?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
advapi32: Add well-known SID WinBuiltinAnyPackageSid.
[wine.git] / dlls / advapi32 / tests / security.c
blob46db49c5c0ddfe9c1cceb83ec4ca69bd109be0e4
1 /*
2 * Unit tests for security functions
3 *
4 * Copyright (c) 2004 Mike McCormack
5 * Copyright (c) 2011 Dmitry Timoshkov
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
20 */
21
22 #include <stdarg.h>
23 #include <stdio.h>
24
25 #include "ntstatus.h"
26 #define WIN32_NO_STATUS
27 #include "windef.h"
28 #include "winbase.h"
29 #include "winerror.h"
30 #include "winternl.h"
31 #include "aclapi.h"
32 #include "winnt.h"
33 #include "sddl.h"
34 #include "ntsecapi.h"
35 #include "lmcons.h"
36
37 #include "wine/test.h"
38
39 #ifndef PROCESS_QUERY_LIMITED_INFORMATION
40 #define PROCESS_QUERY_LIMITED_INFORMATION 0x1000
41 #endif
42
43 /* PROCESS_ALL_ACCESS in Vista+ PSDKs is incompatible with older Windows versions */
44 #define PROCESS_ALL_ACCESS_NT4 (PROCESS_ALL_ACCESS & ~0xf000)
45 #define PROCESS_ALL_ACCESS_VISTA (PROCESS_ALL_ACCESS | 0xf000)
46
47 #ifndef EVENT_QUERY_STATE
48 #define EVENT_QUERY_STATE 0x0001
49 #endif
50
51 #ifndef SEMAPHORE_QUERY_STATE
52 #define SEMAPHORE_QUERY_STATE 0x0001
53 #endif
54
55 #ifndef THREAD_SET_LIMITED_INFORMATION
56 #define THREAD_SET_LIMITED_INFORMATION 0x0400
57 #define THREAD_QUERY_LIMITED_INFORMATION 0x0800
58 #endif
59
60 #define THREAD_ALL_ACCESS_NT4 (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3ff)
61 #define THREAD_ALL_ACCESS_VISTA (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff)
62
63 #define expect_eq(expr, value, type, format) { type ret_ = expr; ok((value) == ret_, #expr " expected " format " got " format "\n", (value), (ret_)); }
64
65 static BOOL (WINAPI *pAddAccessAllowedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
66 static BOOL (WINAPI *pAddAccessDeniedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
67 static BOOL (WINAPI *pAddAuditAccessAceEx)(PACL, DWORD, DWORD, DWORD, PSID, BOOL, BOOL);
68 static VOID (WINAPI *pBuildTrusteeWithSidA)( PTRUSTEEA pTrustee, PSID pSid );
69 static VOID (WINAPI *pBuildTrusteeWithNameA)( PTRUSTEEA pTrustee, LPSTR pName );
70 static VOID (WINAPI *pBuildTrusteeWithObjectsAndNameA)( PTRUSTEEA pTrustee,
71 POBJECTS_AND_NAME_A pObjName,
72 SE_OBJECT_TYPE ObjectType,
73 LPSTR ObjectTypeName,
74 LPSTR InheritedObjectTypeName,
75 LPSTR Name );
76 static VOID (WINAPI *pBuildTrusteeWithObjectsAndSidA)( PTRUSTEEA pTrustee,
77 POBJECTS_AND_SID pObjSid,
78 GUID* pObjectGuid,
79 GUID* pInheritedObjectGuid,
80 PSID pSid );
81 static LPSTR (WINAPI *pGetTrusteeNameA)( PTRUSTEEA pTrustee );
82 static BOOL (WINAPI *pMakeSelfRelativeSD)( PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR, LPDWORD );
83 static BOOL (WINAPI *pConvertSidToStringSidA)( PSID pSid, LPSTR *str );
84 static BOOL (WINAPI *pConvertStringSidToSidA)( LPCSTR str, PSID pSid );
85 static BOOL (WINAPI *pCheckTokenMembership)(HANDLE, PSID, PBOOL);
86 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorA)(LPCSTR, DWORD,
87 PSECURITY_DESCRIPTOR*, PULONG );
88 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorW)(LPCWSTR, DWORD,
89 PSECURITY_DESCRIPTOR*, PULONG );
90 static BOOL (WINAPI *pConvertSecurityDescriptorToStringSecurityDescriptorA)(PSECURITY_DESCRIPTOR, DWORD,
91 SECURITY_INFORMATION, LPSTR *, PULONG );
92 static BOOL (WINAPI *pGetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
93 PSECURITY_DESCRIPTOR, DWORD, LPDWORD);
94 static BOOL (WINAPI *pSetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
95 PSECURITY_DESCRIPTOR);
96 static DWORD (WINAPI *pGetNamedSecurityInfoA)(LPSTR, SE_OBJECT_TYPE, SECURITY_INFORMATION,
97 PSID*, PSID*, PACL*, PACL*,
98 PSECURITY_DESCRIPTOR*);
99 static DWORD (WINAPI *pSetNamedSecurityInfoA)(LPSTR, SE_OBJECT_TYPE, SECURITY_INFORMATION,
100 PSID, PSID, PACL, PACL);
101 static PDWORD (WINAPI *pGetSidSubAuthority)(PSID, DWORD);
102 static PUCHAR (WINAPI *pGetSidSubAuthorityCount)(PSID);
103 static BOOL (WINAPI *pIsValidSid)(PSID);
104 static DWORD (WINAPI *pRtlAdjustPrivilege)(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
105 static BOOL (WINAPI *pCreateWellKnownSid)(WELL_KNOWN_SID_TYPE,PSID,PSID,DWORD*);
106 static BOOL (WINAPI *pDuplicateTokenEx)(HANDLE,DWORD,LPSECURITY_ATTRIBUTES,
107 SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
108
109 static NTSTATUS (WINAPI *pLsaQueryInformationPolicy)(LSA_HANDLE,POLICY_INFORMATION_CLASS,PVOID*);
110 static NTSTATUS (WINAPI *pLsaClose)(LSA_HANDLE);
111 static NTSTATUS (WINAPI *pLsaFreeMemory)(PVOID);
112 static NTSTATUS (WINAPI *pLsaOpenPolicy)(PLSA_UNICODE_STRING,PLSA_OBJECT_ATTRIBUTES,ACCESS_MASK,PLSA_HANDLE);
113 static NTSTATUS (WINAPI *pNtQueryObject)(HANDLE,OBJECT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
114 static DWORD (WINAPI *pSetEntriesInAclW)(ULONG, PEXPLICIT_ACCESSW, PACL, PACL*);
115 static DWORD (WINAPI *pSetEntriesInAclA)(ULONG, PEXPLICIT_ACCESSA, PACL, PACL*);
116 static BOOL (WINAPI *pSetSecurityDescriptorControl)(PSECURITY_DESCRIPTOR, SECURITY_DESCRIPTOR_CONTROL,
117 SECURITY_DESCRIPTOR_CONTROL);
118 static DWORD (WINAPI *pGetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION,
119 PSID*, PSID*, PACL*, PACL*, PSECURITY_DESCRIPTOR*);
120 static DWORD (WINAPI *pSetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION,
121 PSID, PSID, PACL, PACL);
122 static NTSTATUS (WINAPI *pNtAccessCheck)(PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK, PGENERIC_MAPPING,
123 PPRIVILEGE_SET, PULONG, PULONG, NTSTATUS*);
124 static BOOL (WINAPI *pCreateRestrictedToken)(HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD,
125 PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE);
126 static BOOL (WINAPI *pGetAclInformation)(PACL,LPVOID,DWORD,ACL_INFORMATION_CLASS);
127 static BOOL (WINAPI *pGetAce)(PACL,DWORD,LPVOID*);
128 static NTSTATUS (WINAPI *pNtSetSecurityObject)(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
129 static NTSTATUS (WINAPI *pNtCreateFile)(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
130 static BOOL (WINAPI *pRtlDosPathNameToNtPathName_U)(LPCWSTR,PUNICODE_STRING,PWSTR*,CURDIR*);
131 static NTSTATUS (WINAPI *pRtlAnsiStringToUnicodeString)(PUNICODE_STRING,PCANSI_STRING,BOOLEAN);
132 static BOOL (WINAPI *pGetWindowsAccountDomainSid)(PSID,PSID,DWORD*);
133 static void (WINAPI *pRtlInitAnsiString)(PANSI_STRING,PCSZ);
134 static NTSTATUS (WINAPI *pRtlFreeUnicodeString)(PUNICODE_STRING);
135
136 static HMODULE hmod;
137 static int myARGC;
138 static char** myARGV;
139
140 struct strsid_entry
141 {
142 const char *str;
143 DWORD flags;
144 };
145 #define STRSID_OK 0
146 #define STRSID_OPT 1
147
148 struct sidRef
149 {
150 SID_IDENTIFIER_AUTHORITY auth;
151 const char *refStr;
152 };
153
154 static void init(void)
155 {
156 HMODULE hntdll;
157
158 hntdll = GetModuleHandleA("ntdll.dll");
159 pNtQueryObject = (void *)GetProcAddress( hntdll, "NtQueryObject" );
160 pNtAccessCheck = (void *)GetProcAddress( hntdll, "NtAccessCheck" );
161 pNtSetSecurityObject = (void *)GetProcAddress(hntdll, "NtSetSecurityObject");
162 pNtCreateFile = (void *)GetProcAddress(hntdll, "NtCreateFile");
163 pRtlDosPathNameToNtPathName_U = (void *)GetProcAddress(hntdll, "RtlDosPathNameToNtPathName_U");
164 pRtlAnsiStringToUnicodeString = (void *)GetProcAddress(hntdll, "RtlAnsiStringToUnicodeString");
165 pRtlInitAnsiString = (void *)GetProcAddress(hntdll, "RtlInitAnsiString");
166 pRtlFreeUnicodeString = (void *)GetProcAddress(hntdll, "RtlFreeUnicodeString");
167
168 hmod = GetModuleHandleA("advapi32.dll");
169 pAddAccessAllowedAceEx = (void *)GetProcAddress(hmod, "AddAccessAllowedAceEx");
170 pAddAccessDeniedAceEx = (void *)GetProcAddress(hmod, "AddAccessDeniedAceEx");
171 pAddAuditAccessAceEx = (void *)GetProcAddress(hmod, "AddAuditAccessAceEx");
172 pCheckTokenMembership = (void *)GetProcAddress(hmod, "CheckTokenMembership");
173 pConvertStringSecurityDescriptorToSecurityDescriptorA =
174 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
175 pConvertStringSecurityDescriptorToSecurityDescriptorW =
176 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorW" );
177 pConvertSecurityDescriptorToStringSecurityDescriptorA =
178 (void *)GetProcAddress(hmod, "ConvertSecurityDescriptorToStringSecurityDescriptorA" );
179 pGetFileSecurityA = (void *)GetProcAddress(hmod, "GetFileSecurityA" );
180 pSetFileSecurityA = (void *)GetProcAddress(hmod, "SetFileSecurityA" );
181 pCreateWellKnownSid = (void *)GetProcAddress( hmod, "CreateWellKnownSid" );
182 pGetNamedSecurityInfoA = (void *)GetProcAddress(hmod, "GetNamedSecurityInfoA");
183 pSetNamedSecurityInfoA = (void *)GetProcAddress(hmod, "SetNamedSecurityInfoA");
184 pGetSidSubAuthority = (void *)GetProcAddress(hmod, "GetSidSubAuthority");
185 pGetSidSubAuthorityCount = (void *)GetProcAddress(hmod, "GetSidSubAuthorityCount");
186 pIsValidSid = (void *)GetProcAddress(hmod, "IsValidSid");
187 pMakeSelfRelativeSD = (void *)GetProcAddress(hmod, "MakeSelfRelativeSD");
188 pSetEntriesInAclW = (void *)GetProcAddress(hmod, "SetEntriesInAclW");
189 pSetEntriesInAclA = (void *)GetProcAddress(hmod, "SetEntriesInAclA");
190 pSetSecurityDescriptorControl = (void *)GetProcAddress(hmod, "SetSecurityDescriptorControl");
191 pGetSecurityInfo = (void *)GetProcAddress(hmod, "GetSecurityInfo");
192 pSetSecurityInfo = (void *)GetProcAddress(hmod, "SetSecurityInfo");
193 pCreateRestrictedToken = (void *)GetProcAddress(hmod, "CreateRestrictedToken");
194 pConvertSidToStringSidA = (void *)GetProcAddress(hmod, "ConvertSidToStringSidA");
195 pConvertStringSidToSidA = (void *)GetProcAddress(hmod, "ConvertStringSidToSidA");
196 pGetAclInformation = (void *)GetProcAddress(hmod, "GetAclInformation");
197 pGetAce = (void *)GetProcAddress(hmod, "GetAce");
198 pGetWindowsAccountDomainSid = (void *)GetProcAddress(hmod, "GetWindowsAccountDomainSid");
199
200 myARGC = winetest_get_mainargs( &myARGV );
201 }
202
203 static SECURITY_DESCRIPTOR* test_get_security_descriptor(HANDLE handle, int line)
204 {
205 /* use HeapFree(GetProcessHeap(), 0, sd); when done */
206 DWORD ret, length, needed;
207 SECURITY_DESCRIPTOR *sd;
208
209 needed = 0xdeadbeef;
210 SetLastError(0xdeadbeef);
211 ret = GetKernelObjectSecurity(handle, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
212 NULL, 0, &needed);
213 ok_(__FILE__, line)(!ret, "GetKernelObjectSecurity should fail\n");
214 ok_(__FILE__, line)(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
215 ok_(__FILE__, line)(needed != 0xdeadbeef, "GetKernelObjectSecurity should return required buffer length\n");
216
217 length = needed;
218 sd = HeapAlloc(GetProcessHeap(), 0, length);
219
220 needed = 0xdeadbeef;
221 SetLastError(0xdeadbeef);
222 ret = GetKernelObjectSecurity(handle, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
223 sd, length, &needed);
224 ok_(__FILE__, line)(ret, "GetKernelObjectSecurity error %d\n", GetLastError());
225 ok_(__FILE__, line)(needed == length || needed == 0 /* file, pipe */, "GetKernelObjectSecurity should return %u instead of %u\n", length, needed);
226 return sd;
227 }
228
229 static void test_owner_equal(HANDLE Handle, PSID expected, int line)
230 {
231 BOOL res;
232 SECURITY_DESCRIPTOR *queriedSD = NULL;
233 PSID owner;
234 BOOL owner_defaulted;
235
236 queriedSD = test_get_security_descriptor( Handle, line );
237
238 res = GetSecurityDescriptorOwner(queriedSD, &owner, &owner_defaulted);
239 ok_(__FILE__, line)(res, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
240
241 ok_(__FILE__, line)(EqualSid(owner, expected), "Owner SIDs are not equal\n");
242 ok_(__FILE__, line)(!owner_defaulted, "Defaulted is true\n");
243
244 HeapFree(GetProcessHeap(), 0, queriedSD);
245 }
246
247 static void test_group_equal(HANDLE Handle, PSID expected, int line)
248 {
249 BOOL res;
250 SECURITY_DESCRIPTOR *queriedSD = NULL;
251 PSID group;
252 BOOL group_defaulted;
253
254 queriedSD = test_get_security_descriptor( Handle, line );
255
256 res = GetSecurityDescriptorGroup(queriedSD, &group, &group_defaulted);
257 ok_(__FILE__, line)(res, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
258
259 ok_(__FILE__, line)(EqualSid(group, expected), "Group SIDs are not equal\n");
260 ok_(__FILE__, line)(!group_defaulted, "Defaulted is true\n");
261
262 HeapFree(GetProcessHeap(), 0, queriedSD);
263 }
264
265 static void test_sid(void)
266 {
267 struct sidRef refs[] = {
268 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
269 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
270 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
271 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
272 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
273 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
274 };
275 struct strsid_entry strsid_table[] = {
276 {"AO", STRSID_OK}, {"RU", STRSID_OK}, {"AN", STRSID_OK}, {"AU", STRSID_OK},
277 {"BA", STRSID_OK}, {"BG", STRSID_OK}, {"BO", STRSID_OK}, {"BU", STRSID_OK},
278 {"CA", STRSID_OPT}, {"CG", STRSID_OK}, {"CO", STRSID_OK}, {"DA", STRSID_OPT},
279 {"DC", STRSID_OPT}, {"DD", STRSID_OPT}, {"DG", STRSID_OPT}, {"DU", STRSID_OPT},
280 {"EA", STRSID_OPT}, {"ED", STRSID_OK}, {"WD", STRSID_OK}, {"PA", STRSID_OPT},
281 {"IU", STRSID_OK}, {"LA", STRSID_OK}, {"LG", STRSID_OK}, {"LS", STRSID_OK},
282 {"SY", STRSID_OK}, {"NU", STRSID_OK}, {"NO", STRSID_OK}, {"NS", STRSID_OK},
283 {"PO", STRSID_OK}, {"PS", STRSID_OK}, {"PU", STRSID_OK}, {"RS", STRSID_OPT},
284 {"RD", STRSID_OK}, {"RE", STRSID_OK}, {"RC", STRSID_OK}, {"SA", STRSID_OPT},
285 {"SO", STRSID_OK}, {"SU", STRSID_OK}};
286
287 const char noSubAuthStr[] = "S-1-5";
288 unsigned int i;
289 PSID psid = NULL;
290 SID *pisid;
291 BOOL r;
292 LPSTR str = NULL;
293
294 if( !pConvertSidToStringSidA || !pConvertStringSidToSidA )
295 {
296 win_skip("ConvertSidToStringSidA or ConvertStringSidToSidA not available\n");
297 return;
298 }
299
300 r = pConvertStringSidToSidA( NULL, NULL );
301 ok( !r, "expected failure with NULL parameters\n" );
302 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED )
303 return;
304 ok( GetLastError() == ERROR_INVALID_PARAMETER,
305 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
306 GetLastError() );
307
308 r = pConvertStringSidToSidA( refs[0].refStr, NULL );
309 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
310 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
311 GetLastError() );
312
313 r = pConvertStringSidToSidA( NULL, &str );
314 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
315 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
316 GetLastError() );
317
318 r = pConvertStringSidToSidA( noSubAuthStr, &psid );
319 ok( !r,
320 "expected failure with no sub authorities\n" );
321 ok( GetLastError() == ERROR_INVALID_SID,
322 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
323 GetLastError() );
324
325 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid), "ConvertStringSidToSidA failed\n");
326 pisid = psid;
327 ok(pisid->SubAuthorityCount == 4, "Invalid sub authority count - expected 4, got %d\n", pisid->SubAuthorityCount);
328 ok(pisid->SubAuthority[0] == 21, "Invalid subauthority 0 - expected 21, got %d\n", pisid->SubAuthority[0]);
329 ok(pisid->SubAuthority[3] == 4576, "Invalid subauthority 0 - expected 4576, got %d\n", pisid->SubAuthority[3]);
330 LocalFree(str);
331 LocalFree(psid);
332
333 for( i = 0; i < sizeof(refs) / sizeof(refs[0]); i++ )
334 {
335 r = AllocateAndInitializeSid( &refs[i].auth, 1,1,0,0,0,0,0,0,0,
336 &psid );
337 ok( r, "failed to allocate sid\n" );
338 r = pConvertSidToStringSidA( psid, &str );
339 ok( r, "failed to convert sid\n" );
340 if (r)
341 {
342 ok( !strcmp( str, refs[i].refStr ),
343 "incorrect sid, expected %s, got %s\n", refs[i].refStr, str );
344 LocalFree( str );
345 }
346 if( psid )
347 FreeSid( psid );
348
349 r = pConvertStringSidToSidA( refs[i].refStr, &psid );
350 ok( r, "failed to parse sid string\n" );
351 pisid = psid;
352 ok( pisid &&
353 !memcmp( pisid->IdentifierAuthority.Value, refs[i].auth.Value,
354 sizeof(refs[i].auth) ),
355 "string sid %s didn't parse to expected value\n"
356 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
357 refs[i].refStr,
358 MAKEWORD( pisid->IdentifierAuthority.Value[1],
359 pisid->IdentifierAuthority.Value[0] ),
360 MAKELONG( MAKEWORD( pisid->IdentifierAuthority.Value[5],
361 pisid->IdentifierAuthority.Value[4] ),
362 MAKEWORD( pisid->IdentifierAuthority.Value[3],
363 pisid->IdentifierAuthority.Value[2] ) ),
364 MAKEWORD( refs[i].auth.Value[1], refs[i].auth.Value[0] ),
365 MAKELONG( MAKEWORD( refs[i].auth.Value[5], refs[i].auth.Value[4] ),
366 MAKEWORD( refs[i].auth.Value[3], refs[i].auth.Value[2] ) ) );
367 if( psid )
368 LocalFree( psid );
369 }
370
371 /* string constant format not supported before XP */
372 r = pConvertStringSidToSidA(strsid_table[0].str, &psid);
373 if(!r)
374 {
375 win_skip("String constant format not supported\n");
376 return;
377 }
378 LocalFree(psid);
379
380 for(i = 0; i < sizeof(strsid_table) / sizeof(strsid_table[0]); i++)
381 {
382 char *temp;
383
384 SetLastError(0xdeadbeef);
385 r = pConvertStringSidToSidA(strsid_table[i].str, &psid);
386
387 if (!(strsid_table[i].flags & STRSID_OPT))
388 {
389 ok(r, "%s: got %u\n", strsid_table[i].str, GetLastError());
390 }
391
392 if (r)
393 {
394 if ((winetest_debug > 1) && (pConvertSidToStringSidA(psid, &temp)))
395 {
396 trace(" %s: %s\n", strsid_table[i].str, temp);
397 LocalFree(temp);
398 }
399 LocalFree(psid);
400 }
401 else
402 {
403 if (GetLastError() != ERROR_INVALID_SID)
404 trace(" %s: couldn't be converted, returned %d\n", strsid_table[i].str, GetLastError());
405 else
406 trace(" %s: couldn't be converted\n", strsid_table[i].str);
407 }
408 }
409 }
410
411 static void test_trustee(void)
412 {
413 GUID ObjectType = {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
414 GUID InheritedObjectType = {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
415 GUID ZeroGuid;
416 OBJECTS_AND_NAME_A oan;
417 OBJECTS_AND_SID oas;
418 TRUSTEEA trustee;
419 PSID psid;
420 char szObjectTypeName[] = "ObjectTypeName";
421 char szInheritedObjectTypeName[] = "InheritedObjectTypeName";
422 char szTrusteeName[] = "szTrusteeName";
423 SID_IDENTIFIER_AUTHORITY auth = { {0x11,0x22,0,0,0, 0} };
424
425 memset( &ZeroGuid, 0x00, sizeof (ZeroGuid) );
426
427 pBuildTrusteeWithSidA = (void *)GetProcAddress( hmod, "BuildTrusteeWithSidA" );
428 pBuildTrusteeWithNameA = (void *)GetProcAddress( hmod, "BuildTrusteeWithNameA" );
429 pBuildTrusteeWithObjectsAndNameA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndNameA" );
430 pBuildTrusteeWithObjectsAndSidA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndSidA" );
431 pGetTrusteeNameA = (void *)GetProcAddress (hmod, "GetTrusteeNameA" );
432 if( !pBuildTrusteeWithSidA || !pBuildTrusteeWithNameA ||
433 !pBuildTrusteeWithObjectsAndNameA || !pBuildTrusteeWithObjectsAndSidA ||
434 !pGetTrusteeNameA )
435 return;
436
437 if ( ! AllocateAndInitializeSid( &auth, 1, 42, 0,0,0,0,0,0,0,&psid ) )
438 {
439 trace( "failed to init SID\n" );
440 return;
441 }
442
443 /* test BuildTrusteeWithSidA */
444 memset( &trustee, 0xff, sizeof trustee );
445 pBuildTrusteeWithSidA( &trustee, psid );
446
447 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
448 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
449 "MultipleTrusteeOperation wrong\n");
450 ok( trustee.TrusteeForm == TRUSTEE_IS_SID, "TrusteeForm wrong\n");
451 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
452 ok( trustee.ptstrName == psid, "ptstrName wrong\n" );
453
454 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
455 memset( &trustee, 0xff, sizeof trustee );
456 memset( &oas, 0xff, sizeof(oas) );
457 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, &ObjectType,
458 &InheritedObjectType, psid);
459
460 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
461 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
462 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
463 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
464 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
465
466 ok(oas.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
467 ok(!memcmp(&oas.ObjectTypeGuid, &ObjectType, sizeof(GUID)), "ObjectTypeGuid wrong\n");
468 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
469 ok(oas.pSid == psid, "pSid wrong\n");
470
471 /* test GetTrusteeNameA */
472 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oas, "GetTrusteeName returned wrong value\n");
473
474 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
475 memset( &trustee, 0xff, sizeof trustee );
476 memset( &oas, 0xff, sizeof(oas) );
477 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, NULL,
478 &InheritedObjectType, psid);
479
480 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
481 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
482 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
483 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
484 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
485
486 ok(oas.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
487 ok(!memcmp(&oas.ObjectTypeGuid, &ZeroGuid, sizeof(GUID)), "ObjectTypeGuid wrong\n");
488 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
489 ok(oas.pSid == psid, "pSid wrong\n");
490
491 FreeSid( psid );
492
493 /* test BuildTrusteeWithNameA */
494 memset( &trustee, 0xff, sizeof trustee );
495 pBuildTrusteeWithNameA( &trustee, szTrusteeName );
496
497 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
498 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
499 "MultipleTrusteeOperation wrong\n");
500 ok( trustee.TrusteeForm == TRUSTEE_IS_NAME, "TrusteeForm wrong\n");
501 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
502 ok( trustee.ptstrName == szTrusteeName, "ptstrName wrong\n" );
503
504 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
505 memset( &trustee, 0xff, sizeof trustee );
506 memset( &oan, 0xff, sizeof(oan) );
507 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
508 szInheritedObjectTypeName, szTrusteeName);
509
510 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
511 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
512 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
513 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
514 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
515
516 ok(oan.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
517 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
518 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
519 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
520
521 /* test GetTrusteeNameA */
522 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oan, "GetTrusteeName returned wrong value\n");
523
524 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
525 memset( &trustee, 0xff, sizeof trustee );
526 memset( &oan, 0xff, sizeof(oan) );
527 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, NULL,
528 szInheritedObjectTypeName, szTrusteeName);
529
530 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
531 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
532 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
533 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
534 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
535
536 ok(oan.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
537 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
538 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
539 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
540
541 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
542 memset( &trustee, 0xff, sizeof trustee );
543 memset( &oan, 0xff, sizeof(oan) );
544 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
545 NULL, szTrusteeName);
546
547 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
548 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
549 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
550 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
551 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
552
553 ok(oan.ObjectsPresent == ACE_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
554 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
555 ok(oan.InheritedObjectTypeName == NULL, "InheritedObjectTypeName wrong\n");
556 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
557 }
558
559 /* If the first isn't defined, assume none is */
560 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
561 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
562 #define SE_CREATE_TOKEN_PRIVILEGE 2L
563 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
564 #define SE_LOCK_MEMORY_PRIVILEGE 4L
565 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
566 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
567 #define SE_TCB_PRIVILEGE 7L
568 #define SE_SECURITY_PRIVILEGE 8L
569 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
570 #define SE_LOAD_DRIVER_PRIVILEGE 10L
571 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
572 #define SE_SYSTEMTIME_PRIVILEGE 12L
573 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
574 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
575 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
576 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
577 #define SE_BACKUP_PRIVILEGE 17L
578 #define SE_RESTORE_PRIVILEGE 18L
579 #define SE_SHUTDOWN_PRIVILEGE 19L
580 #define SE_DEBUG_PRIVILEGE 20L
581 #define SE_AUDIT_PRIVILEGE 21L
582 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
583 #define SE_CHANGE_NOTIFY_PRIVILEGE 23L
584 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
585 #define SE_UNDOCK_PRIVILEGE 25L
586 #define SE_SYNC_AGENT_PRIVILEGE 26L
587 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
588 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
589 #define SE_IMPERSONATE_PRIVILEGE 29L
590 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
591 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
592 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
593
594 static void test_allocateLuid(void)
595 {
596 BOOL (WINAPI *pAllocateLocallyUniqueId)(PLUID);
597 LUID luid1, luid2;
598 BOOL ret;
599
600 pAllocateLocallyUniqueId = (void*)GetProcAddress(hmod, "AllocateLocallyUniqueId");
601 if (!pAllocateLocallyUniqueId) return;
602
603 ret = pAllocateLocallyUniqueId(&luid1);
604 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
605 return;
606
607 ok(ret,
608 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
609 ret = pAllocateLocallyUniqueId(&luid2);
610 ok( ret,
611 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
612 ok(luid1.LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE || luid1.HighPart != 0,
613 "AllocateLocallyUniqueId returned a well-known LUID\n");
614 ok(luid1.LowPart != luid2.LowPart || luid1.HighPart != luid2.HighPart,
615 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
616 ret = pAllocateLocallyUniqueId(NULL);
617 ok( !ret && GetLastError() == ERROR_NOACCESS,
618 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
619 GetLastError());
620 }
621
622 static void test_lookupPrivilegeName(void)
623 {
624 BOOL (WINAPI *pLookupPrivilegeNameA)(LPCSTR, PLUID, LPSTR, LPDWORD);
625 char buf[MAX_PATH]; /* arbitrary, seems long enough */
626 DWORD cchName = sizeof(buf);
627 LUID luid = { 0, 0 };
628 LONG i;
629 BOOL ret;
630
631 /* check whether it's available first */
632 pLookupPrivilegeNameA = (void*)GetProcAddress(hmod, "LookupPrivilegeNameA");
633 if (!pLookupPrivilegeNameA) return;
634 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
635 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
636 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
637 return;
638
639 /* check with a short buffer */
640 cchName = 0;
641 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
642 ret = pLookupPrivilegeNameA(NULL, &luid, NULL, &cchName);
643 ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
644 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
645 GetLastError());
646 ok(cchName == strlen("SeCreateTokenPrivilege") + 1,
647 "LookupPrivilegeNameA returned an incorrect required length for\n"
648 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
649 lstrlenA("SeCreateTokenPrivilege") + 1);
650 /* check a known value and its returned length on success */
651 cchName = sizeof(buf);
652 ok(pLookupPrivilegeNameA(NULL, &luid, buf, &cchName) &&
653 cchName == strlen("SeCreateTokenPrivilege"),
654 "LookupPrivilegeNameA returned an incorrect output length for\n"
655 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
656 (int)strlen("SeCreateTokenPrivilege"));
657 /* check known values */
658 for (i = SE_MIN_WELL_KNOWN_PRIVILEGE; i <= SE_MAX_WELL_KNOWN_PRIVILEGE; i++)
659 {
660 luid.LowPart = i;
661 cchName = sizeof(buf);
662 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
663 ok( ret || GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
664 "LookupPrivilegeNameA(0.%d) failed: %d\n", i, GetLastError());
665 }
666 /* check a bogus LUID */
667 luid.LowPart = 0xdeadbeef;
668 cchName = sizeof(buf);
669 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
670 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
671 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
672 GetLastError());
673 /* check on a bogus system */
674 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
675 cchName = sizeof(buf);
676 ret = pLookupPrivilegeNameA("b0gu5.Nam3", &luid, buf, &cchName);
677 ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
678 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
679 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
680 GetLastError());
681 }
682
683 struct NameToLUID
684 {
685 const char *name;
686 DWORD lowPart;
687 };
688
689 static void test_lookupPrivilegeValue(void)
690 {
691 static const struct NameToLUID privs[] = {
692 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE },
693 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE },
