msi: Select the first item in the SelectionTree control.
[wine.git] / server / token.c
blobce08e95ac9e0577aa687c54b9c91049ca190bc7b
1 /*
2 * Tokens
4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
23 #include "config.h"
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <stdarg.h>
30 #include "ntstatus.h"
31 #define WIN32_NO_STATUS
32 #include "windef.h"
33 #include "winternl.h"
35 #include "handle.h"
36 #include "thread.h"
37 #include "process.h"
38 #include "request.h"
39 #include "security.h"
41 #include "wine/unicode.h"
43 #define MAX_SUBAUTH_COUNT 1
45 const LUID SeIncreaseQuotaPrivilege = { 5, 0 };
46 const LUID SeSecurityPrivilege = { 8, 0 };
47 const LUID SeTakeOwnershipPrivilege = { 9, 0 };
48 const LUID SeLoadDriverPrivilege = { 10, 0 };
49 const LUID SeSystemProfilePrivilege = { 11, 0 };
50 const LUID SeSystemtimePrivilege = { 12, 0 };
51 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
52 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
53 const LUID SeCreatePagefilePrivilege = { 15, 0 };
54 const LUID SeBackupPrivilege = { 17, 0 };
55 const LUID SeRestorePrivilege = { 18, 0 };
56 const LUID SeShutdownPrivilege = { 19, 0 };
57 const LUID SeDebugPrivilege = { 20, 0 };
58 const LUID SeSystemEnvironmentPrivilege = { 22, 0 };
59 const LUID SeChangeNotifyPrivilege = { 23, 0 };
60 const LUID SeRemoteShutdownPrivilege = { 24, 0 };
61 const LUID SeUndockPrivilege = { 25, 0 };
62 const LUID SeManageVolumePrivilege = { 28, 0 };
63 const LUID SeImpersonatePrivilege = { 29, 0 };
64 const LUID SeCreateGlobalPrivilege = { 30, 0 };
66 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
67 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
68 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
69 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
70 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
71 static const PSID security_world_sid = (PSID)&world_sid;
72 static const PSID security_local_sid = (PSID)&local_sid;
73 const PSID security_interactive_sid = (PSID)&interactive_sid;
74 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
75 static const PSID security_local_system_sid = (PSID)&local_system_sid;
77 struct token
79 struct object obj; /* object header */
80 struct list privileges; /* privileges available to the token */
81 struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
82 SID *user; /* SID of user this token represents */
83 unsigned primary; /* is this a primary or impersonation token? */
84 ACL *default_dacl; /* the default DACL to assign to objects created by this user */
85 TOKEN_SOURCE source; /* source of the token */
88 struct privilege
90 struct list entry;
91 LUID luid;
92 unsigned enabled : 1; /* is the privilege currently enabled? */
93 unsigned def : 1; /* is the privilege enabled by default? */
96 struct group
98 struct list entry;
99 unsigned enabled : 1; /* is the sid currently enabled? */
100 unsigned def : 1; /* is the sid enabled by default? */
101 unsigned logon : 1; /* is this a logon sid? */
102 unsigned mandatory: 1; /* is this sid always enabled? */
103 unsigned owner : 1; /* can this sid be an owner of an object? */
104 unsigned resource : 1; /* is this a domain-local group? */
105 unsigned deny_only: 1; /* is this a sid that should be use for denying only? */
106 SID sid;
109 static void token_dump( struct object *obj, int verbose );
110 static unsigned int token_map_access( struct object *obj, unsigned int access );
111 static void token_destroy( struct object *obj );
113 static const struct object_ops token_ops =
115 sizeof(struct token), /* size */
116 token_dump, /* dump */
117 no_add_queue, /* add_queue */
118 NULL, /* remove_queue */
119 NULL, /* signaled */
120 NULL, /* satisfied */
121 no_signal, /* signal */
122 no_get_fd, /* get_fd */
123 token_map_access, /* map_access */
124 no_lookup_name, /* lookup_name */
125 no_close_handle, /* close_handle */
