?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
windowscodecs: Move PNG encoding to the unix lib.
[wine/zf.git] / server / token.c
blob30320851436ce14e82b4a4ad3596a633861a44de
1 /*
2 * Tokens
3 *
4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 */
22
23 #include "config.h"
24
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <stdarg.h>
29 #include <unistd.h>
30
31 #include "ntstatus.h"
32 #define WIN32_NO_STATUS
33 #include "windef.h"
34 #include "winternl.h"
35
36 #include "handle.h"
37 #include "thread.h"
38 #include "process.h"
39 #include "request.h"
40 #include "security.h"
41
42 #define MAX_SUBAUTH_COUNT 1
43
44 const LUID SeIncreaseQuotaPrivilege = { 5, 0 };
45 const LUID SeTcbPrivilege = { 7, 0 };
46 const LUID SeSecurityPrivilege = { 8, 0 };
47 const LUID SeTakeOwnershipPrivilege = { 9, 0 };
48 const LUID SeLoadDriverPrivilege = { 10, 0 };
49 const LUID SeSystemProfilePrivilege = { 11, 0 };
50 const LUID SeSystemtimePrivilege = { 12, 0 };
51 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
52 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
53 const LUID SeCreatePagefilePrivilege = { 15, 0 };
54 const LUID SeBackupPrivilege = { 17, 0 };
55 const LUID SeRestorePrivilege = { 18, 0 };
56 const LUID SeShutdownPrivilege = { 19, 0 };
57 const LUID SeDebugPrivilege = { 20, 0 };
58 const LUID SeSystemEnvironmentPrivilege = { 22, 0 };
59 const LUID SeChangeNotifyPrivilege = { 23, 0 };
60 const LUID SeRemoteShutdownPrivilege = { 24, 0 };
61 const LUID SeUndockPrivilege = { 25, 0 };
62 const LUID SeManageVolumePrivilege = { 28, 0 };
63 const LUID SeImpersonatePrivilege = { 29, 0 };
64 const LUID SeCreateGlobalPrivilege = { 30, 0 };
65
66 #define SID_N(n) struct /* same fields as struct SID */ \
67 { \
68 BYTE Revision; \
69 BYTE SubAuthorityCount; \
70 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
71 DWORD SubAuthority[n]; \
72 }
73
74 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
75 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
76 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
77 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
78 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
79 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
80 static const SID high_label_sid = { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY }, { SECURITY_MANDATORY_HIGH_RID } };
81 static const SID_N(5) local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
82 static const SID_N(2) builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
83 static const SID_N(2) builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
84 static const SID_N(3) builtin_logon_sid = { SID_REVISION, 3, { SECURITY_NT_AUTHORITY }, { SECURITY_LOGON_IDS_RID, 0, 0 } };
85 static const SID_N(5) domain_users_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, DOMAIN_GROUP_RID_USERS } };
86
87 const PSID security_world_sid = (PSID)&world_sid;
88 static const PSID security_local_sid = (PSID)&local_sid;
89 static const PSID security_interactive_sid = (PSID)&interactive_sid;
90 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
91 const PSID security_local_system_sid = (PSID)&local_system_sid;
92 const PSID security_local_user_sid = (PSID)&local_user_sid;
93 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
94 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
95 const PSID security_domain_users_sid = (PSID)&domain_users_sid;
96 const PSID security_high_label_sid = (PSID)&high_label_sid;
97
98 static luid_t prev_luid_value = { 1000, 0 };
99
100 struct token
101 {
102 struct object obj; /* object header */
103 luid_t token_id; /* system-unique id of token */
104 luid_t modified_id; /* new id allocated every time token is modified */
105 struct list privileges; /* privileges available to the token */
106 struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
107 SID *user; /* SID of user this token represents */
108 SID *owner; /* SID of owner (points to user or one of groups) */
109 SID *primary_group; /* SID of user's primary group (points to one of groups) */
110 unsigned primary; /* is this a primary or impersonation token? */
111 ACL *default_dacl; /* the default DACL to assign to objects created by this user */
112 TOKEN_SOURCE source; /* source of the token */
113 int impersonation_level; /* impersonation level this token is capable of if non-primary token */
114 };
115
116 struct privilege
117 {
118 struct list entry;
119 LUID luid;
120 unsigned enabled : 1; /* is the privilege currently enabled? */
121 unsigned def : 1; /* is the privilege enabled by default? */
122 };
123
124 struct group
125 {
126 struct list entry;
127 unsigned enabled : 1; /* is the sid currently enabled? */
128 unsigned def : 1; /* is the sid enabled by default? */
129 unsigned logon : 1; /* is this a logon sid? */
130 unsigned mandatory: 1; /* is this sid always enabled? */
131 unsigned owner : 1; /* can this sid be an owner of an object? */
132 unsigned resource : 1; /* is this a domain-local group? */
133 unsigned deny_only: 1; /* is this a sid that should be use for denying only? */
134 SID sid;
135 };
136
137 static void token_dump( struct object *obj, int verbose );
138 static struct object_type *token_get_type( struct object *obj );
139 static unsigned int token_map_access( struct object *obj, unsigned int access );
140 static void token_destroy( struct object *obj );
141
142 static const struct object_ops token_ops =
143 {
144 sizeof(struct token), /* size */
145 token_dump, /* dump */
146 token_get_type, /* get_type */
147 no_add_queue, /* add_queue */
148 NULL, /* remove_queue */
149 NULL, /* signaled */
150 NULL, /* satisfied */
151 no_signal, /* signal */
152 no_get_fd, /* get_fd */
153 token_map_access, /* map_access */
154 default_get_sd, /* get_sd */
155 default_set_sd, /* set_sd */
156 no_get_full_name, /* get_full_name */
157 no_lookup_name, /* lookup_name */
158 no_link_name, /* link_name */
159 NULL, /* unlink_name */
160 no_open_file, /* open_file */
161 no_kernel_obj_list, /* get_kernel_obj_list */
162 no_close_handle, /* close_handle */
163 token_destroy /* destroy */
164 };
165
166 static void token_dump( struct object *obj, int verbose )
167 {
168 struct token *token = (struct token *)obj;
169 assert( obj->ops == &token_ops );
170 fprintf( stderr, "Token id=%d.%u primary=%u impersonation level=%d\n", token->token_id.high_part,
171 token->token_id.low_part, token->primary, token->impersonation_level );
172 }
173
174 static struct object_type *token_get_type( struct object *obj )
175 {
176 static const WCHAR name[] = {'T','o','k','e','n'};
177 static const struct unicode_str str = { name, sizeof(name) };
178 return get_object_type( &str );
179 }
180
181 static unsigned int token_map_access( struct object *obj, unsigned int access )
182 {
183 if (access & GENERIC_READ) access |= TOKEN_READ;
