2 * Unit tests for security functions
4 * Copyright (c) 2004 Mike McCormack
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
25 #define WIN32_NO_STATUS
36 #include "wine/test.h"
38 typedef VOID (WINAPI
*fnBuildTrusteeWithSidA
)( PTRUSTEEA pTrustee
, PSID pSid
);
39 typedef VOID (WINAPI
*fnBuildTrusteeWithNameA
)( PTRUSTEEA pTrustee
, LPSTR pName
);
40 typedef VOID (WINAPI
*fnBuildTrusteeWithObjectsAndNameA
)( PTRUSTEEA pTrustee
,
41 POBJECTS_AND_NAME_A pObjName
,
42 SE_OBJECT_TYPE ObjectType
,
44 LPSTR InheritedObjectTypeName
,
46 typedef VOID (WINAPI
*fnBuildTrusteeWithObjectsAndSidA
)( PTRUSTEEA pTrustee
,
47 POBJECTS_AND_SID pObjSid
,
49 GUID
* pInheritedObjectGuid
,
51 typedef LPSTR (WINAPI
*fnGetTrusteeNameA
)( PTRUSTEEA pTrustee
);
52 typedef BOOL (WINAPI
*fnConvertSidToStringSidA
)( PSID pSid
, LPSTR
*str
);
53 typedef BOOL (WINAPI
*fnConvertStringSidToSidA
)( LPCSTR str
, PSID pSid
);
54 typedef BOOL (WINAPI
*fnGetFileSecurityA
)(LPCSTR
, SECURITY_INFORMATION
,
55 PSECURITY_DESCRIPTOR
, DWORD
, LPDWORD
);
56 typedef DWORD (WINAPI
*fnRtlAdjustPrivilege
)(ULONG
,BOOLEAN
,BOOLEAN
,PBOOLEAN
);
57 typedef BOOL (WINAPI
*fnCreateWellKnownSid
)(WELL_KNOWN_SID_TYPE
,PSID
,PSID
,DWORD
*);
59 typedef NTSTATUS (WINAPI
*fnLsaQueryInformationPolicy
)(LSA_HANDLE
,POLICY_INFORMATION_CLASS
,PVOID
*);
60 typedef NTSTATUS (WINAPI
*fnLsaClose
)(LSA_HANDLE
);
61 typedef NTSTATUS (WINAPI
*fnLsaFreeMemory
)(PVOID
);
62 typedef NTSTATUS (WINAPI
*fnLsaOpenPolicy
)(PLSA_UNICODE_STRING
,PLSA_OBJECT_ATTRIBUTES
,ACCESS_MASK
,PLSA_HANDLE
);
63 static NTSTATUS (WINAPI
*pNtQueryObject
)(HANDLE
,OBJECT_INFORMATION_CLASS
,PVOID
,ULONG
,PULONG
);
69 fnBuildTrusteeWithSidA pBuildTrusteeWithSidA
;
70 fnBuildTrusteeWithNameA pBuildTrusteeWithNameA
;
71 fnBuildTrusteeWithObjectsAndNameA pBuildTrusteeWithObjectsAndNameA
;
72 fnBuildTrusteeWithObjectsAndSidA pBuildTrusteeWithObjectsAndSidA
;
73 fnGetTrusteeNameA pGetTrusteeNameA
;
74 fnConvertSidToStringSidA pConvertSidToStringSidA
;
75 fnConvertStringSidToSidA pConvertStringSidToSidA
;
76 fnGetFileSecurityA pGetFileSecurityA
;
77 fnRtlAdjustPrivilege pRtlAdjustPrivilege
;
78 fnCreateWellKnownSid pCreateWellKnownSid
;
79 fnLsaQueryInformationPolicy pLsaQueryInformationPolicy
;
81 fnLsaFreeMemory pLsaFreeMemory
;
82 fnLsaOpenPolicy pLsaOpenPolicy
;
86 SID_IDENTIFIER_AUTHORITY auth
;
90 static void init(void)
92 HMODULE hntdll
= GetModuleHandleA("ntdll.dll");
94 hmod
= GetModuleHandle("advapi32.dll");
95 myARGC
= winetest_get_mainargs( &myARGV
);
97 pNtQueryObject
= (void *)GetProcAddress( hntdll
, "NtQueryObject" );
100 static void test_str_sid(const char *str_sid
)
105 if (pConvertStringSidToSidA(str_sid
, &psid
))
107 if (pConvertSidToStringSidA(psid
, &temp
))
109 trace(" %s: %s\n", str_sid
, temp
);
116 if (GetLastError() != ERROR_INVALID_SID
)
117 trace(" %s: couldn't be converted, returned %d\n", str_sid
, GetLastError());
119 trace(" %s: couldn't be converted\n", str_sid
);
123 static void test_sid(void)
125 struct sidRef refs
[] = {
126 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
127 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
128 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
129 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
130 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
131 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
133 const char noSubAuthStr
[] = "S-1-5";
139 pConvertSidToStringSidA
= (fnConvertSidToStringSidA
)
140 GetProcAddress( hmod
, "ConvertSidToStringSidA" );
141 if( !pConvertSidToStringSidA
)
143 pConvertStringSidToSidA
= (fnConvertStringSidToSidA
)
144 GetProcAddress( hmod
, "ConvertStringSidToSidA" );
145 if( !pConvertStringSidToSidA
)
148 r
= pConvertStringSidToSidA( NULL
, NULL
);
149 ok( !r
, "expected failure with NULL parameters\n" );
150 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
152 ok( GetLastError() == ERROR_INVALID_PARAMETER
,
153 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
156 r
= pConvertStringSidToSidA( refs
[0].refStr
, NULL
);
157 ok( !r
&& GetLastError() == ERROR_INVALID_PARAMETER
,
158 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
161 r
= pConvertStringSidToSidA( NULL
, &str
);
162 ok( !r
&& GetLastError() == ERROR_INVALID_PARAMETER
,
163 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
166 r
= pConvertStringSidToSidA( noSubAuthStr
, &psid
);
168 "expected failure with no sub authorities\n" );
169 ok( GetLastError() == ERROR_INVALID_SID
,
170 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
173 for( i
= 0; i
< sizeof(refs
) / sizeof(refs
[0]); i
++ )
177 r
= AllocateAndInitializeSid( &refs
[i
].auth
, 1,1,0,0,0,0,0,0,0,
179 ok( r
, "failed to allocate sid\n" );
180 r
= pConvertSidToStringSidA( psid
, &str
);
181 ok( r
, "failed to convert sid\n" );
184 ok( !strcmp( str
, refs
[i
].refStr
),
185 "incorrect sid, expected %s, got %s\n", refs
[i
].refStr
, str
);
191 r
= pConvertStringSidToSidA( refs
[i
].refStr
, &psid
);
192 ok( r
, "failed to parse sid string\n" );
195 !memcmp( pisid
->IdentifierAuthority
.Value
, refs
[i
].auth
.Value
,
196 sizeof(refs
[i
].auth
) ),
197 "string sid %s didn't parse to expected value\n"
198 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
200 MAKEWORD( pisid
->IdentifierAuthority
.Value
[1],
201 pisid
->IdentifierAuthority
.Value
[0] ),
202 MAKELONG( MAKEWORD( pisid
->IdentifierAuthority
.Value
[5],
203 pisid
->IdentifierAuthority
.Value
[4] ),
204 MAKEWORD( pisid
->IdentifierAuthority
.Value
[3],
205 pisid
->IdentifierAuthority
.Value
[2] ) ),
206 MAKEWORD( refs
[i
].auth
.Value
[1], refs
[i
].auth
.Value
[0] ),
207 MAKELONG( MAKEWORD( refs
[i
].auth
.Value
[5], refs
[i
].auth
.Value
[4] ),
208 MAKEWORD( refs
[i
].auth
.Value
[3], refs
[i
].auth
.Value
[2] ) ) );
213 trace("String SIDs:\n");
254 static void test_trustee(void)
256 GUID ObjectType
= {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
257 GUID InheritedObjectType
= {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
259 OBJECTS_AND_NAME_ oan
;
263 char szObjectTypeName
[] = "ObjectTypeName";
264 char szInheritedObjectTypeName
[] = "InheritedObjectTypeName";
265 char szTrusteeName
[] = "szTrusteeName";
266 SID_IDENTIFIER_AUTHORITY auth
= { {0x11,0x22,0,0,0, 0} };
268 memset( &ZeroGuid
, 0x00, sizeof (ZeroGuid
) );
270 pBuildTrusteeWithSidA
= (fnBuildTrusteeWithSidA
)
271 GetProcAddress( hmod
, "BuildTrusteeWithSidA" );
272 pBuildTrusteeWithNameA
= (fnBuildTrusteeWithNameA
)
273 GetProcAddress( hmod
, "BuildTrusteeWithNameA" );
274 pBuildTrusteeWithObjectsAndNameA
= (fnBuildTrusteeWithObjectsAndNameA
)
275 GetProcAddress (hmod
, "BuildTrusteeWithObjectsAndNameA" );
276 pBuildTrusteeWithObjectsAndSidA
= (fnBuildTrusteeWithObjectsAndSidA
)
277 GetProcAddress (hmod
, "BuildTrusteeWithObjectsAndSidA" );
278 pGetTrusteeNameA
= (fnGetTrusteeNameA
)
279 GetProcAddress (hmod
, "GetTrusteeNameA" );
280 if( !pBuildTrusteeWithSidA
|| !pBuildTrusteeWithNameA
||
281 !pBuildTrusteeWithObjectsAndNameA
|| !pBuildTrusteeWithObjectsAndSidA
||
285 if ( ! AllocateAndInitializeSid( &auth
, 1, 42, 0,0,0,0,0,0,0,&psid
) )
287 trace( "failed to init SID\n" );
291 /* test BuildTrusteeWithSidA */
292 memset( &trustee
, 0xff, sizeof trustee
);
293 pBuildTrusteeWithSidA( &trustee
, psid
);
295 ok( trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
296 ok( trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
,
297 "MultipleTrusteeOperation wrong\n");
298 ok( trustee
.TrusteeForm
== TRUSTEE_IS_SID
, "TrusteeForm wrong\n");
299 ok( trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
300 ok( trustee
.ptstrName
== (LPSTR
) psid
, "ptstrName wrong\n" );
302 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
303 memset( &trustee
, 0xff, sizeof trustee
