Synchronize up to trunk's revision r57784.

[reactos.git] / ntoskrnl / se / semgr.c

diff --git a/ntoskrnl/se/semgr.c b/ntoskrnl/se/semgr.c
index de37447..855f528 100644 (file)
--- a/ntoskrnl/se/semgr.c
+++ b/ntoskrnl/se/semgr.c
@@ -17,13 +17,15 @@
 
 PSE_EXPORTS SeExports = NULL;
 SE_EXPORTS SepExports;
+ULONG SidInTokenCalls = 0;
 
 extern ULONG ExpInitializationPhase;
 extern ERESOURCE SepSubjectContextLock;
 
 /* PRIVATE FUNCTIONS **********************************************************/
 
-static BOOLEAN INIT_FUNCTION
+static BOOLEAN
+INIT_FUNCTION
 SepInitExports(VOID)
 {
     SepExports.SeCreateTokenPrivilege = SeCreateTokenPrivilege;
@@ -84,6 +86,7 @@ SepInitExports(VOID)
 
 BOOLEAN
 NTAPI
+INIT_FUNCTION
 SepInitializationPhase0(VOID)
 {
     PAGED_CODE();
@@ -115,9 +118,11 @@ SepInitializationPhase0(VOID)
 
 BOOLEAN
 NTAPI
+INIT_FUNCTION
 SepInitializationPhase1(VOID)
 {
     NTSTATUS Status;
+
     PAGED_CODE();
 
     /* Insert the system token into the tree */
@@ -136,6 +141,7 @@ SepInitializationPhase1(VOID)
 
 BOOLEAN
 NTAPI
+INIT_FUNCTION
 SeInitSystem(VOID)
 {
     /* Check the initialization phase */
@@ -165,6 +171,7 @@ SeInitSystem(VOID)
 
 BOOLEAN
 NTAPI
+INIT_FUNCTION
 SeInitSRM(VOID)
 {
     OBJECT_ATTRIBUTES ObjectAttributes;
@@ -279,68 +286,8 @@ SeDefaultObjectMethod(IN PVOID Object,
     return STATUS_SUCCESS;
 }
 
-ULONG SidInTokenCalls = 0;
-
-static BOOLEAN
-SepSidInToken(PACCESS_TOKEN _Token,
-              PSID Sid)
-{
-    ULONG i;
-    PTOKEN Token = (PTOKEN)_Token;
-
-    PAGED_CODE();
-
-    SidInTokenCalls++;
-    if (!(SidInTokenCalls % 10000)) DPRINT1("SidInToken Calls: %d\n", SidInTokenCalls);
-    
-    if (Token->UserAndGroupCount == 0)
-    {
-        return FALSE;
-    }
-
-    for (i=0; i<Token->UserAndGroupCount; i++)
-    {
-        if (RtlEqualSid(Sid, Token->UserAndGroups[i].Sid))
-        {
-            if ((i == 0)|| (Token->UserAndGroups[i].Attributes & SE_GROUP_ENABLED))
-            {
-                return TRUE;
-            }
-
-            return FALSE;
-        }
-    }
-
-    return FALSE;
-}
-
-static BOOLEAN
-SepTokenIsOwner(PACCESS_TOKEN Token,
-                PSECURITY_DESCRIPTOR SecurityDescriptor)
-{
-    NTSTATUS Status;
-    PSID Sid = NULL;
-    BOOLEAN Defaulted;
-
-    Status = RtlGetOwnerSecurityDescriptor(SecurityDescriptor,
-                                           &Sid,
-                                           &Defaulted);
-    if (!NT_SUCCESS(Status))
-    {
-        DPRINT1("RtlGetOwnerSecurityDescriptor() failed (Status %lx)\n", Status);
-        return FALSE;
-    }
-
-    if (Sid == NULL)
-    {
-        DPRINT1("Owner Sid is NULL\n");
-        return FALSE;
-    }
-
-    return SepSidInToken(Token, Sid);
-}
-
-VOID NTAPI
+VOID
+NTAPI
 SeQuerySecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
                           OUT PACCESS_MASK DesiredAccess)
 {
@@ -351,13 +298,15 @@ SeQuerySecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
     {
         *DesiredAccess |= READ_CONTROL;
     }
+
     if (SecurityInformation & SACL_SECURITY_INFORMATION)
     {
         *DesiredAccess |= ACCESS_SYSTEM_SECURITY;
     }
 }
 