184 if (access & GENERIC_WRITE) access |= TOKEN_WRITE;
185 if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
186 if (access & GENERIC_ALL) access |= TOKEN_ALL_ACCESS;
187 return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
188 }
189
190 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
191 {
192 int i;
193 SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
194 if (!sid) return NULL;
195 sid->Revision = SID_REVISION;
196 sid->SubAuthorityCount = subauthcount;
197 sid->IdentifierAuthority = *idauthority;
198 for (i = 0; i < subauthcount; i++)
199 sid->SubAuthority[i] = subauth[i];
200 return sid;
201 }
202
203 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
204 {
205 if (!handle)
206 {
207 if (thread->token)
208 release_object( thread->token );
209 thread->token = NULL;
210 }
211 else
212 {
213 struct token *token = (struct token *)get_handle_obj( current->process,
214 handle,
215 TOKEN_IMPERSONATE,
216 &token_ops );
217 if (token)
218 {
219 if (thread->token)
220 release_object( thread->token );
221 thread->token = token;
222 }
223 }
224 }
225
226 const SID *security_unix_uid_to_sid( uid_t uid )
227 {
228 /* very simple mapping: either the current user or not the current user */
229 if (uid == getuid())
230 return (const SID *)&local_user_sid;
231 else
232 return &anonymous_logon_sid;
233 }
234
235 static int acl_is_valid( const ACL *acl, data_size_t size )
236 {
237 ULONG i;
238 const ACE_HEADER *ace;
239
240 if (size < sizeof(ACL))
241 return FALSE;
242
243 size = min(size, MAX_ACL_LEN);
244
245 size -= sizeof(ACL);
246
247 ace = (const ACE_HEADER *)(acl + 1);
248 for (i = 0; i < acl->AceCount; i++)
249 {
250 const SID *sid;
251 data_size_t sid_size;
252
253 if (size < sizeof(ACE_HEADER))
254 return FALSE;
255 if (size < ace->AceSize)
256 return FALSE;
257 size -= ace->AceSize;
258 switch (ace->AceType)
259 {
260 case ACCESS_DENIED_ACE_TYPE:
261 sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
262 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
263 break;
264 case ACCESS_ALLOWED_ACE_TYPE:
265 sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
266 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
267 break;
268 case SYSTEM_AUDIT_ACE_TYPE:
269 sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
270 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
271 break;
272 case SYSTEM_ALARM_ACE_TYPE:
273 sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
274 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
275 break;
276 case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
277 sid = (const SID *)&((const SYSTEM_MANDATORY_LABEL_ACE *)ace)->SidStart;
278 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart);
279 break;
280 default:
281 return FALSE;
282 }
283 if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
284 return FALSE;
285 ace = ace_next( ace );
286 }
287 return TRUE;
288 }
289
290 static unsigned int get_sid_count( const SID *sid, data_size_t size )
291 {
292 unsigned int count;
293
294 for (count = 0; size >= sizeof(SID) && security_sid_len( sid ) <= size; count++)
295 {
296 size -= security_sid_len( sid );
297 sid = (const SID *)((char *)sid + security_sid_len( sid ));
298 }
299
300 return count;
301 }
302
303 /* checks whether all members of a security descriptor fit inside the size
304 * of memory specified */
305 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
306 {
307 size_t offset = sizeof(struct security_descriptor);
308 const SID *group;
309 const SID *owner;
310 const ACL *sacl;
311 const ACL *dacl;
312 int dummy;
313
314 if (size < offset)
315 return FALSE;
316
317 if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
318 (offset + sd->owner_len > size))
319 return FALSE;
320 owner = sd_get_owner( sd );
321 if (owner)
322 {
323 if ((sd->owner_len < sizeof(SID)) || (security_sid_len( owner ) > sd->owner_len))
324 return FALSE;
325 }
326 offset += sd->owner_len;
327
328 if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
329 (offset + sd->group_len > size))
330 return FALSE;
331 group = sd_get_group( sd );
332 if (group)
333 {
334 if ((sd->group_len < sizeof(SID)) || (security_sid_len( group ) > sd->group_len))
335 return FALSE;
336 }
337 offset += sd->group_len;
338
339 if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
340 return FALSE;
341 sacl = sd_get_sacl( sd, &dummy );
342 if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
343 return FALSE;
344 offset += sd->sacl_len;
345
346 if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
347 return FALSE;
348 dacl = sd_get_dacl( sd, &dummy );
349 if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
350 return FALSE;
351 offset += sd->dacl_len;
352
353 return TRUE;
354 }
355
356 /* extract security labels from SACL */
357 ACL *extract_security_labels( const ACL *sacl )
358 {
359 size_t size = sizeof(ACL);
360 const ACE_HEADER *ace;
361 ACE_HEADER *label_ace;
362 unsigned int i, count = 0;
363 ACL *label_acl;
364
365 ace = (const ACE_HEADER *)(sacl + 1);
366 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
367 {
368 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
369 {
370 size += ace->AceSize;
371 count++;
372 }
373 }
374
375 label_acl = mem_alloc( size );
376 if (!label_acl) return NULL;
377
378 label_acl->AclRevision = sacl->AclRevision;
379 label_acl->Sbz1 = 0;
380 label_acl->AclSize = size;
381 label_acl->AceCount = count;
382 label_acl->Sbz2 = 0;
383 label_ace = (ACE_HEADER *)(label_acl + 1);
384
385 ace = (const ACE_HEADER *)(sacl + 1);
386 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
387 {
388 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
389 {
390 memcpy( label_ace, ace, ace->AceSize );
391 label_ace = (ACE_HEADER *)ace_next( label_ace );
392 }
393 }
394 return label_acl;
395 }
396
397 /* replace security labels in an existing SACL */
398 ACL *replace_security_labels( const ACL *old_sacl, const ACL *new_sacl )
399 {
400 const ACE_HEADER *ace;
401 ACE_HEADER *replaced_ace;
402 size_t size = sizeof(ACL);
403 unsigned int i, count = 0;
404 BYTE revision = ACL_REVISION;
405 ACL *replaced_acl;
406
407 if (old_sacl)
408 {
409 revision = max( revision, old_sacl->AclRevision );
410 ace = (const ACE_HEADER *)(old_sacl + 1);
411 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
412 {
413 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
414 size += ace->AceSize;
415 count++;
416 }
417 }
418
419 if (new_sacl)
420 {
421 revision = max( revision, new_sacl->AclRevision );
422 ace = (const ACE_HEADER *)(new_sacl + 1);
423 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
424 {
425 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
426 size += ace->AceSize;
427 count++;
428 }
429 }
430
431 replaced_acl = mem_alloc( size );
432 if (!replaced_acl) return NULL;
433
434 replaced_acl->AclRevision = revision;
435 replaced_acl->Sbz1 = 0;
