?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
include: Introduce combaseapi.h.
[wine.git] / server / token.c
blob5d2fc9555a25f99e67ee48fbeae7de407f5f3bc6
1 /*
2 * Tokens
3 *
4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 */
22
23 #include "config.h"
24
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <stdarg.h>
29 #include <unistd.h>
30
31 #include "ntstatus.h"
32 #define WIN32_NO_STATUS
33 #include "windef.h"
34 #include "winternl.h"
35
36 #include "handle.h"
37 #include "thread.h"
38 #include "process.h"
39 #include "request.h"
40 #include "security.h"
41
42 #define MAX_SUBAUTH_COUNT 1
43
44 const LUID SeIncreaseQuotaPrivilege = { 5, 0 };
45 const LUID SeTcbPrivilege = { 7, 0 };
46 const LUID SeSecurityPrivilege = { 8, 0 };
47 const LUID SeTakeOwnershipPrivilege = { 9, 0 };
48 const LUID SeLoadDriverPrivilege = { 10, 0 };
49 const LUID SeSystemProfilePrivilege = { 11, 0 };
50 const LUID SeSystemtimePrivilege = { 12, 0 };
51 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
52 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
53 const LUID SeCreatePagefilePrivilege = { 15, 0 };
54 const LUID SeBackupPrivilege = { 17, 0 };
55 const LUID SeRestorePrivilege = { 18, 0 };
56 const LUID SeShutdownPrivilege = { 19, 0 };
57 const LUID SeDebugPrivilege = { 20, 0 };
58 const LUID SeSystemEnvironmentPrivilege = { 22, 0 };
59 const LUID SeChangeNotifyPrivilege = { 23, 0 };
60 const LUID SeRemoteShutdownPrivilege = { 24, 0 };
61 const LUID SeUndockPrivilege = { 25, 0 };
62 const LUID SeManageVolumePrivilege = { 28, 0 };
63 const LUID SeImpersonatePrivilege = { 29, 0 };
64 const LUID SeCreateGlobalPrivilege = { 30, 0 };
65
66 #define SID_N(n) struct /* same fields as struct SID */ \
67 { \
68 BYTE Revision; \
69 BYTE SubAuthorityCount; \
70 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
71 DWORD SubAuthority[n]; \
72 }
73
74 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
75 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
76 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
77 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
78 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
79 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
80 static const SID high_label_sid = { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY }, { SECURITY_MANDATORY_HIGH_RID } };
81 static const SID_N(5) local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
82 static const SID_N(2) builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
83 static const SID_N(2) builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
84 static const SID_N(3) builtin_logon_sid = { SID_REVISION, 3, { SECURITY_NT_AUTHORITY }, { SECURITY_LOGON_IDS_RID, 0, 0 } };
85 static const SID_N(5) domain_users_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, DOMAIN_GROUP_RID_USERS } };
86
87 const PSID security_world_sid = (PSID)&world_sid;
88 static const PSID security_local_sid = (PSID)&local_sid;
89 static const PSID security_interactive_sid = (PSID)&interactive_sid;
90 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
91 const PSID security_local_system_sid = (PSID)&local_system_sid;
92 const PSID security_local_user_sid = (PSID)&local_user_sid;
93 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
94 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
95 const PSID security_domain_users_sid = (PSID)&domain_users_sid;
96 const PSID security_high_label_sid = (PSID)&high_label_sid;
97
98 static luid_t prev_luid_value = { 1000, 0 };
99
100 static const WCHAR token_name[] = {'T','o','k','e','n'};
101
102 struct type_descr token_type =
103 {
104 { token_name, sizeof(token_name) }, /* name */
105 TOKEN_ALL_ACCESS | SYNCHRONIZE, /* valid_access */
106 { /* mapping */
107 STANDARD_RIGHTS_READ | TOKEN_QUERY_SOURCE | TOKEN_QUERY | TOKEN_DUPLICATE,
108 STANDARD_RIGHTS_WRITE | TOKEN_ADJUST_SESSIONID | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_GROUPS
109 | TOKEN_ADJUST_PRIVILEGES,
110 STANDARD_RIGHTS_EXECUTE | TOKEN_IMPERSONATE | TOKEN_ASSIGN_PRIMARY,
111 TOKEN_ALL_ACCESS
112 },
113 };
114
115 struct token
116 {
117 struct object obj; /* object header */
118 luid_t token_id; /* system-unique id of token */
119 luid_t modified_id; /* new id allocated every time token is modified */
120 struct list privileges; /* privileges available to the token */
121 struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
122 SID *user; /* SID of user this token represents */
123 SID *owner; /* SID of owner (points to user or one of groups) */
124 SID *primary_group; /* SID of user's primary group (points to one of groups) */
125 unsigned int primary; /* is this a primary or impersonation token? */
126 unsigned int session_id; /* token session id */
127 ACL *default_dacl; /* the default DACL to assign to objects created by this user */
128 TOKEN_SOURCE source; /* source of the token */
129 int impersonation_level; /* impersonation level this token is capable of if non-primary token */
130 int elevation; /* elevation type */
131 };
132
133 struct privilege
134 {
135 struct list entry;
136 LUID luid;
137 unsigned enabled : 1; /* is the privilege currently enabled? */
138 unsigned def : 1; /* is the privilege enabled by default? */
139 };
140
141 struct group
142 {
143 struct list entry;
144 unsigned enabled : 1; /* is the sid currently enabled? */
145 unsigned def : 1; /* is the sid enabled by default? */
146 unsigned logon : 1; /* is this a logon sid? */
147 unsigned mandatory: 1; /* is this sid always enabled? */
148 unsigned owner : 1; /* can this sid be an owner of an object? */
149 unsigned resource : 1; /* is this a domain-local group? */
150 unsigned deny_only: 1; /* is this a sid that should be use for denying only? */
151 SID sid;
152 };
153
154 static void token_dump( struct object *obj, int verbose );
155 static void token_destroy( struct object *obj );
156
157 static const struct object_ops token_ops =
158 {
159 sizeof(struct token), /* size */
160 &token_type, /* type */
161 token_dump, /* dump */
162 no_add_queue, /* add_queue */
163 NULL, /* remove_queue */
164 NULL, /* signaled */
165 NULL, /* satisfied */
166 no_signal, /* signal */
167 no_get_fd, /* get_fd */
168 default_map_access, /* map_access */
169 default_get_sd, /* get_sd */
170 default_set_sd, /* set_sd */
171 no_get_full_name, /* get_full_name */
172 no_lookup_name, /* lookup_name */
173 no_link_name, /* link_name */
174 NULL, /* unlink_name */
175 no_open_file, /* open_file */
176 no_kernel_obj_list, /* get_kernel_obj_list */
177 no_close_handle, /* close_handle */
178 token_destroy /* destroy */
179 };
180
181 static void token_dump( struct object *obj, int verbose )
182 {