);
304 memset( &oas
, 0xff, sizeof(oas
) );
305 pBuildTrusteeWithObjectsAndSidA(&trustee
, &oas
, &ObjectType
,
306 &InheritedObjectType
, psid
);
308 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
309 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
310 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_SID
, "TrusteeForm wrong\n");
311 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
312 ok(trustee
.ptstrName
== (LPSTR
)&oas
, "ptstrName wrong\n");
314 ok(oas
.ObjectsPresent
== (ACE_OBJECT_TYPE_PRESENT
| ACE_INHERITED_OBJECT_TYPE_PRESENT
), "ObjectsPresent wrong\n");
315 ok(!memcmp(&oas
.ObjectTypeGuid
, &ObjectType
, sizeof(GUID
)), "ObjectTypeGuid wrong\n");
316 ok(!memcmp(&oas
.InheritedObjectTypeGuid
, &InheritedObjectType
, sizeof(GUID
)), "InheritedObjectTypeGuid wrong\n");
317 ok(oas
.pSid
== psid
, "pSid wrong\n");
319 /* test GetTrusteeNameA */
320 ok(pGetTrusteeNameA(&trustee
) == (LPSTR
)&oas
, "GetTrusteeName returned wrong value\n");
322 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
323 memset( &trustee
, 0xff, sizeof trustee
);
324 memset( &oas
, 0xff, sizeof(oas
) );
325 pBuildTrusteeWithObjectsAndSidA(&trustee
, &oas
, NULL
,
326 &InheritedObjectType
, psid
);
328 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
329 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
330 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_SID
, "TrusteeForm wrong\n");
331 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
332 ok(trustee
.ptstrName
== (LPSTR
)&oas
, "ptstrName wrong\n");
334 ok(oas
.ObjectsPresent
== ACE_INHERITED_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
335 ok(!memcmp(&oas
.ObjectTypeGuid
, &ZeroGuid
, sizeof(GUID
)), "ObjectTypeGuid wrong\n");
336 ok(!memcmp(&oas
.InheritedObjectTypeGuid
, &InheritedObjectType
, sizeof(GUID
)), "InheritedObjectTypeGuid wrong\n");
337 ok(oas
.pSid
== psid
, "pSid wrong\n");
341 /* test BuildTrusteeWithNameA */
342 memset( &trustee
, 0xff, sizeof trustee
);
343 pBuildTrusteeWithNameA( &trustee
, szTrusteeName
);
345 ok( trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
346 ok( trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
,
347 "MultipleTrusteeOperation wrong\n");
348 ok( trustee
.TrusteeForm
== TRUSTEE_IS_NAME
, "TrusteeForm wrong\n");
349 ok( trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
350 ok( trustee
.ptstrName
== szTrusteeName
, "ptstrName wrong\n" );
352 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
353 memset( &trustee
, 0xff, sizeof trustee
);
354 memset( &oan
, 0xff, sizeof(oan
) );
355 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, szObjectTypeName
,
356 szInheritedObjectTypeName
, szTrusteeName
);
358 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
359 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
360 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
361 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
362 ok(trustee
.ptstrName
== (LPTSTR
)&oan
, "ptstrName wrong\n");
364 ok(oan
.ObjectsPresent
== (ACE_OBJECT_TYPE_PRESENT
| ACE_INHERITED_OBJECT_TYPE_PRESENT
), "ObjectsPresent wrong\n");
365 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
366 ok(oan
.InheritedObjectTypeName
== szInheritedObjectTypeName
, "InheritedObjectTypeName wrong\n");
367 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
369 /* test GetTrusteeNameA */
370 ok(pGetTrusteeNameA(&trustee
) == (LPSTR
)&oan
, "GetTrusteeName returned wrong value\n");
372 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
373 memset( &trustee
, 0xff, sizeof trustee
);
374 memset( &oan
, 0xff, sizeof(oan
) );
375 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, NULL
,
376 szInheritedObjectTypeName
, szTrusteeName
);
378 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
379 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
380 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
381 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
382 ok(trustee
.ptstrName
== (LPSTR
)&oan
, "ptstrName wrong\n");
384 ok(oan
.ObjectsPresent
== ACE_INHERITED_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
385 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
386 ok(oan
.InheritedObjectTypeName
== szInheritedObjectTypeName
, "InheritedObjectTypeName wrong\n");
387 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
389 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
390 memset( &trustee
, 0xff, sizeof trustee
);
391 memset( &oan
, 0xff, sizeof(oan
) );
392 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, szObjectTypeName
,
393 NULL
, szTrusteeName
);
395 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
396 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
397 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
398 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
399 ok(trustee
.ptstrName
== (LPTSTR
)&oan
, "ptstrName wrong\n");
401 ok(oan
.ObjectsPresent
== ACE_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
402 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
403 ok(oan
.InheritedObjectTypeName
== NULL
, "InheritedObjectTypeName wrong\n");
404 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
407 /* If the first isn't defined, assume none is */
408 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
409 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
410 #define SE_CREATE_TOKEN_PRIVILEGE 2L
411 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
412 #define SE_LOCK_MEMORY_PRIVILEGE 4L
413 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
414 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
415 #define SE_TCB_PRIVILEGE 7L
416 #define SE_SECURITY_PRIVILEGE 8L
417 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
418 #define SE_LOAD_DRIVER_PRIVILEGE 10L
419 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
420 #define SE_SYSTEMTIME_PRIVILEGE 12L
421 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
422 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
423 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
424 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
425 #define SE_BACKUP_PRIVILEGE 17L
426 #define SE_RESTORE_PRIVILEGE 18L
427 #define SE_SHUTDOWN_PRIVILEGE 19L
428 #define SE_DEBUG_PRIVILEGE 20L
429 #define SE_AUDIT_PRIVILEGE 21L
430 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
431 #define SE_CHANGE_NOTIFY_PRIVILLEGE 23L
432 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
433 #define SE_UNDOCK_PRIVILEGE 25L
434 #define SE_SYNC_AGENT_PRIVILEGE 26L
435 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
436 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
437 #define SE_IMPERSONATE_PRIVILEGE 29L
438 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
439 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
440 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
442 static void test_allocateLuid(void)
444 BOOL (WINAPI
*pAllocateLocallyUniqueId
)(PLUID
);
448 pAllocateLocallyUniqueId
= (void*)GetProcAddress(hmod
, "AllocateLocallyUniqueId");
449 if (!pAllocateLocallyUniqueId
) return;
451 ret
= pAllocateLocallyUniqueId(&luid1
);
452 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
456 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
457 ret
= pAllocateLocallyUniqueId(&luid2
);
459 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
460 ok(luid1
.LowPart
> SE_MAX_WELL_KNOWN_PRIVILEGE
|| luid1
.HighPart
!= 0,
461 "AllocateLocallyUniqueId returned a well-known LUID\n");
462 ok(luid1
.LowPart
!= luid2
.LowPart
|| luid1
.HighPart
!= luid2
.HighPart
,
463 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
464 ret
= pAllocateLocallyUniqueId(NULL
);
465 ok( !ret
&& GetLastError() == ERROR_NOACCESS
,
466 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
