dlls/advapi32/security.c

   1 /*
   2  * Copyright 1999, 2000 Juergen Schmied <juergen.schmied@debitel.net>
   3  * Copyright 2003 CodeWeavers Inc. (Ulrich Czekalla)
   4  * Copyright 2006 Robert Reif
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  */
  21
  22 #include "config.h"
  23
  24 #include <stdarg.h>
  25 #include <string.h>
  26
  27 #include "ntstatus.h"
  28 #define WIN32_NO_STATUS
  29 #include "windef.h"
  30 #include "winbase.h"
  31 #include "winerror.h"
  32 #include "winreg.h"
  33 #include "winsafer.h"
  34 #include "winternl.h"
  35 #include "winioctl.h"
  36 #include "accctrl.h"
  37 #include "sddl.h"
  38 #include "winsvc.h"
  39 #include "aclapi.h"
  40 #include "objbase.h"
  41 #include "iads.h"
  42 #include "advapi32_misc.h"
  43 #include "lmcons.h"
  44
  45 #include "wine/debug.h"
  46 #include "wine/unicode.h"
  47
  48 WINE_DEFAULT_DEBUG_CHANNEL(advapi);
  49
  50 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes);
  51
  52 typedef struct _ACEFLAG
  53 {
  54    LPCWSTR wstr;
  55    DWORD value;
  56 } ACEFLAG, *LPACEFLAG;
  57
  58 typedef struct _MAX_SID
  59 {
  60     /* same fields as struct _SID */
  61     BYTE Revision;
  62     BYTE SubAuthorityCount;
  63     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  64     DWORD SubAuthority[SID_MAX_SUB_AUTHORITIES];
  65 } MAX_SID;
  66
  67 typedef struct WELLKNOWNSID
  68 {
  69     WCHAR wstr[2];
  70     WELL_KNOWN_SID_TYPE Type;
  71     MAX_SID Sid;
  72 } WELLKNOWNSID;
  73
  74 static const WELLKNOWNSID WellKnownSids[] =
  75 {
  76     { {0,0}, WinNullSid, { SID_REVISION, 1, { SECURITY_NULL_SID_AUTHORITY }, { SECURITY_NULL_RID } } },
  77     { {'W','D'}, WinWorldSid, { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } } },
  78     { {0,0}, WinLocalSid, { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } } },
  79     { {'C','O'}, WinCreatorOwnerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_RID } } },
  80     { {'C','G'}, WinCreatorGroupSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_RID } } },
  81     { {0,0}, WinCreatorOwnerServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_SERVER_RID } } },
  82     { {0,0}, WinCreatorGroupServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_SERVER_RID } } },
  83     { {0,0}, WinNtAuthoritySid, { SID_REVISION, 0, { SECURITY_NT_AUTHORITY }, { SECURITY_NULL_RID } } },
  84     { {0,0}, WinDialupSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_DIALUP_RID } } },
  85     { {'N','U'}, WinNetworkSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_RID } } },
  86     { {0,0}, WinBatchSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BATCH_RID } } },
  87     { {'I','U'}, WinInteractiveSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } } },
  88     { {'S','U'}, WinServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_SERVICE_RID } } },
  89     { {'A','N'}, WinAnonymousSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } } },
  90     { {0,0}, WinProxySid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PROXY_RID } } },
  91     { {'E','D'}, WinEnterpriseControllersSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ENTERPRISE_CONTROLLERS_RID } } },
  92     { {'P','S'}, WinSelfSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PRINCIPAL_SELF_RID } } },
  93     { {'A','U'}, WinAuthenticatedUserSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } } },
  94     { {'R','C'}, WinRestrictedCodeSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_RESTRICTED_CODE_RID } } },
  95     { {0,0}, WinTerminalServerSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_TERMINAL_SERVER_RID } } },
  96     { {0,0}, WinRemoteLogonIdSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_REMOTE_LOGON_RID } } },
  97     { {0,0}, WinLogonIdsSid, { SID_REVISION, SECURITY_LOGON_IDS_RID_COUNT, { SECURITY_NT_AUTHORITY }, { SECURITY_LOGON_IDS_RID } } },
  98     { {'S','Y'}, WinLocalSystemSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } } },
  99     { {'L','S'}, WinLocalServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SERVICE_RID } } },
 100     { {'N','S'}, WinNetworkServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_SERVICE_RID } } },
 101     { {0,0}, WinBuiltinDomainSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID } } },
 102     { {'B','A'}, WinBuiltinAdministratorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } } },
 103     { {'B','U'}, WinBuiltinUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } } },
 104     { {'B','G'}, WinBuiltinGuestsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_GUESTS } } },
 105     { {'P','U'}, WinBuiltinPowerUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_POWER_USERS } } },
 106     { {'A','O'}, WinBuiltinAccountOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ACCOUNT_OPS } } },
 107     { {'S','O'}, WinBuiltinSystemOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_SYSTEM_OPS } } },
 108     { {'P','O'}, WinBuiltinPrintOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PRINT_OPS } } },
 109     { {'B','O'}, WinBuiltinBackupOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_BACKUP_OPS } } },
 110     { {'R','E'}, WinBuiltinReplicatorSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REPLICATOR } } },
 111     { {'R','U'}, WinBuiltinPreWindows2000CompatibleAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PREW2KCOMPACCESS } } },
 112     { {'R','D'}, WinBuiltinRemoteDesktopUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS } } },
 113     { {'N','O'}, WinBuiltinNetworkConfigurationOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS } } },
 114     { {0,0}, WinNTLMAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_NTLM_RID } } },
 115     { {0,0}, WinDigestAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_DIGEST_RID } } },
 116     { {0,0}, WinSChannelAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_SCHANNEL_RID } } },
 117     { {0,0}, WinThisOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_THIS_ORGANIZATION_RID } } },
 118     { {0,0}, WinOtherOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_OTHER_ORGANIZATION_RID } } },
 119     { {0,0}, WinBuiltinIncomingForestTrustBuildersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS  } } },
 120     { {0,0}, WinBuiltinPerfMonitoringUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_MONITORING_USERS } } },
 121     { {0,0}, WinBuiltinPerfLoggingUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_LOGGING_USERS } } },
 122     { {0,0}, WinBuiltinAuthorizationAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS } } },
 123     { {0,0}, WinBuiltinTerminalServerLicenseServersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS } } },
 124     { {0,0}, WinBuiltinDCOMUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_DCOM_USERS } } },
 125     { {'L','W'}, WinLowLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_LOW_RID} } },
 126     { {'M','E'}, WinMediumLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_MEDIUM_RID } } },
 127     { {'H','I'}, WinHighLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_HIGH_RID } } },
 128     { {'S','I'}, WinSystemLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_SYSTEM_RID } } },
 129     { {0,0}, WinBuiltinAnyPackageSid, { SID_REVISION, 2, { SECURITY_APP_PACKAGE_AUTHORITY }, { SECURITY_APP_PACKAGE_BASE_RID, SECURITY_BUILTIN_PACKAGE_ANY_PACKAGE } } },
 130 };
 131
 132 /* these SIDs must be constructed as relative to some domain - only the RID is well-known */
 133 typedef struct WELLKNOWNRID
 134 {
 135     WCHAR wstr[2];
 136     WELL_KNOWN_SID_TYPE Type;
 137     DWORD Rid;
 138 } WELLKNOWNRID;
 139
 140 static const WELLKNOWNRID WellKnownRids[] = {
 141     { {'L','A'}, WinAccountAdministratorSid,    DOMAIN_USER_RID_ADMIN },
 142     { {'L','G'}, WinAccountGuestSid,            DOMAIN_USER_RID_GUEST },
 143     { {0,0}, WinAccountKrbtgtSid,           DOMAIN_USER_RID_KRBTGT },
 144     { {'D','A'}, WinAccountDomainAdminsSid,     DOMAIN_GROUP_RID_ADMINS },
 145     { {'D','U'}, WinAccountDomainUsersSid,      DOMAIN_GROUP_RID_USERS },
 146     { {'D','G'}, WinAccountDomainGuestsSid,     DOMAIN_GROUP_RID_GUESTS },
 147     { {'D','C'}, WinAccountComputersSid,        DOMAIN_GROUP_RID_COMPUTERS },
 148     { {'D','D'}, WinAccountControllersSid,      DOMAIN_GROUP_RID_CONTROLLERS },
 149     { {'C','A'}, WinAccountCertAdminsSid,       DOMAIN_GROUP_RID_CERT_ADMINS },
 150     { {'S','A'}, WinAccountSchemaAdminsSid,     DOMAIN_GROUP_RID_SCHEMA_ADMINS },
 151     { {'E','A'}, WinAccountEnterpriseAdminsSid, DOMAIN_GROUP_RID_ENTERPRISE_ADMINS },
 152     { {'P','A'}, WinAccountPolicyAdminsSid,     DOMAIN_GROUP_RID_POLICY_ADMINS },
 153     { {'R','S'}, WinAccountRasAndIasServersSid, DOMAIN_ALIAS_RID_RAS_SERVERS },
 154 };
 155
 156
 157 static SID const sidWorld = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY} , { SECURITY_WORLD_RID } };
 158
 159 typedef struct _AccountSid {
 160     WELL_KNOWN_SID_TYPE type;
 161     LPCWSTR account;
 162     LPCWSTR domain;
 163     SID_NAME_USE name_use;
 164     LPCWSTR alias;
 165 } AccountSid;
 166
 167 static const WCHAR Account_Operators[] = { 'A','c','c','o','u','n','t',' ','O','p','e','r','a','t','o','r','s',0 };
 168 static const WCHAR Administrator[] = {'A','d','m','i','n','i','s','t','r','a','t','o','r',0 };
 169 static const WCHAR Administrators[] = { 'A','d','m','i','n','i','s','t','r','a','t','o','r','s',0 };
 170 static const WCHAR ALL_APPLICATION_PACKAGES[] = { 'A','L','L',' ','A','P','P','L','I','C','A','T','I','O','N',' ','P','A','C','K','A','G','E','S',0 };
 171 static const WCHAR ANONYMOUS_LOGON[] = { 'A','N','O','N','Y','M','O','U','S',' ','L','O','G','O','N',0 };
 172 static const WCHAR APPLICATION_PACKAGE_AUTHORITY[] = { 'A','P','P','L','I','C','A','T','I','O','N',' ','P','A','C','K','A','G','E',' ','A','U','T','H','O','R','I','T','Y',0 };
 173 static const WCHAR Authenticated_Users[] = { 'A','u','t','h','e','n','t','i','c','a','t','e','d',' ','U','s','e','r','s',0 };
 174 static const WCHAR Backup_Operators[] = { 'B','a','c','k','u','p',' ','O','p','e','r','a','t','o','r','s',0 };
 175 static const WCHAR BATCH[] = { 'B','A','T','C','H',0 };
 176 static const WCHAR Blank[] = { 0 };
 177 static const WCHAR BUILTIN[] = { 'B','U','I','L','T','I','N',0 };
 178 static const WCHAR Cert_Publishers[] = { 'C','e','r','t',' ','P','u','b','l','i','s','h','e','r','s',0 };
 179 static const WCHAR CREATOR_GROUP[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',0 };
 180 static const WCHAR CREATOR_GROUP_SERVER[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',' ','S','E','R','V','E','R',0 };
 181 static const WCHAR CREATOR_OWNER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',0 };
 182 static const WCHAR CREATOR_OWNER_SERVER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',' ','S','E','R','V','E','R',0 };
 183 static const WCHAR CURRENT_USER[] = { 'C','U','R','R','E','N','T','_','U','S','E','R',0 };
 184 static const WCHAR DIALUP[] = { 'D','I','A','L','U','P',0 };
 185 static const WCHAR Digest_Authentication[] = { 'D','i','g','e','s','t',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 186 static const WCHAR Domain_Admins[] = { 'D','o','m','a','i','n',' ','A','d','m','i','n','s',0 };
 187 static const WCHAR Domain_Computers[] = { 'D','o','m','a','i','n',' ','C','o','m','p','u','t','e','r','s',0 };
 188 static const WCHAR Domain_Controllers[] = { 'D','o','m','a','i','n',' ','C','o','n','t','r','o','l','l','e','r','s',0 };
 189 static const WCHAR Domain_Guests[] = { 'D','o','m','a','i','n',' ','G','u','e','s','t','s',0 };
 190 static const WCHAR Domain_Users[] = { 'D','o','m','a','i','n',' ','U','s','e','r','s',0 };
 191 static const WCHAR Enterprise_Admins[] = { 'E','n','t','e','r','p','r','i','s','e',' ','A','d','m','i','n','s',0 };
 192 static const WCHAR ENTERPRISE_DOMAIN_CONTROLLERS[] = { 'E','N','T','E','R','P','R','I','S','E',' ','D','O','M','A','I','N',' ','C','O','N','T','R','O','L','L','E','R','S',0 };
 193 static const WCHAR Everyone[] = { 'E','v','e','r','y','o','n','e',0 };
 194 static const WCHAR Group_Policy_Creator_Owners[] = { 'G','r','o','u','p',' ','P','o','l','i','c','y',' ','C','r','e','a','t','o','r',' ','O','w','n','e','r','s',0 };
 195 static const WCHAR Guest[] = { 'G','u','e','s','t',0 };
 196 static const WCHAR Guests[] = { 'G','u','e','s','t','s',0 };
 197 static const WCHAR INTERACTIVE[] = { 'I','N','T','E','R','A','C','T','I','V','E',0 };
 198 static const WCHAR LOCAL[] = { 'L','O','C','A','L',0 };
 199 static const WCHAR LOCAL_SERVICE[] = { 'L','O','C','A','L',' ','S','E','R','V','I','C','E',0 };
 200 static const WCHAR LOCAL_SERVICE2[] = { 'L','O','C','A','L','S','E','R','V','I','C','E',0 };
 201 static const WCHAR NETWORK[] = { 'N','E','T','W','O','R','K',0 };
 202 static const WCHAR Network_Configuration_Operators[] = { 'N','e','t','w','o','r','k',' ','C','o','n','f','i','g','u','r','a','t','i','o','n',' ','O','p','e','r','a','t','o','r','s',0 };
 203 static const WCHAR NETWORK_SERVICE[] = { 'N','E','T','W','O','R','K',' ','S','E','R','V','I','C','E',0 };
 204 static const WCHAR NETWORK_SERVICE2[] = { 'N','E','T','W','O','R','K','S','E','R','V','I','C','E',0 };
 205 static const WCHAR NT_AUTHORITY[] = { 'N','T',' ','A','U','T','H','O','R','I','T','Y',0 };
 206 static const WCHAR NT_Pseudo_Domain[] = { 'N','T',' ','P','s','e','u','d','o',' ','D','o','m','a','i','n',0 };
 207 static const WCHAR NTML_Authentication[] = { 'N','T','M','L',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 208 static const WCHAR NULL_SID[] = { 'N','U','L','L',' ','S','I','D',0 };
 209 static const WCHAR Other_Organization[] = { 'O','t','h','e','r',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 };
 210 static const WCHAR Performance_Log_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','L','o','g',' ','U','s','e','r','s',0 };
 211 static const WCHAR Performance_Monitor_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','M','o','n','i','t','o','r',' ','U','s','e','r','s',0 };
 212 static const WCHAR Power_Users[] = { 'P','o','w','e','r',' ','U','s','e','r','s',0 };
 213 static const WCHAR Pre_Windows_2000_Compatible_Access[] = { 'P','r','e','-','W','i','n','d','o','w','s',' ','2','0','0','0',' ','C','o','m','p','a','t','i','b','l','e',' ','A','c','c','e','s','s',0 };
 214 static const WCHAR Print_Operators[] = { 'P','r','i','n','t',' ','O','p','e','r','a','t','o','r','s',0 };
 215 static const WCHAR PROXY[] = { 'P','R','O','X','Y',0 };
 216 static const WCHAR RAS_and_IAS_Servers[] = { 'R','A','S',' ','a','n','d',' ','I','A','S',' ','S','e','r','v','e','r','s',0 };
 217 static const WCHAR Remote_Desktop_Users[] = { 'R','e','m','o','t','e',' ','D','e','s','k','t','o','p',' ','U','s','e','r','s',0 };
 218 static const WCHAR REMOTE_INTERACTIVE_LOGON[] = { 'R','E','M','O','T','E',' ','I','N','T','E','R','A','C','T','I','V','E',' ','L','O','G','O','N',0 };
 219 static const WCHAR Replicators[] = { 'R','e','p','l','i','c','a','t','o','r','s',0 };
 220 static const WCHAR RESTRICTED[] = { 'R','E','S','T','R','I','C','T','E','D',0 };
 221 static const WCHAR SChannel_Authentication[] = { 'S','C','h','a','n','n','e','l',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 222 static const WCHAR Schema_Admins[] = { 'S','c','h','e','m','a',' ','A','d','m','i','n','s',0 };
 223 static const WCHAR SELF[] = { 'S','E','L','F',0 };
 224 static const WCHAR Server_Operators[] = { 'S','e','r','v','e','r',' ','O','p','e','r','a','t','o','r','s',0 };
 225 static const WCHAR SERVICE[] = { 'S','E','R','V','I','C','E',0 };
 226 static const WCHAR SYSTEM[] = { 'S','Y','S','T','E','M',0 };
 227 static const WCHAR TERMINAL_SERVER_USER[] = { 'T','E','R','M','I','N','A','L',' ','S','E','R','V','E','R',' ','U','S','E','R',0 };
 228 static const WCHAR This_Organization[] = { 'T','h','i','s',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 };
 229 static const WCHAR Users[] = { 'U','s','e','r','s',0 };
 230
 231 static const AccountSid ACCOUNT_SIDS[] = {
 232     { WinNullSid, NULL_SID, Blank, SidTypeWellKnownGroup },
 233     { WinWorldSid, Everyone, Blank, SidTypeWellKnownGroup },
 234     { WinLocalSid, LOCAL, Blank, SidTypeWellKnownGroup },
 235     { WinCreatorOwnerSid, CREATOR_OWNER, Blank, SidTypeWellKnownGroup },
 236     { WinCreatorGroupSid, CREATOR_GROUP, Blank, SidTypeWellKnownGroup },
 237     { WinCreatorOwnerServerSid, CREATOR_OWNER_SERVER, Blank, SidTypeWellKnownGroup },
 238     { WinCreatorGroupServerSid, CREATOR_GROUP_SERVER, Blank, SidTypeWellKnownGroup },
 239     { WinNtAuthoritySid, NT_Pseudo_Domain, NT_Pseudo_Domain, SidTypeDomain },
 240     { WinDialupSid, DIALUP, NT_AUTHORITY, SidTypeWellKnownGroup },
 241     { WinNetworkSid, NETWORK, NT_AUTHORITY, SidTypeWellKnownGroup },
 242     { WinBatchSid, BATCH, NT_AUTHORITY, SidTypeWellKnownGroup },
 243     { WinInteractiveSid, INTERACTIVE, NT_AUTHORITY, SidTypeWellKnownGroup },
 244     { WinServiceSid, SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup },
 245     { WinAnonymousSid, ANONYMOUS_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup },
 246     { WinProxySid, PROXY, NT_AUTHORITY, SidTypeWellKnownGroup },
 247     { WinEnterpriseControllersSid, ENTERPRISE_DOMAIN_CONTROLLERS, NT_AUTHORITY, SidTypeWellKnownGroup },
 248     { WinSelfSid, SELF, NT_AUTHORITY, SidTypeWellKnownGroup },
 249     { WinAuthenticatedUserSid, Authenticated_Users, NT_AUTHORITY, SidTypeWellKnownGroup },
 250     { WinRestrictedCodeSid, RESTRICTED, NT_AUTHORITY, SidTypeWellKnownGroup },
 251     { WinTerminalServerSid, TERMINAL_SERVER_USER, NT_AUTHORITY, SidTypeWellKnownGroup },
 252     { WinRemoteLogonIdSid, REMOTE_INTERACTIVE_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup },
 253     { WinLocalSystemSid, SYSTEM, NT_AUTHORITY, SidTypeWellKnownGroup },
 254     { WinLocalServiceSid, LOCAL_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup, LOCAL_SERVICE2 },
 255     { WinNetworkServiceSid, NETWORK_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup , NETWORK_SERVICE2},
 256     { WinBuiltinDomainSid, BUILTIN, BUILTIN, SidTypeDomain },
 257     { WinBuiltinAdministratorsSid, Administrators, BUILTIN, SidTypeAlias },
 258     { WinBuiltinUsersSid, Users, BUILTIN, SidTypeAlias },
 259     { WinBuiltinGuestsSid, Guests, BUILTIN, SidTypeAlias },
 260     { WinBuiltinPowerUsersSid, Power_Users, BUILTIN, SidTypeAlias },
 261     { WinBuiltinAccountOperatorsSid, Account_Operators, BUILTIN, SidTypeAlias },
 262     { WinBuiltinSystemOperatorsSid, Server_Operators, BUILTIN, SidTypeAlias },
 263     { WinBuiltinPrintOperatorsSid, Print_Operators, BUILTIN, SidTypeAlias },
 264     { WinBuiltinBackupOperatorsSid, Backup_Operators, BUILTIN, SidTypeAlias },
 265     { WinBuiltinReplicatorSid, Replicators, BUILTIN, SidTypeAlias },
 266     { WinBuiltinPreWindows2000CompatibleAccessSid, Pre_Windows_2000_Compatible_Access, BUILTIN, SidTypeAlias },
 267     { WinBuiltinRemoteDesktopUsersSid, Remote_Desktop_Users, BUILTIN, SidTypeAlias },
 268     { WinBuiltinNetworkConfigurationOperatorsSid, Network_Configuration_Operators, BUILTIN, SidTypeAlias },
 269     { WinNTLMAuthenticationSid, NTML_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 270     { WinDigestAuthenticationSid, Digest_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 271     { WinSChannelAuthenticationSid, SChannel_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 272     { WinThisOrganizationSid, This_Organization, NT_AUTHORITY, SidTypeWellKnownGroup },
 273     { WinOtherOrganizationSid, Other_Organization, NT_AUTHORITY, SidTypeWellKnownGroup },
 274     { WinBuiltinPerfMonitoringUsersSid, Performance_Monitor_Users, BUILTIN, SidTypeAlias },
 275     { WinBuiltinPerfLoggingUsersSid, Performance_Log_Users, BUILTIN, SidTypeAlias },
 276     { WinBuiltinAnyPackageSid, ALL_APPLICATION_PACKAGES, APPLICATION_PACKAGE_AUTHORITY, SidTypeWellKnownGroup },
 277 };
 278 /*
 279  * ACE access rights
 280  */
 281 static const WCHAR SDDL_READ_CONTROL[]     = {'R','C',0};
 282 static const WCHAR SDDL_WRITE_DAC[]        = {'W','D',0};
 283 static const WCHAR SDDL_WRITE_OWNER[]      = {'W','O',0};
 284 static const WCHAR SDDL_STANDARD_DELETE[]  = {'S','D',0};
 285
 286 static const WCHAR SDDL_READ_PROPERTY[]    = {'R','P',0};
 287 static const WCHAR SDDL_WRITE_PROPERTY[]   = {'W','P',0};
 288 static const WCHAR SDDL_CREATE_CHILD[]     = {'C','C',0};
 289 static const WCHAR SDDL_DELETE_CHILD[]     = {'D','C',0};
 290 static const WCHAR SDDL_LIST_CHILDREN[]    = {'L','C',0};
 291 static const WCHAR SDDL_SELF_WRITE[]       = {'S','W',0};
 292 static const WCHAR SDDL_LIST_OBJECT[]      = {'L','O',0};
 293 static const WCHAR SDDL_DELETE_TREE[]      = {'D','T',0};
 294 static const WCHAR SDDL_CONTROL_ACCESS[]   = {'C','R',0};
 295
 296 static const WCHAR SDDL_FILE_ALL[]         = {'F','A',0};
 297 static const WCHAR SDDL_FILE_READ[]        = {'F','R',0};
 298 static const WCHAR SDDL_FILE_WRITE[]       = {'F','W',0};
 299 static const WCHAR SDDL_FILE_EXECUTE[]     = {'F','X',0};
 300
 301 static const WCHAR SDDL_KEY_ALL[]          = {'K','A',0};
 302 static const WCHAR SDDL_KEY_READ[]         = {'K','R',0};
 303 static const WCHAR SDDL_KEY_WRITE[]        = {'K','W',0};
 304 static const WCHAR SDDL_KEY_EXECUTE[]      = {'K','X',0};
 305
 306 static const WCHAR SDDL_GENERIC_ALL[]      = {'G','A',0};
 307 static const WCHAR SDDL_GENERIC_READ[]     = {'G','R',0};
 308 static const WCHAR SDDL_GENERIC_WRITE[]    = {'G','W',0};
 309 static const WCHAR SDDL_GENERIC_EXECUTE[]  = {'G','X',0};
 310
 311 static const WCHAR SDDL_NO_READ_UP[]       = {'N','R',0};
 312 static const WCHAR SDDL_NO_WRITE_UP[]      = {'N','W',0};
 313 static const WCHAR SDDL_NO_EXECUTE_UP[]    = {'N','X',0};
 314
 315 /*
 316  * ACL flags
 317  */
 318 static const WCHAR SDDL_PROTECTED[]             = {'P',0};
 319 static const WCHAR SDDL_AUTO_INHERIT_REQ[]      = {'A','R',0};
 320 static const WCHAR SDDL_AUTO_INHERITED[]        = {'A','I',0};
 321
 322 /*
 323  * ACE types
 324  */
 325 static const WCHAR SDDL_ACCESS_ALLOWED[]        = {'A',0};
 326 static const WCHAR SDDL_ACCESS_DENIED[]         = {'D',0};
 327 static const WCHAR SDDL_AUDIT[]                 = {'A','U',0};
 328 static const WCHAR SDDL_ALARM[]                 = {'A','L',0};
 329 static const WCHAR SDDL_MANDATORY_LABEL[]       = {'M','L',0};
 330
 331 /*
 332  * ACE flags
 333  */
 334 static const WCHAR SDDL_CONTAINER_INHERIT[]  = {'C','I',0};
 335 static const WCHAR SDDL_OBJECT_INHERIT[]     = {'O','I',0};
 336 static const WCHAR SDDL_NO_PROPAGATE[]       = {'N','P',0};
 337 static const WCHAR SDDL_INHERIT_ONLY[]       = {'I','O',0};
 338 static const WCHAR SDDL_INHERITED[]          = {'I','D',0};
 339 static const WCHAR SDDL_AUDIT_SUCCESS[]      = {'S','A',0};
 340 static const WCHAR SDDL_AUDIT_FAILURE[]      = {'F','A',0};
 341
 342 const char * debugstr_sid(PSID sid)
 343 {
 344     int auth = 0;
 345     SID * psid = sid;
 346
 347     if (psid == NULL)
 348         return "(null)";
 349
 350     auth = psid->IdentifierAuthority.Value[5] +
 351            (psid->IdentifierAuthority.Value[4] << 8) +
 352            (psid->IdentifierAuthority.Value[3] << 16) +
 353            (psid->IdentifierAuthority.Value[2] << 24);
 354
 355     switch (psid->SubAuthorityCount) {
 356     case 0:
 357         return wine_dbg_sprintf("S-%d-%d", psid->Revision, auth);
 358     case 1:
 359         return wine_dbg_sprintf("S-%d-%d-%u", psid->Revision, auth,
 360             psid->SubAuthority[0]);
 361     case 2:
 362         return wine_dbg_sprintf("S-%d-%d-%u-%u", psid->Revision, auth,
 363             psid->SubAuthority[0], psid->SubAuthority[1]);
 364     case 3:
 365         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u", psid->Revision, auth,
 366             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2]);
 367     case 4:
 368         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u", psid->Revision, auth,
 369             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 370             psid->SubAuthority[3]);
 371     case 5:
 372         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u", psid->Revision, auth,
 373             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 374             psid->SubAuthority[3], psid->SubAuthority[4]);
 375     case 6:
 376         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 377             psid->SubAuthority[3], psid->SubAuthority[1], psid->SubAuthority[2],
 378             psid->SubAuthority[0], psid->SubAuthority[4], psid->SubAuthority[5]);
 379     case 7:
 380         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 381             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 382             psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
 383             psid->SubAuthority[6]);
 384     case 8:
 385         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 386             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 387             psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
 388             psid->SubAuthority[6], psid->SubAuthority[7]);
 389     }
 390     return "(too-big)";
 391 }
 392
 393 /* set last error code from NT status and get the proper boolean return value */
 394 /* used for functions that are a simple wrapper around the corresponding ntdll API */
 395 static inline BOOL set_ntstatus( NTSTATUS status )
 396 {
 397     if (status) SetLastError( RtlNtStatusToDosError( status ));
 398     return !status;
 399 }
 400
 401 /* helper function for SE_FILE_OBJECT objects in [Get|Set]NamedSecurityInfo */
 402 static inline DWORD get_security_file( LPCWSTR full_file_name, DWORD access, HANDLE *file )
 403 {
 404     UNICODE_STRING file_nameW;
 405     OBJECT_ATTRIBUTES attr;
 406     IO_STATUS_BLOCK io;
 407     NTSTATUS status;
 408
 409     if (!RtlDosPathNameToNtPathName_U( full_file_name, &file_nameW, NULL, NULL ))
 410         return ERROR_PATH_NOT_FOUND;
 411     attr.Length = sizeof(attr);
 412     attr.RootDirectory = 0;
 413     attr.Attributes = OBJ_CASE_INSENSITIVE;
 414     attr.ObjectName = &file_nameW;
 415     attr.SecurityDescriptor = NULL;
 416     status = NtCreateFile( file, access|SYNCHRONIZE, &attr, &io, NULL, FILE_FLAG_BACKUP_SEMANTICS,
 417                            FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, FILE_OPEN,
 418                            FILE_OPEN_FOR_BACKUP_INTENT, NULL, 0 );
 419     RtlFreeUnicodeString( &file_nameW );
 420     return RtlNtStatusToDosError( status );
 421 }
 422
 423 /* helper function for SE_SERVICE objects in [Get|Set]NamedSecurityInfo */
 424 static inline DWORD get_security_service( LPWSTR full_service_name, DWORD access, HANDLE *service )
 425 {
 426     SC_HANDLE manager = 0;
 427     DWORD err;
 428
 429     err = SERV_OpenSCManagerW( NULL, NULL, access, (SC_HANDLE *)&manager );
 430     if (err == ERROR_SUCCESS)
 431     {
 432         err = SERV_OpenServiceW( manager, full_service_name, access, (SC_HANDLE *)service );
 433         CloseServiceHandle( manager );
 434     }
 435     return err;
 436 }
 437
 438 /* helper function for SE_REGISTRY_KEY objects in [Get|Set]NamedSecurityInfo */
 439 static inline DWORD get_security_regkey( LPWSTR full_key_name, DWORD access, HANDLE *key )
 440 {
 441     WCHAR classes_rootW[] = {'C','L','A','S','S','E','S','_','R','O','O','T',0};
 442     WCHAR current_userW[] = {'C','U','R','R','E','N','T','_','U','S','E','R',0};
 443     WCHAR machineW[] = {'M','A','C','H','I','N','E',0};
 444     WCHAR usersW[] = {'U','S','E','R','S',0};
 445     LPWSTR p = strchrW(full_key_name, '\\');
 446     int len = p-full_key_name;
 447     HKEY hParent;
 448
 449     if (!p) return ERROR_INVALID_PARAMETER;
 450     if (strncmpW( full_key_name, classes_rootW, len ) == 0)
 451         hParent = HKEY_CLASSES_ROOT;
 452     else if (strncmpW( full_key_name, current_userW, len ) == 0)
 453         hParent = HKEY_CURRENT_USER;
 454     else if (strncmpW( full_key_name, machineW, len ) == 0)
 455         hParent = HKEY_LOCAL_MACHINE;
 456     else if (strncmpW( full_key_name, usersW, len ) == 0)
 457         hParent = HKEY_USERS;
 458     else
 459         return ERROR_INVALID_PARAMETER;
 460     return RegOpenKeyExW( hParent, p+1, 0, access, (HKEY *)key );
 461 }
 462
 463 #define WINE_SIZE_OF_WORLD_ACCESS_ACL   (sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD))
 464
 465 static void GetWorldAccessACL(PACL pACL)
 466 {
 467     PACCESS_ALLOWED_ACE pACE = (PACCESS_ALLOWED_ACE) (pACL + 1);
 468
 469     pACL->AclRevision = ACL_REVISION;
 470     pACL->Sbz1 = 0;
 471     pACL->AclSize = WINE_SIZE_OF_WORLD_ACCESS_ACL;
 472     pACL->AceCount = 1;
 473     pACL->Sbz2 = 0;
 474
 475     pACE->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 476     pACE->Header.AceFlags = CONTAINER_INHERIT_ACE;
 477     pACE->Header.AceSize = sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD);
 478     pACE->Mask = 0xf3ffffff; /* Everything except reserved bits */
 479     memcpy(&pACE->SidStart, &sidWorld, sizeof(sidWorld));
 480 }
 481
 482 /************************************************************
 483  *                ADVAPI_IsLocalComputer
 484  *
 485  * Checks whether the server name indicates local machine.
