server/token.c

   1 /*
   2  * Tokens
   3  *
   4  * Copyright (C) 1998 Alexandre Julliard
   5  * Copyright (C) 2003 Mike McCormack
   6  * Copyright (C) 2005 Robert Shearman
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  */
  22
  23 #include "config.h"
  24
  25 #include <assert.h>
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28
  29 #include "windef.h"
  30
  31 #include "handle.h"
  32 #include "thread.h"
  33 #include "process.h"
  34 #include "request.h"
  35 #include "security.h"
  36
  37 #define MAX_SUBAUTH_COUNT 1
  38
  39 const LUID SeIncreaseQuotaPrivilege        = {  5, 0 };
  40 const LUID SeSecurityPrivilege             = {  8, 0 };
  41 const LUID SeTakeOwnershipPrivilege        = {  9, 0 };
  42 const LUID SeLoadDriverPrivilege           = { 10, 0 };
  43 const LUID SeSystemProfilePrivilege        = { 11, 0 };
  44 const LUID SeSystemtimePrivilege           = { 12, 0 };
  45 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
  46 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
  47 const LUID SeCreatePagefilePrivilege       = { 15, 0 };
  48 const LUID SeBackupPrivilege               = { 17, 0 };
  49 const LUID SeRestorePrivilege              = { 18, 0 };
  50 const LUID SeShutdownPrivilege             = { 19, 0 };
  51 const LUID SeDebugPrivilege                = { 20, 0 };
  52 const LUID SeSystemEnvironmentPrivilege    = { 22, 0 };
  53 const LUID SeChangeNotifyPrivilege         = { 23, 0 };
  54 const LUID SeRemoteShutdownPrivilege       = { 24, 0 };
  55 const LUID SeUndockPrivilege               = { 25, 0 };
  56 const LUID SeManageVolumePrivilege         = { 28, 0 };
  57 const LUID SeImpersonatePrivilege          = { 29, 0 };
  58 const LUID SeCreateGlobalPrivilege         = { 30, 0 };
  59
  60 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
  61 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
  62 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
  63 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
  64 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
  65 static PSID security_world_sid = (PSID)&world_sid;
  66 static PSID security_local_sid = (PSID)&local_sid;
  67 static PSID security_interactive_sid = (PSID)&interactive_sid;
  68 static PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
  69
  70 struct token
  71 {
  72     struct object  obj;             /* object header */
  73     struct list    privileges;      /* privileges available to the token */
  74     struct list    groups;          /* groups that the user of this token belongs to (sid_and_attributes) */
  75     SID           *user;            /* SID of user this token represents */
  76     unsigned       primary;         /* is this a primary or impersonation token? */
  77     ACL           *default_dacl;    /* the default DACL to assign to objects created by this user */
  78 };
  79
  80 struct privilege
  81 {
  82     struct list entry;
  83     LUID        luid;
  84     unsigned    enabled  : 1; /* is the privilege currently enabled? */
  85     unsigned    def      : 1; /* is the privilege enabled by default? */
  86 };
  87
  88 struct sid_and_attributes
  89 {
  90     struct list entry;
  91     unsigned    enabled  : 1; /* is the sid currently enabled? */
  92     unsigned    def      : 1; /* is the sid enabled by default? */
  93     unsigned    logon    : 1; /* is this a logon sid? */
  94     unsigned    mandatory: 1; /* is this sid always enabled? */
  95     unsigned    owner    : 1; /* can this sid be an owner of an object? */
  96     unsigned    resource : 1; /* is this a domain-local group? */
  97     unsigned    deny_only: 1; /* is this a sid that should be use for denying only? */
  98     SID         sid;
  99 };
 100
 101 static void token_dump( struct object *obj, int verbose );
 102 static void token_destroy( struct object *obj );
 103
 104 static const struct object_ops token_ops =
 105 {
 106     sizeof(struct token),      /* size */
 107     token_dump,                /* dump */
 108     no_add_queue,              /* add_queue */
 109     NULL,                      /* remove_queue */
 110     NULL,                      /* signaled */
 111     NULL,                      /* satisfied */
 112     no_signal,                 /* signal */
 113     no_get_fd,                 /* get_fd */
 114     no_close_handle,           /* close_handle */
 115     token_destroy              /* destroy */
 116 };
 117
 118
 119 static void token_dump( struct object *obj, int verbose )
 120 {
 121     fprintf( stderr, "Security token\n" );
 122     /* FIXME: dump token members */
 123 }
 124