694 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE },
695 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE },
696 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE },
697 { "SeTcbPrivilege", SE_TCB_PRIVILEGE },
698 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE },
699 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE },
700 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE },
701 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE },
702 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE },
703 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE },
704 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE },
705 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE },
706 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE },
707 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE },
708 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE },
709 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE },
710 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE },
711 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE },
712 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE },
713 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILEGE },
714 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE },
715 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE },
716 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE },
717 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE },
718 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE },
719 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE },
720 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE },
721 };
722 BOOL (WINAPI *pLookupPrivilegeValueA)(LPCSTR, LPCSTR, PLUID);
723 unsigned int i;
724 LUID luid;
725 BOOL ret;
726
727 /* check whether it's available first */
728 pLookupPrivilegeValueA = (void*)GetProcAddress(hmod, "LookupPrivilegeValueA");
729 if (!pLookupPrivilegeValueA) return;
730 ret = pLookupPrivilegeValueA(NULL, "SeCreateTokenPrivilege", &luid);
731 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
732 return;
733
734 /* check a bogus system name */
735 ret = pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid);
736 ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
737 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
738 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
739 GetLastError());
740 /* check a NULL string */
741 ret = pLookupPrivilegeValueA(NULL, 0, &luid);
742 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
743 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
744 GetLastError());
745 /* check a bogus privilege name */
746 ret = pLookupPrivilegeValueA(NULL, "SeBogusPrivilege", &luid);
747 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
748 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
749 GetLastError());
750 /* check case insensitive */
751 ret = pLookupPrivilegeValueA(NULL, "sEcREATEtOKENpRIVILEGE", &luid);
752 ok( ret,
753 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
754 GetLastError());
755 for (i = 0; i < sizeof(privs) / sizeof(privs[0]); i++)
756 {
757 /* Not all privileges are implemented on all Windows versions, so
758 * don't worry if the call fails
759 */
760 if (pLookupPrivilegeValueA(NULL, privs[i].name, &luid))
761 {
762 ok(luid.LowPart == privs[i].lowPart,
763 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
764 privs[i].name);
765 }
766 }
767 }
768
769 static void test_luid(void)
770 {
771 test_allocateLuid();
772 test_lookupPrivilegeName();
773 test_lookupPrivilegeValue();
774 }
775
776 static void test_FileSecurity(void)
777 {
778 char wintmpdir [MAX_PATH];
779 char path [MAX_PATH];
780 char file [MAX_PATH];
781 HANDLE fh, token;
782 DWORD sdSize, retSize, rc, granted, priv_set_len;
783 PRIVILEGE_SET priv_set;
784 BOOL status;
785 BYTE *sd;
786 GENERIC_MAPPING mapping = { FILE_READ_DATA, FILE_WRITE_DATA, FILE_EXECUTE, FILE_ALL_ACCESS };
787 const SECURITY_INFORMATION request = OWNER_SECURITY_INFORMATION
788 | GROUP_SECURITY_INFORMATION
789 | DACL_SECURITY_INFORMATION;
790
791 if (!pGetFileSecurityA) {
792 win_skip ("GetFileSecurity is not available\n");
793 return;
794 }
795
796 if (!pSetFileSecurityA) {
797 win_skip ("SetFileSecurity is not available\n");
798 return;
799 }
800
801 if (!GetTempPathA (sizeof (wintmpdir), wintmpdir)) {
802 win_skip ("GetTempPathA failed\n");
803 return;
804 }
805
806 /* Create a temporary directory and in it a temporary file */
807 strcat (strcpy (path, wintmpdir), "rary");
808 SetLastError(0xdeadbeef);
809 rc = CreateDirectoryA (path, NULL);
810 ok (rc || GetLastError() == ERROR_ALREADY_EXISTS, "CreateDirectoryA "
811 "failed for '%s' with %d\n", path, GetLastError());
812
813 strcat (strcpy (file, path), "\\ess");
814 SetLastError(0xdeadbeef);
815 fh = CreateFileA (file, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
816 ok (fh != INVALID_HANDLE_VALUE, "CreateFileA "
817 "failed for '%s' with %d\n", file, GetLastError());
818 CloseHandle (fh);
819
820 /* For the temporary file ... */
821
822 /* Get size needed */
823 retSize = 0;
824 SetLastError(0xdeadbeef);
825 rc = pGetFileSecurityA (file, request, NULL, 0, &retSize);
826 if (!rc && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)) {
827 win_skip("GetFileSecurityA is not implemented\n");
828 goto cleanup;
829 }
830 ok (!rc, "GetFileSecurityA "
831 "was expected to fail for '%s'\n", file);
832 ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
833 "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
834 ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
835
836 sdSize = retSize;
837 sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
838
839 /* Get security descriptor for real */
840 retSize = -1;
841 SetLastError(0xdeadbeef);
842 rc = pGetFileSecurityA (file, request, sd, sdSize, &retSize);
843 ok (rc, "GetFileSecurityA "
844 "was not expected to fail '%s': %d\n", file, GetLastError());
845 ok (retSize == sdSize ||
846 broken(retSize == 0), /* NT4 */
847 "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
848
849 /* Use it to set security descriptor */
850 SetLastError(0xdeadbeef);
851 rc = pSetFileSecurityA (file, request, sd);
852 ok (rc, "SetFileSecurityA "
853 "was not expected to fail '%s': %d\n", file, GetLastError());
854
855 HeapFree (GetProcessHeap (), 0, sd);
856
857 /* Repeat for the temporary directory ... */
858
859 /* Get size needed */
860 retSize = 0;
861 SetLastError(0xdeadbeef);
862 rc = pGetFileSecurityA (path, request, NULL, 0, &retSize);
863 ok (!rc, "GetFileSecurityA "
864 "was expected to fail for '%s'\n", path);
865 ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
866 "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
867 ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
868
869 sdSize = retSize;
870 sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
871
872 /* Get security descriptor for real */
873 retSize = -1;
874 SetLastError(0xdeadbeef);
875 rc = pGetFileSecurityA (path, request, sd, sdSize, &retSize);
876 ok (rc, "GetFileSecurityA "
877 "was not expected to fail '%s': %d\n", path, GetLastError());
878 ok (retSize == sdSize ||
879 broken(retSize == 0), /* NT4 */
880 "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
881
882 /* Use it to set security descriptor */
883 SetLastError(0xdeadbeef);
884 rc = pSetFileSecurityA (path, request, sd);
885 ok (rc, "SetFileSecurityA "
886 "was not expected to fail '%s': %d\n", path, GetLastError());
887 HeapFree (GetProcessHeap (), 0, sd);
888
889 /* Old test */
890 strcpy (wintmpdir, "\\Should not exist");
891 SetLastError(0xdeadbeef);
892 rc = pGetFileSecurityA (wintmpdir, OWNER_SECURITY_INFORMATION, NULL, 0, &sdSize);
893 ok (!rc, "GetFileSecurityA should fail for not existing directories/files\n");
894 ok (GetLastError() == ERROR_FILE_NOT_FOUND,
895 "last error ERROR_FILE_NOT_FOUND expected, got %d\n", GetLastError());
896
897 cleanup:
898 /* Remove temporary file and directory */
899 DeleteFileA(file);
900 RemoveDirectoryA(path);
901
902 /* Test file access permissions for a file with FILE_ATTRIBUTE_ARCHIVE */
903 SetLastError(0xdeadbeef);
904 rc = GetTempPathA(sizeof(wintmpdir), wintmpdir);
905 ok(rc, "GetTempPath error %d\n", GetLastError());
906
907 SetLastError(0xdeadbeef);
908 rc = GetTempFileNameA(wintmpdir, "tmp", 0, file);
909 ok(rc, "GetTempFileName error %d\n", GetLastError());
910
911 rc = GetFileAttributesA(file);
912 rc &= ~(FILE_ATTRIBUTE_NOT_CONTENT_INDEXED|FILE_ATTRIBUTE_COMPRESSED);
913 ok(rc == FILE_ATTRIBUTE_ARCHIVE, "expected FILE_ATTRIBUTE_ARCHIVE got %#x\n", rc);
914
915 rc = GetFileSecurityA(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
916 NULL, 0, &sdSize);
917 ok(!rc, "GetFileSecurity should fail\n");
918 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
919 "expected ERROR_INSUFFICIENT_BUFFER got %d\n", GetLastError());
920 ok(sdSize > sizeof(SECURITY_DESCRIPTOR), "got sd size %d\n", sdSize);
921
922 sd = HeapAlloc(GetProcessHeap (), 0, sdSize);
923 retSize = 0xdeadbeef;
924 SetLastError(0xdeadbeef);
925 rc = GetFileSecurityA(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
926 sd, sdSize, &retSize);
927 ok(rc, "GetFileSecurity error %d\n", GetLastError());
928 ok(retSize == sdSize || broken(retSize == 0) /* NT4 */, "expected %d, got %d\n", sdSize, retSize);
929
930 SetLastError(0xdeadbeef);
931 rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
932 ok(!rc, "OpenThreadToken should fail\n");
933 ok(GetLastError() == ERROR_NO_TOKEN, "expected ERROR_NO_TOKEN, got %d\n", GetLastError());
934
935 SetLastError(0xdeadbeef);
936 rc = ImpersonateSelf(SecurityIdentification);
937 ok(rc, "ImpersonateSelf error %d\n", GetLastError());
938
939 SetLastError(0xdeadbeef);
940 rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
941 ok(rc, "OpenThreadToken error %d\n", GetLastError());
942
943 SetLastError(0xdeadbeef);
944 rc = RevertToSelf();
945 ok(rc, "RevertToSelf error %d\n", GetLastError());
946
947 priv_set_len = sizeof(priv_set);
948 granted = 0xdeadbeef;
949 status = 0xdeadbeef;
950 SetLastError(0xdeadbeef);
951 rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
952 ok(rc, "AccessCheck error %d\n", GetLastError());
953 ok(status == 1, "expected 1, got %d\n", status);
954 ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
955
956 granted = 0xdeadbeef;
957 status = 0xdeadbeef;
958 SetLastError(0xdeadbeef);
959 rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
960 ok(rc, "AccessCheck error %d\n", GetLastError());
961 ok(status == 1, "expected 1, got %d\n", status);
962 ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
963
964 granted = 0xdeadbeef;
965 status = 0xdeadbeef;
966 SetLastError(0xdeadbeef);
967 rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
968 ok(rc, "AccessCheck error %d\n", GetLastError());
969 ok(status == 1, "expected 1, got %d\n", status);
970 ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
971
972 granted = 0xdeadbeef;
973 status = 0xdeadbeef;
974 SetLastError(0xdeadbeef);
975 rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status);
976 ok(rc, "AccessCheck error %d\n", GetLastError());
977 ok(status == 1, "expected 1, got %d\n", status);
978 ok(granted == DELETE, "expected DELETE, got %#x\n", granted);
979
980 granted = 0xdeadbeef;
981 status = 0xdeadbeef;
982 SetLastError(0xdeadbeef);
983 rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
984 ok(rc, "AccessCheck error %d\n", GetLastError());
985 ok(status == 1, "expected 1, got %d\n", status);
986 ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
987
988 granted = 0xdeadbeef;
989 status = 0xdeadbeef;
990 SetLastError(0xdeadbeef);
991 rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
992 ok(rc, "AccessCheck error %d\n", GetLastError());
993 ok(status == 1, "expected 1, got %d\n", status);
994 ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
995
996 granted = 0xdeadbeef;
997 status = 0xdeadbeef;
998 SetLastError(0xdeadbeef);
999 rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
1000 ok(rc, "AccessCheck error %d\n", GetLastError());
1001 ok(status == 1, "expected 1, got %d\n", status);
1002 ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
1003
1004 SetLastError(0xdeadbeef);
1005 rc = AccessCheck(sd, token, 0xffffffff, &mapping, &priv_set, &priv_set_len, &granted, &status);
1006 ok(!rc, "AccessCheck should fail\n");
1007 ok(GetLastError() == ERROR_GENERIC_NOT_MAPPED, "expected ERROR_GENERIC_NOT_MAPPED, got %d\n", GetLastError());
1008
1009 /* Test file access permissions for a file with FILE_ATTRIBUTE_READONLY */
1010 SetLastError(0xdeadbeef);
1011 fh = CreateFileA(file, FILE_READ_DATA, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_READONLY, 0);
1012 ok(fh != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
1013 retSize = 0xdeadbeef;
1014 SetLastError(0xdeadbeef);
1015 rc = WriteFile(fh, "1", 1, &retSize, NULL);
1016 ok(!rc, "WriteFile should fail\n");
1017 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1018 ok(retSize == 0, "expected 0, got %d\n", retSize);
1019 CloseHandle(fh);
1020
1021 rc = GetFileAttributesA(file);
1022 rc &= ~(FILE_ATTRIBUTE_NOT_CONTENT_INDEXED|FILE_ATTRIBUTE_COMPRESSED);
1023 todo_wine
1024 ok(rc == (FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY),
1025 "expected FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY got %#x\n", rc);
1026
1027 SetLastError(0xdeadbeef);
1028 rc = SetFileAttributesA(file, FILE_ATTRIBUTE_ARCHIVE);
1029 ok(rc, "SetFileAttributes error %d\n", GetLastError());
1030 SetLastError(0xdeadbeef);
1031 rc = DeleteFileA(file);
1032 ok(rc, "DeleteFile error %d\n", GetLastError());
1033
1034 SetLastError(0xdeadbeef);
1035 fh = CreateFileA(file, FILE_READ_DATA, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_READONLY, 0);
1036 ok(fh != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
1037 retSize = 0xdeadbeef;
1038 SetLastError(0xdeadbeef);
1039 rc = WriteFile(fh, "1", 1, &retSize, NULL);
1040 ok(!rc, "WriteFile should fail\n");
1041 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1042 ok(retSize == 0, "expected 0, got %d\n", retSize);
1043 CloseHandle(fh);
1044
1045 rc = GetFileAttributesA(file);
1046 rc &= ~(FILE_ATTRIBUTE_NOT_CONTENT_INDEXED|FILE_ATTRIBUTE_COMPRESSED);
1047 ok(rc == (FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY),
1048 "expected FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY got %#x\n", rc);
1049
1050 retSize = 0xdeadbeef;
1051 SetLastError(0xdeadbeef);
1052 rc = GetFileSecurityA(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
1053 sd, sdSize, &retSize);
1054 ok(rc, "GetFileSecurity error %d\n", GetLastError());
1055 ok(retSize == sdSize || broken(retSize == 0) /* NT4 */, "expected %d, got %d\n", sdSize, retSize);
1056
1057 priv_set_len = sizeof(priv_set);
1058 granted = 0xdeadbeef;
1059 status = 0xdeadbeef;
1060 SetLastError(0xdeadbeef);
1061 rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
1062 ok(rc, "AccessCheck error %d\n", GetLastError());
1063 ok(status == 1, "expected 1, got %d\n", status);
1064 ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
1065
1066 granted = 0xdeadbeef;
1067 status = 0xdeadbeef;
1068 SetLastError(0xdeadbeef);
1069 rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
1070 ok(rc, "AccessCheck error %d\n", GetLastError());
1071 todo_wine {
1072 ok(status == 1, "expected 1, got %d\n", status);
1073 ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
1074 }
1075 granted = 0xdeadbeef;
1076 status = 0xdeadbeef;
1077 SetLastError(0xdeadbeef);
1078 rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
1079 ok(rc, "AccessCheck error %d\n", GetLastError());
1080 ok(status == 1, "expected 1, got %d\n", status);
1081 ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
1082
1083 granted = 0xdeadbeef;
1084 status = 0xdeadbeef;
1085 SetLastError(0xdeadbeef);
1086 rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status);
1087 ok(rc, "AccessCheck error %d\n", GetLastError());
1088 todo_wine {
1089 ok(status == 1, "expected 1, got %d\n", status);
1090 ok(granted == DELETE, "expected DELETE, got %#x\n", granted);
1091 }
1092 granted = 0xdeadbeef;
1093 status = 0xdeadbeef;
1094 SetLastError(0xdeadbeef);
1095 rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
1096 ok(rc, "AccessCheck error %d\n", GetLastError());
1097 todo_wine {
1098 ok(status == 1, "expected 1, got %d\n", status);
1099 ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
1100 }
1101 granted = 0xdeadbeef;
1102 status = 0xdeadbeef;
1103 SetLastError(0xdeadbeef);
1104 rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
1105 ok(rc, "AccessCheck error %d\n", GetLastError());
1106 todo_wine {
1107 ok(status == 1, "expected 1, got %d\n", status);
1108 ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
1109 }
1110 granted = 0xdeadbeef;
1111 status = 0xdeadbeef;
1112 SetLastError(0xdeadbeef);
1113 rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
1114 ok(rc, "AccessCheck error %d\n", GetLastError());
1115 todo_wine {
1116 ok(status == 1, "expected 1, got %d\n", status);
1117 ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
1118 }
1119 SetLastError(0xdeadbeef);
1120 rc = DeleteFileA(file);
1121 ok(!rc, "DeleteFile should fail\n");
1122 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1123 SetLastError(0xdeadbeef);
1124 rc = SetFileAttributesA(file, FILE_ATTRIBUTE_ARCHIVE);
1125 ok(rc, "SetFileAttributes error %d\n", GetLastError());
1126 SetLastError(0xdeadbeef);
1127 rc = DeleteFileA(file);
1128 ok(rc, "DeleteFile error %d\n", GetLastError());
1129
1130 CloseHandle(token);
1131 HeapFree(GetProcessHeap(), 0, sd);
1132 }
1133
1134 static void test_AccessCheck(void)
1135 {
1136 PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL;
1137 PACL Acl = NULL;
1138 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
1139 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
1140 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1141 GENERIC_MAPPING Mapping = { KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS };
1142 ACCESS_MASK Access;
1143 BOOL AccessStatus;
1144 HANDLE Token;
1145 HANDLE ProcessToken;
1146 BOOL ret;
1147 DWORD PrivSetLen;
1148 PRIVILEGE_SET *PrivSet;
1149 BOOL res;
1150 HMODULE NtDllModule;
1151 BOOLEAN Enabled;
1152 DWORD err;
1153 NTSTATUS ntret, ntAccessStatus;
1154
1155 NtDllModule = GetModuleHandleA("ntdll.dll");
1156 if (!NtDllModule)
1157 {
1158 skip("not running on NT, skipping test\n");
1159 return;
1160 }
1161 pRtlAdjustPrivilege = (void *)GetProcAddress(NtDllModule, "RtlAdjustPrivilege");
1162 if (!pRtlAdjustPrivilege)
1163 {
1164 win_skip("missing RtlAdjustPrivilege, skipping test\n");
1165 return;
1166 }
1167
1168 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
1169 res = InitializeAcl(Acl, 256, ACL_REVISION);
1170 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
1171 {
1172 skip("ACLs not implemented - skipping tests\n");
1173 HeapFree(GetProcessHeap(), 0, Acl);
1174 return;
1175 }
1176 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
1177
1178 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
1179 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1180
1181 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1182 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdminSid);
1183 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1184
1185 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1186 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
1187 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1188
1189 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
1190
1191 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
1192 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1193
1194 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1195 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1196
1197 PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
1198 PrivSet = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PrivSetLen);
1199 PrivSet->PrivilegeCount = 16;
1200
1201 res = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &ProcessToken);
1202 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
1203
1204 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, FALSE, TRUE, &Enabled);
1205
1206 res = DuplicateToken(ProcessToken, SecurityImpersonation, &Token);
1207 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1208
1209 /* SD without owner/group */
1210 SetLastError(0xdeadbeef);
1211 Access = AccessStatus = 0x1abe11ed;
1212 ret = AccessCheck(SecurityDescriptor, Token, KEY_QUERY_VALUE, &Mapping,
1213 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1214 err = GetLastError();
1215 ok(!ret && err == ERROR_INVALID_SECURITY_DESCR, "AccessCheck should have "
1216 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err);
1217 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1218 "Access and/or AccessStatus were changed!\n");
1219
1220 /* Set owner and group */
1221 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
1222 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1223 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, TRUE);
1224 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1225
1226 /* Generic access mask */
1227 SetLastError(0xdeadbeef);
1228 Access = AccessStatus = 0x1abe11ed;
1229 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1230 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1231 err = GetLastError();
1232 ok(!ret && err == ERROR_GENERIC_NOT_MAPPED, "AccessCheck should have failed "
1233 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err);
1234 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1235 "Access and/or AccessStatus were changed!\n");
1236
1237 /* Generic access mask - no privilegeset buffer */
1238 SetLastError(0xdeadbeef);
1239 Access = AccessStatus = 0x1abe11ed;
1240 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1241 NULL, &PrivSetLen, &Access, &AccessStatus);
1242 err = GetLastError();
1243 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1244 "with ERROR_NOACCESS, instead of %d\n", err);
1245 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1246 "Access and/or AccessStatus were changed!\n");
1247
1248 /* Generic access mask - no returnlength */
1249 SetLastError(0xdeadbeef);
1250 Access = AccessStatus = 0x1abe11ed;
1251 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1252 PrivSet, NULL, &Access, &AccessStatus);
1253 err = GetLastError();
1254 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1255 "with ERROR_NOACCESS, instead of %d\n", err);
1256 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1257 "Access and/or AccessStatus were changed!\n");
1258
1259 /* Generic access mask - no privilegeset buffer, no returnlength */
1260 SetLastError(0xdeadbeef);
1261 Access = AccessStatus = 0x1abe11ed;
1262 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1263 NULL, NULL, &Access, &AccessStatus);
1264 err = GetLastError();
1265 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1266 "with ERROR_NOACCESS, instead of %d\n", err);
1267 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1268 "Access and/or AccessStatus were changed!\n");
1269
1270 /* sd with no dacl present */
1271 Access = AccessStatus = 0x1abe11ed;
1272 ret = SetSecurityDescriptorDacl(SecurityDescriptor, FALSE, NULL, FALSE);
1273 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1274 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1275 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1276 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1277 ok(AccessStatus && (Access == KEY_READ),
1278 "AccessCheck failed to grant access with error %d\n",
1279 GetLastError());
1280
1281 /* sd with no dacl present - no privilegeset buffer */
1282 SetLastError(0xdeadbeef);
1283 Access = AccessStatus = 0x1abe11ed;
1284 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1285 NULL, &PrivSetLen, &Access, &AccessStatus);
1286 err = GetLastError();
1287 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1288 "with ERROR_NOACCESS, instead of %d\n", err);
1289 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1290 "Access and/or AccessStatus were changed!\n");
1291
1292 if(pNtAccessCheck)
1293 {
1294 /* Generic access mask - no privilegeset buffer */
1295 SetLastError(0xdeadbeef);
1296 Access = ntAccessStatus = 0x1abe11ed;
1297 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1298 NULL, &PrivSetLen, &Access, &ntAccessStatus);
1299 err = GetLastError();
1300 ok(ntret == STATUS_ACCESS_VIOLATION,
1301 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1302 ok(err == 0xdeadbeef,
1303 "NtAccessCheck shouldn't set last error, got %d\n", err);
1304 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1305 "Access and/or AccessStatus were changed!\n");
1306
1307 /* Generic access mask - no returnlength */
1308 SetLastError(0xdeadbeef);
1309 Access = ntAccessStatus = 0x1abe11ed;
1310 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1311 PrivSet, NULL, &Access, &ntAccessStatus);
1312 err = GetLastError();
1313 ok(ntret == STATUS_ACCESS_VIOLATION,
1314 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1315 ok(err == 0xdeadbeef,
1316 "NtAccessCheck shouldn't set last error, got %d\n", err);
1317 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1318 "Access and/or AccessStatus were changed!\n");
1319
1320 /* Generic access mask - no privilegeset buffer, no returnlength */
1321 SetLastError(0xdeadbeef);
1322 Access = ntAccessStatus = 0x1abe11ed;
1323 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1324 NULL, NULL, &Access, &ntAccessStatus);
1325 err = GetLastError();
1326 ok(ntret == STATUS_ACCESS_VIOLATION,
1327 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1328 ok(err == 0xdeadbeef,
1329 "NtAccessCheck shouldn't set last error, got %d\n", err);
1330 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1331 "Access and/or AccessStatus were changed!\n");
1332 }
1333 else
1334 win_skip("NtAccessCheck unavailable. Skipping.\n");
1335
1336 /* sd with NULL dacl */
1337 Access = AccessStatus = 0x1abe11ed;
1338 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, NULL, FALSE);
1339 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1340 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1341 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1342 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1343 ok(AccessStatus && (Access == KEY_READ),
1344 "AccessCheck failed to grant access with error %d\n",
1345 GetLastError());
1346
1347 /* sd with blank dacl */
1348 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1349 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1350 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1351 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1352 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1353 err = GetLastError();
1354 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1355 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1356 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1357
1358 res = AddAccessAllowedAce(Acl, ACL_REVISION, KEY_READ, EveryoneSid);
1359 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
1360
1361 res = AddAccessDeniedAce(Acl, ACL_REVISION, KEY_SET_VALUE, AdminSid);
1362 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1363
1364 /* sd with dacl */
1365 Access = AccessStatus = 0x1abe11ed;
1366 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1367 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1368 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1369 ok(AccessStatus && (Access == KEY_READ),
1370 "AccessCheck failed to grant access with error %d\n",
1371 GetLastError());
1372
1373 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1374 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1375 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1376 ok(AccessStatus,
1377 "AccessCheck failed to grant any access with error %d\n",
1378 GetLastError());
1379 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access);
1380
1381 /* Access denied by SD */
1382 SetLastError(0xdeadbeef);
1383 Access = AccessStatus = 0x1abe11ed;
1384 ret = AccessCheck(SecurityDescriptor, Token, KEY_WRITE, &Mapping,
1385 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1386 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1387 err = GetLastError();
1388 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1389 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1390 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1391
1392 SetLastError(0);
1393 PrivSet->PrivilegeCount = 16;
1394 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1395 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1396 ok(ret && !AccessStatus && GetLastError() == ERROR_PRIVILEGE_NOT_HELD,
1397 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
1398 GetLastError());
1399
1400 ret = ImpersonateLoggedOnUser(Token);
1401 ok(ret, "ImpersonateLoggedOnUser failed with error %d\n", GetLastError());
1402 ret = pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, TRUE, TRUE, &Enabled);
1403 if (!ret)
1404 {
1405 SetLastError(0);
1406 PrivSet->PrivilegeCount = 16;
1407 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1408 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1409 ok(ret && AccessStatus && GetLastError() == 0,
1410 "AccessCheck should have succeeded, error %d\n",
1411 GetLastError());
1412 ok(Access == ACCESS_SYSTEM_SECURITY,
1413 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
1414 Access);
1415 }
1416 else
1417 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
1418 ret);
1419 ret = RevertToSelf();
1420 ok(ret, "RevertToSelf failed with error %d\n", GetLastError());
1421
1422 /* test INHERIT_ONLY_ACE */
1423 ret = InitializeAcl(Acl, 256, ACL_REVISION);
1424 ok(ret, "InitializeAcl failed with error %d\n", GetLastError());
1425
1426 /* NT doesn't have AddAccessAllowedAceEx. Skipping this call/test doesn't influence
1427 * the next ones.