183 struct token *token = (struct token *)obj;
184 assert( obj->ops == &token_ops );
185 fprintf( stderr, "Token id=%d.%u primary=%u impersonation level=%d\n", token->token_id.high_part,
186 token->token_id.low_part, token->primary, token->impersonation_level );
187 }
188
189 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
190 {
191 int i;
192 SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
193 if (!sid) return NULL;
194 sid->Revision = SID_REVISION;
195 sid->SubAuthorityCount = subauthcount;
196 sid->IdentifierAuthority = *idauthority;
197 for (i = 0; i < subauthcount; i++)
198 sid->SubAuthority[i] = subauth[i];
199 return sid;
200 }
201
202 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
203 {
204 if (!handle)
205 {
206 if (thread->token)
207 release_object( thread->token );
208 thread->token = NULL;
209 }
210 else
211 {
212 struct token *token = (struct token *)get_handle_obj( current->process,
213 handle,
214 TOKEN_IMPERSONATE,
215 &token_ops );
216 if (token)
217 {
218 if (thread->token)
219 release_object( thread->token );
220 thread->token = token;
221 }
222 }
223 }
224
225 const SID *security_unix_uid_to_sid( uid_t uid )
226 {
227 /* very simple mapping: either the current user or not the current user */
228 if (uid == getuid())
229 return (const SID *)&local_user_sid;
230 else
231 return &anonymous_logon_sid;
232 }
233
234 static int acl_is_valid( const ACL *acl, data_size_t size )
235 {
236 ULONG i;
237 const ACE_HEADER *ace;
238
239 if (size < sizeof(ACL))
240 return FALSE;
241
242 size = min(size, MAX_ACL_LEN);
243
244 size -= sizeof(ACL);
245
246 ace = (const ACE_HEADER *)(acl + 1);
247 for (i = 0; i < acl->AceCount; i++)
248 {
249 const SID *sid;
250 data_size_t sid_size;
251
252 if (size < sizeof(ACE_HEADER))
253 return FALSE;
254 if (size < ace->AceSize)
255 return FALSE;
256 size -= ace->AceSize;
257 switch (ace->AceType)
258 {
259 case ACCESS_DENIED_ACE_TYPE:
260 sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
261 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
262 break;
263 case ACCESS_ALLOWED_ACE_TYPE:
264 sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
265 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
266 break;
267 case SYSTEM_AUDIT_ACE_TYPE:
268 sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
269 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
270 break;
271 case SYSTEM_ALARM_ACE_TYPE:
272 sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
273 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
274 break;
275 case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
276 sid = (const SID *)&((const SYSTEM_MANDATORY_LABEL_ACE *)ace)->SidStart;
277 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart);
278 break;
279 default:
280 return FALSE;
281 }
282 if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
283 return FALSE;
284 ace = ace_next( ace );
285 }
286 return TRUE;
287 }
288
289 static unsigned int get_sid_count( const SID *sid, data_size_t size )
290 {
291 unsigned int count;
292
293 for (count = 0; size >= sizeof(SID) && security_sid_len( sid ) <= size; count++)
294 {
295 size -= security_sid_len( sid );
296 sid = (const SID *)((char *)sid + security_sid_len( sid ));
297 }
298
299 return count;
300 }
301
302 /* checks whether all members of a security descriptor fit inside the size
303 * of memory specified */
304 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
305 {
306 size_t offset = sizeof(struct security_descriptor);
307 const SID *group;
308 const SID *owner;
309 const ACL *sacl;
310 const ACL *dacl;
311 int dummy;
312
313 if (size < offset)
314 return FALSE;
315
316 if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
317 (offset + sd->owner_len > size))
318 return FALSE;
319 owner = sd_get_owner( sd );
320 if (owner)
321 {
322 if ((sd->owner_len < sizeof(SID)) || (security_sid_len( owner ) > sd->owner_len))
323 return FALSE;
324 }
325 offset += sd->owner_len;
326
327 if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
328 (offset + sd->group_len > size))
329 return FALSE;
330 group = sd_get_group( sd );
331 if (group)
332 {
333 if ((sd->group_len < sizeof(SID)) || (security_sid_len( group ) > sd->group_len))
334 return FALSE;
335 }
336 offset += sd->group_len;
337
338 if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
339 return FALSE;
340 sacl = sd_get_sacl( sd, &dummy );
341 if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
342 return FALSE;
343 offset += sd->sacl_len;
344
345 if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
346 return FALSE;
347 dacl = sd_get_dacl( sd, &dummy );
348 if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
349 return FALSE;
350 offset += sd->dacl_len;
351
352 return TRUE;
353 }
354
355 /* extract security labels from SACL */
356 ACL *extract_security_labels( const ACL *sacl )
357 {
358 size_t size = sizeof(ACL);
359 const ACE_HEADER *ace;
360 ACE_HEADER *label_ace;
361 unsigned int i, count = 0;
362 ACL *label_acl;
363
364 ace = (const ACE_HEADER *)(sacl + 1);
365 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
366 {
367 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
368 {
369 size += ace->AceSize;
370 count++;
371 }
372 }
373
374 label_acl = mem_alloc( size );
375 if (!label_acl) return NULL;
376
377 label_acl->AclRevision = sacl->AclRevision;
378 label_acl->Sbz1 = 0;
379 label_acl->AclSize = size;
380 label_acl->AceCount = count;
381 label_acl->Sbz2 = 0;
382 label_ace = (ACE_HEADER *)(label_acl + 1);
383
384 ace = (const ACE_HEADER *)(sacl + 1);
385 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
386 {
387 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
388 {
389 memcpy( label_ace, ace, ace->AceSize );
390 label_ace = (ACE_HEADER *)ace_next( label_ace );
391 }
392 }
393 return label_acl;
394 }
395
396 /* replace security labels in an existing SACL */
397 ACL *replace_security_labels( const ACL *old_sacl, const ACL *new_sacl )
398 {
399 const ACE_HEADER *ace;
400 ACE_HEADER *replaced_ace;
401 size_t size = sizeof(ACL);
402 unsigned int i, count = 0;
403 BYTE revision = ACL_REVISION;
404 ACL *replaced_acl;
405
406 if (old_sacl)
407 {
408 revision = max( revision, old_sacl->AclRevision );
409 ace = (const ACE_HEADER *)(old_sacl + 1);
410 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
411 {
412 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
413 size += ace->AceSize;
414 count++;
415 }
416 }
417
418 if (new_sacl)
419 {
420 revision = max( revision, new_sacl->AclRevision );
421 ace = (const ACE_HEADER *)(new_sacl + 1);
422 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
423 {
424 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
425 size += ace->AceSize;
426 count++;
427 }
428 }
429
