4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
29 #include <sys/types.h>
33 #define WIN32_NO_STATUS
43 #define MAX_SUBAUTH_COUNT 1
45 const struct luid SeIncreaseQuotaPrivilege
= { 5, 0 };
46 const struct luid SeTcbPrivilege
= { 7, 0 };
47 const struct luid SeSecurityPrivilege
= { 8, 0 };
48 const struct luid SeTakeOwnershipPrivilege
= { 9, 0 };
49 const struct luid SeLoadDriverPrivilege
= { 10, 0 };
50 const struct luid SeSystemProfilePrivilege
= { 11, 0 };
51 const struct luid SeSystemtimePrivilege
= { 12, 0 };
52 const struct luid SeProfileSingleProcessPrivilege
= { 13, 0 };
53 const struct luid SeIncreaseBasePriorityPrivilege
= { 14, 0 };
54 const struct luid SeCreatePagefilePrivilege
= { 15, 0 };
55 const struct luid SeBackupPrivilege
= { 17, 0 };
56 const struct luid SeRestorePrivilege
= { 18, 0 };
57 const struct luid SeShutdownPrivilege
= { 19, 0 };
58 const struct luid SeDebugPrivilege
= { 20, 0 };
59 const struct luid SeSystemEnvironmentPrivilege
= { 22, 0 };
60 const struct luid SeChangeNotifyPrivilege
= { 23, 0 };
61 const struct luid SeRemoteShutdownPrivilege
= { 24, 0 };
62 const struct luid SeUndockPrivilege
= { 25, 0 };
63 const struct luid SeManageVolumePrivilege
= { 28, 0 };
64 const struct luid SeImpersonatePrivilege
= { 29, 0 };
65 const struct luid SeCreateGlobalPrivilege
= { 30, 0 };
67 #define SID_N(n) struct /* same fields as struct SID */ \
70 BYTE SubAuthorityCount; \
71 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
72 DWORD SubAuthority[n]; \
75 static const SID world_sid
= { SID_REVISION
, 1, { SECURITY_WORLD_SID_AUTHORITY
}, { SECURITY_WORLD_RID
} };
76 static const SID local_sid
= { SID_REVISION
, 1, { SECURITY_LOCAL_SID_AUTHORITY
}, { SECURITY_LOCAL_RID
} };
77 static const SID interactive_sid
= { SID_REVISION
, 1, { SECURITY_NT_AUTHORITY
}, { SECURITY_INTERACTIVE_RID
} };
78 static const SID anonymous_logon_sid
= { SID_REVISION
, 1, { SECURITY_NT_AUTHORITY
}, { SECURITY_ANONYMOUS_LOGON_RID
} };
79 static const SID authenticated_user_sid
= { SID_REVISION
, 1, { SECURITY_NT_AUTHORITY
}, { SECURITY_AUTHENTICATED_USER_RID
} };
80 static const SID local_system_sid
= { SID_REVISION
, 1, { SECURITY_NT_AUTHORITY
}, { SECURITY_LOCAL_SYSTEM_RID
} };
81 static const SID high_label_sid
= { SID_REVISION
, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY
}, { SECURITY_MANDATORY_HIGH_RID
} };
82 static const SID_N(5) local_user_sid
= { SID_REVISION
, 5, { SECURITY_NT_AUTHORITY
}, { SECURITY_NT_NON_UNIQUE
, 0, 0, 0, 1000 } };
83 static const SID_N(2) builtin_admins_sid
= { SID_REVISION
, 2, { SECURITY_NT_AUTHORITY
}, { SECURITY_BUILTIN_DOMAIN_RID
, DOMAIN_ALIAS_RID_ADMINS
} };
84 static const SID_N(2) builtin_users_sid
= { SID_REVISION
, 2, { SECURITY_NT_AUTHORITY
}, { SECURITY_BUILTIN_DOMAIN_RID
, DOMAIN_ALIAS_RID_USERS
} };
85 static const SID_N(3) builtin_logon_sid
= { SID_REVISION
, 3, { SECURITY_NT_AUTHORITY
}, { SECURITY_LOGON_IDS_RID
, 0, 0 } };
86 static const SID_N(5) domain_users_sid
= { SID_REVISION
, 5, { SECURITY_NT_AUTHORITY
}, { SECURITY_NT_NON_UNIQUE
, 0, 0, 0, DOMAIN_GROUP_RID_USERS
} };
88 const PSID security_world_sid
= (PSID
)&world_sid
;
89 static const PSID security_local_sid
= (PSID
)&local_sid
;
90 static const PSID security_interactive_sid
= (PSID
)&interactive_sid
;
91 static const PSID security_authenticated_user_sid
= (PSID
)&authenticated_user_sid
;
92 const PSID security_local_system_sid
= (PSID
)&local_system_sid
;
93 const PSID security_local_user_sid
= (PSID
)&local_user_sid
;
94 const PSID security_builtin_admins_sid
= (PSID
)&builtin_admins_sid
;
95 const PSID security_builtin_users_sid
= (PSID
)&builtin_users_sid
;
96 const PSID security_domain_users_sid
= (PSID
)&domain_users_sid
;
97 const PSID security_high_label_sid
= (PSID
)&high_label_sid
;
99 static struct luid prev_luid_value
= { 1000, 0 };
101 static const WCHAR token_name
[] = {'T','o','k','e','n'};
103 struct type_descr token_type
=
105 { token_name
, sizeof(token_name
) }, /* name */
106 TOKEN_ALL_ACCESS
| SYNCHRONIZE
, /* valid_access */
108 STANDARD_RIGHTS_READ
| TOKEN_QUERY_SOURCE
| TOKEN_QUERY
| TOKEN_DUPLICATE
,
109 STANDARD_RIGHTS_WRITE
| TOKEN_ADJUST_SESSIONID
| TOKEN_ADJUST_DEFAULT
| TOKEN_ADJUST_GROUPS
110 | TOKEN_ADJUST_PRIVILEGES
,
111 STANDARD_RIGHTS_EXECUTE
| TOKEN_IMPERSONATE
| TOKEN_ASSIGN_PRIMARY
,
118 struct object obj
; /* object header */
119 struct luid token_id
; /* system-unique id of token */
120 struct luid modified_id
; /* new id allocated every time token is modified */
121 struct list privileges
; /* privileges available to the token */
122 struct list groups
; /* groups that the user of this token belongs to (sid_and_attributes) */
123 SID
*user
; /* SID of user this token represents */
124 SID
*owner
; /* SID of owner (points to user or one of groups) */
125 SID
*primary_group
; /* SID of user's primary group (points to one of groups) */
126 unsigned int primary
; /* is this a primary or impersonation token? */
127 unsigned int session_id
; /* token session id */
128 ACL
*default_dacl
; /* the default DACL to assign to objects created by this user */