1428 */
1429 if (pAddAccessAllowedAceEx)
1430 {
1431 ret = pAddAccessAllowedAceEx(Acl, ACL_REVISION, INHERIT_ONLY_ACE, KEY_READ, EveryoneSid);
1432 ok(ret, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1433 }
1434 else
1435 win_skip("AddAccessAllowedAceEx is not available\n");
1436
1437 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1438 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1439 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1440 err = GetLastError();
1441 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1442 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1443 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1444
1445 CloseHandle(Token);
1446
1447 res = DuplicateToken(ProcessToken, SecurityAnonymous, &Token);
1448 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1449
1450 SetLastError(0xdeadbeef);
1451 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1452 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1453 err = GetLastError();
1454 ok(!ret && err == ERROR_BAD_IMPERSONATION_LEVEL, "AccessCheck should have failed "
1455 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err);
1456
1457 CloseHandle(Token);
1458
1459 SetLastError(0xdeadbeef);
1460 ret = AccessCheck(SecurityDescriptor, ProcessToken, KEY_READ, &Mapping,
1461 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1462 err = GetLastError();
1463 ok(!ret && err == ERROR_NO_IMPERSONATION_TOKEN, "AccessCheck should have failed "
1464 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err);
1465
1466 CloseHandle(ProcessToken);
1467
1468 if (EveryoneSid)
1469 FreeSid(EveryoneSid);
1470 if (AdminSid)
1471 FreeSid(AdminSid);
1472 if (UsersSid)
1473 FreeSid(UsersSid);
1474 HeapFree(GetProcessHeap(), 0, Acl);
1475 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
1476 HeapFree(GetProcessHeap(), 0, PrivSet);
1477 }
1478
1479 /* test GetTokenInformation for the various attributes */
1480 static void test_token_attr(void)
1481 {
1482 HANDLE Token, ImpersonationToken;
1483 DWORD Size, Size2;
1484 TOKEN_PRIVILEGES *Privileges;
1485 TOKEN_GROUPS *Groups;
1486 TOKEN_USER *User;
1487 TOKEN_DEFAULT_DACL *Dacl;
1488 BOOL ret;
1489 DWORD i, GLE;
1490 LPSTR SidString;
1491 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1492 ACL *acl;
1493
1494 /* cygwin-like use case */
1495 SetLastError(0xdeadbeef);
1496 ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &Token);
1497 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1498 {
1499 win_skip("OpenProcessToken is not implemented\n");
1500 return;
1501 }
1502 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1503 if (ret)
1504 {
1505 DWORD buf[256]; /* GetTokenInformation wants a dword-aligned buffer */
1506 Size = sizeof(buf);
1507 ret = GetTokenInformation(Token, TokenUser,(void*)buf, Size, &Size);
1508 ok(ret, "GetTokenInformation failed with error %d\n", GetLastError());
1509 Size = sizeof(ImpersonationLevel);
1510 ret = GetTokenInformation(Token, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1511 GLE = GetLastError();
1512 ok(!ret && (GLE == ERROR_INVALID_PARAMETER), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE);
1513 CloseHandle(Token);
1514 }
1515
1516 if(!pConvertSidToStringSidA)
1517 {
1518 win_skip("ConvertSidToStringSidA is not available\n");
1519 return;
1520 }
1521
1522 SetLastError(0xdeadbeef);
1523 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &Token);
1524 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1525
1526 /* groups */
1527 /* insufficient buffer length */
1528 SetLastError(0xdeadbeef);
1529 Size2 = 0;
1530 ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size2);
1531 ok(Size2 > 1, "got %d\n", Size2);
1532 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1533 "%d with error %d\n", ret, GetLastError());
1534 Size2 -= 1;
1535 Groups = HeapAlloc(GetProcessHeap(), 0, Size2);
1536 memset(Groups, 0xcc, Size2);
1537 Size = 0;
1538 ret = GetTokenInformation(Token, TokenGroups, Groups, Size2, &Size);
1539 ok(Size > 1, "got %d\n", Size);
1540 ok((!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER) || broken(ret) /* wow64 */,
1541 "%d with error %d\n", ret, GetLastError());
1542 if(!ret)
1543 ok(*((BYTE*)Groups) == 0xcc, "buffer altered\n");
1544
1545 HeapFree(GetProcessHeap(), 0, Groups);
1546
1547 SetLastError(0xdeadbeef);
1548 ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size);
1549 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1550 "GetTokenInformation(TokenGroups) %s with error %d\n",
1551 ret ? "succeeded" : "failed", GetLastError());
1552 Groups = HeapAlloc(GetProcessHeap(), 0, Size);
1553 SetLastError(0xdeadbeef);
1554 ret = GetTokenInformation(Token, TokenGroups, Groups, Size, &Size);
1555 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
1556 ok(GetLastError() == 0xdeadbeef,
1557 "GetTokenInformation shouldn't have set last error to %d\n",
1558 GetLastError());
1559 trace("TokenGroups:\n");
1560 for (i = 0; i < Groups->GroupCount; i++)
1561 {
1562 DWORD NameLength = 255;
1563 CHAR Name[255];
1564 DWORD DomainLength = 255;
1565 CHAR Domain[255];
1566 SID_NAME_USE SidNameUse;
1567 Name[0] = '\0';
1568 Domain[0] = '\0';
1569 ret = LookupAccountSidA(NULL, Groups->Groups[i].Sid, Name, &NameLength, Domain, &DomainLength, &SidNameUse);
1570 if (ret)
1571 {
1572 pConvertSidToStringSidA(Groups->Groups[i].Sid, &SidString);
1573 trace("%s, %s\\%s use: %d attr: 0x%08x\n", SidString, Domain, Name, SidNameUse, Groups->Groups[i].Attributes);
1574 LocalFree(SidString);
1575 }
1576 else trace("attr: 0x%08x LookupAccountSid failed with error %d\n", Groups->Groups[i].Attributes, GetLastError());
1577 }
1578 HeapFree(GetProcessHeap(), 0, Groups);
1579
1580 /* user */
1581 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
1582 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1583 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1584 User = HeapAlloc(GetProcessHeap(), 0, Size);
1585 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
1586 ok(ret,
1587 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1588
1589 pConvertSidToStringSidA(User->User.Sid, &SidString);
1590 trace("TokenUser: %s attr: 0x%08x\n", SidString, User->User.Attributes);
1591 LocalFree(SidString);
1592 HeapFree(GetProcessHeap(), 0, User);
1593
1594 /* privileges */
1595 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
1596 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1597 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1598 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
1599 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
1600 ok(ret,
1601 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1602 trace("TokenPrivileges:\n");
1603 for (i = 0; i < Privileges->PrivilegeCount; i++)
1604 {
1605 CHAR Name[256];
1606 DWORD NameLen = sizeof(Name)/sizeof(Name[0]);
1607 LookupPrivilegeNameA(NULL, &Privileges->Privileges[i].Luid, Name, &NameLen);
1608 trace("\t%s, 0x%x\n", Name, Privileges->Privileges[i].Attributes);
1609 }
1610 HeapFree(GetProcessHeap(), 0, Privileges);
1611
1612 ret = DuplicateToken(Token, SecurityAnonymous, &ImpersonationToken);
1613 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
1614
1615 Size = sizeof(ImpersonationLevel);
1616 ret = GetTokenInformation(ImpersonationToken, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1617 ok(ret, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
1618 ok(ImpersonationLevel == SecurityAnonymous, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel);
1619
1620 CloseHandle(ImpersonationToken);
1621
1622 /* default dacl */
1623 ret = GetTokenInformation(Token, TokenDefaultDacl, NULL, 0, &Size);
1624 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1625 "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1626
1627 Dacl = HeapAlloc(GetProcessHeap(), 0, Size);
1628 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size);
1629 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1630
1631 SetLastError(0xdeadbeef);
1632 ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, 0);
1633 GLE = GetLastError();
1634 ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1635 ok(GLE == ERROR_BAD_LENGTH, "expected ERROR_BAD_LENGTH got %u\n", GLE);
1636
1637 SetLastError(0xdeadbeef);
1638 ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, Size);
1639 GLE = GetLastError();
1640 ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1641 ok(GLE == ERROR_NOACCESS, "expected ERROR_NOACCESS got %u\n", GLE);
1642
1643 acl = Dacl->DefaultDacl;
1644 Dacl->DefaultDacl = NULL;
1645
1646 ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1647 ok(ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1648
1649 Size2 = 0;
1650 Dacl->DefaultDacl = (ACL *)0xdeadbeef;
1651 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1652 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1653 ok(Dacl->DefaultDacl == NULL, "expected NULL, got %p\n", Dacl->DefaultDacl);
1654 ok(Size2 == sizeof(TOKEN_DEFAULT_DACL) || broken(Size2 == 2*sizeof(TOKEN_DEFAULT_DACL)), /* WoW64 */
1655 "got %u expected sizeof(TOKEN_DEFAULT_DACL)\n", Size2);
1656
1657 Dacl->DefaultDacl = acl;
1658 ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1659 ok(ret, "SetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1660
1661 if (Size2 == sizeof(TOKEN_DEFAULT_DACL)) {
1662 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1663 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1664 } else
1665 win_skip("TOKEN_DEFAULT_DACL size too small on WoW64\n");
1666
1667 HeapFree(GetProcessHeap(), 0, Dacl);
1668 CloseHandle(Token);
1669 }
1670
1671 typedef union _MAX_SID
1672 {
1673 SID sid;
1674 char max[SECURITY_MAX_SID_SIZE];
1675 } MAX_SID;
1676
1677 static void test_sid_str(PSID * sid)
1678 {
1679 char *str_sid;
1680 BOOL ret = pConvertSidToStringSidA(sid, &str_sid);
1681 ok(ret, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
1682 if (ret)
1683 {
1684 char account[MAX_PATH], domain[MAX_PATH];
1685 SID_NAME_USE use;
1686 DWORD acc_size = MAX_PATH;
1687 DWORD dom_size = MAX_PATH;
1688 ret = LookupAccountSidA (NULL, sid, account, &acc_size, domain, &dom_size, &use);
1689 ok(ret || (!ret && (GetLastError() == ERROR_NONE_MAPPED)),
1690 "LookupAccountSid(%s) failed: %d\n", str_sid, GetLastError());
1691 if (ret)
1692 trace(" %s %s\\%s %d\n", str_sid, domain, account, use);
1693 else if (GetLastError() == ERROR_NONE_MAPPED)
1694 trace(" %s couldn't be mapped\n", str_sid);
1695 LocalFree(str_sid);
1696 }
1697 }
1698
1699 static const struct well_known_sid_value
1700 {
1701 BOOL without_domain;
1702 const char *sid_string;
1703 } well_known_sid_values[] = {
1704 /* 0 */ {TRUE, "S-1-0-0"}, {TRUE, "S-1-1-0"}, {TRUE, "S-1-2-0"}, {TRUE, "S-1-3-0"},
1705 /* 4 */ {TRUE, "S-1-3-1"}, {TRUE, "S-1-3-2"}, {TRUE, "S-1-3-3"}, {TRUE, "S-1-5"},
1706 /* 8 */ {FALSE, "S-1-5-1"}, {TRUE, "S-1-5-2"}, {TRUE, "S-1-5-3"}, {TRUE, "S-1-5-4"},
1707 /* 12 */ {TRUE, "S-1-5-6"}, {TRUE, "S-1-5-7"}, {TRUE, "S-1-5-8"}, {TRUE, "S-1-5-9"},
1708 /* 16 */ {TRUE, "S-1-5-10"}, {TRUE, "S-1-5-11"}, {TRUE, "S-1-5-12"}, {TRUE, "S-1-5-13"},
1709 /* 20 */ {TRUE, "S-1-5-14"}, {FALSE, NULL}, {TRUE, "S-1-5-18"}, {TRUE, "S-1-5-19"},
1710 /* 24 */ {TRUE, "S-1-5-20"}, {TRUE, "S-1-5-32"},
1711 /* 26 */ {FALSE, "S-1-5-32-544"}, {TRUE, "S-1-5-32-545"}, {TRUE, "S-1-5-32-546"},
1712 /* 29 */ {TRUE, "S-1-5-32-547"}, {TRUE, "S-1-5-32-548"}, {TRUE, "S-1-5-32-549"},
1713 /* 32 */ {TRUE, "S-1-5-32-550"}, {TRUE, "S-1-5-32-551"}, {TRUE, "S-1-5-32-552"},
1714 /* 35 */ {TRUE, "S-1-5-32-554"}, {TRUE, "S-1-5-32-555"}, {TRUE, "S-1-5-32-556"},
1715 /* 38 */ {FALSE, "S-1-5-21-12-23-34-45-56-500"}, {FALSE, "S-1-5-21-12-23-34-45-56-501"},
1716 /* 40 */ {FALSE, "S-1-5-21-12-23-34-45-56-502"}, {FALSE, "S-1-5-21-12-23-34-45-56-512"},
1717 /* 42 */ {FALSE, "S-1-5-21-12-23-34-45-56-513"}, {FALSE, "S-1-5-21-12-23-34-45-56-514"},
1718 /* 44 */ {FALSE, "S-1-5-21-12-23-34-45-56-515"}, {FALSE, "S-1-5-21-12-23-34-45-56-516"},
1719 /* 46 */ {FALSE, "S-1-5-21-12-23-34-45-56-517"}, {FALSE, "S-1-5-21-12-23-34-45-56-518"},
1720 /* 48 */ {FALSE, "S-1-5-21-12-23-34-45-56-519"}, {FALSE, "S-1-5-21-12-23-34-45-56-520"},
1721 /* 50 */ {FALSE, "S-1-5-21-12-23-34-45-56-553"},
1722 /* Added in Windows Server 2003 */
1723 /* 51 */ {TRUE, "S-1-5-64-10"}, {TRUE, "S-1-5-64-21"}, {TRUE, "S-1-5-64-14"},
1724 /* 54 */ {TRUE, "S-1-5-15"}, {TRUE, "S-1-5-1000"}, {FALSE, "S-1-5-32-557"},
1725 /* 57 */ {TRUE, "S-1-5-32-558"}, {TRUE, "S-1-5-32-559"}, {TRUE, "S-1-5-32-560"},
1726 /* 60 */ {TRUE, "S-1-5-32-561"}, {TRUE, "S-1-5-32-562"},
1727 /* Added in Windows Vista: */
1728 /* 62 */ {TRUE, "S-1-5-32-568"},
1729 /* 63 */ {TRUE, "S-1-5-17"}, {FALSE, "S-1-5-32-569"}, {TRUE, "S-1-16-0"},
1730 /* 66 */ {TRUE, "S-1-16-4096"}, {TRUE, "S-1-16-8192"}, {TRUE, "S-1-16-12288"},
1731 /* 69 */ {TRUE, "S-1-16-16384"}, {TRUE, "S-1-5-33"}, {TRUE, "S-1-3-4"},
1732 /* 72 */ {FALSE, "S-1-5-21-12-23-34-45-56-571"}, {FALSE, "S-1-5-21-12-23-34-45-56-572"},
1733 /* 74 */ {TRUE, "S-1-5-22"}, {FALSE, "S-1-5-21-12-23-34-45-56-521"}, {TRUE, "S-1-5-32-573"},
1734 /* 77 */ {FALSE, "S-1-5-21-12-23-34-45-56-498"}, {TRUE, "S-1-5-32-574"}, {TRUE, "S-1-16-8448"},
1735 /* 80 */ {FALSE, NULL}, {TRUE, "S-1-2-1"}, {TRUE, "S-1-5-65-1"}, {FALSE, NULL},
1736 /* 84 */ {TRUE, "S-1-15-2-1"},
1737 };
1738
1739 static void test_CreateWellKnownSid(void)
1740 {
1741 SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
1742 PSID domainsid, sid;
1743 DWORD size, error;
1744 BOOL ret;
1745 unsigned int i;
1746
1747 if (!pCreateWellKnownSid)
1748 {
1749 win_skip("CreateWellKnownSid not available\n");
1750 return;
1751 }
1752
1753 size = 0;
1754 SetLastError(0xdeadbeef);
1755 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1756 error = GetLastError();
1757 ok(!ret, "CreateWellKnownSid succeeded\n");
1758 ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
1759 ok(size, "expected size > 0\n");
1760
1761 SetLastError(0xdeadbeef);
1762 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1763 error = GetLastError();
1764 ok(!ret, "CreateWellKnownSid succeeded\n");
1765 ok(error == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %u\n", error);
1766
1767 sid = HeapAlloc(GetProcessHeap(), 0, size);
1768 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, sid, &size);
1769 ok(ret, "CreateWellKnownSid failed %u\n", GetLastError());
1770 HeapFree(GetProcessHeap(), 0, sid);
1771
1772 /* a domain sid usually have three subauthorities but we test that CreateWellKnownSid doesn't check it */
1773 AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
1774
1775 for (i = 0; i < sizeof(well_known_sid_values)/sizeof(well_known_sid_values[0]); i++)
1776 {
1777 const struct well_known_sid_value *value = &well_known_sid_values[i];
1778 char sid_buffer[SECURITY_MAX_SID_SIZE];
1779 LPSTR str;
1780 DWORD cb;
1781
1782 if (value->sid_string == NULL)
1783 continue;
1784
1785 /* some SIDs aren't implemented by all Windows versions - detect it */
1786 cb = sizeof(sid_buffer);
1787 if (!pCreateWellKnownSid(i, NULL, sid_buffer, &cb))
1788 {
1789 skip("Well known SID %u not implemented\n", i);
1790 continue;
1791 }
1792
1793 cb = sizeof(sid_buffer);
1794 ok(pCreateWellKnownSid(i, value->without_domain ? NULL : domainsid, sid_buffer, &cb), "Couldn't create well known sid %u\n", i);
1795 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
1796 ok(IsValidSid(sid_buffer), "The sid is not valid\n");
1797 ok(pConvertSidToStringSidA(sid_buffer, &str), "Couldn't convert SID to string\n");
1798 ok(strcmp(str, value->sid_string) == 0, "%d: SID mismatch - expected %s, got %s\n", i,
1799 value->sid_string, str);
1800 LocalFree(str);
1801
1802 if (value->without_domain)
1803 {
1804 char buf2[SECURITY_MAX_SID_SIZE];
1805 cb = sizeof(buf2);
1806 ok(pCreateWellKnownSid(i, domainsid, buf2, &cb), "Couldn't create well known sid %u with optional domain\n", i);
1807 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
1808 ok(memcmp(buf2, sid_buffer, cb) == 0, "SID create with domain is different than without (%u)\n", i);
1809 }
1810 }
1811
1812 FreeSid(domainsid);
1813 }
1814
1815 static void test_LookupAccountSid(void)
1816 {
1817 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1818 CHAR accountA[MAX_PATH], domainA[MAX_PATH], usernameA[MAX_PATH];
1819 DWORD acc_sizeA, dom_sizeA, user_sizeA;
1820 DWORD real_acc_sizeA, real_dom_sizeA;
1821 WCHAR accountW[MAX_PATH], domainW[MAX_PATH];
1822 DWORD acc_sizeW, dom_sizeW;
1823 DWORD real_acc_sizeW, real_dom_sizeW;
1824 PSID pUsersSid = NULL;
1825 SID_NAME_USE use;
1826 BOOL ret;
1827 DWORD error, size, cbti = 0;
1828 MAX_SID max_sid;
1829 CHAR *str_sidA;
1830 int i;
1831 HANDLE hToken;
1832 PTOKEN_USER ptiUser = NULL;
1833
1834 /* native windows crashes if account size, domain size, or name use is NULL */
1835
1836 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1837 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &pUsersSid);
1838 ok(ret || (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED),
1839 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1840
1841 /* not running on NT so give up */
1842 if (!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1843 return;
1844
1845 real_acc_sizeA = MAX_PATH;
1846 real_dom_sizeA = MAX_PATH;
1847 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1848 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1849
1850 /* try NULL account */
1851 acc_sizeA = MAX_PATH;
1852 dom_sizeA = MAX_PATH;
1853 ret = LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1854 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1855
1856 /* try NULL domain */
1857 acc_sizeA = MAX_PATH;
1858 dom_sizeA = MAX_PATH;
1859 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1860 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1861
1862 /* try a small account buffer */
1863 acc_sizeA = 1;
1864 dom_sizeA = MAX_PATH;
1865 accountA[0] = 0;
1866 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1867 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1868 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1869 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1870
1871 /* try a 0 sized account buffer */
1872 acc_sizeA = 0;
1873 dom_sizeA = MAX_PATH;
1874 accountA[0] = 0;
1875 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1876 /* this can fail or succeed depending on OS version but the size will always be returned */
1877 ok(acc_sizeA == real_acc_sizeA + 1,
1878 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1879 real_acc_sizeA + 1, acc_sizeA);
1880
1881 /* try a 0 sized account buffer */
1882 acc_sizeA = 0;
1883 dom_sizeA = MAX_PATH;
1884 LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1885 /* this can fail or succeed depending on OS version but the size will always be returned */
1886 ok(acc_sizeA == real_acc_sizeA + 1,
1887 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1888 real_acc_sizeA + 1, acc_sizeA);
1889
1890 /* try a small domain buffer */
1891 dom_sizeA = 1;
1892 acc_sizeA = MAX_PATH;
1893 accountA[0] = 0;
1894 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1895 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1896 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1897 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1898
1899 /* try a 0 sized domain buffer */
1900 dom_sizeA = 0;
1901 acc_sizeA = MAX_PATH;
1902 accountA[0] = 0;
1903 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1904 /* this can fail or succeed depending on OS version but the size will always be returned */
1905 ok(dom_sizeA == real_dom_sizeA + 1,
1906 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1907 real_dom_sizeA + 1, dom_sizeA);
1908
1909 /* try a 0 sized domain buffer */
1910 dom_sizeA = 0;
1911 acc_sizeA = MAX_PATH;
1912 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1913 /* this can fail or succeed depending on OS version but the size will always be returned */
1914 ok(dom_sizeA == real_dom_sizeA + 1,
1915 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1916 real_dom_sizeA + 1, dom_sizeA);
1917
1918 real_acc_sizeW = MAX_PATH;
1919 real_dom_sizeW = MAX_PATH;
1920 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &real_acc_sizeW, domainW, &real_dom_sizeW, &use);
1921 ok(ret, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1922
1923 /* try an invalid system name */
1924 real_acc_sizeA = MAX_PATH;
1925 real_dom_sizeA = MAX_PATH;
1926 ret = LookupAccountSidA("deepthought", pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1927 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1928 ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
1929 "LookupAccountSidA() Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %u\n", GetLastError());
1930
1931 /* native windows crashes if domainW or accountW is NULL */
1932
1933 /* try a small account buffer */
1934 acc_sizeW = 1;
1935 dom_sizeW = MAX_PATH;
1936 accountW[0] = 0;
1937 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1938 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1939 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1940 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1941
1942 /* try a 0 sized account buffer */
1943 acc_sizeW = 0;
1944 dom_sizeW = MAX_PATH;
1945 accountW[0] = 0;
1946 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1947 /* this can fail or succeed depending on OS version but the size will always be returned */
1948 ok(acc_sizeW == real_acc_sizeW + 1,
1949 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1950 real_acc_sizeW + 1, acc_sizeW);
1951
1952 /* try a 0 sized account buffer */
1953 acc_sizeW = 0;
1954 dom_sizeW = MAX_PATH;
1955 LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, domainW, &dom_sizeW, &use);
1956 /* this can fail or succeed depending on OS version but the size will always be returned */
1957 ok(acc_sizeW == real_acc_sizeW + 1,
1958 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1959 real_acc_sizeW + 1, acc_sizeW);
1960
1961 /* try a small domain buffer */
1962 dom_sizeW = 1;
1963 acc_sizeW = MAX_PATH;
1964 accountW[0] = 0;
1965 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1966 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1967 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1968 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1969
1970 /* try a 0 sized domain buffer */
1971 dom_sizeW = 0;
1972 acc_sizeW = MAX_PATH;
1973 accountW[0] = 0;
1974 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1975 /* this can fail or succeed depending on OS version but the size will always be returned */
1976 ok(dom_sizeW == real_dom_sizeW + 1,
1977 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1978 real_dom_sizeW + 1, dom_sizeW);
1979
1980 /* try a 0 sized domain buffer */
1981 dom_sizeW = 0;
1982 acc_sizeW = MAX_PATH;
1983 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, NULL, &dom_sizeW, &use);
1984 /* this can fail or succeed depending on OS version but the size will always be returned */
1985 ok(dom_sizeW == real_dom_sizeW + 1,
1986 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1987 real_dom_sizeW + 1, dom_sizeW);
1988
1989 acc_sizeW = dom_sizeW = use = 0;
1990 SetLastError(0xdeadbeef);
1991 ret = LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, NULL, &dom_sizeW, &use);
1992 error = GetLastError();
1993 ok(!ret, "LookupAccountSidW failed %u\n", GetLastError());
1994 ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
1995 ok(acc_sizeW, "expected non-zero account size\n");
1996 ok(dom_sizeW, "expected non-zero domain size\n");
1997 ok(!use, "expected zero use %u\n", use);
1998
1999 FreeSid(pUsersSid);
2000
2001 /* Test LookupAccountSid with Sid retrieved from token information.
2002 This assumes this process is running under the account of the current user.*/
2003 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY|TOKEN_DUPLICATE, &hToken);
2004 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
2005 ret = GetTokenInformation(hToken, TokenUser, NULL, 0, &cbti);
2006 ok(!ret, "GetTokenInformation failed with error %d\n", GetLastError());
2007 ptiUser = HeapAlloc(GetProcessHeap(), 0, cbti);
2008 if (GetTokenInformation(hToken, TokenUser, ptiUser, cbti, &cbti))
2009 {
2010 acc_sizeA = dom_sizeA = MAX_PATH;
2011 ret = LookupAccountSidA(NULL, ptiUser->User.Sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
2012 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
2013 user_sizeA = MAX_PATH;
2014 ret = GetUserNameA(usernameA , &user_sizeA);
2015 ok(ret, "GetUserNameA() Expected TRUE, got FALSE\n");
2016 ok(lstrcmpA(usernameA, accountA) == 0, "LookupAccountSidA() Expected account name: %s got: %s\n", usernameA, accountA );
2017 }
2018 HeapFree(GetProcessHeap(), 0, ptiUser);
2019
2020 if (pCreateWellKnownSid && pConvertSidToStringSidA)
2021 {
2022 trace("Well Known SIDs:\n");
2023 for (i = 0; i <= 60; i++)
2024 {
2025 size = SECURITY_MAX_SID_SIZE;
2026 if (pCreateWellKnownSid(i, NULL, &max_sid.sid, &size))
2027 {
2028 if (pConvertSidToStringSidA(&max_sid.sid, &str_sidA))
2029 {
2030 acc_sizeA = MAX_PATH;
2031 dom_sizeA = MAX_PATH;
2032 if (LookupAccountSidA(NULL, &max_sid.sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use))
2033 trace(" %d: %s %s\\%s %d\n", i, str_sidA, domainA, accountA, use);
2034 LocalFree(str_sidA);
2035 }
2036 }
2037 else
2038 {
2039 if (GetLastError() != ERROR_INVALID_PARAMETER)
2040 trace(" CreateWellKnownSid(%d) failed: %d\n", i, GetLastError());
2041 else
2042 trace(" %d: not supported\n", i);
2043 }
2044 }
2045
2046 pLsaQueryInformationPolicy = (void *)GetProcAddress( hmod, "LsaQueryInformationPolicy");
2047 pLsaOpenPolicy = (void *)GetProcAddress( hmod, "LsaOpenPolicy");
2048 pLsaFreeMemory = (void *)GetProcAddress( hmod, "LsaFreeMemory");
2049 pLsaClose = (void *)GetProcAddress( hmod, "LsaClose");
2050
2051 if (pLsaQueryInformationPolicy && pLsaOpenPolicy && pLsaFreeMemory && pLsaClose)
2052 {
2053 NTSTATUS status;
2054 LSA_HANDLE handle;
2055 LSA_OBJECT_ATTRIBUTES object_attributes;
2056
2057 ZeroMemory(&object_attributes, sizeof(object_attributes));
2058 object_attributes.Length = sizeof(object_attributes);
2059
2060 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_ALL_ACCESS, &handle);
2061 ok(status == STATUS_SUCCESS || status == STATUS_ACCESS_DENIED,
2062 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status);
2063
2064 /* try a more restricted access mask if necessary */
2065 if (status == STATUS_ACCESS_DENIED) {
2066 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
2067 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_VIEW_LOCAL_INFORMATION, &handle);
2068 ok(status == STATUS_SUCCESS, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status);
2069 }
2070
2071 if (status == STATUS_SUCCESS)
2072 {
2073 PPOLICY_ACCOUNT_DOMAIN_INFO info;
2074 status = pLsaQueryInformationPolicy(handle, PolicyAccountDomainInformation, (PVOID*)&info);
2075 ok(status == STATUS_SUCCESS, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status);
2076 if (status == STATUS_SUCCESS)
2077 {
2078 ok(info->DomainSid!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
2079 if (info->DomainSid)
2080 {
2081 int count = *GetSidSubAuthorityCount(info->DomainSid);
2082 CopySid(GetSidLengthRequired(count), &max_sid, info->DomainSid);
2083 test_sid_str((PSID)&max_sid.sid);
2084 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_ADMIN;
2085 max_sid.sid.SubAuthorityCount = count + 1;
2086 test_sid_str((PSID)&max_sid.sid);
2087 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_GUEST;
2088 test_sid_str((PSID)&max_sid.sid);
2089 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ADMINS;
2090 test_sid_str((PSID)&max_sid.sid);
2091 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_USERS;
2092 test_sid_str((PSID)&max_sid.sid);
2093 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_GUESTS;
2094 test_sid_str((PSID)&max_sid.sid);
2095 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_COMPUTERS;
2096 test_sid_str((PSID)&max_sid.sid);
2097 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CONTROLLERS;
2098 test_sid_str((PSID)&max_sid.sid);
2099 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CERT_ADMINS;
2100 test_sid_str((PSID)&max_sid.sid);
2101 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_SCHEMA_ADMINS;
2102 test_sid_str((PSID)&max_sid.sid);
2103 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS;
2104 test_sid_str((PSID)&max_sid.sid);
2105 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_POLICY_ADMINS;
2106 test_sid_str((PSID)&max_sid.sid);
2107 max_sid.sid.SubAuthority[count] = DOMAIN_ALIAS_RID_RAS_SERVERS;
2108 test_sid_str((PSID)&max_sid.sid);
2109 max_sid.sid.SubAuthority[count] = 1000; /* first user account */
2110 test_sid_str((PSID)&max_sid.sid);
2111 }
2112
2113 pLsaFreeMemory((LPVOID)info);
2114 }
2115
2116 status = pLsaClose(handle);
2117 ok(status == STATUS_SUCCESS, "LsaClose() failed, returned 0x%08x\n", status);
2118 }
2119 }
2120 }
2121 }
2122
2123 static BOOL get_sid_info(PSID psid, LPSTR *user, LPSTR *dom)
2124 {
2125 static CHAR account[UNLEN + 1];
2126 static CHAR domain[UNLEN + 1];
2127 DWORD size, dom_size;
2128 SID_NAME_USE use;
2129
2130 *user = account;
2131 *dom = domain;
2132
2133 size = dom_size = UNLEN + 1;
2134 account[0] = '\0';
2135 domain[0] = '\0';
2136 SetLastError(0xdeadbeef);
2137 return LookupAccountSidA(NULL, psid, account, &size, domain, &dom_size, &use);
2138 }
2139
2140 static void check_wellknown_name(const char* name, WELL_KNOWN_SID_TYPE result)
2141 {
2142 SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
2143 PSID domainsid = NULL;
2144 char wk_sid[SECURITY_MAX_SID_SIZE];
2145 DWORD cb;
2146
2147 DWORD sid_size, domain_size;
2148 SID_NAME_USE sid_use;
2149 LPSTR domain, account, sid_domain, wk_domain, wk_account;
2150 PSID psid;
2151 BOOL ret ,ret2;
2152
2153 sid_size = 0;
2154 domain_size = 0;
2155 ret = LookupAccountNameA(NULL, name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2156 ok(!ret, " %s Should have failed to lookup account name\n", name);
2157 psid = HeapAlloc(GetProcessHeap(),0,sid_size);
2158 domain = HeapAlloc(GetProcessHeap(),0,domain_size);
2159 ret = LookupAccountNameA(NULL, name, psid, &sid_size, domain, &domain_size, &sid_use);
2160
2161 if (!result)
2162 {
2163 ok(!ret, " %s Should have failed to lookup account name\n",name);
2164 goto cleanup;
2165 }
2166
2167 AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
2168 cb = sizeof(wk_sid);
2169 if (!pCreateWellKnownSid(result, domainsid, wk_sid, &cb))
2170 {
2171 win_skip("SID %i is not available on the system\n",result);
2172 goto cleanup;
2173 }
2174
2175 ret2 = get_sid_info(wk_sid, &wk_account, &wk_domain);
2176 if (!ret2 && GetLastError() == ERROR_NONE_MAPPED)
2177 {
2178 win_skip("CreateWellKnownSid() succeeded but the account '%s' is not present (W2K)\n", name);
2179 goto cleanup;
2180 }
2181
2182 get_sid_info(psid, &account, &sid_domain);
2183
2184 ok(ret, "Failed to lookup account name %s\n",name);
2185 ok(sid_size != 0, "sid_size was zero\n");
2186
2187 ok(EqualSid(psid,wk_sid),"(%s) Sids fail to match well known sid!\n",name);
2188
2189 ok(!lstrcmpA(account, wk_account), "Expected %s , got %s\n", account, wk_account);
2190 ok(!lstrcmpA(domain, wk_domain), "Expected %s, got %s\n", wk_domain, domain);