430 replaced_acl = mem_alloc( size );
431 if (!replaced_acl) return NULL;
432
433 replaced_acl->AclRevision = revision;
434 replaced_acl->Sbz1 = 0;
435 replaced_acl->AclSize = size;
436 replaced_acl->AceCount = count;
437 replaced_acl->Sbz2 = 0;
438 replaced_ace = (ACE_HEADER *)(replaced_acl + 1);
439
440 if (old_sacl)
441 {
442 ace = (const ACE_HEADER *)(old_sacl + 1);
443 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
444 {
445 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
446 memcpy( replaced_ace, ace, ace->AceSize );
447 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
448 }
449 }
450
451 if (new_sacl)
452 {
453 ace = (const ACE_HEADER *)(new_sacl + 1);
454 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
455 {
456 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
457 memcpy( replaced_ace, ace, ace->AceSize );
458 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
459 }
460 }
461
462 return replaced_acl;
463 }
464
465 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
466 {
467 return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
468 }
469
470 static inline void allocate_luid( luid_t *luid )
471 {
472 prev_luid_value.low_part++;
473 *luid = prev_luid_value;
474 }
475
476 DECL_HANDLER( allocate_locally_unique_id )
477 {
478 allocate_luid( &reply->luid );
479 }
480
481 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
482 {
483 out->Luid = in->luid;
484 out->Attributes =
485 (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
486 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
487 }
488
489 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
490 {
491 struct privilege *privilege = mem_alloc( sizeof(*privilege) );
492 if (privilege)
493 {
494 privilege->luid = *luid;
495 privilege->def = privilege->enabled = (enabled != 0);
496 list_add_tail( &token->privileges, &privilege->entry );
497 }
498 return privilege;
499 }
500
501 static inline void privilege_remove( struct privilege *privilege )
502 {
503 list_remove( &privilege->entry );
504 free( privilege );
505 }
506
507 static void token_destroy( struct object *obj )
508 {
509 struct token* token;
510 struct list *cursor, *cursor_next;
511
512 assert( obj->ops == &token_ops );
513 token = (struct token *)obj;
514
515 free( token->user );
516
517 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
518 {
519 struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
520 privilege_remove( privilege );
521 }
522
523 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
524 {
525 struct group *group = LIST_ENTRY( cursor, struct group, entry );
526 list_remove( &group->entry );
527 free( group );
528 }
529
530 free( token->default_dacl );
531 }
532
533 /* creates a new token.
534 * groups may be NULL if group_count is 0.
535 * privs may be NULL if priv_count is 0.
536 * default_dacl may be NULL, indicating that all objects created by the user
537 * are unsecured.
538 * modified_id may be NULL, indicating that a new modified_id luid should be
539 * allocated.
540 */
541 static struct token *create_token( unsigned int primary, unsigned int session_id, const SID *user,
542 const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
543 const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
544 const ACL *default_dacl, TOKEN_SOURCE source,
545 const luid_t *modified_id,
546 int impersonation_level, int elevation )
547 {
548 struct token *token = alloc_object( &token_ops );
549 if (token)
550 {
551 unsigned int i;
552
553 allocate_luid( &token->token_id );
554 if (modified_id)
555 token->modified_id = *modified_id;
556 else
557 allocate_luid( &token->modified_id );
558 list_init( &token->privileges );
559 list_init( &token->groups );
560 token->primary = primary;
561 token->session_id = session_id;
562 /* primary tokens don't have impersonation levels */
563 if (primary)
564 token->impersonation_level = -1;
565 else
566 token->impersonation_level = impersonation_level;
567 token->default_dacl = NULL;
568 token->primary_group = NULL;
569 token->elevation = elevation;
570
571 /* copy user */
572 token->user = memdup( user, security_sid_len( user ));
573 if (!token->user)
574 {
575 release_object( token );
576 return NULL;
577 }
578
579 /* copy groups */
580 for (i = 0; i < group_count; i++)
581 {
582 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
583 struct group *group = mem_alloc( size );
584
585 if (!group)
586 {
587 release_object( token );
588 return NULL;
589 }
590 memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
591 group->enabled = TRUE;
592 group->def = TRUE;
593 group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
594 group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
595 group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
596 group->resource = FALSE;
597 group->deny_only = FALSE;
598 list_add_tail( &token->groups, &group->entry );
599 /* Use first owner capable group as owner and primary group */
600 if (!token->primary_group && group->owner)
601 {
602 token->owner = &group->sid;
603 token->primary_group = &group->sid;
604 }
605 }
606
607 /* copy privileges */
608 for (i = 0; i < priv_count; i++)
609 {
610 /* note: we don't check uniqueness: the caller must make sure
611 * privs doesn't contain any duplicate luids */
612 if (!privilege_add( token, &privs[i].Luid,
613 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
614 {
615 release_object( token );
616 return NULL;
617 }
618 }
619
620 if (default_dacl)
621 {
622 token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
623 if (!token->default_dacl)
624 {
625 release_object( token );
626 return NULL;
627 }
628 }
629
630 token->source = source;
631 }
632 return token;
633 }
634
635 static int filter_group( struct group *group, const SID *filter, unsigned int count )
636 {
637 unsigned int i;
638
639 for (i = 0; i < count; i++)
640 {
641 if (security_equal_sid( &group->sid, filter )) return 1;
642 filter = (const SID *)((char *)filter + security_sid_len( filter ));
643 }
644
645 return 0;
646 }
647
648 static int filter_privilege( struct privilege *privilege, const LUID_AND_ATTRIBUTES *filter, unsigned int count )
649 {
650 unsigned int i;
651
652 for (i = 0; i < count; i++)
653 {
654 if (!memcmp( &privilege->luid, &filter[i].Luid, sizeof(LUID) ))
655 return 1;
656 }
657
658 return 0;
659 }
660
661 struct token *token_duplicate( struct token *src_token, unsigned primary,
662 int impersonation_level, const struct security_descriptor *sd,
663 const LUID_AND_ATTRIBUTES *remove_privs, unsigned int remove_priv_count,
664 const SID *remove_groups, unsigned int remove_group_count)
665 {
666 const luid_t *modified_id =
667 primary || (impersonation_level == src_token->impersonation_level) ?