129 TOKEN_SOURCE source
; /* source of the token */
130 int impersonation_level
; /* impersonation level this token is capable of if non-primary token */
131 int elevation
; /* elevation type */
138 unsigned enabled
: 1; /* is the privilege currently enabled? */
139 unsigned def
: 1; /* is the privilege enabled by default? */
145 unsigned enabled
: 1; /* is the sid currently enabled? */
146 unsigned def
: 1; /* is the sid enabled by default? */
147 unsigned logon
: 1; /* is this a logon sid? */
148 unsigned mandatory
: 1; /* is this sid always enabled? */
149 unsigned owner
: 1; /* can this sid be an owner of an object? */
150 unsigned resource
: 1; /* is this a domain-local group? */
151 unsigned deny_only
: 1; /* is this a sid that should be use for denying only? */
155 static void token_dump( struct object
*obj
, int verbose
);
156 static void token_destroy( struct object
*obj
);
158 static const struct object_ops token_ops
=
160 sizeof(struct token
), /* size */
161 &token_type
, /* type */
162 token_dump
, /* dump */
163 no_add_queue
, /* add_queue */
164 NULL
, /* remove_queue */
166 NULL
, /* satisfied */
167 no_signal
, /* signal */
168 no_get_fd
, /* get_fd */
169 default_map_access
, /* map_access */
170 default_get_sd
, /* get_sd */
171 default_set_sd
, /* set_sd */
172 no_get_full_name
, /* get_full_name */
173 no_lookup_name
, /* lookup_name */
174 no_link_name
, /* link_name */
175 NULL
, /* unlink_name */
176 no_open_file
, /* open_file */
177 no_kernel_obj_list
, /* get_kernel_obj_list */
178 no_close_handle
, /* close_handle */
179 token_destroy
/* destroy */
182 static void token_dump( struct object
*obj
, int verbose
)
184 struct token
*token
= (struct token
*)obj
;
185 assert( obj
->ops
== &token_ops
);
186 fprintf( stderr
, "Token id=%d.%u primary=%u impersonation level=%d\n", token
->token_id
.high_part
,
187 token
->token_id
.low_part
, token
->primary
, token
->impersonation_level
);
190 static SID
*security_sid_alloc( const SID_IDENTIFIER_AUTHORITY
*idauthority
, int subauthcount
, const unsigned int subauth
[] )
193 SID
*sid
= mem_alloc( FIELD_OFFSET(SID
, SubAuthority
[subauthcount
]) );
194 if (!sid
) return NULL
;
195 sid
->Revision
= SID_REVISION
;
196 sid
->SubAuthorityCount
= subauthcount
;
197 sid
->IdentifierAuthority
= *idauthority
;
198 for (i
= 0; i
< subauthcount
; i
++)
199 sid
->SubAuthority
[i
] = subauth
[i
];
203 void security_set_thread_token( struct thread
*thread
, obj_handle_t handle
)
208 release_object( thread
->token
);
209 thread
->token
= NULL
;
213 struct token
*token
= (struct token
*)get_handle_obj( current
->process
,
220 release_object( thread
->token
);
221 thread
->token
= token
;
226 const SID
*security_unix_uid_to_sid( uid_t uid
)
228 /* very simple mapping: either the current user or not the current user */
230 return (const SID
*)&local_user_sid
;
232 return &anonymous_logon_sid
;
235 static int acl_is_valid( const ACL
*acl
, data_size_t size
)
238 const ACE_HEADER
*ace
;
240 if (size
< sizeof(ACL
))
243 size
= min(size
, MAX_ACL_LEN
);
247 ace
= (const ACE_HEADER
*)(acl
+ 1);
248 for (i
= 0; i
< acl
->AceCount
; i
++)
251 data_size_t sid_size
;
253 if (size
< sizeof(ACE_HEADER
))
255 if (size
< ace
->AceSize
)
257 size
-= ace
->AceSize
;
258 switch (ace
->AceType
)
260 case ACCESS_DENIED_ACE_TYPE
:
261 sid
= (const SID
*)&((const ACCESS_DENIED_ACE
*)ace
)->SidStart
;
262 sid_size
= ace
->AceSize
- FIELD_OFFSET(ACCESS_DENIED_ACE
, SidStart
);
264 case ACCESS_ALLOWED_ACE_TYPE
:
265 sid
= (const SID
*)&((const ACCESS_ALLOWED_ACE
*)ace
)->SidStart
;
266 sid_size
= ace
->AceSize
- FIELD_OFFSET(ACCESS_ALLOWED_ACE
, SidStart
);
268 case SYSTEM_AUDIT_ACE_TYPE
:
269 sid
= (const SID
*)&((const SYSTEM_AUDIT_ACE
*)ace
)->SidStart
;
270 sid_size
= ace
->AceSize
- FIELD_OFFSET(SYSTEM_AUDIT_ACE
, SidStart
);
272 case SYSTEM_ALARM_ACE_TYPE
:
273 sid
= (const SID
*)&((const SYSTEM_ALARM_ACE
*)ace
)->SidStart
;
274 sid_size
= ace
->AceSize
- FIELD_OFFSET(SYSTEM_ALARM_ACE
, SidStart
);
276 case SYSTEM_MANDATORY_LABEL_ACE_TYPE
:
277 sid
= (const SID
*)&((const SYSTEM_MANDATORY_LABEL_ACE
*)ace
)->SidStart
;
278 sid_size
= ace
->AceSize
- FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE
, SidStart
);
283 if (sid_size
< FIELD_OFFSET(SID
, SubAuthority
[0]) || sid_size
< security_sid_len( sid
))
285 ace
= ace_next( ace
);
290 static unsigned int get_sid_count( const SID
*sid
, data_size_t size
)
294 for (count
= 0; size
>= sizeof(SID
) && security_sid_len( sid
) <= size
; count
++)
296 size
-= security_sid_len( sid
);
297 sid
= (const SID
*)((char *)sid
+ security_sid_len( sid
));
303 /* checks whether all members of a security descriptor fit inside the size
304 * of memory specified */
305 int sd_is_valid( const struct security_descriptor
*sd
, data_size_t size
)
307 size_t offset
= sizeof(struct security_descriptor
);
317 if ((sd
->owner_len
>= FIELD_OFFSET(SID
, SubAuthority
[255])) ||
318 (offset
+ sd
->owner_len
> size
))
320 owner
= sd_get_owner( sd
);
323 if ((sd
->owner_len
< sizeof(SID
)) || (security_sid_len( owner
