;;;WD)",         SDDL_REVISION_1, TRUE },
4260         /* test ACE string access right error case */
4261         { "D:(A;;ROB;;;WD)",                 SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL },
4262         /* test behaviour with empty strings */
4263         { "",                                SDDL_REVISION_1, TRUE },
4264         /* test ACE string SID */
4265         { "D:(D;;GA;;;S-1-0-0)",             SDDL_REVISION_1, TRUE },
4266         { "D:(D;;GA;;;Nonexistent account)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL, ERROR_INVALID_SID } /* W2K */
4267     };
4268
4269     if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
4270     {
4271         win_skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
4272         return;
4273     }
4274
4275     for (i = 0; i < sizeof(cssd)/sizeof(cssd[0]); i++)
4276     {
4277         DWORD GLE;
4278
4279         SetLastError(0xdeadbeef);
4280         ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
4281             cssd[i].sidstring, cssd[i].revision, &pSD, NULL);
4282         GLE = GetLastError();
4283         ok(ret == cssd[i].ret, "(%02u) Expected %s (%d)\n", i, cssd[i].ret ? "success" : "failure", GLE);
4284         if (!cssd[i].ret)
4285             ok(GLE == cssd[i].GLE ||
4286                (cssd[i].altGLE && GLE == cssd[i].altGLE),
4287                "(%02u) Unexpected last error %d\n", i, GLE);
4288         if (ret)
4289             LocalFree(pSD);
4290     }
4291
4292     /* test behaviour with NULL parameters */
4293     SetLastError(0xdeadbeef);
4294     ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
4295         NULL, 0xdeadbeef, &pSD, NULL);
4296     todo_wine
4297     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
4298         "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
4299         GetLastError());
4300
4301     SetLastError(0xdeadbeef);
4302     ret = pConvertStringSecurityDescriptorToSecurityDescriptorW(
4303         NULL, 0xdeadbeef, &pSD, NULL);
4304     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
4305         "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
4306         GetLastError());
4307
4308     SetLastError(0xdeadbeef);
4309     ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
4310         "D:(A;;ROB;;;WD)", 0xdeadbeef, NULL, NULL);
4311     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
4312         "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
4313         GetLastError());
4314
4315     SetLastError(0xdeadbeef);
4316     ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
4317         "D:(A;;ROB;;;WD)", SDDL_REVISION_1, NULL, NULL);
4318     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
4319         "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
4320         GetLastError());
4321
4322     /* test behaviour with empty strings */
4323     SetLastError(0xdeadbeef);
4324     ret = pConvertStringSecurityDescriptorToSecurityDescriptorW(
4325         Blank, SDDL_REVISION_1, &pSD, NULL);
4326     ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
4327     LocalFree(pSD);
4328
4329     SetLastError(0xdeadbeef);
4330     ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
4331         "D:P(A;;GRGW;;;BA)(A;;GRGW;;;S-1-5-21-0-0-0-1000)S:(ML;;NWNR;;;S-1-16-12288)", SDDL_REVISION_1, &pSD, NULL);
4332     ok(ret || broken(!ret && GetLastError() == ERROR_INVALID_DATATYPE) /* win2k */,
4333        "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %u\n", GetLastError());
4334     if (ret) LocalFree(pSD);
4335 }
4336
4337 static void test_ConvertSecurityDescriptorToString(void)
4338 {
4339     SECURITY_DESCRIPTOR desc;
4340     SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
4341     LPSTR string;
4342     DWORD size;
4343     PSID psid, psid2;
4344     PACL pacl;
4345     char sid_buf[256];
4346     char acl_buf[8192];
4347     ULONG len;
4348
4349     if (!pConvertSecurityDescriptorToStringSecurityDescriptorA)
4350     {
4351         win_skip("ConvertSecurityDescriptorToStringSecurityDescriptor is not available\n");
4352         return;
4353     }
4354     if (!pCreateWellKnownSid)
4355     {
4356         win_skip("CreateWellKnownSid is not available\n");
4357         return;
4358     }
4359
4360 /* It seems Windows XP adds an extra character to the length of the string for each ACE in an ACL. We
4361  * don't replicate this feature so we only test len >= strlen+1. */
4362 #define CHECK_RESULT_AND_FREE(exp_str) \
4363     ok(strcmp(string, (exp_str)) == 0, "String mismatch (expected \"%s\", got \"%s\")\n", (exp_str), string); \
4364     ok(len >= (strlen(exp_str) + 1), "Length mismatch (expected %d, got %d)\n", lstrlenA(exp_str) + 1, len); \
4365     LocalFree(string);
4366
4367 #define CHECK_ONE_OF_AND_FREE(exp_str1, exp_str2) \
4368     ok(strcmp(string, (exp_str1)) == 0 || strcmp(string, (exp_str2)) == 0, "String mismatch (expected\n\"%s\" or\n\"%s\", got\n\"%s\")\n", (exp_str1), (exp_str2), string); \
4369     ok(len >= (strlen(exp_str1) + 1) || len >= (strlen(exp_str2) + 1), "Length mismatch (expected %d or %d, got %d)\n", lstrlenA(exp_str1) + 1, lstrlenA(exp_str2) + 1, len); \
4370     LocalFree(string);
4371
4372     InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION);
4373     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4374     CHECK_RESULT_AND_FREE("");
4375
4376     size = 4096;
4377     pCreateWellKnownSid(WinLocalSid, NULL, sid_buf, &size);
4378     SetSecurityDescriptorOwner(&desc, sid_buf, FALSE);
4379     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4380     CHECK_RESULT_AND_FREE("O:S-1-2-0");
4381
4382     SetSecurityDescriptorOwner(&desc, sid_buf, TRUE);
4383     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4384     CHECK_RESULT_AND_FREE("O:S-1-2-0");
4385
4386     size = sizeof(sid_buf);
4387     pCreateWellKnownSid(WinLocalSystemSid, NULL, sid_buf, &size);
4388     SetSecurityDescriptorOwner(&desc, sid_buf, TRUE);
4389     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4390     CHECK_RESULT_AND_FREE("O:SY");
4391
4392     pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid);
4393     SetSecurityDescriptorGroup(&desc, psid, TRUE);
4394     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4395     CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576");
4396
4397     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, GROUP_SECURITY_INFORMATION, &string, &len), "Conversion failed\n");
4398     CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
4399
4400     pacl = (PACL)acl_buf;
4401     InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
4402     SetSecurityDescriptorDacl(&desc, TRUE, pacl, TRUE);
4403     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4404     CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
4405
4406     SetSecurityDescriptorDacl(&desc, TRUE, pacl, FALSE);
4407     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4408     CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
4409
4410     pConvertStringSidToSidA("S-1-5-6", &psid2);
4411     pAddAccessAllowedAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, 0xf0000000, psid2);
4412     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4413     CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)");
4414
4415     pAddAccessAllowedAceEx(pacl, ACL_REVISION, INHERIT_ONLY_ACE|INHERITED_ACE, 0x00000003, psid2);
4416     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4417     CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)");
4418
4419     pAddAccessDeniedAceEx(pacl, ACL_REVISION, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE, 0xffffffff, psid);
4420     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4421     CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
4422
4423
4424     pacl = (PACL)acl_buf;
4425     InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
4426     SetSecurityDescriptorSacl(&desc, TRUE, pacl, FALSE);
4427     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4428     CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:");
4429
4430     /* fails in win2k */
4431     SetSecurityDescriptorDacl(&desc, TRUE, NULL, FALSE);
4432     pAddAuditAccessAceEx(pacl, ACL_REVISION, VALID_INHERIT_FLAGS, KEY_READ|KEY_WRITE, psid2, TRUE, TRUE);
4433     if (pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len))
4434     {
4435         CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)", /* XP */
4436             "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)" /* Vista */);
4437     }
4438
4439     /* fails in win2k */
4440     pAddAuditAccessAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, FILE_GENERIC_READ|FILE_GENERIC_WRITE, psid2, TRUE, FALSE);
4441     if (pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len))
4442     {
4443         CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", /* XP */
4444             "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)" /* Vista */);
4445     }
4446
4447     LocalFree(psid2);
4448     LocalFree(psid);
4449 }
4450
4451 static void test_SetSecurityDescriptorControl (PSECURITY_DESCRIPTOR sec)
4452 {
4453     SECURITY_DESCRIPTOR_CONTROL ref;
4454     SECURITY_DESCRIPTOR_CONTROL test;
4455
4456     SECURITY_DESCRIPTOR_CONTROL const mutable
4457         = SE_DACL_AUTO_INHERIT_REQ | SE_SACL_AUTO_INHERIT_REQ
4458         | SE_DACL_AUTO_INHERITED   | SE_SACL_AUTO_INHERITED
4459         | SE_DACL_PROTECTED        | SE_SACL_PROTECTED
4460         | 0x00000040               | 0x00000080        /* not defined in winnt.h */
4461         ;
4462     SECURITY_DESCRIPTOR_CONTROL const immutable
4463         = SE_OWNER_DEFAULTED       | SE_GROUP_DEFAULTED
4464         | SE_DACL_PRESENT          | SE_DACL_DEFAULTED
4465         | SE_SACL_PRESENT          | SE_SACL_DEFAULTED
4466         | SE_RM_CONTROL_VALID      | SE_SELF_RELATIVE
4467         ;
4468
4469     int     bit;
4470     DWORD   dwRevision;
4471     LPCSTR  fmt = "Expected error %s, got %u\n";
4472
4473     GetSecurityDescriptorControl (sec, &ref, &dwRevision);
4474
4475     /* The mutable bits are mutable regardless of the truth of
4476        SE_DACL_PRESENT and/or SE_SACL_PRESENT */
4477
4478     /* Check call barfs if any bit-of-interest is immutable */
4479     for (bit = 0; bit < 16; ++bit)
4480     {
4481         SECURITY_DESCRIPTOR_CONTROL const bitOfInterest = 1 << bit;
4482         SECURITY_DESCRIPTOR_CONTROL setOrClear = ref & bitOfInterest;
4483
4484         SECURITY_DESCRIPTOR_CONTROL ctrl;
4485
4486         DWORD   dwExpect  = (bitOfInterest & immutable)
4487                           ?  ERROR_INVALID_PARAMETER  :  0xbebecaca;
4488         LPCSTR  strExpect = (bitOfInterest & immutable)
4489                           ? "ERROR_INVALID_PARAMETER" : "0xbebecaca";
4490
4491         ctrl = (bitOfInterest & mutable) ? ref + bitOfInterest : ref;
4492         setOrClear ^= bitOfInterest;
4493         SetLastError (0xbebecaca);
4494         pSetSecurityDescriptorControl (sec, bitOfInterest, setOrClear);
4495         ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
4496         GetSecurityDescriptorControl(sec, &test, &dwRevision);
4497         expect_eq(test, ctrl, int, "%x");
4498
4499         setOrClear ^= bitOfInterest;
4500         SetLastError (0xbebecaca);
4501         pSetSecurityDescriptorControl (sec, bitOfInterest, setOrClear);
4502         ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
4503         GetSecurityDescriptorControl (sec, &test, &dwRevision);
4504         expect_eq(test, ref, int, "%x");
4505     }
4506
4507     /* Check call barfs if any bit-to-set is immutable
4508        even when not a bit-of-interest */
4509     for (bit = 0; bit < 16; ++bit)
4510     {
4511         SECURITY_DESCRIPTOR_CONTROL const bitsOfInterest = mutable;
4512         SECURITY_DESCRIPTOR_CONTROL setOrClear = ref & bitsOfInterest;
4513
4514         SECURITY_DESCRIPTOR_CONTROL ctrl;
4515
4516         DWORD   dwExpect  = ((1 << bit) & immutable)
4517                           ?  ERROR_INVALID_PARAMETER  :  0xbebecaca;
4518         LPCSTR  strExpect = ((1 << bit) & immutable)
4519                           ? "ERROR_INVALID_PARAMETER" : "0xbebecaca";
4520
4521         ctrl = ((1 << bit) & immutable) ? test : ref | mutable;
4522         setOrClear ^= bitsOfInterest;
4523         SetLastError (0xbebecaca);
4524         pSetSecurityDescriptorControl (sec, bitsOfInterest, setOrClear | (1 << bit));
4525         ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
4526         GetSecurityDescriptorControl(sec, &test, &dwRevision);
4527         expect_eq(test, ctrl, int, "%x");
4528
4529         ctrl = ((1 << bit) & immutable) ? test : ref | (1 << bit);
4530         setOrClear ^= bitsOfInterest;
4531         SetLastError (0xbebecaca);
4532         pSetSecurityDescriptorControl (sec, bitsOfInterest, setOrClear | (1 << bit));
4533         ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
4534         GetSecurityDescriptorControl(sec, &test, &dwRevision);
4535         expect_eq(test, ctrl, int, "%x");
4536     }
4537 }
4538
4539 static void test_PrivateObjectSecurity(void)
4540 {
4541     SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
4542     SECURITY_DESCRIPTOR_CONTROL ctrl;
4543     PSECURITY_DESCRIPTOR sec;
4544     DWORD dwDescSize;
4545     DWORD dwRevision;
4546     DWORD retSize;
4547     LPSTR string;
4548     ULONG len;
4549     PSECURITY_DESCRIPTOR buf;