-VOID NTAPI
+VOID
+NTAPI
 SeSetSecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
                         OUT PACCESS_MASK DesiredAccess)
 {
@@ -367,10 +316,12 @@ SeSetSecurityAccessMask(IN SECURITY_INFORMATION SecurityInformation,
     {
         *DesiredAccess |= WRITE_OWNER;
     }
+
     if (SecurityInformation & DACL_SECURITY_INFORMATION)
     {
         *DesiredAccess |= WRITE_DAC;
     }
+
     if (SecurityInformation & SACL_SECURITY_INFORMATION)
     {
         *DesiredAccess |= ACCESS_SYSTEM_SECURITY;
@@ -494,7 +445,7 @@ SepAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
         {
             *GrantedAccess = DesiredAccess | PreviouslyGrantedAccess;
         }
-        
+
         *AccessStatus = STATUS_SUCCESS;
         return TRUE;
     }
@@ -695,6 +646,7 @@ SepAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
                 *GrantedAccess, DesiredAccess, GenericMapping);
         //*AccessStatus = STATUS_ACCESS_DENIED;
         //return FALSE;
+        *GrantedAccess = DesiredAccess;
         *AccessStatus = STATUS_SUCCESS;
         return TRUE;
     }
@@ -763,7 +715,8 @@ SepGetSDGroup(IN PSECURITY_DESCRIPTOR _SecurityDescriptor)
 /*
  * @implemented
  */
-BOOLEAN NTAPI
+BOOLEAN
+NTAPI
 SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
               IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
               IN BOOLEAN SubjectContextLocked,
@@ -828,7 +781,8 @@ SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
              SubjectSecurityContext->ClientToken : SubjectSecurityContext->PrimaryToken;
 
         if (SepTokenIsOwner(Token,
-                            SecurityDescriptor))
+                            SecurityDescriptor,
+                            FALSE))
         {
             if (DesiredAccess & MAXIMUM_ALLOWED)
                 PreviouslyGrantedAccess |= (WRITE_DAC | READ_CONTROL);
@@ -935,7 +889,7 @@ NtAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
     /* Reference the token */
     Status = ObReferenceObjectByHandle(TokenHandle,
                                        TOKEN_QUERY,
-                                       SepTokenObjectType,
+                                       SeTokenObjectType,
                                        PreviousMode,
                                        (PVOID*)&Token,
                                        NULL);
@@ -995,16 +949,15 @@ NtAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
     }
 
     /* Set up the subject context, and lock it */
-    SubjectSecurityContext.ClientToken = Token;
-    SubjectSecurityContext.ImpersonationLevel = Token->ImpersonationLevel;
-    SubjectSecurityContext.PrimaryToken = NULL;
-    SubjectSecurityContext.ProcessAuditId = NULL;
-    SeLockSubjectContext(&SubjectSecurityContext);
+    SeCaptureSubjectContext(&SubjectSecurityContext);
+
+    /* Lock the token */
+    SepAcquireTokenLockShared(Token);
 
     /* Check if the token is the owner and grant WRITE_DAC and READ_CONTROL rights */
     if (DesiredAccess & (WRITE_DAC | READ_CONTROL | MAXIMUM_ALLOWED))
     {
-        if (SepTokenIsOwner(Token, SecurityDescriptor)) // FIXME: use CapturedSecurityDescriptor
+        if (SepTokenIsOwner(Token, SecurityDescriptor, FALSE)) // FIXME: use CapturedSecurityDescriptor
         {
             if (DesiredAccess & MAXIMUM_ALLOWED)
                 PreviouslyGrantedAccess |= (WRITE_DAC | READ_CONTROL);
@@ -1034,8 +987,9 @@ NtAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
                        AccessStatus);
     }
 
-    /* Unlock subject context */
-    SeUnlockSubjectContext(&SubjectSecurityContext);
+    /* Release subject context and unlock the token */
+    SeReleaseSubjectContext(&SubjectSecurityContext);
+    SepReleaseTokenLock(Token);
 
     /* Release the captured security descriptor */
     SeReleaseSecurityDescriptor(CapturedSecurityDescriptor,
@@ -1060,7 +1014,7 @@ NtAccessCheckByType(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
                     IN ULONG ObjectTypeLength,
                     IN PGENERIC_MAPPING GenericMapping,
                     IN PPRIVILEGE_SET PrivilegeSet,
-                    IN ULONG PrivilegeSetLength,
+                    IN OUT PULONG PrivilegeSetLength,
                     OUT PACCESS_MASK GrantedAccess,
                     OUT PNTSTATUS AccessStatus)
 {
@@ -1101,7 +1055,7 @@ NtAccessCheckByTypeResultList(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
                               IN ULONG ObjectTypeLength,
                               IN PGENERIC_MAPPING GenericMapping,
                               IN PPRIVILEGE_SET PrivilegeSet,
-                              IN ULONG PrivilegeSetLength,
+                              IN OUT PULONG PrivilegeSetLength,
                               OUT PACCESS_MASK GrantedAccess,
                               OUT PNTSTATUS AccessStatus)
 {