?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ws2_32: Translate WSA_FLAG_OVERLAPPED to NT overlapped flags.
[wine.git] / server / token.c
blob26d9708f2cdac0ddc74b8503d975a4dde427d4bd
1 /*
2 * Tokens
3 *
4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 */
22
23 #include "config.h"
24
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <stdarg.h>
29 #include <unistd.h>
30
31 #include "ntstatus.h"
32 #define WIN32_NO_STATUS
33 #include "windef.h"
34 #include "winternl.h"
35
36 #include "handle.h"
37 #include "thread.h"
38 #include "process.h"
39 #include "request.h"
40 #include "security.h"
41
42 #define MAX_SUBAUTH_COUNT 1
43
44 const LUID SeIncreaseQuotaPrivilege = { 5, 0 };
45 const LUID SeSecurityPrivilege = { 8, 0 };
46 const LUID SeTakeOwnershipPrivilege = { 9, 0 };
47 const LUID SeLoadDriverPrivilege = { 10, 0 };
48 const LUID SeSystemProfilePrivilege = { 11, 0 };
49 const LUID SeSystemtimePrivilege = { 12, 0 };
50 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
51 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
52 const LUID SeCreatePagefilePrivilege = { 15, 0 };
53 const LUID SeBackupPrivilege = { 17, 0 };
54 const LUID SeRestorePrivilege = { 18, 0 };
55 const LUID SeShutdownPrivilege = { 19, 0 };
56 const LUID SeDebugPrivilege = { 20, 0 };
57 const LUID SeSystemEnvironmentPrivilege = { 22, 0 };
58 const LUID SeChangeNotifyPrivilege = { 23, 0 };
59 const LUID SeRemoteShutdownPrivilege = { 24, 0 };
60 const LUID SeUndockPrivilege = { 25, 0 };
61 const LUID SeManageVolumePrivilege = { 28, 0 };
62 const LUID SeImpersonatePrivilege = { 29, 0 };
63 const LUID SeCreateGlobalPrivilege = { 30, 0 };
64
65 #define SID_N(n) struct /* same fields as struct SID */ \
66 { \
67 BYTE Revision; \
68 BYTE SubAuthorityCount; \
69 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
70 DWORD SubAuthority[n]; \
71 }
72
73 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
74 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
75 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
76 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
77 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
78 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
79 static const SID high_label_sid = { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY }, { SECURITY_MANDATORY_HIGH_RID } };
80 static const SID_N(5) local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
81 static const SID_N(2) builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
82 static const SID_N(2) builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
83 static const SID_N(3) builtin_logon_sid = { SID_REVISION, 3, { SECURITY_NT_AUTHORITY }, { SECURITY_LOGON_IDS_RID, 0, 0 } };
84 static const SID_N(5) domain_users_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, DOMAIN_GROUP_RID_USERS } };
85
86 const PSID security_world_sid = (PSID)&world_sid;
87 static const PSID security_local_sid = (PSID)&local_sid;
88 static const PSID security_interactive_sid = (PSID)&interactive_sid;
89 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
90 const PSID security_local_system_sid = (PSID)&local_system_sid;
91 const PSID security_local_user_sid = (PSID)&local_user_sid;
92 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
93 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
94 const PSID security_domain_users_sid = (PSID)&domain_users_sid;
95 const PSID security_high_label_sid = (PSID)&high_label_sid;
96
97 static luid_t prev_luid_value = { 1000, 0 };
98
99 struct token
100 {
101 struct object obj; /* object header */
102 luid_t token_id; /* system-unique id of token */
103 luid_t modified_id; /* new id allocated every time token is modified */
104 struct list privileges; /* privileges available to the token */
105 struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
106 SID *user; /* SID of user this token represents */
107 SID *owner; /* SID of owner (points to user or one of groups) */
108 SID *primary_group; /* SID of user's primary group (points to one of groups) */
109 unsigned primary; /* is this a primary or impersonation token? */
110 ACL *default_dacl; /* the default DACL to assign to objects created by this user */
111 TOKEN_SOURCE source; /* source of the token */
112 int impersonation_level; /* impersonation level this token is capable of if non-primary token */
113 };
114
115 struct privilege
116 {
117 struct list entry;
118 LUID luid;
119 unsigned enabled : 1; /* is the privilege currently enabled? */
120 unsigned def : 1; /* is the privilege enabled by default? */
121 };
122
123 struct group
124 {
125 struct list entry;
126 unsigned enabled : 1; /* is the sid currently enabled? */
127 unsigned def : 1; /* is the sid enabled by default? */
128 unsigned logon : 1; /* is this a logon sid? */
129 unsigned mandatory: 1; /* is this sid always enabled? */
130 unsigned owner : 1; /* can this sid be an owner of an object? */
131 unsigned resource : 1; /* is this a domain-local group? */
132 unsigned deny_only: 1; /* is this a sid that should be use for denying only? */
133 SID sid;
134 };
135
136 static void token_dump( struct object *obj, int verbose );
137 static struct object_type *token_get_type( struct object *obj );
138 static unsigned int token_map_access( struct object *obj, unsigned int access );
139 static void token_destroy( struct object *obj );
140
141 static const struct object_ops token_ops =
142 {
143 sizeof(struct token), /* size */
144 token_dump, /* dump */
145 token_get_type, /* get_type */
146 no_add_queue, /* add_queue */
147 NULL, /* remove_queue */
148 NULL, /* signaled */
149 NULL, /* satisfied */
150 no_signal, /* signal */
151 no_get_fd, /* get_fd */
152 token_map_access, /* map_access */
153 default_get_sd, /* get_sd */
154 default_set_sd, /* set_sd */
155 no_get_full_name, /* get_full_name */
156 no_lookup_name, /* lookup_name */
157 no_link_name, /* link_name */
158 NULL, /* unlink_name */
159 no_open_file, /* open_file */
160 no_kernel_obj_list, /* get_kernel_obj_list */
161 no_close_handle, /* close_handle */
162 token_destroy /* destroy */
163 };
164
165 static void token_dump( struct object *obj, int verbose )
166 {
167 struct token *token = (struct token *)obj;
168 assert( obj->ops == &token_ops );
169 fprintf( stderr, "Token id=%d.%u primary=%u impersonation level=%d\n", token->token_id.high_part,
170 token->token_id.low_part, token->primary, token->impersonation_level );
171 }
172
173 static struct object_type *token_get_type( struct object *obj )
174 {
175 static const WCHAR name[] = {'T','o','k','e','n'};
176 static const struct unicode_str str = { name, sizeof(name) };
177 return get_object_type( &str );
178 }
179
180 static unsigned int token_map_access( struct object *obj, unsigned int access )
181 {
182 if (access & GENERIC_READ) access |= TOKEN_READ;