) > sd
->owner_len
))
326 offset
+= sd
->owner_len
;
328 if ((sd
->group_len
>= FIELD_OFFSET(SID
, SubAuthority
[255])) ||
329 (offset
+ sd
->group_len
> size
))
331 group
= sd_get_group( sd
);
334 if ((sd
->group_len
< sizeof(SID
)) || (security_sid_len( group
) > sd
->group_len
))
337 offset
+= sd
->group_len
;
339 if ((sd
->sacl_len
>= MAX_ACL_LEN
) || (offset
+ sd
->sacl_len
> size
))
341 sacl
= sd_get_sacl( sd
, &dummy
);
342 if (sacl
&& !acl_is_valid( sacl
, sd
->sacl_len
))
344 offset
+= sd
->sacl_len
;
346 if ((sd
->dacl_len
>= MAX_ACL_LEN
) || (offset
+ sd
->dacl_len
> size
))
348 dacl
= sd_get_dacl( sd
, &dummy
);
349 if (dacl
&& !acl_is_valid( dacl
, sd
->dacl_len
))
351 offset
+= sd
->dacl_len
;
356 /* extract security labels from SACL */
357 ACL
*extract_security_labels( const ACL
*sacl
)
359 size_t size
= sizeof(ACL
);
360 const ACE_HEADER
*ace
;
361 ACE_HEADER
*label_ace
;
362 unsigned int i
, count
= 0;
365 ace
= (const ACE_HEADER
*)(sacl
+ 1);
366 for (i
= 0; i
< sacl
->AceCount
; i
++, ace
= ace_next( ace
))
368 if (ace
->AceType
== SYSTEM_MANDATORY_LABEL_ACE_TYPE
)
370 size
+= ace
->AceSize
;
375 label_acl
= mem_alloc( size
);
376 if (!label_acl
) return NULL
;
378 label_acl
->AclRevision
= sacl
->AclRevision
;
380 label_acl
->AclSize
= size
;
381 label_acl
->AceCount
= count
;
383 label_ace
= (ACE_HEADER
*)(label_acl
+ 1);
385 ace
= (const ACE_HEADER
*)(sacl
+ 1);
386 for (i
= 0; i
< sacl
->AceCount
; i
++, ace
= ace_next( ace
))
388 if (ace
->AceType
== SYSTEM_MANDATORY_LABEL_ACE_TYPE
)
390 memcpy( label_ace
, ace
, ace
->AceSize
);
391 label_ace
= (ACE_HEADER
*)ace_next( label_ace
);
397 /* replace security labels in an existing SACL */
398 ACL
*replace_security_labels( const ACL
*old_sacl
, const ACL
*new_sacl
)
400 const ACE_HEADER
*ace
;
401 ACE_HEADER
*replaced_ace
;
402 size_t size
= sizeof(ACL
);
403 unsigned int i
, count
= 0;
404 BYTE revision
= ACL_REVISION
;
409 revision
= max( revision
, old_sacl
->AclRevision
);
410 ace
= (const ACE_HEADER
*)(old_sacl
+ 1);
411 for (i
= 0; i
< old_sacl
->AceCount
; i
++, ace
= ace_next( ace
))
413 if (ace
->AceType
== SYSTEM_MANDATORY_LABEL_ACE_TYPE
) continue;
414 size
+= ace
->AceSize
;
421 revision
= max( revision
, new_sacl
->AclRevision
);
422 ace
= (const ACE_HEADER
*)(new_sacl
+ 1);
423 for (i
= 0; i
< new_sacl
->AceCount
; i
++, ace
= ace_next( ace
))
425 if (ace
->AceType
!= SYSTEM_MANDATORY_LABEL_ACE_TYPE
) continue;
426 size
+= ace
->AceSize
;
431 replaced_acl
= mem_alloc( size
);
432 if (!replaced_acl
) return NULL
;
434 replaced_acl
->AclRevision
= revision
;
435 replaced_acl
->Sbz1
= 0;
436 replaced_acl
->AclSize
= size
;
437 replaced_acl
->AceCount
= count
;
438 replaced_acl
->Sbz2
= 0;
439 replaced_ace
= (ACE_HEADER
*)(replaced_acl
+ 1);
443 ace
= (const ACE_HEADER
*)(old_sacl
+ 1);
444 for (i
= 0; i
< old_sacl
->AceCount
; i
++, ace
= ace_next( ace
))
446 if (ace
->AceType
== SYSTEM_MANDATORY_LABEL_ACE_TYPE
) continue;
447 memcpy( replaced_ace
, ace
, ace
->AceSize
);
448 replaced_ace
= (ACE_HEADER
*)ace_next( replaced_ace
);
454 ace
= (const ACE_HEADER
*)(new_sacl
+ 1);
455 for (i
= 0; i
< new_sacl
->AceCount
; i
++, ace
= ace_next( ace
))
457 if (ace
->AceType
!= SYSTEM_MANDATORY_LABEL_ACE_TYPE
) continue;
458 memcpy( replaced_ace
, ace
, ace
->AceSize
);
459 replaced_ace
= (ACE_HEADER
*)ace_next( replaced_ace
);
466 static inline int is_equal_luid( struct luid luid1
, struct luid luid2
)
468 return (luid1
.low_part
== luid2
.low_part
&& luid1
.high_part
== luid2
.high_part
);
471 static inline void allocate_luid( struct luid
*luid
)
473 prev_luid_value
.low_part
++;
474 *luid
= prev_luid_value
;
477 DECL_HANDLER( allocate_locally_unique_id
)
479 allocate_luid( &reply
->luid
);
482 static inline struct luid_attr
luid_and_attr_from_privilege( const struct privilege
*in
)
484 struct luid_attr ret
= { in
->luid
};
486 ret
.attrs
= (in
->enabled
? SE_PRIVILEGE_ENABLED
: 0) |
487 (in
->def
? SE_PRIVILEGE_ENABLED_BY_DEFAULT
: 0);
491 static struct privilege
*privilege_add( struct token
*token
, struct luid luid
, int enabled
)
493 struct privilege
*privilege
= mem_alloc( sizeof(*privilege
) );
496 privilege
->luid
= luid
;
497 privilege
->def
= privilege
->enabled
= (enabled
!= 0);
498 list_add_tail( &token
->privileges
, &privilege
->entry
);
503 static inline void privilege_remove( struct privilege
*privilege
)
505 list_remove( &privilege
->entry
);
509 static void token_destroy( struct object
*obj
)
512 struct list
*cursor
, *cursor_next
;
514 assert( obj
->ops
== &token_ops
);
515 token
= (struct token
*)obj
;
519 LIST_FOR_EACH_SAFE( cursor
, cursor_next
, &token
->privileges
)
521 struct privilege
*privilege
= LIST_ENTRY( cursor
, struct privilege
, entry
);
522 privilege_remove( privilege
);
525 LIST_FOR_EACH_SAFE( cursor
, cursor_next
, &token
->groups
)
527 struct group
*group
= LIST_ENTRY( cursor
, struct group
, entry
);
528 list_remove( &group
->entry
);
532 free( token
->default_dacl
);
535 /* creates a new token.
536 * groups may be NULL if group_count is 0.
537 * privs may be NULL if priv_count is 0.
