?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
msi: Avoid using awstring in MsiGetSourcePathW().
[wine.git] / server / token.c
blob0810a613539975d1be3bb1e67ae2fa889e4c9327
1 /*
2 * Tokens
3 *
4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 */
22
23 #include "config.h"
24
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <stdarg.h>
29 #include <unistd.h>
30
31 #include "ntstatus.h"
32 #define WIN32_NO_STATUS
33 #include "windef.h"
34 #include "winternl.h"
35
36 #include "handle.h"
37 #include "thread.h"
38 #include "process.h"
39 #include "request.h"
40 #include "security.h"
41
42 #include "wine/unicode.h"
43
44 #define MAX_SUBAUTH_COUNT 1
45
46 const LUID SeIncreaseQuotaPrivilege = { 5, 0 };
47 const LUID SeSecurityPrivilege = { 8, 0 };
48 const LUID SeTakeOwnershipPrivilege = { 9, 0 };
49 const LUID SeLoadDriverPrivilege = { 10, 0 };
50 const LUID SeSystemProfilePrivilege = { 11, 0 };
51 const LUID SeSystemtimePrivilege = { 12, 0 };
52 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
53 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
54 const LUID SeCreatePagefilePrivilege = { 15, 0 };
55 const LUID SeBackupPrivilege = { 17, 0 };
56 const LUID SeRestorePrivilege = { 18, 0 };
57 const LUID SeShutdownPrivilege = { 19, 0 };
58 const LUID SeDebugPrivilege = { 20, 0 };
59 const LUID SeSystemEnvironmentPrivilege = { 22, 0 };
60 const LUID SeChangeNotifyPrivilege = { 23, 0 };
61 const LUID SeRemoteShutdownPrivilege = { 24, 0 };
62 const LUID SeUndockPrivilege = { 25, 0 };
63 const LUID SeManageVolumePrivilege = { 28, 0 };
64 const LUID SeImpersonatePrivilege = { 29, 0 };
65 const LUID SeCreateGlobalPrivilege = { 30, 0 };
66
67 #define SID_N(n) struct /* same fields as struct SID */ \
68 { \
69 BYTE Revision; \
70 BYTE SubAuthorityCount; \
71 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
72 DWORD SubAuthority[n]; \
73 }
74
75 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
76 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
77 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
78 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
79 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
80 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
81 static const SID high_label_sid = { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY }, { SECURITY_MANDATORY_HIGH_RID } };
82 static const SID_N(5) local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
83 static const SID_N(2) builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
84 static const SID_N(2) builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
85 static const SID_N(3) builtin_logon_sid = { SID_REVISION, 3, { SECURITY_NT_AUTHORITY }, { SECURITY_LOGON_IDS_RID, 0, 0 } };
86
87 const PSID security_world_sid = (PSID)&world_sid;
88 static const PSID security_local_sid = (PSID)&local_sid;
89 static const PSID security_interactive_sid = (PSID)&interactive_sid;
90 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
91 const PSID security_local_system_sid = (PSID)&local_system_sid;
92 const PSID security_local_user_sid = (PSID)&local_user_sid;
93 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
94 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
95 const PSID security_high_label_sid = (PSID)&high_label_sid;
96
97 static luid_t prev_luid_value = { 1000, 0 };
98
99 struct token
100 {
101 struct object obj; /* object header */
102 luid_t token_id; /* system-unique id of token */
103 luid_t modified_id; /* new id allocated every time token is modified */
104 struct list privileges; /* privileges available to the token */
105 struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
106 SID *user; /* SID of user this token represents */
107 SID *owner; /* SID of owner (points to user or one of groups) */
108 SID *primary_group; /* SID of user's primary group (points to one of groups) */
109 unsigned primary; /* is this a primary or impersonation token? */
110 ACL *default_dacl; /* the default DACL to assign to objects created by this user */
111 TOKEN_SOURCE source; /* source of the token */
112 int impersonation_level; /* impersonation level this token is capable of if non-primary token */
113 };
114
115 struct privilege
116 {
117 struct list entry;
118 LUID luid;
119 unsigned enabled : 1; /* is the privilege currently enabled? */
120 unsigned def : 1; /* is the privilege enabled by default? */
121 };
122
123 struct group
124 {
125 struct list entry;
126 unsigned enabled : 1; /* is the sid currently enabled? */
127 unsigned def : 1; /* is the sid enabled by default? */
128 unsigned logon : 1; /* is this a logon sid? */
129 unsigned mandatory: 1; /* is this sid always enabled? */
130 unsigned owner : 1; /* can this sid be an owner of an object? */
131 unsigned resource : 1; /* is this a domain-local group? */
132 unsigned deny_only: 1; /* is this a sid that should be use for denying only? */
133 SID sid;
134 };
135
136 static void token_dump( struct object *obj, int verbose );
137 static unsigned int token_map_access( struct object *obj, unsigned int access );
138 static void token_destroy( struct object *obj );
139
140 static const struct object_ops token_ops =
141 {
142 sizeof(struct token), /* size */
143 token_dump, /* dump */
144 no_get_type, /* get_type */
145 no_add_queue, /* add_queue */
146 NULL, /* remove_queue */
147 NULL, /* signaled */
148 NULL, /* satisfied */
149 no_signal, /* signal */
150 no_get_fd, /* get_fd */
151 token_map_access, /* map_access */
152 default_get_sd, /* get_sd */
153 default_set_sd, /* set_sd */
154 no_lookup_name, /* lookup_name */
155 no_link_name, /* link_name */
156 NULL, /* unlink_name */
157 no_open_file, /* open_file */
158 no_close_handle, /* close_handle */
159 token_destroy /* destroy */
160 };
161
162 static void token_dump( struct object *obj, int verbose )
163 {
164 struct token *token = (struct token *)obj;
165 assert( obj->ops == &token_ops );
166 fprintf( stderr, "Token id=%d.%u primary=%u impersonation level=%d\n", token->token_id.high_part,
167 token->token_id.low_part, token->primary, token->impersonation_level );
168 }
169
170 static unsigned int token_map_access( struct object *obj, unsigned int access )
171 {
172 if (access & GENERIC_READ) access |= TOKEN_READ;
173 if (access & GENERIC_WRITE) access |= TOKEN_WRITE;