126 token_destroy /* destroy */
130 static void token_dump( struct object *obj, int verbose )
132 fprintf( stderr, "Security token\n" );
133 /* FIXME: dump token members */
136 static unsigned int token_map_access( struct object *obj, unsigned int access )
138 if (access & GENERIC_READ) access |= TOKEN_READ;
139 if (access & GENERIC_WRITE) access |= TOKEN_WRITE;
140 if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
141 if (access & GENERIC_ALL) access |= TOKEN_ALL_ACCESS;
142 return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
145 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
147 int i;
148 SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
149 if (!sid) return NULL;
150 sid->Revision = SID_REVISION;
151 sid->SubAuthorityCount = subauthcount;
152 sid->IdentifierAuthority = *idauthority;
153 for (i = 0; i < subauthcount; i++)
154 sid->SubAuthority[i] = subauth[i];
155 return sid;
158 static inline int security_equal_sid( const SID *sid1, const SID *sid2 )
160 return ((sid1->SubAuthorityCount == sid2->SubAuthorityCount) &&
161 !memcmp( sid1, sid2, FIELD_OFFSET(SID, SubAuthority[sid1->SubAuthorityCount]) ));
164 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
166 if (!handle)
168 if (thread->token)
169 release_object( thread->token );
170 thread->token = NULL;
172 else
174 struct token *token = (struct token *)get_handle_obj( current->process,
175 handle,
176 TOKEN_IMPERSONATE,
177 &token_ops );
178 if (token)
180 if (thread->token)
181 release_object( thread->token );
182 thread->token = token;
187 static const ACE_HEADER *ace_next( const ACE_HEADER *ace )
189 return (const ACE_HEADER *)((const char *)ace + ace->AceSize);
192 static int acl_is_valid( const ACL *acl, data_size_t size )
194 ULONG i;
195 const ACE_HEADER *ace;
197 if (size < sizeof(ACL))
198 return FALSE;
200 size = min(size, MAX_ACL_LEN);
202 size -= sizeof(ACL);
204 ace = (const ACE_HEADER *)(acl + 1);
205 for (i = 0; i < acl->AceCount; i++)
207 const SID *sid;
208 data_size_t sid_size;
210 if (size < sizeof(ACE_HEADER))
211 return FALSE;
212 if (size < ace->AceSize)
213 return FALSE;
214 size -= ace->AceSize;
215 switch (ace->AceType)
217 case ACCESS_DENIED_ACE_TYPE:
218 sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
219 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
220 break;
221 case ACCESS_ALLOWED_ACE_TYPE:
222 sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
223 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
224 break;
225 case SYSTEM_AUDIT_ACE_TYPE:
226 sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
227 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
228 break;
229 case SYSTEM_ALARM_ACE_TYPE:
230 sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
231 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
232 break;
233 default:
234 return FALSE;
236 if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) ||
237 sid_size < FIELD_OFFSET(SID, SubAuthority[sid->SubAuthorityCount]))
238 return FALSE;
239 ace = ace_next( ace );
241 return TRUE;
244 /* gets the discretionary access control list from a security descriptor */
245 static inline const ACL *sd_get_dacl( const struct security_descriptor *sd, int *present )
247 *present = (sd->control & SE_DACL_PRESENT ? TRUE : FALSE);
249 if (sd->dacl_len)
250 return (const ACL *)((const char *)(sd + 1) +
251 sd->owner_len + sd->group_len + sd->sacl_len);
252 else
253 return NULL;
256 /* gets the system access control list from a security descriptor */
257 static inline const ACL *sd_get_sacl( const struct security_descriptor *sd, int *present )
259 *present = (sd->control & SE_SACL_PRESENT ? TRUE : FALSE);
261 if (sd->sacl_len)
262 return (const ACL *)((const char *)(sd + 1) +
263 sd->owner_len + sd->group_len);
264 else
265 return NULL;
268 /* gets the owner from a security descriptor */
269 static inline const SID *sd_get_owner( const struct security_descriptor *sd )
