server/token.c

   1 /*
   2  * Tokens
   3  *
   4  * Copyright (C) 1998 Alexandre Julliard
   5  * Copyright (C) 2003 Mike McCormack
   6  * Copyright (C) 2005 Robert Shearman
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #include "config.h"
  24
  25 #include <assert.h>
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28 #include <stdarg.h>
  29 #include <unistd.h>
  30
  31 #include "ntstatus.h"
  32 #define WIN32_NO_STATUS
  33 #include "windef.h"
  34 #include "winternl.h"
  35
  36 #include "handle.h"
  37 #include "thread.h"
  38 #include "process.h"
  39 #include "request.h"
  40 #include "security.h"
  41
  42 #include "wine/unicode.h"
  43
  44 #define MAX_SUBAUTH_COUNT 1
  45
  46 const LUID SeIncreaseQuotaPrivilege        = {  5, 0 };
  47 const LUID SeSecurityPrivilege             = {  8, 0 };
  48 const LUID SeTakeOwnershipPrivilege        = {  9, 0 };
  49 const LUID SeLoadDriverPrivilege           = { 10, 0 };
  50 const LUID SeSystemProfilePrivilege        = { 11, 0 };
  51 const LUID SeSystemtimePrivilege           = { 12, 0 };
  52 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
  53 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
  54 const LUID SeCreatePagefilePrivilege       = { 15, 0 };
  55 const LUID SeBackupPrivilege               = { 17, 0 };
  56 const LUID SeRestorePrivilege              = { 18, 0 };
  57 const LUID SeShutdownPrivilege             = { 19, 0 };
  58 const LUID SeDebugPrivilege                = { 20, 0 };
  59 const LUID SeSystemEnvironmentPrivilege    = { 22, 0 };
  60 const LUID SeChangeNotifyPrivilege         = { 23, 0 };
  61 const LUID SeRemoteShutdownPrivilege       = { 24, 0 };
  62 const LUID SeUndockPrivilege               = { 25, 0 };
  63 const LUID SeManageVolumePrivilege         = { 28, 0 };
  64 const LUID SeImpersonatePrivilege          = { 29, 0 };
  65 const LUID SeCreateGlobalPrivilege         = { 30, 0 };
  66
  67 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
  68 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
  69 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
  70 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
  71 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
  72 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
  73 static const struct /* same fields as struct SID */
  74 {
  75     BYTE Revision;
  76     BYTE SubAuthorityCount;
  77     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  78     DWORD SubAuthority[5];
  79 } local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
  80 static const struct /* same fields as struct SID */
  81 {
  82     BYTE Revision;
  83     BYTE SubAuthorityCount;
  84     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  85     DWORD SubAuthority[2];
  86 } builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
  87 static const struct /* same fields as struct SID */
  88 {
  89     BYTE Revision;
  90     BYTE SubAuthorityCount;
  91     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  92     DWORD SubAuthority[2];
  93 } builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
  94
  95 const PSID security_world_sid = (PSID)&world_sid;
  96 static const PSID security_local_sid = (PSID)&local_sid;
  97 static const PSID security_interactive_sid = (PSID)&interactive_sid;
  98 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
  99 const PSID security_local_system_sid = (PSID)&local_system_sid;
 100 const PSID security_local_user_sid = (PSID)&local_user_sid;
 101 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
 102 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
 103
 104 static luid_t prev_luid_value = { 1000, 0 };
 105
 106 struct token
 107 {
 108     struct object  obj;             /* object header */
 109     luid_t         token_id;        /* system-unique id of token */
 110     luid_t         modified_id;     /* new id allocated every time token is modified */
 111     struct list    privileges;      /* privileges available to the token */
 112     struct list    groups;          /* groups that the user of this token belongs to (sid_and_attributes) */
 113     SID           *user;            /* SID of user this token represents */
 114     SID           *primary_group;   /* SID of user's primary group */
 115     unsigned       primary;         /* is this a primary or impersonation token? */
 116     ACL           *default_dacl;    /* the default DACL to assign to objects created by this user */
 117     TOKEN_SOURCE   source;          /* source of the token */
 118     int            impersonation_level; /* impersonation level this token is capable of if non-primary token */
 119 };
 120
 121 struct privilege
 122 {
 123     struct list entry;
 124     LUID        luid;
 125     unsigned    enabled  : 1; /* is the privilege currently enabled? */
 126     unsigned    def      : 1; /* is the privilege enabled by default? */
 127 };
 128
 129 struct group
 130 {
 131     struct list entry;
 132     unsigned    enabled  : 1; /* is the sid currently enabled? */
 133     unsigned    def      : 1; /* is the sid enabled by default? */
 134     unsigned    logon    : 1; /* is this a logon sid? */
 135     unsigned    mandatory: 1; /* is this sid always enabled? */
 136     unsigned    owner    : 1; /* can this sid be an owner of an object? */
 137     unsigned    resource : 1; /* is this a domain-local group? */
 138     unsigned    deny_only: 1; /* is this a sid that should be use for denying only? */
 139     SID         sid;
 140 };
 141
 142 static void token_dump( struct object *obj, int verbose );
 143 static unsigned int token_map_access( struct object *obj, unsigned int access );
 144 static void token_destroy( struct object *obj );
 145
 146 static const struct object_ops token_ops =
 147 {
 148     sizeof(struct token),      /* size */
 149     token_dump,                /* dump */
 150     no_get_type,               /* get_type */
 151     no_add_queue,              /* add_queue */
 152     NULL,                      /* remove_queue */
 153     NULL,                      /* signaled */
 154     NULL,                      /* satisfied */
 155     no_signal,                 /* signal */
 156     no_get_fd,                 /* get_fd */
 157     token_map_access,          /* map_access */
 158     default_get_sd,            /* get_sd */
 159     default_set_sd,            /* set_sd */
 160     no_lookup_name,            /* lookup_name */
 161     no_open_file,              /* open_file */
 162     no_close_handle,           /* close_handle */