 125 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
 126 {
 127     int i;
 128     SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
 129     if (!sid) return NULL;
 130     sid->Revision = SID_REVISION;
 131     sid->SubAuthorityCount = subauthcount;
 132     sid->IdentifierAuthority = *idauthority;
 133     for (i = 0; i < subauthcount; i++)
 134         sid->SubAuthority[i] = subauth[i];
 135     return sid;
 136 }
 137
 138 static inline int security_equal_sid( const SID *sid1, const SID *sid2 )
 139 {
 140     return ((sid1->SubAuthorityCount == sid2->SubAuthorityCount) &&
 141         !memcmp( sid1, sid2, FIELD_OFFSET(SID, SubAuthority[sid1->SubAuthorityCount]) ));
 142 }
 143
 144 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
 145 {
 146     if (!handle)
 147     {
 148         if (thread->token)
 149             release_object( thread->token );
 150         thread->token = NULL;
 151     }
 152     else
 153     {
 154         struct token *token = (struct token *)get_handle_obj( current->process,
 155                                                               handle,
 156                                                               TOKEN_IMPERSONATE,
 157                                                               &token_ops );
 158         if (token)
 159         {
 160             if (thread->token)
 161                 release_object( thread->token );
 162             thread->token = token;
 163         }
 164     }
 165 }
 166
 167 static const ACE_HEADER *ace_next( const ACE_HEADER *ace )
 168 {
 169     return (const ACE_HEADER *)((const char *)ace + ace->AceSize);
 170 }
 171
 172 static int acl_is_valid( const ACL *acl, size_t size )
 173 {
 174     ULONG i;
 175     const ACE_HEADER *ace;
 176
 177     if (size < sizeof(ACL))
 178         return FALSE;
 179
 180     size = min(size, MAX_ACL_LEN);
 181
 182     size -= sizeof(ACL);
 183
 184     ace = (const ACE_HEADER *)(acl + 1);
 185     for (i = 0; i < acl->AceCount; i++)
 186     {
 187         const SID *sid;
 188         size_t sid_size;
 189
 190         if (size < sizeof(ACE_HEADER))
 191             return FALSE;
 192         if (size < ace->AceSize)
 193             return FALSE;
 194         size -= ace->AceSize;
 195         switch (ace->AceType)
 196         {
 197         case ACCESS_DENIED_ACE_TYPE:
 198             sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
 199             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
 200             break;
 201         case ACCESS_ALLOWED_ACE_TYPE:
 202             sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
 203             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
 204             break;
 205         case SYSTEM_AUDIT_ACE_TYPE:
 206             sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
 207             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
 208             break;
 209         case SYSTEM_ALARM_ACE_TYPE:
 210             sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
 211             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
 212             break;
 213         default:
 214             return FALSE;
 215         }
 216         if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) ||
 217             sid_size < FIELD_OFFSET(SID, SubAuthority[sid->SubAuthorityCount]))
 218             return FALSE;
 219         ace = ace_next( ace );
 220     }
 221     return TRUE;
 222 }
 223
 224 /* gets the discretionary access control list from a security descriptor */
 225 static inline const ACL *sd_get_dacl( const struct security_descriptor *sd, int *present )
 226 {
 227     *present = (sd->control & SE_DACL_PRESENT ? TRUE : FALSE);
 228
 229     if (sd->dacl_len)
 230         return (const ACL *)((const char *)(sd + 1) +
 231             sd->owner_len + sd->group_len + sd->sacl_len);
 232     else
 233         return NULL;
 234 }
 235
 236 /* gets the system access control list from a security descriptor */
 237 static inline const ACL *sd_get_sacl( const struct security_descriptor *sd, int *present )
 238 {
 239     *present = (sd->control & SE_SACL_PRESENT ? TRUE : FALSE);
 240
 241     if (sd->sacl_len)
 242         return (const ACL *)((const char *)(sd + 1) +
 243             sd->owner_len + sd->group_len);
 244     else
 245         return NULL;
 246 }
 247
 248 /* gets the owner from a security descriptor */
 249 static inline const SID *sd_get_owner( const struct security_descriptor *sd )
 250 {
 251     if (sd->owner_len)
 252         return (const SID *)(sd + 1);
 253     else
 254         return NULL;
 255 }
 256
