?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
kernel32: Move Beep implementation to conhost.
[wine.git] / server / token.c
blob23e85ebbff36133506ca0259c494f72f2eb4bc12
1 /*
2 * Tokens
3 *
4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 */
22
23 #include "config.h"
24
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <stdarg.h>
29 #include <unistd.h>
30
31 #include "ntstatus.h"
32 #define WIN32_NO_STATUS
33 #include "windef.h"
34 #include "winternl.h"
35
36 #include "handle.h"
37 #include "thread.h"
38 #include "process.h"
39 #include "request.h"
40 #include "security.h"
41
42 #define MAX_SUBAUTH_COUNT 1
43
44 const LUID SeIncreaseQuotaPrivilege = { 5, 0 };
45 const LUID SeSecurityPrivilege = { 8, 0 };
46 const LUID SeTakeOwnershipPrivilege = { 9, 0 };
47 const LUID SeLoadDriverPrivilege = { 10, 0 };
48 const LUID SeSystemProfilePrivilege = { 11, 0 };
49 const LUID SeSystemtimePrivilege = { 12, 0 };
50 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
51 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
52 const LUID SeCreatePagefilePrivilege = { 15, 0 };
53 const LUID SeBackupPrivilege = { 17, 0 };
54 const LUID SeRestorePrivilege = { 18, 0 };
55 const LUID SeShutdownPrivilege = { 19, 0 };
56 const LUID SeDebugPrivilege = { 20, 0 };
57 const LUID SeSystemEnvironmentPrivilege = { 22, 0 };
58 const LUID SeChangeNotifyPrivilege = { 23, 0 };
59 const LUID SeRemoteShutdownPrivilege = { 24, 0 };
60 const LUID SeUndockPrivilege = { 25, 0 };
61 const LUID SeManageVolumePrivilege = { 28, 0 };
62 const LUID SeImpersonatePrivilege = { 29, 0 };
63 const LUID SeCreateGlobalPrivilege = { 30, 0 };
64
65 #define SID_N(n) struct /* same fields as struct SID */ \
66 { \
67 BYTE Revision; \
68 BYTE SubAuthorityCount; \
69 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
70 DWORD SubAuthority[n]; \
71 }
72
73 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
74 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
75 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
76 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
77 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
78 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
79 static const SID high_label_sid = { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY }, { SECURITY_MANDATORY_HIGH_RID } };
80 static const SID_N(5) local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
81 static const SID_N(2) builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
82 static const SID_N(2) builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
83 static const SID_N(3) builtin_logon_sid = { SID_REVISION, 3, { SECURITY_NT_AUTHORITY }, { SECURITY_LOGON_IDS_RID, 0, 0 } };
84 static const SID_N(5) domain_users_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, DOMAIN_GROUP_RID_USERS } };
85
86 const PSID security_world_sid = (PSID)&world_sid;
87 static const PSID security_local_sid = (PSID)&local_sid;
88 static const PSID security_interactive_sid = (PSID)&interactive_sid;
89 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
90 const PSID security_local_system_sid = (PSID)&local_system_sid;
91 const PSID security_local_user_sid = (PSID)&local_user_sid;
92 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
93 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
94 const PSID security_domain_users_sid = (PSID)&domain_users_sid;
95 const PSID security_high_label_sid = (PSID)&high_label_sid;
96
97 static luid_t prev_luid_value = { 1000, 0 };
98
99 struct token
100 {
101 struct object obj; /* object header */
102 luid_t token_id; /* system-unique id of token */
103 luid_t modified_id; /* new id allocated every time token is modified */
104 struct list privileges; /* privileges available to the token */
105 struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
106 SID *user; /* SID of user this token represents */
107 SID *owner; /* SID of owner (points to user or one of groups) */
108 SID *primary_group; /* SID of user's primary group (points to one of groups) */
109 unsigned primary; /* is this a primary or impersonation token? */
110 ACL *default_dacl; /* the default DACL to assign to objects created by this user */
111 TOKEN_SOURCE source; /* source of the token */
112 int impersonation_level; /* impersonation level this token is capable of if non-primary token */
113 };
114
115 struct privilege
116 {
117 struct list entry;
118 LUID luid;
119 unsigned enabled : 1; /* is the privilege currently enabled? */
120 unsigned def : 1; /* is the privilege enabled by default? */
121 };
122
123 struct group
124 {
125 struct list entry;
126 unsigned enabled : 1; /* is the sid currently enabled? */
127 unsigned def : 1; /* is the sid enabled by default? */
128 unsigned logon : 1; /* is this a logon sid? */
129 unsigned mandatory: 1; /* is this sid always enabled? */
130 unsigned owner : 1; /* can this sid be an owner of an object? */
131 unsigned resource : 1; /* is this a domain-local group? */
132 unsigned deny_only: 1; /* is this a sid that should be use for denying only? */
133 SID sid;
134 };
135
136 static void token_dump( struct object *obj, int verbose );
137 static struct object_type *token_get_type( struct object *obj );
138 static unsigned int token_map_access( struct object *obj, unsigned int access );
139 static void token_destroy( struct object *obj );
140
141 static const struct object_ops token_ops =
142 {
143 sizeof(struct token), /* size */
144 token_dump, /* dump */
145 token_get_type, /* get_type */
146 no_add_queue, /* add_queue */
147 NULL, /* remove_queue */
148 NULL, /* signaled */
149 NULL, /* satisfied */
150 no_signal, /* signal */
151 no_get_fd, /* get_fd */
152 token_map_access, /* map_access */
153 default_get_sd, /* get_sd */
154 default_set_sd, /* set_sd */
155 no_get_full_name, /* get_full_name */
156 no_lookup_name, /* lookup_name */
157 no_link_name, /* link_name */
158 NULL, /* unlink_name */
159 no_open_file, /* open_file */
160 no_kernel_obj_list, /* get_kernel_obj_list */
161 no_close_handle, /* close_handle */
162 token_destroy /* destroy */
163 };
164
165 static void token_dump( struct object *obj, int verbose )
166 {
167 struct token *token = (struct token *)obj;
168 assert( obj->ops == &token_ops );
169 fprintf( stderr, "Token id=%d.%u primary=%u impersonation level=%d\n", token->token_id.high_part,
170 token->token_id.low_part, token->primary, token->impersonation_level );
171 }
172
173 static struct object_type *token_get_type( struct object *obj )