183 if (access & GENERIC_WRITE) access |= TOKEN_WRITE;
184 if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
185 if (access & GENERIC_ALL) access |= TOKEN_ALL_ACCESS;
186 return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
187 }
188
189 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
190 {
191 int i;
192 SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
193 if (!sid) return NULL;
194 sid->Revision = SID_REVISION;
195 sid->SubAuthorityCount = subauthcount;
196 sid->IdentifierAuthority = *idauthority;
197 for (i = 0; i < subauthcount; i++)
198 sid->SubAuthority[i] = subauth[i];
199 return sid;
200 }
201
202 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
203 {
204 if (!handle)
205 {
206 if (thread->token)
207 release_object( thread->token );
208 thread->token = NULL;
209 }
210 else
211 {
212 struct token *token = (struct token *)get_handle_obj( current->process,
213 handle,
214 TOKEN_IMPERSONATE,
215 &token_ops );
216 if (token)
217 {
218 if (thread->token)
219 release_object( thread->token );
220 thread->token = token;
221 }
222 }
223 }
224
225 const SID *security_unix_uid_to_sid( uid_t uid )
226 {
227 /* very simple mapping: either the current user or not the current user */
228 if (uid == getuid())
229 return (const SID *)&local_user_sid;
230 else
231 return &anonymous_logon_sid;
232 }
233
234 static int acl_is_valid( const ACL *acl, data_size_t size )
235 {
236 ULONG i;
237 const ACE_HEADER *ace;
238
239 if (size < sizeof(ACL))
240 return FALSE;
241
242 size = min(size, MAX_ACL_LEN);
243
244 size -= sizeof(ACL);
245
246 ace = (const ACE_HEADER *)(acl + 1);
247 for (i = 0; i < acl->AceCount; i++)
248 {
249 const SID *sid;
250 data_size_t sid_size;
251
252 if (size < sizeof(ACE_HEADER))
253 return FALSE;
254 if (size < ace->AceSize)
255 return FALSE;
256 size -= ace->AceSize;
257 switch (ace->AceType)
258 {
259 case ACCESS_DENIED_ACE_TYPE:
260 sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
261 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
262 break;
263 case ACCESS_ALLOWED_ACE_TYPE:
264 sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
265 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
266 break;
267 case SYSTEM_AUDIT_ACE_TYPE:
268 sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
269 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
270 break;
271 case SYSTEM_ALARM_ACE_TYPE:
272 sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
273 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
274 break;
275 case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
276 sid = (const SID *)&((const SYSTEM_MANDATORY_LABEL_ACE *)ace)->SidStart;
277 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart);
278 break;
279 default:
280 return FALSE;
281 }
282 if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
283 return FALSE;
284 ace = ace_next( ace );
285 }
286 return TRUE;
287 }
288
289 static unsigned int get_sid_count( const SID *sid, data_size_t size )
290 {
291 unsigned int count;
292
293 for (count = 0; size >= sizeof(SID) && security_sid_len( sid ) <= size; count++)
294 {
295 size -= security_sid_len( sid );
296 sid = (const SID *)((char *)sid + security_sid_len( sid ));
297 }
298
299 return count;
300 }
301
302 /* checks whether all members of a security descriptor fit inside the size
303 * of memory specified */
304 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
305 {
306 size_t offset = sizeof(struct security_descriptor);
307 const SID *group;
308 const SID *owner;
309 const ACL *sacl;
310 const ACL *dacl;
311 int dummy;
312
313 if (size < offset)
314 return FALSE;
315
316 if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
317 (offset + sd->owner_len > size))
318 return FALSE;
319 owner = sd_get_owner( sd );
320 if (owner)
321 {
322 if ((sd->owner_len < sizeof(SID)) || (security_sid_len( owner ) > sd->owner_len))
323 return FALSE;
324 }
325 offset += sd->owner_len;
326
327 if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
328 (offset + sd->group_len > size))
329 return FALSE;
330 group = sd_get_group( sd );
331 if (group)
332 {
333 if ((sd->group_len < sizeof(SID)) || (security_sid_len( group ) > sd->group_len))
334 return FALSE;
335 }
336 offset += sd->group_len;
337
338 if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
339 return FALSE;
340 sacl = sd_get_sacl( sd, &dummy );
341 if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
342 return FALSE;
343 offset += sd->sacl_len;
344
345 if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
346 return FALSE;
347 dacl = sd_get_dacl( sd, &dummy );
348 if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
349 return FALSE;
350 offset += sd->dacl_len;
351
352 return TRUE;
353 }
354
355 /* extract security labels from SACL */
356 ACL *extract_security_labels( const ACL *sacl )
357 {
358 size_t size = sizeof(ACL);
359 const ACE_HEADER *ace;
360 ACE_HEADER *label_ace;
361 unsigned int i, count = 0;
362 ACL *label_acl;
363
364 ace = (const ACE_HEADER *)(sacl + 1);
365 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
366 {
367 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
368 {
369 size += ace->AceSize;
370 count++;
371 }
372 }
373
374 label_acl = mem_alloc( size );
375 if (!label_acl) return NULL;
376
377 label_acl->AclRevision = sacl->AclRevision;
378 label_acl->Sbz1 = 0;
379 label_acl->AclSize = size;
380 label_acl->AceCount = count;
381 label_acl->Sbz2 = 0;
382 label_ace = (ACE_HEADER *)(label_acl + 1);
383
384 ace = (const ACE_HEADER *)(sacl + 1);
385 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
386 {
387 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
388 {
389 memcpy( label_ace, ace, ace->AceSize );
390 label_ace = (ACE_HEADER *)ace_next( label_ace );
391 }
392 }
393 return label_acl;
394 }
395
396 /* replace security labels in an existing SACL */
397 ACL *replace_security_labels( const ACL *old_sacl, const ACL *new_sacl )
398 {
399 const ACE_HEADER *ace;
400 ACE_HEADER *replaced_ace;
401 size_t size = sizeof(ACL);
402 unsigned int i, count = 0;
403 BYTE revision = ACL_REVISION;
404 ACL *replaced_acl;
405
406 if (old_sacl)
407 {
408 revision = max( revision, old_sacl->AclRevision );
409 ace = (const ACE_HEADER *)(old_sacl + 1);
410 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
411 {
412 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
413 size += ace->AceSize;
414 count++;
415 }
416 }
417
418 if (new_sacl)
419 {
420 revision = max( revision, new_sacl->AclRevision );
421 ace = (const ACE_HEADER *)(new_sacl + 1);
422 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
423 {
424 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
425 size += ace->AceSize;
426 count++;
427 }
428 }
429
430 replaced_acl = mem_alloc( size );
431 if (!replaced_acl) return NULL;
432
433 replaced_acl->AclRevision = revision;
434 replaced_acl->Sbz1 = 0;