 257 /* gets the primary group from a security descriptor */
 258 static inline const SID *sd_get_group( const struct security_descriptor *sd )
 259 {
 260     if (sd->group_len)
 261         return (const SID *)((const char *)(sd + 1) + sd->owner_len);
 262     else
 263         return NULL;
 264 }
 265
 266 /* checks whether all members of a security descriptor fit inside the size
 267  * of memory specified */
 268 static int sd_is_valid( const struct security_descriptor *sd, size_t size )
 269 {
 270     size_t offset = sizeof(struct security_descriptor);
 271     const SID *group;
 272     const SID *owner;
 273     const ACL *sacl;
 274     const ACL *dacl;
 275     int dummy;
 276
 277     if (size < offset)
 278         return FALSE;
 279
 280     if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 281         (offset + sd->owner_len > size))
 282         return FALSE;
 283     owner = sd_get_owner( sd );
 284     if (owner)
 285     {
 286         size_t needed_size = FIELD_OFFSET(SID, SubAuthority[owner->SubAuthorityCount]);
 287         if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
 288             return FALSE;
 289     }
 290     offset += sd->owner_len;
 291
 292     if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 293         (offset + sd->group_len > size))
 294         return FALSE;
 295     group = sd_get_group( sd );
 296     if (group)
 297     {
 298         size_t needed_size = FIELD_OFFSET(SID, SubAuthority[group->SubAuthorityCount]);
 299         if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
 300             return FALSE;
 301     }
 302     offset += sd->group_len;
 303
 304     if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
 305         return FALSE;
 306     sacl = sd_get_sacl( sd, &dummy );
 307     if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
 308         return FALSE;
 309     offset += sd->sacl_len;
 310
 311     if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
 312         return FALSE;
 313     dacl = sd_get_dacl( sd, &dummy );
 314     if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
 315         return FALSE;
 316     offset += sd->dacl_len;
 317
 318     return TRUE;
 319 }
 320
 321 /* maps from generic rights to specific rights as given by a mapping */
 322 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
 323 {
 324     if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
 325     if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
 326     if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
 327     if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
 328     *mask &= 0x0FFFFFFF;
 329 }
 330
 331 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
 332 {
 333     return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
 334 }
 335
 336 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
 337 {
 338     out->Luid = in->luid;
 339     out->Attributes =
 340         (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
 341         (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
 342 }
 343
 344 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
 345 {
 346     struct privilege *privilege = mem_alloc( sizeof(*privilege) );
 347     if (privilege)
 348     {
 349         privilege->luid = *luid;
 350         privilege->def = privilege->enabled = (enabled != 0);
 351         list_add_tail( &token->privileges, &privilege->entry );
 352     }
 353     return privilege;
 354 }
 355
 356 static inline void privilege_remove( struct privilege *privilege )
 357 {
 358     list_remove( &privilege->entry );
 359     free( privilege );
 360 }
 361
 362 static void token_destroy( struct object *obj )
 363 {
 364     struct token* token;
 365     struct list *cursor, *cursor_next;
 366
 367     assert( obj->ops == &token_ops );
 368     token = (struct token *)obj;
 369
 370     free( token->user );
 371
 372     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
 373     {
 374         struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
 375         privilege_remove( privilege );
 376     }
 377
 378     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
 379     {
 380         struct sid_and_attributes *group = LIST_ENTRY( cursor, struct sid_and_attributes, entry );
 381         list_remove( &group->entry );
 382         free( group );
 383     }
 384
 385     free( token->default_dacl );
 386 }
 387
 388 /* creates a new token.
 389  *  groups may be NULL if group_count is 0.
 390  *  privs may be NULL if priv_count is 0.
 391  *  default_dacl may be NULL, indicating that all objects created by the user
 392  *   are unsecured.