4550     BOOL ret;
4551
4552     if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
4553     {
4554         win_skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
4555         return;
4556     }
4557
4558     ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
4559         "O:SY"
4560         "G:S-1-5-21-93476-23408-4576"
4561         "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)"
4562           "(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
4563         "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)",
4564         SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
4565
4566     test_SetSecurityDescriptorControl(sec);
4567
4568     LocalFree(sec);
4569
4570     ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
4571         "O:SY"
4572         "G:S-1-5-21-93476-23408-4576",
4573         SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
4574
4575     test_SetSecurityDescriptorControl(sec);
4576
4577     LocalFree(sec);
4578
4579     ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
4580         "O:SY"
4581         "G:S-1-5-21-93476-23408-4576"
4582         "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
4583         "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
4584     buf = HeapAlloc(GetProcessHeap(), 0, dwDescSize);
4585     pSetSecurityDescriptorControl(sec, SE_DACL_PROTECTED, SE_DACL_PROTECTED);
4586     GetSecurityDescriptorControl(sec, &ctrl, &dwRevision);
4587     expect_eq(ctrl, 0x9014, int, "%x");
4588
4589     ret = GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION, buf, dwDescSize, &retSize);
4590     ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
4591     ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
4592     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4593     CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
4594     GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
4595     expect_eq(ctrl, 0x8000, int, "%x");
4596
4597     ret = GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, buf, dwDescSize, &retSize);
4598     ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
4599     ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
4600     ret = pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len);
4601     ok(ret, "Conversion failed err=%u\n", GetLastError());
4602     CHECK_ONE_OF_AND_FREE("G:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)",
4603         "G:S-1-5-21-93476-23408-4576D:P(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"); /* Win7 */
4604     GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
4605     expect_eq(ctrl & (~ SE_DACL_PROTECTED), 0x8004, int, "%x");
4606
4607     ret = GetPrivateObjectSecurity(sec, sec_info, buf, dwDescSize, &retSize);
4608     ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
4609     ok(retSize == dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
4610     ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4611     CHECK_ONE_OF_AND_FREE("O:SY"
4612         "G:S-1-5-21-93476-23408-4576"
4613         "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
4614         "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)",
4615       "O:SY"
4616         "G:S-1-5-21-93476-23408-4576"
4617         "D:P(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
4618         "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)"); /* Win7 */
4619     GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
4620     expect_eq(ctrl & (~ SE_DACL_PROTECTED), 0x8014, int, "%x");
4621
4622     SetLastError(0xdeadbeef);
4623     ok(GetPrivateObjectSecurity(sec, sec_info, buf, 5, &retSize) == FALSE, "GetPrivateObjectSecurity should have failed\n");
4624     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Expected error ERROR_INSUFFICIENT_BUFFER, got %u\n", GetLastError());
4625
4626     LocalFree(sec);
4627     HeapFree(GetProcessHeap(), 0, buf);
4628 }
4629 #undef CHECK_RESULT_AND_FREE
4630 #undef CHECK_ONE_OF_AND_FREE
4631
4632 static void test_acls(void)
4633 {
4634     char buffer[256];
4635     PACL pAcl = (PACL)buffer;
4636     BOOL ret;
4637
4638     SetLastError(0xdeadbeef);
4639     ret = InitializeAcl(pAcl, sizeof(ACL) - 1, ACL_REVISION);
4640     if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
4641     {
4642         win_skip("InitializeAcl is not implemented\n");
4643         return;
4644     }
4645
4646     ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "InitializeAcl with too small a buffer should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", GetLastError());
4647
4648     SetLastError(0xdeadbeef);
4649     ret = InitializeAcl(pAcl, 0xffffffff, ACL_REVISION);
4650     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl with too large a buffer should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
4651
4652     SetLastError(0xdeadbeef);
4653     ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION1);
4654     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl(ACL_REVISION1) should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
4655
4656     ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION2);
4657     ok(ret, "InitializeAcl(ACL_REVISION2) failed with error %d\n", GetLastError());
4658
4659     ret = IsValidAcl(pAcl);
4660     ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
4661
4662     ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION3);
4663     ok(ret, "InitializeAcl(ACL_REVISION3) failed with error %d\n", GetLastError());
4664
4665     ret = IsValidAcl(pAcl);
4666     ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
4667
4668     SetLastError(0xdeadbeef);
4669     ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION4);
4670     if (GetLastError() != ERROR_INVALID_PARAMETER)
4671     {
4672         ok(ret, "InitializeAcl(ACL_REVISION4) failed with error %d\n", GetLastError());
4673
4674         ret = IsValidAcl(pAcl);
4675         ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
4676     }
4677     else
4678         win_skip("ACL_REVISION4 is not implemented on NT4\n");
4679
4680     SetLastError(0xdeadbeef);
4681     ret = InitializeAcl(pAcl, sizeof(buffer), -1);
4682     ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl(-1) failed with error %d\n", GetLastError());
4683 }
4684
4685 static void test_GetSecurityInfo(void)
4686 {
4687     char domain_users_ptr[sizeof(TOKEN_USER) + sizeof(SID) + sizeof(DWORD)*SID_MAX_SUB_AUTHORITIES];
4688     char b[sizeof(TOKEN_USER) + sizeof(SID) + sizeof(DWORD)*SID_MAX_SUB_AUTHORITIES];
4689     char admin_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES], dacl[100];
4690     PSID domain_users_sid = (PSID) domain_users_ptr, domain_sid;
4691     SID_IDENTIFIER_AUTHORITY sia = { SECURITY_NT_AUTHORITY };
4692     int domain_users_ace_id = -1, admins_ace_id = -1, i;
4693     DWORD sid_size = sizeof(admin_ptr), l = sizeof(b);
4694     PSID admin_sid = (PSID) admin_ptr, user_sid;
4695     char sd[SECURITY_DESCRIPTOR_MIN_LENGTH];
4696     BOOL owner_defaulted, group_defaulted;
4697     BOOL dacl_defaulted, dacl_present;
4698     ACL_SIZE_INFORMATION acl_size;
4699     PSECURITY_DESCRIPTOR pSD;
4700     ACCESS_ALLOWED_ACE *ace;
4701     HANDLE token, obj;
4702     PSID owner, group;
4703     BOOL bret = TRUE;
4704     PACL pDacl;
4705     BYTE flags;
4706     DWORD ret;
4707
4708     if (!pGetSecurityInfo || !pSetSecurityInfo)
4709     {
4710         win_skip("[Get|Set]SecurityInfo is not available\n");
4711         return;
4712     }
4713
4714     if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
4715     {
4716         if (GetLastError() != ERROR_NO_TOKEN) bret = FALSE;
4717         else if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) bret = FALSE;
4718     }
4719     if (!bret)
4720     {
4721         win_skip("Failed to get current user token\n");
4722         return;
4723     }
4724     bret = GetTokenInformation(token, TokenUser, b, l, &l);
4725     ok(bret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
4726     CloseHandle( token );
4727     user_sid = ((TOKEN_USER *)b)->User.Sid;
4728
4729     /* Create something.  Files have lots of associated security info.  */
4730     obj = CreateFileA(myARGV[0], GENERIC_READ|WRITE_DAC, FILE_SHARE_READ, NULL,
4731                       OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
4732     if (obj == INVALID_HANDLE_VALUE)
4733     {
4734         skip("Couldn't create an object for GetSecurityInfo test\n");
4735         return;
4736     }
4737
4738     ret = pGetSecurityInfo(obj, SE_FILE_OBJECT,
4739                           OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
4740                           &owner, &group, &pDacl, NULL, &pSD);
4741     if (ret == ERROR_CALL_NOT_IMPLEMENTED)
4742     {
4743         win_skip("GetSecurityInfo is not implemented\n");
4744         CloseHandle(obj);
4745         return;
4746     }
4747     ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
4748     ok(pSD != NULL, "GetSecurityInfo\n");
4749     ok(owner != NULL, "GetSecurityInfo\n");
4750     ok(group != NULL, "GetSecurityInfo\n");
4751     if (pDacl != NULL)
4752         ok(IsValidAcl(pDacl), "GetSecurityInfo\n");
4753     else
4754         win_skip("No ACL information returned\n");
4755
4756     LocalFree(pSD);
4757
4758     if (!pCreateWellKnownSid)
4759     {
4760         win_skip("NULL parameter test would crash on NT4\n");
4761         CloseHandle(obj);
4762         return;
4763     }
4764
4765     /* If we don't ask for the security descriptor, Windows will still give us
4766        the other stuff, leaving us no way to free it.  */
4767     ret = pGetSecurityInfo(obj, SE_FILE_OBJECT,
4768                           OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
4769                           &owner, &group, &pDacl, NULL, NULL);
4770     ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
4771     ok(owner != NULL, "GetSecurityInfo\n");
4772     ok(group != NULL, "GetSecurityInfo\n");
4773     if (pDacl != NULL)
4774         ok(IsValidAcl(pDacl), "GetSecurityInfo\n");
4775     else
4776         win_skip("No ACL information returned\n");
4777
4778     /* Create security descriptor information and test that it comes back the same */
4779     pSD = &sd;
4780     pDacl = (PACL)&dacl;
4781     InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
4782     pCreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, admin_sid, &sid_size);
4783     bret = InitializeAcl(pDacl, sizeof(dacl), ACL_REVISION);
4784     ok(bret, "Failed to initialize ACL.\n");
4785     bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
4786     ok(bret, "Failed to add Current User to ACL.\n");
4787     bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, admin_sid);
4788     ok(bret, "Failed to add Administrator Group to ACL.\n");
4789     bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
4790     ok(bret, "Failed to add ACL to security descriptor.\n");
4791     ret = pSetSecurityInfo(obj, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
4792                           NULL, NULL, pDacl, NULL);
4793     ok(ret == ERROR_SUCCESS, "SetSecurityInfo returned %d\n", ret);
4794     ret = pGetSecurityInfo(obj, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
4795                           NULL, NULL, &pDacl, NULL, &pSD);
4796     ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
4797     ok(pDacl && IsValidAcl(pDacl), "GetSecurityInfo returned invalid DACL.\n");
4798     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
4799     ok(bret, "GetAclInformation failed\n");
4800     if (acl_size.AceCount > 0)
4801     {
4802         bret = pGetAce(pDacl, 0, (VOID **)&ace);
4803         ok(bret, "Failed to get Current User ACE.\n");
4804         bret = EqualSid(&ace->SidStart, user_sid);
4805         ok(bret, "Current User ACE (%s) != Current User SID (%s).\n", debugstr_sid(&ace->SidStart), debugstr_sid(user_sid));
4806         ok(((ACE_HEADER *)ace)->AceFlags == 0,
4807            "Current User ACE has unexpected flags (0x%x != 0x0)\n", ((ACE_HEADER *)ace)->AceFlags);
4808         ok(ace->Mask == 0x1f01ff, "Current User ACE has unexpected mask (0x%x != 0x1f01ff)\n",
4809                                   ace->Mask);
4810     }
4811     if (acl_size.AceCount > 1)
4812     {
4813         bret = pGetAce(pDacl, 1, (VOID **)&ace);
4814         ok(bret, "Failed to get Administators Group ACE.\n");
4815         bret = EqualSid(&ace->SidStart, admin_sid);
4816         ok(bret, "Administators Group ACE (%s) != Administators Group SID (%s).\n", debugstr_sid(&ace->SidStart), debugstr_sid(admin_sid));
4817         ok(((ACE_HEADER *)ace)->AceFlags == 0,
4818            "Administators Group ACE has unexpected flags (0x%x != 0x0)\n", ((ACE_HEADER *)ace)->AceFlags);
4819         ok(ace->Mask == 0x1f01ff,
4820                      "Administators Group ACE has unexpected mask (0x%x != 0x1f01ff)\n", ace->Mask);
4821     }
4822     LocalFree(pSD);
4823     CloseHandle(obj);
4824
4825     /* Obtain the "domain users" SID from the user SID */
4826     if (!AllocateAndInitializeSid(&sia, 4, *GetSidSubAuthority(user_sid, 0),
4827                                   *GetSidSubAuthority(user_sid, 1),
4828                                   *GetSidSubAuthority(user_sid, 2),
4829                                   *GetSidSubAuthority(user_sid, 3), 0, 0, 0, 0, &domain_sid))
4830     {