470 static void test_lookupPrivilegeName(void)
472 BOOL (WINAPI
*pLookupPrivilegeNameA
)(LPCSTR
, PLUID
, LPSTR
, LPDWORD
);
473 char buf
[MAX_PATH
]; /* arbitrary, seems long enough */
474 DWORD cchName
= sizeof(buf
);
475 LUID luid
= { 0, 0 };
479 /* check whether it's available first */
480 pLookupPrivilegeNameA
= (void*)GetProcAddress(hmod
, "LookupPrivilegeNameA");
481 if (!pLookupPrivilegeNameA
) return;
482 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
483 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
484 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
487 /* check with a short buffer */
489 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
490 ret
= pLookupPrivilegeNameA(NULL
, &luid
, NULL
, &cchName
);
491 ok( !ret
&& GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
492 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
494 ok(cchName
== strlen("SeCreateTokenPrivilege") + 1,
495 "LookupPrivilegeNameA returned an incorrect required length for\n"
496 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName
,
497 lstrlenA("SeCreateTokenPrivilege") + 1);
498 /* check a known value and its returned length on success */
499 cchName
= sizeof(buf
);
500 ok(pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
) &&
501 cchName
== strlen("SeCreateTokenPrivilege"),
502 "LookupPrivilegeNameA returned an incorrect output length for\n"
503 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName
,
504 (int)strlen("SeCreateTokenPrivilege"));
505 /* check known values */
506 for (i
= SE_MIN_WELL_KNOWN_PRIVILEGE
; i
< SE_MAX_WELL_KNOWN_PRIVILEGE
; i
++)
509 cchName
= sizeof(buf
);
510 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
511 ok( ret
|| GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
512 "LookupPrivilegeNameA(0.%d) failed: %d\n", i
, GetLastError());
514 /* check a bogus LUID */
515 luid
.LowPart
= 0xdeadbeef;
516 cchName
= sizeof(buf
);
517 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
518 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
519 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
521 /* check on a bogus system */
522 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
523 cchName
= sizeof(buf
);
524 ret
= pLookupPrivilegeNameA("b0gu5.Nam3", &luid
, buf
, &cchName
);
525 ok( !ret
&& GetLastError() == RPC_S_SERVER_UNAVAILABLE
,
526 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
536 static void test_lookupPrivilegeValue(void)
538 static const struct NameToLUID privs
[] = {
539 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE
},
540 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE
},
541 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE
},
542 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE
},
543 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE
},
544 { "SeTcbPrivilege", SE_TCB_PRIVILEGE
},
545 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE
},
546 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE
},
547 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE
},
548 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE
},
549 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE
},
550 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE
},
551 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE
},
552 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE
},
553 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE
},
554 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE
},
555 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE
},
556 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE
},
557 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE
},
558 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE
},
559 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE
},
560 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILLEGE
},
561 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE
},
562 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE
},
563 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE
},
564 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE
},
565 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE
},
566 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE
},
567 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE
},
569 BOOL (WINAPI
*pLookupPrivilegeValueA
)(LPCSTR
, LPCSTR
, PLUID
);
574 /* check whether it's available first */
575 pLookupPrivilegeValueA
= (void*)GetProcAddress(hmod
, "LookupPrivilegeValueA");
576 if (!pLookupPrivilegeValueA
) return;
577 ret
= pLookupPrivilegeValueA(NULL
, "SeCreateTokenPrivilege", &luid
);
578 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
581 /* check a bogus system name */
582 ret
= pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid
);
583 ok( !ret
&& GetLastError() == RPC_S_SERVER_UNAVAILABLE
,
584 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
586 /* check a NULL string */
587 ret
= pLookupPrivilegeValueA(NULL
, 0, &luid
);
588 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
589 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
591 /* check a bogus privilege name */
592 ret
= pLookupPrivilegeValueA(NULL
, "SeBogusPrivilege", &luid
);
593 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
594 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
596 /* check case insensitive */
597 ret
= pLookupPrivilegeValueA(NULL
, "sEcREATEtOKENpRIVILEGE", &luid
);
599 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
601 for (i
= 0; i
< sizeof(privs
) / sizeof(privs
[0]); i
++)
603 /* Not all privileges are implemented on all Windows versions, so
604 * don't worry if the call fails
606 if (pLookupPrivilegeValueA(NULL
, privs
[i
].name
, &luid
))
608 ok(luid
.LowPart
== privs
[i
].lowPart
,
609 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
615 static void test_luid(void)
618 test_lookupPrivilegeName();
619 test_lookupPrivilegeValue();
622 static void test_FileSecurity(void)
624 char directory
[MAX_PATH
];
625 DWORD retval
, outSize
;
629 pGetFileSecurityA
= (fnGetFileSecurityA
)
630 GetProcAddress( hmod
, "GetFileSecurityA" );
631 if( !pGetFileSecurityA
)
634 retval
= GetTempPathA(sizeof(directory
), directory
);
636 trace("GetTempPathA failed\n");
640 strcpy(directory
, "\\Should not exist");
642 SetLastError(NO_ERROR
);
643 result
= pGetFileSecurityA( directory
,OWNER_SECURITY_INFORMATION
,buffer
,0x40,&outSize
);
644 ok(!result
, "GetFileSecurityA should fail for not existing directories/files\n");
645 ok( (GetLastError() == ERROR_FILE_NOT_FOUND
) ||
646 (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
) ,
647 "last error ERROR_FILE_NOT_FOUND / ERROR_CALL_NOT_IMPLEMENTED (98) "
648 "expected, got %d\n", GetLastError());
651 static void test_AccessCheck(void)
653 PSID EveryoneSid
= NULL
, AdminSid
= NULL
, UsersSid
= NULL
;
655 SECURITY_DESCRIPTOR
*SecurityDescriptor
= NULL
;
656 SID_IDENTIFIER_AUTHORITY SIDAuthWorld
= { SECURITY_WORLD_SID_AUTHORITY
};
657 SID_IDENTIFIER_AUTHORITY SIDAuthNT
= { SECURITY_NT_AUTHORITY
};
658 GENERIC_MAPPING Mapping
= { KEY_READ
, KEY_WRITE
, KEY_EXECUTE
, KEY_ALL_ACCESS
};
665 PRIVILEGE_SET
*PrivSet
;
671 NtDllModule
= GetModuleHandle("ntdll.dll");
675 trace("not running on NT, skipping test\n");
678 pRtlAdjustPrivilege
= (fnRtlAdjustPrivilege
)
679 GetProcAddress(NtDllModule
, "RtlAdjustPrivilege");
680 if (!pRtlAdjustPrivilege
) return;
682 Acl
= HeapAlloc(GetProcessHeap(), 0, 256);
683 res
= InitializeAcl(Acl
, 256, ACL_REVISION
);
684 if(!res
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
686 skip("ACLs not implemented - skipping tests\n");
689 ok(res
, "InitializeAcl failed with error %d\n", GetLastError());
691 res
= AllocateAndInitializeSid( &SIDAuthWorld