436 replaced_acl->AclSize = size;
437 replaced_acl->AceCount = count;
438 replaced_acl->Sbz2 = 0;
439 replaced_ace = (ACE_HEADER *)(replaced_acl + 1);
440
441 if (old_sacl)
442 {
443 ace = (const ACE_HEADER *)(old_sacl + 1);
444 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
445 {
446 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
447 memcpy( replaced_ace, ace, ace->AceSize );
448 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
449 }
450 }
451
452 if (new_sacl)
453 {
454 ace = (const ACE_HEADER *)(new_sacl + 1);
455 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
456 {
457 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
458 memcpy( replaced_ace, ace, ace->AceSize );
459 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
460 }
461 }
462
463 return replaced_acl;
464 }
465
466 /* maps from generic rights to specific rights as given by a mapping */
467 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
468 {
469 if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
470 if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
471 if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
472 if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
473 *mask &= 0x0FFFFFFF;
474 }
475
476 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
477 {
478 return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
479 }
480
481 static inline void allocate_luid( luid_t *luid )
482 {
483 prev_luid_value.low_part++;
484 *luid = prev_luid_value;
485 }
486
487 DECL_HANDLER( allocate_locally_unique_id )
488 {
489 allocate_luid( &reply->luid );
490 }
491
492 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
493 {
494 out->Luid = in->luid;
495 out->Attributes =
496 (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
497 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
498 }
499
500 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
501 {
502 struct privilege *privilege = mem_alloc( sizeof(*privilege) );
503 if (privilege)
504 {
505 privilege->luid = *luid;
506 privilege->def = privilege->enabled = (enabled != 0);
507 list_add_tail( &token->privileges, &privilege->entry );
508 }
509 return privilege;
510 }
511
512 static inline void privilege_remove( struct privilege *privilege )
513 {
514 list_remove( &privilege->entry );
515 free( privilege );
516 }
517
518 static void token_destroy( struct object *obj )
519 {
520 struct token* token;
521 struct list *cursor, *cursor_next;
522
523 assert( obj->ops == &token_ops );
524 token = (struct token *)obj;
525
526 free( token->user );
527
528 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
529 {
530 struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
531 privilege_remove( privilege );
532 }
533
534 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
535 {
536 struct group *group = LIST_ENTRY( cursor, struct group, entry );
537 list_remove( &group->entry );
538 free( group );
539 }
540
541 free( token->default_dacl );
542 }
543
544 /* creates a new token.
545 * groups may be NULL if group_count is 0.
546 * privs may be NULL if priv_count is 0.
547 * default_dacl may be NULL, indicating that all objects created by the user
548 * are unsecured.
549 * modified_id may be NULL, indicating that a new modified_id luid should be
550 * allocated.
551 */
552 static struct token *create_token( unsigned primary, const SID *user,
553 const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
554 const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
555 const ACL *default_dacl, TOKEN_SOURCE source,
556 const luid_t *modified_id,
557 int impersonation_level )
558 {
559 struct token *token = alloc_object( &token_ops );
560 if (token)
561 {
562 unsigned int i;
563
564 allocate_luid( &token->token_id );
565 if (modified_id)
566 token->modified_id = *modified_id;
567 else
568 allocate_luid( &token->modified_id );
569 list_init( &token->privileges );
570 list_init( &token->groups );
571 token->primary = primary;
572 /* primary tokens don't have impersonation levels */
573 if (primary)
574 token->impersonation_level = -1;
575 else
576 token->impersonation_level = impersonation_level;
577 token->default_dacl = NULL;
578 token->primary_group = NULL;
579
580 /* copy user */
581 token->user = memdup( user, security_sid_len( user ));
582 if (!token->user)
583 {
584 release_object( token );
585 return NULL;
586 }
587
588 /* copy groups */
589 for (i = 0; i < group_count; i++)
590 {
591 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
592 struct group *group = mem_alloc( size );
593
594 if (!group)
595 {
596 release_object( token );
597 return NULL;
598 }
599 memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
600 group->enabled = TRUE;
601 group->def = TRUE;
602 group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
603 group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
604 group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
605 group->resource = FALSE;
606 group->deny_only = FALSE;
607 list_add_tail( &token->groups, &group->entry );
608 /* Use first owner capable group as owner and primary group */
609 if (!token->primary_group && group->owner)
610 {
611 token->owner = &group->sid;
612 token->primary_group = &group->sid;
613 }
614 }
615
616 /* copy privileges */
617 for (i = 0; i < priv_count; i++)
618 {
619 /* note: we don't check uniqueness: the caller must make sure
620 * privs doesn't contain any duplicate luids */
621 if (!privilege_add( token, &privs[i].Luid,
622 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
623 {
624 release_object( token );
625 return NULL;
626 }
627 }
628
629 if (default_dacl)
630 {
631 token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
632 if (!token->default_dacl)
633 {
634 release_object( token );
635 return NULL;
636 }
637 }
638
639 token->source = source;
640 }
641 return token;
642 }
643
644 static int filter_group( struct group *group, const SID *filter, unsigned int count )
645 {
646 unsigned int i;
647
648 for (i = 0; i < count; i++)
649 {
650 if (security_equal_sid( &group->sid, filter )) return 1;
651 filter = (const SID *)((char *)filter + security_sid_len( filter ));
652 }
653
654 return 0;
655 }
656
657 static int filter_privilege( struct privilege *privilege, const LUID_AND_ATTRIBUTES *filter, unsigned int count )
658 {
659 unsigned int i;
660
661 for (i = 0; i < count; i++)
662 {
663 if (!memcmp( &privilege->luid, &filter[i].Luid, sizeof(LUID) ))
664 return 1;
665 }
666
667 return 0;
668 }
669
670 struct token *token_duplicate( struct token *src_token, unsigned primary,
671 int impersonation_level, const struct security_descriptor *sd,
672 const LUID_AND_ATTRIBUTES *remove_privs, unsigned int remove_priv_count,
673 const SID *remove_groups, unsigned int remove_group_count)
674 {
675 const luid_t *modified_id =
676 primary || (impersonation_level == src_token->impersonation_level) ?
