[NTOSKRNL]

[reactos.git] / reactos / ntoskrnl / se / token.c

diff --git a/reactos/ntoskrnl/se/token.c b/reactos/ntoskrnl/se/token.c
index 7bb2d95..04fe7c2 100644 (file)
--- a/reactos/ntoskrnl/se/token.c
+++ b/reactos/ntoskrnl/se/token.c
@@ -790,10 +790,10 @@ SepCreateSystemProcessToken(VOID)
     Privileges[i].Attributes = 0;
     Privileges[i++].Luid = SeTakeOwnershipPrivilege;
 
-    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
+    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
     Privileges[i++].Luid = SeCreatePagefilePrivilege;
 
-    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
+    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
     Privileges[i++].Luid = SeLockMemoryPrivilege;
 
     Privileges[i].Attributes = 0;
@@ -802,16 +802,16 @@ SepCreateSystemProcessToken(VOID)
     Privileges[i].Attributes = 0;
     Privileges[i++].Luid = SeIncreaseQuotaPrivilege;
 
-    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
+    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
     Privileges[i++].Luid = SeIncreaseBasePriorityPrivilege;
 
-    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
+    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
     Privileges[i++].Luid = SeCreatePermanentPrivilege;
 
-    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
+    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
     Privileges[i++].Luid = SeDebugPrivilege;
 
-    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
+    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
     Privileges[i++].Luid = SeAuditPrivilege;
 
     Privileges[i].Attributes = 0;
@@ -820,7 +820,7 @@ SepCreateSystemProcessToken(VOID)
     Privileges[i].Attributes = 0;
     Privileges[i++].Luid = SeSystemEnvironmentPrivilege;
 
-    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
+    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
     Privileges[i++].Luid = SeChangeNotifyPrivilege;
 
     Privileges[i].Attributes = 0;
@@ -835,7 +835,7 @@ SepCreateSystemProcessToken(VOID)
     Privileges[i].Attributes = 0;
     Privileges[i++].Luid = SeLoadDriverPrivilege;
 
-    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT|SE_PRIVILEGE_ENABLED;
+    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
     Privileges[i++].Luid = SeProfileSingleProcessPrivilege;
 
     Privileges[i].Attributes = 0;
@@ -1709,7 +1709,7 @@ NtSetInformationToken(IN HANDLE TokenHandle,
                     {
                         PACL CapturedAcl;
 
-                        /* capture and copy the dacl */
+                        /* Capture and copy the dacl */
                         Status = SepCaptureAcl(InputAcl,
                                                PreviousMode,
                                                PagedPool,
@@ -1717,19 +1717,19 @@ NtSetInformationToken(IN HANDLE TokenHandle,
                                                &CapturedAcl);
                         if (NT_SUCCESS(Status))
                         {
-                            /* free the previous dacl if present */
+                            /* Free the previous dacl if present */
                             if(Token->DefaultDacl != NULL)
                             {
                                 ExFreePool(Token->DefaultDacl);
                             }
 
-                            /* set the new dacl */
+                            /* Set the new dacl */
                             Token->DefaultDacl = CapturedAcl;
                         }
                     }
                     else
                     {
-                        /* clear and free the default dacl if present */
+                        /* Clear and free the default dacl if present */
                         if (Token->DefaultDacl != NULL)
                         {
                             ExFreePool(Token->DefaultDacl);
@@ -1750,7 +1750,7 @@ NtSetInformationToken(IN HANDLE TokenHandle,
 
                 _SEH2_TRY
                 {
-                    /* buffer size was already verified, no need to check here again */
+                    /* Buffer size was already verified, no need to check here again */
                     SessionId = *(PULONG)TokenInformation;
                 }
                 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
@@ -1844,43 +1844,65 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle,
                                        PreviousMode,
                                        (PVOID*)&Token,
                                        NULL);
-    if (NT_SUCCESS(Status))
+    if (!NT_SUCCESS(Status))
     {
-        Status = SepDuplicateToken(Token,
-                                   ObjectAttributes,
-                                   EffectiveOnly,
-                                   TokenType,
-                                   (QoSPresent ? CapturedSecurityQualityOfService->ImpersonationLevel : SecurityAnonymous),
-                                   PreviousMode,
-                                   &NewToken);
+        SepReleaseSecurityQualityOfService(CapturedSecurityQualityOfService,
+                                           PreviousMode,
+                                           FALSE);
+        return Status;
+    }
 
-        ObDereferenceObject(Token);
+    /*
+     * Fail, if the original token is an impersonation token and the caller
+     * tries to raise the impersonation level of the new token above the
+     * impersonation level of the original token.
+     */
+    if (Token->TokenType == TokenImpersonation)
+    {
+        if (QoSPresent &&
+            CapturedSecurityQualityOfService->ImpersonationLevel >Token->ImpersonationLevel)
+        {
+            ObDereferenceObject(Token);
+            SepReleaseSecurityQualityOfService(CapturedSecurityQualityOfService,
+                                               PreviousMode,
+                                               FALSE);
+            return STATUS_BAD_IMPERSONATION_LEVEL;
+        }
+    }
+
+    Status = SepDuplicateToken(Token,
+                               ObjectAttributes,
+                               EffectiveOnly,
+                               TokenType,
+                               (QoSPresent ? CapturedSecurityQualityOfService->ImpersonationLevel : SecurityAnonymous),
+                               PreviousMode,
+                               &NewToken);
 
+    ObDereferenceObject(Token);
+
+    if (NT_SUCCESS(Status))
+    {
+        Status = ObInsertObject((PVOID)NewToken,
+                                NULL,
+                                DesiredAccess,
+                                0,
+                                NULL,
+                                &hToken);
         if (NT_SUCCESS(Status))
         {
-            Status = ObInsertObject((PVOID)NewToken,
-                                    NULL,
-                                    DesiredAccess,
-                                    0,
-                                    NULL,
-                                    &hToken);
-
-            if (NT_SUCCESS(Status))
+            _SEH2_TRY
             {
-                _SEH2_TRY
-                {
-                    *NewTokenHandle = hToken;
-                }
-                _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
-                {
-                    Status = _SEH2_GetExceptionCode();
-                }
-                _SEH2_END;
+                *NewTokenHandle = hToken;
+            }
+            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+            {
+                Status = _SEH2_GetExceptionCode();
             }
+            _SEH2_END;
         }
     }
 
-    /* free the captured structure */
+    /* Free the captured structure */
     SepReleaseSecurityQualityOfService(CapturedSecurityQualityOfService,
                                        PreviousMode,
                                        FALSE);
@@ -1997,7 +2019,8 @@ NtAdjustPrivilegesToken(IN HANDLE TokenHandle,
                     }
                     else
                     {
-                        /* FIXME: Should revert all the changes, calculate how
+                        /*
+                         * FIXME: Should revert all the changes, calculate how
                          * much space would be needed, set ResultLength
                          * accordingly and fail.
                          */
@@ -2044,7 +2067,8 @@ NtAdjustPrivilegesToken(IN HANDLE TokenHandle,
                             }
                             else
                             {
-                                /* FIXME: Should revert all the changes, calculate how
+                                /*
+                                 * FIXME: Should revert all the changes, calculate how
                                  * much space would be needed, set ResultLength
                                  * accordingly and fail.
                                  */