?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
kernel32: Add a helper function to fill object attributes in Open* functions.
[wine.git] / server / token.c
blob7deddc466454d1945467cec70eca36fe33296722
1 /*
2 * Tokens
3 *
4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 */
22
23 #include "config.h"
24
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <stdarg.h>
29 #include <unistd.h>
30
31 #include "ntstatus.h"
32 #define WIN32_NO_STATUS
33 #include "windef.h"
34 #include "winternl.h"
35
36 #include "handle.h"
37 #include "thread.h"
38 #include "process.h"
39 #include "request.h"
40 #include "security.h"
41
42 #include "wine/unicode.h"
43
44 #define MAX_SUBAUTH_COUNT 1
45
46 const LUID SeIncreaseQuotaPrivilege = { 5, 0 };
47 const LUID SeSecurityPrivilege = { 8, 0 };
48 const LUID SeTakeOwnershipPrivilege = { 9, 0 };
49 const LUID SeLoadDriverPrivilege = { 10, 0 };
50 const LUID SeSystemProfilePrivilege = { 11, 0 };
51 const LUID SeSystemtimePrivilege = { 12, 0 };
52 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
53 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
54 const LUID SeCreatePagefilePrivilege = { 15, 0 };
55 const LUID SeBackupPrivilege = { 17, 0 };
56 const LUID SeRestorePrivilege = { 18, 0 };
57 const LUID SeShutdownPrivilege = { 19, 0 };
58 const LUID SeDebugPrivilege = { 20, 0 };
59 const LUID SeSystemEnvironmentPrivilege = { 22, 0 };
60 const LUID SeChangeNotifyPrivilege = { 23, 0 };
61 const LUID SeRemoteShutdownPrivilege = { 24, 0 };
62 const LUID SeUndockPrivilege = { 25, 0 };
63 const LUID SeManageVolumePrivilege = { 28, 0 };
64 const LUID SeImpersonatePrivilege = { 29, 0 };
65 const LUID SeCreateGlobalPrivilege = { 30, 0 };
66
67 #define SID_N(n) struct /* same fields as struct SID */ \
68 { \
69 BYTE Revision; \
70 BYTE SubAuthorityCount; \
71 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
72 DWORD SubAuthority[n]; \
73 }
74
75 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
76 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
77 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
78 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
79 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
80 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
81 static const SID high_label_sid = { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY }, { SECURITY_MANDATORY_HIGH_RID } };
82 static const SID_N(5) local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
83 static const SID_N(2) builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
84 static const SID_N(2) builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
85 static const SID_N(3) builtin_logon_sid = { SID_REVISION, 3, { SECURITY_NT_AUTHORITY }, { SECURITY_LOGON_IDS_RID, 0, 0 } };
86
87 const PSID security_world_sid = (PSID)&world_sid;
88 static const PSID security_local_sid = (PSID)&local_sid;
89 static const PSID security_interactive_sid = (PSID)&interactive_sid;
90 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
91 const PSID security_local_system_sid = (PSID)&local_system_sid;
92 const PSID security_local_user_sid = (PSID)&local_user_sid;
93 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
94 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
95 const PSID security_high_label_sid = (PSID)&high_label_sid;
96
97 static luid_t prev_luid_value = { 1000, 0 };
98
99 struct token
100 {
101 struct object obj; /* object header */
102 luid_t token_id; /* system-unique id of token */
103 luid_t modified_id; /* new id allocated every time token is modified */
104 struct list privileges; /* privileges available to the token */
105 struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
106 SID *user; /* SID of user this token represents */
107 SID *primary_group; /* SID of user's primary group */
108 unsigned primary; /* is this a primary or impersonation token? */
109 ACL *default_dacl; /* the default DACL to assign to objects created by this user */
110 TOKEN_SOURCE source; /* source of the token */
111 int impersonation_level; /* impersonation level this token is capable of if non-primary token */
112 };
113
114 struct privilege
115 {
116 struct list entry;
117 LUID luid;
118 unsigned enabled : 1; /* is the privilege currently enabled? */
119 unsigned def : 1; /* is the privilege enabled by default? */
120 };
121
122 struct group
123 {
124 struct list entry;
125 unsigned enabled : 1; /* is the sid currently enabled? */
126 unsigned def : 1; /* is the sid enabled by default? */
127 unsigned logon : 1; /* is this a logon sid? */
128 unsigned mandatory: 1; /* is this sid always enabled? */
129 unsigned owner : 1; /* can this sid be an owner of an object? */
130 unsigned resource : 1; /* is this a domain-local group? */
131 unsigned deny_only: 1; /* is this a sid that should be use for denying only? */
132 SID sid;
133 };
134
135 static void token_dump( struct object *obj, int verbose );
136 static unsigned int token_map_access( struct object *obj, unsigned int access );
137 static void token_destroy( struct object *obj );
138
139 static const struct object_ops token_ops =
140 {
141 sizeof(struct token), /* size */
142 token_dump, /* dump */
143 no_get_type, /* get_type */
144 no_add_queue, /* add_queue */
145 NULL, /* remove_queue */
146 NULL, /* signaled */
147 NULL, /* satisfied */
148 no_signal, /* signal */
149 no_get_fd, /* get_fd */
150 token_map_access, /* map_access */
151 default_get_sd, /* get_sd */
152 default_set_sd, /* set_sd */
153 no_lookup_name, /* lookup_name */
154 no_link_name, /* link_name */
155 NULL, /* unlink_name */
156 no_open_file, /* open_file */
157 no_close_handle, /* close_handle */
158 token_destroy /* destroy */
159 };
160
161
162 static void token_dump( struct object *obj, int verbose )
163 {
164 fprintf( stderr, "Security token\n" );
165 /* FIXME: dump token members */
166 }
167
168 static unsigned int token_map_access( struct object *obj, unsigned int access )
169 {
170 if (access & GENERIC_READ) access |= TOKEN_READ;
171 if (access & GENERIC_WRITE) access |= TOKEN_WRITE;
172 if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
173 if (access & GENERIC_ALL) access |= TOKEN_ALL_ACCESS;
