?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
quartz: Free two assert calls from having side effects.
[wine/testsucceed.git] / dlls / advapi32 / tests / security.c
blob4cc140277ed3fb1792c48d3c8b644a32f723882c
1 /*
2 * Unit tests for security functions
3 *
4 * Copyright (c) 2004 Mike McCormack
5 * Copyright (c) 2011 Dmitry Timoshkov
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
20 */
21
22 #include <stdarg.h>
23 #include <stdio.h>
24
25 #include "ntstatus.h"
26 #define WIN32_NO_STATUS
27 #include "windef.h"
28 #include "winbase.h"
29 #include "winerror.h"
30 #include "aclapi.h"
31 #include "winnt.h"
32 #include "sddl.h"
33 #include "ntsecapi.h"
34 #include "lmcons.h"
35
36 #include "wine/test.h"
37
38 /* copied from Wine winternl.h - not included in the Windows SDK */
39 typedef enum _OBJECT_INFORMATION_CLASS {
40 ObjectBasicInformation,
41 ObjectNameInformation,
42 ObjectTypeInformation,
43 ObjectAllInformation,
44 ObjectDataInformation
45 } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
46
47 typedef struct _OBJECT_BASIC_INFORMATION {
48 ULONG Attributes;
49 ACCESS_MASK GrantedAccess;
50 ULONG HandleCount;
51 ULONG PointerCount;
52 ULONG PagedPoolUsage;
53 ULONG NonPagedPoolUsage;
54 ULONG Reserved[3];
55 ULONG NameInformationLength;
56 ULONG TypeInformationLength;
57 ULONG SecurityDescriptorLength;
58 LARGE_INTEGER CreateTime;
59 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
60
61 #define expect_eq(expr, value, type, format) { type ret = expr; ok((value) == ret, #expr " expected " format " got " format "\n", (value), (ret)); }
62
63 static BOOL (WINAPI *pAddAccessAllowedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
64 static BOOL (WINAPI *pAddAccessDeniedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
65 static BOOL (WINAPI *pAddAuditAccessAceEx)(PACL, DWORD, DWORD, DWORD, PSID, BOOL, BOOL);
66 static VOID (WINAPI *pBuildTrusteeWithSidA)( PTRUSTEEA pTrustee, PSID pSid );
67 static VOID (WINAPI *pBuildTrusteeWithNameA)( PTRUSTEEA pTrustee, LPSTR pName );
68 static VOID (WINAPI *pBuildTrusteeWithObjectsAndNameA)( PTRUSTEEA pTrustee,
69 POBJECTS_AND_NAME_A pObjName,
70 SE_OBJECT_TYPE ObjectType,
71 LPSTR ObjectTypeName,
72 LPSTR InheritedObjectTypeName,
73 LPSTR Name );
74 static VOID (WINAPI *pBuildTrusteeWithObjectsAndSidA)( PTRUSTEEA pTrustee,
75 POBJECTS_AND_SID pObjSid,
76 GUID* pObjectGuid,
77 GUID* pInheritedObjectGuid,
78 PSID pSid );
79 static LPSTR (WINAPI *pGetTrusteeNameA)( PTRUSTEEA pTrustee );
80 static BOOL (WINAPI *pMakeSelfRelativeSD)( PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR, LPDWORD );
81 static BOOL (WINAPI *pConvertSidToStringSidA)( PSID pSid, LPSTR *str );
82 static BOOL (WINAPI *pConvertStringSidToSidA)( LPCSTR str, PSID pSid );
83 static BOOL (WINAPI *pCheckTokenMembership)(HANDLE, PSID, PBOOL);
84 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorA)(LPCSTR, DWORD,
85 PSECURITY_DESCRIPTOR*, PULONG );
86 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorW)(LPCWSTR, DWORD,
87 PSECURITY_DESCRIPTOR*, PULONG );
88 static BOOL (WINAPI *pConvertSecurityDescriptorToStringSecurityDescriptorA)(PSECURITY_DESCRIPTOR, DWORD,
89 SECURITY_INFORMATION, LPSTR *, PULONG );
90 static BOOL (WINAPI *pGetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
91 PSECURITY_DESCRIPTOR, DWORD, LPDWORD);
92 static BOOL (WINAPI *pSetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
93 PSECURITY_DESCRIPTOR);
94 static DWORD (WINAPI *pGetNamedSecurityInfoA)(LPSTR, SE_OBJECT_TYPE, SECURITY_INFORMATION,
95 PSID*, PSID*, PACL*, PACL*,
96 PSECURITY_DESCRIPTOR*);
97 static PDWORD (WINAPI *pGetSidSubAuthority)(PSID, DWORD);
98 static PUCHAR (WINAPI *pGetSidSubAuthorityCount)(PSID);
99 static BOOL (WINAPI *pIsValidSid)(PSID);
100 static DWORD (WINAPI *pRtlAdjustPrivilege)(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
101 static BOOL (WINAPI *pCreateWellKnownSid)(WELL_KNOWN_SID_TYPE,PSID,PSID,DWORD*);
102 static BOOL (WINAPI *pDuplicateTokenEx)(HANDLE,DWORD,LPSECURITY_ATTRIBUTES,
103 SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
104
105 static NTSTATUS (WINAPI *pLsaQueryInformationPolicy)(LSA_HANDLE,POLICY_INFORMATION_CLASS,PVOID*);
106 static NTSTATUS (WINAPI *pLsaClose)(LSA_HANDLE);
107 static NTSTATUS (WINAPI *pLsaFreeMemory)(PVOID);
108 static NTSTATUS (WINAPI *pLsaOpenPolicy)(PLSA_UNICODE_STRING,PLSA_OBJECT_ATTRIBUTES,ACCESS_MASK,PLSA_HANDLE);
109 static NTSTATUS (WINAPI *pNtQueryObject)(HANDLE,OBJECT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
110 static DWORD (WINAPI *pSetEntriesInAclW)(ULONG, PEXPLICIT_ACCESSW, PACL, PACL*);
111 static DWORD (WINAPI *pSetEntriesInAclA)(ULONG, PEXPLICIT_ACCESSA, PACL, PACL*);
112 static BOOL (WINAPI *pSetSecurityDescriptorControl)(PSECURITY_DESCRIPTOR, SECURITY_DESCRIPTOR_CONTROL,
113 SECURITY_DESCRIPTOR_CONTROL);
114 static DWORD (WINAPI *pGetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION,
115 PSID*, PSID*, PACL*, PACL*, PSECURITY_DESCRIPTOR*);
116 static NTSTATUS (WINAPI *pNtAccessCheck)(PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK, PGENERIC_MAPPING,
117 PPRIVILEGE_SET, PULONG, PULONG, NTSTATUS*);
118 static BOOL (WINAPI *pCreateRestrictedToken)(HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD,
119 PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE);
120
121 static HMODULE hmod;
122 static int myARGC;
123 static char** myARGV;
124
125 struct sidRef
126 {
127 SID_IDENTIFIER_AUTHORITY auth;
128 const char *refStr;
129 };
130
131 static void init(void)
132 {
133 HMODULE hntdll;
134
135 hntdll = GetModuleHandleA("ntdll.dll");
136 pNtQueryObject = (void *)GetProcAddress( hntdll, "NtQueryObject" );
137 pNtAccessCheck = (void *)GetProcAddress( hntdll, "NtAccessCheck" );
138
139 hmod = GetModuleHandle("advapi32.dll");
140 pAddAccessAllowedAceEx = (void *)GetProcAddress(hmod, "AddAccessAllowedAceEx");
141 pAddAccessDeniedAceEx = (void *)GetProcAddress(hmod, "AddAccessDeniedAceEx");
142 pAddAuditAccessAceEx = (void *)GetProcAddress(hmod, "AddAuditAccessAceEx");
143 pCheckTokenMembership = (void *)GetProcAddress(hmod, "CheckTokenMembership");
144 pConvertStringSecurityDescriptorToSecurityDescriptorA =
145 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
146 pConvertStringSecurityDescriptorToSecurityDescriptorW =
147 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorW" );
148 pConvertSecurityDescriptorToStringSecurityDescriptorA =
149 (void *)GetProcAddress(hmod, "ConvertSecurityDescriptorToStringSecurityDescriptorA" );
150 pGetFileSecurityA = (void *)GetProcAddress(hmod, "GetFileSecurityA" );
151 pSetFileSecurityA = (void *)GetProcAddress(hmod, "SetFileSecurityA" );
152 pCreateWellKnownSid = (void *)GetProcAddress( hmod, "CreateWellKnownSid" );
153 pGetNamedSecurityInfoA = (void *)GetProcAddress(hmod, "GetNamedSecurityInfoA");
154 pGetSidSubAuthority = (void *)GetProcAddress(hmod, "GetSidSubAuthority");
155 pGetSidSubAuthorityCount = (void *)GetProcAddress(hmod, "GetSidSubAuthorityCount");
156 pIsValidSid = (void *)GetProcAddress(hmod, "IsValidSid");
157 pMakeSelfRelativeSD = (void *)GetProcAddress(hmod, "MakeSelfRelativeSD");
158 pSetEntriesInAclW = (void *)GetProcAddress(hmod, "SetEntriesInAclW");
159 pSetEntriesInAclA = (void *)GetProcAddress(hmod, "SetEntriesInAclA");
160 pSetSecurityDescriptorControl = (void *)GetProcAddress(hmod, "SetSecurityDescriptorControl");
161 pGetSecurityInfo = (void *)GetProcAddress(hmod, "GetSecurityInfo");
162 pCreateRestrictedToken = (void *)GetProcAddress(hmod, "CreateRestrictedToken");
163
164 myARGC = winetest_get_mainargs( &myARGV );
165 }
166
167 static void test_str_sid(const char *str_sid)
168 {
169 PSID psid;
170 char *temp;
171
172 if (pConvertStringSidToSidA(str_sid, &psid))
173 {
174 if (pConvertSidToStringSidA(psid, &temp))
175 {
176 trace(" %s: %s\n", str_sid, temp);
177 LocalFree(temp);
178 }
179 LocalFree(psid);
180 }
181 else
182 {
183 if (GetLastError() != ERROR_INVALID_SID)
184 trace(" %s: couldn't be converted, returned %d\n", str_sid, GetLastError());
185 else
186 trace(" %s: couldn't be converted\n", str_sid);
187 }
188 }
189
190 static void test_sid(void)
191 {
192 struct sidRef refs[] = {
193 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
194 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
195 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
196 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
197 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
198 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
199 };
200 const char noSubAuthStr[] = "S-1-5";
201 unsigned int i;
202 PSID psid = NULL;
203 SID *pisid;
204 BOOL r;
205 LPSTR str = NULL;
206
207 pConvertSidToStringSidA = (void *)GetProcAddress( hmod, "ConvertSidToStringSidA" );
208 if( !pConvertSidToStringSidA )
209 return;
210 pConvertStringSidToSidA = (void *)GetProcAddress( hmod, "ConvertStringSidToSidA" );
211 if( !pConvertStringSidToSidA )
212 return;
213
214 r = pConvertStringSidToSidA( NULL, NULL );
215 ok( !r, "expected failure with NULL parameters\n" );
216 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED )
217 return;
218 ok( GetLastError() == ERROR_INVALID_PARAMETER,
219 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
220 GetLastError() );
221
222 r = pConvertStringSidToSidA( refs[0].refStr, NULL );
223 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
224 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
225 GetLastError() );
226
227 r = pConvertStringSidToSidA( NULL, &str );
228 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
229 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
230 GetLastError() );
231
232 r = pConvertStringSidToSidA( noSubAuthStr, &psid );
233 ok( !r,
234 "expected failure with no sub authorities\n" );
235 ok( GetLastError() == ERROR_INVALID_SID,
236 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
237 GetLastError() );
238
239 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid), "ConvertStringSidToSidA failed\n");
240 pisid = psid;
241 ok(pisid->SubAuthorityCount == 4, "Invalid sub authority count - expected 4, got %d\n", pisid->SubAuthorityCount);
242 ok(pisid->SubAuthority[0] == 21, "Invalid subauthority 0 - expected 21, got %d\n", pisid->SubAuthority[0]);
243 ok(pisid->SubAuthority[3] == 4576, "Invalid subauthority 0 - expected 4576, got %d\n", pisid->SubAuthority[3]);
244 LocalFree(str);
245 LocalFree(psid);
246
247 for( i = 0; i < sizeof(refs) / sizeof(refs[0]); i++ )
248 {
249 PISID pisid;
250
251 r = AllocateAndInitializeSid( &refs[i].auth, 1,1,0,0,0,0,0,0,0,
252 &psid );
253 ok( r, "failed to allocate sid\n" );
254 r = pConvertSidToStringSidA( psid, &str );
255 ok( r, "failed to convert sid\n" );
256 if (r)
257 {
258 ok( !strcmp( str, refs[i].refStr ),
259 "incorrect sid, expected %s, got %s\n", refs[i].refStr, str );
260 LocalFree( str );
261 }
262 if( psid )
263 FreeSid( psid );
264
265 r = pConvertStringSidToSidA( refs[i].refStr, &psid );
266 ok( r, "failed to parse sid string\n" );
267 pisid = psid;
268 ok( pisid &&
269 !memcmp( pisid->IdentifierAuthority.Value, refs[i].auth.Value,
270 sizeof(refs[i].auth) ),
271 "string sid %s didn't parse to expected value\n"
272 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
273 refs[i].refStr,
274 MAKEWORD( pisid->IdentifierAuthority.Value[1],
275 pisid->IdentifierAuthority.Value[0] ),
276 MAKELONG( MAKEWORD( pisid->IdentifierAuthority.Value[5],
277 pisid->IdentifierAuthority.Value[4] ),
278 MAKEWORD( pisid->IdentifierAuthority.Value[3],
279 pisid->IdentifierAuthority.Value[2] ) ),
280 MAKEWORD( refs[i].auth.Value[1], refs[i].auth.Value[0] ),
281 MAKELONG( MAKEWORD( refs[i].auth.Value[5], refs[i].auth.Value[4] ),
282 MAKEWORD( refs[i].auth.Value[3], refs[i].auth.Value[2] ) ) );
283 if( psid )
284 LocalFree( psid );
285 }
286
287 trace("String SIDs:\n");
288 test_str_sid("AO");
289 test_str_sid("RU");
290 test_str_sid("AN");
291 test_str_sid("AU");
292 test_str_sid("BA");
293 test_str_sid("BG");
294 test_str_sid("BO");
295 test_str_sid("BU");
296 test_str_sid("CA");
297 test_str_sid("CG");
298 test_str_sid("CO");
299 test_str_sid("DA");
300 test_str_sid("DC");
301 test_str_sid("DD");
302 test_str_sid("DG");
303 test_str_sid("DU");
304 test_str_sid("EA");
305 test_str_sid("ED");
306 test_str_sid("WD");
307 test_str_sid("PA");
308 test_str_sid("IU");
309 test_str_sid("LA");
310 test_str_sid("LG");
311 test_str_sid("LS");
312 test_str_sid("SY");
313 test_str_sid("NU");
314 test_str_sid("NO");
315 test_str_sid("NS");
316 test_str_sid("PO");
317 test_str_sid("PS");
318 test_str_sid("PU");
319 test_str_sid("RS");
320 test_str_sid("RD");
321 test_str_sid("RE");
322 test_str_sid("RC");
323 test_str_sid("SA");
324 test_str_sid("SO");
325 test_str_sid("SU");
326 }
327
328 static void test_trustee(void)
329 {
330 GUID ObjectType = {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
331 GUID InheritedObjectType = {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
332 GUID ZeroGuid;
333 OBJECTS_AND_NAME_ oan;
334 OBJECTS_AND_SID oas;
335 TRUSTEE trustee;
336 PSID psid;
337 char szObjectTypeName[] = "ObjectTypeName";
338 char szInheritedObjectTypeName[] = "InheritedObjectTypeName";
339 char szTrusteeName[] = "szTrusteeName";
340 SID_IDENTIFIER_AUTHORITY auth = { {0x11,0x22,0,0,0, 0} };
341
342 memset( &ZeroGuid, 0x00, sizeof (ZeroGuid) );
343
344 pBuildTrusteeWithSidA = (void *)GetProcAddress( hmod, "BuildTrusteeWithSidA" );
345 pBuildTrusteeWithNameA = (void *)GetProcAddress( hmod, "BuildTrusteeWithNameA" );
346 pBuildTrusteeWithObjectsAndNameA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndNameA" );
347 pBuildTrusteeWithObjectsAndSidA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndSidA" );
348 pGetTrusteeNameA = (void *)GetProcAddress (hmod, "GetTrusteeNameA" );
349 if( !pBuildTrusteeWithSidA || !pBuildTrusteeWithNameA ||
350 !pBuildTrusteeWithObjectsAndNameA || !pBuildTrusteeWithObjectsAndSidA ||
351 !pGetTrusteeNameA )
352 return;
353
354 if ( ! AllocateAndInitializeSid( &auth, 1, 42, 0,0,0,0,0,0,0,&psid ) )
355 {
356 trace( "failed to init SID\n" );
357 return;
358 }
359
360 /* test BuildTrusteeWithSidA */
361 memset( &trustee, 0xff, sizeof trustee );
362 pBuildTrusteeWithSidA( &trustee, psid );
363
364 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
365 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
366 "MultipleTrusteeOperation wrong\n");
367 ok( trustee.TrusteeForm == TRUSTEE_IS_SID, "TrusteeForm wrong\n");
368 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
369 ok( trustee.ptstrName == psid, "ptstrName wrong\n" );
370
371 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
372 memset( &trustee, 0xff, sizeof trustee );
373 memset( &oas, 0xff, sizeof(oas) );
374 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, &ObjectType,
375 &InheritedObjectType, psid);
376
377 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
378 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
379 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
380 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
381 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
382
383 ok(oas.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
384 ok(!memcmp(&oas.ObjectTypeGuid, &ObjectType, sizeof(GUID)), "ObjectTypeGuid wrong\n");
385 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
386 ok(oas.pSid == psid, "pSid wrong\n");
387
388 /* test GetTrusteeNameA */
389 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oas, "GetTrusteeName returned wrong value\n");
390
391 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
392 memset( &trustee, 0xff, sizeof trustee );
393 memset( &oas, 0xff, sizeof(oas) );
394 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, NULL,
395 &InheritedObjectType, psid);
396
397 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
398 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
399 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
400 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
401 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
402
403 ok(oas.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
404 ok(!memcmp(&oas.ObjectTypeGuid, &ZeroGuid, sizeof(GUID)), "ObjectTypeGuid wrong\n");
405 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
406 ok(oas.pSid == psid, "pSid wrong\n");
407
408 FreeSid( psid );
409
410 /* test BuildTrusteeWithNameA */
411 memset( &trustee, 0xff, sizeof trustee );
412 pBuildTrusteeWithNameA( &trustee, szTrusteeName );
413
414 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
415 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
416 "MultipleTrusteeOperation wrong\n");
417 ok( trustee.TrusteeForm == TRUSTEE_IS_NAME, "TrusteeForm wrong\n");
418 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
419 ok( trustee.ptstrName == szTrusteeName, "ptstrName wrong\n" );
420
421 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
422 memset( &trustee, 0xff, sizeof trustee );
423 memset( &oan, 0xff, sizeof(oan) );
424 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
425 szInheritedObjectTypeName, szTrusteeName);
426
427 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
428 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
429 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
430 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
431 ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
432
433 ok(oan.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
434 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
435 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
436 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
437
438 /* test GetTrusteeNameA */
439 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oan, "GetTrusteeName returned wrong value\n");
440
441 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
442 memset( &trustee, 0xff, sizeof trustee );
443 memset( &oan, 0xff, sizeof(oan) );
444 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, NULL,
445 szInheritedObjectTypeName, szTrusteeName);
446
447 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
448 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
449 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
450 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
451 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
452
453 ok(oan.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
454 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
455 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
456 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
457
458 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
459 memset( &trustee, 0xff, sizeof trustee );
460 memset( &oan, 0xff, sizeof(oan) );
461 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
462 NULL, szTrusteeName);
463
464 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
465 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
466 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
467 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
468 ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
469
470 ok(oan.ObjectsPresent == ACE_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
471 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
472 ok(oan.InheritedObjectTypeName == NULL, "InheritedObjectTypeName wrong\n");
473 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
474 }
475
476 /* If the first isn't defined, assume none is */
477 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
478 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