 163     token_destroy              /* destroy */
 164 };
 165
 166
 167 static void token_dump( struct object *obj, int verbose )
 168 {
 169     fprintf( stderr, "Security token\n" );
 170     /* FIXME: dump token members */
 171 }
 172
 173 static unsigned int token_map_access( struct object *obj, unsigned int access )
 174 {
 175     if (access & GENERIC_READ)    access |= TOKEN_READ;
 176     if (access & GENERIC_WRITE)   access |= TOKEN_WRITE;
 177     if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
 178     if (access & GENERIC_ALL)     access |= TOKEN_ALL_ACCESS;
 179     return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
 180 }
 181
 182 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
 183 {
 184     int i;
 185     SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
 186     if (!sid) return NULL;
 187     sid->Revision = SID_REVISION;
 188     sid->SubAuthorityCount = subauthcount;
 189     sid->IdentifierAuthority = *idauthority;
 190     for (i = 0; i < subauthcount; i++)
 191         sid->SubAuthority[i] = subauth[i];
 192     return sid;
 193 }
 194
 195 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
 196 {
 197     if (!handle)
 198     {
 199         if (thread->token)
 200             release_object( thread->token );
 201         thread->token = NULL;
 202     }
 203     else
 204     {
 205         struct token *token = (struct token *)get_handle_obj( current->process,
 206                                                               handle,
 207                                                               TOKEN_IMPERSONATE,
 208                                                               &token_ops );
 209         if (token)
 210         {
 211             if (thread->token)
 212                 release_object( thread->token );
 213             thread->token = token;
 214         }
 215     }
 216 }
 217
 218 const SID *security_unix_uid_to_sid( uid_t uid )
 219 {
 220     /* very simple mapping: either the current user or not the current user */
 221     if (uid == getuid())
 222         return (const SID *)&local_user_sid;
 223     else
 224         return &anonymous_logon_sid;
 225 }
 226
 227 static int acl_is_valid( const ACL *acl, data_size_t size )
 228 {
 229     ULONG i;
 230     const ACE_HEADER *ace;
 231
 232     if (size < sizeof(ACL))
 233         return FALSE;
 234
 235     size = min(size, MAX_ACL_LEN);
 236
 237     size -= sizeof(ACL);
 238
 239     ace = (const ACE_HEADER *)(acl + 1);
 240     for (i = 0; i < acl->AceCount; i++)
 241     {
 242         const SID *sid;
 243         data_size_t sid_size;
 244
 245         if (size < sizeof(ACE_HEADER))
 246             return FALSE;
 247         if (size < ace->AceSize)
 248             return FALSE;
 249         size -= ace->AceSize;
 250         switch (ace->AceType)
 251         {
 252         case ACCESS_DENIED_ACE_TYPE:
 253             sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
 254             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
 255             break;
 256         case ACCESS_ALLOWED_ACE_TYPE:
 257             sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
 258             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
 259             break;
 260         case SYSTEM_AUDIT_ACE_TYPE:
 261             sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
 262             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
 263             break;
 264         case SYSTEM_ALARM_ACE_TYPE:
 265             sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
 266             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
 267             break;
 268         default:
 269             return FALSE;
 270         }
 271         if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
 272             return FALSE;
 273         ace = ace_next( ace );
 274     }
 275     return TRUE;
 276 }
 277
 278 /* checks whether all members of a security descriptor fit inside the size
 279  * of memory specified */
 280 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
 281 {
 282     size_t offset = sizeof(struct security_descriptor);
 283     const SID *group;
 284     const SID *owner;
 285     const ACL *sacl;
 286     const ACL *dacl;
 287     int dummy;
 288
 289     if (size < offset)
 290         return FALSE;
 291
 292     if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 293         (offset + sd->owner_len > size))
 294         return FALSE;
 295     owner = sd_get_owner( sd );
 296     if (owner)
 297     {
 298         size_t needed_size = security_sid_len( owner );
 299         if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
 300             return FALSE;
 301     }
 302     offset += sd->owner_len;
 303
 304     if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 305         (offset + sd->group_len > size))
 306         return FALSE;
 307     group = sd_get_group( sd );
 308     if (group)
 309     {
 310         size_t needed_size = security_sid_len( group );
 311         if ((sd->group_len < sizeof(SID)) || (needed_size > sd->group_len))
 312             return FALSE;
 313     }
 314     offset += sd->group_len;
 315
 316     if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
 317         return FALSE;
 318     sacl = sd_get_sacl( sd, &dummy );
 319     if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
 320         return FALSE;
 321     offset += sd->sacl_len;
 322
 323     if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
 324         return FALSE;
 325     dacl = sd_get_dacl( sd, &dummy );
 326     if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
 327         return FALSE;
 328     offset += sd->dacl_len;
 329
 330     return TRUE;
 331 }
 332
 333 /* determines whether an object_attributes struct is valid in a buffer
 334  * and calls set_error appropriately */
 335 int objattr_is_valid( const struct object_attributes *objattr, data_size_t size )
 336 {
 337     if ((size < sizeof(*objattr)) || (size - sizeof(*objattr) < objattr->sd_len) ||
 338         (size - sizeof(*objattr) - objattr->sd_len < objattr->name_len))
 339     {
 340         set_error( STATUS_ACCESS_VIOLATION );
 341         return FALSE;
 342     }
 343
 344     if (objattr->sd_len)
 345     {
 346         const struct security_descriptor *sd = (const struct security_descriptor *)(objattr + 1);
 347         if (!sd_is_valid( sd, objattr->sd_len ))
 348         {
 349             set_error( STATUS_INVALID_SECURITY_DESCR );
 350             return FALSE;
 351         }
 352     }
 353