2191 ok(sid_use == SidTypeWellKnownGroup , "Expected Use (5), got %d\n", sid_use);
2192
2193 cleanup:
2194 FreeSid(domainsid);
2195 HeapFree(GetProcessHeap(),0,psid);
2196 HeapFree(GetProcessHeap(),0,domain);
2197 }
2198
2199 static void test_LookupAccountName(void)
2200 {
2201 DWORD sid_size, domain_size, user_size;
2202 DWORD sid_save, domain_save;
2203 CHAR user_name[UNLEN + 1];
2204 CHAR computer_name[UNLEN + 1];
2205 SID_NAME_USE sid_use;
2206 LPSTR domain, account, sid_dom;
2207 PSID psid;
2208 BOOL ret;
2209
2210 /* native crashes if (assuming all other parameters correct):
2211 * - peUse is NULL
2212 * - Sid is NULL and cbSid is > 0
2213 * - cbSid or cchReferencedDomainName are NULL
2214 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
2215 */
2216
2217 user_size = UNLEN + 1;
2218 SetLastError(0xdeadbeef);
2219 ret = GetUserNameA(user_name, &user_size);
2220 ok(ret, "Failed to get user name : %d\n", GetLastError());
2221
2222 /* get sizes */
2223 sid_size = 0;
2224 domain_size = 0;
2225 sid_use = 0xcafebabe;
2226 SetLastError(0xdeadbeef);
2227 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2228 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2229 {
2230 win_skip("LookupAccountNameA is not implemented\n");
2231 return;
2232 }
2233 ok(!ret, "Expected 0, got %d\n", ret);
2234 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2235 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2236 ok(sid_size != 0, "Expected non-zero sid size\n");
2237 ok(domain_size != 0, "Expected non-zero domain size\n");
2238 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2239
2240 sid_save = sid_size;
2241 domain_save = domain_size;
2242
2243 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2244 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2245
2246 /* try valid account name */
2247 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, domain, &domain_size, &sid_use);
2248 get_sid_info(psid, &account, &sid_dom);
2249 ok(ret, "Failed to lookup account name\n");
2250 ok(sid_size == GetLengthSid(psid), "Expected %d, got %d\n", GetLengthSid(psid), sid_size);
2251 ok(!lstrcmpA(account, user_name), "Expected %s, got %s\n", user_name, account);
2252 ok(!lstrcmpA(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2253 ok(domain_size == domain_save - 1, "Expected %d, got %d\n", domain_save - 1, domain_size);
2254 ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlenA(domain), domain_size);
2255 ok(sid_use == SidTypeUser, "Expected SidTypeUser (%d), got %d\n", SidTypeUser, sid_use);
2256 domain_size = domain_save;
2257 sid_size = sid_save;
2258
2259 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2260 {
2261 skip("Non-English locale (test with hardcoded 'Everyone')\n");
2262 }
2263 else
2264 {
2265 ret = LookupAccountNameA(NULL, "Everyone", psid, &sid_size, domain, &domain_size, &sid_use);
2266 get_sid_info(psid, &account, &sid_dom);
2267 ok(ret, "Failed to lookup account name\n");
2268 ok(sid_size != 0, "sid_size was zero\n");
2269 ok(!lstrcmpA(account, "Everyone"), "Expected Everyone, got %s\n", account);
2270 ok(!lstrcmpA(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2271 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2272 ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlenA(domain), domain_size);
2273 ok(sid_use == SidTypeWellKnownGroup, "Expected SidTypeWellKnownGroup (%d), got %d\n", SidTypeWellKnownGroup, sid_use);
2274 domain_size = domain_save;
2275 }
2276
2277 /* NULL Sid with zero sid size */
2278 SetLastError(0xdeadbeef);
2279 sid_size = 0;
2280 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2281 ok(!ret, "Expected 0, got %d\n", ret);
2282 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2283 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2284 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2285 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2286
2287 /* try cchReferencedDomainName - 1 */
2288 SetLastError(0xdeadbeef);
2289 domain_size--;
2290 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2291 ok(!ret, "Expected 0, got %d\n", ret);
2292 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2293 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2294 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2295 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2296
2297 /* NULL ReferencedDomainName with zero domain name size */
2298 SetLastError(0xdeadbeef);
2299 domain_size = 0;
2300 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, NULL, &domain_size, &sid_use);
2301 ok(!ret, "Expected 0, got %d\n", ret);
2302 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2303 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2304 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2305 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2306
2307 HeapFree(GetProcessHeap(), 0, psid);
2308 HeapFree(GetProcessHeap(), 0, domain);
2309
2310 /* get sizes for NULL account name */
2311 sid_size = 0;
2312 domain_size = 0;
2313 sid_use = 0xcafebabe;
2314 SetLastError(0xdeadbeef);
2315 ret = LookupAccountNameA(NULL, NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2316 if (!ret && GetLastError() == ERROR_NONE_MAPPED)
2317 win_skip("NULL account name doesn't work on NT4\n");
2318 else
2319 {
2320 ok(!ret, "Expected 0, got %d\n", ret);
2321 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2322 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2323 ok(sid_size != 0, "Expected non-zero sid size\n");
2324 ok(domain_size != 0, "Expected non-zero domain size\n");
2325 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2326
2327 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2328 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2329
2330 /* try NULL account name */
2331 ret = LookupAccountNameA(NULL, NULL, psid, &sid_size, domain, &domain_size, &sid_use);
2332 get_sid_info(psid, &account, &sid_dom);
2333 ok(ret, "Failed to lookup account name\n");
2334 /* Using a fixed string will not work on different locales */
2335 ok(!lstrcmpA(account, domain),
2336 "Got %s for account and %s for domain, these should be the same\n",
2337 account, domain);
2338 ok(sid_use == SidTypeDomain, "Expected SidTypeDomain (%d), got %d\n", SidTypeDomain, sid_use);
2339
2340 HeapFree(GetProcessHeap(), 0, psid);
2341 HeapFree(GetProcessHeap(), 0, domain);
2342 }
2343
2344 /* try an invalid account name */
2345 SetLastError(0xdeadbeef);
2346 sid_size = 0;
2347 domain_size = 0;
2348 ret = LookupAccountNameA(NULL, "oogabooga", NULL, &sid_size, NULL, &domain_size, &sid_use);
2349 ok(!ret, "Expected 0, got %d\n", ret);
2350 ok(GetLastError() == ERROR_NONE_MAPPED ||
2351 broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE),
2352 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
2353 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2354 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2355
2356 /* try an invalid system name */
2357 SetLastError(0xdeadbeef);
2358 sid_size = 0;
2359 domain_size = 0;
2360 ret = LookupAccountNameA("deepthought", NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2361 ok(!ret, "Expected 0, got %d\n", ret);
2362 ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
2363 "Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %d\n", GetLastError());
2364 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2365 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2366
2367 /* try with the computer name as the account name */
2368 domain_size = sizeof(computer_name);
2369 GetComputerNameA(computer_name, &domain_size);
2370 sid_size = 0;
2371 domain_size = 0;
2372 ret = LookupAccountNameA(NULL, computer_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2373 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER ||
2374 GetLastError() == ERROR_NONE_MAPPED /* in a domain */ ||
2375 broken(GetLastError() == ERROR_TRUSTED_DOMAIN_FAILURE) ||
2376 broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE)),
2377 "LookupAccountNameA failed: %d\n", GetLastError());
2378 if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
2379 {
2380 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2381 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2382 ret = LookupAccountNameA(NULL, computer_name, psid, &sid_size, domain, &domain_size, &sid_use);
2383 ok(ret, "LookupAccountNameA failed: %d\n", GetLastError());
2384 ok(sid_use == SidTypeDomain ||
2385 (sid_use == SidTypeUser && ! strcmp(computer_name, user_name)), "expected SidTypeDomain for %s, got %d\n", computer_name, sid_use);
2386 HeapFree(GetProcessHeap(), 0, domain);
2387 HeapFree(GetProcessHeap(), 0, psid);
2388 }
2389
2390 /* Well Known names */
2391 if (!pCreateWellKnownSid)
2392 {
2393 win_skip("CreateWellKnownSid not available\n");
2394 return;
2395 }
2396
2397 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2398 {
2399 skip("Non-English locale (skipping well known name creation tests)\n");
2400 return;
2401 }
2402
2403 check_wellknown_name("LocalService", WinLocalServiceSid);
2404 check_wellknown_name("Local Service", WinLocalServiceSid);
2405 /* 2 spaces */
2406 check_wellknown_name("Local Service", 0);
2407 check_wellknown_name("NetworkService", WinNetworkServiceSid);
2408 check_wellknown_name("Network Service", WinNetworkServiceSid);
2409
2410 /* example of some names where the spaces are not optional */
2411 check_wellknown_name("Terminal Server User", WinTerminalServerSid);
2412 check_wellknown_name("TerminalServer User", 0);
2413 check_wellknown_name("TerminalServerUser", 0);
2414 check_wellknown_name("Terminal ServerUser", 0);
2415
2416 check_wellknown_name("enterprise domain controllers",WinEnterpriseControllersSid);
2417 check_wellknown_name("enterprisedomain controllers", 0);
2418 check_wellknown_name("enterprise domaincontrollers", 0);
2419 check_wellknown_name("enterprisedomaincontrollers", 0);
2420
2421 /* case insensitivity */
2422 check_wellknown_name("lOCAlServICE", WinLocalServiceSid);
2423
2424 /* fully qualified account names */
2425 check_wellknown_name("NT AUTHORITY\\LocalService", WinLocalServiceSid);
2426 check_wellknown_name("nt authority\\Network Service", WinNetworkServiceSid);
2427 check_wellknown_name("nt authority test\\Network Service", 0);
2428 check_wellknown_name("Dummy\\Network Service", 0);
2429 check_wellknown_name("ntauthority\\Network Service", 0);
2430 }
2431
2432 static void test_security_descriptor(void)
2433 {
2434 SECURITY_DESCRIPTOR sd;
2435 char buf[8192];
2436 DWORD size;
2437 BOOL isDefault, isPresent, ret;
2438 PACL pacl;
2439 PSID psid;
2440
2441 SetLastError(0xdeadbeef);
2442 ret = InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION);
2443 if (ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2444 {
2445 win_skip("InitializeSecurityDescriptor is not implemented\n");
2446 return;
2447 }
2448
2449 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2450 expect_eq(psid, NULL, PSID, "%p");
2451 expect_eq(isDefault, FALSE, BOOL, "%d");
2452 sd.Control |= SE_DACL_PRESENT | SE_SACL_PRESENT;
2453
2454 SetLastError(0xdeadbeef);
2455 size = 5;
2456 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), FALSE, BOOL, "%d");
2457 expect_eq(GetLastError(), ERROR_INSUFFICIENT_BUFFER, DWORD, "%u");
2458 ok(size > 5, "Size not increased\n");
2459 if (size <= 8192)
2460 {
2461 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), TRUE, BOOL, "%d");
2462 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2463 expect_eq(psid, NULL, PSID, "%p");
2464 expect_eq(isDefault, FALSE, BOOL, "%d");
2465 ok(GetSecurityDescriptorGroup(&sd, &psid, &isDefault), "GetSecurityDescriptorGroup failed\n");
2466 expect_eq(psid, NULL, PSID, "%p");
2467 expect_eq(isDefault, FALSE, BOOL, "%d");
2468 ok(GetSecurityDescriptorDacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorDacl failed\n");
2469 expect_eq(isPresent, TRUE, BOOL, "%d");
2470 expect_eq(psid, NULL, PSID, "%p");
2471 expect_eq(isDefault, FALSE, BOOL, "%d");
2472 ok(GetSecurityDescriptorSacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorSacl failed\n");
2473 expect_eq(isPresent, TRUE, BOOL, "%d");
2474 expect_eq(psid, NULL, PSID, "%p");
2475 expect_eq(isDefault, FALSE, BOOL, "%d");
2476 }
2477 }
2478
2479 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,0,__LINE__)
2480 #define TEST_GRANTED_ACCESS2(a,b,c) test_granted_access(a,b,c,__LINE__)
2481 static void test_granted_access(HANDLE handle, ACCESS_MASK access,
2482 ACCESS_MASK alt, int line)
2483 {
2484 OBJECT_BASIC_INFORMATION obj_info;
2485 NTSTATUS status;
2486
2487 if (!pNtQueryObject)
2488 {
2489 skip_(__FILE__, line)("Not NT platform - skipping tests\n");
2490 return;
2491 }
2492
2493 status = pNtQueryObject( handle, ObjectBasicInformation, &obj_info,
2494 sizeof(obj_info), NULL );
2495 ok_(__FILE__, line)(!status, "NtQueryObject with err: %08x\n", status);
2496 if (alt)
2497 ok_(__FILE__, line)(obj_info.GrantedAccess == access ||
2498 obj_info.GrantedAccess == alt, "Granted access should be 0x%08x "
2499 "or 0x%08x, instead of 0x%08x\n", access, alt, obj_info.GrantedAccess);
2500 else
2501 ok_(__FILE__, line)(obj_info.GrantedAccess == access, "Granted access should "
2502 "be 0x%08x, instead of 0x%08x\n", access, obj_info.GrantedAccess);
2503 }
2504
2505 #define CHECK_SET_SECURITY(o,i,e) \
2506 do{ \
2507 BOOL res_; \
2508 DWORD err; \
2509 SetLastError( 0xdeadbeef ); \
2510 res_ = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
2511 err = GetLastError(); \
2512 if (e == ERROR_SUCCESS) \
2513 ok(res_, "SetKernelObjectSecurity failed with %d\n", err); \
2514 else \
2515 ok(!res_ && err == e, "SetKernelObjectSecurity should have failed " \
2516 "with %s, instead of %d\n", #e, err); \
2517 }while(0)
2518
2519 static void test_process_security(void)
2520 {
2521 BOOL res;
2522 PTOKEN_OWNER owner;
2523 PTOKEN_PRIMARY_GROUP group;
2524 PSID AdminSid = NULL, UsersSid = NULL;
2525 PACL Acl = NULL;
2526 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
2527 char buffer[MAX_PATH];
2528 PROCESS_INFORMATION info;
2529 STARTUPINFOA startup;
2530 SECURITY_ATTRIBUTES psa;
2531 HANDLE token, event;
2532 DWORD size;
2533 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2534 PSID EveryoneSid = NULL;
2535
2536 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
2537 res = InitializeAcl(Acl, 256, ACL_REVISION);
2538 if (!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2539 {
2540 win_skip("ACLs not implemented - skipping tests\n");
2541 HeapFree(GetProcessHeap(), 0, Acl);
2542 return;
2543 }
2544 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2545
2546 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
2547 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2548
2549 /* get owner from the token we might be running as a user not admin */
2550 res = OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED, &token );
2551 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
2552 if (!res)
2553 {
2554 HeapFree(GetProcessHeap(), 0, Acl);
2555 return;
2556 }
2557
2558 res = GetTokenInformation( token, TokenOwner, NULL, 0, &size );
2559 ok(!res, "Expected failure, got %d\n", res);
2560 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2561 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2562
2563 owner = HeapAlloc(GetProcessHeap(), 0, size);
2564 res = GetTokenInformation( token, TokenOwner, owner, size, &size );
2565 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2566 AdminSid = ((TOKEN_OWNER*)owner)->Owner;
2567
2568 res = GetTokenInformation( token, TokenPrimaryGroup, NULL, 0, &size );
2569 ok(!res, "Expected failure, got %d\n", res);
2570 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2571 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2572
2573 group = HeapAlloc(GetProcessHeap(), 0, size);
2574 res = GetTokenInformation( token, TokenPrimaryGroup, group, size, &size );
2575 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2576 UsersSid = ((TOKEN_PRIMARY_GROUP*)group)->PrimaryGroup;
2577
2578 CloseHandle( token );
2579 if (!res)
2580 {
2581 HeapFree(GetProcessHeap(), 0, group);
2582 HeapFree(GetProcessHeap(), 0, owner);
2583 HeapFree(GetProcessHeap(), 0, Acl);
2584 return;
2585 }
2586
2587 res = AddAccessDeniedAce(Acl, ACL_REVISION, PROCESS_VM_READ, AdminSid);
2588 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
2589 res = AddAccessAllowedAce(Acl, ACL_REVISION, PROCESS_ALL_ACCESS, AdminSid);
2590 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2591
2592 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
2593 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
2594 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
2595
2596 event = CreateEventA( NULL, TRUE, TRUE, "test_event" );
2597 ok(event != NULL, "CreateEvent %d\n", GetLastError());
2598
2599 SecurityDescriptor->Revision = 0;
2600 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_UNKNOWN_REVISION );
2601 SecurityDescriptor->Revision = SECURITY_DESCRIPTOR_REVISION;
2602
2603 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2604 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2605 CHECK_SET_SECURITY( event, SACL_SECURITY_INFORMATION, ERROR_ACCESS_DENIED );
2606 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2607 /* NULL DACL is valid and means that everyone has access */
2608 SecurityDescriptor->Control |= SE_DACL_PRESENT;
2609 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2610
2611 /* Set owner and group and dacl */
2612 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
2613 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
2614 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_SUCCESS );
2615 test_owner_equal( event, AdminSid, __LINE__ );
2616
2617 res = SetSecurityDescriptorGroup(SecurityDescriptor, EveryoneSid, FALSE);
2618 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2619 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_SUCCESS );
2620 test_group_equal( event, EveryoneSid, __LINE__ );
2621
2622 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
2623 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
2624 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2625 /* setting a dacl should not change the owner or group */
2626 test_owner_equal( event, AdminSid, __LINE__ );
2627 test_group_equal( event, EveryoneSid, __LINE__ );
2628
2629 /* Test again with a different SID in case the previous SID also happens to
2630 * be the one that is incorrectly replacing the group. */
2631 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, FALSE);
2632 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2633 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_SUCCESS );
2634 test_group_equal( event, UsersSid, __LINE__ );
2635
2636 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
2637 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
2638 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2639 test_group_equal( event, UsersSid, __LINE__ );
2640
2641 sprintf(buffer, "%s tests/security.c test", myARGV[0]);
2642 memset(&startup, 0, sizeof(startup));
2643 startup.cb = sizeof(startup);
2644 startup.dwFlags = STARTF_USESHOWWINDOW;
2645 startup.wShowWindow = SW_SHOWNORMAL;
2646
2647 psa.nLength = sizeof(psa);
2648 psa.lpSecurityDescriptor = SecurityDescriptor;
2649 psa.bInheritHandle = TRUE;
2650
2651 /* Doesn't matter what ACL say we should get full access for ourselves */
2652 res = CreateProcessA( NULL, buffer, &psa, NULL, FALSE, 0, NULL, NULL, &startup, &info );
2653 ok(res, "CreateProcess with err:%d\n", GetLastError());
2654 TEST_GRANTED_ACCESS2( info.hProcess, PROCESS_ALL_ACCESS_NT4,
2655 STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
2656 winetest_wait_child_process( info.hProcess );
2657
2658 FreeSid(EveryoneSid);
2659 CloseHandle( info.hProcess );
2660 CloseHandle( info.hThread );
2661 CloseHandle( event );
2662 HeapFree(GetProcessHeap(), 0, group);
2663 HeapFree(GetProcessHeap(), 0, owner);
2664 HeapFree(GetProcessHeap(), 0, Acl);
2665 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
2666 }
2667
2668 static void test_process_security_child(void)
2669 {
2670 HANDLE handle, handle1;
2671 BOOL ret;
2672 DWORD err;
2673
2674 handle = OpenProcess( PROCESS_TERMINATE, FALSE, GetCurrentProcessId() );
2675 ok(handle != NULL, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
2676 TEST_GRANTED_ACCESS( handle, PROCESS_TERMINATE );
2677
2678 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2679 &handle1, 0, TRUE, DUPLICATE_SAME_ACCESS );
2680 ok(ret, "duplicating handle err:%d\n", GetLastError());
2681 TEST_GRANTED_ACCESS( handle1, PROCESS_TERMINATE );
2682
2683 CloseHandle( handle1 );
2684
2685 SetLastError( 0xdeadbeef );
2686 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2687 &handle1, PROCESS_ALL_ACCESS, TRUE, 0 );
2688 err = GetLastError();
2689 todo_wine
2690 ok(!ret && err == ERROR_ACCESS_DENIED, "duplicating handle should have failed "
2691 "with STATUS_ACCESS_DENIED, instead of err:%d\n", err);
2692
2693 CloseHandle( handle );
2694
2695 /* These two should fail - they are denied by ACL */
2696 handle = OpenProcess( PROCESS_VM_READ, FALSE, GetCurrentProcessId() );
2697 todo_wine
2698 ok(handle == NULL, "OpenProcess(PROCESS_VM_READ) should have failed\n");
2699 handle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId() );
2700 todo_wine
2701 ok(handle == NULL, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
2702
2703 /* Documented privilege elevation */
2704 ret = DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
2705 &handle, 0, TRUE, DUPLICATE_SAME_ACCESS );
2706 ok(ret, "duplicating handle err:%d\n", GetLastError());
2707 TEST_GRANTED_ACCESS2( handle, PROCESS_ALL_ACCESS_NT4,
2708 STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
2709
2710 CloseHandle( handle );
2711
2712 /* Same only explicitly asking for all access rights */
2713 ret = DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
2714 &handle, PROCESS_ALL_ACCESS, TRUE, 0 );
2715 ok(ret, "duplicating handle err:%d\n", GetLastError());
2716 TEST_GRANTED_ACCESS2( handle, PROCESS_ALL_ACCESS_NT4,
2717 PROCESS_ALL_ACCESS | PROCESS_QUERY_LIMITED_INFORMATION );
2718 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2719 &handle1, PROCESS_VM_READ, TRUE, 0 );
2720 ok(ret, "duplicating handle err:%d\n", GetLastError());
2721 TEST_GRANTED_ACCESS( handle1, PROCESS_VM_READ );
2722 CloseHandle( handle1 );
2723 CloseHandle( handle );
2724 }
2725
2726 static void test_impersonation_level(void)
2727 {
2728 HANDLE Token, ProcessToken;
2729 HANDLE Token2;
2730 DWORD Size;
2731 TOKEN_PRIVILEGES *Privileges;
2732 TOKEN_USER *User;
2733 PRIVILEGE_SET *PrivilegeSet;
2734 BOOL AccessGranted;
2735 BOOL ret;
2736 HKEY hkey;
2737 DWORD error;
2738
2739 pDuplicateTokenEx = (void *)GetProcAddress(hmod, "DuplicateTokenEx");
2740 if( !pDuplicateTokenEx ) {
2741 win_skip("DuplicateTokenEx is not available\n");
2742 return;
2743 }
2744 SetLastError(0xdeadbeef);
2745 ret = ImpersonateSelf(SecurityAnonymous);
2746 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2747 {
2748 win_skip("ImpersonateSelf is not implemented\n");
2749 return;
2750 }
2751 ok(ret, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
2752 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2753 ok(!ret, "OpenThreadToken should have failed\n");
2754 error = GetLastError();
2755 ok(error == ERROR_CANT_OPEN_ANONYMOUS, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error);
2756 /* can't perform access check when opening object against an anonymous impersonation token */
2757 todo_wine {
2758 error = RegOpenKeyExA(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2759 ok(error == ERROR_INVALID_HANDLE || error == ERROR_CANT_OPEN_ANONYMOUS || error == ERROR_BAD_IMPERSONATION_LEVEL,
2760 "RegOpenKeyEx failed with %d\n", error);
2761 }
2762 RevertToSelf();
2763
2764 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &ProcessToken);
2765 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
2766
2767 ret = pDuplicateTokenEx(ProcessToken,
2768 TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE, NULL,
2769 SecurityAnonymous, TokenImpersonation, &Token);
2770 ok(ret, "DuplicateTokenEx failed with error %d\n", GetLastError());
2771 /* can't increase the impersonation level */
2772 ret = DuplicateToken(Token, SecurityIdentification, &Token2);
2773 error = GetLastError();
2774 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL,
2775 "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2776 /* we can query anything from an anonymous token, including the user */
2777 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
2778 error = GetLastError();
2779 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
2780 User = HeapAlloc(GetProcessHeap(), 0, Size);
2781 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
2782 ok(ret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
2783 HeapFree(GetProcessHeap(), 0, User);
2784
2785 /* PrivilegeCheck fails with SecurityAnonymous level */
2786 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
2787 error = GetLastError();
2788 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
2789 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
2790 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
2791 ok(ret, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
2792
2793 PrivilegeSet = HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET, Privilege[Privileges->PrivilegeCount]));
2794 PrivilegeSet->PrivilegeCount = Privileges->PrivilegeCount;
2795 memcpy(PrivilegeSet->Privilege, Privileges->Privileges, PrivilegeSet->PrivilegeCount * sizeof(PrivilegeSet->Privilege[0]));
2796 PrivilegeSet->Control = PRIVILEGE_SET_ALL_NECESSARY;
2797 HeapFree(GetProcessHeap(), 0, Privileges);
2798
2799 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2800 error = GetLastError();
2801 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2802
2803 CloseHandle(Token);
2804
2805 ret = ImpersonateSelf(SecurityIdentification);
2806 ok(ret, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
2807 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2808 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
2809
2810 /* can't perform access check when opening object against an identification impersonation token */
2811 error = RegOpenKeyExA(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2812 todo_wine {
2813 ok(error == ERROR_INVALID_HANDLE || error == ERROR_BAD_IMPERSONATION_LEVEL,
2814 "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE or ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2815 }
2816 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2817 ok(ret, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
2818 CloseHandle(Token);
2819 RevertToSelf();
2820
2821 ret = ImpersonateSelf(SecurityImpersonation);
2822 ok(ret, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
2823 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2824 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
2825 error = RegOpenKeyExA(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2826 ok(error == ERROR_SUCCESS, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error);
2827 RegCloseKey(hkey);
2828 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2829 ok(ret, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
2830 RevertToSelf();
2831
2832 CloseHandle(Token);
2833 CloseHandle(ProcessToken);
2834
2835 HeapFree(GetProcessHeap(), 0, PrivilegeSet);
2836 }
2837
2838 static void test_SetEntriesInAclW(void)
2839 {
2840 DWORD res;
2841 PSID EveryoneSid = NULL, UsersSid = NULL;
2842 PACL OldAcl = NULL, NewAcl;
2843 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2844 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
2845 EXPLICIT_ACCESSW ExplicitAccess;
2846 static const WCHAR wszEveryone[] = {'E','v','e','r','y','o','n','e',0};
2847 static const WCHAR wszCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
2848
2849 if (!pSetEntriesInAclW)
2850 {
2851 win_skip("SetEntriesInAclW is not available\n");
2852 return;
2853 }
2854
2855 NewAcl = (PACL)0xdeadbeef;
2856 res = pSetEntriesInAclW(0, NULL, NULL, &NewAcl);
2857 if(res == ERROR_CALL_NOT_IMPLEMENTED)
2858 {
2859 win_skip("SetEntriesInAclW is not implemented\n");
2860 return;
2861 }
2862 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2863 ok(NewAcl == NULL ||
2864 broken(NewAcl != NULL), /* NT4 */
2865 "NewAcl=%p, expected NULL\n", NewAcl);
2866 LocalFree(NewAcl);
2867
2868 OldAcl = HeapAlloc(GetProcessHeap(), 0, 256);
2869 res = InitializeAcl(OldAcl, 256, ACL_REVISION);
2870 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2871 {
2872 win_skip("ACLs not implemented - skipping tests\n");
2873 HeapFree(GetProcessHeap(), 0, OldAcl);
2874 return;
2875 }
2876 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2877
2878 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
2879 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2880
2881 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
2882 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
2883 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2884
2885 res = AddAccessAllowedAce(OldAcl, ACL_REVISION, KEY_READ, UsersSid);
2886 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2887
2888 ExplicitAccess.grfAccessPermissions = KEY_WRITE;
2889 ExplicitAccess.grfAccessMode = GRANT_ACCESS;
2890 ExplicitAccess.grfInheritance = NO_INHERITANCE;
2891 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
2892 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2893 ExplicitAccess.Trustee.ptstrName = EveryoneSid;
2894 ExplicitAccess.Trustee.MultipleTrusteeOperation = 0xDEADBEEF;
2895 ExplicitAccess.Trustee.pMultipleTrustee = (PVOID)0xDEADBEEF;
2896 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2897 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2898 ok(NewAcl != NULL, "returned acl was NULL\n");
2899 LocalFree(NewAcl);
2900
2901 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
2902 ExplicitAccess.Trustee.pMultipleTrustee = NULL;
2903 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2904 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2905 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2906 ok(NewAcl != NULL, "returned acl was NULL\n");
2907 LocalFree(NewAcl);
2908
2909 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2910 {
2911 skip("Non-English locale (test with hardcoded 'Everyone')\n");
2912 }
2913 else
2914 {
2915 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2916 ExplicitAccess.Trustee.ptstrName = (LPWSTR)wszEveryone;
2917 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2918 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2919 ok(NewAcl != NULL, "returned acl was NULL\n");
2920 LocalFree(NewAcl);
2921
2922 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_BAD_FORM;
2923 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2924 ok(res == ERROR_INVALID_PARAMETER ||
2925 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2926 "SetEntriesInAclW failed: %u\n", res);
2927 ok(NewAcl == NULL ||
2928 broken(NewAcl != NULL), /* NT4 */
2929 "returned acl wasn't NULL: %p\n", NewAcl);
2930
2931 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2932 ExplicitAccess.Trustee.MultipleTrusteeOperation = TRUSTEE_IS_IMPERSONATE;
2933 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2934 ok(res == ERROR_INVALID_PARAMETER ||