271 if (sd->owner_len)
272 return (const SID *)(sd + 1);
273 else
274 return NULL;
277 /* gets the primary group from a security descriptor */
278 static inline const SID *sd_get_group( const struct security_descriptor *sd )
280 if (sd->group_len)
281 return (const SID *)((const char *)(sd + 1) + sd->owner_len);
282 else
283 return NULL;
286 /* checks whether all members of a security descriptor fit inside the size
287 * of memory specified */
288 static int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
290 size_t offset = sizeof(struct security_descriptor);
291 const SID *group;
292 const SID *owner;
293 const ACL *sacl;
294 const ACL *dacl;
295 int dummy;
297 if (size < offset)
298 return FALSE;
300 if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
301 (offset + sd->owner_len > size))
302 return FALSE;
303 owner = sd_get_owner( sd );
304 if (owner)
306 size_t needed_size = FIELD_OFFSET(SID, SubAuthority[owner->SubAuthorityCount]);
307 if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
308 return FALSE;
310 offset += sd->owner_len;
312 if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
313 (offset + sd->group_len > size))
314 return FALSE;
315 group = sd_get_group( sd );
316 if (group)
318 size_t needed_size = FIELD_OFFSET(SID, SubAuthority[group->SubAuthorityCount]);
319 if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
320 return FALSE;
322 offset += sd->group_len;
324 if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
325 return FALSE;
326 sacl = sd_get_sacl( sd, &dummy );
327 if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
328 return FALSE;
329 offset += sd->sacl_len;
331 if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
332 return FALSE;
333 dacl = sd_get_dacl( sd, &dummy );
334 if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
335 return FALSE;
336 offset += sd->dacl_len;
338 return TRUE;
341 /* maps from generic rights to specific rights as given by a mapping */
342 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
344 if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
345 if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
346 if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
347 if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
348 *mask &= 0x0FFFFFFF;
351 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
353 return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
356 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
358 out->Luid = in->luid;
359 out->Attributes =
360 (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
361 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
364 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
366 struct privilege *privilege = mem_alloc( sizeof(*privilege) );
367 if (privilege)
369 privilege->luid = *luid;
370 privilege->def = privilege->enabled = (enabled != 0);
371 list_add_tail( &token->privileges, &privilege->entry );
373 return privilege;
376 static inline void privilege_remove( struct privilege *privilege )
378 list_remove( &privilege->entry );
379 free( privilege );
382 static void token_destroy( struct object *obj )
384 struct token* token;
385 struct list *cursor, *cursor_next;
387 assert( obj->ops == &token_ops );
388 token = (struct token *)obj;
390 free( token->user );
392 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
394 struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
395 privilege_remove( privilege );
398 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
400 struct group *group = LIST_ENTRY( cursor, struct group, entry );
401 list_remove( &group->entry );
402 free( group );
405 free( token->default_dacl );
408 /* creates a new token.
409 * groups may be NULL if group_count is 0.
410 * privs may be NULL if priv_count is 0.
411 * default_dacl may be NULL, indicating that all objects created by the user
412 * are unsecured.
