?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ntdll: Fix the Mac build with SDKs older than 10.14.
[wine.git] / server / token.c
blobe0f28c6da6eb206789283089057488125fe5a042
1 /*
2 * Tokens
3 *
4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 */
22
23 #include "config.h"
24
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <stdarg.h>
29 #include <unistd.h>
30
31 #include "ntstatus.h"
32 #define WIN32_NO_STATUS
33 #include "windef.h"
34 #include "winternl.h"
35
36 #include "handle.h"
37 #include "thread.h"
38 #include "process.h"
39 #include "request.h"
40 #include "security.h"
41
42 #include "wine/unicode.h"
43
44 #define MAX_SUBAUTH_COUNT 1
45
46 const LUID SeIncreaseQuotaPrivilege = { 5, 0 };
47 const LUID SeSecurityPrivilege = { 8, 0 };
48 const LUID SeTakeOwnershipPrivilege = { 9, 0 };
49 const LUID SeLoadDriverPrivilege = { 10, 0 };
50 const LUID SeSystemProfilePrivilege = { 11, 0 };
51 const LUID SeSystemtimePrivilege = { 12, 0 };
52 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
53 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
54 const LUID SeCreatePagefilePrivilege = { 15, 0 };
55 const LUID SeBackupPrivilege = { 17, 0 };
56 const LUID SeRestorePrivilege = { 18, 0 };
57 const LUID SeShutdownPrivilege = { 19, 0 };
58 const LUID SeDebugPrivilege = { 20, 0 };
59 const LUID SeSystemEnvironmentPrivilege = { 22, 0 };
60 const LUID SeChangeNotifyPrivilege = { 23, 0 };
61 const LUID SeRemoteShutdownPrivilege = { 24, 0 };
62 const LUID SeUndockPrivilege = { 25, 0 };
63 const LUID SeManageVolumePrivilege = { 28, 0 };
64 const LUID SeImpersonatePrivilege = { 29, 0 };
65 const LUID SeCreateGlobalPrivilege = { 30, 0 };
66
67 #define SID_N(n) struct /* same fields as struct SID */ \
68 { \
69 BYTE Revision; \
70 BYTE SubAuthorityCount; \
71 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
72 DWORD SubAuthority[n]; \
73 }
74
75 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
76 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
77 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
78 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
79 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
80 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
81 static const SID high_label_sid = { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY }, { SECURITY_MANDATORY_HIGH_RID } };
82 static const SID_N(5) local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
83 static const SID_N(2) builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
84 static const SID_N(2) builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
85 static const SID_N(3) builtin_logon_sid = { SID_REVISION, 3, { SECURITY_NT_AUTHORITY }, { SECURITY_LOGON_IDS_RID, 0, 0 } };
86 static const SID_N(5) domain_users_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, DOMAIN_GROUP_RID_USERS } };
87
88 const PSID security_world_sid = (PSID)&world_sid;
89 static const PSID security_local_sid = (PSID)&local_sid;
90 static const PSID security_interactive_sid = (PSID)&interactive_sid;
91 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
92 const PSID security_local_system_sid = (PSID)&local_system_sid;
93 const PSID security_local_user_sid = (PSID)&local_user_sid;
94 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
95 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
96 const PSID security_domain_users_sid = (PSID)&domain_users_sid;
97 const PSID security_high_label_sid = (PSID)&high_label_sid;
98
99 static luid_t prev_luid_value = { 1000, 0 };
100
101 struct token
102 {
103 struct object obj; /* object header */
104 luid_t token_id; /* system-unique id of token */
105 luid_t modified_id; /* new id allocated every time token is modified */
106 struct list privileges; /* privileges available to the token */
107 struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
108 SID *user; /* SID of user this token represents */
109 SID *owner; /* SID of owner (points to user or one of groups) */
110 SID *primary_group; /* SID of user's primary group (points to one of groups) */
111 unsigned primary; /* is this a primary or impersonation token? */
112 ACL *default_dacl; /* the default DACL to assign to objects created by this user */
113 TOKEN_SOURCE source; /* source of the token */
114 int impersonation_level; /* impersonation level this token is capable of if non-primary token */
115 };
116
117 struct privilege
118 {
119 struct list entry;
120 LUID luid;
121 unsigned enabled : 1; /* is the privilege currently enabled? */
122 unsigned def : 1; /* is the privilege enabled by default? */
123 };
124
125 struct group
126 {
127 struct list entry;
128 unsigned enabled : 1; /* is the sid currently enabled? */
129 unsigned def : 1; /* is the sid enabled by default? */
130 unsigned logon : 1; /* is this a logon sid? */
131 unsigned mandatory: 1; /* is this sid always enabled? */
132 unsigned owner : 1; /* can this sid be an owner of an object? */
133 unsigned resource : 1; /* is this a domain-local group? */
134 unsigned deny_only: 1; /* is this a sid that should be use for denying only? */
135 SID sid;
136 };
137
138 static void token_dump( struct object *obj, int verbose );
139 static struct object_type *token_get_type( struct object *obj );
140 static unsigned int token_map_access( struct object *obj, unsigned int access );
141 static void token_destroy( struct object *obj );
142
143 static const struct object_ops token_ops =
144 {
145 sizeof(struct token), /* size */
146 token_dump, /* dump */
147 token_get_type, /* get_type */
148 no_add_queue, /* add_queue */
149 NULL, /* remove_queue */
150 NULL, /* signaled */
151 NULL, /* satisfied */
152 no_signal, /* signal */
153 no_get_fd, /* get_fd */
154 token_map_access, /* map_access */
155 default_get_sd, /* get_sd */
156 default_set_sd, /* set_sd */
157 no_lookup_name, /* lookup_name */
158 no_link_name, /* link_name */
159 NULL, /* unlink_name */
160 no_open_file, /* open_file */
161 no_kernel_obj_list, /* get_kernel_obj_list */
162 no_close_handle, /* close_handle */
163 token_destroy /* destroy */
164 };
165
166 static void token_dump( struct object *obj, int verbose )
167 {
168 struct token *token = (struct token *)obj;
169 assert( obj->ops == &token_ops );
170 fprintf( stderr, "Token id=%d.%u primary=%u impersonation level=%d\n", token->token_id.high_part,
171 token->token_id.low_part, token->primary, token->impersonation_level );
172 }
173
174 static struct object_type *token_get_type( struct object *obj )