174 {
175 static const WCHAR name[] = {'T','o','k','e','n'};
176 static const struct unicode_str str = { name, sizeof(name) };
177 return get_object_type( &str );
178 }
179
180 static unsigned int token_map_access( struct object *obj, unsigned int access )
181 {
182 if (access & GENERIC_READ) access |= TOKEN_READ;
183 if (access & GENERIC_WRITE) access |= TOKEN_WRITE;
184 if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
185 if (access & GENERIC_ALL) access |= TOKEN_ALL_ACCESS;
186 return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
187 }
188
189 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
190 {
191 int i;
192 SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
193 if (!sid) return NULL;
194 sid->Revision = SID_REVISION;
195 sid->SubAuthorityCount = subauthcount;
196 sid->IdentifierAuthority = *idauthority;
197 for (i = 0; i < subauthcount; i++)
198 sid->SubAuthority[i] = subauth[i];
199 return sid;
200 }
201
202 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
203 {
204 if (!handle)
205 {
206 if (thread->token)
207 release_object( thread->token );
208 thread->token = NULL;
209 }
210 else
211 {
212 struct token *token = (struct token *)get_handle_obj( current->process,
213 handle,
214 TOKEN_IMPERSONATE,
215 &token_ops );
216 if (token)
217 {
218 if (thread->token)
219 release_object( thread->token );
220 thread->token = token;
221 }
222 }
223 }
224
225 const SID *security_unix_uid_to_sid( uid_t uid )
226 {
227 /* very simple mapping: either the current user or not the current user */
228 if (uid == getuid())
229 return (const SID *)&local_user_sid;
230 else
231 return &anonymous_logon_sid;
232 }
233
234 static int acl_is_valid( const ACL *acl, data_size_t size )
235 {
236 ULONG i;
237 const ACE_HEADER *ace;
238
239 if (size < sizeof(ACL))
240 return FALSE;
241
242 size = min(size, MAX_ACL_LEN);
243
244 size -= sizeof(ACL);
245
246 ace = (const ACE_HEADER *)(acl + 1);
247 for (i = 0; i < acl->AceCount; i++)
248 {
249 const SID *sid;
250 data_size_t sid_size;
251
252 if (size < sizeof(ACE_HEADER))
253 return FALSE;
254 if (size < ace->AceSize)
255 return FALSE;
256 size -= ace->AceSize;
257 switch (ace->AceType)
258 {
259 case ACCESS_DENIED_ACE_TYPE:
260 sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
261 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
262 break;
263 case ACCESS_ALLOWED_ACE_TYPE:
264 sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
265 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
266 break;
267 case SYSTEM_AUDIT_ACE_TYPE:
268 sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
269 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
270 break;
271 case SYSTEM_ALARM_ACE_TYPE:
272 sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
273 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
274 break;
275 case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
276 sid = (const SID *)&((const SYSTEM_MANDATORY_LABEL_ACE *)ace)->SidStart;
277 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart);
278 break;
279 default:
280 return FALSE;
281 }
282 if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
283 return FALSE;
284 ace = ace_next( ace );
285 }
286 return TRUE;
287 }
288
289 /* checks whether all members of a security descriptor fit inside the size
290 * of memory specified */
291 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
292 {
293 size_t offset = sizeof(struct security_descriptor);
294 const SID *group;
295 const SID *owner;
296 const ACL *sacl;
297 const ACL *dacl;
298 int dummy;
299
300 if (size < offset)
301 return FALSE;
302
303 if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
304 (offset + sd->owner_len > size))
305 return FALSE;
306 owner = sd_get_owner( sd );
307 if (owner)
308 {
309 if ((sd->owner_len < sizeof(SID)) || (security_sid_len( owner ) > sd->owner_len))
310 return FALSE;
311 }
312 offset += sd->owner_len;
313
314 if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
315 (offset + sd->group_len > size))
316 return FALSE;
317 group = sd_get_group( sd );
318 if (group)
319 {
320 if ((sd->group_len < sizeof(SID)) || (security_sid_len( group ) > sd->group_len))
321 return FALSE;
322 }
323 offset += sd->group_len;
324
325 if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
326 return FALSE;
327 sacl = sd_get_sacl( sd, &dummy );
328 if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
329 return FALSE;
330 offset += sd->sacl_len;
331
332 if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
333 return FALSE;
334 dacl = sd_get_dacl( sd, &dummy );
335 if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
336 return FALSE;
337 offset += sd->dacl_len;
338
339 return TRUE;
340 }
341
342 /* extract security labels from SACL */
343 ACL *extract_security_labels( const ACL *sacl )
344 {
345 size_t size = sizeof(ACL);
346 const ACE_HEADER *ace;
347 ACE_HEADER *label_ace;
348 unsigned int i, count = 0;
349 ACL *label_acl;
350
351 ace = (const ACE_HEADER *)(sacl + 1);
352 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
353 {
354 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
355 {
356 size += ace->AceSize;
357 count++;
358 }
359 }
360
361 label_acl = mem_alloc( size );
362 if (!label_acl) return NULL;
363
364 label_acl->AclRevision = sacl->AclRevision;
365 label_acl->Sbz1 = 0;
366 label_acl->AclSize = size;
367 label_acl->AceCount = count;
368 label_acl->Sbz2 = 0;
369 label_ace = (ACE_HEADER *)(label_acl + 1);
370
371 ace = (const ACE_HEADER *)(sacl + 1);
372 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
373 {
374 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
375 {
376 memcpy( label_ace, ace, ace->AceSize );
377 label_ace = (ACE_HEADER *)ace_next( label_ace );
378 }
379 }
380 return label_acl;
381 }
382
383 /* replace security labels in an existing SACL */
384 ACL *replace_security_labels( const ACL *old_sacl, const ACL *new_sacl )
385 {
386 const ACE_HEADER *ace;
387 ACE_HEADER *replaced_ace;
388 size_t size = sizeof(ACL);
389 unsigned int i, count = 0;
390 BYTE revision = ACL_REVISION;
391 ACL *replaced_acl;
392
393 if (old_sacl)
394 {
395 revision = max( revision, old_sacl->AclRevision );
396 ace = (const ACE_HEADER *)(old_sacl + 1);
397 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
398 {
399 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
400 size += ace->AceSize;
401 count++;
402 }
403 }
404
405 if (new_sacl)
406 {
407 revision = max( revision, new_sacl->AclRevision );