668 &src_token->modified_id : NULL;
669 struct token *token = NULL;
670 struct privilege *privilege;
671 struct group *group;
672
673 if (!primary &&
674 (impersonation_level < SecurityAnonymous ||
675 impersonation_level > SecurityDelegation ||
676 (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
677 {
678 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
679 return NULL;
680 }
681
682 token = create_token( primary, src_token->session_id, src_token->user, NULL, 0,
683 NULL, 0, src_token->default_dacl,
684 src_token->source, modified_id,
685 impersonation_level, src_token->elevation );
686 if (!token) return token;
687
688 /* copy groups */
689 token->primary_group = NULL;
690 LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
691 {
692 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
693 struct group *newgroup = mem_alloc( size );
694 if (!newgroup)
695 {
696 release_object( token );
697 return NULL;
698 }
699 memcpy( newgroup, group, size );
700 if (filter_group( group, remove_groups, remove_group_count ))
701 {
702 newgroup->enabled = 0;
703 newgroup->def = 0;
704 newgroup->deny_only = 1;
705 }
706 list_add_tail( &token->groups, &newgroup->entry );
707 if (src_token->primary_group == &group->sid)
708 {
709 token->owner = &newgroup->sid;
710 token->primary_group = &newgroup->sid;
711 }
712 }
713 assert( token->primary_group );
714
715 /* copy privileges */
716 LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
717 {
718 if (filter_privilege( privilege, remove_privs, remove_priv_count )) continue;
719 if (!privilege_add( token, &privilege->luid, privilege->enabled ))
720 {
721 release_object( token );
722 return NULL;
723 }
724 }
725
726 if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
727 DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
728
729 return token;
730 }
731
732 static ACL *create_default_dacl( const SID *user )
733 {
734 ACCESS_ALLOWED_ACE *aaa;
735 ACL *default_dacl;
736 SID *sid;
737 size_t default_dacl_size = sizeof(ACL) +
738 2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
739 sizeof(local_system_sid) +
740 security_sid_len( user );
741
742 default_dacl = mem_alloc( default_dacl_size );
743 if (!default_dacl) return NULL;
744
745 default_dacl->AclRevision = ACL_REVISION;
746 default_dacl->Sbz1 = 0;
747 default_dacl->AclSize = default_dacl_size;
748 default_dacl->AceCount = 2;
749 default_dacl->Sbz2 = 0;
750
751 /* GENERIC_ALL for Local System */
752 aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
753 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
754 aaa->Header.AceFlags = 0;
755 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
756 sizeof(local_system_sid);
757 aaa->Mask = GENERIC_ALL;
758 sid = (SID *)&aaa->SidStart;
759 memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
760
761 /* GENERIC_ALL for specified user */
762 aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
763 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
764 aaa->Header.AceFlags = 0;
765 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
766 aaa->Mask = GENERIC_ALL;
767 sid = (SID *)&aaa->SidStart;
768 memcpy( sid, user, security_sid_len( user ));
769
770 return default_dacl;
771 }
772
773 struct sid_data
774 {
775 SID_IDENTIFIER_AUTHORITY idauth;
776 int count;
777 unsigned int subauth[MAX_SUBAUTH_COUNT];
778 };
779
780 static struct security_descriptor *create_security_label_sd( struct token *token, PSID label_sid )
781 {
782 size_t sid_len = security_sid_len( label_sid ), sacl_size, sd_size;
783 SYSTEM_MANDATORY_LABEL_ACE *smla;
784 struct security_descriptor *sd;
785 ACL *sacl;
786
787 sacl_size = sizeof(ACL) + FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
788 sd_size = sizeof(struct security_descriptor) + sacl_size;
789 if (!(sd = mem_alloc( sd_size )))
790 return NULL;
791
792 sd->control = SE_SACL_PRESENT;
793 sd->owner_len = 0;
794 sd->group_len = 0;
795 sd->sacl_len = sacl_size;
796 sd->dacl_len = 0;
797
798 sacl = (ACL *)(sd + 1);
799 sacl->AclRevision = ACL_REVISION;
800 sacl->Sbz1 = 0;
801 sacl->AclSize = sacl_size;
802 sacl->AceCount = 1;
803 sacl->Sbz2 = 0;
804
805 smla = (SYSTEM_MANDATORY_LABEL_ACE *)(sacl + 1);
806 smla->Header.AceType = SYSTEM_MANDATORY_LABEL_ACE_TYPE;
807 smla->Header.AceFlags = 0;
808 smla->Header.AceSize = FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
809 smla->Mask = SYSTEM_MANDATORY_LABEL_NO_WRITE_UP;
810 memcpy( &smla->SidStart, label_sid, sid_len );
811
812 assert( sd_is_valid( sd, sd_size ) );
813 return sd;
814 }
815
816 int token_assign_label( struct token *token, PSID label )
817 {
818 struct security_descriptor *sd;
819 int ret = 0;
820
821 if ((sd = create_security_label_sd( token, label )))
822 {
823 ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
824 free( sd );
825 }
826
827 return ret;
828 }
829
830 struct token *get_token_obj( struct process *process, obj_handle_t handle, unsigned int access )
831 {
832 return (struct token *)get_handle_obj( process, handle, access, &token_ops );
833 }
834
835 struct token *token_create_admin( unsigned primary, int impersonation_level, int elevation, unsigned int session_id )
836 {
837 struct token *token = NULL;
838 static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
839 static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
840 static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
841 /* on Windows, this value changes every time the user logs on */
842 static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
843 PSID alias_admins_sid;
844 PSID alias_users_sid;
845 PSID logon_sid;