 393  */
 394 static struct token *create_token( unsigned primary, const SID *user,
 395                                    const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
 396                                    const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
 397                                    const ACL *default_dacl )
 398 {
 399     struct token *token = alloc_object( &token_ops );
 400     if (token)
 401     {
 402         int i;
 403
 404         list_init( &token->privileges );
 405         list_init( &token->groups );
 406         token->primary = primary;
 407
 408         /* copy user */
 409         token->user = memdup( user, FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]) );
 410         if (!token->user)
 411         {
 412             release_object( token );
 413             return NULL;
 414         }
 415
 416         /* copy groups */
 417         for (i = 0; i < group_count; i++)
 418         {
 419             size_t size = FIELD_OFFSET( struct sid_and_attributes, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
 420             struct sid_and_attributes *group = mem_alloc( size );
 421             memcpy( &group->sid, groups[i].Sid, FIELD_OFFSET( SID, SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] ) );
 422             group->enabled = TRUE;
 423             group->def = TRUE;
 424             group->logon = FALSE;
 425             group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) ? TRUE : FALSE;
 426             group->owner = FALSE;
 427             group->resource = FALSE;
 428             group->deny_only = FALSE;
 429             list_add_tail( &token->groups, &group->entry );
 430         }
 431
 432         /* copy privileges */
 433         for (i = 0; i < priv_count; i++)
 434         {
 435             /* note: we don't check uniqueness: the caller must make sure
 436              * privs doesn't contain any duplicate luids */
 437             if (!privilege_add( token, &privs[i].Luid,
 438                                 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
 439             {
 440                 release_object( token );
 441                 return NULL;
 442             }
 443         }
 444
 445         if (default_dacl)
 446         {
 447             token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
 448             if (!token->default_dacl)
 449             {
 450                 release_object( token );
 451                 return NULL;
 452             }
 453         }
 454         else
 455             token->default_dacl = NULL;
 456     }
 457     return token;
 458 }
 459
 460 static ACL *create_default_dacl( const SID *user )
 461 {
 462     ACCESS_ALLOWED_ACE *aaa;
 463     ACL *default_dacl;
 464     SID *sid;
 465     size_t default_dacl_size = sizeof(ACL) +
 466                                2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 467                                sizeof(local_system_sid) +
 468                                FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]);
 469
 470     default_dacl = mem_alloc( default_dacl_size );
 471     if (!default_dacl) return NULL;
 472
 473     default_dacl->AclRevision = MAX_ACL_REVISION;
 474     default_dacl->Sbz1 = 0;
 475     default_dacl->AclSize = default_dacl_size;
 476     default_dacl->AceCount = 2;
 477     default_dacl->Sbz2 = 0;
 478
 479     /* GENERIC_ALL for Local System */
 480     aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
 481     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 482     aaa->Header.AceFlags = 0;
 483     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 484                           sizeof(local_system_sid);
 485     aaa->Mask = GENERIC_ALL;
 486     sid = (SID *)&aaa->SidStart;
 487     memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
 488
 489     /* GENERIC_ALL for specified user */
 490     aaa = (ACCESS_ALLOWED_ACE *)((const char *)aaa + aaa->Header.AceSize);
 491     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 492     aaa->Header.AceFlags = 0;
 493     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 494                           FIELD_OFFSET( SID, SubAuthority[user->SubAuthorityCount] );
 495     aaa->Mask = GENERIC_ALL;
 496     sid = (SID *)&aaa->SidStart;
 497     memcpy( sid, user, FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]) );
 498
 499     return default_dacl;
 500 }
 501
 502 struct sid_data
 503 {
 504     SID_IDENTIFIER_AUTHORITY idauth;
 505     int count;
 506     unsigned int subauth[MAX_SUBAUTH_COUNT];
 507 };
 508
 509 struct token *token_create_admin( void )
 510 {
 511     struct token *token = NULL;
 512     static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
 513     static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
 514     static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
 515     PSID alias_admins_sid;
 516     PSID alias_users_sid;
 517     ACL *default_dacl = create_default_dacl( &local_system_sid );
 518
 519     alias_admins_sid = security_sid_alloc( &nt_authority, sizeof(alias_admins_subauth)/sizeof(alias_admins_subauth[0]),
 520                                            alias_admins_subauth );
 521     alias_users_sid = security_sid_alloc( &nt_authority, sizeof(alias_users_subauth)/sizeof(alias_users_subauth[0]),
 522                                           alias_users_subauth );
 523
 524     if (alias_admins_sid && alias_users_sid && default_dacl)
 525     {
 526         const LUID_AND_ATTRIBUTES admin_privs[] =
 527         {
 528             { SeChangeNotifyPrivilege        , SE_PRIVILEGE_ENABLED },
 529             { SeSecurityPrivilege            , 0                    },
 530             { SeBackupPrivilege              , 0                    },
 531             { SeRestorePrivilege             , 0                    },
 532             { SeSystemtimePrivilege          , 0                    },
 533             { SeShutdownPrivilege            , 0                    },