 354     return TRUE;
 355 }
 356
 357 /* maps from generic rights to specific rights as given by a mapping */
 358 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
 359 {
 360     if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
 361     if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
 362     if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
 363     if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
 364     *mask &= 0x0FFFFFFF;
 365 }
 366
 367 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
 368 {
 369     return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
 370 }
 371
 372 static inline void allocate_luid( luid_t *luid )
 373 {
 374     prev_luid_value.low_part++;
 375     *luid = prev_luid_value;
 376 }
 377
 378 DECL_HANDLER( allocate_locally_unique_id )
 379 {
 380     allocate_luid( &reply->luid );
 381 }
 382
 383 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
 384 {
 385     out->Luid = in->luid;
 386     out->Attributes =
 387         (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
 388         (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
 389 }
 390
 391 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
 392 {
 393     struct privilege *privilege = mem_alloc( sizeof(*privilege) );
 394     if (privilege)
 395     {
 396         privilege->luid = *luid;
 397         privilege->def = privilege->enabled = (enabled != 0);
 398         list_add_tail( &token->privileges, &privilege->entry );
 399     }
 400     return privilege;
 401 }
 402
 403 static inline void privilege_remove( struct privilege *privilege )
 404 {
 405     list_remove( &privilege->entry );
 406     free( privilege );
 407 }
 408
 409 static void token_destroy( struct object *obj )
 410 {
 411     struct token* token;
 412     struct list *cursor, *cursor_next;
 413
 414     assert( obj->ops == &token_ops );
 415     token = (struct token *)obj;
 416
 417     free( token->user );
 418
 419     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
 420     {
 421         struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
 422         privilege_remove( privilege );
 423     }
 424
 425     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
 426     {
 427         struct group *group = LIST_ENTRY( cursor, struct group, entry );
 428         list_remove( &group->entry );
 429         free( group );
 430     }
 431
 432     free( token->default_dacl );
 433 }
 434
 435 /* creates a new token.
 436  *  groups may be NULL if group_count is 0.
 437  *  privs may be NULL if priv_count is 0.
 438  *  default_dacl may be NULL, indicating that all objects created by the user
 439  *   are unsecured.
 440  *  modified_id may be NULL, indicating that a new modified_id luid should be
 441  *   allocated.
 442  */
 443 static struct token *create_token( unsigned primary, const SID *user,
 444                                    const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
 445                                    const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
 446                                    const ACL *default_dacl, TOKEN_SOURCE source,
 447                                    const luid_t *modified_id,
 448                                    int impersonation_level )
 449 {
 450     struct token *token = alloc_object( &token_ops );
 451     if (token)
 452     {
 453         unsigned int i;
 454
 455         allocate_luid( &token->token_id );
 456         if (modified_id)
 457             token->modified_id = *modified_id;
 458         else
 459             allocate_luid( &token->modified_id );
 460         list_init( &token->privileges );
 461         list_init( &token->groups );
 462         token->primary = primary;
 463         /* primary tokens don't have impersonation levels */
 464         if (primary)
 465             token->impersonation_level = -1;
 466         else
 467             token->impersonation_level = impersonation_level;
 468         token->default_dacl = NULL;
 469         token->primary_group = NULL;
 470
 471         /* copy user */
 472         token->user = memdup( user, security_sid_len( user ));
 473         if (!token->user)
 474         {
 475             release_object( token );
 476             return NULL;
 477         }
 478
 479         /* copy groups */
 480         for (i = 0; i < group_count; i++)
 481         {
 482             size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
 483             struct group *group = mem_alloc( size );
 484
 485             if (!group)
 486             {
 487                 release_object( token );
 488                 return NULL;
 489             }
 490             memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
 491             group->enabled = TRUE;
 492             group->def = TRUE;
 493             group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
 494             group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
 495             group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
 496             group->resource = FALSE;
 497             group->deny_only = FALSE;
 498             list_add_tail( &token->groups, &group->entry );
 499             /* Use first owner capable group as an owner */
 500             if (!token->primary_group && group->owner)
 501                 token->primary_group = &group->sid;
 502         }
 503
 504         /* copy privileges */
 505         for (i = 0; i < priv_count; i++)
 506         {
 507             /* note: we don't check uniqueness: the caller must make sure
 508              * privs doesn't contain any duplicate luids */
 509             if (!privilege_add( token, &privs[i].Luid,
 510                                 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
 511             {
 512                 release_object( token );
 513                 return NULL;
 514             }
 515         }
 516
 517         if (default_dacl)
 518         {
 519             token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
 520             if (!token->default_dacl)
 521             {
 522                 release_object( token );
 523                 return NULL;
 524             }
 525         }
 526
 527         token->source = source;
 528     }
 529     return token;
 530 }
 531
 532 struct token *token_duplicate( struct token *src_token, unsigned primary,
 533                                int impersonation_level )
 534 {
 535     const luid_t *modified_id =
 536         primary || (impersonation_level == src_token->impersonation_level) ?