414 static struct token *create_token( unsigned primary, const SID *user,
415 const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
416 const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
417 const ACL *default_dacl, TOKEN_SOURCE source )
419 struct token *token = alloc_object( &token_ops );
420 if (token)
422 unsigned int i;
424 list_init( &token->privileges );
425 list_init( &token->groups );
426 token->primary = primary;
428 /* copy user */
429 token->user = memdup( user, FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]) );
430 if (!token->user)
432 release_object( token );
433 return NULL;
436 /* copy groups */
437 for (i = 0; i < group_count; i++)
439 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
440 struct group *group = mem_alloc( size );
442 if (!group)
444 release_object( token );
445 return NULL;
447 memcpy( &group->sid, groups[i].Sid, FIELD_OFFSET( SID, SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] ) );
448 group->enabled = TRUE;
449 group->def = TRUE;
450 group->logon = FALSE;
451 group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) ? TRUE : FALSE;
452 group->owner = FALSE;
453 group->resource = FALSE;
454 group->deny_only = FALSE;
455 list_add_tail( &token->groups, &group->entry );
458 /* copy privileges */
459 for (i = 0; i < priv_count; i++)
461 /* note: we don't check uniqueness: the caller must make sure
462 * privs doesn't contain any duplicate luids */
463 if (!privilege_add( token, &privs[i].Luid,
464 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
466 release_object( token );
467 return NULL;
471 if (default_dacl)
473 token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
474 if (!token->default_dacl)
476 release_object( token );
477 return NULL;
480 else
481 token->default_dacl = NULL;
483 token->source = source;
485 return token;
488 static ACL *create_default_dacl( const SID *user )
490 ACCESS_ALLOWED_ACE *aaa;
491 ACL *default_dacl;
492 SID *sid;
493 size_t default_dacl_size = sizeof(ACL) +
494 2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
495 sizeof(local_system_sid) +
496 FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]);
498 default_dacl = mem_alloc( default_dacl_size );
499 if (!default_dacl) return NULL;
501 default_dacl->AclRevision = MAX_ACL_REVISION;
502 default_dacl->Sbz1 = 0;
503 default_dacl->AclSize = default_dacl_size;
504 default_dacl->AceCount = 2;
505 default_dacl->Sbz2 = 0;
507 /* GENERIC_ALL for Local System */
508 aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
509 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
510 aaa->Header.AceFlags = 0;
511 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
512 sizeof(local_system_sid);
513 aaa->Mask = GENERIC_ALL;
514 sid = (SID *)&aaa->SidStart;
515 memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
517 /* GENERIC_ALL for specified user */
518 aaa = (ACCESS_ALLOWED_ACE *)((const char *)aaa + aaa->Header.AceSize);
519 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
520 aaa->Header.AceFlags = 0;
521 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
522 FIELD_OFFSET( SID, SubAuthority[user->SubAuthorityCount] );
523 aaa->Mask = GENERIC_ALL;
524 sid = (SID *)&aaa->SidStart;
525 memcpy( sid, user, FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]) );
527 return default_dacl;
530 struct sid_data
532 SID_IDENTIFIER_AUTHORITY idauth;
533 int count;
534 unsigned int subauth[MAX_SUBAUTH_COUNT];
537 struct token *token_create_admin( void )
539 struct token *token = NULL;
540 static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
541 static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
542 static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
543 PSID alias_admins_sid;
544 PSID alias_users_sid;
545 ACL *default_dacl = create_default_dacl( &local_system_sid );
547 alias_admins_sid = security_sid_alloc( &nt_authority, sizeof(alias_admins_subauth)/sizeof(alias_admins_subauth[0]),
548 alias_admins_subauth );
549 alias_users_sid = security_sid_alloc( &nt_authority, sizeof(alias_users_subauth)/sizeof(alias_users_subauth[0]),
550 alias_users_subauth );
552 if (alias_admins_sid && alias_users_sid && default_dacl)
554 const LUID_AND_ATTRIBUTES admin_privs[] =
556 { SeChangeNotifyPrivilege , SE_PRIVILEGE_ENABLED },