 486  */
 487 BOOL ADVAPI_IsLocalComputer(LPCWSTR ServerName)
 488 {
 489     DWORD dwSize = MAX_COMPUTERNAME_LENGTH + 1;
 490     BOOL Result;
 491     LPWSTR buf;
 492
 493     if (!ServerName || !ServerName[0])
 494         return TRUE;
 495
 496     buf = heap_alloc(dwSize * sizeof(WCHAR));
 497     Result = GetComputerNameW(buf,  &dwSize);
 498     if (Result && (ServerName[0] == '\\') && (ServerName[1] == '\\'))
 499         ServerName += 2;
 500     Result = Result && !lstrcmpW(ServerName, buf);
 501     heap_free(buf);
 502
 503     return Result;
 504 }
 505
 506 /************************************************************
 507  *                ADVAPI_GetComputerSid
 508  */
 509 BOOL ADVAPI_GetComputerSid(PSID sid)
 510 {
 511     static const struct /* same fields as struct SID */
 512     {
 513         BYTE Revision;
 514         BYTE SubAuthorityCount;
 515         SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
 516         DWORD SubAuthority[4];
 517     } computer_sid =
 518     { SID_REVISION, 4, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0 } };
 519
 520     memcpy( sid, &computer_sid, sizeof(computer_sid) );
 521     return TRUE;
 522 }
 523
 524 /*      ##############################
 525         ######  TOKEN FUNCTIONS ######
 526         ##############################
 527 */
 528
 529 /******************************************************************************
 530  * OpenProcessToken                     [ADVAPI32.@]
 531  * Opens the access token associated with a process handle.
 532  *
 533  * PARAMS
 534  *   ProcessHandle [I] Handle to process
 535  *   DesiredAccess [I] Desired access to process
 536  *   TokenHandle   [O] Pointer to handle of open access token
 537  *
 538  * RETURNS
 539  *  Success: TRUE. TokenHandle contains the access token.
 540  *  Failure: FALSE.
 541  *
 542  * NOTES
 543  *  See NtOpenProcessToken.
 544  */
 545 BOOL WINAPI
 546 OpenProcessToken( HANDLE ProcessHandle, DWORD DesiredAccess,
 547                   HANDLE *TokenHandle )
 548 {
 549         return set_ntstatus(NtOpenProcessToken( ProcessHandle, DesiredAccess, TokenHandle ));
 550 }
 551
 552 /******************************************************************************
 553  * OpenThreadToken [ADVAPI32.@]
 554  *
 555  * Opens the access token associated with a thread handle.
 556  *
 557  * PARAMS
 558  *   ThreadHandle  [I] Handle to process
 559  *   DesiredAccess [I] Desired access to the thread
 560  *   OpenAsSelf    [I] ???
 561  *   TokenHandle   [O] Destination for the token handle
 562  *
 563  * RETURNS
 564  *  Success: TRUE. TokenHandle contains the access token.
 565  *  Failure: FALSE.
 566  *
 567  * NOTES
 568  *  See NtOpenThreadToken.
 569  */
 570 BOOL WINAPI
 571 OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess,
 572                  BOOL OpenAsSelf, HANDLE *TokenHandle)
 573 {
 574         return set_ntstatus( NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle));
 575 }
 576
 577 BOOL WINAPI
 578 AdjustTokenGroups( HANDLE TokenHandle, BOOL ResetToDefault, PTOKEN_GROUPS NewState,
 579                    DWORD BufferLength, PTOKEN_GROUPS PreviousState, PDWORD ReturnLength )
 580 {
 581     return set_ntstatus( NtAdjustGroupsToken(TokenHandle, ResetToDefault, NewState, BufferLength,
 582                                              PreviousState, ReturnLength));
 583 }
 584
 585 /******************************************************************************
 586  * AdjustTokenPrivileges [ADVAPI32.@]
 587  *
 588  * Adjust the privileges of an open token handle.
 589  *
 590  * PARAMS
 591  *  TokenHandle          [I]   Handle from OpenProcessToken() or OpenThreadToken()
 592  *  DisableAllPrivileges [I]   TRUE=Remove all privileges, FALSE=Use NewState
 593  *  NewState             [I]   Desired new privileges of the token
 594  *  BufferLength         [I]   Length of NewState
 595  *  PreviousState        [O]   Destination for the previous state
 596  *  ReturnLength         [I/O] Size of PreviousState
 597  *
 598  *
 599  * RETURNS
 600  *  Success: TRUE. Privileges are set to NewState and PreviousState is updated.
 601  *  Failure: FALSE.
 602  *
 603  * NOTES
 604  *  See NtAdjustPrivilegesToken.
 605  */
 606 BOOL WINAPI
 607 AdjustTokenPrivileges( HANDLE TokenHandle, BOOL DisableAllPrivileges,
 608                        PTOKEN_PRIVILEGES NewState, DWORD BufferLength,
 609                        PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength )
 610 {
 611     NTSTATUS status;
 612
 613     TRACE("(%p %d %p %d %p %p)\n", TokenHandle, DisableAllPrivileges, NewState, BufferLength,
 614         PreviousState, ReturnLength);
 615
 616     status = NtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges,
 617                                                      NewState, BufferLength, PreviousState,
 618                                                      ReturnLength);
 619     SetLastError( RtlNtStatusToDosError( status ));
 620     if ((status == STATUS_SUCCESS) || (status == STATUS_NOT_ALL_ASSIGNED))
 621         return TRUE;
 622     else
 623         return FALSE;
 624 }
 625
 626 /******************************************************************************
 627  * CheckTokenMembership [ADVAPI32.@]
 628  *
 629  * Determine if an access token is a member of a SID.
 630  *
 631  * PARAMS
 632  *   TokenHandle [I] Handle from OpenProcessToken() or OpenThreadToken()
 633  *   SidToCheck  [I] SID that possibly contains the token
 634  *   IsMember    [O] Destination for result.
 635  *
 636  * RETURNS
 637  *  Success: TRUE. IsMember is TRUE if TokenHandle is a member, FALSE otherwise.
 638  *  Failure: FALSE.
 639  */
 640 BOOL WINAPI
 641 CheckTokenMembership( HANDLE token, PSID sid_to_check,
 642                       PBOOL is_member )
 643 {
 644     PTOKEN_GROUPS token_groups = NULL;
 645     HANDLE thread_token = NULL;
 646     DWORD size, i;
 647     BOOL ret;
 648
 649     TRACE("(%p %s %p)\n", token, debugstr_sid(sid_to_check), is_member);
 650
 651     *is_member = FALSE;
 652
 653     if (!token)
 654     {
 655         if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &thread_token))
 656         {
 657             HANDLE process_token;
 658             ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &process_token);
 659             if (!ret)
 660                 goto exit;
 661             ret = DuplicateTokenEx(process_token, TOKEN_QUERY,
 662                 NULL, SecurityImpersonation, TokenImpersonation,
 663                 &thread_token);
 664             CloseHandle(process_token);
 665             if (!ret)
 666                 goto exit;
 667         }
 668         token = thread_token;
 669     }
 670     else
 671     {
 672         TOKEN_TYPE type;
 673
 674         ret = GetTokenInformation(token, TokenType, &type, sizeof(TOKEN_TYPE), &size);
 675         if (!ret) goto exit;
 676
 677         if (type == TokenPrimary)
 678         {
 679             SetLastError(ERROR_NO_IMPERSONATION_TOKEN);
 680             return FALSE;
 681         }
 682     }
 683
 684     ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
 685     if (!ret && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
 686         goto exit;
 687
 688     token_groups = heap_alloc(size);
 689     if (!token_groups)
 690     {
 691         ret = FALSE;
 692         goto exit;
 693     }
 694
 695     ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
 696     if (!ret)
 697         goto exit;
 698
 699     for (i = 0; i < token_groups->GroupCount; i++)
 700     {
 701         TRACE("Groups[%d]: {0x%x, %s}\n", i,
 702             token_groups->Groups[i].Attributes,
 703             debugstr_sid(token_groups->Groups[i].Sid));
 704         if ((token_groups->Groups[i].Attributes & SE_GROUP_ENABLED) &&
 705             EqualSid(sid_to_check, token_groups->Groups[i].Sid))
 706         {
 707             *is_member = TRUE;
 708             TRACE("sid enabled and found in token\n");
 709             break;
 710         }
 711     }
 712
 713 exit:
 714     heap_free(token_groups);
 715     if (thread_token != NULL) CloseHandle(thread_token);
 716
 717     return ret;
 718 }
 719
 720 /******************************************************************************
 721  * GetTokenInformation [ADVAPI32.@]
 722  *
 723  * Get a type of information about an access token.
 724  *
 725  * PARAMS
 726  *   token           [I] Handle from OpenProcessToken() or OpenThreadToken()
 727  *   tokeninfoclass  [I] A TOKEN_INFORMATION_CLASS from "winnt.h"
 728  *   tokeninfo       [O] Destination for token information
 729  *   tokeninfolength [I] Length of tokeninfo
 730  *   retlen          [O] Destination for returned token information length
 731  *
 732  * RETURNS
 733  *  Success: TRUE. tokeninfo contains retlen bytes of token information
 734  *  Failure: FALSE.
 735  *
 736  * NOTES
 737  *  See NtQueryInformationToken.
 738  */
 739 BOOL WINAPI
 740 GetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
 741                      LPVOID tokeninfo, DWORD tokeninfolength, LPDWORD retlen )
 742 {
 743     TRACE("(%p, %s, %p, %d, %p):\n",
 744           token,
 745           (tokeninfoclass == TokenUser) ? "TokenUser" :
 746           (tokeninfoclass == TokenGroups) ? "TokenGroups" :
 747           (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" :
 748           (tokeninfoclass == TokenOwner) ? "TokenOwner" :
 749           (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" :
 750           (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" :
 751           (tokeninfoclass == TokenSource) ? "TokenSource" :
 752           (tokeninfoclass == TokenType) ? "TokenType" :
 753           (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" :
 754           (tokeninfoclass == TokenStatistics) ? "TokenStatistics" :
 755           (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" :
 756           (tokeninfoclass == TokenSessionId) ? "TokenSessionId" :
 757           (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" :
 758           (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" :
 759           (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" :
 760           "Unknown",
 761           tokeninfo, tokeninfolength, retlen);
 762     return set_ntstatus( NtQueryInformationToken( token, tokeninfoclass, tokeninfo,
 763                                                   tokeninfolength, retlen));
 764 }
 765
 766 /******************************************************************************
 767  * SetTokenInformation [ADVAPI32.@]
 768  *
 769  * Set information for an access token.
 770  *
 771  * PARAMS
 772  *   token           [I] Handle from OpenProcessToken() or OpenThreadToken()
 773  *   tokeninfoclass  [I] A TOKEN_INFORMATION_CLASS from "winnt.h"
 774  *   tokeninfo       [I] Token information to set
 775  *   tokeninfolength [I] Length of tokeninfo
 776  *
 777  * RETURNS
 778  *  Success: TRUE. The information for the token is set to tokeninfo.
 779  *  Failure: FALSE.
 780  */
 781 BOOL WINAPI
 782 SetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
 783                      LPVOID tokeninfo, DWORD tokeninfolength )
 784 {
 785     TRACE("(%p, %s, %p, %d)\n",
 786           token,
 787           (tokeninfoclass == TokenUser) ? "TokenUser" :
 788           (tokeninfoclass == TokenGroups) ? "TokenGroups" :
 789           (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" :
 790           (tokeninfoclass == TokenOwner) ? "TokenOwner" :
 791           (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" :
 792           (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" :
 793           (tokeninfoclass == TokenSource) ? "TokenSource" :
 794           (tokeninfoclass == TokenType) ? "TokenType" :
 795           (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" :
 796           (tokeninfoclass == TokenStatistics) ? "TokenStatistics" :
 797           (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" :
 798           (tokeninfoclass == TokenSessionId) ? "TokenSessionId" :
 799           (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" :
 800           (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" :
 801           (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" :
 802           "Unknown",
 803           tokeninfo, tokeninfolength);
 804
 805     return set_ntstatus( NtSetInformationToken( token, tokeninfoclass, tokeninfo, tokeninfolength ));
 806 }
 807
 808 /*************************************************************************
 809  * SetThreadToken [ADVAPI32.@]
 810  *
 811  * Assigns an 'impersonation token' to a thread so it can assume the
 812  * security privileges of another thread or process.  Can also remove
 813  * a previously assigned token.
 814  *
 815  * PARAMS
 816  *   thread          [O] Handle to thread to set the token for
 817  *   token           [I] Token to set
 818  *
 819  * RETURNS
 820  *  Success: TRUE. The threads access token is set to token
 821  *  Failure: FALSE.
 822  *
 823  * NOTES
 824  *  Only supported on NT or higher. On Win9X this function does nothing.
 825  *  See SetTokenInformation.
 826  */
 827 BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token)
 828 {
 829     return set_ntstatus( NtSetInformationThread( thread ? *thread : GetCurrentThread(),
 830                                                  ThreadImpersonationToken, &token, sizeof token ));
 831 }
 832
 833 /*************************************************************************
 834  * CreateRestrictedToken [ADVAPI32.@]
 835  *
 836  * Create a new more restricted token from an existing token.
 837  *
 838  * PARAMS
 839  *   baseToken       [I] Token to base the new restricted token on
 840  *   flags           [I] Options
 841  *   nDisableSids    [I] Length of disableSids array
 842  *   disableSids     [I] Array of SIDs to disable in the new token
 843  *   nDeletePrivs    [I] Length of deletePrivs array
 844  *   deletePrivs     [I] Array of privileges to delete in the new token
 845  *   nRestrictSids   [I] Length of restrictSids array
 846  *   restrictSids    [I] Array of SIDs to restrict in the new token
 847  *   newToken        [O] Address where the new token is stored
 848  *
 849  * RETURNS
 850  *  Success: TRUE
 851  *  Failure: FALSE
 852  */
 853 BOOL WINAPI CreateRestrictedToken(
 854     HANDLE baseToken,
 855     DWORD flags,
 856     DWORD nDisableSids,
 857     PSID_AND_ATTRIBUTES disableSids,
 858     DWORD nDeletePrivs,
 859     PLUID_AND_ATTRIBUTES deletePrivs,
 860     DWORD nRestrictSids,
 861     PSID_AND_ATTRIBUTES restrictSids,
 862     PHANDLE newToken)
 863 {
 864     TOKEN_TYPE type;
 865     SECURITY_IMPERSONATION_LEVEL level = SecurityAnonymous;
 866     DWORD size;
 867
 868     FIXME("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p): stub\n",
 869           baseToken, flags, nDisableSids, disableSids,
 870           nDeletePrivs, deletePrivs,
 871           nRestrictSids, restrictSids,
 872           newToken);
 873
 874     size = sizeof(type);
 875     if (!GetTokenInformation( baseToken, TokenType, &type, size, &size )) return FALSE;
 876     if (type == TokenImpersonation)
 877     {
 878         size = sizeof(level);
 879         if (!GetTokenInformation( baseToken, TokenImpersonationLevel, &level, size, &size ))
 880             return FALSE;
 881     }
 882     return DuplicateTokenEx( baseToken, MAXIMUM_ALLOWED, NULL, level, type, newToken );
 883 }
 884
 885 /*      ##############################
 886         ######  SID FUNCTIONS   ######
 887         ##############################
 888 */
 889
 890 /******************************************************************************
 891  * AllocateAndInitializeSid [ADVAPI32.@]
 892  *
 893  * PARAMS
 894  *   pIdentifierAuthority []
 895  *   nSubAuthorityCount   []
 896  *   nSubAuthority0       []
 897  *   nSubAuthority1       []
 898  *   nSubAuthority2       []
 899  *   nSubAuthority3       []
 900  *   nSubAuthority4       []
 901  *   nSubAuthority5       []
 902  *   nSubAuthority6       []
 903  *   nSubAuthority7       []
 904  *   pSid                 []
 905  */
 906 BOOL WINAPI
 907 AllocateAndInitializeSid( PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
 908                           BYTE nSubAuthorityCount,
 909                           DWORD nSubAuthority0, DWORD nSubAuthority1,
 910                           DWORD nSubAuthority2, DWORD nSubAuthority3,
 911                           DWORD nSubAuthority4, DWORD nSubAuthority5,
 912                           DWORD nSubAuthority6, DWORD nSubAuthority7,
 913                           PSID *pSid )
 914 {
 915     return set_ntstatus( RtlAllocateAndInitializeSid(
 916                              pIdentifierAuthority, nSubAuthorityCount,
 917                              nSubAuthority0, nSubAuthority1, nSubAuthority2, nSubAuthority3,
 918                              nSubAuthority4, nSubAuthority5, nSubAuthority6, nSubAuthority7,
 919                              pSid ));
 920 }
 921
 922 /******************************************************************************
 923  * FreeSid [ADVAPI32.@]
 924  *
 925  * PARAMS
 926  *   pSid []
 927  */
 928 PVOID WINAPI
 929 FreeSid( PSID pSid )
 930 {
 931         RtlFreeSid(pSid);
 932         return NULL; /* is documented like this */
 933 }
 934
 935 /******************************************************************************
 936  * CopySid [ADVAPI32.@]
 937  *
 938  * PARAMS
 939  *   nDestinationSidLength []
 940  *   pDestinationSid       []
 941  *   pSourceSid            []
 942  */
 943 BOOL WINAPI
 944 CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid )
 945 {
 946         return RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid);
 947 }
 948
 949 /******************************************************************************
 950  * CreateWellKnownSid [ADVAPI32.@]
 951  */
 952 BOOL WINAPI
 953 CreateWellKnownSid( WELL_KNOWN_SID_TYPE WellKnownSidType,
 954                     PSID DomainSid,
 955                     PSID pSid,
 956                     DWORD* cbSid)
 957 {
 958     unsigned int i;
 959     TRACE("(%d, %s, %p, %p)\n", WellKnownSidType, debugstr_sid(DomainSid), pSid, cbSid);
 960
 961     if (cbSid == NULL || (DomainSid && !IsValidSid(DomainSid)))
 962     {
 963         SetLastError(ERROR_INVALID_PARAMETER);
 964         return FALSE;
 965     }
 966
 967     for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++) {
 968         if (WellKnownSids[i].Type == WellKnownSidType) {
 969             DWORD length = GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
 970
 971             if (*cbSid < length)
 972             {
 973                 *cbSid = length;
 974                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
 975                 return FALSE;
 976             }
 977             if (!pSid)
 978             {
 979                 SetLastError(ERROR_INVALID_PARAMETER);
 980                 return FALSE;
 981             }
 982             CopyMemory(pSid, &WellKnownSids[i].Sid.Revision, length);
 983             *cbSid = length;
 984             return TRUE;
 985         }
 986     }
 987
 988     if (DomainSid == NULL || *GetSidSubAuthorityCount(DomainSid) == SID_MAX_SUB_AUTHORITIES)
 989     {
 990         SetLastError(ERROR_INVALID_PARAMETER);
 991         return FALSE;
 992     }
 993
 994     for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
 995         if (WellKnownRids[i].Type == WellKnownSidType) {
 996             UCHAR domain_subauth = *GetSidSubAuthorityCount(DomainSid);
 997             DWORD domain_sid_length = GetSidLengthRequired(domain_subauth);
 998             DWORD output_sid_length = GetSidLengthRequired(domain_subauth + 1);
 999
1000             if (*cbSid < output_sid_length)
1001             {
1002                 *cbSid = output_sid_length;
1003                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
1004                 return FALSE;
1005             }
1006             if (!pSid)
1007             {
1008                 SetLastError(ERROR_INVALID_PARAMETER);
1009                 return FALSE;
1010             }
1011             CopyMemory(pSid, DomainSid, domain_sid_length);
1012             (*GetSidSubAuthorityCount(pSid))++;
1013             (*GetSidSubAuthority(pSid, domain_subauth)) = WellKnownRids[i].Rid;
1014             *cbSid = output_sid_length;
1015             return TRUE;
1016         }
1017
1018     SetLastError(ERROR_INVALID_PARAMETER);
1019     return FALSE;
1020 }
1021
1022 /******************************************************************************
1023  * IsWellKnownSid [ADVAPI32.@]
1024  */
1025 BOOL WINAPI
1026 IsWellKnownSid( PSID pSid, WELL_KNOWN_SID_TYPE WellKnownSidType )
1027 {
1028     unsigned int i;
1029     TRACE("(%s, %d)\n", debugstr_sid(pSid), WellKnownSidType);
1030
1031     for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
1032         if (WellKnownSids[i].Type == WellKnownSidType)
1033             if (EqualSid(pSid, (PSID)&(WellKnownSids[i].Sid.Revision)))
1034                 return TRUE;
1035
1036     return FALSE;
1037 }
1038
1039 BOOL WINAPI
1040 IsTokenRestricted( HANDLE TokenHandle )
1041 {
1042     TOKEN_GROUPS *groups;
1043     DWORD size;
1044     NTSTATUS status;
1045     BOOL restricted;
1046
1047     TRACE("(%p)\n", TokenHandle);
1048
1049     status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, NULL, 0, &size);
1050     if (status != STATUS_BUFFER_TOO_SMALL)
1051         return FALSE;
1052
1053     groups = heap_alloc(size);
1054     if (!groups)
1055     {
1056         SetLastError(ERROR_OUTOFMEMORY);
1057         return FALSE;
1058     }
1059
1060     status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, groups, size, &size);
1061     if (status != STATUS_SUCCESS)
1062     {
1063         heap_free(groups);
1064         return set_ntstatus(status);
1065     }
1066
1067     restricted = groups->GroupCount > 0;
1068     heap_free(groups);
1069
1070     return restricted;
1071 }
1072
1073 /******************************************************************************
1074  * IsValidSid [ADVAPI32.@]
1075  *
1076  * PARAMS
1077  *   pSid []
1078  */
1079 BOOL WINAPI
1080 IsValidSid( PSID pSid )
1081 {
1082         return RtlValidSid( pSid );
1083 }
1084
1085 /******************************************************************************
1086  * EqualSid [ADVAPI32.@]
1087  *
1088  * PARAMS
1089  *   pSid1 []
1090  *   pSid2 []
1091  */
1092 BOOL WINAPI
1093 EqualSid( PSID pSid1, PSID pSid2 )
1094 {
1095         BOOL ret = RtlEqualSid( pSid1, pSid2 );
1096         SetLastError(ERROR_SUCCESS);
1097         return ret;
1098 }
1099
1100 /******************************************************************************
1101  * EqualPrefixSid [ADVAPI32.@]
1102  */
1103 BOOL WINAPI EqualPrefixSid (PSID pSid1, PSID pSid2)
1104 {
1105         return RtlEqualPrefixSid(pSid1, pSid2);
1106 }
1107
1108 /******************************************************************************
1109  * GetSidLengthRequired [ADVAPI32.@]
1110  *
1111  * PARAMS
1112  *   nSubAuthorityCount []
1113  */
1114 DWORD WINAPI
1115 GetSidLengthRequired( BYTE nSubAuthorityCount )
1116 {
1117         return RtlLengthRequiredSid(nSubAuthorityCount);
1118 }
1119
1120 /******************************************************************************
1121  * InitializeSid [ADVAPI32.@]
1122  *
1123  * PARAMS
1124  *   pIdentifierAuthority []
1125  */
1126 BOOL WINAPI
1127 InitializeSid (
1128         PSID pSid,
1129         PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
1130         BYTE nSubAuthorityCount)
1131 {
1132         return RtlInitializeSid(pSid, pIdentifierAuthority, nSubAuthorityCount);
1133 }
1134
1135 DWORD WINAPI
1136 GetEffectiveRightsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pAccessRights )
1137 {
1138     FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights);
1139
1140     *pAccessRights = STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL;
1141     return 0;
1142 }
1143
1144 DWORD WINAPI
1145 GetEffectiveRightsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pAccessRights )
1146 {
1147     FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights);
1148
1149     return 1;
1150 }
1151
1152 /******************************************************************************
1153  * GetSidIdentifierAuthority [ADVAPI32.@]
1154  *
1155  * PARAMS
1156  *   pSid []
1157  */
1158 PSID_IDENTIFIER_AUTHORITY WINAPI
1159 GetSidIdentifierAuthority( PSID pSid )
1160 {
1161     SetLastError(ERROR_SUCCESS);
1162     return RtlIdentifierAuthoritySid(pSid);
1163 }
1164
1165 /******************************************************************************
1166  * GetSidSubAuthority [ADVAPI32.@]
1167  *
1168  * PARAMS
1169  *   pSid          []
1170  *   nSubAuthority []
1171  */
1172 PDWORD WINAPI
1173 GetSidSubAuthority( PSID pSid, DWORD nSubAuthority )
1174 {
1175         SetLastError(ERROR_SUCCESS);
1176         return RtlSubAuthoritySid(pSid, nSubAuthority);
1177 }
1178
1179 /******************************************************************************
1180  * GetSidSubAuthorityCount [ADVAPI32.@]
1181  *
1182  * PARAMS
1183  *   pSid []
1184  */
1185 PUCHAR WINAPI
1186 GetSidSubAuthorityCount (PSID pSid)
1187 {
1188         SetLastError(ERROR_SUCCESS);
1189         return RtlSubAuthorityCountSid(pSid);
1190 }
1191
1192 /******************************************************************************
1193  * GetLengthSid [ADVAPI32.@]
1194  *
1195  * PARAMS
1196  *   pSid []
1197  */
1198 DWORD WINAPI
1199 GetLengthSid (PSID pSid)
1200 {
1201         return RtlLengthSid(pSid);
1202 }
1203
1204 /*      ##############################################
1205         ######  SECURITY DESCRIPTOR FUNCTIONS   ######
1206         ##############################################
1207 */
1208
1209  /******************************************************************************
1210  * BuildSecurityDescriptorA [ADVAPI32.@]
1211  *
1212  * Builds a SD from
1213  *
1214  * PARAMS
1215  *  pOwner                [I]
1216  *  pGroup                [I]
1217  *  cCountOfAccessEntries [I]
1218  *  pListOfAccessEntries  [I]
1219  *  cCountOfAuditEntries  [I]
1220  *  pListofAuditEntries   [I]
1221  *  pOldSD                [I]
1222  *  lpdwBufferLength      [I/O]
1223  *  pNewSD                [O]
1224  *
1225  * RETURNS
1226  *  Success: ERROR_SUCCESS
1227  *  Failure: nonzero error code from Winerror.h
1228  */
1229 DWORD WINAPI BuildSecurityDescriptorA(
1230     IN PTRUSTEEA pOwner,
1231     IN PTRUSTEEA pGroup,
1232     IN ULONG cCountOfAccessEntries,
1233     IN PEXPLICIT_ACCESSA pListOfAccessEntries,
1234     IN ULONG cCountOfAuditEntries,
1235     IN PEXPLICIT_ACCESSA pListofAuditEntries,
1236     IN PSECURITY_DESCRIPTOR pOldSD,
1237     IN OUT PULONG lpdwBufferLength,
1238     OUT PSECURITY_DESCRIPTOR* pNewSD)
1239 {
1240     FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup,
1241           cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries,
1242           pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD);
1243
1244     return ERROR_CALL_NOT_IMPLEMENTED;
1245 }
1246
1247 /******************************************************************************
1248  * BuildSecurityDescriptorW [ADVAPI32.@]
1249  *
1250  * See BuildSecurityDescriptorA.