, 1, SECURITY_WORLD_RID
, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid
);
692 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
694 res
= AllocateAndInitializeSid( &SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
695 DOMAIN_ALIAS_RID_ADMINS
, 0, 0, 0, 0, 0, 0, &AdminSid
);
696 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
698 res
= AllocateAndInitializeSid( &SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
699 DOMAIN_ALIAS_RID_USERS
, 0, 0, 0, 0, 0, 0, &UsersSid
);
700 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
702 res
= AddAccessAllowedAce(Acl
, ACL_REVISION
, KEY_READ
, EveryoneSid
);
703 ok(res
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
705 res
= AddAccessDeniedAce(Acl
, ACL_REVISION
, KEY_SET_VALUE
, AdminSid
);
706 ok(res
, "AddAccessDeniedAce failed with error %d\n", GetLastError());
708 SecurityDescriptor
= HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH
);
710 res
= InitializeSecurityDescriptor(SecurityDescriptor
, SECURITY_DESCRIPTOR_REVISION
);
711 ok(res
, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
713 res
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
714 ok(res
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
716 PrivSetLen
= FIELD_OFFSET(PRIVILEGE_SET
, Privilege
[16]);
717 PrivSet
= HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY
, PrivSetLen
);
718 PrivSet
->PrivilegeCount
= 16;
720 res
= OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE
|TOKEN_QUERY
, &ProcessToken
);
721 ok(res
, "OpenProcessToken failed with error %d\n", GetLastError());
723 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE
, FALSE
, TRUE
, &Enabled
);
725 res
= DuplicateToken(ProcessToken
, SecurityIdentification
, &Token
);
726 ok(res
, "DuplicateToken failed with error %d\n", GetLastError());
728 /* SD without owner/group */
729 SetLastError(0xdeadbeef);
730 Access
= AccessStatus
= 0xdeadbeef;
731 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_QUERY_VALUE
, &Mapping
,
732 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
733 err
= GetLastError();
734 ok(!ret
&& err
== ERROR_INVALID_SECURITY_DESCR
, "AccessCheck should have "
735 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err
);
736 ok(Access
== 0xdeadbeef && AccessStatus
== 0xdeadbeef,
737 "Access and/or AccessStatus were changed!\n");
739 /* Set owner and group */
740 res
= SetSecurityDescriptorOwner(SecurityDescriptor
, AdminSid
, FALSE
);
741 ok(res
, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
742 res
= SetSecurityDescriptorGroup(SecurityDescriptor
, UsersSid
, TRUE
);
743 ok(res
, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
745 /* Generic access mask */
746 SetLastError(0xdeadbeef);
747 ret
= AccessCheck(SecurityDescriptor
, Token
, GENERIC_READ
, &Mapping
,
748 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
749 err
= GetLastError();
750 ok(!ret
&& err
== ERROR_GENERIC_NOT_MAPPED
, "AccessCheck should have failed "
751 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err
);
752 ok(Access
== 0xdeadbeef && AccessStatus
== 0xdeadbeef,
753 "Access and/or AccessStatus were changed!\n");
755 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
756 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
757 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
758 ok(AccessStatus
&& (Access
== KEY_READ
),
759 "AccessCheck failed to grant access with error %d\n",
762 ret
= AccessCheck(SecurityDescriptor
, Token
, MAXIMUM_ALLOWED
, &Mapping
,
763 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
764 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
766 "AccessCheck failed to grant any access with error %d\n",
768 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access
);
770 /* Access denied by SD */
771 SetLastError(0xdeadbeef);
772 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_WRITE
, &Mapping
,
773 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
774 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
775 err
= GetLastError();
776 ok(!AccessStatus
&& err
== ERROR_ACCESS_DENIED
, "AccessCheck should have failed "
777 "with ERROR_ACCESS_DENIED, instead of %d\n", err
);
778 ok(!Access
, "Should have failed to grant any access, got 0x%08x\n", Access
);
781 PrivSet
->PrivilegeCount
= 16;
782 ret
= AccessCheck(SecurityDescriptor
, Token
, ACCESS_SYSTEM_SECURITY
, &Mapping
,
783 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
784 ok(ret
&& !AccessStatus
&& GetLastError() == ERROR_PRIVILEGE_NOT_HELD
,
785 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
788 ret
= pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE
, TRUE
, TRUE
, &Enabled
);
792 PrivSet
->PrivilegeCount
= 16;
793 ret
= AccessCheck(SecurityDescriptor
, Token
, ACCESS_SYSTEM_SECURITY
, &Mapping
,
794 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
795 ok(ret
&& AccessStatus
&& GetLastError() == 0,
796 "AccessCheck should have succeeded, error %d\n",
798 ok(Access
== ACCESS_SYSTEM_SECURITY
,
799 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
803 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
808 res
= DuplicateToken(ProcessToken
, SecurityAnonymous
, &Token
);
809 ok(res
, "DuplicateToken failed with error %d\n", GetLastError());
811 SetLastError(0xdeadbeef);
812 ret
= AccessCheck(SecurityDescriptor
, Token
, MAXIMUM_ALLOWED
, &Mapping
,
813 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
814 err
= GetLastError();
815 ok(!ret
&& err
== ERROR_BAD_IMPERSONATION_LEVEL
, "AccessCheck should have failed "
816 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err
);
820 SetLastError(0xdeadbeef);
821 ret
= AccessCheck(SecurityDescriptor
, ProcessToken
, KEY_READ
, &Mapping
,
822 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
823 err
= GetLastError();
824 ok(!ret
&& err
== ERROR_NO_IMPERSONATION_TOKEN
, "AccessCheck should have failed "
825 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err
);
827 CloseHandle(ProcessToken
);
830 FreeSid(EveryoneSid
);
835 HeapFree(GetProcessHeap(), 0, Acl
);
836 HeapFree(GetProcessHeap(), 0, SecurityDescriptor
);
837 HeapFree(GetProcessHeap(), 0, PrivSet
);
840 /* test GetTokenInformation for the various attributes */
841 static void test_token_attr(void)
843 HANDLE Token
, ImpersonationToken
;
845 TOKEN_PRIVILEGES
*Privileges
;
846 TOKEN_GROUPS
*Groups
;
851 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
853 /* cygwin-like use case */
854 ret
= OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED
, &Token
);
855 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
860 ret
= GetTokenInformation(Token
, TokenUser
,(void*)buf
, Size
, &Size
);
861 ok(ret
, "GetTokenInformation failed with error %d\n", GetLastError());
862 Size
= sizeof(ImpersonationLevel
);
863 ret
= GetTokenInformation(Token
, TokenImpersonationLevel
, &ImpersonationLevel
, Size
, &Size
);
864 GLE
= GetLastError();
865 ok(!ret
&& (GLE
== ERROR_INVALID_PARAMETER
), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE
);
869 if(!pConvertSidToStringSidA
)
872 ret
= OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY
|TOKEN_DUPLICATE
, &Token
);
873 GLE
= GetLastError();
874 ok(ret
|| (GLE
== ERROR_CALL_NOT_IMPLEMENTED
),
875 "OpenProcessToken failed with error %d\n", GLE
);
876 if(!ret
&& (GLE
== ERROR_CALL_NOT_IMPLEMENTED
))
878 trace("OpenProcessToken() not implemented, skipping test_token_attr()\n");
883 ret
= GetTokenInformation(Token
, TokenGroups
, NULL
, 0, &Size
);
884 Groups
= HeapAlloc(GetProcessHeap(), 0, Size
);
885 ret
= GetTokenInformation(Token
, TokenGroups
, Groups
, Size
, &Size
);
886 ok(ret
, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
887 trace("TokenGroups:\n");
888 for (i
= 0; i
< Groups
->GroupCount
; i
++)
890 DWORD NameLength