174 return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
175 }
176
177 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
178 {
179 int i;
180 SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
181 if (!sid) return NULL;
182 sid->Revision = SID_REVISION;
183 sid->SubAuthorityCount = subauthcount;
184 sid->IdentifierAuthority = *idauthority;
185 for (i = 0; i < subauthcount; i++)
186 sid->SubAuthority[i] = subauth[i];
187 return sid;
188 }
189
190 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
191 {
192 if (!handle)
193 {
194 if (thread->token)
195 release_object( thread->token );
196 thread->token = NULL;
197 }
198 else
199 {
200 struct token *token = (struct token *)get_handle_obj( current->process,
201 handle,
202 TOKEN_IMPERSONATE,
203 &token_ops );
204 if (token)
205 {
206 if (thread->token)
207 release_object( thread->token );
208 thread->token = token;
209 }
210 }
211 }
212
213 const SID *security_unix_uid_to_sid( uid_t uid )
214 {
215 /* very simple mapping: either the current user or not the current user */
216 if (uid == getuid())
217 return (const SID *)&local_user_sid;
218 else
219 return &anonymous_logon_sid;
220 }
221
222 static int acl_is_valid( const ACL *acl, data_size_t size )
223 {
224 ULONG i;
225 const ACE_HEADER *ace;
226
227 if (size < sizeof(ACL))
228 return FALSE;
229
230 size = min(size, MAX_ACL_LEN);
231
232 size -= sizeof(ACL);
233
234 ace = (const ACE_HEADER *)(acl + 1);
235 for (i = 0; i < acl->AceCount; i++)
236 {
237 const SID *sid;
238 data_size_t sid_size;
239
240 if (size < sizeof(ACE_HEADER))
241 return FALSE;
242 if (size < ace->AceSize)
243 return FALSE;
244 size -= ace->AceSize;
245 switch (ace->AceType)
246 {
247 case ACCESS_DENIED_ACE_TYPE:
248 sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
249 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
250 break;
251 case ACCESS_ALLOWED_ACE_TYPE:
252 sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
253 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
254 break;
255 case SYSTEM_AUDIT_ACE_TYPE:
256 sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
257 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
258 break;
259 case SYSTEM_ALARM_ACE_TYPE:
260 sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
261 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
262 break;
263 case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
264 sid = (const SID *)&((const SYSTEM_MANDATORY_LABEL_ACE *)ace)->SidStart;
265 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart);
266 break;
267 default:
268 return FALSE;
269 }
270 if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
271 return FALSE;
272 ace = ace_next( ace );
273 }
274 return TRUE;
275 }
276
277 /* checks whether all members of a security descriptor fit inside the size
278 * of memory specified */
279 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
280 {
281 size_t offset = sizeof(struct security_descriptor);
282 const SID *group;
283 const SID *owner;
284 const ACL *sacl;
285 const ACL *dacl;
286 int dummy;
287
288 if (size < offset)
289 return FALSE;
290
291 if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
292 (offset + sd->owner_len > size))
293 return FALSE;
294 owner = sd_get_owner( sd );
295 if (owner)
296 {
297 size_t needed_size = security_sid_len( owner );
298 if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
299 return FALSE;
300 }
301 offset += sd->owner_len;
302
303 if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
304 (offset + sd->group_len > size))
305 return FALSE;
306 group = sd_get_group( sd );
307 if (group)
308 {
309 size_t needed_size = security_sid_len( group );
310 if ((sd->group_len < sizeof(SID)) || (needed_size > sd->group_len))
311 return FALSE;
312 }
313 offset += sd->group_len;
314
315 if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
316 return FALSE;
317 sacl = sd_get_sacl( sd, &dummy );
318 if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
319 return FALSE;
320 offset += sd->sacl_len;
321
322 if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
323 return FALSE;
324 dacl = sd_get_dacl( sd, &dummy );
325 if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
326 return FALSE;
327 offset += sd->dacl_len;
328
329 return TRUE;
330 }
331
332 /* extract security labels from SACL */
333 ACL *extract_security_labels( const ACL *sacl )
334 {
335 size_t size = sizeof(ACL);
336 const ACE_HEADER *ace;
337 ACE_HEADER *label_ace;
338 unsigned int i, count = 0;
339 ACL *label_acl;
340
341 ace = (const ACE_HEADER *)(sacl + 1);
342 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
343 {
344 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
345 {
346 size += ace->AceSize;
347 count++;
348 }
349 }
350
351 label_acl = mem_alloc( size );
352 if (!label_acl) return NULL;
353
354 label_acl->AclRevision = sacl->AclRevision;
355 label_acl->Sbz1 = 0;
356 label_acl->AclSize = size;
357 label_acl->AceCount = count;
358 label_acl->Sbz2 = 0;
359 label_ace = (ACE_HEADER *)(label_acl + 1);
360
361 ace = (const ACE_HEADER *)(sacl + 1);
362 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
363 {
364 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
365 {
366 memcpy( label_ace, ace, ace->AceSize );
367 label_ace = (ACE_HEADER *)ace_next( label_ace );
368 }
369 }
370 return label_acl;
371 }
372
373 /* replace security labels in an existing SACL */
374 ACL *replace_security_labels( const ACL *old_sacl, const ACL *new_sacl )
375 {
376 const ACE_HEADER *ace;
377 ACE_HEADER *replaced_ace;
378 size_t size = sizeof(ACL);
379 unsigned int i, count = 0;
380 BYTE revision = ACL_REVISION;
381 ACL *replaced_acl;
382
383 if (old_sacl)
384 {
385 revision = max( revision, old_sacl->AclRevision );
386 ace = (const ACE_HEADER *)(old_sacl + 1);
387 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
388 {
389 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
390 size += ace->AceSize;
391 count++;
392 }
393 }
394
395 if (new_sacl)
396 {
397 revision = max( revision, new_sacl->AclRevision );
398 ace = (const ACE_HEADER *)(new_sacl + 1);
399 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
400 {
401 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
402 size += ace->AceSize;