677 &src_token->modified_id : NULL;
678 struct token *token = NULL;
679 struct privilege *privilege;
680 struct group *group;
681
682 if (!primary &&
683 (impersonation_level < SecurityAnonymous ||
684 impersonation_level > SecurityDelegation ||
685 (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
686 {
687 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
688 return NULL;
689 }
690
691 token = create_token( primary, src_token->user, NULL, 0,
692 NULL, 0, src_token->default_dacl,
693 src_token->source, modified_id,
694 impersonation_level );
695 if (!token) return token;
696
697 /* copy groups */
698 token->primary_group = NULL;
699 LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
700 {
701 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
702 struct group *newgroup = mem_alloc( size );
703 if (!newgroup)
704 {
705 release_object( token );
706 return NULL;
707 }
708 memcpy( newgroup, group, size );
709 if (filter_group( group, remove_groups, remove_group_count ))
710 {
711 newgroup->enabled = 0;
712 newgroup->def = 0;
713 newgroup->deny_only = 1;
714 }
715 list_add_tail( &token->groups, &newgroup->entry );
716 if (src_token->primary_group == &group->sid)
717 {
718 token->owner = &newgroup->sid;
719 token->primary_group = &newgroup->sid;
720 }
721 }
722 assert( token->primary_group );
723
724 /* copy privileges */
725 LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
726 {
727 if (filter_privilege( privilege, remove_privs, remove_priv_count )) continue;
728 if (!privilege_add( token, &privilege->luid, privilege->enabled ))
729 {
730 release_object( token );
731 return NULL;
732 }
733 }
734
735 if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
736 DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
737
738 return token;
739 }
740
741 static ACL *create_default_dacl( const SID *user )
742 {
743 ACCESS_ALLOWED_ACE *aaa;
744 ACL *default_dacl;
745 SID *sid;
746 size_t default_dacl_size = sizeof(ACL) +
747 2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
748 sizeof(local_system_sid) +
749 security_sid_len( user );
750
751 default_dacl = mem_alloc( default_dacl_size );
752 if (!default_dacl) return NULL;
753
754 default_dacl->AclRevision = ACL_REVISION;
755 default_dacl->Sbz1 = 0;
756 default_dacl->AclSize = default_dacl_size;
757 default_dacl->AceCount = 2;
758 default_dacl->Sbz2 = 0;
759
760 /* GENERIC_ALL for Local System */
761 aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
762 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
763 aaa->Header.AceFlags = 0;
764 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
765 sizeof(local_system_sid);
766 aaa->Mask = GENERIC_ALL;
767 sid = (SID *)&aaa->SidStart;
768 memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
769
770 /* GENERIC_ALL for specified user */
771 aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
772 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
773 aaa->Header.AceFlags = 0;
774 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
775 aaa->Mask = GENERIC_ALL;
776 sid = (SID *)&aaa->SidStart;
777 memcpy( sid, user, security_sid_len( user ));
778
779 return default_dacl;
780 }
781
782 struct sid_data
783 {
784 SID_IDENTIFIER_AUTHORITY idauth;
785 int count;
786 unsigned int subauth[MAX_SUBAUTH_COUNT];
787 };
788
789 static struct security_descriptor *create_security_label_sd( struct token *token, PSID label_sid )
790 {
791 size_t sid_len = security_sid_len( label_sid ), sacl_size, sd_size;
792 SYSTEM_MANDATORY_LABEL_ACE *smla;
793 struct security_descriptor *sd;
794 ACL *sacl;
795
796 sacl_size = sizeof(ACL) + FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
797 sd_size = sizeof(struct security_descriptor) + sacl_size;
798 if (!(sd = mem_alloc( sd_size )))
799 return NULL;
800
801 sd->control = SE_SACL_PRESENT;
802 sd->owner_len = 0;
803 sd->group_len = 0;
804 sd->sacl_len = sacl_size;
805 sd->dacl_len = 0;
806
807 sacl = (ACL *)(sd + 1);
808 sacl->AclRevision = ACL_REVISION;
809 sacl->Sbz1 = 0;
810 sacl->AclSize = sacl_size;
811 sacl->AceCount = 1;
812 sacl->Sbz2 = 0;
813
814 smla = (SYSTEM_MANDATORY_LABEL_ACE *)(sacl + 1);
815 smla->Header.AceType = SYSTEM_MANDATORY_LABEL_ACE_TYPE;
816 smla->Header.AceFlags = 0;
817 smla->Header.AceSize = FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
818 smla->Mask = SYSTEM_MANDATORY_LABEL_NO_WRITE_UP;
819 memcpy( &smla->SidStart, label_sid, sid_len );
820
821 assert( sd_is_valid( sd, sd_size ) );
822 return sd;
823 }
824
825 int token_assign_label( struct token *token, PSID label )
826 {
827 struct security_descriptor *sd;
828 int ret = 0;
829
830 if ((sd = create_security_label_sd( token, label )))
831 {
832 ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
833 free( sd );
834 }
835
836 return ret;
837 }
838
839 struct token *get_token_obj( struct process *process, obj_handle_t handle, unsigned int access )
840 {
841 return (struct token *)get_handle_obj( process, handle, access, &token_ops );
842 }
843
844 struct token *token_create_admin( void )
845 {
846 struct token *token = NULL;
847 static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
848 static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
849 static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
850 /* on Windows, this value changes every time the user logs on */
851 static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
852 PSID alias_admins_sid;
853 PSID alias_users_sid;
854 PSID logon_sid;
855 const SID *user_sid = security_unix_uid_to_sid( getuid() );