408 ace = (const ACE_HEADER *)(new_sacl + 1);
409 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
410 {
411 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
412 size += ace->AceSize;
413 count++;
414 }
415 }
416
417 replaced_acl = mem_alloc( size );
418 if (!replaced_acl) return NULL;
419
420 replaced_acl->AclRevision = revision;
421 replaced_acl->Sbz1 = 0;
422 replaced_acl->AclSize = size;
423 replaced_acl->AceCount = count;
424 replaced_acl->Sbz2 = 0;
425 replaced_ace = (ACE_HEADER *)(replaced_acl + 1);
426
427 if (old_sacl)
428 {
429 ace = (const ACE_HEADER *)(old_sacl + 1);
430 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
431 {
432 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
433 memcpy( replaced_ace, ace, ace->AceSize );
434 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
435 }
436 }
437
438 if (new_sacl)
439 {
440 ace = (const ACE_HEADER *)(new_sacl + 1);
441 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
442 {
443 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
444 memcpy( replaced_ace, ace, ace->AceSize );
445 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
446 }
447 }
448
449 return replaced_acl;
450 }
451
452 /* maps from generic rights to specific rights as given by a mapping */
453 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
454 {
455 if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
456 if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
457 if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
458 if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
459 *mask &= 0x0FFFFFFF;
460 }
461
462 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
463 {
464 return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
465 }
466
467 static inline void allocate_luid( luid_t *luid )
468 {
469 prev_luid_value.low_part++;
470 *luid = prev_luid_value;
471 }
472
473 DECL_HANDLER( allocate_locally_unique_id )
474 {
475 allocate_luid( &reply->luid );
476 }
477
478 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
479 {
480 out->Luid = in->luid;
481 out->Attributes =
482 (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
483 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
484 }
485
486 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
487 {
488 struct privilege *privilege = mem_alloc( sizeof(*privilege) );
489 if (privilege)
490 {
491 privilege->luid = *luid;
492 privilege->def = privilege->enabled = (enabled != 0);
493 list_add_tail( &token->privileges, &privilege->entry );
494 }
495 return privilege;
496 }
497
498 static inline void privilege_remove( struct privilege *privilege )
499 {
500 list_remove( &privilege->entry );
501 free( privilege );
502 }
503
504 static void token_destroy( struct object *obj )
505 {
506 struct token* token;
507 struct list *cursor, *cursor_next;
508
509 assert( obj->ops == &token_ops );
510 token = (struct token *)obj;
511
512 free( token->user );
513
514 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
515 {
516 struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
517 privilege_remove( privilege );
518 }
519
520 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
521 {
522 struct group *group = LIST_ENTRY( cursor, struct group, entry );
523 list_remove( &group->entry );
524 free( group );
525 }
526
527 free( token->default_dacl );
528 }
529
530 /* creates a new token.
531 * groups may be NULL if group_count is 0.
532 * privs may be NULL if priv_count is 0.
533 * default_dacl may be NULL, indicating that all objects created by the user
534 * are unsecured.
535 * modified_id may be NULL, indicating that a new modified_id luid should be
536 * allocated.
537 */
538 static struct token *create_token( unsigned primary, const SID *user,
539 const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
540 const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
541 const ACL *default_dacl, TOKEN_SOURCE source,
542 const luid_t *modified_id,
543 int impersonation_level )
544 {
545 struct token *token = alloc_object( &token_ops );
546 if (token)
547 {
548 unsigned int i;
549
550 allocate_luid( &token->token_id );
551 if (modified_id)
552 token->modified_id = *modified_id;
553 else
554 allocate_luid( &token->modified_id );
555 list_init( &token->privileges );
556 list_init( &token->groups );
557 token->primary = primary;
558 /* primary tokens don't have impersonation levels */
559 if (primary)
560 token->impersonation_level = -1;
561 else
562 token->impersonation_level = impersonation_level;
563 token->default_dacl = NULL;
564 token->primary_group = NULL;
565
566 /* copy user */
567 token->user = memdup( user, security_sid_len( user ));
568 if (!token->user)
569 {
570 release_object( token );
571 return NULL;
572 }
573
574 /* copy groups */
575 for (i = 0; i < group_count; i++)
576 {
577 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
578 struct group *group = mem_alloc( size );
579
580 if (!group)
581 {
582 release_object( token );
583 return NULL;
584 }
585 memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
586 group->enabled = TRUE;
587 group->def = TRUE;
588 group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
589 group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
590 group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
591 group->resource = FALSE;
592 group->deny_only = FALSE;
593 list_add_tail( &token->groups, &group->entry );
594 /* Use first owner capable group as owner and primary group */
595 if (!token->primary_group && group->owner)
596 {
597 token->owner = &group->sid;
598 token->primary_group = &group->sid;
599 }
600 }
601
602 /* copy privileges */
603 for (i = 0; i < priv_count; i++)
604 {
605 /* note: we don't check uniqueness: the caller must make sure
606 * privs doesn't contain any duplicate luids */
607 if (!privilege_add( token, &privs[i].Luid,
608 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
609 {
610 release_object( token );
611 return NULL;
612 }
613 }
614
615 if (default_dacl)
616 {
617 token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
618 if (!token->default_dacl)
619 {
620 release_object( token );
621 return NULL;
622 }
623 }
624
625 token->source = source;
626 }
627 return token;
628 }
629
630 struct token *token_duplicate( struct token *src_token, unsigned primary,
631 int impersonation_level, const struct security_descriptor *sd )
632 {
633 const luid_t *modified_id =
634 primary || (impersonation_level == src_token->impersonation_level) ?