175 {
176 static const WCHAR name[] = {'T','o','k','e','n'};
177 static const struct unicode_str str = { name, sizeof(name) };
178 return get_object_type( &str );
179 }
180
181 static unsigned int token_map_access( struct object *obj, unsigned int access )
182 {
183 if (access & GENERIC_READ) access |= TOKEN_READ;
184 if (access & GENERIC_WRITE) access |= TOKEN_WRITE;
185 if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
186 if (access & GENERIC_ALL) access |= TOKEN_ALL_ACCESS;
187 return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
188 }
189
190 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
191 {
192 int i;
193 SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
194 if (!sid) return NULL;
195 sid->Revision = SID_REVISION;
196 sid->SubAuthorityCount = subauthcount;
197 sid->IdentifierAuthority = *idauthority;
198 for (i = 0; i < subauthcount; i++)
199 sid->SubAuthority[i] = subauth[i];
200 return sid;
201 }
202
203 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
204 {
205 if (!handle)
206 {
207 if (thread->token)
208 release_object( thread->token );
209 thread->token = NULL;
210 }
211 else
212 {
213 struct token *token = (struct token *)get_handle_obj( current->process,
214 handle,
215 TOKEN_IMPERSONATE,
216 &token_ops );
217 if (token)
218 {
219 if (thread->token)
220 release_object( thread->token );
221 thread->token = token;
222 }
223 }
224 }
225
226 const SID *security_unix_uid_to_sid( uid_t uid )
227 {
228 /* very simple mapping: either the current user or not the current user */
229 if (uid == getuid())
230 return (const SID *)&local_user_sid;
231 else
232 return &anonymous_logon_sid;
233 }
234
235 static int acl_is_valid( const ACL *acl, data_size_t size )
236 {
237 ULONG i;
238 const ACE_HEADER *ace;
239
240 if (size < sizeof(ACL))
241 return FALSE;
242
243 size = min(size, MAX_ACL_LEN);
244
245 size -= sizeof(ACL);
246
247 ace = (const ACE_HEADER *)(acl + 1);
248 for (i = 0; i < acl->AceCount; i++)
249 {
250 const SID *sid;
251 data_size_t sid_size;
252
253 if (size < sizeof(ACE_HEADER))
254 return FALSE;
255 if (size < ace->AceSize)
256 return FALSE;
257 size -= ace->AceSize;
258 switch (ace->AceType)
259 {
260 case ACCESS_DENIED_ACE_TYPE:
261 sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
262 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
263 break;
264 case ACCESS_ALLOWED_ACE_TYPE:
265 sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
266 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
267 break;
268 case SYSTEM_AUDIT_ACE_TYPE:
269 sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
270 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
271 break;
272 case SYSTEM_ALARM_ACE_TYPE:
273 sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
274 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
275 break;
276 case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
277 sid = (const SID *)&((const SYSTEM_MANDATORY_LABEL_ACE *)ace)->SidStart;
278 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart);
279 break;
280 default:
281 return FALSE;
282 }
283 if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
284 return FALSE;
285 ace = ace_next( ace );
286 }
287 return TRUE;
288 }
289
290 /* checks whether all members of a security descriptor fit inside the size
291 * of memory specified */
292 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
293 {
294 size_t offset = sizeof(struct security_descriptor);
295 const SID *group;
296 const SID *owner;
297 const ACL *sacl;
298 const ACL *dacl;
299 int dummy;
300
301 if (size < offset)
302 return FALSE;
303
304 if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
305 (offset + sd->owner_len > size))
306 return FALSE;
307 owner = sd_get_owner( sd );
308 if (owner)
309 {
310 if ((sd->owner_len < sizeof(SID)) || (security_sid_len( owner ) > sd->owner_len))
311 return FALSE;
312 }
313 offset += sd->owner_len;
314
315 if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
316 (offset + sd->group_len > size))
317 return FALSE;
318 group = sd_get_group( sd );
319 if (group)
320 {
321 if ((sd->group_len < sizeof(SID)) || (security_sid_len( group ) > sd->group_len))
322 return FALSE;
323 }
324 offset += sd->group_len;
325
326 if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
327 return FALSE;
328 sacl = sd_get_sacl( sd, &dummy );
329 if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
330 return FALSE;
331 offset += sd->sacl_len;
332
333 if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
334 return FALSE;
335 dacl = sd_get_dacl( sd, &dummy );
336 if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
337 return FALSE;
338 offset += sd->dacl_len;
339
340 return TRUE;
341 }
342
343 /* extract security labels from SACL */
344 ACL *extract_security_labels( const ACL *sacl )
345 {
346 size_t size = sizeof(ACL);
347 const ACE_HEADER *ace;
348 ACE_HEADER *label_ace;
349 unsigned int i, count = 0;
350 ACL *label_acl;
351
352 ace = (const ACE_HEADER *)(sacl + 1);
353 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
354 {
355 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
356 {
357 size += ace->AceSize;
358 count++;
359 }
360 }
361
362 label_acl = mem_alloc( size );
363 if (!label_acl) return NULL;
364
365 label_acl->AclRevision = sacl->AclRevision;
366 label_acl->Sbz1 = 0;
367 label_acl->AclSize = size;
368 label_acl->AceCount = count;
369 label_acl->Sbz2 = 0;
370 label_ace = (ACE_HEADER *)(label_acl + 1);
371
372 ace = (const ACE_HEADER *)(sacl + 1);
373 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
374 {
375 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
376 {
377 memcpy( label_ace, ace, ace->AceSize );
378 label_ace = (ACE_HEADER *)ace_next( label_ace );
379 }
380 }
381 return label_acl;
382 }
383
384 /* replace security labels in an existing SACL */
385 ACL *replace_security_labels( const ACL *old_sacl, const ACL *new_sacl )
386 {
387 const ACE_HEADER *ace;
388 ACE_HEADER *replaced_ace;
389 size_t size = sizeof(ACL);
390 unsigned int i, count = 0;
391 BYTE revision = ACL_REVISION;
392 ACL *replaced_acl;
393
394 if (old_sacl)
395 {
396 revision = max( revision, old_sacl->AclRevision );
397 ace = (const ACE_HEADER *)(old_sacl + 1);
398 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
399 {
400 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
401 size += ace->AceSize;
402 count++;
403 }
404 }
405
406 if (new_sacl)
407 {
408 revision = max( revision, new_sacl->AclRevision );