479 #define SE_CREATE_TOKEN_PRIVILEGE 2L
480 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
481 #define SE_LOCK_MEMORY_PRIVILEGE 4L
482 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
483 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
484 #define SE_TCB_PRIVILEGE 7L
485 #define SE_SECURITY_PRIVILEGE 8L
486 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
487 #define SE_LOAD_DRIVER_PRIVILEGE 10L
488 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
489 #define SE_SYSTEMTIME_PRIVILEGE 12L
490 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
491 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
492 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
493 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
494 #define SE_BACKUP_PRIVILEGE 17L
495 #define SE_RESTORE_PRIVILEGE 18L
496 #define SE_SHUTDOWN_PRIVILEGE 19L
497 #define SE_DEBUG_PRIVILEGE 20L
498 #define SE_AUDIT_PRIVILEGE 21L
499 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
500 #define SE_CHANGE_NOTIFY_PRIVILEGE 23L
501 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
502 #define SE_UNDOCK_PRIVILEGE 25L
503 #define SE_SYNC_AGENT_PRIVILEGE 26L
504 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
505 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
506 #define SE_IMPERSONATE_PRIVILEGE 29L
507 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
508 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
509 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
510
511 static void test_allocateLuid(void)
512 {
513 BOOL (WINAPI *pAllocateLocallyUniqueId)(PLUID);
514 LUID luid1, luid2;
515 BOOL ret;
516
517 pAllocateLocallyUniqueId = (void*)GetProcAddress(hmod, "AllocateLocallyUniqueId");
518 if (!pAllocateLocallyUniqueId) return;
519
520 ret = pAllocateLocallyUniqueId(&luid1);
521 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
522 return;
523
524 ok(ret,
525 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
526 ret = pAllocateLocallyUniqueId(&luid2);
527 ok( ret,
528 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
529 ok(luid1.LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE || luid1.HighPart != 0,
530 "AllocateLocallyUniqueId returned a well-known LUID\n");
531 ok(luid1.LowPart != luid2.LowPart || luid1.HighPart != luid2.HighPart,
532 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
533 ret = pAllocateLocallyUniqueId(NULL);
534 ok( !ret && GetLastError() == ERROR_NOACCESS,
535 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
536 GetLastError());
537 }
538
539 static void test_lookupPrivilegeName(void)
540 {
541 BOOL (WINAPI *pLookupPrivilegeNameA)(LPCSTR, PLUID, LPSTR, LPDWORD);
542 char buf[MAX_PATH]; /* arbitrary, seems long enough */
543 DWORD cchName = sizeof(buf);
544 LUID luid = { 0, 0 };
545 LONG i;
546 BOOL ret;
547
548 /* check whether it's available first */
549 pLookupPrivilegeNameA = (void*)GetProcAddress(hmod, "LookupPrivilegeNameA");
550 if (!pLookupPrivilegeNameA) return;
551 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
552 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
553 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
554 return;
555
556 /* check with a short buffer */
557 cchName = 0;
558 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
559 ret = pLookupPrivilegeNameA(NULL, &luid, NULL, &cchName);
560 ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
561 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
562 GetLastError());
563 ok(cchName == strlen("SeCreateTokenPrivilege") + 1,
564 "LookupPrivilegeNameA returned an incorrect required length for\n"
565 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
566 lstrlenA("SeCreateTokenPrivilege") + 1);
567 /* check a known value and its returned length on success */
568 cchName = sizeof(buf);
569 ok(pLookupPrivilegeNameA(NULL, &luid, buf, &cchName) &&
570 cchName == strlen("SeCreateTokenPrivilege"),
571 "LookupPrivilegeNameA returned an incorrect output length for\n"
572 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
573 (int)strlen("SeCreateTokenPrivilege"));
574 /* check known values */
575 for (i = SE_MIN_WELL_KNOWN_PRIVILEGE; i <= SE_MAX_WELL_KNOWN_PRIVILEGE; i++)
576 {
577 luid.LowPart = i;
578 cchName = sizeof(buf);
579 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
580 ok( ret || GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
581 "LookupPrivilegeNameA(0.%d) failed: %d\n", i, GetLastError());
582 }
583 /* check a bogus LUID */
584 luid.LowPart = 0xdeadbeef;
585 cchName = sizeof(buf);
586 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
587 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
588 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
589 GetLastError());
590 /* check on a bogus system */
591 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
592 cchName = sizeof(buf);
593 ret = pLookupPrivilegeNameA("b0gu5.Nam3", &luid, buf, &cchName);
594 ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
595 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
596 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
597 GetLastError());
598 }
599
600 struct NameToLUID
601 {
602 const char *name;
603 DWORD lowPart;
604 };
605
606 static void test_lookupPrivilegeValue(void)
607 {
608 static const struct NameToLUID privs[] = {
609 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE },
610 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE },
611 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE },
612 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE },
613 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE },
614 { "SeTcbPrivilege", SE_TCB_PRIVILEGE },
615 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE },
616 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE },
617 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE },
618 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE },
619 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE },
620 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE },
621 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE },
622 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE },
623 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE },
624 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE },
625 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE },
626 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE },
627 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE },
628 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE },
629 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE },
630 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILEGE },
631 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE },
632 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE },
633 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE },
634 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE },
635 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE },
636 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE },
637 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE },
638 };
639 BOOL (WINAPI *pLookupPrivilegeValueA)(LPCSTR, LPCSTR, PLUID);
640 unsigned int i;
641 LUID luid;
642 BOOL ret;
643
644 /* check whether it's available first */
645 pLookupPrivilegeValueA = (void*)GetProcAddress(hmod, "LookupPrivilegeValueA");
646 if (!pLookupPrivilegeValueA) return;
647 ret = pLookupPrivilegeValueA(NULL, "SeCreateTokenPrivilege", &luid);
648 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
649 return;
650
651 /* check a bogus system name */
652 ret = pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid);
653 ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
654 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
655 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
656 GetLastError());
657 /* check a NULL string */
658 ret = pLookupPrivilegeValueA(NULL, 0, &luid);
659 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
660 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
661 GetLastError());
662 /* check a bogus privilege name */
663 ret = pLookupPrivilegeValueA(NULL, "SeBogusPrivilege", &luid);
664 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
665 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
666 GetLastError());
667 /* check case insensitive */
668 ret = pLookupPrivilegeValueA(NULL, "sEcREATEtOKENpRIVILEGE", &luid);
669 ok( ret,
670 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
671 GetLastError());
672 for (i = 0; i < sizeof(privs) / sizeof(privs[0]); i++)
673 {
674 /* Not all privileges are implemented on all Windows versions, so
675 * don't worry if the call fails
676 */
677 if (pLookupPrivilegeValueA(NULL, privs[i].name, &luid))
678 {
679 ok(luid.LowPart == privs[i].lowPart,
680 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
681 privs[i].name);
682 }
683 }
684 }
685
686 static void test_luid(void)
687 {
688 test_allocateLuid();
689 test_lookupPrivilegeName();
690 test_lookupPrivilegeValue();
691 }
692
693 static void test_FileSecurity(void)
694 {
695 char wintmpdir [MAX_PATH];
696 char path [MAX_PATH];
697 char file [MAX_PATH];
698 HANDLE fh, token;
699 DWORD sdSize, retSize, rc, granted, priv_set_len;
700 PRIVILEGE_SET priv_set;
701 BOOL status;
702 BYTE *sd;
703 GENERIC_MAPPING mapping = { FILE_READ_DATA, FILE_WRITE_DATA, FILE_EXECUTE, FILE_ALL_ACCESS };
704 const SECURITY_INFORMATION request = OWNER_SECURITY_INFORMATION
705 | GROUP_SECURITY_INFORMATION
706 | DACL_SECURITY_INFORMATION;
707
708 if (!pGetFileSecurityA) {
709 win_skip ("GetFileSecurity is not available\n");
710 return;
711 }
712
713 if (!pSetFileSecurityA) {
714 win_skip ("SetFileSecurity is not available\n");
715 return;
716 }
717
718 if (!GetTempPathA (sizeof (wintmpdir), wintmpdir)) {
719 win_skip ("GetTempPathA failed\n");
720 return;
721 }
722
723 /* Create a temporary directory and in it a temporary file */
724 strcat (strcpy (path, wintmpdir), "rary");
725 SetLastError(0xdeadbeef);
726 rc = CreateDirectoryA (path, NULL);
727 ok (rc || GetLastError() == ERROR_ALREADY_EXISTS, "CreateDirectoryA "
728 "failed for '%s' with %d\n", path, GetLastError());
729
730 strcat (strcpy (file, path), "\\ess");
731 SetLastError(0xdeadbeef);
732 fh = CreateFileA (file, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
733 ok (fh != INVALID_HANDLE_VALUE, "CreateFileA "
734 "failed for '%s' with %d\n", file, GetLastError());
735 CloseHandle (fh);
736
737 /* For the temporary file ... */
738
739 /* Get size needed */
740 retSize = 0;
741 SetLastError(0xdeadbeef);
742 rc = pGetFileSecurityA (file, request, NULL, 0, &retSize);
743 if (!rc && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)) {
744 win_skip("GetFileSecurityA is not implemented\n");
745 goto cleanup;
746 }
747 ok (!rc, "GetFileSecurityA "
748 "was expected to fail for '%s'\n", file);
749 ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
750 "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
751 ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
752
753 sdSize = retSize;
754 sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
755
756 /* Get security descriptor for real */
757 retSize = -1;
758 SetLastError(0xdeadbeef);
759 rc = pGetFileSecurityA (file, request, sd, sdSize, &retSize);
760 ok (rc, "GetFileSecurityA "
761 "was not expected to fail '%s': %d\n", file, GetLastError());
762 ok (retSize == sdSize ||
763 broken(retSize == 0), /* NT4 */
764 "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
765
766 /* Use it to set security descriptor */
767 SetLastError(0xdeadbeef);
768 rc = pSetFileSecurityA (file, request, sd);
769 ok (rc, "SetFileSecurityA "
770 "was not expected to fail '%s': %d\n", file, GetLastError());
771
772 HeapFree (GetProcessHeap (), 0, sd);
773
774 /* Repeat for the temporary directory ... */
775
776 /* Get size needed */
777 retSize = 0;
778 SetLastError(0xdeadbeef);
779 rc = pGetFileSecurityA (path, request, NULL, 0, &retSize);
780 ok (!rc, "GetFileSecurityA "
781 "was expected to fail for '%s'\n", path);
782 ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
783 "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
784 ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
785
786 sdSize = retSize;
787 sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
788
789 /* Get security descriptor for real */
790 retSize = -1;
791 SetLastError(0xdeadbeef);
792 rc = pGetFileSecurityA (path, request, sd, sdSize, &retSize);
793 ok (rc, "GetFileSecurityA "
794 "was not expected to fail '%s': %d\n", path, GetLastError());
795 ok (retSize == sdSize ||
796 broken(retSize == 0), /* NT4 */
797 "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
798
799 /* Use it to set security descriptor */
800 SetLastError(0xdeadbeef);
801 rc = pSetFileSecurityA (path, request, sd);
802 ok (rc, "SetFileSecurityA "
803 "was not expected to fail '%s': %d\n", path, GetLastError());
804 HeapFree (GetProcessHeap (), 0, sd);
805
806 /* Old test */
807 strcpy (wintmpdir, "\\Should not exist");
808 SetLastError(0xdeadbeef);
809 rc = pGetFileSecurityA (wintmpdir, OWNER_SECURITY_INFORMATION, NULL, 0, &sdSize);
810 ok (!rc, "GetFileSecurityA should fail for not existing directories/files\n");
811 ok (GetLastError() == ERROR_FILE_NOT_FOUND,
812 "last error ERROR_FILE_NOT_FOUND expected, got %d\n", GetLastError());
813
814 cleanup:
815 /* Remove temporary file and directory */
816 DeleteFileA(file);
817 RemoveDirectoryA(path);
818
819 /* Test file access permissions for a file with FILE_ATTRIBUTE_ARCHIVE */
820 SetLastError(0xdeadbeef);
821 rc = GetTempPath(sizeof(wintmpdir), wintmpdir);
822 ok(rc, "GetTempPath error %d\n", GetLastError());
823
824 SetLastError(0xdeadbeef);
825 rc = GetTempFileName(wintmpdir, "tmp", 0, file);
826 ok(rc, "GetTempFileName error %d\n", GetLastError());
827
828 rc = GetFileAttributes(file);
829 rc &= ~FILE_ATTRIBUTE_NOT_CONTENT_INDEXED;
830 ok(rc == FILE_ATTRIBUTE_ARCHIVE, "expected FILE_ATTRIBUTE_ARCHIVE got %#x\n", rc);
831
832 retSize = 0xdeadbeef;
833 rc = GetFileSecurity(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
834 NULL, 0, &sdSize);
835 ok(!rc, "GetFileSecurity should fail\n");
836 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
837 "expected ERROR_INSUFFICIENT_BUFFER got %d\n", GetLastError());
838 ok(sdSize > sizeof(SECURITY_DESCRIPTOR), "got sd size %d\n", sdSize);
839
840 sd = HeapAlloc(GetProcessHeap (), 0, sdSize);
841 retSize = 0xdeadbeef;
842 SetLastError(0xdeadbeef);
843 rc = GetFileSecurity(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
844 sd, sdSize, &retSize);
845 ok(rc, "GetFileSecurity error %d\n", GetLastError());
846 ok(retSize == sdSize || broken(retSize == 0) /* NT4 */, "expected %d, got %d\n", sdSize, retSize);
847
848 SetLastError(0xdeadbeef);
849 rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
850 ok(!rc, "OpenThreadToken should fail\n");
851 ok(GetLastError() == ERROR_NO_TOKEN, "expected ERROR_NO_TOKEN, got %d\n", GetLastError());
852
853 SetLastError(0xdeadbeef);
854 rc = ImpersonateSelf(SecurityIdentification);
855 ok(rc, "ImpersonateSelf error %d\n", GetLastError());
856
857 SetLastError(0xdeadbeef);
858 rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
859 ok(rc, "OpenThreadToken error %d\n", GetLastError());
860
861 SetLastError(0xdeadbeef);
862 rc = RevertToSelf();
863 ok(rc, "RevertToSelf error %d\n", GetLastError());
864
865 priv_set_len = sizeof(priv_set);
866 granted = 0xdeadbeef;
867 status = 0xdeadbeef;
868 SetLastError(0xdeadbeef);
869 rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
870 ok(rc, "AccessCheck error %d\n", GetLastError());
871 ok(status == 1, "expected 1, got %d\n", status);
872 ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
873
874 granted = 0xdeadbeef;
875 status = 0xdeadbeef;
876 SetLastError(0xdeadbeef);
877 rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
878 ok(rc, "AccessCheck error %d\n", GetLastError());
879 ok(status == 1, "expected 1, got %d\n", status);
880 ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
881
882 granted = 0xdeadbeef;
883 status = 0xdeadbeef;
884 SetLastError(0xdeadbeef);
885 rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
886 ok(rc, "AccessCheck error %d\n", GetLastError());
887 ok(status == 1, "expected 1, got %d\n", status);
888 ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
889
890 granted = 0xdeadbeef;
891 status = 0xdeadbeef;
892 SetLastError(0xdeadbeef);
893 rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status);
894 ok(rc, "AccessCheck error %d\n", GetLastError());
895 ok(status == 1, "expected 1, got %d\n", status);
896 ok(granted == DELETE, "expected DELETE, got %#x\n", granted);
897
898 granted = 0xdeadbeef;
899 status = 0xdeadbeef;
900 SetLastError(0xdeadbeef);
901 rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
902 ok(rc, "AccessCheck error %d\n", GetLastError());
903 ok(status == 1, "expected 1, got %d\n", status);
904 ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
905
906 granted = 0xdeadbeef;
907 status = 0xdeadbeef;
908 SetLastError(0xdeadbeef);
909 rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
910 ok(rc, "AccessCheck error %d\n", GetLastError());
911 ok(status == 1, "expected 1, got %d\n", status);
912 ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
913
914 granted = 0xdeadbeef;
915 status = 0xdeadbeef;
916 SetLastError(0xdeadbeef);
917 rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
918 ok(rc, "AccessCheck error %d\n", GetLastError());
919 ok(status == 1, "expected 1, got %d\n", status);
920 ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
921
922 SetLastError(0xdeadbeef);
923 rc = AccessCheck(sd, token, 0xffffffff, &mapping, &priv_set, &priv_set_len, &granted, &status);
924 ok(!rc, "AccessCheck should fail\n");
925 ok(GetLastError() == ERROR_GENERIC_NOT_MAPPED, "expected ERROR_GENERIC_NOT_MAPPED, got %d\n", GetLastError());
926
927 /* Test file access permissions for a file with FILE_ATTRIBUTE_READONLY */
928 SetLastError(0xdeadbeef);
929 fh = CreateFile(file, FILE_READ_DATA, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_READONLY, 0);
930 ok(fh != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
931 retSize = 0xdeadbeef;
932 SetLastError(0xdeadbeef);
933 rc = WriteFile(fh, "1", 1, &retSize, NULL);
934 ok(!rc, "WriteFile should fail\n");
935 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
936 ok(retSize == 0, "expected 0, got %d\n", retSize);
937 CloseHandle(fh);
938
939 rc = GetFileAttributes(file);
940 rc &= ~FILE_ATTRIBUTE_NOT_CONTENT_INDEXED;
941 todo_wine
942 ok(rc == (FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY),
943 "expected FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY got %#x\n", rc);
944
945 SetLastError(0xdeadbeef);
946 rc = SetFileAttributes(file, FILE_ATTRIBUTE_ARCHIVE);
947 ok(rc, "SetFileAttributes error %d\n", GetLastError());
948 SetLastError(0xdeadbeef);
949 rc = DeleteFile(file);
950 ok(rc, "DeleteFile error %d\n", GetLastError());
951
952 SetLastError(0xdeadbeef);
953 fh = CreateFile(file, FILE_READ_DATA, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_READONLY, 0);
954 ok(fh != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
955 retSize = 0xdeadbeef;
956 SetLastError(0xdeadbeef);
957 rc = WriteFile(fh, "1", 1, &retSize, NULL);
958 ok(!rc, "WriteFile should fail\n");
959 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
960 ok(retSize == 0, "expected 0, got %d\n", retSize);
961 CloseHandle(fh);
962
963 rc = GetFileAttributes(file);
964 rc &= ~FILE_ATTRIBUTE_NOT_CONTENT_INDEXED;