403 count++;
404 }
405 }
406
407 replaced_acl = mem_alloc( size );
408 if (!replaced_acl) return NULL;
409
410 replaced_acl->AclRevision = revision;
411 replaced_acl->Sbz1 = 0;
412 replaced_acl->AclSize = size;
413 replaced_acl->AceCount = count;
414 replaced_acl->Sbz2 = 0;
415 replaced_ace = (ACE_HEADER *)(replaced_acl + 1);
416
417 if (old_sacl)
418 {
419 ace = (const ACE_HEADER *)(old_sacl + 1);
420 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
421 {
422 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
423 memcpy( replaced_ace, ace, ace->AceSize );
424 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
425 }
426 }
427
428 if (new_sacl)
429 {
430 ace = (const ACE_HEADER *)(new_sacl + 1);
431 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
432 {
433 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
434 memcpy( replaced_ace, ace, ace->AceSize );
435 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
436 }
437 }
438
439 return replaced_acl;
440 }
441
442 /* maps from generic rights to specific rights as given by a mapping */
443 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
444 {
445 if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
446 if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
447 if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
448 if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
449 *mask &= 0x0FFFFFFF;
450 }
451
452 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
453 {
454 return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
455 }
456
457 static inline void allocate_luid( luid_t *luid )
458 {
459 prev_luid_value.low_part++;
460 *luid = prev_luid_value;
461 }
462
463 DECL_HANDLER( allocate_locally_unique_id )
464 {
465 allocate_luid( &reply->luid );
466 }
467
468 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
469 {
470 out->Luid = in->luid;
471 out->Attributes =
472 (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
473 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
474 }
475
476 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
477 {
478 struct privilege *privilege = mem_alloc( sizeof(*privilege) );
479 if (privilege)
480 {
481 privilege->luid = *luid;
482 privilege->def = privilege->enabled = (enabled != 0);
483 list_add_tail( &token->privileges, &privilege->entry );
484 }
485 return privilege;
486 }
487
488 static inline void privilege_remove( struct privilege *privilege )
489 {
490 list_remove( &privilege->entry );
491 free( privilege );
492 }
493
494 static void token_destroy( struct object *obj )
495 {
496 struct token* token;
497 struct list *cursor, *cursor_next;
498
499 assert( obj->ops == &token_ops );
500 token = (struct token *)obj;
501
502 free( token->user );
503
504 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
505 {
506 struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
507 privilege_remove( privilege );
508 }
509
510 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
511 {
512 struct group *group = LIST_ENTRY( cursor, struct group, entry );
513 list_remove( &group->entry );
514 free( group );
515 }
516
517 free( token->default_dacl );
518 }
519
520 /* creates a new token.
521 * groups may be NULL if group_count is 0.
522 * privs may be NULL if priv_count is 0.
523 * default_dacl may be NULL, indicating that all objects created by the user
524 * are unsecured.
525 * modified_id may be NULL, indicating that a new modified_id luid should be
526 * allocated.
527 */
528 static struct token *create_token( unsigned primary, const SID *user,
529 const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
530 const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
531 const ACL *default_dacl, TOKEN_SOURCE source,
532 const luid_t *modified_id,
533 int impersonation_level )
534 {
535 struct token *token = alloc_object( &token_ops );
536 if (token)
537 {
538 unsigned int i;
539
540 allocate_luid( &token->token_id );
541 if (modified_id)
542 token->modified_id = *modified_id;
543 else
544 allocate_luid( &token->modified_id );
545 list_init( &token->privileges );
546 list_init( &token->groups );
547 token->primary = primary;
548 /* primary tokens don't have impersonation levels */
549 if (primary)
550 token->impersonation_level = -1;
551 else
552 token->impersonation_level = impersonation_level;
553 token->default_dacl = NULL;
554 token->primary_group = NULL;
555
556 /* copy user */
557 token->user = memdup( user, security_sid_len( user ));
558 if (!token->user)
559 {
560 release_object( token );
561 return NULL;
562 }
563
564 /* copy groups */
565 for (i = 0; i < group_count; i++)
566 {
567 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
568 struct group *group = mem_alloc( size );
569
570 if (!group)
571 {
572 release_object( token );
573 return NULL;
574 }
575 memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
576 group->enabled = TRUE;
577 group->def = TRUE;
578 group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
579 group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
580 group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
581 group->resource = FALSE;
582 group->deny_only = FALSE;
583 list_add_tail( &token->groups, &group->entry );
584 /* Use first owner capable group as an owner */
585 if (!token->primary_group && group->owner)
586 token->primary_group = &group->sid;
587 }
588
589 /* copy privileges */
590 for (i = 0; i < priv_count; i++)
591 {
592 /* note: we don't check uniqueness: the caller must make sure
593 * privs doesn't contain any duplicate luids */
594 if (!privilege_add( token, &privs[i].Luid,
595 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
596 {
597 release_object( token );
598 return NULL;
599 }
600 }
601
602 if (default_dacl)
603 {
604 token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
605 if (!token->default_dacl)
606 {
607 release_object( token );
608 return NULL;
609 }
610 }
611
612 token->source = source;
613 }
614 return token;
615 }
616
617 struct token *token_duplicate( struct token *src_token, unsigned primary,
618 int impersonation_level, const struct security_descriptor *sd )
619 {
620 const luid_t *modified_id =
621 primary || (impersonation_level == src_token->impersonation_level) ?