409 ace = (const ACE_HEADER *)(new_sacl + 1);
410 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
411 {
412 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
413 size += ace->AceSize;
414 count++;
415 }
416 }
417
418 replaced_acl = mem_alloc( size );
419 if (!replaced_acl) return NULL;
420
421 replaced_acl->AclRevision = revision;
422 replaced_acl->Sbz1 = 0;
423 replaced_acl->AclSize = size;
424 replaced_acl->AceCount = count;
425 replaced_acl->Sbz2 = 0;
426 replaced_ace = (ACE_HEADER *)(replaced_acl + 1);
427
428 if (old_sacl)
429 {
430 ace = (const ACE_HEADER *)(old_sacl + 1);
431 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
432 {
433 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
434 memcpy( replaced_ace, ace, ace->AceSize );
435 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
436 }
437 }
438
439 if (new_sacl)
440 {
441 ace = (const ACE_HEADER *)(new_sacl + 1);
442 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
443 {
444 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
445 memcpy( replaced_ace, ace, ace->AceSize );
446 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
447 }
448 }
449
450 return replaced_acl;
451 }
452
453 /* maps from generic rights to specific rights as given by a mapping */
454 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
455 {
456 if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
457 if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
458 if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
459 if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
460 *mask &= 0x0FFFFFFF;
461 }
462
463 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
464 {
465 return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
466 }
467
468 static inline void allocate_luid( luid_t *luid )
469 {
470 prev_luid_value.low_part++;
471 *luid = prev_luid_value;
472 }
473
474 DECL_HANDLER( allocate_locally_unique_id )
475 {
476 allocate_luid( &reply->luid );
477 }
478
479 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
480 {
481 out->Luid = in->luid;
482 out->Attributes =
483 (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
484 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
485 }
486
487 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
488 {
489 struct privilege *privilege = mem_alloc( sizeof(*privilege) );
490 if (privilege)
491 {
492 privilege->luid = *luid;
493 privilege->def = privilege->enabled = (enabled != 0);
494 list_add_tail( &token->privileges, &privilege->entry );
495 }
496 return privilege;
497 }
498
499 static inline void privilege_remove( struct privilege *privilege )
500 {
501 list_remove( &privilege->entry );
502 free( privilege );
503 }
504
505 static void token_destroy( struct object *obj )
506 {
507 struct token* token;
508 struct list *cursor, *cursor_next;
509
510 assert( obj->ops == &token_ops );
511 token = (struct token *)obj;
512
513 free( token->user );
514
515 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
516 {
517 struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
518 privilege_remove( privilege );
519 }
520
521 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
522 {
523 struct group *group = LIST_ENTRY( cursor, struct group, entry );
524 list_remove( &group->entry );
525 free( group );
526 }
527
528 free( token->default_dacl );
529 }
530
531 /* creates a new token.
532 * groups may be NULL if group_count is 0.
533 * privs may be NULL if priv_count is 0.
534 * default_dacl may be NULL, indicating that all objects created by the user
535 * are unsecured.
536 * modified_id may be NULL, indicating that a new modified_id luid should be
537 * allocated.
538 */
539 static struct token *create_token( unsigned primary, const SID *user,
540 const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
541 const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
542 const ACL *default_dacl, TOKEN_SOURCE source,
543 const luid_t *modified_id,
544 int impersonation_level )
545 {
546 struct token *token = alloc_object( &token_ops );
547 if (token)
548 {
549 unsigned int i;
550
551 allocate_luid( &token->token_id );
552 if (modified_id)
553 token->modified_id = *modified_id;
554 else
555 allocate_luid( &token->modified_id );
556 list_init( &token->privileges );
557 list_init( &token->groups );
558 token->primary = primary;
559 /* primary tokens don't have impersonation levels */
560 if (primary)
561 token->impersonation_level = -1;
562 else
563 token->impersonation_level = impersonation_level;
564 token->default_dacl = NULL;
565 token->primary_group = NULL;
566
567 /* copy user */
568 token->user = memdup( user, security_sid_len( user ));
569 if (!token->user)
570 {
571 release_object( token );
572 return NULL;
573 }
574
575 /* copy groups */
576 for (i = 0; i < group_count; i++)
577 {
578 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
579 struct group *group = mem_alloc( size );
580
581 if (!group)
582 {
583 release_object( token );
584 return NULL;
585 }
586 memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
587 group->enabled = TRUE;
588 group->def = TRUE;
589 group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
590 group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
591 group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
592 group->resource = FALSE;
593 group->deny_only = FALSE;
594 list_add_tail( &token->groups, &group->entry );
595 /* Use first owner capable group as owner and primary group */
596 if (!token->primary_group && group->owner)
597 {
598 token->owner = &group->sid;
599 token->primary_group = &group->sid;
600 }
601 }
602
603 /* copy privileges */
604 for (i = 0; i < priv_count; i++)
605 {
606 /* note: we don't check uniqueness: the caller must make sure
607 * privs doesn't contain any duplicate luids */
608 if (!privilege_add( token, &privs[i].Luid,
609 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
610 {
611 release_object( token );
612 return NULL;
613 }
614 }
615
616 if (default_dacl)
617 {
618 token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
619 if (!token->default_dacl)
620 {
621 release_object( token );
622 return NULL;
623 }
624 }
625
626 token->source = source;
627 }
628 return token;
629 }
630
631 struct token *token_duplicate( struct token *src_token, unsigned primary,
632 int impersonation_level, const struct security_descriptor *sd )
633 {
634 const luid_t *modified_id =
635 primary || (impersonation_level == src_token->impersonation_level) ?