846 const SID *user_sid = security_unix_uid_to_sid( getuid() );
847 ACL *default_dacl = create_default_dacl( user_sid );
848
849 alias_admins_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_admins_subauth ),
850 alias_admins_subauth );
851 alias_users_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_users_subauth ),
852 alias_users_subauth );
853 logon_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( logon_subauth ), logon_subauth );
854
855 if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
856 {
857 const LUID_AND_ATTRIBUTES admin_privs[] =
858 {
859 { SeChangeNotifyPrivilege , SE_PRIVILEGE_ENABLED },
860 { SeTcbPrivilege , 0 },
861 { SeSecurityPrivilege , 0 },
862 { SeBackupPrivilege , 0 },
863 { SeRestorePrivilege , 0 },
864 { SeSystemtimePrivilege , 0 },
865 { SeShutdownPrivilege , 0 },
866 { SeRemoteShutdownPrivilege , 0 },
867 { SeTakeOwnershipPrivilege , 0 },
868 { SeDebugPrivilege , 0 },
869 { SeSystemEnvironmentPrivilege , 0 },
870 { SeSystemProfilePrivilege , 0 },
871 { SeProfileSingleProcessPrivilege, 0 },
872 { SeIncreaseBasePriorityPrivilege, 0 },
873 { SeLoadDriverPrivilege , SE_PRIVILEGE_ENABLED },
874 { SeCreatePagefilePrivilege , 0 },
875 { SeIncreaseQuotaPrivilege , 0 },
876 { SeUndockPrivilege , 0 },
877 { SeManageVolumePrivilege , 0 },
878 { SeImpersonatePrivilege , SE_PRIVILEGE_ENABLED },
879 { SeCreateGlobalPrivilege , SE_PRIVILEGE_ENABLED },
880 };
881 /* note: we don't include non-builtin groups here for the user -
882 * telling us these is the job of a client-side program */
883 const SID_AND_ATTRIBUTES admin_groups[] =
884 {
885 { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
886 { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
887 { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
888 { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
889 { security_domain_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
890 { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
891 { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
892 { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
893 };
894 static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
895 token = create_token( primary, session_id, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
896 admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
897 admin_source, NULL, impersonation_level, elevation );
898 /* we really need a primary group */
899 assert( token->primary_group );
900 }
901
902 free( logon_sid );
903 free( alias_admins_sid );
904 free( alias_users_sid );
905 free( default_dacl );
906
907 return token;
908 }
909
910 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
911 {
912 struct privilege *privilege;
913 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
914 {
915 if (is_equal_luid( luid, &privilege->luid ))
916 {
917 if (enabled_only && !privilege->enabled)
918 return NULL;
919 return privilege;
920 }
921 }
922 return NULL;
923 }
924
925 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
926 unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
927 unsigned int mod_privs_count )
928 {
929 unsigned int i, modified_count = 0;
930
931 /* mark as modified */
932 allocate_luid( &token->modified_id );
933
934 for (i = 0; i < count; i++)
935 {
936 struct privilege *privilege =
937 token_find_privilege( token, &privs[i].Luid, FALSE );
938 if (!privilege)
939 {
940 set_error( STATUS_NOT_ALL_ASSIGNED );
941 continue;
942 }
943
944 if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
945 privilege_remove( privilege );
946 else
947 {
948 /* save previous state for caller */
949 if (mod_privs_count)
950 {
951 luid_and_attr_from_privilege(mod_privs, privilege);
952 mod_privs++;
953 mod_privs_count--;
954 modified_count++;
955 }
956
957 if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
958 privilege->enabled = TRUE;
959 else
960 privilege->enabled = FALSE;
961 }
962 }
963 return modified_count;
964 }
965
966 static void token_disable_privileges( struct token *token )
967 {
968 struct privilege *privilege;
969
970 /* mark as modified */
971 allocate_luid( &token->modified_id );
972
973 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
974 privilege->enabled = FALSE;
975 }
976
977 int token_check_privileges( struct token *token, int all_required,
978 const LUID_AND_ATTRIBUTES *reqprivs,
979 unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
980 {
981 unsigned int i, enabled_count = 0;
982
983 for (i = 0; i < count; i++)
984 {
985 struct privilege *privilege =
986 token_find_privilege( token, &reqprivs[i].Luid, TRUE );
987
988 if (usedprivs)
989 usedprivs[i] = reqprivs[i];
990
991 if (privilege && privilege->enabled)
992 {
993 enabled_count++;
994 if (usedprivs)
995 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
996 }
997 }
998
999 if (all_required)
1000 return (enabled_count == count);
1001 else
1002 return (enabled_count > 0);
1003 }
1004
1005 int token_sid_present( struct token *token, const SID *sid, int deny )
1006 {
1007 struct group *group;
1008
1009 if (security_equal_sid( token->user, sid )) return TRUE;
1010
1011 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
1012 {
1013 if (!group->enabled) continue;
1014 if (group->deny_only && !deny) continue;
1015
1016 if (security_equal_sid( &group->sid, sid )) return TRUE;
1017 }
1018
1019 return FALSE;
1020 }
1021
1022 /* Checks access to a security descriptor. 'sd' must have been validated by
1023 * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
1024 * the reason. 'status' parameter will indicate if access is granted or denied.