174 if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
175 if (access & GENERIC_ALL) access |= TOKEN_ALL_ACCESS;
176 return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
177 }
178
179 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
180 {
181 int i;
182 SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
183 if (!sid) return NULL;
184 sid->Revision = SID_REVISION;
185 sid->SubAuthorityCount = subauthcount;
186 sid->IdentifierAuthority = *idauthority;
187 for (i = 0; i < subauthcount; i++)
188 sid->SubAuthority[i] = subauth[i];
189 return sid;
190 }
191
192 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
193 {
194 if (!handle)
195 {
196 if (thread->token)
197 release_object( thread->token );
198 thread->token = NULL;
199 }
200 else
201 {
202 struct token *token = (struct token *)get_handle_obj( current->process,
203 handle,
204 TOKEN_IMPERSONATE,
205 &token_ops );
206 if (token)
207 {
208 if (thread->token)
209 release_object( thread->token );
210 thread->token = token;
211 }
212 }
213 }
214
215 const SID *security_unix_uid_to_sid( uid_t uid )
216 {
217 /* very simple mapping: either the current user or not the current user */
218 if (uid == getuid())
219 return (const SID *)&local_user_sid;
220 else
221 return &anonymous_logon_sid;
222 }
223
224 static int acl_is_valid( const ACL *acl, data_size_t size )
225 {
226 ULONG i;
227 const ACE_HEADER *ace;
228
229 if (size < sizeof(ACL))
230 return FALSE;
231
232 size = min(size, MAX_ACL_LEN);
233
234 size -= sizeof(ACL);
235
236 ace = (const ACE_HEADER *)(acl + 1);
237 for (i = 0; i < acl->AceCount; i++)
238 {
239 const SID *sid;
240 data_size_t sid_size;
241
242 if (size < sizeof(ACE_HEADER))
243 return FALSE;
244 if (size < ace->AceSize)
245 return FALSE;
246 size -= ace->AceSize;
247 switch (ace->AceType)
248 {
249 case ACCESS_DENIED_ACE_TYPE:
250 sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
251 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
252 break;
253 case ACCESS_ALLOWED_ACE_TYPE:
254 sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
255 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
256 break;
257 case SYSTEM_AUDIT_ACE_TYPE:
258 sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
259 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
260 break;
261 case SYSTEM_ALARM_ACE_TYPE:
262 sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
263 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
264 break;
265 case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
266 sid = (const SID *)&((const SYSTEM_MANDATORY_LABEL_ACE *)ace)->SidStart;
267 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart);
268 break;
269 default:
270 return FALSE;
271 }
272 if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
273 return FALSE;
274 ace = ace_next( ace );
275 }
276 return TRUE;
277 }
278
279 /* checks whether all members of a security descriptor fit inside the size
280 * of memory specified */
281 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
282 {
283 size_t offset = sizeof(struct security_descriptor);
284 const SID *group;
285 const SID *owner;
286 const ACL *sacl;
287 const ACL *dacl;
288 int dummy;
289
290 if (size < offset)
291 return FALSE;
292
293 if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
294 (offset + sd->owner_len > size))
295 return FALSE;
296 owner = sd_get_owner( sd );
297 if (owner)
298 {
299 size_t needed_size = security_sid_len( owner );
300 if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
301 return FALSE;
302 }
303 offset += sd->owner_len;
304
305 if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
306 (offset + sd->group_len > size))
307 return FALSE;
308 group = sd_get_group( sd );
309 if (group)
310 {
311 size_t needed_size = security_sid_len( group );
312 if ((sd->group_len < sizeof(SID)) || (needed_size > sd->group_len))
313 return FALSE;
314 }
315 offset += sd->group_len;
316
317 if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
318 return FALSE;
319 sacl = sd_get_sacl( sd, &dummy );
320 if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
321 return FALSE;
322 offset += sd->sacl_len;
323
324 if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
325 return FALSE;
326 dacl = sd_get_dacl( sd, &dummy );
327 if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
328 return FALSE;
329 offset += sd->dacl_len;
330
331 return TRUE;
332 }
333
334 /* extract security labels from SACL */
335 ACL *extract_security_labels( const ACL *sacl )
336 {
337 size_t size = sizeof(ACL);
338 const ACE_HEADER *ace;
339 ACE_HEADER *label_ace;
340 unsigned int i, count = 0;
341 ACL *label_acl;
342
343 ace = (const ACE_HEADER *)(sacl + 1);
344 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
345 {
346 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
347 {
348 size += ace->AceSize;
349 count++;
350 }
351 }
352
353 label_acl = mem_alloc( size );
354 if (!label_acl) return NULL;
355
356 label_acl->AclRevision = sacl->AclRevision;
357 label_acl->Sbz1 = 0;
358 label_acl->AclSize = size;
359 label_acl->AceCount = count;
360 label_acl->Sbz2 = 0;
361 label_ace = (ACE_HEADER *)(label_acl + 1);
362
363 ace = (const ACE_HEADER *)(sacl + 1);
364 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
365 {
366 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
367 {
368 memcpy( label_ace, ace, ace->AceSize );
369 label_ace = (ACE_HEADER *)ace_next( label_ace );
370 }
371 }
372 return label_acl;
373 }
374
375 /* replace security labels in an existing SACL */
376 ACL *replace_security_labels( const ACL *old_sacl, const ACL *new_sacl )
377 {
378 const ACE_HEADER *ace;
379 ACE_HEADER *replaced_ace;
380 size_t size = sizeof(ACL);
381 unsigned int i, count = 0;
382 BYTE revision = ACL_REVISION;
383 ACL *replaced_acl;
384
385 if (old_sacl)
386 {
387 revision = max( revision, old_sacl->AclRevision );
388 ace = (const ACE_HEADER *)(old_sacl + 1);
389 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
390 {
391 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
392 size += ace->AceSize;
393 count++;
394 }
395 }
396
397 if (new_sacl)
398 {
399 revision = max( revision, new_sacl->AclRevision );
400 ace = (const ACE_HEADER *)(new_sacl + 1);
401 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
402 {
403 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