538 * default_dacl may be NULL, indicating that all objects created by the user
540 * modified_id may be NULL, indicating that a new modified_id luid should be
543 static struct token
*create_token( unsigned int primary
, unsigned int session_id
, const SID
*user
,
544 const SID_AND_ATTRIBUTES
*groups
, unsigned int group_count
,
545 const struct luid_attr
*privs
, unsigned int priv_count
,
546 const ACL
*default_dacl
, TOKEN_SOURCE source
,
547 const struct luid
*modified_id
,
548 int impersonation_level
, int elevation
)
550 struct token
*token
= alloc_object( &token_ops
);
555 allocate_luid( &token
->token_id
);
557 token
->modified_id
= *modified_id
;
559 allocate_luid( &token
->modified_id
);
560 list_init( &token
->privileges
);
561 list_init( &token
->groups
);
562 token
->primary
= primary
;
563 token
->session_id
= session_id
;
564 /* primary tokens don't have impersonation levels */
566 token
->impersonation_level
= -1;
568 token
->impersonation_level
= impersonation_level
;
569 token
->default_dacl
= NULL
;
570 token
->primary_group
= NULL
;
571 token
->elevation
= elevation
;
574 token
->user
= memdup( user
, security_sid_len( user
));
577 release_object( token
);
582 for (i
= 0; i
< group_count
; i
++)
584 size_t size
= FIELD_OFFSET( struct group
, sid
.SubAuthority
[((const SID
*)groups
[i
].Sid
)->SubAuthorityCount
] );
585 struct group
*group
= mem_alloc( size
);
589 release_object( token
);
592 memcpy( &group
->sid
, groups
[i
].Sid
, security_sid_len( groups
[i
].Sid
));
593 group
->enabled
= TRUE
;
595 group
->logon
= (groups
[i
].Attributes
& SE_GROUP_LOGON_ID
) != 0;
596 group
->mandatory
= (groups
[i
].Attributes
& SE_GROUP_MANDATORY
) != 0;
597 group
->owner
= (groups
[i
].Attributes
& SE_GROUP_OWNER
) != 0;
598 group
->resource
= FALSE
;
599 group
->deny_only
= FALSE
;
600 list_add_tail( &token
->groups
, &group
->entry
);
601 /* Use first owner capable group as owner and primary group */
602 if (!token
->primary_group
&& group
->owner
)
604 token
->owner
= &group
->sid
;
605 token
->primary_group
= &group
->sid
;
609 /* copy privileges */
610 for (i
= 0; i
< priv_count
; i
++)
612 /* note: we don't check uniqueness: the caller must make sure
613 * privs doesn't contain any duplicate luids */
614 if (!privilege_add( token
, privs
[i
].luid
, privs
[i
].attrs
& SE_PRIVILEGE_ENABLED
))
616 release_object( token
);
623 token
->default_dacl
= memdup( default_dacl
, default_dacl
->AclSize
);
624 if (!token
->default_dacl
)
626 release_object( token
);
631 token
->source
= source
;
636 static int filter_group( struct group
*group
, const SID
*filter
, unsigned int count
)
640 for (i
= 0; i
< count
; i
++)
642 if (security_equal_sid( &group
->sid
, filter
)) return 1;
643 filter
= (const SID
*)((char *)filter
+ security_sid_len( filter
));
649 static int filter_privilege( struct privilege
*privilege
, const struct luid_attr
*filter
, unsigned int count
)
653 for (i
= 0; i
< count
; i
++)
654 if (is_equal_luid( privilege
->luid
, filter
[i
].luid
)) return 1;
659 struct token
*token_duplicate( struct token
*src_token
, unsigned primary
,
660 int impersonation_level
, const struct security_descriptor
*sd
,
661 const struct luid_attr
*remove_privs
, unsigned int remove_priv_count
,
662 const SID
*remove_groups
, unsigned int remove_group_count
)
664 const struct luid
*modified_id
=
665 primary
|| (impersonation_level
== src_token
->impersonation_level
) ?
666 &src_token
->modified_id
: NULL
;
667 struct token
*token
= NULL
;
668 struct privilege
*privilege
;
672 (impersonation_level
< SecurityAnonymous
||
673 impersonation_level
> SecurityDelegation
||
674 (!src_token
->primary
&& (impersonation_level
> src_token
->impersonation_level
))))
676 set_error( STATUS_BAD_IMPERSONATION_LEVEL
);
680 token
= create_token( primary
, src_token
->session_id
, src_token
->user
, NULL
, 0,
681 NULL
, 0, src_token
->default_dacl
,
682 src_token
->source
, modified_id
,
683 impersonation_level
, src_token
->elevation
);
684 if (!token
) return token
;
687 token
->primary_group
= NULL
;
688 LIST_FOR_EACH_ENTRY( group
, &src_token
->groups
, struct group
, entry
)
690 size_t size
= FIELD_OFFSET( struct group
, sid
.SubAuthority
[group
->sid
.SubAuthorityCount
] );
691 struct group
*newgroup
= mem_alloc( size
);
694 release_object( token
);
697 memcpy( newgroup
, group
, size
);
698 if (filter_group( group
, remove_groups
, remove_group_count
))
700 newgroup
->enabled
= 0;
702 newgroup
->deny_only
= 1;
704 list_add_tail( &token
->groups
, &newgroup
->entry
);
705 if (src_token
->primary_group
== &group
->sid
)
707 token
->owner
= &newgroup
->sid
;
708 token
->primary_group
= &newgroup
->sid
;
711 assert( token
->primary_group
);
713 /* copy privileges */
714 LIST_FOR_EACH_ENTRY( privilege
, &src_token
->privileges
, struct privilege
, entry
)
716 if (filter_privilege( privilege
, remove_privs
, remove_priv_count
)) continue;
717 if (!privilege_add( token
, privilege
->luid
, privilege
->enabled
))
719 release_object( token
);
724 if (sd
) default_set_sd( &token
->obj
, sd
, OWNER_SECURITY_INFORMATION
| GROUP_SECURITY_INFORMATION
|
725 DACL_SECURITY_INFORMATION
| SACL_SECURITY_INFORMATION
);
730 static ACL
*create_default_dacl( const SID
*user
)
732 ACCESS_ALLOWED_ACE
*aaa
;
735 size_t default_dacl_size
= sizeof(ACL
) +
736 2*(sizeof(ACCESS_ALLOWED_ACE
) - sizeof(DWORD
)) +
737 sizeof(local_system_sid
) +
738 security_sid_len( user
);
740 default_dacl
= mem_alloc( default_dacl_size
);
741 if (!default_dacl
) return NULL
;
743 default_dacl
->AclRevision
= ACL_REVISION
;
744 default_dacl
->Sbz1
= 0;
745 default_dacl
->AclSize
= default_dacl_size
;
746 default_dacl
->AceCount
= 2;
747 default_dacl
->Sbz2
= 0;
749 /* GENERIC_ALL for Local System */
750 aaa
= (ACCESS_ALLOWED_ACE
*)(default_dacl
+ 1);
751 aaa
->Header
.AceType
= ACCESS_ALLOWED_ACE_TYPE
;
752 aaa
->Header
.AceFlags
= 0;
753 aaa
->Header
.AceSize
= (sizeof(ACCESS_ALLOWED_ACE
) - sizeof(DWORD
)) +
754 sizeof(local_system_sid
);
755 aaa
->Mask
= GENERIC_ALL
;
756 sid
= (SID
*)&aaa
->SidStart
;
757 memcpy( sid
, &local_system_sid
, sizeof(local_system_sid
) );
759 /* GENERIC_ALL for specified user */
760 aaa
= (ACCESS_ALLOWED_ACE
*)((char *)aaa
+ aaa
->Header
.AceSize
);
761 aaa
->Header
.AceType
= ACCESS_ALLOWED_ACE_TYPE
;
762 aaa
->Header
.AceFlags
= 0;
763 aaa
->Header
.AceSize
= (sizeof(ACCESS_ALLOWED_ACE
) - sizeof(DWORD
)) + security_sid_len( user
);
764 aaa
->Mask
= GENERIC_ALL
;
765 sid
= (SID
*)&aaa
->SidStart
;
766 memcpy( sid
, user
, security_sid_len( user
));
773 SID_IDENTIFIER_AUTHORITY idauth
;
775 unsigned int subauth
[MAX_SUBAUTH_COUNT
];
778 static struct security_descriptor
*create_security_label_sd( struct token
*token
, PSID label_sid
)
780 size_t sid_len
= security_sid_len( label_sid
), sacl_size
, sd_size
;
781 SYSTEM_MANDATORY_LABEL_ACE
*smla
;
782 struct security_descriptor
*sd
;
785 sacl_size
= sizeof(ACL
) + FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE
, SidStart
) + sid_len
;
786 sd_size
= sizeof(struct security_descriptor
) + sacl_size
;
787 if (!(sd
= mem_alloc( sd_size
)))
790 sd
->control
