server/token.c

   1 /*
   2  * Tokens
   3  *
   4  * Copyright (C) 1998 Alexandre Julliard
   5  * Copyright (C) 2003 Mike McCormack
   6  * Copyright (C) 2005 Robert Shearman
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #include "config.h"
  24
  25 #include <assert.h>
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28 #include <stdarg.h>
  29 #include <sys/types.h>
  30 #include <unistd.h>
  31
  32 #include "ntstatus.h"
  33 #define WIN32_NO_STATUS
  34 #include "windef.h"
  35 #include "winternl.h"
  36
  37 #include "handle.h"
  38 #include "thread.h"
  39 #include "process.h"
  40 #include "request.h"
  41 #include "security.h"
  42
  43 #define MAX_SUBAUTH_COUNT 1
  44
  45 const struct luid SeIncreaseQuotaPrivilege        = {  5, 0 };
  46 const struct luid SeTcbPrivilege                  = {  7, 0 };
  47 const struct luid SeSecurityPrivilege             = {  8, 0 };
  48 const struct luid SeTakeOwnershipPrivilege        = {  9, 0 };
  49 const struct luid SeLoadDriverPrivilege           = { 10, 0 };
  50 const struct luid SeSystemProfilePrivilege        = { 11, 0 };
  51 const struct luid SeSystemtimePrivilege           = { 12, 0 };
  52 const struct luid SeProfileSingleProcessPrivilege = { 13, 0 };
  53 const struct luid SeIncreaseBasePriorityPrivilege = { 14, 0 };
  54 const struct luid SeCreatePagefilePrivilege       = { 15, 0 };
  55 const struct luid SeBackupPrivilege               = { 17, 0 };
  56 const struct luid SeRestorePrivilege              = { 18, 0 };
  57 const struct luid SeShutdownPrivilege             = { 19, 0 };
  58 const struct luid SeDebugPrivilege                = { 20, 0 };
  59 const struct luid SeSystemEnvironmentPrivilege    = { 22, 0 };
  60 const struct luid SeChangeNotifyPrivilege         = { 23, 0 };
  61 const struct luid SeRemoteShutdownPrivilege       = { 24, 0 };
  62 const struct luid SeUndockPrivilege               = { 25, 0 };
  63 const struct luid SeManageVolumePrivilege         = { 28, 0 };
  64 const struct luid SeImpersonatePrivilege          = { 29, 0 };
  65 const struct luid SeCreateGlobalPrivilege         = { 30, 0 };
  66
  67 struct sid_attrs
  68 {
  69     const struct sid *sid;
  70     unsigned int      attrs;
  71 };
  72
  73 const struct sid world_sid = { SID_REVISION, 1, SECURITY_WORLD_SID_AUTHORITY, { SECURITY_WORLD_RID } };
  74 const struct sid local_system_sid = { SID_REVISION, 1, SECURITY_NT_AUTHORITY, { SECURITY_LOCAL_SYSTEM_RID } };
  75 const struct sid high_label_sid = { SID_REVISION, 1, SECURITY_MANDATORY_LABEL_AUTHORITY, { SECURITY_MANDATORY_HIGH_RID } };
  76 const struct sid local_user_sid = { SID_REVISION, 5, SECURITY_NT_AUTHORITY, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
  77 const struct sid builtin_admins_sid = { SID_REVISION, 2, SECURITY_NT_AUTHORITY, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
  78 const struct sid builtin_users_sid = { SID_REVISION, 2, SECURITY_NT_AUTHORITY, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
  79 const struct sid domain_users_sid = { SID_REVISION, 5, SECURITY_NT_AUTHORITY, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, DOMAIN_GROUP_RID_USERS } };
  80
  81 static const struct sid local_sid = { SID_REVISION, 1, SECURITY_LOCAL_SID_AUTHORITY, { SECURITY_LOCAL_RID } };
  82 static const struct sid interactive_sid = { SID_REVISION, 1, SECURITY_NT_AUTHORITY, { SECURITY_INTERACTIVE_RID } };
  83 static const struct sid anonymous_logon_sid = { SID_REVISION, 1, SECURITY_NT_AUTHORITY, { SECURITY_ANONYMOUS_LOGON_RID } };
  84 static const struct sid authenticated_user_sid = { SID_REVISION, 1, SECURITY_NT_AUTHORITY, { SECURITY_AUTHENTICATED_USER_RID } };
  85
  86 static struct luid prev_luid_value = { 1000, 0 };
  87
  88 static const WCHAR token_name[] = {'T','o','k','e','n'};
  89
  90 struct type_descr token_type =
  91 {
  92     { token_name, sizeof(token_name) },   /* name */
  93     TOKEN_ALL_ACCESS | SYNCHRONIZE,       /* valid_access */
  94     {                                     /* mapping */
  95         STANDARD_RIGHTS_READ | TOKEN_QUERY_SOURCE | TOKEN_QUERY | TOKEN_DUPLICATE,
  96         STANDARD_RIGHTS_WRITE | TOKEN_ADJUST_SESSIONID | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_GROUPS
  97         | TOKEN_ADJUST_PRIVILEGES,
  98         STANDARD_RIGHTS_EXECUTE | TOKEN_IMPERSONATE | TOKEN_ASSIGN_PRIMARY,
  99         TOKEN_ALL_ACCESS
 100     },
 101 };
 102
 103 struct token
 104 {
 105     struct object  obj;             /* object header */
 106     struct luid    token_id;        /* system-unique id of token */
 107     struct luid    modified_id;     /* new id allocated every time token is modified */
 108     struct list    privileges;      /* privileges available to the token */
 109     struct list    groups;          /* groups that the user of this token belongs to (sid_and_attributes) */
 110     struct sid    *user;            /* SID of user this token represents */
 111     struct sid    *owner;           /* SID of owner (points to user or one of groups) */
 112     struct sid    *primary_group;   /* SID of user's primary group (points to one of groups) */
 113     unsigned int   primary;         /* is this a primary or impersonation token? */
 114     unsigned int   session_id;      /* token session id */
 115     struct acl    *default_dacl;    /* the default DACL to assign to objects created by this user */
 116     int            impersonation_level; /* impersonation level this token is capable of if non-primary token */
 117     int            elevation;       /* elevation type */
 118 };
 119
 120 struct privilege
 121 {
 122     struct list entry;
 123     struct luid luid;
 124     unsigned    enabled  : 1; /* is the privilege currently enabled? */
 125     unsigned    def      : 1; /* is the privilege enabled by default? */
 126 };
 127
 128 struct group
 129 {
 130     struct list    entry;
 131     unsigned int   attrs;