622 &src_token->modified_id : NULL;
623 struct token *token = NULL;
624 struct privilege *privilege;
625 struct group *group;
626
627 if (!primary &&
628 (impersonation_level < SecurityAnonymous ||
629 impersonation_level > SecurityDelegation ||
630 (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
631 {
632 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
633 return NULL;
634 }
635
636 token = create_token( primary, src_token->user, NULL, 0,
637 NULL, 0, src_token->default_dacl,
638 src_token->source, modified_id,
639 impersonation_level );
640 if (!token) return token;
641
642 /* copy groups */
643 token->primary_group = NULL;
644 LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
645 {
646 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
647 struct group *newgroup = mem_alloc( size );
648 if (!newgroup)
649 {
650 release_object( token );
651 return NULL;
652 }
653 memcpy( newgroup, group, size );
654 list_add_tail( &token->groups, &newgroup->entry );
655 if (src_token->primary_group == &group->sid)
656 token->primary_group = &newgroup->sid;
657 }
658 assert( token->primary_group );
659
660 /* copy privileges */
661 LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
662 if (!privilege_add( token, &privilege->luid, privilege->enabled ))
663 {
664 release_object( token );
665 return NULL;
666 }
667
668 if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
669 DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
670
671 return token;
672 }
673
674 static ACL *create_default_dacl( const SID *user )
675 {
676 ACCESS_ALLOWED_ACE *aaa;
677 ACL *default_dacl;
678 SID *sid;
679 size_t default_dacl_size = sizeof(ACL) +
680 2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
681 sizeof(local_system_sid) +
682 security_sid_len( user );
683
684 default_dacl = mem_alloc( default_dacl_size );
685 if (!default_dacl) return NULL;
686
687 default_dacl->AclRevision = ACL_REVISION;
688 default_dacl->Sbz1 = 0;
689 default_dacl->AclSize = default_dacl_size;
690 default_dacl->AceCount = 2;
691 default_dacl->Sbz2 = 0;
692
693 /* GENERIC_ALL for Local System */
694 aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
695 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
696 aaa->Header.AceFlags = 0;
697 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
698 sizeof(local_system_sid);
699 aaa->Mask = GENERIC_ALL;
700 sid = (SID *)&aaa->SidStart;
701 memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
702
703 /* GENERIC_ALL for specified user */
704 aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
705 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
706 aaa->Header.AceFlags = 0;
707 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
708 aaa->Mask = GENERIC_ALL;
709 sid = (SID *)&aaa->SidStart;
710 memcpy( sid, user, security_sid_len( user ));
711
712 return default_dacl;
713 }
714
715 struct sid_data
716 {
717 SID_IDENTIFIER_AUTHORITY idauth;
718 int count;
719 unsigned int subauth[MAX_SUBAUTH_COUNT];
720 };
721
722 static struct security_descriptor *create_security_label_sd( struct token *token, PSID label_sid )
723 {
724 size_t sid_len = security_sid_len( label_sid ), sacl_size, sd_size;
725 SYSTEM_MANDATORY_LABEL_ACE *smla;
726 struct security_descriptor *sd;
727 ACL *sacl;
728
729 sacl_size = sizeof(ACL) + FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
730 sd_size = sizeof(struct security_descriptor) + sacl_size;
731 if (!(sd = mem_alloc( sd_size )))
732 return NULL;
733
734 sd->control = SE_SACL_PRESENT;
735 sd->owner_len = 0;
736 sd->group_len = 0;
737 sd->sacl_len = sacl_size;
738 sd->dacl_len = 0;
739
740 sacl = (ACL *)(sd + 1);
741 sacl->AclRevision = ACL_REVISION;
742 sacl->Sbz1 = 0;
743 sacl->AclSize = sacl_size;
744 sacl->AceCount = 1;
745 sacl->Sbz2 = 0;
746
747 smla = (SYSTEM_MANDATORY_LABEL_ACE *)(sacl + 1);
748 smla->Header.AceType = SYSTEM_MANDATORY_LABEL_ACE_TYPE;
749 smla->Header.AceFlags = 0;
750 smla->Header.AceSize = FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
751 smla->Mask = SYSTEM_MANDATORY_LABEL_NO_WRITE_UP;
752 memcpy( &smla->SidStart, label_sid, sid_len );
753
754 assert( sd_is_valid( sd, sd_size ) );
755 return sd;
756 }
757
758 int token_assign_label( struct token *token, PSID label )
759 {
760 struct security_descriptor *sd;
761 int ret = 0;
762
763 if ((sd = create_security_label_sd( token, label )))
764 {
765 ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
766 free( sd );
767 }
768
769 return ret;
770 }
771
772 struct token *token_create_admin( void )
773 {
774 struct token *token = NULL;
775 static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
776 static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
777 static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
778 /* on Windows, this value changes every time the user logs on */
779 static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
780 PSID alias_admins_sid;
781 PSID alias_users_sid;
782 PSID logon_sid;
783 const SID *user_sid = security_unix_uid_to_sid( getuid() );
784 ACL *default_dacl = create_default_dacl( user_sid );
785
786 alias_admins_sid = security_sid_alloc( &nt_authority, sizeof(alias_admins_subauth)/sizeof(alias_admins_subauth[0]),
787 alias_admins_subauth );