856 ACL *default_dacl = create_default_dacl( user_sid );
857
858 alias_admins_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_admins_subauth ),
859 alias_admins_subauth );
860 alias_users_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_users_subauth ),
861 alias_users_subauth );
862 logon_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( logon_subauth ), logon_subauth );
863
864 if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
865 {
866 const LUID_AND_ATTRIBUTES admin_privs[] =
867 {
868 { SeChangeNotifyPrivilege , SE_PRIVILEGE_ENABLED },
869 { SeTcbPrivilege , 0 },
870 { SeSecurityPrivilege , 0 },
871 { SeBackupPrivilege , 0 },
872 { SeRestorePrivilege , 0 },
873 { SeSystemtimePrivilege , 0 },
874 { SeShutdownPrivilege , 0 },
875 { SeRemoteShutdownPrivilege , 0 },
876 { SeTakeOwnershipPrivilege , 0 },
877 { SeDebugPrivilege , 0 },
878 { SeSystemEnvironmentPrivilege , 0 },
879 { SeSystemProfilePrivilege , 0 },
880 { SeProfileSingleProcessPrivilege, 0 },
881 { SeIncreaseBasePriorityPrivilege, 0 },
882 { SeLoadDriverPrivilege , SE_PRIVILEGE_ENABLED },
883 { SeCreatePagefilePrivilege , 0 },
884 { SeIncreaseQuotaPrivilege , 0 },
885 { SeUndockPrivilege , 0 },
886 { SeManageVolumePrivilege , 0 },
887 { SeImpersonatePrivilege , SE_PRIVILEGE_ENABLED },
888 { SeCreateGlobalPrivilege , SE_PRIVILEGE_ENABLED },
889 };
890 /* note: we don't include non-builtin groups here for the user -
891 * telling us these is the job of a client-side program */
892 const SID_AND_ATTRIBUTES admin_groups[] =
893 {
894 { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
895 { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
896 { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
897 { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
898 { security_domain_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
899 { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
900 { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
901 { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
902 };
903 static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
904 token = create_token( TRUE, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
905 admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
906 admin_source, NULL, -1 );
907 /* we really need a primary group */
908 assert( token->primary_group );
909 }
910
911 free( logon_sid );
912 free( alias_admins_sid );
913 free( alias_users_sid );
914 free( default_dacl );
915
916 return token;
917 }
918
919 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
920 {
921 struct privilege *privilege;
922 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
923 {
924 if (is_equal_luid( luid, &privilege->luid ))
925 {
926 if (enabled_only && !privilege->enabled)
927 return NULL;
928 return privilege;
929 }
930 }
931 return NULL;
932 }
933
934 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
935 unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
936 unsigned int mod_privs_count )
937 {
938 unsigned int i, modified_count = 0;
939
940 /* mark as modified */
941 allocate_luid( &token->modified_id );
942
943 for (i = 0; i < count; i++)
944 {
945 struct privilege *privilege =
946 token_find_privilege( token, &privs[i].Luid, FALSE );
947 if (!privilege)
948 {
949 set_error( STATUS_NOT_ALL_ASSIGNED );
950 continue;
951 }
952
953 if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
954 privilege_remove( privilege );
955 else
956 {
957 /* save previous state for caller */
958 if (mod_privs_count)
959 {
960 luid_and_attr_from_privilege(mod_privs, privilege);
961 mod_privs++;
962 mod_privs_count--;
963 modified_count++;
964 }
965
966 if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
967 privilege->enabled = TRUE;
968 else
969 privilege->enabled = FALSE;
970 }
971 }
972 return modified_count;
973 }
974
975 static void token_disable_privileges( struct token *token )
976 {
977 struct privilege *privilege;
978
979 /* mark as modified */
980 allocate_luid( &token->modified_id );
981
982 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
983 privilege->enabled = FALSE;
984 }
985
986 int token_check_privileges( struct token *token, int all_required,
987 const LUID_AND_ATTRIBUTES *reqprivs,
988 unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
989 {
990 unsigned int i, enabled_count = 0;
991
992 for (i = 0; i < count; i++)
993 {
994 struct privilege *privilege =
995 token_find_privilege( token, &reqprivs[i].Luid, TRUE );
996
997 if (usedprivs)
998 usedprivs[i] = reqprivs[i];
999
1000 if (privilege && privilege->enabled)
1001 {
1002 enabled_count++;
1003 if (usedprivs)
1004 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
1005 }
1006 }
1007
1008 if (all_required)
1009 return (enabled_count == count);
1010 else
1011 return (enabled_count > 0);
1012 }
1013
1014 int token_sid_present( struct token *token, const SID *sid, int deny )
1015 {
1016 struct group *group;
1017
1018 if (security_equal_sid( token->user, sid )) return TRUE;
1019
1020 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
1021 {
1022 if (!group->enabled) continue;
1023 if (group->deny_only && !deny) continue;
1024
1025 if (security_equal_sid( &group->sid, sid )) return TRUE;
1026 }
1027
1028 return FALSE;
1029 }
1030
1031 /* Checks access to a security descriptor. 'sd' must have been validated by
1032 * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
1033 * the reason. 'status' parameter will indicate if access is granted or denied.