557 { SeSecurityPrivilege , 0 },
558 { SeBackupPrivilege , 0 },
559 { SeRestorePrivilege , 0 },
560 { SeSystemtimePrivilege , 0 },
561 { SeShutdownPrivilege , 0 },
562 { SeRemoteShutdownPrivilege , 0 },
563 { SeTakeOwnershipPrivilege , 0 },
564 { SeDebugPrivilege , 0 },
565 { SeSystemEnvironmentPrivilege , 0 },
566 { SeSystemProfilePrivilege , 0 },
567 { SeProfileSingleProcessPrivilege, 0 },
568 { SeIncreaseBasePriorityPrivilege, 0 },
569 { SeLoadDriverPrivilege , 0 },
570 { SeCreatePagefilePrivilege , 0 },
571 { SeIncreaseQuotaPrivilege , 0 },
572 { SeUndockPrivilege , 0 },
573 { SeManageVolumePrivilege , 0 },
574 { SeImpersonatePrivilege , SE_PRIVILEGE_ENABLED },
575 { SeCreateGlobalPrivilege , SE_PRIVILEGE_ENABLED },
577 /* note: we don't include non-builtin groups here for the user -
578 * telling us these is the job of a client-side program */
579 const SID_AND_ATTRIBUTES admin_groups[] =
581 { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
582 { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
583 { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
584 { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
585 { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
586 { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
588 static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
589 /* note: we just set the user sid to be the interactive builtin sid -
590 * we should really translate the UNIX user id to a sid */
591 token = create_token( TRUE, &interactive_sid,
592 admin_groups, sizeof(admin_groups)/sizeof(admin_groups[0]),
593 admin_privs, sizeof(admin_privs)/sizeof(admin_privs[0]),
594 default_dacl, admin_source );
597 if (alias_admins_sid)
598 free( alias_admins_sid );
599 if (alias_users_sid)
600 free( alias_users_sid );
601 if (default_dacl)
602 free( default_dacl );
604 return token;
607 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
609 struct privilege *privilege;
610 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
612 if (is_equal_luid( luid, &privilege->luid ))
614 if (enabled_only && !privilege->enabled)
615 return NULL;
616 return privilege;
619 return NULL;
622 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
623 unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
624 unsigned int mod_privs_count )
626 unsigned int i, modified_count = 0;
628 for (i = 0; i < count; i++)
630 struct privilege *privilege =
631 token_find_privilege( token, &privs[i].Luid, FALSE );
632 if (!privilege)
634 set_error( STATUS_NOT_ALL_ASSIGNED );
635 continue;
638 if (privs[i].Attributes & SE_PRIVILEGE_REMOVE)
639 privilege_remove( privilege );
640 else
642 /* save previous state for caller */
643 if (mod_privs_count)
645 luid_and_attr_from_privilege(mod_privs, privilege);
646 mod_privs++;
647 mod_privs_count--;
648 modified_count++;
651 if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
652 privilege->enabled = TRUE;
653 else
654 privilege->enabled = FALSE;
657 return modified_count;
660 static void token_disable_privileges( struct token *token )
662 struct privilege *privilege;
663 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
664 privilege->enabled = FALSE;
667 int token_check_privileges( struct token *token, int all_required,
668 const LUID_AND_ATTRIBUTES *reqprivs,
669 unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
671 unsigned int i, enabled_count = 0;
673 for (i = 0; i < count; i++)
675 struct privilege *privilege =
676 token_find_privilege( token, &reqprivs[i].Luid, TRUE );
678 if (usedprivs)
679 usedprivs[i] = reqprivs[i];
681 if (privilege && privilege->enabled)
683 enabled_count++;
684 if (usedprivs)
685 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
689 if (all_required)
690 return (enabled_count == count);
691 else
692 return (enabled_count > 0);
695 static int token_sid_present( struct token *token, const SID *sid, int deny )
697 struct group *group;
699 if (security_equal_sid( token->user, sid )) return TRUE;
701 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
703 if (!group->enabled) continue;
704 if (group->deny_only && !deny) continue;
706 if (security_equal_sid( &group->sid, sid )) return TRUE;
709 return FALSE;
712 /* checks access to a security descriptor. sd must have been validated by caller.