435 replaced_acl->AclSize = size;
436 replaced_acl->AceCount = count;
437 replaced_acl->Sbz2 = 0;
438 replaced_ace = (ACE_HEADER *)(replaced_acl + 1);
439
440 if (old_sacl)
441 {
442 ace = (const ACE_HEADER *)(old_sacl + 1);
443 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
444 {
445 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
446 memcpy( replaced_ace, ace, ace->AceSize );
447 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
448 }
449 }
450
451 if (new_sacl)
452 {
453 ace = (const ACE_HEADER *)(new_sacl + 1);
454 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
455 {
456 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
457 memcpy( replaced_ace, ace, ace->AceSize );
458 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
459 }
460 }
461
462 return replaced_acl;
463 }
464
465 /* maps from generic rights to specific rights as given by a mapping */
466 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
467 {
468 if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
469 if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
470 if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
471 if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
472 *mask &= 0x0FFFFFFF;
473 }
474
475 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
476 {
477 return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
478 }
479
480 static inline void allocate_luid( luid_t *luid )
481 {
482 prev_luid_value.low_part++;
483 *luid = prev_luid_value;
484 }
485
486 DECL_HANDLER( allocate_locally_unique_id )
487 {
488 allocate_luid( &reply->luid );
489 }
490
491 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
492 {
493 out->Luid = in->luid;
494 out->Attributes =
495 (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
496 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
497 }
498
499 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
500 {
501 struct privilege *privilege = mem_alloc( sizeof(*privilege) );
502 if (privilege)
503 {
504 privilege->luid = *luid;
505 privilege->def = privilege->enabled = (enabled != 0);
506 list_add_tail( &token->privileges, &privilege->entry );
507 }
508 return privilege;
509 }
510
511 static inline void privilege_remove( struct privilege *privilege )
512 {
513 list_remove( &privilege->entry );
514 free( privilege );
515 }
516
517 static void token_destroy( struct object *obj )
518 {
519 struct token* token;
520 struct list *cursor, *cursor_next;
521
522 assert( obj->ops == &token_ops );
523 token = (struct token *)obj;
524
525 free( token->user );
526
527 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
528 {
529 struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
530 privilege_remove( privilege );
531 }
532
533 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
534 {
535 struct group *group = LIST_ENTRY( cursor, struct group, entry );
536 list_remove( &group->entry );
537 free( group );
538 }
539
540 free( token->default_dacl );
541 }
542
543 /* creates a new token.
544 * groups may be NULL if group_count is 0.
545 * privs may be NULL if priv_count is 0.
546 * default_dacl may be NULL, indicating that all objects created by the user
547 * are unsecured.
548 * modified_id may be NULL, indicating that a new modified_id luid should be
549 * allocated.
550 */
551 static struct token *create_token( unsigned primary, const SID *user,
552 const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
553 const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
554 const ACL *default_dacl, TOKEN_SOURCE source,
555 const luid_t *modified_id,
556 int impersonation_level )
557 {
558 struct token *token = alloc_object( &token_ops );
559 if (token)
560 {
561 unsigned int i;
562
563 allocate_luid( &token->token_id );
564 if (modified_id)
565 token->modified_id = *modified_id;
566 else
567 allocate_luid( &token->modified_id );
568 list_init( &token->privileges );
569 list_init( &token->groups );
570 token->primary = primary;
571 /* primary tokens don't have impersonation levels */
572 if (primary)
573 token->impersonation_level = -1;
574 else
575 token->impersonation_level = impersonation_level;
576 token->default_dacl = NULL;
577 token->primary_group = NULL;
578
579 /* copy user */
580 token->user = memdup( user, security_sid_len( user ));
581 if (!token->user)
582 {
583 release_object( token );
584 return NULL;
585 }
586
587 /* copy groups */
588 for (i = 0; i < group_count; i++)
589 {
590 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
591 struct group *group = mem_alloc( size );
592
593 if (!group)
594 {
595 release_object( token );
596 return NULL;
597 }
598 memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
599 group->enabled = TRUE;
600 group->def = TRUE;
601 group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
602 group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
603 group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
604 group->resource = FALSE;
605 group->deny_only = FALSE;
606 list_add_tail( &token->groups, &group->entry );
607 /* Use first owner capable group as owner and primary group */
608 if (!token->primary_group && group->owner)
609 {
610 token->owner = &group->sid;
611 token->primary_group = &group->sid;
612 }
613 }
614
615 /* copy privileges */
616 for (i = 0; i < priv_count; i++)
617 {
618 /* note: we don't check uniqueness: the caller must make sure
619 * privs doesn't contain any duplicate luids */
620 if (!privilege_add( token, &privs[i].Luid,
621 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
622 {
623 release_object( token );
624 return NULL;
625 }
626 }
627
628 if (default_dacl)
629 {
630 token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
631 if (!token->default_dacl)
632 {
633 release_object( token );
634 return NULL;
635 }
636 }
637
638 token->source = source;
639 }
640 return token;
641 }
642
643 static int filter_group( struct group *group, const SID *filter, unsigned int count )
644 {
645 unsigned int i;
646
647 for (i = 0; i < count; i++)
648 {
649 if (security_equal_sid( &group->sid, filter )) return 1;
650 filter = (const SID *)((char *)filter + security_sid_len( filter ));
651 }
652
653 return 0;
654 }
655
656 static int filter_privilege( struct privilege *privilege, const LUID_AND_ATTRIBUTES *filter, unsigned int count )
657 {
658 unsigned int i;
659
660 for (i = 0; i < count; i++)
661 {
662 if (!memcmp( &privilege->luid, &filter[i].Luid, sizeof(LUID) ))
663 return 1;
664 }
665
666 return 0;
667 }
668
669 struct token *token_duplicate( struct token *src_token, unsigned primary,
670 int impersonation_level, const struct security_descriptor *sd,
671 const LUID_AND_ATTRIBUTES *remove_privs, unsigned int remove_priv_count,
672 const SID *remove_groups, unsigned int remove_group_count)
673 {
674 const luid_t *modified_id =
675 primary || (impersonation_level == src_token->impersonation_level) ?