635 &src_token->modified_id : NULL;
636 struct token *token = NULL;
637 struct privilege *privilege;
638 struct group *group;
639
640 if (!primary &&
641 (impersonation_level < SecurityAnonymous ||
642 impersonation_level > SecurityDelegation ||
643 (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
644 {
645 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
646 return NULL;
647 }
648
649 token = create_token( primary, src_token->user, NULL, 0,
650 NULL, 0, src_token->default_dacl,
651 src_token->source, modified_id,
652 impersonation_level );
653 if (!token) return token;
654
655 /* copy groups */
656 token->primary_group = NULL;
657 LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
658 {
659 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
660 struct group *newgroup = mem_alloc( size );
661 if (!newgroup)
662 {
663 release_object( token );
664 return NULL;
665 }
666 memcpy( newgroup, group, size );
667 list_add_tail( &token->groups, &newgroup->entry );
668 if (src_token->primary_group == &group->sid)
669 {
670 token->owner = &newgroup->sid;
671 token->primary_group = &newgroup->sid;
672 }
673 }
674 assert( token->primary_group );
675
676 /* copy privileges */
677 LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
678 if (!privilege_add( token, &privilege->luid, privilege->enabled ))
679 {
680 release_object( token );
681 return NULL;
682 }
683
684 if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
685 DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
686
687 return token;
688 }
689
690 static ACL *create_default_dacl( const SID *user )
691 {
692 ACCESS_ALLOWED_ACE *aaa;
693 ACL *default_dacl;
694 SID *sid;
695 size_t default_dacl_size = sizeof(ACL) +
696 2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
697 sizeof(local_system_sid) +
698 security_sid_len( user );
699
700 default_dacl = mem_alloc( default_dacl_size );
701 if (!default_dacl) return NULL;
702
703 default_dacl->AclRevision = ACL_REVISION;
704 default_dacl->Sbz1 = 0;
705 default_dacl->AclSize = default_dacl_size;
706 default_dacl->AceCount = 2;
707 default_dacl->Sbz2 = 0;
708
709 /* GENERIC_ALL for Local System */
710 aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
711 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
712 aaa->Header.AceFlags = 0;
713 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
714 sizeof(local_system_sid);
715 aaa->Mask = GENERIC_ALL;
716 sid = (SID *)&aaa->SidStart;
717 memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
718
719 /* GENERIC_ALL for specified user */
720 aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
721 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
722 aaa->Header.AceFlags = 0;
723 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
724 aaa->Mask = GENERIC_ALL;
725 sid = (SID *)&aaa->SidStart;
726 memcpy( sid, user, security_sid_len( user ));
727
728 return default_dacl;
729 }
730
731 struct sid_data
732 {
733 SID_IDENTIFIER_AUTHORITY idauth;
734 int count;
735 unsigned int subauth[MAX_SUBAUTH_COUNT];
736 };
737
738 static struct security_descriptor *create_security_label_sd( struct token *token, PSID label_sid )
739 {
740 size_t sid_len = security_sid_len( label_sid ), sacl_size, sd_size;
741 SYSTEM_MANDATORY_LABEL_ACE *smla;
742 struct security_descriptor *sd;
743 ACL *sacl;
744
745 sacl_size = sizeof(ACL) + FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
746 sd_size = sizeof(struct security_descriptor) + sacl_size;
747 if (!(sd = mem_alloc( sd_size )))
748 return NULL;
749
750 sd->control = SE_SACL_PRESENT;
751 sd->owner_len = 0;
752 sd->group_len = 0;
753 sd->sacl_len = sacl_size;
754 sd->dacl_len = 0;
755
756 sacl = (ACL *)(sd + 1);
757 sacl->AclRevision = ACL_REVISION;
758 sacl->Sbz1 = 0;
759 sacl->AclSize = sacl_size;
760 sacl->AceCount = 1;
761 sacl->Sbz2 = 0;
762
763 smla = (SYSTEM_MANDATORY_LABEL_ACE *)(sacl + 1);
764 smla->Header.AceType = SYSTEM_MANDATORY_LABEL_ACE_TYPE;
765 smla->Header.AceFlags = 0;
766 smla->Header.AceSize = FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
767 smla->Mask = SYSTEM_MANDATORY_LABEL_NO_WRITE_UP;
768 memcpy( &smla->SidStart, label_sid, sid_len );
769
770 assert( sd_is_valid( sd, sd_size ) );
771 return sd;
772 }
773
774 int token_assign_label( struct token *token, PSID label )
775 {
776 struct security_descriptor *sd;
777 int ret = 0;
778
779 if ((sd = create_security_label_sd( token, label )))
780 {
781 ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
782 free( sd );
783 }
784
785 return ret;
786 }
787
788 struct token *token_create_admin( void )
789 {
790 struct token *token = NULL;
791 static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
792 static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
793 static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
794 /* on Windows, this value changes every time the user logs on */
795 static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
796 PSID alias_admins_sid;
797 PSID alias_users_sid;
798 PSID logon_sid;
799 const SID *user_sid = security_unix_uid_to_sid( getuid() );
800 ACL *default_dacl = create_default_dacl( user_sid );
801
802 alias_admins_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_admins_subauth ),
803 alias_admins_subauth );