4831         win_skip("Failed to get current domain SID\n");
4832         return;
4833     }
4834     sid_size = sizeof(domain_users_ptr);
4835     pCreateWellKnownSid(WinAccountDomainUsersSid, domain_sid, domain_users_sid, &sid_size);
4836     FreeSid(domain_sid);
4837
4838     /* Test querying the ownership of a process */
4839     ret = pGetSecurityInfo(GetCurrentProcess(), SE_KERNEL_OBJECT,
4840                            OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION,
4841                            NULL, NULL, NULL, NULL, &pSD);
4842     ok(!ret, "GetNamedSecurityInfo failed with error %d\n", ret);
4843
4844     bret = GetSecurityDescriptorOwner(pSD, &owner, &owner_defaulted);
4845     ok(bret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
4846     ok(owner != NULL, "owner should not be NULL\n");
4847     ok(EqualSid(owner, admin_sid) || EqualSid(owner, user_sid),
4848        "Process owner SID != Administrators SID.\n");
4849
4850     bret = GetSecurityDescriptorGroup(pSD, &group, &group_defaulted);
4851     ok(bret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
4852     ok(group != NULL, "group should not be NULL\n");
4853     ok(EqualSid(group, domain_users_sid), "Process group SID != Domain Users SID.\n");
4854     LocalFree(pSD);
4855
4856     /* Test querying the DACL of a process */
4857     ret = pGetSecurityInfo(GetCurrentProcess(), SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION,
4858                                    NULL, NULL, NULL, NULL, &pSD);
4859     ok(!ret, "GetSecurityInfo failed with error %d\n", ret);
4860
4861     bret = GetSecurityDescriptorDacl(pSD, &dacl_present, &pDacl, &dacl_defaulted);
4862     ok(bret, "GetSecurityDescriptorDacl failed with error %d\n", GetLastError());
4863     ok(dacl_present, "DACL should be present\n");
4864     ok(pDacl && IsValidAcl(pDacl), "GetSecurityDescriptorDacl returned invalid DACL.\n");
4865     bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
4866     ok(bret, "GetAclInformation failed\n");
4867     ok(acl_size.AceCount != 0, "GetAclInformation returned no ACLs\n");
4868     for (i=0; i<acl_size.AceCount; i++)
4869     {
4870         bret = pGetAce(pDacl, i, (VOID **)&ace);
4871         ok(bret, "Failed to get ACE %d.\n", i);
4872         bret = EqualSid(&ace->SidStart, domain_users_sid);
4873         if (bret) domain_users_ace_id = i;
4874         bret = EqualSid(&ace->SidStart, admin_sid);
4875         if (bret) admins_ace_id = i;
4876     }
4877     ok(domain_users_ace_id != -1 || broken(domain_users_ace_id == -1) /* win2k */,
4878        "Domain Users ACE not found.\n");
4879     if (domain_users_ace_id != -1)
4880     {
4881         bret = pGetAce(pDacl, domain_users_ace_id, (VOID **)&ace);
4882         ok(bret, "Failed to get Domain Users ACE.\n");
4883         flags = ((ACE_HEADER *)ace)->AceFlags;
4884         ok(flags == (INHERIT_ONLY_ACE|CONTAINER_INHERIT_ACE),
4885            "Domain Users ACE has unexpected flags (0x%x != 0x%x)\n", flags,
4886            INHERIT_ONLY_ACE|CONTAINER_INHERIT_ACE);
4887         ok(ace->Mask == GENERIC_READ, "Domain Users ACE has unexpected mask (0x%x != 0x%x)\n",
4888                                       ace->Mask, GENERIC_READ);
4889     }
4890     ok(admins_ace_id != -1 || broken(admins_ace_id == -1) /* xp */,
4891        "Builtin Admins ACE not found.\n");
4892     if (admins_ace_id != -1)
4893     {
4894         bret = pGetAce(pDacl, admins_ace_id, (VOID **)&ace);
4895         ok(bret, "Failed to get Builtin Admins ACE.\n");
4896         flags = ((ACE_HEADER *)ace)->AceFlags;
4897         ok(flags == 0x0, "Builtin Admins ACE has unexpected flags (0x%x != 0x0)\n", flags);
4898         ok(ace->Mask == PROCESS_ALL_ACCESS || broken(ace->Mask == 0x1f0fff) /* win2k */,
4899            "Builtin Admins ACE has unexpected mask (0x%x != 0x%x)\n", ace->Mask, PROCESS_ALL_ACCESS);
4900     }
4901     LocalFree(pSD);
4902 }
4903
4904 static void test_GetSidSubAuthority(void)
4905 {
4906     PSID psid = NULL;
4907
4908     if (!pGetSidSubAuthority || !pConvertStringSidToSidA || !pIsValidSid || !pGetSidSubAuthorityCount)
4909     {
4910         win_skip("Some functions not available\n");
4911         return;
4912     }
4913     /* Note: on windows passing in an invalid index like -1, lets GetSidSubAuthority return 0x05000000 but
4914              still GetLastError returns ERROR_SUCCESS then. We don't test these unlikely cornercases here for now */
4915     ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576",&psid),"ConvertStringSidToSidA failed\n");
4916     ok(pIsValidSid(psid),"Sid is not valid\n");
4917     SetLastError(0xbebecaca);
4918     ok(*pGetSidSubAuthorityCount(psid) == 4,"GetSidSubAuthorityCount gave %d expected 4\n",*pGetSidSubAuthorityCount(psid));
4919     ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
4920     SetLastError(0xbebecaca);
4921     ok(*pGetSidSubAuthority(psid,0) == 21,"GetSidSubAuthority gave %d expected 21\n",*pGetSidSubAuthority(psid,0));
4922     ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
4923     SetLastError(0xbebecaca);
4924     ok(*pGetSidSubAuthority(psid,1) == 93476,"GetSidSubAuthority gave %d expected 93476\n",*pGetSidSubAuthority(psid,1));
4925     ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
4926     SetLastError(0xbebecaca);
4927     ok(pGetSidSubAuthority(psid,4) != NULL,"Expected out of bounds GetSidSubAuthority to return a non-NULL pointer\n");
4928     ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
4929     LocalFree(psid);
4930 }
4931
4932 static void test_CheckTokenMembership(void)
4933 {
4934     PTOKEN_GROUPS token_groups;
4935     DWORD size;
4936     HANDLE process_token, token;
4937     BOOL is_member;
4938     BOOL ret;
4939     DWORD i;
4940
4941     if (!pCheckTokenMembership)
4942     {
4943         win_skip("CheckTokenMembership is not available\n");
4944         return;
4945     }
4946     ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token);
4947     ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
4948
4949     ret = DuplicateToken(process_token, SecurityImpersonation, &token);
4950     ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
4951
4952     /* groups */
4953     ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
4954     ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
4955         "GetTokenInformation(TokenGroups) %s with error %d\n",
4956         ret ? "succeeded" : "failed", GetLastError());
4957     token_groups = HeapAlloc(GetProcessHeap(), 0, size);
4958     ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
4959     ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
4960
4961     for (i = 0; i < token_groups->GroupCount; i++)
4962     {
4963         if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED)
4964             break;
4965     }
4966
4967     if (i == token_groups->GroupCount)
4968     {
4969         HeapFree(GetProcessHeap(), 0, token_groups);
4970         CloseHandle(token);
4971         skip("user not a member of any group\n");
4972         return;
4973     }
4974
4975     is_member = FALSE;
4976     ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member);
4977     ok(ret, "CheckTokenMembership failed with error %d\n", GetLastError());
4978     ok(is_member, "CheckTokenMembership should have detected sid as member\n");
4979
4980     is_member = FALSE;
4981     ret = pCheckTokenMembership(NULL, token_groups->Groups[i].Sid, &is_member);
4982     ok(ret, "CheckTokenMembership failed with error %d\n", GetLastError());
4983     ok(is_member, "CheckTokenMembership should have detected sid as member\n");
4984
4985     is_member = TRUE;
4986     SetLastError(0xdeadbeef);
4987     ret = pCheckTokenMembership(process_token, token_groups->Groups[i].Sid, &is_member);
4988     ok(!ret && GetLastError() == ERROR_NO_IMPERSONATION_TOKEN,
4989         "CheckTokenMembership with process token %s with error %d\n",
4990         ret ? "succeeded" : "failed", GetLastError());
4991     ok(!is_member, "CheckTokenMembership should have cleared is_member\n");
4992
4993     HeapFree(GetProcessHeap(), 0, token_groups);
4994     CloseHandle(token);
4995     CloseHandle(process_token);
4996 }
4997
4998 static void test_EqualSid(void)
4999 {
5000     PSID sid1, sid2;
5001     BOOL ret;
5002     SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
5003     SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
5004
5005     SetLastError(0xdeadbeef);
5006     ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
5007         DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid1);
5008     if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
5009     {
5010         win_skip("AllocateAndInitializeSid is not implemented\n");
5011         return;
5012     }
5013     ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
5014     ok(GetLastError() == 0xdeadbeef,
5015        "AllocateAndInitializeSid shouldn't have set last error to %d\n",
5016        GetLastError());
5017
5018     ret = AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID,
5019         0, 0, 0, 0, 0, 0, 0, &sid2);
5020     ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
5021
5022     SetLastError(0xdeadbeef);
5023     ret = EqualSid(sid1, sid2);
5024     ok(!ret, "World and domain admins sids shouldn't have been equal\n");
5025     ok(GetLastError() == ERROR_SUCCESS ||
5026        broken(GetLastError() == 0xdeadbeef), /* NT4 */
5027        "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
5028        GetLastError());
5029
5030     SetLastError(0xdeadbeef);
5031     sid2 = FreeSid(sid2);
5032     ok(!sid2, "FreeSid should have returned NULL instead of %p\n", sid2);
5033     ok(GetLastError() == 0xdeadbeef,
5034        "FreeSid shouldn't have set last error to %d\n",
5035        GetLastError());
5036
5037     ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
5038         DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid2);
5039     ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
5040
5041     SetLastError(0xdeadbeef);
5042     ret = EqualSid(sid1, sid2);
5043     ok(ret, "Same sids should have been equal %s != %s\n",
5044        debugstr_sid(sid1), debugstr_sid(sid2));
5045     ok(GetLastError() == ERROR_SUCCESS ||
5046        broken(GetLastError() == 0xdeadbeef), /* NT4 */
5047        "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
5048        GetLastError());
5049
5050     ((SID *)sid2)->Revision = 2;
5051     SetLastError(0xdeadbeef);
5052     ret = EqualSid(sid1, sid2);
5053     ok(!ret, "EqualSid with invalid sid should have returned FALSE\n");
5054     ok(GetLastError() == ERROR_SUCCESS ||
5055        broken(GetLastError() == 0xdeadbeef), /* NT4 */
5056        "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
5057        GetLastError());
5058     ((SID *)sid2)->Revision = SID_REVISION;
5059
5060     FreeSid(sid1);
5061     FreeSid(sid2);
5062 }
5063
5064 static void test_GetUserNameA(void)
5065 {
5066     char buffer[UNLEN + 1], filler[UNLEN + 1];
5067     DWORD required_len, buffer_len;
5068     BOOL ret;
5069
5070     /* Test crashes on Windows. */
5071     if (0)
5072     {
5073         SetLastError(0xdeadbeef);
5074         GetUserNameA(NULL, NULL);
5075     }
5076
5077     SetLastError(0xdeadbeef);
5078     required_len = 0;
5079     ret = GetUserNameA(NULL, &required_len);
5080     ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
5081     ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
5082     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
5083
5084     SetLastError(0xdeadbeef);
5085     required_len = 1;
5086     ret = GetUserNameA(NULL, &required_len);
5087     ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
5088     ok(required_len != 0 && required_len != 1, "Outputted buffer length was %u\n", required_len);
5089     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
5090
5091     /* Tests crashes on Windows. */
5092     if (0)
5093     {
5094         SetLastError(0xdeadbeef);
5095         required_len = UNLEN + 1;
5096         GetUserNameA(NULL, &required_len);
5097
5098         SetLastError(0xdeadbeef);
5099         GetUserNameA(buffer, NULL);
5100     }
5101
5102     memset(filler, 'x', sizeof(filler));
5103
5104     /* Note that GetUserNameA on XP and newer outputs the number of bytes
5105      * required for a Unicode string, which affects a test in the next block. */
5106     SetLastError(0xdeadbeef);
5107     memcpy(buffer, filler, sizeof(filler));
5108     required_len = 0;
5109     ret = GetUserNameA(buffer, &required_len);
5110     ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
5111     ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was altered\n");
5112     ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
5113     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
5114
5115     SetLastError(0xdeadbeef);
5116     memcpy(buffer, filler, sizeof(filler));
5117     buffer_len = required_len;
5118     ret = GetUserNameA(buffer, &buffer_len);
5119     ok(ret == TRUE, "GetUserNameA returned %d, last error %u\n", ret, GetLastError());
5120     ok(memcmp(buffer, filler, sizeof(filler)) != 0, "Output buffer was untouched\n");
5121     ok(buffer_len == required_len ||
5122        broken(buffer_len == required_len / sizeof(WCHAR)), /* XP+ */
5123        "Outputted buffer length was %u\n", buffer_len);
5124
5125     /* Use the reported buffer size from the last GetUserNameA call and pass