676 &src_token->modified_id : NULL;
677 struct token *token = NULL;
678 struct privilege *privilege;
679 struct group *group;
680
681 if (!primary &&
682 (impersonation_level < SecurityAnonymous ||
683 impersonation_level > SecurityDelegation ||
684 (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
685 {
686 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
687 return NULL;
688 }
689
690 token = create_token( primary, src_token->user, NULL, 0,
691 NULL, 0, src_token->default_dacl,
692 src_token->source, modified_id,
693 impersonation_level );
694 if (!token) return token;
695
696 /* copy groups */
697 token->primary_group = NULL;
698 LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
699 {
700 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
701 struct group *newgroup = mem_alloc( size );
702 if (!newgroup)
703 {
704 release_object( token );
705 return NULL;
706 }
707 memcpy( newgroup, group, size );
708 if (filter_group( group, remove_groups, remove_group_count ))
709 {
710 newgroup->enabled = 0;
711 newgroup->def = 0;
712 newgroup->deny_only = 1;
713 }
714 list_add_tail( &token->groups, &newgroup->entry );
715 if (src_token->primary_group == &group->sid)
716 {
717 token->owner = &newgroup->sid;
718 token->primary_group = &newgroup->sid;
719 }
720 }
721 assert( token->primary_group );
722
723 /* copy privileges */
724 LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
725 {
726 if (filter_privilege( privilege, remove_privs, remove_priv_count )) continue;
727 if (!privilege_add( token, &privilege->luid, privilege->enabled ))
728 {
729 release_object( token );
730 return NULL;
731 }
732 }
733
734 if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
735 DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
736
737 return token;
738 }
739
740 static ACL *create_default_dacl( const SID *user )
741 {
742 ACCESS_ALLOWED_ACE *aaa;
743 ACL *default_dacl;
744 SID *sid;
745 size_t default_dacl_size = sizeof(ACL) +
746 2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
747 sizeof(local_system_sid) +
748 security_sid_len( user );
749
750 default_dacl = mem_alloc( default_dacl_size );
751 if (!default_dacl) return NULL;
752
753 default_dacl->AclRevision = ACL_REVISION;
754 default_dacl->Sbz1 = 0;
755 default_dacl->AclSize = default_dacl_size;
756 default_dacl->AceCount = 2;
757 default_dacl->Sbz2 = 0;
758
759 /* GENERIC_ALL for Local System */
760 aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
761 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
762 aaa->Header.AceFlags = 0;
763 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
764 sizeof(local_system_sid);
765 aaa->Mask = GENERIC_ALL;
766 sid = (SID *)&aaa->SidStart;
767 memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
768
769 /* GENERIC_ALL for specified user */
770 aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
771 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
772 aaa->Header.AceFlags = 0;
773 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
774 aaa->Mask = GENERIC_ALL;
775 sid = (SID *)&aaa->SidStart;
776 memcpy( sid, user, security_sid_len( user ));
777
778 return default_dacl;
779 }
780
781 struct sid_data
782 {
783 SID_IDENTIFIER_AUTHORITY idauth;
784 int count;
785 unsigned int subauth[MAX_SUBAUTH_COUNT];
786 };
787
788 static struct security_descriptor *create_security_label_sd( struct token *token, PSID label_sid )
789 {
790 size_t sid_len = security_sid_len( label_sid ), sacl_size, sd_size;
791 SYSTEM_MANDATORY_LABEL_ACE *smla;
792 struct security_descriptor *sd;
793 ACL *sacl;
794
795 sacl_size = sizeof(ACL) + FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
796 sd_size = sizeof(struct security_descriptor) + sacl_size;
797 if (!(sd = mem_alloc( sd_size )))
798 return NULL;
799
800 sd->control = SE_SACL_PRESENT;
801 sd->owner_len = 0;
802 sd->group_len = 0;
803 sd->sacl_len = sacl_size;
804 sd->dacl_len = 0;
805
806 sacl = (ACL *)(sd + 1);
807 sacl->AclRevision = ACL_REVISION;
808 sacl->Sbz1 = 0;
809 sacl->AclSize = sacl_size;
810 sacl->AceCount = 1;
811 sacl->Sbz2 = 0;
812
813 smla = (SYSTEM_MANDATORY_LABEL_ACE *)(sacl + 1);
814 smla->Header.AceType = SYSTEM_MANDATORY_LABEL_ACE_TYPE;
815 smla->Header.AceFlags = 0;
816 smla->Header.AceSize = FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
817 smla->Mask = SYSTEM_MANDATORY_LABEL_NO_WRITE_UP;
818 memcpy( &smla->SidStart, label_sid, sid_len );
819
820 assert( sd_is_valid( sd, sd_size ) );
821 return sd;
822 }
823
824 int token_assign_label( struct token *token, PSID label )
825 {
826 struct security_descriptor *sd;
827 int ret = 0;
828
829 if ((sd = create_security_label_sd( token, label )))
830 {
831 ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
832 free( sd );
833 }
834
835 return ret;
836 }
837
838 struct token *get_token_obj( struct process *process, obj_handle_t handle, unsigned int access )
839 {
840 return (struct token *)get_handle_obj( process, handle, access, &token_ops );
841 }
842
843 struct token *token_create_admin( void )
844 {
845 struct token *token = NULL;
846 static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
847 static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
848 static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
849 /* on Windows, this value changes every time the user logs on */
850 static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
851 PSID alias_admins_sid;
852 PSID alias_users_sid;
853 PSID logon_sid;