 534             { SeRemoteShutdownPrivilege      , 0                    },
 535             { SeTakeOwnershipPrivilege       , 0                    },
 536             { SeDebugPrivilege               , 0                    },
 537             { SeSystemEnvironmentPrivilege   , 0                    },
 538             { SeSystemProfilePrivilege       , 0                    },
 539             { SeProfileSingleProcessPrivilege, 0                    },
 540             { SeIncreaseBasePriorityPrivilege, 0                    },
 541             { SeLoadDriverPrivilege          , 0                    },
 542             { SeCreatePagefilePrivilege      , 0                    },
 543             { SeIncreaseQuotaPrivilege       , 0                    },
 544             { SeUndockPrivilege              , 0                    },
 545             { SeManageVolumePrivilege        , 0                    },
 546             { SeImpersonatePrivilege         , SE_PRIVILEGE_ENABLED },
 547             { SeCreateGlobalPrivilege        , SE_PRIVILEGE_ENABLED },
 548         };
 549         /* note: we don't include non-builtin groups here for the user -
 550          * telling us these is the job of a client-side program */
 551         const SID_AND_ATTRIBUTES admin_groups[] =
 552         {
 553             { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 554             { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 555             { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 556             { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 557             { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 558             { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 559         };
 560         /* note: we just set the user sid to be the local system builtin sid -
 561          * telling us what this should be is the job of a client-side program */
 562         token = create_token( TRUE, &local_system_sid,
 563                             admin_groups, sizeof(admin_groups)/sizeof(admin_groups[0]),
 564                             admin_privs, sizeof(admin_privs)/sizeof(admin_privs[0]),
 565                             default_dacl );
 566     }
 567
 568     if (alias_admins_sid)
 569         free( alias_admins_sid );
 570     if (alias_users_sid)
 571         free( alias_users_sid );
 572     if (default_dacl)
 573         free( default_dacl );
 574
 575     return token;
 576 }
 577
 578 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
 579 {
 580     struct privilege *privilege;
 581     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 582     {
 583         if (is_equal_luid( luid, &privilege->luid ))
 584         {
 585             if (enabled_only && !privilege->enabled)
 586                 return NULL;
 587             return privilege;
 588         }
 589     }
 590     return NULL;
 591 }
 592
 593 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
 594                                              unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
 595                                              unsigned int mod_privs_count )
 596 {
 597     int i;
 598     unsigned int modified_count = 0;
 599
 600     for (i = 0; i < count; i++)
 601     {
 602         struct privilege *privilege =
 603             token_find_privilege( token, &privs[i].Luid, FALSE );
 604         if (!privilege)
 605         {
 606             set_error( STATUS_NOT_ALL_ASSIGNED );
 607             continue;
 608         }
 609
 610         if (privs[i].Attributes & SE_PRIVILEGE_REMOVE)
 611             privilege_remove( privilege );
 612         else
 613         {
 614             /* save previous state for caller */
 615             if (mod_privs_count)
 616             {
 617                 luid_and_attr_from_privilege(mod_privs, privilege);
 618                 mod_privs++;
 619                 mod_privs_count--;
 620                 modified_count++;
 621             }
 622
 623             if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
 624                 privilege->enabled = TRUE;
 625             else
 626                 privilege->enabled = FALSE;
 627         }
 628     }
 629     return modified_count;
 630 }
 631
 632 static void token_disable_privileges( struct token *token )
 633 {
 634     struct privilege *privilege;
 635     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 636         privilege->enabled = FALSE;
 637 }
 638
 639 int token_check_privileges( struct token *token, int all_required,
 640                             const LUID_AND_ATTRIBUTES *reqprivs,
 641                             unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
 642 {
 643     int i;
 644     unsigned int enabled_count = 0;
 645
 646     for (i = 0; i < count; i++)
 647     {
 648         struct privilege *privilege =
 649             token_find_privilege( token, &reqprivs[i].Luid, TRUE );
 650
 651         if (usedprivs)
 652             usedprivs[i] = reqprivs[i];
 653
 654         if (privilege && privilege->enabled)
 655         {
 656             enabled_count++;
 657             if (usedprivs)
 658                 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
 659         }
 660     }
 661
 662     if (all_required)
 663         return (enabled_count == count);
 664     else
 665         return (enabled_count > 0);
 666 }
 667
 668 static int token_sid_present( struct token *token, const SID *sid, int deny )
 669 {
 670     struct sid_and_attributes *group;
 671
 672     if (security_equal_sid( token->user, sid )) return TRUE;
 673
 674     LIST_FOR_EACH_ENTRY( group, &token->groups, struct sid_and_attributes, entry )
 675     {
 676         if (!group->enabled) continue;
 677         if (group->deny_only && !deny) continue;
 678
 679         if (security_equal_sid( &group->sid, sid )) return TRUE;
 680     }
 681
 682     return FALSE;
 683 }
 684
 685 /* checks access to a security descriptor. sd must have been validated by caller.