965 ok(rc == (FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY),
966 "expected FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY got %#x\n", rc);
967
968 retSize = 0xdeadbeef;
969 SetLastError(0xdeadbeef);
970 rc = GetFileSecurity(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
971 sd, sdSize, &retSize);
972 ok(rc, "GetFileSecurity error %d\n", GetLastError());
973 ok(retSize == sdSize || broken(retSize == 0) /* NT4 */, "expected %d, got %d\n", sdSize, retSize);
974
975 priv_set_len = sizeof(priv_set);
976 granted = 0xdeadbeef;
977 status = 0xdeadbeef;
978 SetLastError(0xdeadbeef);
979 rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
980 ok(rc, "AccessCheck error %d\n", GetLastError());
981 ok(status == 1, "expected 1, got %d\n", status);
982 ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
983
984 granted = 0xdeadbeef;
985 status = 0xdeadbeef;
986 SetLastError(0xdeadbeef);
987 rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
988 ok(rc, "AccessCheck error %d\n", GetLastError());
989 todo_wine {
990 ok(status == 1, "expected 1, got %d\n", status);
991 ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
992 }
993 granted = 0xdeadbeef;
994 status = 0xdeadbeef;
995 SetLastError(0xdeadbeef);
996 rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
997 ok(rc, "AccessCheck error %d\n", GetLastError());
998 ok(status == 1, "expected 1, got %d\n", status);
999 ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
1000
1001 granted = 0xdeadbeef;
1002 status = 0xdeadbeef;
1003 SetLastError(0xdeadbeef);
1004 rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status);
1005 ok(rc, "AccessCheck error %d\n", GetLastError());
1006 todo_wine {
1007 ok(status == 1, "expected 1, got %d\n", status);
1008 ok(granted == DELETE, "expected DELETE, got %#x\n", granted);
1009 }
1010 granted = 0xdeadbeef;
1011 status = 0xdeadbeef;
1012 SetLastError(0xdeadbeef);
1013 rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
1014 ok(rc, "AccessCheck error %d\n", GetLastError());
1015 todo_wine {
1016 ok(status == 1, "expected 1, got %d\n", status);
1017 ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
1018 }
1019 granted = 0xdeadbeef;
1020 status = 0xdeadbeef;
1021 SetLastError(0xdeadbeef);
1022 rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
1023 ok(rc, "AccessCheck error %d\n", GetLastError());
1024 todo_wine {
1025 ok(status == 1, "expected 1, got %d\n", status);
1026 ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
1027 }
1028 granted = 0xdeadbeef;
1029 status = 0xdeadbeef;
1030 SetLastError(0xdeadbeef);
1031 rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
1032 ok(rc, "AccessCheck error %d\n", GetLastError());
1033 todo_wine {
1034 ok(status == 1, "expected 1, got %d\n", status);
1035 ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
1036 }
1037 SetLastError(0xdeadbeef);
1038 rc = DeleteFile(file);
1039 ok(!rc, "DeleteFile should fail\n");
1040 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1041 SetLastError(0xdeadbeef);
1042 rc = SetFileAttributes(file, FILE_ATTRIBUTE_ARCHIVE);
1043 ok(rc, "SetFileAttributes error %d\n", GetLastError());
1044 SetLastError(0xdeadbeef);
1045 rc = DeleteFile(file);
1046 ok(rc, "DeleteFile error %d\n", GetLastError());
1047
1048 CloseHandle(token);
1049 HeapFree(GetProcessHeap(), 0, sd);
1050 }
1051
1052 static void test_AccessCheck(void)
1053 {
1054 PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL;
1055 PACL Acl = NULL;
1056 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
1057 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
1058 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1059 GENERIC_MAPPING Mapping = { KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS };
1060 ACCESS_MASK Access;
1061 BOOL AccessStatus;
1062 HANDLE Token;
1063 HANDLE ProcessToken;
1064 BOOL ret;
1065 DWORD PrivSetLen;
1066 PRIVILEGE_SET *PrivSet;
1067 BOOL res;
1068 HMODULE NtDllModule;
1069 BOOLEAN Enabled;
1070 DWORD err;
1071 NTSTATUS ntret, ntAccessStatus;
1072
1073 NtDllModule = GetModuleHandle("ntdll.dll");
1074 if (!NtDllModule)
1075 {
1076 skip("not running on NT, skipping test\n");
1077 return;
1078 }
1079 pRtlAdjustPrivilege = (void *)GetProcAddress(NtDllModule, "RtlAdjustPrivilege");
1080 if (!pRtlAdjustPrivilege)
1081 {
1082 win_skip("missing RtlAdjustPrivilege, skipping test\n");
1083 return;
1084 }
1085
1086 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
1087 res = InitializeAcl(Acl, 256, ACL_REVISION);
1088 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
1089 {
1090 skip("ACLs not implemented - skipping tests\n");
1091 HeapFree(GetProcessHeap(), 0, Acl);
1092 return;
1093 }
1094 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
1095
1096 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
1097 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1098
1099 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1100 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdminSid);
1101 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1102
1103 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1104 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
1105 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1106
1107 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
1108
1109 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
1110 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1111
1112 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1113 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1114
1115 PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
1116 PrivSet = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PrivSetLen);
1117 PrivSet->PrivilegeCount = 16;
1118
1119 res = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &ProcessToken);
1120 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
1121
1122 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, FALSE, TRUE, &Enabled);
1123
1124 res = DuplicateToken(ProcessToken, SecurityImpersonation, &Token);
1125 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1126
1127 /* SD without owner/group */
1128 SetLastError(0xdeadbeef);
1129 Access = AccessStatus = 0x1abe11ed;
1130 ret = AccessCheck(SecurityDescriptor, Token, KEY_QUERY_VALUE, &Mapping,
1131 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1132 err = GetLastError();
1133 ok(!ret && err == ERROR_INVALID_SECURITY_DESCR, "AccessCheck should have "
1134 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err);
1135 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1136 "Access and/or AccessStatus were changed!\n");
1137
1138 /* Set owner and group */
1139 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
1140 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1141 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, TRUE);
1142 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1143
1144 /* Generic access mask */
1145 SetLastError(0xdeadbeef);
1146 Access = AccessStatus = 0x1abe11ed;
1147 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1148 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1149 err = GetLastError();
1150 ok(!ret && err == ERROR_GENERIC_NOT_MAPPED, "AccessCheck should have failed "
1151 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err);
1152 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1153 "Access and/or AccessStatus were changed!\n");
1154
1155 /* Generic access mask - no privilegeset buffer */
1156 SetLastError(0xdeadbeef);
1157 Access = AccessStatus = 0x1abe11ed;
1158 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1159 NULL, &PrivSetLen, &Access, &AccessStatus);
1160 err = GetLastError();
1161 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1162 "with ERROR_NOACCESS, instead of %d\n", err);
1163 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1164 "Access and/or AccessStatus were changed!\n");
1165
1166 /* Generic access mask - no returnlength */
1167 SetLastError(0xdeadbeef);
1168 Access = AccessStatus = 0x1abe11ed;
1169 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1170 PrivSet, NULL, &Access, &AccessStatus);
1171 err = GetLastError();
1172 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1173 "with ERROR_NOACCESS, instead of %d\n", err);
1174 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1175 "Access and/or AccessStatus were changed!\n");
1176
1177 /* Generic access mask - no privilegeset buffer, no returnlength */
1178 SetLastError(0xdeadbeef);
1179 Access = AccessStatus = 0x1abe11ed;
1180 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1181 NULL, NULL, &Access, &AccessStatus);
1182 err = GetLastError();
1183 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1184 "with ERROR_NOACCESS, instead of %d\n", err);
1185 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1186 "Access and/or AccessStatus were changed!\n");
1187
1188 /* sd with no dacl present */
1189 Access = AccessStatus = 0x1abe11ed;
1190 ret = SetSecurityDescriptorDacl(SecurityDescriptor, FALSE, NULL, FALSE);
1191 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1192 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1193 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1194 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1195 ok(AccessStatus && (Access == KEY_READ),
1196 "AccessCheck failed to grant access with error %d\n",
1197 GetLastError());
1198
1199 /* sd with no dacl present - no privilegeset buffer */
1200 SetLastError(0xdeadbeef);
1201 Access = AccessStatus = 0x1abe11ed;
1202 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1203 NULL, &PrivSetLen, &Access, &AccessStatus);
1204 err = GetLastError();
1205 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1206 "with ERROR_NOACCESS, instead of %d\n", err);
1207 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1208 "Access and/or AccessStatus were changed!\n");
1209
1210 if(pNtAccessCheck)
1211 {
1212 /* Generic access mask - no privilegeset buffer */
1213 SetLastError(0xdeadbeef);
1214 Access = ntAccessStatus = 0x1abe11ed;
1215 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1216 NULL, &PrivSetLen, &Access, &ntAccessStatus);
1217 err = GetLastError();
1218 ok(ntret == STATUS_ACCESS_VIOLATION,
1219 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1220 ok(err == 0xdeadbeef,
1221 "NtAccessCheck shouldn't set last error, got %d\n", err);
1222 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1223 "Access and/or AccessStatus were changed!\n");
1224
1225 /* Generic access mask - no returnlength */
1226 SetLastError(0xdeadbeef);
1227 Access = ntAccessStatus = 0x1abe11ed;
1228 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1229 PrivSet, NULL, &Access, &ntAccessStatus);
1230 err = GetLastError();
1231 ok(ntret == STATUS_ACCESS_VIOLATION,
1232 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1233 ok(err == 0xdeadbeef,
1234 "NtAccessCheck shouldn't set last error, got %d\n", err);
1235 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1236 "Access and/or AccessStatus were changed!\n");
1237
1238 /* Generic access mask - no privilegeset buffer, no returnlength */
1239 SetLastError(0xdeadbeef);
1240 Access = ntAccessStatus = 0x1abe11ed;
1241 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1242 NULL, NULL, &Access, &ntAccessStatus);
1243 err = GetLastError();
1244 ok(ntret == STATUS_ACCESS_VIOLATION,
1245 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1246 ok(err == 0xdeadbeef,
1247 "NtAccessCheck shouldn't set last error, got %d\n", err);
1248 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1249 "Access and/or AccessStatus were changed!\n");
1250 }
1251 else
1252 win_skip("NtAccessCheck unavailable. Skipping.\n");
1253
1254 /* sd with NULL dacl */
1255 Access = AccessStatus = 0x1abe11ed;
1256 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, NULL, FALSE);
1257 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1258 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1259 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1260 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1261 ok(AccessStatus && (Access == KEY_READ),
1262 "AccessCheck failed to grant access with error %d\n",
1263 GetLastError());
1264
1265 /* sd with blank dacl */
1266 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1267 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1268 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1269 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1270 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1271 err = GetLastError();
1272 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1273 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1274 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1275
1276 res = AddAccessAllowedAce(Acl, ACL_REVISION, KEY_READ, EveryoneSid);
1277 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
1278
1279 res = AddAccessDeniedAce(Acl, ACL_REVISION, KEY_SET_VALUE, AdminSid);
1280 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1281
1282 /* sd with dacl */
1283 Access = AccessStatus = 0x1abe11ed;
1284 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1285 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1286 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1287 ok(AccessStatus && (Access == KEY_READ),
1288 "AccessCheck failed to grant access with error %d\n",
1289 GetLastError());
1290
1291 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1292 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1293 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1294 ok(AccessStatus,
1295 "AccessCheck failed to grant any access with error %d\n",
1296 GetLastError());
1297 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access);
1298
1299 /* Access denied by SD */
1300 SetLastError(0xdeadbeef);
1301 Access = AccessStatus = 0x1abe11ed;
1302 ret = AccessCheck(SecurityDescriptor, Token, KEY_WRITE, &Mapping,
1303 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1304 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1305 err = GetLastError();
1306 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1307 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1308 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1309
1310 SetLastError(0);
1311 PrivSet->PrivilegeCount = 16;
1312 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1313 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1314 ok(ret && !AccessStatus && GetLastError() == ERROR_PRIVILEGE_NOT_HELD,
1315 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
1316 GetLastError());
1317
1318 ret = ImpersonateLoggedOnUser(Token);
1319 ok(ret, "ImpersonateLoggedOnUser failed with error %d\n", GetLastError());
1320 ret = pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, TRUE, TRUE, &Enabled);
1321 if (!ret)
1322 {
1323 SetLastError(0);
1324 PrivSet->PrivilegeCount = 16;
1325 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1326 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1327 ok(ret && AccessStatus && GetLastError() == 0,
1328 "AccessCheck should have succeeded, error %d\n",
1329 GetLastError());
1330 ok(Access == ACCESS_SYSTEM_SECURITY,
1331 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
1332 Access);
1333 }
1334 else
1335 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
1336 ret);
1337 ret = RevertToSelf();
1338 ok(ret, "RevertToSelf failed with error %d\n", GetLastError());
1339
1340 /* test INHERIT_ONLY_ACE */
1341 ret = InitializeAcl(Acl, 256, ACL_REVISION);
1342 ok(ret, "InitializeAcl failed with error %d\n", GetLastError());
1343
1344 /* NT doesn't have AddAccessAllowedAceEx. Skipping this call/test doesn't influence
1345 * the next ones.
1346 */
1347 if (pAddAccessAllowedAceEx)
1348 {
1349 ret = pAddAccessAllowedAceEx(Acl, ACL_REVISION, INHERIT_ONLY_ACE, KEY_READ, EveryoneSid);
1350 ok(ret, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1351 }
1352 else
1353 win_skip("AddAccessAllowedAceEx is not available\n");
1354
1355 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1356 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1357 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1358 err = GetLastError();
1359 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1360 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1361 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1362
1363 CloseHandle(Token);
1364
1365 res = DuplicateToken(ProcessToken, SecurityAnonymous, &Token);
1366 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1367
1368 SetLastError(0xdeadbeef);
1369 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1370 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1371 err = GetLastError();
1372 ok(!ret && err == ERROR_BAD_IMPERSONATION_LEVEL, "AccessCheck should have failed "
1373 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err);
1374
1375 CloseHandle(Token);
1376
1377 SetLastError(0xdeadbeef);
1378 ret = AccessCheck(SecurityDescriptor, ProcessToken, KEY_READ, &Mapping,
1379 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1380 err = GetLastError();
1381 ok(!ret && err == ERROR_NO_IMPERSONATION_TOKEN, "AccessCheck should have failed "
1382 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err);
1383
1384 CloseHandle(ProcessToken);
1385
1386 if (EveryoneSid)
1387 FreeSid(EveryoneSid);
1388 if (AdminSid)
1389 FreeSid(AdminSid);
1390 if (UsersSid)
1391 FreeSid(UsersSid);
1392 HeapFree(GetProcessHeap(), 0, Acl);
1393 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
1394 HeapFree(GetProcessHeap(), 0, PrivSet);
1395 }
1396
1397 /* test GetTokenInformation for the various attributes */
1398 static void test_token_attr(void)
1399 {
1400 HANDLE Token, ImpersonationToken;
1401 DWORD Size, Size2;
1402 TOKEN_PRIVILEGES *Privileges;
1403 TOKEN_GROUPS *Groups;
1404 TOKEN_USER *User;
1405 TOKEN_DEFAULT_DACL *Dacl;
1406 BOOL ret;
1407 DWORD i, GLE;
1408 LPSTR SidString;
1409 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1410 ACL *acl;
1411
1412 /* cygwin-like use case */
1413 SetLastError(0xdeadbeef);
1414 ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &Token);
1415 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1416 {
1417 win_skip("OpenProcessToken is not implemented\n");
1418 return;
1419 }
1420 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1421 if (ret)
1422 {
1423 DWORD buf[256]; /* GetTokenInformation wants a dword-aligned buffer */
1424 Size = sizeof(buf);
1425 ret = GetTokenInformation(Token, TokenUser,(void*)buf, Size, &Size);
1426 ok(ret, "GetTokenInformation failed with error %d\n", GetLastError());
1427 Size = sizeof(ImpersonationLevel);
1428 ret = GetTokenInformation(Token, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1429 GLE = GetLastError();
1430 ok(!ret && (GLE == ERROR_INVALID_PARAMETER), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE);
1431 CloseHandle(Token);
1432 }
1433
1434 if(!pConvertSidToStringSidA)
1435 {
1436 win_skip("ConvertSidToStringSidA is not available\n");
1437 return;
1438 }
1439
1440 SetLastError(0xdeadbeef);
1441 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &Token);
1442 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1443
1444 /* groups */
1445 /* insufficient buffer length */
1446 SetLastError(0xdeadbeef);
1447 Size2 = 0;
1448 ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size2);
1449 ok(Size2 > 1, "got %d\n", Size2);
1450 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1451 "%d with error %d\n", ret, GetLastError());
1452 Size2 -= 1;
1453 Groups = HeapAlloc(GetProcessHeap(), 0, Size2);
1454 memset(Groups, 0xcc, Size2);