= 255;
892 DWORD DomainLength
= 255;
894 SID_NAME_USE SidNameUse
;
895 pConvertSidToStringSidA(Groups
->Groups
[i
].Sid
, &SidString
);
898 ret
= LookupAccountSid(NULL
, Groups
->Groups
[i
].Sid
, Name
, &NameLength
, Domain
, &DomainLength
, &SidNameUse
);
899 ok(ret
, "LookupAccountSid(%s) failed with error %d\n", SidString
, GetLastError());
900 trace("\t%s, %s\\%s use: %d attr: 0x%08x\n", SidString
, Domain
, Name
, SidNameUse
, Groups
->Groups
[i
].Attributes
);
901 LocalFree(SidString
);
903 HeapFree(GetProcessHeap(), 0, Groups
);
906 ret
= GetTokenInformation(Token
, TokenUser
, NULL
, 0, &Size
);
907 ok(!ret
&& (GetLastError() == ERROR_INSUFFICIENT_BUFFER
),
908 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
909 User
= HeapAlloc(GetProcessHeap(), 0, Size
);
910 ret
= GetTokenInformation(Token
, TokenUser
, User
, Size
, &Size
);
912 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
914 pConvertSidToStringSidA(User
->User
.Sid
, &SidString
);
915 trace("TokenUser: %s attr: 0x%08x\n", SidString
, User
->User
.Attributes
);
916 LocalFree(SidString
);
917 HeapFree(GetProcessHeap(), 0, User
);
920 ret
= GetTokenInformation(Token
, TokenPrivileges
, NULL
, 0, &Size
);
921 ok(!ret
&& (GetLastError() == ERROR_INSUFFICIENT_BUFFER
),
922 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
923 Privileges
= HeapAlloc(GetProcessHeap(), 0, Size
);
924 ret
= GetTokenInformation(Token
, TokenPrivileges
, Privileges
, Size
, &Size
);
926 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
927 trace("TokenPrivileges:\n");
928 for (i
= 0; i
< Privileges
->PrivilegeCount
; i
++)
931 DWORD NameLen
= sizeof(Name
)/sizeof(Name
[0]);
932 LookupPrivilegeName(NULL
, &Privileges
->Privileges
[i
].Luid
, Name
, &NameLen
);
933 trace("\t%s, 0x%x\n", Name
, Privileges
->Privileges
[i
].Attributes
);
935 HeapFree(GetProcessHeap(), 0, Privileges
);
937 ret
= DuplicateToken(Token
, SecurityAnonymous
, &ImpersonationToken
);
938 ok(ret
, "DuplicateToken failed with error %d\n", GetLastError());
940 Size
= sizeof(ImpersonationLevel
);
941 ret
= GetTokenInformation(ImpersonationToken
, TokenImpersonationLevel
, &ImpersonationLevel
, Size
, &Size
);
942 ok(ret
, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
943 ok(ImpersonationLevel
== SecurityAnonymous
, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel
);
945 CloseHandle(ImpersonationToken
);
949 typedef union _MAX_SID
952 char max
[SECURITY_MAX_SID_SIZE
];
955 static void test_sid_str(PSID
* sid
)
958 BOOL ret
= pConvertSidToStringSidA(sid
, &str_sid
);
959 ok(ret
, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
962 char account
[MAX_PATH
], domain
[MAX_PATH
];
964 DWORD acc_size
= MAX_PATH
;
965 DWORD dom_size
= MAX_PATH
;
966 ret
= LookupAccountSid(NULL
, sid
, account
, &acc_size
, domain
, &dom_size
, &use
);
967 ok(ret
|| (!ret
&& (GetLastError() == ERROR_NONE_MAPPED
)),
968 "LookupAccountSid(%s) failed: %d\n", str_sid
, GetLastError());
970 trace(" %s %s\\%s %d\n", str_sid
, domain
, account
, use
);
971 else if (GetLastError() == ERROR_NONE_MAPPED
)
972 trace(" %s couldn't be mapped\n", str_sid
);
977 static void test_LookupAccountSid(void)
979 SID_IDENTIFIER_AUTHORITY SIDAuthNT
= { SECURITY_NT_AUTHORITY
};
980 CHAR accountA
[MAX_PATH
], domainA
[MAX_PATH
];
981 DWORD acc_sizeA
, dom_sizeA
;
982 DWORD real_acc_sizeA
, real_dom_sizeA
;
983 WCHAR accountW
[MAX_PATH
], domainW
[MAX_PATH
];
984 DWORD acc_sizeW
, dom_sizeW
;
985 DWORD real_acc_sizeW
, real_dom_sizeW
;
986 PSID pUsersSid
= NULL
;
994 /* native windows crashes if account size, domain size, or name use is NULL */
996 ret
= AllocateAndInitializeSid(&SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
997 DOMAIN_ALIAS_RID_USERS
, 0, 0, 0, 0, 0, 0, &pUsersSid
);
998 ok(ret
|| (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
),
999 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1001 /* not running on NT so give up */
1002 if (!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1005 real_acc_sizeA
= MAX_PATH
;
1006 real_dom_sizeA
= MAX_PATH
;
1007 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &real_acc_sizeA
, domainA
, &real_dom_sizeA
, &use
);
1008 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1010 /* try NULL account */
1011 acc_sizeA
= MAX_PATH
;
1012 dom_sizeA
= MAX_PATH
;
1013 ret
= LookupAccountSidA(NULL
, pUsersSid
, NULL
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1014 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1016 /* try NULL domain */
1017 acc_sizeA
= MAX_PATH
;
1018 dom_sizeA
= MAX_PATH
;
1019 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, NULL
, &dom_sizeA
, &use
);
1020 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1022 /* try a small account buffer */
1024 dom_sizeA
= MAX_PATH
;
1026 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1027 ok(!ret
, "LookupAccountSidA() Expected FALSE got TRUE\n");
1028 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1029 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1031 /* try a 0 sized account buffer */
1033 dom_sizeA
= MAX_PATH
;
1035 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1036 /* this can fail or succeed depending on OS version but the size will always be returned */
1037 ok(acc_sizeA
== real_acc_sizeA
+ 1,
1038 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1039 real_acc_sizeA
+ 1, acc_sizeA
);
1041 /* try a 0 sized account buffer */
1043 dom_sizeA
= MAX_PATH
;
1044 ret
= LookupAccountSidA(NULL
, pUsersSid
, NULL
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1045 /* this can fail or succeed depending on OS version but the size will always be returned */
1046 ok(acc_sizeA
== real_acc_sizeA
+ 1,
1047 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1048 real_acc_sizeA
+ 1, acc_sizeA
);
1050 /* try a small domain buffer */
1052 acc_sizeA
= MAX_PATH
;
1054 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1055 ok(!ret
, "LookupAccountSidA() Expected FALSE got TRUE\n");
1056 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1057 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1059 /* try a 0 sized domain buffer */
1061 acc_sizeA
= MAX_PATH
;
1063 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1064 /* this can fail or succeed depending on OS version but the size will always be returned */
1065 ok(dom_sizeA
== real_dom_sizeA
+ 1,
1066 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1067 real_dom_sizeA
+ 1, dom_sizeA
);
1069 /* try a 0 sized domain buffer */
1071 acc_sizeA
= MAX_PATH
;
1072 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, NULL
, &dom_sizeA
, &use
);
1073 /* this can fail or succeed depending on OS version but the size will always be returned */
1074 ok(dom_sizeA
== real_dom_sizeA
+ 1,
1075 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1076 real_dom_sizeA
+ 1, dom_sizeA
);
1078 real_acc_sizeW
= MAX_PATH
;
1079 real_dom_sizeW
= MAX_PATH
;
1080 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &real_acc_sizeW
, domainW
, &real_dom_sizeW
, &use
);
1081 ok(ret
, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1083 /* native windows crashes if domainW or accountW is NULL */
1085 /* try a small account buffer */
1087 dom_sizeW
= MAX_PATH
;
1089 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1090 ok(!ret
, "LookupAccountSidW() Expected FALSE got TRUE\n");
1091 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1092 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1094 /* try a 0 sized account buffer */
1096 dom_sizeW
= MAX_PATH
;
1098 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1099 /* this can fail or succeed depending on OS version but the size will always be returned */
1100 ok(acc_sizeW
== real_acc_sizeW
+ 1,