804 alias_users_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_users_subauth ),
805 alias_users_subauth );
806 logon_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( logon_subauth ), logon_subauth );
807
808 if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
809 {
810 const LUID_AND_ATTRIBUTES admin_privs[] =
811 {
812 { SeChangeNotifyPrivilege , SE_PRIVILEGE_ENABLED },
813 { SeSecurityPrivilege , 0 },
814 { SeBackupPrivilege , 0 },
815 { SeRestorePrivilege , 0 },
816 { SeSystemtimePrivilege , 0 },
817 { SeShutdownPrivilege , 0 },
818 { SeRemoteShutdownPrivilege , 0 },
819 { SeTakeOwnershipPrivilege , 0 },
820 { SeDebugPrivilege , 0 },
821 { SeSystemEnvironmentPrivilege , 0 },
822 { SeSystemProfilePrivilege , 0 },
823 { SeProfileSingleProcessPrivilege, 0 },
824 { SeIncreaseBasePriorityPrivilege, 0 },
825 { SeLoadDriverPrivilege , SE_PRIVILEGE_ENABLED },
826 { SeCreatePagefilePrivilege , 0 },
827 { SeIncreaseQuotaPrivilege , 0 },
828 { SeUndockPrivilege , 0 },
829 { SeManageVolumePrivilege , 0 },
830 { SeImpersonatePrivilege , SE_PRIVILEGE_ENABLED },
831 { SeCreateGlobalPrivilege , SE_PRIVILEGE_ENABLED },
832 };
833 /* note: we don't include non-builtin groups here for the user -
834 * telling us these is the job of a client-side program */
835 const SID_AND_ATTRIBUTES admin_groups[] =
836 {
837 { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
838 { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
839 { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
840 { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
841 { security_domain_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
842 { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
843 { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
844 { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
845 };
846 static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
847 token = create_token( TRUE, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
848 admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
849 admin_source, NULL, -1 );
850 /* we really need a primary group */
851 assert( token->primary_group );
852 }
853
854 free( logon_sid );
855 free( alias_admins_sid );
856 free( alias_users_sid );
857 free( default_dacl );
858
859 return token;
860 }
861
862 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
863 {
864 struct privilege *privilege;
865 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
866 {
867 if (is_equal_luid( luid, &privilege->luid ))
868 {
869 if (enabled_only && !privilege->enabled)
870 return NULL;
871 return privilege;
872 }
873 }
874 return NULL;
875 }
876
877 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
878 unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
879 unsigned int mod_privs_count )
880 {
881 unsigned int i, modified_count = 0;
882
883 /* mark as modified */
884 allocate_luid( &token->modified_id );
885
886 for (i = 0; i < count; i++)
887 {
888 struct privilege *privilege =
889 token_find_privilege( token, &privs[i].Luid, FALSE );
890 if (!privilege)
891 {
892 set_error( STATUS_NOT_ALL_ASSIGNED );
893 continue;
894 }
895
896 if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
897 privilege_remove( privilege );
898 else
899 {
900 /* save previous state for caller */
901 if (mod_privs_count)
902 {
903 luid_and_attr_from_privilege(mod_privs, privilege);
904 mod_privs++;
905 mod_privs_count--;
906 modified_count++;
907 }
908
909 if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
910 privilege->enabled = TRUE;
911 else
912 privilege->enabled = FALSE;
913 }
914 }
915 return modified_count;
916 }
917
918 static void token_disable_privileges( struct token *token )
919 {
920 struct privilege *privilege;
921
922 /* mark as modified */
923 allocate_luid( &token->modified_id );
924
925 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
926 privilege->enabled = FALSE;
927 }
928
929 int token_check_privileges( struct token *token, int all_required,
930 const LUID_AND_ATTRIBUTES *reqprivs,
931 unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
932 {
933 unsigned int i, enabled_count = 0;
934
935 for (i = 0; i < count; i++)
936 {
937 struct privilege *privilege =
938 token_find_privilege( token, &reqprivs[i].Luid, TRUE );
939
940 if (usedprivs)
941 usedprivs[i] = reqprivs[i];
942
943 if (privilege && privilege->enabled)
944 {
945 enabled_count++;
946 if (usedprivs)
947 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
948 }
949 }
950
951 if (all_required)
952 return (enabled_count == count);
953 else
954 return (enabled_count > 0);
955 }
956
957 int token_sid_present( struct token *token, const SID *sid, int deny )
958 {
959 struct group *group;
960
961 if (security_equal_sid( token->user, sid )) return TRUE;
962
963 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
964 {
965 if (!group->enabled) continue;
966 if (group->deny_only && !deny) continue;
967
968 if (security_equal_sid( &group->sid, sid )) return TRUE;
969 }
970
971 return FALSE;
972 }
973
974 /* Checks access to a security descriptor. 'sd' must have been validated by
975 * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
976 * the reason. 'status' parameter will indicate if access is granted or denied.