1034 *
1035 * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
1036 */
1037 static unsigned int token_access_check( struct token *token,
1038 const struct security_descriptor *sd,
1039 unsigned int desired_access,
1040 LUID_AND_ATTRIBUTES *privs,
1041 unsigned int *priv_count,
1042 const GENERIC_MAPPING *mapping,
1043 unsigned int *granted_access,
1044 unsigned int *status )
1045 {
1046 unsigned int current_access = 0;
1047 unsigned int denied_access = 0;
1048 ULONG i;
1049 const ACL *dacl;
1050 int dacl_present;
1051 const ACE_HEADER *ace;
1052 const SID *owner;
1053
1054 /* assume no access rights */
1055 *granted_access = 0;
1056
1057 /* fail if desired_access contains generic rights */
1058 if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
1059 {
1060 if (priv_count) *priv_count = 0;
1061 return STATUS_GENERIC_NOT_MAPPED;
1062 }
1063
1064 dacl = sd_get_dacl( sd, &dacl_present );
1065 owner = sd_get_owner( sd );
1066 if (!owner || !sd_get_group( sd ))
1067 {
1068 if (priv_count) *priv_count = 0;
1069 return STATUS_INVALID_SECURITY_DESCR;
1070 }
1071
1072 /* 1: Grant desired access if the object is unprotected */
1073 if (!dacl_present || !dacl)
1074 {
1075 if (priv_count) *priv_count = 0;
1076 if (desired_access & MAXIMUM_ALLOWED)
1077 *granted_access = mapping->GenericAll;
1078 else
1079 *granted_access = desired_access;
1080 return *status = STATUS_SUCCESS;
1081 }
1082
1083 /* 2: Check if caller wants access to system security part. Note: access
1084 * is only granted if specifically asked for */
1085 if (desired_access & ACCESS_SYSTEM_SECURITY)
1086 {
1087 const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
1088 LUID_AND_ATTRIBUTES retpriv = security_priv;
1089 if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
1090 {
1091 if (priv_count)
1092 {
1093 /* assumes that there will only be one privilege to return */
1094 if (*priv_count >= 1)
1095 {
1096 *priv_count = 1;
1097 *privs = retpriv;
1098 }
1099 else
1100 {
1101 *priv_count = 1;
1102 return STATUS_BUFFER_TOO_SMALL;
1103 }
1104 }
1105 current_access |= ACCESS_SYSTEM_SECURITY;
1106 if (desired_access == current_access)
1107 {
1108 *granted_access = current_access;
1109 return *status = STATUS_SUCCESS;
1110 }
1111 }
1112 else
1113 {
1114 if (priv_count) *priv_count = 0;
1115 *status = STATUS_PRIVILEGE_NOT_HELD;
1116 return STATUS_SUCCESS;
1117 }
1118 }
1119 else if (priv_count) *priv_count = 0;
1120
1121 /* 3: Check whether the token is the owner */
1122 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
1123 * checked when a "set owner" call is made, overriding the access rights
1124 * determined here. */
1125 if (token_sid_present( token, owner, FALSE ))
1126 {
1127 current_access |= (READ_CONTROL | WRITE_DAC);
1128 if (desired_access == current_access)
1129 {
1130 *granted_access = current_access;
1131 return *status = STATUS_SUCCESS;
1132 }
1133 }
1134
1135 /* 4: Grant rights according to the DACL */
1136 ace = (const ACE_HEADER *)(dacl + 1);
1137 for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
1138 {
1139 const ACCESS_ALLOWED_ACE *aa_ace;
1140 const ACCESS_DENIED_ACE *ad_ace;
1141 const SID *sid;
1142
1143 if (ace->AceFlags & INHERIT_ONLY_ACE)
1144 continue;
1145
1146 switch (ace->AceType)
1147 {
1148 case ACCESS_DENIED_ACE_TYPE:
1149 ad_ace = (const ACCESS_DENIED_ACE *)ace;
1150 sid = (const SID *)&ad_ace->SidStart;
1151 if (token_sid_present( token, sid, TRUE ))
1152 {
1153 unsigned int access = ad_ace->Mask;
1154 map_generic_mask(&access, mapping);
1155 if (desired_access & MAXIMUM_ALLOWED)
1156 denied_access |= access;
1157 else
1158 {
1159 denied_access |= (access & ~current_access);
1160 if (desired_access & access) goto done;
1161 }
1162 }
1163 break;
1164 case ACCESS_ALLOWED_ACE_TYPE:
1165 aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
1166 sid = (const SID *)&aa_ace->SidStart;
1167 if (token_sid_present( token, sid, FALSE ))
1168 {
1169 unsigned int access = aa_ace->Mask;
1170 map_generic_mask(&access, mapping);
1171 if (desired_access & MAXIMUM_ALLOWED)
1172 current_access |= access;
1173 else
1174 current_access |= (access & ~denied_access);
1175 }
1176 break;
1177 }
1178
1179 /* don't bother carrying on checking if we've already got all of
1180 * rights we need */
1181 if (desired_access == *granted_access)
1182 break;
1183 }
1184
1185 done:
1186 if (desired_access & MAXIMUM_ALLOWED)
1187 *granted_access = current_access & ~denied_access;
1188 else
1189 if ((current_access & desired_access) == desired_access)
1190 *granted_access = current_access & desired_access;
1191 else
1192 *granted_access = 0;
1193
1194 *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1195 return STATUS_SUCCESS;
1196 }
1197
1198 const ACL *token_get_default_dacl( struct token *token )
1199 {
1200 return token->default_dacl;
1201 }
1202
1203 const SID *token_get_user( struct token *token )
1204 {
1205 return token->user;
1206 }
1207
1208 const SID *token_get_primary_group( struct token *token )
1209 {
1210 return token->primary_group;
1211 }
1212
1213 int check_object_access(struct token *token, struct object *obj, unsigned int *access)
1214 {
1215 GENERIC_MAPPING mapping;
1216 unsigned int status;
1217 int res;
1218
1219 if (!token)
1220 token = current->token ? current->token : current->process->token;
1221
1222 mapping.GenericAll = obj->ops->map_access( obj, GENERIC_ALL );
1223
1224 if (!obj->sd)
1225 {
1226 if (*access & MAXIMUM_ALLOWED)
1227 *access = mapping.GenericAll;
1228 return TRUE;
1229 }
1230
1231 mapping.GenericRead = obj->ops->map_access( obj, GENERIC_READ );
1232 mapping.GenericWrite = obj->ops->map_access( obj, GENERIC_WRITE );
1233 mapping.GenericExecute = obj->ops->map_access( obj, GENERIC_EXECUTE );
1234
1235 res = token_access_check( token, obj->sd, *access, NULL, NULL,
1236 &mapping, access, &status ) == STATUS_SUCCESS &&
1237 status == STATUS_SUCCESS;
1238
1239 if (!res) set_error( STATUS_ACCESS_DENIED );
1240 return res;
1241 }
1242
1243
1244 /* open a security token */
1245 DECL_HANDLER(open_token)
1246 {
1247 if (req->flags & OPEN_TOKEN_THREAD)
1248 {
1249 struct thread *thread = get_thread_from_handle( req->handle, 0 );
1250 if (thread)
1251 {
1252 if (thread->token)