1455 Size = 0;
1456 ret = GetTokenInformation(Token, TokenGroups, Groups, Size2, &Size);
1457 ok(Size > 1, "got %d\n", Size);
1458 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1459 "%d with error %d\n", ret, GetLastError());
1460 ok(*((BYTE*)Groups) == 0xcc, "buffer altered\n");
1461 HeapFree(GetProcessHeap(), 0, Groups);
1462
1463 SetLastError(0xdeadbeef);
1464 ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size);
1465 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1466 "GetTokenInformation(TokenGroups) %s with error %d\n",
1467 ret ? "succeeded" : "failed", GetLastError());
1468 Groups = HeapAlloc(GetProcessHeap(), 0, Size);
1469 SetLastError(0xdeadbeef);
1470 ret = GetTokenInformation(Token, TokenGroups, Groups, Size, &Size);
1471 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
1472 ok(GetLastError() == 0xdeadbeef,
1473 "GetTokenInformation shouldn't have set last error to %d\n",
1474 GetLastError());
1475 trace("TokenGroups:\n");
1476 for (i = 0; i < Groups->GroupCount; i++)
1477 {
1478 DWORD NameLength = 255;
1479 TCHAR Name[255];
1480 DWORD DomainLength = 255;
1481 TCHAR Domain[255];
1482 SID_NAME_USE SidNameUse;
1483 Name[0] = '\0';
1484 Domain[0] = '\0';
1485 ret = LookupAccountSid(NULL, Groups->Groups[i].Sid, Name, &NameLength, Domain, &DomainLength, &SidNameUse);
1486 if (ret)
1487 {
1488 pConvertSidToStringSidA(Groups->Groups[i].Sid, &SidString);
1489 trace("%s, %s\\%s use: %d attr: 0x%08x\n", SidString, Domain, Name, SidNameUse, Groups->Groups[i].Attributes);
1490 LocalFree(SidString);
1491 }
1492 else trace("attr: 0x%08x LookupAccountSid failed with error %d\n", Groups->Groups[i].Attributes, GetLastError());
1493 }
1494 HeapFree(GetProcessHeap(), 0, Groups);
1495
1496 /* user */
1497 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
1498 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1499 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1500 User = HeapAlloc(GetProcessHeap(), 0, Size);
1501 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
1502 ok(ret,
1503 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1504
1505 pConvertSidToStringSidA(User->User.Sid, &SidString);
1506 trace("TokenUser: %s attr: 0x%08x\n", SidString, User->User.Attributes);
1507 LocalFree(SidString);
1508 HeapFree(GetProcessHeap(), 0, User);
1509
1510 /* privileges */
1511 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
1512 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1513 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1514 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
1515 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
1516 ok(ret,
1517 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1518 trace("TokenPrivileges:\n");
1519 for (i = 0; i < Privileges->PrivilegeCount; i++)
1520 {
1521 TCHAR Name[256];
1522 DWORD NameLen = sizeof(Name)/sizeof(Name[0]);
1523 LookupPrivilegeName(NULL, &Privileges->Privileges[i].Luid, Name, &NameLen);
1524 trace("\t%s, 0x%x\n", Name, Privileges->Privileges[i].Attributes);
1525 }
1526 HeapFree(GetProcessHeap(), 0, Privileges);
1527
1528 ret = DuplicateToken(Token, SecurityAnonymous, &ImpersonationToken);
1529 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
1530
1531 Size = sizeof(ImpersonationLevel);
1532 ret = GetTokenInformation(ImpersonationToken, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1533 ok(ret, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
1534 ok(ImpersonationLevel == SecurityAnonymous, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel);
1535
1536 CloseHandle(ImpersonationToken);
1537
1538 /* default dacl */
1539 ret = GetTokenInformation(Token, TokenDefaultDacl, NULL, 0, &Size);
1540 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1541 "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1542
1543 Dacl = HeapAlloc(GetProcessHeap(), 0, Size);
1544 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size);
1545 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1546
1547 SetLastError(0xdeadbeef);
1548 ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, 0);
1549 GLE = GetLastError();
1550 ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1551 ok(GLE == ERROR_BAD_LENGTH, "expected ERROR_BAD_LENGTH got %u\n", GLE);
1552
1553 SetLastError(0xdeadbeef);
1554 ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, Size);
1555 GLE = GetLastError();
1556 ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1557 ok(GLE == ERROR_NOACCESS, "expected ERROR_NOACCESS got %u\n", GLE);
1558
1559 acl = Dacl->DefaultDacl;
1560 Dacl->DefaultDacl = NULL;
1561
1562 ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1563 ok(ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1564
1565 Size2 = 0;
1566 Dacl->DefaultDacl = (ACL *)0xdeadbeef;
1567 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1568 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1569 ok(Dacl->DefaultDacl == NULL, "expected NULL, got %p\n", Dacl->DefaultDacl);
1570 ok(Size2 == sizeof(TOKEN_DEFAULT_DACL) || broken(Size2 == 2*sizeof(TOKEN_DEFAULT_DACL)), /* WoW64 */
1571 "got %u expected sizeof(TOKEN_DEFAULT_DACL)\n", Size2);
1572
1573 Dacl->DefaultDacl = acl;
1574 ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1575 ok(ret, "SetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1576
1577 if (Size2 == sizeof(TOKEN_DEFAULT_DACL)) {
1578 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1579 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1580 } else
1581 win_skip("TOKEN_DEFAULT_DACL size too small on WoW64\n");
1582
1583 HeapFree(GetProcessHeap(), 0, Dacl);
1584 CloseHandle(Token);
1585 }
1586
1587 typedef union _MAX_SID
1588 {
1589 SID sid;
1590 char max[SECURITY_MAX_SID_SIZE];
1591 } MAX_SID;
1592
1593 static void test_sid_str(PSID * sid)
1594 {
1595 char *str_sid;
1596 BOOL ret = pConvertSidToStringSidA(sid, &str_sid);
1597 ok(ret, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
1598 if (ret)
1599 {
1600 char account[MAX_PATH], domain[MAX_PATH];
1601 SID_NAME_USE use;
1602 DWORD acc_size = MAX_PATH;
1603 DWORD dom_size = MAX_PATH;
1604 ret = LookupAccountSid(NULL, sid, account, &acc_size, domain, &dom_size, &use);
1605 ok(ret || (!ret && (GetLastError() == ERROR_NONE_MAPPED)),
1606 "LookupAccountSid(%s) failed: %d\n", str_sid, GetLastError());
1607 if (ret)
1608 trace(" %s %s\\%s %d\n", str_sid, domain, account, use);
1609 else if (GetLastError() == ERROR_NONE_MAPPED)
1610 trace(" %s couldn't be mapped\n", str_sid);
1611 LocalFree(str_sid);
1612 }
1613 }
1614
1615 static const struct well_known_sid_value
1616 {
1617 BOOL without_domain;
1618 const char *sid_string;
1619 } well_known_sid_values[] = {
1620 /* 0 */ {TRUE, "S-1-0-0"}, {TRUE, "S-1-1-0"}, {TRUE, "S-1-2-0"}, {TRUE, "S-1-3-0"},
1621 /* 4 */ {TRUE, "S-1-3-1"}, {TRUE, "S-1-3-2"}, {TRUE, "S-1-3-3"}, {TRUE, "S-1-5"},
1622 /* 8 */ {FALSE, "S-1-5-1"}, {TRUE, "S-1-5-2"}, {TRUE, "S-1-5-3"}, {TRUE, "S-1-5-4"},
1623 /* 12 */ {TRUE, "S-1-5-6"}, {TRUE, "S-1-5-7"}, {TRUE, "S-1-5-8"}, {TRUE, "S-1-5-9"},
1624 /* 16 */ {TRUE, "S-1-5-10"}, {TRUE, "S-1-5-11"}, {TRUE, "S-1-5-12"}, {TRUE, "S-1-5-13"},
1625 /* 20 */ {TRUE, "S-1-5-14"}, {FALSE, NULL}, {TRUE, "S-1-5-18"}, {TRUE, "S-1-5-19"},
1626 /* 24 */ {TRUE, "S-1-5-20"}, {TRUE, "S-1-5-32"},
1627 /* 26 */ {FALSE, "S-1-5-32-544"}, {TRUE, "S-1-5-32-545"}, {TRUE, "S-1-5-32-546"},
1628 /* 29 */ {TRUE, "S-1-5-32-547"}, {TRUE, "S-1-5-32-548"}, {TRUE, "S-1-5-32-549"},
1629 /* 32 */ {TRUE, "S-1-5-32-550"}, {TRUE, "S-1-5-32-551"}, {TRUE, "S-1-5-32-552"},
1630 /* 35 */ {TRUE, "S-1-5-32-554"}, {TRUE, "S-1-5-32-555"}, {TRUE, "S-1-5-32-556"},
1631 /* 38 */ {FALSE, "S-1-5-21-12-23-34-45-56-500"}, {FALSE, "S-1-5-21-12-23-34-45-56-501"},
1632 /* 40 */ {FALSE, "S-1-5-21-12-23-34-45-56-502"}, {FALSE, "S-1-5-21-12-23-34-45-56-512"},
1633 /* 42 */ {FALSE, "S-1-5-21-12-23-34-45-56-513"}, {FALSE, "S-1-5-21-12-23-34-45-56-514"},
1634 /* 44 */ {FALSE, "S-1-5-21-12-23-34-45-56-515"}, {FALSE, "S-1-5-21-12-23-34-45-56-516"},
1635 /* 46 */ {FALSE, "S-1-5-21-12-23-34-45-56-517"}, {FALSE, "S-1-5-21-12-23-34-45-56-518"},
1636 /* 48 */ {FALSE, "S-1-5-21-12-23-34-45-56-519"}, {FALSE, "S-1-5-21-12-23-34-45-56-520"},
1637 /* 50 */ {FALSE, "S-1-5-21-12-23-34-45-56-553"},
1638 /* Added in Windows Server 2003 */
1639 /* 51 */ {TRUE, "S-1-5-64-10"}, {TRUE, "S-1-5-64-21"}, {TRUE, "S-1-5-64-14"},
1640 /* 54 */ {TRUE, "S-1-5-15"}, {TRUE, "S-1-5-1000"}, {FALSE, "S-1-5-32-557"},
1641 /* 57 */ {TRUE, "S-1-5-32-558"}, {TRUE, "S-1-5-32-559"}, {TRUE, "S-1-5-32-560"},
1642 /* 60 */ {TRUE, "S-1-5-32-561"}, {TRUE, "S-1-5-32-562"},
1643 /* Added in Windows Vista: */
1644 /* 62 */ {TRUE, "S-1-5-32-568"},
1645 /* 63 */ {TRUE, "S-1-5-17"}, {FALSE, "S-1-5-32-569"}, {TRUE, "S-1-16-0"},
1646 /* 66 */ {TRUE, "S-1-16-4096"}, {TRUE, "S-1-16-8192"}, {TRUE, "S-1-16-12288"},
1647 /* 69 */ {TRUE, "S-1-16-16384"}, {TRUE, "S-1-5-33"}, {TRUE, "S-1-3-4"},
1648 /* 72 */ {FALSE, "S-1-5-21-12-23-34-45-56-571"}, {FALSE, "S-1-5-21-12-23-34-45-56-572"},
1649 /* 74 */ {TRUE, "S-1-5-22"}, {FALSE, "S-1-5-21-12-23-34-45-56-521"}, {TRUE, "S-1-5-32-573"}
1650 };
1651
1652 static void test_CreateWellKnownSid(void)
1653 {
1654 SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
1655 PSID domainsid, sid;
1656 DWORD size, error;
1657 BOOL ret;
1658 unsigned int i;
1659
1660 if (!pCreateWellKnownSid)
1661 {
1662 win_skip("CreateWellKnownSid not available\n");
1663 return;
1664 }
1665
1666 size = 0;
1667 SetLastError(0xdeadbeef);
1668 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1669 error = GetLastError();
1670 ok(!ret, "CreateWellKnownSid succeeded\n");
1671 ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
1672 ok(size, "expected size > 0\n");
1673
1674 SetLastError(0xdeadbeef);
1675 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1676 error = GetLastError();
1677 ok(!ret, "CreateWellKnownSid succeeded\n");
1678 ok(error == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %u\n", error);
1679
1680 sid = HeapAlloc(GetProcessHeap(), 0, size);
1681 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, sid, &size);
1682 ok(ret, "CreateWellKnownSid failed %u\n", GetLastError());
1683 HeapFree(GetProcessHeap(), 0, sid);
1684
1685 /* a domain sid usually have three subauthorities but we test that CreateWellKnownSid doesn't check it */
1686 AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
1687
1688 for (i = 0; i < sizeof(well_known_sid_values)/sizeof(well_known_sid_values[0]); i++)
1689 {
1690 const struct well_known_sid_value *value = &well_known_sid_values[i];
1691 char sid_buffer[SECURITY_MAX_SID_SIZE];
1692 LPSTR str;
1693 DWORD cb;
1694
1695 if (value->sid_string == NULL)
1696 continue;
1697
1698 if (i > WinAccountRasAndIasServersSid)
1699 {
1700 /* These SIDs aren't implemented by all Windows versions - detect it and break the loop */
1701 cb = sizeof(sid_buffer);
1702 if (!pCreateWellKnownSid(i, domainsid, sid_buffer, &cb))
1703 {
1704 skip("Well known SIDs starting from %u are not implemented\n", i);
1705 break;
1706 }
1707 }
1708
1709 cb = sizeof(sid_buffer);
1710 ok(pCreateWellKnownSid(i, value->without_domain ? NULL : domainsid, sid_buffer, &cb), "Couldn't create well known sid %u\n", i);
1711 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
1712 ok(IsValidSid(sid_buffer), "The sid is not valid\n");
1713 ok(pConvertSidToStringSidA(sid_buffer, &str), "Couldn't convert SID to string\n");
1714 ok(strcmp(str, value->sid_string) == 0, "SID mismatch - expected %s, got %s\n",
1715 value->sid_string, str);
1716 LocalFree(str);
1717
1718 if (value->without_domain)
1719 {
1720 char buf2[SECURITY_MAX_SID_SIZE];
1721 cb = sizeof(buf2);
1722 ok(pCreateWellKnownSid(i, domainsid, buf2, &cb), "Couldn't create well known sid %u with optional domain\n", i);
1723 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
1724 ok(memcmp(buf2, sid_buffer, cb) == 0, "SID create with domain is different than without (%u)\n", i);
1725 }
1726 }
1727
1728 FreeSid(domainsid);
1729 }
1730
1731 static void test_LookupAccountSid(void)
1732 {
1733 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1734 CHAR accountA[MAX_PATH], domainA[MAX_PATH], usernameA[MAX_PATH];
1735 DWORD acc_sizeA, dom_sizeA, user_sizeA;
1736 DWORD real_acc_sizeA, real_dom_sizeA;
1737 WCHAR accountW[MAX_PATH], domainW[MAX_PATH];
1738 DWORD acc_sizeW, dom_sizeW;
1739 DWORD real_acc_sizeW, real_dom_sizeW;
1740 PSID pUsersSid = NULL;
1741 SID_NAME_USE use;
1742 BOOL ret;
1743 DWORD error, size, cbti = 0;
1744 MAX_SID max_sid;
1745 CHAR *str_sidA;
1746 int i;
1747 HANDLE hToken;
1748 PTOKEN_USER ptiUser = NULL;
1749
1750 /* native windows crashes if account size, domain size, or name use is NULL */
1751
1752 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1753 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &pUsersSid);
1754 ok(ret || (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED),
1755 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1756
1757 /* not running on NT so give up */
1758 if (!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1759 return;
1760
1761 real_acc_sizeA = MAX_PATH;
1762 real_dom_sizeA = MAX_PATH;
1763 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1764 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1765
1766 /* try NULL account */
1767 acc_sizeA = MAX_PATH;
1768 dom_sizeA = MAX_PATH;
1769 ret = LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1770 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1771
1772 /* try NULL domain */
1773 acc_sizeA = MAX_PATH;
1774 dom_sizeA = MAX_PATH;
1775 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1776 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1777
1778 /* try a small account buffer */
1779 acc_sizeA = 1;
1780 dom_sizeA = MAX_PATH;
1781 accountA[0] = 0;
1782 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1783 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1784 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1785 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1786
1787 /* try a 0 sized account buffer */
1788 acc_sizeA = 0;
1789 dom_sizeA = MAX_PATH;
1790 accountA[0] = 0;
1791 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1792 /* this can fail or succeed depending on OS version but the size will always be returned */
1793 ok(acc_sizeA == real_acc_sizeA + 1,
1794 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1795 real_acc_sizeA + 1, acc_sizeA);
1796
1797 /* try a 0 sized account buffer */
1798 acc_sizeA = 0;
1799 dom_sizeA = MAX_PATH;
1800 LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1801 /* this can fail or succeed depending on OS version but the size will always be returned */
1802 ok(acc_sizeA == real_acc_sizeA + 1,
1803 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1804 real_acc_sizeA + 1, acc_sizeA);
1805
1806 /* try a small domain buffer */
1807 dom_sizeA = 1;
1808 acc_sizeA = MAX_PATH;
1809 accountA[0] = 0;
1810 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1811 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1812 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1813 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1814
1815 /* try a 0 sized domain buffer */
1816 dom_sizeA = 0;
1817 acc_sizeA = MAX_PATH;
1818 accountA[0] = 0;
1819 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1820 /* this can fail or succeed depending on OS version but the size will always be returned */
1821 ok(dom_sizeA == real_dom_sizeA + 1,
1822 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1823 real_dom_sizeA + 1, dom_sizeA);
1824
1825 /* try a 0 sized domain buffer */
1826 dom_sizeA = 0;
1827 acc_sizeA = MAX_PATH;
1828 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1829 /* this can fail or succeed depending on OS version but the size will always be returned */
1830 ok(dom_sizeA == real_dom_sizeA + 1,
1831 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1832 real_dom_sizeA + 1, dom_sizeA);
1833
1834 real_acc_sizeW = MAX_PATH;
1835 real_dom_sizeW = MAX_PATH;
1836 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &real_acc_sizeW, domainW, &real_dom_sizeW, &use);
1837 ok(ret, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1838
1839 /* try an invalid system name */
1840 real_acc_sizeA = MAX_PATH;
1841 real_dom_sizeA = MAX_PATH;
1842 ret = LookupAccountSidA("deepthought", pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1843 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1844 ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
1845 "LookupAccountSidA() Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %u\n", GetLastError());
1846
1847 /* native windows crashes if domainW or accountW is NULL */
1848
1849 /* try a small account buffer */
1850 acc_sizeW = 1;
1851 dom_sizeW = MAX_PATH;
1852 accountW[0] = 0;
1853 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1854 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1855 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1856 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1857
1858 /* try a 0 sized account buffer */
1859 acc_sizeW = 0;
1860 dom_sizeW = MAX_PATH;
1861 accountW[0] = 0;
1862 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1863 /* this can fail or succeed depending on OS version but the size will always be returned */
1864 ok(acc_sizeW == real_acc_sizeW + 1,
1865 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1866 real_acc_sizeW + 1, acc_sizeW);
1867
1868 /* try a 0 sized account buffer */
1869 acc_sizeW = 0;
1870 dom_sizeW = MAX_PATH;
1871 LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, domainW, &dom_sizeW, &use);
1872 /* this can fail or succeed depending on OS version but the size will always be returned */
1873 ok(acc_sizeW == real_acc_sizeW + 1,
1874 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1875 real_acc_sizeW + 1, acc_sizeW);
1876
1877 /* try a small domain buffer */
1878 dom_sizeW = 1;
1879 acc_sizeW = MAX_PATH;
1880 accountW[0] = 0;
1881 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1882 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1883 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1884 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1885
1886 /* try a 0 sized domain buffer */
1887 dom_sizeW = 0;
1888 acc_sizeW = MAX_PATH;
1889 accountW[0] = 0;
1890 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1891 /* this can fail or succeed depending on OS version but the size will always be returned */
1892 ok(dom_sizeW == real_dom_sizeW + 1,
1893 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1894 real_dom_sizeW + 1, dom_sizeW);
1895
1896 /* try a 0 sized domain buffer */
1897 dom_sizeW = 0;
1898 acc_sizeW = MAX_PATH;
1899 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, NULL, &dom_sizeW, &use);
1900 /* this can fail or succeed depending on OS version but the size will always be returned */
1901 ok(dom_sizeW == real_dom_sizeW + 1,
1902 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1903 real_dom_sizeW + 1, dom_sizeW);
1904
1905 acc_sizeW = dom_sizeW = use = 0;
1906 SetLastError(0xdeadbeef);
1907 ret = LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, NULL, &dom_sizeW, &use);
1908 error = GetLastError();
1909 ok(!ret, "LookupAccountSidW failed %u\n", GetLastError());
1910 ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
1911 ok(acc_sizeW, "expected non-zero account size\n");
1912 ok(dom_sizeW, "expected non-zero domain size\n");
1913 ok(!use, "expected zero use %u\n", use);
1914
1915 FreeSid(pUsersSid);
1916
1917 /* Test LookupAccountSid with Sid retrieved from token information.