 686  * it returns STATUS_SUCCESS if access was granted to the object, or an error
 687  * status code if not, giving the reason. errors not relating to giving access
 688  * to the object are returned in the status parameter. granted_access and
 689  * status always have a valid value stored in them on return. */
 690 static unsigned int token_access_check( struct token *token,
 691                                  const struct security_descriptor *sd,
 692                                  unsigned int desired_access,
 693                                  LUID_AND_ATTRIBUTES *privs,
 694                                  unsigned int *priv_count,
 695                                  const GENERIC_MAPPING *mapping,
 696                                  unsigned int *granted_access,
 697                                  unsigned int *status )
 698 {
 699     unsigned int current_access = 0;
 700     unsigned int denied_access = 0;
 701     ULONG i;
 702     const ACL *dacl;
 703     int dacl_present;
 704     const ACE_HEADER *ace;
 705     const SID *owner;
 706
 707     /* assume success, but no access rights */
 708     *status = STATUS_SUCCESS;
 709     *granted_access = 0;
 710
 711     /* fail if desired_access contains generic rights */
 712     if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
 713     {
 714         *priv_count = 0;
 715         *status = STATUS_GENERIC_NOT_MAPPED;
 716         return STATUS_ACCESS_DENIED;
 717     }
 718
 719     dacl = sd_get_dacl( sd, &dacl_present );
 720     owner = sd_get_owner( sd );
 721     if (!owner || !sd_get_group( sd ))
 722     {
 723         *priv_count = 0;
 724         *status = STATUS_INVALID_SECURITY_DESCR;
 725         return STATUS_ACCESS_DENIED;
 726     }
 727
 728     /* 1: Grant desired access if the object is unprotected */
 729     if (!dacl_present)
 730     {
 731         *priv_count = 0;
 732         *granted_access = desired_access;
 733         return STATUS_SUCCESS;
 734     }
 735     if (!dacl)
 736     {
 737         *priv_count = 0;
 738         return STATUS_ACCESS_DENIED;
 739     }
 740
 741     /* 2: Check if caller wants access to system security part. Note: access
 742      * is only granted if specifically asked for */
 743     if (desired_access & ACCESS_SYSTEM_SECURITY)
 744     {
 745         const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
 746         LUID_AND_ATTRIBUTES retpriv = security_priv;
 747         if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
 748         {
 749             if (priv_count)
 750             {
 751                 /* assumes that there will only be one privilege to return */
 752                 if (*priv_count >= 1)
 753                 {
 754                     *priv_count = 1;
 755                     *privs = retpriv;
 756                 }
 757                 else
 758                 {
 759                     *priv_count = 1;
 760                     return STATUS_BUFFER_TOO_SMALL;
 761                 }
 762             }
 763             current_access |= ACCESS_SYSTEM_SECURITY;
 764             if (desired_access == current_access)
 765             {
 766                 *granted_access = current_access;
 767                 return STATUS_SUCCESS;
 768             }
 769         }
 770         else
 771         {
 772             *priv_count = 0;
 773             return STATUS_PRIVILEGE_NOT_HELD;
 774         }
 775     }
 776     else if (priv_count) *priv_count = 0;
 777
 778     /* 3: Check whether the token is the owner */
 779     /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
 780      * checked when a "set owner" call is made, overriding the access rights
 781      * determined here. */
 782     if (token_sid_present( token, owner, FALSE ))
 783     {
 784         current_access |= (READ_CONTROL | WRITE_DAC);
 785         if (desired_access == current_access)
 786         {
 787             *granted_access = current_access;
 788             return STATUS_SUCCESS;
 789         }
 790     }
 791
 792     /* 4: Grant rights according to the DACL */
 793     ace = (const ACE_HEADER *)(dacl + 1);
 794     for (i = 0; i < dacl->AceCount; i++)
 795     {
 796         const ACCESS_ALLOWED_ACE *aa_ace;
 797         const ACCESS_DENIED_ACE *ad_ace;
 798         const SID *sid;
 799         switch (ace->AceType)
 800         {
 801         case ACCESS_DENIED_ACE_TYPE:
 802             ad_ace = (const ACCESS_DENIED_ACE *)ace;
 803             sid = (const SID *)&ad_ace->SidStart;
 804             if (token_sid_present( token, sid, TRUE ))
 805             {
 806                 unsigned int access = ad_ace->Mask;
 807                 map_generic_mask(&access, mapping);
 808                 if (desired_access & MAXIMUM_ALLOWED)
 809                     denied_access |= access;
 810                 else
 811                 {
 812                     denied_access |= (access & ~current_access);
 813                     if (desired_access & access)
 814                     {
 815                         *granted_access = 0;
 816                         return STATUS_SUCCESS;
 817                     }