404 size += ace->AceSize;
405 count++;
406 }
407 }
408
409 replaced_acl = mem_alloc( size );
410 if (!replaced_acl) return NULL;
411
412 replaced_acl->AclRevision = revision;
413 replaced_acl->Sbz1 = 0;
414 replaced_acl->AclSize = size;
415 replaced_acl->AceCount = count;
416 replaced_acl->Sbz2 = 0;
417 replaced_ace = (ACE_HEADER *)(replaced_acl + 1);
418
419 if (old_sacl)
420 {
421 ace = (const ACE_HEADER *)(old_sacl + 1);
422 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
423 {
424 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
425 memcpy( replaced_ace, ace, ace->AceSize );
426 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
427 }
428 }
429
430 if (new_sacl)
431 {
432 ace = (const ACE_HEADER *)(new_sacl + 1);
433 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
434 {
435 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
436 memcpy( replaced_ace, ace, ace->AceSize );
437 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
438 }
439 }
440
441 return replaced_acl;
442 }
443
444 /* maps from generic rights to specific rights as given by a mapping */
445 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
446 {
447 if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
448 if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
449 if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
450 if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
451 *mask &= 0x0FFFFFFF;
452 }
453
454 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
455 {
456 return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
457 }
458
459 static inline void allocate_luid( luid_t *luid )
460 {
461 prev_luid_value.low_part++;
462 *luid = prev_luid_value;
463 }
464
465 DECL_HANDLER( allocate_locally_unique_id )
466 {
467 allocate_luid( &reply->luid );
468 }
469
470 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
471 {
472 out->Luid = in->luid;
473 out->Attributes =
474 (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
475 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
476 }
477
478 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
479 {
480 struct privilege *privilege = mem_alloc( sizeof(*privilege) );
481 if (privilege)
482 {
483 privilege->luid = *luid;
484 privilege->def = privilege->enabled = (enabled != 0);
485 list_add_tail( &token->privileges, &privilege->entry );
486 }
487 return privilege;
488 }
489
490 static inline void privilege_remove( struct privilege *privilege )
491 {
492 list_remove( &privilege->entry );
493 free( privilege );
494 }
495
496 static void token_destroy( struct object *obj )
497 {
498 struct token* token;
499 struct list *cursor, *cursor_next;
500
501 assert( obj->ops == &token_ops );
502 token = (struct token *)obj;
503
504 free( token->user );
505
506 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
507 {
508 struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
509 privilege_remove( privilege );
510 }
511
512 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
513 {
514 struct group *group = LIST_ENTRY( cursor, struct group, entry );
515 list_remove( &group->entry );
516 free( group );
517 }
518
519 free( token->default_dacl );
520 }
521
522 /* creates a new token.
523 * groups may be NULL if group_count is 0.
524 * privs may be NULL if priv_count is 0.
525 * default_dacl may be NULL, indicating that all objects created by the user
526 * are unsecured.
527 * modified_id may be NULL, indicating that a new modified_id luid should be
528 * allocated.
529 */
530 static struct token *create_token( unsigned primary, const SID *user,
531 const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
532 const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
533 const ACL *default_dacl, TOKEN_SOURCE source,
534 const luid_t *modified_id,
535 int impersonation_level )
536 {
537 struct token *token = alloc_object( &token_ops );
538 if (token)
539 {
540 unsigned int i;
541
542 allocate_luid( &token->token_id );
543 if (modified_id)
544 token->modified_id = *modified_id;
545 else
546 allocate_luid( &token->modified_id );
547 list_init( &token->privileges );
548 list_init( &token->groups );
549 token->primary = primary;
550 /* primary tokens don't have impersonation levels */
551 if (primary)
552 token->impersonation_level = -1;
553 else
554 token->impersonation_level = impersonation_level;
555 token->default_dacl = NULL;
556 token->primary_group = NULL;
557
558 /* copy user */
559 token->user = memdup( user, security_sid_len( user ));
560 if (!token->user)
561 {
562 release_object( token );
563 return NULL;
564 }
565
566 /* copy groups */
567 for (i = 0; i < group_count; i++)
568 {
569 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
570 struct group *group = mem_alloc( size );
571
572 if (!group)
573 {
574 release_object( token );
575 return NULL;
576 }
577 memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
578 group->enabled = TRUE;
579 group->def = TRUE;
580 group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
581 group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
582 group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
583 group->resource = FALSE;
584 group->deny_only = FALSE;
585 list_add_tail( &token->groups, &group->entry );
586 /* Use first owner capable group as owner and primary group */
587 if (!token->primary_group && group->owner)
588 {
589 token->owner = &group->sid;
590 token->primary_group = &group->sid;
591 }
592 }
593
594 /* copy privileges */
595 for (i = 0; i < priv_count; i++)
596 {
597 /* note: we don't check uniqueness: the caller must make sure
598 * privs doesn't contain any duplicate luids */
599 if (!privilege_add( token, &privs[i].Luid,
600 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
601 {
602 release_object( token );
603 return NULL;
604 }
605 }
606
607 if (default_dacl)
608 {
609 token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
610 if (!token->default_dacl)
611 {
612 release_object( token );
613 return NULL;
614 }
615 }
616
617 token->source = source;
618 }
619 return token;
620 }
621
622 struct token *token_duplicate( struct token *src_token, unsigned primary,
623 int impersonation_level, const struct security_descriptor *sd )
624 {
625 const luid_t *modified_id =
626 primary || (impersonation_level == src_token->impersonation_level) ?