 132     struct sid     sid;
 133 };
 134
 135 static void token_dump( struct object *obj, int verbose );
 136 static void token_destroy( struct object *obj );
 137
 138 static const struct object_ops token_ops =
 139 {
 140     sizeof(struct token),      /* size */
 141     &token_type,               /* type */
 142     token_dump,                /* dump */
 143     no_add_queue,              /* add_queue */
 144     NULL,                      /* remove_queue */
 145     NULL,                      /* signaled */
 146     NULL,                      /* satisfied */
 147     no_signal,                 /* signal */
 148     no_get_fd,                 /* get_fd */
 149     default_map_access,        /* map_access */
 150     default_get_sd,            /* get_sd */
 151     default_set_sd,            /* set_sd */
 152     no_get_full_name,          /* get_full_name */
 153     no_lookup_name,            /* lookup_name */
 154     no_link_name,              /* link_name */
 155     NULL,                      /* unlink_name */
 156     no_open_file,              /* open_file */
 157     no_kernel_obj_list,        /* get_kernel_obj_list */
 158     no_close_handle,           /* close_handle */
 159     token_destroy              /* destroy */
 160 };
 161
 162 static void token_dump( struct object *obj, int verbose )
 163 {
 164     struct token *token = (struct token *)obj;
 165     assert( obj->ops == &token_ops );
 166     fprintf( stderr, "Token id=%d.%u primary=%u impersonation level=%d\n", token->token_id.high_part,
 167              token->token_id.low_part, token->primary, token->impersonation_level );
 168 }
 169
 170 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
 171 {
 172     if (!handle)
 173     {
 174         if (thread->token)
 175             release_object( thread->token );
 176         thread->token = NULL;
 177     }
 178     else
 179     {
 180         struct token *token = (struct token *)get_handle_obj( current->process,
 181                                                               handle,
 182                                                               TOKEN_IMPERSONATE,
 183                                                               &token_ops );
 184         if (token)
 185         {
 186             if (thread->token)
 187                 release_object( thread->token );
 188             thread->token = token;
 189         }
 190     }
 191 }
 192
 193 const struct sid *security_unix_uid_to_sid( uid_t uid )
 194 {
 195     /* very simple mapping: either the current user or not the current user */
 196     if (uid == getuid())
 197         return &local_user_sid;
 198     else
 199         return &anonymous_logon_sid;
 200 }
 201
 202 static int acl_is_valid( const struct acl *acl, data_size_t size )
 203 {
 204     ULONG i;
 205     const struct ace *ace;
 206
 207     if (size < sizeof(*acl)) return FALSE;
 208
 209     size = min(size, MAX_ACL_LEN);
 210     size -= sizeof(*acl);
 211
 212     for (i = 0, ace = ace_first( acl ); i < acl->count; i++, ace = ace_next( ace ))
 213     {
 214         if (size < sizeof(*ace) || size < ace->size) return FALSE;
 215         size -= ace->size;
 216         switch (ace->type)
 217         {
 218         case ACCESS_DENIED_ACE_TYPE:
 219         case ACCESS_ALLOWED_ACE_TYPE:
 220         case SYSTEM_AUDIT_ACE_TYPE:
 221         case SYSTEM_ALARM_ACE_TYPE:
 222         case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
 223             break;
 224         default:
 225             return FALSE;
 226         }
 227         if (!sid_valid_size( (const struct sid *)(ace + 1), ace->size - sizeof(*ace) )) return FALSE;
 228     }
 229     return TRUE;
 230 }
 231
 232 static unsigned int get_sid_count( const struct sid *sid, data_size_t size )
 233 {
 234     unsigned int count;
 235
 236     for (count = 0; sid_valid_size( sid, size ); count++)
 237     {
 238         size -= sid_len( sid );
 239         sid = (const struct sid *)((char *)sid + sid_len( sid ));
 240     }
 241     return count;
 242 }
 243
 244 /* checks whether all members of a security descriptor fit inside the size
 245  * of memory specified */
 246 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
 247 {
 248     size_t offset = sizeof(struct security_descriptor);
 249     const struct sid *group;
 250     const struct sid *owner;
 251     const struct acl *sacl;
 252     const struct acl *dacl;
 253     int dummy;
 254
 255     if (size < offset)
 256         return FALSE;
 257
 258     if (sd->owner_len >= offsetof(struct sid, sub_auth[255]) || offset + sd->owner_len > size) return FALSE;
 259     owner = sd_get_owner( sd );
 260     offset += sd->owner_len;
 261     if (owner && !sid_valid_size( owner, sd->owner_len )) return FALSE;
 262
 263     if (sd->group_len >= offsetof(struct sid, sub_auth[255]) || offset + sd->group_len > size) return FALSE;
 264     group = sd_get_group( sd );
 265     offset += sd->group_len;
 266     if (group && !sid_valid_size( group, sd->group_len )) return FALSE;
 267
 268     if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
 269         return FALSE;
 270     sacl = sd_get_sacl( sd, &dummy );
 271     if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
 272         return FALSE;
 273     offset += sd->sacl_len;
 274
 275     if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
 276         return FALSE;
 277     dacl = sd_get_dacl( sd, &dummy );
 278     if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
 279         return FALSE;
 280     offset += sd->dacl_len;
 281
 282     return TRUE;
 283 }
 284
 285 /* extract security labels from SACL */
 286 struct acl *extract_security_labels( const struct acl *sacl )
 287 {
 288     size_t size = sizeof(*sacl);
 289     const struct ace *ace;
 290     struct ace *label_ace;
 291     unsigned int i, count = 0;
 292     struct acl *label_acl;
 293