5126      * a length that is one less than the required value. */
5127     SetLastError(0xdeadbeef);
5128     memcpy(buffer, filler, sizeof(filler));
5129     buffer_len--;
5130     ret = GetUserNameA(buffer, &buffer_len);
5131     ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
5132     ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was untouched\n");
5133     ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
5134     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
5135 }
5136
5137 static void test_GetUserNameW(void)
5138 {
5139     WCHAR buffer[UNLEN + 1], filler[UNLEN + 1];
5140     DWORD required_len, buffer_len;
5141     BOOL ret;
5142
5143     /* Test crashes on Windows. */
5144     if (0)
5145     {
5146         SetLastError(0xdeadbeef);
5147         GetUserNameW(NULL, NULL);
5148     }
5149
5150     SetLastError(0xdeadbeef);
5151     required_len = 0;
5152     ret = GetUserNameW(NULL, &required_len);
5153     ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
5154     ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
5155     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
5156
5157     SetLastError(0xdeadbeef);
5158     required_len = 1;
5159     ret = GetUserNameW(NULL, &required_len);
5160     ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
5161     ok(required_len != 0 && required_len != 1, "Outputted buffer length was %u\n", required_len);
5162     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
5163
5164     /* Tests crash on Windows. */
5165     if (0)
5166     {
5167         SetLastError(0xdeadbeef);
5168         required_len = UNLEN + 1;
5169         GetUserNameW(NULL, &required_len);
5170
5171         SetLastError(0xdeadbeef);
5172         GetUserNameW(buffer, NULL);
5173     }
5174
5175     memset(filler, 'x', sizeof(filler));
5176
5177     SetLastError(0xdeadbeef);
5178     memcpy(buffer, filler, sizeof(filler));
5179     required_len = 0;
5180     ret = GetUserNameW(buffer, &required_len);
5181     ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
5182     ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was altered\n");
5183     ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
5184     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
5185
5186     SetLastError(0xdeadbeef);
5187     memcpy(buffer, filler, sizeof(filler));
5188     buffer_len = required_len;
5189     ret = GetUserNameW(buffer, &buffer_len);
5190     ok(ret == TRUE, "GetUserNameW returned %d, last error %u\n", ret, GetLastError());
5191     ok(memcmp(buffer, filler, sizeof(filler)) != 0, "Output buffer was untouched\n");
5192     ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
5193
5194     /* GetUserNameW on XP and newer writes a truncated portion of the username string to the buffer. */
5195     SetLastError(0xdeadbeef);
5196     memcpy(buffer, filler, sizeof(filler));
5197     buffer_len--;
5198     ret = GetUserNameW(buffer, &buffer_len);
5199     ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
5200     ok(!memcmp(buffer, filler, sizeof(filler)) ||
5201        broken(memcmp(buffer, filler, sizeof(filler)) != 0), /* XP+ */
5202        "Output buffer was altered\n");
5203     ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
5204     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
5205 }
5206
5207 static void test_CreateRestrictedToken(void)
5208 {
5209     HANDLE process_token, token, r_token;
5210     PTOKEN_GROUPS token_groups, groups2;
5211     SID_AND_ATTRIBUTES sattr;
5212     SECURITY_IMPERSONATION_LEVEL level;
5213     TOKEN_TYPE type;
5214     BOOL is_member;
5215     DWORD size;
5216     BOOL ret;
5217     DWORD i, j;
5218
5219     if (!pCreateRestrictedToken)
5220     {
5221         win_skip("CreateRestrictedToken is not available\n");
5222         return;
5223     }
5224
5225     ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token);
5226     ok(ret, "got error %d\n", GetLastError());
5227
5228     ret = DuplicateTokenEx(process_token, TOKEN_DUPLICATE|TOKEN_ADJUST_GROUPS|TOKEN_QUERY,
5229         NULL, SecurityImpersonation, TokenImpersonation, &token);
5230     ok(ret, "got error %d\n", GetLastError());
5231
5232     /* groups */
5233     ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
5234     ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
5235         "got %d with error %d\n", ret, GetLastError());
5236     token_groups = HeapAlloc(GetProcessHeap(), 0, size);
5237     ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
5238     ok(ret, "got error %d\n", GetLastError());
5239
5240     for (i = 0; i < token_groups->GroupCount; i++)
5241     {
5242         if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED)
5243             break;
5244     }
5245
5246     if (i == token_groups->GroupCount)
5247     {
5248         HeapFree(GetProcessHeap(), 0, token_groups);
5249         CloseHandle(token);
5250         skip("User not a member of any group\n");
5251         return;
5252     }
5253
5254     is_member = FALSE;
5255     ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member);
5256     ok(ret, "got error %d\n", GetLastError());
5257     ok(is_member, "not a member\n");
5258
5259     /* disable a SID in new token */
5260     sattr.Sid = token_groups->Groups[i].Sid;
5261     sattr.Attributes = 0;
5262     r_token = NULL;
5263     ret = pCreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token);
5264     ok(ret, "got error %d\n", GetLastError());
5265
5266     if (ret)
5267     {
5268         /* check if a SID is enabled */
5269         is_member = TRUE;
5270         ret = pCheckTokenMembership(r_token, token_groups->Groups[i].Sid, &is_member);
5271         ok(ret, "got error %d\n", GetLastError());
5272         todo_wine ok(!is_member, "not a member\n");
5273
5274         ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size);
5275         ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n",
5276             ret, GetLastError());
5277         groups2 = HeapAlloc(GetProcessHeap(), 0, size);
5278         ret = GetTokenInformation(r_token, TokenGroups, groups2, size, &size);
5279         ok(ret, "got error %d\n", GetLastError());
5280
5281         for (j = 0; j < groups2->GroupCount; j++)
5282         {
5283             if (EqualSid(groups2->Groups[j].Sid, token_groups->Groups[i].Sid))
5284                 break;
5285         }
5286
5287         todo_wine ok(groups2->Groups[j].Attributes & SE_GROUP_USE_FOR_DENY_ONLY,
5288             "got wrong attributes\n");
5289         todo_wine ok((groups2->Groups[j].Attributes & SE_GROUP_ENABLED) == 0,
5290             "got wrong attributes\n");
5291
5292         HeapFree(GetProcessHeap(), 0, groups2);
5293
5294         size = sizeof(type);
5295         ret = GetTokenInformation(r_token, TokenType, &type, size, &size);
5296         ok(ret, "got error %d\n", GetLastError());
5297         ok(type == TokenImpersonation, "got type %u\n", type);
5298
5299         size = sizeof(level);
5300         ret = GetTokenInformation(r_token, TokenImpersonationLevel, &level, size, &size);
5301         ok(ret, "got error %d\n", GetLastError());
5302         ok(level == SecurityImpersonation, "got level %u\n", type);
5303     }
5304
5305     HeapFree(GetProcessHeap(), 0, token_groups);
5306     CloseHandle(r_token);
5307     CloseHandle(token);
5308     CloseHandle(process_token);
5309 }
5310
5311 static void validate_default_security_descriptor(SECURITY_DESCRIPTOR *sd)
5312 {
5313     BOOL ret, present, defaulted;
5314     ACL *acl;
5315     void *sid;
5316
5317     ret = IsValidSecurityDescriptor(sd);
5318     ok(ret, "security descriptor is not valid\n");
5319
5320     present = -1;
5321     defaulted = -1;
5322     acl = (void *)0xdeadbeef;
5323     SetLastError(0xdeadbeef);
5324     ret = GetSecurityDescriptorDacl(sd, &present, &acl, &defaulted);
5325     ok(ret, "GetSecurityDescriptorDacl error %d\n", GetLastError());
5326 todo_wine
5327     ok(present == 1, "acl is not present\n");
5328 todo_wine
5329     ok(acl != (void *)0xdeadbeef && acl != NULL, "acl pointer is not set\n");
5330     ok(defaulted == 0, "defaulted is set to TRUE\n");
5331
5332     defaulted = -1;
5333     sid = (void *)0xdeadbeef;
5334     SetLastError(0xdeadbeef);
5335     ret = GetSecurityDescriptorOwner(sd, &sid, &defaulted);
5336     ok(ret, "GetSecurityDescriptorOwner error %d\n", GetLastError());
5337 todo_wine
5338     ok(sid != (void *)0xdeadbeef && sid != NULL, "sid pointer is not set\n");
5339     ok(defaulted == 0, "defaulted is set to TRUE\n");
5340
5341     defaulted = -1;
5342     sid = (void *)0xdeadbeef;
5343     SetLastError(0xdeadbeef);
5344     ret = GetSecurityDescriptorGroup(sd, &sid, &defaulted);
5345     ok(ret, "GetSecurityDescriptorGroup error %d\n", GetLastError());
5346 todo_wine
5347     ok(sid != (void *)0xdeadbeef && sid != NULL, "sid pointer is not set\n");
5348     ok(defaulted == 0, "defaulted is set to TRUE\n");
5349 }
5350
5351 static void test_default_handle_security(HANDLE token, HANDLE handle, GENERIC_MAPPING *mapping)
5352 {
5353     DWORD ret, granted, priv_set_len;
5354     BOOL status;
5355     PRIVILEGE_SET priv_set;
5356     SECURITY_DESCRIPTOR *sd;
5357
5358     sd = test_get_security_descriptor(handle, __LINE__);
5359     validate_default_security_descriptor(sd);
5360
5361     priv_set_len = sizeof(priv_set);
5362     granted = 0xdeadbeef;
5363     status = 0xdeadbeef;
5364     SetLastError(0xdeadbeef);
5365     ret = AccessCheck(sd, token, MAXIMUM_ALLOWED, mapping, &priv_set, &priv_set_len, &granted, &status);
5366 todo_wine {
5367     ok(ret, "AccessCheck error %d\n", GetLastError());
5368     ok(status == 1, "expected 1, got %d\n", status);
5369     ok(granted == mapping->GenericAll, "expected all access %#x, got %#x\n", mapping->GenericAll, granted);
5370 }
5371     priv_set_len = sizeof(priv_set);
5372     granted = 0xdeadbeef;
5373     status = 0xdeadbeef;
5374     SetLastError(0xdeadbeef);
5375     ret = AccessCheck(sd, token, 0, mapping, &priv_set, &priv_set_len, &granted, &status);
5376 todo_wine {
5377     ok(ret, "AccessCheck error %d\n", GetLastError());
5378     ok(status == 0 || broken(status == 1) /* NT4 */, "expected 0, got %d\n", status);
5379     ok(granted == 0 || broken(granted == mapping->GenericRead) /* NT4 */, "expected 0, got %#x\n", granted);
5380 }
5381     priv_set_len = sizeof(priv_set);
5382     granted = 0xdeadbeef;
5383     status = 0xdeadbeef;
5384     SetLastError(0xdeadbeef);
5385     ret = AccessCheck(sd, token, ACCESS_SYSTEM_SECURITY, mapping, &priv_set, &priv_set_len, &granted, &status);
5386 todo_wine {
5387     ok(ret, "AccessCheck error %d\n", GetLastError());
5388     ok(status == 0, "expected 0, got %d\n", status);
5389     ok(granted == 0, "expected 0, got %#x\n", granted);
5390 }
5391     priv_set_len = sizeof(priv_set);
5392     granted = 0xdeadbeef;
5393     status = 0xdeadbeef;
5394     SetLastError(0xdeadbeef);
5395     ret = AccessCheck(sd, token, mapping->GenericRead, mapping, &priv_set, &priv_set_len, &granted, &status);
5396 todo_wine {
5397     ok(ret, "AccessCheck error %d\n", GetLastError());
5398     ok(status == 1, "expected 1, got %d\n", status);
5399     ok(granted == mapping->GenericRead, "expected read access %#x, got %#x\n", mapping->GenericRead, granted);
5400 }
5401     priv_set_len = sizeof(priv_set);
5402     granted = 0xdeadbeef;
5403     status = 0xdeadbeef;
5404     SetLastError(0xdeadbeef);
5405     ret = AccessCheck(sd, token, mapping->GenericWrite, mapping, &priv_set, &priv_set_len, &granted, &status);
5406 todo_wine {
5407     ok(ret, "AccessCheck error %d\n", GetLastError());
5408     ok(status == 1, "expected 1, got %d\n", status);
5409     ok(granted == mapping->GenericWrite, "expected write access %#x, got %#x\n", mapping->GenericWrite, granted);
5410 }
5411     priv_set_len = sizeof(priv_set);
5412     granted = 0xdeadbeef;
5413     status = 0xdeadbeef;
5414     SetLastError(0xdeadbeef);
5415     ret = AccessCheck(sd, token, mapping->GenericExecute, mapping, &priv_set, &priv_set_len, &granted, &status);
5416 todo_wine {
5417     ok(ret, "AccessCheck error %d\n", GetLastError());
5418     ok(status == 1, "expected 1, got %d\n", status);
5419     ok(granted == mapping->GenericExecute, "expected execute access %#x, got %#x\n", mapping->GenericExecute, granted);
5420 }
5421     HeapFree(GetProcessHeap(), 0, sd);
5422 }
5423
5424 static ACCESS_MASK get_obj_access(HANDLE obj)
5425 {
5426     OBJECT_BASIC_INFORMATION info;
5427     NTSTATUS status;
5428
5429     if (!pNtQueryObject) return 0;
5430
5431     status = pNtQueryObject(obj, ObjectBasicInformation, &info, sizeof(info), NULL);
5432     ok(!status, "NtQueryObject error %#x\n", status);
5433
5434     return info.GrantedAccess;
5435 }
5436
5437 static void test_mutex_security(HANDLE token)
5438 {
5439     DWORD ret, i, access;
5440     HANDLE mutex, dup;
5441     GENERIC_MAPPING mapping = { STANDARD_RIGHTS_READ | MUTANT_QUERY_STATE | SYNCHRONIZE,
5442                                 STANDARD_RIGHTS_WRITE | MUTEX_MODIFY_STATE | SYNCHRONIZE,
5443                                 STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
5444                                 STANDARD_RIGHTS_ALL | MUTEX_ALL_ACCESS };
5445     static const struct
5446     {
5447         int generic, mapped;
5448     } map[] =
5449     {
5450         { 0, 0 },
5451         { GENERIC_READ, STANDARD_RIGHTS_READ | MUTANT_QUERY_STATE },