1251  */
1252 DWORD WINAPI BuildSecurityDescriptorW(
1253     IN PTRUSTEEW pOwner,
1254     IN PTRUSTEEW pGroup,
1255     IN ULONG cCountOfAccessEntries,
1256     IN PEXPLICIT_ACCESSW pListOfAccessEntries,
1257     IN ULONG cCountOfAuditEntries,
1258     IN PEXPLICIT_ACCESSW pListofAuditEntries,
1259     IN PSECURITY_DESCRIPTOR pOldSD,
1260     IN OUT PULONG lpdwBufferLength,
1261     OUT PSECURITY_DESCRIPTOR* pNewSD)
1262 {
1263     FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup,
1264           cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries,
1265           pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD);
1266
1267     return ERROR_CALL_NOT_IMPLEMENTED;
1268 }
1269
1270 /******************************************************************************
1271  * InitializeSecurityDescriptor [ADVAPI32.@]
1272  *
1273  * PARAMS
1274  *   pDescr   []
1275  *   revision []
1276  */
1277 BOOL WINAPI
1278 InitializeSecurityDescriptor( PSECURITY_DESCRIPTOR pDescr, DWORD revision )
1279 {
1280         return set_ntstatus( RtlCreateSecurityDescriptor(pDescr, revision ));
1281 }
1282
1283
1284 /******************************************************************************
1285  * MakeAbsoluteSD [ADVAPI32.@]
1286  */
1287 BOOL WINAPI MakeAbsoluteSD (
1288         IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
1289         OUT PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
1290         OUT LPDWORD lpdwAbsoluteSecurityDescriptorSize,
1291         OUT PACL pDacl,
1292         OUT LPDWORD lpdwDaclSize,
1293         OUT PACL pSacl,
1294         OUT LPDWORD lpdwSaclSize,
1295         OUT PSID pOwner,
1296         OUT LPDWORD lpdwOwnerSize,
1297         OUT PSID pPrimaryGroup,
1298         OUT LPDWORD lpdwPrimaryGroupSize)
1299 {
1300     return set_ntstatus( RtlSelfRelativeToAbsoluteSD(pSelfRelativeSecurityDescriptor,
1301                                                      pAbsoluteSecurityDescriptor,
1302                                                      lpdwAbsoluteSecurityDescriptorSize,
1303                                                      pDacl, lpdwDaclSize, pSacl, lpdwSaclSize,
1304                                                      pOwner, lpdwOwnerSize,
1305                                                      pPrimaryGroup, lpdwPrimaryGroupSize));
1306 }
1307
1308 /******************************************************************************
1309  * GetKernelObjectSecurity [ADVAPI32.@]
1310  */
1311 BOOL WINAPI GetKernelObjectSecurity(
1312         HANDLE Handle,
1313         SECURITY_INFORMATION RequestedInformation,
1314         PSECURITY_DESCRIPTOR pSecurityDescriptor,
1315         DWORD nLength,
1316         LPDWORD lpnLengthNeeded )
1317 {
1318     TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", Handle, RequestedInformation,
1319           pSecurityDescriptor, nLength, lpnLengthNeeded);
1320
1321     return set_ntstatus( NtQuerySecurityObject(Handle, RequestedInformation, pSecurityDescriptor,
1322                                                nLength, lpnLengthNeeded ));
1323 }
1324
1325 /******************************************************************************
1326  * GetPrivateObjectSecurity [ADVAPI32.@]
1327  */
1328 BOOL WINAPI GetPrivateObjectSecurity(
1329         PSECURITY_DESCRIPTOR ObjectDescriptor,
1330         SECURITY_INFORMATION SecurityInformation,
1331         PSECURITY_DESCRIPTOR ResultantDescriptor,
1332         DWORD DescriptorLength,
1333         PDWORD ReturnLength )
1334 {
1335     SECURITY_DESCRIPTOR desc;
1336     BOOL defaulted, present;
1337     PACL pacl;
1338     PSID psid;
1339
1340     TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", ObjectDescriptor, SecurityInformation,
1341           ResultantDescriptor, DescriptorLength, ReturnLength);
1342
1343     if (!InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION))
1344         return FALSE;
1345
1346     if (SecurityInformation & OWNER_SECURITY_INFORMATION)
1347     {
1348         if (!GetSecurityDescriptorOwner(ObjectDescriptor, &psid, &defaulted))
1349             return FALSE;
1350         SetSecurityDescriptorOwner(&desc, psid, defaulted);
1351     }
1352
1353     if (SecurityInformation & GROUP_SECURITY_INFORMATION)
1354     {
1355         if (!GetSecurityDescriptorGroup(ObjectDescriptor, &psid, &defaulted))
1356             return FALSE;
1357         SetSecurityDescriptorGroup(&desc, psid, defaulted);
1358     }
1359
1360     if (SecurityInformation & DACL_SECURITY_INFORMATION)
1361     {
1362         if (!GetSecurityDescriptorDacl(ObjectDescriptor, &present, &pacl, &defaulted))
1363             return FALSE;
1364         SetSecurityDescriptorDacl(&desc, present, pacl, defaulted);
1365     }
1366
1367     if (SecurityInformation & SACL_SECURITY_INFORMATION)
1368     {
1369         if (!GetSecurityDescriptorSacl(ObjectDescriptor, &present, &pacl, &defaulted))
1370             return FALSE;
1371         SetSecurityDescriptorSacl(&desc, present, pacl, defaulted);
1372     }
1373
1374     *ReturnLength = DescriptorLength;
1375     return MakeSelfRelativeSD(&desc, ResultantDescriptor, ReturnLength);
1376 }
1377
1378 /******************************************************************************
1379  * GetSecurityDescriptorLength [ADVAPI32.@]
1380  */
1381 DWORD WINAPI GetSecurityDescriptorLength( PSECURITY_DESCRIPTOR pDescr)
1382 {
1383         return RtlLengthSecurityDescriptor(pDescr);
1384 }
1385
1386 /******************************************************************************
1387  * GetSecurityDescriptorOwner [ADVAPI32.@]
1388  *
1389  * PARAMS
1390  *   pOwner            []
1391  *   lpbOwnerDefaulted []
1392  */
1393 BOOL WINAPI
1394 GetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pDescr, PSID *pOwner,
1395                             LPBOOL lpbOwnerDefaulted )
1396 {
1397     BOOLEAN defaulted;
1398     BOOL ret = set_ntstatus( RtlGetOwnerSecurityDescriptor( pDescr, pOwner, &defaulted ));
1399     *lpbOwnerDefaulted = defaulted;
1400     return ret;
1401 }
1402
1403 /******************************************************************************
1404  * SetSecurityDescriptorOwner [ADVAPI32.@]
1405  *
1406  * PARAMS
1407  */
1408 BOOL WINAPI SetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1409                                    PSID pOwner, BOOL bOwnerDefaulted)
1410 {
1411     return set_ntstatus( RtlSetOwnerSecurityDescriptor(pSecurityDescriptor, pOwner, bOwnerDefaulted));
1412 }
1413 /******************************************************************************
1414  * GetSecurityDescriptorGroup                   [ADVAPI32.@]
1415  */
1416 BOOL WINAPI GetSecurityDescriptorGroup(
1417         PSECURITY_DESCRIPTOR SecurityDescriptor,
1418         PSID *Group,
1419         LPBOOL GroupDefaulted)
1420 {
1421     BOOLEAN defaulted;
1422     BOOL ret = set_ntstatus( RtlGetGroupSecurityDescriptor(SecurityDescriptor, Group, &defaulted ));
1423     *GroupDefaulted = defaulted;
1424     return ret;
1425 }
1426 /******************************************************************************
1427  * SetSecurityDescriptorGroup [ADVAPI32.@]
1428  */
1429 BOOL WINAPI SetSecurityDescriptorGroup ( PSECURITY_DESCRIPTOR SecurityDescriptor,
1430                                            PSID Group, BOOL GroupDefaulted)
1431 {
1432     return set_ntstatus( RtlSetGroupSecurityDescriptor( SecurityDescriptor, Group, GroupDefaulted));
1433 }
1434
1435 /******************************************************************************
1436  * IsValidSecurityDescriptor [ADVAPI32.@]
1437  *
1438  * PARAMS
1439  *   lpsecdesc []
1440  */
1441 BOOL WINAPI
1442 IsValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor )
1443 {
1444     return set_ntstatus( RtlValidSecurityDescriptor(SecurityDescriptor));
1445 }
1446
1447 /******************************************************************************
1448  *  GetSecurityDescriptorDacl                   [ADVAPI32.@]
1449  */
1450 BOOL WINAPI GetSecurityDescriptorDacl(
1451         IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
1452         OUT LPBOOL lpbDaclPresent,
1453         OUT PACL *pDacl,
1454         OUT LPBOOL lpbDaclDefaulted)
1455 {
1456     BOOLEAN present, defaulted;
1457     BOOL ret = set_ntstatus( RtlGetDaclSecurityDescriptor(pSecurityDescriptor, &present, pDacl, &defaulted));
1458     *lpbDaclPresent = present;
1459     *lpbDaclDefaulted = defaulted;
1460     return ret;
1461 }
1462
1463 /******************************************************************************
1464  *  SetSecurityDescriptorDacl                   [ADVAPI32.@]
1465  */
1466 BOOL WINAPI
1467 SetSecurityDescriptorDacl (
1468         PSECURITY_DESCRIPTOR lpsd,
1469         BOOL daclpresent,
1470         PACL dacl,
1471         BOOL dacldefaulted )
1472 {
1473     return set_ntstatus( RtlSetDaclSecurityDescriptor (lpsd, daclpresent, dacl, dacldefaulted ) );
1474 }
1475 /******************************************************************************
1476  *  GetSecurityDescriptorSacl                   [ADVAPI32.@]
1477  */
1478 BOOL WINAPI GetSecurityDescriptorSacl(
1479         IN PSECURITY_DESCRIPTOR lpsd,
1480         OUT LPBOOL lpbSaclPresent,
1481         OUT PACL *pSacl,
1482         OUT LPBOOL lpbSaclDefaulted)
1483 {
1484     BOOLEAN present, defaulted;
1485     BOOL ret = set_ntstatus( RtlGetSaclSecurityDescriptor(lpsd, &present, pSacl, &defaulted) );
1486     *lpbSaclPresent = present;
1487     *lpbSaclDefaulted = defaulted;
1488     return ret;
1489 }
1490
1491 /**************************************************************************
1492  * SetSecurityDescriptorSacl                    [ADVAPI32.@]
1493  */
1494 BOOL WINAPI SetSecurityDescriptorSacl (
1495         PSECURITY_DESCRIPTOR lpsd,
1496         BOOL saclpresent,
1497         PACL lpsacl,
1498         BOOL sacldefaulted)
1499 {
1500     return set_ntstatus (RtlSetSaclSecurityDescriptor(lpsd, saclpresent, lpsacl, sacldefaulted));
1501 }
1502 /******************************************************************************
1503  * MakeSelfRelativeSD [ADVAPI32.@]
1504  *
1505  * PARAMS
1506  *   lpabssecdesc  []
1507  *   lpselfsecdesc []
1508  *   lpbuflen      []
1509  */
1510 BOOL WINAPI
1511 MakeSelfRelativeSD(
1512         IN PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
1513         IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
1514         IN OUT LPDWORD lpdwBufferLength)
1515 {
1516     return set_ntstatus( RtlMakeSelfRelativeSD( pAbsoluteSecurityDescriptor,
1517                                                 pSelfRelativeSecurityDescriptor, lpdwBufferLength));
1518 }
1519
1520 /******************************************************************************
1521  * GetSecurityDescriptorControl                 [ADVAPI32.@]
1522  */
1523
1524 BOOL WINAPI GetSecurityDescriptorControl ( PSECURITY_DESCRIPTOR  pSecurityDescriptor,
1525                  PSECURITY_DESCRIPTOR_CONTROL pControl, LPDWORD lpdwRevision)
1526 {
1527     return set_ntstatus( RtlGetControlSecurityDescriptor(pSecurityDescriptor,pControl,lpdwRevision));
1528 }
1529
1530 /******************************************************************************
1531  * SetSecurityDescriptorControl                 [ADVAPI32.@]
1532  */
1533 BOOL WINAPI SetSecurityDescriptorControl( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1534   SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest,
1535   SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet )
1536 {
1537     return set_ntstatus( RtlSetControlSecurityDescriptor(
1538         pSecurityDescriptor, ControlBitsOfInterest, ControlBitsToSet ) );
1539 }
1540
1541 /******************************************************************************
1542  * GetWindowsAccountDomainSid         [ADVAPI32.@]
1543  */
1544 BOOL WINAPI GetWindowsAccountDomainSid( PSID sid, PSID domain_sid, DWORD *size )
1545 {
1546     SID_IDENTIFIER_AUTHORITY domain_ident = { SECURITY_NT_AUTHORITY };
1547     DWORD required_size;
1548     int i;
1549
1550     FIXME( "(%p %p %p): semi-stub\n", sid, domain_sid, size );
1551
1552     if (!sid || !IsValidSid( sid ))
1553     {
1554         SetLastError( ERROR_INVALID_SID );
1555         return FALSE;
1556     }
1557
1558     if (!size)
1559     {
1560         SetLastError( ERROR_INVALID_PARAMETER );
1561         return FALSE;
1562     }
1563
1564     if (*GetSidSubAuthorityCount( sid ) < 4)
1565     {
1566         SetLastError( ERROR_INVALID_SID );
1567         return FALSE;
1568     }
1569
1570     required_size = GetSidLengthRequired( 4 );
1571     if (*size < required_size || !domain_sid)
1572     {
1573         *size = required_size;
1574         SetLastError( domain_sid ? ERROR_INSUFFICIENT_BUFFER :
1575                                    ERROR_INVALID_PARAMETER );
1576         return FALSE;
1577     }
1578
1579     InitializeSid( domain_sid, &domain_ident, 4 );
1580     for (i = 0; i < 4; i++)
1581         *GetSidSubAuthority( domain_sid, i ) = *GetSidSubAuthority( sid, i );
1582
1583     *size = required_size;
1584     return TRUE;
1585 }
1586
1587 /*      ##############################
1588         ######  ACL FUNCTIONS   ######
1589         ##############################
1590 */
1591
1592 /*************************************************************************
1593  * InitializeAcl [ADVAPI32.@]
1594  */
1595 BOOL WINAPI InitializeAcl(PACL acl, DWORD size, DWORD rev)
1596 {
1597     return set_ntstatus( RtlCreateAcl(acl, size, rev));
1598 }
1599
1600 BOOL WINAPI ImpersonateNamedPipeClient( HANDLE hNamedPipe )
1601 {
1602     IO_STATUS_BLOCK io_block;
1603
1604     TRACE("(%p)\n", hNamedPipe);
1605
1606     return set_ntstatus( NtFsControlFile(hNamedPipe, NULL, NULL, NULL,
1607                          &io_block, FSCTL_PIPE_IMPERSONATE, NULL, 0, NULL, 0) );
1608 }
1609
1610 /******************************************************************************
1611  *  AddAccessAllowedAce [ADVAPI32.@]
1612  */
1613 BOOL WINAPI AddAccessAllowedAce(
1614         IN OUT PACL pAcl,
1615         IN DWORD dwAceRevision,
1616         IN DWORD AccessMask,
1617         IN PSID pSid)
1618 {
1619     return set_ntstatus(RtlAddAccessAllowedAce(pAcl, dwAceRevision, AccessMask, pSid));
1620 }
1621
1622 /******************************************************************************
1623  *  AddAccessAllowedAceEx [ADVAPI32.@]
1624  */
1625 BOOL WINAPI AddAccessAllowedAceEx(
1626         IN OUT PACL pAcl,
1627         IN DWORD dwAceRevision,
1628         IN DWORD AceFlags,
1629         IN DWORD AccessMask,
1630         IN PSID pSid)
1631 {
1632     return set_ntstatus(RtlAddAccessAllowedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid));
1633 }
1634
1635 /******************************************************************************
1636  *  AddAccessAllowedObjectAce [ADVAPI32.@]
1637  */
1638 BOOL WINAPI AddAccessAllowedObjectAce(
1639         IN OUT PACL pAcl,
1640         IN DWORD dwAceRevision,
1641         IN DWORD dwAceFlags,
1642         IN DWORD dwAccessMask,
1643         IN GUID* pObjectTypeGuid,
1644         IN GUID* pInheritedObjectTypeGuid,
1645         IN PSID pSid)
1646 {
1647     return set_ntstatus(RtlAddAccessAllowedObjectAce(pAcl, dwAceRevision, dwAceFlags, dwAccessMask,
1648                         pObjectTypeGuid, pInheritedObjectTypeGuid, pSid));
1649 }
1650
1651 /******************************************************************************
1652  *  AddAccessDeniedAce [ADVAPI32.@]
1653  */
1654 BOOL WINAPI AddAccessDeniedAce(
1655         IN OUT PACL pAcl,
1656         IN DWORD dwAceRevision,
1657         IN DWORD AccessMask,
1658         IN PSID pSid)
1659 {
1660     return set_ntstatus(RtlAddAccessDeniedAce(pAcl, dwAceRevision, AccessMask, pSid));
1661 }
1662
1663 /******************************************************************************
1664  *  AddAccessDeniedAceEx [ADVAPI32.@]
1665  */
1666 BOOL WINAPI AddAccessDeniedAceEx(
1667         IN OUT PACL pAcl,
1668         IN DWORD dwAceRevision,
1669         IN DWORD AceFlags,
1670         IN DWORD AccessMask,
1671         IN PSID pSid)
1672 {
1673     return set_ntstatus(RtlAddAccessDeniedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid));
1674 }
1675
1676 /******************************************************************************
1677  *  AddAccessDeniedObjectAce [ADVAPI32.@]
1678  */
1679 BOOL WINAPI AddAccessDeniedObjectAce(
1680     IN OUT PACL pAcl,
1681     IN DWORD dwAceRevision,
1682     IN DWORD dwAceFlags,
1683     IN DWORD dwAccessMask,
1684     IN GUID* pObjectTypeGuid,
1685     IN GUID* pInheritedObjectTypeGuid,
1686     IN PSID pSid)
1687 {
1688     return set_ntstatus( RtlAddAccessDeniedObjectAce(pAcl, dwAceRevision, dwAceFlags, dwAccessMask,
1689                          pObjectTypeGuid, pInheritedObjectTypeGuid, pSid) );
1690 }
1691
1692 /******************************************************************************
1693  *  AddAce [ADVAPI32.@]
1694  */
1695 BOOL WINAPI AddAce(
1696         IN OUT PACL pAcl,
1697         IN DWORD dwAceRevision,
1698         IN DWORD dwStartingAceIndex,
1699         LPVOID pAceList,
1700         DWORD nAceListLength)
1701 {
1702     return set_ntstatus(RtlAddAce(pAcl, dwAceRevision, dwStartingAceIndex, pAceList, nAceListLength));
1703 }
1704
1705 /******************************************************************************
1706  *  AddMandatoryAce [ADVAPI32.@]
1707  */
1708 BOOL WINAPI AddMandatoryAce(ACL *acl, DWORD ace_revision, DWORD ace_flags, DWORD mandatory_policy, PSID label_sid)
1709 {
1710     return set_ntstatus(RtlAddMandatoryAce(acl, ace_revision, ace_flags, mandatory_policy,
1711                                            SYSTEM_MANDATORY_LABEL_ACE_TYPE, label_sid));
1712 }
1713
1714 /******************************************************************************
1715  * DeleteAce [ADVAPI32.@]
1716  */
1717 BOOL WINAPI DeleteAce(PACL pAcl, DWORD dwAceIndex)
1718 {
1719     return set_ntstatus(RtlDeleteAce(pAcl, dwAceIndex));
1720 }
1721
1722 /******************************************************************************
1723  *  FindFirstFreeAce [ADVAPI32.@]
1724  */
1725 BOOL WINAPI FindFirstFreeAce(IN PACL pAcl, LPVOID * pAce)
1726 {
1727         return RtlFirstFreeAce(pAcl, (PACE_HEADER *)pAce);
1728 }
1729
1730 /******************************************************************************
1731  * GetAce [ADVAPI32.@]
1732  */
1733 BOOL WINAPI GetAce(PACL pAcl,DWORD dwAceIndex,LPVOID *pAce )
1734 {
1735     return set_ntstatus(RtlGetAce(pAcl, dwAceIndex, pAce));
1736 }
1737
1738 /******************************************************************************
1739  * GetAclInformation [ADVAPI32.@]
1740  */
1741 BOOL WINAPI GetAclInformation(
1742   PACL pAcl,
1743   LPVOID pAclInformation,
1744   DWORD nAclInformationLength,
1745   ACL_INFORMATION_CLASS dwAclInformationClass)
1746 {
1747     return set_ntstatus(RtlQueryInformationAcl(pAcl, pAclInformation,
1748                                                nAclInformationLength, dwAclInformationClass));
1749 }
1750
1751 /******************************************************************************
1752  *  IsValidAcl [ADVAPI32.@]
1753  */
1754 BOOL WINAPI IsValidAcl(IN PACL pAcl)
1755 {
1756         return RtlValidAcl(pAcl);
1757 }
1758
1759 /*      ##############################
1760         ######  MISC FUNCTIONS  ######
1761         ##############################
1762 */
1763
1764 /******************************************************************************
1765  * AllocateLocallyUniqueId [ADVAPI32.@]
1766  *
1767  * PARAMS
1768  *   lpLuid []
1769  */
1770 BOOL WINAPI AllocateLocallyUniqueId( PLUID lpLuid )
1771 {
1772     return set_ntstatus(NtAllocateLocallyUniqueId(lpLuid));
1773 }
1774
1775 static const WCHAR SE_CREATE_TOKEN_NAME_W[] =
1776  { 'S','e','C','r','e','a','t','e','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 };
1777 static const WCHAR SE_ASSIGNPRIMARYTOKEN_NAME_W[] =
1778  { 'S','e','A','s','s','i','g','n','P','r','i','m','a','r','y','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 };
1779 static const WCHAR SE_LOCK_MEMORY_NAME_W[] =
1780  { 'S','e','L','o','c','k','M','e','m','o','r','y','P','r','i','v','i','l','e','g','e',0 };
1781 static const WCHAR SE_INCREASE_QUOTA_NAME_W[] =
1782  { 'S','e','I','n','c','r','e','a','s','e','Q','u','o','t','a','P','r','i','v','i','l','e','g','e',0 };
1783 static const WCHAR SE_MACHINE_ACCOUNT_NAME_W[] =
1784  { 'S','e','M','a','c','h','i','n','e','A','c','c','o','u','n','t','P','r','i','v','i','l','e','g','e',0 };
1785 static const WCHAR SE_TCB_NAME_W[] =
1786  { 'S','e','T','c','b','P','r','i','v','i','l','e','g','e',0 };
1787 static const WCHAR SE_SECURITY_NAME_W[] =
1788  { 'S','e','S','e','c','u','r','i','t','y','P','r','i','v','i','l','e','g','e',0 };
1789 static const WCHAR SE_TAKE_OWNERSHIP_NAME_W[] =
1790  { 'S','e','T','a','k','e','O','w','n','e','r','s','h','i','p','P','r','i','v','i','l','e','g','e',0 };
1791 static const WCHAR SE_LOAD_DRIVER_NAME_W[] =
1792  { 'S','e','L','o','a','d','D','r','i','v','e','r','P','r','i','v','i','l','e','g','e',0 };
1793 static const WCHAR SE_SYSTEM_PROFILE_NAME_W[] =
1794  { 'S','e','S','y','s','t','e','m','P','r','o','f','i','l','e','P','r','i','v','i','l','e','g','e',0 };
1795 static const WCHAR SE_SYSTEMTIME_NAME_W[] =
1796  { 'S','e','S','y','s','t','e','m','t','i','m','e','P','r','i','v','i','l','e','g','e',0 };
1797 static const WCHAR SE_PROF_SINGLE_PROCESS_NAME_W[] =
1798  { 'S','e','P','r','o','f','i','l','e','S','i','n','g','l','e','P','r','o','c','e','s','s','P','r','i','v','i','l','e','g','e',0 };
1799 static const WCHAR SE_INC_BASE_PRIORITY_NAME_W[] =
1800  { 'S','e','I','n','c','r','e','a','s','e','B','a','s','e','P','r','i','o','r','i','t','y','P','r','i','v','i','l','e','g','e',0 };
1801 static const WCHAR SE_CREATE_PAGEFILE_NAME_W[] =
1802  { 'S','e','C','r','e','a','t','e','P','a','g','e','f','i','l','e','P','r','i','v','i','l','e','g','e',0 };
1803 static const WCHAR SE_CREATE_PERMANENT_NAME_W[] =
1804  { 'S','e','C','r','e','a','t','e','P','e','r','m','a','n','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1805 static const WCHAR SE_BACKUP_NAME_W[] =
1806  { 'S','e','B','a','c','k','u','p','P','r','i','v','i','l','e','g','e',0 };
1807 static const WCHAR SE_RESTORE_NAME_W[] =
1808  { 'S','e','R','e','s','t','o','r','e','P','r','i','v','i','l','e','g','e',0 };
1809 static const WCHAR SE_SHUTDOWN_NAME_W[] =
1810  { 'S','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 };
1811 static const WCHAR SE_DEBUG_NAME_W[] =
1812  { 'S','e','D','e','b','u','g','P','r','i','v','i','l','e','g','e',0 };
1813 static const WCHAR SE_AUDIT_NAME_W[] =
1814  { 'S','e','A','u','d','i','t','P','r','i','v','i','l','e','g','e',0 };
1815 static const WCHAR SE_SYSTEM_ENVIRONMENT_NAME_W[] =
1816  { 'S','e','S','y','s','t','e','m','E','n','v','i','r','o','n','m','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1817 static const WCHAR SE_CHANGE_NOTIFY_NAME_W[] =
1818  { 'S','e','C','h','a','n','g','e','N','o','t','i','f','y','P','r','i','v','i','l','e','g','e',0 };
1819 static const WCHAR SE_REMOTE_SHUTDOWN_NAME_W[] =
1820  { 'S','e','R','e','m','o','t','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 };
1821 static const WCHAR SE_UNDOCK_NAME_W[] =
1822  { 'S','e','U','n','d','o','c','k','P','r','i','v','i','l','e','g','e',0 };
1823 static const WCHAR SE_SYNC_AGENT_NAME_W[] =
1824  { 'S','e','S','y','n','c','A','g','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1825 static const WCHAR SE_ENABLE_DELEGATION_NAME_W[] =
1826  { 'S','e','E','n','a','b','l','e','D','e','l','e','g','a','t','i','o','n','P','r','i','v','i','l','e','g','e',0 };
1827 static const WCHAR SE_MANAGE_VOLUME_NAME_W[] =
1828  { 'S','e','M','a','n','a','g','e','V','o','l','u','m','e','P','r','i','v','i','l','e','g','e',0 };
1829 static const WCHAR SE_IMPERSONATE_NAME_W[] =
1830  { 'S','e','I','m','p','e','r','s','o','n','a','t','e','P','r','i','v','i','l','e','g','e',0 };
1831 static const WCHAR SE_CREATE_GLOBAL_NAME_W[] =
1832  { 'S','e','C','r','e','a','t','e','G','l','o','b','a','l','P','r','i','v','i','l','e','g','e',0 };
1833
1834 static const WCHAR * const WellKnownPrivNames[SE_MAX_WELL_KNOWN_PRIVILEGE + 1] =
1835 {
1836     NULL,
1837     NULL,
1838     SE_CREATE_TOKEN_NAME_W,
1839     SE_ASSIGNPRIMARYTOKEN_NAME_W,
1840     SE_LOCK_MEMORY_NAME_W,
1841     SE_INCREASE_QUOTA_NAME_W,
1842     SE_MACHINE_ACCOUNT_NAME_W,
1843     SE_TCB_NAME_W,
1844     SE_SECURITY_NAME_W,
1845     SE_TAKE_OWNERSHIP_NAME_W,
1846     SE_LOAD_DRIVER_NAME_W,
1847     SE_SYSTEM_PROFILE_NAME_W,
1848     SE_SYSTEMTIME_NAME_W,
1849     SE_PROF_SINGLE_PROCESS_NAME_W,
1850     SE_INC_BASE_PRIORITY_NAME_W,
1851     SE_CREATE_PAGEFILE_NAME_W,
1852     SE_CREATE_PERMANENT_NAME_W,
1853     SE_BACKUP_NAME_W,
1854     SE_RESTORE_NAME_W,
1855     SE_SHUTDOWN_NAME_W,
1856     SE_DEBUG_NAME_W,
1857     SE_AUDIT_NAME_W,
1858     SE_SYSTEM_ENVIRONMENT_NAME_W,
1859     SE_CHANGE_NOTIFY_NAME_W,
1860     SE_REMOTE_SHUTDOWN_NAME_W,
1861     SE_UNDOCK_NAME_W,
1862     SE_SYNC_AGENT_NAME_W,
1863     SE_ENABLE_DELEGATION_NAME_W,
1864     SE_MANAGE_VOLUME_NAME_W,
1865     SE_IMPERSONATE_NAME_W,
1866     SE_CREATE_GLOBAL_NAME_W,
1867 };
1868
1869 const WCHAR *get_wellknown_privilege_name(const LUID *luid)
1870 {
1871     if (luid->HighPart || luid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
1872             luid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE || !WellKnownPrivNames[luid->LowPart])
1873         return NULL;
1874
1875     return WellKnownPrivNames[luid->LowPart];
1876 }
1877
1878 /******************************************************************************
1879  * LookupPrivilegeValueW                        [ADVAPI32.@]
1880  *
1881  * See LookupPrivilegeValueA.
1882  */
1883 BOOL WINAPI
1884 LookupPrivilegeValueW( LPCWSTR lpSystemName, LPCWSTR lpName, PLUID lpLuid )
1885 {
1886     UINT i;
1887
1888     TRACE("%s,%s,%p\n",debugstr_w(lpSystemName), debugstr_w(lpName), lpLuid);
1889
1890     if (!ADVAPI_IsLocalComputer(lpSystemName))
1891     {
1892         SetLastError(RPC_S_SERVER_UNAVAILABLE);
1893         return FALSE;
1894     }
1895     if (!lpName)
1896     {
1897         SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1898         return FALSE;
1899     }
1900     for( i=SE_MIN_WELL_KNOWN_PRIVILEGE; i<=SE_MAX_WELL_KNOWN_PRIVILEGE; i++ )
1901     {
1902         if( !WellKnownPrivNames[i] )
1903             continue;
1904         if( strcmpiW( WellKnownPrivNames[i], lpName) )
1905             continue;
1906         lpLuid->LowPart = i;
1907         lpLuid->HighPart = 0;
1908         TRACE( "%s -> %08x-%08x\n",debugstr_w( lpSystemName ),
1909                lpLuid->HighPart, lpLuid->LowPart );
1910         return TRUE;
1911     }
1912     SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1913     return FALSE;
1914 }
1915
1916 /******************************************************************************
1917  * LookupPrivilegeValueA                        [ADVAPI32.@]
1918  *
1919  * Retrieves LUID used on a system to represent the privilege name.
1920  *
1921  * PARAMS
1922  *  lpSystemName [I] Name of the system
1923  *  lpName       [I] Name of the privilege
1924  *  lpLuid       [O] Destination for the resulting LUID
1925  *
1926  * RETURNS
1927  *  Success: TRUE. lpLuid contains the requested LUID.
1928  *  Failure: FALSE.
1929  */
1930 BOOL WINAPI
1931 LookupPrivilegeValueA( LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid )
1932 {
1933     UNICODE_STRING lpSystemNameW;
1934     UNICODE_STRING lpNameW;
1935     BOOL ret;
1936
1937     RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
1938     RtlCreateUnicodeStringFromAsciiz(&lpNameW,lpName);
1939     ret = LookupPrivilegeValueW(lpSystemNameW.Buffer, lpNameW.Buffer, lpLuid);
1940     RtlFreeUnicodeString(&lpNameW);
1941     RtlFreeUnicodeString(&lpSystemNameW);
1942     return ret;
1943 }
1944
1945 BOOL WINAPI LookupPrivilegeDisplayNameA( LPCSTR lpSystemName, LPCSTR lpName, LPSTR lpDisplayName,
1946                                          LPDWORD cchDisplayName, LPDWORD lpLanguageId )
1947 {
1948     FIXME("%s %s %s %p %p - stub\n", debugstr_a(lpSystemName), debugstr_a(lpName),
1949           debugstr_a(lpDisplayName), cchDisplayName, lpLanguageId);
1950
1951     return FALSE;
1952 }
1953
1954 BOOL WINAPI LookupPrivilegeDisplayNameW( LPCWSTR lpSystemName, LPCWSTR lpName, LPWSTR lpDisplayName,
1955                                          LPDWORD cchDisplayName, LPDWORD lpLanguageId )
1956 {
1957     FIXME("%s %s %s %p %p - stub\n", debugstr_w(lpSystemName), debugstr_w(lpName),
1958           debugstr_w(lpDisplayName), cchDisplayName, lpLanguageId);
1959
1960     return FALSE;
1961 }
1962
1963 /******************************************************************************
1964  * LookupPrivilegeNameA                 [ADVAPI32.@]
1965  *
1966  * See LookupPrivilegeNameW.
1967  */
1968 BOOL WINAPI
1969 LookupPrivilegeNameA( LPCSTR lpSystemName, PLUID lpLuid, LPSTR lpName,
1970  LPDWORD cchName)
1971 {
1972     UNICODE_STRING lpSystemNameW;
1973     BOOL ret;
1974     DWORD wLen = 0;
1975
1976     TRACE("%s %p %p %p\n", debugstr_a(lpSystemName), lpLuid, lpName, cchName);
1977
1978     RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
1979     ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, NULL, &wLen);
1980     if (!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
1981     {
1982         LPWSTR lpNameW = heap_alloc(wLen * sizeof(WCHAR));
1983
1984         ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, lpNameW,
1985          &wLen);
1986         if (ret)
1987         {
1988             /* Windows crashes if cchName is NULL, so will I */
1989             unsigned int len = WideCharToMultiByte(CP_ACP, 0, lpNameW, -1, lpName,
1990              *cchName, NULL, NULL);
1991
1992             if (len == 0)
1993             {
1994                 /* WideCharToMultiByte failed */
1995                 ret = FALSE;
1996             }
1997             else if (len > *cchName)
1998             {
1999                 *cchName = len;
2000                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2001                 ret = FALSE;
2002             }
2003             else
2004             {
2005                 /* WideCharToMultiByte succeeded, output length needs to be
2006                  * length not including NULL terminator
2007                  */
2008                 *cchName = len - 1;
2009             }
2010         }
2011         heap_free(lpNameW);
2012     }
2013     RtlFreeUnicodeString(&lpSystemNameW);
2014     return ret;
2015 }
2016
2017 /******************************************************************************
2018  * LookupPrivilegeNameW                 [ADVAPI32.@]
2019  *
2020  * Retrieves the privilege name referred to by the LUID lpLuid.
2021  *
2022  * PARAMS
2023  *  lpSystemName [I]   Name of the system
2024  *  lpLuid       [I]   Privilege value
2025  *  lpName       [O]   Name of the privilege
2026  *  cchName      [I/O] Number of characters in lpName.
2027  *
2028  * RETURNS
2029  *  Success: TRUE. lpName contains the name of the privilege whose value is
2030  *  *lpLuid.
2031  *  Failure: FALSE.