 294     for (i = 0, ace = ace_first( sacl ); i < sacl->count; i++, ace = ace_next( ace ))
 295     {
 296         if (ace->type == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
 297         {
 298             size += ace->size;
 299             count++;
 300         }
 301     }
 302
 303     label_acl = mem_alloc( size );
 304     if (!label_acl) return NULL;
 305
 306     label_acl->revision = sacl->revision;
 307     label_acl->pad1     = 0;
 308     label_acl->size     = size;
 309     label_acl->count    = count;
 310     label_acl->pad2     = 0;
 311
 312     label_ace = ace_first( label_acl );
 313     for (i = 0, ace = ace_first( sacl ); i < sacl->count; i++, ace = ace_next( ace ))
 314     {
 315         if (ace->type == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
 316         {
 317             memcpy( label_ace, ace, ace->size );
 318             label_ace = ace_next( label_ace );
 319         }
 320     }
 321     return label_acl;
 322 }
 323
 324 /* replace security labels in an existing SACL */
 325 struct acl *replace_security_labels( const struct acl *old_sacl, const struct acl *new_sacl )
 326 {
 327     const struct ace *ace;
 328     struct ace *replaced_ace;
 329     unsigned int i, count = 0;
 330     unsigned char revision = ACL_REVISION;
 331     struct acl *replaced_acl;
 332     data_size_t size = sizeof(*replaced_acl);
 333
 334     if (old_sacl)
 335     {
 336         revision = max( revision, old_sacl->revision );
 337         for (i = 0, ace = ace_first( old_sacl ); i < old_sacl->count; i++, ace = ace_next( ace ))
 338         {
 339             if (ace->type == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
 340             size += ace->size;
 341             count++;
 342         }
 343     }
 344
 345     if (new_sacl)
 346     {
 347         revision = max( revision, new_sacl->revision );
 348         for (i = 0, ace = ace_first( new_sacl ); i < new_sacl->count; i++, ace = ace_next( ace ))
 349         {
 350             if (ace->type != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
 351             size += ace->size;
 352             count++;
 353         }
 354     }
 355     if (size > MAX_ACL_LEN)
 356     {
 357         set_error( STATUS_INVALID_ACL );
 358         return NULL;
 359     }
 360
 361     replaced_acl = mem_alloc( size );
 362     if (!replaced_acl) return NULL;
 363
 364     replaced_acl->revision = revision;
 365     replaced_acl->pad1     = 0;
 366     replaced_acl->size     = size;
 367     replaced_acl->count    = count;
 368     replaced_acl->pad2     = 0;
 369
 370     replaced_ace = (struct ace *)(replaced_acl + 1);
 371     if (old_sacl)
 372     {
 373         for (i = 0, ace = ace_first( old_sacl ); i < old_sacl->count; i++, ace = ace_next( ace ))
 374         {
 375             if (ace->type == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
 376             memcpy( replaced_ace, ace, ace->size );
 377             replaced_ace = ace_next( replaced_ace );
 378         }
 379     }
 380
 381     if (new_sacl)
 382     {
 383         for (i = 0, ace = ace_first( new_sacl ); i < new_sacl->count; i++, ace = ace_next( ace ))
 384         {
 385             if (ace->type != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
 386             memcpy( replaced_ace, ace, ace->size );
 387             replaced_ace = ace_next( replaced_ace );
 388         }
 389     }
 390
 391     return replaced_acl;
 392 }
 393
 394 static inline int is_equal_luid( struct luid luid1, struct luid luid2 )
 395 {
 396     return (luid1.low_part == luid2.low_part && luid1.high_part == luid2.high_part);
 397 }
 398
 399 static inline void allocate_luid( struct luid *luid )
 400 {
 401     prev_luid_value.low_part++;
 402     *luid = prev_luid_value;
 403 }
 404
 405 DECL_HANDLER( allocate_locally_unique_id )
 406 {
 407     allocate_luid( &reply->luid );
 408 }
 409
 410 static inline struct luid_attr luid_and_attr_from_privilege( const struct privilege *in )
 411 {
 412     struct luid_attr ret = { in->luid };
 413
 414     ret.attrs = (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
 415                 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
 416     return ret;
 417 }
 418
 419 static struct privilege *privilege_add( struct token *token, struct luid luid, int enabled )
 420 {
 421     struct privilege *privilege = mem_alloc( sizeof(*privilege) );
 422     if (privilege)
 423     {
 424         privilege->luid = luid;
 425         privilege->def = privilege->enabled = (enabled != 0);
 426         list_add_tail( &token->privileges, &privilege->entry );
 427     }
 428     return privilege;
 429 }
 430
 431 static inline void privilege_remove( struct privilege *privilege )
 432 {
 433     list_remove( &privilege->entry );
 434     free( privilege );
 435 }
 436
 437 static void token_destroy( struct object *obj )
 438 {
 439     struct token* token;
 440     struct list *cursor, *cursor_next;
 441
 442     assert( obj->ops == &token_ops );
 443     token = (struct token *)obj;
 444
 445     free( token->user );
 446
 447     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
 448     {
 449         struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
 450         privilege_remove( privilege );
 451     }
 452
 453     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
 454     {
 455         struct group *group = LIST_ENTRY( cursor, struct group, entry );
 456         list_remove( &group->entry );
 457         free( group );
 458     }
 459
 460     free( token->default_dacl );
 461 }
 462
 463 /* creates a new token.
 464  *  groups may be NULL if group_count is 0.
 465  *  privs may be NULL if priv_count is 0.
 466  *  default_dacl may be NULL, indicating that all objects created by the user
 467  *   are unsecured.
 468  *  modified_id may be NULL, indicating that a new modified_id luid should be
 469  *   allocated.