627 &src_token->modified_id : NULL;
628 struct token *token = NULL;
629 struct privilege *privilege;
630 struct group *group;
631
632 if (!primary &&
633 (impersonation_level < SecurityAnonymous ||
634 impersonation_level > SecurityDelegation ||
635 (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
636 {
637 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
638 return NULL;
639 }
640
641 token = create_token( primary, src_token->user, NULL, 0,
642 NULL, 0, src_token->default_dacl,
643 src_token->source, modified_id,
644 impersonation_level );
645 if (!token) return token;
646
647 /* copy groups */
648 token->primary_group = NULL;
649 LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
650 {
651 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
652 struct group *newgroup = mem_alloc( size );
653 if (!newgroup)
654 {
655 release_object( token );
656 return NULL;
657 }
658 memcpy( newgroup, group, size );
659 list_add_tail( &token->groups, &newgroup->entry );
660 if (src_token->primary_group == &group->sid)
661 {
662 token->owner = &newgroup->sid;
663 token->primary_group = &newgroup->sid;
664 }
665 }
666 assert( token->primary_group );
667
668 /* copy privileges */
669 LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
670 if (!privilege_add( token, &privilege->luid, privilege->enabled ))
671 {
672 release_object( token );
673 return NULL;
674 }
675
676 if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
677 DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
678
679 return token;
680 }
681
682 static ACL *create_default_dacl( const SID *user )
683 {
684 ACCESS_ALLOWED_ACE *aaa;
685 ACL *default_dacl;
686 SID *sid;
687 size_t default_dacl_size = sizeof(ACL) +
688 2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
689 sizeof(local_system_sid) +
690 security_sid_len( user );
691
692 default_dacl = mem_alloc( default_dacl_size );
693 if (!default_dacl) return NULL;
694
695 default_dacl->AclRevision = ACL_REVISION;
696 default_dacl->Sbz1 = 0;
697 default_dacl->AclSize = default_dacl_size;
698 default_dacl->AceCount = 2;
699 default_dacl->Sbz2 = 0;
700
701 /* GENERIC_ALL for Local System */
702 aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
703 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
704 aaa->Header.AceFlags = 0;
705 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
706 sizeof(local_system_sid);
707 aaa->Mask = GENERIC_ALL;
708 sid = (SID *)&aaa->SidStart;
709 memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
710
711 /* GENERIC_ALL for specified user */
712 aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
713 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
714 aaa->Header.AceFlags = 0;
715 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
716 aaa->Mask = GENERIC_ALL;
717 sid = (SID *)&aaa->SidStart;
718 memcpy( sid, user, security_sid_len( user ));
719
720 return default_dacl;
721 }
722
723 struct sid_data
724 {
725 SID_IDENTIFIER_AUTHORITY idauth;
726 int count;
727 unsigned int subauth[MAX_SUBAUTH_COUNT];
728 };
729
730 static struct security_descriptor *create_security_label_sd( struct token *token, PSID label_sid )
731 {
732 size_t sid_len = security_sid_len( label_sid ), sacl_size, sd_size;
733 SYSTEM_MANDATORY_LABEL_ACE *smla;
734 struct security_descriptor *sd;
735 ACL *sacl;
736
737 sacl_size = sizeof(ACL) + FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
738 sd_size = sizeof(struct security_descriptor) + sacl_size;
739 if (!(sd = mem_alloc( sd_size )))
740 return NULL;
741
742 sd->control = SE_SACL_PRESENT;
743 sd->owner_len = 0;
744 sd->group_len = 0;
745 sd->sacl_len = sacl_size;
746 sd->dacl_len = 0;
747
748 sacl = (ACL *)(sd + 1);
749 sacl->AclRevision = ACL_REVISION;
750 sacl->Sbz1 = 0;
751 sacl->AclSize = sacl_size;
752 sacl->AceCount = 1;
753 sacl->Sbz2 = 0;
754
755 smla = (SYSTEM_MANDATORY_LABEL_ACE *)(sacl + 1);
756 smla->Header.AceType = SYSTEM_MANDATORY_LABEL_ACE_TYPE;
757 smla->Header.AceFlags = 0;
758 smla->Header.AceSize = FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
759 smla->Mask = SYSTEM_MANDATORY_LABEL_NO_WRITE_UP;
760 memcpy( &smla->SidStart, label_sid, sid_len );
761
762 assert( sd_is_valid( sd, sd_size ) );
763 return sd;
764 }
765
766 int token_assign_label( struct token *token, PSID label )
767 {
768 struct security_descriptor *sd;
769 int ret = 0;
770
771 if ((sd = create_security_label_sd( token, label )))
772 {
773 ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
774 free( sd );
775 }
776
777 return ret;
778 }
779
780 struct token *token_create_admin( void )
781 {
782 struct token *token = NULL;
783 static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
784 static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
785 static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
786 /* on Windows, this value changes every time the user logs on */
787 static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
788 PSID alias_admins_sid;
789 PSID alias_users_sid;
790 PSID logon_sid;
791 const SID *user_sid = security_unix_uid_to_sid( getuid() );
792 ACL *default_dacl = create_default_dacl( user_sid );
793
794 alias_admins_sid = security_sid_alloc( &nt_authority, sizeof(alias_admins_subauth)/sizeof(alias_admins_subauth[0]),