1253 {
1254 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1255 set_error( STATUS_CANT_OPEN_ANONYMOUS );
1256 else
1257 reply->token = alloc_handle( current->process, thread->token,
1258 req->access, req->attributes );
1259 }
1260 else
1261 set_error( STATUS_NO_TOKEN );
1262 release_object( thread );
1263 }
1264 }
1265 else
1266 {
1267 struct process *process = get_process_from_handle( req->handle, 0 );
1268 if (process)
1269 {
1270 if (process->token)
1271 reply->token = alloc_handle( current->process, process->token, req->access,
1272 req->attributes );
1273 else
1274 set_error( STATUS_NO_TOKEN );
1275 release_object( process );
1276 }
1277 }
1278 }
1279
1280 /* adjust the privileges held by a token */
1281 DECL_HANDLER(adjust_token_privileges)
1282 {
1283 struct token *token;
1284 unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1285
1286 if (req->get_modified_state) access |= TOKEN_QUERY;
1287
1288 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1289 access, &token_ops )))
1290 {
1291 const LUID_AND_ATTRIBUTES *privs = get_req_data();
1292 LUID_AND_ATTRIBUTES *modified_privs = NULL;
1293 unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1294 unsigned int modified_priv_count = 0;
1295
1296 if (req->get_modified_state && !req->disable_all)
1297 {
1298 unsigned int i;
1299 /* count modified privs */
1300 for (i = 0; i < priv_count; i++)
1301 {
1302 struct privilege *privilege =
1303 token_find_privilege( token, &privs[i].Luid, FALSE );
1304 if (privilege && req->get_modified_state)
1305 modified_priv_count++;
1306 }
1307 reply->len = modified_priv_count;
1308 modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1309 if (modified_priv_count)
1310 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1311 }
1312 reply->len = modified_priv_count * sizeof(*modified_privs);
1313
1314 if (req->disable_all)
1315 token_disable_privileges( token );
1316 else
1317 token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
1318
1319 release_object( token );
1320 }
1321 }
1322
1323 /* retrieves the list of privileges that may be held be the token */
1324 DECL_HANDLER(get_token_privileges)
1325 {
1326 struct token *token;
1327
1328 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1329 TOKEN_QUERY,
1330 &token_ops )))
1331 {
1332 int priv_count = 0;
1333 LUID_AND_ATTRIBUTES *privs;
1334 struct privilege *privilege;
1335
1336 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1337 priv_count++;
1338
1339 reply->len = priv_count * sizeof(*privs);
1340 if (reply->len <= get_reply_max_size())
1341 {
1342 privs = set_reply_data_size( priv_count * sizeof(*privs) );
1343 if (privs)
1344 {
1345 int i = 0;
1346 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1347 {
1348 luid_and_attr_from_privilege( &privs[i], privilege );
1349 i++;
1350 }
1351 }
1352 }
1353 else
1354 set_error(STATUS_BUFFER_TOO_SMALL);
1355
1356 release_object( token );
1357 }
1358 }
1359
1360 /* creates a duplicate of the token */
1361 DECL_HANDLER(duplicate_token)
1362 {
1363 struct token *src_token;
1364 struct unicode_str name;
1365 const struct security_descriptor *sd;
1366 const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
1367
1368 if (!objattr) return;
1369
1370 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1371 TOKEN_DUPLICATE,
1372 &token_ops )))
1373 {
1374 struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd, NULL, 0, NULL, 0 );
1375 if (token)
1376 {
1377 reply->new_handle = alloc_handle_no_access_check( current->process, token, req->access, objattr->attributes );
1378 release_object( token );
1379 }
1380 release_object( src_token );
1381 }
1382 }
1383
1384 /* creates a restricted version of a token */
1385 DECL_HANDLER(filter_token)
1386 {
1387 struct token *src_token;
1388
1389 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_DUPLICATE, &token_ops )))
1390 {
1391 const LUID_AND_ATTRIBUTES *filter_privileges = get_req_data();
1392 unsigned int priv_count, group_count;
1393 const SID *filter_groups;
1394 struct token *token;
1395
1396 priv_count = min( req->privileges_size, get_req_data_size() ) / sizeof(LUID_AND_ATTRIBUTES);
1397 filter_groups = (const SID *)((char *)filter_privileges + priv_count * sizeof(LUID_AND_ATTRIBUTES));
1398 group_count = get_sid_count( filter_groups, get_req_data_size() - priv_count * sizeof(LUID_AND_ATTRIBUTES) );
1399
1400 token = token_duplicate( src_token, src_token->primary, src_token->impersonation_level, NULL,
1401 filter_privileges, priv_count, filter_groups, group_count );
1402 if (token)
1403 {
1404 unsigned int access = get_handle_access( current->process, req->handle );
1405 reply->new_handle = alloc_handle_no_access_check( current->process, token, access, 0 );
1406 release_object( token );
1407 }
1408 release_object( src_token );
1409 }
1410 }
1411
1412 /* checks the specified privileges are held by the token */
1413 DECL_HANDLER(check_token_privileges)
1414 {
1415 struct token *token;
1416
1417 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1418 TOKEN_QUERY,
1419 &token_ops )))
1420 {
1421 unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1422
1423 if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1424 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1425 else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1426 {
1427 LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1428 reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1429 }
1430 else
1431 set_error( STATUS_BUFFER_OVERFLOW );
1432 release_object( token );
1433 }
1434 }
1435
1436 /* checks that a user represented by a token is allowed to access an object
1437 * represented by a security descriptor */
1438 DECL_HANDLER(access_check)
1439 {
1440 data_size_t sd_size = get_req_data_size();
1441 const struct security_descriptor *sd = get_req_data();
1442 struct token *token;
1443
1444 if (!sd_is_valid( sd, sd_size ))
1445 {
1446 set_error( STATUS_ACCESS_VIOLATION );
1447 return;
1448 }
1449
1450 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1451 TOKEN_QUERY,
1452 &token_ops )))
1453 {
1454 GENERIC_MAPPING mapping;
1455 unsigned int status;
1456 LUID_AND_ATTRIBUTES priv;
1457 unsigned int priv_count = 1;
1458
1459 memset(&priv, 0, sizeof(priv));