 470  */
 471 static struct token *create_token( unsigned int primary, unsigned int session_id, const struct sid *user,
 472                                    const struct sid_attrs *groups, unsigned int group_count,
 473                                    const struct luid_attr *privs, unsigned int priv_count,
 474                                    const struct acl *default_dacl, const struct luid *modified_id,
 475                                    int impersonation_level, int elevation )
 476 {
 477     struct token *token = alloc_object( &token_ops );
 478     if (token)
 479     {
 480         unsigned int i;
 481
 482         allocate_luid( &token->token_id );
 483         if (modified_id)
 484             token->modified_id = *modified_id;
 485         else
 486             allocate_luid( &token->modified_id );
 487         list_init( &token->privileges );
 488         list_init( &token->groups );
 489         token->primary = primary;
 490         token->session_id = session_id;
 491         /* primary tokens don't have impersonation levels */
 492         if (primary)
 493             token->impersonation_level = -1;
 494         else
 495             token->impersonation_level = impersonation_level;
 496         token->default_dacl = NULL;
 497         token->primary_group = NULL;
 498         token->elevation = elevation;
 499
 500         /* copy user */
 501         token->user = memdup( user, sid_len( user ));
 502         if (!token->user)
 503         {
 504             release_object( token );
 505             return NULL;
 506         }
 507
 508         /* copy groups */
 509         for (i = 0; i < group_count; i++)
 510         {
 511             size_t size = offsetof( struct group, sid.sub_auth[groups[i].sid->sub_count] );
 512             struct group *group = mem_alloc( size );
 513
 514             if (!group)
 515             {
 516                 release_object( token );
 517                 return NULL;
 518             }
 519             group->attrs = groups[i].attrs;
 520             copy_sid( &group->sid, groups[i].sid );
 521             list_add_tail( &token->groups, &group->entry );
 522             /* Use first owner capable group as owner and primary group */
 523             if (!token->primary_group && (group->attrs & SE_GROUP_OWNER))
 524             {
 525                 token->owner = &group->sid;
 526                 token->primary_group = &group->sid;
 527             }
 528         }
 529
 530         /* copy privileges */
 531         for (i = 0; i < priv_count; i++)
 532         {
 533             /* note: we don't check uniqueness: the caller must make sure
 534              * privs doesn't contain any duplicate luids */
 535             if (!privilege_add( token, privs[i].luid, privs[i].attrs & SE_PRIVILEGE_ENABLED ))
 536             {
 537                 release_object( token );
 538                 return NULL;
 539             }
 540         }
 541
 542         if (default_dacl)
 543         {
 544             token->default_dacl = memdup( default_dacl, default_dacl->size );
 545             if (!token->default_dacl)
 546             {
 547                 release_object( token );
 548                 return NULL;
 549             }
 550         }
 551     }
 552     return token;
 553 }
 554
 555 static int filter_group( struct group *group, const struct sid *filter, unsigned int count )
 556 {
 557     unsigned int i;
 558
 559     for (i = 0; i < count; i++)
 560     {
 561         if (equal_sid( &group->sid, filter )) return 1;
 562         filter = (const struct sid *)((char *)filter + sid_len( filter ));
 563     }
 564
 565     return 0;
 566 }
 567
 568 static int filter_privilege( struct privilege *privilege, const struct luid_attr *filter, unsigned int count )
 569 {
 570     unsigned int i;
 571
 572     for (i = 0; i < count; i++)
 573         if (is_equal_luid( privilege->luid, filter[i].luid )) return 1;
 574
 575     return 0;
 576 }
 577
 578 struct token *token_duplicate( struct token *src_token, unsigned primary,
 579                                int impersonation_level, const struct security_descriptor *sd,
 580                                const struct luid_attr *remove_privs, unsigned int remove_priv_count,
 581                                const struct sid *remove_groups, unsigned int remove_group_count)
 582 {
 583     const struct luid *modified_id =
 584         primary || (impersonation_level == src_token->impersonation_level) ?
 585             &src_token->modified_id : NULL;
 586     struct token *token = NULL;
 587     struct privilege *privilege;
 588     struct group *group;
 589
 590     if (!primary &&
 591         (impersonation_level < SecurityAnonymous ||
 592          impersonation_level > SecurityDelegation ||
 593          (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
 594     {
 595         set_error( STATUS_BAD_IMPERSONATION_LEVEL );
 596         return NULL;
 597     }
 598
 599     token = create_token( primary, src_token->session_id, src_token->user, NULL, 0,
 600                           NULL, 0, src_token->default_dacl, modified_id,
 601                           impersonation_level, src_token->elevation );
 602     if (!token) return token;
 603
 604     /* copy groups */
 605     token->primary_group = NULL;
 606     LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
 607     {
 608         size_t size = offsetof( struct group, sid.sub_auth[group->sid.sub_count] );
 609         struct group *newgroup = mem_alloc( size );
 610         if (!newgroup)
 611         {
 612             release_object( token );
 613             return NULL;
 614         }
 615         memcpy( newgroup, group, size );
 616         if (filter_group( group, remove_groups, remove_group_count ))
 617         {
 618             newgroup->attrs &= ~(SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT);
 619             newgroup->attrs |= SE_GROUP_USE_FOR_DENY_ONLY;
 620         }
 621         list_add_tail( &token->groups, &newgroup->entry );
 622         if (src_token->primary_group == &group->sid)
 623         {
 624             token->owner = &newgroup->sid;
 625             token->primary_group = &newgroup->sid;
 626         }
 627     }
 628     assert( token->primary_group );
 629
 630     /* copy privileges */
 631     LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
 632     {
 633         if (filter_privilege( privilege, remove_privs, remove_priv_count )) continue;
 634         if (!privilege_add( token, privilege->luid, privilege->enabled ))
 635         {
 636             release_object( token );
 637             return NULL;
 638         }
 639     }
 640
 641     if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
 642                             DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
 643
 644     return token;
 645 }
 646
 647 static struct acl *create_default_dacl( const struct sid *user )
 648 {
 649     struct ace *ace;
 650     struct acl *default_dacl;
 651     size_t default_dacl_size = sizeof(*default_dacl) + 2 * sizeof(*ace) +
 652                                sid_len( &local_system_sid ) + sid_len( user );
 653
 654     default_dacl = mem_alloc( default_dacl_size );
 655     if (!default_dacl) return NULL;
 656
 657     default_dacl->revision = ACL_REVISION;
 658     default_dacl->pad1     = 0;
 659     default_dacl->size     = default_dacl_size;
 660     default_dacl->count    = 2;
 661     default_dacl->pad2     = 0;
 662
 663     /* GENERIC_ALL for Local System */
 664     ace = set_ace( ace_first( default_dacl ), &local_system_sid, ACCESS_ALLOWED_ACE_TYPE, 0, GENERIC_ALL );
 665     /* GENERIC_ALL for specified user */
 666     set_ace( ace_next( ace ), user, ACCESS_ALLOWED_ACE_TYPE, 0, GENERIC_ALL );
 667
 668     return default_dacl;
 669 }
 670
 671 struct sid_data
 672 {
 673     SID_IDENTIFIER_AUTHORITY idauth;
 674     int count;
 675     unsigned int subauth[MAX_SUBAUTH_COUNT];
 676 };
 677
 678 static struct security_descriptor *create_security_label_sd( struct token *token, const struct sid *label_sid )
 679 {
 680     size_t sid_size = sid_len( label_sid ), sacl_size, sd_size;
 681     struct security_descriptor *sd;