636 &src_token->modified_id : NULL;
637 struct token *token = NULL;
638 struct privilege *privilege;
639 struct group *group;
640
641 if (!primary &&
642 (impersonation_level < SecurityAnonymous ||
643 impersonation_level > SecurityDelegation ||
644 (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
645 {
646 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
647 return NULL;
648 }
649
650 token = create_token( primary, src_token->user, NULL, 0,
651 NULL, 0, src_token->default_dacl,
652 src_token->source, modified_id,
653 impersonation_level );
654 if (!token) return token;
655
656 /* copy groups */
657 token->primary_group = NULL;
658 LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
659 {
660 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
661 struct group *newgroup = mem_alloc( size );
662 if (!newgroup)
663 {
664 release_object( token );
665 return NULL;
666 }
667 memcpy( newgroup, group, size );
668 list_add_tail( &token->groups, &newgroup->entry );
669 if (src_token->primary_group == &group->sid)
670 {
671 token->owner = &newgroup->sid;
672 token->primary_group = &newgroup->sid;
673 }
674 }
675 assert( token->primary_group );
676
677 /* copy privileges */
678 LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
679 if (!privilege_add( token, &privilege->luid, privilege->enabled ))
680 {
681 release_object( token );
682 return NULL;
683 }
684
685 if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
686 DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
687
688 return token;
689 }
690
691 static ACL *create_default_dacl( const SID *user )
692 {
693 ACCESS_ALLOWED_ACE *aaa;
694 ACL *default_dacl;
695 SID *sid;
696 size_t default_dacl_size = sizeof(ACL) +
697 2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
698 sizeof(local_system_sid) +
699 security_sid_len( user );
700
701 default_dacl = mem_alloc( default_dacl_size );
702 if (!default_dacl) return NULL;
703
704 default_dacl->AclRevision = ACL_REVISION;
705 default_dacl->Sbz1 = 0;
706 default_dacl->AclSize = default_dacl_size;
707 default_dacl->AceCount = 2;
708 default_dacl->Sbz2 = 0;
709
710 /* GENERIC_ALL for Local System */
711 aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
712 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
713 aaa->Header.AceFlags = 0;
714 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
715 sizeof(local_system_sid);
716 aaa->Mask = GENERIC_ALL;
717 sid = (SID *)&aaa->SidStart;
718 memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
719
720 /* GENERIC_ALL for specified user */
721 aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
722 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
723 aaa->Header.AceFlags = 0;
724 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
725 aaa->Mask = GENERIC_ALL;
726 sid = (SID *)&aaa->SidStart;
727 memcpy( sid, user, security_sid_len( user ));
728
729 return default_dacl;
730 }
731
732 struct sid_data
733 {
734 SID_IDENTIFIER_AUTHORITY idauth;
735 int count;
736 unsigned int subauth[MAX_SUBAUTH_COUNT];
737 };
738
739 static struct security_descriptor *create_security_label_sd( struct token *token, PSID label_sid )
740 {
741 size_t sid_len = security_sid_len( label_sid ), sacl_size, sd_size;
742 SYSTEM_MANDATORY_LABEL_ACE *smla;
743 struct security_descriptor *sd;
744 ACL *sacl;
745
746 sacl_size = sizeof(ACL) + FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
747 sd_size = sizeof(struct security_descriptor) + sacl_size;
748 if (!(sd = mem_alloc( sd_size )))
749 return NULL;
750
751 sd->control = SE_SACL_PRESENT;
752 sd->owner_len = 0;
753 sd->group_len = 0;
754 sd->sacl_len = sacl_size;
755 sd->dacl_len = 0;
756
757 sacl = (ACL *)(sd + 1);
758 sacl->AclRevision = ACL_REVISION;
759 sacl->Sbz1 = 0;
760 sacl->AclSize = sacl_size;
761 sacl->AceCount = 1;
762 sacl->Sbz2 = 0;
763
764 smla = (SYSTEM_MANDATORY_LABEL_ACE *)(sacl + 1);
765 smla->Header.AceType = SYSTEM_MANDATORY_LABEL_ACE_TYPE;
766 smla->Header.AceFlags = 0;
767 smla->Header.AceSize = FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
768 smla->Mask = SYSTEM_MANDATORY_LABEL_NO_WRITE_UP;
769 memcpy( &smla->SidStart, label_sid, sid_len );
770
771 assert( sd_is_valid( sd, sd_size ) );
772 return sd;
773 }
774
775 int token_assign_label( struct token *token, PSID label )
776 {
777 struct security_descriptor *sd;
778 int ret = 0;
779
780 if ((sd = create_security_label_sd( token, label )))
781 {
782 ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
783 free( sd );
784 }
785
786 return ret;
787 }
788
789 struct token *token_create_admin( void )
790 {
791 struct token *token = NULL;
792 static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
793 static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
794 static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
795 /* on Windows, this value changes every time the user logs on */
796 static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
797 PSID alias_admins_sid;
798 PSID alias_users_sid;
799 PSID logon_sid;
800 const SID *user_sid = security_unix_uid_to_sid( getuid() );
801 ACL *default_dacl = create_default_dacl( user_sid );
802
803 alias_admins_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_admins_subauth ),
804 alias_admins_subauth );