1918 This assumes this process is running under the account of the current user.*/
1919 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY|TOKEN_DUPLICATE, &hToken);
1920 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1921 ret = GetTokenInformation(hToken, TokenUser, NULL, 0, &cbti);
1922 ok(!ret, "GetTokenInformation failed with error %d\n", GetLastError());
1923 ptiUser = HeapAlloc(GetProcessHeap(), 0, cbti);
1924 if (GetTokenInformation(hToken, TokenUser, ptiUser, cbti, &cbti))
1925 {
1926 acc_sizeA = dom_sizeA = MAX_PATH;
1927 ret = LookupAccountSidA(NULL, ptiUser->User.Sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1928 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1929 user_sizeA = MAX_PATH;
1930 ret = GetUserNameA(usernameA , &user_sizeA);
1931 ok(ret, "GetUserNameA() Expected TRUE, got FALSE\n");
1932 ok(lstrcmpA(usernameA, accountA) == 0, "LookupAccountSidA() Expected account name: %s got: %s\n", usernameA, accountA );
1933 }
1934 HeapFree(GetProcessHeap(), 0, ptiUser);
1935
1936 if (pCreateWellKnownSid && pConvertSidToStringSidA)
1937 {
1938 trace("Well Known SIDs:\n");
1939 for (i = 0; i <= 60; i++)
1940 {
1941 size = SECURITY_MAX_SID_SIZE;
1942 if (pCreateWellKnownSid(i, NULL, &max_sid.sid, &size))
1943 {
1944 if (pConvertSidToStringSidA(&max_sid.sid, &str_sidA))
1945 {
1946 acc_sizeA = MAX_PATH;
1947 dom_sizeA = MAX_PATH;
1948 if (LookupAccountSidA(NULL, &max_sid.sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use))
1949 trace(" %d: %s %s\\%s %d\n", i, str_sidA, domainA, accountA, use);
1950 LocalFree(str_sidA);
1951 }
1952 }
1953 else
1954 {
1955 if (GetLastError() != ERROR_INVALID_PARAMETER)
1956 trace(" CreateWellKnownSid(%d) failed: %d\n", i, GetLastError());
1957 else
1958 trace(" %d: not supported\n", i);
1959 }
1960 }
1961
1962 pLsaQueryInformationPolicy = (void *)GetProcAddress( hmod, "LsaQueryInformationPolicy");
1963 pLsaOpenPolicy = (void *)GetProcAddress( hmod, "LsaOpenPolicy");
1964 pLsaFreeMemory = (void *)GetProcAddress( hmod, "LsaFreeMemory");
1965 pLsaClose = (void *)GetProcAddress( hmod, "LsaClose");
1966
1967 if (pLsaQueryInformationPolicy && pLsaOpenPolicy && pLsaFreeMemory && pLsaClose)
1968 {
1969 NTSTATUS status;
1970 LSA_HANDLE handle;
1971 LSA_OBJECT_ATTRIBUTES object_attributes;
1972
1973 ZeroMemory(&object_attributes, sizeof(object_attributes));
1974 object_attributes.Length = sizeof(object_attributes);
1975
1976 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_ALL_ACCESS, &handle);
1977 ok(status == STATUS_SUCCESS || status == STATUS_ACCESS_DENIED,
1978 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status);
1979
1980 /* try a more restricted access mask if necessary */
1981 if (status == STATUS_ACCESS_DENIED) {
1982 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
1983 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_VIEW_LOCAL_INFORMATION, &handle);
1984 ok(status == STATUS_SUCCESS, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status);
1985 }
1986
1987 if (status == STATUS_SUCCESS)
1988 {
1989 PPOLICY_ACCOUNT_DOMAIN_INFO info;
1990 status = pLsaQueryInformationPolicy(handle, PolicyAccountDomainInformation, (PVOID*)&info);
1991 ok(status == STATUS_SUCCESS, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status);
1992 if (status == STATUS_SUCCESS)
1993 {
1994 ok(info->DomainSid!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
1995 if (info->DomainSid)
1996 {
1997 int count = *GetSidSubAuthorityCount(info->DomainSid);
1998 CopySid(GetSidLengthRequired(count), &max_sid, info->DomainSid);
1999 test_sid_str((PSID)&max_sid.sid);
2000 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_ADMIN;
2001 max_sid.sid.SubAuthorityCount = count + 1;
2002 test_sid_str((PSID)&max_sid.sid);
2003 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_GUEST;
2004 test_sid_str((PSID)&max_sid.sid);
2005 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ADMINS;
2006 test_sid_str((PSID)&max_sid.sid);
2007 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_USERS;
2008 test_sid_str((PSID)&max_sid.sid);
2009 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_GUESTS;
2010 test_sid_str((PSID)&max_sid.sid);
2011 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_COMPUTERS;
2012 test_sid_str((PSID)&max_sid.sid);
2013 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CONTROLLERS;
2014 test_sid_str((PSID)&max_sid.sid);
2015 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CERT_ADMINS;
2016 test_sid_str((PSID)&max_sid.sid);
2017 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_SCHEMA_ADMINS;
2018 test_sid_str((PSID)&max_sid.sid);
2019 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS;
2020 test_sid_str((PSID)&max_sid.sid);
2021 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_POLICY_ADMINS;
2022 test_sid_str((PSID)&max_sid.sid);
2023 max_sid.sid.SubAuthority[count] = DOMAIN_ALIAS_RID_RAS_SERVERS;
2024 test_sid_str((PSID)&max_sid.sid);
2025 max_sid.sid.SubAuthority[count] = 1000; /* first user account */
2026 test_sid_str((PSID)&max_sid.sid);
2027 }
2028
2029 pLsaFreeMemory((LPVOID)info);
2030 }
2031
2032 status = pLsaClose(handle);
2033 ok(status == STATUS_SUCCESS, "LsaClose() failed, returned 0x%08x\n", status);
2034 }
2035 }
2036 }
2037 }
2038
2039 static BOOL get_sid_info(PSID psid, LPSTR *user, LPSTR *dom)
2040 {
2041 static CHAR account[UNLEN + 1];
2042 static CHAR domain[UNLEN + 1];
2043 DWORD size, dom_size;
2044 SID_NAME_USE use;
2045
2046 *user = account;
2047 *dom = domain;
2048
2049 size = dom_size = UNLEN + 1;
2050 account[0] = '\0';
2051 domain[0] = '\0';
2052 SetLastError(0xdeadbeef);
2053 return LookupAccountSidA(NULL, psid, account, &size, domain, &dom_size, &use);
2054 }
2055
2056 static void check_wellknown_name(const char* name, WELL_KNOWN_SID_TYPE result)
2057 {
2058 SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
2059 PSID domainsid = NULL;
2060 char wk_sid[SECURITY_MAX_SID_SIZE];
2061 DWORD cb;
2062
2063 DWORD sid_size, domain_size;
2064 SID_NAME_USE sid_use;
2065 LPSTR domain, account, sid_domain, wk_domain, wk_account;
2066 PSID psid;
2067 BOOL ret ,ret2;
2068
2069 sid_size = 0;
2070 domain_size = 0;
2071 ret = LookupAccountNameA(NULL, name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2072 ok(!ret, " %s Should have failed to lookup account name\n", name);
2073 psid = HeapAlloc(GetProcessHeap(),0,sid_size);
2074 domain = HeapAlloc(GetProcessHeap(),0,domain_size);
2075 ret = LookupAccountNameA(NULL, name, psid, &sid_size, domain, &domain_size, &sid_use);
2076
2077 if (!result)
2078 {
2079 ok(!ret, " %s Should have failed to lookup account name\n",name);
2080 goto cleanup;
2081 }
2082
2083 AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
2084 cb = sizeof(wk_sid);
2085 if (!pCreateWellKnownSid(result, domainsid, wk_sid, &cb))
2086 {
2087 win_skip("SID %i is not available on the system\n",result);
2088 goto cleanup;
2089 }
2090
2091 ret2 = get_sid_info(wk_sid, &wk_account, &wk_domain);
2092 if (!ret2 && GetLastError() == ERROR_NONE_MAPPED)
2093 {
2094 win_skip("CreateWellKnownSid() succeeded but the account '%s' is not present (W2K)\n", name);
2095 goto cleanup;
2096 }
2097
2098 get_sid_info(psid, &account, &sid_domain);
2099
2100 ok(ret, "Failed to lookup account name %s\n",name);
2101 ok(sid_size != 0, "sid_size was zero\n");
2102
2103 ok(EqualSid(psid,wk_sid),"(%s) Sids fail to match well known sid!\n",name);
2104
2105 ok(!lstrcmp(account, wk_account), "Expected %s , got %s\n", account, wk_account);
2106 ok(!lstrcmp(domain, wk_domain), "Expected %s, got %s\n", wk_domain, domain);
2107 ok(sid_use == SidTypeWellKnownGroup , "Expected Use (5), got %d\n", sid_use);
2108
2109 cleanup:
2110 FreeSid(domainsid);
2111 HeapFree(GetProcessHeap(),0,psid);
2112 HeapFree(GetProcessHeap(),0,domain);
2113 }
2114
2115 static void test_LookupAccountName(void)
2116 {
2117 DWORD sid_size, domain_size, user_size;
2118 DWORD sid_save, domain_save;
2119 CHAR user_name[UNLEN + 1];
2120 CHAR computer_name[UNLEN + 1];
2121 SID_NAME_USE sid_use;
2122 LPSTR domain, account, sid_dom;
2123 PSID psid;
2124 BOOL ret;
2125
2126 /* native crashes if (assuming all other parameters correct):
2127 * - peUse is NULL
2128 * - Sid is NULL and cbSid is > 0
2129 * - cbSid or cchReferencedDomainName are NULL
2130 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
2131 */
2132
2133 user_size = UNLEN + 1;
2134 SetLastError(0xdeadbeef);
2135 ret = GetUserNameA(user_name, &user_size);
2136 ok(ret, "Failed to get user name : %d\n", GetLastError());
2137
2138 /* get sizes */
2139 sid_size = 0;
2140 domain_size = 0;
2141 sid_use = 0xcafebabe;
2142 SetLastError(0xdeadbeef);
2143 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2144 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2145 {
2146 win_skip("LookupAccountNameA is not implemented\n");
2147 return;
2148 }
2149 ok(!ret, "Expected 0, got %d\n", ret);
2150 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2151 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2152 ok(sid_size != 0, "Expected non-zero sid size\n");
2153 ok(domain_size != 0, "Expected non-zero domain size\n");
2154 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2155
2156 sid_save = sid_size;
2157 domain_save = domain_size;
2158
2159 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2160 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2161
2162 /* try valid account name */
2163 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, domain, &domain_size, &sid_use);
2164 get_sid_info(psid, &account, &sid_dom);
2165 ok(ret, "Failed to lookup account name\n");
2166 ok(sid_size == GetLengthSid(psid), "Expected %d, got %d\n", GetLengthSid(psid), sid_size);
2167 ok(!lstrcmp(account, user_name), "Expected %s, got %s\n", user_name, account);
2168 ok(!lstrcmp(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2169 ok(domain_size == domain_save - 1, "Expected %d, got %d\n", domain_save - 1, domain_size);
2170 ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlen(domain), domain_size);
2171 ok(sid_use == SidTypeUser, "Expected SidTypeUser (%d), got %d\n", SidTypeUser, sid_use);
2172 domain_size = domain_save;
2173 sid_size = sid_save;
2174
2175 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2176 {
2177 skip("Non-English locale (test with hardcoded 'Everyone')\n");
2178 }
2179 else
2180 {
2181 ret = LookupAccountNameA(NULL, "Everyone", psid, &sid_size, domain, &domain_size, &sid_use);
2182 get_sid_info(psid, &account, &sid_dom);
2183 ok(ret, "Failed to lookup account name\n");
2184 ok(sid_size != 0, "sid_size was zero\n");
2185 ok(!lstrcmp(account, "Everyone"), "Expected Everyone, got %s\n", account);
2186 ok(!lstrcmp(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2187 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2188 ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlen(domain), domain_size);
2189 ok(sid_use == SidTypeWellKnownGroup, "Expected SidTypeWellKnownGroup (%d), got %d\n", SidTypeWellKnownGroup, sid_use);
2190 domain_size = domain_save;
2191 }
2192
2193 /* NULL Sid with zero sid size */
2194 SetLastError(0xdeadbeef);
2195 sid_size = 0;
2196 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2197 ok(!ret, "Expected 0, got %d\n", ret);
2198 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2199 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2200 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2201 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2202
2203 /* try cchReferencedDomainName - 1 */
2204 SetLastError(0xdeadbeef);
2205 domain_size--;
2206 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2207 ok(!ret, "Expected 0, got %d\n", ret);
2208 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2209 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2210 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2211 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2212
2213 /* NULL ReferencedDomainName with zero domain name size */
2214 SetLastError(0xdeadbeef);
2215 domain_size = 0;
2216 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, NULL, &domain_size, &sid_use);
2217 ok(!ret, "Expected 0, got %d\n", ret);
2218 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2219 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2220 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2221 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2222
2223 HeapFree(GetProcessHeap(), 0, psid);
2224 HeapFree(GetProcessHeap(), 0, domain);
2225
2226 /* get sizes for NULL account name */
2227 sid_size = 0;
2228 domain_size = 0;
2229 sid_use = 0xcafebabe;
2230 SetLastError(0xdeadbeef);
2231 ret = LookupAccountNameA(NULL, NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2232 if (!ret && GetLastError() == ERROR_NONE_MAPPED)
2233 win_skip("NULL account name doesn't work on NT4\n");
2234 else
2235 {
2236 ok(!ret, "Expected 0, got %d\n", ret);
2237 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2238 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2239 ok(sid_size != 0, "Expected non-zero sid size\n");
2240 ok(domain_size != 0, "Expected non-zero domain size\n");
2241 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2242
2243 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2244 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2245
2246 /* try NULL account name */
2247 ret = LookupAccountNameA(NULL, NULL, psid, &sid_size, domain, &domain_size, &sid_use);
2248 get_sid_info(psid, &account, &sid_dom);
2249 ok(ret, "Failed to lookup account name\n");
2250 /* Using a fixed string will not work on different locales */
2251 ok(!lstrcmp(account, domain),
2252 "Got %s for account and %s for domain, these should be the same\n",
2253 account, domain);
2254 ok(sid_use == SidTypeDomain, "Expected SidTypeDomain (%d), got %d\n", SidTypeDomain, sid_use);
2255
2256 HeapFree(GetProcessHeap(), 0, psid);
2257 HeapFree(GetProcessHeap(), 0, domain);
2258 }
2259
2260 /* try an invalid account name */
2261 SetLastError(0xdeadbeef);
2262 sid_size = 0;
2263 domain_size = 0;
2264 ret = LookupAccountNameA(NULL, "oogabooga", NULL, &sid_size, NULL, &domain_size, &sid_use);
2265 ok(!ret, "Expected 0, got %d\n", ret);
2266 ok(GetLastError() == ERROR_NONE_MAPPED ||
2267 broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE),
2268 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
2269 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2270 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2271
2272 /* try an invalid system name */
2273 SetLastError(0xdeadbeef);
2274 sid_size = 0;
2275 domain_size = 0;
2276 ret = LookupAccountNameA("deepthought", NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2277 ok(!ret, "Expected 0, got %d\n", ret);
2278 ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
2279 "Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %d\n", GetLastError());
2280 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2281 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2282
2283 /* try with the computer name as the account name */
2284 domain_size = sizeof(computer_name);
2285 GetComputerNameA(computer_name, &domain_size);
2286 sid_size = 0;
2287 domain_size = 0;
2288 ret = LookupAccountNameA(NULL, computer_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2289 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER ||
2290 GetLastError() == ERROR_NONE_MAPPED /* in a domain */ ||
2291 broken(GetLastError() == ERROR_TRUSTED_DOMAIN_FAILURE) ||
2292 broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE)),
2293 "LookupAccountNameA failed: %d\n", GetLastError());
2294 if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
2295 {
2296 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2297 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2298 ret = LookupAccountNameA(NULL, computer_name, psid, &sid_size, domain, &domain_size, &sid_use);
2299 ok(ret, "LookupAccountNameA failed: %d\n", GetLastError());
2300 ok(sid_use == SidTypeDomain ||
2301 (sid_use == SidTypeUser && ! strcmp(computer_name, user_name)), "expected SidTypeDomain for %s, got %d\n", computer_name, sid_use);
2302 HeapFree(GetProcessHeap(), 0, domain);
2303 HeapFree(GetProcessHeap(), 0, psid);
2304 }
2305
2306 /* Well Known names */
2307 if (!pCreateWellKnownSid)
2308 {
2309 win_skip("CreateWellKnownSid not available\n");
2310 return;
2311 }
2312
2313 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2314 {
2315 skip("Non-English locale (skipping well known name creation tests)\n");
2316 return;
2317 }
2318
2319 check_wellknown_name("LocalService", WinLocalServiceSid);
2320 check_wellknown_name("Local Service", WinLocalServiceSid);
2321 /* 2 spaces */
2322 check_wellknown_name("Local Service", 0);
2323 check_wellknown_name("NetworkService", WinNetworkServiceSid);
2324 check_wellknown_name("Network Service", WinNetworkServiceSid);
2325
2326 /* example of some names where the spaces are not optional */
2327 check_wellknown_name("Terminal Server User", WinTerminalServerSid);
2328 check_wellknown_name("TerminalServer User", 0);
2329 check_wellknown_name("TerminalServerUser", 0);
2330 check_wellknown_name("Terminal ServerUser", 0);
2331
2332 check_wellknown_name("enterprise domain controllers",WinEnterpriseControllersSid);
2333 check_wellknown_name("enterprisedomain controllers", 0);
2334 check_wellknown_name("enterprise domaincontrollers", 0);
2335 check_wellknown_name("enterprisedomaincontrollers", 0);
2336
2337 /* case insensitivity */
2338 check_wellknown_name("lOCAlServICE", WinLocalServiceSid);
2339
2340 /* fully qualified account names */
2341 check_wellknown_name("NT AUTHORITY\\LocalService", WinLocalServiceSid);
2342 check_wellknown_name("nt authority\\Network Service", WinNetworkServiceSid);
2343 check_wellknown_name("nt authority test\\Network Service", 0);
2344 check_wellknown_name("Dummy\\Network Service", 0);
2345 check_wellknown_name("ntauthority\\Network Service", 0);
2346 }
2347
2348 static void test_security_descriptor(void)
2349 {
2350 SECURITY_DESCRIPTOR sd;
2351 char buf[8192];
2352 DWORD size;
2353 BOOL isDefault, isPresent, ret;
2354 PACL pacl;
2355 PSID psid;
2356
2357 SetLastError(0xdeadbeef);
2358 ret = InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION);
2359 if (ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2360 {
2361 win_skip("InitializeSecurityDescriptor is not implemented\n");
2362 return;
2363 }
2364
2365 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2366 expect_eq(psid, NULL, PSID, "%p");
2367 expect_eq(isDefault, FALSE, BOOL, "%d");
2368 sd.Control |= SE_DACL_PRESENT | SE_SACL_PRESENT;
2369
2370 SetLastError(0xdeadbeef);
2371 size = 5;
2372 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), FALSE, BOOL, "%d");
2373 expect_eq(GetLastError(), ERROR_INSUFFICIENT_BUFFER, DWORD, "%u");
2374 ok(size > 5, "Size not increased\n");
2375 if (size <= 8192)
2376 {
2377 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), TRUE, BOOL, "%d");
2378 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2379 expect_eq(psid, NULL, PSID, "%p");
2380 expect_eq(isDefault, FALSE, BOOL, "%d");
2381 ok(GetSecurityDescriptorGroup(&sd, &psid, &isDefault), "GetSecurityDescriptorGroup failed\n");
2382 expect_eq(psid, NULL, PSID, "%p");
2383 expect_eq(isDefault, FALSE, BOOL, "%d");
2384 ok(GetSecurityDescriptorDacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorDacl failed\n");
2385 expect_eq(isPresent, TRUE, BOOL, "%d");
2386 expect_eq(psid, NULL, PSID, "%p");
2387 expect_eq(isDefault, FALSE, BOOL, "%d");
2388 ok(GetSecurityDescriptorSacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorSacl failed\n");
2389 expect_eq(isPresent, TRUE, BOOL, "%d");
2390 expect_eq(psid, NULL, PSID, "%p");
2391 expect_eq(isDefault, FALSE, BOOL, "%d");
2392 }
2393 }
2394
2395 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,0,__LINE__)
2396 #define TEST_GRANTED_ACCESS2(a,b,c) test_granted_access(a,b,c,__LINE__)
2397 static void test_granted_access(HANDLE handle, ACCESS_MASK access,
2398 ACCESS_MASK alt, int line)
2399 {
2400 OBJECT_BASIC_INFORMATION obj_info;
2401 NTSTATUS status;
2402
2403 if (!pNtQueryObject)
2404 {
2405 skip_(__FILE__, line)("Not NT platform - skipping tests\n");
2406 return;
2407 }
2408
2409 status = pNtQueryObject( handle, ObjectBasicInformation, &obj_info,
2410 sizeof(obj_info), NULL );
2411 ok_(__FILE__, line)(!status, "NtQueryObject with err: %08x\n", status);
2412 if (alt)
2413 ok_(__FILE__, line)(obj_info.GrantedAccess == access ||
2414 obj_info.GrantedAccess == alt, "Granted access should be 0x%08x "
2415 "or 0x%08x, instead of 0x%08x\n", access, alt, obj_info.GrantedAccess);
2416 else
2417 ok_(__FILE__, line)(obj_info.GrantedAccess == access, "Granted access should "
2418 "be 0x%08x, instead of 0x%08x\n", access, obj_info.GrantedAccess);
2419 }
2420
2421 #define CHECK_SET_SECURITY(o,i,e) \
2422 do{ \
2423 BOOL res; \
2424 DWORD err; \
2425 SetLastError( 0xdeadbeef ); \