 682     struct acl *sacl;
 683
 684     sacl_size = sizeof(*sacl) + sizeof(struct ace) + sid_size;
 685     sd_size = sizeof(struct security_descriptor) + sacl_size;
 686     if (!(sd = mem_alloc( sd_size )))
 687         return NULL;
 688
 689     sd->control   = SE_SACL_PRESENT;
 690     sd->owner_len = 0;
 691     sd->group_len = 0;
 692     sd->sacl_len  = sacl_size;
 693     sd->dacl_len  = 0;
 694
 695     sacl = (struct acl *)(sd + 1);
 696     sacl->revision = ACL_REVISION;
 697     sacl->pad1     = 0;
 698     sacl->size     = sacl_size;
 699     sacl->count    = 1;
 700     sacl->pad2     = 0;
 701
 702     set_ace( ace_first( sacl ), label_sid, SYSTEM_MANDATORY_LABEL_ACE_TYPE, 0,
 703              SYSTEM_MANDATORY_LABEL_NO_WRITE_UP );
 704     assert( sd_is_valid( sd, sd_size ) );
 705     return sd;
 706 }
 707
 708 int token_assign_label( struct token *token, const struct sid *label )
 709 {
 710     struct security_descriptor *sd;
 711     int ret = 0;
 712
 713     if ((sd = create_security_label_sd( token, label )))
 714     {
 715         ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
 716         free( sd );
 717     }
 718
 719     return ret;
 720 }
 721
 722 struct token *get_token_obj( struct process *process, obj_handle_t handle, unsigned int access )
 723 {
 724     return (struct token *)get_handle_obj( process, handle, access, &token_ops );
 725 }
 726
 727 struct token *token_create_admin( unsigned primary, int impersonation_level, int elevation, unsigned int session_id )
 728 {
 729     struct token *token = NULL;
 730     struct sid alias_admins_sid = { SID_REVISION, 2, SECURITY_NT_AUTHORITY, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS }};
 731     struct sid alias_users_sid = { SID_REVISION, 2, SECURITY_NT_AUTHORITY, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS }};
 732     /* on Windows, this value changes every time the user logs on */
 733     struct sid logon_sid = { SID_REVISION, 3, SECURITY_NT_AUTHORITY, { SECURITY_LOGON_IDS_RID, 0, 0 /* FIXME: should be randomly generated when tokens are inherited by new processes */ }};
 734     const struct sid *user_sid = security_unix_uid_to_sid( getuid() );
 735     struct acl *default_dacl = create_default_dacl( &domain_users_sid );
 736     const struct luid_attr admin_privs[] =
 737     {
 738         { SeChangeNotifyPrivilege, SE_PRIVILEGE_ENABLED },
 739         { SeTcbPrivilege, 0 },
 740         { SeSecurityPrivilege, 0 },
 741         { SeBackupPrivilege, 0 },
 742         { SeRestorePrivilege, 0 },
 743         { SeSystemtimePrivilege, 0 },
 744         { SeShutdownPrivilege, 0 },
 745         { SeRemoteShutdownPrivilege, 0 },
 746         { SeTakeOwnershipPrivilege, 0 },
 747         { SeDebugPrivilege, 0 },
 748         { SeSystemEnvironmentPrivilege, 0 },
 749         { SeSystemProfilePrivilege, 0 },
 750         { SeProfileSingleProcessPrivilege, 0 },
 751         { SeIncreaseBasePriorityPrivilege, 0 },
 752         { SeLoadDriverPrivilege, SE_PRIVILEGE_ENABLED },
 753         { SeCreatePagefilePrivilege, 0 },
 754         { SeIncreaseQuotaPrivilege, 0 },
 755         { SeUndockPrivilege, 0 },
 756         { SeManageVolumePrivilege, 0 },
 757         { SeImpersonatePrivilege, SE_PRIVILEGE_ENABLED },
 758         { SeCreateGlobalPrivilege, SE_PRIVILEGE_ENABLED },
 759     };
 760     /* note: we don't include non-builtin groups here for the user -
 761      * telling us these is the job of a client-side program */
 762     const struct sid_attrs admin_groups[] =
 763     {
 764         { &world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 765         { &local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 766         { &interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 767         { &authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 768         { &domain_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
 769         { &alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
 770         { &alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 771         { &logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
 772     };
 773
 774     token = create_token( primary, session_id, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
 775                           admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
 776                           NULL, impersonation_level, elevation );
 777     /* we really need a primary group */
 778     assert( token->primary_group );
 779
 780     free( default_dacl );
 781     return token;
 782 }
 783
 784 static struct privilege *token_find_privilege( struct token *token, struct luid luid, int enabled_only )
 785 {
 786     struct privilege *privilege;
 787     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 788     {
 789         if (is_equal_luid( luid, privilege->luid ))
 790         {
 791             if (enabled_only && !privilege->enabled)
 792                 return NULL;
 793             return privilege;
 794         }
 795     }
 796     return NULL;
 797 }
 798
 799 static unsigned int token_adjust_privileges( struct token *token, const struct luid_attr *privs,
 800                                              unsigned int count, struct luid_attr *mod_privs,
 801                                              unsigned int mod_privs_count )
 802 {
 803     unsigned int i, modified_count = 0;
 804
 805     /* mark as modified */
 806     allocate_luid( &token->modified_id );
 807
 808     for (i = 0; i < count; i++)
 809     {
 810         struct privilege *privilege = token_find_privilege( token, privs[i].luid, FALSE );
 811         if (!privilege)
 812         {
 813             set_error( STATUS_NOT_ALL_ASSIGNED );
 814             continue;
 815         }
 816
 817         if (privs[i].attrs & SE_PRIVILEGE_REMOVED) privilege_remove( privilege );
 818         else
 819         {
 820             /* save previous state for caller */
 821             if (mod_privs_count)
 822             {
 823                 *mod_privs++ = luid_and_attr_from_privilege( privilege );
 824                 mod_privs_count--;
 825                 modified_count++;
 826             }
 827             privilege->enabled = !!(privs[i].attrs & SE_PRIVILEGE_ENABLED);
 828         }
 829     }
 830     return modified_count;
 831 }
 832
 833 static void token_disable_privileges( struct token *token )
 834 {
 835     struct privilege *privilege;
 836
 837     /* mark as modified */
 838     allocate_luid( &token->modified_id );
 839
 840     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 841         privilege->enabled = FALSE;
 842 }
 843
 844 int token_check_privileges( struct token *token, int all_required, const struct luid_attr *reqprivs,
 845                             unsigned int count, struct luid_attr *usedprivs)
 846 {
 847     unsigned int i, enabled_count = 0;
 848
 849     for (i = 0; i < count; i++)
 850     {
 851         struct privilege *privilege = token_find_privilege( token, reqprivs[i].luid, TRUE );
 852
 853         if (usedprivs)
 854             usedprivs[i] = reqprivs[i];
 855
 856         if (privilege && privilege->enabled)
 857         {
 858             enabled_count++;
 859             if (usedprivs) usedprivs[i].attrs |= SE_PRIVILEGE_USED_FOR_ACCESS;
 860         }
 861     }
 862
 863     if (all_required)
 864         return (enabled_count == count);
 865     else
 866         return (enabled_count > 0);
 867 }
 868
 869 int token_sid_present( struct token *token, const struct sid *sid, int deny )
 870 {
 871     struct group *group;
 872
 873     if (equal_sid( token->user, sid )) return TRUE;
 874
 875     LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
 876     {
 877         if (!(group->attrs & SE_GROUP_ENABLED)) continue;
 878         if (!deny && (group->attrs & SE_GROUP_USE_FOR_DENY_ONLY)) continue;
 879         if (equal_sid( &group->sid, sid )) return TRUE;
 880     }
 881
 882     return FALSE;
 883 }
 884
 885 /* Checks access to a security descriptor. 'sd' must have been validated by
 886  * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
 887  * the reason. 'status' parameter will indicate if access is granted or denied.