795 alias_admins_subauth );
796 alias_users_sid = security_sid_alloc( &nt_authority, sizeof(alias_users_subauth)/sizeof(alias_users_subauth[0]),
797 alias_users_subauth );
798 logon_sid = security_sid_alloc( &nt_authority, sizeof(logon_subauth)/sizeof(logon_subauth[0]),
799 logon_subauth );
800
801 if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
802 {
803 const LUID_AND_ATTRIBUTES admin_privs[] =
804 {
805 { SeChangeNotifyPrivilege , SE_PRIVILEGE_ENABLED },
806 { SeSecurityPrivilege , 0 },
807 { SeBackupPrivilege , 0 },
808 { SeRestorePrivilege , 0 },
809 { SeSystemtimePrivilege , 0 },
810 { SeShutdownPrivilege , 0 },
811 { SeRemoteShutdownPrivilege , 0 },
812 { SeTakeOwnershipPrivilege , 0 },
813 { SeDebugPrivilege , 0 },
814 { SeSystemEnvironmentPrivilege , 0 },
815 { SeSystemProfilePrivilege , 0 },
816 { SeProfileSingleProcessPrivilege, 0 },
817 { SeIncreaseBasePriorityPrivilege, 0 },
818 { SeLoadDriverPrivilege , SE_PRIVILEGE_ENABLED },
819 { SeCreatePagefilePrivilege , 0 },
820 { SeIncreaseQuotaPrivilege , 0 },
821 { SeUndockPrivilege , 0 },
822 { SeManageVolumePrivilege , 0 },
823 { SeImpersonatePrivilege , SE_PRIVILEGE_ENABLED },
824 { SeCreateGlobalPrivilege , SE_PRIVILEGE_ENABLED },
825 };
826 /* note: we don't include non-builtin groups here for the user -
827 * telling us these is the job of a client-side program */
828 const SID_AND_ATTRIBUTES admin_groups[] =
829 {
830 { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
831 { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
832 { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
833 { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
834 { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
835 { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
836 { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
837 };
838 static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
839 token = create_token( TRUE, user_sid, admin_groups, sizeof(admin_groups)/sizeof(admin_groups[0]),
840 admin_privs, sizeof(admin_privs)/sizeof(admin_privs[0]), default_dacl,
841 admin_source, NULL, -1 );
842 /* we really need a primary group */
843 assert( token->primary_group );
844 }
845
846 free( logon_sid );
847 free( alias_admins_sid );
848 free( alias_users_sid );
849 free( default_dacl );
850
851 return token;
852 }
853
854 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
855 {
856 struct privilege *privilege;
857 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
858 {
859 if (is_equal_luid( luid, &privilege->luid ))
860 {
861 if (enabled_only && !privilege->enabled)
862 return NULL;
863 return privilege;
864 }
865 }
866 return NULL;
867 }
868
869 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
870 unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
871 unsigned int mod_privs_count )
872 {
873 unsigned int i, modified_count = 0;
874
875 /* mark as modified */
876 allocate_luid( &token->modified_id );
877
878 for (i = 0; i < count; i++)
879 {
880 struct privilege *privilege =
881 token_find_privilege( token, &privs[i].Luid, FALSE );
882 if (!privilege)
883 {
884 set_error( STATUS_NOT_ALL_ASSIGNED );
885 continue;
886 }
887
888 if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
889 privilege_remove( privilege );
890 else
891 {
892 /* save previous state for caller */
893 if (mod_privs_count)
894 {
895 luid_and_attr_from_privilege(mod_privs, privilege);
896 mod_privs++;
897 mod_privs_count--;
898 modified_count++;
899 }
900
901 if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
902 privilege->enabled = TRUE;
903 else
904 privilege->enabled = FALSE;
905 }
906 }
907 return modified_count;
908 }
909
910 static void token_disable_privileges( struct token *token )
911 {
912 struct privilege *privilege;
913
914 /* mark as modified */
915 allocate_luid( &token->modified_id );
916
917 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
918 privilege->enabled = FALSE;
919 }
920
921 int token_check_privileges( struct token *token, int all_required,
922 const LUID_AND_ATTRIBUTES *reqprivs,
923 unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
924 {
925 unsigned int i, enabled_count = 0;
926
927 for (i = 0; i < count; i++)
928 {
929 struct privilege *privilege =
930 token_find_privilege( token, &reqprivs[i].Luid, TRUE );
931
932 if (usedprivs)
933 usedprivs[i] = reqprivs[i];
934
935 if (privilege && privilege->enabled)
936 {
937 enabled_count++;
938 if (usedprivs)
939 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
940 }
941 }
942
943 if (all_required)
944 return (enabled_count == count);
945 else
946 return (enabled_count > 0);
947 }
948
949 int token_sid_present( struct token *token, const SID *sid, int deny )
950 {
951 struct group *group;
952
953 if (security_equal_sid( token->user, sid )) return TRUE;
954
955 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
956 {
957 if (!group->enabled) continue;
958 if (group->deny_only && !deny) continue;
959
960 if (security_equal_sid( &group->sid, sid )) return TRUE;
961 }
962
963 return FALSE;
964 }
965
966 /* Checks access to a security descriptor. 'sd' must have been validated by
967 * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
968 * the reason. 'status' parameter will indicate if access is granted or denied.
