From: Eric Kohl <eric.kohl@reactos.org>
Date: Sat, 4 Mar 2017 14:38:13 +0000 (+0000)
Subject: [NTOS:SE]
X-Git-Tag: ReactOS-0.4.4-CLT2017~41
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=81b072cc640dad2b38d489fb7d3295e7ab007586

[NTOS:SE]
Add a missing ACE(SeAliasAdminsSid / GENERIC_ALL) to the SePublicDefaultDacl ACL. This fixes a kmtest:ObSecurity failure.

svn path=/trunk/; revision=74050
---

diff --git a/reactos/ntoskrnl/se/acl.c b/reactos/ntoskrnl/se/acl.c
index a29a85e861c..392f2a9ea64 100644
--- a/reactos/ntoskrnl/se/acl.c
+++ b/reactos/ntoskrnl/se/acl.c
@@ -38,7 +38,8 @@ SepInitDACLs(VOID)
     /* create PublicDefaultDacl */
     AclLength = sizeof(ACL) +
                 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +
-                (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid));
+                (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
+                (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid));
 
     SePublicDefaultDacl = ExAllocatePoolWithTag(PagedPool,
                                                 AclLength,
@@ -60,6 +61,11 @@ SepInitDACLs(VOID)
                            GENERIC_ALL,
                            SeLocalSystemSid);
 
+    RtlAddAccessAllowedAce(SePublicDefaultDacl,
+                           ACL_REVISION,
+                           GENERIC_ALL,
+                           SeAliasAdminsSid);
+
     /* create PublicDefaultUnrestrictedDacl */
     AclLength = sizeof(ACL) +
                 (sizeof(ACE) + RtlLengthSid(SeWorldSid)) +