= SE_SACL_PRESENT
;
793 sd
->sacl_len
= sacl_size
;
796 sacl
= (ACL
*)(sd
+ 1);
797 sacl
->AclRevision
= ACL_REVISION
;
799 sacl
->AclSize
= sacl_size
;
803 smla
= (SYSTEM_MANDATORY_LABEL_ACE
*)(sacl
+ 1);
804 smla
->Header
.AceType
= SYSTEM_MANDATORY_LABEL_ACE_TYPE
;
805 smla
->Header
.AceFlags
= 0;
806 smla
->Header
.AceSize
= FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE
, SidStart
) + sid_len
;
807 smla
->Mask
= SYSTEM_MANDATORY_LABEL_NO_WRITE_UP
;
808 memcpy( &smla
->SidStart
, label_sid
, sid_len
);
810 assert( sd_is_valid( sd
, sd_size
) );
814 int token_assign_label( struct token
*token
, PSID label
)
816 struct security_descriptor
*sd
;
819 if ((sd
= create_security_label_sd( token
, label
)))
821 ret
= set_sd_defaults_from_token( &token
->obj
, sd
, LABEL_SECURITY_INFORMATION
, token
);
828 struct token
*get_token_obj( struct process
*process
, obj_handle_t handle
, unsigned int access
)
830 return (struct token
*)get_handle_obj( process
, handle
, access
, &token_ops
);
833 struct token
*token_create_admin( unsigned primary
, int impersonation_level
, int elevation
, unsigned int session_id
)
835 struct token
*token
= NULL
;
836 static const SID_IDENTIFIER_AUTHORITY nt_authority
= { SECURITY_NT_AUTHORITY
};
837 static const unsigned int alias_admins_subauth
[] = { SECURITY_BUILTIN_DOMAIN_RID
, DOMAIN_ALIAS_RID_ADMINS
};
838 static const unsigned int alias_users_subauth
[] = { SECURITY_BUILTIN_DOMAIN_RID
, DOMAIN_ALIAS_RID_USERS
};
839 /* on Windows, this value changes every time the user logs on */
840 static const unsigned int logon_subauth
[] = { SECURITY_LOGON_IDS_RID
, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
841 PSID alias_admins_sid
;
842 PSID alias_users_sid
;
844 const SID
*user_sid
= security_unix_uid_to_sid( getuid() );
845 ACL
*default_dacl
= create_default_dacl( user_sid
);
847 alias_admins_sid
= security_sid_alloc( &nt_authority
, ARRAY_SIZE( alias_admins_subauth
),
848 alias_admins_subauth
);
849 alias_users_sid
= security_sid_alloc( &nt_authority
, ARRAY_SIZE( alias_users_subauth
),
850 alias_users_subauth
);
851 logon_sid
= security_sid_alloc( &nt_authority
, ARRAY_SIZE( logon_subauth
), logon_subauth
);
853 if (alias_admins_sid
&& alias_users_sid
&& logon_sid
&& default_dacl
)
855 const struct luid_attr admin_privs
[] =
857 { SeChangeNotifyPrivilege
, SE_PRIVILEGE_ENABLED
},
858 { SeTcbPrivilege
, 0 },
859 { SeSecurityPrivilege
, 0 },
860 { SeBackupPrivilege
, 0 },
861 { SeRestorePrivilege
, 0 },
862 { SeSystemtimePrivilege
, 0 },
863 { SeShutdownPrivilege
, 0 },
864 { SeRemoteShutdownPrivilege
, 0 },
865 { SeTakeOwnershipPrivilege
, 0 },
866 { SeDebugPrivilege
, 0 },
867 { SeSystemEnvironmentPrivilege
, 0 },
868 { SeSystemProfilePrivilege
, 0 },
869 { SeProfileSingleProcessPrivilege
, 0 },
870 { SeIncreaseBasePriorityPrivilege
, 0 },
871 { SeLoadDriverPrivilege
, SE_PRIVILEGE_ENABLED
},
872 { SeCreatePagefilePrivilege
, 0 },
873 { SeIncreaseQuotaPrivilege
, 0 },
874 { SeUndockPrivilege
, 0 },
875 { SeManageVolumePrivilege
, 0 },
876 { SeImpersonatePrivilege
, SE_PRIVILEGE_ENABLED
},
877 { SeCreateGlobalPrivilege
, SE_PRIVILEGE_ENABLED
},
879 /* note: we don't include non-builtin groups here for the user -
880 * telling us these is the job of a client-side program */
881 const SID_AND_ATTRIBUTES admin_groups
[] =
883 { security_world_sid
, SE_GROUP_ENABLED
|SE_GROUP_ENABLED_BY_DEFAULT
|SE_GROUP_MANDATORY
},
884 { security_local_sid
, SE_GROUP_ENABLED
|SE_GROUP_ENABLED_BY_DEFAULT
|SE_GROUP_MANDATORY
},
885 { security_interactive_sid
, SE_GROUP_ENABLED
|SE_GROUP_ENABLED_BY_DEFAULT
|SE_GROUP_MANDATORY
},
886 { security_authenticated_user_sid
, SE_GROUP_ENABLED
|SE_GROUP_ENABLED_BY_DEFAULT
|SE_GROUP_MANDATORY
},
887 { security_domain_users_sid
, SE_GROUP_ENABLED
|SE_GROUP_ENABLED_BY_DEFAULT
|SE_GROUP_MANDATORY
|SE_GROUP_OWNER
},
888 { alias_admins_sid
, SE_GROUP_ENABLED
|SE_GROUP_ENABLED_BY_DEFAULT
|SE_GROUP_MANDATORY
|SE_GROUP_OWNER
},
889 { alias_users_sid
, SE_GROUP_ENABLED
|SE_GROUP_ENABLED_BY_DEFAULT
|SE_GROUP_MANDATORY
},
890 { logon_sid
, SE_GROUP_ENABLED
|SE_GROUP_ENABLED_BY_DEFAULT
|SE_GROUP_MANDATORY
|SE_GROUP_LOGON_ID
},
892 static const TOKEN_SOURCE admin_source
= {"SeMgr", {0, 0}};
893 token
= create_token( primary
, session_id
, user_sid
, admin_groups
, ARRAY_SIZE( admin_groups
),
894 admin_privs
, ARRAY_SIZE( admin_privs
), default_dacl
,
895 admin_source
, NULL
, impersonation_level
, elevation
);
896 /* we really need a primary group */
897 assert( token
->primary_group
);
901 free( alias_admins_sid
);
902 free( alias_users_sid
);
903 free( default_dacl
);
908 static struct privilege
*token_find_privilege( struct token
*token
, struct luid luid
, int enabled_only
)
910 struct privilege
*privilege
;
911 LIST_FOR_EACH_ENTRY( privilege
, &token
->privileges
, struct privilege
, entry
)
913 if (is_equal_luid( luid
, privilege
->luid
))
915 if (enabled_only
&& !privilege
->enabled
)
923 static unsigned int token_adjust_privileges( struct token
*token
, const struct luid_attr
*privs
,
924 unsigned int count
, struct luid_attr
*mod_privs
,
925 unsigned int mod_privs_count
)
927 unsigned int i
, modified_count
= 0;
929 /* mark as modified */
930 allocate_luid( &token
->modified_id
);
932 for (i
= 0; i
< count
; i
++)
934 struct privilege
*privilege
= token_find_privilege( token
, privs
[i
].luid
, FALSE
);
937 set_error( STATUS_NOT_ALL_ASSIGNED
);
941 if (privs
[i
].attrs
& SE_PRIVILEGE_REMOVED
) privilege_remove( privilege
);
944 /* save previous state for caller */
947 *mod_privs
++ = luid_and_attr_from_privilege( privilege
);
951 privilege
->enabled
= !!(privs
[i
].attrs
& SE_PRIVILEGE_ENABLED
);
954 return modified_count
;
957 static void token_disable_privileges( struct token
*token
)
959 struct privilege
*privilege
;
961 /* mark as modified */
962 allocate_luid( &token
->modified_id
);
964 LIST_FOR_EACH_ENTRY( privilege
, &token
->privileges
, struct privilege
, entry
)
965 privilege
->enabled
= FALSE
;
968 int token_check_privileges( struct token
*token
, int all_required
, const struct luid_attr
*reqprivs
,
969 unsigned int count
, struct luid_attr
*usedprivs
)
971 unsigned int i
, enabled_count
= 0;
973 for (i
= 0; i
< count
; i
++)
975 struct privilege
*privilege
= token_find_privilege( token
, reqprivs
[i
].luid
, TRUE
);
978 usedprivs
[i
] = reqprivs
[i
];
980 if (privilege
&& privilege
->enabled
)
983 if (usedprivs
) usedprivs
[i
].attrs
|= SE_PRIVILEGE_USED_FOR_ACCESS
;
988 return (enabled_count
== count
);
990 return (enabled_count
> 0);
993 int token_sid_present( struct token
*token
, const SID
*sid
, int deny
)
997 if (security_equal_sid( token
->user
, sid
)) return TRUE
;
999 LIST_FOR_EACH_ENTRY( group
, &token
->groups
, struct group
, entry
)
1001 if (!group
->enabled
) continue;
1002 if (group
->deny_only
&& !deny
) continue;
1004 if (security_equal_sid( &group
->sid
, sid
)) return TRUE
;
1010 /* Checks access to a security descriptor. 'sd' must have been validated by
1011 * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
1012 * the reason. 'status' parameter will indicate if access is granted or denied.