 537             &src_token->modified_id : NULL;
 538     struct token *token = NULL;
 539     struct privilege *privilege;
 540     struct group *group;
 541
 542     if (!primary &&
 543         (impersonation_level < SecurityAnonymous ||
 544          impersonation_level > SecurityDelegation ||
 545          (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
 546     {
 547         set_error( STATUS_BAD_IMPERSONATION_LEVEL );
 548         return NULL;
 549     }
 550
 551     token = create_token( primary, src_token->user, NULL, 0,
 552                           NULL, 0, src_token->default_dacl,
 553                           src_token->source, modified_id,
 554                           impersonation_level );
 555     if (!token) return token;
 556
 557     /* copy groups */
 558     LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
 559     {
 560         size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
 561         struct group *newgroup = mem_alloc( size );
 562         if (!newgroup)
 563         {
 564             release_object( token );
 565             return NULL;
 566         }
 567         memcpy( newgroup, group, size );
 568         list_add_tail( &token->groups, &newgroup->entry );
 569     }
 570     token->primary_group = src_token->primary_group;
 571     assert( token->primary_group );
 572
 573     /* copy privileges */
 574     LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
 575         if (!privilege_add( token, &privilege->luid, privilege->enabled ))
 576         {
 577             release_object( token );
 578             return NULL;
 579         }
 580
 581     return token;
 582 }
 583
 584 static ACL *create_default_dacl( const SID *user )
 585 {
 586     ACCESS_ALLOWED_ACE *aaa;
 587     ACL *default_dacl;
 588     SID *sid;
 589     size_t default_dacl_size = sizeof(ACL) +
 590                                2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 591                                sizeof(local_system_sid) +
 592                                security_sid_len( user );
 593
 594     default_dacl = mem_alloc( default_dacl_size );
 595     if (!default_dacl) return NULL;
 596
 597     default_dacl->AclRevision = ACL_REVISION;
 598     default_dacl->Sbz1 = 0;
 599     default_dacl->AclSize = default_dacl_size;
 600     default_dacl->AceCount = 2;
 601     default_dacl->Sbz2 = 0;
 602
 603     /* GENERIC_ALL for Local System */
 604     aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
 605     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 606     aaa->Header.AceFlags = 0;
 607     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 608                           sizeof(local_system_sid);
 609     aaa->Mask = GENERIC_ALL;
 610     sid = (SID *)&aaa->SidStart;
 611     memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
 612
 613     /* GENERIC_ALL for specified user */
 614     aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
 615     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 616     aaa->Header.AceFlags = 0;
 617     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
 618     aaa->Mask = GENERIC_ALL;
 619     sid = (SID *)&aaa->SidStart;
 620     memcpy( sid, user, security_sid_len( user ));
 621
 622     return default_dacl;
 623 }
 624
 625 struct sid_data
 626 {
 627     SID_IDENTIFIER_AUTHORITY idauth;
 628     int count;
 629     unsigned int subauth[MAX_SUBAUTH_COUNT];
 630 };
 631
 632 struct token *token_create_admin( void )
 633 {
 634     struct token *token = NULL;
 635     static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
 636     static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
 637     static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
 638     /* on Windows, this value changes every time the user logs on */
 639     static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
 640     PSID alias_admins_sid;
 641     PSID alias_users_sid;
 642     PSID logon_sid;
 643     const SID *user_sid = security_unix_uid_to_sid( getuid() );
 644     ACL *default_dacl = create_default_dacl( user_sid );
 645
 646     alias_admins_sid = security_sid_alloc( &nt_authority, sizeof(alias_admins_subauth)/sizeof(alias_admins_subauth[0]),
 647                                            alias_admins_subauth );
 648     alias_users_sid = security_sid_alloc( &nt_authority, sizeof(alias_users_subauth)/sizeof(alias_users_subauth[0]),
 649                                           alias_users_subauth );
 650     logon_sid = security_sid_alloc( &nt_authority, sizeof(logon_subauth)/sizeof(logon_subauth[0]),
 651                                     logon_subauth );
 652
 653     if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
 654     {
 655         const LUID_AND_ATTRIBUTES admin_privs[] =
 656         {
 657             { SeChangeNotifyPrivilege        , SE_PRIVILEGE_ENABLED },
 658             { SeSecurityPrivilege            , 0                    },
 659             { SeBackupPrivilege              , 0                    },
 660             { SeRestorePrivilege             , 0                    },
 661             { SeSystemtimePrivilege          , 0                    },
 662             { SeShutdownPrivilege            , 0                    },
 663             { SeRemoteShutdownPrivilege      , 0                    },
 664             { SeTakeOwnershipPrivilege       , 0                    },
 665             { SeDebugPrivilege               , 0                    },
 666             { SeSystemEnvironmentPrivilege   , 0                    },
 667             { SeSystemProfilePrivilege       , 0                    },
 668             { SeProfileSingleProcessPrivilege, 0                    },
 669             { SeIncreaseBasePriorityPrivilege, 0                    },
 670             { SeLoadDriverPrivilege          , SE_PRIVILEGE_ENABLED },
 671             { SeCreatePagefilePrivilege      , 0                    },
 672             { SeIncreaseQuotaPrivilege       , 0                    },
 673             { SeUndockPrivilege              , 0                    },
 674             { SeManageVolumePrivilege        , 0                    },
 675             { SeImpersonatePrivilege         , SE_PRIVILEGE_ENABLED },
 676             { SeCreateGlobalPrivilege        , SE_PRIVILEGE_ENABLED },
 677         };
 678         /* note: we don't include non-builtin groups here for the user -
 679          * telling us these is the job of a client-side program */
 680         const SID_AND_ATTRIBUTES admin_groups[] =
 681         {
 682             { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 683             { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 684             { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 685             { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 686             { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