977 *
978 * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
979 */
980 static unsigned int token_access_check( struct token *token,
981 const struct security_descriptor *sd,
982 unsigned int desired_access,
983 LUID_AND_ATTRIBUTES *privs,
984 unsigned int *priv_count,
985 const GENERIC_MAPPING *mapping,
986 unsigned int *granted_access,
987 unsigned int *status )
988 {
989 unsigned int current_access = 0;
990 unsigned int denied_access = 0;
991 ULONG i;
992 const ACL *dacl;
993 int dacl_present;
994 const ACE_HEADER *ace;
995 const SID *owner;
996
997 /* assume no access rights */
998 *granted_access = 0;
999
1000 /* fail if desired_access contains generic rights */
1001 if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
1002 {
1003 if (priv_count) *priv_count = 0;
1004 return STATUS_GENERIC_NOT_MAPPED;
1005 }
1006
1007 dacl = sd_get_dacl( sd, &dacl_present );
1008 owner = sd_get_owner( sd );
1009 if (!owner || !sd_get_group( sd ))
1010 {
1011 if (priv_count) *priv_count = 0;
1012 return STATUS_INVALID_SECURITY_DESCR;
1013 }
1014
1015 /* 1: Grant desired access if the object is unprotected */
1016 if (!dacl_present || !dacl)
1017 {
1018 if (priv_count) *priv_count = 0;
1019 if (desired_access & MAXIMUM_ALLOWED)
1020 *granted_access = mapping->GenericAll;
1021 else
1022 *granted_access = desired_access;
1023 return *status = STATUS_SUCCESS;
1024 }
1025
1026 /* 2: Check if caller wants access to system security part. Note: access
1027 * is only granted if specifically asked for */
1028 if (desired_access & ACCESS_SYSTEM_SECURITY)
1029 {
1030 const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
1031 LUID_AND_ATTRIBUTES retpriv = security_priv;
1032 if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
1033 {
1034 if (priv_count)
1035 {
1036 /* assumes that there will only be one privilege to return */
1037 if (*priv_count >= 1)
1038 {
1039 *priv_count = 1;
1040 *privs = retpriv;
1041 }
1042 else
1043 {
1044 *priv_count = 1;
1045 return STATUS_BUFFER_TOO_SMALL;
1046 }
1047 }
1048 current_access |= ACCESS_SYSTEM_SECURITY;
1049 if (desired_access == current_access)
1050 {
1051 *granted_access = current_access;
1052 return *status = STATUS_SUCCESS;
1053 }
1054 }
1055 else
1056 {
1057 if (priv_count) *priv_count = 0;
1058 *status = STATUS_PRIVILEGE_NOT_HELD;
1059 return STATUS_SUCCESS;
1060 }
1061 }
1062 else if (priv_count) *priv_count = 0;
1063
1064 /* 3: Check whether the token is the owner */
1065 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
1066 * checked when a "set owner" call is made, overriding the access rights
1067 * determined here. */
1068 if (token_sid_present( token, owner, FALSE ))
1069 {
1070 current_access |= (READ_CONTROL | WRITE_DAC);
1071 if (desired_access == current_access)
1072 {
1073 *granted_access = current_access;
1074 return *status = STATUS_SUCCESS;
1075 }
1076 }
1077
1078 /* 4: Grant rights according to the DACL */
1079 ace = (const ACE_HEADER *)(dacl + 1);
1080 for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
1081 {
1082 const ACCESS_ALLOWED_ACE *aa_ace;
1083 const ACCESS_DENIED_ACE *ad_ace;
1084 const SID *sid;
1085
1086 if (ace->AceFlags & INHERIT_ONLY_ACE)
1087 continue;
1088
1089 switch (ace->AceType)
1090 {
1091 case ACCESS_DENIED_ACE_TYPE:
1092 ad_ace = (const ACCESS_DENIED_ACE *)ace;
1093 sid = (const SID *)&ad_ace->SidStart;
1094 if (token_sid_present( token, sid, TRUE ))
1095 {
1096 unsigned int access = ad_ace->Mask;
1097 map_generic_mask(&access, mapping);
1098 if (desired_access & MAXIMUM_ALLOWED)
1099 denied_access |= access;
1100 else
1101 {
1102 denied_access |= (access & ~current_access);
1103 if (desired_access & access) goto done;
1104 }
1105 }
1106 break;
1107 case ACCESS_ALLOWED_ACE_TYPE:
1108 aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
1109 sid = (const SID *)&aa_ace->SidStart;
1110 if (token_sid_present( token, sid, FALSE ))
1111 {
1112 unsigned int access = aa_ace->Mask;
1113 map_generic_mask(&access, mapping);
1114 if (desired_access & MAXIMUM_ALLOWED)
1115 current_access |= access;
1116 else
1117 current_access |= (access & ~denied_access);
1118 }
1119 break;
1120 }
1121
1122 /* don't bother carrying on checking if we've already got all of
1123 * rights we need */
1124 if (desired_access == *granted_access)
1125 break;
1126 }
1127
1128 done:
1129 if (desired_access & MAXIMUM_ALLOWED)
1130 *granted_access = current_access & ~denied_access;
1131 else
1132 if ((current_access & desired_access) == desired_access)
1133 *granted_access = current_access & desired_access;
1134 else
1135 *granted_access = 0;
1136
1137 *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1138 return STATUS_SUCCESS;
1139 }
1140
1141 const ACL *token_get_default_dacl( struct token *token )
1142 {
1143 return token->default_dacl;
1144 }
1145
1146 const SID *token_get_user( struct token *token )
1147 {
1148 return token->user;
1149 }
1150
1151 const SID *token_get_primary_group( struct token *token )
1152 {
1153 return token->primary_group;
1154 }
1155
1156 int check_object_access(struct object *obj, unsigned int *access)
1157 {
1158 GENERIC_MAPPING mapping;
1159 struct token *token = current->token ? current->token : current->process->token;
1160 unsigned int status;
1161 int res;
1162
1163 mapping.GenericAll = obj->ops->map_access( obj, GENERIC_ALL );
1164
1165 if (!obj->sd)
1166 {
1167 if (*access & MAXIMUM_ALLOWED)
1168 *access = mapping.GenericAll;
1169 return TRUE;
1170 }
1171
1172 mapping.GenericRead = obj->ops->map_access( obj, GENERIC_READ );
1173 mapping.GenericWrite = obj->ops->map_access( obj, GENERIC_WRITE );
1174 mapping.GenericExecute = obj->ops->map_access( obj, GENERIC_EXECUTE );
1175
1176 res = token_access_check( token, obj->sd, *access, NULL, NULL,
1177 &mapping, access, &status ) == STATUS_SUCCESS &&