1101 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1102 real_acc_sizeW
+ 1, acc_sizeW
);
1104 /* try a 0 sized account buffer */
1106 dom_sizeW
= MAX_PATH
;
1107 ret
= LookupAccountSidW(NULL
, pUsersSid
, NULL
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1108 /* this can fail or succeed depending on OS version but the size will always be returned */
1109 ok(acc_sizeW
== real_acc_sizeW
+ 1,
1110 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1111 real_acc_sizeW
+ 1, acc_sizeW
);
1113 /* try a small domain buffer */
1115 acc_sizeW
= MAX_PATH
;
1117 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1118 ok(!ret
, "LookupAccountSidW() Expected FALSE got TRUE\n");
1119 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1120 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1122 /* try a 0 sized domain buffer */
1124 acc_sizeW
= MAX_PATH
;
1126 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1127 /* this can fail or succeed depending on OS version but the size will always be returned */
1128 ok(dom_sizeW
== real_dom_sizeW
+ 1,
1129 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1130 real_dom_sizeW
+ 1, dom_sizeW
);
1132 /* try a 0 sized domain buffer */
1134 acc_sizeW
= MAX_PATH
;
1135 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, NULL
, &dom_sizeW
, &use
);
1136 /* this can fail or succeed depending on OS version but the size will always be returned */
1137 ok(dom_sizeW
== real_dom_sizeW
+ 1,
1138 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1139 real_dom_sizeW
+ 1, dom_sizeW
);
1143 pCreateWellKnownSid
= (fnCreateWellKnownSid
)GetProcAddress( hmod
, "CreateWellKnownSid" );
1145 if (pCreateWellKnownSid
&& pConvertSidToStringSidA
)
1147 trace("Well Known SIDs:\n");
1148 for (i
= 0; i
<= 60; i
++)
1150 size
= SECURITY_MAX_SID_SIZE
;
1151 if (pCreateWellKnownSid(i
, NULL
, &max_sid
.sid
, &size
))
1153 if (pConvertSidToStringSidA(&max_sid
.sid
, &str_sidA
))
1155 acc_sizeA
= MAX_PATH
;
1156 dom_sizeA
= MAX_PATH
;
1157 if (LookupAccountSidA(NULL
, &max_sid
.sid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
))
1158 trace(" %d: %s %s\\%s %d\n", i
, str_sidA
, domainA
, accountA
, use
);
1159 LocalFree(str_sidA
);
1164 if (GetLastError() != ERROR_INVALID_PARAMETER
)
1165 trace(" CreateWellKnownSid(%d) failed: %d\n", i
, GetLastError());
1167 trace(" %d: not supported\n", i
);
1171 pLsaQueryInformationPolicy
= (fnLsaQueryInformationPolicy
)GetProcAddress( hmod
, "LsaQueryInformationPolicy");
1172 pLsaOpenPolicy
= (fnLsaOpenPolicy
)GetProcAddress( hmod
, "LsaOpenPolicy");
1173 pLsaFreeMemory
= (fnLsaFreeMemory
)GetProcAddress( hmod
, "LsaFreeMemory");
1174 pLsaClose
= (fnLsaClose
)GetProcAddress( hmod
, "LsaClose");
1176 if (pLsaQueryInformationPolicy
&& pLsaOpenPolicy
&& pLsaFreeMemory
&& pLsaClose
)
1180 LSA_OBJECT_ATTRIBUTES object_attributes
;
1182 ZeroMemory(&object_attributes
, sizeof(object_attributes
));
1183 object_attributes
.Length
= sizeof(object_attributes
);
1185 status
= pLsaOpenPolicy( NULL
, &object_attributes
, POLICY_ALL_ACCESS
, &handle
);
1186 ok(status
== STATUS_SUCCESS
|| status
== STATUS_ACCESS_DENIED
,
1187 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status
);
1189 /* try a more restricted access mask if necessary */
1190 if (status
== STATUS_ACCESS_DENIED
) {
1191 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
1192 status
= pLsaOpenPolicy( NULL
, &object_attributes
, POLICY_VIEW_LOCAL_INFORMATION
, &handle
);
1193 ok(status
== STATUS_SUCCESS
, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status
);
1196 if (status
== STATUS_SUCCESS
)
1198 PPOLICY_ACCOUNT_DOMAIN_INFO info
;
1199 status
= pLsaQueryInformationPolicy(handle
, PolicyAccountDomainInformation
, (PVOID
*)&info
);
1200 ok(status
== STATUS_SUCCESS
, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status
);
1201 if (status
== STATUS_SUCCESS
)
1203 ok(info
->DomainSid
!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
1204 if (info
->DomainSid
)
1206 int count
= *GetSidSubAuthorityCount(info
->DomainSid
);
1207 CopySid(GetSidLengthRequired(count
), &max_sid
, info
->DomainSid
);
1208 test_sid_str((PSID
)&max_sid
.sid
);
1209 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_USER_RID_ADMIN
;
1210 max_sid
.sid
.SubAuthorityCount
= count
+ 1;
1211 test_sid_str((PSID
)&max_sid
.sid
);
1212 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_USER_RID_GUEST
;
1213 test_sid_str((PSID
)&max_sid
.sid
);
1214 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_ADMINS
;
1215 test_sid_str((PSID
)&max_sid
.sid
);
1216 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_USERS
;
1217 test_sid_str((PSID
)&max_sid
.sid
);
1218 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_GUESTS
;
1219 test_sid_str((PSID
)&max_sid
.sid
);
1220 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_COMPUTERS
;
1221 test_sid_str((PSID
)&max_sid
.sid
);
1222 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_CONTROLLERS
;
1223 test_sid_str((PSID
)&max_sid
.sid
);
1224 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_CERT_ADMINS
;
1225 test_sid_str((PSID
)&max_sid
.sid
);
1226 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_SCHEMA_ADMINS
;
1227 test_sid_str((PSID
)&max_sid
.sid
);
1228 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS
;
1229 test_sid_str((PSID
)&max_sid
.sid
);
1230 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_POLICY_ADMINS
;
1231 test_sid_str((PSID
)&max_sid
.sid
);
1232 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_ALIAS_RID_RAS_SERVERS
;
1233 test_sid_str((PSID
)&max_sid
.sid
);
1234 max_sid
.sid
.SubAuthority
[count
] = 1000; /* first user account */
1235 test_sid_str((PSID
)&max_sid
.sid
);
1238 pLsaFreeMemory((LPVOID
)info
);
1241 status
= pLsaClose(handle
);
1242 ok(status
== STATUS_SUCCESS
, "LsaClose() failed, returned 0x%08x\n", status
);
1248 static void get_sid_info(PSID psid
, LPSTR
*user
, LPSTR
*dom
)
1250 static CHAR account
[UNLEN
+ 1];
1251 static CHAR domain
[UNLEN
+ 1];
1252 DWORD size
, dom_size
;
1258 size
= dom_size
= UNLEN
+ 1;
1261 LookupAccountSidA(NULL
, psid
, account
, &size
, domain
, &dom_size
, &use
);
1264 static void test_LookupAccountName(void)
1266 DWORD sid_size
, domain_size
, user_size
;
1267 DWORD sid_save
, domain_save
;
1268 CHAR user_name
[UNLEN
+ 1];
1269 SID_NAME_USE sid_use
;
1270 LPSTR domain
, account
, sid_dom
;
1274 /* native crashes if (assuming all other parameters correct):
1276 * - Sid is NULL and cbSid is > 0
1277 * - cbSid or cchReferencedDomainName are NULL
1278 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
1281 user_size
= UNLEN
+ 1;
1282 ret
= GetUserNameA(user_name
, &user_size
);
1283 ok(ret
, "Failed to get user name\n");
1288 sid_use
= 0xcafebabe;
1289 SetLastError(0xdeadbeef);
1290 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1291 ok(!ret
, "Expected 0, got %d\n", ret
);
1292 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1293 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1294 ok(sid_size
!= 0, "Expected non-zero sid size\n");
1295 ok(domain_size
!= 0, "Expected non-zero domain size\n");
1296 ok(sid_use
== 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use
);
1298 sid_save
= sid_size
;
1299 domain_save
= domain_size
;
1301 psid
= HeapAlloc(GetProcessHeap(), 0, sid_size
);
1302 domain
= HeapAlloc(GetProcessHeap(), 0, domain_size
);
1304 /* try valid account name */
1305 ret
= LookupAccountNameA(NULL
, user_name
, psid
, &sid_size
, domain
, &domain_size
, &sid_use
);
1306 get_sid_info(psid
, &account
, &sid_dom
);
1307 ok(ret
, "Failed to lookup account name\n");
1308 ok(sid_size
== GetLengthSid(psid
), "Expected %d, got %d\n", GetLengthSid(psid
), sid_size
);
1311 ok(!lstrcmp(account
, user_name
), "Expected %s, got %s\n", user_name
, account