 687             { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 688             { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
 689         };
 690         static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
 691         token = create_token( TRUE, user_sid, admin_groups, sizeof(admin_groups)/sizeof(admin_groups[0]),
 692                               admin_privs, sizeof(admin_privs)/sizeof(admin_privs[0]), default_dacl,
 693                               admin_source, NULL, -1 );
 694         /* we really need a primary group */
 695         assert( token->primary_group );
 696     }
 697
 698     free( logon_sid );
 699     free( alias_admins_sid );
 700     free( alias_users_sid );
 701     free( default_dacl );
 702
 703     return token;
 704 }
 705
 706 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
 707 {
 708     struct privilege *privilege;
 709     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 710     {
 711         if (is_equal_luid( luid, &privilege->luid ))
 712         {
 713             if (enabled_only && !privilege->enabled)
 714                 return NULL;
 715             return privilege;
 716         }
 717     }
 718     return NULL;
 719 }
 720
 721 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
 722                                              unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
 723                                              unsigned int mod_privs_count )
 724 {
 725     unsigned int i, modified_count = 0;
 726
 727     /* mark as modified */
 728     allocate_luid( &token->modified_id );
 729
 730     for (i = 0; i < count; i++)
 731     {
 732         struct privilege *privilege =
 733             token_find_privilege( token, &privs[i].Luid, FALSE );
 734         if (!privilege)
 735         {
 736             set_error( STATUS_NOT_ALL_ASSIGNED );
 737             continue;
 738         }
 739
 740         if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
 741             privilege_remove( privilege );
 742         else
 743         {
 744             /* save previous state for caller */
 745             if (mod_privs_count)
 746             {
 747                 luid_and_attr_from_privilege(mod_privs, privilege);
 748                 mod_privs++;
 749                 mod_privs_count--;
 750                 modified_count++;
 751             }
 752
 753             if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
 754                 privilege->enabled = TRUE;
 755             else
 756                 privilege->enabled = FALSE;
 757         }
 758     }
 759     return modified_count;
 760 }
 761
 762 static void token_disable_privileges( struct token *token )
 763 {
 764     struct privilege *privilege;
 765
 766     /* mark as modified */
 767     allocate_luid( &token->modified_id );
 768
 769     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 770         privilege->enabled = FALSE;
 771 }
 772
 773 int token_check_privileges( struct token *token, int all_required,
 774                             const LUID_AND_ATTRIBUTES *reqprivs,
 775                             unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
 776 {
 777     unsigned int i, enabled_count = 0;
 778
 779     for (i = 0; i < count; i++)
 780     {
 781         struct privilege *privilege =
 782             token_find_privilege( token, &reqprivs[i].Luid, TRUE );
 783
 784         if (usedprivs)
 785             usedprivs[i] = reqprivs[i];
 786
 787         if (privilege && privilege->enabled)
 788         {
 789             enabled_count++;
 790             if (usedprivs)
 791                 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
 792         }
 793     }
 794
 795     if (all_required)
 796         return (enabled_count == count);
 797     else
 798         return (enabled_count > 0);
 799 }
 800
 801 int token_sid_present( struct token *token, const SID *sid, int deny )
 802 {
 803     struct group *group;
 804
 805     if (security_equal_sid( token->user, sid )) return TRUE;
 806
 807     LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
 808     {
 809         if (!group->enabled) continue;
 810         if (group->deny_only && !deny) continue;
 811
 812         if (security_equal_sid( &group->sid, sid )) return TRUE;
 813     }
 814
 815     return FALSE;
 816 }
 817
 818 /* Checks access to a security descriptor. 'sd' must have been validated by
 819  * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
 820  * the reason. 'status' parameter will indicate if access is granted or denied.
 821  *
 822  * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
 823  */
 824 static unsigned int token_access_check( struct token *token,
 825                                  const struct security_descriptor *sd,
 826                                  unsigned int desired_access,
 827                                  LUID_AND_ATTRIBUTES *privs,
 828                                  unsigned int *priv_count,
 829                                  const GENERIC_MAPPING *mapping,
 830                                  unsigned int *granted_access,
 831                                  unsigned int *status )
 832 {
 833     unsigned int current_access = 0;
 834     unsigned int denied_access = 0;
 835     ULONG i;
 836     const ACL *dacl;
 837     int dacl_present;
 838     const ACE_HEADER *ace;
 839     const SID *owner;
 840
 841     /* assume no access rights */
 842     *granted_access = 0;
 843
 844     /* fail if desired_access contains generic rights */
 845     if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
 846     {
 847         *priv_count = 0;
 848         return STATUS_GENERIC_NOT_MAPPED;
 849     }
 850
 851     dacl = sd_get_dacl( sd, &dacl_present );
 852     owner = sd_get_owner( sd );
 853     if (!owner || !sd_get_group( sd ))
 854     {
 855         *priv_count = 0;
 856         return STATUS_INVALID_SECURITY_DESCR;
 857     }
 858
 859     /* 1: Grant desired access if the object is unprotected */
 860     if (!dacl_present || !dacl)
 861     {
 862         *priv_count = 0;
 863         *granted_access = desired_access;
 864         return *status = STATUS_SUCCESS;
 865     }
 866
 867     /* 2: Check if caller wants access to system security part. Note: access
 868      * is only granted if specifically asked for */
 869     if (desired_access & ACCESS_SYSTEM_SECURITY)
 870     {
 871         const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
 872         LUID_AND_ATTRIBUTES retpriv = security_priv;
 873         if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
 874         {
 875             if (priv_count)
 876             {
 877                 /* assumes that there will only be one privilege to return */
 878                 if (*priv_count >= 1)