1025 *
1026 * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
1027 */
1028 static unsigned int token_access_check( struct token *token,
1029 const struct security_descriptor *sd,
1030 unsigned int desired_access,
1031 LUID_AND_ATTRIBUTES *privs,
1032 unsigned int *priv_count,
1033 const generic_map_t *mapping,
1034 unsigned int *granted_access,
1035 unsigned int *status )
1036 {
1037 unsigned int current_access = 0;
1038 unsigned int denied_access = 0;
1039 ULONG i;
1040 const ACL *dacl;
1041 int dacl_present;
1042 const ACE_HEADER *ace;
1043 const SID *owner;
1044
1045 /* assume no access rights */
1046 *granted_access = 0;
1047
1048 /* fail if desired_access contains generic rights */
1049 if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
1050 {
1051 if (priv_count) *priv_count = 0;
1052 return STATUS_GENERIC_NOT_MAPPED;
1053 }
1054
1055 dacl = sd_get_dacl( sd, &dacl_present );
1056 owner = sd_get_owner( sd );
1057 if (!owner || !sd_get_group( sd ))
1058 {
1059 if (priv_count) *priv_count = 0;
1060 return STATUS_INVALID_SECURITY_DESCR;
1061 }
1062
1063 /* 1: Grant desired access if the object is unprotected */
1064 if (!dacl_present || !dacl)
1065 {
1066 if (priv_count) *priv_count = 0;
1067 if (desired_access & MAXIMUM_ALLOWED)
1068 *granted_access = mapping->all;
1069 else
1070 *granted_access = desired_access;
1071 return *status = STATUS_SUCCESS;
1072 }
1073
1074 /* 2: Check if caller wants access to system security part. Note: access
1075 * is only granted if specifically asked for */
1076 if (desired_access & ACCESS_SYSTEM_SECURITY)
1077 {
1078 const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
1079 LUID_AND_ATTRIBUTES retpriv = security_priv;
1080 if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
1081 {
1082 if (priv_count)
1083 {
1084 /* assumes that there will only be one privilege to return */
1085 if (*priv_count >= 1)
1086 {
1087 *priv_count = 1;
1088 *privs = retpriv;
1089 }
1090 else
1091 {
1092 *priv_count = 1;
1093 return STATUS_BUFFER_TOO_SMALL;
1094 }
1095 }
1096 current_access |= ACCESS_SYSTEM_SECURITY;
1097 if (desired_access == current_access)
1098 {
1099 *granted_access = current_access;
1100 return *status = STATUS_SUCCESS;
1101 }
1102 }
1103 else
1104 {
1105 if (priv_count) *priv_count = 0;
1106 *status = STATUS_PRIVILEGE_NOT_HELD;
1107 return STATUS_SUCCESS;
1108 }
1109 }
1110 else if (priv_count) *priv_count = 0;
1111
1112 /* 3: Check whether the token is the owner */
1113 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
1114 * checked when a "set owner" call is made, overriding the access rights
1115 * determined here. */
1116 if (token_sid_present( token, owner, FALSE ))
1117 {
1118 current_access |= (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE);
1119 if (desired_access == current_access)
1120 {
1121 *granted_access = current_access;
1122 return *status = STATUS_SUCCESS;
1123 }
1124 }
1125
1126 /* 4: Grant rights according to the DACL */
1127 ace = (const ACE_HEADER *)(dacl + 1);
1128 for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
1129 {
1130 const ACCESS_ALLOWED_ACE *aa_ace;
1131 const ACCESS_DENIED_ACE *ad_ace;
1132 const SID *sid;
1133
1134 if (ace->AceFlags & INHERIT_ONLY_ACE)
1135 continue;
1136
1137 switch (ace->AceType)
1138 {
1139 case ACCESS_DENIED_ACE_TYPE:
1140 ad_ace = (const ACCESS_DENIED_ACE *)ace;
1141 sid = (const SID *)&ad_ace->SidStart;
1142 if (token_sid_present( token, sid, TRUE ))
1143 {
1144 unsigned int access = map_access( ad_ace->Mask, mapping );
1145 if (desired_access & MAXIMUM_ALLOWED)
1146 denied_access |= access;
1147 else
1148 {
1149 denied_access |= (access & ~current_access);
1150 if (desired_access & access) goto done;
1151 }
1152 }
1153 break;
1154 case ACCESS_ALLOWED_ACE_TYPE:
1155 aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
1156 sid = (const SID *)&aa_ace->SidStart;
1157 if (token_sid_present( token, sid, FALSE ))
1158 {
1159 unsigned int access = map_access( aa_ace->Mask, mapping );
1160 if (desired_access & MAXIMUM_ALLOWED)
1161 current_access |= access;
1162 else
1163 current_access |= (access & ~denied_access);
1164 }
1165 break;
1166 }
1167
1168 /* don't bother carrying on checking if we've already got all of
1169 * rights we need */
1170 if (desired_access == *granted_access)
1171 break;
1172 }
1173
1174 done:
1175 if (desired_access & MAXIMUM_ALLOWED)
1176 *granted_access = current_access & ~denied_access;
1177 else
1178 if ((current_access & desired_access) == desired_access)
1179 *granted_access = current_access & desired_access;
1180 else
1181 *granted_access = 0;
1182
1183 *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1184 return STATUS_SUCCESS;
1185 }
1186
1187 const ACL *token_get_default_dacl( struct token *token )
1188 {
1189 return token->default_dacl;
1190 }
1191
1192 const SID *token_get_user( struct token *token )
1193 {
1194 return token->user;
1195 }
1196
1197 const SID *token_get_primary_group( struct token *token )
1198 {
1199 return token->primary_group;
1200 }
1201
1202 unsigned int token_get_session_id( struct token *token )
1203 {
1204 return token->session_id;
1205 }
1206
1207 int check_object_access(struct token *token, struct object *obj, unsigned int *access)
1208 {
1209 generic_map_t mapping;
1210 unsigned int status;
1211 int res;
1212
1213 if (!token)
1214 token = current->token ? current->token : current->process->token;
1215
1216 mapping.all = obj->ops->map_access( obj, GENERIC_ALL );
1217
1218 if (!obj->sd)
1219 {
1220 if (*access & MAXIMUM_ALLOWED) *access = mapping.all;
1221 return TRUE;
1222 }
1223
1224 mapping.read = obj->ops->map_access( obj, GENERIC_READ );
1225 mapping.write = obj->ops->map_access( obj, GENERIC_WRITE );
1226 mapping.exec = obj->ops->map_access( obj, GENERIC_EXECUTE );
1227
1228 res = token_access_check( token, obj->sd, *access, NULL, NULL,
1229 &mapping, access, &status ) == STATUS_SUCCESS &&
1230 status == STATUS_SUCCESS;
1231
1232 if (!res) set_error( STATUS_ACCESS_DENIED );
1233 return res;
1234 }
1235
1236
1237 /* open a security token */
1238 DECL_HANDLER(open_token)
1239 {
1240 if (req->flags & OPEN_TOKEN_THREAD)
1241 {
1242 struct thread *thread = get_thread_from_handle( req->handle, 0 );
1243 if (thread)
1244 {
1245 if (thread->token)
1246 {
1247 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1248 set_error( STATUS_CANT_OPEN_ANONYMOUS );