969 *
970 * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
971 */
972 static unsigned int token_access_check( struct token *token,
973 const struct security_descriptor *sd,
974 unsigned int desired_access,
975 LUID_AND_ATTRIBUTES *privs,
976 unsigned int *priv_count,
977 const GENERIC_MAPPING *mapping,
978 unsigned int *granted_access,
979 unsigned int *status )
980 {
981 unsigned int current_access = 0;
982 unsigned int denied_access = 0;
983 ULONG i;
984 const ACL *dacl;
985 int dacl_present;
986 const ACE_HEADER *ace;
987 const SID *owner;
988
989 /* assume no access rights */
990 *granted_access = 0;
991
992 /* fail if desired_access contains generic rights */
993 if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
994 {
995 if (priv_count) *priv_count = 0;
996 return STATUS_GENERIC_NOT_MAPPED;
997 }
998
999 dacl = sd_get_dacl( sd, &dacl_present );
1000 owner = sd_get_owner( sd );
1001 if (!owner || !sd_get_group( sd ))
1002 {
1003 if (priv_count) *priv_count = 0;
1004 return STATUS_INVALID_SECURITY_DESCR;
1005 }
1006
1007 /* 1: Grant desired access if the object is unprotected */
1008 if (!dacl_present || !dacl)
1009 {
1010 if (priv_count) *priv_count = 0;
1011 if (desired_access & MAXIMUM_ALLOWED)
1012 *granted_access = mapping->GenericAll;
1013 else
1014 *granted_access = desired_access;
1015 return *status = STATUS_SUCCESS;
1016 }
1017
1018 /* 2: Check if caller wants access to system security part. Note: access
1019 * is only granted if specifically asked for */
1020 if (desired_access & ACCESS_SYSTEM_SECURITY)
1021 {
1022 const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
1023 LUID_AND_ATTRIBUTES retpriv = security_priv;
1024 if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
1025 {
1026 if (priv_count)
1027 {
1028 /* assumes that there will only be one privilege to return */
1029 if (*priv_count >= 1)
1030 {
1031 *priv_count = 1;
1032 *privs = retpriv;
1033 }
1034 else
1035 {
1036 *priv_count = 1;
1037 return STATUS_BUFFER_TOO_SMALL;
1038 }
1039 }
1040 current_access |= ACCESS_SYSTEM_SECURITY;
1041 if (desired_access == current_access)
1042 {
1043 *granted_access = current_access;
1044 return *status = STATUS_SUCCESS;
1045 }
1046 }
1047 else
1048 {
1049 if (priv_count) *priv_count = 0;
1050 *status = STATUS_PRIVILEGE_NOT_HELD;
1051 return STATUS_SUCCESS;
1052 }
1053 }
1054 else if (priv_count) *priv_count = 0;
1055
1056 /* 3: Check whether the token is the owner */
1057 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
1058 * checked when a "set owner" call is made, overriding the access rights
1059 * determined here. */
1060 if (token_sid_present( token, owner, FALSE ))
1061 {
1062 current_access |= (READ_CONTROL | WRITE_DAC);
1063 if (desired_access == current_access)
1064 {
1065 *granted_access = current_access;
1066 return *status = STATUS_SUCCESS;
1067 }
1068 }
1069
1070 /* 4: Grant rights according to the DACL */
1071 ace = (const ACE_HEADER *)(dacl + 1);
1072 for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
1073 {
1074 const ACCESS_ALLOWED_ACE *aa_ace;
1075 const ACCESS_DENIED_ACE *ad_ace;
1076 const SID *sid;
1077
1078 if (ace->AceFlags & INHERIT_ONLY_ACE)
1079 continue;
1080
1081 switch (ace->AceType)
1082 {
1083 case ACCESS_DENIED_ACE_TYPE:
1084 ad_ace = (const ACCESS_DENIED_ACE *)ace;
1085 sid = (const SID *)&ad_ace->SidStart;
1086 if (token_sid_present( token, sid, TRUE ))
1087 {
1088 unsigned int access = ad_ace->Mask;
1089 map_generic_mask(&access, mapping);
1090 if (desired_access & MAXIMUM_ALLOWED)
1091 denied_access |= access;
1092 else
1093 {
1094 denied_access |= (access & ~current_access);
1095 if (desired_access & access) goto done;
1096 }
1097 }
1098 break;
1099 case ACCESS_ALLOWED_ACE_TYPE:
1100 aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
1101 sid = (const SID *)&aa_ace->SidStart;
1102 if (token_sid_present( token, sid, FALSE ))
1103 {
1104 unsigned int access = aa_ace->Mask;
1105 map_generic_mask(&access, mapping);
1106 if (desired_access & MAXIMUM_ALLOWED)
1107 current_access |= access;
1108 else
1109 current_access |= (access & ~denied_access);
1110 }
1111 break;
1112 }
1113
1114 /* don't bother carrying on checking if we've already got all of
1115 * rights we need */
1116 if (desired_access == *granted_access)
1117 break;
1118 }
1119
1120 done:
1121 if (desired_access & MAXIMUM_ALLOWED)
1122 *granted_access = current_access & ~denied_access;
1123 else
1124 if ((current_access & desired_access) == desired_access)
1125 *granted_access = current_access & desired_access;
1126 else
1127 *granted_access = 0;
1128
1129 *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1130 return STATUS_SUCCESS;
1131 }
1132
1133 const ACL *token_get_default_dacl( struct token *token )
1134 {
1135 return token->default_dacl;
1136 }
1137
1138 const SID *token_get_user( struct token *token )
1139 {
1140 return token->user;
1141 }
1142
1143 const SID *token_get_primary_group( struct token *token )
1144 {
1145 return token->primary_group;
1146 }
1147
1148 int check_object_access(struct object *obj, unsigned int *access)
1149 {
1150 GENERIC_MAPPING mapping;
1151 struct token *token = current->token ? current->token : current->process->token;
1152 unsigned int status;
1153 int res;
1154
1155 mapping.GenericAll = obj->ops->map_access( obj, GENERIC_ALL );
1156
1157 if (!obj->sd)
1158 {
1159 if (*access & MAXIMUM_ALLOWED)
1160 *access = mapping.GenericAll;
1161 return TRUE;
1162 }
1163
1164 mapping.GenericRead = obj->ops->map_access( obj, GENERIC_READ );
1165 mapping.GenericWrite = obj->ops->map_access( obj, GENERIC_WRITE );
1166 mapping.GenericExecute = obj->ops->map_access( obj, GENERIC_EXECUTE );
1167
1168 res = token_access_check( token, obj->sd, *access, NULL, NULL,
1169 &mapping, access, &status ) == STATUS_SUCCESS &&