713 * it returns STATUS_SUCCESS if access was granted to the object, or an error
714 * status code if not, giving the reason. errors not relating to giving access
715 * to the object are returned in the status parameter. granted_access and
716 * status always have a valid value stored in them on return. */
717 static unsigned int token_access_check( struct token *token,
718 const struct security_descriptor *sd,
719 unsigned int desired_access,
720 LUID_AND_ATTRIBUTES *privs,
721 unsigned int *priv_count,
722 const GENERIC_MAPPING *mapping,
723 unsigned int *granted_access,
724 unsigned int *status )
726 unsigned int current_access = 0;
727 unsigned int denied_access = 0;
728 ULONG i;
729 const ACL *dacl;
730 int dacl_present;
731 const ACE_HEADER *ace;
732 const SID *owner;
734 /* assume success, but no access rights */
735 *status = STATUS_SUCCESS;
736 *granted_access = 0;
738 /* fail if desired_access contains generic rights */
739 if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
741 *priv_count = 0;
742 *status = STATUS_GENERIC_NOT_MAPPED;
743 return STATUS_ACCESS_DENIED;
746 dacl = sd_get_dacl( sd, &dacl_present );
747 owner = sd_get_owner( sd );
748 if (!owner || !sd_get_group( sd ))
750 *priv_count = 0;
751 *status = STATUS_INVALID_SECURITY_DESCR;
752 return STATUS_ACCESS_DENIED;
755 /* 1: Grant desired access if the object is unprotected */
756 if (!dacl_present)
758 *priv_count = 0;
759 *granted_access = desired_access;
760 return STATUS_SUCCESS;
762 if (!dacl)
764 *priv_count = 0;
765 return STATUS_ACCESS_DENIED;
768 /* 2: Check if caller wants access to system security part. Note: access
769 * is only granted if specifically asked for */
770 if (desired_access & ACCESS_SYSTEM_SECURITY)
772 const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
773 LUID_AND_ATTRIBUTES retpriv = security_priv;
774 if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
776 if (priv_count)
778 /* assumes that there will only be one privilege to return */
779 if (*priv_count >= 1)
781 *priv_count = 1;
782 *privs = retpriv;
784 else
786 *priv_count = 1;
787 return STATUS_BUFFER_TOO_SMALL;
790 current_access |= ACCESS_SYSTEM_SECURITY;
791 if (desired_access == current_access)
793 *granted_access = current_access;
794 return STATUS_SUCCESS;
797 else
799 *priv_count = 0;
800 return STATUS_PRIVILEGE_NOT_HELD;
803 else if (priv_count) *priv_count = 0;
805 /* 3: Check whether the token is the owner */
806 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
807 * checked when a "set owner" call is made, overriding the access rights
808 * determined here. */
809 if (token_sid_present( token, owner, FALSE ))
811 current_access |= (READ_CONTROL | WRITE_DAC);
812 if (desired_access == current_access)
814 *granted_access = current_access;
815 return STATUS_SUCCESS;
819 /* 4: Grant rights according to the DACL */
820 ace = (const ACE_HEADER *)(dacl + 1);
821 for (i = 0; i < dacl->AceCount; i++)
823 const ACCESS_ALLOWED_ACE *aa_ace;
824 const ACCESS_DENIED_ACE *ad_ace;
825 const SID *sid;
826 switch (ace->AceType)
828 case ACCESS_DENIED_ACE_TYPE:
829 ad_ace = (const ACCESS_DENIED_ACE *)ace;
830 sid = (const SID *)&ad_ace->SidStart;
831 if (token_sid_present( token, sid, TRUE ))
833 unsigned int access = ad_ace->Mask;
834 map_generic_mask(&access, mapping);
835 if (desired_access & MAXIMUM_ALLOWED)
836 denied_access |= access;
837 else
839 denied_access |= (access & ~current_access);
840 if (desired_access & access)
842 *granted_access = 0;
843 return STATUS_SUCCESS;
847 break;
848 case ACCESS_ALLOWED_ACE_TYPE:
849 aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
850 sid = (const SID *)&aa_ace->SidStart;
851 if (token_sid_present( token, sid, FALSE ))
853 unsigned int access = aa_ace->Mask;
854 map_generic_mask(&access, mapping);
855 if (desired_access & MAXIMUM_ALLOWED)
856 current_access |= access;
857 else
858 current_access |= (access & ~denied_access);
860 break;
863 /* don't bother carrying on checking if we've already got all of
864 * rights we need */
865 if (desired_access == *granted_access)
866 break;
868 ace = ace_next( ace );
871 if (desired_access & MAXIMUM_ALLOWED)
873 *granted_access = current_access & ~denied_access;
874 if (*granted_access)
875 return STATUS_SUCCESS;
876 else
877 return STATUS_ACCESS_DENIED;
879 else