2935 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2936 "SetEntriesInAclW failed: %u\n", res);
2937 ok(NewAcl == NULL ||
2938 broken(NewAcl != NULL), /* NT4 */
2939 "returned acl wasn't NULL: %p\n", NewAcl);
2940
2941 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2942 ExplicitAccess.grfAccessMode = SET_ACCESS;
2943 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2944 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2945 ok(NewAcl != NULL, "returned acl was NULL\n");
2946 LocalFree(NewAcl);
2947 }
2948
2949 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2950 ExplicitAccess.Trustee.ptstrName = (LPWSTR)wszCurrentUser;
2951 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2952 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2953 ok(NewAcl != NULL, "returned acl was NULL\n");
2954 LocalFree(NewAcl);
2955
2956 ExplicitAccess.grfAccessMode = REVOKE_ACCESS;
2957 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2958 ExplicitAccess.Trustee.ptstrName = UsersSid;
2959 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2960 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2961 ok(NewAcl != NULL, "returned acl was NULL\n");
2962 LocalFree(NewAcl);
2963
2964 FreeSid(UsersSid);
2965 FreeSid(EveryoneSid);
2966 HeapFree(GetProcessHeap(), 0, OldAcl);
2967 }
2968
2969 static void test_SetEntriesInAclA(void)
2970 {
2971 DWORD res;
2972 PSID EveryoneSid = NULL, UsersSid = NULL;
2973 PACL OldAcl = NULL, NewAcl;
2974 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2975 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
2976 EXPLICIT_ACCESSA ExplicitAccess;
2977 static const CHAR szEveryone[] = {'E','v','e','r','y','o','n','e',0};
2978 static const CHAR szCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
2979
2980 if (!pSetEntriesInAclA)
2981 {
2982 win_skip("SetEntriesInAclA is not available\n");
2983 return;
2984 }
2985
2986 NewAcl = (PACL)0xdeadbeef;
2987 res = pSetEntriesInAclA(0, NULL, NULL, &NewAcl);
2988 if(res == ERROR_CALL_NOT_IMPLEMENTED)
2989 {
2990 win_skip("SetEntriesInAclA is not implemented\n");
2991 return;
2992 }
2993 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2994 ok(NewAcl == NULL ||
2995 broken(NewAcl != NULL), /* NT4 */
2996 "NewAcl=%p, expected NULL\n", NewAcl);
2997 LocalFree(NewAcl);
2998
2999 OldAcl = HeapAlloc(GetProcessHeap(), 0, 256);
3000 res = InitializeAcl(OldAcl, 256, ACL_REVISION);
3001 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
3002 {
3003 win_skip("ACLs not implemented - skipping tests\n");
3004 HeapFree(GetProcessHeap(), 0, OldAcl);
3005 return;
3006 }
3007 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
3008
3009 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
3010 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3011
3012 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
3013 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
3014 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3015
3016 res = AddAccessAllowedAce(OldAcl, ACL_REVISION, KEY_READ, UsersSid);
3017 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
3018
3019 ExplicitAccess.grfAccessPermissions = KEY_WRITE;
3020 ExplicitAccess.grfAccessMode = GRANT_ACCESS;
3021 ExplicitAccess.grfInheritance = NO_INHERITANCE;
3022 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
3023 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
3024 ExplicitAccess.Trustee.ptstrName = EveryoneSid;
3025 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3026 ExplicitAccess.Trustee.pMultipleTrustee = NULL;
3027 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3028 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3029 ok(NewAcl != NULL, "returned acl was NULL\n");
3030 LocalFree(NewAcl);
3031
3032 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3033 ExplicitAccess.Trustee.pMultipleTrustee = NULL;
3034 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3035 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3036 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3037 ok(NewAcl != NULL, "returned acl was NULL\n");
3038 LocalFree(NewAcl);
3039
3040 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
3041 {
3042 skip("Non-English locale (test with hardcoded 'Everyone')\n");
3043 }
3044 else
3045 {
3046 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3047 ExplicitAccess.Trustee.ptstrName = (LPSTR)szEveryone;
3048 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3049 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3050 ok(NewAcl != NULL, "returned acl was NULL\n");
3051 LocalFree(NewAcl);
3052
3053 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_BAD_FORM;
3054 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3055 ok(res == ERROR_INVALID_PARAMETER ||
3056 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
3057 "SetEntriesInAclA failed: %u\n", res);
3058 ok(NewAcl == NULL ||
3059 broken(NewAcl != NULL), /* NT4 */
3060 "returned acl wasn't NULL: %p\n", NewAcl);
3061
3062 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3063 ExplicitAccess.Trustee.MultipleTrusteeOperation = TRUSTEE_IS_IMPERSONATE;
3064 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3065 ok(res == ERROR_INVALID_PARAMETER ||
3066 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
3067 "SetEntriesInAclA failed: %u\n", res);
3068 ok(NewAcl == NULL ||
3069 broken(NewAcl != NULL), /* NT4 */
3070 "returned acl wasn't NULL: %p\n", NewAcl);
3071
3072 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3073 ExplicitAccess.grfAccessMode = SET_ACCESS;
3074 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3075 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3076 ok(NewAcl != NULL, "returned acl was NULL\n");
3077 LocalFree(NewAcl);
3078 }
3079
3080 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3081 ExplicitAccess.Trustee.ptstrName = (LPSTR)szCurrentUser;
3082 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3083 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3084 ok(NewAcl != NULL, "returned acl was NULL\n");
3085 LocalFree(NewAcl);
3086
3087 ExplicitAccess.grfAccessMode = REVOKE_ACCESS;
3088 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
3089 ExplicitAccess.Trustee.ptstrName = UsersSid;
3090 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
3091 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
3092 ok(NewAcl != NULL, "returned acl was NULL\n");
3093 LocalFree(NewAcl);
3094
3095 FreeSid(UsersSid);
3096 FreeSid(EveryoneSid);
3097 HeapFree(GetProcessHeap(), 0, OldAcl);
3098 }
3099
3100 /* helper function for test_CreateDirectoryA */
3101 static void get_nt_pathW(const char *name, UNICODE_STRING *nameW)
3102 {
3103 UNICODE_STRING strW;
3104 ANSI_STRING str;
3105 NTSTATUS status;
3106 BOOLEAN ret;
3107
3108 pRtlInitAnsiString(&str, name);
3109
3110 status = pRtlAnsiStringToUnicodeString(&strW, &str, TRUE);
3111 ok(!status, "RtlAnsiStringToUnicodeString failed with %08x\n", status);
3112
3113 ret = pRtlDosPathNameToNtPathName_U(strW.Buffer, nameW, NULL, NULL);
3114 ok(ret, "RtlDosPathNameToNtPathName_U failed\n");
3115
3116 pRtlFreeUnicodeString(&strW);
3117 }
3118
3119 static void test_inherited_dacl(PACL dacl, PSID admin_sid, PSID user_sid, DWORD flags, DWORD mask,
3120 BOOL todo_count, BOOL todo_sid, BOOL todo_flags, int line)
3121 {
3122 ACL_SIZE_INFORMATION acl_size;
3123 ACCESS_ALLOWED_ACE *ace;
3124 BOOL bret;
3125
3126 bret = pGetAclInformation(dacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3127 ok_(__FILE__, line)(bret, "GetAclInformation failed\n");
3128
3129 if (todo_count)
3130 todo_wine
3131 ok_(__FILE__, line)(acl_size.AceCount == 2,
3132 "GetAclInformation returned unexpected entry count (%d != 2)\n",
3133 acl_size.AceCount);
3134 else
3135 ok_(__FILE__, line)(acl_size.AceCount == 2,
3136 "GetAclInformation returned unexpected entry count (%d != 2)\n",
3137 acl_size.AceCount);
3138
3139 if (acl_size.AceCount > 0)
3140 {
3141 bret = pGetAce(dacl, 0, (VOID **)&ace);
3142 ok_(__FILE__, line)(bret, "Failed to get Current User ACE\n");
3143
3144 bret = EqualSid(&ace->SidStart, user_sid);
3145 if (todo_sid)
3146 todo_wine
3147 ok_(__FILE__, line)(bret, "Current User ACE != Current User SID\n");
3148 else
3149 ok_(__FILE__, line)(bret, "Current User ACE != Current User SID\n");
3150
3151 if (todo_flags)
3152 todo_wine
3153 ok_(__FILE__, line)(((ACE_HEADER *)ace)->AceFlags == flags,
3154 "Current User ACE has unexpected flags (0x%x != 0x%x)\n",
3155 ((ACE_HEADER *)ace)->AceFlags, flags);
3156 else
3157 ok_(__FILE__, line)(((ACE_HEADER *)ace)->AceFlags == flags,
3158 "Current User ACE has unexpected flags (0x%x != 0x%x)\n",
3159 ((ACE_HEADER *)ace)->AceFlags, flags);
3160
3161 ok_(__FILE__, line)(ace->Mask == mask,
3162 "Current User ACE has unexpected mask (0x%x != 0x%x)\n",
3163 ace->Mask, mask);
3164 }
3165 if (acl_size.AceCount > 1)
3166 {
3167 bret = pGetAce(dacl, 1, (VOID **)&ace);
3168 ok_(__FILE__, line)(bret, "Failed to get Administators Group ACE\n");
3169
3170 bret = EqualSid(&ace->SidStart, admin_sid);
3171 if (todo_sid)
3172 todo_wine
3173 ok_(__FILE__, line)(bret, "Administators Group ACE != Administators Group SID\n");
3174 else
3175 ok_(__FILE__, line)(bret, "Administators Group ACE != Administators Group SID\n");
3176
3177 if (todo_flags)
3178 todo_wine
3179 ok_(__FILE__, line)(((ACE_HEADER *)ace)->AceFlags == flags,
3180 "Administators Group ACE has unexpected flags (0x%x != 0x%x)\n",
3181 ((ACE_HEADER *)ace)->AceFlags, flags);
3182 else
3183 ok_(__FILE__, line)(((ACE_HEADER *)ace)->AceFlags == flags,
3184 "Administators Group ACE has unexpected flags (0x%x != 0x%x)\n",
3185 ((ACE_HEADER *)ace)->AceFlags, flags);
3186
3187 ok_(__FILE__, line)(ace->Mask == mask,
3188 "Administators Group ACE has unexpected mask (0x%x != 0x%x)\n",
3189 ace->Mask, mask);
3190 }
3191 }
3192
3193 static void test_CreateDirectoryA(void)
3194 {
3195 char admin_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES], *user;
3196 DWORD sid_size = sizeof(admin_ptr), user_size;
3197 PSID admin_sid = (PSID) admin_ptr, user_sid;
3198 char sd[SECURITY_DESCRIPTOR_MIN_LENGTH];
3199 PSECURITY_DESCRIPTOR pSD = &sd;
3200 ACL_SIZE_INFORMATION acl_size;
3201 UNICODE_STRING tmpfileW;
3202 SECURITY_ATTRIBUTES sa;
3203 OBJECT_ATTRIBUTES attr;
3204 char tmpfile[MAX_PATH];
3205 char tmpdir[MAX_PATH];
3206 HANDLE token, hTemp;
3207 IO_STATUS_BLOCK io;
3208 struct _SID *owner;
3209 BOOL bret = TRUE;
3210 NTSTATUS status;
3211 DWORD error;
3212 PACL pDacl;
3213
3214 if (!pGetSecurityInfo || !pGetNamedSecurityInfoA || !pCreateWellKnownSid)
3215 {
3216 win_skip("Required functions are not available\n");
3217 return;
3218 }
3219
3220 if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
3221 {
3222 if (GetLastError() != ERROR_NO_TOKEN) bret = FALSE;
3223 else if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) bret = FALSE;
3224 }
3225 if (!bret)
3226 {
3227 win_skip("Failed to get current user token\n");
3228 return;
3229 }
3230 bret = GetTokenInformation(token, TokenUser, NULL, 0, &user_size);
3231 ok(!bret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
3232 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
3233 user = HeapAlloc(GetProcessHeap(), 0, user_size);
3234 bret = GetTokenInformation(token, TokenUser, user, user_size, &user_size);
3235 ok(bret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
3236 CloseHandle( token );
3237 user_sid = ((TOKEN_USER *)user)->User.Sid;
3238
3239 sa.nLength = sizeof(sa);
3240 sa.lpSecurityDescriptor = pSD;
3241 sa.bInheritHandle = TRUE;
3242 InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3243 pCreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, admin_sid, &sid_size);
3244 pDacl = HeapAlloc(GetProcessHeap(), 0, 100);
3245 bret = InitializeAcl(pDacl, 100, ACL_REVISION);
3246 ok(bret, "Failed to initialize ACL.\n");
3247 bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE,
3248 GENERIC_ALL, user_sid);
3249 ok(bret, "Failed to add Current User to ACL.\n");
3250 bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE,
3251 GENERIC_ALL, admin_sid);
3252 ok(bret, "Failed to add Administrator Group to ACL.\n");
3253 bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3254 ok(bret, "Failed to add ACL to security desciptor.\n");
3255
3256 GetTempPathA(MAX_PATH, tmpdir);
3257 lstrcatA(tmpdir, "Please Remove Me");
3258 bret = CreateDirectoryA(tmpdir, &sa);
3259 ok(bret == TRUE, "CreateDirectoryA(%s) failed err=%d\n", tmpdir, GetLastError());
3260 HeapFree(GetProcessHeap(), 0, pDacl);
3261
3262 SetLastError(0xdeadbeef);
3263 error = pGetNamedSecurityInfoA(tmpdir, SE_FILE_OBJECT,
3264 OWNER_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, (PSID*)&owner,
3265 NULL, &pDacl, NULL, &pSD);
3266 if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3267 {
3268 win_skip("GetNamedSecurityInfoA is not implemented\n");
3269 goto done;
3270 }
3271 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3272 test_inherited_dacl(pDacl, admin_sid, user_sid, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE,
3273 0x1f01ff, FALSE, TRUE, FALSE, __LINE__);
3274 LocalFree(pSD);
3275
3276 /* Test inheritance of ACLs in CreateFile without security descriptor */
3277 strcpy(tmpfile, tmpdir);
3278 lstrcatA(tmpfile, "/tmpfile");
3279
3280 hTemp = CreateFileA(tmpfile, GENERIC_WRITE, FILE_SHARE_READ, NULL,
3281 CREATE_NEW, FILE_FLAG_DELETE_ON_CLOSE, NULL);
3282 ok(hTemp != INVALID_HANDLE_VALUE, "CreateFile error %u\n", GetLastError());
3283
3284 error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3285 OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3286 (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3287 ok(error == ERROR_SUCCESS, "Failed to get permissions on file\n");
3288 test_inherited_dacl(pDacl, admin_sid, user_sid, INHERITED_ACE,
3289 0x1f01ff, TRUE, TRUE, TRUE, __LINE__);
3290 LocalFree(pSD);
3291 CloseHandle(hTemp);
3292
3293 /* Test inheritance of ACLs in CreateFile with security descriptor -
3294 * When a security descriptor is set, then inheritance doesn't take effect */
3295 pSD = &sd;
3296 InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3297 pDacl = HeapAlloc(GetProcessHeap(), 0, sizeof(ACL));
3298 bret = InitializeAcl(pDacl, sizeof(ACL), ACL_REVISION);
3299 ok(bret, "Failed to initialize ACL\n");
3300 bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3301 ok(bret, "Failed to add ACL to security desciptor\n");
3302
3303 strcpy(tmpfile, tmpdir);
3304 lstrcatA(tmpfile, "/tmpfile");
3305
3306 sa.nLength = sizeof(sa);
3307 sa.lpSecurityDescriptor = pSD;
3308 sa.bInheritHandle = TRUE;
3309 hTemp = CreateFileA(tmpfile, GENERIC_WRITE, FILE_SHARE_READ, &sa,
3310 CREATE_NEW, FILE_FLAG_DELETE_ON_CLOSE, NULL);
3311 ok(hTemp != INVALID_HANDLE_VALUE, "CreateFile error %u\n", GetLastError());
3312 HeapFree(GetProcessHeap(), 0, pDacl);
3313
3314 error = pGetSecurityInfo(hTemp, SE_FILE_OBJECT,
3315 OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3316 (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3317 ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3318 bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3319 ok(bret, "GetAclInformation failed\n");
3320 todo_wine
3321 ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3322 acl_size.AceCount);
3323 LocalFree(pSD);
3324
3325 error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3326 OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3327 (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3328 todo_wine
3329 ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3330 if (error == ERROR_SUCCESS)
3331 {
3332 bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3333 ok(bret, "GetAclInformation failed\n");
3334 todo_wine
3335 ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3336 acl_size.AceCount);
3337 LocalFree(pSD);
3338 }
3339 CloseHandle(hTemp);
3340
3341 /* Test inheritance of ACLs in NtCreateFile without security descriptor */
3342 strcpy(tmpfile, tmpdir);
3343 lstrcatA(tmpfile, "/tmpfile");
3344 get_nt_pathW(tmpfile, &tmpfileW);
3345
3346 attr.Length = sizeof(attr);
3347 attr.RootDirectory = 0;
3348 attr.ObjectName = &tmpfileW;
3349 attr.Attributes = OBJ_CASE_INSENSITIVE;
3350 attr.SecurityDescriptor = NULL;
3351 attr.SecurityQualityOfService = NULL;
3352
3353 status = pNtCreateFile(&hTemp, GENERIC_WRITE | DELETE, &attr, &io, NULL, 0,
3354 FILE_SHARE_READ, FILE_CREATE, FILE_DELETE_ON_CLOSE, NULL, 0);
3355 ok(!status, "NtCreateFile failed with %08x\n", status);
3356 pRtlFreeUnicodeString(&tmpfileW);
3357
3358 error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3359 OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3360 (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3361 ok(error == ERROR_SUCCESS, "Failed to get permissions on file\n");
3362 test_inherited_dacl(pDacl, admin_sid, user_sid, INHERITED_ACE,
3363 0x1f01ff, TRUE, TRUE, TRUE, __LINE__);
3364 LocalFree(pSD);
3365 CloseHandle(hTemp);
3366
3367 /* Test inheritance of ACLs in NtCreateFile with security descriptor -
3368 * When a security descriptor is set, then inheritance doesn't take effect */
3369 pSD = &sd;
3370 InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3371 pDacl = HeapAlloc(GetProcessHeap(), 0, sizeof(ACL));
3372 bret = InitializeAcl(pDacl, sizeof(ACL), ACL_REVISION);
3373 ok(bret, "Failed to initialize ACL\n");
3374 bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3375 ok(bret, "Failed to add ACL to security desciptor\n");
3376
3377 strcpy(tmpfile, tmpdir);
3378 lstrcatA(tmpfile, "/tmpfile");
3379 get_nt_pathW(tmpfile, &tmpfileW);
3380
3381 attr.Length = sizeof(attr);
3382 attr.RootDirectory = 0;
3383 attr.ObjectName = &tmpfileW;
3384 attr.Attributes = OBJ_CASE_INSENSITIVE;
3385 attr.SecurityDescriptor = pSD;
3386 attr.SecurityQualityOfService = NULL;
3387
3388 status = pNtCreateFile(&hTemp, GENERIC_WRITE | DELETE, &attr, &io, NULL, 0,
3389 FILE_SHARE_READ, FILE_CREATE, FILE_DELETE_ON_CLOSE, NULL, 0);
3390 ok(!status, "NtCreateFile failed with %08x\n", status);
3391 pRtlFreeUnicodeString(&tmpfileW);
3392 HeapFree(GetProcessHeap(), 0, pDacl);
3393
3394 error = pGetSecurityInfo(hTemp, SE_FILE_OBJECT,
3395 OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3396 (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3397 ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3398 bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3399 ok(bret, "GetAclInformation failed\n");
3400 todo_wine
3401 ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3402 acl_size.AceCount);
3403 LocalFree(pSD);
3404
3405 error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3406 OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3407 (PSID *)&owner, NULL, &pDacl, NULL, &pSD);
3408 todo_wine
3409 ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error);
3410 if (error == ERROR_SUCCESS)
3411 {
3412 bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3413 ok(bret, "GetAclInformation failed\n");
3414 todo_wine
3415 ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n",
3416 acl_size.AceCount);
3417 LocalFree(pSD);
3418 }
3419 CloseHandle(hTemp);
3420
3421 done:
3422 HeapFree(GetProcessHeap(), 0, user);
3423 bret = RemoveDirectoryA(tmpdir);
3424 ok(bret == TRUE, "RemoveDirectoryA should always succeed\n");
3425 }
3426
3427 static void test_GetNamedSecurityInfoA(void)
3428 {
3429 char admin_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES], *user;
3430 char system_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES];
3431 char users_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES];
3432 PSID admin_sid = (PSID) admin_ptr, users_sid = (PSID) users_ptr;
3433 PSID system_sid = (PSID) system_ptr, user_sid;
3434 DWORD sid_size = sizeof(admin_ptr), user_size;
3435 char invalid_path[] = "/an invalid file path";
3436 int users_ace_id = -1, admins_ace_id = -1, i;
3437 char software_key[] = "MACHINE\\Software";
3438 char sd[SECURITY_DESCRIPTOR_MIN_LENGTH+sizeof(void*)];
3439 SECURITY_DESCRIPTOR_CONTROL control;
3440 ACL_SIZE_INFORMATION acl_size;
3441 CHAR windows_dir[MAX_PATH];
3442 PSECURITY_DESCRIPTOR pSD;
3443 ACCESS_ALLOWED_ACE *ace;
3444 BOOL bret = TRUE, isNT4;
3445 char tmpfile[MAX_PATH];
3446 DWORD error, revision;
3447 BOOL owner_defaulted;
3448 BOOL group_defaulted;
3449 BOOL dacl_defaulted;
3450 HANDLE token, hTemp, h;
3451 PSID owner, group;
3452 BOOL dacl_present;
3453 PACL pDacl;
3454 BYTE flags;
3455 NTSTATUS status;
3456
3457 if (!pSetNamedSecurityInfoA || !pGetNamedSecurityInfoA || !pCreateWellKnownSid)
3458 {
3459 win_skip("Required functions are not available\n");
3460 return;
3461 }
3462
3463 if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
3464 {
3465 if (GetLastError() != ERROR_NO_TOKEN) bret = FALSE;
3466 else if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) bret = FALSE;
3467 }
3468 if (!bret)
3469 {
3470 win_skip("Failed to get current user token\n");
3471 return;
3472 }
3473 bret = GetTokenInformation(token, TokenUser, NULL, 0, &user_size);
3474 ok(!bret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
3475 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
3476 user = HeapAlloc(GetProcessHeap(), 0, user_size);
3477 bret = GetTokenInformation(token, TokenUser, user, user_size, &user_size);
3478 ok(bret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
3479 CloseHandle( token );
3480 user_sid = ((TOKEN_USER *)user)->User.Sid;
3481
3482 bret = GetWindowsDirectoryA(windows_dir, MAX_PATH);
3483 ok(bret, "GetWindowsDirectory failed with error %d\n", GetLastError());
3484
3485 SetLastError(0xdeadbeef);
3486 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,
3487 OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
3488 NULL, NULL, NULL, NULL, &pSD);
3489 if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3490 {
3491 win_skip("GetNamedSecurityInfoA is not implemented\n");
3492 HeapFree(GetProcessHeap(), 0, user);
3493 return;
3494 }
3495 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3496
3497 bret = GetSecurityDescriptorControl(pSD, &control, &revision);
3498 ok(bret, "GetSecurityDescriptorControl failed with error %d\n", GetLastError());
3499 ok((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == (SE_SELF_RELATIVE|SE_DACL_PRESENT) ||
3500 broken((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == SE_DACL_PRESENT), /* NT4 */
3501 "control (0x%x) doesn't have (SE_SELF_RELATIVE|SE_DACL_PRESENT) flags set\n", control);
3502 ok(revision == SECURITY_DESCRIPTOR_REVISION1, "revision was %d instead of 1\n", revision);
3503
3504 isNT4 = (control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == SE_DACL_PRESENT;
3505
3506 bret = GetSecurityDescriptorOwner(pSD, &owner, &owner_defaulted);
3507 ok(bret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
3508 ok(owner != NULL, "owner should not be NULL\n");
3509
3510 bret = GetSecurityDescriptorGroup(pSD, &group, &group_defaulted);
3511 ok(bret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
3512 ok(group != NULL, "group should not be NULL\n");
3513 LocalFree(pSD);
3514
3515
3516 /* NULL descriptor tests */
3517 if(isNT4)
3518 {
3519 win_skip("NT4 does not support GetNamedSecutityInfo with a NULL descriptor\n");
3520 HeapFree(GetProcessHeap(), 0, user);
3521 return;
3522 }
3523
3524 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,
3525 NULL, NULL, NULL, NULL, NULL);
3526 ok(error==ERROR_INVALID_PARAMETER, "GetNamedSecurityInfo failed with error %d\n", error);
3527
3528 pDacl = NULL;
3529 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,
3530 NULL, NULL, &pDacl, NULL, &pSD);
3531 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3532 ok(pDacl != NULL, "DACL should not be NULL\n");
3533 LocalFree(pSD);
3534
3535 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,OWNER_SECURITY_INFORMATION,
3536 NULL, NULL, &pDacl, NULL, NULL);
3537 ok(error==ERROR_INVALID_PARAMETER, "GetNamedSecurityInfo failed with error %d\n", error);
3538
3539 /* Test behavior of SetNamedSecurityInfo with an invalid path */
3540 SetLastError(0xdeadbeef);
3541 error = pSetNamedSecurityInfoA(invalid_path, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL,
3542 NULL, NULL, NULL);
3543 ok(error == ERROR_FILE_NOT_FOUND, "Unexpected error returned: 0x%x\n", error);
3544 ok(GetLastError() == 0xdeadbeef, "Expected last error to remain unchanged.\n");
3545
3546 /* Create security descriptor information and test that it comes back the same */
3547 pSD = &sd;
3548 pDacl = HeapAlloc(GetProcessHeap(), 0, 100);
3549 InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3550 pCreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, admin_sid, &sid_size);
3551 bret = InitializeAcl(pDacl, 100, ACL_REVISION);
3552 ok(bret, "Failed to initialize ACL.\n");
3553 bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
3554 ok(bret, "Failed to add Current User to ACL.\n");
3555 bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, admin_sid);
3556 ok(bret, "Failed to add Administrator Group to ACL.\n");
3557 bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3558 ok(bret, "Failed to add ACL to security desciptor.\n");
3559 GetTempFileNameA(".", "foo", 0, tmpfile);
3560 hTemp = CreateFileA(tmpfile, WRITE_DAC|GENERIC_WRITE, FILE_SHARE_DELETE|FILE_SHARE_READ,
3561 NULL, OPEN_EXISTING, FILE_FLAG_DELETE_ON_CLOSE, NULL);
3562 SetLastError(0xdeadbeef);
3563 error = pSetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL,
3564 NULL, pDacl, NULL);
3565 HeapFree(GetProcessHeap(), 0, pDacl);
3566 if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3567 {
3568 win_skip("SetNamedSecurityInfoA is not implemented\n");
3569 HeapFree(GetProcessHeap(), 0, user);
3570 CloseHandle(hTemp);
3571 return;
3572 }
3573 ok(!error, "SetNamedSecurityInfoA failed with error %d\n", error);
3574 SetLastError(0xdeadbeef);
3575 error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
3576 NULL, NULL, &pDacl, NULL, &pSD);
3577 if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3578 {
3579 win_skip("GetNamedSecurityInfoA is not implemented\n");
3580 HeapFree(GetProcessHeap(), 0, user);
3581 CloseHandle(hTemp);
3582 return;
3583 }
3584 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3585
3586 bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3587 ok(bret, "GetAclInformation failed\n");
3588 if (acl_size.AceCount > 0)
3589 {
3590 bret = pGetAce(pDacl, 0, (VOID **)&ace);
3591 ok(bret, "Failed to get Current User ACE.\n");
3592 bret = EqualSid(&ace->SidStart, user_sid);
3593 todo_wine ok(bret, "Current User ACE != Current User SID.\n");
3594 ok(((ACE_HEADER *)ace)->AceFlags == 0,
3595 "Current User ACE has unexpected flags (0x%x != 0x0)\n", ((ACE_HEADER *)ace)->AceFlags);
3596 ok(ace->Mask == 0x1f01ff, "Current User ACE has unexpected mask (0x%x != 0x1f01ff)\n",
3597 ace->Mask);
3598 }
3599 if (acl_size.AceCount > 1)
3600 {
3601 bret = pGetAce(pDacl, 1, (VOID **)&ace);
3602 ok(bret, "Failed to get Administators Group ACE.\n");
3603 bret = EqualSid(&ace->SidStart, admin_sid);
3604 todo_wine ok(bret || broken(!bret) /* win2k */,
3605 "Administators Group ACE != Administators Group SID.\n");
3606 ok(((ACE_HEADER *)ace)->AceFlags == 0,
3607 "Administators Group ACE has unexpected flags (0x%x != 0x0)\n", ((ACE_HEADER *)ace)->AceFlags);
3608 ok(ace->Mask == 0x1f01ff || broken(ace->Mask == GENERIC_ALL) /* win2k */,
3609 "Administators Group ACE has unexpected mask (0x%x != 0x1f01ff)\n", ace->Mask);
3610 }
3611 LocalFree(pSD);
3612
3613 /* show that setting empty DACL is not removing all file permissions */
3614 pDacl = HeapAlloc(GetProcessHeap(), 0, sizeof(ACL));
3615 bret = InitializeAcl(pDacl, sizeof(ACL), ACL_REVISION);
3616 ok(bret, "Failed to initialize ACL.\n");
3617 error = pSetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
3618 NULL, NULL, pDacl, NULL);
3619 ok(!error, "SetNamedSecurityInfoA failed with error %d\n", error);
3620 HeapFree(GetProcessHeap(), 0, pDacl);
3621
3622 error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
3623 NULL, NULL, &pDacl, NULL, &pSD);
3624 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3625
3626 bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3627 ok(bret, "GetAclInformation failed\n");
3628 if (acl_size.AceCount > 0)
3629 {
3630 bret = pGetAce(pDacl, 0, (VOID **)&ace);
3631 ok(bret, "Failed to get ACE.\n");
3632 todo_wine ok(((ACE_HEADER *)ace)->AceFlags & INHERITED_ACE,
3633 "ACE has unexpected flags: 0x%x\n", ((ACE_HEADER *)ace)->AceFlags);
3634 }
3635 LocalFree(pSD);
3636
3637 h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
3638 NULL, OPEN_EXISTING, 0, NULL);
3639 ok(h != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
3640 CloseHandle(h);
3641
3642 /* test setting NULL DACL */
3643 error = pSetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT,
3644 DACL_SECURITY_INFORMATION, NULL, NULL, NULL, NULL);
3645 ok(!error, "SetNamedSecurityInfoA failed with error %d\n", error);
3646
3647 error = pGetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
3648 NULL, NULL, &pDacl, NULL, &pSD);
3649 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3650 todo_wine ok(!pDacl, "pDacl != NULL\n");
3651 LocalFree(pSD);
3652
3653 h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
3654 NULL, OPEN_EXISTING, 0, NULL);
3655 ok(h != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
3656 CloseHandle(h);
3657
3658 /* NtSetSecurityObject doesn't inherit DACL entries */
3659 pSD = sd+sizeof(void*)-((ULONG_PTR)sd)%sizeof(void*);
3660 InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
3661 pDacl = HeapAlloc(GetProcessHeap(), 0, 100);
3662 bret = InitializeAcl(pDacl, sizeof(ACL), ACL_REVISION);
3663 ok(bret, "Failed to initialize ACL.\n");
3664 bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3665 ok(bret, "Failed to add ACL to security desciptor.\n");
3666 status = pNtSetSecurityObject(hTemp, DACL_SECURITY_INFORMATION, pSD);
3667 ok(status == ERROR_SUCCESS, "NtSetSecurityObject returned %x\n", status);
3668
3669 h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
3670 NULL, OPEN_EXISTING, 0, NULL);
3671 ok(h == INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
3672 CloseHandle(h);
3673
3674 pSetSecurityDescriptorControl(pSD, SE_DACL_AUTO_INHERIT_REQ, SE_DACL_AUTO_INHERIT_REQ);
3675 status = pNtSetSecurityObject(hTemp, DACL_SECURITY_INFORMATION, pSD);
3676 ok(status == ERROR_SUCCESS, "NtSetSecurityObject returned %x\n", status);
3677
3678 h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
3679 NULL, OPEN_EXISTING, 0, NULL);
3680 ok(h == INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
3681 CloseHandle(h);
3682
3683 pSetSecurityDescriptorControl(pSD, SE_DACL_AUTO_INHERIT_REQ|SE_DACL_AUTO_INHERITED,
3684 SE_DACL_AUTO_INHERIT_REQ|SE_DACL_AUTO_INHERITED);
3685 status = pNtSetSecurityObject(hTemp, DACL_SECURITY_INFORMATION, pSD);
3686 ok(status == ERROR_SUCCESS, "NtSetSecurityObject returned %x\n", status);
3687
3688 h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
3689 NULL, OPEN_EXISTING, 0, NULL);
3690 ok(h == INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
3691 CloseHandle(h);
3692
3693 /* test if DACL is properly mapped to permission */
3694 bret = InitializeAcl(pDacl, 100, ACL_REVISION);
3695 ok(bret, "Failed to initialize ACL.\n");
3696 bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