1170 status == STATUS_SUCCESS;
1171
1172 if (!res) set_error( STATUS_ACCESS_DENIED );
1173 return res;
1174 }
1175
1176
1177 /* open a security token */
1178 DECL_HANDLER(open_token)
1179 {
1180 if (req->flags & OPEN_TOKEN_THREAD)
1181 {
1182 struct thread *thread = get_thread_from_handle( req->handle, 0 );
1183 if (thread)
1184 {
1185 if (thread->token)
1186 {
1187 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1188 set_error( STATUS_CANT_OPEN_ANONYMOUS );
1189 else
1190 reply->token = alloc_handle( current->process, thread->token,
1191 req->access, req->attributes );
1192 }
1193 else
1194 set_error( STATUS_NO_TOKEN );
1195 release_object( thread );
1196 }
1197 }
1198 else
1199 {
1200 struct process *process = get_process_from_handle( req->handle, 0 );
1201 if (process)
1202 {
1203 if (process->token)
1204 reply->token = alloc_handle( current->process, process->token, req->access,
1205 req->attributes );
1206 else
1207 set_error( STATUS_NO_TOKEN );
1208 release_object( process );
1209 }
1210 }
1211 }
1212
1213 /* adjust the privileges held by a token */
1214 DECL_HANDLER(adjust_token_privileges)
1215 {
1216 struct token *token;
1217 unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1218
1219 if (req->get_modified_state) access |= TOKEN_QUERY;
1220
1221 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1222 access, &token_ops )))
1223 {
1224 const LUID_AND_ATTRIBUTES *privs = get_req_data();
1225 LUID_AND_ATTRIBUTES *modified_privs = NULL;
1226 unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1227 unsigned int modified_priv_count = 0;
1228
1229 if (req->get_modified_state && !req->disable_all)
1230 {
1231 unsigned int i;
1232 /* count modified privs */
1233 for (i = 0; i < priv_count; i++)
1234 {
1235 struct privilege *privilege =
1236 token_find_privilege( token, &privs[i].Luid, FALSE );
1237 if (privilege && req->get_modified_state)
1238 modified_priv_count++;
1239 }
1240 reply->len = modified_priv_count;
1241 modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1242 if (modified_priv_count)
1243 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1244 }
1245 reply->len = modified_priv_count * sizeof(*modified_privs);
1246
1247 if (req->disable_all)
1248 token_disable_privileges( token );
1249 else
1250 token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
1251
1252 release_object( token );
1253 }
1254 }
1255
1256 /* retrieves the list of privileges that may be held be the token */
1257 DECL_HANDLER(get_token_privileges)
1258 {
1259 struct token *token;
1260
1261 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1262 TOKEN_QUERY,
1263 &token_ops )))
1264 {
1265 int priv_count = 0;
1266 LUID_AND_ATTRIBUTES *privs;
1267 struct privilege *privilege;
1268
1269 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1270 priv_count++;
1271
1272 reply->len = priv_count * sizeof(*privs);
1273 if (reply->len <= get_reply_max_size())
1274 {
1275 privs = set_reply_data_size( priv_count * sizeof(*privs) );
1276 if (privs)
1277 {
1278 int i = 0;
1279 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1280 {
1281 luid_and_attr_from_privilege( &privs[i], privilege );
1282 i++;
1283 }
1284 }
1285 }
1286 else
1287 set_error(STATUS_BUFFER_TOO_SMALL);
1288
1289 release_object( token );
1290 }
1291 }
1292
1293 /* creates a duplicate of the token */
1294 DECL_HANDLER(duplicate_token)
1295 {
1296 struct token *src_token;
1297 struct unicode_str name;
1298 const struct security_descriptor *sd;
1299 const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
1300
1301 if (!objattr) return;
1302
1303 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1304 TOKEN_DUPLICATE,
1305 &token_ops )))
1306 {
1307 struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd );
1308 if (token)
1309 {
1310 reply->new_handle = alloc_handle_no_access_check( current->process, token, req->access, objattr->attributes );
1311 release_object( token );
1312 }
1313 release_object( src_token );
1314 }
1315 }
1316
1317 /* checks the specified privileges are held by the token */
1318 DECL_HANDLER(check_token_privileges)
1319 {
1320 struct token *token;
1321
1322 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1323 TOKEN_QUERY,
1324 &token_ops )))
1325 {
1326 unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1327
1328 if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1329 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1330 else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1331 {
1332 LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1333 reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1334 }
1335 else
1336 set_error( STATUS_BUFFER_OVERFLOW );
1337 release_object( token );
1338 }
1339 }
1340
1341 /* checks that a user represented by a token is allowed to access an object
1342 * represented by a security descriptor */
1343 DECL_HANDLER(access_check)
1344 {
1345 data_size_t sd_size = get_req_data_size();
1346 const struct security_descriptor *sd = get_req_data();
1347 struct token *token;
1348
1349 if (!sd_is_valid( sd, sd_size ))
1350 {
1351 set_error( STATUS_ACCESS_VIOLATION );
1352 return;
1353 }
1354
1355 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1356 TOKEN_QUERY,
1357 &token_ops )))
1358 {
1359 GENERIC_MAPPING mapping;
1360 unsigned int status;
1361 LUID_AND_ATTRIBUTES priv;
1362 unsigned int priv_count = 1;
1363
1364 memset(&priv, 0, sizeof(priv));
1365
1366 /* only impersonation tokens may be used with this function */
1367 if (token->primary)
1368 {
1369 set_error( STATUS_NO_IMPERSONATION_TOKEN );
1370 release_object( token );
1371 return;
1372 }
1373 /* anonymous impersonation tokens can't be used */
1374 if (token->impersonation_level <= SecurityAnonymous)
1375 {
1376 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1377 release_object( token );