805 alias_users_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_users_subauth ),
806 alias_users_subauth );
807 logon_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( logon_subauth ), logon_subauth );
808
809 if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
810 {
811 const LUID_AND_ATTRIBUTES admin_privs[] =
812 {
813 { SeChangeNotifyPrivilege , SE_PRIVILEGE_ENABLED },
814 { SeSecurityPrivilege , 0 },
815 { SeBackupPrivilege , 0 },
816 { SeRestorePrivilege , 0 },
817 { SeSystemtimePrivilege , 0 },
818 { SeShutdownPrivilege , 0 },
819 { SeRemoteShutdownPrivilege , 0 },
820 { SeTakeOwnershipPrivilege , 0 },
821 { SeDebugPrivilege , 0 },
822 { SeSystemEnvironmentPrivilege , 0 },
823 { SeSystemProfilePrivilege , 0 },
824 { SeProfileSingleProcessPrivilege, 0 },
825 { SeIncreaseBasePriorityPrivilege, 0 },
826 { SeLoadDriverPrivilege , SE_PRIVILEGE_ENABLED },
827 { SeCreatePagefilePrivilege , 0 },
828 { SeIncreaseQuotaPrivilege , 0 },
829 { SeUndockPrivilege , 0 },
830 { SeManageVolumePrivilege , 0 },
831 { SeImpersonatePrivilege , SE_PRIVILEGE_ENABLED },
832 { SeCreateGlobalPrivilege , SE_PRIVILEGE_ENABLED },
833 };
834 /* note: we don't include non-builtin groups here for the user -
835 * telling us these is the job of a client-side program */
836 const SID_AND_ATTRIBUTES admin_groups[] =
837 {
838 { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
839 { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
840 { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
841 { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
842 { security_domain_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
843 { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
844 { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
845 { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
846 };
847 static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
848 token = create_token( TRUE, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
849 admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
850 admin_source, NULL, -1 );
851 /* we really need a primary group */
852 assert( token->primary_group );
853 }
854
855 free( logon_sid );
856 free( alias_admins_sid );
857 free( alias_users_sid );
858 free( default_dacl );
859
860 return token;
861 }
862
863 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
864 {
865 struct privilege *privilege;
866 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
867 {
868 if (is_equal_luid( luid, &privilege->luid ))
869 {
870 if (enabled_only && !privilege->enabled)
871 return NULL;
872 return privilege;
873 }
874 }
875 return NULL;
876 }
877
878 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
879 unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
880 unsigned int mod_privs_count )
881 {
882 unsigned int i, modified_count = 0;
883
884 /* mark as modified */
885 allocate_luid( &token->modified_id );
886
887 for (i = 0; i < count; i++)
888 {
889 struct privilege *privilege =
890 token_find_privilege( token, &privs[i].Luid, FALSE );
891 if (!privilege)
892 {
893 set_error( STATUS_NOT_ALL_ASSIGNED );
894 continue;
895 }
896
897 if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
898 privilege_remove( privilege );
899 else
900 {
901 /* save previous state for caller */
902 if (mod_privs_count)
903 {
904 luid_and_attr_from_privilege(mod_privs, privilege);
905 mod_privs++;
906 mod_privs_count--;
907 modified_count++;
908 }
909
910 if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
911 privilege->enabled = TRUE;
912 else
913 privilege->enabled = FALSE;
914 }
915 }
916 return modified_count;
917 }
918
919 static void token_disable_privileges( struct token *token )
920 {
921 struct privilege *privilege;
922
923 /* mark as modified */
924 allocate_luid( &token->modified_id );
925
926 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
927 privilege->enabled = FALSE;
928 }
929
930 int token_check_privileges( struct token *token, int all_required,
931 const LUID_AND_ATTRIBUTES *reqprivs,
932 unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
933 {
934 unsigned int i, enabled_count = 0;
935
936 for (i = 0; i < count; i++)
937 {
938 struct privilege *privilege =
939 token_find_privilege( token, &reqprivs[i].Luid, TRUE );
940
941 if (usedprivs)
942 usedprivs[i] = reqprivs[i];
943
944 if (privilege && privilege->enabled)
945 {
946 enabled_count++;
947 if (usedprivs)
948 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
949 }
950 }
951
952 if (all_required)
953 return (enabled_count == count);
954 else
955 return (enabled_count > 0);
956 }
957
958 int token_sid_present( struct token *token, const SID *sid, int deny )
959 {
960 struct group *group;
961
962 if (security_equal_sid( token->user, sid )) return TRUE;
963
964 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
965 {
966 if (!group->enabled) continue;
967 if (group->deny_only && !deny) continue;
968
969 if (security_equal_sid( &group->sid, sid )) return TRUE;
970 }
971
972 return FALSE;
973 }
974
975 /* Checks access to a security descriptor. 'sd' must have been validated by
976 * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
977 * the reason. 'status' parameter will indicate if access is granted or denied.