3697 ok(bret, "Failed to add Current User to ACL.\n");
3698 bret = pAddAccessDeniedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
3699 ok(bret, "Failed to add Current User to ACL.\n");
3700 bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3701 ok(bret, "Failed to add ACL to security desciptor.\n");
3702 status = pNtSetSecurityObject(hTemp, DACL_SECURITY_INFORMATION, pSD);
3703 ok(status == ERROR_SUCCESS, "NtSetSecurityObject returned %x\n", status);
3704
3705 h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
3706 NULL, OPEN_EXISTING, 0, NULL);
3707 ok(h != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
3708 CloseHandle(h);
3709
3710 bret = InitializeAcl(pDacl, 100, ACL_REVISION);
3711 ok(bret, "Failed to initialize ACL.\n");
3712 bret = pAddAccessDeniedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
3713 ok(bret, "Failed to add Current User to ACL.\n");
3714 bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
3715 ok(bret, "Failed to add Current User to ACL.\n");
3716 bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
3717 ok(bret, "Failed to add ACL to security desciptor.\n");
3718 status = pNtSetSecurityObject(hTemp, DACL_SECURITY_INFORMATION, pSD);
3719 ok(status == ERROR_SUCCESS, "NtSetSecurityObject returned %x\n", status);
3720
3721 h = CreateFileA(tmpfile, GENERIC_READ, FILE_SHARE_DELETE|FILE_SHARE_WRITE|FILE_SHARE_READ,
3722 NULL, OPEN_EXISTING, 0, NULL);
3723 ok(h == INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
3724 HeapFree(GetProcessHeap(), 0, pDacl);
3725 HeapFree(GetProcessHeap(), 0, user);
3726 CloseHandle(hTemp);
3727
3728 /* Test querying the ownership of a built-in registry key */
3729 sid_size = sizeof(system_ptr);
3730 pCreateWellKnownSid(WinLocalSystemSid, NULL, system_sid, &sid_size);
3731 error = pGetNamedSecurityInfoA(software_key, SE_REGISTRY_KEY,
3732 OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION,
3733 NULL, NULL, NULL, NULL, &pSD);
3734 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3735
3736 bret = GetSecurityDescriptorOwner(pSD, &owner, &owner_defaulted);
3737 ok(bret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
3738 ok(owner != NULL, "owner should not be NULL\n");
3739 ok(EqualSid(owner, admin_sid), "MACHINE\\Software owner SID != Administrators SID.\n");
3740
3741 bret = GetSecurityDescriptorGroup(pSD, &group, &group_defaulted);
3742 ok(bret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
3743 ok(group != NULL, "group should not be NULL\n");
3744 ok(EqualSid(group, admin_sid) || broken(EqualSid(group, system_sid)) /* before Win7 */
3745 || broken(((SID*)group)->SubAuthority[0] == SECURITY_NT_NON_UNIQUE) /* Vista */,
3746 "MACHINE\\Software group SID != Local System SID.\n");
3747 LocalFree(pSD);
3748
3749 /* Test querying the DACL of a built-in registry key */
3750 sid_size = sizeof(users_ptr);
3751 pCreateWellKnownSid(WinBuiltinUsersSid, NULL, users_sid, &sid_size);
3752 error = pGetNamedSecurityInfoA(software_key, SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION,
3753 NULL, NULL, NULL, NULL, &pSD);
3754 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3755
3756 bret = GetSecurityDescriptorDacl(pSD, &dacl_present, &pDacl, &dacl_defaulted);
3757 ok(bret, "GetSecurityDescriptorDacl failed with error %d\n", GetLastError());
3758 ok(dacl_present, "DACL should be present\n");
3759 ok(pDacl && IsValidAcl(pDacl), "GetSecurityDescriptorDacl returned invalid DACL.\n");
3760 bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
3761 ok(bret, "GetAclInformation failed\n");
3762 ok(acl_size.AceCount != 0, "GetAclInformation returned no ACLs\n");
3763 for (i=0; i<acl_size.AceCount; i++)
3764 {
3765 bret = pGetAce(pDacl, i, (VOID **)&ace);
3766 ok(bret, "Failed to get ACE %d.\n", i);
3767 bret = EqualSid(&ace->SidStart, users_sid);
3768 if (bret) users_ace_id = i;
3769 bret = EqualSid(&ace->SidStart, admin_sid);
3770 if (bret) admins_ace_id = i;
3771 }
3772 ok(users_ace_id != -1 || broken(users_ace_id == -1) /* win2k */,
3773 "Bultin Users ACE not found.\n");
3774 if (users_ace_id != -1)
3775 {
3776 bret = pGetAce(pDacl, users_ace_id, (VOID **)&ace);
3777 ok(bret, "Failed to get Builtin Users ACE.\n");
3778 flags = ((ACE_HEADER *)ace)->AceFlags;
3779 ok(flags == (INHERIT_ONLY_ACE|CONTAINER_INHERIT_ACE)
3780 || broken(flags == (INHERIT_ONLY_ACE|CONTAINER_INHERIT_ACE|INHERITED_ACE)) /* w2k8 */,
3781 "Builtin Users ACE has unexpected flags (0x%x != 0x%x)\n", flags,
3782 INHERIT_ONLY_ACE|CONTAINER_INHERIT_ACE);
3783 ok(ace->Mask == GENERIC_READ, "Builtin Users ACE has unexpected mask (0x%x != 0x%x)\n",
3784 ace->Mask, GENERIC_READ);
3785 }
3786 ok(admins_ace_id != -1, "Bultin Admins ACE not found.\n");
3787 if (admins_ace_id != -1)
3788 {
3789 bret = pGetAce(pDacl, admins_ace_id, (VOID **)&ace);
3790 ok(bret, "Failed to get Builtin Admins ACE.\n");
3791 flags = ((ACE_HEADER *)ace)->AceFlags;
3792 ok(flags == 0x0
3793 || broken(flags == (INHERIT_ONLY_ACE|CONTAINER_INHERIT_ACE|INHERITED_ACE)) /* w2k8 */,
3794 "Builtin Admins ACE has unexpected flags (0x%x != 0x0)\n", flags);
3795 ok(ace->Mask == KEY_ALL_ACCESS || broken(ace->Mask == GENERIC_ALL) /* w2k8 */,
3796 "Builtin Admins ACE has unexpected mask (0x%x != 0x%x)\n", ace->Mask, KEY_ALL_ACCESS);
3797 }
3798 LocalFree(pSD);
3799 }
3800
3801 static void test_ConvertStringSecurityDescriptor(void)
3802 {
3803 BOOL ret;
3804 PSECURITY_DESCRIPTOR pSD;
3805 static const WCHAR Blank[] = { 0 };
3806 unsigned int i;
3807 static const struct
3808 {
3809 const char *sidstring;
3810 DWORD revision;
3811 BOOL ret;
3812 DWORD GLE;
3813 DWORD altGLE;
3814 } cssd[] =
3815 {
3816 { "D:(A;;GA;;;WD)", 0xdeadbeef, FALSE, ERROR_UNKNOWN_REVISION },
3817 /* test ACE string type */
3818 { "D:(A;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3819 { "D:(D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3820 { "ERROR:(D;;GA;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_PARAMETER },
3821 /* test ACE string with spaces */
3822 { " D:(D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3823 { "D: (D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3824 { "D:( D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3825 { "D:(D ;;GA;;;WD)", SDDL_REVISION_1, FALSE, RPC_S_INVALID_STRING_UUID, ERROR_INVALID_ACL }, /* Vista+ */
3826 { "D:(D; ;GA;;;WD)", SDDL_REVISION_1, TRUE },
3827 { "D:(D;; GA;;;WD)", SDDL_REVISION_1, TRUE },
3828 { "D:(D;;GA ;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL },
3829 { "D:(D;;GA; ;;WD)", SDDL_REVISION_1, TRUE },
3830 { "D:(D;;GA;; ;WD)", SDDL_REVISION_1, TRUE },
3831 { "D:(D;;GA;;; WD)", SDDL_REVISION_1, TRUE },
3832 { "D:(D;;GA;;;WD )", SDDL_REVISION_1, TRUE },
3833 /* test ACE string access rights */
3834 { "D:(A;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3835 { "D:(A;;GRGWGX;;;WD)", SDDL_REVISION_1, TRUE },
3836 { "D:(A;;RCSDWDWO;;;WD)", SDDL_REVISION_1, TRUE },
3837 { "D:(A;;RPWPCCDCLCSWLODTCR;;;WD)", SDDL_REVISION_1, TRUE },
3838 { "D:(A;;FAFRFWFX;;;WD)", SDDL_REVISION_1, TRUE },
3839 { "D:(A;;KAKRKWKX;;;WD)", SDDL_REVISION_1, TRUE },
3840 { "D:(A;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, TRUE },
3841 { "S:(AU;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, TRUE },
3842 /* test ACE string access right error case */
3843 { "D:(A;;ROB;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL },
3844 /* test behaviour with empty strings */
3845 { "", SDDL_REVISION_1, TRUE },
3846 /* test ACE string SID */
3847 { "D:(D;;GA;;;S-1-0-0)", SDDL_REVISION_1, TRUE },
3848 { "D:(D;;GA;;;Nonexistent account)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL, ERROR_INVALID_SID } /* W2K */
3849 };
3850
3851 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
3852 {
3853 win_skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
3854 return;
3855 }
3856
3857 for (i = 0; i < sizeof(cssd)/sizeof(cssd[0]); i++)
3858 {
3859 DWORD GLE;
3860
3861 SetLastError(0xdeadbeef);
3862 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3863 cssd[i].sidstring, cssd[i].revision, &pSD, NULL);
3864 GLE = GetLastError();
3865 ok(ret == cssd[i].ret, "(%02u) Expected %s (%d)\n", i, cssd[i].ret ? "success" : "failure", GLE);
3866 if (!cssd[i].ret)
3867 ok(GLE == cssd[i].GLE ||
3868 (cssd[i].altGLE && GLE == cssd[i].altGLE),
3869 "(%02u) Unexpected last error %d\n", i, GLE);
3870 if (ret)
3871 LocalFree(pSD);
3872 }
3873
3874 /* test behaviour with NULL parameters */
3875 SetLastError(0xdeadbeef);
3876 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3877 NULL, 0xdeadbeef, &pSD, NULL);
3878 todo_wine
3879 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3880 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3881 GetLastError());
3882
3883 SetLastError(0xdeadbeef);
3884 ret = pConvertStringSecurityDescriptorToSecurityDescriptorW(
3885 NULL, 0xdeadbeef, &pSD, NULL);
3886 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3887 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3888 GetLastError());
3889
3890 SetLastError(0xdeadbeef);
3891 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3892 "D:(A;;ROB;;;WD)", 0xdeadbeef, NULL, NULL);
3893 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3894 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3895 GetLastError());
3896
3897 SetLastError(0xdeadbeef);
3898 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3899 "D:(A;;ROB;;;WD)", SDDL_REVISION_1, NULL, NULL);
3900 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3901 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3902 GetLastError());
3903
3904 /* test behaviour with empty strings */
3905 SetLastError(0xdeadbeef);
3906 ret = pConvertStringSecurityDescriptorToSecurityDescriptorW(
3907 Blank, SDDL_REVISION_1, &pSD, NULL);
3908 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
3909 LocalFree(pSD);
3910
3911 SetLastError(0xdeadbeef);
3912 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3913 "D:P(A;;GRGW;;;BA)(A;;GRGW;;;S-1-5-21-0-0-0-1000)S:(ML;;NWNR;;;S-1-16-12288)", SDDL_REVISION_1, &pSD, NULL);
3914 ok(ret || broken(!ret && GetLastError() == ERROR_INVALID_DATATYPE) /* win2k */,
3915 "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %u\n", GetLastError());
3916 if (ret) LocalFree(pSD);
3917 }
3918
3919 static void test_ConvertSecurityDescriptorToString(void)
3920 {
3921 SECURITY_DESCRIPTOR desc;
3922 SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
3923 LPSTR string;
3924 DWORD size;
3925 PSID psid, psid2;
3926 PACL pacl;
3927 char sid_buf[256];
3928 char acl_buf[8192];
3929 ULONG len;
3930
3931 if (!pConvertSecurityDescriptorToStringSecurityDescriptorA)
3932 {
3933 win_skip("ConvertSecurityDescriptorToStringSecurityDescriptor is not available\n");
3934 return;
3935 }
3936 if (!pCreateWellKnownSid)
3937 {
3938 win_skip("CreateWellKnownSid is not available\n");
3939 return;
3940 }
3941
3942 /* It seems Windows XP adds an extra character to the length of the string for each ACE in an ACL. We
3943 * don't replicate this feature so we only test len >= strlen+1. */
3944 #define CHECK_RESULT_AND_FREE(exp_str) \
3945 ok(strcmp(string, (exp_str)) == 0, "String mismatch (expected \"%s\", got \"%s\")\n", (exp_str), string); \
3946 ok(len >= (strlen(exp_str) + 1), "Length mismatch (expected %d, got %d)\n", lstrlenA(exp_str) + 1, len); \
3947 LocalFree(string);
3948
3949 #define CHECK_ONE_OF_AND_FREE(exp_str1, exp_str2) \
3950 ok(strcmp(string, (exp_str1)) == 0 || strcmp(string, (exp_str2)) == 0, "String mismatch (expected\n\"%s\" or\n\"%s\", got\n\"%s\")\n", (exp_str1), (exp_str2), string); \
3951 ok(len >= (strlen(exp_str1) + 1) || len >= (strlen(exp_str2) + 1), "Length mismatch (expected %d or %d, got %d)\n", lstrlenA(exp_str1) + 1, lstrlenA(exp_str2) + 1, len); \
3952 LocalFree(string);
3953
3954 InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION);
3955 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3956 CHECK_RESULT_AND_FREE("");
3957
3958 size = 4096;
3959 pCreateWellKnownSid(WinLocalSid, NULL, sid_buf, &size);
3960 SetSecurityDescriptorOwner(&desc, sid_buf, FALSE);
3961 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3962 CHECK_RESULT_AND_FREE("O:S-1-2-0");
3963
3964 SetSecurityDescriptorOwner(&desc, sid_buf, TRUE);
3965 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3966 CHECK_RESULT_AND_FREE("O:S-1-2-0");
3967
3968 size = sizeof(sid_buf);
3969 pCreateWellKnownSid(WinLocalSystemSid, NULL, sid_buf, &size);
3970 SetSecurityDescriptorOwner(&desc, sid_buf, TRUE);
3971 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3972 CHECK_RESULT_AND_FREE("O:SY");
3973
3974 pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid);
3975 SetSecurityDescriptorGroup(&desc, psid, TRUE);
3976 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3977 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576");
3978
3979 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, GROUP_SECURITY_INFORMATION, &string, &len), "Conversion failed\n");
3980 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
3981
3982 pacl = (PACL)acl_buf;
3983 InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
3984 SetSecurityDescriptorDacl(&desc, TRUE, pacl, TRUE);
3985 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3986 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
3987
3988 SetSecurityDescriptorDacl(&desc, TRUE, pacl, FALSE);
3989 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3990 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
3991
3992 pConvertStringSidToSidA("S-1-5-6", &psid2);
3993 pAddAccessAllowedAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, 0xf0000000, psid2);
3994 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3995 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)");
3996
3997 pAddAccessAllowedAceEx(pacl, ACL_REVISION, INHERIT_ONLY_ACE|INHERITED_ACE, 0x00000003, psid2);
3998 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3999 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)");
4000
4001 pAddAccessDeniedAceEx(pacl, ACL_REVISION, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE, 0xffffffff, psid);
4002 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4003 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
4004
4005
4006 pacl = (PACL)acl_buf;
4007 InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
4008 SetSecurityDescriptorSacl(&desc, TRUE, pacl, FALSE);
4009 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4010 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:");
4011
4012 /* fails in win2k */
4013 SetSecurityDescriptorDacl(&desc, TRUE, NULL, FALSE);
4014 pAddAuditAccessAceEx(pacl, ACL_REVISION, VALID_INHERIT_FLAGS, KEY_READ|KEY_WRITE, psid2, TRUE, TRUE);
4015 if (pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len))
4016 {
4017 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)", /* XP */
4018 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)" /* Vista */);
4019 }
4020
4021 /* fails in win2k */
4022 pAddAuditAccessAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, FILE_GENERIC_READ|FILE_GENERIC_WRITE, psid2, TRUE, FALSE);
4023 if (pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len))
4024 {
4025 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", /* XP */
4026 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)" /* Vista */);
4027 }
4028
4029 LocalFree(psid2);
4030 LocalFree(psid);
4031 }
4032
4033 static void test_SetSecurityDescriptorControl (PSECURITY_DESCRIPTOR sec)
4034 {
4035 SECURITY_DESCRIPTOR_CONTROL ref;
4036 SECURITY_DESCRIPTOR_CONTROL test;
4037
4038 SECURITY_DESCRIPTOR_CONTROL const mutable
4039 = SE_DACL_AUTO_INHERIT_REQ | SE_SACL_AUTO_INHERIT_REQ
4040 | SE_DACL_AUTO_INHERITED | SE_SACL_AUTO_INHERITED
4041 | SE_DACL_PROTECTED | SE_SACL_PROTECTED
4042 | 0x00000040 | 0x00000080 /* not defined in winnt.h */
4043 ;
4044 SECURITY_DESCRIPTOR_CONTROL const immutable
4045 = SE_OWNER_DEFAULTED | SE_GROUP_DEFAULTED
4046 | SE_DACL_PRESENT | SE_DACL_DEFAULTED
4047 | SE_SACL_PRESENT | SE_SACL_DEFAULTED
4048 | SE_RM_CONTROL_VALID | SE_SELF_RELATIVE
4049 ;
4050
4051 int bit;
4052 DWORD dwRevision;
4053 LPCSTR fmt = "Expected error %s, got %u\n";
4054
4055 GetSecurityDescriptorControl (sec, &ref, &dwRevision);
4056
4057 /* The mutable bits are mutable regardless of the truth of
4058 SE_DACL_PRESENT and/or SE_SACL_PRESENT */
4059
4060 /* Check call barfs if any bit-of-interest is immutable */
4061 for (bit = 0; bit < 16; ++bit)
4062 {
4063 SECURITY_DESCRIPTOR_CONTROL const bitOfInterest = 1 << bit;
4064 SECURITY_DESCRIPTOR_CONTROL setOrClear = ref & bitOfInterest;
4065
4066 SECURITY_DESCRIPTOR_CONTROL ctrl;
4067
4068 DWORD dwExpect = (bitOfInterest & immutable)
4069 ? ERROR_INVALID_PARAMETER : 0xbebecaca;
4070 LPCSTR strExpect = (bitOfInterest & immutable)
4071 ? "ERROR_INVALID_PARAMETER" : "0xbebecaca";
4072
4073 ctrl = (bitOfInterest & mutable) ? ref + bitOfInterest : ref;
4074 setOrClear ^= bitOfInterest;
4075 SetLastError (0xbebecaca);
4076 pSetSecurityDescriptorControl (sec, bitOfInterest, setOrClear);
4077 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
4078 GetSecurityDescriptorControl(sec, &test, &dwRevision);
4079 expect_eq(test, ctrl, int, "%x");
4080
4081 setOrClear ^= bitOfInterest;
4082 SetLastError (0xbebecaca);
4083 pSetSecurityDescriptorControl (sec, bitOfInterest, setOrClear);
4084 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
4085 GetSecurityDescriptorControl (sec, &test, &dwRevision);
4086 expect_eq(test, ref, int, "%x");
4087 }
4088
4089 /* Check call barfs if any bit-to-set is immutable
4090 even when not a bit-of-interest */
4091 for (bit = 0; bit < 16; ++bit)
4092 {
4093 SECURITY_DESCRIPTOR_CONTROL const bitsOfInterest = mutable;
4094 SECURITY_DESCRIPTOR_CONTROL setOrClear = ref & bitsOfInterest;
4095
4096 SECURITY_DESCRIPTOR_CONTROL ctrl;
4097
4098 DWORD dwExpect = ((1 << bit) & immutable)
4099 ? ERROR_INVALID_PARAMETER : 0xbebecaca;
4100 LPCSTR strExpect = ((1 << bit) & immutable)
4101 ? "ERROR_INVALID_PARAMETER" : "0xbebecaca";
4102
4103 ctrl = ((1 << bit) & immutable) ? test : ref | mutable;
4104 setOrClear ^= bitsOfInterest;
4105 SetLastError (0xbebecaca);
4106 pSetSecurityDescriptorControl (sec, bitsOfInterest, setOrClear | (1 << bit));
4107 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
4108 GetSecurityDescriptorControl(sec, &test, &dwRevision);
4109 expect_eq(test, ctrl, int, "%x");
4110
4111 ctrl = ((1 << bit) & immutable) ? test : ref | (1 << bit);
4112 setOrClear ^= bitsOfInterest;
4113 SetLastError (0xbebecaca);
4114 pSetSecurityDescriptorControl (sec, bitsOfInterest, setOrClear | (1 << bit));
4115 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
4116 GetSecurityDescriptorControl(sec, &test, &dwRevision);
4117 expect_eq(test, ctrl, int, "%x");
4118 }
4119 }
4120
4121 static void test_PrivateObjectSecurity(void)
4122 {
4123 SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
4124 SECURITY_DESCRIPTOR_CONTROL ctrl;
4125 PSECURITY_DESCRIPTOR sec;
4126 DWORD dwDescSize;
4127 DWORD dwRevision;
4128 DWORD retSize;
4129 LPSTR string;
4130 ULONG len;
4131 PSECURITY_DESCRIPTOR buf;
4132 BOOL ret;
4133
4134 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
4135 {
4136 win_skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
4137 return;
4138 }
4139
4140 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
4141 "O:SY"
4142 "G:S-1-5-21-93476-23408-4576"
4143 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)"
4144 "(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
4145 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)",
4146 SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
4147
4148 test_SetSecurityDescriptorControl(sec);
4149
4150 LocalFree(sec);
4151
4152 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
4153 "O:SY"
4154 "G:S-1-5-21-93476-23408-4576",
4155 SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
4156
4157 test_SetSecurityDescriptorControl(sec);
4158
4159 LocalFree(sec);
4160
4161 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
4162 "O:SY"
4163 "G:S-1-5-21-93476-23408-4576"
4164 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
4165 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
4166 buf = HeapAlloc(GetProcessHeap(), 0, dwDescSize);
4167 pSetSecurityDescriptorControl(sec, SE_DACL_PROTECTED, SE_DACL_PROTECTED);
4168 GetSecurityDescriptorControl(sec, &ctrl, &dwRevision);
4169 expect_eq(ctrl, 0x9014, int, "%x");
4170
4171 ret = GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION, buf, dwDescSize, &retSize);
4172 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
4173 ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
4174 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4175 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
4176 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
4177 expect_eq(ctrl, 0x8000, int, "%x");
4178
4179 ret = GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, buf, dwDescSize, &retSize);
4180 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
4181 ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
4182 ret = pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len);
4183 ok(ret, "Conversion failed err=%u\n", GetLastError());
4184 CHECK_ONE_OF_AND_FREE("G:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)",
4185 "G:S-1-5-21-93476-23408-4576D:P(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"); /* Win7 */
4186 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
4187 expect_eq(ctrl & (~ SE_DACL_PROTECTED), 0x8004, int, "%x");
4188
4189 ret = GetPrivateObjectSecurity(sec, sec_info, buf, dwDescSize, &retSize);
4190 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
4191 ok(retSize == dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
4192 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
4193 CHECK_ONE_OF_AND_FREE("O:SY"
4194 "G:S-1-5-21-93476-23408-4576"
4195 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
4196 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)",
4197 "O:SY"
4198 "G:S-1-5-21-93476-23408-4576"
4199 "D:P(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
4200 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)"); /* Win7 */
4201 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
4202 expect_eq(ctrl & (~ SE_DACL_PROTECTED), 0x8014, int, "%x");
4203
4204 SetLastError(0xdeadbeef);
4205 ok(GetPrivateObjectSecurity(sec, sec_info, buf, 5, &retSize) == FALSE, "GetPrivateObjectSecurity should have failed\n");
4206 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Expected error ERROR_INSUFFICIENT_BUFFER, got %u\n", GetLastError());
4207
4208 LocalFree(sec);
4209 HeapFree(GetProcessHeap(), 0, buf);
4210 }
4211 #undef CHECK_RESULT_AND_FREE
4212 #undef CHECK_ONE_OF_AND_FREE
4213
4214 static void test_acls(void)
4215 {
4216 char buffer[256];
4217 PACL pAcl = (PACL)buffer;
4218 BOOL ret;
4219
4220 SetLastError(0xdeadbeef);
4221 ret = InitializeAcl(pAcl, sizeof(ACL) - 1, ACL_REVISION);
4222 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
4223 {
4224 win_skip("InitializeAcl is not implemented\n");
4225 return;
4226 }
4227
4228 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "InitializeAcl with too small a buffer should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", GetLastError());
4229
4230 SetLastError(0xdeadbeef);
4231 ret = InitializeAcl(pAcl, 0xffffffff, ACL_REVISION);
4232 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl with too large a buffer should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
4233
4234 SetLastError(0xdeadbeef);
4235 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION1);
4236 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl(ACL_REVISION1) should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
4237
4238 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION2);
4239 ok(ret, "InitializeAcl(ACL_REVISION2) failed with error %d\n", GetLastError());
4240
4241 ret = IsValidAcl(pAcl);
4242 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
4243
4244 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION3);
4245 ok(ret, "InitializeAcl(ACL_REVISION3) failed with error %d\n", GetLastError());
4246
4247 ret = IsValidAcl(pAcl);
4248 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
4249
4250 SetLastError(0xdeadbeef);
4251 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION4);
4252 if (GetLastError() != ERROR_INVALID_PARAMETER)
4253 {
4254 ok(ret, "InitializeAcl(ACL_REVISION4) failed with error %d\n", GetLastError());
4255
4256 ret = IsValidAcl(pAcl);
4257 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
4258 }
4259 else
4260 win_skip("ACL_REVISION4 is not implemented on NT4\n");
4261
4262 SetLastError(0xdeadbeef);
4263 ret = InitializeAcl(pAcl, sizeof(buffer), -1);
4264 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl(-1) failed with error %d\n", GetLastError());
4265 }
4266
4267 static void test_GetSecurityInfo(void)
4268 {
4269 char b[sizeof(TOKEN_USER) + sizeof(SID) + sizeof(DWORD)*SID_MAX_SUB_AUTHORITIES];
4270 char admin_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES], dacl[100];
4271 DWORD sid_size = sizeof(admin_ptr), l = sizeof(b);
4272 PSID admin_sid = (PSID) admin_ptr, user_sid;
4273 char sd[SECURITY_DESCRIPTOR_MIN_LENGTH];
4274 ACL_SIZE_INFORMATION acl_size;
4275 PSECURITY_DESCRIPTOR pSD;
4276 ACCESS_ALLOWED_ACE *ace;
4277 HANDLE token, obj;
4278 PSID owner, group;
4279 BOOL bret = TRUE;
4280 PACL pDacl;
4281 DWORD ret;
4282
4283 if (!pGetSecurityInfo || !pSetSecurityInfo)
4284 {
4285 win_skip("[Get|Set]SecurityInfo is not available\n");
4286 return;
4287 }
4288
4289 if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
4290 {
4291 if (GetLastError() != ERROR_NO_TOKEN) bret = FALSE;
4292 else if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) bret = FALSE;
4293 }
4294 if (!bret)
4295 {
4296 win_skip("Failed to get current user token\n");
4297 return;
4298 }
4299 bret = GetTokenInformation(token, TokenUser, b, l, &l);
4300 ok(bret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
4301 CloseHandle( token );
4302 user_sid = ((TOKEN_USER *)b)->User.Sid;
4303
4304 /* Create something. Files have lots of associated security info. */
4305 obj = CreateFileA(myARGV[0], GENERIC_READ|WRITE_DAC, FILE_SHARE_READ, NULL,
4306 OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
4307 if (obj == INVALID_HANDLE_VALUE)
4308 {
4309 skip("Couldn't create an object for GetSecurityInfo test\n");
4310 return;
4311 }
4312
4313 ret = pGetSecurityInfo(obj, SE_FILE_OBJECT,
4314 OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
4315 &owner, &group, &pDacl, NULL, &pSD);
4316 if (ret == ERROR_CALL_NOT_IMPLEMENTED)
4317 {
4318 win_skip("GetSecurityInfo is not implemented\n");
4319 CloseHandle(obj);
4320 return;
4321 }
4322 ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
4323 ok(pSD != NULL, "GetSecurityInfo\n");
4324 ok(owner != NULL, "GetSecurityInfo\n");
4325 ok(group != NULL, "GetSecurityInfo\n");
4326 if (pDacl != NULL)
4327 ok(IsValidAcl(pDacl), "GetSecurityInfo\n");
4328 else
4329 win_skip("No ACL information returned\n");
4330
4331 LocalFree(pSD);
4332
4333 if (!pCreateWellKnownSid)
4334 {
4335 win_skip("NULL parameter test would crash on NT4\n");
4336 CloseHandle(obj);
4337 return;
4338 }
4339
4340 /* If we don't ask for the security descriptor, Windows will still give us
4341 the other stuff, leaving us no way to free it. */
4342 ret = pGetSecurityInfo(obj, SE_FILE_OBJECT,
4343 OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
4344 &owner, &group, &pDacl, NULL, NULL);
4345 ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
4346 ok(owner != NULL, "GetSecurityInfo\n");
4347 ok(group != NULL, "GetSecurityInfo\n");
4348 if (pDacl != NULL)
4349 ok(IsValidAcl(pDacl), "GetSecurityInfo\n");
4350 else
4351 win_skip("No ACL information returned\n");
4352
4353 /* Create security descriptor information and test that it comes back the same */
4354 pSD = &sd;
4355 pDacl = (PACL)&dacl;
4356 InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
4357 pCreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, admin_sid, &sid_size);
4358 bret = InitializeAcl(pDacl, sizeof(dacl), ACL_REVISION);
4359 ok(bret, "Failed to initialize ACL.\n");
4360 bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
4361 ok(bret, "Failed to add Current User to ACL.\n");
4362 bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, admin_sid);
4363 ok(bret, "Failed to add Administrator Group to ACL.\n");
4364 bret = SetSecurityDescriptorDacl(pSD, TRUE, pDacl, FALSE);
4365 ok(bret, "Failed to add ACL to security desciptor.\n");
4366 ret = pSetSecurityInfo(obj, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
4367 NULL, NULL, pDacl, NULL);
4368 ok(ret == ERROR_SUCCESS, "SetSecurityInfo returned %d\n", ret);
4369 ret = pGetSecurityInfo(obj, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
4370 NULL, NULL, &pDacl, NULL, &pSD);
4371 ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
4372 ok(pDacl && IsValidAcl(pDacl), "GetSecurityInfo returned invalid DACL.\n");
4373 bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation);
4374 ok(bret, "GetAclInformation failed\n");
4375 if (acl_size.AceCount > 0)
4376 {
4377 bret = pGetAce(pDacl, 0, (VOID **)&ace);
4378 ok(bret, "Failed to get Current User ACE.\n");
4379 bret = EqualSid(&ace->SidStart, user_sid);
4380 todo_wine ok(bret, "Current User ACE != Current User SID.\n");
4381 ok(((ACE_HEADER *)ace)->AceFlags == 0,
4382 "Current User ACE has unexpected flags (0x%x != 0x0)\n", ((ACE_HEADER *)ace)->AceFlags);
4383 ok(ace->Mask == 0x1f01ff, "Current User ACE has unexpected mask (0x%x != 0x1f01ff)\n",
4384 ace->Mask);
4385 }
4386 if (acl_size.AceCount > 1)
4387 {
4388 bret = pGetAce(pDacl, 1, (VOID **)&ace);
4389 ok(bret, "Failed to get Administators Group ACE.\n");
4390 bret = EqualSid(&ace->SidStart, admin_sid);
4391 todo_wine ok(bret, "Administators Group ACE != Administators Group SID.\n");
4392 ok(((ACE_HEADER *)ace)->AceFlags == 0,
4393 "Administators Group ACE has unexpected flags (0x%x != 0x0)\n", ((ACE_HEADER *)ace)->AceFlags);
4394 ok(ace->Mask == 0x1f01ff, "Administators Group ACE has unexpected mask (0x%x != 0x1f01ff)\n",
4395 ace->Mask);
4396 }
4397 LocalFree(pSD);
4398 CloseHandle(obj);
4399 }
4400
4401 static void test_GetSidSubAuthority(void)
4402 {
4403 PSID psid = NULL;
4404
4405 if (!pGetSidSubAuthority || !pConvertStringSidToSidA || !pIsValidSid || !pGetSidSubAuthorityCount)
4406 {
4407 win_skip("Some functions not available\n");
4408 return;
4409 }
4410 /* Note: on windows passing in an invalid index like -1, lets GetSidSubAuthority return 0x05000000 but
4411 still GetLastError returns ERROR_SUCCESS then. We don't test these unlikely cornercases here for now */
4412 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576",&psid),"ConvertStringSidToSidA failed\n");
4413 ok(pIsValidSid(psid),"Sid is not valid\n");
4414 SetLastError(0xbebecaca);
4415 ok(*pGetSidSubAuthorityCount(psid) == 4,"GetSidSubAuthorityCount gave %d expected 4\n",*pGetSidSubAuthorityCount(psid));
4416 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
4417 SetLastError(0xbebecaca);
4418 ok(*pGetSidSubAuthority(psid,0) == 21,"GetSidSubAuthority gave %d expected 21\n",*pGetSidSubAuthority(psid,0));
4419 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