2032  *
2033  * REMARKS
2034  *  Only well-known privilege names (those defined in winnt.h) can be retrieved
2035  *  using this function.
2036  *  If the length of lpName is too small, on return *cchName will contain the
2037  *  number of WCHARs needed to contain the privilege, including the NULL
2038  *  terminator, and GetLastError will return ERROR_INSUFFICIENT_BUFFER.
2039  *  On success, *cchName will contain the number of characters stored in
2040  *  lpName, NOT including the NULL terminator.
2041  */
2042 BOOL WINAPI
2043 LookupPrivilegeNameW( LPCWSTR lpSystemName, PLUID lpLuid, LPWSTR lpName,
2044  LPDWORD cchName)
2045 {
2046     size_t privNameLen;
2047
2048     TRACE("%s,%p,%p,%p\n",debugstr_w(lpSystemName), lpLuid, lpName, cchName);
2049
2050     if (!ADVAPI_IsLocalComputer(lpSystemName))
2051     {
2052         SetLastError(RPC_S_SERVER_UNAVAILABLE);
2053         return FALSE;
2054     }
2055     if (lpLuid->HighPart || (lpLuid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
2056      lpLuid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE))
2057     {
2058         SetLastError(ERROR_NO_SUCH_PRIVILEGE);
2059         return FALSE;
2060     }
2061     privNameLen = strlenW(WellKnownPrivNames[lpLuid->LowPart]);
2062     /* Windows crashes if cchName is NULL, so will I */
2063     if (*cchName <= privNameLen)
2064     {
2065         *cchName = privNameLen + 1;
2066         SetLastError(ERROR_INSUFFICIENT_BUFFER);
2067         return FALSE;
2068     }
2069     else
2070     {
2071         strcpyW(lpName, WellKnownPrivNames[lpLuid->LowPart]);
2072         *cchName = privNameLen;
2073         return TRUE;
2074     }
2075 }
2076
2077 /******************************************************************************
2078  * GetFileSecurityA [ADVAPI32.@]
2079  *
2080  * Obtains Specified information about the security of a file or directory.
2081  *
2082  * PARAMS
2083  *  lpFileName           [I] Name of the file to get info for
2084  *  RequestedInformation [I] SE_ flags from "winnt.h"
2085  *  pSecurityDescriptor  [O] Destination for security information
2086  *  nLength              [I] Length of pSecurityDescriptor
2087  *  lpnLengthNeeded      [O] Destination for length of returned security information
2088  *
2089  * RETURNS
2090  *  Success: TRUE. pSecurityDescriptor contains the requested information.
2091  *  Failure: FALSE. lpnLengthNeeded contains the required space to return the info.
2092  *
2093  * NOTES
2094  *  The information returned is constrained by the callers access rights and
2095  *  privileges.
2096  */
2097 BOOL WINAPI
2098 GetFileSecurityA( LPCSTR lpFileName,
2099                     SECURITY_INFORMATION RequestedInformation,
2100                     PSECURITY_DESCRIPTOR pSecurityDescriptor,
2101                     DWORD nLength, LPDWORD lpnLengthNeeded )
2102 {
2103     BOOL r;
2104     LPWSTR name;
2105
2106     name = SERV_dup(lpFileName);
2107     r = GetFileSecurityW( name, RequestedInformation, pSecurityDescriptor,
2108                           nLength, lpnLengthNeeded );
2109     heap_free( name );
2110
2111     return r;
2112 }
2113
2114 /******************************************************************************
2115  * GetFileSecurityW [ADVAPI32.@]
2116  *
2117  * See GetFileSecurityA.
2118  */
2119 BOOL WINAPI
2120 GetFileSecurityW( LPCWSTR lpFileName,
2121                     SECURITY_INFORMATION RequestedInformation,
2122                     PSECURITY_DESCRIPTOR pSecurityDescriptor,
2123                     DWORD nLength, LPDWORD lpnLengthNeeded )
2124 {
2125     HANDLE hfile;
2126     NTSTATUS status;
2127     DWORD access = 0, err;
2128
2129     TRACE("(%s,%d,%p,%d,%p)\n", debugstr_w(lpFileName),
2130           RequestedInformation, pSecurityDescriptor,
2131           nLength, lpnLengthNeeded);
2132
2133     if (RequestedInformation & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|
2134                                 DACL_SECURITY_INFORMATION))
2135         access |= READ_CONTROL;
2136     if (RequestedInformation & SACL_SECURITY_INFORMATION)
2137         access |= ACCESS_SYSTEM_SECURITY;
2138
2139     err = get_security_file( lpFileName, access, &hfile);
2140     if (err)
2141     {
2142         SetLastError(err);
2143         return FALSE;
2144     }
2145
2146     status = NtQuerySecurityObject( hfile, RequestedInformation, pSecurityDescriptor,
2147                                     nLength, lpnLengthNeeded );
2148     CloseHandle( hfile );
2149     return set_ntstatus( status );
2150 }
2151
2152
2153 /******************************************************************************
2154  * LookupAccountSidA [ADVAPI32.@]
2155  */
2156 BOOL WINAPI
2157 LookupAccountSidA(
2158         IN LPCSTR system,
2159         IN PSID sid,
2160         OUT LPSTR account,
2161         IN OUT LPDWORD accountSize,
2162         OUT LPSTR domain,
2163         IN OUT LPDWORD domainSize,
2164         OUT PSID_NAME_USE name_use )
2165 {
2166     DWORD len;
2167     BOOL r;
2168     LPWSTR systemW;
2169     LPWSTR accountW = NULL;
2170     LPWSTR domainW = NULL;
2171     DWORD accountSizeW = *accountSize;
2172     DWORD domainSizeW = *domainSize;
2173
2174     systemW = SERV_dup(system);
2175     if (account)
2176         accountW = heap_alloc( accountSizeW * sizeof(WCHAR) );
2177     if (domain)
2178         domainW = heap_alloc( domainSizeW * sizeof(WCHAR) );
2179
2180     r = LookupAccountSidW( systemW, sid, accountW, &accountSizeW, domainW, &domainSizeW, name_use );
2181
2182     if (r) {
2183         if (accountW && *accountSize) {
2184             len = WideCharToMultiByte( CP_ACP, 0, accountW, -1, NULL, 0, NULL, NULL );
2185             WideCharToMultiByte( CP_ACP, 0, accountW, -1, account, len, NULL, NULL );
2186             *accountSize = len;
2187         } else
2188             *accountSize = accountSizeW + 1;
2189
2190         if (domainW && *domainSize) {
2191             len = WideCharToMultiByte( CP_ACP, 0, domainW, -1, NULL, 0, NULL, NULL );
2192             WideCharToMultiByte( CP_ACP, 0, domainW, -1, domain, len, NULL, NULL );
2193             *domainSize = len;
2194         } else
2195             *domainSize = domainSizeW + 1;
2196     }
2197     else
2198     {
2199         *accountSize = accountSizeW + 1;
2200         *domainSize = domainSizeW + 1;
2201     }
2202
2203     heap_free( systemW );
2204     heap_free( accountW );
2205     heap_free( domainW );
2206
2207     return r;
2208 }
2209
2210 /******************************************************************************
2211  * LookupAccountSidW [ADVAPI32.@]
2212  *
2213  * PARAMS
2214  *   system      []
2215  *   sid         []
2216  *   account     []
2217  *   accountSize []
2218  *   domain      []
2219  *   domainSize  []
2220  *   name_use    []
2221  */
2222
2223 BOOL WINAPI
2224 LookupAccountSidW(
2225         IN LPCWSTR system,
2226         IN PSID sid,
2227         OUT LPWSTR account,
2228         IN OUT LPDWORD accountSize,
2229         OUT LPWSTR domain,
2230         IN OUT LPDWORD domainSize,
2231         OUT PSID_NAME_USE name_use )
2232 {
2233     unsigned int i, j;
2234     const WCHAR * ac = NULL;
2235     const WCHAR * dm = NULL;
2236     SID_NAME_USE use = 0;
2237     LPWSTR computer_name = NULL;
2238     LPWSTR account_name = NULL;
2239
2240     TRACE("(%s,sid=%s,%p,%p(%u),%p,%p(%u),%p)\n",
2241           debugstr_w(system),debugstr_sid(sid),
2242           account,accountSize,accountSize?*accountSize:0,
2243           domain,domainSize,domainSize?*domainSize:0,
2244           name_use);
2245
2246     if (!ADVAPI_IsLocalComputer(system)) {
2247         FIXME("Only local computer supported!\n");
2248         SetLastError(RPC_S_SERVER_UNAVAILABLE);
2249         return FALSE;
2250     }
2251
2252     /* check the well known SIDs first */
2253     for (i = 0; i <= WinAccountProtectedUsersSid; i++) {
2254         if (IsWellKnownSid(sid, i)) {
2255             for (j = 0; j < (sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0])); j++) {
2256                 if (ACCOUNT_SIDS[j].type == i) {
2257                     ac = ACCOUNT_SIDS[j].account;
2258                     dm = ACCOUNT_SIDS[j].domain;
2259                     use = ACCOUNT_SIDS[j].name_use;
2260                 }
2261             }
2262             break;
2263         }
2264     }
2265
2266     if (dm == NULL) {
2267         MAX_SID local;
2268
2269         /* check for the local computer next */
2270         if (ADVAPI_GetComputerSid(&local)) {
2271             DWORD size = MAX_COMPUTERNAME_LENGTH + 1;
2272             BOOL result;
2273
2274             computer_name = heap_alloc(size * sizeof(WCHAR));
2275             result = GetComputerNameW(computer_name,  &size);
2276
2277             if (result) {
2278                 if (EqualSid(sid, &local)) {
2279                     dm = computer_name;
2280                     ac = Blank;
2281                     use = 3;
2282                 } else {
2283                     local.SubAuthorityCount++;
2284
2285                     if (EqualPrefixSid(sid, &local)) {
2286                         dm = computer_name;
2287                         use = 1;
2288                         switch (((MAX_SID *)sid)->SubAuthority[4]) {
2289                         case DOMAIN_USER_RID_ADMIN:
2290                             ac = Administrator;
2291                             break;
2292                         case DOMAIN_USER_RID_GUEST:
2293                             ac = Guest;
2294                             break;
2295                         case DOMAIN_GROUP_RID_ADMINS:
2296                             ac = Domain_Admins;
2297                             break;
2298                         case DOMAIN_GROUP_RID_USERS:
2299                             ac = Domain_Users;
2300                             break;
2301                         case DOMAIN_GROUP_RID_GUESTS:
2302                             ac = Domain_Guests;
2303                             break;
2304                         case DOMAIN_GROUP_RID_COMPUTERS:
2305                             ac = Domain_Computers;
2306                             break;
2307                         case DOMAIN_GROUP_RID_CONTROLLERS:
2308                             ac = Domain_Controllers;
2309                             break;
2310                         case DOMAIN_GROUP_RID_CERT_ADMINS:
2311                             ac = Cert_Publishers;
2312                             break;
2313                         case DOMAIN_GROUP_RID_SCHEMA_ADMINS:
2314                             ac = Schema_Admins;
2315                             break;
2316                         case DOMAIN_GROUP_RID_ENTERPRISE_ADMINS:
2317                             ac = Enterprise_Admins;
2318                             break;
2319                         case DOMAIN_GROUP_RID_POLICY_ADMINS:
2320                             ac = Group_Policy_Creator_Owners;
2321                             break;
2322                         case DOMAIN_ALIAS_RID_RAS_SERVERS:
2323                             ac = RAS_and_IAS_Servers;
2324                             break;
2325                         case 1000:      /* first user account */
2326                             size = UNLEN + 1;
2327                             account_name = heap_alloc(size * sizeof(WCHAR));
2328                             if (GetUserNameW(account_name, &size))
2329                                 ac = account_name;
2330                             else
2331                                 dm = NULL;
2332
2333                             break;
2334                         default:
2335                             dm = NULL;
2336                             break;
2337                         }
2338                     }
2339                 }
2340             }
2341         }
2342     }
2343
2344     if (dm) {
2345         DWORD ac_len = lstrlenW(ac);
2346         DWORD dm_len = lstrlenW(dm);
2347         BOOL status = TRUE;
2348
2349         if (*accountSize > ac_len) {
2350             if (account)
2351                 lstrcpyW(account, ac);
2352         }
2353         if (*domainSize > dm_len) {
2354             if (domain)
2355                 lstrcpyW(domain, dm);
2356         }
2357         if ((*accountSize && *accountSize < ac_len) ||
2358             (!account && !*accountSize && ac_len)   ||
2359             (*domainSize && *domainSize < dm_len)   ||
2360             (!domain && !*domainSize && dm_len))
2361         {
2362             SetLastError(ERROR_INSUFFICIENT_BUFFER);
2363             status = FALSE;
2364         }
2365         if (*domainSize)
2366             *domainSize = dm_len;
2367         else
2368             *domainSize = dm_len + 1;
2369         if (*accountSize)
2370             *accountSize = ac_len;
2371         else
2372             *accountSize = ac_len + 1;
2373
2374         heap_free(account_name);
2375         heap_free(computer_name);
2376         if (status) *name_use = use;
2377         return status;
2378     }
2379
2380     heap_free(account_name);
2381     heap_free(computer_name);
2382     SetLastError(ERROR_NONE_MAPPED);
2383     return FALSE;
2384 }
2385
2386 /******************************************************************************
2387  * SetFileSecurityA [ADVAPI32.@]
2388  *
2389  * See SetFileSecurityW.
2390  */
2391 BOOL WINAPI SetFileSecurityA( LPCSTR lpFileName,
2392                                 SECURITY_INFORMATION RequestedInformation,
2393                                 PSECURITY_DESCRIPTOR pSecurityDescriptor)
2394 {
2395     BOOL r;
2396     LPWSTR name;
2397
2398     name = SERV_dup(lpFileName);
2399     r = SetFileSecurityW( name, RequestedInformation, pSecurityDescriptor );
2400     heap_free( name );
2401
2402     return r;
2403 }
2404
2405 /******************************************************************************
2406  * SetFileSecurityW [ADVAPI32.@]
2407  *
2408  * Sets the security of a file or directory.
2409  *
2410  * PARAMS
2411  *   lpFileName           []
2412  *   RequestedInformation []
2413  *   pSecurityDescriptor  []
2414  *
2415  * RETURNS
2416  *  Success: TRUE.
2417  *  Failure: FALSE.
2418  */
2419 BOOL WINAPI
2420 SetFileSecurityW( LPCWSTR lpFileName,
2421                     SECURITY_INFORMATION RequestedInformation,
2422                     PSECURITY_DESCRIPTOR pSecurityDescriptor )
2423 {
2424     HANDLE file;
2425     DWORD access = 0, err;
2426     NTSTATUS status;
2427
2428     TRACE("(%s, 0x%x, %p)\n", debugstr_w(lpFileName), RequestedInformation,
2429           pSecurityDescriptor );
2430
2431     if (RequestedInformation & OWNER_SECURITY_INFORMATION ||
2432         RequestedInformation & GROUP_SECURITY_INFORMATION)
2433         access |= WRITE_OWNER;
2434     if (RequestedInformation & SACL_SECURITY_INFORMATION)
2435         access |= ACCESS_SYSTEM_SECURITY;
2436     if (RequestedInformation & DACL_SECURITY_INFORMATION)
2437         access |= WRITE_DAC;
2438
2439     err = get_security_file( lpFileName, access, &file);
2440     if (err)
2441     {
2442         SetLastError(err);
2443         return FALSE;
2444     }
2445
2446     status = NtSetSecurityObject( file, RequestedInformation, pSecurityDescriptor );
2447     CloseHandle( file );
2448     return set_ntstatus( status );
2449 }
2450
2451 /******************************************************************************
2452  * QueryWindows31FilesMigration [ADVAPI32.@]
2453  *
2454  * PARAMS
2455  *   x1 []
2456  */
2457 BOOL WINAPI
2458 QueryWindows31FilesMigration( DWORD x1 )
2459 {
2460         FIXME("(%d):stub\n",x1);
2461         return TRUE;
2462 }
2463
2464 /******************************************************************************
2465  * SynchronizeWindows31FilesAndWindowsNTRegistry [ADVAPI32.@]
2466  *
2467  * PARAMS
2468  *   x1 []
2469  *   x2 []
2470  *   x3 []
2471  *   x4 []
2472  */
2473 BOOL WINAPI
2474 SynchronizeWindows31FilesAndWindowsNTRegistry( DWORD x1, DWORD x2, DWORD x3,
2475                                                DWORD x4 )
2476 {
2477         FIXME("(0x%08x,0x%08x,0x%08x,0x%08x):stub\n",x1,x2,x3,x4);
2478         return TRUE;
2479 }
2480
2481 /******************************************************************************
2482  * NotifyBootConfigStatus [ADVAPI32.@]
2483  *
2484  * PARAMS
2485  *   x1 []
2486  */
2487 BOOL WINAPI
2488 NotifyBootConfigStatus( BOOL x1 )
2489 {
2490         FIXME("(0x%08d):stub\n",x1);
2491         return TRUE;
2492 }
2493
2494 /******************************************************************************
2495  * RevertToSelf [ADVAPI32.@]
2496  *
2497  * Ends the impersonation of a user.
2498  *
2499  * PARAMS
2500  *   void []
2501  *
2502  * RETURNS
2503  *  Success: TRUE.
2504  *  Failure: FALSE.
2505  */
2506 BOOL WINAPI
2507 RevertToSelf( void )
2508 {
2509     HANDLE Token = NULL;
2510     return set_ntstatus( NtSetInformationThread( GetCurrentThread(),
2511         ThreadImpersonationToken, &Token, sizeof(Token) ) );
2512 }
2513
2514 /******************************************************************************
2515  * ImpersonateSelf [ADVAPI32.@]
2516  *
2517  * Makes an impersonation token that represents the process user and assigns
2518  * to the current thread.
2519  *
2520  * PARAMS
2521  *  ImpersonationLevel [I] Level at which to impersonate.
2522  *
2523  * RETURNS
2524  *  Success: TRUE.
2525  *  Failure: FALSE.
2526  */
2527 BOOL WINAPI
2528 ImpersonateSelf(SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
2529 {
2530     return set_ntstatus( RtlImpersonateSelf( ImpersonationLevel ) );
2531 }
2532
2533 /******************************************************************************
2534  * ImpersonateLoggedOnUser [ADVAPI32.@]
2535  */
2536 BOOL WINAPI ImpersonateLoggedOnUser(HANDLE hToken)
2537 {
2538     DWORD size;
2539     NTSTATUS Status;
2540     HANDLE ImpersonationToken;
2541     TOKEN_TYPE Type;
2542     static BOOL warn = TRUE;
2543
2544     if (warn)
2545     {
2546         FIXME( "(%p)\n", hToken );
2547         warn = FALSE;
2548     }
2549     if (!GetTokenInformation( hToken, TokenType, &Type,
2550                               sizeof(TOKEN_TYPE), &size ))
2551         return FALSE;
2552
2553     if (Type == TokenPrimary)
2554     {
2555         OBJECT_ATTRIBUTES ObjectAttributes;
2556
2557         InitializeObjectAttributes( &ObjectAttributes, NULL, 0, NULL, NULL );
2558
2559         Status = NtDuplicateToken( hToken,
2560                                    TOKEN_IMPERSONATE | TOKEN_QUERY,
2561                                    &ObjectAttributes,
2562                                    SecurityImpersonation,
2563                                    TokenImpersonation,
2564                                    &ImpersonationToken );
2565         if (Status != STATUS_SUCCESS)
2566         {
2567             ERR( "NtDuplicateToken failed with error 0x%08x\n", Status );
2568             SetLastError( RtlNtStatusToDosError( Status ) );
2569             return FALSE;
2570         }
2571     }
2572     else
2573         ImpersonationToken = hToken;
2574
2575     Status = NtSetInformationThread( GetCurrentThread(),
2576                                      ThreadImpersonationToken,
2577                                      &ImpersonationToken,
2578                                      sizeof(ImpersonationToken) );
2579
2580     if (Type == TokenPrimary)
2581         NtClose( ImpersonationToken );
2582
2583     if (Status != STATUS_SUCCESS)
2584     {
2585         ERR( "NtSetInformationThread failed with error 0x%08x\n", Status );
2586         SetLastError( RtlNtStatusToDosError( Status ) );
2587         return FALSE;
2588     }
2589
2590     return TRUE;
2591 }
2592
2593 /******************************************************************************
2594  * ImpersonateAnonymousToken [ADVAPI32.@]
2595  */
2596 BOOL WINAPI ImpersonateAnonymousToken( HANDLE thread )
2597 {
2598     TRACE("(%p)\n", thread);
2599     return set_ntstatus( NtImpersonateAnonymousToken( thread ) );
2600 }
2601
2602 /******************************************************************************
2603  * AccessCheck [ADVAPI32.@]
2604  */
2605 BOOL WINAPI
2606 AccessCheck(
2607         PSECURITY_DESCRIPTOR SecurityDescriptor,
2608         HANDLE ClientToken,
2609         DWORD DesiredAccess,
2610         PGENERIC_MAPPING GenericMapping,
2611         PPRIVILEGE_SET PrivilegeSet,
2612         LPDWORD PrivilegeSetLength,
2613         LPDWORD GrantedAccess,
2614         LPBOOL AccessStatus)
2615 {
2616     NTSTATUS access_status;
2617     BOOL ret = set_ntstatus( NtAccessCheck(SecurityDescriptor, ClientToken, DesiredAccess,
2618                                            GenericMapping, PrivilegeSet, PrivilegeSetLength,
2619                                            GrantedAccess, &access_status) );
2620     if (ret) *AccessStatus = set_ntstatus( access_status );
2621     return ret;
2622 }
2623
2624
2625 /******************************************************************************
2626  * AccessCheckByType [ADVAPI32.@]
2627  */
2628 BOOL WINAPI AccessCheckByType(
2629     PSECURITY_DESCRIPTOR pSecurityDescriptor,
2630     PSID PrincipalSelfSid,
2631     HANDLE ClientToken,
2632     DWORD DesiredAccess,
2633     POBJECT_TYPE_LIST ObjectTypeList,
2634     DWORD ObjectTypeListLength,
2635     PGENERIC_MAPPING GenericMapping,
2636     PPRIVILEGE_SET PrivilegeSet,
2637     LPDWORD PrivilegeSetLength,
2638     LPDWORD GrantedAccess,
2639     LPBOOL AccessStatus)
2640 {
2641         FIXME("stub\n");
2642
2643         *AccessStatus = TRUE;
2644
2645         return !*AccessStatus;
2646 }
2647
2648 /******************************************************************************
2649  * MapGenericMask [ADVAPI32.@]
2650  *
2651  * Maps generic access rights into specific access rights according to the
2652  * supplied mapping.
2653  *
2654  * PARAMS
2655  *  AccessMask     [I/O] Access rights.
2656  *  GenericMapping [I] The mapping between generic and specific rights.
2657  *
2658  * RETURNS
2659  *  Nothing.