 888  *
 889  * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
 890  */
 891 static unsigned int token_access_check( struct token *token,
 892                                  const struct security_descriptor *sd,
 893                                  unsigned int desired_access,
 894                                  struct luid_attr *privs,
 895                                  unsigned int *priv_count,
 896                                  const generic_map_t *mapping,
 897                                  unsigned int *granted_access,
 898                                  unsigned int *status )
 899 {
 900     unsigned int current_access = 0;
 901     unsigned int denied_access = 0;
 902     ULONG i;
 903     const struct acl *dacl;
 904     int dacl_present;
 905     const struct ace *ace;
 906     const struct sid *owner;
 907
 908     /* assume no access rights */
 909     *granted_access = 0;
 910
 911     /* fail if desired_access contains generic rights */
 912     if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
 913     {
 914         if (priv_count) *priv_count = 0;
 915         return STATUS_GENERIC_NOT_MAPPED;
 916     }
 917
 918     dacl = sd_get_dacl( sd, &dacl_present );
 919     owner = sd_get_owner( sd );
 920     if (!owner || !sd_get_group( sd ))
 921     {
 922         if (priv_count) *priv_count = 0;
 923         return STATUS_INVALID_SECURITY_DESCR;
 924     }
 925
 926     /* 1: Grant desired access if the object is unprotected */
 927     if (!dacl_present || !dacl)
 928     {
 929         if (priv_count) *priv_count = 0;
 930         if (desired_access & MAXIMUM_ALLOWED)
 931             *granted_access = mapping->all;
 932         else
 933             *granted_access = desired_access;
 934         return *status = STATUS_SUCCESS;
 935     }
 936
 937     /* 2: Check if caller wants access to system security part. Note: access
 938      * is only granted if specifically asked for */
 939     if (desired_access & ACCESS_SYSTEM_SECURITY)
 940     {
 941         const struct luid_attr security_priv = { SeSecurityPrivilege, 0 };
 942         struct luid_attr retpriv = security_priv;
 943         if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
 944         {
 945             if (priv_count)
 946             {
 947                 /* assumes that there will only be one privilege to return */
 948                 if (*priv_count >= 1)
 949                 {
 950                     *priv_count = 1;
 951                     *privs = retpriv;
 952                 }
 953                 else
 954                 {
 955                     *priv_count = 1;
 956                     return STATUS_BUFFER_TOO_SMALL;
 957                 }
 958             }
 959             current_access |= ACCESS_SYSTEM_SECURITY;
 960             if (desired_access == current_access)
 961             {
 962                 *granted_access = current_access;
 963                 return *status = STATUS_SUCCESS;
 964             }
 965         }
 966         else
 967         {
 968             if (priv_count) *priv_count = 0;
 969             *status = STATUS_PRIVILEGE_NOT_HELD;
 970             return STATUS_SUCCESS;
 971         }
 972     }
 973     else if (priv_count) *priv_count = 0;
 974
 975     /* 3: Check whether the token is the owner */
 976     /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
 977      * checked when a "set owner" call is made, overriding the access rights
 978      * determined here. */
 979     if (token_sid_present( token, owner, FALSE ))
 980     {
 981         current_access |= (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE);
 982         if (desired_access == current_access)
 983         {
 984             *granted_access = current_access;
 985             return *status = STATUS_SUCCESS;
 986         }
 987     }
 988
 989     /* 4: Grant rights according to the DACL */
 990     for (i = 0, ace = ace_first( dacl ); i < dacl->count; i++, ace = ace_next( ace ))
 991     {
 992         const struct sid *sid = (const struct sid *)(ace + 1);
 993
 994         if (ace->flags & INHERIT_ONLY_ACE) continue;
 995
 996         switch (ace->type)
 997         {
 998         case ACCESS_DENIED_ACE_TYPE:
 999             if (token_sid_present( token, sid, TRUE ))
1000             {
1001                 unsigned int access = map_access( ace->mask, mapping );
1002                 if (desired_access & MAXIMUM_ALLOWED)
1003                     denied_access |= access;
1004                 else
1005                 {
1006                     denied_access |= (access & ~current_access);
1007                     if (desired_access & access) goto done;
1008                 }
1009             }
1010             break;
1011         case ACCESS_ALLOWED_ACE_TYPE:
1012             if (token_sid_present( token, sid, FALSE ))
1013             {
1014                 unsigned int access = map_access( ace->mask, mapping );
1015                 if (desired_access & MAXIMUM_ALLOWED)
1016                     current_access |= access;
1017                 else
1018                     current_access |= (access & ~denied_access);
1019             }
1020             break;
1021         }
1022
1023         /* don't bother carrying on checking if we've already got all of
1024             * rights we need */
1025         if (desired_access == *granted_access)
1026             break;
1027     }
1028
1029 done:
1030     if (desired_access & MAXIMUM_ALLOWED)
1031         *granted_access = current_access & ~denied_access;
1032     else
1033         if ((current_access & desired_access) == desired_access)
1034             *granted_access = current_access & desired_access;
1035         else
1036             *granted_access = 0;
1037
1038     *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1039     return STATUS_SUCCESS;
1040 }
1041
1042 const struct acl *token_get_default_dacl( struct token *token )
1043 {
1044     return token->default_dacl;
1045 }
1046
1047 const struct sid *token_get_owner( struct token *token )
1048 {
1049     return token->owner;
1050 }
1051
1052 const struct sid *token_get_primary_group( struct token *token )
1053 {
1054     return token->primary_group;
1055 }
1056
1057 unsigned int token_get_session_id( struct token *token )
1058 {
1059     return token->session_id;
1060 }
1061
1062 int check_object_access(struct token *token, struct object *obj, unsigned int *access)
1063 {
1064     generic_map_t mapping;
1065     unsigned int status;
1066     int res;
1067
1068     if (!token)
1069         token = current->token ? current->token : current->process->token;
1070
1071     mapping.all = obj->ops->map_access( obj, GENERIC_ALL );
1072
1073     if (!obj->sd)
1074     {
1075         if (*access & MAXIMUM_ALLOWED) *access = mapping.all;
1076         return TRUE;
1077     }
1078
1079     mapping.read  = obj->ops->map_access( obj, GENERIC_READ );
1080     mapping.write = obj->ops->map_access( obj, GENERIC_WRITE );
1081     mapping.exec = obj->ops->map_access( obj, GENERIC_EXECUTE );
1082
1083     res = token_access_check( token, obj->sd, *access, NULL, NULL,
1084                               &mapping, access, &status ) == STATUS_SUCCESS &&
1085           status == STATUS_SUCCESS;
1086
1087     if (!res) set_error( STATUS_ACCESS_DENIED );
1088     return res;
1089 }
1090
1091
1092 /* open a security token */
1093 DECL_HANDLER(open_token)
1094 {
1095     if (req->flags & OPEN_TOKEN_THREAD)
1096     {
1097         struct thread *thread = get_thread_from_handle( req->handle, 0 );
1098         if (thread)