4420 SetLastError(0xbebecaca);
4421 ok(*pGetSidSubAuthority(psid,1) == 93476,"GetSidSubAuthority gave %d expected 93476\n",*pGetSidSubAuthority(psid,1));
4422 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
4423 SetLastError(0xbebecaca);
4424 ok(pGetSidSubAuthority(psid,4) != NULL,"Expected out of bounds GetSidSubAuthority to return a non-NULL pointer\n");
4425 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
4426 LocalFree(psid);
4427 }
4428
4429 static void test_CheckTokenMembership(void)
4430 {
4431 PTOKEN_GROUPS token_groups;
4432 DWORD size;
4433 HANDLE process_token, token;
4434 BOOL is_member;
4435 BOOL ret;
4436 DWORD i;
4437
4438 if (!pCheckTokenMembership)
4439 {
4440 win_skip("CheckTokenMembership is not available\n");
4441 return;
4442 }
4443 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token);
4444 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
4445
4446 ret = DuplicateToken(process_token, SecurityImpersonation, &token);
4447 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
4448
4449 /* groups */
4450 ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
4451 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
4452 "GetTokenInformation(TokenGroups) %s with error %d\n",
4453 ret ? "succeeded" : "failed", GetLastError());
4454 token_groups = HeapAlloc(GetProcessHeap(), 0, size);
4455 ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
4456 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
4457
4458 for (i = 0; i < token_groups->GroupCount; i++)
4459 {
4460 if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED)
4461 break;
4462 }
4463
4464 if (i == token_groups->GroupCount)
4465 {
4466 HeapFree(GetProcessHeap(), 0, token_groups);
4467 CloseHandle(token);
4468 skip("user not a member of any group\n");
4469 return;
4470 }
4471
4472 is_member = FALSE;
4473 ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member);
4474 ok(ret, "CheckTokenMembership failed with error %d\n", GetLastError());
4475 ok(is_member, "CheckTokenMembership should have detected sid as member\n");
4476
4477 is_member = FALSE;
4478 ret = pCheckTokenMembership(NULL, token_groups->Groups[i].Sid, &is_member);
4479 ok(ret, "CheckTokenMembership failed with error %d\n", GetLastError());
4480 ok(is_member, "CheckTokenMembership should have detected sid as member\n");
4481
4482 is_member = TRUE;
4483 SetLastError(0xdeadbeef);
4484 ret = pCheckTokenMembership(process_token, token_groups->Groups[i].Sid, &is_member);
4485 ok(!ret && GetLastError() == ERROR_NO_IMPERSONATION_TOKEN,
4486 "CheckTokenMembership with process token %s with error %d\n",
4487 ret ? "succeeded" : "failed", GetLastError());
4488 ok(!is_member, "CheckTokenMembership should have cleared is_member\n");
4489
4490 HeapFree(GetProcessHeap(), 0, token_groups);
4491 CloseHandle(token);
4492 CloseHandle(process_token);
4493 }
4494
4495 static void test_EqualSid(void)
4496 {
4497 PSID sid1, sid2;
4498 BOOL ret;
4499 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
4500 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
4501
4502 SetLastError(0xdeadbeef);
4503 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
4504 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid1);
4505 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
4506 {
4507 win_skip("AllocateAndInitializeSid is not implemented\n");
4508 return;
4509 }
4510 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
4511 ok(GetLastError() == 0xdeadbeef,
4512 "AllocateAndInitializeSid shouldn't have set last error to %d\n",
4513 GetLastError());
4514
4515 ret = AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID,
4516 0, 0, 0, 0, 0, 0, 0, &sid2);
4517 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
4518
4519 SetLastError(0xdeadbeef);
4520 ret = EqualSid(sid1, sid2);
4521 ok(!ret, "World and domain admins sids shouldn't have been equal\n");
4522 ok(GetLastError() == ERROR_SUCCESS ||
4523 broken(GetLastError() == 0xdeadbeef), /* NT4 */
4524 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
4525 GetLastError());
4526
4527 SetLastError(0xdeadbeef);
4528 sid2 = FreeSid(sid2);
4529 ok(!sid2, "FreeSid should have returned NULL instead of %p\n", sid2);
4530 ok(GetLastError() == 0xdeadbeef,
4531 "FreeSid shouldn't have set last error to %d\n",
4532 GetLastError());
4533
4534 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
4535 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid2);
4536 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
4537
4538 SetLastError(0xdeadbeef);
4539 ret = EqualSid(sid1, sid2);
4540 ok(ret, "Same sids should have been equal\n");
4541 ok(GetLastError() == ERROR_SUCCESS ||
4542 broken(GetLastError() == 0xdeadbeef), /* NT4 */
4543 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
4544 GetLastError());
4545
4546 ((SID *)sid2)->Revision = 2;
4547 SetLastError(0xdeadbeef);
4548 ret = EqualSid(sid1, sid2);
4549 ok(!ret, "EqualSid with invalid sid should have returned FALSE\n");
4550 ok(GetLastError() == ERROR_SUCCESS ||
4551 broken(GetLastError() == 0xdeadbeef), /* NT4 */
4552 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
4553 GetLastError());
4554 ((SID *)sid2)->Revision = SID_REVISION;
4555
4556 FreeSid(sid1);
4557 FreeSid(sid2);
4558 }
4559
4560 static void test_GetUserNameA(void)
4561 {
4562 char buffer[UNLEN + 1], filler[UNLEN + 1];
4563 DWORD required_len, buffer_len;
4564 BOOL ret;
4565
4566 /* Test crashes on Windows. */
4567 if (0)
4568 {
4569 SetLastError(0xdeadbeef);
4570 GetUserNameA(NULL, NULL);
4571 }
4572
4573 SetLastError(0xdeadbeef);
4574 required_len = 0;
4575 ret = GetUserNameA(NULL, &required_len);
4576 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
4577 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
4578 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
4579
4580 SetLastError(0xdeadbeef);
4581 required_len = 1;
4582 ret = GetUserNameA(NULL, &required_len);
4583 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
4584 ok(required_len != 0 && required_len != 1, "Outputted buffer length was %u\n", required_len);
4585 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
4586
4587 /* Tests crashes on Windows. */
4588 if (0)
4589 {
4590 SetLastError(0xdeadbeef);
4591 required_len = UNLEN + 1;
4592 GetUserNameA(NULL, &required_len);
4593
4594 SetLastError(0xdeadbeef);
4595 GetUserNameA(buffer, NULL);
4596 }
4597
4598 memset(filler, 'x', sizeof(filler));
4599
4600 /* Note that GetUserNameA on XP and newer outputs the number of bytes
4601 * required for a Unicode string, which affects a test in the next block. */
4602 SetLastError(0xdeadbeef);
4603 memcpy(buffer, filler, sizeof(filler));
4604 required_len = 0;
4605 ret = GetUserNameA(buffer, &required_len);
4606 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
4607 ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was altered\n");
4608 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
4609 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
4610
4611 SetLastError(0xdeadbeef);
4612 memcpy(buffer, filler, sizeof(filler));
4613 buffer_len = required_len;
4614 ret = GetUserNameA(buffer, &buffer_len);
4615 ok(ret == TRUE, "GetUserNameA returned %d, last error %u\n", ret, GetLastError());
4616 ok(memcmp(buffer, filler, sizeof(filler)) != 0, "Output buffer was untouched\n");
4617 ok(buffer_len == required_len ||
4618 broken(buffer_len == required_len / sizeof(WCHAR)), /* XP+ */
4619 "Outputted buffer length was %u\n", buffer_len);
4620
4621 /* Use the reported buffer size from the last GetUserNameA call and pass
4622 * a length that is one less than the required value. */
4623 SetLastError(0xdeadbeef);
4624 memcpy(buffer, filler, sizeof(filler));
4625 buffer_len--;
4626 ret = GetUserNameA(buffer, &buffer_len);
4627 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
4628 ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was untouched\n");
4629 ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
4630 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
4631 }
4632
4633 static void test_GetUserNameW(void)
4634 {
4635 WCHAR buffer[UNLEN + 1], filler[UNLEN + 1];
4636 DWORD required_len, buffer_len;
4637 BOOL ret;
4638
4639 /* Test crashes on Windows. */
4640 if (0)
4641 {
4642 SetLastError(0xdeadbeef);
4643 GetUserNameW(NULL, NULL);
4644 }
4645
4646 SetLastError(0xdeadbeef);
4647 required_len = 0;
4648 ret = GetUserNameW(NULL, &required_len);
4649 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
4650 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
4651 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
4652
4653 SetLastError(0xdeadbeef);
4654 required_len = 1;
4655 ret = GetUserNameW(NULL, &required_len);
4656 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
4657 ok(required_len != 0 && required_len != 1, "Outputted buffer length was %u\n", required_len);
4658 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
4659
4660 /* Tests crash on Windows. */
4661 if (0)
4662 {
4663 SetLastError(0xdeadbeef);
4664 required_len = UNLEN + 1;
4665 GetUserNameW(NULL, &required_len);
4666
4667 SetLastError(0xdeadbeef);
4668 GetUserNameW(buffer, NULL);
4669 }
4670
4671 memset(filler, 'x', sizeof(filler));
4672
4673 SetLastError(0xdeadbeef);
4674 memcpy(buffer, filler, sizeof(filler));
4675 required_len = 0;
4676 ret = GetUserNameW(buffer, &required_len);
4677 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
4678 ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was altered\n");
4679 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
4680 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
4681
4682 SetLastError(0xdeadbeef);
4683 memcpy(buffer, filler, sizeof(filler));
4684 buffer_len = required_len;
4685 ret = GetUserNameW(buffer, &buffer_len);
4686 ok(ret == TRUE, "GetUserNameW returned %d, last error %u\n", ret, GetLastError());
4687 ok(memcmp(buffer, filler, sizeof(filler)) != 0, "Output buffer was untouched\n");
4688 ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
4689
4690 /* GetUserNameW on XP and newer writes a truncated portion of the username string to the buffer. */
4691 SetLastError(0xdeadbeef);
4692 memcpy(buffer, filler, sizeof(filler));
4693 buffer_len--;
4694 ret = GetUserNameW(buffer, &buffer_len);
4695 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
4696 ok(!memcmp(buffer, filler, sizeof(filler)) ||
4697 broken(memcmp(buffer, filler, sizeof(filler)) != 0), /* XP+ */
4698 "Output buffer was altered\n");
4699 ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
4700 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
4701 }
4702
4703 static void test_CreateRestrictedToken(void)
4704 {
4705 HANDLE process_token, token, r_token;
4706 PTOKEN_GROUPS token_groups, groups2;
4707 SID_AND_ATTRIBUTES sattr;
4708 SECURITY_IMPERSONATION_LEVEL level;
4709 TOKEN_TYPE type;
4710 BOOL is_member;
4711 DWORD size;
4712 BOOL ret;
4713 DWORD i, j;
4714
4715 if (!pCreateRestrictedToken)
4716 {
4717 win_skip("CreateRestrictedToken is not available\n");
4718 return;
4719 }
4720
4721 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token);
4722 ok(ret, "got error %d\n", GetLastError());
4723
4724 ret = DuplicateTokenEx(process_token, TOKEN_DUPLICATE|TOKEN_ADJUST_GROUPS|TOKEN_QUERY,
4725 NULL, SecurityImpersonation, TokenImpersonation, &token);
4726 ok(ret, "got error %d\n", GetLastError());
4727
4728 /* groups */
4729 ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
4730 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
4731 "got %d with error %d\n", ret, GetLastError());
4732 token_groups = HeapAlloc(GetProcessHeap(), 0, size);
4733 ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
4734 ok(ret, "got error %d\n", GetLastError());
4735
4736 for (i = 0; i < token_groups->GroupCount; i++)
4737 {
4738 if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED)
4739 break;
4740 }
4741
4742 if (i == token_groups->GroupCount)
4743 {
4744 HeapFree(GetProcessHeap(), 0, token_groups);
4745 CloseHandle(token);
4746 skip("User not a member of any group\n");
4747 return;
4748 }
4749
4750 is_member = FALSE;
4751 ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member);
4752 ok(ret, "got error %d\n", GetLastError());
4753 ok(is_member, "not a member\n");
4754
4755 /* disable a SID in new token */
4756 sattr.Sid = token_groups->Groups[i].Sid;
4757 sattr.Attributes = 0;
4758 r_token = NULL;
4759 ret = pCreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token);
4760 ok(ret, "got error %d\n", GetLastError());
4761
4762 if (ret)
4763 {
4764 /* check if a SID is enabled */
4765 is_member = TRUE;
4766 ret = pCheckTokenMembership(r_token, token_groups->Groups[i].Sid, &is_member);
4767 ok(ret, "got error %d\n", GetLastError());
4768 todo_wine ok(!is_member, "not a member\n");
4769
4770 ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size);
4771 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n",
4772 ret, GetLastError());
4773 groups2 = HeapAlloc(GetProcessHeap(), 0, size);
4774 ret = GetTokenInformation(r_token, TokenGroups, groups2, size, &size);
4775 ok(ret, "got error %d\n", GetLastError());
4776
4777 for (j = 0; j < groups2->GroupCount; j++)
4778 {
4779 if (EqualSid(groups2->Groups[j].Sid, token_groups->Groups[i].Sid))
4780 break;
4781 }
4782
4783 todo_wine ok(groups2->Groups[j].Attributes & SE_GROUP_USE_FOR_DENY_ONLY,
4784 "got wrong attributes\n");
4785 todo_wine ok((groups2->Groups[j].Attributes & SE_GROUP_ENABLED) == 0,
4786 "got wrong attributes\n");
4787
4788 HeapFree(GetProcessHeap(), 0, groups2);
4789
4790 size = sizeof(type);
4791 ret = GetTokenInformation(r_token, TokenType, &type, size, &size);
4792 ok(ret, "got error %d\n", GetLastError());
4793 ok(type == TokenImpersonation, "got type %u\n", type);
4794
4795 size = sizeof(level);
4796 ret = GetTokenInformation(r_token, TokenImpersonationLevel, &level, size, &size);
4797 ok(ret, "got error %d\n", GetLastError());
4798 ok(level == SecurityImpersonation, "got level %u\n", type);
4799 }
4800
4801 HeapFree(GetProcessHeap(), 0, token_groups);
4802 CloseHandle(r_token);
4803 CloseHandle(token);
4804 CloseHandle(process_token);
4805 }
4806
4807 static void validate_default_security_descriptor(SECURITY_DESCRIPTOR *sd)
4808 {
4809 BOOL ret, present, defaulted;
4810 ACL *acl;
4811 void *sid;
4812
4813 ret = IsValidSecurityDescriptor(sd);
4814 ok(ret, "security descriptor is not valid\n");
4815
4816 present = -1;
4817 defaulted = -1;
4818 acl = (void *)0xdeadbeef;
4819 SetLastError(0xdeadbeef);
4820 ret = GetSecurityDescriptorDacl(sd, &present, &acl, &defaulted);
4821 ok(ret, "GetSecurityDescriptorDacl error %d\n", GetLastError());
4822 todo_wine
4823 ok(present == 1, "acl is not present\n");
4824 todo_wine
4825 ok(acl != (void *)0xdeadbeef && acl != NULL, "acl pointer is not set\n");
4826 ok(defaulted == 0, "defaulted is set to TRUE\n");
4827
4828 defaulted = -1;
4829 sid = (void *)0xdeadbeef;
4830 SetLastError(0xdeadbeef);
4831 ret = GetSecurityDescriptorOwner(sd, &sid, &defaulted);
4832 ok(ret, "GetSecurityDescriptorOwner error %d\n", GetLastError());
4833 todo_wine
4834 ok(sid != (void *)0xdeadbeef && sid != NULL, "sid pointer is not set\n");
4835 ok(defaulted == 0, "defaulted is set to TRUE\n");
4836
4837 defaulted = -1;
4838 sid = (void *)0xdeadbeef;
4839 SetLastError(0xdeadbeef);
4840 ret = GetSecurityDescriptorGroup(sd, &sid, &defaulted);
4841 ok(ret, "GetSecurityDescriptorGroup error %d\n", GetLastError());
4842 todo_wine
4843 ok(sid != (void *)0xdeadbeef && sid != NULL, "sid pointer is not set\n");
4844 ok(defaulted == 0, "defaulted is set to TRUE\n");
4845 }
4846
4847 static void test_default_handle_security(HANDLE token, HANDLE handle, GENERIC_MAPPING *mapping)
4848 {
4849 DWORD ret, granted, priv_set_len;
4850 BOOL status;
4851 PRIVILEGE_SET priv_set;
4852 SECURITY_DESCRIPTOR *sd;
4853
4854 sd = test_get_security_descriptor(handle, __LINE__);
4855 validate_default_security_descriptor(sd);
4856
4857 priv_set_len = sizeof(priv_set);
4858 granted = 0xdeadbeef;
4859 status = 0xdeadbeef;
4860 SetLastError(0xdeadbeef);
4861 ret = AccessCheck(sd, token, MAXIMUM_ALLOWED, mapping, &priv_set, &priv_set_len, &granted, &status);
4862 todo_wine {
4863 ok(ret, "AccessCheck error %d\n", GetLastError());
4864 ok(status == 1, "expected 1, got %d\n", status);
4865 ok(granted == mapping->GenericAll, "expected all access %#x, got %#x\n", mapping->GenericAll, granted);
4866 }
4867 priv_set_len = sizeof(priv_set);
4868 granted = 0xdeadbeef;
4869 status = 0xdeadbeef;
4870 SetLastError(0xdeadbeef);
4871 ret = AccessCheck(sd, token, 0, mapping, &priv_set, &priv_set_len, &granted, &status);
4872 todo_wine {
4873 ok(ret, "AccessCheck error %d\n", GetLastError());
4874 ok(status == 0 || broken(status == 1) /* NT4 */, "expected 0, got %d\n", status);
4875 ok(granted == 0 || broken(granted == mapping->GenericRead) /* NT4 */, "expected 0, got %#x\n", granted);
4876 }
4877 priv_set_len = sizeof(priv_set);
4878 granted = 0xdeadbeef;
4879 status = 0xdeadbeef;
4880 SetLastError(0xdeadbeef);
4881 ret = AccessCheck(sd, token, ACCESS_SYSTEM_SECURITY, mapping, &priv_set, &priv_set_len, &granted, &status);
4882 todo_wine {
4883 ok(ret, "AccessCheck error %d\n", GetLastError());
4884 ok(status == 0, "expected 0, got %d\n", status);
4885 ok(granted == 0, "expected 0, got %#x\n", granted);
4886 }
4887 priv_set_len = sizeof(priv_set);
4888 granted = 0xdeadbeef;
4889 status = 0xdeadbeef;
4890 SetLastError(0xdeadbeef);
4891 ret = AccessCheck(sd, token, mapping->GenericRead, mapping, &priv_set, &priv_set_len, &granted, &status);
4892 todo_wine {
4893 ok(ret, "AccessCheck error %d\n", GetLastError());
4894 ok(status == 1, "expected 1, got %d\n", status);
4895 ok(granted == mapping->GenericRead, "expected read access %#x, got %#x\n", mapping->GenericRead, granted);
4896 }
4897 priv_set_len = sizeof(priv_set);
4898 granted = 0xdeadbeef;
4899 status = 0xdeadbeef;
4900 SetLastError(0xdeadbeef);
4901 ret = AccessCheck(sd, token, mapping->GenericWrite, mapping, &priv_set, &priv_set_len, &granted, &status);
4902 todo_wine {
4903 ok(ret, "AccessCheck error %d\n", GetLastError());
4904 ok(status == 1, "expected 1, got %d\n", status);
4905 ok(granted == mapping->GenericWrite, "expected write access %#x, got %#x\n", mapping->GenericWrite, granted);
4906 }
4907 priv_set_len = sizeof(priv_set);
4908 granted = 0xdeadbeef;
4909 status = 0xdeadbeef;
4910 SetLastError(0xdeadbeef);
4911 ret = AccessCheck(sd, token, mapping->GenericExecute, mapping, &priv_set, &priv_set_len, &granted, &status);
4912 todo_wine {
4913 ok(ret, "AccessCheck error %d\n", GetLastError());
4914 ok(status == 1, "expected 1, got %d\n", status);
4915 ok(granted == mapping->GenericExecute, "expected execute access %#x, got %#x\n", mapping->GenericExecute, granted);
4916 }
4917 HeapFree(GetProcessHeap(), 0, sd);
4918 }
4919
4920 static ACCESS_MASK get_obj_access(HANDLE obj)
4921 {
4922 OBJECT_BASIC_INFORMATION info;
4923 NTSTATUS status;
4924
4925 if (!pNtQueryObject) return 0;
4926
4927 status = pNtQueryObject(obj, ObjectBasicInformation, &info, sizeof(info), NULL);
4928 ok(!status, "NtQueryObject error %#x\n", status);
4929
4930 return info.GrantedAccess;
4931 }
4932
4933 static void test_mutex_security(HANDLE token)
4934 {
4935 DWORD ret, i, access;
4936 HANDLE mutex, dup;
4937 GENERIC_MAPPING mapping = { STANDARD_RIGHTS_READ | MUTANT_QUERY_STATE | SYNCHRONIZE,
4938 STANDARD_RIGHTS_WRITE | MUTEX_MODIFY_STATE | SYNCHRONIZE,
4939 STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
4940 STANDARD_RIGHTS_ALL | MUTEX_ALL_ACCESS };
4941 static const struct
4942 {
4943 int generic, mapped;
4944 } map[] =
4945 {
4946 { 0, 0 },
4947 { GENERIC_READ, STANDARD_RIGHTS_READ | MUTANT_QUERY_STATE },
4948 { GENERIC_WRITE, STANDARD_RIGHTS_WRITE },
4949 { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE },
4950 { GENERIC_ALL, STANDARD_RIGHTS_ALL | MUTANT_QUERY_STATE }
4951 };
4952
4953 SetLastError(0xdeadbeef);
4954 mutex = OpenMutexA(0, FALSE, "WineTestMutex");
4955 ok(!mutex, "mutex should not exist\n");
4956 ok(GetLastError() == ERROR_FILE_NOT_FOUND, "wrong error %u\n", GetLastError());
4957
4958 SetLastError(0xdeadbeef);
4959 mutex = CreateMutexA(NULL, FALSE, "WineTestMutex");
4960 ok(mutex != 0, "CreateMutex error %d\n", GetLastError());
4961
4962 access = get_obj_access(mutex);
4963 ok(access == MUTANT_ALL_ACCESS, "expected MUTANT_ALL_ACCESS, got %#x\n", access);
4964
4965 for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
4966 {
4967 SetLastError( 0xdeadbeef );
4968 ret = DuplicateHandle(GetCurrentProcess(), mutex, GetCurrentProcess(), &dup,
4969 map[i].generic, FALSE, 0);
4970 ok(ret, "DuplicateHandle error %d\n", GetLastError());
4971
4972 access = get_obj_access(dup);
4973 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
4974
4975 CloseHandle(dup);
4976
4977 SetLastError(0xdeadbeef);
4978 dup = OpenMutexA(0, FALSE, "WineTestMutex");
4979 todo_wine
4980 ok(!dup, "OpenMutex should fail\n");
4981 todo_wine
4982 ok(GetLastError() == ERROR_ACCESS_DENIED, "wrong error %u\n", GetLastError());
4983 }
4984
4985 test_default_handle_security(token, mutex, &mapping);
4986
4987 CloseHandle (mutex);
4988 }
4989
4990 static void test_event_security(HANDLE token)
4991 {
4992 DWORD ret, i, access;
4993 HANDLE event, dup;
4994 GENERIC_MAPPING mapping = { STANDARD_RIGHTS_READ | EVENT_QUERY_STATE | SYNCHRONIZE,
4995 STANDARD_RIGHTS_WRITE | EVENT_MODIFY_STATE | SYNCHRONIZE,
4996 STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
4997 STANDARD_RIGHTS_ALL | EVENT_ALL_ACCESS };
4998 static const struct
4999 {
5000 int generic, mapped;
5001 } map[] =
5002 {
5003 { 0, 0 },
5004 { GENERIC_READ, STANDARD_RIGHTS_READ | EVENT_QUERY_STATE },
5005 { GENERIC_WRITE, STANDARD_RIGHTS_WRITE | EVENT_MODIFY_STATE },
5006 { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE },
5007 { GENERIC_ALL, STANDARD_RIGHTS_ALL | EVENT_QUERY_STATE | EVENT_MODIFY_STATE }
5008 };
5009
5010 SetLastError(0xdeadbeef);
5011 event = OpenEventA(0, FALSE, "WineTestEvent");
5012 ok(!event, "event should not exist\n");
5013 ok(GetLastError() == ERROR_FILE_NOT_FOUND, "wrong error %u\n", GetLastError());
5014
5015 SetLastError(0xdeadbeef);
5016 event = CreateEventA(NULL, FALSE, FALSE, "WineTestEvent");
5017 ok(event != 0, "CreateEvent error %d\n", GetLastError());
5018
5019 access = get_obj_access(event);
5020 ok(access == EVENT_ALL_ACCESS, "expected EVENT_ALL_ACCESS, got %#x\n", access);
5021
5022 for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5023 {
5024 SetLastError( 0xdeadbeef );
5025 ret = DuplicateHandle(GetCurrentProcess(), event, GetCurrentProcess(), &dup,
5026 map[i].generic, FALSE, 0);
5027 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5028
5029 access = get_obj_access(dup);
5030 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5031
5032 CloseHandle(dup);
5033
5034 SetLastError(0xdeadbeef);
5035 dup = OpenEventA(0, FALSE, "WineTestEvent");
5036 todo_wine
5037 ok(!dup, "OpenEvent should fail\n");
5038 todo_wine
5039 ok(GetLastError() == ERROR_ACCESS_DENIED, "wrong error %u\n", GetLastError());
5040 }
5041
5042 test_default_handle_security(token, event, &mapping);
5043
5044 CloseHandle(event);
5045 }
5046
5047 static void test_semaphore_security(HANDLE token)
5048 {
5049 DWORD ret, i, access;
5050 HANDLE sem, dup;
5051 GENERIC_MAPPING mapping = { STANDARD_RIGHTS_READ | SEMAPHORE_QUERY_STATE,
5052 STANDARD_RIGHTS_WRITE | SEMAPHORE_MODIFY_STATE,
5053 STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE,
5054 STANDARD_RIGHTS_ALL | SEMAPHORE_ALL_ACCESS };
5055 static const struct
5056 {
5057 int generic, mapped;
5058 } map[] =
5059 {
5060 { 0, 0 },
5061 { GENERIC_READ, STANDARD_RIGHTS_READ | SEMAPHORE_QUERY_STATE },
5062 { GENERIC_WRITE, STANDARD_RIGHTS_WRITE | SEMAPHORE_MODIFY_STATE },
5063 { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE },
5064 { GENERIC_ALL, STANDARD_RIGHTS_ALL | SEMAPHORE_QUERY_STATE | SEMAPHORE_MODIFY_STATE }
5065 };
5066
5067 SetLastError(0xdeadbeef);
5068 sem = OpenSemaphoreA(0, FALSE, "WineTestSemaphore");
5069 ok(!sem, "semaphore should not exist\n");
5070 ok(GetLastError() == ERROR_FILE_NOT_FOUND, "wrong error %u\n", GetLastError());
5071
5072 SetLastError(0xdeadbeef);
5073 sem = CreateSemaphoreA(NULL, 0, 10, "WineTestSemaphore");
5074 ok(sem != 0, "CreateSemaphore error %d\n", GetLastError());
5075
5076 access = get_obj_access(sem);
5077 ok(access == SEMAPHORE_ALL_ACCESS, "expected SEMAPHORE_ALL_ACCESS, got %#x\n", access);
5078
5079 for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5080 {
5081 SetLastError( 0xdeadbeef );
5082 ret = DuplicateHandle(GetCurrentProcess(), sem, GetCurrentProcess(), &dup,
5083 map[i].generic, FALSE, 0);
5084 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5085
5086 access = get_obj_access(dup);
5087 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5088
5089 CloseHandle(dup);
5090 }
5091
5092 test_default_handle_security(token, sem, &mapping);
5093
5094 CloseHandle(sem);
5095 }
5096
5097 #define WINE_TEST_PIPE "\\\\.\\pipe\\WineTestPipe"
5098 static void test_named_pipe_security(HANDLE token)
5099 {
5100 DWORD ret, i, access;
5101 HANDLE pipe, file, dup;
5102 GENERIC_MAPPING mapping = { FILE_GENERIC_READ,
5103 FILE_GENERIC_WRITE,
5104 FILE_GENERIC_EXECUTE,
5105 STANDARD_RIGHTS_ALL | FILE_ALL_ACCESS };
5106 static const struct
5107 {
5108 int todo, generic, mapped;
5109 } map[] =
5110 {
5111 { 0, 0, 0 },
5112 { 1, GENERIC_READ, FILE_GENERIC_READ },
5113 { 1, GENERIC_WRITE, FILE_GENERIC_WRITE },
5114 { 1, GENERIC_EXECUTE, FILE_GENERIC_EXECUTE },
5115 { 1, GENERIC_ALL, STANDARD_RIGHTS_ALL | FILE_ALL_ACCESS }
5116 };
5117 static const struct
5118 {
5119 DWORD open_mode;
5120 DWORD access;
5121 } creation_access[] =
5122 {
5123 { PIPE_ACCESS_INBOUND, FILE_GENERIC_READ },
5124 { PIPE_ACCESS_OUTBOUND, FILE_GENERIC_WRITE },
5125 { PIPE_ACCESS_DUPLEX, FILE_GENERIC_READ|FILE_GENERIC_WRITE },
5126 { PIPE_ACCESS_INBOUND|WRITE_DAC, FILE_GENERIC_READ|WRITE_DAC },
5127 { PIPE_ACCESS_INBOUND|WRITE_OWNER, FILE_GENERIC_READ|WRITE_OWNER }
5128 /* ACCESS_SYSTEM_SECURITY is also valid, but will fail with ERROR_PRIVILEGE_NOT_HELD */
5129 };
5130
5131 /* Test the different security access options for pipes */
5132 for (i = 0; i < sizeof(creation_access)/sizeof(creation_access[0]); i++)
5133 {
5134 SetLastError(0xdeadbeef);
5135 pipe = CreateNamedPipeA(WINE_TEST_PIPE, creation_access[i].open_mode,
5136 PIPE_TYPE_BYTE | PIPE_NOWAIT, PIPE_UNLIMITED_INSTANCES, 0, 0,
5137 NMPWAIT_USE_DEFAULT_WAIT, NULL);
5138 ok(pipe != INVALID_HANDLE_VALUE, "CreateNamedPipe(0x%x) error %d\n",
5139 creation_access[i].open_mode, GetLastError());
5140 access = get_obj_access(pipe);
5141 ok(access == creation_access[i].access,
5142 "CreateNamedPipeA(0x%x) pipe expected access 0x%x (got 0x%x)\n",
5143 creation_access[i].open_mode, creation_access[i].access, access);
5144 CloseHandle(pipe);
5145 }
5146
5147 SetLastError(0xdeadbeef);
5148 pipe = CreateNamedPipeA(WINE_TEST_PIPE, PIPE_ACCESS_DUPLEX | FILE_FLAG_FIRST_PIPE_INSTANCE,
5149 PIPE_TYPE_BYTE | PIPE_NOWAIT, PIPE_UNLIMITED_INSTANCES,
5150 0, 0, NMPWAIT_USE_DEFAULT_WAIT, NULL);
5151 ok(pipe != INVALID_HANDLE_VALUE, "CreateNamedPipe error %d\n", GetLastError());
5152
5153 test_default_handle_security(token, pipe, &mapping);
5154
5155 SetLastError(0xdeadbeef);
5156 file = CreateFileA(WINE_TEST_PIPE, FILE_ALL_ACCESS, 0, NULL, OPEN_EXISTING, 0, 0);
5157 ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5158
5159 access = get_obj_access(file);
5160 ok(access == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", access);
5161
5162 for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5163 {
5164 SetLastError( 0xdeadbeef );
5165 ret = DuplicateHandle(GetCurrentProcess(), file, GetCurrentProcess(), &dup,
5166 map[i].generic, FALSE, 0);
5167 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5168
5169 access = get_obj_access(dup);
5170 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5171
5172 CloseHandle(dup);
5173 }
5174
5175 CloseHandle(file);
5176 CloseHandle(pipe);
5177
5178 SetLastError(0xdeadbeef);
5179 file = CreateFileA("\\\\.\\pipe\\", FILE_ALL_ACCESS, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, 0);
5180 ok(file != INVALID_HANDLE_VALUE || broken(file == INVALID_HANDLE_VALUE) /* before Vista */, "CreateFile error %d\n", GetLastError());
5181
5182 if (file != INVALID_HANDLE_VALUE)
5183 {
5184 access = get_obj_access(file);
5185 ok(access == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", access);
5186
5187 for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5188 {
5189 SetLastError( 0xdeadbeef );
5190 ret = DuplicateHandle(GetCurrentProcess(), file, GetCurrentProcess(), &dup,
5191 map[i].generic, FALSE, 0);
5192 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5193
5194 access = get_obj_access(dup);
5195 if (map[i].todo)
5196 todo_wine
5197 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5198 else
5199 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5200
5201 CloseHandle(dup);
5202 }
5203 }
5204
5205 CloseHandle(file);
5206 }
5207
5208 static void test_file_security(HANDLE token)
5209 {
5210 DWORD ret, i, access, bytes;
5211 HANDLE file, dup;
5212 static const struct
5213 {
5214 int generic, mapped;
5215 } map[] =
5216 {
5217 { 0, 0 },
5218 { GENERIC_READ, FILE_GENERIC_READ },
5219 { GENERIC_WRITE, FILE_GENERIC_WRITE },
5220 { GENERIC_EXECUTE, FILE_GENERIC_EXECUTE },
5221 { GENERIC_ALL, STANDARD_RIGHTS_ALL | FILE_ALL_ACCESS }
5222 };
5223 char temp_path[MAX_PATH];
5224 char file_name[MAX_PATH];
5225 char buf[16];
5226
5227 GetTempPathA(MAX_PATH, temp_path);
5228 GetTempFileNameA(temp_path, "tmp", 0, file_name);
5229
5230 /* file */
5231 SetLastError(0xdeadbeef);
5232 file = CreateFileA(file_name, GENERIC_ALL, 0, NULL, CREATE_ALWAYS, 0, NULL);
5233 ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5234
5235 access = get_obj_access(file);
5236 ok(access == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", access);
5237
5238 for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5239 {
5240 SetLastError( 0xdeadbeef );
5241 ret = DuplicateHandle(GetCurrentProcess(), file, GetCurrentProcess(), &dup,
5242 map[i].generic, FALSE, 0);
5243 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5244
5245 access = get_obj_access(dup);
5246 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5247
5248 CloseHandle(dup);
5249 }
5250
5251 CloseHandle(file);
5252
5253 SetLastError(0xdeadbeef);
5254 file = CreateFileA(file_name, 0, 0, NULL, OPEN_EXISTING, 0, NULL);
5255 ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5256
5257 access = get_obj_access(file);
5258 todo_wine
5259 ok(access == (FILE_READ_ATTRIBUTES | SYNCHRONIZE), "expected FILE_READ_ATTRIBUTES | SYNCHRONIZE, got %#x\n", access);
5260
5261 bytes = 0xdeadbeef;
5262 SetLastError(0xdeadbeef);
5263 ret = ReadFile(file, buf, sizeof(buf), &bytes, NULL);
5264 ok(!ret, "ReadFile should fail\n");
5265 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
5266 ok(bytes == 0, "expected 0, got %u\n", bytes);
5267
5268 CloseHandle(file);
5269
5270 SetLastError(0xdeadbeef);
5271 file = CreateFileA(file_name, GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, 0);
5272 ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5273