2660  */
2661 VOID WINAPI MapGenericMask( PDWORD AccessMask, PGENERIC_MAPPING GenericMapping )
2662 {
2663     RtlMapGenericMask( AccessMask, GenericMapping );
2664 }
2665
2666 /*************************************************************************
2667  * SetKernelObjectSecurity [ADVAPI32.@]
2668  */
2669 BOOL WINAPI SetKernelObjectSecurity (
2670         IN HANDLE Handle,
2671         IN SECURITY_INFORMATION SecurityInformation,
2672         IN PSECURITY_DESCRIPTOR SecurityDescriptor )
2673 {
2674     return set_ntstatus (NtSetSecurityObject (Handle, SecurityInformation, SecurityDescriptor));
2675 }
2676
2677
2678 /******************************************************************************
2679  *  AddAuditAccessAce [ADVAPI32.@]
2680  */
2681 BOOL WINAPI AddAuditAccessAce(
2682     IN OUT PACL pAcl,
2683     IN DWORD dwAceRevision,
2684     IN DWORD dwAccessMask,
2685     IN PSID pSid,
2686     IN BOOL bAuditSuccess,
2687     IN BOOL bAuditFailure)
2688 {
2689     return set_ntstatus( RtlAddAuditAccessAce(pAcl, dwAceRevision, dwAccessMask, pSid,
2690                                               bAuditSuccess, bAuditFailure) );
2691 }
2692
2693 /******************************************************************************
2694  *  AddAuditAccessAceEx [ADVAPI32.@]
2695  */
2696 BOOL WINAPI AddAuditAccessAceEx(
2697     IN OUT PACL pAcl,
2698     IN DWORD dwAceRevision,
2699     IN DWORD dwAceFlags,
2700     IN DWORD dwAccessMask,
2701     IN PSID pSid,
2702     IN BOOL bAuditSuccess,
2703     IN BOOL bAuditFailure)
2704 {
2705     return set_ntstatus( RtlAddAuditAccessAceEx(pAcl, dwAceRevision, dwAceFlags, dwAccessMask, pSid,
2706                                               bAuditSuccess, bAuditFailure) );
2707 }
2708
2709 /******************************************************************************
2710  *  AddAuditAccessObjectAce [ADVAPI32.@]
2711  */
2712 BOOL WINAPI AddAuditAccessObjectAce(
2713     IN OUT PACL pAcl,
2714     IN DWORD dwAceRevision,
2715     IN DWORD dwAceFlags,
2716     IN DWORD dwAccessMask,
2717     IN GUID* pObjectTypeGuid,
2718     IN GUID* pInheritedObjectTypeGuid,
2719     IN PSID pSid,
2720     IN BOOL bAuditSuccess,
2721     IN BOOL bAuditFailure)
2722 {
2723     return set_ntstatus( RtlAddAuditAccessObjectAce(pAcl, dwAceRevision, dwAceFlags, dwAccessMask,
2724            pObjectTypeGuid, pInheritedObjectTypeGuid, pSid, bAuditSuccess, bAuditFailure) );
2725 }
2726
2727 /******************************************************************************
2728  * LookupAccountNameA [ADVAPI32.@]
2729  */
2730 BOOL WINAPI
2731 LookupAccountNameA(
2732         IN LPCSTR system,
2733         IN LPCSTR account,
2734         OUT PSID sid,
2735         OUT LPDWORD cbSid,
2736         LPSTR ReferencedDomainName,
2737         IN OUT LPDWORD cbReferencedDomainName,
2738         OUT PSID_NAME_USE name_use )
2739 {
2740     BOOL ret;
2741     UNICODE_STRING lpSystemW;
2742     UNICODE_STRING lpAccountW;
2743     LPWSTR lpReferencedDomainNameW = NULL;
2744
2745     RtlCreateUnicodeStringFromAsciiz(&lpSystemW, system);
2746     RtlCreateUnicodeStringFromAsciiz(&lpAccountW, account);
2747
2748     if (ReferencedDomainName)
2749         lpReferencedDomainNameW = heap_alloc(*cbReferencedDomainName * sizeof(WCHAR));
2750
2751     ret = LookupAccountNameW(lpSystemW.Buffer, lpAccountW.Buffer, sid, cbSid, lpReferencedDomainNameW,
2752         cbReferencedDomainName, name_use);
2753
2754     if (ret && lpReferencedDomainNameW)
2755     {
2756         WideCharToMultiByte(CP_ACP, 0, lpReferencedDomainNameW, -1,
2757             ReferencedDomainName, *cbReferencedDomainName+1, NULL, NULL);
2758     }
2759
2760     RtlFreeUnicodeString(&lpSystemW);
2761     RtlFreeUnicodeString(&lpAccountW);
2762     heap_free(lpReferencedDomainNameW);
2763
2764     return ret;
2765 }
2766
2767 /******************************************************************************
2768  * lookup_user_account_name
2769  */
2770 static BOOL lookup_user_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName,
2771                                      LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2772 {
2773     char buffer[sizeof(TOKEN_USER) + sizeof(SID) + sizeof(DWORD)*SID_MAX_SUB_AUTHORITIES];
2774     DWORD len = sizeof(buffer);
2775     HANDLE token;
2776     BOOL ret;
2777     PSID pSid;
2778     WCHAR domainName[MAX_COMPUTERNAME_LENGTH + 1];
2779     DWORD nameLen;
2780
2781     if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
2782     {
2783         if (GetLastError() != ERROR_NO_TOKEN) return FALSE;
2784         if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) return FALSE;
2785     }
2786
2787     ret = GetTokenInformation(token, TokenUser, buffer, len, &len);
2788     CloseHandle( token );
2789
2790     if (!ret) return FALSE;
2791
2792     pSid = ((TOKEN_USER *)buffer)->User.Sid;
2793
2794     if (Sid != NULL && (*cbSid >= GetLengthSid(pSid)))
2795        CopySid(*cbSid, Sid, pSid);
2796     if (*cbSid < GetLengthSid(pSid))
2797     {
2798        SetLastError(ERROR_INSUFFICIENT_BUFFER);
2799        ret = FALSE;
2800     }
2801     *cbSid = GetLengthSid(pSid);
2802
2803     nameLen = MAX_COMPUTERNAME_LENGTH + 1;
2804     if (!GetComputerNameW(domainName, &nameLen))
2805     {
2806         domainName[0] = 0;
2807         nameLen = 0;
2808     }
2809     if (*cchReferencedDomainName <= nameLen || !ret)
2810     {
2811         SetLastError(ERROR_INSUFFICIENT_BUFFER);
2812         nameLen += 1;
2813         ret = FALSE;
2814     }
2815     else if (ReferencedDomainName)
2816         strcpyW(ReferencedDomainName, domainName);
2817
2818     *cchReferencedDomainName = nameLen;
2819
2820     if (ret)
2821         *peUse = SidTypeUser;
2822
2823     return ret;
2824 }
2825
2826 /******************************************************************************
2827  * lookup_computer_account_name
2828  */
2829 static BOOL lookup_computer_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName,
2830                                          LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2831 {
2832     MAX_SID local;
2833     BOOL ret;
2834     WCHAR domainName[MAX_COMPUTERNAME_LENGTH + 1];
2835     DWORD nameLen;
2836
2837     if ((ret = ADVAPI_GetComputerSid(&local)))
2838     {
2839         if (Sid != NULL && (*cbSid >= GetLengthSid(&local)))
2840            CopySid(*cbSid, Sid, &local);
2841         if (*cbSid < GetLengthSid(&local))
2842         {
2843            SetLastError(ERROR_INSUFFICIENT_BUFFER);
2844            ret = FALSE;
2845         }
2846         *cbSid = GetLengthSid(&local);
2847     }
2848
2849     nameLen = MAX_COMPUTERNAME_LENGTH + 1;
2850     if (!GetComputerNameW(domainName, &nameLen))
2851     {
2852         domainName[0] = 0;
2853         nameLen = 0;
2854     }
2855     if (*cchReferencedDomainName <= nameLen || !ret)
2856     {
2857         SetLastError(ERROR_INSUFFICIENT_BUFFER);
2858         nameLen += 1;
2859         ret = FALSE;
2860     }
2861     else if (ReferencedDomainName)
2862         strcpyW(ReferencedDomainName, domainName);
2863
2864     *cchReferencedDomainName = nameLen;
2865
2866     if (ret)
2867         *peUse = SidTypeDomain;
2868
2869     return ret;
2870 }
2871
2872 static void split_domain_account( const LSA_UNICODE_STRING *str, LSA_UNICODE_STRING *account,
2873                                   LSA_UNICODE_STRING *domain )
2874 {
2875     WCHAR *p = str->Buffer + str->Length / sizeof(WCHAR) - 1;
2876
2877     while (p > str->Buffer && *p != '\\') p--;
2878
2879     if (*p == '\\')
2880     {
2881         domain->Buffer = str->Buffer;
2882         domain->Length = (p - str->Buffer) * sizeof(WCHAR);
2883
2884         account->Buffer = p + 1;
2885         account->Length = str->Length - ((p - str->Buffer + 1) * sizeof(WCHAR));
2886     }
2887     else
2888     {
2889         domain->Buffer = NULL;
2890         domain->Length = 0;
2891
2892         account->Buffer = str->Buffer;
2893         account->Length = str->Length;
2894     }
2895 }
2896
2897 static BOOL match_domain( ULONG idx, const LSA_UNICODE_STRING *domain )
2898 {
2899     ULONG len = strlenW( ACCOUNT_SIDS[idx].domain );
2900
2901     if (len == domain->Length / sizeof(WCHAR) && !strncmpiW( domain->Buffer, ACCOUNT_SIDS[idx].domain, len ))
2902         return TRUE;
2903
2904     return FALSE;
2905 }
2906
2907 static BOOL match_account( ULONG idx, const LSA_UNICODE_STRING *account )
2908 {
2909     ULONG len = strlenW( ACCOUNT_SIDS[idx].account );
2910
2911     if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].account, len ))
2912         return TRUE;
2913
2914     if (ACCOUNT_SIDS[idx].alias)
2915     {
2916         len = strlenW( ACCOUNT_SIDS[idx].alias );
2917         if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].alias, len ))
2918             return TRUE;
2919     }
2920     return FALSE;
2921 }
2922
2923 /*
2924  * Helper function for LookupAccountNameW
2925  */
2926 BOOL lookup_local_wellknown_name( const LSA_UNICODE_STRING *account_and_domain,
2927                                   PSID Sid, LPDWORD cbSid,
2928                                   LPWSTR ReferencedDomainName,
2929                                   LPDWORD cchReferencedDomainName,
2930                                   PSID_NAME_USE peUse, BOOL *handled )
2931 {
2932     PSID pSid;
2933     LSA_UNICODE_STRING account, domain;
2934     BOOL ret = TRUE;
2935     ULONG i;
2936
2937     *handled = FALSE;
2938     split_domain_account( account_and_domain, &account, &domain );
2939
2940     for (i = 0; i < sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0]); i++)
2941     {
2942         /* check domain first */
2943         if (domain.Buffer && !match_domain( i, &domain )) continue;
2944
2945         if (match_account( i, &account ))
2946         {
2947             DWORD len, sidLen = SECURITY_MAX_SID_SIZE;
2948
2949             if (!(pSid = heap_alloc( sidLen ))) return FALSE;
2950
2951             if ((ret = CreateWellKnownSid( ACCOUNT_SIDS[i].type, NULL, pSid, &sidLen )))
2952             {
2953                 if (*cbSid < sidLen)
2954                 {
2955                     SetLastError(ERROR_INSUFFICIENT_BUFFER);
2956                     ret = FALSE;
2957                 }
2958                 else if (Sid)
2959                 {
2960                     CopySid(*cbSid, Sid, pSid);
2961                 }
2962                 *cbSid = sidLen;
2963             }
2964
2965             len = strlenW( ACCOUNT_SIDS[i].domain );
2966             if (*cchReferencedDomainName <= len || !ret)
2967             {
2968                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2969                 len++;
2970                 ret = FALSE;
2971             }
2972             else if (ReferencedDomainName)
2973             {
2974                 strcpyW( ReferencedDomainName, ACCOUNT_SIDS[i].domain );
2975             }
2976
2977             *cchReferencedDomainName = len;
2978             if (ret)
2979                 *peUse = ACCOUNT_SIDS[i].name_use;
2980
2981             heap_free(pSid);
2982             *handled = TRUE;
2983             return ret;
2984         }
2985     }
2986     return ret;
2987 }
2988
2989 BOOL lookup_local_user_name( const LSA_UNICODE_STRING *account_and_domain,
2990                              PSID Sid, LPDWORD cbSid,
2991                              LPWSTR ReferencedDomainName,
2992                              LPDWORD cchReferencedDomainName,
2993                              PSID_NAME_USE peUse, BOOL *handled )
2994 {
2995     DWORD nameLen;
2996     LPWSTR userName = NULL;
2997     LSA_UNICODE_STRING account, domain;
2998     BOOL ret = TRUE;
2999
3000     *handled = FALSE;
3001     split_domain_account( account_and_domain, &account, &domain );
3002
3003     /* Let the current Unix user id masquerade as first Windows user account */
3004
3005     nameLen = UNLEN + 1;
3006     if (!(userName = heap_alloc( nameLen * sizeof(WCHAR) ))) return FALSE;
3007
3008     if (domain.Buffer)
3009     {
3010         /* check to make sure this account is on this computer */
3011         if (GetComputerNameW( userName, &nameLen ) &&
3012             (domain.Length / sizeof(WCHAR) != nameLen || strncmpW( domain.Buffer, userName, nameLen )))
3013         {
3014             SetLastError(ERROR_NONE_MAPPED);
3015             ret = FALSE;
3016         }
3017         nameLen = UNLEN + 1;
3018     }
3019
3020     if (GetUserNameW( userName, &nameLen ) &&
3021         account.Length / sizeof(WCHAR) == nameLen - 1 && !strncmpW( account.Buffer, userName, nameLen - 1 ))
3022     {
3023             ret = lookup_user_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse );
3024             *handled = TRUE;
3025     }
3026     else
3027     {
3028         nameLen = UNLEN + 1;
3029         if (GetComputerNameW( userName, &nameLen ) &&
3030             account.Length / sizeof(WCHAR) == nameLen && !strncmpW( account.Buffer, userName , nameLen ))
3031         {
3032             ret = lookup_computer_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse );
3033             *handled = TRUE;
3034         }
3035     }
3036
3037     heap_free(userName);
3038     return ret;
3039 }
3040
3041 /******************************************************************************
3042  * LookupAccountNameW [ADVAPI32.@]
3043  */
3044 BOOL WINAPI LookupAccountNameW( LPCWSTR lpSystemName, LPCWSTR lpAccountName, PSID Sid,
3045                                 LPDWORD cbSid, LPWSTR ReferencedDomainName,
3046                                 LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
3047 {
3048     BOOL ret, handled;
3049     LSA_UNICODE_STRING account;
3050
3051     TRACE("%s %s %p %p %p %p %p\n", debugstr_w(lpSystemName), debugstr_w(lpAccountName),
3052           Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse);
3053
3054     if (!ADVAPI_IsLocalComputer( lpSystemName ))
3055     {
3056         FIXME("remote computer not supported\n");
3057         SetLastError( RPC_S_SERVER_UNAVAILABLE );
3058         return FALSE;
3059     }
3060
3061     if (!lpAccountName || !strcmpW( lpAccountName, Blank ))
3062     {
3063         lpAccountName = BUILTIN;
3064     }
3065
3066     RtlInitUnicodeString( &account, lpAccountName );
3067
3068     /* Check well known SIDs first */
3069     ret = lookup_local_wellknown_name( &account, Sid, cbSid, ReferencedDomainName,
3070                                        cchReferencedDomainName, peUse, &handled );
3071     if (handled)
3072         return ret;
3073
3074     /* Check user names */
3075     ret = lookup_local_user_name( &account, Sid, cbSid, ReferencedDomainName,
3076                                   cchReferencedDomainName, peUse, &handled);
3077     if (handled)
3078         return ret;
3079
3080     SetLastError( ERROR_NONE_MAPPED );
3081     return FALSE;
3082 }
3083
3084 /******************************************************************************
3085  * PrivilegeCheck [ADVAPI32.@]
3086  */
3087 BOOL WINAPI PrivilegeCheck( HANDLE ClientToken, PPRIVILEGE_SET RequiredPrivileges, LPBOOL pfResult)
3088 {
3089     BOOL ret;
3090     BOOLEAN Result;
3091
3092     TRACE("%p %p %p\n", ClientToken, RequiredPrivileges, pfResult);
3093
3094     ret = set_ntstatus (NtPrivilegeCheck (ClientToken, RequiredPrivileges, &Result));
3095     if (ret)
3096         *pfResult = Result;
3097     return ret;
3098 }
3099
3100 /******************************************************************************
3101  * AccessCheckAndAuditAlarmA [ADVAPI32.@]
3102  */
3103 BOOL WINAPI AccessCheckAndAuditAlarmA(LPCSTR Subsystem, LPVOID HandleId, LPSTR ObjectTypeName,
3104   LPSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess,
3105   PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess,
3106   LPBOOL AccessStatus, LPBOOL pfGenerateOnClose)
3107 {
3108         FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_a(Subsystem),
3109                 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName),
3110                 SecurityDescriptor, DesiredAccess, GenericMapping,
3111                 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose);
3112         return TRUE;
3113 }
3114
3115 /******************************************************************************
3116  * AccessCheckAndAuditAlarmW [ADVAPI32.@]
3117  */
3118 BOOL WINAPI AccessCheckAndAuditAlarmW(LPCWSTR Subsystem, LPVOID HandleId, LPWSTR ObjectTypeName,
3119   LPWSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess,
3120   PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess,
3121   LPBOOL AccessStatus, LPBOOL pfGenerateOnClose)
3122 {
3123         FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_w(Subsystem),
3124                 HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName),
3125                 SecurityDescriptor, DesiredAccess, GenericMapping,
3126                 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose);
3127         return TRUE;
3128 }
3129
3130 BOOL WINAPI ObjectCloseAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
3131 {
3132     FIXME("stub (%s,%p,%x)\n", debugstr_a(SubsystemName), HandleId, GenerateOnClose);
3133
3134     return TRUE;
3135 }
3136
3137 BOOL WINAPI ObjectCloseAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
3138 {
3139     FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose);
3140
3141     return TRUE;
3142 }
3143
3144 BOOL WINAPI ObjectDeleteAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
3145 {
3146     FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose);
3147
3148     return TRUE;
3149 }
3150
3151 BOOL WINAPI ObjectOpenAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, LPSTR ObjectTypeName,
3152   LPSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess,
3153   DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted,
3154   LPBOOL GenerateOnClose)
3155 {
3156         FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_a(SubsystemName),
3157                 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName), pSecurityDescriptor,
3158         ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted,
3159         GenerateOnClose);
3160
3161     return TRUE;
3162 }
3163
3164 BOOL WINAPI ObjectOpenAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, LPWSTR ObjectTypeName,
3165   LPWSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess,
3166   DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted,
3167   LPBOOL GenerateOnClose)
3168 {
3169     FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_w(SubsystemName),
3170         HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName), pSecurityDescriptor,
3171         ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted,
3172         GenerateOnClose);
3173
3174     return TRUE;
3175 }
3176
3177 BOOL WINAPI ObjectPrivilegeAuditAlarmA( LPCSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken,
3178   DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3179 {
3180     FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_a(SubsystemName), HandleId, ClientToken,
3181           DesiredAccess, Privileges, AccessGranted);
3182
3183     return TRUE;
3184 }
3185
3186 BOOL WINAPI ObjectPrivilegeAuditAlarmW( LPCWSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken,
3187   DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3188 {
3189     FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_w(SubsystemName), HandleId, ClientToken,
3190           DesiredAccess, Privileges, AccessGranted);
3191
3192     return TRUE;
3193 }
3194
3195 BOOL WINAPI PrivilegedServiceAuditAlarmA( LPCSTR SubsystemName, LPCSTR ServiceName, HANDLE ClientToken,
3196                                    PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3197 {
3198     FIXME("stub (%s,%s,%p,%p,%x)\n", debugstr_a(SubsystemName), debugstr_a(ServiceName),
3199           ClientToken, Privileges, AccessGranted);
3200
3201     return TRUE;
3202 }
3203
3204 BOOL WINAPI PrivilegedServiceAuditAlarmW( LPCWSTR SubsystemName, LPCWSTR ServiceName, HANDLE ClientToken,
3205                                    PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3206 {
3207     FIXME("stub %s,%s,%p,%p,%x)\n", debugstr_w(SubsystemName), debugstr_w(ServiceName),
3208           ClientToken, Privileges, AccessGranted);
3209
3210     return TRUE;
3211 }
3212
3213 /******************************************************************************
3214  * GetSecurityInfo [ADVAPI32.@]
3215  *
3216  * Retrieves a copy of the security descriptor associated with an object.
3217  *
3218  * PARAMS
3219  *  hObject              [I] A handle for the object.
3220  *  ObjectType           [I] The type of object.
3221  *  SecurityInfo         [I] A bitmask indicating what info to retrieve.
3222  *  ppsidOwner           [O] If non-null, receives a pointer to the owner SID.
3223  *  ppsidGroup           [O] If non-null, receives a pointer to the group SID.
3224  *  ppDacl               [O] If non-null, receives a pointer to the DACL.
3225  *  ppSacl               [O] If non-null, receives a pointer to the SACL.
3226  *  ppSecurityDescriptor [O] Receives a pointer to the security descriptor,
3227  *                           which must be freed with LocalFree.
3228  *
3229  * RETURNS
3230  *  ERROR_SUCCESS if all's well, and a WIN32 error code otherwise.
3231  */
3232 DWORD WINAPI GetSecurityInfo(
3233     HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3234     SECURITY_INFORMATION SecurityInfo, PSID *ppsidOwner,
3235     PSID *ppsidGroup, PACL *ppDacl, PACL *ppSacl,
3236     PSECURITY_DESCRIPTOR *ppSecurityDescriptor
3237 )
3238 {
3239     PSECURITY_DESCRIPTOR sd;
3240     NTSTATUS status;
3241     ULONG n1, n2;
3242     BOOL present, defaulted;
3243
3244     /* A NULL descriptor is allowed if any one of the other pointers is not NULL */
3245     if (!(ppsidOwner||ppsidGroup||ppDacl||ppSacl||ppSecurityDescriptor)) return ERROR_INVALID_PARAMETER;
3246
3247     /* If no descriptor, we have to check that there's a pointer for the requested information */
3248     if( !ppSecurityDescriptor && (
3249         ((SecurityInfo & OWNER_SECURITY_INFORMATION) && !ppsidOwner)
3250     ||  ((SecurityInfo & GROUP_SECURITY_INFORMATION) && !ppsidGroup)
3251     ||  ((SecurityInfo & DACL_SECURITY_INFORMATION)  && !ppDacl)
3252     ||  ((SecurityInfo & SACL_SECURITY_INFORMATION)  && !ppSacl)  ))
3253         return ERROR_INVALID_PARAMETER;
3254
3255     switch (ObjectType)
3256     {
3257     case SE_SERVICE:
3258         status = SERV_QueryServiceObjectSecurity(hObject, SecurityInfo, NULL, 0, &n1);
3259         break;
3260     default:
3261         status = NtQuerySecurityObject(hObject, SecurityInfo, NULL, 0, &n1);
3262         break;
3263     }
3264     if (status != STATUS_BUFFER_TOO_SMALL && status != STATUS_SUCCESS)
3265         return RtlNtStatusToDosError(status);
3266
3267     sd = LocalAlloc(0, n1);
3268     if (!sd)
3269         return ERROR_NOT_ENOUGH_MEMORY;
3270
3271     switch (ObjectType)
3272     {
3273     case SE_SERVICE:
3274         status = SERV_QueryServiceObjectSecurity(hObject, SecurityInfo, sd, n1, &n2);
3275         break;
3276     default:
3277         status = NtQuerySecurityObject(hObject, SecurityInfo, sd, n1, &n2);
3278         break;
3279     }
3280     if (status != STATUS_SUCCESS)
3281     {
3282         LocalFree(sd);
3283         return RtlNtStatusToDosError(status);
3284     }
3285
3286     if (ppsidOwner)
3287     {
3288         *ppsidOwner = NULL;
3289         GetSecurityDescriptorOwner(sd, ppsidOwner, &defaulted);
3290     }
3291     if (ppsidGroup)
3292     {
3293         *ppsidGroup = NULL;
3294         GetSecurityDescriptorGroup(sd, ppsidGroup, &defaulted);
3295     }
3296     if (ppDacl)
3297     {
3298         *ppDacl = NULL;
3299         GetSecurityDescriptorDacl(sd, &present, ppDacl, &defaulted);
3300     }
3301     if (ppSacl)
3302     {
3303         *ppSacl = NULL;
3304         GetSecurityDescriptorSacl(sd, &present, ppSacl, &defaulted);
3305     }
3306     if (ppSecurityDescriptor)
3307         *ppSecurityDescriptor = sd;
3308
3309     /* The security descriptor (sd) cannot be freed if ppSecurityDescriptor is
3310      * NULL, because native happily returns the SIDs and ACLs that are requested
3311      * in this case.
3312      */
3313
3314     return ERROR_SUCCESS;
3315 }
3316
3317 /******************************************************************************
3318  * GetSecurityInfoExA [ADVAPI32.@]
3319  */
3320 DWORD WINAPI GetSecurityInfoExA(
3321         HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3322         SECURITY_INFORMATION SecurityInfo, LPCSTR lpProvider,
3323         LPCSTR lpProperty, PACTRL_ACCESSA *ppAccessList,
3324         PACTRL_AUDITA *ppAuditList, LPSTR *lppOwner, LPSTR *lppGroup
3325 )
3326 {
3327   FIXME("stub!\n");
3328   return ERROR_BAD_PROVIDER;
3329 }
3330
3331 /******************************************************************************
3332  * GetSecurityInfoExW [ADVAPI32.@]
3333  */
3334 DWORD WINAPI GetSecurityInfoExW(
3335         HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3336         SECURITY_INFORMATION SecurityInfo, LPCWSTR lpProvider,
3337         LPCWSTR lpProperty, PACTRL_ACCESSW *ppAccessList,
3338         PACTRL_AUDITW *ppAuditList, LPWSTR *lppOwner, LPWSTR *lppGroup
3339 )
3340 {
3341   FIXME("stub!\n");
3342   return ERROR_BAD_PROVIDER;
3343 }
3344
3345 /******************************************************************************
3346  * BuildExplicitAccessWithNameA [ADVAPI32.@]
3347  */
3348 VOID WINAPI BuildExplicitAccessWithNameA( PEXPLICIT_ACCESSA pExplicitAccess,
3349                                           LPSTR pTrusteeName, DWORD AccessPermissions,
3350                                           ACCESS_MODE AccessMode, DWORD Inheritance )
3351 {
3352     TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_a(pTrusteeName),
3353           AccessPermissions, AccessMode, Inheritance);
3354
3355     pExplicitAccess->grfAccessPermissions = AccessPermissions;
3356     pExplicitAccess->grfAccessMode = AccessMode;
3357     pExplicitAccess->grfInheritance = Inheritance;
3358
3359     pExplicitAccess->Trustee.pMultipleTrustee = NULL;
3360     pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3361     pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3362     pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3363     pExplicitAccess->Trustee.ptstrName = pTrusteeName;
3364 }
3365
3366 /******************************************************************************
3367  * BuildExplicitAccessWithNameW [ADVAPI32.@]
3368  */
3369 VOID WINAPI BuildExplicitAccessWithNameW( PEXPLICIT_ACCESSW pExplicitAccess,
3370                                           LPWSTR pTrusteeName, DWORD AccessPermissions,
3371                                           ACCESS_MODE AccessMode, DWORD Inheritance )
3372 {
3373     TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_w(pTrusteeName),
3374           AccessPermissions, AccessMode, Inheritance);
3375
3376     pExplicitAccess->grfAccessPermissions = AccessPermissions;
3377     pExplicitAccess->grfAccessMode = AccessMode;
3378     pExplicitAccess->grfInheritance = Inheritance;
3379
3380     pExplicitAccess->Trustee.pMultipleTrustee = NULL;
3381     pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3382     pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3383     pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3384     pExplicitAccess->Trustee.ptstrName = pTrusteeName;
3385 }
3386
3387 /******************************************************************************
3388  * BuildTrusteeWithObjectsAndNameA [ADVAPI32.@]
3389  */
3390 VOID WINAPI BuildTrusteeWithObjectsAndNameA( PTRUSTEEA pTrustee, POBJECTS_AND_NAME_A pObjName,
3391                                              SE_OBJECT_TYPE ObjectType, LPSTR ObjectTypeName,
3392                                              LPSTR InheritedObjectTypeName, LPSTR Name )
3393 {
3394     DWORD ObjectsPresent = 0;
3395
3396     TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
3397           ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_a(Name));
3398
3399     /* Fill the OBJECTS_AND_NAME structure */
3400     pObjName->ObjectType = ObjectType;
3401     if (ObjectTypeName != NULL)
3402     {
3403         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3404     }
3405
3406     pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
3407     if (InheritedObjectTypeName != NULL)
3408     {
3409         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3410     }
3411
3412     pObjName->ObjectsPresent = ObjectsPresent;
3413     pObjName->ptstrName = Name;
3414
3415     /* Fill the TRUSTEE structure */
3416     pTrustee->pMultipleTrustee = NULL;
3417     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3418     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
3419     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3420     pTrustee->ptstrName = (LPSTR)pObjName;
3421 }
3422
3423 /******************************************************************************
3424  * BuildTrusteeWithObjectsAndNameW [ADVAPI32.@]
3425  */
3426 VOID WINAPI BuildTrusteeWithObjectsAndNameW( PTRUSTEEW pTrustee, POBJECTS_AND_NAME_W pObjName,
3427                                              SE_OBJECT_TYPE ObjectType, LPWSTR ObjectTypeName,
3428                                              LPWSTR InheritedObjectTypeName, LPWSTR Name )
3429 {
3430     DWORD ObjectsPresent = 0;
3431
3432     TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
3433           ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_w(Name));
3434
3435     /* Fill the OBJECTS_AND_NAME structure */
3436     pObjName->ObjectType = ObjectType;
3437     if (ObjectTypeName != NULL)
3438     {
3439         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3440     }
3441
3442     pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
3443     if (InheritedObjectTypeName != NULL)
3444     {
3445         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3446     }
3447
3448     pObjName->ObjectsPresent = ObjectsPresent;
3449     pObjName->ptstrName = Name;
3450
3451     /* Fill the TRUSTEE structure */
3452     pTrustee->pMultipleTrustee = NULL;
3453     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3454     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
3455     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3456     pTrustee->ptstrName = (LPWSTR)pObjName;
3457 }
3458
3459 /******************************************************************************
3460  * BuildTrusteeWithObjectsAndSidA [ADVAPI32.@]
3461  */
3462 VOID WINAPI BuildTrusteeWithObjectsAndSidA( PTRUSTEEA pTrustee, POBJECTS_AND_SID pObjSid,
3463                                             GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid )
3464 {
3465     DWORD ObjectsPresent = 0;
3466
3467     TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
3468
3469     /* Fill the OBJECTS_AND_SID structure */
3470     if (pObjectGuid != NULL)
3471     {
3472         pObjSid->ObjectTypeGuid = *pObjectGuid;
3473         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3474     }
3475     else
3476     {
3477         ZeroMemory(&pObjSid->ObjectTypeGuid,
3478                    sizeof(GUID));
3479     }
3480
3481     if (pInheritedObjectGuid != NULL)
3482     {
3483         pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
3484         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3485     }
3486     else
3487     {
3488         ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
3489                    sizeof(GUID));
3490     }
3491
3492     pObjSid->ObjectsPresent = ObjectsPresent;
3493     pObjSid->pSid = pSid;
3494
3495     /* Fill the TRUSTEE structure */
3496     pTrustee->pMultipleTrustee = NULL;
3497     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3498     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
3499     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3500     pTrustee->ptstrName = (LPSTR) pObjSid;
3501 }
3502
3503 /******************************************************************************
3504  * BuildTrusteeWithObjectsAndSidW [ADVAPI32.@]
3505  */
3506 VOID WINAPI BuildTrusteeWithObjectsAndSidW( PTRUSTEEW pTrustee, POBJECTS_AND_SID pObjSid,
3507                                             GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid )
3508 {
3509     DWORD ObjectsPresent = 0;
3510
3511     TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
3512
3513     /* Fill the OBJECTS_AND_SID structure */
3514     if (pObjectGuid != NULL)
3515     {
3516         pObjSid->ObjectTypeGuid = *pObjectGuid;
3517         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3518     }
3519     else
3520     {
3521         ZeroMemory(&pObjSid->ObjectTypeGuid,
3522                    sizeof(GUID));
3523     }
3524
3525     if (pInheritedObjectGuid != NULL)
3526     {
3527         pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
3528         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3529     }
3530     else
3531     {
3532         ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
3533                    sizeof(GUID));
3534     }
3535
3536     pObjSid->ObjectsPresent = ObjectsPresent;
3537     pObjSid->pSid = pSid;
3538
3539     /* Fill the TRUSTEE structure */
3540     pTrustee->pMultipleTrustee = NULL;
3541     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3542     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
3543     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3544     pTrustee->ptstrName = (LPWSTR) pObjSid;
3545 }
3546
3547 /******************************************************************************
3548  * BuildTrusteeWithSidA [ADVAPI32.@]
3549  */
3550 VOID WINAPI BuildTrusteeWithSidA(PTRUSTEEA pTrustee, PSID pSid)
3551 {
3552     TRACE("%p %p\n", pTrustee, pSid);
3553
3554     pTrustee->pMultipleTrustee = NULL;
3555     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3556     pTrustee->TrusteeForm = TRUSTEE_IS_SID;
3557     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3558     pTrustee->ptstrName = pSid;
3559 }
3560
3561 /******************************************************************************
3562  * BuildTrusteeWithSidW [ADVAPI32.@]
3563  */
3564 VOID WINAPI BuildTrusteeWithSidW(PTRUSTEEW pTrustee, PSID pSid)
3565 {
3566     TRACE("%p %p\n", pTrustee, pSid);
3567
3568     pTrustee->pMultipleTrustee = NULL;
3569     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3570     pTrustee->TrusteeForm = TRUSTEE_IS_SID;
3571     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3572     pTrustee->ptstrName = pSid;
3573 }
3574
3575 /******************************************************************************
3576  * BuildTrusteeWithNameA [ADVAPI32.@]
3577  */
3578 VOID WINAPI BuildTrusteeWithNameA(PTRUSTEEA pTrustee, LPSTR name)
3579 {
3580     TRACE("%p %s\n", pTrustee, debugstr_a(name) );
3581
3582     pTrustee->pMultipleTrustee = NULL;
3583     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3584     pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
3585     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3586     pTrustee->ptstrName = name;
3587 }
3588
3589 /******************************************************************************
3590  * BuildTrusteeWithNameW [ADVAPI32.@]
3591  */
3592 VOID WINAPI BuildTrusteeWithNameW(PTRUSTEEW pTrustee, LPWSTR name)
3593 {
3594     TRACE("%p %s\n", pTrustee, debugstr_w(name) );
3595
3596     pTrustee->pMultipleTrustee = NULL;
3597     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3598     pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
3599     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3600     pTrustee->ptstrName = name;
3601 }
3602
3603 /******************************************************************************
3604  * GetTrusteeFormA [ADVAPI32.@]
3605  */
3606 TRUSTEE_FORM WINAPI GetTrusteeFormA(PTRUSTEEA pTrustee)
3607 {
3608     TRACE("(%p)\n", pTrustee);
3609
3610     if (!pTrustee)
3611         return TRUSTEE_BAD_FORM;
3612
3613     return pTrustee->TrusteeForm;
3614 }
3615
3616 /******************************************************************************
3617  * GetTrusteeFormW [ADVAPI32.@]
3618  */
3619 TRUSTEE_FORM WINAPI GetTrusteeFormW(PTRUSTEEW pTrustee)
3620 {
3621     TRACE("(%p)\n", pTrustee);
3622
3623     if (!pTrustee)
3624         return TRUSTEE_BAD_FORM;
3625
3626     return pTrustee->TrusteeForm;
3627 }
3628
3629 /******************************************************************************
3630  * GetTrusteeNameA [ADVAPI32.@]
3631  */
3632 LPSTR WINAPI GetTrusteeNameA(PTRUSTEEA pTrustee)
3633 {
3634     TRACE("(%p)\n", pTrustee);
3635
3636     if (!pTrustee)
3637         return NULL;
3638
3639     return pTrustee->ptstrName;
3640 }
3641
3642 /******************************************************************************
3643  * GetTrusteeNameW [ADVAPI32.@]
3644  */
3645 LPWSTR WINAPI GetTrusteeNameW(PTRUSTEEW pTrustee)
3646 {
3647     TRACE("(%p)\n", pTrustee);
3648
3649     if (!pTrustee)
3650         return NULL;
3651
3652     return pTrustee->ptstrName;
3653 }
3654
3655 /******************************************************************************
3656  * GetTrusteeTypeA [ADVAPI32.@]
3657  */
3658 TRUSTEE_TYPE WINAPI GetTrusteeTypeA(PTRUSTEEA pTrustee)
3659 {
3660     TRACE("(%p)\n", pTrustee);
3661
3662     if (!pTrustee)
3663         return TRUSTEE_IS_UNKNOWN;
3664
3665     return pTrustee->TrusteeType;
3666 }
3667
3668 /******************************************************************************
3669  * GetTrusteeTypeW [ADVAPI32.@]
3670  */
3671 TRUSTEE_TYPE WINAPI GetTrusteeTypeW(PTRUSTEEW pTrustee)
3672 {
3673     TRACE("(%p)\n", pTrustee);
3674
3675     if (!pTrustee)
3676         return TRUSTEE_IS_UNKNOWN;
3677
3678     return pTrustee->TrusteeType;
3679 }
3680
3681 BOOL WINAPI SetAclInformation( PACL pAcl, LPVOID pAclInformation,
3682                                DWORD nAclInformationLength,
3683                                ACL_INFORMATION_CLASS dwAclInformationClass )
3684 {
3685     FIXME("%p %p 0x%08x 0x%08x - stub\n", pAcl, pAclInformation,
3686           nAclInformationLength, dwAclInformationClass);
3687
3688     return TRUE;
3689 }
3690
3691 static DWORD trustee_name_A_to_W(TRUSTEE_FORM form, char *trustee_nameA, WCHAR **ptrustee_nameW)
3692 {
3693     switch (form)
3694     {
3695     case TRUSTEE_IS_NAME:
3696     {
3697         *ptrustee_nameW = SERV_dup(trustee_nameA);
3698         return ERROR_SUCCESS;
3699     }
3700     case TRUSTEE_IS_OBJECTS_AND_NAME:
3701     {
3702         OBJECTS_AND_NAME_A *objA = (OBJECTS_AND_NAME_A *)trustee_nameA;
3703         OBJECTS_AND_NAME_W *objW = NULL;
3704
3705         if (objA)
3706         {
3707             if (!(objW = heap_alloc( sizeof(OBJECTS_AND_NAME_W) )))
3708                 return ERROR_NOT_ENOUGH_MEMORY;
3709
3710             objW->ObjectsPresent = objA->ObjectsPresent;
3711             objW->ObjectType = objA->ObjectType;
3712             objW->ObjectTypeName = SERV_dup(objA->ObjectTypeName);
3713             objW->InheritedObjectTypeName = SERV_dup(objA->InheritedObjectTypeName);
3714             objW->ptstrName = SERV_dup(objA->ptstrName);
3715         }
3716
3717         *ptrustee_nameW = (WCHAR *)objW;
3718         return ERROR_SUCCESS;
3719     }
3720     /* These forms do not require conversion. */
3721     case TRUSTEE_IS_SID:
3722     case TRUSTEE_IS_OBJECTS_AND_SID:
3723         *ptrustee_nameW = (WCHAR *)trustee_nameA;
3724         return ERROR_SUCCESS;
3725     default:
3726         return ERROR_INVALID_PARAMETER;
3727     }
3728 }
3729
3730 static void free_trustee_name(TRUSTEE_FORM form, WCHAR *trustee_nameW)
3731 {
3732     switch (form)
3733     {
3734     case TRUSTEE_IS_NAME:
3735         heap_free( trustee_nameW );
3736         break;
3737     case TRUSTEE_IS_OBJECTS_AND_NAME:
3738     {
3739         OBJECTS_AND_NAME_W *objW = (OBJECTS_AND_NAME_W *)trustee_nameW;
3740
3741         if (objW)
3742         {
3743             heap_free( objW->ptstrName );
3744             heap_free( objW->InheritedObjectTypeName );
3745             heap_free( objW->ObjectTypeName );
3746             heap_free( objW );
3747         }
3748
3749         break;
3750     }
3751     /* Other forms did not require allocation, so no freeing is necessary. */
3752     default:
3753         break;
3754     }
3755 }
3756
3757 /******************************************************************************
3758  * SetEntriesInAclA [ADVAPI32.@]
3759  */
3760 DWORD WINAPI SetEntriesInAclA( ULONG count, PEXPLICIT_ACCESSA pEntries,
3761                                PACL OldAcl, PACL* NewAcl )
3762 {
3763     DWORD err = ERROR_SUCCESS;
3764     EXPLICIT_ACCESSW *pEntriesW;
3765     UINT alloc_index, free_index;
3766
3767     TRACE("%d %p %p %p\n", count, pEntries, OldAcl, NewAcl);
3768
3769     if (NewAcl)
3770         *NewAcl = NULL;
3771
3772     if (!count && !OldAcl)
3773         return ERROR_SUCCESS;
3774
3775     pEntriesW = heap_alloc( count * sizeof(EXPLICIT_ACCESSW) );
3776     if (!pEntriesW)
3777         return ERROR_NOT_ENOUGH_MEMORY;
3778
3779     for (alloc_index = 0; alloc_index < count; ++alloc_index)
3780     {
3781         pEntriesW[alloc_index].grfAccessPermissions = pEntries[alloc_index].grfAccessPermissions;
3782         pEntriesW[alloc_index].grfAccessMode = pEntries[alloc_index].grfAccessMode;
3783         pEntriesW[alloc_index].grfInheritance = pEntries[alloc_index].grfInheritance;
3784         pEntriesW[alloc_index].Trustee.pMultipleTrustee = NULL; /* currently not supported */
3785         pEntriesW[alloc_index].Trustee.MultipleTrusteeOperation = pEntries[alloc_index].Trustee.MultipleTrusteeOperation;
3786         pEntriesW[alloc_index].Trustee.TrusteeForm = pEntries[alloc_index].Trustee.TrusteeForm;
3787         pEntriesW[alloc_index].Trustee.TrusteeType = pEntries[alloc_index].Trustee.TrusteeType;
3788
3789         err = trustee_name_A_to_W( pEntries[alloc_index].Trustee.TrusteeForm,
3790                                    pEntries[alloc_index].Trustee.ptstrName,
3791                                    &pEntriesW[alloc_index].Trustee.ptstrName );
3792         if (err != ERROR_SUCCESS)
3793         {
3794             if (err == ERROR_INVALID_PARAMETER)
3795                 WARN("bad trustee form %d for trustee %d\n",
3796                      pEntries[alloc_index].Trustee.TrusteeForm, alloc_index);
3797
3798             goto cleanup;
3799         }
3800     }
3801
3802     err = SetEntriesInAclW( count, pEntriesW, OldAcl, NewAcl );
3803
3804 cleanup:
3805     /* Free any previously allocated trustee name buffers, taking into account
3806      * a possible out-of-memory condition while building the EXPLICIT_ACCESSW
3807      * list. */
3808     for (free_index = 0; free_index < alloc_index; ++free_index)
3809         free_trustee_name( pEntriesW[free_index].Trustee.TrusteeForm, pEntriesW[free_index].Trustee.ptstrName );
3810
3811     heap_free( pEntriesW );
3812     return err;
3813 }
3814
3815 /******************************************************************************
3816  * SetEntriesInAclW [ADVAPI32.@]
3817  */
3818 DWORD WINAPI SetEntriesInAclW( ULONG count, PEXPLICIT_ACCESSW pEntries,
3819                                PACL OldAcl, PACL* NewAcl )
3820 {
3821     ULONG i;
3822     PSID *ppsid;
3823     DWORD ret = ERROR_SUCCESS;
3824     DWORD acl_size = sizeof(ACL);
3825     NTSTATUS status;
3826
3827     TRACE("%d %p %p %p\n", count, pEntries, OldAcl, NewAcl);
3828
3829     if (NewAcl)
3830         *NewAcl = NULL;
3831
3832     if (!count && !OldAcl)
3833         return ERROR_SUCCESS;
3834
3835     /* allocate array of maximum sized sids allowed */
3836     ppsid = heap_alloc(count * (sizeof(SID *) + FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES])));
3837     if (!ppsid)
3838         return ERROR_OUTOFMEMORY;
3839
3840     for (i = 0; i < count; i++)
3841     {
3842         ppsid[i] = (char *)&ppsid[count] + i * FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]);
3843
3844         TRACE("[%d]:\n\tgrfAccessPermissions = 0x%x\n\tgrfAccessMode = %d\n\tgrfInheritance = 0x%x\n\t"
3845               "Trustee.pMultipleTrustee = %p\n\tMultipleTrusteeOperation = %d\n\tTrusteeForm = %d\n\t"
3846               "Trustee.TrusteeType = %d\n\tptstrName = %p\n", i,
3847               pEntries[i].grfAccessPermissions, pEntries[i].grfAccessMode, pEntries[i].grfInheritance,
3848               pEntries[i].Trustee.pMultipleTrustee, pEntries[i].Trustee.MultipleTrusteeOperation,
3849               pEntries[i].Trustee.TrusteeForm, pEntries[i].Trustee.TrusteeType,
3850               pEntries[i].Trustee.ptstrName);
3851
3852         if (pEntries[i].Trustee.MultipleTrusteeOperation == TRUSTEE_IS_IMPERSONATE)
3853         {
3854             WARN("bad multiple trustee operation %d for trustee %d\n", pEntries[i].Trustee.MultipleTrusteeOperation, i);
3855             ret = ERROR_INVALID_PARAMETER;
3856             goto exit;
3857         }
3858
3859         switch (pEntries[i].Trustee.TrusteeForm)
3860         {
3861         case TRUSTEE_IS_SID:
3862             if (!CopySid(FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]),
3863                          ppsid[i], pEntries[i].Trustee.ptstrName))
3864             {
3865                 WARN("bad sid %p for trustee %d\n", pEntries[i].Trustee.ptstrName, i);
3866                 ret = ERROR_INVALID_PARAMETER;
3867                 goto exit;
3868             }
3869             break;
3870         case TRUSTEE_IS_NAME:
3871         {
3872             DWORD sid_size = FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]);
3873             DWORD domain_size = MAX_COMPUTERNAME_LENGTH + 1;
3874             SID_NAME_USE use;
3875             if (!strcmpW( pEntries[i].Trustee.ptstrName, CURRENT_USER ))
3876             {
3877                 if (!lookup_user_account_name( ppsid[i], &sid_size, NULL, &domain_size, &use ))
3878                 {
3879                     ret = GetLastError();
3880                     goto exit;
3881                 }
3882             }
3883             else if (!LookupAccountNameW(NULL, pEntries[i].Trustee.ptstrName, ppsid[i], &sid_size, NULL, &domain_size, &use))
3884             {
3885                 WARN("bad user name %s for trustee %d\n", debugstr_w(pEntries[i].Trustee.ptstrName), i);
3886                 ret = ERROR_INVALID_PARAMETER;
3887                 goto exit;
3888             }
3889             break;
3890         }
3891         case TRUSTEE_IS_OBJECTS_AND_SID:
3892             FIXME("TRUSTEE_IS_OBJECTS_AND_SID unimplemented\n");
3893             break;
3894         case TRUSTEE_IS_OBJECTS_AND_NAME:
3895             FIXME("TRUSTEE_IS_OBJECTS_AND_NAME unimplemented\n");
3896             break;
3897         default:
3898             WARN("bad trustee form %d for trustee %d\n", pEntries[i].Trustee.TrusteeForm, i);
3899             ret = ERROR_INVALID_PARAMETER;
3900             goto exit;
3901         }
3902
3903         /* Note: we overestimate the ACL size here as a tradeoff between
3904          * instructions (simplicity) and memory */
3905         switch (pEntries[i].grfAccessMode)
3906         {
3907         case GRANT_ACCESS:
3908         case SET_ACCESS:
3909             acl_size += FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart) + GetLengthSid(ppsid[i]);
3910             break;
3911         case DENY_ACCESS:
3912             acl_size += FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart) + GetLengthSid(ppsid[i]);
3913             break;
3914         case SET_AUDIT_SUCCESS:
3915         case SET_AUDIT_FAILURE:
3916             acl_size += FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart) + GetLengthSid(ppsid[i]);
3917             break;
3918         case REVOKE_ACCESS:
3919             break;
3920         default:
3921             WARN("bad access mode %d for trustee %d\n", pEntries[i].grfAccessMode, i);
3922             ret = ERROR_INVALID_PARAMETER;
3923             goto exit;
3924         }
3925     }
3926
3927     if (OldAcl)
3928     {
3929         ACL_SIZE_INFORMATION size_info;
3930
3931         status = RtlQueryInformationAcl(OldAcl, &size_info, sizeof(size_info), AclSizeInformation);
3932         if (status != STATUS_SUCCESS)
3933         {
3934             ret = RtlNtStatusToDosError(status);
3935             goto exit;
3936         }
3937         acl_size += size_info.AclBytesInUse - sizeof(ACL);
3938     }
3939
3940     *NewAcl = LocalAlloc(0, acl_size);
3941     if (!*NewAcl)
3942     {
3943         ret = ERROR_OUTOFMEMORY;
3944         goto exit;
3945     }
3946
3947     status = RtlCreateAcl( *NewAcl, acl_size, ACL_REVISION );
3948     if (status != STATUS_SUCCESS)
3949     {
3950         ret = RtlNtStatusToDosError(status);
3951         goto exit;
3952     }
3953
3954     for (i = 0; i < count; i++)
3955     {
3956         switch (pEntries[i].grfAccessMode)
3957         {
3958         case GRANT_ACCESS:
3959             status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION,
3960                                               pEntries[i].grfInheritance,
3961                                               pEntries[i].grfAccessPermissions,
3962                                               ppsid[i]);
3963             break;
3964         case SET_ACCESS:
3965         {
3966             ULONG j;
3967             BOOL add = TRUE;
3968             if (OldAcl)
3969             {
3970                 for (j = 0; ; j++)
3971                 {
3972                     const ACE_HEADER *existing_ace_header;
3973                     status = RtlGetAce(OldAcl, j, (LPVOID *)&existing_ace_header);
3974                     if (status != STATUS_SUCCESS)
3975                         break;
3976                     if (pEntries[i].grfAccessMode == SET_ACCESS &&
3977                         existing_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE &&
3978                         EqualSid(ppsid[i], &((ACCESS_ALLOWED_ACE *)existing_ace_header)->SidStart))
3979                     {
3980                         add = FALSE;
3981                         break;
3982                     }
3983                 }
3984             }
3985             if (add)
3986                 status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION,
3987                                                   pEntries[i].grfInheritance,
3988                                                   pEntries[i].grfAccessPermissions,
3989                                                   ppsid[i]);
3990             break;
3991         }
3992         case DENY_ACCESS:
3993             status = RtlAddAccessDeniedAceEx(*NewAcl, ACL_REVISION,
3994                                              pEntries[i].grfInheritance,
3995                                              pEntries[i].grfAccessPermissions,
3996                                              ppsid[i]);
3997             break;
3998         case SET_AUDIT_SUCCESS:
3999             status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION,
4000                                             pEntries[i].grfInheritance,
4001                                             pEntries[i].grfAccessPermissions,
4002                                             ppsid[i], TRUE, FALSE);
4003             break;
4004         case SET_AUDIT_FAILURE:
4005             status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION,
4006                                             pEntries[i].grfInheritance,
4007                                             pEntries[i].grfAccessPermissions,
4008                                             ppsid[i], FALSE, TRUE);
4009             break;
4010         default:
4011             FIXME("unhandled access mode %d\n", pEntries[i].grfAccessMode);
4012         }
4013     }
4014
4015     if (OldAcl)
4016     {
4017         for (i = 0; ; i++)
4018         {
4019             BOOL add = TRUE;
4020             ULONG j;
4021             const ACE_HEADER *old_ace_header;
4022             status = RtlGetAce(OldAcl, i, (LPVOID *)&old_ace_header);
4023             if (status != STATUS_SUCCESS) break;
4024             for (j = 0; j < count; j++)
4025             {
4026                 if (pEntries[j].grfAccessMode == SET_ACCESS &&
4027                     old_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE &&
4028                     EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart))
4029                 {
4030                     status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION, pEntries[j].grfInheritance, pEntries[j].grfAccessPermissions, ppsid[j]);
4031                     add = FALSE;
4032                     break;
4033                 }
4034                 else if (pEntries[j].grfAccessMode == REVOKE_ACCESS)
4035                 {
4036                     switch (old_ace_header->AceType)
4037                     {
4038                     case ACCESS_ALLOWED_ACE_TYPE:
4039                         if (EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart))
4040                             add = FALSE;
4041                         break;
4042                     case ACCESS_DENIED_ACE_TYPE:
4043                         if (EqualSid(ppsid[j], &((ACCESS_DENIED_ACE *)old_ace_header)->SidStart))
4044                             add = FALSE;
4045                         break;
4046                     case SYSTEM_AUDIT_ACE_TYPE:
4047                         if (EqualSid(ppsid[j], &((SYSTEM_AUDIT_ACE *)old_ace_header)->SidStart))
4048                             add = FALSE;
4049                         break;
4050                     case SYSTEM_ALARM_ACE_TYPE:
4051                         if (EqualSid(ppsid[j], &((SYSTEM_ALARM_ACE *)old_ace_header)->SidStart))
4052                             add = FALSE;
4053                         break;
4054                     default:
4055                         FIXME("unhandled ace type %d\n", old_ace_header->AceType);
4056                     }
4057
4058                     if (!add)
4059                         break;
4060                 }
4061             }
4062             if (add)
4063                 status = RtlAddAce(*NewAcl, ACL_REVISION, 1, (PACE_HEADER)old_ace_header, old_ace_header->AceSize);
4064             if (status != STATUS_SUCCESS)
4065             {
4066                 WARN("RtlAddAce failed with error 0x%08x\n", status);
4067                 ret = RtlNtStatusToDosError(status);
4068                 break;
4069             }
4070         }
4071     }
4072
4073 exit:
4074     heap_free(ppsid);
4075     return ret;
4076 }
4077
4078 /******************************************************************************
4079  * SetNamedSecurityInfoA [ADVAPI32.@]
4080  */
4081 DWORD WINAPI SetNamedSecurityInfoA(LPSTR pObjectName,
4082         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
4083         PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
4084 {
4085     LPWSTR wstr;
4086     DWORD r;
4087
4088     TRACE("%s %d %d %p %p %p %p\n", debugstr_a(pObjectName), ObjectType,
4089            SecurityInfo, psidOwner, psidGroup, pDacl, pSacl);
4090
4091     wstr = SERV_dup(pObjectName);
4092     r = SetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, psidOwner,
4093                            psidGroup, pDacl, pSacl );
4094
4095     heap_free( wstr );
4096
4097     return r;
4098 }
4099
4100 BOOL WINAPI SetPrivateObjectSecurity( SECURITY_INFORMATION SecurityInformation,
4101     PSECURITY_DESCRIPTOR ModificationDescriptor,
4102     PSECURITY_DESCRIPTOR* ObjectsSecurityDescriptor,
4103     PGENERIC_MAPPING GenericMapping,
4104     HANDLE Token )
4105 {
4106     FIXME("0x%08x %p %p %p %p - stub\n", SecurityInformation, ModificationDescriptor,
4107           ObjectsSecurityDescriptor, GenericMapping, Token);
4108
4109     return TRUE;
4110 }
4111
4112 BOOL WINAPI AreAllAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess )
4113 {
4114     return RtlAreAllAccessesGranted( GrantedAccess, DesiredAccess );
4115 }
4116
4117 /******************************************************************************
4118  * AreAnyAccessesGranted [ADVAPI32.@]
4119  *
4120  * Determines whether or not any of a set of specified access permissions have
4121  * been granted or not.
4122  *
4123  * PARAMS
4124  *   GrantedAccess [I] The permissions that have been granted.
4125  *   DesiredAccess [I] The permissions that you want to have.
4126  *
4127  * RETURNS
4128  *   Nonzero if any of the permissions have been granted, zero if none of the
4129  *   permissions have been granted.
4130  */
4131
4132 BOOL WINAPI AreAnyAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess )
4133 {
4134     return RtlAreAnyAccessesGranted( GrantedAccess, DesiredAccess );
4135 }
4136
4137 /******************************************************************************
4138  * SetNamedSecurityInfoW [ADVAPI32.@]
4139  */
4140 DWORD WINAPI SetNamedSecurityInfoW(LPWSTR pObjectName,
4141         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
4142         PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
4143 {
4144     DWORD access = 0;
4145     HANDLE handle;
4146     DWORD err;
4147
4148     TRACE( "%s %d %d %p %p %p %p\n", debugstr_w(pObjectName), ObjectType,
4149            SecurityInfo, psidOwner, psidGroup, pDacl, pSacl);
4150
4151     if (!pObjectName) return ERROR_INVALID_PARAMETER;
4152
4153     if (SecurityInfo & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION))
4154         access |= WRITE_OWNER;
4155     if (SecurityInfo & DACL_SECURITY_INFORMATION)
4156         access |= WRITE_DAC;
4157     if (SecurityInfo & SACL_SECURITY_INFORMATION)
4158         access |= ACCESS_SYSTEM_SECURITY;
4159
4160     switch (ObjectType)
4161     {
4162     case SE_SERVICE:
4163         if (!(err = get_security_service( pObjectName, access, &handle )))
4164         {
4165             err = SetSecurityInfo( handle, ObjectType, SecurityInfo, psidOwner, psidGroup, pDacl, pSacl );
4166             CloseServiceHandle( handle );
4167         }
4168         break;
4169     case SE_REGISTRY_KEY:
4170         if (!(err = get_security_regkey( pObjectName, access, &handle )))
4171         {
4172             err = SetSecurityInfo( handle, ObjectType, SecurityInfo, psidOwner, psidGroup, pDacl, pSacl );
4173             RegCloseKey( handle );
4174         }
4175         break;
4176     case SE_FILE_OBJECT:
4177         if (SecurityInfo & DACL_SECURITY_INFORMATION)
4178             access |= READ_CONTROL;
4179         if (!(err = get_security_file( pObjectName, access, &handle )))
4180         {
4181             err = SetSecurityInfo( handle, ObjectType, SecurityInfo, psidOwner, psidGroup, pDacl, pSacl );
4182             CloseHandle( handle );
4183         }
4184         break;
4185     default:
4186         FIXME( "Object type %d is not currently supported.\n", ObjectType );
4187         return ERROR_SUCCESS;
4188     }
4189     return err;
4190 }
4191
4192 /******************************************************************************
4193  * GetExplicitEntriesFromAclA [ADVAPI32.@]
4194  */
4195 DWORD WINAPI GetExplicitEntriesFromAclA( PACL pacl, PULONG pcCountOfExplicitEntries,
4196         PEXPLICIT_ACCESSA* pListOfExplicitEntries)
4197 {
4198     FIXME("%p %p %p\n",pacl, pcCountOfExplicitEntries, pListOfExplicitEntries);
4199     return ERROR_CALL_NOT_IMPLEMENTED;
4200 }
4201
4202 /******************************************************************************
4203  * GetExplicitEntriesFromAclW [ADVAPI32.@]
4204  */
4205 DWORD WINAPI GetExplicitEntriesFromAclW( PACL pacl, PULONG count, PEXPLICIT_ACCESSW *list )
4206 {
4207     ACL_SIZE_INFORMATION sizeinfo;
4208     EXPLICIT_ACCESSW *entries;
4209     MAX_SID *sid_entries;
4210     ACE_HEADER *ace;
4211     NTSTATUS status;
4212     int i;
4213
4214     TRACE("%p %p %p\n",pacl, count, list);
4215
4216     if (!count || !list)
4217         return ERROR_INVALID_PARAMETER;
4218
4219     status = RtlQueryInformationAcl(pacl, &sizeinfo, sizeof(sizeinfo), AclSizeInformation);
4220     if (status) return RtlNtStatusToDosError(status);
4221
4222     if (!sizeinfo.AceCount)
4223     {
4224         *count = 0;
4225         *list = NULL;
4226         return ERROR_SUCCESS;
4227     }
4228
4229     entries = LocalAlloc(LMEM_FIXED | LMEM_ZEROINIT, (sizeof(EXPLICIT_ACCESSW) + sizeof(MAX_SID)) * sizeinfo.AceCount);
4230     if (!entries) return ERROR_OUTOFMEMORY;
4231     sid_entries = (MAX_SID *)(entries + sizeinfo.AceCount);
4232
4233     for (i = 0; i < sizeinfo.AceCount; i++)
4234     {
4235         status = RtlGetAce(pacl, i, (void**)&ace);
4236         if (status) goto error;
4237
4238         switch (ace->AceType)
4239         {
4240             case ACCESS_ALLOWED_ACE_TYPE:
4241             {
4242                 ACCESS_ALLOWED_ACE *allow = (ACCESS_ALLOWED_ACE *)ace;
4243                 entries[i].grfAccessMode = GRANT_ACCESS;
4244                 entries[i].grfInheritance = ace->AceFlags;
4245                 entries[i].grfAccessPermissions = allow->Mask;
4246
4247                 CopySid(sizeof(MAX_SID), (PSID)&sid_entries[i], (PSID)&allow->SidStart);
4248                 entries[i].Trustee.pMultipleTrustee = NULL;
4249                 entries[i].Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
4250                 entries[i].Trustee.TrusteeForm = TRUSTEE_IS_SID;
4251                 entries[i].Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
4252                 entries[i].Trustee.ptstrName = (WCHAR *)&sid_entries[i];
4253                 break;
4254             }
4255
4256             case ACCESS_DENIED_ACE_TYPE:
4257             {
4258                 ACCESS_DENIED_ACE *deny = (ACCESS_DENIED_ACE *)ace;
4259                 entries[i].grfAccessMode = DENY_ACCESS;
4260                 entries[i].grfInheritance = ace->AceFlags;
4261                 entries[i].grfAccessPermissions = deny->Mask;
4262
4263                 CopySid(sizeof(MAX_SID), (PSID)&sid_entries[i], (PSID)&deny->SidStart);
4264                 entries[i].Trustee.pMultipleTrustee = NULL;
4265                 entries[i].Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
4266                 entries[i].Trustee.TrusteeForm = TRUSTEE_IS_SID;
4267                 entries[i].Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
4268                 entries[i].Trustee.ptstrName = (WCHAR *)&sid_entries[i];
4269                 break;
4270             }
4271
4272             default:
4273                 FIXME("Unhandled ace type %d\n", ace->AceType);
4274                 entries[i].grfAccessMode = NOT_USED_ACCESS;
4275                 continue;
4276         }
4277     }
4278
4279     *count = sizeinfo.AceCount;
4280     *list = entries;
4281     return ERROR_SUCCESS;
4282
4283 error:
4284     LocalFree(entries);
4285     return RtlNtStatusToDosError(status);
4286 }
4287
4288 /******************************************************************************
4289  * GetAuditedPermissionsFromAclA [ADVAPI32.@]
4290  */
4291 DWORD WINAPI GetAuditedPermissionsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pSuccessfulAuditedRights,
4292         PACCESS_MASK pFailedAuditRights)
4293 {
4294     FIXME("%p %p %p %p\n",pacl, pTrustee, pSuccessfulAuditedRights, pFailedAuditRights);
4295     return ERROR_CALL_NOT_IMPLEMENTED;
4296
4297 }
4298
4299 /******************************************************************************
4300  * GetAuditedPermissionsFromAclW [ADVAPI32.@]
4301  */
4302 DWORD WINAPI GetAuditedPermissionsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pSuccessfulAuditedRights,
4303         PACCESS_MASK pFailedAuditRights)
4304 {
4305     FIXME("%p %p %p %p\n",pacl, pTrustee, pSuccessfulAuditedRights, pFailedAuditRights);
4306     return ERROR_CALL_NOT_IMPLEMENTED;
4307
4308 }
4309
4310 /******************************************************************************
4311  * ParseAclStringFlags
4312  */
4313 static DWORD ParseAclStringFlags(LPCWSTR* StringAcl)
4314 {
4315     DWORD flags = 0;
4316     LPCWSTR szAcl = *StringAcl;
4317
4318     while (*szAcl && *szAcl != '(')
4319     {
4320         if (*szAcl == 'P')
4321         {
4322             flags |= SE_DACL_PROTECTED;
4323         }
4324         else if (*szAcl == 'A')
4325         {
4326             szAcl++;
4327             if (*szAcl == 'R')
4328                 flags |= SE_DACL_AUTO_INHERIT_REQ;
4329             else if (*szAcl == 'I')
4330                 flags |= SE_DACL_AUTO_INHERITED;
4331         }
4332         szAcl++;
4333     }
4334
4335     *StringAcl = szAcl;
4336     return flags;
4337 }
4338
4339 /******************************************************************************