 879                 {
 880                     *priv_count = 1;
 881                     *privs = retpriv;
 882                 }
 883                 else
 884                 {
 885                     *priv_count = 1;
 886                     return STATUS_BUFFER_TOO_SMALL;
 887                 }
 888             }
 889             current_access |= ACCESS_SYSTEM_SECURITY;
 890             if (desired_access == current_access)
 891             {
 892                 *granted_access = current_access;
 893                 return *status = STATUS_SUCCESS;
 894             }
 895         }
 896         else
 897         {
 898             *priv_count = 0;
 899             *status = STATUS_PRIVILEGE_NOT_HELD;
 900             return STATUS_SUCCESS;
 901         }
 902     }
 903     else if (priv_count) *priv_count = 0;
 904
 905     /* 3: Check whether the token is the owner */
 906     /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
 907      * checked when a "set owner" call is made, overriding the access rights
 908      * determined here. */
 909     if (token_sid_present( token, owner, FALSE ))
 910     {
 911         current_access |= (READ_CONTROL | WRITE_DAC);
 912         if (desired_access == current_access)
 913         {
 914             *granted_access = current_access;
 915             return *status = STATUS_SUCCESS;
 916         }
 917     }
 918
 919     /* 4: Grant rights according to the DACL */
 920     ace = (const ACE_HEADER *)(dacl + 1);
 921     for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
 922     {
 923         const ACCESS_ALLOWED_ACE *aa_ace;
 924         const ACCESS_DENIED_ACE *ad_ace;
 925         const SID *sid;
 926
 927         if (ace->AceFlags & INHERIT_ONLY_ACE)
 928             continue;
 929
 930         switch (ace->AceType)
 931         {
 932         case ACCESS_DENIED_ACE_TYPE:
 933             ad_ace = (const ACCESS_DENIED_ACE *)ace;
 934             sid = (const SID *)&ad_ace->SidStart;
 935             if (token_sid_present( token, sid, TRUE ))
 936             {
 937                 unsigned int access = ad_ace->Mask;
 938                 map_generic_mask(&access, mapping);
 939                 if (desired_access & MAXIMUM_ALLOWED)
 940                     denied_access |= access;
 941                 else
 942                 {
 943                     denied_access |= (access & ~current_access);
 944                     if (desired_access & access) goto done;
 945                 }
 946             }
 947             break;
 948         case ACCESS_ALLOWED_ACE_TYPE:
 949             aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
 950             sid = (const SID *)&aa_ace->SidStart;
 951             if (token_sid_present( token, sid, FALSE ))
 952             {
 953                 unsigned int access = aa_ace->Mask;
 954                 map_generic_mask(&access, mapping);
 955                 if (desired_access & MAXIMUM_ALLOWED)
 956                     current_access |= access;
 957                 else
 958                     current_access |= (access & ~denied_access);
 959             }
 960             break;
 961         }
 962
 963         /* don't bother carrying on checking if we've already got all of
 964             * rights we need */
 965         if (desired_access == *granted_access)
 966             break;
 967     }
 968
 969 done:
 970     if (desired_access & MAXIMUM_ALLOWED)
 971         *granted_access = current_access & ~denied_access;
 972     else
 973         if ((current_access & desired_access) == desired_access)
 974             *granted_access = current_access & desired_access;
 975         else
 976             *granted_access = 0;
 977
 978     *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
 979     return STATUS_SUCCESS;
 980 }
 981
 982 const ACL *token_get_default_dacl( struct token *token )
 983 {
 984     return token->default_dacl;
 985 }
 986
 987 const SID *token_get_user( struct token *token )
 988 {
 989     return token->user;
 990 }
 991
 992 const SID *token_get_primary_group( struct token *token )
 993 {
 994     return token->primary_group;
 995 }
 996
 997 int check_object_access(struct object *obj, unsigned int *access)
 998 {
 999     GENERIC_MAPPING mapping;
1000     struct token *token = current->token ? current->token : current->process->token;
1001     LUID_AND_ATTRIBUTES priv;
1002     unsigned int status, priv_count = 1;
1003     int res;
1004
1005     mapping.GenericAll = obj->ops->map_access( obj, GENERIC_ALL );
1006
1007     if (!obj->sd)
1008     {
1009         if (*access & MAXIMUM_ALLOWED)
1010             *access = mapping.GenericAll;
1011         return TRUE;
1012     }
1013
1014     mapping.GenericRead  = obj->ops->map_access( obj, GENERIC_READ );
1015     mapping.GenericWrite = obj->ops->map_access( obj, GENERIC_WRITE );
1016     mapping.GenericExecute = obj->ops->map_access( obj, GENERIC_EXECUTE );
1017
1018     res = token_access_check( token, obj->sd, *access, &priv, &priv_count,
1019                               &mapping, access, &status ) == STATUS_SUCCESS &&
1020           status == STATUS_SUCCESS;
1021
1022     if (!res) set_error( STATUS_ACCESS_DENIED );
1023     return res;
1024 }
1025
1026
1027 /* open a security token */
1028 DECL_HANDLER(open_token)
1029 {
1030     if (req->flags & OPEN_TOKEN_THREAD)
1031     {
1032         struct thread *thread = get_thread_from_handle( req->handle, 0 );
1033         if (thread)
1034         {
1035             if (thread->token)
1036             {
1037                 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1038                     set_error( STATUS_CANT_OPEN_ANONYMOUS );
1039                 else
1040                     reply->token = alloc_handle( current->process, thread->token,
1041                                                  req->access, req->attributes );
1042             }
1043             else
1044                 set_error( STATUS_NO_TOKEN );
1045             release_object( thread );
1046         }
1047     }
1048     else
1049     {
1050         struct process *process = get_process_from_handle( req->handle, 0 );
1051         if (process)
1052         {
1053             if (process->token)
1054                 reply->token = alloc_handle( current->process, process->token, req->access,
1055                                              req->attributes );
1056             else
1057                 set_error( STATUS_NO_TOKEN );
1058             release_object( process );
1059         }
1060     }
1061 }
1062
1063 /* adjust the privileges held by a token */
1064 DECL_HANDLER(adjust_token_privileges)
1065 {
1066     struct token *token;
1067     unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1068
1069     if (req->get_modified_state) access |= TOKEN_QUERY;
1070