881 if ((current_access & desired_access) == desired_access)
883 *granted_access = current_access & desired_access;
884 return STATUS_SUCCESS;
886 else
887 return STATUS_ACCESS_DENIED;
891 const ACL *token_get_default_dacl( struct token *token )
893 return token->default_dacl;
896 /* open a security token */
897 DECL_HANDLER(open_token)
899 if (req->flags & OPEN_TOKEN_THREAD)
901 struct thread *thread = get_thread_from_handle( req->handle, 0 );
902 if (thread)
904 if (thread->token)
905 reply->token = alloc_handle( current->process, thread->token, req->access,
906 req->attributes );
907 else
908 set_error(STATUS_NO_TOKEN);
909 release_object( thread );
912 else
914 struct process *process = get_process_from_handle( req->handle, 0 );
915 if (process)
917 if (process->token)
918 reply->token = alloc_handle( current->process, process->token, req->access,
919 req->attributes );
920 else
921 set_error(STATUS_NO_TOKEN);
922 release_object( process );
927 /* adjust the privileges held by a token */
928 DECL_HANDLER(adjust_token_privileges)
930 struct token *token;
931 unsigned int access = TOKEN_ADJUST_PRIVILEGES;
933 if (req->get_modified_state) access |= TOKEN_QUERY;
935 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
936 access, &token_ops )))
938 const LUID_AND_ATTRIBUTES *privs = get_req_data();
939 LUID_AND_ATTRIBUTES *modified_privs = NULL;
940 unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
941 unsigned int modified_priv_count = 0;
943 if (req->get_modified_state && !req->disable_all)
945 unsigned int i;
946 /* count modified privs */
947 for (i = 0; i < priv_count; i++)
949 struct privilege *privilege =
950 token_find_privilege( token, &privs[i].Luid, FALSE );
951 if (privilege && req->get_modified_state)
952 modified_priv_count++;
954 reply->len = modified_priv_count;
955 modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
956 if (modified_priv_count)
957 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
959 reply->len = modified_priv_count * sizeof(*modified_privs);
961 if (req->disable_all)
962 token_disable_privileges( token );
963 else
964 modified_priv_count = token_adjust_privileges( token, privs,
965 priv_count, modified_privs, modified_priv_count );
967 release_object( token );
971 /* retrieves the list of privileges that may be held be the token */
972 DECL_HANDLER(get_token_privileges)
974 struct token *token;
976 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
977 TOKEN_QUERY,
978 &token_ops )))
980 int priv_count = 0;
981 LUID_AND_ATTRIBUTES *privs;
982 struct privilege *privilege;
984 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
985 priv_count++;
987 reply->len = priv_count * sizeof(*privs);
988 if (reply->len <= get_reply_max_size())
990 privs = set_reply_data_size( priv_count * sizeof(*privs) );
991 if (privs)
993 int i = 0;
994 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
996 luid_and_attr_from_privilege( &privs[i], privilege );
997 i++;
1001 else
1002 set_error(STATUS_BUFFER_TOO_SMALL);
1004 release_object( token );
1008 /* creates a duplicate of the token */
1009 DECL_HANDLER(duplicate_token)
1011 struct token *src_token;
1012 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1013 TOKEN_DUPLICATE,
1014 &token_ops )))
1016 /* FIXME: use req->impersonation_level */
1017 struct token *token = create_token( req->primary, src_token->user,
1018 NULL, 0, NULL, 0,
1019 src_token->default_dacl,
1020 src_token->source );
1021 if (token)
1023 struct privilege *privilege;
1024 struct group *group;
1025 unsigned int access;
1027 /* copy groups */
1028 LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
1030 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
1031 struct group *newgroup = mem_alloc( size );
1032 if (!newgroup)
1034 release_object( token );
1035 release_object( src_token );
1036 return;
1038 memcpy( newgroup, group, size );
1039 list_add_tail( &token->groups, &newgroup->entry );
1042 /* copy privileges */
1043 LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
1044 privilege_add( token, &privilege->luid, privilege->enabled );
1046 access = req->access;
1047 if (access & MAXIMUM_ALLOWED) access = TOKEN_ALL_ACCESS; /* FIXME: needs general solution */
1048 reply->new_handle = alloc_handle( current->process, token, access, req->attributes);
1049 release_object( token );
1051 release_object( src_token );