);
1312 ok(!lstrcmp(domain
, sid_dom
), "Expected %s, got %s\n", sid_dom
, domain
);
1313 ok(domain_size
== domain_save
- 1, "Expected %d, got %d\n", domain_save
- 1, domain_size
);
1314 ok(lstrlen(domain
) == domain_size
, "Expected %d\n", lstrlen(domain
));
1315 ok(sid_use
== SidTypeUser
, "Expected SidTypeUser, got %d\n", SidTypeUser
);
1317 domain_size
= domain_save
;
1319 /* NULL Sid with zero sid size */
1320 SetLastError(0xdeadbeef);
1322 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, domain
, &domain_size
, &sid_use
);
1323 ok(!ret
, "Expected 0, got %d\n", ret
);
1324 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1325 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1326 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1327 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1329 /* try cchReferencedDomainName - 1 */
1330 SetLastError(0xdeadbeef);
1332 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, domain
, &domain_size
, &sid_use
);
1333 ok(!ret
, "Expected 0, got %d\n", ret
);
1334 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1335 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1336 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1337 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1339 /* NULL ReferencedDomainName with zero domain name size */
1340 SetLastError(0xdeadbeef);
1342 ret
= LookupAccountNameA(NULL
, user_name
, psid
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1343 ok(!ret
, "Expected 0, got %d\n", ret
);
1344 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1345 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1346 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1347 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1349 HeapFree(GetProcessHeap(), 0, psid
);
1350 HeapFree(GetProcessHeap(), 0, domain
);
1352 /* get sizes for NULL account name */
1355 sid_use
= 0xcafebabe;
1356 SetLastError(0xdeadbeef);
1357 ret
= LookupAccountNameA(NULL
, NULL
, NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1358 ok(!ret
, "Expected 0, got %d\n", ret
);
1359 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1360 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1361 ok(sid_size
!= 0, "Expected non-zero sid size\n");
1362 ok(domain_size
!= 0, "Expected non-zero domain size\n");
1363 ok(sid_use
== 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use
);
1365 psid
= HeapAlloc(GetProcessHeap(), 0, sid_size
);
1366 domain
= HeapAlloc(GetProcessHeap(), 0, domain_size
);
1368 /* try NULL account name */
1369 ret
= LookupAccountNameA(NULL
, NULL
, psid
, &sid_size
, domain
, &domain_size
, &sid_use
);
1370 get_sid_info(psid
, &account
, &sid_dom
);
1371 ok(ret
, "Failed to lookup account name\n");
1374 ok(!lstrcmp(account
, "BUILTIN"), "Expected BUILTIN, got %s\n", account
);
1375 ok(!lstrcmp(domain
, "BUILTIN"), "Expected BUILTIN, got %s\n", domain
);
1376 ok(sid_use
== SidTypeDomain
, "Expected SidTypeDomain, got %d\n", SidTypeDomain
);
1379 /* try an invalid account name */
1380 SetLastError(0xdeadbeef);
1383 ret
= LookupAccountNameA(NULL
, "oogabooga", NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1384 ok(!ret
, "Expected 0, got %d\n", ret
);
1387 ok(GetLastError() == ERROR_NONE_MAPPED
,
1388 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
1389 ok(sid_size
== 0, "Expected 0, got %d\n", sid_size
);
1390 ok(domain_size
== 0, "Expected 0, got %d\n", domain_size
);
1393 HeapFree(GetProcessHeap(), 0, psid
);
1394 HeapFree(GetProcessHeap(), 0, domain
);
1397 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,__LINE__)
1398 static void test_granted_access(HANDLE handle
, ACCESS_MASK access
, int line
)
1400 OBJECT_BASIC_INFORMATION obj_info
;
1403 if (!pNtQueryObject
)
1405 skip_(__FILE__
, line
)("Not NT platform - skipping tests\n");
1409 status
= pNtQueryObject( handle
, ObjectBasicInformation
, &obj_info
,
1410 sizeof(obj_info
), NULL
);
1411 ok_(__FILE__
, line
)(!status
, "NtQueryObject with err: %08x\n", status
);
1412 ok_(__FILE__
, line
)(obj_info
.GrantedAccess
== access
, "Gratned access should "
1413 "be 0x%08x, instead of 0x%08x\n", access
, obj_info
.GrantedAccess
);
1416 #define CHECK_SET_SECURITY(o,i,e) \
1420 SetLastError( 0xdeadbeef ); \
1421 res = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
1422 err = GetLastError(); \
1423 if (e == ERROR_SUCCESS) \
1424 ok(res, "SetKernelObjectSecurity failed with %d\n", err); \
1426 ok(!res && err == e, "SetKernelObjectSecurity should have failed " \
1427 "with %s, instead of %d\n", #e, err); \
1430 static void test_process_security(void)
1433 char owner
[32], group
[32];
1434 PSID AdminSid
= NULL
, UsersSid
= NULL
;
1436 SECURITY_DESCRIPTOR
*SecurityDescriptor
= NULL
;
1437 char buffer
[MAX_PATH
];
1438 PROCESS_INFORMATION info
;
1439 STARTUPINFOA startup
;
1440 SECURITY_ATTRIBUTES psa
;
1441 HANDLE token
, event
;
1444 Acl
= HeapAlloc(GetProcessHeap(), 0, 256);
1445 res
= InitializeAcl(Acl
, 256, ACL_REVISION
);
1446 if (!res
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
1448 skip("ACLs not implemented - skipping tests\n");
1451 ok(res
, "InitializeAcl failed with error %d\n", GetLastError());
1453 /* get owner from the token we might be running as a user not admin */
1454 res
= OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED
, &token
);
1455 ok(res
, "OpenProcessToken failed with error %d\n", GetLastError());
1458 res
= GetTokenInformation( token
, TokenOwner
, owner
, sizeof(owner
), &tmp
);
1459 ok(res
, "GetTokenInformation failed with error %d\n", GetLastError());
1460 AdminSid
= ((TOKEN_OWNER
*)owner
)->Owner
;
1461 res
= GetTokenInformation( token
, TokenPrimaryGroup
, group
, sizeof(group
), &tmp
);
1462 ok(res
, "GetTokenInformation failed with error %d\n", GetLastError());
1463 UsersSid
= ((TOKEN_PRIMARY_GROUP
*)group
)->PrimaryGroup
;
1465 CloseHandle( token
);
1468 res
= AddAccessDeniedAce(Acl
, ACL_REVISION
, PROCESS_VM_READ
, AdminSid
);
1469 ok(res
, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1470 res
= AddAccessAllowedAce(Acl
, ACL_REVISION
, PROCESS_ALL_ACCESS
, AdminSid
);
1471 ok(res
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1473 SecurityDescriptor
= HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH
);
1474 res
= InitializeSecurityDescriptor(SecurityDescriptor
, SECURITY_DESCRIPTOR_REVISION
);
1475 ok(res
, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1477 event
= CreateEvent( NULL
, TRUE
, TRUE
, "test_event" );
1478 ok(event
!= NULL
, "CreateEvent %d\n", GetLastError());
1480 SecurityDescriptor
->Revision
= 0;
1481 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_UNKNOWN_REVISION
);
1482 SecurityDescriptor
->Revision
= SECURITY_DESCRIPTOR_REVISION
;
1484 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_INVALID_SECURITY_DESCR
);
1485 CHECK_SET_SECURITY( event
, GROUP_SECURITY_INFORMATION
, ERROR_INVALID_SECURITY_DESCR
);
1486 CHECK_SET_SECURITY( event
, SACL_SECURITY_INFORMATION
, ERROR_ACCESS_DENIED
);
1487 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1488 /* NULL DACL is valid and means default DACL from token */
1489 SecurityDescriptor
->Control
|= SE_DACL_PRESENT
;
1490 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1492 /* Set owner and group and dacl */
1493 res
= SetSecurityDescriptorOwner(SecurityDescriptor
, AdminSid
, FALSE
);
1494 ok(res
, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1495 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1496 res
= SetSecurityDescriptorGroup(SecurityDescriptor
, UsersSid
, FALSE
);
1497 ok(res
, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1498 CHECK_SET_SECURITY( event
, GROUP_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1499 res
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