788 alias_users_sid = security_sid_alloc( &nt_authority, sizeof(alias_users_subauth)/sizeof(alias_users_subauth[0]),
789 alias_users_subauth );
790 logon_sid = security_sid_alloc( &nt_authority, sizeof(logon_subauth)/sizeof(logon_subauth[0]),
791 logon_subauth );
792
793 if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
794 {
795 const LUID_AND_ATTRIBUTES admin_privs[] =
796 {
797 { SeChangeNotifyPrivilege , SE_PRIVILEGE_ENABLED },
798 { SeSecurityPrivilege , 0 },
799 { SeBackupPrivilege , 0 },
800 { SeRestorePrivilege , 0 },
801 { SeSystemtimePrivilege , 0 },
802 { SeShutdownPrivilege , 0 },
803 { SeRemoteShutdownPrivilege , 0 },
804 { SeTakeOwnershipPrivilege , 0 },
805 { SeDebugPrivilege , 0 },
806 { SeSystemEnvironmentPrivilege , 0 },
807 { SeSystemProfilePrivilege , 0 },
808 { SeProfileSingleProcessPrivilege, 0 },
809 { SeIncreaseBasePriorityPrivilege, 0 },
810 { SeLoadDriverPrivilege , SE_PRIVILEGE_ENABLED },
811 { SeCreatePagefilePrivilege , 0 },
812 { SeIncreaseQuotaPrivilege , 0 },
813 { SeUndockPrivilege , 0 },
814 { SeManageVolumePrivilege , 0 },
815 { SeImpersonatePrivilege , SE_PRIVILEGE_ENABLED },
816 { SeCreateGlobalPrivilege , SE_PRIVILEGE_ENABLED },
817 };
818 /* note: we don't include non-builtin groups here for the user -
819 * telling us these is the job of a client-side program */
820 const SID_AND_ATTRIBUTES admin_groups[] =
821 {
822 { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
823 { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
824 { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
825 { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
826 { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
827 { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
828 { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
829 };
830 static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
831 token = create_token( TRUE, user_sid, admin_groups, sizeof(admin_groups)/sizeof(admin_groups[0]),
832 admin_privs, sizeof(admin_privs)/sizeof(admin_privs[0]), default_dacl,
833 admin_source, NULL, -1 );
834 /* we really need a primary group */
835 assert( token->primary_group );
836 }
837
838 free( logon_sid );
839 free( alias_admins_sid );
840 free( alias_users_sid );
841 free( default_dacl );
842
843 return token;
844 }
845
846 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
847 {
848 struct privilege *privilege;
849 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
850 {
851 if (is_equal_luid( luid, &privilege->luid ))
852 {
853 if (enabled_only && !privilege->enabled)
854 return NULL;
855 return privilege;
856 }
857 }
858 return NULL;
859 }
860
861 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
862 unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
863 unsigned int mod_privs_count )
864 {
865 unsigned int i, modified_count = 0;
866
867 /* mark as modified */
868 allocate_luid( &token->modified_id );
869
870 for (i = 0; i < count; i++)
871 {
872 struct privilege *privilege =
873 token_find_privilege( token, &privs[i].Luid, FALSE );
874 if (!privilege)
875 {
876 set_error( STATUS_NOT_ALL_ASSIGNED );
877 continue;
878 }
879
880 if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
881 privilege_remove( privilege );
882 else
883 {
884 /* save previous state for caller */
885 if (mod_privs_count)
886 {
887 luid_and_attr_from_privilege(mod_privs, privilege);
888 mod_privs++;
889 mod_privs_count--;
890 modified_count++;
891 }
892
893 if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
894 privilege->enabled = TRUE;
895 else
896 privilege->enabled = FALSE;
897 }
898 }
899 return modified_count;
900 }
901
902 static void token_disable_privileges( struct token *token )
903 {
904 struct privilege *privilege;
905
906 /* mark as modified */
907 allocate_luid( &token->modified_id );
908
909 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
910 privilege->enabled = FALSE;
911 }
912
913 int token_check_privileges( struct token *token, int all_required,
914 const LUID_AND_ATTRIBUTES *reqprivs,
915 unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
916 {
917 unsigned int i, enabled_count = 0;
918
919 for (i = 0; i < count; i++)
920 {
921 struct privilege *privilege =
922 token_find_privilege( token, &reqprivs[i].Luid, TRUE );
923
924 if (usedprivs)
925 usedprivs[i] = reqprivs[i];
926
927 if (privilege && privilege->enabled)
928 {
929 enabled_count++;
930 if (usedprivs)
931 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
932 }
933 }
934
935 if (all_required)
936 return (enabled_count == count);
937 else
938 return (enabled_count > 0);
939 }
940
941 int token_sid_present( struct token *token, const SID *sid, int deny )
942 {
943 struct group *group;
944
945 if (security_equal_sid( token->user, sid )) return TRUE;
946
947 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
948 {
949 if (!group->enabled) continue;
950 if (group->deny_only && !deny) continue;
951
952 if (security_equal_sid( &group->sid, sid )) return TRUE;
953 }
954
955 return FALSE;
956 }
957
958 /* Checks access to a security descriptor. 'sd' must have been validated by
959 * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
960 * the reason. 'status' parameter will indicate if access is granted or denied.