1099         {
1100             if (thread->token)
1101             {
1102                 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1103                     set_error( STATUS_CANT_OPEN_ANONYMOUS );
1104                 else
1105                     reply->token = alloc_handle( current->process, thread->token,
1106                                                  req->access, req->attributes );
1107             }
1108             else
1109                 set_error( STATUS_NO_TOKEN );
1110             release_object( thread );
1111         }
1112     }
1113     else
1114     {
1115         struct process *process = get_process_from_handle( req->handle, 0 );
1116         if (process)
1117         {
1118             if (process->token)
1119                 reply->token = alloc_handle( current->process, process->token, req->access,
1120                                              req->attributes );
1121             else
1122                 set_error( STATUS_NO_TOKEN );
1123             release_object( process );
1124         }
1125     }
1126 }
1127
1128 /* adjust the privileges held by a token */
1129 DECL_HANDLER(adjust_token_privileges)
1130 {
1131     struct token *token;
1132     unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1133
1134     if (req->get_modified_state) access |= TOKEN_QUERY;
1135
1136     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1137                                                  access, &token_ops )))
1138     {
1139         const struct luid_attr *privs = get_req_data();
1140         struct luid_attr *modified_privs = NULL;
1141         unsigned int priv_count = get_req_data_size() / sizeof(*privs);
1142         unsigned int modified_priv_count = 0;
1143
1144         if (req->get_modified_state && !req->disable_all)
1145         {
1146             unsigned int i;
1147             /* count modified privs */
1148             for (i = 0; i < priv_count; i++)
1149             {
1150                 struct privilege *privilege = token_find_privilege( token, privs[i].luid, FALSE );
1151                 if (privilege && req->get_modified_state)
1152                     modified_priv_count++;
1153             }
1154             reply->len = modified_priv_count;
1155             modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1156             if (modified_priv_count)
1157                 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1158         }
1159         reply->len = modified_priv_count * sizeof(*modified_privs);
1160
1161         if (req->disable_all)
1162             token_disable_privileges( token );
1163         else
1164             token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
1165
1166         release_object( token );
1167     }
1168 }
1169
1170 /* retrieves the list of privileges that may be held be the token */
1171 DECL_HANDLER(get_token_privileges)
1172 {
1173     struct token *token;
1174
1175     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1176                                                  TOKEN_QUERY,
1177                                                  &token_ops )))
1178     {
1179         int priv_count = 0;
1180         struct luid_attr *privs;
1181         struct privilege *privilege;
1182
1183         LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1184             priv_count++;
1185
1186         reply->len = priv_count * sizeof(*privs);
1187         if (reply->len <= get_reply_max_size())
1188         {
1189             privs = set_reply_data_size( priv_count * sizeof(*privs) );
1190             if (privs)
1191                 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1192                     *privs++ = luid_and_attr_from_privilege( privilege );
1193         }
1194         else
1195             set_error(STATUS_BUFFER_TOO_SMALL);
1196
1197         release_object( token );
1198     }
1199 }
1200
1201 /* creates a duplicate of the token */
1202 DECL_HANDLER(duplicate_token)
1203 {
1204     struct token *src_token;
1205     struct unicode_str name;
1206     const struct security_descriptor *sd;
1207     const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
1208
1209     if (!objattr) return;
1210
1211     if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1212                                                      TOKEN_DUPLICATE,
1213                                                      &token_ops )))
1214     {
1215         struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd, NULL, 0, NULL, 0 );
1216         if (token)
1217         {
1218             unsigned int access = req->access ? req->access : get_handle_access( current->process, req->handle );
1219             reply->new_handle = alloc_handle_no_access_check( current->process, token, access, objattr->attributes );
1220             release_object( token );
1221         }
1222         release_object( src_token );
1223     }
1224 }
1225
1226 /* creates a restricted version of a token */
1227 DECL_HANDLER(filter_token)
1228 {
1229     struct token *src_token;
1230
1231     if ((src_token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_DUPLICATE, &token_ops )))
1232     {
1233         const struct luid_attr *filter_privileges = get_req_data();
1234         unsigned int priv_count, group_count;
1235         const struct sid *filter_groups;
1236         struct token *token;
1237
1238         priv_count = min( req->privileges_size, get_req_data_size() ) / sizeof(struct luid_attr);
1239         filter_groups = (const struct sid *)((char *)filter_privileges + priv_count * sizeof(struct luid_attr));
1240         group_count = get_sid_count( filter_groups, get_req_data_size() - priv_count * sizeof(struct luid_attr) );
1241
1242         token = token_duplicate( src_token, src_token->primary, src_token->impersonation_level, NULL,
1243                                  filter_privileges, priv_count, filter_groups, group_count );
1244         if (token)
1245         {
1246             unsigned int access = get_handle_access( current->process, req->handle );
1247             reply->new_handle = alloc_handle_no_access_check( current->process, token, access, 0 );
1248             release_object( token );
1249         }
1250         release_object( src_token );
1251     }
1252 }
1253
1254 /* checks the specified privileges are held by the token */
1255 DECL_HANDLER(check_token_privileges)
1256 {
1257     struct token *token;
1258
1259     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1260                                                  TOKEN_QUERY,
1261                                                  &token_ops )))
1262     {
1263         unsigned int count = get_req_data_size() / sizeof(struct luid_attr);
1264
1265         if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1266             set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1267         else if (get_reply_max_size() >= count * sizeof(struct luid_attr))
1268         {
1269             struct luid_attr *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1270             reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1271         }
1272         else
1273             set_error( STATUS_BUFFER_OVERFLOW );
1274         release_object( token );
1275     }
1276 }
1277
1278 /* checks that a user represented by a token is allowed to access an object
1279  * represented by a security descriptor */
1280 DECL_HANDLER(access_check)
1281 {
1282     data_size_t sd_size = get_req_data_size();
1283     const struct security_descriptor *sd = get_req_data();