2426 res = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
2427 err = GetLastError(); \
2428 if (e == ERROR_SUCCESS) \
2429 ok(res, "SetKernelObjectSecurity failed with %d\n", err); \
2430 else \
2431 ok(!res && err == e, "SetKernelObjectSecurity should have failed " \
2432 "with %s, instead of %d\n", #e, err); \
2433 }while(0)
2434
2435 static void test_process_security(void)
2436 {
2437 BOOL res;
2438 PTOKEN_OWNER owner;
2439 PTOKEN_PRIMARY_GROUP group;
2440 PSID AdminSid = NULL, UsersSid = NULL;
2441 PACL Acl = NULL;
2442 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
2443 char buffer[MAX_PATH];
2444 PROCESS_INFORMATION info;
2445 STARTUPINFOA startup;
2446 SECURITY_ATTRIBUTES psa;
2447 HANDLE token, event;
2448 DWORD size;
2449
2450 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
2451 res = InitializeAcl(Acl, 256, ACL_REVISION);
2452 if (!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2453 {
2454 win_skip("ACLs not implemented - skipping tests\n");
2455 HeapFree(GetProcessHeap(), 0, Acl);
2456 return;
2457 }
2458 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2459
2460 /* get owner from the token we might be running as a user not admin */
2461 res = OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED, &token );
2462 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
2463 if (!res)
2464 {
2465 HeapFree(GetProcessHeap(), 0, Acl);
2466 return;
2467 }
2468
2469 res = GetTokenInformation( token, TokenOwner, NULL, 0, &size );
2470 ok(!res, "Expected failure, got %d\n", res);
2471 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2472 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2473
2474 owner = HeapAlloc(GetProcessHeap(), 0, size);
2475 res = GetTokenInformation( token, TokenOwner, owner, size, &size );
2476 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2477 AdminSid = ((TOKEN_OWNER*)owner)->Owner;
2478
2479 res = GetTokenInformation( token, TokenPrimaryGroup, NULL, 0, &size );
2480 ok(!res, "Expected failure, got %d\n", res);
2481 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2482 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2483
2484 group = HeapAlloc(GetProcessHeap(), 0, size);
2485 res = GetTokenInformation( token, TokenPrimaryGroup, group, size, &size );
2486 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2487 UsersSid = ((TOKEN_PRIMARY_GROUP*)group)->PrimaryGroup;
2488
2489 CloseHandle( token );
2490 if (!res)
2491 {
2492 HeapFree(GetProcessHeap(), 0, group);
2493 HeapFree(GetProcessHeap(), 0, owner);
2494 HeapFree(GetProcessHeap(), 0, Acl);
2495 return;
2496 }
2497
2498 res = AddAccessDeniedAce(Acl, ACL_REVISION, PROCESS_VM_READ, AdminSid);
2499 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
2500 res = AddAccessAllowedAce(Acl, ACL_REVISION, PROCESS_ALL_ACCESS, AdminSid);
2501 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2502
2503 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
2504 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
2505 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
2506
2507 event = CreateEvent( NULL, TRUE, TRUE, "test_event" );
2508 ok(event != NULL, "CreateEvent %d\n", GetLastError());
2509
2510 SecurityDescriptor->Revision = 0;
2511 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_UNKNOWN_REVISION );
2512 SecurityDescriptor->Revision = SECURITY_DESCRIPTOR_REVISION;
2513
2514 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2515 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2516 CHECK_SET_SECURITY( event, SACL_SECURITY_INFORMATION, ERROR_ACCESS_DENIED );
2517 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2518 /* NULL DACL is valid and means default DACL from token */
2519 SecurityDescriptor->Control |= SE_DACL_PRESENT;
2520 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2521
2522 /* Set owner and group and dacl */
2523 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
2524 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
2525 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_SUCCESS );
2526 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, FALSE);
2527 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2528 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_SUCCESS );
2529 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
2530 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
2531 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2532
2533 sprintf(buffer, "%s tests/security.c test", myARGV[0]);
2534 memset(&startup, 0, sizeof(startup));
2535 startup.cb = sizeof(startup);
2536 startup.dwFlags = STARTF_USESHOWWINDOW;
2537 startup.wShowWindow = SW_SHOWNORMAL;
2538
2539 psa.nLength = sizeof(psa);
2540 psa.lpSecurityDescriptor = SecurityDescriptor;
2541 psa.bInheritHandle = TRUE;
2542
2543 /* Doesn't matter what ACL say we should get full access for ourselves */
2544 res = CreateProcessA( NULL, buffer, &psa, NULL, FALSE, 0, NULL, NULL, &startup, &info );
2545 ok(res, "CreateProcess with err:%d\n", GetLastError());
2546 TEST_GRANTED_ACCESS2( info.hProcess, PROCESS_ALL_ACCESS,
2547 STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
2548 winetest_wait_child_process( info.hProcess );
2549
2550 CloseHandle( info.hProcess );
2551 CloseHandle( info.hThread );
2552 CloseHandle( event );
2553 HeapFree(GetProcessHeap(), 0, group);
2554 HeapFree(GetProcessHeap(), 0, owner);
2555 HeapFree(GetProcessHeap(), 0, Acl);
2556 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
2557 }
2558
2559 static void test_process_security_child(void)
2560 {
2561 HANDLE handle, handle1;
2562 BOOL ret;
2563 DWORD err;
2564
2565 handle = OpenProcess( PROCESS_TERMINATE, FALSE, GetCurrentProcessId() );
2566 ok(handle != NULL, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
2567 TEST_GRANTED_ACCESS( handle, PROCESS_TERMINATE );
2568
2569 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2570 &handle1, 0, TRUE, DUPLICATE_SAME_ACCESS );
2571 ok(ret, "duplicating handle err:%d\n", GetLastError());
2572 TEST_GRANTED_ACCESS( handle1, PROCESS_TERMINATE );
2573
2574 CloseHandle( handle1 );
2575
2576 SetLastError( 0xdeadbeef );
2577 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2578 &handle1, PROCESS_ALL_ACCESS, TRUE, 0 );
2579 err = GetLastError();
2580 todo_wine
2581 ok(!ret && err == ERROR_ACCESS_DENIED, "duplicating handle should have failed "
2582 "with STATUS_ACCESS_DENIED, instead of err:%d\n", err);
2583
2584 CloseHandle( handle );
2585
2586 /* These two should fail - they are denied by ACL */
2587 handle = OpenProcess( PROCESS_VM_READ, FALSE, GetCurrentProcessId() );
2588 todo_wine
2589 ok(handle == NULL, "OpenProcess(PROCESS_VM_READ) should have failed\n");
2590 handle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId() );
2591 todo_wine
2592 ok(handle == NULL, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
2593
2594 /* Documented privilege elevation */
2595 ret = DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
2596 &handle, 0, TRUE, DUPLICATE_SAME_ACCESS );
2597 ok(ret, "duplicating handle err:%d\n", GetLastError());
2598 TEST_GRANTED_ACCESS2( handle, PROCESS_ALL_ACCESS,
2599 STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
2600
2601 CloseHandle( handle );
2602
2603 /* Same only explicitly asking for all access rights */
2604 ret = DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
2605 &handle, PROCESS_ALL_ACCESS, TRUE, 0 );
2606 ok(ret, "duplicating handle err:%d\n", GetLastError());
2607 TEST_GRANTED_ACCESS2( handle, PROCESS_ALL_ACCESS,
2608 PROCESS_ALL_ACCESS | PROCESS_QUERY_LIMITED_INFORMATION );
2609 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2610 &handle1, PROCESS_VM_READ, TRUE, 0 );
2611 ok(ret, "duplicating handle err:%d\n", GetLastError());
2612 TEST_GRANTED_ACCESS( handle1, PROCESS_VM_READ );
2613 CloseHandle( handle1 );
2614 CloseHandle( handle );
2615 }
2616
2617 static void test_impersonation_level(void)
2618 {
2619 HANDLE Token, ProcessToken;
2620 HANDLE Token2;
2621 DWORD Size;
2622 TOKEN_PRIVILEGES *Privileges;
2623 TOKEN_USER *User;
2624 PRIVILEGE_SET *PrivilegeSet;
2625 BOOL AccessGranted;
2626 BOOL ret;
2627 HKEY hkey;
2628 DWORD error;
2629
2630 pDuplicateTokenEx = (void *)GetProcAddress(hmod, "DuplicateTokenEx");
2631 if( !pDuplicateTokenEx ) {
2632 win_skip("DuplicateTokenEx is not available\n");
2633 return;
2634 }
2635 SetLastError(0xdeadbeef);
2636 ret = ImpersonateSelf(SecurityAnonymous);
2637 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2638 {
2639 win_skip("ImpersonateSelf is not implemented\n");
2640 return;
2641 }
2642 ok(ret, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
2643 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2644 ok(!ret, "OpenThreadToken should have failed\n");
2645 error = GetLastError();
2646 ok(error == ERROR_CANT_OPEN_ANONYMOUS, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error);
2647 /* can't perform access check when opening object against an anonymous impersonation token */
2648 todo_wine {
2649 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2650 ok(error == ERROR_INVALID_HANDLE || error == ERROR_CANT_OPEN_ANONYMOUS,
2651 "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE or ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error);
2652 }
2653 RevertToSelf();
2654
2655 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &ProcessToken);
2656 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
2657
2658 ret = pDuplicateTokenEx(ProcessToken,
2659 TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE, NULL,
2660 SecurityAnonymous, TokenImpersonation, &Token);
2661 ok(ret, "DuplicateTokenEx failed with error %d\n", GetLastError());
2662 /* can't increase the impersonation level */
2663 ret = DuplicateToken(Token, SecurityIdentification, &Token2);
2664 error = GetLastError();
2665 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL,
2666 "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2667 /* we can query anything from an anonymous token, including the user */
2668 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
2669 error = GetLastError();
2670 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
2671 User = HeapAlloc(GetProcessHeap(), 0, Size);
2672 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
2673 ok(ret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
2674 HeapFree(GetProcessHeap(), 0, User);
2675
2676 /* PrivilegeCheck fails with SecurityAnonymous level */
2677 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
2678 error = GetLastError();
2679 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
2680 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
2681 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
2682 ok(ret, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
2683
2684 PrivilegeSet = HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET, Privilege[Privileges->PrivilegeCount]));
2685 PrivilegeSet->PrivilegeCount = Privileges->PrivilegeCount;
2686 memcpy(PrivilegeSet->Privilege, Privileges->Privileges, PrivilegeSet->PrivilegeCount * sizeof(PrivilegeSet->Privilege[0]));
2687 PrivilegeSet->Control = PRIVILEGE_SET_ALL_NECESSARY;
2688 HeapFree(GetProcessHeap(), 0, Privileges);
2689
2690 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2691 error = GetLastError();
2692 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2693
2694 CloseHandle(Token);
2695
2696 ret = ImpersonateSelf(SecurityIdentification);
2697 ok(ret, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
2698 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2699 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
2700
2701 /* can't perform access check when opening object against an identification impersonation token */
2702 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2703 todo_wine {
2704 ok(error == ERROR_INVALID_HANDLE || error == ERROR_BAD_IMPERSONATION_LEVEL,
2705 "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE or ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2706 }
2707 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2708 ok(ret, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
2709 CloseHandle(Token);
2710 RevertToSelf();
2711
2712 ret = ImpersonateSelf(SecurityImpersonation);
2713 ok(ret, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
2714 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2715 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
2716 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2717 ok(error == ERROR_SUCCESS, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error);
2718 RegCloseKey(hkey);
2719 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2720 ok(ret, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
2721 RevertToSelf();
2722
2723 CloseHandle(Token);
2724 CloseHandle(ProcessToken);
2725
2726 HeapFree(GetProcessHeap(), 0, PrivilegeSet);
2727 }
2728
2729 static void test_SetEntriesInAclW(void)
2730 {
2731 DWORD res;
2732 PSID EveryoneSid = NULL, UsersSid = NULL;
2733 PACL OldAcl = NULL, NewAcl;
2734 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2735 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
2736 EXPLICIT_ACCESSW ExplicitAccess;
2737 static const WCHAR wszEveryone[] = {'E','v','e','r','y','o','n','e',0};
2738 static const WCHAR wszCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
2739
2740 if (!pSetEntriesInAclW)
2741 {
2742 win_skip("SetEntriesInAclW is not available\n");
2743 return;
2744 }
2745
2746 NewAcl = (PACL)0xdeadbeef;
2747 res = pSetEntriesInAclW(0, NULL, NULL, &NewAcl);
2748 if(res == ERROR_CALL_NOT_IMPLEMENTED)
2749 {
2750 win_skip("SetEntriesInAclW is not implemented\n");
2751 return;
2752 }
2753 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2754 ok(NewAcl == NULL ||
2755 broken(NewAcl != NULL), /* NT4 */
2756 "NewAcl=%p, expected NULL\n", NewAcl);
2757 LocalFree(NewAcl);
2758
2759 OldAcl = HeapAlloc(GetProcessHeap(), 0, 256);
2760 res = InitializeAcl(OldAcl, 256, ACL_REVISION);
2761 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2762 {
2763 win_skip("ACLs not implemented - skipping tests\n");
2764 HeapFree(GetProcessHeap(), 0, OldAcl);
2765 return;
2766 }
2767 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2768
2769 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
2770 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2771
2772 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
2773 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
2774 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2775
2776 res = AddAccessAllowedAce(OldAcl, ACL_REVISION, KEY_READ, UsersSid);
2777 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2778
2779 ExplicitAccess.grfAccessPermissions = KEY_WRITE;
2780 ExplicitAccess.grfAccessMode = GRANT_ACCESS;
2781 ExplicitAccess.grfInheritance = NO_INHERITANCE;
2782 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
2783 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2784 ExplicitAccess.Trustee.ptstrName = EveryoneSid;
2785 ExplicitAccess.Trustee.MultipleTrusteeOperation = 0xDEADBEEF;
2786 ExplicitAccess.Trustee.pMultipleTrustee = (PVOID)0xDEADBEEF;
2787 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2788 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2789 ok(NewAcl != NULL, "returned acl was NULL\n");
2790 LocalFree(NewAcl);
2791
2792 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
2793 ExplicitAccess.Trustee.pMultipleTrustee = NULL;
2794 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2795 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2796 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2797 ok(NewAcl != NULL, "returned acl was NULL\n");
2798 LocalFree(NewAcl);
2799
2800 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2801 {
2802 skip("Non-English locale (test with hardcoded 'Everyone')\n");
2803 }
2804 else
2805 {
2806 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2807 ExplicitAccess.Trustee.ptstrName = (LPWSTR)wszEveryone;
2808 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2809 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2810 ok(NewAcl != NULL, "returned acl was NULL\n");
2811 LocalFree(NewAcl);
2812
2813 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_BAD_FORM;
2814 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2815 ok(res == ERROR_INVALID_PARAMETER ||
2816 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2817 "SetEntriesInAclW failed: %u\n", res);
2818 ok(NewAcl == NULL ||
2819 broken(NewAcl != NULL), /* NT4 */
2820 "returned acl wasn't NULL: %p\n", NewAcl);
2821
2822 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2823 ExplicitAccess.Trustee.MultipleTrusteeOperation = TRUSTEE_IS_IMPERSONATE;
2824 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2825 ok(res == ERROR_INVALID_PARAMETER ||
2826 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2827 "SetEntriesInAclW failed: %u\n", res);
2828 ok(NewAcl == NULL ||
2829 broken(NewAcl != NULL), /* NT4 */
2830 "returned acl wasn't NULL: %p\n", NewAcl);
2831
2832 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2833 ExplicitAccess.grfAccessMode = SET_ACCESS;
2834 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2835 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2836 ok(NewAcl != NULL, "returned acl was NULL\n");
2837 LocalFree(NewAcl);
2838 }
2839
2840 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2841 ExplicitAccess.Trustee.ptstrName = (LPWSTR)wszCurrentUser;
2842 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2843 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2844 ok(NewAcl != NULL, "returned acl was NULL\n");
2845 LocalFree(NewAcl);
2846
2847 ExplicitAccess.grfAccessMode = REVOKE_ACCESS;
2848 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2849 ExplicitAccess.Trustee.ptstrName = UsersSid;
2850 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2851 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2852 ok(NewAcl != NULL, "returned acl was NULL\n");
2853 LocalFree(NewAcl);
2854
2855 FreeSid(UsersSid);
2856 FreeSid(EveryoneSid);
2857 HeapFree(GetProcessHeap(), 0, OldAcl);
2858 }
2859
2860 static void test_SetEntriesInAclA(void)
2861 {
2862 DWORD res;
2863 PSID EveryoneSid = NULL, UsersSid = NULL;
2864 PACL OldAcl = NULL, NewAcl;
2865 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2866 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
2867 EXPLICIT_ACCESS ExplicitAccess;
2868 static const CHAR szEveryone[] = {'E','v','e','r','y','o','n','e',0};
2869 static const CHAR szCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
2870
2871 if (!pSetEntriesInAclA)
2872 {
2873 win_skip("SetEntriesInAclA is not available\n");
2874 return;
2875 }
2876
2877 NewAcl = (PACL)0xdeadbeef;
2878 res = pSetEntriesInAclA(0, NULL, NULL, &NewAcl);
2879 if(res == ERROR_CALL_NOT_IMPLEMENTED)
2880 {
2881 win_skip("SetEntriesInAclA is not implemented\n");
2882 return;
2883 }
2884 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2885 ok(NewAcl == NULL ||
2886 broken(NewAcl != NULL), /* NT4 */
2887 "NewAcl=%p, expected NULL\n", NewAcl);
2888 LocalFree(NewAcl);
2889
2890 OldAcl = HeapAlloc(GetProcessHeap(), 0, 256);
2891 res = InitializeAcl(OldAcl, 256, ACL_REVISION);
2892 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2893 {
2894 win_skip("ACLs not implemented - skipping tests\n");
2895 HeapFree(GetProcessHeap(), 0, OldAcl);
2896 return;
2897 }
2898 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2899
2900 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
2901 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2902
2903 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
2904 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
2905 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2906
2907 res = AddAccessAllowedAce(OldAcl, ACL_REVISION, KEY_READ, UsersSid);
2908 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2909
2910 ExplicitAccess.grfAccessPermissions = KEY_WRITE;
2911 ExplicitAccess.grfAccessMode = GRANT_ACCESS;
2912 ExplicitAccess.grfInheritance = NO_INHERITANCE;
2913 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
2914 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2915 ExplicitAccess.Trustee.ptstrName = EveryoneSid;
2916 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2917 ExplicitAccess.Trustee.pMultipleTrustee = NULL;
2918 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2919 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2920 ok(NewAcl != NULL, "returned acl was NULL\n");
2921 LocalFree(NewAcl);
2922
2923 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
2924 ExplicitAccess.Trustee.pMultipleTrustee = NULL;
2925 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2926 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2927 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2928 ok(NewAcl != NULL, "returned acl was NULL\n");
2929 LocalFree(NewAcl);
2930
2931 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2932 {
2933 skip("Non-English locale (test with hardcoded 'Everyone')\n");