978 *
979 * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
980 */
981 static unsigned int token_access_check( struct token *token,
982 const struct security_descriptor *sd,
983 unsigned int desired_access,
984 LUID_AND_ATTRIBUTES *privs,
985 unsigned int *priv_count,
986 const GENERIC_MAPPING *mapping,
987 unsigned int *granted_access,
988 unsigned int *status )
989 {
990 unsigned int current_access = 0;
991 unsigned int denied_access = 0;
992 ULONG i;
993 const ACL *dacl;
994 int dacl_present;
995 const ACE_HEADER *ace;
996 const SID *owner;
997
998 /* assume no access rights */
999 *granted_access = 0;
1000
1001 /* fail if desired_access contains generic rights */
1002 if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
1003 {
1004 if (priv_count) *priv_count = 0;
1005 return STATUS_GENERIC_NOT_MAPPED;
1006 }
1007
1008 dacl = sd_get_dacl( sd, &dacl_present );
1009 owner = sd_get_owner( sd );
1010 if (!owner || !sd_get_group( sd ))
1011 {
1012 if (priv_count) *priv_count = 0;
1013 return STATUS_INVALID_SECURITY_DESCR;
1014 }
1015
1016 /* 1: Grant desired access if the object is unprotected */
1017 if (!dacl_present || !dacl)
1018 {
1019 if (priv_count) *priv_count = 0;
1020 if (desired_access & MAXIMUM_ALLOWED)
1021 *granted_access = mapping->GenericAll;
1022 else
1023 *granted_access = desired_access;
1024 return *status = STATUS_SUCCESS;
1025 }
1026
1027 /* 2: Check if caller wants access to system security part. Note: access
1028 * is only granted if specifically asked for */
1029 if (desired_access & ACCESS_SYSTEM_SECURITY)
1030 {
1031 const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
1032 LUID_AND_ATTRIBUTES retpriv = security_priv;
1033 if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
1034 {
1035 if (priv_count)
1036 {
1037 /* assumes that there will only be one privilege to return */
1038 if (*priv_count >= 1)
1039 {
1040 *priv_count = 1;
1041 *privs = retpriv;
1042 }
1043 else
1044 {
1045 *priv_count = 1;
1046 return STATUS_BUFFER_TOO_SMALL;
1047 }
1048 }
1049 current_access |= ACCESS_SYSTEM_SECURITY;
1050 if (desired_access == current_access)
1051 {
1052 *granted_access = current_access;
1053 return *status = STATUS_SUCCESS;
1054 }
1055 }
1056 else
1057 {
1058 if (priv_count) *priv_count = 0;
1059 *status = STATUS_PRIVILEGE_NOT_HELD;
1060 return STATUS_SUCCESS;
1061 }
1062 }
1063 else if (priv_count) *priv_count = 0;
1064
1065 /* 3: Check whether the token is the owner */
1066 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
1067 * checked when a "set owner" call is made, overriding the access rights
1068 * determined here. */
1069 if (token_sid_present( token, owner, FALSE ))
1070 {
1071 current_access |= (READ_CONTROL | WRITE_DAC);
1072 if (desired_access == current_access)
1073 {
1074 *granted_access = current_access;
1075 return *status = STATUS_SUCCESS;
1076 }
1077 }
1078
1079 /* 4: Grant rights according to the DACL */
1080 ace = (const ACE_HEADER *)(dacl + 1);
1081 for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
1082 {
1083 const ACCESS_ALLOWED_ACE *aa_ace;
1084 const ACCESS_DENIED_ACE *ad_ace;
1085 const SID *sid;
1086
1087 if (ace->AceFlags & INHERIT_ONLY_ACE)
1088 continue;
1089
1090 switch (ace->AceType)
1091 {
1092 case ACCESS_DENIED_ACE_TYPE:
1093 ad_ace = (const ACCESS_DENIED_ACE *)ace;
1094 sid = (const SID *)&ad_ace->SidStart;
1095 if (token_sid_present( token, sid, TRUE ))
1096 {
1097 unsigned int access = ad_ace->Mask;
1098 map_generic_mask(&access, mapping);
1099 if (desired_access & MAXIMUM_ALLOWED)
1100 denied_access |= access;
1101 else
1102 {
1103 denied_access |= (access & ~current_access);
1104 if (desired_access & access) goto done;
1105 }
1106 }
1107 break;
1108 case ACCESS_ALLOWED_ACE_TYPE:
1109 aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
1110 sid = (const SID *)&aa_ace->SidStart;
1111 if (token_sid_present( token, sid, FALSE ))
1112 {
1113 unsigned int access = aa_ace->Mask;
1114 map_generic_mask(&access, mapping);
1115 if (desired_access & MAXIMUM_ALLOWED)
1116 current_access |= access;
1117 else
1118 current_access |= (access & ~denied_access);
1119 }
1120 break;
1121 }
1122
1123 /* don't bother carrying on checking if we've already got all of
1124 * rights we need */
1125 if (desired_access == *granted_access)
1126 break;
1127 }
1128
1129 done:
1130 if (desired_access & MAXIMUM_ALLOWED)
1131 *granted_access = current_access & ~denied_access;
1132 else
1133 if ((current_access & desired_access) == desired_access)
1134 *granted_access = current_access & desired_access;
1135 else
1136 *granted_access = 0;
1137
1138 *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1139 return STATUS_SUCCESS;
1140 }
1141
1142 const ACL *token_get_default_dacl( struct token *token )
1143 {
1144 return token->default_dacl;
1145 }
1146
1147 const SID *token_get_user( struct token *token )
1148 {
1149 return token->user;
1150 }
1151
1152 const SID *token_get_primary_group( struct token *token )
1153 {
1154 return token->primary_group;
1155 }
1156
1157 int check_object_access(struct object *obj, unsigned int *access)
1158 {
1159 GENERIC_MAPPING mapping;
1160 struct token *token = current->token ? current->token : current->process->token;
1161 unsigned int status;
1162 int res;
1163
1164 mapping.GenericAll = obj->ops->map_access( obj, GENERIC_ALL );
1165
1166 if (!obj->sd)
1167 {
1168 if (*access & MAXIMUM_ALLOWED)
1169 *access = mapping.GenericAll;
1170 return TRUE;
1171 }
1172
1173 mapping.GenericRead = obj->ops->map_access( obj, GENERIC_READ );
1174 mapping.GenericWrite = obj->ops->map_access( obj, GENERIC_WRITE );
1175 mapping.GenericExecute = obj->ops->map_access( obj, GENERIC_EXECUTE );
1176
1177 res = token_access_check( token, obj->sd, *access, NULL, NULL,
1178 &mapping, access, &status ) == STATUS_SUCCESS &&