 818                 }
 819             }
 820             break;
 821         case ACCESS_ALLOWED_ACE_TYPE:
 822             aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
 823             sid = (const SID *)&aa_ace->SidStart;
 824             if (token_sid_present( token, sid, FALSE ))
 825             {
 826                 unsigned int access = aa_ace->Mask;
 827                 map_generic_mask(&access, mapping);
 828                 if (desired_access & MAXIMUM_ALLOWED)
 829                     current_access |= access;
 830                 else
 831                     current_access |= (access & ~denied_access);
 832             }
 833             break;
 834         }
 835
 836         /* don't bother carrying on checking if we've already got all of
 837             * rights we need */
 838         if (desired_access == *granted_access)
 839             break;
 840
 841         ace = ace_next( ace );
 842     }
 843
 844     if (desired_access & MAXIMUM_ALLOWED)
 845     {
 846         *granted_access = current_access & ~denied_access;
 847         if (*granted_access)
 848             return STATUS_SUCCESS;
 849         else
 850             return STATUS_ACCESS_DENIED;
 851     }
 852     else
 853     {
 854         if ((current_access & desired_access) == desired_access)
 855         {
 856             *granted_access = current_access & desired_access;
 857             return STATUS_SUCCESS;
 858         }
 859         else
 860             return STATUS_ACCESS_DENIED;
 861     }
 862 }
 863
 864 const ACL *token_get_default_dacl( struct token *token )
 865 {
 866     return token->default_dacl;
 867 }
 868
 869 /* open a security token */
 870 DECL_HANDLER(open_token)
 871 {
 872     if (req->flags & OPEN_TOKEN_THREAD)
 873     {
 874         struct thread *thread = get_thread_from_handle( req->handle, 0 );
 875         if (thread)
 876         {
 877             if (thread->token)
 878                 reply->token = alloc_handle( current->process, thread->token, TOKEN_ALL_ACCESS, 0);
 879             else
 880                 set_error(STATUS_NO_TOKEN);
 881             release_object( thread );
 882         }
 883     }
 884     else
 885     {
 886         struct process *process = get_process_from_handle( req->handle, 0 );
 887         if (process)
 888         {
 889             if (process->token)
 890                 reply->token = alloc_handle( current->process, process->token, TOKEN_ALL_ACCESS, 0);
 891             else
 892                 set_error(STATUS_NO_TOKEN);
 893             release_object( process );
 894         }
 895     }
 896 }
 897
 898 /* adjust the privileges held by a token */
 899 DECL_HANDLER(adjust_token_privileges)
 900 {
 901     struct token *token;
 902     unsigned int access = TOKEN_ADJUST_PRIVILEGES;
 903
 904     if (req->get_modified_state) access |= TOKEN_QUERY;
 905
 906     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
 907                                                  access, &token_ops )))
 908     {
 909         const LUID_AND_ATTRIBUTES *privs = get_req_data();
 910         LUID_AND_ATTRIBUTES *modified_privs = NULL;
 911         unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
 912         unsigned int modified_priv_count = 0;
 913
 914         if (req->get_modified_state && !req->disable_all)
 915         {
 916             int i;
 917             /* count modified privs */
 918             for (i = 0; i < priv_count; i++)
 919             {
 920                 struct privilege *privilege =
 921                     token_find_privilege( token, &privs[i].Luid, FALSE );
 922                 if (privilege && req->get_modified_state)
 923                     modified_priv_count++;
 924             }
 925             reply->len = modified_priv_count;
 926             modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
 927             if (modified_priv_count)
 928                 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
 929         }
 930         reply->len = modified_priv_count * sizeof(*modified_privs);
 931
 932         if (req->disable_all)
 933             token_disable_privileges( token );
 934         else
 935             modified_priv_count = token_adjust_privileges( token, privs,
 936                 priv_count, modified_privs, modified_priv_count );
 937
 938         release_object( token );
 939     }
 940 }
 941
 942 /* retrieves the list of privileges that may be held be the token */
 943 DECL_HANDLER(get_token_privileges)
 944 {
 945     struct token *token;
 946
 947     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
 948                                                  TOKEN_QUERY,
 949                                                  &token_ops )))
 950     {
 951         int priv_count = 0;
 952         LUID_AND_ATTRIBUTES *privs;
 953         struct privilege *privilege;
 954
 955         LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 956             priv_count++;
 957
 958         reply->len = priv_count * sizeof(*privs);
 959         if (reply->len <= get_reply_max_size())
 960         {