854 const SID *user_sid = security_unix_uid_to_sid( getuid() );
855 ACL *default_dacl = create_default_dacl( user_sid );
856
857 alias_admins_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_admins_subauth ),
858 alias_admins_subauth );
859 alias_users_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_users_subauth ),
860 alias_users_subauth );
861 logon_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( logon_subauth ), logon_subauth );
862
863 if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
864 {
865 const LUID_AND_ATTRIBUTES admin_privs[] =
866 {
867 { SeChangeNotifyPrivilege , SE_PRIVILEGE_ENABLED },
868 { SeSecurityPrivilege , 0 },
869 { SeBackupPrivilege , 0 },
870 { SeRestorePrivilege , 0 },
871 { SeSystemtimePrivilege , 0 },
872 { SeShutdownPrivilege , 0 },
873 { SeRemoteShutdownPrivilege , 0 },
874 { SeTakeOwnershipPrivilege , 0 },
875 { SeDebugPrivilege , 0 },
876 { SeSystemEnvironmentPrivilege , 0 },
877 { SeSystemProfilePrivilege , 0 },
878 { SeProfileSingleProcessPrivilege, 0 },
879 { SeIncreaseBasePriorityPrivilege, 0 },
880 { SeLoadDriverPrivilege , SE_PRIVILEGE_ENABLED },
881 { SeCreatePagefilePrivilege , 0 },
882 { SeIncreaseQuotaPrivilege , 0 },
883 { SeUndockPrivilege , 0 },
884 { SeManageVolumePrivilege , 0 },
885 { SeImpersonatePrivilege , SE_PRIVILEGE_ENABLED },
886 { SeCreateGlobalPrivilege , SE_PRIVILEGE_ENABLED },
887 };
888 /* note: we don't include non-builtin groups here for the user -
889 * telling us these is the job of a client-side program */
890 const SID_AND_ATTRIBUTES admin_groups[] =
891 {
892 { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
893 { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
894 { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
895 { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
896 { security_domain_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
897 { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
898 { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
899 { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
900 };
901 static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
902 token = create_token( TRUE, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
903 admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
904 admin_source, NULL, -1 );
905 /* we really need a primary group */
906 assert( token->primary_group );
907 }
908
909 free( logon_sid );
910 free( alias_admins_sid );
911 free( alias_users_sid );
912 free( default_dacl );
913
914 return token;
915 }
916
917 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
918 {
919 struct privilege *privilege;
920 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
921 {
922 if (is_equal_luid( luid, &privilege->luid ))
923 {
924 if (enabled_only && !privilege->enabled)
925 return NULL;
926 return privilege;
927 }
928 }
929 return NULL;
930 }
931
932 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
933 unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
934 unsigned int mod_privs_count )
935 {
936 unsigned int i, modified_count = 0;
937
938 /* mark as modified */
939 allocate_luid( &token->modified_id );
940
941 for (i = 0; i < count; i++)
942 {
943 struct privilege *privilege =
944 token_find_privilege( token, &privs[i].Luid, FALSE );
945 if (!privilege)
946 {
947 set_error( STATUS_NOT_ALL_ASSIGNED );
948 continue;
949 }
950
951 if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
952 privilege_remove( privilege );
953 else
954 {
955 /* save previous state for caller */
956 if (mod_privs_count)
957 {
958 luid_and_attr_from_privilege(mod_privs, privilege);
959 mod_privs++;
960 mod_privs_count--;
961 modified_count++;
962 }
963
964 if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
965 privilege->enabled = TRUE;
966 else
967 privilege->enabled = FALSE;
968 }
969 }
970 return modified_count;
971 }
972
973 static void token_disable_privileges( struct token *token )
974 {
975 struct privilege *privilege;
976
977 /* mark as modified */
978 allocate_luid( &token->modified_id );
979
980 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
981 privilege->enabled = FALSE;
982 }
983
984 int token_check_privileges( struct token *token, int all_required,
985 const LUID_AND_ATTRIBUTES *reqprivs,
986 unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
987 {
988 unsigned int i, enabled_count = 0;
989
990 for (i = 0; i < count; i++)
991 {
992 struct privilege *privilege =
993 token_find_privilege( token, &reqprivs[i].Luid, TRUE );
994
995 if (usedprivs)
996 usedprivs[i] = reqprivs[i];
997
998 if (privilege && privilege->enabled)
999 {
1000 enabled_count++;
1001 if (usedprivs)
1002 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
1003 }
1004 }
1005
1006 if (all_required)
1007 return (enabled_count == count);
1008 else
1009 return (enabled_count > 0);
1010 }
1011
1012 int token_sid_present( struct token *token, const SID *sid, int deny )
1013 {
1014 struct group *group;
1015
1016 if (security_equal_sid( token->user, sid )) return TRUE;
1017
1018 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
1019 {
1020 if (!group->enabled) continue;
1021 if (group->deny_only && !deny) continue;
1022
1023 if (security_equal_sid( &group->sid, sid )) return TRUE;
1024 }
1025
1026 return FALSE;
1027 }
1028
1029 /* Checks access to a security descriptor. 'sd' must have been validated by
1030 * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
1031 * the reason. 'status' parameter will indicate if access is granted or denied.