961 *
962 * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
963 */
964 static unsigned int token_access_check( struct token *token,
965 const struct security_descriptor *sd,
966 unsigned int desired_access,
967 LUID_AND_ATTRIBUTES *privs,
968 unsigned int *priv_count,
969 const GENERIC_MAPPING *mapping,
970 unsigned int *granted_access,
971 unsigned int *status )
972 {
973 unsigned int current_access = 0;
974 unsigned int denied_access = 0;
975 ULONG i;
976 const ACL *dacl;
977 int dacl_present;
978 const ACE_HEADER *ace;
979 const SID *owner;
980
981 /* assume no access rights */
982 *granted_access = 0;
983
984 /* fail if desired_access contains generic rights */
985 if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
986 {
987 if (priv_count) *priv_count = 0;
988 return STATUS_GENERIC_NOT_MAPPED;
989 }
990
991 dacl = sd_get_dacl( sd, &dacl_present );
992 owner = sd_get_owner( sd );
993 if (!owner || !sd_get_group( sd ))
994 {
995 if (priv_count) *priv_count = 0;
996 return STATUS_INVALID_SECURITY_DESCR;
997 }
998
999 /* 1: Grant desired access if the object is unprotected */
1000 if (!dacl_present || !dacl)
1001 {
1002 if (priv_count) *priv_count = 0;
1003 if (desired_access & MAXIMUM_ALLOWED)
1004 *granted_access = mapping->GenericAll;
1005 else
1006 *granted_access = desired_access;
1007 return *status = STATUS_SUCCESS;
1008 }
1009
1010 /* 2: Check if caller wants access to system security part. Note: access
1011 * is only granted if specifically asked for */
1012 if (desired_access & ACCESS_SYSTEM_SECURITY)
1013 {
1014 const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
1015 LUID_AND_ATTRIBUTES retpriv = security_priv;
1016 if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
1017 {
1018 if (priv_count)
1019 {
1020 /* assumes that there will only be one privilege to return */
1021 if (*priv_count >= 1)
1022 {
1023 *priv_count = 1;
1024 *privs = retpriv;
1025 }
1026 else
1027 {
1028 *priv_count = 1;
1029 return STATUS_BUFFER_TOO_SMALL;
1030 }
1031 }
1032 current_access |= ACCESS_SYSTEM_SECURITY;
1033 if (desired_access == current_access)
1034 {
1035 *granted_access = current_access;
1036 return *status = STATUS_SUCCESS;
1037 }
1038 }
1039 else
1040 {
1041 if (priv_count) *priv_count = 0;
1042 *status = STATUS_PRIVILEGE_NOT_HELD;
1043 return STATUS_SUCCESS;
1044 }
1045 }
1046 else if (priv_count) *priv_count = 0;
1047
1048 /* 3: Check whether the token is the owner */
1049 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
1050 * checked when a "set owner" call is made, overriding the access rights
1051 * determined here. */
1052 if (token_sid_present( token, owner, FALSE ))
1053 {
1054 current_access |= (READ_CONTROL | WRITE_DAC);
1055 if (desired_access == current_access)
1056 {
1057 *granted_access = current_access;
1058 return *status = STATUS_SUCCESS;
1059 }
1060 }
1061
1062 /* 4: Grant rights according to the DACL */
1063 ace = (const ACE_HEADER *)(dacl + 1);
1064 for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
1065 {
1066 const ACCESS_ALLOWED_ACE *aa_ace;
1067 const ACCESS_DENIED_ACE *ad_ace;
1068 const SID *sid;
1069
1070 if (ace->AceFlags & INHERIT_ONLY_ACE)
1071 continue;
1072
1073 switch (ace->AceType)
1074 {
1075 case ACCESS_DENIED_ACE_TYPE:
1076 ad_ace = (const ACCESS_DENIED_ACE *)ace;
1077 sid = (const SID *)&ad_ace->SidStart;
1078 if (token_sid_present( token, sid, TRUE ))
1079 {
1080 unsigned int access = ad_ace->Mask;
1081 map_generic_mask(&access, mapping);
1082 if (desired_access & MAXIMUM_ALLOWED)
1083 denied_access |= access;
1084 else
1085 {
1086 denied_access |= (access & ~current_access);
1087 if (desired_access & access) goto done;
1088 }
1089 }
1090 break;
1091 case ACCESS_ALLOWED_ACE_TYPE:
1092 aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
1093 sid = (const SID *)&aa_ace->SidStart;
1094 if (token_sid_present( token, sid, FALSE ))
1095 {
1096 unsigned int access = aa_ace->Mask;
1097 map_generic_mask(&access, mapping);
1098 if (desired_access & MAXIMUM_ALLOWED)
1099 current_access |= access;
1100 else
1101 current_access |= (access & ~denied_access);
1102 }
1103 break;
1104 }
1105
1106 /* don't bother carrying on checking if we've already got all of
1107 * rights we need */
1108 if (desired_access == *granted_access)
1109 break;
1110 }
1111
1112 done:
1113 if (desired_access & MAXIMUM_ALLOWED)
1114 *granted_access = current_access & ~denied_access;
1115 else
1116 if ((current_access & desired_access) == desired_access)
1117 *granted_access = current_access & desired_access;
1118 else
1119 *granted_access = 0;
1120
1121 *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1122 return STATUS_SUCCESS;
1123 }
1124
1125 const ACL *token_get_default_dacl( struct token *token )
1126 {
1127 return token->default_dacl;
1128 }
1129
1130 const SID *token_get_user( struct token *token )
1131 {
1132 return token->user;
1133 }
1134
1135 const SID *token_get_primary_group( struct token *token )
1136 {
1137 return token->primary_group;
1138 }
1139
1140 int check_object_access(struct object *obj, unsigned int *access)
1141 {
1142 GENERIC_MAPPING mapping;
1143 struct token *token = current->token ? current->token : current->process->token;
1144 unsigned int status;
1145 int res;
1146
1147 mapping.GenericAll = obj->ops->map_access( obj, GENERIC_ALL );
1148
1149 if (!obj->sd)
1150 {
1151 if (*access & MAXIMUM_ALLOWED)
1152 *access = mapping.GenericAll;
1153 return TRUE;
1154 }
1155
1156 mapping.GenericRead = obj->ops->map_access( obj, GENERIC_READ );
1157 mapping.GenericWrite = obj->ops->map_access( obj, GENERIC_WRITE );
1158 mapping.GenericExecute = obj->ops->map_access( obj, GENERIC_EXECUTE );
1159
1160 res = token_access_check( token, obj->sd, *access, NULL, NULL,
1161 &mapping, access, &status ) == STATUS_SUCCESS &&
1162 status == STATUS_SUCCESS;
1163
1164 if (!res) set_error( STATUS_ACCESS_DENIED );