 961             privs = set_reply_data_size( priv_count * sizeof(*privs) );
 962             if (privs)
 963             {
 964                 int i = 0;
 965                 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 966                 {
 967                     luid_and_attr_from_privilege( &privs[i], privilege );
 968                     i++;
 969                 }
 970             }
 971         }
 972         else
 973             set_error(STATUS_BUFFER_TOO_SMALL);
 974
 975         release_object( token );
 976     }
 977 }
 978
 979 /* creates a duplicate of the token */
 980 DECL_HANDLER(duplicate_token)
 981 {
 982     struct token *src_token;
 983     if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
 984                                                      TOKEN_DUPLICATE,
 985                                                      &token_ops )))
 986     {
 987         /* FIXME: use req->impersonation_level */
 988         struct token *token = create_token( req->primary, src_token->user, NULL, 0, NULL, 0, src_token->default_dacl );
 989         if (token)
 990         {
 991             struct privilege *privilege;
 992             struct sid_and_attributes *group;
 993             unsigned int access;
 994
 995             /* copy groups */
 996             LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct sid_and_attributes, entry )
 997             {
 998                 size_t size = FIELD_OFFSET( struct sid_and_attributes, sid.SubAuthority[group->sid.SubAuthorityCount] );
 999                 struct sid_and_attributes *newgroup = mem_alloc( size );
1000                 memcpy( newgroup, group, size );
1001                 list_add_tail( &token->groups, &newgroup->entry );
1002             }
1003
1004             /* copy privileges */
1005             LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
1006                 privilege_add( token, &privilege->luid, privilege->enabled );
1007
1008             access = req->access;
1009             if (access & MAXIMUM_ALLOWED) access = TOKEN_ALL_ACCESS; /* FIXME: needs general solution */
1010             reply->new_handle = alloc_handle( current->process, token, access, req->inherit);
1011             release_object( token );
1012         }
1013         release_object( src_token );
1014     }
1015 }
1016
1017 /* checks the specified privileges are held by the token */
1018 DECL_HANDLER(check_token_privileges)
1019 {
1020     struct token *token;
1021
1022     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1023                                                  TOKEN_QUERY,
1024                                                  &token_ops )))
1025     {
1026         unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1027         if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1028         {
1029             LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1030             reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1031         }
1032         else
1033             set_error( STATUS_BUFFER_OVERFLOW );
1034         release_object( token );
1035     }
1036 }
1037
1038 /* checks that a user represented by a token is allowed to access an object
1039  * represented by a security descriptor */
1040 DECL_HANDLER(access_check)
1041 {
1042     size_t sd_size = get_req_data_size();
1043     const struct security_descriptor *sd = get_req_data();
1044     struct token *token;
1045
1046     if (!sd_is_valid( sd, sd_size ))
1047     {
1048         set_error( STATUS_ACCESS_VIOLATION );
1049         return;
1050     }
1051
1052     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1053                                                  TOKEN_QUERY,
1054                                                  &token_ops )))
1055     {
1056         GENERIC_MAPPING mapping;
1057         unsigned int status;
1058         LUID_AND_ATTRIBUTES priv;
1059         unsigned int priv_count = 1;
1060
1061         memset(&priv, 0, sizeof(priv));
1062
1063         /* only impersonation tokens may be used with this function */
1064         if (token->primary)
1065         {
1066             set_error( STATUS_NO_IMPERSONATION_TOKEN );
1067             release_object( token );
1068             return;
1069         }
1070
1071         mapping.GenericRead = req->mapping_read;
1072         mapping.GenericWrite = req->mapping_write;
1073         mapping.GenericExecute = req->mapping_execute;
1074         mapping.GenericAll = req->mapping_all;
1075
1076         reply->access_status = token_access_check(
1077             token, sd, req->desired_access, &priv, &priv_count, &mapping,
1078             &reply->access_granted, &status );
1079
1080         reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1081
1082         if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1083         {
1084             LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1085             memcpy( privs, &priv, sizeof(priv) );
1086         }
1087
1088         if (status != STATUS_SUCCESS)
1089             set_error( status );
1090
1091         release_object( token );
1092     }
1093 }