1178 status == STATUS_SUCCESS;
1179
1180 if (!res) set_error( STATUS_ACCESS_DENIED );
1181 return res;
1182 }
1183
1184
1185 /* open a security token */
1186 DECL_HANDLER(open_token)
1187 {
1188 if (req->flags & OPEN_TOKEN_THREAD)
1189 {
1190 struct thread *thread = get_thread_from_handle( req->handle, 0 );
1191 if (thread)
1192 {
1193 if (thread->token)
1194 {
1195 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1196 set_error( STATUS_CANT_OPEN_ANONYMOUS );
1197 else
1198 reply->token = alloc_handle( current->process, thread->token,
1199 req->access, req->attributes );
1200 }
1201 else
1202 set_error( STATUS_NO_TOKEN );
1203 release_object( thread );
1204 }
1205 }
1206 else
1207 {
1208 struct process *process = get_process_from_handle( req->handle, 0 );
1209 if (process)
1210 {
1211 if (process->token)
1212 reply->token = alloc_handle( current->process, process->token, req->access,
1213 req->attributes );
1214 else
1215 set_error( STATUS_NO_TOKEN );
1216 release_object( process );
1217 }
1218 }
1219 }
1220
1221 /* adjust the privileges held by a token */
1222 DECL_HANDLER(adjust_token_privileges)
1223 {
1224 struct token *token;
1225 unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1226
1227 if (req->get_modified_state) access |= TOKEN_QUERY;
1228
1229 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1230 access, &token_ops )))
1231 {
1232 const LUID_AND_ATTRIBUTES *privs = get_req_data();
1233 LUID_AND_ATTRIBUTES *modified_privs = NULL;
1234 unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1235 unsigned int modified_priv_count = 0;
1236
1237 if (req->get_modified_state && !req->disable_all)
1238 {
1239 unsigned int i;
1240 /* count modified privs */
1241 for (i = 0; i < priv_count; i++)
1242 {
1243 struct privilege *privilege =
1244 token_find_privilege( token, &privs[i].Luid, FALSE );
1245 if (privilege && req->get_modified_state)
1246 modified_priv_count++;
1247 }
1248 reply->len = modified_priv_count;
1249 modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1250 if (modified_priv_count)
1251 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1252 }
1253 reply->len = modified_priv_count * sizeof(*modified_privs);
1254
1255 if (req->disable_all)
1256 token_disable_privileges( token );
1257 else
1258 token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
1259
1260 release_object( token );
1261 }
1262 }
1263
1264 /* retrieves the list of privileges that may be held be the token */
1265 DECL_HANDLER(get_token_privileges)
1266 {
1267 struct token *token;
1268
1269 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1270 TOKEN_QUERY,
1271 &token_ops )))
1272 {
1273 int priv_count = 0;
1274 LUID_AND_ATTRIBUTES *privs;
1275 struct privilege *privilege;
1276
1277 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1278 priv_count++;
1279
1280 reply->len = priv_count * sizeof(*privs);
1281 if (reply->len <= get_reply_max_size())
1282 {
1283 privs = set_reply_data_size( priv_count * sizeof(*privs) );
1284 if (privs)
1285 {
1286 int i = 0;
1287 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1288 {
1289 luid_and_attr_from_privilege( &privs[i], privilege );
1290 i++;
1291 }
1292 }
1293 }
1294 else
1295 set_error(STATUS_BUFFER_TOO_SMALL);
1296
1297 release_object( token );
1298 }
1299 }
1300
1301 /* creates a duplicate of the token */
1302 DECL_HANDLER(duplicate_token)
1303 {
1304 struct token *src_token;
1305 struct unicode_str name;
1306 const struct security_descriptor *sd;
1307 const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
1308
1309 if (!objattr) return;
1310
1311 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1312 TOKEN_DUPLICATE,
1313 &token_ops )))
1314 {
1315 struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd );
1316 if (token)
1317 {
1318 reply->new_handle = alloc_handle_no_access_check( current->process, token, req->access, objattr->attributes );
1319 release_object( token );
1320 }
1321 release_object( src_token );
1322 }
1323 }
1324
1325 /* checks the specified privileges are held by the token */
1326 DECL_HANDLER(check_token_privileges)
1327 {
1328 struct token *token;
1329
1330 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1331 TOKEN_QUERY,
1332 &token_ops )))
1333 {
1334 unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1335
1336 if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1337 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1338 else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1339 {
1340 LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1341 reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1342 }
1343 else
1344 set_error( STATUS_BUFFER_OVERFLOW );
1345 release_object( token );
1346 }
1347 }
1348
1349 /* checks that a user represented by a token is allowed to access an object
1350 * represented by a security descriptor */
1351 DECL_HANDLER(access_check)
1352 {
1353 data_size_t sd_size = get_req_data_size();
1354 const struct security_descriptor *sd = get_req_data();
1355 struct token *token;
1356
1357 if (!sd_is_valid( sd, sd_size ))
1358 {
1359 set_error( STATUS_ACCESS_VIOLATION );
1360 return;
1361 }
1362
1363 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1364 TOKEN_QUERY,
1365 &token_ops )))
1366 {
1367 GENERIC_MAPPING mapping;
1368 unsigned int status;
1369 LUID_AND_ATTRIBUTES priv;
1370 unsigned int priv_count = 1;
1371
1372 memset(&priv, 0, sizeof(priv));
1373
1374 /* only impersonation tokens may be used with this function */
1375 if (token->primary)
1376 {
1377 set_error( STATUS_NO_IMPERSONATION_TOKEN );
1378 release_object( token );
1379 return;
1380 }
1381 /* anonymous impersonation tokens can't be used */
1382 if (token->impersonation_level <= SecurityAnonymous)
1383 {
1384 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1385 release_object( token );