4340  * ParseAceStringType
4341  */
4342 static const ACEFLAG AceType[] =
4343 {
4344     { SDDL_ALARM,          SYSTEM_ALARM_ACE_TYPE },
4345     { SDDL_AUDIT,          SYSTEM_AUDIT_ACE_TYPE },
4346     { SDDL_ACCESS_ALLOWED, ACCESS_ALLOWED_ACE_TYPE },
4347     { SDDL_ACCESS_DENIED,  ACCESS_DENIED_ACE_TYPE },
4348     { SDDL_MANDATORY_LABEL,SYSTEM_MANDATORY_LABEL_ACE_TYPE },
4349     /*
4350     { SDDL_OBJECT_ACCESS_ALLOWED, ACCESS_ALLOWED_OBJECT_ACE_TYPE },
4351     { SDDL_OBJECT_ACCESS_DENIED,  ACCESS_DENIED_OBJECT_ACE_TYPE },
4352     { SDDL_OBJECT_ALARM,          SYSTEM_ALARM_OBJECT_ACE_TYPE },
4353     { SDDL_OBJECT_AUDIT,          SYSTEM_AUDIT_OBJECT_ACE_TYPE },
4354     */
4355     { NULL, 0 },
4356 };
4357
4358 static BYTE ParseAceStringType(LPCWSTR* StringAcl)
4359 {
4360     UINT len = 0;
4361     LPCWSTR szAcl = *StringAcl;
4362     const ACEFLAG *lpaf = AceType;
4363
4364     while (*szAcl == ' ')
4365         szAcl++;
4366
4367     while (lpaf->wstr &&
4368         (len = strlenW(lpaf->wstr)) &&
4369         strncmpW(lpaf->wstr, szAcl, len))
4370         lpaf++;
4371
4372     if (!lpaf->wstr)
4373         return 0;
4374
4375     *StringAcl = szAcl + len;
4376     return lpaf->value;
4377 }
4378
4379
4380 /******************************************************************************
4381  * ParseAceStringFlags
4382  */
4383 static const ACEFLAG AceFlags[] =
4384 {
4385     { SDDL_CONTAINER_INHERIT, CONTAINER_INHERIT_ACE },
4386     { SDDL_AUDIT_FAILURE,     FAILED_ACCESS_ACE_FLAG },
4387     { SDDL_INHERITED,         INHERITED_ACE },
4388     { SDDL_INHERIT_ONLY,      INHERIT_ONLY_ACE },
4389     { SDDL_NO_PROPAGATE,      NO_PROPAGATE_INHERIT_ACE },
4390     { SDDL_OBJECT_INHERIT,    OBJECT_INHERIT_ACE },
4391     { SDDL_AUDIT_SUCCESS,     SUCCESSFUL_ACCESS_ACE_FLAG },
4392     { NULL, 0 },
4393 };
4394
4395 static BYTE ParseAceStringFlags(LPCWSTR* StringAcl)
4396 {
4397     UINT len = 0;
4398     BYTE flags = 0;
4399     LPCWSTR szAcl = *StringAcl;
4400
4401     while (*szAcl == ' ')
4402         szAcl++;
4403
4404     while (*szAcl != ';')
4405     {
4406         const ACEFLAG *lpaf = AceFlags;
4407
4408         while (lpaf->wstr &&
4409                (len = strlenW(lpaf->wstr)) &&
4410                strncmpW(lpaf->wstr, szAcl, len))
4411             lpaf++;
4412
4413         if (!lpaf->wstr)
4414             return 0;
4415
4416         flags |= lpaf->value;
4417         szAcl += len;
4418     }
4419
4420     *StringAcl = szAcl;
4421     return flags;
4422 }
4423
4424
4425 /******************************************************************************
4426  * ParseAceStringRights
4427  */
4428 static const ACEFLAG AceRights[] =
4429 {
4430     { SDDL_GENERIC_ALL,     GENERIC_ALL },
4431     { SDDL_GENERIC_READ,    GENERIC_READ },
4432     { SDDL_GENERIC_WRITE,   GENERIC_WRITE },
4433     { SDDL_GENERIC_EXECUTE, GENERIC_EXECUTE },
4434
4435     { SDDL_READ_CONTROL,    READ_CONTROL },
4436     { SDDL_STANDARD_DELETE, DELETE },
4437     { SDDL_WRITE_DAC,       WRITE_DAC },
4438     { SDDL_WRITE_OWNER,     WRITE_OWNER },
4439
4440     { SDDL_READ_PROPERTY,   ADS_RIGHT_DS_READ_PROP},
4441     { SDDL_WRITE_PROPERTY,  ADS_RIGHT_DS_WRITE_PROP},
4442     { SDDL_CREATE_CHILD,    ADS_RIGHT_DS_CREATE_CHILD},
4443     { SDDL_DELETE_CHILD,    ADS_RIGHT_DS_DELETE_CHILD},
4444     { SDDL_LIST_CHILDREN,   ADS_RIGHT_ACTRL_DS_LIST},
4445     { SDDL_SELF_WRITE,      ADS_RIGHT_DS_SELF},
4446     { SDDL_LIST_OBJECT,     ADS_RIGHT_DS_LIST_OBJECT},
4447     { SDDL_DELETE_TREE,     ADS_RIGHT_DS_DELETE_TREE},
4448     { SDDL_CONTROL_ACCESS,  ADS_RIGHT_DS_CONTROL_ACCESS},
4449
4450     { SDDL_FILE_ALL,        FILE_ALL_ACCESS },
4451     { SDDL_FILE_READ,       FILE_GENERIC_READ },
4452     { SDDL_FILE_WRITE,      FILE_GENERIC_WRITE },
4453     { SDDL_FILE_EXECUTE,    FILE_GENERIC_EXECUTE },
4454
4455     { SDDL_KEY_ALL,         KEY_ALL_ACCESS },
4456     { SDDL_KEY_READ,        KEY_READ },
4457     { SDDL_KEY_WRITE,       KEY_WRITE },
4458     { SDDL_KEY_EXECUTE,     KEY_EXECUTE },
4459
4460     { SDDL_NO_READ_UP,      SYSTEM_MANDATORY_LABEL_NO_READ_UP },
4461     { SDDL_NO_WRITE_UP,     SYSTEM_MANDATORY_LABEL_NO_WRITE_UP },
4462     { SDDL_NO_EXECUTE_UP,   SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP },
4463     { NULL, 0 },
4464 };
4465
4466 static DWORD ParseAceStringRights(LPCWSTR* StringAcl)
4467 {
4468     UINT len = 0;
4469     DWORD rights = 0;
4470     LPCWSTR szAcl = *StringAcl;
4471
4472     while (*szAcl == ' ')
4473         szAcl++;
4474
4475     if ((*szAcl == '0') && (*(szAcl + 1) == 'x'))
4476     {
4477         LPCWSTR p = szAcl;
4478
4479         while (*p && *p != ';')
4480             p++;
4481
4482         if (p - szAcl <= 10 /* 8 hex digits + "0x" */ )
4483         {
4484             rights = strtoulW(szAcl, NULL, 16);
4485             szAcl = p;
4486         }
4487         else
4488             WARN("Invalid rights string format: %s\n", debugstr_wn(szAcl, p - szAcl));
4489     }
4490     else
4491     {
4492         while (*szAcl != ';')
4493         {
4494             const ACEFLAG *lpaf = AceRights;
4495
4496             while (lpaf->wstr &&
4497                (len = strlenW(lpaf->wstr)) &&
4498                strncmpW(lpaf->wstr, szAcl, len))
4499             {
4500                lpaf++;
4501             }
4502
4503             if (!lpaf->wstr)
4504                 return 0;
4505
4506             rights |= lpaf->value;
4507             szAcl += len;
4508         }
4509     }
4510
4511     *StringAcl = szAcl;
4512     return rights;
4513 }
4514
4515
4516 /******************************************************************************
4517  * ParseStringAclToAcl
4518  *
4519  * dacl_flags(string_ace1)(string_ace2)... (string_acen)
4520  */
4521 static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags,
4522     PACL pAcl, LPDWORD cBytes)
4523 {
4524     DWORD val;
4525     DWORD sidlen;
4526     DWORD length = sizeof(ACL);
4527     DWORD acesize = 0;
4528     DWORD acecount = 0;
4529     PACCESS_ALLOWED_ACE pAce = NULL; /* pointer to current ACE */
4530     DWORD error = ERROR_INVALID_ACL;
4531
4532     TRACE("%s\n", debugstr_w(StringAcl));
4533
4534     if (!StringAcl)
4535         return FALSE;
4536
4537     if (pAcl) /* pAce is only useful if we're setting values */
4538         pAce = (PACCESS_ALLOWED_ACE) (pAcl + 1);
4539
4540     /* Parse ACL flags */
4541     *lpdwFlags = ParseAclStringFlags(&StringAcl);
4542
4543     /* Parse ACE */
4544     while (*StringAcl == '(')
4545     {
4546         StringAcl++;
4547
4548         /* Parse ACE type */
4549         val = ParseAceStringType(&StringAcl);
4550         if (pAce)
4551             pAce->Header.AceType = (BYTE) val;
4552         if (*StringAcl != ';')
4553         {
4554             error = RPC_S_INVALID_STRING_UUID;
4555             goto lerr;
4556         }
4557         StringAcl++;
4558
4559         /* Parse ACE flags */
4560         val = ParseAceStringFlags(&StringAcl);
4561         if (pAce)
4562             pAce->Header.AceFlags = (BYTE) val;
4563         if (*StringAcl != ';')
4564             goto lerr;
4565         StringAcl++;
4566
4567         /* Parse ACE rights */
4568         val = ParseAceStringRights(&StringAcl);
4569         if (pAce)
4570             pAce->Mask = val;
4571         if (*StringAcl != ';')
4572             goto lerr;
4573         StringAcl++;
4574
4575         /* Parse ACE object guid */
4576         while (*StringAcl == ' ')
4577             StringAcl++;
4578         if (*StringAcl != ';')
4579         {
4580             FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
4581             goto lerr;
4582         }
4583         StringAcl++;
4584
4585         /* Parse ACE inherit object guid */
4586         while (*StringAcl == ' ')
4587             StringAcl++;
4588         if (*StringAcl != ';')
4589         {
4590             FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
4591             goto lerr;
4592         }
4593         StringAcl++;
4594
4595         /* Parse ACE account sid */
4596         if (ParseStringSidToSid(StringAcl, pAce ? &pAce->SidStart : NULL, &sidlen))
4597         {
4598             while (*StringAcl && *StringAcl != ')')
4599                 StringAcl++;
4600         }
4601
4602         if (*StringAcl != ')')
4603             goto lerr;
4604         StringAcl++;
4605
4606         acesize = sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) + sidlen;
4607         length += acesize;
4608         if (pAce)
4609         {
4610             pAce->Header.AceSize = acesize;
4611             pAce = (PACCESS_ALLOWED_ACE)((LPBYTE)pAce + acesize);
4612         }
4613         acecount++;
4614     }
4615
4616     *cBytes = length;
4617
4618     if (length > 0xffff)
4619     {
4620         ERR("ACL too large\n");
4621         goto lerr;
4622     }
4623
4624     if (pAcl)
4625     {
4626         pAcl->AclRevision = ACL_REVISION;
4627         pAcl->Sbz1 = 0;
4628         pAcl->AclSize = length;
4629         pAcl->AceCount = acecount;
4630         pAcl->Sbz2 = 0;
4631     }
4632     return TRUE;
4633
4634 lerr:
4635     SetLastError(error);
4636     WARN("Invalid ACE string format\n");
4637     return FALSE;
4638 }
4639
4640
4641 /******************************************************************************
4642  * ParseStringSecurityDescriptorToSecurityDescriptor
4643  */
4644 static BOOL ParseStringSecurityDescriptorToSecurityDescriptor(
4645     LPCWSTR StringSecurityDescriptor,
4646     SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
4647     LPDWORD cBytes)
4648 {
4649     BOOL bret = FALSE;
4650     WCHAR toktype;
4651     WCHAR *tok;
4652     LPCWSTR lptoken;
4653     LPBYTE lpNext = NULL;
4654     DWORD len;
4655
4656     *cBytes = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
4657
4658     tok = heap_alloc( (lstrlenW(StringSecurityDescriptor) + 1) * sizeof(WCHAR));
4659
4660     if (SecurityDescriptor)
4661         lpNext = (LPBYTE)(SecurityDescriptor + 1);
4662
4663     while (*StringSecurityDescriptor == ' ')
4664         StringSecurityDescriptor++;
4665
4666     while (*StringSecurityDescriptor)
4667     {
4668         toktype = *StringSecurityDescriptor;
4669
4670         /* Expect char identifier followed by ':' */
4671         StringSecurityDescriptor++;
4672         if (*StringSecurityDescriptor != ':')
4673         {
4674             SetLastError(ERROR_INVALID_PARAMETER);
4675             goto lend;
4676         }
4677         StringSecurityDescriptor++;
4678
4679         /* Extract token */
4680         lptoken = StringSecurityDescriptor;
4681         while (*lptoken && *lptoken != ':')
4682             lptoken++;
4683
4684         if (*lptoken)
4685             lptoken--;
4686
4687         len = lptoken - StringSecurityDescriptor;
4688         memcpy( tok, StringSecurityDescriptor, len * sizeof(WCHAR) );
4689         tok[len] = 0;
4690
4691         switch (toktype)
4692         {
4693             case 'O':
4694             {
4695                 DWORD bytes;
4696
4697                 if (!ParseStringSidToSid(tok, lpNext, &bytes))
4698                     goto lend;
4699
4700                 if (SecurityDescriptor)
4701                 {
4702                     SecurityDescriptor->Owner = lpNext - (LPBYTE)SecurityDescriptor;
4703                     lpNext += bytes; /* Advance to next token */
4704                 }
4705
4706                 *cBytes += bytes;
4707
4708                 break;
4709             }
4710
4711             case 'G':
4712             {
4713                 DWORD bytes;
4714
4715                 if (!ParseStringSidToSid(tok, lpNext, &bytes))
4716                     goto lend;
4717
4718                 if (SecurityDescriptor)
4719                 {
4720                     SecurityDescriptor->Group = lpNext - (LPBYTE)SecurityDescriptor;
4721                     lpNext += bytes; /* Advance to next token */
4722                 }
4723
4724                 *cBytes += bytes;
4725
4726                 break;
4727             }
4728
4729             case 'D':
4730             {
4731                 DWORD flags;
4732                 DWORD bytes;
4733
4734                 if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
4735                     goto lend;
4736
4737                 if (SecurityDescriptor)
4738                 {
4739                     SecurityDescriptor->Control |= SE_DACL_PRESENT | flags;
4740                     SecurityDescriptor->Dacl = lpNext - (LPBYTE)SecurityDescriptor;
4741                     lpNext += bytes; /* Advance to next token */
4742                 }
4743
4744                 *cBytes += bytes;
4745
4746                 break;
4747             }
4748
4749             case 'S':
4750             {
4751                 DWORD flags;
4752                 DWORD bytes;
4753
4754                 if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
4755                     goto lend;
4756
4757                 if (SecurityDescriptor)
4758                 {
4759                     SecurityDescriptor->Control |= SE_SACL_PRESENT | flags;
4760                     SecurityDescriptor->Sacl = lpNext - (LPBYTE)SecurityDescriptor;
4761                     lpNext += bytes; /* Advance to next token */
4762                 }
4763
4764                 *cBytes += bytes;
4765
4766                 break;
4767             }
4768
4769             default:
4770                 FIXME("Unknown token\n");
4771                 SetLastError(ERROR_INVALID_PARAMETER);
4772                 goto lend;
4773         }
4774
4775         StringSecurityDescriptor = lptoken;
4776     }
4777
4778     bret = TRUE;
4779
4780 lend:
4781     heap_free(tok);
4782     return bret;
4783 }
4784
4785 /******************************************************************************
4786  * ConvertStringSecurityDescriptorToSecurityDescriptorA [ADVAPI32.@]
4787  */
4788 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorA(
4789         LPCSTR StringSecurityDescriptor,
4790         DWORD StringSDRevision,
4791         PSECURITY_DESCRIPTOR* SecurityDescriptor,
4792         PULONG SecurityDescriptorSize)
4793 {
4794     BOOL ret;
4795     LPWSTR StringSecurityDescriptorW;
4796
4797     TRACE("%s, %u, %p, %p\n", debugstr_a(StringSecurityDescriptor), StringSDRevision,
4798           SecurityDescriptor, SecurityDescriptorSize);
4799
4800     if(!StringSecurityDescriptor)
4801         return FALSE;
4802
4803     StringSecurityDescriptorW = SERV_dup(StringSecurityDescriptor);
4804     ret = ConvertStringSecurityDescriptorToSecurityDescriptorW(StringSecurityDescriptorW,
4805                                                                StringSDRevision, SecurityDescriptor,
4806                                                                SecurityDescriptorSize);
4807     heap_free(StringSecurityDescriptorW);
4808
4809     return ret;
4810 }
4811
4812 /******************************************************************************
4813  * ConvertStringSecurityDescriptorToSecurityDescriptorW [ADVAPI32.@]
4814  */
4815 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorW(
4816         LPCWSTR StringSecurityDescriptor,
4817         DWORD StringSDRevision,
4818         PSECURITY_DESCRIPTOR* SecurityDescriptor,
4819         PULONG SecurityDescriptorSize)
4820 {
4821     DWORD cBytes;
4822     SECURITY_DESCRIPTOR* psd;
4823     BOOL bret = FALSE;
4824
4825     TRACE("%s, %u, %p, %p\n", debugstr_w(StringSecurityDescriptor), StringSDRevision,
4826           SecurityDescriptor, SecurityDescriptorSize);
4827
4828     if (GetVersion() & 0x80000000)
4829     {
4830         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4831         goto lend;
4832     }
4833     else if (!StringSecurityDescriptor || !SecurityDescriptor)
4834     {
4835         SetLastError(ERROR_INVALID_PARAMETER);
4836         goto lend;
4837     }
4838     else if (StringSDRevision != SID_REVISION)
4839     {
4840         SetLastError(ERROR_UNKNOWN_REVISION);
4841         goto lend;
4842     }
4843
4844     /* Compute security descriptor length */
4845     if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
4846         NULL, &cBytes))
4847         goto lend;
4848
4849     psd = *SecurityDescriptor = LocalAlloc(GMEM_ZEROINIT, cBytes);
4850     if (!psd) goto lend;
4851
4852     psd->Revision = SID_REVISION;
4853     psd->Control |= SE_SELF_RELATIVE;
4854
4855     if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
4856              (SECURITY_DESCRIPTOR_RELATIVE *)psd, &cBytes))
4857     {
4858         LocalFree(psd);
4859         goto lend;
4860     }
4861
4862     if (SecurityDescriptorSize)
4863         *SecurityDescriptorSize = cBytes;
4864
4865     bret = TRUE;
4866
4867 lend:
4868     TRACE(" ret=%d\n", bret);
4869     return bret;
4870 }
4871
4872 static void DumpString(LPCWSTR string, int cch, WCHAR **pwptr, ULONG *plen)
4873 {
4874     if (cch == -1)
4875         cch = strlenW(string);
4876
4877     if (plen)
4878         *plen += cch;
4879
4880     if (pwptr)
4881     {
4882         memcpy(*pwptr, string, sizeof(WCHAR)*cch);
4883         *pwptr += cch;
4884     }
4885 }
4886
4887 static BOOL DumpSidNumeric(PSID psid, WCHAR **pwptr, ULONG *plen)
4888 {
4889     DWORD i;
4890     WCHAR fmt[] = { 'S','-','%','u','-','%','d',0 };
4891     WCHAR subauthfmt[] = { '-','%','u',0 };
4892     WCHAR buf[26];
4893     SID *pisid = psid;
4894
4895     if( !IsValidSid( psid ) || pisid->Revision != SDDL_REVISION)
4896     {
4897         SetLastError(ERROR_INVALID_SID);
4898         return FALSE;
4899     }
4900
4901     if (pisid->IdentifierAuthority.Value[0] ||
4902      pisid->IdentifierAuthority.Value[1])
4903     {
4904         FIXME("not matching MS' bugs\n");
4905         SetLastError(ERROR_INVALID_SID);
4906         return FALSE;
4907     }
4908
4909     sprintfW( buf, fmt, pisid->Revision,
4910         MAKELONG(
4911             MAKEWORD( pisid->IdentifierAuthority.Value[5],
4912                     pisid->IdentifierAuthority.Value[4] ),
4913             MAKEWORD( pisid->IdentifierAuthority.Value[3],
4914                     pisid->IdentifierAuthority.Value[2] )
4915         ) );
4916     DumpString(buf, -1, pwptr, plen);
4917
4918     for( i=0; i<pisid->SubAuthorityCount; i++ )
4919     {
4920         sprintfW( buf, subauthfmt, pisid->SubAuthority[i] );
4921         DumpString(buf, -1, pwptr, plen);
4922     }
4923     return TRUE;
4924 }
4925
4926 static BOOL DumpSid(PSID psid, WCHAR **pwptr, ULONG *plen)
4927 {
4928     size_t i;
4929     for (i = 0; i < sizeof(WellKnownSids) / sizeof(WellKnownSids[0]); i++)
4930     {
4931         if (WellKnownSids[i].wstr[0] && EqualSid(psid, (PSID)&(WellKnownSids[i].Sid.Revision)))
4932         {
4933             DumpString(WellKnownSids[i].wstr, 2, pwptr, plen);
4934             return TRUE;
4935         }
4936     }
4937
4938     return DumpSidNumeric(psid, pwptr, plen);
4939 }
4940
4941 static const LPCWSTR AceRightBitNames[32] = {
4942         SDDL_CREATE_CHILD,        /*  0 */
4943         SDDL_DELETE_CHILD,
4944         SDDL_LIST_CHILDREN,
4945         SDDL_SELF_WRITE,
4946         SDDL_READ_PROPERTY,       /*  4 */
4947         SDDL_WRITE_PROPERTY,
4948         SDDL_DELETE_TREE,
4949         SDDL_LIST_OBJECT,
4950         SDDL_CONTROL_ACCESS,      /*  8 */
4951         NULL,
4952         NULL,
4953         NULL,
4954         NULL,                     /* 12 */
4955         NULL,
4956         NULL,
4957         NULL,
4958         SDDL_STANDARD_DELETE,     /* 16 */
4959         SDDL_READ_CONTROL,
4960         SDDL_WRITE_DAC,
4961         SDDL_WRITE_OWNER,
4962         NULL,                     /* 20 */
4963         NULL,
4964         NULL,
4965         NULL,
4966         NULL,                     /* 24 */
4967         NULL,
4968         NULL,
4969         NULL,
4970         SDDL_GENERIC_ALL,         /* 28 */
4971         SDDL_GENERIC_EXECUTE,
4972         SDDL_GENERIC_WRITE,
4973         SDDL_GENERIC_READ
4974 };
4975
4976 static void DumpRights(DWORD mask, WCHAR **pwptr, ULONG *plen)
4977 {
4978     static const WCHAR fmtW[] = {'0','x','%','x',0};
4979     WCHAR buf[15];
4980     size_t i;
4981
4982     if (mask == 0)
4983         return;
4984
4985     /* first check if the right have name */
4986     for (i = 0; i < sizeof(AceRights)/sizeof(AceRights[0]); i++)
4987     {
4988         if (AceRights[i].wstr == NULL)
4989             break;
4990         if (mask == AceRights[i].value)
4991         {
4992             DumpString(AceRights[i].wstr, -1, pwptr, plen);
4993             return;
4994         }
4995     }
4996
4997     /* then check if it can be built from bit names */
4998     for (i = 0; i < 32; i++)
4999     {
5000         if ((mask & (1 << i)) && (AceRightBitNames[i] == NULL))
5001         {
5002             /* can't be built from bit names */
5003             sprintfW(buf, fmtW, mask);
5004             DumpString(buf, -1, pwptr, plen);
5005             return;
5006         }
5007     }
5008
5009     /* build from bit names */
5010     for (i = 0; i < 32; i++)
5011         if (mask & (1 << i))
5012             DumpString(AceRightBitNames[i], -1, pwptr, plen);
5013 }
5014
5015 static BOOL DumpAce(LPVOID pace, WCHAR **pwptr, ULONG *plen)
5016 {
5017     ACCESS_ALLOWED_ACE *piace; /* all the supported ACEs have the same memory layout */
5018     static const WCHAR openbr = '(';
5019     static const WCHAR closebr = ')';
5020     static const WCHAR semicolon = ';';
5021
5022     if (((PACE_HEADER)pace)->AceType > SYSTEM_ALARM_ACE_TYPE || ((PACE_HEADER)pace)->AceSize < sizeof(ACCESS_ALLOWED_ACE))
5023     {
5024         SetLastError(ERROR_INVALID_ACL);
5025         return FALSE;
5026     }
5027
5028     piace = pace;
5029     DumpString(&openbr, 1, pwptr, plen);
5030     switch (piace->Header.AceType)
5031     {
5032         case ACCESS_ALLOWED_ACE_TYPE:
5033             DumpString(SDDL_ACCESS_ALLOWED, -1, pwptr, plen);
5034             break;
5035         case ACCESS_DENIED_ACE_TYPE:
5036             DumpString(SDDL_ACCESS_DENIED, -1, pwptr, plen);
5037             break;
5038         case SYSTEM_AUDIT_ACE_TYPE:
5039             DumpString(SDDL_AUDIT, -1, pwptr, plen);
5040             break;
5041         case SYSTEM_ALARM_ACE_TYPE:
5042             DumpString(SDDL_ALARM, -1, pwptr, plen);
5043             break;
5044     }
5045     DumpString(&semicolon, 1, pwptr, plen);
5046
5047     if (piace->Header.AceFlags & OBJECT_INHERIT_ACE)
5048         DumpString(SDDL_OBJECT_INHERIT, -1, pwptr, plen);
5049     if (piace->Header.AceFlags & CONTAINER_INHERIT_ACE)
5050         DumpString(SDDL_CONTAINER_INHERIT, -1, pwptr, plen);
5051     if (piace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE)
5052         DumpString(SDDL_NO_PROPAGATE, -1, pwptr, plen);
5053     if (piace->Header.AceFlags & INHERIT_ONLY_ACE)
5054         DumpString(SDDL_INHERIT_ONLY, -1, pwptr, plen);
5055     if (piace->Header.AceFlags & INHERITED_ACE)
5056         DumpString(SDDL_INHERITED, -1, pwptr, plen);
5057     if (piace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG)
5058         DumpString(SDDL_AUDIT_SUCCESS, -1, pwptr, plen);
5059     if (piace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG)
5060         DumpString(SDDL_AUDIT_FAILURE, -1, pwptr, plen);
5061     DumpString(&semicolon, 1, pwptr, plen);
5062     DumpRights(piace->Mask, pwptr, plen);
5063     DumpString(&semicolon, 1, pwptr, plen);
5064     /* objects not supported */
5065     DumpString(&semicolon, 1, pwptr, plen);
5066     /* objects not supported */
5067     DumpString(&semicolon, 1, pwptr, plen);
5068     if (!DumpSid(&piace->SidStart, pwptr, plen))
5069         return FALSE;
5070     DumpString(&closebr, 1, pwptr, plen);
5071     return TRUE;
5072 }
5073
5074 static BOOL DumpAcl(PACL pacl, WCHAR **pwptr, ULONG *plen, BOOL protected, BOOL autoInheritReq, BOOL autoInherited)
5075 {
5076     WORD count;
5077     UINT i;
5078
5079     if (protected)
5080         DumpString(SDDL_PROTECTED, -1, pwptr, plen);
5081     if (autoInheritReq)
5082         DumpString(SDDL_AUTO_INHERIT_REQ, -1, pwptr, plen);
5083     if (autoInherited)
5084         DumpString(SDDL_AUTO_INHERITED, -1, pwptr, plen);
5085
5086     if (pacl == NULL)
5087         return TRUE;
5088
5089     if (!IsValidAcl(pacl))
5090         return FALSE;
5091
5092     count = pacl->AceCount;
5093     for (i = 0; i < count; i++)
5094     {
5095         LPVOID ace;
5096         if (!GetAce(pacl, i, &ace))
5097             return FALSE;
5098         if (!DumpAce(ace, pwptr, plen))
5099             return FALSE;
5100     }
5101
5102     return TRUE;
5103 }
5104
5105 static BOOL DumpOwner(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
5106 {
5107     static const WCHAR prefix[] = {'O',':',0};
5108     BOOL bDefaulted;
5109     PSID psid;
5110
5111     if (!GetSecurityDescriptorOwner(SecurityDescriptor, &psid, &bDefaulted))
5112         return FALSE;
5113
5114     if (psid == NULL)
5115         return TRUE;
5116
5117     DumpString(prefix, -1, pwptr, plen);
5118     if (!DumpSid(psid, pwptr, plen))
5119         return FALSE;
5120     return TRUE;
5121 }
5122
5123 static BOOL DumpGroup(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
5124 {
5125     static const WCHAR prefix[] = {'G',':',0};
5126     BOOL bDefaulted;
5127     PSID psid;
5128
5129     if (!GetSecurityDescriptorGroup(SecurityDescriptor, &psid, &bDefaulted))
5130         return FALSE;
5131
5132     if (psid == NULL)
5133         return TRUE;
5134
5135     DumpString(prefix, -1, pwptr, plen);
5136     if (!DumpSid(psid, pwptr, plen))
5137         return FALSE;
5138     return TRUE;
5139 }
5140
5141 static BOOL DumpDacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
5142 {
5143     static const WCHAR dacl[] = {'D',':',0};
5144     SECURITY_DESCRIPTOR_CONTROL control;
5145     BOOL present, defaulted;
5146     DWORD revision;
5147     PACL pacl;
5148
5149     if (!GetSecurityDescriptorDacl(SecurityDescriptor, &present, &pacl, &defaulted))
5150         return FALSE;
5151
5152     if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
5153         return FALSE;
5154
5155     if (!present)
5156         return TRUE;
5157
5158     DumpString(dacl, 2, pwptr, plen);
5159     if (!DumpAcl(pacl, pwptr, plen, control & SE_DACL_PROTECTED, control & SE_DACL_AUTO_INHERIT_REQ, control & SE_DACL_AUTO_INHERITED))
5160         return FALSE;
5161     return TRUE;
5162 }
5163
5164 static BOOL DumpSacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
5165 {
5166     static const WCHAR sacl[] = {'S',':',0};
5167     SECURITY_DESCRIPTOR_CONTROL control;
5168     BOOL present, defaulted;
5169     DWORD revision;
5170     PACL pacl;
5171
5172     if (!GetSecurityDescriptorSacl(SecurityDescriptor, &present, &pacl, &defaulted))
5173         return FALSE;
5174
5175     if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
5176         return FALSE;
5177
5178     if (!present)
5179         return TRUE;
5180
5181     DumpString(sacl, 2, pwptr, plen);
5182     if (!DumpAcl(pacl, pwptr, plen, control & SE_SACL_PROTECTED, control & SE_SACL_AUTO_INHERIT_REQ, control & SE_SACL_AUTO_INHERITED))
5183         return FALSE;
5184     return TRUE;
5185 }
5186
5187 /******************************************************************************
5188  * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
5189  */
5190 BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorW(PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION RequestedInformation, LPWSTR *OutputString, PULONG OutputLen)
5191 {
5192     ULONG len;
5193     WCHAR *wptr, *wstr;
5194
5195     if (SDRevision != SDDL_REVISION_1)
5196     {
5197         ERR("Program requested unknown SDDL revision %d\n", SDRevision);
5198         SetLastError(ERROR_UNKNOWN_REVISION);
5199         return FALSE;
5200     }
5201
5202     len = 0;
5203     if (RequestedInformation & OWNER_SECURITY_INFORMATION)
5204         if (!DumpOwner(SecurityDescriptor, NULL, &len))
5205             return FALSE;
5206     if (RequestedInformation & GROUP_SECURITY_INFORMATION)
5207         if (!DumpGroup(SecurityDescriptor, NULL, &len))
5208             return FALSE;
5209     if (RequestedInformation & DACL_SECURITY_INFORMATION)
5210         if (!DumpDacl(SecurityDescriptor, NULL, &len))
5211             return FALSE;
5212     if (RequestedInformation & SACL_SECURITY_INFORMATION)
5213         if (!DumpSacl(SecurityDescriptor, NULL, &len))
5214             return FALSE;
5215
5216     wstr = wptr = LocalAlloc(0, (len + 1)*sizeof(WCHAR));
5217     if (RequestedInformation & OWNER_SECURITY_INFORMATION)
5218         if (!DumpOwner(SecurityDescriptor, &wptr, NULL)) {
5219             LocalFree (wstr);
5220             return FALSE;
5221         }
5222     if (RequestedInformation & GROUP_SECURITY_INFORMATION)
5223         if (!DumpGroup(SecurityDescriptor, &wptr, NULL)) {
5224             LocalFree (wstr);
5225             return FALSE;
5226         }
5227     if (RequestedInformation & DACL_SECURITY_INFORMATION)
5228         if (!DumpDacl(SecurityDescriptor, &wptr, NULL)) {
5229             LocalFree (wstr);
5230             return FALSE;
5231         }
5232     if (RequestedInformation & SACL_SECURITY_INFORMATION)
5233         if (!DumpSacl(SecurityDescriptor, &wptr, NULL)) {
5234             LocalFree (wstr);
5235             return FALSE;
5236         }
5237     *wptr = 0;
5238
5239     TRACE("ret: %s, %d\n", wine_dbgstr_w(wstr), len);
5240     *OutputString = wstr;
5241     if (OutputLen)
5242         *OutputLen = strlenW(*OutputString)+1;
5243     return TRUE;
5244 }
5245
5246 /******************************************************************************
5247  * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
5248  */
5249 BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorA(PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION Information, LPSTR *OutputString, PULONG OutputLen)
5250 {
5251     LPWSTR wstr;
5252     ULONG len;
5253     if (ConvertSecurityDescriptorToStringSecurityDescriptorW(SecurityDescriptor, SDRevision, Information, &wstr, &len))
5254     {
5255         int lenA;
5256
5257         lenA = WideCharToMultiByte(CP_ACP, 0, wstr, len, NULL, 0, NULL, NULL);
5258         *OutputString = heap_alloc(lenA);
5259         WideCharToMultiByte(CP_ACP, 0, wstr, len, *OutputString, lenA, NULL, NULL);
5260         LocalFree(wstr);
5261
5262         if (OutputLen != NULL)
5263             *OutputLen = lenA;
5264         return TRUE;
5265     }
5266     else
5267     {
5268         *OutputString = NULL;
5269         if (OutputLen)
5270             *OutputLen = 0;
5271         return FALSE;
5272     }
5273 }
5274
5275 /******************************************************************************
5276  * ConvertStringSidToSidW [ADVAPI32.@]
5277  */
5278 BOOL WINAPI ConvertStringSidToSidW(LPCWSTR StringSid, PSID* Sid)
5279 {
5280     BOOL bret = FALSE;
5281     DWORD cBytes;
5282
5283     TRACE("%s, %p\n", debugstr_w(StringSid), Sid);
5284     if (GetVersion() & 0x80000000)
5285         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
5286     else if (!StringSid || !Sid)
5287         SetLastError(ERROR_INVALID_PARAMETER);
5288     else if (ParseStringSidToSid(StringSid, NULL, &cBytes))
5289     {
5290         PSID pSid = *Sid = LocalAlloc(0, cBytes);
5291
5292         bret = ParseStringSidToSid(StringSid, pSid, &cBytes);
5293         if (!bret)
5294             LocalFree(*Sid);
5295     }
5296     return bret;
5297 }
5298
5299 /******************************************************************************
5300  * ConvertStringSidToSidA [ADVAPI32.@]
5301  */
5302 BOOL WINAPI ConvertStringSidToSidA(LPCSTR StringSid, PSID* Sid)
5303 {
5304     BOOL bret = FALSE;
5305
5306     TRACE("%s, %p\n", debugstr_a(StringSid), Sid);
5307     if (GetVersion() & 0x80000000)
5308         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
5309     else if (!StringSid || !Sid)
5310         SetLastError(ERROR_INVALID_PARAMETER);
5311     else
5312     {
5313         WCHAR *wStringSid = SERV_dup(StringSid);
5314         bret = ConvertStringSidToSidW(wStringSid, Sid);
5315         heap_free(wStringSid);
5316     }
5317     return bret;
5318 }
5319
5320 /******************************************************************************
5321  * ConvertSidToStringSidW [ADVAPI32.@]
5322  *
5323  *  format of SID string is:
5324  *    S-<count>-<auth>-<subauth1>-<subauth2>-<subauth3>...