1165 return res;
1166 }
1167
1168
1169 /* open a security token */
1170 DECL_HANDLER(open_token)
1171 {
1172 if (req->flags & OPEN_TOKEN_THREAD)
1173 {
1174 struct thread *thread = get_thread_from_handle( req->handle, 0 );
1175 if (thread)
1176 {
1177 if (thread->token)
1178 {
1179 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1180 set_error( STATUS_CANT_OPEN_ANONYMOUS );
1181 else
1182 reply->token = alloc_handle( current->process, thread->token,
1183 req->access, req->attributes );
1184 }
1185 else
1186 set_error( STATUS_NO_TOKEN );
1187 release_object( thread );
1188 }
1189 }
1190 else
1191 {
1192 struct process *process = get_process_from_handle( req->handle, 0 );
1193 if (process)
1194 {
1195 if (process->token)
1196 reply->token = alloc_handle( current->process, process->token, req->access,
1197 req->attributes );
1198 else
1199 set_error( STATUS_NO_TOKEN );
1200 release_object( process );
1201 }
1202 }
1203 }
1204
1205 /* adjust the privileges held by a token */
1206 DECL_HANDLER(adjust_token_privileges)
1207 {
1208 struct token *token;
1209 unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1210
1211 if (req->get_modified_state) access |= TOKEN_QUERY;
1212
1213 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1214 access, &token_ops )))
1215 {
1216 const LUID_AND_ATTRIBUTES *privs = get_req_data();
1217 LUID_AND_ATTRIBUTES *modified_privs = NULL;
1218 unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1219 unsigned int modified_priv_count = 0;
1220
1221 if (req->get_modified_state && !req->disable_all)
1222 {
1223 unsigned int i;
1224 /* count modified privs */
1225 for (i = 0; i < priv_count; i++)
1226 {
1227 struct privilege *privilege =
1228 token_find_privilege( token, &privs[i].Luid, FALSE );
1229 if (privilege && req->get_modified_state)
1230 modified_priv_count++;
1231 }
1232 reply->len = modified_priv_count;
1233 modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1234 if (modified_priv_count)
1235 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1236 }
1237 reply->len = modified_priv_count * sizeof(*modified_privs);
1238
1239 if (req->disable_all)
1240 token_disable_privileges( token );
1241 else
1242 token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
1243
1244 release_object( token );
1245 }
1246 }
1247
1248 /* retrieves the list of privileges that may be held be the token */
1249 DECL_HANDLER(get_token_privileges)
1250 {
1251 struct token *token;
1252
1253 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1254 TOKEN_QUERY,
1255 &token_ops )))
1256 {
1257 int priv_count = 0;
1258 LUID_AND_ATTRIBUTES *privs;
1259 struct privilege *privilege;
1260
1261 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1262 priv_count++;
1263
1264 reply->len = priv_count * sizeof(*privs);
1265 if (reply->len <= get_reply_max_size())
1266 {
1267 privs = set_reply_data_size( priv_count * sizeof(*privs) );
1268 if (privs)
1269 {
1270 int i = 0;
1271 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1272 {
1273 luid_and_attr_from_privilege( &privs[i], privilege );
1274 i++;
1275 }
1276 }
1277 }
1278 else
1279 set_error(STATUS_BUFFER_TOO_SMALL);
1280
1281 release_object( token );
1282 }
1283 }
1284
1285 /* creates a duplicate of the token */
1286 DECL_HANDLER(duplicate_token)
1287 {
1288 struct token *src_token;
1289 struct unicode_str name;
1290 const struct security_descriptor *sd;
1291 const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
1292
1293 if (!objattr) return;
1294
1295 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1296 TOKEN_DUPLICATE,
1297 &token_ops )))
1298 {
1299 struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd );
1300 if (token)
1301 {
1302 reply->new_handle = alloc_handle_no_access_check( current->process, token, req->access, objattr->attributes );
1303 release_object( token );
1304 }
1305 release_object( src_token );
1306 }
1307 }
1308
1309 /* checks the specified privileges are held by the token */
1310 DECL_HANDLER(check_token_privileges)
1311 {
1312 struct token *token;
1313
1314 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1315 TOKEN_QUERY,
1316 &token_ops )))
1317 {
1318 unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1319
1320 if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1321 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1322 else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1323 {
1324 LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1325 reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1326 }
1327 else
1328 set_error( STATUS_BUFFER_OVERFLOW );
1329 release_object( token );
1330 }
1331 }
1332
1333 /* checks that a user represented by a token is allowed to access an object
1334 * represented by a security descriptor */
1335 DECL_HANDLER(access_check)
1336 {
1337 data_size_t sd_size = get_req_data_size();
1338 const struct security_descriptor *sd = get_req_data();
1339 struct token *token;
1340
1341 if (!sd_is_valid( sd, sd_size ))
1342 {
1343 set_error( STATUS_ACCESS_VIOLATION );
1344 return;
1345 }
1346
1347 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1348 TOKEN_QUERY,
1349 &token_ops )))
1350 {
1351 GENERIC_MAPPING mapping;
1352 unsigned int status;
1353 LUID_AND_ATTRIBUTES priv;
1354 unsigned int priv_count = 1;
1355
1356 memset(&priv, 0, sizeof(priv));
1357
1358 /* only impersonation tokens may be used with this function */
1359 if (token->primary)
1360 {
1361 set_error( STATUS_NO_IMPERSONATION_TOKEN );
1362 release_object( token );
1363 return;
1364 }
1365 /* anonymous impersonation tokens can't be used */
1366 if (token->impersonation_level <= SecurityAnonymous)
1367 {
1368 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1369 release_object( token );
1370 return;
1371 }
1372
1373 mapping.GenericRead = req->mapping_read;
1374 mapping.GenericWrite = req->mapping_write;