1249 else
1250 reply->token = alloc_handle( current->process, thread->token,
1251 req->access, req->attributes );
1252 }
1253 else
1254 set_error( STATUS_NO_TOKEN );
1255 release_object( thread );
1256 }
1257 }
1258 else
1259 {
1260 struct process *process = get_process_from_handle( req->handle, 0 );
1261 if (process)
1262 {
1263 if (process->token)
1264 reply->token = alloc_handle( current->process, process->token, req->access,
1265 req->attributes );
1266 else
1267 set_error( STATUS_NO_TOKEN );
1268 release_object( process );
1269 }
1270 }
1271 }
1272
1273 /* adjust the privileges held by a token */
1274 DECL_HANDLER(adjust_token_privileges)
1275 {
1276 struct token *token;
1277 unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1278
1279 if (req->get_modified_state) access |= TOKEN_QUERY;
1280
1281 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1282 access, &token_ops )))
1283 {
1284 const LUID_AND_ATTRIBUTES *privs = get_req_data();
1285 LUID_AND_ATTRIBUTES *modified_privs = NULL;
1286 unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1287 unsigned int modified_priv_count = 0;
1288
1289 if (req->get_modified_state && !req->disable_all)
1290 {
1291 unsigned int i;
1292 /* count modified privs */
1293 for (i = 0; i < priv_count; i++)
1294 {
1295 struct privilege *privilege =
1296 token_find_privilege( token, &privs[i].Luid, FALSE );
1297 if (privilege && req->get_modified_state)
1298 modified_priv_count++;
1299 }
1300 reply->len = modified_priv_count;
1301 modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1302 if (modified_priv_count)
1303 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1304 }
1305 reply->len = modified_priv_count * sizeof(*modified_privs);
1306
1307 if (req->disable_all)
1308 token_disable_privileges( token );
1309 else
1310 token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
1311
1312 release_object( token );
1313 }
1314 }
1315
1316 /* retrieves the list of privileges that may be held be the token */
1317 DECL_HANDLER(get_token_privileges)
1318 {
1319 struct token *token;
1320
1321 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1322 TOKEN_QUERY,
1323 &token_ops )))
1324 {
1325 int priv_count = 0;
1326 LUID_AND_ATTRIBUTES *privs;
1327 struct privilege *privilege;
1328
1329 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1330 priv_count++;
1331
1332 reply->len = priv_count * sizeof(*privs);
1333 if (reply->len <= get_reply_max_size())
1334 {
1335 privs = set_reply_data_size( priv_count * sizeof(*privs) );
1336 if (privs)
1337 {
1338 int i = 0;
1339 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1340 {
1341 luid_and_attr_from_privilege( &privs[i], privilege );
1342 i++;
1343 }
1344 }
1345 }
1346 else
1347 set_error(STATUS_BUFFER_TOO_SMALL);
1348
1349 release_object( token );
1350 }
1351 }
1352
1353 /* creates a duplicate of the token */
1354 DECL_HANDLER(duplicate_token)
1355 {
1356 struct token *src_token;
1357 struct unicode_str name;
1358 const struct security_descriptor *sd;
1359 const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
1360
1361 if (!objattr) return;
1362
1363 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1364 TOKEN_DUPLICATE,
1365 &token_ops )))
1366 {
1367 struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd, NULL, 0, NULL, 0 );
1368 if (token)
1369 {
1370 unsigned int access = req->access ? req->access : get_handle_access( current->process, req->handle );
1371 reply->new_handle = alloc_handle_no_access_check( current->process, token, access, objattr->attributes );
1372 release_object( token );
1373 }
1374 release_object( src_token );
1375 }
1376 }
1377
1378 /* creates a restricted version of a token */
1379 DECL_HANDLER(filter_token)
1380 {
1381 struct token *src_token;
1382
1383 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_DUPLICATE, &token_ops )))
1384 {
1385 const LUID_AND_ATTRIBUTES *filter_privileges = get_req_data();
1386 unsigned int priv_count, group_count;
1387 const SID *filter_groups;
1388 struct token *token;
1389
1390 priv_count = min( req->privileges_size, get_req_data_size() ) / sizeof(LUID_AND_ATTRIBUTES);
1391 filter_groups = (const SID *)((char *)filter_privileges + priv_count * sizeof(LUID_AND_ATTRIBUTES));
1392 group_count = get_sid_count( filter_groups, get_req_data_size() - priv_count * sizeof(LUID_AND_ATTRIBUTES) );
1393
1394 token = token_duplicate( src_token, src_token->primary, src_token->impersonation_level, NULL,
1395 filter_privileges, priv_count, filter_groups, group_count );
1396 if (token)
1397 {
1398 unsigned int access = get_handle_access( current->process, req->handle );
1399 reply->new_handle = alloc_handle_no_access_check( current->process, token, access, 0 );
1400 release_object( token );
1401 }
1402 release_object( src_token );
1403 }
1404 }
1405
1406 /* checks the specified privileges are held by the token */
1407 DECL_HANDLER(check_token_privileges)
1408 {
1409 struct token *token;
1410
1411 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1412 TOKEN_QUERY,
1413 &token_ops )))
1414 {
1415 unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1416
1417 if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1418 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1419 else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1420 {
1421 LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1422 reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1423 }
1424 else
1425 set_error( STATUS_BUFFER_OVERFLOW );
1426 release_object( token );
1427 }
1428 }
1429
1430 /* checks that a user represented by a token is allowed to access an object
1431 * represented by a security descriptor */
1432 DECL_HANDLER(access_check)
1433 {
1434 data_size_t sd_size = get_req_data_size();
1435 const struct security_descriptor *sd = get_req_data();
1436 struct token *token;
1437
1438 if (!sd_is_valid( sd, sd_size ))
1439 {
1440 set_error( STATUS_ACCESS_VIOLATION );
1441 return;
1442 }
1443
1444 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1445 TOKEN_QUERY,
1446 &token_ops )))
1447 {
1448 unsigned int status;
1449 LUID_AND_ATTRIBUTES priv;
1450 unsigned int priv_count = 1;
1451
1452 memset(&priv, 0, sizeof(priv));
1453
1454 /* only impersonation tokens may be used with this function */
1455 if (token->primary)