1460
1461 /* only impersonation tokens may be used with this function */
1462 if (token->primary)
1463 {
1464 set_error( STATUS_NO_IMPERSONATION_TOKEN );
1465 release_object( token );
1466 return;
1467 }
1468 /* anonymous impersonation tokens can't be used */
1469 if (token->impersonation_level <= SecurityAnonymous)
1470 {
1471 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1472 release_object( token );
1473 return;
1474 }
1475
1476 mapping.GenericRead = req->mapping_read;
1477 mapping.GenericWrite = req->mapping_write;
1478 mapping.GenericExecute = req->mapping_execute;
1479 mapping.GenericAll = req->mapping_all;
1480
1481 status = token_access_check(
1482 token, sd, req->desired_access, &priv, &priv_count, &mapping,
1483 &reply->access_granted, &reply->access_status );
1484
1485 reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1486
1487 if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1488 {
1489 LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1490 memcpy( privs, &priv, sizeof(priv) );
1491 }
1492
1493 set_error( status );
1494 release_object( token );
1495 }
1496 }
1497
1498 /* retrieves an SID from the token */
1499 DECL_HANDLER(get_token_sid)
1500 {
1501 struct token *token;
1502
1503 reply->sid_len = 0;
1504
1505 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1506 {
1507 const SID *sid = NULL;
1508
1509 switch (req->which_sid)
1510 {
1511 case TokenUser:
1512 assert(token->user);
1513 sid = token->user;
1514 break;
1515 case TokenPrimaryGroup:
1516 sid = token->primary_group;
1517 break;
1518 case TokenOwner:
1519 sid = token->owner;
1520 break;
1521 case TokenLogonSid:
1522 sid = (const SID *)&builtin_logon_sid;
1523 break;
1524 default:
1525 set_error( STATUS_INVALID_PARAMETER );
1526 break;
1527 }
1528
1529 if (sid)
1530 {
1531 reply->sid_len = security_sid_len( sid );
1532 if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1533 else set_error( STATUS_BUFFER_TOO_SMALL );
1534 }
1535 release_object( token );
1536 }
1537 }
1538
1539 /* retrieves the groups that the user represented by the token belongs to */
1540 DECL_HANDLER(get_token_groups)
1541 {
1542 struct token *token;
1543
1544 reply->user_len = 0;
1545
1546 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1547 TOKEN_QUERY,
1548 &token_ops )))
1549 {
1550 size_t size_needed = sizeof(struct token_groups);
1551 size_t sid_size = 0;
1552 unsigned int group_count = 0;
1553 const struct group *group;
1554
1555 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1556 {
1557 group_count++;
1558 sid_size += security_sid_len( &group->sid );
1559 }
1560 size_needed += sid_size;
1561 /* attributes size */
1562 size_needed += sizeof(unsigned int) * group_count;
1563
1564 /* reply buffer contains size_needed bytes formatted as:
1565
1566 unsigned int count;
1567 unsigned int attrib[count];
1568 char sid_data[];
1569
1570 user_len includes extra data needed for TOKEN_GROUPS representation,
1571 required caller buffer size calculated here to avoid extra server call */
1572 reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1573
1574 if (reply->user_len <= get_reply_max_size())
1575 {
1576 struct token_groups *tg = set_reply_data_size( size_needed );
1577 if (tg)
1578 {
1579 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1580 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1581
1582 tg->count = group_count;
1583
1584 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1585 {
1586
1587 *attr_ptr = 0;
1588 if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1589 if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1590 if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1591 if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1592 if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1593 if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1594 if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1595
1596 memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1597
1598 sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1599 attr_ptr++;
1600 }
1601 }
1602 }
1603 else set_error( STATUS_BUFFER_TOO_SMALL );
1604
1605 release_object( token );
1606 }
1607 }
1608
1609 DECL_HANDLER(get_token_impersonation_level)
1610 {
1611 struct token *token;
1612
1613 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1614 TOKEN_QUERY,
1615 &token_ops )))
1616 {
1617 if (token->primary)
1618 set_error( STATUS_INVALID_PARAMETER );
1619 else
1620 reply->impersonation_level = token->impersonation_level;
1621
1622 release_object( token );
1623 }
1624 }
1625
1626 DECL_HANDLER(get_token_statistics)
1627 {
1628 struct token *token;
1629
1630 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1631 TOKEN_QUERY,
1632 &token_ops )))
1633 {
1634 reply->token_id = token->token_id;
1635 reply->modified_id = token->modified_id;
1636 reply->primary = token->primary;
1637 reply->impersonation_level = token->impersonation_level;
1638 reply->group_count = list_count( &token->groups );
1639 reply->privilege_count = list_count( &token->privileges );
1640
1641 release_object( token );
1642 }
1643 }
1644
1645 DECL_HANDLER(get_token_default_dacl)
1646 {
1647 struct token *token;
1648
1649 reply->acl_len = 0;
1650
1651 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1652 TOKEN_QUERY,
1653 &token_ops )))
1654 {
1655 if (token->default_dacl)
1656 reply->acl_len = token->default_dacl->AclSize;
1657
1658 if (reply->acl_len <= get_reply_max_size())
1659 {
1660 ACL *acl_reply = set_reply_data_size( reply->acl_len );
1661 if (acl_reply)
1662 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1663 }
1664 else set_error( STATUS_BUFFER_TOO_SMALL );
1665
1666 release_object( token );
1667 }
1668 }
1669
1670 DECL_HANDLER(set_token_default_dacl)
1671 {
1672 struct token *token;
1673
1674 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1675 TOKEN_ADJUST_DEFAULT,
1676 &token_ops )))
1677 {
1678 const ACL *acl = get_req_data();
1679 unsigned int acl_size = get_req_data_size();
1680
1681 free( token->default_dacl );
1682 token->default_dacl = NULL;
1683
1684 if (acl_size)
1685 token->default_dacl = memdup( acl, acl_size );
1686
1687 release_object( token );
1688 }
1689 }
Zebediah Figura's local tree