1375 mapping.GenericExecute = req->mapping_execute;
1376 mapping.GenericAll = req->mapping_all;
1377
1378 status = token_access_check(
1379 token, sd, req->desired_access, &priv, &priv_count, &mapping,
1380 &reply->access_granted, &reply->access_status );
1381
1382 reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1383
1384 if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1385 {
1386 LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1387 memcpy( privs, &priv, sizeof(priv) );
1388 }
1389
1390 set_error( status );
1391 release_object( token );
1392 }
1393 }
1394
1395 /* retrieves the SID of the user that the token represents */
1396 DECL_HANDLER(get_token_sid)
1397 {
1398 struct token *token;
1399
1400 reply->sid_len = 0;
1401
1402 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1403 TOKEN_QUERY,
1404 &token_ops )))
1405 {
1406 const SID *sid = NULL;
1407
1408 switch (req->which_sid)
1409 {
1410 case TokenUser:
1411 assert(token->user);
1412 sid = token->user;
1413 break;
1414 case TokenPrimaryGroup:
1415 sid = token->primary_group;
1416 break;
1417 case TokenOwner:
1418 {
1419 struct group *group;
1420 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
1421 {
1422 if (group->owner)
1423 {
1424 sid = &group->sid;
1425 break;
1426 }
1427 }
1428 break;
1429 }
1430 case TokenLogonSid:
1431 sid = (const SID *)&builtin_logon_sid;
1432 break;
1433 default:
1434 set_error( STATUS_INVALID_PARAMETER );
1435 break;
1436 }
1437
1438 if (sid)
1439 {
1440 reply->sid_len = security_sid_len( sid );
1441 if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1442 else set_error( STATUS_BUFFER_TOO_SMALL );
1443 }
1444 release_object( token );
1445 }
1446 }
1447
1448 /* retrieves the groups that the user represented by the token belongs to */
1449 DECL_HANDLER(get_token_groups)
1450 {
1451 struct token *token;
1452
1453 reply->user_len = 0;
1454
1455 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1456 TOKEN_QUERY,
1457 &token_ops )))
1458 {
1459 size_t size_needed = sizeof(struct token_groups);
1460 size_t sid_size = 0;
1461 unsigned int group_count = 0;
1462 const struct group *group;
1463
1464 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1465 {
1466 group_count++;
1467 sid_size += security_sid_len( &group->sid );
1468 }
1469 size_needed += sid_size;
1470 /* attributes size */
1471 size_needed += sizeof(unsigned int) * group_count;
1472
1473 /* reply buffer contains size_needed bytes formatted as:
1474
1475 unsigned int count;
1476 unsigned int attrib[count];
1477 char sid_data[];
1478
1479 user_len includes extra data needed for TOKEN_GROUPS representation,
1480 required caller buffer size calculated here to avoid extra server call */
1481 reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1482
1483 if (reply->user_len <= get_reply_max_size())
1484 {
1485 struct token_groups *tg = set_reply_data_size( size_needed );
1486 if (tg)
1487 {
1488 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1489 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1490
1491 tg->count = group_count;
1492
1493 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1494 {
1495
1496 *attr_ptr = 0;
1497 if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1498 if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1499 if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1500 if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1501 if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1502 if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1503 if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1504
1505 memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1506
1507 sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1508 attr_ptr++;
1509 }
1510 }
1511 }
1512 else set_error( STATUS_BUFFER_TOO_SMALL );
1513
1514 release_object( token );
1515 }
1516 }
1517
1518 DECL_HANDLER(get_token_impersonation_level)
1519 {
1520 struct token *token;
1521
1522 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1523 TOKEN_QUERY,
1524 &token_ops )))
1525 {
1526 if (token->primary)
1527 set_error( STATUS_INVALID_PARAMETER );
1528 else
1529 reply->impersonation_level = token->impersonation_level;
1530
1531 release_object( token );
1532 }
1533 }
1534
1535 DECL_HANDLER(get_token_statistics)
1536 {
1537 struct token *token;
1538
1539 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1540 TOKEN_QUERY,
1541 &token_ops )))
1542 {
1543 reply->token_id = token->token_id;
1544 reply->modified_id = token->modified_id;
1545 reply->primary = token->primary;
1546 reply->impersonation_level = token->impersonation_level;
1547 reply->group_count = list_count( &token->groups );
1548 reply->privilege_count = list_count( &token->privileges );
1549
1550 release_object( token );
1551 }
1552 }
1553
1554 DECL_HANDLER(get_token_default_dacl)
1555 {
1556 struct token *token;
1557
1558 reply->acl_len = 0;
1559
1560 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1561 TOKEN_QUERY,
1562 &token_ops )))
1563 {
1564 if (token->default_dacl)
1565 reply->acl_len = token->default_dacl->AclSize;
1566
1567 if (reply->acl_len <= get_reply_max_size())
1568 {
1569 ACL *acl_reply = set_reply_data_size( reply->acl_len );
1570 if (acl_reply)
1571 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1572 }
1573 else set_error( STATUS_BUFFER_TOO_SMALL );
1574
1575 release_object( token );
1576 }
1577 }
1578
1579 DECL_HANDLER(set_token_default_dacl)
1580 {
1581 struct token *token;
1582
1583 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1584 TOKEN_ADJUST_DEFAULT,
1585 &token_ops )))
1586 {
1587 const ACL *acl = get_req_data();
1588 unsigned int acl_size = get_req_data_size();
1589
1590 free( token->default_dacl );
1591 token->default_dacl = NULL;
1592
1593 if (acl_size)
1594 token->default_dacl = memdup( acl, acl_size );
1595
1596 release_object( token );
1597 }
1598 }
Windows API implementation