1071     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1072                                                  access, &token_ops )))
1073     {
1074         const LUID_AND_ATTRIBUTES *privs = get_req_data();
1075         LUID_AND_ATTRIBUTES *modified_privs = NULL;
1076         unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1077         unsigned int modified_priv_count = 0;
1078
1079         if (req->get_modified_state && !req->disable_all)
1080         {
1081             unsigned int i;
1082             /* count modified privs */
1083             for (i = 0; i < priv_count; i++)
1084             {
1085                 struct privilege *privilege =
1086                     token_find_privilege( token, &privs[i].Luid, FALSE );
1087                 if (privilege && req->get_modified_state)
1088                     modified_priv_count++;
1089             }
1090             reply->len = modified_priv_count;
1091             modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1092             if (modified_priv_count)
1093                 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1094         }
1095         reply->len = modified_priv_count * sizeof(*modified_privs);
1096
1097         if (req->disable_all)
1098             token_disable_privileges( token );
1099         else
1100             modified_priv_count = token_adjust_privileges( token, privs,
1101                 priv_count, modified_privs, modified_priv_count );
1102
1103         release_object( token );
1104     }
1105 }
1106
1107 /* retrieves the list of privileges that may be held be the token */
1108 DECL_HANDLER(get_token_privileges)
1109 {
1110     struct token *token;
1111
1112     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1113                                                  TOKEN_QUERY,
1114                                                  &token_ops )))
1115     {
1116         int priv_count = 0;
1117         LUID_AND_ATTRIBUTES *privs;
1118         struct privilege *privilege;
1119
1120         LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1121             priv_count++;
1122
1123         reply->len = priv_count * sizeof(*privs);
1124         if (reply->len <= get_reply_max_size())
1125         {
1126             privs = set_reply_data_size( priv_count * sizeof(*privs) );
1127             if (privs)
1128             {
1129                 int i = 0;
1130                 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1131                 {
1132                     luid_and_attr_from_privilege( &privs[i], privilege );
1133                     i++;
1134                 }
1135             }
1136         }
1137         else
1138             set_error(STATUS_BUFFER_TOO_SMALL);
1139
1140         release_object( token );
1141     }
1142 }
1143
1144 /* creates a duplicate of the token */
1145 DECL_HANDLER(duplicate_token)
1146 {
1147     struct token *src_token;
1148
1149     if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1150                                                      TOKEN_DUPLICATE,
1151                                                      &token_ops )))
1152     {
1153         struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level );
1154         if (token)
1155         {
1156             reply->new_handle = alloc_handle( current->process, token, req->access, req->attributes);
1157             release_object( token );
1158         }
1159         release_object( src_token );
1160     }
1161 }
1162
1163 /* checks the specified privileges are held by the token */
1164 DECL_HANDLER(check_token_privileges)
1165 {
1166     struct token *token;
1167
1168     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1169                                                  TOKEN_QUERY,
1170                                                  &token_ops )))
1171     {
1172         unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1173
1174         if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1175             set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1176         else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1177         {
1178             LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1179             reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1180         }
1181         else
1182             set_error( STATUS_BUFFER_OVERFLOW );
1183         release_object( token );
1184     }
1185 }
1186
1187 /* checks that a user represented by a token is allowed to access an object
1188  * represented by a security descriptor */
1189 DECL_HANDLER(access_check)
1190 {
1191     data_size_t sd_size = get_req_data_size();
1192     const struct security_descriptor *sd = get_req_data();
1193     struct token *token;
1194
1195     if (!sd_is_valid( sd, sd_size ))
1196     {
1197         set_error( STATUS_ACCESS_VIOLATION );
1198         return;
1199     }
1200
1201     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1202                                                  TOKEN_QUERY,
1203                                                  &token_ops )))
1204     {
1205         GENERIC_MAPPING mapping;
1206         unsigned int status;
1207         LUID_AND_ATTRIBUTES priv;
1208         unsigned int priv_count = 1;
1209
1210         memset(&priv, 0, sizeof(priv));
1211
1212         /* only impersonation tokens may be used with this function */
1213         if (token->primary)
1214         {
1215             set_error( STATUS_NO_IMPERSONATION_TOKEN );
1216             release_object( token );
1217             return;
1218         }
1219         /* anonymous impersonation tokens can't be used */
1220         if (token->impersonation_level <= SecurityAnonymous)
1221         {
1222             set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1223             release_object( token );
1224             return;
1225         }
1226
1227         mapping.GenericRead = req->mapping_read;
1228         mapping.GenericWrite = req->mapping_write;
1229         mapping.GenericExecute = req->mapping_execute;
1230         mapping.GenericAll = req->mapping_all;
1231
1232         status = token_access_check(
1233             token, sd, req->desired_access, &priv, &priv_count, &mapping,
1234             &reply->access_granted, &reply->access_status );
1235
1236         reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1237
1238         if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1239         {
1240             LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1241             memcpy( privs, &priv, sizeof(priv) );
1242         }
1243
1244         set_error( status );
1245         release_object( token );
1246     }
1247 }
1248
1249 /* retrieves the SID of the user that the token represents */
1250 DECL_HANDLER(get_token_sid)
1251 {
1252     struct token *token;
1253
1254     reply->sid_len = 0;
1255