1179 status == STATUS_SUCCESS;
1180
1181 if (!res) set_error( STATUS_ACCESS_DENIED );
1182 return res;
1183 }
1184
1185
1186 /* open a security token */
1187 DECL_HANDLER(open_token)
1188 {
1189 if (req->flags & OPEN_TOKEN_THREAD)
1190 {
1191 struct thread *thread = get_thread_from_handle( req->handle, 0 );
1192 if (thread)
1193 {
1194 if (thread->token)
1195 {
1196 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1197 set_error( STATUS_CANT_OPEN_ANONYMOUS );
1198 else
1199 reply->token = alloc_handle( current->process, thread->token,
1200 req->access, req->attributes );
1201 }
1202 else
1203 set_error( STATUS_NO_TOKEN );
1204 release_object( thread );
1205 }
1206 }
1207 else
1208 {
1209 struct process *process = get_process_from_handle( req->handle, 0 );
1210 if (process)
1211 {
1212 if (process->token)
1213 reply->token = alloc_handle( current->process, process->token, req->access,
1214 req->attributes );
1215 else
1216 set_error( STATUS_NO_TOKEN );
1217 release_object( process );
1218 }
1219 }
1220 }
1221
1222 /* adjust the privileges held by a token */
1223 DECL_HANDLER(adjust_token_privileges)
1224 {
1225 struct token *token;
1226 unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1227
1228 if (req->get_modified_state) access |= TOKEN_QUERY;
1229
1230 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1231 access, &token_ops )))
1232 {
1233 const LUID_AND_ATTRIBUTES *privs = get_req_data();
1234 LUID_AND_ATTRIBUTES *modified_privs = NULL;
1235 unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1236 unsigned int modified_priv_count = 0;
1237
1238 if (req->get_modified_state && !req->disable_all)
1239 {
1240 unsigned int i;
1241 /* count modified privs */
1242 for (i = 0; i < priv_count; i++)
1243 {
1244 struct privilege *privilege =
1245 token_find_privilege( token, &privs[i].Luid, FALSE );
1246 if (privilege && req->get_modified_state)
1247 modified_priv_count++;
1248 }
1249 reply->len = modified_priv_count;
1250 modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1251 if (modified_priv_count)
1252 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1253 }
1254 reply->len = modified_priv_count * sizeof(*modified_privs);
1255
1256 if (req->disable_all)
1257 token_disable_privileges( token );
1258 else
1259 token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
1260
1261 release_object( token );
1262 }
1263 }
1264
1265 /* retrieves the list of privileges that may be held be the token */
1266 DECL_HANDLER(get_token_privileges)
1267 {
1268 struct token *token;
1269
1270 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1271 TOKEN_QUERY,
1272 &token_ops )))
1273 {
1274 int priv_count = 0;
1275 LUID_AND_ATTRIBUTES *privs;
1276 struct privilege *privilege;
1277
1278 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1279 priv_count++;
1280
1281 reply->len = priv_count * sizeof(*privs);
1282 if (reply->len <= get_reply_max_size())
1283 {
1284 privs = set_reply_data_size( priv_count * sizeof(*privs) );
1285 if (privs)
1286 {
1287 int i = 0;
1288 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1289 {
1290 luid_and_attr_from_privilege( &privs[i], privilege );
1291 i++;
1292 }
1293 }
1294 }
1295 else
1296 set_error(STATUS_BUFFER_TOO_SMALL);
1297
1298 release_object( token );
1299 }
1300 }
1301
1302 /* creates a duplicate of the token */
1303 DECL_HANDLER(duplicate_token)
1304 {
1305 struct token *src_token;
1306 struct unicode_str name;
1307 const struct security_descriptor *sd;
1308 const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
1309
1310 if (!objattr) return;
1311
1312 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1313 TOKEN_DUPLICATE,
1314 &token_ops )))
1315 {
1316 struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd );
1317 if (token)
1318 {
1319 reply->new_handle = alloc_handle_no_access_check( current->process, token, req->access, objattr->attributes );
1320 release_object( token );
1321 }
1322 release_object( src_token );
1323 }
1324 }
1325
1326 /* checks the specified privileges are held by the token */
1327 DECL_HANDLER(check_token_privileges)
1328 {
1329 struct token *token;
1330
1331 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1332 TOKEN_QUERY,
1333 &token_ops )))
1334 {
1335 unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1336
1337 if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1338 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1339 else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1340 {
1341 LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1342 reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1343 }
1344 else
1345 set_error( STATUS_BUFFER_OVERFLOW );
1346 release_object( token );
1347 }
1348 }
1349
1350 /* checks that a user represented by a token is allowed to access an object
1351 * represented by a security descriptor */
1352 DECL_HANDLER(access_check)
1353 {
1354 data_size_t sd_size = get_req_data_size();
1355 const struct security_descriptor *sd = get_req_data();
1356 struct token *token;
1357
1358 if (!sd_is_valid( sd, sd_size ))
1359 {
1360 set_error( STATUS_ACCESS_VIOLATION );
1361 return;
1362 }
1363
1364 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1365 TOKEN_QUERY,
1366 &token_ops )))
1367 {
1368 GENERIC_MAPPING mapping;
1369 unsigned int status;
1370 LUID_AND_ATTRIBUTES priv;
1371 unsigned int priv_count = 1;
1372
1373 memset(&priv, 0, sizeof(priv));
1374
1375 /* only impersonation tokens may be used with this function */
1376 if (token->primary)
1377 {
1378 set_error( STATUS_NO_IMPERSONATION_TOKEN );
1379 release_object( token );
1380 return;
1381 }
1382 /* anonymous impersonation tokens can't be used */
1383 if (token->impersonation_level <= SecurityAnonymous)
1384 {
1385 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1386 release_object( token );