5452         { GENERIC_WRITE, STANDARD_RIGHTS_WRITE },
5453         { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE },
5454         { GENERIC_ALL, STANDARD_RIGHTS_ALL | MUTANT_QUERY_STATE }
5455     };
5456
5457     SetLastError(0xdeadbeef);
5458     mutex = OpenMutexA(0, FALSE, "WineTestMutex");
5459     ok(!mutex, "mutex should not exist\n");
5460     ok(GetLastError() == ERROR_FILE_NOT_FOUND, "wrong error %u\n", GetLastError());
5461
5462     SetLastError(0xdeadbeef);
5463     mutex = CreateMutexA(NULL, FALSE, "WineTestMutex");
5464     ok(mutex != 0, "CreateMutex error %d\n", GetLastError());
5465
5466     access = get_obj_access(mutex);
5467     ok(access == MUTANT_ALL_ACCESS, "expected MUTANT_ALL_ACCESS, got %#x\n", access);
5468
5469     for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5470     {
5471         SetLastError( 0xdeadbeef );
5472         ret = DuplicateHandle(GetCurrentProcess(), mutex, GetCurrentProcess(), &dup,
5473                               map[i].generic, FALSE, 0);
5474         ok(ret, "DuplicateHandle error %d\n", GetLastError());
5475
5476         access = get_obj_access(dup);
5477         ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5478
5479         CloseHandle(dup);
5480
5481         SetLastError(0xdeadbeef);
5482         dup = OpenMutexA(0, FALSE, "WineTestMutex");
5483 todo_wine
5484         ok(!dup, "OpenMutex should fail\n");
5485 todo_wine
5486         ok(GetLastError() == ERROR_ACCESS_DENIED, "wrong error %u\n", GetLastError());
5487     }
5488
5489     test_default_handle_security(token, mutex, &mapping);
5490
5491     CloseHandle (mutex);
5492 }
5493
5494 static void test_event_security(HANDLE token)
5495 {
5496     DWORD ret, i, access;
5497     HANDLE event, dup;
5498     GENERIC_MAPPING mapping = { STANDARD_RIGHTS_READ | EVENT_QUERY_STATE | SYNCHRONIZE,
5499                                 STANDARD_RIGHTS_WRITE | EVENT_MODIFY_STATE | SYNCHRONIZE,
5500                                 STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
5501                                 STANDARD_RIGHTS_ALL | EVENT_ALL_ACCESS };
5502     static const struct
5503     {
5504         int generic, mapped;
5505     } map[] =
5506     {
5507         { 0, 0 },
5508         { GENERIC_READ, STANDARD_RIGHTS_READ | EVENT_QUERY_STATE },
5509         { GENERIC_WRITE, STANDARD_RIGHTS_WRITE | EVENT_MODIFY_STATE },
5510         { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE },
5511         { GENERIC_ALL, STANDARD_RIGHTS_ALL | EVENT_QUERY_STATE | EVENT_MODIFY_STATE }
5512     };
5513
5514     SetLastError(0xdeadbeef);
5515     event = OpenEventA(0, FALSE, "WineTestEvent");
5516     ok(!event, "event should not exist\n");
5517     ok(GetLastError() == ERROR_FILE_NOT_FOUND, "wrong error %u\n", GetLastError());
5518
5519     SetLastError(0xdeadbeef);
5520     event = CreateEventA(NULL, FALSE, FALSE, "WineTestEvent");
5521     ok(event != 0, "CreateEvent error %d\n", GetLastError());
5522
5523     access = get_obj_access(event);
5524     ok(access == EVENT_ALL_ACCESS, "expected EVENT_ALL_ACCESS, got %#x\n", access);
5525
5526     for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5527     {
5528         SetLastError( 0xdeadbeef );
5529         ret = DuplicateHandle(GetCurrentProcess(), event, GetCurrentProcess(), &dup,
5530                               map[i].generic, FALSE, 0);
5531         ok(ret, "DuplicateHandle error %d\n", GetLastError());
5532
5533         access = get_obj_access(dup);
5534         ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5535
5536         CloseHandle(dup);
5537
5538         SetLastError(0xdeadbeef);
5539         dup = OpenEventA(0, FALSE, "WineTestEvent");
5540 todo_wine
5541         ok(!dup, "OpenEvent should fail\n");
5542 todo_wine
5543         ok(GetLastError() == ERROR_ACCESS_DENIED, "wrong error %u\n", GetLastError());
5544     }
5545
5546     test_default_handle_security(token, event, &mapping);
5547
5548     CloseHandle(event);
5549 }
5550
5551 static void test_semaphore_security(HANDLE token)
5552 {
5553     DWORD ret, i, access;
5554     HANDLE sem, dup;
5555     GENERIC_MAPPING mapping = { STANDARD_RIGHTS_READ | SEMAPHORE_QUERY_STATE,
5556                                 STANDARD_RIGHTS_WRITE | SEMAPHORE_MODIFY_STATE,
5557                                 STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
5558                                 STANDARD_RIGHTS_ALL | SEMAPHORE_ALL_ACCESS };
5559     static const struct
5560     {
5561         int generic, mapped;
5562     } map[] =
5563     {
5564         { 0, 0 },
5565         { GENERIC_READ, STANDARD_RIGHTS_READ | SEMAPHORE_QUERY_STATE },
5566         { GENERIC_WRITE, STANDARD_RIGHTS_WRITE | SEMAPHORE_MODIFY_STATE },
5567         { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE },
5568         { GENERIC_ALL, STANDARD_RIGHTS_ALL | SEMAPHORE_QUERY_STATE | SEMAPHORE_MODIFY_STATE }
5569     };
5570
5571     SetLastError(0xdeadbeef);
5572     sem = OpenSemaphoreA(0, FALSE, "WineTestSemaphore");
5573     ok(!sem, "semaphore should not exist\n");
5574     ok(GetLastError() == ERROR_FILE_NOT_FOUND, "wrong error %u\n", GetLastError());
5575
5576     SetLastError(0xdeadbeef);
5577     sem = CreateSemaphoreA(NULL, 0, 10, "WineTestSemaphore");
5578     ok(sem != 0, "CreateSemaphore error %d\n", GetLastError());
5579
5580     access = get_obj_access(sem);
5581     ok(access == SEMAPHORE_ALL_ACCESS, "expected SEMAPHORE_ALL_ACCESS, got %#x\n", access);
5582
5583     for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5584     {
5585         SetLastError( 0xdeadbeef );
5586         ret = DuplicateHandle(GetCurrentProcess(), sem, GetCurrentProcess(), &dup,
5587                               map[i].generic, FALSE, 0);
5588         ok(ret, "DuplicateHandle error %d\n", GetLastError());
5589
5590         access = get_obj_access(dup);
5591         ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5592
5593         CloseHandle(dup);
5594     }
5595
5596     test_default_handle_security(token, sem, &mapping);
5597
5598     CloseHandle(sem);
5599 }
5600
5601 #define WINE_TEST_PIPE "\\\\.\\pipe\\WineTestPipe"
5602 static void test_named_pipe_security(HANDLE token)
5603 {
5604     DWORD ret, i, access;
5605     HANDLE pipe, file, dup;
5606     GENERIC_MAPPING mapping = { FILE_GENERIC_READ,
5607                                 FILE_GENERIC_WRITE,
5608                                 FILE_GENERIC_EXECUTE,
5609                                 STANDARD_RIGHTS_ALL | FILE_ALL_ACCESS };
5610     static const struct
5611     {
5612         int todo, generic, mapped;
5613     } map[] =
5614     {
5615         { 0, 0, 0 },
5616         { 1, GENERIC_READ, FILE_GENERIC_READ },
5617         { 1, GENERIC_WRITE, FILE_GENERIC_WRITE },
5618         { 1, GENERIC_EXECUTE, FILE_GENERIC_EXECUTE },
5619         { 1, GENERIC_ALL, STANDARD_RIGHTS_ALL | FILE_ALL_ACCESS }
5620     };
5621     static const struct
5622     {
5623         DWORD open_mode;
5624         DWORD access;
5625     } creation_access[] =
5626     {
5627         { PIPE_ACCESS_INBOUND, FILE_GENERIC_READ },
5628         { PIPE_ACCESS_OUTBOUND, FILE_GENERIC_WRITE },
5629         { PIPE_ACCESS_DUPLEX, FILE_GENERIC_READ|FILE_GENERIC_WRITE },
5630         { PIPE_ACCESS_INBOUND|WRITE_DAC, FILE_GENERIC_READ|WRITE_DAC },
5631         { PIPE_ACCESS_INBOUND|WRITE_OWNER, FILE_GENERIC_READ|WRITE_OWNER }
5632         /* ACCESS_SYSTEM_SECURITY is also valid, but will fail with ERROR_PRIVILEGE_NOT_HELD */
5633     };
5634
5635     /* Test the different security access options for pipes */
5636     for (i = 0; i < sizeof(creation_access)/sizeof(creation_access[0]); i++)
5637     {
5638         SetLastError(0xdeadbeef);
5639         pipe = CreateNamedPipeA(WINE_TEST_PIPE, creation_access[i].open_mode,
5640                                 PIPE_TYPE_BYTE | PIPE_NOWAIT, PIPE_UNLIMITED_INSTANCES, 0, 0,
5641                                 NMPWAIT_USE_DEFAULT_WAIT, NULL);
5642         ok(pipe != INVALID_HANDLE_VALUE, "CreateNamedPipe(0x%x) error %d\n",
5643                                          creation_access[i].open_mode, GetLastError());
5644         access = get_obj_access(pipe);
5645         ok(access == creation_access[i].access,
5646            "CreateNamedPipeA(0x%x) pipe expected access 0x%x (got 0x%x)\n",
5647            creation_access[i].open_mode, creation_access[i].access, access);
5648         CloseHandle(pipe);
5649     }
5650
5651     SetLastError(0xdeadbeef);
5652     pipe = CreateNamedPipeA(WINE_TEST_PIPE, PIPE_ACCESS_DUPLEX | FILE_FLAG_FIRST_PIPE_INSTANCE,
5653                             PIPE_TYPE_BYTE | PIPE_NOWAIT, PIPE_UNLIMITED_INSTANCES,
5654                             0, 0, NMPWAIT_USE_DEFAULT_WAIT, NULL);
5655     ok(pipe != INVALID_HANDLE_VALUE, "CreateNamedPipe error %d\n", GetLastError());
5656
5657     test_default_handle_security(token, pipe, &mapping);
5658
5659     SetLastError(0xdeadbeef);
5660     file = CreateFileA(WINE_TEST_PIPE, FILE_ALL_ACCESS, 0, NULL, OPEN_EXISTING, 0, 0);
5661     ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5662
5663     access = get_obj_access(file);
5664     ok(access == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", access);
5665
5666     for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5667     {
5668         SetLastError( 0xdeadbeef );
5669         ret = DuplicateHandle(GetCurrentProcess(), file, GetCurrentProcess(), &dup,
5670                               map[i].generic, FALSE, 0);
5671         ok(ret, "DuplicateHandle error %d\n", GetLastError());
5672
5673         access = get_obj_access(dup);
5674         ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5675
5676         CloseHandle(dup);
5677     }
5678
5679     CloseHandle(file);
5680     CloseHandle(pipe);
5681
5682     SetLastError(0xdeadbeef);
5683     file = CreateFileA("\\\\.\\pipe\\", FILE_ALL_ACCESS, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, 0);
5684     ok(file != INVALID_HANDLE_VALUE || broken(file == INVALID_HANDLE_VALUE) /* before Vista */, "CreateFile error %d\n", GetLastError());
5685
5686     if (file != INVALID_HANDLE_VALUE)
5687     {
5688         access = get_obj_access(file);
5689         ok(access == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", access);
5690
5691         for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5692         {
5693             SetLastError( 0xdeadbeef );
5694             ret = DuplicateHandle(GetCurrentProcess(), file, GetCurrentProcess(), &dup,
5695                                   map[i].generic, FALSE, 0);
5696             ok(ret, "DuplicateHandle error %d\n", GetLastError());
5697
5698             access = get_obj_access(dup);
5699             todo_wine_if (map[i].todo)
5700                 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5701
5702             CloseHandle(dup);
5703         }
5704     }
5705
5706     CloseHandle(file);
5707 }
5708
5709 static void test_file_security(HANDLE token)
5710 {
5711     DWORD ret, i, access, bytes;
5712     HANDLE file, dup;
5713     static const struct
5714     {
5715         int generic, mapped;
5716     } map[] =
5717     {
5718         { 0, 0 },
5719         { GENERIC_READ, FILE_GENERIC_READ },
5720         { GENERIC_WRITE, FILE_GENERIC_WRITE },
5721         { GENERIC_EXECUTE, FILE_GENERIC_EXECUTE },
5722         { GENERIC_ALL, STANDARD_RIGHTS_ALL | FILE_ALL_ACCESS }
5723     };
5724     char temp_path[MAX_PATH];
5725     char file_name[MAX_PATH];
5726     char buf[16];
5727
5728     GetTempPathA(MAX_PATH, temp_path);
5729     GetTempFileNameA(temp_path, "tmp", 0, file_name);
5730
5731     /* file */
5732     SetLastError(0xdeadbeef);
5733     file = CreateFileA(file_name, GENERIC_ALL, 0, NULL, CREATE_ALWAYS, 0, NULL);
5734     ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5735
5736     access = get_obj_access(file);
5737     ok(access == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", access);
5738
5739     for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5740     {
5741         SetLastError( 0xdeadbeef );
5742         ret = DuplicateHandle(GetCurrentProcess(), file, GetCurrentProcess(), &dup,
5743                               map[i].generic, FALSE, 0);
5744         ok(ret, "DuplicateHandle error %d\n", GetLastError());
5745
5746         access = get_obj_access(dup);
5747         ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5748
5749         CloseHandle(dup);
5750     }
5751
5752     CloseHandle(file);
5753
5754     SetLastError(0xdeadbeef);
5755     file = CreateFileA(file_name, 0, 0, NULL, OPEN_EXISTING, 0, NULL);
5756     ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5757
5758     access = get_obj_access(file);
5759 todo_wine
5760     ok(access == (FILE_READ_ATTRIBUTES | SYNCHRONIZE), "expected FILE_READ_ATTRIBUTES | SYNCHRONIZE, got %#x\n", access);
5761
5762     bytes = 0xdeadbeef;
5763     SetLastError(0xdeadbeef);
5764     ret = ReadFile(file, buf, sizeof(buf), &bytes, NULL);
5765     ok(!ret, "ReadFile should fail\n");
5766     ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
5767     ok(bytes == 0, "expected 0, got %u\n", bytes);
5768
5769     CloseHandle(file);
5770
5771     SetLastError(0xdeadbeef);
5772     file = CreateFileA(file_name, GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, 0);
5773     ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5774