1055 /* checks the specified privileges are held by the token */
1056 DECL_HANDLER(check_token_privileges)
1058 struct token *token;
1060 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1061 TOKEN_QUERY,
1062 &token_ops )))
1064 unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1065 if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1067 LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1068 reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1070 else
1071 set_error( STATUS_BUFFER_OVERFLOW );
1072 release_object( token );
1076 /* checks that a user represented by a token is allowed to access an object
1077 * represented by a security descriptor */
1078 DECL_HANDLER(access_check)
1080 data_size_t sd_size = get_req_data_size();
1081 const struct security_descriptor *sd = get_req_data();
1082 struct token *token;
1084 if (!sd_is_valid( sd, sd_size ))
1086 set_error( STATUS_ACCESS_VIOLATION );
1087 return;
1090 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1091 TOKEN_QUERY,
1092 &token_ops )))
1094 GENERIC_MAPPING mapping;
1095 unsigned int status;
1096 LUID_AND_ATTRIBUTES priv;
1097 unsigned int priv_count = 1;
1099 memset(&priv, 0, sizeof(priv));
1101 /* only impersonation tokens may be used with this function */
1102 if (token->primary)
1104 set_error( STATUS_NO_IMPERSONATION_TOKEN );
1105 release_object( token );
1106 return;
1109 mapping.GenericRead = req->mapping_read;
1110 mapping.GenericWrite = req->mapping_write;
1111 mapping.GenericExecute = req->mapping_execute;
1112 mapping.GenericAll = req->mapping_all;
1114 reply->access_status = token_access_check(
1115 token, sd, req->desired_access, &priv, &priv_count, &mapping,
1116 &reply->access_granted, &status );
1118 reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1120 if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1122 LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1123 memcpy( privs, &priv, sizeof(priv) );
1126 if (status != STATUS_SUCCESS)
1127 set_error( status );
1129 release_object( token );
1133 /* retrieves the SID of the user that the token represents */
1134 DECL_HANDLER(get_token_user)
1136 struct token *token;
1138 reply->user_len = 0;
1140 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1141 TOKEN_QUERY,
1142 &token_ops )))
1144 const SID *user = token->user;
1146 reply->user_len = FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]);
1147 if (reply->user_len <= get_reply_max_size())
1149 SID *user_reply = set_reply_data_size( reply->user_len );
1150 if (user_reply)
1151 memcpy( user_reply, user, reply->user_len );
1153 else set_error( STATUS_BUFFER_TOO_SMALL );
1155 release_object( token );
1159 /* retrieves the groups that the user represented by the token belongs to */
1160 DECL_HANDLER(get_token_groups)
1162 struct token *token;
1164 reply->user_len = 0;
1166 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1167 TOKEN_QUERY,
1168 &token_ops )))
1170 size_t size_needed = sizeof(struct token_groups);
1171 unsigned int group_count = 0;
1172 const struct group *group;
1174 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1176 group_count++;
1177 size_needed += FIELD_OFFSET(SID, SubAuthority[group->sid.SubAuthorityCount]);
1179 size_needed += sizeof(unsigned int) * group_count;
1181 reply->user_len = size_needed;
1183 if (size_needed <= get_reply_max_size())
1185 struct token_groups *tg = set_reply_data_size( size_needed );
1186 if (tg)
1188 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1189 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1191 tg->count = group_count;
1193 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1196 *attr_ptr = 0;
1197 if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1198 if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1199 if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1200 if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1201 if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1202 if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1204 memcpy(sid_ptr, &group->sid, FIELD_OFFSET(SID, SubAuthority[group->sid.SubAuthorityCount]));
1206 sid_ptr = (SID *)((char *)sid_ptr + FIELD_OFFSET(SID, SubAuthority[group->sid.SubAuthorityCount]));
1207 attr_ptr++;
1211 else set_error( STATUS_BUFFER_TOO_SMALL );
1213 release_object( token );