1014 * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
1016 static unsigned int token_access_check( struct token
*token
,
1017 const struct security_descriptor
*sd
,
1018 unsigned int desired_access
,
1019 struct luid_attr
*privs
,
1020 unsigned int *priv_count
,
1021 const generic_map_t
*mapping
,
1022 unsigned int *granted_access
,
1023 unsigned int *status
)
1025 unsigned int current_access
= 0;
1026 unsigned int denied_access
= 0;
1030 const ACE_HEADER
*ace
;
1033 /* assume no access rights */
1034 *granted_access
= 0;
1036 /* fail if desired_access contains generic rights */
1037 if (desired_access
& (GENERIC_READ
|GENERIC_WRITE
|GENERIC_EXECUTE
|GENERIC_ALL
))
1039 if (priv_count
) *priv_count
= 0;
1040 return STATUS_GENERIC_NOT_MAPPED
;
1043 dacl
= sd_get_dacl( sd
, &dacl_present
);
1044 owner
= sd_get_owner( sd
);
1045 if (!owner
|| !sd_get_group( sd
))
1047 if (priv_count
) *priv_count
= 0;
1048 return STATUS_INVALID_SECURITY_DESCR
;
1051 /* 1: Grant desired access if the object is unprotected */
1052 if (!dacl_present
|| !dacl
)
1054 if (priv_count
) *priv_count
= 0;
1055 if (desired_access
& MAXIMUM_ALLOWED
)
1056 *granted_access
= mapping
->all
;
1058 *granted_access
= desired_access
;
1059 return *status
= STATUS_SUCCESS
;
1062 /* 2: Check if caller wants access to system security part. Note: access
1063 * is only granted if specifically asked for */
1064 if (desired_access
& ACCESS_SYSTEM_SECURITY
)
1066 const struct luid_attr security_priv
= { SeSecurityPrivilege
, 0 };
1067 struct luid_attr retpriv
= security_priv
;
1068 if (token_check_privileges( token
, TRUE
, &security_priv
, 1, &retpriv
))
1072 /* assumes that there will only be one privilege to return */
1073 if (*priv_count
>= 1)
1081 return STATUS_BUFFER_TOO_SMALL
;
1084 current_access
|= ACCESS_SYSTEM_SECURITY
;
1085 if (desired_access
== current_access
)
1087 *granted_access
= current_access
;
1088 return *status
= STATUS_SUCCESS
;
1093 if (priv_count
) *priv_count
= 0;
1094 *status
= STATUS_PRIVILEGE_NOT_HELD
;
1095 return STATUS_SUCCESS
;
1098 else if (priv_count
) *priv_count
= 0;
1100 /* 3: Check whether the token is the owner */
1101 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
1102 * checked when a "set owner" call is made, overriding the access rights
1103 * determined here. */
1104 if (token_sid_present( token
, owner
, FALSE
))
1106 current_access
|= (STANDARD_RIGHTS_REQUIRED
| SYNCHRONIZE
);
1107 if (desired_access
== current_access
)
1109 *granted_access
= current_access
;
1110 return *status
= STATUS_SUCCESS
;
1114 /* 4: Grant rights according to the DACL */
1115 ace
= (const ACE_HEADER
*)(dacl
+ 1);
1116 for (i
= 0; i
< dacl
->AceCount
; i
++, ace
= ace_next( ace
))
1118 const ACCESS_ALLOWED_ACE
*aa_ace
;
1119 const ACCESS_DENIED_ACE
*ad_ace
;
1122 if (ace
->AceFlags
& INHERIT_ONLY_ACE
)
1125 switch (ace
->AceType
)
1127 case ACCESS_DENIED_ACE_TYPE
:
1128 ad_ace
= (const ACCESS_DENIED_ACE
*)ace
;
1129 sid
= (const SID
*)&ad_ace
->SidStart
;
1130 if (token_sid_present( token
, sid
, TRUE
))
1132 unsigned int access
= map_access( ad_ace
->Mask
, mapping
);
1133 if (desired_access
& MAXIMUM_ALLOWED
)
1134 denied_access
|= access
;
1137 denied_access
|= (access
& ~current_access
);
1138 if (desired_access
& access
) goto done
;
1142 case ACCESS_ALLOWED_ACE_TYPE
:
1143 aa_ace
= (const ACCESS_ALLOWED_ACE
*)ace
;
1144 sid
= (const SID
*)&aa_ace
->SidStart
;
1145 if (token_sid_present( token
, sid
, FALSE
))
1147 unsigned int access
= map_access( aa_ace
->Mask
, mapping
);
1148 if (desired_access
& MAXIMUM_ALLOWED
)
1149 current_access
|= access
;
1151 current_access
|= (access
& ~denied_access
);
1156 /* don't bother carrying on checking if we've already got all of
1158 if (desired_access
== *granted_access
)
1163 if (desired_access
& MAXIMUM_ALLOWED
)
1164 *granted_access
= current_access
& ~denied_access
;
1166 if ((current_access
& desired_access
) == desired_access
)
1167 *granted_access
= current_access
& desired_access
;
1169 *granted_access
= 0;
1171 *status
= *granted_access
? STATUS_SUCCESS
: STATUS_ACCESS_DENIED
;
1172 return STATUS_SUCCESS
;
1175 const ACL
*token_get_default_dacl( struct token
*token
)
1177 return token
->default_dacl
;
1180 const SID
*token_get_user( struct token
*token
)
1185 const SID
*token_get_primary_group( struct token
*token
)
1187 return token
->primary_group
;
1190 unsigned int token_get_session_id( struct token
*token
)
1192 return token
->session_id
;
1195 int check_object_access(struct token
*token
, struct object
*obj
, unsigned int *access
)
1197 generic_map_t mapping
;
1198 unsigned int status
;
1202 token
= current
->token
? current
->token
: current
->process
->token
;
1204 mapping
.all
= obj
->ops
->map_access( obj
, GENERIC_ALL
);
1208 if (*access
& MAXIMUM_ALLOWED
) *access
= mapping
.all
;
1212 mapping
.read
= obj
->ops
->map_access( obj
, GENERIC_READ
);
1213 mapping
.write
= obj
->ops
->map_access( obj
, GENERIC_WRITE
);
1214 mapping
.exec
= obj
->ops
->map_access( obj
, GENERIC_EXECUTE
);
1216 res
= token_access_check( token
, obj
->sd
, *access
, NULL
, NULL
,
1217 &mapping
, access
, &status
) == STATUS_SUCCESS
&&
1218 status
== STATUS_SUCCESS
;
1220 if (!res
) set_error( STATUS_ACCESS_DENIED
);
1225 /* open a security token */
1226 DECL_HANDLER(open_token
)
1228 if (req
->flags
& OPEN_TOKEN_THREAD
)
1230 struct thread
*thread
= get_thread_from_handle( req
->handle
, 0 );
1235 if (!thread
->token
->primary
&& thread
->token
->impersonation_level
<= SecurityAnonymous
)
1236 set_error( STATUS_CANT_OPEN_ANONYMOUS
);
1238 reply
->token
= alloc_handle( current
->process
, thread
->token
,
1239 req
->access
, req
->attributes
);