5775     access = get_obj_access(file);
5776 todo_wine
5777     ok(access == (FILE_GENERIC_WRITE | FILE_READ_ATTRIBUTES), "expected FILE_GENERIC_WRITE | FILE_READ_ATTRIBUTES, got %#x\n", access);
5778
5779     bytes = 0xdeadbeef;
5780     SetLastError(0xdeadbeef);
5781     ret = ReadFile(file, buf, sizeof(buf), &bytes, NULL);
5782     ok(!ret, "ReadFile should fail\n");
5783     ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
5784     ok(bytes == 0, "expected 0, got %u\n", bytes);
5785
5786     CloseHandle(file);
5787     DeleteFileA(file_name);
5788
5789     /* directory */
5790     SetLastError(0xdeadbeef);
5791     file = CreateFileA(temp_path, GENERIC_ALL, 0, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0);
5792     ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5793
5794     access = get_obj_access(file);
5795     ok(access == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", access);
5796
5797     for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5798     {
5799         SetLastError( 0xdeadbeef );
5800         ret = DuplicateHandle(GetCurrentProcess(), file, GetCurrentProcess(), &dup,
5801                               map[i].generic, FALSE, 0);
5802         ok(ret, "DuplicateHandle error %d\n", GetLastError());
5803
5804         access = get_obj_access(dup);
5805         ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5806
5807         CloseHandle(dup);
5808     }
5809
5810     CloseHandle(file);
5811
5812     SetLastError(0xdeadbeef);
5813     file = CreateFileA(temp_path, 0, 0, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0);
5814     ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5815
5816     access = get_obj_access(file);
5817 todo_wine
5818     ok(access == (FILE_READ_ATTRIBUTES | SYNCHRONIZE), "expected FILE_READ_ATTRIBUTES | SYNCHRONIZE, got %#x\n", access);
5819
5820     CloseHandle(file);
5821
5822     SetLastError(0xdeadbeef);
5823     file = CreateFileA(temp_path, GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0);
5824     ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5825
5826     access = get_obj_access(file);
5827 todo_wine
5828     ok(access == (FILE_GENERIC_WRITE | FILE_READ_ATTRIBUTES), "expected FILE_GENERIC_WRITE | FILE_READ_ATTRIBUTES, got %#x\n", access);
5829
5830     CloseHandle(file);
5831 }
5832
5833 static void test_filemap_security(void)
5834 {
5835     char temp_path[MAX_PATH];
5836     char file_name[MAX_PATH];
5837     DWORD ret, i, access;
5838     HANDLE file, mapping, dup, created_mapping;
5839     static const struct
5840     {
5841         int generic, mapped;
5842         BOOL open_only;
5843     } map[] =
5844     {
5845         { 0, 0 },
5846         { GENERIC_READ, STANDARD_RIGHTS_READ | SECTION_QUERY | SECTION_MAP_READ },
5847         { GENERIC_WRITE, STANDARD_RIGHTS_WRITE | SECTION_MAP_WRITE },
5848         { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SECTION_MAP_EXECUTE },
5849         { GENERIC_ALL, STANDARD_RIGHTS_REQUIRED | SECTION_ALL_ACCESS },
5850         { SECTION_MAP_READ | SECTION_MAP_WRITE, SECTION_MAP_READ | SECTION_MAP_WRITE },
5851         { SECTION_MAP_WRITE, SECTION_MAP_WRITE },
5852         { SECTION_MAP_READ | SECTION_QUERY, SECTION_MAP_READ | SECTION_QUERY },
5853         { SECTION_QUERY, SECTION_MAP_READ, TRUE },
5854         { SECTION_QUERY | SECTION_MAP_READ, SECTION_QUERY | SECTION_MAP_READ }
5855     };
5856     static const struct
5857     {
5858         int prot, mapped;
5859     } prot_map[] =
5860     {
5861         { 0, 0 },
5862         { PAGE_NOACCESS, 0 },
5863         { PAGE_READONLY, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ },
5864         { PAGE_READWRITE, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE },
5865         { PAGE_WRITECOPY, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ },
5866         { PAGE_EXECUTE, 0 },
5867         { PAGE_EXECUTE_READ, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_EXECUTE },
5868         { PAGE_EXECUTE_READWRITE, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE | SECTION_MAP_EXECUTE },
5869         { PAGE_EXECUTE_WRITECOPY, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_EXECUTE }
5870     };
5871
5872     GetTempPathA(MAX_PATH, temp_path);
5873     GetTempFileNameA(temp_path, "tmp", 0, file_name);
5874
5875     SetLastError(0xdeadbeef);
5876     file = CreateFileA(file_name, GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE, 0, NULL, CREATE_ALWAYS, 0, 0);
5877     ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5878     SetFilePointer(file, 4096, NULL, FILE_BEGIN);
5879     SetEndOfFile(file);
5880
5881     for (i = 0; i < sizeof(prot_map)/sizeof(prot_map[0]); i++)
5882     {
5883         if (map[i].open_only) continue;
5884
5885         SetLastError(0xdeadbeef);
5886         mapping = CreateFileMappingW(file, NULL, prot_map[i].prot, 0, 4096, NULL);
5887         if (prot_map[i].mapped)
5888         {
5889             if (!mapping)
5890             {
5891                 /* NT4 and win2k don't support EXEC on file mappings */
5892                 if (prot_map[i].prot == PAGE_EXECUTE_READ || prot_map[i].prot == PAGE_EXECUTE_READWRITE || prot_map[i].prot == PAGE_EXECUTE_WRITECOPY)
5893                 {
5894                     win_skip("CreateFileMapping doesn't support PAGE_EXECUTE protection\n");
5895                     continue;
5896                 }
5897             }
5898             ok(mapping != 0, "CreateFileMapping(%04x) error %d\n", prot_map[i].prot, GetLastError());
5899         }
5900         else
5901         {
5902             ok(!mapping, "CreateFileMapping(%04x) should fail\n", prot_map[i].prot);
5903             ok(GetLastError() == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
5904             continue;
5905         }
5906
5907         access = get_obj_access(mapping);
5908         ok(access == prot_map[i].mapped, "%d: expected %#x, got %#x\n", i, prot_map[i].mapped, access);
5909
5910         CloseHandle(mapping);
5911     }
5912
5913     SetLastError(0xdeadbeef);
5914     mapping = CreateFileMappingW(file, NULL, PAGE_EXECUTE_READWRITE, 0, 4096, NULL);
5915     if (!mapping)
5916     {
5917         /* NT4 and win2k don't support EXEC on file mappings */
5918         win_skip("CreateFileMapping doesn't support PAGE_EXECUTE protection\n");
5919         CloseHandle(file);
5920         DeleteFileA(file_name);
5921         return;
5922     }
5923     ok(mapping != 0, "CreateFileMapping error %d\n", GetLastError());
5924
5925     access = get_obj_access(mapping);
5926     ok(access == (STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE | SECTION_MAP_EXECUTE),
5927        "expected STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE | SECTION_MAP_EXECUTE, got %#x\n", access);
5928
5929     for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5930     {
5931         if (map[i].open_only) continue;
5932
5933         SetLastError( 0xdeadbeef );
5934         ret = DuplicateHandle(GetCurrentProcess(), mapping, GetCurrentProcess(), &dup,
5935                               map[i].generic, FALSE, 0);
5936         ok(ret, "DuplicateHandle error %d\n", GetLastError());
5937
5938         access = get_obj_access(dup);
5939         ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5940
5941         CloseHandle(dup);
5942     }
5943
5944     CloseHandle(mapping);
5945     CloseHandle(file);
5946     DeleteFileA(file_name);
5947
5948     created_mapping = CreateFileMappingA(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0, 0x1000,
5949                                          "Wine Test Open Mapping");
5950     ok(created_mapping != NULL, "CreateFileMapping failed with error %u\n", GetLastError());
5951
5952     for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5953     {
5954         if (!map[i].generic) continue;
5955
5956         mapping = OpenFileMappingA(map[i].generic, FALSE, "Wine Test Open Mapping");
5957         ok(mapping != NULL, "OpenFileMapping failed with error %d\n", GetLastError());
5958         access = get_obj_access(mapping);
5959         ok(access == map[i].mapped, "%d: unexpected access flags %#x, expected %#x\n",
5960            i, access, map[i].mapped);
5961         CloseHandle(mapping);
5962     }
5963
5964     CloseHandle(created_mapping);
5965 }
5966
5967 static void test_thread_security(void)
5968 {
5969     DWORD ret, i, access;
5970     HANDLE thread, dup;
5971     static const struct
5972     {
5973         int generic, mapped;
5974     } map[] =
5975     {
5976         { 0, 0 },
5977         { GENERIC_READ, STANDARD_RIGHTS_READ | THREAD_QUERY_INFORMATION | THREAD_GET_CONTEXT },
5978         { GENERIC_WRITE, STANDARD_RIGHTS_WRITE | THREAD_SET_INFORMATION | THREAD_SET_CONTEXT | THREAD_TERMINATE | THREAD_SUSPEND_RESUME | 0x4 },
5979         { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE },
5980         { GENERIC_ALL, THREAD_ALL_ACCESS_NT4 }
5981     };
5982
5983     SetLastError(0xdeadbeef);
5984     thread = CreateThread(NULL, 0, (void *)0xdeadbeef, NULL, CREATE_SUSPENDED, &ret);
5985     ok(thread != 0, "CreateThread error %d\n", GetLastError());
5986
5987     access = get_obj_access(thread);
5988     ok(access == THREAD_ALL_ACCESS_NT4 || access == THREAD_ALL_ACCESS_VISTA, "expected THREAD_ALL_ACCESS, got %#x\n", access);
5989
5990     for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5991     {
5992         SetLastError( 0xdeadbeef );
5993         ret = DuplicateHandle(GetCurrentProcess(), thread, GetCurrentProcess(), &dup,
5994                               map[i].generic, FALSE, 0);
5995         ok(ret, "DuplicateHandle error %d\n", GetLastError());
5996
5997         access = get_obj_access(dup);
5998         switch (map[i].generic)
5999         {
6000         case GENERIC_READ:
6001         case GENERIC_EXECUTE:
6002             ok(access == map[i].mapped ||
6003                access == (map[i].mapped | THREAD_QUERY_LIMITED_INFORMATION) /* Vista+ */ ||
6004                access == (map[i].mapped | THREAD_QUERY_LIMITED_INFORMATION | THREAD_RESUME) /* win8 */,
6005                "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
6006             break;
6007         case GENERIC_WRITE:
6008 todo_wine
6009             ok(access == map[i].mapped ||
6010                access == (map[i].mapped | THREAD_SET_LIMITED_INFORMATION) /* Vista+ */ ||
6011                access == (map[i].mapped | THREAD_SET_LIMITED_INFORMATION | THREAD_RESUME) /* win8 */,
6012                "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
6013             break;
6014         case GENERIC_ALL:
6015             ok(access == map[i].mapped || access == THREAD_ALL_ACCESS_VISTA,
6016                "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
6017             break;
6018         default:
6019             ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
6020             break;
6021         }
6022
6023         CloseHandle(dup);
6024     }
6025
6026     SetLastError( 0xdeadbeef );
6027     ret = DuplicateHandle(GetCurrentProcess(), thread, GetCurrentProcess(), &dup,
6028                           THREAD_QUERY_INFORMATION, FALSE, 0);
6029     ok(ret, "DuplicateHandle error %d\n", GetLastError());
6030     access = get_obj_access(dup);
6031     ok(access == (THREAD_QUERY_INFORMATION | THREAD_QUERY_LIMITED_INFORMATION) /* Vista+ */ ||
6032        access == THREAD_QUERY_INFORMATION /* before Vista */,
6033        "expected THREAD_QUERY_INFORMATION|THREAD_QUERY_LIMITED_INFORMATION, got %#x\n", access);
6034     CloseHandle(dup);
6035
6036     TerminateThread(thread, 0);
6037     CloseHandle(thread);
6038 }
6039
6040 static void test_process_access(void)
6041 {
6042     DWORD ret, i, access;
6043     HANDLE process, dup;
6044     STARTUPINFOA sti;
6045     PROCESS_INFORMATION pi;
6046     char cmdline[] = "winver.exe";
6047     static const struct
6048     {
6049         int generic, mapped;
6050     } map[] =
6051     {
6052         { 0, 0 },
6053         { GENERIC_READ, STANDARD_RIGHTS_READ | PROCESS_QUERY_INFORMATION | PROCESS_VM_READ },
6054         { GENERIC_WRITE, STANDARD_RIGHTS_WRITE | PROCESS_SET_QUOTA | PROCESS_SET_INFORMATION | PROCESS_SUSPEND_RESUME |
6055                          PROCESS_VM_WRITE | PROCESS_DUP_HANDLE | PROCESS_CREATE_PROCESS | PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION },
6056         { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE },
6057         { GENERIC_ALL, PROCESS_ALL_ACCESS_NT4 }
6058     };
6059
6060     memset(&sti, 0, sizeof(sti));
6061     sti.cb = sizeof(sti);
6062     SetLastError(0xdeadbeef);
6063     ret = CreateProcessA(NULL, cmdline, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &sti, &pi);
6064     ok(ret, "CreateProcess() error %d\n", GetLastError());
6065
6066     CloseHandle(pi.hThread);
6067     process = pi.hProcess;
6068
6069     access = get_obj_access(process);
6070     ok(access == PROCESS_ALL_ACCESS_NT4 || access == PROCESS_ALL_ACCESS_VISTA, "expected PROCESS_ALL_ACCESS, got %#x\n", access);
6071
6072     for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
6073     {
6074         SetLastError( 0xdeadbeef );
6075         ret = DuplicateHandle(GetCurrentProcess(), process, GetCurrentProcess(), &dup,
6076                               map[i].generic, FALSE, 0);
6077         ok(ret, "DuplicateHandle error %d\n", GetLastError());
6078
6079         access = get_obj_access(dup);
6080         switch (map[i].generic)