1032 *
1033 * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
1034 */
1035 static unsigned int token_access_check( struct token *token,
1036 const struct security_descriptor *sd,
1037 unsigned int desired_access,
1038 LUID_AND_ATTRIBUTES *privs,
1039 unsigned int *priv_count,
1040 const GENERIC_MAPPING *mapping,
1041 unsigned int *granted_access,
1042 unsigned int *status )
1043 {
1044 unsigned int current_access = 0;
1045 unsigned int denied_access = 0;
1046 ULONG i;
1047 const ACL *dacl;
1048 int dacl_present;
1049 const ACE_HEADER *ace;
1050 const SID *owner;
1051
1052 /* assume no access rights */
1053 *granted_access = 0;
1054
1055 /* fail if desired_access contains generic rights */
1056 if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
1057 {
1058 if (priv_count) *priv_count = 0;
1059 return STATUS_GENERIC_NOT_MAPPED;
1060 }
1061
1062 dacl = sd_get_dacl( sd, &dacl_present );
1063 owner = sd_get_owner( sd );
1064 if (!owner || !sd_get_group( sd ))
1065 {
1066 if (priv_count) *priv_count = 0;
1067 return STATUS_INVALID_SECURITY_DESCR;
1068 }
1069
1070 /* 1: Grant desired access if the object is unprotected */
1071 if (!dacl_present || !dacl)
1072 {
1073 if (priv_count) *priv_count = 0;
1074 if (desired_access & MAXIMUM_ALLOWED)
1075 *granted_access = mapping->GenericAll;
1076 else
1077 *granted_access = desired_access;
1078 return *status = STATUS_SUCCESS;
1079 }
1080
1081 /* 2: Check if caller wants access to system security part. Note: access
1082 * is only granted if specifically asked for */
1083 if (desired_access & ACCESS_SYSTEM_SECURITY)
1084 {
1085 const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
1086 LUID_AND_ATTRIBUTES retpriv = security_priv;
1087 if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
1088 {
1089 if (priv_count)
1090 {
1091 /* assumes that there will only be one privilege to return */
1092 if (*priv_count >= 1)
1093 {
1094 *priv_count = 1;
1095 *privs = retpriv;
1096 }
1097 else
1098 {
1099 *priv_count = 1;
1100 return STATUS_BUFFER_TOO_SMALL;
1101 }
1102 }
1103 current_access |= ACCESS_SYSTEM_SECURITY;
1104 if (desired_access == current_access)
1105 {
1106 *granted_access = current_access;
1107 return *status = STATUS_SUCCESS;
1108 }
1109 }
1110 else
1111 {
1112 if (priv_count) *priv_count = 0;
1113 *status = STATUS_PRIVILEGE_NOT_HELD;
1114 return STATUS_SUCCESS;
1115 }
1116 }
1117 else if (priv_count) *priv_count = 0;
1118
1119 /* 3: Check whether the token is the owner */
1120 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
1121 * checked when a "set owner" call is made, overriding the access rights
1122 * determined here. */
1123 if (token_sid_present( token, owner, FALSE ))
1124 {
1125 current_access |= (READ_CONTROL | WRITE_DAC);
1126 if (desired_access == current_access)
1127 {
1128 *granted_access = current_access;
1129 return *status = STATUS_SUCCESS;
1130 }
1131 }
1132
1133 /* 4: Grant rights according to the DACL */
1134 ace = (const ACE_HEADER *)(dacl + 1);
1135 for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
1136 {
1137 const ACCESS_ALLOWED_ACE *aa_ace;
1138 const ACCESS_DENIED_ACE *ad_ace;
1139 const SID *sid;
1140
1141 if (ace->AceFlags & INHERIT_ONLY_ACE)
1142 continue;
1143
1144 switch (ace->AceType)
1145 {
1146 case ACCESS_DENIED_ACE_TYPE:
1147 ad_ace = (const ACCESS_DENIED_ACE *)ace;
1148 sid = (const SID *)&ad_ace->SidStart;
1149 if (token_sid_present( token, sid, TRUE ))
1150 {
1151 unsigned int access = ad_ace->Mask;
1152 map_generic_mask(&access, mapping);
1153 if (desired_access & MAXIMUM_ALLOWED)
1154 denied_access |= access;
1155 else
1156 {
1157 denied_access |= (access & ~current_access);
1158 if (desired_access & access) goto done;
1159 }
1160 }
1161 break;
1162 case ACCESS_ALLOWED_ACE_TYPE:
1163 aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
1164 sid = (const SID *)&aa_ace->SidStart;
1165 if (token_sid_present( token, sid, FALSE ))
1166 {
1167 unsigned int access = aa_ace->Mask;
1168 map_generic_mask(&access, mapping);
1169 if (desired_access & MAXIMUM_ALLOWED)
1170 current_access |= access;
1171 else
1172 current_access |= (access & ~denied_access);
1173 }
1174 break;
1175 }
1176
1177 /* don't bother carrying on checking if we've already got all of
1178 * rights we need */
1179 if (desired_access == *granted_access)
1180 break;
1181 }
1182
1183 done:
1184 if (desired_access & MAXIMUM_ALLOWED)
1185 *granted_access = current_access & ~denied_access;
1186 else
1187 if ((current_access & desired_access) == desired_access)
1188 *granted_access = current_access & desired_access;
1189 else
1190 *granted_access = 0;
1191
1192 *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1193 return STATUS_SUCCESS;
1194 }
1195
1196 const ACL *token_get_default_dacl( struct token *token )
1197 {
1198 return token->default_dacl;
1199 }
1200
1201 const SID *token_get_user( struct token *token )
1202 {
1203 return token->user;
1204 }
1205
1206 const SID *token_get_primary_group( struct token *token )
1207 {
1208 return token->primary_group;
1209 }
1210
1211 int check_object_access(struct token *token, struct object *obj, unsigned int *access)
1212 {
1213 GENERIC_MAPPING mapping;
1214 unsigned int status;
1215 int res;
1216
1217 if (!token)
1218 token = current->token ? current->token : current->process->token;
1219
1220 mapping.GenericAll = obj->ops->map_access( obj, GENERIC_ALL );
1221
1222 if (!obj->sd)
1223 {
1224 if (*access & MAXIMUM_ALLOWED)
1225 *access = mapping.GenericAll;
1226 return TRUE;
1227 }
1228
1229 mapping.GenericRead = obj->ops->map_access( obj, GENERIC_READ );
1230 mapping.GenericWrite = obj->ops->map_access( obj, GENERIC_WRITE );
1231 mapping.GenericExecute = obj->ops->map_access( obj, GENERIC_EXECUTE );
1232
1233 res = token_access_check( token, obj->sd, *access, NULL, NULL,
1234 &mapping, access, &status ) == STATUS_SUCCESS &&
1235 status == STATUS_SUCCESS;
1236
1237 if (!res) set_error( STATUS_ACCESS_DENIED );
1238 return res;
1239 }
1240
1241
1242 /* open a security token */
1243 DECL_HANDLER(open_token)
1244 {
1245 if (req->flags & OPEN_TOKEN_THREAD)
1246 {
1247 struct thread *thread = get_thread_from_handle( req->handle, 0 );
1248 if (thread)
1249 {
1250 if (thread->token)