5274 access = get_obj_access(file);
5275 todo_wine
5276 ok(access == (FILE_GENERIC_WRITE | FILE_READ_ATTRIBUTES), "expected FILE_GENERIC_WRITE | FILE_READ_ATTRIBUTES, got %#x\n", access);
5277
5278 bytes = 0xdeadbeef;
5279 SetLastError(0xdeadbeef);
5280 ret = ReadFile(file, buf, sizeof(buf), &bytes, NULL);
5281 ok(!ret, "ReadFile should fail\n");
5282 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
5283 ok(bytes == 0, "expected 0, got %u\n", bytes);
5284
5285 CloseHandle(file);
5286 DeleteFileA(file_name);
5287
5288 /* directory */
5289 SetLastError(0xdeadbeef);
5290 file = CreateFileA(temp_path, GENERIC_ALL, 0, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0);
5291 ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5292
5293 access = get_obj_access(file);
5294 ok(access == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", access);
5295
5296 for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5297 {
5298 SetLastError( 0xdeadbeef );
5299 ret = DuplicateHandle(GetCurrentProcess(), file, GetCurrentProcess(), &dup,
5300 map[i].generic, FALSE, 0);
5301 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5302
5303 access = get_obj_access(dup);
5304 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5305
5306 CloseHandle(dup);
5307 }
5308
5309 CloseHandle(file);
5310
5311 SetLastError(0xdeadbeef);
5312 file = CreateFileA(temp_path, 0, 0, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0);
5313 ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5314
5315 access = get_obj_access(file);
5316 todo_wine
5317 ok(access == (FILE_READ_ATTRIBUTES | SYNCHRONIZE), "expected FILE_READ_ATTRIBUTES | SYNCHRONIZE, got %#x\n", access);
5318
5319 CloseHandle(file);
5320
5321 SetLastError(0xdeadbeef);
5322 file = CreateFileA(temp_path, GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0);
5323 ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5324
5325 access = get_obj_access(file);
5326 todo_wine
5327 ok(access == (FILE_GENERIC_WRITE | FILE_READ_ATTRIBUTES), "expected FILE_GENERIC_WRITE | FILE_READ_ATTRIBUTES, got %#x\n", access);
5328
5329 CloseHandle(file);
5330 }
5331
5332 static void test_filemap_security(void)
5333 {
5334 char temp_path[MAX_PATH];
5335 char file_name[MAX_PATH];
5336 DWORD ret, i, access;
5337 HANDLE file, mapping, dup;
5338 static const struct
5339 {
5340 int generic, mapped;
5341 } map[] =
5342 {
5343 { 0, 0 },
5344 { GENERIC_READ, STANDARD_RIGHTS_READ | SECTION_QUERY | SECTION_MAP_READ },
5345 { GENERIC_WRITE, STANDARD_RIGHTS_WRITE | SECTION_MAP_WRITE },
5346 { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SECTION_MAP_EXECUTE },
5347 { GENERIC_ALL, STANDARD_RIGHTS_REQUIRED | SECTION_ALL_ACCESS }
5348 };
5349 static const struct
5350 {
5351 int prot, mapped;
5352 } prot_map[] =
5353 {
5354 { 0, 0 },
5355 { PAGE_NOACCESS, 0 },
5356 { PAGE_READONLY, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ },
5357 { PAGE_READWRITE, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE },
5358 { PAGE_WRITECOPY, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ },
5359 { PAGE_EXECUTE, 0 },
5360 { PAGE_EXECUTE_READ, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_EXECUTE },
5361 { PAGE_EXECUTE_READWRITE, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE | SECTION_MAP_EXECUTE },
5362 { PAGE_EXECUTE_WRITECOPY, STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_EXECUTE }
5363 };
5364
5365 GetTempPathA(MAX_PATH, temp_path);
5366 GetTempFileNameA(temp_path, "tmp", 0, file_name);
5367
5368 SetLastError(0xdeadbeef);
5369 file = CreateFileA(file_name, GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE, 0, NULL, CREATE_ALWAYS, 0, 0);
5370 ok(file != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
5371 SetFilePointer(file, 4096, NULL, FILE_BEGIN);
5372 SetEndOfFile(file);
5373
5374 for (i = 0; i < sizeof(prot_map)/sizeof(prot_map[0]); i++)
5375 {
5376 SetLastError(0xdeadbeef);
5377 mapping = CreateFileMappingW(file, NULL, prot_map[i].prot, 0, 4096, NULL);
5378 if (prot_map[i].mapped)
5379 {
5380 if (!mapping)
5381 {
5382 /* NT4 and win2k don't support EXEC on file mappings */
5383 if (prot_map[i].prot == PAGE_EXECUTE_READ || prot_map[i].prot == PAGE_EXECUTE_READWRITE || prot_map[i].prot == PAGE_EXECUTE_WRITECOPY)
5384 {
5385 win_skip("CreateFileMapping doesn't support PAGE_EXECUTE protection\n");
5386 continue;
5387 }
5388 }
5389 ok(mapping != 0, "CreateFileMapping(%04x) error %d\n", prot_map[i].prot, GetLastError());
5390 }
5391 else
5392 {
5393 ok(!mapping, "CreateFileMapping(%04x) should fail\n", prot_map[i].prot);
5394 ok(GetLastError() == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
5395 continue;
5396 }
5397
5398 access = get_obj_access(mapping);
5399 ok(access == prot_map[i].mapped, "%d: expected %#x, got %#x\n", i, prot_map[i].mapped, access);
5400
5401 CloseHandle(mapping);
5402 }
5403
5404 SetLastError(0xdeadbeef);
5405 mapping = CreateFileMappingW(file, NULL, PAGE_EXECUTE_READWRITE, 0, 4096, NULL);
5406 if (!mapping)
5407 {
5408 /* NT4 and win2k don't support EXEC on file mappings */
5409 win_skip("CreateFileMapping doesn't support PAGE_EXECUTE protection\n");
5410 CloseHandle(file);
5411 DeleteFileA(file_name);
5412 return;
5413 }
5414 ok(mapping != 0, "CreateFileMapping error %d\n", GetLastError());
5415
5416 access = get_obj_access(mapping);
5417 ok(access == (STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE | SECTION_MAP_EXECUTE),
5418 "expected STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE | SECTION_MAP_EXECUTE, got %#x\n", access);
5419
5420 for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5421 {
5422 SetLastError( 0xdeadbeef );
5423 ret = DuplicateHandle(GetCurrentProcess(), mapping, GetCurrentProcess(), &dup,
5424 map[i].generic, FALSE, 0);
5425 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5426
5427 access = get_obj_access(dup);
5428 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5429
5430 CloseHandle(dup);
5431 }
5432
5433 CloseHandle(mapping);
5434 CloseHandle(file);
5435 DeleteFileA(file_name);
5436 }
5437
5438 static void test_thread_security(void)
5439 {
5440 DWORD ret, i, access;
5441 HANDLE thread, dup;
5442 static const struct
5443 {
5444 int generic, mapped;
5445 } map[] =
5446 {
5447 { 0, 0 },
5448 { GENERIC_READ, STANDARD_RIGHTS_READ | THREAD_QUERY_INFORMATION | THREAD_GET_CONTEXT },
5449 { GENERIC_WRITE, STANDARD_RIGHTS_WRITE | THREAD_SET_INFORMATION | THREAD_SET_CONTEXT | THREAD_TERMINATE | THREAD_SUSPEND_RESUME | 0x4 },
5450 { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE },
5451 { GENERIC_ALL, THREAD_ALL_ACCESS_NT4 }
5452 };
5453
5454 SetLastError(0xdeadbeef);
5455 thread = CreateThread(NULL, 0, (void *)0xdeadbeef, NULL, CREATE_SUSPENDED, &ret);
5456 ok(thread != 0, "CreateThread error %d\n", GetLastError());
5457
5458 access = get_obj_access(thread);
5459 ok(access == THREAD_ALL_ACCESS_NT4 || access == THREAD_ALL_ACCESS_VISTA, "expected THREAD_ALL_ACCESS, got %#x\n", access);
5460
5461 for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5462 {
5463 SetLastError( 0xdeadbeef );
5464 ret = DuplicateHandle(GetCurrentProcess(), thread, GetCurrentProcess(), &dup,
5465 map[i].generic, FALSE, 0);
5466 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5467
5468 access = get_obj_access(dup);
5469 switch (map[i].generic)
5470 {
5471 case GENERIC_READ:
5472 case GENERIC_EXECUTE:
5473 ok(access == map[i].mapped ||
5474 access == (map[i].mapped | THREAD_QUERY_LIMITED_INFORMATION) /* Vista+ */ ||
5475 access == (map[i].mapped | THREAD_QUERY_LIMITED_INFORMATION | THREAD_RESUME) /* win8 */,
5476 "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5477 break;
5478 case GENERIC_WRITE:
5479 todo_wine
5480 ok(access == map[i].mapped ||
5481 access == (map[i].mapped | THREAD_SET_LIMITED_INFORMATION) /* Vista+ */ ||
5482 access == (map[i].mapped | THREAD_SET_LIMITED_INFORMATION | THREAD_RESUME) /* win8 */,
5483 "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5484 break;
5485 case GENERIC_ALL:
5486 ok(access == map[i].mapped || access == THREAD_ALL_ACCESS_VISTA,
5487 "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5488 break;
5489 default:
5490 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5491 break;
5492 }
5493
5494 CloseHandle(dup);
5495 }
5496
5497 SetLastError( 0xdeadbeef );
5498 ret = DuplicateHandle(GetCurrentProcess(), thread, GetCurrentProcess(), &dup,
5499 THREAD_QUERY_INFORMATION, FALSE, 0);
5500 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5501 access = get_obj_access(dup);
5502 ok(access == (THREAD_QUERY_INFORMATION | THREAD_QUERY_LIMITED_INFORMATION) /* Vista+ */ ||
5503 access == THREAD_QUERY_INFORMATION /* before Vista */,
5504 "expected THREAD_QUERY_INFORMATION|THREAD_QUERY_LIMITED_INFORMATION, got %#x\n", access);
5505 CloseHandle(dup);
5506
5507 TerminateThread(thread, 0);
5508 CloseHandle(thread);
5509 }
5510
5511 static void test_process_access(void)
5512 {
5513 DWORD ret, i, access;
5514 HANDLE process, dup;
5515 STARTUPINFOA sti;
5516 PROCESS_INFORMATION pi;
5517 char cmdline[] = "winver.exe";
5518 static const struct
5519 {
5520 int generic, mapped;
5521 } map[] =
5522 {
5523 { 0, 0 },
5524 { GENERIC_READ, STANDARD_RIGHTS_READ | PROCESS_QUERY_INFORMATION | PROCESS_VM_READ },
5525 { GENERIC_WRITE, STANDARD_RIGHTS_WRITE | PROCESS_SET_QUOTA | PROCESS_SET_INFORMATION | PROCESS_SUSPEND_RESUME |
5526 PROCESS_VM_WRITE | PROCESS_DUP_HANDLE | PROCESS_CREATE_PROCESS | PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION },
5527 { GENERIC_EXECUTE, STANDARD_RIGHTS_EXECUTE | SYNCHRONIZE },
5528 { GENERIC_ALL, PROCESS_ALL_ACCESS_NT4 }
5529 };
5530
5531 memset(&sti, 0, sizeof(sti));
5532 sti.cb = sizeof(sti);
5533 SetLastError(0xdeadbeef);
5534 ret = CreateProcessA(NULL, cmdline, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &sti, &pi);
5535 ok(ret, "CreateProcess() error %d\n", GetLastError());
5536
5537 CloseHandle(pi.hThread);
5538 process = pi.hProcess;
5539
5540 access = get_obj_access(process);
5541 ok(access == PROCESS_ALL_ACCESS_NT4 || access == PROCESS_ALL_ACCESS_VISTA, "expected PROCESS_ALL_ACCESS, got %#x\n", access);
5542
5543 for (i = 0; i < sizeof(map)/sizeof(map[0]); i++)
5544 {
5545 SetLastError( 0xdeadbeef );
5546 ret = DuplicateHandle(GetCurrentProcess(), process, GetCurrentProcess(), &dup,
5547 map[i].generic, FALSE, 0);
5548 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5549
5550 access = get_obj_access(dup);
5551 switch (map[i].generic)
5552 {
5553 case GENERIC_READ:
5554 ok(access == map[i].mapped || access == (map[i].mapped | PROCESS_QUERY_LIMITED_INFORMATION) /* Vista+ */,
5555 "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5556 break;
5557 case GENERIC_WRITE:
5558 ok(access == map[i].mapped ||
5559 access == (map[i].mapped | PROCESS_TERMINATE) /* before Vista */ ||
5560 access == (map[i].mapped | PROCESS_SET_LIMITED_INFORMATION) /* win8 */,
5561 "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5562 break;
5563 case GENERIC_EXECUTE:
5564 ok(access == map[i].mapped || access == (map[i].mapped | PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_TERMINATE) /* Vista+ */,
5565 "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5566 break;
5567 case GENERIC_ALL:
5568 ok(access == map[i].mapped || access == PROCESS_ALL_ACCESS_VISTA,
5569 "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5570 break;
5571 default:
5572 ok(access == map[i].mapped, "%d: expected %#x, got %#x\n", i, map[i].mapped, access);
5573 break;
5574 }
5575
5576 CloseHandle(dup);
5577 }
5578
5579 SetLastError( 0xdeadbeef );
5580 ret = DuplicateHandle(GetCurrentProcess(), process, GetCurrentProcess(), &dup,
5581 PROCESS_QUERY_INFORMATION, FALSE, 0);
5582 ok(ret, "DuplicateHandle error %d\n", GetLastError());
5583 access = get_obj_access(dup);
5584 ok(access == (PROCESS_QUERY_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION) /* Vista+ */ ||
5585 access == PROCESS_QUERY_INFORMATION /* before Vista */,
5586 "expected PROCESS_QUERY_INFORMATION|PROCESS_QUERY_LIMITED_INFORMATION, got %#x\n", access);
5587 CloseHandle(dup);
5588
5589 TerminateProcess(process, 0);
5590 CloseHandle(process);
5591 }
5592
5593 static BOOL validate_impersonation_token(HANDLE token, DWORD *token_type)
5594 {
5595 DWORD ret, needed;
5596 TOKEN_TYPE type;
5597 SECURITY_IMPERSONATION_LEVEL sil;
5598
5599 type = 0xdeadbeef;
5600 needed = 0;
5601 SetLastError(0xdeadbeef);
5602 ret = GetTokenInformation(token, TokenType, &type, sizeof(type), &needed);
5603 ok(ret, "GetTokenInformation error %d\n", GetLastError());
5604 ok(needed == sizeof(type), "GetTokenInformation should return required buffer length\n");
5605 ok(type == TokenPrimary || type == TokenImpersonation, "expected TokenPrimary or TokenImpersonation, got %d\n", type);
5606
5607 *token_type = type;
5608 if (type != TokenImpersonation) return FALSE;
5609
5610 needed = 0;
5611 SetLastError(0xdeadbeef);
5612 ret = GetTokenInformation(token, TokenImpersonationLevel, &sil, sizeof(sil), &needed);
5613 ok(ret, "GetTokenInformation error %d\n", GetLastError());
5614 ok(needed == sizeof(sil), "GetTokenInformation should return required buffer length\n");
5615 ok(sil == SecurityImpersonation, "expected SecurityImpersonation, got %d\n", sil);
5616
5617 needed = 0xdeadbeef;
5618 SetLastError(0xdeadbeef);
5619 ret = GetTokenInformation(token, TokenDefaultDacl, NULL, 0, &needed);
5620 ok(!ret, "GetTokenInformation should fail\n");
5621 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
5622 ok(needed != 0xdeadbeef, "GetTokenInformation should return required buffer length\n");
5623 ok(needed > sizeof(TOKEN_DEFAULT_DACL), "GetTokenInformation returned empty default DACL\n");
5624
5625 needed = 0xdeadbeef;
5626 SetLastError(0xdeadbeef);
5627 ret = GetTokenInformation(token, TokenOwner, NULL, 0, &needed);
5628 ok(!ret, "GetTokenInformation should fail\n");
5629 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
5630 ok(needed != 0xdeadbeef, "GetTokenInformation should return required buffer length\n");
5631 ok(needed > sizeof(TOKEN_OWNER), "GetTokenInformation returned empty token owner\n");
5632
5633 needed = 0xdeadbeef;
5634 SetLastError(0xdeadbeef);
5635 ret = GetTokenInformation(token, TokenPrimaryGroup, NULL, 0, &needed);
5636 ok(!ret, "GetTokenInformation should fail\n");
5637 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
5638 ok(needed != 0xdeadbeef, "GetTokenInformation should return required buffer length\n");
5639 ok(needed > sizeof(TOKEN_PRIMARY_GROUP), "GetTokenInformation returned empty token primary group\n");
5640
5641 return TRUE;
5642 }
5643
5644 static void test_kernel_objects_security(void)
5645 {
5646 HANDLE token, process_token;
5647 DWORD ret, token_type;
5648
5649 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE | TOKEN_QUERY, &process_token);
5650 ok(ret, "OpenProcessToken error %d\n", GetLastError());
5651
5652 ret = validate_impersonation_token(process_token, &token_type);
5653 ok(token_type == TokenPrimary, "expected TokenPrimary, got %d\n", token_type);
5654 ok(!ret, "access token should not be an impersonation token\n");
5655
5656 ret = DuplicateToken(process_token, SecurityImpersonation, &token);
5657 ok(ret, "DuplicateToken error %d\n", GetLastError());
5658
5659 ret = validate_impersonation_token(token, &token_type);
5660 ok(ret, "access token should be a valid impersonation token\n");
5661 ok(token_type == TokenImpersonation, "expected TokenImpersonation, got %d\n", token_type);
5662
5663 test_mutex_security(token);
5664 test_event_security(token);
5665 test_named_pipe_security(token);
5666 test_semaphore_security(token);
5667 test_file_security(token);
5668 test_filemap_security();
5669 test_thread_security();
5670 test_process_access();
5671 /* FIXME: test other kernel object types */
5672
5673 CloseHandle(process_token);
5674 CloseHandle(token);
5675 }
5676
5677 static void test_TokenIntegrityLevel(void)
5678 {
5679 TOKEN_MANDATORY_LABEL *tml;
5680 BYTE buffer[64]; /* using max. 28 byte in win7 x64 */
5681 HANDLE token;
5682 DWORD size;
5683 DWORD res;
5684 char *sidname = NULL;
5685 static SID medium_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
5686 {SECURITY_MANDATORY_HIGH_RID}};
5687 static SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
5688 {SECURITY_MANDATORY_MEDIUM_RID}};
5689
5690 SetLastError(0xdeadbeef);
5691 res = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token);
5692 ok(res, "got %d with %d (expected TRUE)\n", res, GetLastError());
5693
5694 SetLastError(0xdeadbeef);
5695 res = GetTokenInformation(token, TokenIntegrityLevel, buffer, sizeof(buffer), &size);
5696
5697 /* not supported before Vista */
5698 if (!res && ((GetLastError() == ERROR_INVALID_PARAMETER) || GetLastError() == ERROR_INVALID_FUNCTION))
5699 {
5700 win_skip("TokenIntegrityLevel not supported\n");
5701 CloseHandle(token);
5702 return;
5703 }
5704
5705 ok(res, "got %u with %u (expected TRUE)\n", res, GetLastError());
5706 if (!res)
5707 {
5708 CloseHandle(token);
5709 return;
5710 }
5711
5712 tml = (TOKEN_MANDATORY_LABEL*) buffer;
5713 ok(tml->Label.Attributes == (SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED),
5714 "got 0x%x (expected 0x%x)\n", tml->Label.Attributes, (SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED));
5715
5716 SetLastError(0xdeadbeef);
5717 res = pConvertSidToStringSidA(tml->Label.Sid, &sidname);
5718 ok(res, "got %u and %u\n", res, GetLastError());
5719
5720 ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level),
5721 "got %s (expected 'S-1-16-8192' or 'S-1-16-12288')\n", sidname);
5722
5723 LocalFree(sidname);
5724 CloseHandle(token);
5725 }
5726
5727 static void test_default_dacl_owner_sid(void)
5728 {
5729 HANDLE handle;
5730 BOOL ret, defaulted, present, found;
5731 DWORD size, index;
5732 SECURITY_DESCRIPTOR *sd;
5733 SECURITY_ATTRIBUTES sa;
5734 PSID owner;
5735 ACL *dacl;
5736 ACCESS_ALLOWED_ACE *ace;
5737
5738 sd = HeapAlloc( GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH );
5739 ret = InitializeSecurityDescriptor( sd, SECURITY_DESCRIPTOR_REVISION );
5740 ok( ret, "error %u\n", GetLastError() );
5741
5742 sa.nLength = sizeof(SECURITY_ATTRIBUTES);
5743 sa.lpSecurityDescriptor = sd;
5744 sa.bInheritHandle = FALSE;
5745 handle = CreateEventA( &sa, TRUE, TRUE, "test_event" );
5746 ok( handle != NULL, "error %u\n", GetLastError() );
5747
5748 size = 0;
5749 ret = GetKernelObjectSecurity( handle, OWNER_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, NULL, 0, &size );
5750 ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "error %u\n", GetLastError() );
5751
5752 sd = HeapAlloc( GetProcessHeap(), 0, size );
5753 ret = GetKernelObjectSecurity( handle, OWNER_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, sd, size, &size );
5754 ok( ret, "error %u\n", GetLastError() );
5755
5756 owner = (void *)0xdeadbeef;
5757 defaulted = TRUE;
5758 ret = GetSecurityDescriptorOwner( sd, &owner, &defaulted );
5759 ok( ret, "error %u\n", GetLastError() );
5760 ok( owner != (void *)0xdeadbeef, "owner not set\n" );
5761 ok( !defaulted, "owner defaulted\n" );
5762
5763 dacl = (void *)0xdeadbeef;
5764 present = FALSE;
5765 defaulted = TRUE;
5766 ret = GetSecurityDescriptorDacl( sd, &present, &dacl, &defaulted );
5767 ok( ret, "error %u\n", GetLastError() );
5768 ok( present, "dacl not present\n" );
5769 ok( dacl != (void *)0xdeadbeef, "dacl not set\n" );
5770 ok( !defaulted, "dacl defaulted\n" );
5771
5772 index = 0;
5773 found = FALSE;
5774 while (pGetAce( dacl, index++, (void **)&ace ))
5775 {
5776 if (EqualSid( &ace->SidStart, owner )) found = TRUE;
5777 }
5778 ok( found, "owner sid not found in dacl\n" );
5779
5780 HeapFree( GetProcessHeap(), 0, sa.lpSecurityDescriptor );
5781 HeapFree( GetProcessHeap(), 0, sd );
5782 CloseHandle( handle );
5783 }
5784
5785 static void test_AdjustTokenPrivileges(void)
5786 {
5787 TOKEN_PRIVILEGES tp, prev;
5788 HANDLE token;
5789 DWORD len;
5790 LUID luid;
5791 BOOL ret;
5792
5793 if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &token))
5794 return;
5795
5796 if (!LookupPrivilegeValueA(NULL, SE_BACKUP_NAME, &luid))
5797 {
5798 CloseHandle(token);
5799 return;
5800 }
5801
5802 tp.PrivilegeCount = 1;
5803 tp.Privileges[0].Luid = luid;
5804 tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
5805
5806 len = 0xdeadbeef;
5807 ret = AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, &len);
5808 ok(ret, "got %d\n", ret);
5809 ok(len == 0xdeadbeef, "got length %d\n", len);
5810
5811 /* revert */
5812 tp.PrivilegeCount = 1;
5813 tp.Privileges[0].Luid = luid;
5814 tp.Privileges[0].Attributes = 0;
5815 AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), &prev, NULL);
5816
5817 CloseHandle(token);
5818 }
5819
5820 static void test_AddAce(void)
5821 {
5822 static SID const sidWorld = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY} , { SECURITY_WORLD_RID } };
5823
5824 char acl_buf[1024], ace_buf[256];
5825 ACCESS_ALLOWED_ACE *ace = (ACCESS_ALLOWED_ACE*)ace_buf;
5826 PACL acl = (PACL)acl_buf;
5827 BOOL ret;
5828
5829 memset(ace, 0, sizeof(ace_buf));
5830 ace->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
5831 ace->Header.AceSize = sizeof(ACCESS_ALLOWED_ACE)-sizeof(DWORD)+sizeof(SID);
5832 memcpy(&ace->SidStart, &sidWorld, sizeof(sidWorld));
5833
5834 ret = InitializeAcl(acl, sizeof(acl_buf), ACL_REVISION2);
5835 ok(ret, "InitializeAcl failed: %d\n", GetLastError());
5836
5837 ret = AddAce(acl, ACL_REVISION1, MAXDWORD, ace, ace->Header.AceSize);
5838 ok(ret, "AddAce failed: %d\n", GetLastError());
5839 ret = AddAce(acl, ACL_REVISION2, MAXDWORD, ace, ace->Header.AceSize);
5840 ok(ret, "AddAce failed: %d\n", GetLastError());
5841 ret = AddAce(acl, ACL_REVISION3, MAXDWORD, ace, ace->Header.AceSize);
5842 ok(ret, "AddAce failed: %d\n", GetLastError());
5843 ok(acl->AclRevision == ACL_REVISION3, "acl->AclRevision = %d\n", acl->AclRevision);
5844 ret = AddAce(acl, ACL_REVISION4, MAXDWORD, ace, ace->Header.AceSize);
5845 ok(ret, "AddAce failed: %d\n", GetLastError());
5846 ok(acl->AclRevision == ACL_REVISION4, "acl->AclRevision = %d\n", acl->AclRevision);
5847 ret = AddAce(acl, ACL_REVISION1, MAXDWORD, ace, ace->Header.AceSize);
5848 ok(ret, "AddAce failed: %d\n", GetLastError());
5849 ok(acl->AclRevision == ACL_REVISION4, "acl->AclRevision = %d\n", acl->AclRevision);
5850 ret = AddAce(acl, ACL_REVISION2, MAXDWORD, ace, ace->Header.AceSize);
5851 ok(ret, "AddAce failed: %d\n", GetLastError());
5852
5853 ret = AddAce(acl, MIN_ACL_REVISION-1, MAXDWORD, ace, ace->Header.AceSize);
5854 ok(ret, "AddAce failed: %d\n", GetLastError());
5855 /* next test succeededs but corrupts ACL */
5856 ret = AddAce(acl, MAX_ACL_REVISION+1, MAXDWORD, ace, ace->Header.AceSize);
5857 ok(ret, "AddAce failed: %d\n", GetLastError());
5858 ok(acl->AclRevision == MAX_ACL_REVISION+1, "acl->AclRevision = %d\n", acl->AclRevision);
5859 SetLastError(0xdeadbeef);
5860 ret = AddAce(acl, ACL_REVISION1, MAXDWORD, ace, ace->Header.AceSize);
5861 ok(!ret, "AddAce succeeded\n");
5862 ok(GetLastError() == ERROR_INVALID_PARAMETER, "GetLastError() = %d\n", GetLastError());
5863 }
5864
5865 static void test_system_security_access(void)
5866 {
5867 static const WCHAR testkeyW[] =
5868 {'S','O','F','T','W','A','R','E','\\','W','i','n','e','\\','S','A','C','L','t','e','s','t',0};
5869 LONG res;
5870 HKEY hkey;
5871 PSECURITY_DESCRIPTOR sd;
5872 ACL *sacl;
5873 DWORD err, len = 128;
5874 TOKEN_PRIVILEGES priv, *priv_prev;
5875 HANDLE token;
5876 LUID luid;
5877 BOOL ret;
5878
5879 if (!OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &token )) return;
5880 if (!LookupPrivilegeValueA( NULL, SE_SECURITY_NAME, &luid ))
5881 {
5882 CloseHandle( token );
5883 return;
5884 }
5885
5886 /* ACCESS_SYSTEM_SECURITY requires special privilege */
5887 res = RegCreateKeyExW( HKEY_LOCAL_MACHINE, testkeyW, 0, NULL, 0, KEY_READ|ACCESS_SYSTEM_SECURITY, NULL, &hkey, NULL );
5888 todo_wine ok( res == ERROR_PRIVILEGE_NOT_HELD, "got %d\n", res );
5889
5890 priv.PrivilegeCount = 1;
5891 priv.Privileges[0].Luid = luid;
5892 priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
5893
5894 priv_prev = HeapAlloc( GetProcessHeap(), 0, len );
5895 ret = AdjustTokenPrivileges( token, FALSE, &priv, len, priv_prev, &len );
5896 ok( ret, "got %u\n", GetLastError());
5897
5898 res = RegCreateKeyExW( HKEY_LOCAL_MACHINE, testkeyW, 0, NULL, 0, KEY_READ|ACCESS_SYSTEM_SECURITY, NULL, &hkey, NULL );
5899 ok( !res, "got %d\n", res );
5900
5901 /* restore privileges */
5902 ret = AdjustTokenPrivileges( token, FALSE, priv_prev, 0, NULL, NULL );
5903 ok( ret, "got %u\n", GetLastError() );
5904 HeapFree( GetProcessHeap(), 0, priv_prev );
5905
5906 /* privilege is checked on access */
5907 err = GetSecurityInfo( hkey, SE_REGISTRY_KEY, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, &sacl, &sd );
5908 todo_wine ok( err == ERROR_PRIVILEGE_NOT_HELD, "got %u\n", err );
5909
5910 priv.PrivilegeCount = 1;
5911 priv.Privileges[0].Luid = luid;
5912 priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
5913
5914 priv_prev = HeapAlloc( GetProcessHeap(), 0, len );
5915 ret = AdjustTokenPrivileges( token, FALSE, &priv, len, priv_prev, &len );
5916 ok( ret, "got %u\n", GetLastError());
5917
5918 err = GetSecurityInfo( hkey, SE_REGISTRY_KEY, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, &sacl, &sd );
5919 ok( err == ERROR_SUCCESS, "got %u\n", err );
5920 RegCloseKey( hkey );
5921 LocalFree( sd );
5922
5923 /* handle created without ACCESS_SYSTEM_SECURITY, privilege held */
5924 res = RegCreateKeyExW( HKEY_LOCAL_MACHINE, testkeyW, 0, NULL, 0, KEY_READ, NULL, &hkey, NULL );
5925 ok( res == ERROR_SUCCESS, "got %d\n", res );
5926
5927 sd = NULL;
5928 err = GetSecurityInfo( hkey, SE_REGISTRY_KEY, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, &sacl, &sd );
5929 todo_wine ok( err == ERROR_SUCCESS, "got %u\n", err );
5930 RegCloseKey( hkey );
5931 LocalFree( sd );
5932
5933 /* restore privileges */
5934 ret = AdjustTokenPrivileges( token, FALSE, priv_prev, 0, NULL, NULL );
5935 ok( ret, "got %u\n", GetLastError() );
5936 HeapFree( GetProcessHeap(), 0, priv_prev );
5937
5938 /* handle created without ACCESS_SYSTEM_SECURITY, privilege not held */
5939 res = RegCreateKeyExW( HKEY_LOCAL_MACHINE, testkeyW, 0, NULL, 0, KEY_READ, NULL, &hkey, NULL );
5940 ok( res == ERROR_SUCCESS, "got %d\n", res );
5941
5942 err = GetSecurityInfo( hkey, SE_REGISTRY_KEY, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, &sacl, &sd );
5943 todo_wine ok( err == ERROR_PRIVILEGE_NOT_HELD, "got %u\n", err );
5944 RegCloseKey( hkey );
5945
5946 res = RegDeleteKeyW( HKEY_LOCAL_MACHINE, testkeyW );
5947 ok( !res, "got %d\n", res );
5948 CloseHandle( token );
5949 }
5950
5951 static void test_GetWindowsAccountDomainSid(void)
5952 {
5953 char *user, buffer1[SECURITY_MAX_SID_SIZE], buffer2[SECURITY_MAX_SID_SIZE];
5954 SID_IDENTIFIER_AUTHORITY domain_ident = { SECURITY_NT_AUTHORITY };
5955 PSID domain_sid = (PSID *)&buffer1;
5956 PSID domain_sid2 = (PSID *)&buffer2;
5957 DWORD sid_size;
5958 PSID user_sid;
5959 HANDLE token;
5960 BOOL bret = TRUE;
5961 int i;
5962
5963 if (!pGetWindowsAccountDomainSid)
5964 {
5965 win_skip("GetWindowsAccountDomainSid not available\n");
5966 return;
5967 }
5968
5969 if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
5970 {
5971 if (GetLastError() != ERROR_NO_TOKEN) bret = FALSE;
5972 else if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) bret = FALSE;
5973 }
5974 if (!bret)
5975 {
5976 win_skip("Failed to get current user token\n");
5977 return;
5978 }
5979
5980 bret = GetTokenInformation(token, TokenUser, NULL, 0, &sid_size);
5981 ok(!bret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
5982 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
5983 user = HeapAlloc(GetProcessHeap(), 0, sid_size);
5984 bret = GetTokenInformation(token, TokenUser, user, sid_size, &sid_size);
5985 ok(bret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
5986 CloseHandle(token);
5987 user_sid = ((TOKEN_USER *)user)->User.Sid;
5988
5989 SetLastError(0xdeadbeef);
5990 bret = pGetWindowsAccountDomainSid(0, 0, 0);
5991 ok(!bret, "GetWindowsAccountDomainSid succeeded\n");
5992 ok(GetLastError() == ERROR_INVALID_SID, "expected ERROR_INVALID_SID, got %d\n", GetLastError());
5993
5994 SetLastError(0xdeadbeef);
5995 bret = pGetWindowsAccountDomainSid(user_sid, 0, 0);
5996 ok(!bret, "GetWindowsAccountDomainSid succeeded\n");
5997 ok(GetLastError() == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
5998
5999 sid_size = SECURITY_MAX_SID_SIZE;
6000 SetLastError(0xdeadbeef);
6001 bret = pGetWindowsAccountDomainSid(user_sid, 0, &sid_size);
6002 ok(!bret, "GetWindowsAccountDomainSid succeeded\n");
6003 ok(GetLastError() == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
6004 ok(sid_size == GetSidLengthRequired(4), "expected size %d, got %d\n", GetSidLengthRequired(4), sid_size);
6005
6006 SetLastError(0xdeadbeef);
6007 bret = pGetWindowsAccountDomainSid(user_sid, domain_sid, 0);
6008 ok(!bret, "GetWindowsAccountDomainSid succeeded\n");
6009 ok(GetLastError() == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
6010
6011 sid_size = 1;
6012 SetLastError(0xdeadbeef);
6013 bret = pGetWindowsAccountDomainSid(user_sid, domain_sid, &sid_size);
6014 ok(!bret, "GetWindowsAccountDomainSid succeeded\n");
6015 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
6016 ok(sid_size == GetSidLengthRequired(4), "expected size %d, got %d\n", GetSidLengthRequired(4), sid_size);
6017
6018 sid_size = SECURITY_MAX_SID_SIZE;
6019 bret = pGetWindowsAccountDomainSid(user_sid, domain_sid, &sid_size);
6020 ok(bret, "GetWindowsAccountDomainSid failed with error %d\n", GetLastError());
6021 ok(sid_size == GetSidLengthRequired(4), "expected size %d, got %d\n", GetSidLengthRequired(4), sid_size);
6022 InitializeSid(domain_sid2, &domain_ident, 4);
6023 for (i = 0; i < 4; i++)
6024 *GetSidSubAuthority(domain_sid2, i) = *GetSidSubAuthority(user_sid, i);
6025 ok(EqualSid(domain_sid, domain_sid2), "unexpected domain sid\n");
6026
6027 HeapFree(GetProcessHeap(), 0, user);
6028 }
6029
6030 START_TEST(security)
6031 {
6032 init();
6033 if (!hmod) return;
6034
6035 if (myARGC >= 3)
6036 {
6037 test_process_security_child();
6038 return;
6039 }
6040 test_kernel_objects_security();
6041 test_sid();
6042 test_trustee();
6043 test_luid();
6044 test_CreateWellKnownSid();
6045 test_FileSecurity();
6046 test_AccessCheck();
6047 test_token_attr();
6048 test_LookupAccountSid();
6049 test_LookupAccountName();
6050 test_security_descriptor();
6051 test_process_security();
6052 test_impersonation_level();
6053 test_SetEntriesInAclW();
6054 test_SetEntriesInAclA();
6055 test_CreateDirectoryA();
6056 test_GetNamedSecurityInfoA();
6057 test_ConvertStringSecurityDescriptor();
6058 test_ConvertSecurityDescriptorToString();
6059 test_PrivateObjectSecurity();
6060 test_acls();
6061 test_GetWindowsAccountDomainSid();
6062 test_GetSecurityInfo();
6063 test_GetSidSubAuthority();
6064 test_CheckTokenMembership();
6065 test_EqualSid();
6066 test_GetUserNameA();
6067 test_GetUserNameW();
6068 test_CreateRestrictedToken();
6069 test_TokenIntegrityLevel();
6070 test_default_dacl_owner_sid();
6071 test_AdjustTokenPrivileges();
6072 test_AddAce();
6073 test_system_security_access();
6074 }
Windows API implementation