1242 set_error( STATUS_NO_TOKEN
);
1243 release_object( thread
);
1248 struct process
*process
= get_process_from_handle( req
->handle
, 0 );
1252 reply
->token
= alloc_handle( current
->process
, process
->token
, req
->access
,
1255 set_error( STATUS_NO_TOKEN
);
1256 release_object( process
);
1261 /* adjust the privileges held by a token */
1262 DECL_HANDLER(adjust_token_privileges
)
1264 struct token
*token
;
1265 unsigned int access
= TOKEN_ADJUST_PRIVILEGES
;
1267 if (req
->get_modified_state
) access
|= TOKEN_QUERY
;
1269 if ((token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
,
1270 access
, &token_ops
)))
1272 const struct luid_attr
*privs
= get_req_data();
1273 struct luid_attr
*modified_privs
= NULL
;
1274 unsigned int priv_count
= get_req_data_size() / sizeof(*privs
);
1275 unsigned int modified_priv_count
= 0;
1277 if (req
->get_modified_state
&& !req
->disable_all
)
1280 /* count modified privs */
1281 for (i
= 0; i
< priv_count
; i
++)
1283 struct privilege
*privilege
= token_find_privilege( token
, privs
[i
].luid
, FALSE
);
1284 if (privilege
&& req
->get_modified_state
)
1285 modified_priv_count
++;
1287 reply
->len
= modified_priv_count
;
1288 modified_priv_count
= min( modified_priv_count
, get_reply_max_size() / sizeof(*modified_privs
) );
1289 if (modified_priv_count
)
1290 modified_privs
= set_reply_data_size( modified_priv_count
* sizeof(*modified_privs
) );
1292 reply
->len
= modified_priv_count
* sizeof(*modified_privs
);
1294 if (req
->disable_all
)
1295 token_disable_privileges( token
);
1297 token_adjust_privileges( token
, privs
, priv_count
, modified_privs
, modified_priv_count
);
1299 release_object( token
);
1303 /* retrieves the list of privileges that may be held be the token */
1304 DECL_HANDLER(get_token_privileges
)
1306 struct token
*token
;
1308 if ((token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
,
1313 struct luid_attr
*privs
;
1314 struct privilege
*privilege
;
1316 LIST_FOR_EACH_ENTRY( privilege
, &token
->privileges
, struct privilege
, entry
)
1319 reply
->len
= priv_count
* sizeof(*privs
);
1320 if (reply
->len
<= get_reply_max_size())
1322 privs
= set_reply_data_size( priv_count
* sizeof(*privs
) );
1324 LIST_FOR_EACH_ENTRY( privilege
, &token
->privileges
, struct privilege
, entry
)
1325 *privs
++ = luid_and_attr_from_privilege( privilege
);
1328 set_error(STATUS_BUFFER_TOO_SMALL
);
1330 release_object( token
);
1334 /* creates a duplicate of the token */
1335 DECL_HANDLER(duplicate_token
)
1337 struct token
*src_token
;
1338 struct unicode_str name
;
1339 const struct security_descriptor
*sd
;
1340 const struct object_attributes
*objattr
= get_req_object_attributes( &sd
, &name
, NULL
);
1342 if (!objattr
) return;
1344 if ((src_token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
,
1348 struct token
*token
= token_duplicate( src_token
, req
->primary
, req
->impersonation_level
, sd
, NULL
, 0, NULL
, 0 );
1351 unsigned int access
= req
->access
? req
->access
: get_handle_access( current
->process
, req
->handle
);
1352 reply
->new_handle
= alloc_handle_no_access_check( current
->process
, token
, access
, objattr
->attributes
);
1353 release_object( token
);
1355 release_object( src_token
);
1359 /* creates a restricted version of a token */
1360 DECL_HANDLER(filter_token
)
1362 struct token
*src_token
;
1364 if ((src_token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
, TOKEN_DUPLICATE
, &token_ops
)))
1366 const struct luid_attr
*filter_privileges
= get_req_data();
1367 unsigned int priv_count
, group_count
;
1368 const SID
*filter_groups
;
1369 struct token
*token
;
1371 priv_count
= min( req
->privileges_size
, get_req_data_size() ) / sizeof(struct luid_attr
);
1372 filter_groups
= (const SID
*)((char *)filter_privileges
+ priv_count
* sizeof(struct luid_attr
));
1373 group_count
= get_sid_count( filter_groups
, get_req_data_size() - priv_count
* sizeof(struct luid_attr
) );
1375 token
= token_duplicate( src_token
, src_token
->primary
, src_token
->impersonation_level
, NULL
,
1376 filter_privileges
, priv_count
, filter_groups
, group_count
);
1379 unsigned int access
= get_handle_access( current
->process
, req
->handle
);
1380 reply
->new_handle
= alloc_handle_no_access_check( current
->process
, token
, access
, 0 );
1381 release_object( token
);
1383 release_object( src_token
);
1387 /* checks the specified privileges are held by the token */
1388 DECL_HANDLER(check_token_privileges
)
1390 struct token
*token
;
1392 if ((token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
,
1396 unsigned int count
= get_req_data_size() / sizeof(struct luid_attr
);
1398 if (!token
->primary
&& token
->impersonation_level
<= SecurityAnonymous
)
1399 set_error( STATUS_BAD_IMPERSONATION_LEVEL
);
1400 else if (get_reply_max_size() >= count
* sizeof(struct luid_attr
))
1402 struct luid_attr
*usedprivs
= set_reply_data_size( count
* sizeof(*usedprivs
) );
1403 reply
->has_privileges
= token_check_privileges( token
, req
->all_required
, get_req_data(), count
, usedprivs
);
1406 set_error( STATUS_BUFFER_OVERFLOW
);
1407 release_object( token
);
1411 /* checks that a user represented by a token is allowed to access an object
1412 * represented by a security descriptor */
1413 DECL_HANDLER(access_check
)
1415 data_size_t sd_size
= get_req_data_size();
1416 const struct security_descriptor
*sd
= get_req_data();
1417 struct token
*token
;
1419 if (!sd_is_valid( sd
, sd_size
))
1421 set_error( STATUS_ACCESS_VIOLATION
);
1425 if ((token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
,
1429 unsigned int status
;
1430 struct luid_attr priv
;
1431 unsigned int priv_count
= 1;
1433 memset(&priv