1251 {
1252 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1253 set_error( STATUS_CANT_OPEN_ANONYMOUS );
1254 else
1255 reply->token = alloc_handle( current->process, thread->token,
1256 req->access, req->attributes );
1257 }
1258 else
1259 set_error( STATUS_NO_TOKEN );
1260 release_object( thread );
1261 }
1262 }
1263 else
1264 {
1265 struct process *process = get_process_from_handle( req->handle, 0 );
1266 if (process)
1267 {
1268 if (process->token)
1269 reply->token = alloc_handle( current->process, process->token, req->access,
1270 req->attributes );
1271 else
1272 set_error( STATUS_NO_TOKEN );
1273 release_object( process );
1274 }
1275 }
1276 }
1277
1278 /* adjust the privileges held by a token */
1279 DECL_HANDLER(adjust_token_privileges)
1280 {
1281 struct token *token;
1282 unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1283
1284 if (req->get_modified_state) access |= TOKEN_QUERY;
1285
1286 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1287 access, &token_ops )))
1288 {
1289 const LUID_AND_ATTRIBUTES *privs = get_req_data();
1290 LUID_AND_ATTRIBUTES *modified_privs = NULL;
1291 unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1292 unsigned int modified_priv_count = 0;
1293
1294 if (req->get_modified_state && !req->disable_all)
1295 {
1296 unsigned int i;
1297 /* count modified privs */
1298 for (i = 0; i < priv_count; i++)
1299 {
1300 struct privilege *privilege =
1301 token_find_privilege( token, &privs[i].Luid, FALSE );
1302 if (privilege && req->get_modified_state)
1303 modified_priv_count++;
1304 }
1305 reply->len = modified_priv_count;
1306 modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1307 if (modified_priv_count)
1308 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1309 }
1310 reply->len = modified_priv_count * sizeof(*modified_privs);
1311
1312 if (req->disable_all)
1313 token_disable_privileges( token );
1314 else
1315 token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
1316
1317 release_object( token );
1318 }
1319 }
1320
1321 /* retrieves the list of privileges that may be held be the token */
1322 DECL_HANDLER(get_token_privileges)
1323 {
1324 struct token *token;
1325
1326 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1327 TOKEN_QUERY,
1328 &token_ops )))
1329 {
1330 int priv_count = 0;
1331 LUID_AND_ATTRIBUTES *privs;
1332 struct privilege *privilege;
1333
1334 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1335 priv_count++;
1336
1337 reply->len = priv_count * sizeof(*privs);
1338 if (reply->len <= get_reply_max_size())
1339 {
1340 privs = set_reply_data_size( priv_count * sizeof(*privs) );
1341 if (privs)
1342 {
1343 int i = 0;
1344 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1345 {
1346 luid_and_attr_from_privilege( &privs[i], privilege );
1347 i++;
1348 }
1349 }
1350 }
1351 else
1352 set_error(STATUS_BUFFER_TOO_SMALL);
1353
1354 release_object( token );
1355 }
1356 }
1357
1358 /* creates a duplicate of the token */
1359 DECL_HANDLER(duplicate_token)
1360 {
1361 struct token *src_token;
1362 struct unicode_str name;
1363 const struct security_descriptor *sd;
1364 const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
1365
1366 if (!objattr) return;
1367
1368 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1369 TOKEN_DUPLICATE,
1370 &token_ops )))
1371 {
1372 struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd, NULL, 0, NULL, 0 );
1373 if (token)
1374 {
1375 reply->new_handle = alloc_handle_no_access_check( current->process, token, req->access, objattr->attributes );
1376 release_object( token );
1377 }
1378 release_object( src_token );
1379 }
1380 }
1381
1382 /* creates a restricted version of a token */
1383 DECL_HANDLER(filter_token)
1384 {
1385 struct token *src_token;
1386
1387 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_DUPLICATE, &token_ops )))
1388 {
1389 const LUID_AND_ATTRIBUTES *filter_privileges = get_req_data();
1390 unsigned int priv_count, group_count;
1391 const SID *filter_groups;
1392 struct token *token;
1393
1394 priv_count = min( req->privileges_size, get_req_data_size() ) / sizeof(LUID_AND_ATTRIBUTES);
1395 filter_groups = (const SID *)((char *)filter_privileges + priv_count * sizeof(LUID_AND_ATTRIBUTES));
1396 group_count = get_sid_count( filter_groups, get_req_data_size() - priv_count * sizeof(LUID_AND_ATTRIBUTES) );
1397
1398 token = token_duplicate( src_token, src_token->primary, src_token->impersonation_level, NULL,
1399 filter_privileges, priv_count, filter_groups, group_count );
1400 if (token)
1401 {
1402 unsigned int access = get_handle_access( current->process, req->handle );
1403 reply->new_handle = alloc_handle_no_access_check( current->process, token, access, 0 );
1404 release_object( token );
1405 }
1406 release_object( src_token );
1407 }
1408 }
1409
1410 /* checks the specified privileges are held by the token */
1411 DECL_HANDLER(check_token_privileges)
1412 {
1413 struct token *token;
1414
1415 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1416 TOKEN_QUERY,
1417 &token_ops )))
1418 {
1419 unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1420
1421 if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1422 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1423 else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1424 {
1425 LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1426 reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1427 }
1428 else
1429 set_error( STATUS_BUFFER_OVERFLOW );
1430 release_object( token );
1431 }
1432 }
1433
1434 /* checks that a user represented by a token is allowed to access an object
1435 * represented by a security descriptor */
1436 DECL_HANDLER(access_check)
1437 {
1438 data_size_t sd_size = get_req_data_size();
1439 const struct security_descriptor *sd = get_req_data();
1440 struct token *token;
1441
1442 if (!sd_is_valid( sd, sd_size ))
1443 {
1444 set_error( STATUS_ACCESS_VIOLATION );
1445 return;
1446 }
1447
1448 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1449 TOKEN_QUERY,
1450 &token_ops )))
1451 {
1452 GENERIC_MAPPING mapping;
1453 unsigned int status;
1454 LUID_AND_ATTRIBUTES priv;
1455 unsigned int priv_count = 1;
1456
1457 memset(&priv, 0, sizeof(priv));