1500 ok(res
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1501 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1503 sprintf(buffer
, "%s tests/security.c test", myARGV
[0]);
1504 memset(&startup
, 0, sizeof(startup
));
1505 startup
.cb
= sizeof(startup
);
1506 startup
.dwFlags
= STARTF_USESHOWWINDOW
;
1507 startup
.wShowWindow
= SW_SHOWNORMAL
;
1509 psa
.nLength
= sizeof(psa
);
1510 psa
.lpSecurityDescriptor
= SecurityDescriptor
;
1511 psa
.bInheritHandle
= TRUE
;
1513 /* Doesn't matter what ACL say we should get full access for ourselves */
1514 ok(CreateProcessA( NULL
, buffer
, &psa
, NULL
, FALSE
, 0, NULL
, NULL
, &startup
, &info
),
1515 "CreateProcess with err:%d\n", GetLastError());
1516 TEST_GRANTED_ACCESS( info
.hProcess
, PROCESS_ALL_ACCESS
);
1517 ok(WaitForSingleObject(info
.hProcess
, 30000) == WAIT_OBJECT_0
, "Child process termination\n");
1519 CloseHandle( event
);
1520 HeapFree(GetProcessHeap(), 0, Acl
);
1521 HeapFree(GetProcessHeap(), 0, SecurityDescriptor
);
1524 static void test_process_security_child(void)
1526 HANDLE handle
, handle1
;
1530 handle
= OpenProcess( PROCESS_TERMINATE
, FALSE
, GetCurrentProcessId() );
1531 ok(handle
!= NULL
, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
1532 TEST_GRANTED_ACCESS( handle
, PROCESS_TERMINATE
);
1534 ok(DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1535 &handle1
, 0, TRUE
, DUPLICATE_SAME_ACCESS
),
1536 "duplicating handle err:%d\n", GetLastError());
1537 TEST_GRANTED_ACCESS( handle1
, PROCESS_TERMINATE
);
1539 CloseHandle( handle1
);
1541 SetLastError( 0xdeadbeef );
1542 ret
= DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1543 &handle1
, PROCESS_ALL_ACCESS
, TRUE
, 0 );
1544 err
= GetLastError();
1546 ok(!ret
&& err
== ERROR_ACCESS_DENIED
, "duplicating handle should have failed "
1547 "with STATUS_ACCESS_DENIED, instead of err:%d\n", err
);
1549 CloseHandle( handle
);
1551 /* These two should fail - they are denied by ACL */
1552 handle
= OpenProcess( PROCESS_VM_READ
, FALSE
, GetCurrentProcessId() );
1554 ok(handle
== NULL
, "OpenProcess(PROCESS_VM_READ) should have failed\n");
1555 handle
= OpenProcess( PROCESS_ALL_ACCESS
, FALSE
, GetCurrentProcessId() );
1557 ok(handle
== NULL
, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
1559 /* Documented privilege elevation */
1560 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1561 &handle
, 0, TRUE
, DUPLICATE_SAME_ACCESS
),
1562 "duplicating handle err:%d\n", GetLastError());
1563 TEST_GRANTED_ACCESS( handle
, PROCESS_ALL_ACCESS
);
1565 CloseHandle( handle
);
1567 /* Same only explicitly asking for all access rights */
1568 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1569 &handle
, PROCESS_ALL_ACCESS
, TRUE
, 0 ),
1570 "duplicating handle err:%d\n", GetLastError());
1571 TEST_GRANTED_ACCESS( handle
, PROCESS_ALL_ACCESS
);
1572 ok(DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1573 &handle1
, PROCESS_VM_READ
, TRUE
, 0 ),
1574 "duplicating handle err:%d\n", GetLastError());
1575 TEST_GRANTED_ACCESS( handle1
, PROCESS_VM_READ
);
1576 CloseHandle( handle1
);
1577 CloseHandle( handle
);
1580 static void test_impersonation_level(void)
1582 HANDLE Token
, ProcessToken
;
1585 TOKEN_PRIVILEGES
*Privileges
;
1587 PRIVILEGE_SET
*PrivilegeSet
;
1593 ret
= ImpersonateSelf(SecurityAnonymous
);
1594 ok(ret
, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
1595 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1596 ok(!ret
, "OpenThreadToken should have failed\n");
1597 error
= GetLastError();
1598 ok(error
== ERROR_CANT_OPEN_ANONYMOUS
, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error
);
1599 /* can't perform access check when opening object against an anonymous impersonation token */
1601 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1602 ok(error
== ERROR_INVALID_HANDLE
, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error
);
1606 ret
= OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE
, &ProcessToken
);
1607 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
1609 ret
= DuplicateTokenEx(ProcessToken
,
1610 TOKEN_QUERY
| TOKEN_DUPLICATE
| TOKEN_IMPERSONATE
, NULL
,
1611 SecurityAnonymous
, TokenImpersonation
, &Token
);
1612 ok(ret
, "DuplicateTokenEx failed with error %d\n", GetLastError());
1613 /* can't increase the impersonation level */
1614 ret
= DuplicateToken(Token
, SecurityIdentification
, &Token2
);
1615 error
= GetLastError();
1616 ok(!ret
&& error
== ERROR_BAD_IMPERSONATION_LEVEL
,
1617 "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error
);
1618 /* we can query anything from an anonymous token, including the user */
1619 ret
= GetTokenInformation(Token
, TokenUser
, NULL
, 0, &Size
);
1620 error
= GetLastError();
1621 ok(!ret
&& error
== ERROR_INSUFFICIENT_BUFFER
, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error
);
1622 User
= (TOKEN_USER
*)HeapAlloc(GetProcessHeap(), 0, Size
);
1623 ret
= GetTokenInformation(Token
, TokenUser
, User
, Size
, &Size
);
1624 ok(ret
, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1625 HeapFree(GetProcessHeap(), 0, User
);
1627 /* PrivilegeCheck fails with SecurityAnonymous level */
1628 ret
= GetTokenInformation(Token
, TokenPrivileges
, NULL
, 0, &Size
);
1629 error
= GetLastError();
1630 ok(!ret
&& error
== ERROR_INSUFFICIENT_BUFFER
, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error
);
1631 Privileges
= (TOKEN_PRIVILEGES
*)HeapAlloc(GetProcessHeap(), 0, Size
);
1632 ret
= GetTokenInformation(Token
, TokenPrivileges
, Privileges
, Size
, &Size
);
1633 ok(ret
, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1635 PrivilegeSet
= (PRIVILEGE_SET
*)HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET
, Privilege
[Privileges
->PrivilegeCount
]));
1636 PrivilegeSet
->PrivilegeCount
= Privileges
->PrivilegeCount
;
1637 memcpy(PrivilegeSet
->Privilege
, Privileges
->Privileges
, PrivilegeSet
->PrivilegeCount
* sizeof(PrivilegeSet
->Privilege
[0]));
1638 PrivilegeSet
->Control
= PRIVILEGE_SET_ALL_NECESSARY
;
1639 HeapFree(GetProcessHeap(), 0, Privileges
);
1641 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1642 error
= GetLastError();
1643 ok(!ret
&& error
== ERROR_BAD_IMPERSONATION_LEVEL
, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error
);
1647 ret
= ImpersonateSelf(SecurityIdentification
);
1648 ok(ret
, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
1649 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1650 ok(ret
, "OpenThreadToken failed with error %d\n", GetLastError());
1652 /* can't perform access check when opening object against an identification impersonation token */
1653 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1655 ok(error
== ERROR_INVALID_HANDLE
, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error
);
1657 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1658 ok(ret
, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
1662 ret
= ImpersonateSelf(SecurityImpersonation
);
1663 ok(ret
, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
1664 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1665 ok(ret
, "OpenThreadToken failed with error %d\n", GetLastError());
1666 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1667 ok(error
== ERROR_SUCCESS
, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error
);
1669 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1670 ok(ret
, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
1674 CloseHandle(ProcessToken
);
1676 HeapFree(GetProcessHeap(), 0, PrivilegeSet
);
1679 START_TEST(security
)
1686 test_process_security_child();
1692 test_FileSecurity();
1695 test_LookupAccountSid();
1696 test_LookupAccountName();
1697 test_process_security();
1698 test_impersonation_level();