2934 }
2935 else
2936 {
2937 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2938 ExplicitAccess.Trustee.ptstrName = (LPSTR)szEveryone;
2939 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2940 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2941 ok(NewAcl != NULL, "returned acl was NULL\n");
2942 LocalFree(NewAcl);
2943
2944 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_BAD_FORM;
2945 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2946 ok(res == ERROR_INVALID_PARAMETER ||
2947 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2948 "SetEntriesInAclA failed: %u\n", res);
2949 ok(NewAcl == NULL ||
2950 broken(NewAcl != NULL), /* NT4 */
2951 "returned acl wasn't NULL: %p\n", NewAcl);
2952
2953 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2954 ExplicitAccess.Trustee.MultipleTrusteeOperation = TRUSTEE_IS_IMPERSONATE;
2955 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2956 ok(res == ERROR_INVALID_PARAMETER ||
2957 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2958 "SetEntriesInAclA failed: %u\n", res);
2959 ok(NewAcl == NULL ||
2960 broken(NewAcl != NULL), /* NT4 */
2961 "returned acl wasn't NULL: %p\n", NewAcl);
2962
2963 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2964 ExplicitAccess.grfAccessMode = SET_ACCESS;
2965 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2966 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2967 ok(NewAcl != NULL, "returned acl was NULL\n");
2968 LocalFree(NewAcl);
2969 }
2970
2971 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2972 ExplicitAccess.Trustee.ptstrName = (LPSTR)szCurrentUser;
2973 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2974 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2975 ok(NewAcl != NULL, "returned acl was NULL\n");
2976 LocalFree(NewAcl);
2977
2978 ExplicitAccess.grfAccessMode = REVOKE_ACCESS;
2979 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2980 ExplicitAccess.Trustee.ptstrName = UsersSid;
2981 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2982 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2983 ok(NewAcl != NULL, "returned acl was NULL\n");
2984 LocalFree(NewAcl);
2985
2986 FreeSid(UsersSid);
2987 FreeSid(EveryoneSid);
2988 HeapFree(GetProcessHeap(), 0, OldAcl);
2989 }
2990
2991 static void test_GetNamedSecurityInfoA(void)
2992 {
2993 PSECURITY_DESCRIPTOR pSecDesc;
2994 DWORD revision;
2995 SECURITY_DESCRIPTOR_CONTROL control;
2996 PSID owner;
2997 PSID group;
2998 PACL dacl;
2999 BOOL owner_defaulted;
3000 BOOL group_defaulted;
3001 DWORD error;
3002 BOOL ret, isNT4;
3003 CHAR windows_dir[MAX_PATH];
3004
3005 if (!pGetNamedSecurityInfoA)
3006 {
3007 win_skip("GetNamedSecurityInfoA is not available\n");
3008 return;
3009 }
3010
3011 ret = GetWindowsDirectoryA(windows_dir, MAX_PATH);
3012 ok(ret, "GetWindowsDirectory failed with error %d\n", GetLastError());
3013
3014 SetLastError(0xdeadbeef);
3015 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,
3016 OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
3017 NULL, NULL, NULL, NULL, &pSecDesc);
3018 if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3019 {
3020 win_skip("GetNamedSecurityInfoA is not implemented\n");
3021 return;
3022 }
3023 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3024
3025 ret = GetSecurityDescriptorControl(pSecDesc, &control, &revision);
3026 ok(ret, "GetSecurityDescriptorControl failed with error %d\n", GetLastError());
3027 ok((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == (SE_SELF_RELATIVE|SE_DACL_PRESENT) ||
3028 broken((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == SE_DACL_PRESENT), /* NT4 */
3029 "control (0x%x) doesn't have (SE_SELF_RELATIVE|SE_DACL_PRESENT) flags set\n", control);
3030 ok(revision == SECURITY_DESCRIPTOR_REVISION1, "revision was %d instead of 1\n", revision);
3031
3032 isNT4 = (control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == SE_DACL_PRESENT;
3033
3034 ret = GetSecurityDescriptorOwner(pSecDesc, &owner, &owner_defaulted);
3035 ok(ret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
3036 ok(owner != NULL, "owner should not be NULL\n");
3037
3038 ret = GetSecurityDescriptorGroup(pSecDesc, &group, &group_defaulted);
3039 ok(ret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
3040 ok(group != NULL, "group should not be NULL\n");
3041 LocalFree(pSecDesc);
3042
3043
3044 /* NULL descriptor tests */
3045 if(isNT4)
3046 {
3047 win_skip("NT4 does not support GetNamedSecutityInfo with a NULL descriptor\n");
3048 return;
3049 }
3050
3051 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,
3052 NULL, NULL, NULL, NULL, NULL);
3053 ok(error==ERROR_INVALID_PARAMETER, "GetNamedSecurityInfo failed with error %d\n", error);
3054
3055 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,
3056 NULL, NULL, &dacl, NULL, NULL);
3057 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3058 ok(dacl != NULL, "dacl should not be NULL\n");
3059
3060 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,OWNER_SECURITY_INFORMATION,
3061 NULL, NULL, &dacl, NULL, NULL);
3062 ok(error==ERROR_INVALID_PARAMETER, "GetNamedSecurityInfo failed with error %d\n", error);
3063 }
3064
3065 static void test_ConvertStringSecurityDescriptor(void)
3066 {
3067 BOOL ret;
3068 PSECURITY_DESCRIPTOR pSD;
3069 static const WCHAR Blank[] = { 0 };
3070 unsigned int i;
3071 static const struct
3072 {
3073 const char *sidstring;
3074 DWORD revision;
3075 BOOL ret;
3076 DWORD GLE;
3077 DWORD altGLE;
3078 } cssd[] =
3079 {
3080 { "D:(A;;GA;;;WD)", 0xdeadbeef, FALSE, ERROR_UNKNOWN_REVISION },
3081 /* test ACE string type */
3082 { "D:(A;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3083 { "D:(D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3084 { "ERROR:(D;;GA;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_PARAMETER },
3085 /* test ACE string with spaces */
3086 { " D:(D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3087 { "D: (D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3088 { "D:( D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3089 { "D:(D ;;GA;;;WD)", SDDL_REVISION_1, FALSE, RPC_S_INVALID_STRING_UUID, ERROR_INVALID_ACL }, /* Vista+ */
3090 { "D:(D; ;GA;;;WD)", SDDL_REVISION_1, TRUE },
3091 { "D:(D;; GA;;;WD)", SDDL_REVISION_1, TRUE },
3092 { "D:(D;;GA ;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL },
3093 { "D:(D;;GA; ;;WD)", SDDL_REVISION_1, TRUE },
3094 { "D:(D;;GA;; ;WD)", SDDL_REVISION_1, TRUE },
3095 { "D:(D;;GA;;; WD)", SDDL_REVISION_1, TRUE },
3096 { "D:(D;;GA;;;WD )", SDDL_REVISION_1, TRUE },
3097 /* test ACE string access rights */
3098 { "D:(A;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3099 { "D:(A;;GRGWGX;;;WD)", SDDL_REVISION_1, TRUE },
3100 { "D:(A;;RCSDWDWO;;;WD)", SDDL_REVISION_1, TRUE },
3101 { "D:(A;;RPWPCCDCLCSWLODTCR;;;WD)", SDDL_REVISION_1, TRUE },
3102 { "D:(A;;FAFRFWFX;;;WD)", SDDL_REVISION_1, TRUE },
3103 { "D:(A;;KAKRKWKX;;;WD)", SDDL_REVISION_1, TRUE },
3104 { "D:(A;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, TRUE },
3105 { "S:(AU;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, TRUE },
3106 /* test ACE string access right error case */
3107 { "D:(A;;ROB;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL },
3108 /* test behaviour with empty strings */
3109 { "", SDDL_REVISION_1, TRUE },
3110 /* test ACE string SID */
3111 { "D:(D;;GA;;;S-1-0-0)", SDDL_REVISION_1, TRUE },
3112 { "D:(D;;GA;;;Nonexistent account)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL, ERROR_INVALID_SID } /* W2K */
3113 };
3114
3115 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
3116 {
3117 win_skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
3118 return;
3119 }
3120
3121 for (i = 0; i < sizeof(cssd)/sizeof(cssd[0]); i++)
3122 {
3123 DWORD GLE;
3124
3125 SetLastError(0xdeadbeef);
3126 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3127 cssd[i].sidstring, cssd[i].revision, &pSD, NULL);
3128 GLE = GetLastError();
3129 ok(ret == cssd[i].ret, "(%02u) Expected %s (%d)\n", i, cssd[i].ret ? "success" : "failure", GLE);
3130 if (!cssd[i].ret)
3131 ok(GLE == cssd[i].GLE ||
3132 (cssd[i].altGLE && GLE == cssd[i].altGLE),
3133 "(%02u) Unexpected last error %d\n", i, GLE);
3134 if (ret)
3135 LocalFree(pSD);
3136 }
3137
3138 /* test behaviour with NULL parameters */
3139 SetLastError(0xdeadbeef);
3140 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3141 NULL, 0xdeadbeef, &pSD, NULL);
3142 todo_wine
3143 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3144 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3145 GetLastError());
3146
3147 SetLastError(0xdeadbeef);
3148 ret = pConvertStringSecurityDescriptorToSecurityDescriptorW(
3149 NULL, 0xdeadbeef, &pSD, NULL);
3150 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3151 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3152 GetLastError());
3153
3154 SetLastError(0xdeadbeef);
3155 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3156 "D:(A;;ROB;;;WD)", 0xdeadbeef, NULL, NULL);
3157 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3158 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3159 GetLastError());
3160
3161 SetLastError(0xdeadbeef);
3162 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3163 "D:(A;;ROB;;;WD)", SDDL_REVISION_1, NULL, NULL);
3164 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3165 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3166 GetLastError());
3167
3168 /* test behaviour with empty strings */
3169 SetLastError(0xdeadbeef);
3170 ret = pConvertStringSecurityDescriptorToSecurityDescriptorW(
3171 Blank, SDDL_REVISION_1, &pSD, NULL);
3172 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
3173 LocalFree(pSD);
3174 }
3175
3176 static void test_ConvertSecurityDescriptorToString(void)
3177 {
3178 SECURITY_DESCRIPTOR desc;
3179 SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
3180 LPSTR string;
3181 DWORD size;
3182 PSID psid, psid2;
3183 PACL pacl;
3184 char sid_buf[256];
3185 char acl_buf[8192];
3186 ULONG len;
3187
3188 if (!pConvertSecurityDescriptorToStringSecurityDescriptorA)
3189 {
3190 win_skip("ConvertSecurityDescriptorToStringSecurityDescriptor is not available\n");
3191 return;
3192 }
3193 if (!pCreateWellKnownSid)
3194 {
3195 win_skip("CreateWellKnownSid is not available\n");
3196 return;
3197 }
3198
3199 /* It seems Windows XP adds an extra character to the length of the string for each ACE in an ACL. We
3200 * don't replicate this feature so we only test len >= strlen+1. */
3201 #define CHECK_RESULT_AND_FREE(exp_str) \
3202 ok(strcmp(string, (exp_str)) == 0, "String mismatch (expected \"%s\", got \"%s\")\n", (exp_str), string); \
3203 ok(len >= (strlen(exp_str) + 1), "Length mismatch (expected %d, got %d)\n", lstrlen(exp_str) + 1, len); \
3204 LocalFree(string);
3205
3206 #define CHECK_ONE_OF_AND_FREE(exp_str1, exp_str2) \
3207 ok(strcmp(string, (exp_str1)) == 0 || strcmp(string, (exp_str2)) == 0, "String mismatch (expected\n\"%s\" or\n\"%s\", got\n\"%s\")\n", (exp_str1), (exp_str2), string); \
3208 ok(len >= (strlen(exp_str1) + 1) || len >= (strlen(exp_str2) + 1), "Length mismatch (expected %d or %d, got %d)\n", lstrlen(exp_str1) + 1, lstrlen(exp_str2) + 1, len); \
3209 LocalFree(string);
3210
3211 InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION);
3212 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3213 CHECK_RESULT_AND_FREE("");
3214
3215 size = 4096;
3216 pCreateWellKnownSid(WinLocalSid, NULL, sid_buf, &size);
3217 SetSecurityDescriptorOwner(&desc, sid_buf, FALSE);
3218 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3219 CHECK_RESULT_AND_FREE("O:S-1-2-0");
3220
3221 SetSecurityDescriptorOwner(&desc, sid_buf, TRUE);
3222 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3223 CHECK_RESULT_AND_FREE("O:S-1-2-0");
3224
3225 size = sizeof(sid_buf);
3226 pCreateWellKnownSid(WinLocalSystemSid, NULL, sid_buf, &size);
3227 SetSecurityDescriptorOwner(&desc, sid_buf, TRUE);
3228 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3229 CHECK_RESULT_AND_FREE("O:SY");
3230
3231 pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid);
3232 SetSecurityDescriptorGroup(&desc, psid, TRUE);
3233 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3234 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576");
3235
3236 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, GROUP_SECURITY_INFORMATION, &string, &len), "Conversion failed\n");
3237 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
3238
3239 pacl = (PACL)acl_buf;
3240 InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
3241 SetSecurityDescriptorDacl(&desc, TRUE, pacl, TRUE);
3242 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3243 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
3244
3245 SetSecurityDescriptorDacl(&desc, TRUE, pacl, FALSE);
3246 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3247 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
3248
3249 pConvertStringSidToSidA("S-1-5-6", &psid2);
3250 pAddAccessAllowedAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, 0xf0000000, psid2);
3251 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3252 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)");
3253
3254 pAddAccessAllowedAceEx(pacl, ACL_REVISION, INHERIT_ONLY_ACE|INHERITED_ACE, 0x00000003, psid2);
3255 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3256 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)");
3257
3258 pAddAccessDeniedAceEx(pacl, ACL_REVISION, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE, 0xffffffff, psid);
3259 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3260 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
3261
3262
3263 pacl = (PACL)acl_buf;
3264 InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
3265 SetSecurityDescriptorSacl(&desc, TRUE, pacl, FALSE);
3266 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3267 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:");
3268
3269 /* fails in win2k */
3270 SetSecurityDescriptorDacl(&desc, TRUE, NULL, FALSE);
3271 pAddAuditAccessAceEx(pacl, ACL_REVISION, VALID_INHERIT_FLAGS, KEY_READ|KEY_WRITE, psid2, TRUE, TRUE);
3272 if (pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len))
3273 {
3274 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)", /* XP */
3275 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)" /* Vista */);
3276 }
3277
3278 /* fails in win2k */
3279 pAddAuditAccessAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, FILE_GENERIC_READ|FILE_GENERIC_WRITE, psid2, TRUE, FALSE);
3280 if (pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len))
3281 {
3282 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", /* XP */
3283 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)" /* Vista */);
3284 }
3285
3286 LocalFree(psid2);
3287 LocalFree(psid);
3288 }
3289
3290 static void test_SetSecurityDescriptorControl (PSECURITY_DESCRIPTOR sec)
3291 {
3292 SECURITY_DESCRIPTOR_CONTROL ref;
3293 SECURITY_DESCRIPTOR_CONTROL test;
3294
3295 SECURITY_DESCRIPTOR_CONTROL const mutable
3296 = SE_DACL_AUTO_INHERIT_REQ | SE_SACL_AUTO_INHERIT_REQ
3297 | SE_DACL_AUTO_INHERITED | SE_SACL_AUTO_INHERITED
3298 | SE_DACL_PROTECTED | SE_SACL_PROTECTED
3299 | 0x00000040 | 0x00000080 /* not defined in winnt.h */
3300 ;
3301 SECURITY_DESCRIPTOR_CONTROL const immutable
3302 = SE_OWNER_DEFAULTED | SE_GROUP_DEFAULTED
3303 | SE_DACL_PRESENT | SE_DACL_DEFAULTED
3304 | SE_SACL_PRESENT | SE_SACL_DEFAULTED
3305 | SE_RM_CONTROL_VALID | SE_SELF_RELATIVE
3306 ;
3307
3308 int bit;
3309 DWORD dwRevision;
3310 LPCSTR fmt = "Expected error %s, got %u\n";
3311
3312 GetSecurityDescriptorControl (sec, &ref, &dwRevision);
3313
3314 /* The mutable bits are mutable regardless of the truth of
3315 SE_DACL_PRESENT and/or SE_SACL_PRESENT */
3316
3317 /* Check call barfs if any bit-of-interest is immutable */
3318 for (bit = 0; bit < 16; ++bit)
3319 {
3320 SECURITY_DESCRIPTOR_CONTROL const bitOfInterest = 1 << bit;
3321 SECURITY_DESCRIPTOR_CONTROL setOrClear = ref & bitOfInterest;
3322
3323 SECURITY_DESCRIPTOR_CONTROL ctrl;
3324
3325 DWORD dwExpect = (bitOfInterest & immutable)
3326 ? ERROR_INVALID_PARAMETER : 0xbebecaca;
3327 LPCSTR strExpect = (bitOfInterest & immutable)
3328 ? "ERROR_INVALID_PARAMETER" : "0xbebecaca";
3329
3330 ctrl = (bitOfInterest & mutable) ? ref + bitOfInterest : ref;
3331 setOrClear ^= bitOfInterest;
3332 SetLastError (0xbebecaca);
3333 pSetSecurityDescriptorControl (sec, bitOfInterest, setOrClear);
3334 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3335 GetSecurityDescriptorControl(sec, &test, &dwRevision);
3336 expect_eq(test, ctrl, int, "%x");
3337
3338 setOrClear ^= bitOfInterest;
3339 SetLastError (0xbebecaca);
3340 pSetSecurityDescriptorControl (sec, bitOfInterest, setOrClear);
3341 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3342 GetSecurityDescriptorControl (sec, &test, &dwRevision);
3343 expect_eq(test, ref, int, "%x");
3344 }
3345
3346 /* Check call barfs if any bit-to-set is immutable
3347 even when not a bit-of-interest */
3348 for (bit = 0; bit < 16; ++bit)
3349 {
3350 SECURITY_DESCRIPTOR_CONTROL const bitsOfInterest = mutable;
3351 SECURITY_DESCRIPTOR_CONTROL setOrClear = ref & bitsOfInterest;
3352
3353 SECURITY_DESCRIPTOR_CONTROL ctrl;
3354
3355 DWORD dwExpect = ((1 << bit) & immutable)
3356 ? ERROR_INVALID_PARAMETER : 0xbebecaca;
3357 LPCSTR strExpect = ((1 << bit) & immutable)
3358 ? "ERROR_INVALID_PARAMETER" : "0xbebecaca";
3359
3360 ctrl = ((1 << bit) & immutable) ? test : ref | mutable;
3361 setOrClear ^= bitsOfInterest;
3362 SetLastError (0xbebecaca);
3363 pSetSecurityDescriptorControl (sec, bitsOfInterest, setOrClear | (1 << bit));
3364 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3365 GetSecurityDescriptorControl(sec, &test, &dwRevision);
3366 expect_eq(test, ctrl, int, "%x");
3367
3368 ctrl = ((1 << bit) & immutable) ? test : ref | (1 << bit);
3369 setOrClear ^= bitsOfInterest;
3370 SetLastError (0xbebecaca);
3371 pSetSecurityDescriptorControl (sec, bitsOfInterest, setOrClear | (1 << bit));
3372 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3373 GetSecurityDescriptorControl(sec, &test, &dwRevision);
3374 expect_eq(test, ctrl, int, "%x");
3375 }
3376 }
3377
3378 static void test_PrivateObjectSecurity(void)
3379 {
3380 SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
3381 SECURITY_DESCRIPTOR_CONTROL ctrl;
3382 PSECURITY_DESCRIPTOR sec;
3383 DWORD dwDescSize;
3384 DWORD dwRevision;
3385 DWORD retSize;
3386 LPSTR string;
3387 ULONG len;
3388 PSECURITY_DESCRIPTOR buf;
3389 BOOL ret;
3390
3391 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
3392 {
3393 win_skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
3394 return;
3395 }
3396
3397 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
3398 "O:SY"
3399 "G:S-1-5-21-93476-23408-4576"
3400 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)"
3401 "(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3402 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)",
3403 SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
3404
3405 test_SetSecurityDescriptorControl(sec);
3406
3407 LocalFree(sec);
3408
3409 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
3410 "O:SY"
3411 "G:S-1-5-21-93476-23408-4576",
3412 SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
3413
3414 test_SetSecurityDescriptorControl(sec);
3415
3416 LocalFree(sec);
3417
3418 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
3419 "O:SY"
3420 "G:S-1-5-21-93476-23408-4576"
3421 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3422 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
3423 buf = HeapAlloc(GetProcessHeap(), 0, dwDescSize);
3424 pSetSecurityDescriptorControl(sec, SE_DACL_PROTECTED, SE_DACL_PROTECTED);
3425 GetSecurityDescriptorControl(sec, &ctrl, &dwRevision);
3426 expect_eq(ctrl, 0x9014, int, "%x");
3427
3428 ret = GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION, buf, dwDescSize, &retSize);
3429 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
3430 ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
3431 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3432 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
3433 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
3434 expect_eq(ctrl, 0x8000, int, "%x");
3435
3436 ret = GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, buf, dwDescSize, &retSize);
3437 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
3438 ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
3439 ret = pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len);
3440 ok(ret, "Conversion failed err=%u\n", GetLastError());
3441 CHECK_ONE_OF_AND_FREE("G:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)",
3442 "G:S-1-5-21-93476-23408-4576D:P(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"); /* Win7 */
3443 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
3444 expect_eq(ctrl & (~ SE_DACL_PROTECTED), 0x8004, int, "%x");
3445