6081         {
6082         case GENERIC_READ:
6083             ok(access == map[i].mapped || access == (map[i].mapped | PROCESS_QUERY_LIMITED_INFORMATION) /* Vista+ */,
6084                "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
6085             break;
6086         case GENERIC_WRITE:
6087             ok(access == map[i].mapped ||
6088                access == (map[i].mapped | PROCESS_TERMINATE) /* before Vista */ ||
6089                access == (map[i].mapped | PROCESS_SET_LIMITED_INFORMATION) /* win8 */,
6090                "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
6091             break;
6092         case GENERIC_EXECUTE:
6093             ok(access == map[i].mapped || access == (map[i].mapped | PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_TERMINATE) /* Vista+ */,
6094                "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
6095             break;
6096         case GENERIC_ALL:
6097             ok(access == map[i].mapped || access == PROCESS_ALL_ACCESS_VISTA,
6098                "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
6099             break;
6100         default:
6101             ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
6102             break;
6103         }
6104
6105         CloseHandle(dup);
6106     }
6107
6108     SetLastError( 0xdeadbeef );
6109     ret = DuplicateHandle(GetCurrentProcess(), process, GetCurrentProcess(), &dup,
6110                           PROCESS_QUERY_INFORMATION, FALSE, 0);
6111     ok(ret, "DuplicateHandle error %d\n", GetLastError());
6112     access = get_obj_access(dup);
6113     ok(access == (PROCESS_QUERY_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION) /* Vista+ */ ||
6114        access == PROCESS_QUERY_INFORMATION /* before Vista */,
6115        "expected PROCESS_QUERY_INFORMATION|PROCESS_QUERY_LIMITED_INFORMATION, got %#x\n", access);
6116     CloseHandle(dup);
6117
6118     TerminateProcess(process, 0);
6119     CloseHandle(process);
6120 }
6121
6122 static BOOL validate_impersonation_token(HANDLE token, DWORD *token_type)
6123 {
6124     DWORD ret, needed;
6125     TOKEN_TYPE type;
6126     SECURITY_IMPERSONATION_LEVEL sil;
6127
6128     type = 0xdeadbeef;
6129     needed = 0;
6130     SetLastError(0xdeadbeef);
6131     ret = GetTokenInformation(token, TokenType, &type, sizeof(type), &needed);
6132     ok(ret, "GetTokenInformation error %d\n", GetLastError());
6133     ok(needed == sizeof(type), "GetTokenInformation should return required buffer length\n");
6134     ok(type == TokenPrimary || type == TokenImpersonation, "expected TokenPrimary or TokenImpersonation, got %d\n", type);
6135
6136     *token_type = type;
6137     if (type != TokenImpersonation) return FALSE;
6138
6139     needed = 0;
6140     SetLastError(0xdeadbeef);
6141     ret = GetTokenInformation(token, TokenImpersonationLevel, &sil, sizeof(sil), &needed);
6142     ok(ret, "GetTokenInformation error %d\n", GetLastError());
6143     ok(needed == sizeof(sil), "GetTokenInformation should return required buffer length\n");
6144     ok(sil == SecurityImpersonation, "expected SecurityImpersonation, got %d\n", sil);
6145
6146     needed = 0xdeadbeef;
6147     SetLastError(0xdeadbeef);
6148     ret = GetTokenInformation(token, TokenDefaultDacl, NULL, 0, &needed);
6149     ok(!ret, "GetTokenInformation should fail\n");
6150     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
6151     ok(needed != 0xdeadbeef, "GetTokenInformation should return required buffer length\n");
6152     ok(needed > sizeof(TOKEN_DEFAULT_DACL), "GetTokenInformation returned empty default DACL\n");
6153
6154     needed = 0xdeadbeef;
6155     SetLastError(0xdeadbeef);
6156     ret = GetTokenInformation(token, TokenOwner, NULL, 0, &needed);
6157     ok(!ret, "GetTokenInformation should fail\n");
6158     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
6159     ok(needed != 0xdeadbeef, "GetTokenInformation should return required buffer length\n");
6160     ok(needed > sizeof(TOKEN_OWNER), "GetTokenInformation returned empty token owner\n");
6161
6162     needed = 0xdeadbeef;
6163     SetLastError(0xdeadbeef);
6164     ret = GetTokenInformation(token, TokenPrimaryGroup, NULL, 0, &needed);
6165     ok(!ret, "GetTokenInformation should fail\n");
6166     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
6167     ok(needed != 0xdeadbeef, "GetTokenInformation should return required buffer length\n");
6168     ok(needed > sizeof(TOKEN_PRIMARY_GROUP), "GetTokenInformation returned empty token primary group\n");
6169
6170     return TRUE;
6171 }
6172
6173 static void test_kernel_objects_security(void)
6174 {
6175     HANDLE token, process_token;
6176     DWORD ret, token_type;
6177
6178     ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE | TOKEN_QUERY, &process_token);
6179     ok(ret, "OpenProcessToken error %d\n", GetLastError());
6180
6181     ret = validate_impersonation_token(process_token, &token_type);
6182     ok(token_type == TokenPrimary, "expected TokenPrimary, got %d\n", token_type);
6183     ok(!ret, "access token should not be an impersonation token\n");
6184
6185     ret = DuplicateToken(process_token, SecurityImpersonation, &token);
6186     ok(ret, "DuplicateToken error %d\n", GetLastError());
6187
6188     ret = validate_impersonation_token(token, &token_type);
6189     ok(ret, "access token should be a valid impersonation token\n");
6190     ok(token_type == TokenImpersonation, "expected TokenImpersonation, got %d\n", token_type);
6191
6192     test_mutex_security(token);
6193     test_event_security(token);
6194     test_named_pipe_security(token);
6195     test_semaphore_security(token);
6196     test_file_security(token);
6197     test_filemap_security();
6198     test_thread_security();
6199     test_process_access();
6200     /* FIXME: test other kernel object types */
6201
6202     CloseHandle(process_token);
6203     CloseHandle(token);
6204 }
6205
6206 static void test_TokenIntegrityLevel(void)
6207 {
6208     TOKEN_MANDATORY_LABEL *tml;
6209     BYTE buffer[64];        /* using max. 28 byte in win7 x64 */
6210     HANDLE token;
6211     DWORD size;
6212     DWORD res;
6213     static SID medium_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
6214                                                     {SECURITY_MANDATORY_HIGH_RID}};
6215     static SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
6216                                                     {SECURITY_MANDATORY_MEDIUM_RID}};
6217
6218     SetLastError(0xdeadbeef);
6219     res = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token);
6220     ok(res, "got %d with %d (expected TRUE)\n", res, GetLastError());
6221
6222     SetLastError(0xdeadbeef);
6223     res = GetTokenInformation(token, TokenIntegrityLevel, buffer, sizeof(buffer), &size);
6224
6225     /* not supported before Vista */
6226     if (!res && ((GetLastError() == ERROR_INVALID_PARAMETER) || GetLastError() == ERROR_INVALID_FUNCTION))
6227     {
6228         win_skip("TokenIntegrityLevel not supported\n");
6229         CloseHandle(token);
6230         return;
6231     }
6232
6233     ok(res, "got %u with %u (expected TRUE)\n", res, GetLastError());
6234     if (!res)
6235     {
6236         CloseHandle(token);
6237         return;
6238     }
6239
6240     tml = (TOKEN_MANDATORY_LABEL*) buffer;
6241     ok(tml->Label.Attributes == (SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED),
6242         "got 0x%x (expected 0x%x)\n", tml->Label.Attributes, (SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED));
6243
6244     ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level),
6245        "got %s (expected %s or %s)\n", debugstr_sid(tml->Label.Sid),
6246        debugstr_sid(&medium_level), debugstr_sid(&high_level));
6247
6248     CloseHandle(token);
6249 }
6250
6251 static void test_default_dacl_owner_sid(void)
6252 {
6253     HANDLE handle;
6254     BOOL ret, defaulted, present, found;
6255     DWORD size, index;
6256     SECURITY_DESCRIPTOR *sd;
6257     SECURITY_ATTRIBUTES sa;
6258     PSID owner;
6259     ACL *dacl;
6260     ACCESS_ALLOWED_ACE *ace;
6261
6262     sd = HeapAlloc( GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH );
6263     ret = InitializeSecurityDescriptor( sd, SECURITY_DESCRIPTOR_REVISION );
6264     ok( ret, "error %u\n", GetLastError() );
6265
6266     sa.nLength              = sizeof(SECURITY_ATTRIBUTES);
6267     sa.lpSecurityDescriptor = sd;
6268     sa.bInheritHandle       = FALSE;
6269     handle = CreateEventA( &sa, TRUE, TRUE, "test_event" );
6270     ok( handle != NULL, "error %u\n", GetLastError() );
6271
6272     size = 0;
6273     ret = GetKernelObjectSecurity( handle, OWNER_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, NULL, 0, &size );
6274     ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "error %u\n", GetLastError() );
6275
6276     sd = HeapAlloc( GetProcessHeap(), 0, size );
6277     ret = GetKernelObjectSecurity( handle, OWNER_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, sd, size, &size );
6278     ok( ret, "error %u\n", GetLastError() );
6279
6280     owner = (void *)0xdeadbeef;
6281     defaulted = TRUE;
6282     ret = GetSecurityDescriptorOwner( sd, &owner, &defaulted );
6283     ok( ret, "error %u\n", GetLastError() );
6284     ok( owner != (void *)0xdeadbeef, "owner not set\n" );
6285     ok( !defaulted, "owner defaulted\n" );
6286
6287     dacl = (void *)0xdeadbeef;
6288     present = FALSE;
6289     defaulted = TRUE;
6290     ret = GetSecurityDescriptorDacl( sd, &present, &dacl, &defaulted );
6291     ok( ret, "error %u\n", GetLastError() );
6292     ok( present, "dacl not present\n" );
6293     ok( dacl != (void *)0xdeadbeef, "dacl not set\n" );
6294     ok( !defaulted, "dacl defaulted\n" );
6295
6296     index = 0;
6297     found = FALSE;
6298     while (pGetAce( dacl, index++, (void **)&ace ))
6299     {
6300         if (EqualSid( &ace->SidStart, owner )) found = TRUE;
6301     }
6302     ok( found, "owner sid not found in dacl\n" );
6303
6304     HeapFree( GetProcessHeap(), 0, sa.lpSecurityDescriptor );
6305     HeapFree( GetProcessHeap(), 0, sd );
6306     CloseHandle( handle );
6307 }
6308
6309 static void test_AdjustTokenPrivileges(void)
6310 {
6311     TOKEN_PRIVILEGES tp, prev;
6312     HANDLE token;
6313     DWORD len;
6314     LUID luid;
6315     BOOL ret;
6316
6317     if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &token))
6318         return;
6319
6320     if (!LookupPrivilegeValueA(NULL, SE_BACKUP_NAME, &luid))
6321     {
6322         CloseHandle(token);
6323         return;
6324     }
6325
6326     tp.PrivilegeCount = 1;
6327     tp.Privileges[0].Luid = luid;
6328     tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
6329
6330     len = 0xdeadbeef;
6331     ret = AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, &len);
6332     ok(ret, "got %d\n", ret);
6333     ok(len == 0xdeadbeef, "got length %d\n", len);
6334
6335     /* revert */
6336     tp.PrivilegeCount = 1;
6337     tp.Privileges[0].Luid = luid;
6338     tp.Privileges[0].Attributes = 0;
6339     AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), &prev, NULL);
6340
6341     CloseHandle(token);
6342 }
6343
6344 static void test_AddAce(void)
6345 {
6346     static SID const sidWorld = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY} , { SECURITY_WORLD_RID } };
6347
6348     char acl_buf[1024], ace_buf[256];
6349     ACCESS_ALLOWED_ACE *ace = (ACCESS_ALLOWED_ACE*)ace_buf;
6350     PACL acl = (PACL)acl_buf;
6351     BOOL ret;
6352
6353     memset(ace, 0, sizeof(ace_buf));
6354     ace->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
6355     ace->Header.AceSize = sizeof(ACCESS_ALLOWED_ACE)-sizeof(DWORD)+sizeof(SID);
6356     memcpy(&ace->SidStart, &sidWorld, sizeof(sidWorld));
6357
6358     ret = InitializeAcl(acl, sizeof(acl_buf), ACL_REVISION2);
6359     ok(ret, "InitializeAcl failed: %d\n", GetLastError());
6360
6361     ret = AddAce(acl, ACL_REVISION1, MAXDWORD, ace, ace->Header.AceSize);
6362     ok(ret, "AddAce failed: %d\n", GetLastError());
6363     ret = AddAce(acl, ACL_REVISION2, MAXDWORD, ace, ace->Header.AceSize);
6364     ok(ret, "AddAce failed: %d\n", GetLastError());
6365     ret = AddAce(acl, ACL_REVISION3, MAXDWORD, ace, ace->Header.AceSize);
6366     ok(ret, "AddAce failed: %d\n", GetLastError());
6367     ok(acl->AclRevision == ACL_REVISION3, "acl->AclRevision = %d\n", acl->AclRevision);
6368     ret = AddAce(acl, ACL_REVISION4, MAXDWORD, ace, ace->Header.AceSize);
6369     ok(ret, "AddAce failed: %d\n", GetLastError());
6370     ok(acl->AclRevision == ACL_REVISION4, "acl->AclRevision = %d\n", acl->AclRevision);
6371     ret = AddAce(acl, ACL_REVISION1, MAXDWORD, ace, ace->Header.AceSize);
6372     ok(ret, "AddAce failed: %d\n", GetLastError());
6373     ok(acl->AclRevision == ACL_REVISION4, "acl->AclRevision = %d\n", acl->AclRevision);
6374     ret = AddAce(acl, ACL_REVISION2, MAXDWORD, ace, ace->Header.AceSize);
6375     ok(ret, "AddAce failed: %d\n", GetLastError());
6376
6377     ret = AddAce(acl, MIN_ACL_REVISION-1, MAXDWORD, ace, ace->Header.AceSize);
6378     ok(ret, "AddAce failed: %d\n", GetLastError());
6379     /* next test succeededs but corrupts ACL */
6380     ret = AddAce(acl, MAX_ACL_REVISION+1, MAXDWORD, ace, ace->Header.AceSize);
6381     ok(ret, "AddAce failed: %d\n", GetLastError());