1387 return;
1388 }
1389
1390 mapping.GenericRead = req->mapping_read;
1391 mapping.GenericWrite = req->mapping_write;
1392 mapping.GenericExecute = req->mapping_execute;
1393 mapping.GenericAll = req->mapping_all;
1394
1395 status = token_access_check(
1396 token, sd, req->desired_access, &priv, &priv_count, &mapping,
1397 &reply->access_granted, &reply->access_status );
1398
1399 reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1400
1401 if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1402 {
1403 LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1404 memcpy( privs, &priv, sizeof(priv) );
1405 }
1406
1407 set_error( status );
1408 release_object( token );
1409 }
1410 }
1411
1412 /* retrieves an SID from the token */
1413 DECL_HANDLER(get_token_sid)
1414 {
1415 struct token *token;
1416
1417 reply->sid_len = 0;
1418
1419 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1420 {
1421 const SID *sid = NULL;
1422
1423 switch (req->which_sid)
1424 {
1425 case TokenUser:
1426 assert(token->user);
1427 sid = token->user;
1428 break;
1429 case TokenPrimaryGroup:
1430 sid = token->primary_group;
1431 break;
1432 case TokenOwner:
1433 sid = token->owner;
1434 break;
1435 case TokenLogonSid:
1436 sid = (const SID *)&builtin_logon_sid;
1437 break;
1438 default:
1439 set_error( STATUS_INVALID_PARAMETER );
1440 break;
1441 }
1442
1443 if (sid)
1444 {
1445 reply->sid_len = security_sid_len( sid );
1446 if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1447 else set_error( STATUS_BUFFER_TOO_SMALL );
1448 }
1449 release_object( token );
1450 }
1451 }
1452
1453 /* retrieves the groups that the user represented by the token belongs to */
1454 DECL_HANDLER(get_token_groups)
1455 {
1456 struct token *token;
1457
1458 reply->user_len = 0;
1459
1460 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1461 TOKEN_QUERY,
1462 &token_ops )))
1463 {
1464 size_t size_needed = sizeof(struct token_groups);
1465 size_t sid_size = 0;
1466 unsigned int group_count = 0;
1467 const struct group *group;
1468
1469 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1470 {
1471 group_count++;
1472 sid_size += security_sid_len( &group->sid );
1473 }
1474 size_needed += sid_size;
1475 /* attributes size */
1476 size_needed += sizeof(unsigned int) * group_count;
1477
1478 /* reply buffer contains size_needed bytes formatted as:
1479
1480 unsigned int count;
1481 unsigned int attrib[count];
1482 char sid_data[];
1483
1484 user_len includes extra data needed for TOKEN_GROUPS representation,
1485 required caller buffer size calculated here to avoid extra server call */
1486 reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1487
1488 if (reply->user_len <= get_reply_max_size())
1489 {
1490 struct token_groups *tg = set_reply_data_size( size_needed );
1491 if (tg)
1492 {
1493 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1494 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1495
1496 tg->count = group_count;
1497
1498 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1499 {
1500
1501 *attr_ptr = 0;
1502 if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1503 if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1504 if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1505 if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1506 if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1507 if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1508 if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1509
1510 memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1511
1512 sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1513 attr_ptr++;
1514 }
1515 }
1516 }
1517 else set_error( STATUS_BUFFER_TOO_SMALL );
1518
1519 release_object( token );
1520 }
1521 }
1522
1523 DECL_HANDLER(get_token_impersonation_level)
1524 {
1525 struct token *token;
1526
1527 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1528 TOKEN_QUERY,
1529 &token_ops )))
1530 {
1531 if (token->primary)
1532 set_error( STATUS_INVALID_PARAMETER );
1533 else
1534 reply->impersonation_level = token->impersonation_level;
1535
1536 release_object( token );
1537 }
1538 }
1539
1540 DECL_HANDLER(get_token_statistics)
1541 {
1542 struct token *token;
1543
1544 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1545 TOKEN_QUERY,
1546 &token_ops )))
1547 {
1548 reply->token_id = token->token_id;
1549 reply->modified_id = token->modified_id;
1550 reply->primary = token->primary;
1551 reply->impersonation_level = token->impersonation_level;
1552 reply->group_count = list_count( &token->groups );
1553 reply->privilege_count = list_count( &token->privileges );
1554
1555 release_object( token );
1556 }
1557 }
1558
1559 DECL_HANDLER(get_token_default_dacl)
1560 {
1561 struct token *token;
1562
1563 reply->acl_len = 0;
1564
1565 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1566 TOKEN_QUERY,
1567 &token_ops )))
1568 {
1569 if (token->default_dacl)
1570 reply->acl_len = token->default_dacl->AclSize;
1571
1572 if (reply->acl_len <= get_reply_max_size())
1573 {
1574 ACL *acl_reply = set_reply_data_size( reply->acl_len );
1575 if (acl_reply)
1576 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1577 }
1578 else set_error( STATUS_BUFFER_TOO_SMALL );
1579
1580 release_object( token );
1581 }
1582 }
1583
1584 DECL_HANDLER(set_token_default_dacl)
1585 {
1586 struct token *token;
1587
1588 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1589 TOKEN_ADJUST_DEFAULT,
1590 &token_ops )))
1591 {
1592 const ACL *acl = get_req_data();
1593 unsigned int acl_size = get_req_data_size();
1594
1595 free( token->default_dacl );
1596 token->default_dacl = NULL;
1597
1598 if (acl_size)
1599 token->default_dacl = memdup( acl, acl_size );
1600
1601 release_object( token );
1602 }
1603 }
Windows API implementation