3446 ret = GetPrivateObjectSecurity(sec, sec_info, buf, dwDescSize, &retSize);
3447 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
3448 ok(retSize == dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
3449 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3450 CHECK_ONE_OF_AND_FREE("O:SY"
3451 "G:S-1-5-21-93476-23408-4576"
3452 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3453 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)",
3454 "O:SY"
3455 "G:S-1-5-21-93476-23408-4576"
3456 "D:P(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3457 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)"); /* Win7 */
3458 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
3459 expect_eq(ctrl & (~ SE_DACL_PROTECTED), 0x8014, int, "%x");
3460
3461 SetLastError(0xdeadbeef);
3462 ok(GetPrivateObjectSecurity(sec, sec_info, buf, 5, &retSize) == FALSE, "GetPrivateObjectSecurity should have failed\n");
3463 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Expected error ERROR_INSUFFICIENT_BUFFER, got %u\n", GetLastError());
3464
3465 LocalFree(sec);
3466 HeapFree(GetProcessHeap(), 0, buf);
3467 }
3468 #undef CHECK_RESULT_AND_FREE
3469 #undef CHECK_ONE_OF_AND_FREE
3470
3471 static void test_acls(void)
3472 {
3473 char buffer[256];
3474 PACL pAcl = (PACL)buffer;
3475 BOOL ret;
3476
3477 SetLastError(0xdeadbeef);
3478 ret = InitializeAcl(pAcl, sizeof(ACL) - 1, ACL_REVISION);
3479 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
3480 {
3481 win_skip("InitializeAcl is not implemented\n");
3482 return;
3483 }
3484
3485 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "InitializeAcl with too small a buffer should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", GetLastError());
3486
3487 SetLastError(0xdeadbeef);
3488 ret = InitializeAcl(pAcl, 0xffffffff, ACL_REVISION);
3489 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl with too large a buffer should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
3490
3491 SetLastError(0xdeadbeef);
3492 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION1);
3493 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl(ACL_REVISION1) should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
3494
3495 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION2);
3496 ok(ret, "InitializeAcl(ACL_REVISION2) failed with error %d\n", GetLastError());
3497
3498 ret = IsValidAcl(pAcl);
3499 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
3500
3501 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION3);
3502 ok(ret, "InitializeAcl(ACL_REVISION3) failed with error %d\n", GetLastError());
3503
3504 ret = IsValidAcl(pAcl);
3505 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
3506
3507 SetLastError(0xdeadbeef);
3508 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION4);
3509 if (GetLastError() != ERROR_INVALID_PARAMETER)
3510 {
3511 ok(ret, "InitializeAcl(ACL_REVISION4) failed with error %d\n", GetLastError());
3512
3513 ret = IsValidAcl(pAcl);
3514 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
3515 }
3516 else
3517 win_skip("ACL_REVISION4 is not implemented on NT4\n");
3518
3519 SetLastError(0xdeadbeef);
3520 ret = InitializeAcl(pAcl, sizeof(buffer), -1);
3521 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl(-1) failed with error %d\n", GetLastError());
3522 }
3523
3524 static void test_GetSecurityInfo(void)
3525 {
3526 HANDLE obj;
3527 PSECURITY_DESCRIPTOR sd;
3528 PSID owner, group;
3529 PACL dacl;
3530 DWORD ret;
3531
3532 if (!pGetSecurityInfo)
3533 {
3534 win_skip("GetSecurityInfo is not available\n");
3535 return;
3536 }
3537
3538 /* Create something. Files have lots of associated security info. */
3539 obj = CreateFile(myARGV[0], GENERIC_READ, FILE_SHARE_READ, NULL,
3540 OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
3541 if (obj == INVALID_HANDLE_VALUE)
3542 {
3543 skip("Couldn't create an object for GetSecurityInfo test\n");
3544 return;
3545 }
3546
3547 ret = pGetSecurityInfo(obj, SE_FILE_OBJECT,
3548 OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3549 &owner, &group, &dacl, NULL, &sd);
3550 if (ret == ERROR_CALL_NOT_IMPLEMENTED)
3551 {
3552 win_skip("GetSecurityInfo is not implemented\n");
3553 CloseHandle(obj);
3554 return;
3555 }
3556 ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
3557 ok(sd != NULL, "GetSecurityInfo\n");
3558 ok(owner != NULL, "GetSecurityInfo\n");
3559 ok(group != NULL, "GetSecurityInfo\n");
3560 if (dacl != NULL)
3561 ok(IsValidAcl(dacl), "GetSecurityInfo\n");
3562 else
3563 win_skip("No ACL information returned\n");
3564
3565 LocalFree(sd);
3566
3567 if (!pCreateWellKnownSid)
3568 {
3569 win_skip("NULL parameter test would crash on NT4\n");
3570 CloseHandle(obj);
3571 return;
3572 }
3573
3574 /* If we don't ask for the security descriptor, Windows will still give us
3575 the other stuff, leaving us no way to free it. */
3576 ret = pGetSecurityInfo(obj, SE_FILE_OBJECT,
3577 OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3578 &owner, &group, &dacl, NULL, NULL);
3579 ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
3580 ok(owner != NULL, "GetSecurityInfo\n");
3581 ok(group != NULL, "GetSecurityInfo\n");
3582 if (dacl != NULL)
3583 ok(IsValidAcl(dacl), "GetSecurityInfo\n");
3584 else
3585 win_skip("No ACL information returned\n");
3586
3587 CloseHandle(obj);
3588 }
3589
3590 static void test_GetSidSubAuthority(void)
3591 {
3592 PSID psid = NULL;
3593
3594 if (!pGetSidSubAuthority || !pConvertStringSidToSidA || !pIsValidSid || !pGetSidSubAuthorityCount)
3595 {
3596 win_skip("Some functions not available\n");
3597 return;
3598 }
3599 /* Note: on windows passing in an invalid index like -1, lets GetSidSubAuthority return 0x05000000 but
3600 still GetLastError returns ERROR_SUCCESS then. We don't test these unlikely cornercases here for now */
3601 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576",&psid),"ConvertStringSidToSidA failed\n");
3602 ok(pIsValidSid(psid),"Sid is not valid\n");
3603 SetLastError(0xbebecaca);
3604 ok(*pGetSidSubAuthorityCount(psid) == 4,"GetSidSubAuthorityCount gave %d expected 4\n",*pGetSidSubAuthorityCount(psid));
3605 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3606 SetLastError(0xbebecaca);
3607 ok(*pGetSidSubAuthority(psid,0) == 21,"GetSidSubAuthority gave %d expected 21\n",*pGetSidSubAuthority(psid,0));
3608 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3609 SetLastError(0xbebecaca);
3610 ok(*pGetSidSubAuthority(psid,1) == 93476,"GetSidSubAuthority gave %d expected 93476\n",*pGetSidSubAuthority(psid,1));
3611 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3612 SetLastError(0xbebecaca);
3613 ok(pGetSidSubAuthority(psid,4) != NULL,"Expected out of bounds GetSidSubAuthority to return a non-NULL pointer\n");
3614 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3615 LocalFree(psid);
3616 }
3617
3618 static void test_CheckTokenMembership(void)
3619 {
3620 PTOKEN_GROUPS token_groups;
3621 DWORD size;
3622 HANDLE process_token, token;
3623 BOOL is_member;
3624 BOOL ret;
3625 DWORD i;
3626
3627 if (!pCheckTokenMembership)
3628 {
3629 win_skip("CheckTokenMembership is not available\n");
3630 return;
3631 }
3632 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token);
3633 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
3634
3635 ret = DuplicateToken(process_token, SecurityImpersonation, &token);
3636 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
3637
3638 /* groups */
3639 ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
3640 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
3641 "GetTokenInformation(TokenGroups) %s with error %d\n",
3642 ret ? "succeeded" : "failed", GetLastError());
3643 token_groups = HeapAlloc(GetProcessHeap(), 0, size);
3644 ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
3645 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
3646
3647 for (i = 0; i < token_groups->GroupCount; i++)
3648 {
3649 if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED)
3650 break;
3651 }
3652
3653 if (i == token_groups->GroupCount)
3654 {
3655 HeapFree(GetProcessHeap(), 0, token_groups);
3656 CloseHandle(token);
3657 skip("user not a member of any group\n");
3658 return;
3659 }
3660
3661 is_member = FALSE;
3662 ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member);
3663 ok(ret, "CheckTokenMembership failed with error %d\n", GetLastError());
3664 ok(is_member, "CheckTokenMembership should have detected sid as member\n");
3665
3666 is_member = FALSE;
3667 ret = pCheckTokenMembership(NULL, token_groups->Groups[i].Sid, &is_member);
3668 ok(ret, "CheckTokenMembership failed with error %d\n", GetLastError());
3669 ok(is_member, "CheckTokenMembership should have detected sid as member\n");
3670
3671 is_member = TRUE;
3672 SetLastError(0xdeadbeef);
3673 ret = pCheckTokenMembership(process_token, token_groups->Groups[i].Sid, &is_member);
3674 ok(!ret && GetLastError() == ERROR_NO_IMPERSONATION_TOKEN,
3675 "CheckTokenMembership with process token %s with error %d\n",
3676 ret ? "succeeded" : "failed", GetLastError());
3677 ok(!is_member, "CheckTokenMembership should have cleared is_member\n");
3678
3679 HeapFree(GetProcessHeap(), 0, token_groups);
3680 CloseHandle(token);
3681 CloseHandle(process_token);
3682 }
3683
3684 static void test_EqualSid(void)
3685 {
3686 PSID sid1, sid2;
3687 BOOL ret;
3688 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
3689 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
3690
3691 SetLastError(0xdeadbeef);
3692 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
3693 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid1);
3694 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
3695 {
3696 win_skip("AllocateAndInitializeSid is not implemented\n");
3697 return;
3698 }
3699 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3700 ok(GetLastError() == 0xdeadbeef,
3701 "AllocateAndInitializeSid shouldn't have set last error to %d\n",
3702 GetLastError());
3703
3704 ret = AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID,
3705 0, 0, 0, 0, 0, 0, 0, &sid2);
3706 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3707
3708 SetLastError(0xdeadbeef);
3709 ret = EqualSid(sid1, sid2);
3710 ok(!ret, "World and domain admins sids shouldn't have been equal\n");
3711 ok(GetLastError() == ERROR_SUCCESS ||
3712 broken(GetLastError() == 0xdeadbeef), /* NT4 */
3713 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
3714 GetLastError());
3715
3716 SetLastError(0xdeadbeef);
3717 sid2 = FreeSid(sid2);
3718 ok(!sid2, "FreeSid should have returned NULL instead of %p\n", sid2);
3719 ok(GetLastError() == 0xdeadbeef,
3720 "FreeSid shouldn't have set last error to %d\n",
3721 GetLastError());
3722
3723 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
3724 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid2);
3725 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3726
3727 SetLastError(0xdeadbeef);
3728 ret = EqualSid(sid1, sid2);
3729 ok(ret, "Same sids should have been equal\n");
3730 ok(GetLastError() == ERROR_SUCCESS ||
3731 broken(GetLastError() == 0xdeadbeef), /* NT4 */
3732 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
3733 GetLastError());
3734
3735 ((SID *)sid2)->Revision = 2;
3736 SetLastError(0xdeadbeef);
3737 ret = EqualSid(sid1, sid2);
3738 ok(!ret, "EqualSid with invalid sid should have returned FALSE\n");
3739 ok(GetLastError() == ERROR_SUCCESS ||
3740 broken(GetLastError() == 0xdeadbeef), /* NT4 */
3741 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
3742 GetLastError());
3743 ((SID *)sid2)->Revision = SID_REVISION;
3744
3745 FreeSid(sid1);
3746 FreeSid(sid2);
3747 }
3748
3749 static void test_GetUserNameA(void)
3750 {
3751 char buffer[UNLEN + 1], filler[UNLEN + 1];
3752 DWORD required_len, buffer_len;
3753 BOOL ret;
3754
3755 /* Test crashes on Windows. */
3756 if (0)
3757 {
3758 SetLastError(0xdeadbeef);
3759 GetUserNameA(NULL, NULL);
3760 }
3761
3762 SetLastError(0xdeadbeef);
3763 required_len = 0;
3764 ret = GetUserNameA(NULL, &required_len);
3765 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
3766 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
3767 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3768
3769 SetLastError(0xdeadbeef);
3770 required_len = 1;
3771 ret = GetUserNameA(NULL, &required_len);
3772 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
3773 ok(required_len != 0 && required_len != 1, "Outputted buffer length was %u\n", required_len);
3774 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3775
3776 /* Tests crashes on Windows. */
3777 if (0)
3778 {
3779 SetLastError(0xdeadbeef);
3780 required_len = UNLEN + 1;
3781 GetUserNameA(NULL, &required_len);
3782
3783 SetLastError(0xdeadbeef);
3784 GetUserNameA(buffer, NULL);
3785 }
3786
3787 memset(filler, 'x', sizeof(filler));
3788
3789 /* Note that GetUserNameA on XP and newer outputs the number of bytes
3790 * required for a Unicode string, which affects a test in the next block. */
3791 SetLastError(0xdeadbeef);
3792 memcpy(buffer, filler, sizeof(filler));
3793 required_len = 0;
3794 ret = GetUserNameA(buffer, &required_len);
3795 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
3796 ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was altered\n");
3797 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
3798 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3799
3800 SetLastError(0xdeadbeef);
3801 memcpy(buffer, filler, sizeof(filler));
3802 buffer_len = required_len;
3803 ret = GetUserNameA(buffer, &buffer_len);
3804 ok(ret == TRUE, "GetUserNameA returned %d, last error %u\n", ret, GetLastError());
3805 ok(memcmp(buffer, filler, sizeof(filler)) != 0, "Output buffer was untouched\n");
3806 ok(buffer_len == required_len ||
3807 broken(buffer_len == required_len / sizeof(WCHAR)), /* XP+ */
3808 "Outputted buffer length was %u\n", buffer_len);
3809
3810 /* Use the reported buffer size from the last GetUserNameA call and pass
3811 * a length that is one less than the required value. */
3812 SetLastError(0xdeadbeef);
3813 memcpy(buffer, filler, sizeof(filler));
3814 buffer_len--;
3815 ret = GetUserNameA(buffer, &buffer_len);
3816 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
3817 ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was untouched\n");
3818 ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
3819 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3820 }
3821
3822 static void test_GetUserNameW(void)
3823 {
3824 WCHAR buffer[UNLEN + 1], filler[UNLEN + 1];
3825 DWORD required_len, buffer_len;
3826 BOOL ret;
3827
3828 /* Test crashes on Windows. */
3829 if (0)
3830 {
3831 SetLastError(0xdeadbeef);
3832 GetUserNameW(NULL, NULL);
3833 }
3834
3835 SetLastError(0xdeadbeef);
3836 required_len = 0;
3837 ret = GetUserNameW(NULL, &required_len);
3838 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
3839 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
3840 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3841
3842 SetLastError(0xdeadbeef);
3843 required_len = 1;
3844 ret = GetUserNameW(NULL, &required_len);
3845 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
3846 ok(required_len != 0 && required_len != 1, "Outputted buffer length was %u\n", required_len);
3847 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3848
3849 /* Tests crash on Windows. */
3850 if (0)
3851 {
3852 SetLastError(0xdeadbeef);
3853 required_len = UNLEN + 1;
3854 GetUserNameW(NULL, &required_len);
3855
3856 SetLastError(0xdeadbeef);
3857 GetUserNameW(buffer, NULL);
3858 }
3859
3860 memset(filler, 'x', sizeof(filler));
3861
3862 SetLastError(0xdeadbeef);
3863 memcpy(buffer, filler, sizeof(filler));
3864 required_len = 0;
3865 ret = GetUserNameW(buffer, &required_len);
3866 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
3867 ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was altered\n");
3868 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
3869 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3870
3871 SetLastError(0xdeadbeef);
3872 memcpy(buffer, filler, sizeof(filler));
3873 buffer_len = required_len;
3874 ret = GetUserNameW(buffer, &buffer_len);
3875 ok(ret == TRUE, "GetUserNameW returned %d, last error %u\n", ret, GetLastError());
3876 ok(memcmp(buffer, filler, sizeof(filler)) != 0, "Output buffer was untouched\n");
3877 ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
3878
3879 /* GetUserNameW on XP and newer writes a truncated portion of the username string to the buffer. */
3880 SetLastError(0xdeadbeef);
3881 memcpy(buffer, filler, sizeof(filler));
3882 buffer_len--;
3883 ret = GetUserNameW(buffer, &buffer_len);
3884 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
3885 ok(!memcmp(buffer, filler, sizeof(filler)) ||
3886 broken(memcmp(buffer, filler, sizeof(filler)) != 0), /* XP+ */
3887 "Output buffer was altered\n");
3888 ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
3889 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3890 }
3891
3892 static void test_CreateRestrictedToken(void)
3893 {
3894 HANDLE process_token, token, r_token;
3895 PTOKEN_GROUPS token_groups, groups2;
3896 SID_AND_ATTRIBUTES sattr;
3897 BOOL is_member;
3898 DWORD size;
3899 BOOL ret;
3900 DWORD i, j;
3901
3902 if (!pCreateRestrictedToken)
3903 {
3904 win_skip("CreateRestrictedToken is not available\n");
3905 return;
3906 }
3907
3908 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token);
3909 ok(ret, "got error %d\n", GetLastError());
3910
3911 ret = DuplicateTokenEx(process_token, TOKEN_DUPLICATE|TOKEN_ADJUST_GROUPS|TOKEN_QUERY,
3912 NULL, SecurityImpersonation, TokenImpersonation, &token);
3913 ok(ret, "got error %d\n", GetLastError());
3914
3915 /* groups */
3916 ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
3917 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
3918 "got %d with error %d\n", ret, GetLastError());
3919 token_groups = HeapAlloc(GetProcessHeap(), 0, size);
3920 ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
3921 ok(ret, "got error %d\n", GetLastError());
3922
3923 for (i = 0; i < token_groups->GroupCount; i++)
3924 {
3925 if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED)
3926 break;
3927 }
3928
3929 if (i == token_groups->GroupCount)
3930 {
3931 HeapFree(GetProcessHeap(), 0, token_groups);
3932 CloseHandle(token);
3933 skip("User not a member of any group\n");
3934 return;
3935 }
3936
3937 is_member = FALSE;
3938 ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member);
3939 ok(ret, "got error %d\n", GetLastError());
3940 ok(is_member, "not a member\n");
3941
3942 /* disable a SID in new token */
3943 sattr.Sid = token_groups->Groups[i].Sid;
3944 sattr.Attributes = 0;
3945 r_token = NULL;
3946 ret = pCreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token);
3947 todo_wine ok(ret, "got error %d\n", GetLastError());
3948
3949 if (ret)
3950 {
3951 /* check if a SID is enabled */
3952 is_member = TRUE;
3953 ret = pCheckTokenMembership(r_token, token_groups->Groups[i].Sid, &is_member);
3954 ok(ret, "got error %d\n", GetLastError());
3955 ok(!is_member, "not a member\n");
3956
3957 ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size);
3958 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n",
3959 ret, GetLastError());
3960 groups2 = HeapAlloc(GetProcessHeap(), 0, size);
3961 ret = GetTokenInformation(r_token, TokenGroups, groups2, size, &size);
3962 ok(ret, "got error %d\n", GetLastError());
3963
3964 for (j = 0; j < groups2->GroupCount; j++)
3965 {
3966 if (EqualSid(groups2->Groups[j].Sid, token_groups->Groups[i].Sid))
3967 break;
3968 }
3969
3970 ok(groups2->Groups[j].Attributes & SE_GROUP_USE_FOR_DENY_ONLY,
3971 "got wrong attributes\n");
3972 ok((groups2->Groups[j].Attributes & SE_GROUP_ENABLED) == 0,
3973 "got wrong attributes\n");
3974
3975 HeapFree(GetProcessHeap(), 0, groups2);
3976 }
3977
3978 HeapFree(GetProcessHeap(), 0, token_groups);
3979 CloseHandle(r_token);
3980 CloseHandle(token);
3981 CloseHandle(process_token);
3982 }
3983
3984 START_TEST(security)
3985 {
3986 init();
3987 if (!hmod) return;
3988
3989 if (myARGC >= 3)
3990 {
3991 test_process_security_child();
3992 return;
3993 }
3994 test_sid();
3995 test_trustee();
3996 test_luid();
3997 test_CreateWellKnownSid();
3998 test_FileSecurity();
3999 test_AccessCheck();
4000 test_token_attr();
4001 test_LookupAccountSid();
4002 test_LookupAccountName();
4003 test_security_descriptor();
4004 test_process_security();
4005 test_impersonation_level();
4006 test_SetEntriesInAclW();
4007 test_SetEntriesInAclA();
4008 test_GetNamedSecurityInfoA();
4009 test_ConvertStringSecurityDescriptor();
4010 test_ConvertSecurityDescriptorToString();
4011 test_PrivateObjectSecurity();
4012 test_acls();
4013 test_GetSecurityInfo();
4014 test_GetSidSubAuthority();
4015 test_CheckTokenMembership();
4016 test_EqualSid();
4017 test_GetUserNameA();
4018 test_GetUserNameW();
4019 test_CreateRestrictedToken();
4020 }
Quick hack tree for wine patches julliard doesn't want to commit