6382     ok(acl->AclRevision == MAX_ACL_REVISION+1, "acl->AclRevision = %d\n", acl->AclRevision);
6383     SetLastError(0xdeadbeef);
6384     ret = AddAce(acl, ACL_REVISION1, MAXDWORD, ace, ace->Header.AceSize);
6385     ok(!ret, "AddAce succeeded\n");
6386     ok(GetLastError() == ERROR_INVALID_PARAMETER, "GetLastError() = %d\n", GetLastError());
6387 }
6388
6389 static void test_system_security_access(void)
6390 {
6391     static const WCHAR testkeyW[] =
6392         {'S','O','F','T','W','A','R','E','\\','W','i','n','e','\\','S','A','C','L','t','e','s','t',0};
6393     LONG res;
6394     HKEY hkey;
6395     PSECURITY_DESCRIPTOR sd;
6396     ACL *sacl;
6397     DWORD err, len = 128;
6398     TOKEN_PRIVILEGES priv, *priv_prev;
6399     HANDLE token;
6400     LUID luid;
6401     BOOL ret;
6402
6403     if (!OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &token )) return;
6404     if (!LookupPrivilegeValueA( NULL, SE_SECURITY_NAME, &luid ))
6405     {
6406         CloseHandle( token );
6407         return;
6408     }
6409
6410     /* ACCESS_SYSTEM_SECURITY requires special privilege */
6411     res = RegCreateKeyExW( HKEY_LOCAL_MACHINE, testkeyW, 0, NULL, 0, KEY_READ|ACCESS_SYSTEM_SECURITY, NULL, &hkey, NULL );
6412     if (res == ERROR_ACCESS_DENIED)
6413     {
6414         skip( "unprivileged user\n" );
6415         CloseHandle( token );
6416         return;
6417     }
6418     todo_wine ok( res == ERROR_PRIVILEGE_NOT_HELD, "got %d\n", res );
6419
6420     priv.PrivilegeCount = 1;
6421     priv.Privileges[0].Luid = luid;
6422     priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
6423
6424     priv_prev = HeapAlloc( GetProcessHeap(), 0, len );
6425     ret = AdjustTokenPrivileges( token, FALSE, &priv, len, priv_prev, &len );
6426     ok( ret, "got %u\n", GetLastError());
6427
6428     res = RegCreateKeyExW( HKEY_LOCAL_MACHINE, testkeyW, 0, NULL, 0, KEY_READ|ACCESS_SYSTEM_SECURITY, NULL, &hkey, NULL );
6429     if (res == ERROR_PRIVILEGE_NOT_HELD)
6430     {
6431         win_skip( "privilege not held\n" );
6432         HeapFree( GetProcessHeap(), 0, priv_prev );
6433         CloseHandle( token );
6434         return;
6435     }
6436     ok( !res, "got %d\n", res );
6437
6438     /* restore privileges */
6439     ret = AdjustTokenPrivileges( token, FALSE, priv_prev, 0, NULL, NULL );
6440     ok( ret, "got %u\n", GetLastError() );
6441     HeapFree( GetProcessHeap(), 0, priv_prev );
6442
6443     /* privilege is checked on access */
6444     err = GetSecurityInfo( hkey, SE_REGISTRY_KEY, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, &sacl, &sd );
6445     todo_wine ok( err == ERROR_PRIVILEGE_NOT_HELD, "got %u\n", err );
6446
6447     priv.PrivilegeCount = 1;
6448     priv.Privileges[0].Luid = luid;
6449     priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
6450
6451     priv_prev = HeapAlloc( GetProcessHeap(), 0, len );
6452     ret = AdjustTokenPrivileges( token, FALSE, &priv, len, priv_prev, &len );
6453     ok( ret, "got %u\n", GetLastError());
6454
6455     err = GetSecurityInfo( hkey, SE_REGISTRY_KEY, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, &sacl, &sd );
6456     ok( err == ERROR_SUCCESS, "got %u\n", err );
6457     RegCloseKey( hkey );
6458     LocalFree( sd );
6459
6460     /* handle created without ACCESS_SYSTEM_SECURITY, privilege held */
6461     res = RegCreateKeyExW( HKEY_LOCAL_MACHINE, testkeyW, 0, NULL, 0, KEY_READ, NULL, &hkey, NULL );
6462     ok( res == ERROR_SUCCESS, "got %d\n", res );
6463
6464     sd = NULL;
6465     err = GetSecurityInfo( hkey, SE_REGISTRY_KEY, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, &sacl, &sd );
6466     todo_wine ok( err == ERROR_SUCCESS, "got %u\n", err );
6467     RegCloseKey( hkey );
6468     LocalFree( sd );
6469
6470     /* restore privileges */
6471     ret = AdjustTokenPrivileges( token, FALSE, priv_prev, 0, NULL, NULL );
6472     ok( ret, "got %u\n", GetLastError() );
6473     HeapFree( GetProcessHeap(), 0, priv_prev );
6474
6475     /* handle created without ACCESS_SYSTEM_SECURITY, privilege not held */
6476     res = RegCreateKeyExW( HKEY_LOCAL_MACHINE, testkeyW, 0, NULL, 0, KEY_READ, NULL, &hkey, NULL );
6477     ok( res == ERROR_SUCCESS, "got %d\n", res );
6478
6479     err = GetSecurityInfo( hkey, SE_REGISTRY_KEY, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, &sacl, &sd );
6480     todo_wine ok( err == ERROR_PRIVILEGE_NOT_HELD, "got %u\n", err );
6481     RegCloseKey( hkey );
6482
6483     res = RegDeleteKeyW( HKEY_LOCAL_MACHINE, testkeyW );
6484     ok( !res, "got %d\n", res );
6485     CloseHandle( token );
6486 }
6487
6488 static void test_GetWindowsAccountDomainSid(void)
6489 {
6490     char *user, buffer1[SECURITY_MAX_SID_SIZE], buffer2[SECURITY_MAX_SID_SIZE];
6491     SID_IDENTIFIER_AUTHORITY domain_ident = { SECURITY_NT_AUTHORITY };
6492     PSID domain_sid = (PSID *)&buffer1;
6493     PSID domain_sid2 = (PSID *)&buffer2;
6494     DWORD sid_size;
6495     PSID user_sid;
6496     HANDLE token;
6497     BOOL bret = TRUE;
6498     int i;
6499
6500     if (!pGetWindowsAccountDomainSid)
6501     {
6502         win_skip("GetWindowsAccountDomainSid not available\n");
6503         return;
6504     }
6505
6506     if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
6507     {
6508         if (GetLastError() != ERROR_NO_TOKEN) bret = FALSE;
6509         else if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) bret = FALSE;
6510     }
6511     if (!bret)
6512     {
6513         win_skip("Failed to get current user token\n");
6514         return;
6515     }
6516
6517     bret = GetTokenInformation(token, TokenUser, NULL, 0, &sid_size);
6518     ok(!bret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
6519        "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
6520     user = HeapAlloc(GetProcessHeap(), 0, sid_size);
6521     bret = GetTokenInformation(token, TokenUser, user, sid_size, &sid_size);
6522     ok(bret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
6523     CloseHandle(token);
6524     user_sid = ((TOKEN_USER *)user)->User.Sid;
6525
6526     SetLastError(0xdeadbeef);
6527     bret = pGetWindowsAccountDomainSid(0, 0, 0);
6528     ok(!bret, "GetWindowsAccountDomainSid succeeded\n");
6529     ok(GetLastError() == ERROR_INVALID_SID, "expected ERROR_INVALID_SID, got %d\n", GetLastError());
6530
6531     SetLastError(0xdeadbeef);
6532     bret = pGetWindowsAccountDomainSid(user_sid, 0, 0);
6533     ok(!bret, "GetWindowsAccountDomainSid succeeded\n");
6534     ok(GetLastError() == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
6535
6536     sid_size = SECURITY_MAX_SID_SIZE;
6537     SetLastError(0xdeadbeef);
6538     bret = pGetWindowsAccountDomainSid(user_sid, 0, &sid_size);
6539     ok(!bret, "GetWindowsAccountDomainSid succeeded\n");
6540     ok(GetLastError() == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
6541     ok(sid_size == GetSidLengthRequired(4), "expected size %d, got %d\n", GetSidLengthRequired(4), sid_size);
6542
6543     SetLastError(0xdeadbeef);
6544     bret = pGetWindowsAccountDomainSid(user_sid, domain_sid, 0);
6545     ok(!bret, "GetWindowsAccountDomainSid succeeded\n");
6546     ok(GetLastError() == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
6547
6548     sid_size = 1;
6549     SetLastError(0xdeadbeef);
6550     bret = pGetWindowsAccountDomainSid(user_sid, domain_sid, &sid_size);
6551     ok(!bret, "GetWindowsAccountDomainSid succeeded\n");
6552     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
6553     ok(sid_size == GetSidLengthRequired(4), "expected size %d, got %d\n", GetSidLengthRequired(4), sid_size);
6554
6555     sid_size = SECURITY_MAX_SID_SIZE;
6556     bret = pGetWindowsAccountDomainSid(user_sid, domain_sid, &sid_size);
6557     ok(bret, "GetWindowsAccountDomainSid failed with error %d\n", GetLastError());
6558     ok(sid_size == GetSidLengthRequired(4), "expected size %d, got %d\n", GetSidLengthRequired(4), sid_size);
6559     InitializeSid(domain_sid2, &domain_ident, 4);
6560     for (i = 0; i < 4; i++)
6561         *GetSidSubAuthority(domain_sid2, i) = *GetSidSubAuthority(user_sid, i);
6562     ok(EqualSid(domain_sid, domain_sid2), "unexpected domain sid %s != %s\n",
6563        debugstr_sid(domain_sid), debugstr_sid(domain_sid2));
6564
6565     HeapFree(GetProcessHeap(), 0, user);
6566 }
6567
6568 static void test_GetSidIdentifierAuthority(void)
6569 {
6570     char buffer[SECURITY_MAX_SID_SIZE];
6571     PSID authority_sid = (PSID *)buffer;
6572     PSID_IDENTIFIER_AUTHORITY id;
6573     BOOL ret;
6574
6575     if (!pGetSidIdentifierAuthority)
6576     {
6577         win_skip("GetSidIdentifierAuthority not available\n");
6578         return;
6579     }
6580
6581     memset(buffer, 0xcc, sizeof(buffer));
6582     ret = IsValidSid(authority_sid);
6583     ok(!ret, "expected FALSE, got %u\n", ret);
6584
6585     SetLastError(0xdeadbeef);
6586     id = GetSidIdentifierAuthority(authority_sid);
6587     ok(id != NULL, "got NULL pointer as identifier authority\n");
6588     ok(GetLastError() == ERROR_SUCCESS, "expected ERROR_SUCCESS, got %u\n", GetLastError());
6589
6590     SetLastError(0xdeadbeef);
6591     id = GetSidIdentifierAuthority(NULL);
6592     ok(id != NULL, "got NULL pointer as identifier authority\n");
6593     ok(GetLastError() == ERROR_SUCCESS, "expected ERROR_SUCCESS, got %u\n", GetLastError());
6594 }
6595
6596 static void test_pseudo_tokens(void)
6597 {
6598     TOKEN_STATISTICS statistics1, statistics2;
6599     HANDLE token;
6600     DWORD retlen;
6601     BOOL ret;
6602
6603     ret = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token);
6604     ok(ret, "OpenProcessToken failed with error %u\n", GetLastError());
6605     memset(&statistics1, 0x11, sizeof(statistics1));
6606     ret = GetTokenInformation(token, TokenStatistics, &statistics1, sizeof(statistics1), &retlen);
6607     ok(ret, "GetTokenInformation failed with %u\n", GetLastError());
6608     CloseHandle(token);
6609
6610     /* test GetCurrentProcessToken() */
6611     SetLastError(0xdeadbeef);
6612     memset(&statistics2, 0x22, sizeof(statistics2));
6613     ret = GetTokenInformation(GetCurrentProcessToken(), TokenStatistics,
6614                               &statistics2, sizeof(statistics2), &retlen);
6615     ok(ret || broken(GetLastError() == ERROR_INVALID_HANDLE),
6616        "GetTokenInformation failed with %u\n", GetLastError());
6617     if (ret)
6618         ok(!memcmp(&statistics1, &statistics2, sizeof(statistics1)), "Token statistics do not match\n");
6619     else
6620         win_skip("CurrentProcessToken not supported, skipping test\n");
6621
6622     /* test GetCurrentThreadEffectiveToken() */
6623     SetLastError(0xdeadbeef);
6624     memset(&statistics2, 0x22, sizeof(statistics2));
6625     ret = GetTokenInformation(GetCurrentThreadEffectiveToken(), TokenStatistics,
6626                               &statistics2, sizeof(statistics2), &retlen);
6627     ok(ret || broken(GetLastError() == ERROR_INVALID_HANDLE),
6628        "GetTokenInformation failed with %u\n", GetLastError());
6629     if (ret)
6630         ok(!memcmp(&statistics1, &statistics2, sizeof(statistics1)), "Token statistics do not match\n");
6631     else
6632         win_skip("CurrentThreadEffectiveToken not supported, skipping test\n");
6633
6634     SetLastError(0xdeadbeef);
6635     ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
6636     ok(!ret, "OpenThreadToken should have failed\n");
6637     ok(GetLastError() == ERROR_NO_TOKEN, "Expected ERROR_NO_TOKEN, got %u\n", GetLastError());
6638
6639     /* test GetCurrentThreadToken() */
6640     SetLastError(0xdeadbeef);
6641     ret = GetTokenInformation(GetCurrentThreadToken(), TokenStatistics,
6642                               &statistics2, sizeof(statistics2), &retlen);
6643     todo_wine ok(GetLastError() == ERROR_NO_TOKEN || broken(GetLastError() == ERROR_INVALID_HANDLE),
6644                  "Expected ERROR_NO_TOKEN, got %u\n", GetLastError());
6645 }
6646
6647 START_TEST(security)
6648 {
6649     init();
6650     if (!hmod) return;
6651
6652     if (myARGC >= 3)
6653     {
6654         test_process_security_child();
6655         return;
6656     }
6657     test_kernel_objects_security();
6658     test_sid();
6659     test_trustee();
6660     test_luid();
6661     test_CreateWellKnownSid();
6662     test_FileSecurity();
6663     test_AccessCheck();
6664     test_token_attr();
6665     test_LookupAccountSid();
6666     test_LookupAccountName();
6667     test_security_descriptor();
6668     test_process_security();
6669     test_impersonation_level();
6670     test_SetEntriesInAclW();
6671     test_SetEntriesInAclA();
6672     test_CreateDirectoryA();
6673     test_GetNamedSecurityInfoA();
6674     test_ConvertStringSecurityDescriptor();
6675     test_ConvertSecurityDescriptorToString();
6676     test_PrivateObjectSecurity();
6677     test_acls();
6678     test_GetWindowsAccountDomainSid();
6679     test_GetSecurityInfo();
6680     test_GetSidSubAuthority();
6681     test_CheckTokenMembership();
6682     test_EqualSid();
6683     test_GetUserNameA();
6684     test_GetUserNameW();
6685     test_CreateRestrictedToken();
6686     test_TokenIntegrityLevel();
6687     test_default_dacl_owner_sid();
6688     test_AdjustTokenPrivileges();
6689     test_AddAce();
6690     test_system_security_access();
6691     test_GetSidIdentifierAuthority();
6692     test_pseudo_tokens();
6693 }