1386 return;
1387 }
1388
1389 mapping.GenericRead = req->mapping_read;
1390 mapping.GenericWrite = req->mapping_write;
1391 mapping.GenericExecute = req->mapping_execute;
1392 mapping.GenericAll = req->mapping_all;
1393
1394 status = token_access_check(
1395 token, sd, req->desired_access, &priv, &priv_count, &mapping,
1396 &reply->access_granted, &reply->access_status );
1397
1398 reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1399
1400 if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1401 {
1402 LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1403 memcpy( privs, &priv, sizeof(priv) );
1404 }
1405
1406 set_error( status );
1407 release_object( token );
1408 }
1409 }
1410
1411 /* retrieves an SID from the token */
1412 DECL_HANDLER(get_token_sid)
1413 {
1414 struct token *token;
1415
1416 reply->sid_len = 0;
1417
1418 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1419 {
1420 const SID *sid = NULL;
1421
1422 switch (req->which_sid)
1423 {
1424 case TokenUser:
1425 assert(token->user);
1426 sid = token->user;
1427 break;
1428 case TokenPrimaryGroup:
1429 sid = token->primary_group;
1430 break;
1431 case TokenOwner:
1432 sid = token->owner;
1433 break;
1434 case TokenLogonSid:
1435 sid = (const SID *)&builtin_logon_sid;
1436 break;
1437 default:
1438 set_error( STATUS_INVALID_PARAMETER );
1439 break;
1440 }
1441
1442 if (sid)
1443 {
1444 reply->sid_len = security_sid_len( sid );
1445 if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1446 else set_error( STATUS_BUFFER_TOO_SMALL );
1447 }
1448 release_object( token );
1449 }
1450 }
1451
1452 /* retrieves the groups that the user represented by the token belongs to */
1453 DECL_HANDLER(get_token_groups)
1454 {
1455 struct token *token;
1456
1457 reply->user_len = 0;
1458
1459 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1460 TOKEN_QUERY,
1461 &token_ops )))
1462 {
1463 size_t size_needed = sizeof(struct token_groups);
1464 size_t sid_size = 0;
1465 unsigned int group_count = 0;
1466 const struct group *group;
1467
1468 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1469 {
1470 group_count++;
1471 sid_size += security_sid_len( &group->sid );
1472 }
1473 size_needed += sid_size;
1474 /* attributes size */
1475 size_needed += sizeof(unsigned int) * group_count;
1476
1477 /* reply buffer contains size_needed bytes formatted as:
1478
1479 unsigned int count;
1480 unsigned int attrib[count];
1481 char sid_data[];
1482
1483 user_len includes extra data needed for TOKEN_GROUPS representation,
1484 required caller buffer size calculated here to avoid extra server call */
1485 reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1486
1487 if (reply->user_len <= get_reply_max_size())
1488 {
1489 struct token_groups *tg = set_reply_data_size( size_needed );
1490 if (tg)
1491 {
1492 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1493 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1494
1495 tg->count = group_count;
1496
1497 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1498 {
1499
1500 *attr_ptr = 0;
1501 if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1502 if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1503 if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1504 if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1505 if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1506 if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1507 if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1508
1509 memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1510
1511 sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1512 attr_ptr++;
1513 }
1514 }
1515 }
1516 else set_error( STATUS_BUFFER_TOO_SMALL );
1517
1518 release_object( token );
1519 }
1520 }
1521
1522 DECL_HANDLER(get_token_impersonation_level)
1523 {
1524 struct token *token;
1525
1526 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1527 TOKEN_QUERY,
1528 &token_ops )))
1529 {
1530 if (token->primary)
1531 set_error( STATUS_INVALID_PARAMETER );
1532 else
1533 reply->impersonation_level = token->impersonation_level;
1534
1535 release_object( token );
1536 }
1537 }
1538
1539 DECL_HANDLER(get_token_statistics)
1540 {
1541 struct token *token;
1542
1543 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1544 TOKEN_QUERY,
1545 &token_ops )))
1546 {
1547 reply->token_id = token->token_id;
1548 reply->modified_id = token->modified_id;
1549 reply->primary = token->primary;
1550 reply->impersonation_level = token->impersonation_level;
1551 reply->group_count = list_count( &token->groups );
1552 reply->privilege_count = list_count( &token->privileges );
1553
1554 release_object( token );
1555 }
1556 }
1557
1558 DECL_HANDLER(get_token_default_dacl)
1559 {
1560 struct token *token;
1561
1562 reply->acl_len = 0;
1563
1564 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1565 TOKEN_QUERY,
1566 &token_ops )))
1567 {
1568 if (token->default_dacl)
1569 reply->acl_len = token->default_dacl->AclSize;
1570
1571 if (reply->acl_len <= get_reply_max_size())
1572 {
1573 ACL *acl_reply = set_reply_data_size( reply->acl_len );
1574 if (acl_reply)
1575 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1576 }
1577 else set_error( STATUS_BUFFER_TOO_SMALL );
1578
1579 release_object( token );
1580 }
1581 }
1582
1583 DECL_HANDLER(set_token_default_dacl)
1584 {
1585 struct token *token;
1586
1587 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1588 TOKEN_ADJUST_DEFAULT,
1589 &token_ops )))
1590 {
1591 const ACL *acl = get_req_data();
1592 unsigned int acl_size = get_req_data_size();
1593
1594 free( token->default_dacl );
1595 token->default_dacl = NULL;
1596
1597 if (acl_size)
1598 token->default_dacl = memdup( acl, acl_size );
1599
1600 release_object( token );
1601 }
1602 }
Windows API implementation