1256     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1257                                                  TOKEN_QUERY,
1258                                                  &token_ops )))
1259     {
1260         const SID *sid = NULL;
1261
1262         switch (req->which_sid)
1263         {
1264         case TokenUser:
1265             assert(token->user);
1266             sid = token->user;
1267             break;
1268         case TokenPrimaryGroup:
1269             sid = token->primary_group;
1270             break;
1271         case TokenOwner:
1272         {
1273             struct group *group;
1274             LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
1275             {
1276                 if (group->owner)
1277                 {
1278                     sid = &group->sid;
1279                     break;
1280                 }
1281             }
1282             break;
1283         }
1284         default:
1285             set_error( STATUS_INVALID_PARAMETER );
1286             break;
1287         }
1288
1289         if (sid)
1290         {
1291             reply->sid_len = security_sid_len( sid );
1292             if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1293             else set_error( STATUS_BUFFER_TOO_SMALL );
1294         }
1295         release_object( token );
1296     }
1297 }
1298
1299 /* retrieves the groups that the user represented by the token belongs to */
1300 DECL_HANDLER(get_token_groups)
1301 {
1302     struct token *token;
1303
1304     reply->user_len = 0;
1305
1306     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1307                                                  TOKEN_QUERY,
1308                                                  &token_ops )))
1309     {
1310         size_t size_needed = sizeof(struct token_groups);
1311         size_t sid_size = 0;
1312         unsigned int group_count = 0;
1313         const struct group *group;
1314
1315         LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1316         {
1317             group_count++;
1318             sid_size += security_sid_len( &group->sid );
1319         }
1320         size_needed += sid_size;
1321         /* attributes size */
1322         size_needed += sizeof(unsigned int) * group_count;
1323
1324         /* reply buffer contains size_needed bytes formatted as:
1325
1326            unsigned int count;
1327            unsigned int attrib[count];
1328            char sid_data[];
1329
1330            user_len includes extra data needed for TOKEN_GROUPS representation,
1331            required caller buffer size calculated here to avoid extra server call */
1332         reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1333
1334         if (reply->user_len <= get_reply_max_size())
1335         {
1336             struct token_groups *tg = set_reply_data_size( size_needed );
1337             if (tg)
1338             {
1339                 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1340                 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1341
1342                 tg->count = group_count;
1343
1344                 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1345                 {
1346
1347                     *attr_ptr = 0;
1348                     if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1349                     if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1350                     if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1351                     if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1352                     if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1353                     if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1354                     if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1355
1356                     memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1357
1358                     sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1359                     attr_ptr++;
1360                 }
1361             }
1362         }
1363         else set_error( STATUS_BUFFER_TOO_SMALL );
1364
1365         release_object( token );
1366     }
1367 }
1368
1369 DECL_HANDLER(get_token_impersonation_level)
1370 {
1371     struct token *token;
1372
1373     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1374                                                  TOKEN_QUERY,
1375                                                  &token_ops )))
1376     {
1377         if (token->primary)
1378             set_error( STATUS_INVALID_PARAMETER );
1379         else
1380             reply->impersonation_level = token->impersonation_level;
1381
1382         release_object( token );
1383     }
1384 }
1385
1386 DECL_HANDLER(get_token_statistics)
1387 {
1388     struct token *token;
1389
1390     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1391                                                  TOKEN_QUERY,
1392                                                  &token_ops )))
1393     {
1394         reply->token_id = token->token_id;
1395         reply->modified_id = token->modified_id;
1396         reply->primary = token->primary;
1397         reply->impersonation_level = token->impersonation_level;
1398         reply->group_count = list_count( &token->groups );
1399         reply->privilege_count = list_count( &token->privileges );
1400
1401         release_object( token );
1402     }
1403 }
1404
1405 DECL_HANDLER(get_token_default_dacl)
1406 {
1407     struct token *token;
1408
1409     reply->acl_len = 0;
1410
1411     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1412                                                  TOKEN_QUERY,
1413                                                  &token_ops )))
1414     {
1415         if (token->default_dacl)
1416             reply->acl_len = token->default_dacl->AclSize;
1417
1418         if (reply->acl_len <= get_reply_max_size())
1419         {
1420             ACL *acl_reply = set_reply_data_size( reply->acl_len );
1421             if (acl_reply)
1422                 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1423         }
1424         else set_error( STATUS_BUFFER_TOO_SMALL );
1425
1426         release_object( token );
1427     }
1428 }
1429
1430 DECL_HANDLER(set_token_default_dacl)
1431 {
1432     struct token *token;
1433
1434     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1435                                                  TOKEN_ADJUST_DEFAULT,
1436                                                  &token_ops )))
1437     {
1438         const ACL *acl = get_req_data();
1439         unsigned int acl_size = get_req_data_size();
1440
1441         free( token->default_dacl );
1442         token->default_dacl = NULL;
1443
1444         if (acl_size)
1445             token->default_dacl = memdup( acl, acl_size );
1446
1447         release_object( token );
1448     }
1449 }