1456 {
1457 set_error( STATUS_NO_IMPERSONATION_TOKEN );
1458 release_object( token );
1459 return;
1460 }
1461 /* anonymous impersonation tokens can't be used */
1462 if (token->impersonation_level <= SecurityAnonymous)
1463 {
1464 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1465 release_object( token );
1466 return;
1467 }
1468
1469 status = token_access_check( token, sd, req->desired_access, &priv, &priv_count, &req->mapping,
1470 &reply->access_granted, &reply->access_status );
1471
1472 reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1473
1474 if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1475 {
1476 LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1477 memcpy( privs, &priv, sizeof(priv) );
1478 }
1479
1480 set_error( status );
1481 release_object( token );
1482 }
1483 }
1484
1485 /* retrieves an SID from the token */
1486 DECL_HANDLER(get_token_sid)
1487 {
1488 struct token *token;
1489
1490 reply->sid_len = 0;
1491
1492 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1493 {
1494 const SID *sid = NULL;
1495
1496 switch (req->which_sid)
1497 {
1498 case TokenUser:
1499 assert(token->user);
1500 sid = token->user;
1501 break;
1502 case TokenPrimaryGroup:
1503 sid = token->primary_group;
1504 break;
1505 case TokenOwner:
1506 sid = token->owner;
1507 break;
1508 case TokenLogonSid:
1509 sid = (const SID *)&builtin_logon_sid;
1510 break;
1511 default:
1512 set_error( STATUS_INVALID_PARAMETER );
1513 break;
1514 }
1515
1516 if (sid)
1517 {
1518 reply->sid_len = security_sid_len( sid );
1519 if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1520 else set_error( STATUS_BUFFER_TOO_SMALL );
1521 }
1522 release_object( token );
1523 }
1524 }
1525
1526 /* retrieves the groups that the user represented by the token belongs to */
1527 DECL_HANDLER(get_token_groups)
1528 {
1529 struct token *token;
1530
1531 reply->user_len = 0;
1532
1533 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1534 TOKEN_QUERY,
1535 &token_ops )))
1536 {
1537 size_t size_needed = sizeof(struct token_groups);
1538 size_t sid_size = 0;
1539 unsigned int group_count = 0;
1540 const struct group *group;
1541
1542 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1543 {
1544 group_count++;
1545 sid_size += security_sid_len( &group->sid );
1546 }
1547 size_needed += sid_size;
1548 /* attributes size */
1549 size_needed += sizeof(unsigned int) * group_count;
1550
1551 /* reply buffer contains size_needed bytes formatted as:
1552
1553 unsigned int count;
1554 unsigned int attrib[count];
1555 char sid_data[];
1556
1557 user_len includes extra data needed for TOKEN_GROUPS representation,
1558 required caller buffer size calculated here to avoid extra server call */
1559 reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1560
1561 if (reply->user_len <= get_reply_max_size())
1562 {
1563 struct token_groups *tg = set_reply_data_size( size_needed );
1564 if (tg)
1565 {
1566 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1567 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1568
1569 tg->count = group_count;
1570
1571 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1572 {
1573
1574 *attr_ptr = 0;
1575 if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1576 if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1577 if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1578 if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1579 if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1580 if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1581 if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1582
1583 memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1584
1585 sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1586 attr_ptr++;
1587 }
1588 }
1589 }
1590 else set_error( STATUS_BUFFER_TOO_SMALL );
1591
1592 release_object( token );
1593 }
1594 }
1595
1596 DECL_HANDLER(get_token_info)
1597 {
1598 struct token *token;
1599
1600 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1601 {
1602 reply->token_id = token->token_id;
1603 reply->modified_id = token->modified_id;
1604 reply->session_id = token->session_id;
1605 reply->primary = token->primary;
1606 reply->impersonation_level = token->impersonation_level;
1607 reply->elevation = token->elevation;
1608 reply->group_count = list_count( &token->groups );
1609 reply->privilege_count = list_count( &token->privileges );
1610 release_object( token );
1611 }
1612 }
1613
1614 DECL_HANDLER(get_token_default_dacl)
1615 {
1616 struct token *token;
1617
1618 reply->acl_len = 0;
1619
1620 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1621 TOKEN_QUERY,
1622 &token_ops )))
1623 {
1624 if (token->default_dacl)
1625 reply->acl_len = token->default_dacl->AclSize;
1626
1627 if (reply->acl_len <= get_reply_max_size())
1628 {
1629 ACL *acl_reply = set_reply_data_size( reply->acl_len );
1630 if (acl_reply)
1631 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1632 }
1633 else set_error( STATUS_BUFFER_TOO_SMALL );
1634
1635 release_object( token );
1636 }
1637 }
1638
1639 DECL_HANDLER(set_token_default_dacl)
1640 {
1641 struct token *token;
1642
1643 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1644 TOKEN_ADJUST_DEFAULT,
1645 &token_ops )))
1646 {
1647 const ACL *acl = get_req_data();
1648 unsigned int acl_size = get_req_data_size();
1649
1650 free( token->default_dacl );
1651 token->default_dacl = NULL;
1652
1653 if (acl_size)
1654 token->default_dacl = memdup( acl, acl_size );
1655
1656 release_object( token );
1657 }
1658 }
1659
1660 DECL_HANDLER(create_linked_token)
1661 {
1662 struct token *token, *linked;
1663 int elevation;
1664
1665 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1666 TOKEN_QUERY, &token_ops )))
1667 {
1668 switch (token->elevation)
1669 {
1670 case TokenElevationTypeFull:
1671 elevation = TokenElevationTypeLimited;
1672 break;
1673 case TokenElevationTypeLimited:
1674 elevation = TokenElevationTypeFull;
1675 break;
1676 default:
1677 release_object( token );
1678 return;
1679 }
1680 if ((linked = token_create_admin( FALSE, SecurityIdentification, elevation, token->session_id )))
1681 {
1682 reply->linked = alloc_handle( current->process, linked, TOKEN_ALL_ACCESS, 0 );
1683 release_object( linked );
1684 }
1685 release_object( token );
1686 }
1687 }
Windows API implementation