1458
1459 /* only impersonation tokens may be used with this function */
1460 if (token->primary)
1461 {
1462 set_error( STATUS_NO_IMPERSONATION_TOKEN );
1463 release_object( token );
1464 return;
1465 }
1466 /* anonymous impersonation tokens can't be used */
1467 if (token->impersonation_level <= SecurityAnonymous)
1468 {
1469 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1470 release_object( token );
1471 return;
1472 }
1473
1474 mapping.GenericRead = req->mapping_read;
1475 mapping.GenericWrite = req->mapping_write;
1476 mapping.GenericExecute = req->mapping_execute;
1477 mapping.GenericAll = req->mapping_all;
1478
1479 status = token_access_check(
1480 token, sd, req->desired_access, &priv, &priv_count, &mapping,
1481 &reply->access_granted, &reply->access_status );
1482
1483 reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1484
1485 if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1486 {
1487 LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1488 memcpy( privs, &priv, sizeof(priv) );
1489 }
1490
1491 set_error( status );
1492 release_object( token );
1493 }
1494 }
1495
1496 /* retrieves an SID from the token */
1497 DECL_HANDLER(get_token_sid)
1498 {
1499 struct token *token;
1500
1501 reply->sid_len = 0;
1502
1503 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1504 {
1505 const SID *sid = NULL;
1506
1507 switch (req->which_sid)
1508 {
1509 case TokenUser:
1510 assert(token->user);
1511 sid = token->user;
1512 break;
1513 case TokenPrimaryGroup:
1514 sid = token->primary_group;
1515 break;
1516 case TokenOwner:
1517 sid = token->owner;
1518 break;
1519 case TokenLogonSid:
1520 sid = (const SID *)&builtin_logon_sid;
1521 break;
1522 default:
1523 set_error( STATUS_INVALID_PARAMETER );
1524 break;
1525 }
1526
1527 if (sid)
1528 {
1529 reply->sid_len = security_sid_len( sid );
1530 if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1531 else set_error( STATUS_BUFFER_TOO_SMALL );
1532 }
1533 release_object( token );
1534 }
1535 }
1536
1537 /* retrieves the groups that the user represented by the token belongs to */
1538 DECL_HANDLER(get_token_groups)
1539 {
1540 struct token *token;
1541
1542 reply->user_len = 0;
1543
1544 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1545 TOKEN_QUERY,
1546 &token_ops )))
1547 {
1548 size_t size_needed = sizeof(struct token_groups);
1549 size_t sid_size = 0;
1550 unsigned int group_count = 0;
1551 const struct group *group;
1552
1553 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1554 {
1555 group_count++;
1556 sid_size += security_sid_len( &group->sid );
1557 }
1558 size_needed += sid_size;
1559 /* attributes size */
1560 size_needed += sizeof(unsigned int) * group_count;
1561
1562 /* reply buffer contains size_needed bytes formatted as:
1563
1564 unsigned int count;
1565 unsigned int attrib[count];
1566 char sid_data[];
1567
1568 user_len includes extra data needed for TOKEN_GROUPS representation,
1569 required caller buffer size calculated here to avoid extra server call */
1570 reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1571
1572 if (reply->user_len <= get_reply_max_size())
1573 {
1574 struct token_groups *tg = set_reply_data_size( size_needed );
1575 if (tg)
1576 {
1577 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1578 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1579
1580 tg->count = group_count;
1581
1582 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1583 {
1584
1585 *attr_ptr = 0;
1586 if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1587 if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1588 if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1589 if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1590 if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1591 if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1592 if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1593
1594 memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1595
1596 sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1597 attr_ptr++;
1598 }
1599 }
1600 }
1601 else set_error( STATUS_BUFFER_TOO_SMALL );
1602
1603 release_object( token );
1604 }
1605 }
1606
1607 DECL_HANDLER(get_token_impersonation_level)
1608 {
1609 struct token *token;
1610
1611 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1612 TOKEN_QUERY,
1613 &token_ops )))
1614 {
1615 if (token->primary)
1616 set_error( STATUS_INVALID_PARAMETER );
1617 else
1618 reply->impersonation_level = token->impersonation_level;
1619
1620 release_object( token );
1621 }
1622 }
1623
1624 DECL_HANDLER(get_token_statistics)
1625 {
1626 struct token *token;
1627
1628 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1629 TOKEN_QUERY,
1630 &token_ops )))
1631 {
1632 reply->token_id = token->token_id;
1633 reply->modified_id = token->modified_id;
1634 reply->primary = token->primary;
1635 reply->impersonation_level = token->impersonation_level;
1636 reply->group_count = list_count( &token->groups );
1637 reply->privilege_count = list_count( &token->privileges );
1638
1639 release_object( token );
1640 }
1641 }
1642
1643 DECL_HANDLER(get_token_default_dacl)
1644 {
1645 struct token *token;
1646
1647 reply->acl_len = 0;
1648
1649 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1650 TOKEN_QUERY,
1651 &token_ops )))
1652 {
1653 if (token->default_dacl)
1654 reply->acl_len = token->default_dacl->AclSize;
1655
1656 if (reply->acl_len <= get_reply_max_size())
1657 {
1658 ACL *acl_reply = set_reply_data_size( reply->acl_len );
1659 if (acl_reply)
1660 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1661 }
1662 else set_error( STATUS_BUFFER_TOO_SMALL );
1663
1664 release_object( token );
1665 }
1666 }
1667
1668 DECL_HANDLER(set_token_default_dacl)
1669 {
1670 struct token *token;
1671
1672 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1673 TOKEN_ADJUST_DEFAULT,
1674 &token_ops )))
1675 {
1676 const ACL *acl = get_req_data();
1677 unsigned int acl_size = get_req_data_size();
1678
1679 free( token->default_dacl );
1680 token->default_dacl = NULL;
1681
1682 if (acl_size)
1683 token->default_dacl = memdup( acl, acl_size );
1684
1685 release_object( token );
1686 }
1687 }
Windows API implementation