1284     struct token *token;
1285
1286     if (!sd_is_valid( sd, sd_size ))
1287     {
1288         set_error( STATUS_ACCESS_VIOLATION );
1289         return;
1290     }
1291
1292     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1293                                                  TOKEN_QUERY,
1294                                                  &token_ops )))
1295     {
1296         unsigned int status;
1297         struct luid_attr priv;
1298         unsigned int priv_count = 1;
1299
1300         memset(&priv, 0, sizeof(priv));
1301
1302         /* only impersonation tokens may be used with this function */
1303         if (token->primary)
1304         {
1305             set_error( STATUS_NO_IMPERSONATION_TOKEN );
1306             release_object( token );
1307             return;
1308         }
1309         /* anonymous impersonation tokens can't be used */
1310         if (token->impersonation_level <= SecurityAnonymous)
1311         {
1312             set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1313             release_object( token );
1314             return;
1315         }
1316
1317         status = token_access_check( token, sd, req->desired_access, &priv, &priv_count, &req->mapping,
1318                                      &reply->access_granted, &reply->access_status );
1319
1320         reply->privileges_len = priv_count*sizeof(struct luid_attr);
1321
1322         if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1323         {
1324             struct luid_attr *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1325             memcpy( privs, &priv, sizeof(priv) );
1326         }
1327
1328         set_error( status );
1329         release_object( token );
1330     }
1331 }
1332
1333 /* retrieves an SID from the token */
1334 DECL_HANDLER(get_token_sid)
1335 {
1336     struct token *token;
1337
1338     reply->sid_len = 0;
1339
1340     if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1341     {
1342         const struct sid *sid = NULL;
1343
1344         switch (req->which_sid)
1345         {
1346         case TokenUser:
1347             assert(token->user);
1348             sid = token->user;
1349             break;
1350         case TokenPrimaryGroup:
1351             sid = token->primary_group;
1352             break;
1353         case TokenOwner:
1354             sid = token->owner;
1355             break;
1356         default:
1357             set_error( STATUS_INVALID_PARAMETER );
1358             break;
1359         }
1360
1361         if (sid)
1362         {
1363             reply->sid_len = sid_len( sid );
1364             if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1365             else set_error( STATUS_BUFFER_TOO_SMALL );
1366         }
1367         release_object( token );
1368     }
1369 }
1370
1371 /* retrieves the groups that the user represented by the token belongs to */
1372 DECL_HANDLER(get_token_groups)
1373 {
1374     struct token *token;
1375
1376     if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1377     {
1378         unsigned int group_count = 0;
1379         const struct group *group;
1380
1381         LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1382         {
1383             if (req->attr_mask && !(group->attrs & req->attr_mask)) continue;
1384             group_count++;
1385             reply->sid_len += sid_len( &group->sid );
1386         }
1387         reply->attr_len = sizeof(unsigned int) * group_count;
1388
1389         if (reply->attr_len + reply->sid_len <= get_reply_max_size())
1390         {
1391             unsigned int *attr_ptr = set_reply_data_size( reply->attr_len + reply->sid_len );
1392             struct sid *sid = (struct sid *)(attr_ptr + group_count);
1393
1394             if (attr_ptr)
1395             {
1396                 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1397                 {
1398                     if (req->attr_mask && !(group->attrs & req->attr_mask)) continue;
1399                     sid = copy_sid( sid, &group->sid );
1400                     *attr_ptr++ = group->attrs;
1401                 }
1402             }
1403         }
1404         else set_error( STATUS_BUFFER_TOO_SMALL );
1405
1406         release_object( token );
1407     }
1408 }
1409
1410 DECL_HANDLER(get_token_info)
1411 {
1412     struct token *token;
1413
1414     if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1415     {
1416         reply->token_id = token->token_id;
1417         reply->modified_id = token->modified_id;
1418         reply->session_id = token->session_id;
1419         reply->primary = token->primary;
1420         reply->impersonation_level = token->impersonation_level;
1421         reply->elevation = token->elevation;
1422         reply->group_count = list_count( &token->groups );
1423         reply->privilege_count = list_count( &token->privileges );
1424         release_object( token );
1425     }
1426 }
1427
1428 DECL_HANDLER(get_token_default_dacl)
1429 {
1430     struct token *token;
1431
1432     reply->acl_len = 0;
1433
1434     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1435                                                  TOKEN_QUERY,
1436                                                  &token_ops )))
1437     {
1438         if (token->default_dacl)
1439             reply->acl_len = token->default_dacl->size;
1440
1441         if (reply->acl_len <= get_reply_max_size())
1442         {
1443             struct acl *acl_reply = set_reply_data_size( reply->acl_len );
1444             if (acl_reply)
1445                 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1446         }
1447         else set_error( STATUS_BUFFER_TOO_SMALL );
1448
1449         release_object( token );
1450     }
1451 }
1452
1453 DECL_HANDLER(set_token_default_dacl)
1454 {
1455     struct token *token;
1456     const struct acl *acl = get_req_data();
1457     unsigned int acl_size = get_req_data_size();
1458
1459     if (acl_size && !acl_is_valid( acl, acl_size ))
1460     {
1461         set_error( STATUS_INVALID_ACL );
1462         return;
1463     }
1464
1465     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1466                                                  TOKEN_ADJUST_DEFAULT,
1467                                                  &token_ops )))
1468     {
1469         free( token->default_dacl );
1470         token->default_dacl = NULL;
1471
1472         if (acl_size)
1473             token->default_dacl = memdup( acl, acl_size );
1474
1475         release_object( token );
1476     }
1477 }
1478
1479 DECL_HANDLER(create_linked_token)
1480 {
1481     struct token *token, *linked;
1482     int elevation;
1483
1484     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1485                                                  TOKEN_QUERY, &token_ops )))
1486     {
1487         switch (token->elevation)
1488         {
1489         case TokenElevationTypeFull:
1490             elevation = TokenElevationTypeLimited;
1491             break;
1492         case TokenElevationTypeLimited:
1493             elevation = TokenElevationTypeFull;
1494             break;
1495         default:
1496             release_object( token );
1497             return;
1498         }
1499         if ((linked = token_create_admin( FALSE, SecurityIdentification, elevation, token->session_id )))
1500         {
1501             reply->linked = alloc_handle( current->process, linked, TOKEN_ALL_ACCESS, 0 );
1502             release_object( linked );
1503         }
1504         release_object( token );
1505     }
1506 }