, 0, sizeof(priv
));
1435 /* only impersonation tokens may be used with this function */
1438 set_error( STATUS_NO_IMPERSONATION_TOKEN
);
1439 release_object( token
);
1442 /* anonymous impersonation tokens can't be used */
1443 if (token
->impersonation_level
<= SecurityAnonymous
)
1445 set_error( STATUS_BAD_IMPERSONATION_LEVEL
);
1446 release_object( token
);
1450 status
= token_access_check( token
, sd
, req
->desired_access
, &priv
, &priv_count
, &req
->mapping
,
1451 &reply
->access_granted
, &reply
->access_status
);
1453 reply
->privileges_len
= priv_count
*sizeof(struct luid_attr
);
1455 if ((priv_count
> 0) && (reply
->privileges_len
<= get_reply_max_size()))
1457 struct luid_attr
*privs
= set_reply_data_size( priv_count
* sizeof(*privs
) );
1458 memcpy( privs
, &priv
, sizeof(priv
) );
1461 set_error( status
);
1462 release_object( token
);
1466 /* retrieves an SID from the token */
1467 DECL_HANDLER(get_token_sid
)
1469 struct token
*token
;
1473 if ((token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
, TOKEN_QUERY
, &token_ops
)))
1475 const SID
*sid
= NULL
;
1477 switch (req
->which_sid
)
1480 assert(token
->user
);
1483 case TokenPrimaryGroup
:
1484 sid
= token
->primary_group
;
1490 sid
= (const SID
*)&builtin_logon_sid
;
1493 set_error( STATUS_INVALID_PARAMETER
);
1499 reply
->sid_len
= security_sid_len( sid
);
1500 if (reply
->sid_len
<= get_reply_max_size()) set_reply_data( sid
, reply
->sid_len
);
1501 else set_error( STATUS_BUFFER_TOO_SMALL
);
1503 release_object( token
);
1507 /* retrieves the groups that the user represented by the token belongs to */
1508 DECL_HANDLER(get_token_groups
)
1510 struct token
*token
;
1512 reply
->user_len
= 0;
1514 if ((token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
,
1518 size_t size_needed
= sizeof(struct token_groups
);
1519 size_t sid_size
= 0;
1520 unsigned int group_count
= 0;
1521 const struct group
*group
;
1523 LIST_FOR_EACH_ENTRY( group
, &token
->groups
, const struct group
, entry
)
1526 sid_size
+= security_sid_len( &group
->sid
);
1528 size_needed
+= sid_size
;
1529 /* attributes size */
1530 size_needed
+= sizeof(unsigned int) * group_count
;
1532 /* reply buffer contains size_needed bytes formatted as:
1535 unsigned int attrib[count];
1538 user_len includes extra data needed for TOKEN_GROUPS representation,
1539 required caller buffer size calculated here to avoid extra server call */
1540 reply
->user_len
= FIELD_OFFSET( TOKEN_GROUPS
, Groups
[group_count
] ) + sid_size
;
1542 if (reply
->user_len
<= get_reply_max_size())
1544 struct token_groups
*tg
= set_reply_data_size( size_needed
);
1547 unsigned int *attr_ptr
= (unsigned int *)(tg
+ 1);
1548 SID
*sid_ptr
= (SID
*)(attr_ptr
+ group_count
);
1550 tg
->count
= group_count
;
1552 LIST_FOR_EACH_ENTRY( group
, &token
->groups
, const struct group
, entry
)
1556 if (group
->mandatory
) *attr_ptr
|= SE_GROUP_MANDATORY
;
1557 if (group
->def
) *attr_ptr
|= SE_GROUP_ENABLED_BY_DEFAULT
;
1558 if (group
->enabled
) *attr_ptr
|= SE_GROUP_ENABLED
;
1559 if (group
->owner
) *attr_ptr
|= SE_GROUP_OWNER
;
1560 if (group
->deny_only
) *attr_ptr
|= SE_GROUP_USE_FOR_DENY_ONLY
;
1561 if (group
->resource
) *attr_ptr
|= SE_GROUP_RESOURCE
;
1562 if (group
->logon
) *attr_ptr
|= SE_GROUP_LOGON_ID
;
1564 memcpy(sid_ptr
, &group
->sid
, security_sid_len( &group
->sid
));
1566 sid_ptr
= (SID
*)((char *)sid_ptr
+ security_sid_len( &group
->sid
));
1571 else set_error( STATUS_BUFFER_TOO_SMALL
);
1573 release_object( token
);
1577 DECL_HANDLER(get_token_info
)
1579 struct token
*token
;
1581 if ((token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
, TOKEN_QUERY
, &token_ops
)))
1583 reply
->token_id
= token
->token_id
;
1584 reply
->modified_id
= token
->modified_id
;
1585 reply
->session_id
= token
->session_id
;
1586 reply
->primary
= token
->primary
;
1587 reply
->impersonation_level
= token
->impersonation_level
;
1588 reply
->elevation
= token
->elevation
;
1589 reply
->group_count
= list_count( &token
->groups
);
1590 reply
->privilege_count
= list_count( &token
->privileges
);
1591 release_object( token
);
1595 DECL_HANDLER(get_token_default_dacl
)
1597 struct token
*token
;
1601 if ((token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
,
1605 if (token
->default_dacl
)
1606 reply
->acl_len
= token
->default_dacl
->AclSize
;
1608 if (reply
->acl_len
<= get_reply_max_size())
1610 ACL
*acl_reply
= set_reply_data_size( reply
->acl_len
);
1612 memcpy( acl_reply
, token
->default_dacl
, reply
->acl_len
);
1614 else set_error( STATUS_BUFFER_TOO_SMALL
);
1616 release_object( token
);
1620 DECL_HANDLER(set_token_default_dacl
)
1622 struct token
*token
;
1624 if ((token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
,
1625 TOKEN_ADJUST_DEFAULT
,
1628 const ACL
*acl
= get_req_data();
1629 unsigned int acl_size
= get_req_data_size();
1631 free( token
->default_dacl
);
1632 token
->default_dacl
= NULL
;
1635 token
->default_dacl
= memdup( acl
, acl_size
);
1637 release_object( token
);
1641 DECL_HANDLER(create_linked_token
)
1643 struct token
*token
, *linked
;
1646 if ((token
= (struct token
*)get_handle_obj( current
->process
, req
->handle
,
1647 TOKEN_QUERY
, &token_ops
)))
1649 switch (token
->elevation
)
1651 case TokenElevationTypeFull
:
1652 elevation
= TokenElevationTypeLimited
;
1654 case TokenElevationTypeLimited
:
1655 elevation
= TokenElevationTypeFull
;
1658 release_object( token
);
1661 if ((linked
= token_create_admin( FALSE
, SecurityIdentification
, elevation
, token
->session_id
)))
1663 reply
->linked
= alloc_handle( current
->process
, linked
, TOKEN_ALL_ACCESS
, 0 );
1664 release_object( linked
);
1666 release_object( token
);