1378 return;
1379 }
1380
1381 mapping.GenericRead = req->mapping_read;
1382 mapping.GenericWrite = req->mapping_write;
1383 mapping.GenericExecute = req->mapping_execute;
1384 mapping.GenericAll = req->mapping_all;
1385
1386 status = token_access_check(
1387 token, sd, req->desired_access, &priv, &priv_count, &mapping,
1388 &reply->access_granted, &reply->access_status );
1389
1390 reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1391
1392 if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1393 {
1394 LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1395 memcpy( privs, &priv, sizeof(priv) );
1396 }
1397
1398 set_error( status );
1399 release_object( token );
1400 }
1401 }
1402
1403 /* retrieves an SID from the token */
1404 DECL_HANDLER(get_token_sid)
1405 {
1406 struct token *token;
1407
1408 reply->sid_len = 0;
1409
1410 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1411 {
1412 const SID *sid = NULL;
1413
1414 switch (req->which_sid)
1415 {
1416 case TokenUser:
1417 assert(token->user);
1418 sid = token->user;
1419 break;
1420 case TokenPrimaryGroup:
1421 sid = token->primary_group;
1422 break;
1423 case TokenOwner:
1424 sid = token->owner;
1425 break;
1426 case TokenLogonSid:
1427 sid = (const SID *)&builtin_logon_sid;
1428 break;
1429 default:
1430 set_error( STATUS_INVALID_PARAMETER );
1431 break;
1432 }
1433
1434 if (sid)
1435 {
1436 reply->sid_len = security_sid_len( sid );
1437 if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1438 else set_error( STATUS_BUFFER_TOO_SMALL );
1439 }
1440 release_object( token );
1441 }
1442 }
1443
1444 /* retrieves the groups that the user represented by the token belongs to */
1445 DECL_HANDLER(get_token_groups)
1446 {
1447 struct token *token;
1448
1449 reply->user_len = 0;
1450
1451 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1452 TOKEN_QUERY,
1453 &token_ops )))
1454 {
1455 size_t size_needed = sizeof(struct token_groups);
1456 size_t sid_size = 0;
1457 unsigned int group_count = 0;
1458 const struct group *group;
1459
1460 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1461 {
1462 group_count++;
1463 sid_size += security_sid_len( &group->sid );
1464 }
1465 size_needed += sid_size;
1466 /* attributes size */
1467 size_needed += sizeof(unsigned int) * group_count;
1468
1469 /* reply buffer contains size_needed bytes formatted as:
1470
1471 unsigned int count;
1472 unsigned int attrib[count];
1473 char sid_data[];
1474
1475 user_len includes extra data needed for TOKEN_GROUPS representation,
1476 required caller buffer size calculated here to avoid extra server call */
1477 reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1478
1479 if (reply->user_len <= get_reply_max_size())
1480 {
1481 struct token_groups *tg = set_reply_data_size( size_needed );
1482 if (tg)
1483 {
1484 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1485 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1486
1487 tg->count = group_count;
1488
1489 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1490 {
1491
1492 *attr_ptr = 0;
1493 if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1494 if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1495 if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1496 if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1497 if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1498 if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1499 if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1500
1501 memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1502
1503 sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1504 attr_ptr++;
1505 }
1506 }
1507 }
1508 else set_error( STATUS_BUFFER_TOO_SMALL );
1509
1510 release_object( token );
1511 }
1512 }
1513
1514 DECL_HANDLER(get_token_impersonation_level)
1515 {
1516 struct token *token;
1517
1518 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1519 TOKEN_QUERY,
1520 &token_ops )))
1521 {
1522 if (token->primary)
1523 set_error( STATUS_INVALID_PARAMETER );
1524 else
1525 reply->impersonation_level = token->impersonation_level;
1526
1527 release_object( token );
1528 }
1529 }
1530
1531 DECL_HANDLER(get_token_statistics)
1532 {
1533 struct token *token;
1534
1535 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1536 TOKEN_QUERY,
1537 &token_ops )))
1538 {
1539 reply->token_id = token->token_id;
1540 reply->modified_id = token->modified_id;
1541 reply->primary = token->primary;
1542 reply->impersonation_level = token->impersonation_level;
1543 reply->group_count = list_count( &token->groups );
1544 reply->privilege_count = list_count( &token->privileges );
1545
1546 release_object( token );
1547 }
1548 }
1549
1550 DECL_HANDLER(get_token_default_dacl)
1551 {
1552 struct token *token;
1553
1554 reply->acl_len = 0;
1555
1556 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1557 TOKEN_QUERY,
1558 &token_ops )))
1559 {
1560 if (token->default_dacl)
1561 reply->acl_len = token->default_dacl->AclSize;
1562
1563 if (reply->acl_len <= get_reply_max_size())
1564 {
1565 ACL *acl_reply = set_reply_data_size( reply->acl_len );
1566 if (acl_reply)
1567 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1568 }
1569 else set_error( STATUS_BUFFER_TOO_SMALL );
1570
1571 release_object( token );
1572 }
1573 }
1574
1575 DECL_HANDLER(set_token_default_dacl)
1576 {
1577 struct token *token;
1578
1579 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1580 TOKEN_ADJUST_DEFAULT,
1581 &token_ops )))
1582 {
1583 const ACL *acl = get_req_data();
1584 unsigned int acl_size = get_req_data_size();
1585
1586 free( token->default_dacl );
1587 token->default_dacl = NULL;
1588
1589 if (acl_size)
1590 token->default_dacl = memdup( acl, acl_size );
1591
1592 release_object( token );
1593 }
1594 }
Windows API implementation