5325  *  where
5326  *    <rev> is the revision of the SID encoded as decimal
5327  *    <auth> is the identifier authority encoded as hex
5328  *    <subauthN> is the subauthority id encoded as decimal
5329  */
5330 BOOL WINAPI ConvertSidToStringSidW( PSID pSid, LPWSTR *pstr )
5331 {
5332     DWORD len = 0;
5333     LPWSTR wstr, wptr;
5334
5335     TRACE("%p %p\n", pSid, pstr );
5336
5337     len = 0;
5338     if (!DumpSidNumeric(pSid, NULL, &len))
5339         return FALSE;
5340     wstr = wptr = LocalAlloc(0, (len+1) * sizeof(WCHAR));
5341     DumpSidNumeric(pSid, &wptr, NULL);
5342     *wptr = 0;
5343
5344     *pstr = wstr;
5345     return TRUE;
5346 }
5347
5348 /******************************************************************************
5349  * ConvertSidToStringSidA [ADVAPI32.@]
5350  */
5351 BOOL WINAPI ConvertSidToStringSidA(PSID pSid, LPSTR *pstr)
5352 {
5353     LPWSTR wstr = NULL;
5354     LPSTR str;
5355     UINT len;
5356
5357     TRACE("%p %p\n", pSid, pstr );
5358
5359     if( !ConvertSidToStringSidW( pSid, &wstr ) )
5360         return FALSE;
5361
5362     len = WideCharToMultiByte( CP_ACP, 0, wstr, -1, NULL, 0, NULL, NULL );
5363     str = LocalAlloc( 0, len );
5364     WideCharToMultiByte( CP_ACP, 0, wstr, -1, str, len, NULL, NULL );
5365     LocalFree( wstr );
5366
5367     *pstr = str;
5368
5369     return TRUE;
5370 }
5371
5372 BOOL WINAPI ConvertToAutoInheritPrivateObjectSecurity(
5373         PSECURITY_DESCRIPTOR pdesc,
5374         PSECURITY_DESCRIPTOR cdesc,
5375         PSECURITY_DESCRIPTOR* ndesc,
5376         GUID* objtype,
5377         BOOL isdir,
5378         PGENERIC_MAPPING genmap )
5379 {
5380     FIXME("%p %p %p %p %d %p - stub\n", pdesc, cdesc, ndesc, objtype, isdir, genmap);
5381
5382     return FALSE;
5383 }
5384
5385 BOOL WINAPI CreatePrivateObjectSecurityEx(
5386     PSECURITY_DESCRIPTOR parent, PSECURITY_DESCRIPTOR creator, PSECURITY_DESCRIPTOR *out,
5387     GUID *objtype, BOOL is_directory, ULONG flags, HANDLE token, PGENERIC_MAPPING mapping)
5388 {
5389     SECURITY_DESCRIPTOR_RELATIVE *relative;
5390     DWORD needed, offset;
5391     BYTE *buffer;
5392
5393     FIXME("%p %p %p %p %d %u %p %p - returns fake SECURITY_DESCRIPTOR\n", parent, creator, out,
5394           objtype, is_directory, flags, token, mapping);
5395
5396     needed = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5397     needed += sizeof(sidWorld);
5398     needed += sizeof(sidWorld);
5399     needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5400     needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5401
5402     if (!(buffer = heap_alloc( needed ))) return FALSE;
5403     relative = (SECURITY_DESCRIPTOR_RELATIVE *)buffer;
5404     if (!InitializeSecurityDescriptor( relative, SECURITY_DESCRIPTOR_REVISION ))
5405     {
5406         heap_free( buffer );
5407         return FALSE;
5408     }
5409     relative->Control |= SE_SELF_RELATIVE;
5410     offset = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5411
5412     memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5413     relative->Owner = offset;
5414     offset += sizeof(sidWorld);
5415
5416     memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5417     relative->Group = offset;
5418     offset += sizeof(sidWorld);
5419
5420     GetWorldAccessACL( (ACL *)(buffer + offset) );
5421     relative->Dacl = offset;
5422     offset += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5423
5424     GetWorldAccessACL( (ACL *)(buffer + offset) );
5425     relative->Sacl = offset;
5426
5427     *out = relative;
5428     return TRUE;
5429 }
5430
5431 BOOL WINAPI CreatePrivateObjectSecurity(
5432     PSECURITY_DESCRIPTOR parent, PSECURITY_DESCRIPTOR creator, PSECURITY_DESCRIPTOR *out,
5433     BOOL is_container, HANDLE token, PGENERIC_MAPPING mapping)
5434 {
5435     return CreatePrivateObjectSecurityEx(parent, creator, out, NULL, is_container, 0, token, mapping);
5436 }
5437
5438 BOOL WINAPI CreatePrivateObjectSecurityWithMultipleInheritance(
5439     PSECURITY_DESCRIPTOR parent, PSECURITY_DESCRIPTOR creator, PSECURITY_DESCRIPTOR *out,
5440     GUID **types, ULONG count, BOOL is_container, ULONG flags, HANDLE token, PGENERIC_MAPPING mapping)
5441 {
5442     FIXME(": semi-stub\n");
5443     return CreatePrivateObjectSecurityEx(parent, creator, out, NULL, is_container, flags, token, mapping);
5444 }
5445
5446 BOOL WINAPI DestroyPrivateObjectSecurity( PSECURITY_DESCRIPTOR* ObjectDescriptor )
5447 {
5448     FIXME("%p - stub\n", ObjectDescriptor);
5449
5450     heap_free( *ObjectDescriptor );
5451     return TRUE;
5452 }
5453
5454 BOOL WINAPI DECLSPEC_HOTPATCH CreateProcessAsUserA(
5455         HANDLE hToken,
5456         LPCSTR lpApplicationName,
5457         LPSTR lpCommandLine,
5458         LPSECURITY_ATTRIBUTES lpProcessAttributes,
5459         LPSECURITY_ATTRIBUTES lpThreadAttributes,
5460         BOOL bInheritHandles,
5461         DWORD dwCreationFlags,
5462         LPVOID lpEnvironment,
5463         LPCSTR lpCurrentDirectory,
5464         LPSTARTUPINFOA lpStartupInfo,
5465         LPPROCESS_INFORMATION lpProcessInformation )
5466 {
5467     BOOL ret;
5468     WCHAR *appW, *cmdlnW, *cwdW;
5469     STARTUPINFOW sinfo;
5470
5471     TRACE("%p %s %s %p %p %d 0x%08x %p %s %p %p\n", hToken, debugstr_a(lpApplicationName),
5472           debugstr_a(lpCommandLine), lpProcessAttributes, lpThreadAttributes, bInheritHandles,
5473           dwCreationFlags, lpEnvironment, debugstr_a(lpCurrentDirectory), lpStartupInfo, lpProcessInformation);
5474
5475     appW = SERV_dup(lpApplicationName);
5476     cmdlnW = SERV_dup(lpCommandLine);
5477     cwdW = SERV_dup(lpCurrentDirectory);
5478     sinfo.cb = sizeof(sinfo);
5479     sinfo.lpReserved = SERV_dup(lpStartupInfo->lpReserved);
5480     sinfo.lpDesktop = SERV_dup(lpStartupInfo->lpDesktop);
5481     sinfo.lpTitle = SERV_dup(lpStartupInfo->lpTitle);
5482     sinfo.dwX = lpStartupInfo->dwX;
5483     sinfo.dwY = lpStartupInfo->dwY;
5484     sinfo.dwXSize = lpStartupInfo->dwXSize;
5485     sinfo.dwYSize = lpStartupInfo->dwYSize;
5486     sinfo.dwXCountChars = lpStartupInfo->dwXCountChars;
5487     sinfo.dwYCountChars = lpStartupInfo->dwYCountChars;
5488     sinfo.dwFillAttribute = lpStartupInfo->dwFillAttribute;
5489     sinfo.dwFlags = lpStartupInfo->dwFlags;
5490     sinfo.wShowWindow = lpStartupInfo->wShowWindow;
5491     sinfo.cbReserved2 = lpStartupInfo->cbReserved2;
5492     sinfo.lpReserved2 = lpStartupInfo->lpReserved2;
5493     sinfo.hStdInput = lpStartupInfo->hStdInput;
5494     sinfo.hStdOutput = lpStartupInfo->hStdOutput;
5495     sinfo.hStdError = lpStartupInfo->hStdError;
5496     ret = CreateProcessAsUserW(hToken, appW, cmdlnW, lpProcessAttributes,
5497             lpThreadAttributes, bInheritHandles, dwCreationFlags,
5498             lpEnvironment, cwdW, &sinfo, lpProcessInformation);
5499     heap_free(appW);
5500     heap_free(cmdlnW);
5501     heap_free(cwdW);
5502     heap_free(sinfo.lpReserved);
5503     heap_free(sinfo.lpDesktop);
5504     heap_free(sinfo.lpTitle);
5505
5506     return ret;
5507 }
5508
5509 BOOL WINAPI DECLSPEC_HOTPATCH CreateProcessAsUserW(
5510         HANDLE hToken,
5511         LPCWSTR lpApplicationName,
5512         LPWSTR lpCommandLine,
5513         LPSECURITY_ATTRIBUTES lpProcessAttributes,
5514         LPSECURITY_ATTRIBUTES lpThreadAttributes,
5515         BOOL bInheritHandles,
5516         DWORD dwCreationFlags,
5517         LPVOID lpEnvironment,
5518         LPCWSTR lpCurrentDirectory,
5519         LPSTARTUPINFOW lpStartupInfo,
5520         LPPROCESS_INFORMATION lpProcessInformation )
5521 {
5522     FIXME("%p %s %s %p %p %d 0x%08x %p %s %p %p - semi-stub\n", hToken,
5523           debugstr_w(lpApplicationName), debugstr_w(lpCommandLine), lpProcessAttributes,
5524           lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment,
5525           debugstr_w(lpCurrentDirectory), lpStartupInfo, lpProcessInformation);
5526
5527     /* We should create the process with a suspended main thread */
5528     if (!CreateProcessW (lpApplicationName,
5529                          lpCommandLine,
5530                          lpProcessAttributes,
5531                          lpThreadAttributes,
5532                          bInheritHandles,
5533                          dwCreationFlags, /* CREATE_SUSPENDED */
5534                          lpEnvironment,
5535                          lpCurrentDirectory,
5536                          lpStartupInfo,
5537                          lpProcessInformation))
5538     {
5539       return FALSE;
5540     }
5541
5542     return TRUE;
5543 }
5544
5545 /******************************************************************************
5546  * CreateProcessWithLogonW
5547  */
5548 BOOL WINAPI CreateProcessWithLogonW( LPCWSTR lpUsername, LPCWSTR lpDomain, LPCWSTR lpPassword, DWORD dwLogonFlags,
5549     LPCWSTR lpApplicationName, LPWSTR lpCommandLine, DWORD dwCreationFlags, LPVOID lpEnvironment,
5550     LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation )
5551 {
5552     FIXME("%s %s %s 0x%08x %s %s 0x%08x %p %s %p %p stub\n", debugstr_w(lpUsername), debugstr_w(lpDomain),
5553     debugstr_w(lpPassword), dwLogonFlags, debugstr_w(lpApplicationName),
5554     debugstr_w(lpCommandLine), dwCreationFlags, lpEnvironment, debugstr_w(lpCurrentDirectory),
5555     lpStartupInfo, lpProcessInformation);
5556
5557     return FALSE;
5558 }
5559
5560 BOOL WINAPI CreateProcessWithTokenW(HANDLE token, DWORD logon_flags, LPCWSTR application_name, LPWSTR command_line,
5561         DWORD creation_flags, void *environment, LPCWSTR current_directory, STARTUPINFOW *startup_info,
5562         PROCESS_INFORMATION *process_information )
5563 {
5564     FIXME("%p 0x%08x %s %s 0x%08x %p %s %p %p - semi-stub\n", token,
5565           logon_flags, debugstr_w(application_name), debugstr_w(command_line),
5566           creation_flags, environment, debugstr_w(current_directory),
5567           startup_info, process_information);
5568
5569     /* FIXME: check if handles should be inherited */
5570     return CreateProcessW( application_name, command_line, NULL, NULL, FALSE, creation_flags, environment,
5571                            current_directory, startup_info, process_information );
5572 }
5573
5574 /******************************************************************************
5575  * DuplicateTokenEx [ADVAPI32.@]
5576  */
5577 BOOL WINAPI DuplicateTokenEx(
5578         HANDLE ExistingTokenHandle, DWORD dwDesiredAccess,
5579         LPSECURITY_ATTRIBUTES lpTokenAttributes,
5580         SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5581         TOKEN_TYPE TokenType,
5582         PHANDLE DuplicateTokenHandle )
5583 {
5584     OBJECT_ATTRIBUTES ObjectAttributes;
5585
5586     TRACE("%p 0x%08x 0x%08x 0x%08x %p\n", ExistingTokenHandle, dwDesiredAccess,
5587           ImpersonationLevel, TokenType, DuplicateTokenHandle);
5588
5589     InitializeObjectAttributes(
5590         &ObjectAttributes,
5591         NULL,
5592         (lpTokenAttributes && lpTokenAttributes->bInheritHandle) ? OBJ_INHERIT : 0,
5593         NULL,
5594         lpTokenAttributes ? lpTokenAttributes->lpSecurityDescriptor : NULL );
5595
5596     return set_ntstatus( NtDuplicateToken( ExistingTokenHandle,
5597                                            dwDesiredAccess,
5598                                            &ObjectAttributes,
5599                                            ImpersonationLevel,
5600                                            TokenType,
5601                                            DuplicateTokenHandle ) );
5602 }
5603
5604 BOOL WINAPI DuplicateToken(
5605         HANDLE ExistingTokenHandle,
5606         SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5607         PHANDLE DuplicateTokenHandle )
5608 {
5609     return DuplicateTokenEx( ExistingTokenHandle, TOKEN_IMPERSONATE | TOKEN_QUERY,
5610                              NULL, ImpersonationLevel, TokenImpersonation,
5611                              DuplicateTokenHandle );
5612 }
5613
5614 /******************************************************************************
5615  * ComputeStringSidSize
5616  */
5617 static DWORD ComputeStringSidSize(LPCWSTR StringSid)
5618 {
5619     if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I(-S)+ */
5620     {
5621         int ctok = 0;
5622         while (*StringSid)
5623         {
5624             if (*StringSid == '-')
5625                 ctok++;
5626             StringSid++;
5627         }
5628
5629         if (ctok >= 3)
5630             return GetSidLengthRequired(ctok - 2);
5631     }
5632     else /* String constant format  - Only available in winxp and above */
5633     {
5634         unsigned int i;
5635
5636         for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
5637             if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
5638                 return GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
5639
5640         for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
5641             if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
5642             {
5643                 MAX_SID local;
5644                 ADVAPI_GetComputerSid(&local);
5645                 return GetSidLengthRequired(*GetSidSubAuthorityCount(&local) + 1);
5646             }
5647
5648     }
5649
5650     return GetSidLengthRequired(0);
5651 }
5652
5653 /******************************************************************************
5654  * ParseStringSidToSid
5655  */
5656 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes)
5657 {
5658     BOOL bret = FALSE;
5659     SID* pisid=pSid;
5660
5661     TRACE("%s, %p, %p\n", debugstr_w(StringSid), pSid, cBytes);
5662     if (!StringSid)
5663     {
5664         SetLastError(ERROR_INVALID_PARAMETER);
5665         TRACE("StringSid is NULL, returning FALSE\n");
5666         return FALSE;
5667     }
5668
5669     while (*StringSid == ' ')
5670         StringSid++;
5671
5672     *cBytes = ComputeStringSidSize(StringSid);
5673     if (!pisid) /* Simply compute the size */
5674     {
5675         TRACE("only size requested, returning TRUE with %d\n", *cBytes);
5676         return TRUE;
5677     }
5678
5679     if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I-S-S */
5680     {
5681         DWORD i = 0, identAuth;
5682         DWORD csubauth = ((*cBytes - GetSidLengthRequired(0)) / sizeof(DWORD));
5683
5684         StringSid += 2; /* Advance to Revision */
5685         pisid->Revision = atoiW(StringSid);
5686
5687         if (pisid->Revision != SDDL_REVISION)
5688         {
5689             TRACE("Revision %d is unknown\n", pisid->Revision);
5690             goto lend; /* ERROR_INVALID_SID */
5691         }
5692         if (csubauth == 0)
5693         {
5694             TRACE("SubAuthorityCount is 0\n");
5695             goto lend; /* ERROR_INVALID_SID */
5696         }
5697
5698         pisid->SubAuthorityCount = csubauth;
5699
5700         /* Advance to identifier authority */
5701         while (*StringSid && *StringSid != '-')
5702             StringSid++;
5703         if (*StringSid == '-')
5704             StringSid++;
5705
5706         /* MS' implementation can't handle values greater than 2^32 - 1, so
5707          * we don't either; assume most significant bytes are always 0
5708          */
5709         pisid->IdentifierAuthority.Value[0] = 0;
5710         pisid->IdentifierAuthority.Value[1] = 0;
5711         identAuth = atoiW(StringSid);
5712         pisid->IdentifierAuthority.Value[5] = identAuth & 0xff;
5713         pisid->IdentifierAuthority.Value[4] = (identAuth & 0xff00) >> 8;
5714         pisid->IdentifierAuthority.Value[3] = (identAuth & 0xff0000) >> 16;
5715         pisid->IdentifierAuthority.Value[2] = (identAuth & 0xff000000) >> 24;
5716
5717         /* Advance to first sub authority */
5718         while (*StringSid && *StringSid != '-')
5719             StringSid++;
5720         if (*StringSid == '-')
5721             StringSid++;
5722
5723         while (*StringSid)
5724         {
5725             pisid->SubAuthority[i++] = atoiW(StringSid);
5726
5727             while (*StringSid && *StringSid != '-')
5728                 StringSid++;
5729             if (*StringSid == '-')
5730                 StringSid++;
5731         }
5732
5733         if (i != pisid->SubAuthorityCount)
5734             goto lend; /* ERROR_INVALID_SID */
5735
5736         bret = TRUE;
5737     }
5738     else /* String constant format  - Only available in winxp and above */
5739     {
5740         unsigned int i;
5741         pisid->Revision = SDDL_REVISION;
5742
5743         for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
5744             if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
5745             {
5746                 DWORD j;
5747                 pisid->SubAuthorityCount = WellKnownSids[i].Sid.SubAuthorityCount;
5748                 pisid->IdentifierAuthority = WellKnownSids[i].Sid.IdentifierAuthority;
5749                 for (j = 0; j < WellKnownSids[i].Sid.SubAuthorityCount; j++)
5750                     pisid->SubAuthority[j] = WellKnownSids[i].Sid.SubAuthority[j];
5751                 bret = TRUE;
5752             }
5753
5754         for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
5755             if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
5756             {
5757                 ADVAPI_GetComputerSid(pisid);
5758                 pisid->SubAuthority[pisid->SubAuthorityCount] = WellKnownRids[i].Rid;
5759                 pisid->SubAuthorityCount++;
5760                 bret = TRUE;
5761             }
5762
5763         if (!bret)
5764             FIXME("String constant not supported: %s\n", debugstr_wn(StringSid, 2));
5765     }
5766
5767 lend:
5768     if (!bret)
5769         SetLastError(ERROR_INVALID_SID);
5770
5771     TRACE("returning %s\n", bret ? "TRUE" : "FALSE");
5772     return bret;
5773 }
5774
5775 /******************************************************************************
5776  * GetNamedSecurityInfoA [ADVAPI32.@]
5777  */
5778 DWORD WINAPI GetNamedSecurityInfoA(LPSTR pObjectName,
5779         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
5780         PSID* ppsidOwner, PSID* ppsidGroup, PACL* ppDacl, PACL* ppSacl,
5781         PSECURITY_DESCRIPTOR* ppSecurityDescriptor)
5782 {
5783     LPWSTR wstr;
5784     DWORD r;
5785
5786     TRACE("%s %d %d %p %p %p %p %p\n", pObjectName, ObjectType, SecurityInfo,
5787         ppsidOwner, ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor);
5788
5789     wstr = SERV_dup(pObjectName);
5790     r = GetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, ppsidOwner,
5791                            ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor );
5792
5793     heap_free( wstr );
5794
5795     return r;
5796 }
5797
5798 /******************************************************************************
5799  * GetNamedSecurityInfoW [ADVAPI32.@]
5800  */
5801 DWORD WINAPI GetNamedSecurityInfoW( LPWSTR name, SE_OBJECT_TYPE type,
5802     SECURITY_INFORMATION info, PSID* owner, PSID* group, PACL* dacl,
5803     PACL* sacl, PSECURITY_DESCRIPTOR* descriptor )
5804 {
5805     DWORD access = 0;
5806     HANDLE handle;
5807     DWORD err;
5808
5809     TRACE( "%s %d %d %p %p %p %p %p\n", debugstr_w(name), type, info, owner,
5810            group, dacl, sacl, descriptor );
5811
5812     /* A NULL descriptor is allowed if any one of the other pointers is not NULL */
5813     if (!name || !(owner||group||dacl||sacl||descriptor) ) return ERROR_INVALID_PARAMETER;
5814
5815     /* If no descriptor, we have to check that there's a pointer for the requested information */
5816     if( !descriptor && (
5817         ((info & OWNER_SECURITY_INFORMATION) && !owner)
5818     ||  ((info & GROUP_SECURITY_INFORMATION) && !group)
5819     ||  ((info & DACL_SECURITY_INFORMATION)  && !dacl)
5820     ||  ((info & SACL_SECURITY_INFORMATION)  && !sacl)  ))
5821         return ERROR_INVALID_PARAMETER;
5822
5823     if (info & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION))
5824         access |= READ_CONTROL;
5825     if (info & SACL_SECURITY_INFORMATION)
5826         access |= ACCESS_SYSTEM_SECURITY;
5827
5828     switch (type)
5829     {
5830     case SE_SERVICE:
5831         if (!(err = get_security_service( name, access, &handle )))
5832         {
5833             err = GetSecurityInfo( handle, type, info, owner, group, dacl, sacl, descriptor );
5834             CloseServiceHandle( handle );
5835         }
5836         break;
5837     case SE_REGISTRY_KEY:
5838         if (!(err = get_security_regkey( name, access, &handle )))
5839         {
5840             err = GetSecurityInfo( handle, type, info, owner, group, dacl, sacl, descriptor );
5841             RegCloseKey( handle );
5842         }
5843         break;
5844     case SE_FILE_OBJECT:
5845         if (!(err = get_security_file( name, access, &handle )))
5846         {
5847             err = GetSecurityInfo( handle, type, info, owner, group, dacl, sacl, descriptor );
5848             CloseHandle( handle );
5849         }
5850         break;
5851     default:
5852         FIXME( "Object type %d is not currently supported.\n", type );
5853         if (owner) *owner = NULL;
5854         if (group) *group = NULL;
5855         if (dacl) *dacl = NULL;
5856         if (sacl) *sacl = NULL;
5857         if (descriptor) *descriptor = NULL;
5858         return ERROR_SUCCESS;
5859     }
5860     return err;
5861 }
5862
5863 /******************************************************************************
5864  * GetNamedSecurityInfoExW [ADVAPI32.@]
5865  */
5866 DWORD WINAPI GetNamedSecurityInfoExW( LPCWSTR object, SE_OBJECT_TYPE type,
5867     SECURITY_INFORMATION info, LPCWSTR provider, LPCWSTR property,
5868     PACTRL_ACCESSW* access_list, PACTRL_AUDITW* audit_list, LPWSTR* owner, LPWSTR* group )
5869 {
5870     FIXME("(%s, %d, %d, %s, %s, %p, %p, %p, %p) stub\n", debugstr_w(object), type, info,
5871         debugstr_w(provider), debugstr_w(property), access_list, audit_list, owner, group);
5872     return ERROR_CALL_NOT_IMPLEMENTED;
5873 }
5874
5875 /******************************************************************************
5876  * GetNamedSecurityInfoExA [ADVAPI32.@]
5877  */
5878 DWORD WINAPI GetNamedSecurityInfoExA( LPCSTR object, SE_OBJECT_TYPE type,
5879     SECURITY_INFORMATION info, LPCSTR provider, LPCSTR property,
5880     PACTRL_ACCESSA* access_list, PACTRL_AUDITA* audit_list, LPSTR* owner, LPSTR* group )
5881 {
5882     FIXME("(%s, %d, %d, %s, %s, %p, %p, %p, %p) stub\n", debugstr_a(object), type, info,
5883         debugstr_a(provider), debugstr_a(property), access_list, audit_list, owner, group);
5884     return ERROR_CALL_NOT_IMPLEMENTED;
5885 }
5886
5887 /******************************************************************************
5888  * DecryptFileW [ADVAPI32.@]
5889  */
5890 BOOL WINAPI DecryptFileW(LPCWSTR lpFileName, DWORD dwReserved)
5891 {
5892     FIXME("(%s, %08x): stub\n", debugstr_w(lpFileName), dwReserved);
5893     return TRUE;
5894 }
5895
5896 /******************************************************************************
5897  * DecryptFileA [ADVAPI32.@]
5898  */
5899 BOOL WINAPI DecryptFileA(LPCSTR lpFileName, DWORD dwReserved)
5900 {
5901     FIXME("(%s, %08x): stub\n", debugstr_a(lpFileName), dwReserved);
5902     return TRUE;
5903 }
5904
5905 /******************************************************************************
5906  * EncryptFileW [ADVAPI32.@]
5907  */
5908 BOOL WINAPI EncryptFileW(LPCWSTR lpFileName)
5909 {
5910     FIXME("(%s): stub\n", debugstr_w(lpFileName));
5911     return TRUE;
5912 }
5913
5914 /******************************************************************************
5915  * EncryptFileA [ADVAPI32.@]
5916  */
5917 BOOL WINAPI EncryptFileA(LPCSTR lpFileName)
5918 {
5919     FIXME("(%s): stub\n", debugstr_a(lpFileName));
5920     return TRUE;
5921 }
5922
5923 /******************************************************************************
5924  * FileEncryptionStatusW [ADVAPI32.@]
5925  */
5926 BOOL WINAPI FileEncryptionStatusW(LPCWSTR lpFileName, LPDWORD lpStatus)
5927 {
5928     FIXME("(%s %p): stub\n", debugstr_w(lpFileName), lpStatus);
5929     if (!lpStatus)
5930         return FALSE;
5931     *lpStatus = FILE_SYSTEM_NOT_SUPPORT;
5932     return TRUE;
5933 }
5934
5935 /******************************************************************************
5936  * FileEncryptionStatusA [ADVAPI32.@]
5937  */
5938 BOOL WINAPI FileEncryptionStatusA(LPCSTR lpFileName, LPDWORD lpStatus)
5939 {
5940     FIXME("(%s %p): stub\n", debugstr_a(lpFileName), lpStatus);
5941     if (!lpStatus)
5942         return FALSE;
5943     *lpStatus = FILE_SYSTEM_NOT_SUPPORT;
5944     return TRUE;
5945 }
5946
5947 /******************************************************************************
5948  * SetSecurityInfo [ADVAPI32.@]
5949  */
5950 DWORD WINAPI SetSecurityInfo(HANDLE handle, SE_OBJECT_TYPE ObjectType,
5951                       SECURITY_INFORMATION SecurityInfo, PSID psidOwner,
5952                       PSID psidGroup, PACL pDacl, PACL pSacl)
5953 {
5954     SECURITY_DESCRIPTOR sd;
5955     PACL dacl = pDacl;
5956     NTSTATUS status;
5957
5958     if (!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION))
5959         return ERROR_INVALID_SECURITY_DESCR;
5960
5961     if (SecurityInfo & OWNER_SECURITY_INFORMATION)
5962         SetSecurityDescriptorOwner(&sd, psidOwner, FALSE);
5963     if (SecurityInfo & GROUP_SECURITY_INFORMATION)
5964         SetSecurityDescriptorGroup(&sd, psidGroup, FALSE);
5965     if (SecurityInfo & DACL_SECURITY_INFORMATION)
5966     {
5967         if (ObjectType == SE_FILE_OBJECT && pDacl)
5968         {
5969             SECURITY_DESCRIPTOR_CONTROL control;
5970             PSECURITY_DESCRIPTOR psd;
5971             OBJECT_NAME_INFORMATION *name_info;
5972             DWORD size, rev;
5973
5974             status = NtQuerySecurityObject(handle, SecurityInfo, NULL, 0, &size);
5975             if (status != STATUS_BUFFER_TOO_SMALL)
5976                 return RtlNtStatusToDosError(status);
5977
5978             psd = heap_alloc(size);
5979             if (!psd)
5980                 return ERROR_NOT_ENOUGH_MEMORY;
5981
5982             status = NtQuerySecurityObject(handle, SecurityInfo, psd, size, &size);
5983             if (status)
5984             {
5985                 heap_free(psd);
5986                 return RtlNtStatusToDosError(status);
5987             }
5988
5989             status = RtlGetControlSecurityDescriptor(psd, &control, &rev);
5990             heap_free(psd);
5991             if (status)
5992                 return RtlNtStatusToDosError(status);
5993             /* TODO: copy some control flags to new sd */
5994
5995             /* inherit parent directory DACL */
5996             if (!(control & SE_DACL_PROTECTED))
5997             {
5998                 status = NtQueryObject(handle, ObjectNameInformation, NULL, 0, &size);
5999                 if (status != STATUS_INFO_LENGTH_MISMATCH)
6000                     return RtlNtStatusToDosError(status);
6001
6002                 name_info = heap_alloc(size);
6003                 if (!name_info)
6004                     return ERROR_NOT_ENOUGH_MEMORY;
6005
6006                 status = NtQueryObject(handle, ObjectNameInformation, name_info, size, NULL);
6007                 if (status)
6008                 {
6009                     heap_free(name_info);
6010                     return RtlNtStatusToDosError(status);
6011                 }
6012
6013                 for (name_info->Name.Length-=2; name_info->Name.Length>0; name_info->Name.Length-=2)
6014                     if (name_info->Name.Buffer[name_info->Name.Length/2-1]=='\\' ||
6015                             name_info->Name.Buffer[name_info->Name.Length/2-1]=='/')
6016                         break;
6017                 if (name_info->Name.Length)
6018                 {
6019                     OBJECT_ATTRIBUTES attr;
6020                     IO_STATUS_BLOCK io;
6021                     HANDLE parent;
6022                     PSECURITY_DESCRIPTOR parent_sd;
6023                     ACL *parent_dacl;
6024                     DWORD err = ERROR_ACCESS_DENIED;
6025
6026                     name_info->Name.Buffer[name_info->Name.Length/2] = 0;
6027
6028                     attr.Length = sizeof(attr);
6029                     attr.RootDirectory = 0;
6030                     attr.Attributes = 0;
6031                     attr.ObjectName = &name_info->Name;
6032                     attr.SecurityDescriptor = NULL;
6033                     status = NtOpenFile(&parent, READ_CONTROL|SYNCHRONIZE, &attr, &io,
6034                             FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
6035                             FILE_OPEN_FOR_BACKUP_INTENT);
6036                     heap_free(name_info);
6037                     if (!status)
6038                     {
6039                         err = GetSecurityInfo(parent, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
6040                                 NULL, NULL, &parent_dacl, NULL, &parent_sd);
6041                         CloseHandle(parent);
6042                     }
6043
6044                     if (!err)
6045                     {
6046                         int i;
6047
6048                         dacl = heap_alloc_zero(pDacl->AclSize+parent_dacl->AclSize);
6049                         if (!dacl)
6050                         {
6051                             LocalFree(parent_sd);
6052                             return ERROR_NOT_ENOUGH_MEMORY;
6053                         }
6054                         memcpy(dacl, pDacl, pDacl->AclSize);
6055                         dacl->AclSize = pDacl->AclSize+parent_dacl->AclSize;
6056
6057                         for (i=0; i<parent_dacl->AceCount; i++)
6058                         {
6059                             ACE_HEADER *ace;
6060
6061                             if (!GetAce(parent_dacl, i, (void*)&ace))
6062                                 continue;
6063                             if (!(ace->AceFlags & (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE)))
6064                                 continue;
6065                             if ((ace->AceFlags & (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE)) !=
6066                                     (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE))
6067                             {
6068                                 FIXME("unsupported flags: %x\n", ace->AceFlags);
6069                                 continue;
6070                             }
6071
6072                             if (ace->AceFlags & NO_PROPAGATE_INHERIT_ACE)
6073                                 ace->AceFlags &= ~(OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE|NO_PROPAGATE_INHERIT_ACE);
6074                             ace->AceFlags &= ~INHERIT_ONLY_ACE;
6075                             ace->AceFlags |= INHERITED_ACE;
6076
6077                             if(!AddAce(dacl, ACL_REVISION, MAXDWORD, ace, ace->AceSize))
6078                                 WARN("error adding inherited ACE\n");
6079                         }
6080                         LocalFree(parent_sd);
6081                     }
6082                 }
6083                 else
6084                     heap_free(name_info);
6085             }
6086         }
6087
6088         SetSecurityDescriptorDacl(&sd, TRUE, dacl, FALSE);
6089     }
6090     if (SecurityInfo & SACL_SECURITY_INFORMATION)
6091         SetSecurityDescriptorSacl(&sd, TRUE, pSacl, FALSE);
6092
6093     switch (ObjectType)
6094     {
6095     case SE_SERVICE:
6096         FIXME("stub: Service objects are not supported at this time.\n");
6097         status = STATUS_SUCCESS; /* Implement SetServiceObjectSecurity */
6098         break;
6099     default:
6100         status = NtSetSecurityObject(handle, SecurityInfo, &sd);
6101         break;
6102     }
6103     if (dacl != pDacl)
6104         heap_free(dacl);
6105     return RtlNtStatusToDosError(status);
6106 }
6107
6108 /******************************************************************************
6109  * SaferCreateLevel   [ADVAPI32.@]
6110  */
6111 BOOL WINAPI SaferCreateLevel(DWORD ScopeId, DWORD LevelId, DWORD OpenFlags,
6112                              SAFER_LEVEL_HANDLE* LevelHandle, LPVOID lpReserved)
6113 {
6114     FIXME("(%u, %x, %u, %p, %p) stub\n", ScopeId, LevelId, OpenFlags, LevelHandle, lpReserved);
6115
6116     *LevelHandle = (SAFER_LEVEL_HANDLE)0xdeadbeef;
6117     return TRUE;
6118 }
6119
6120 /******************************************************************************
6121  * SaferComputeTokenFromLevel   [ADVAPI32.@]
6122  */
6123 BOOL WINAPI SaferComputeTokenFromLevel(SAFER_LEVEL_HANDLE handle, HANDLE token, PHANDLE access_token,
6124                                        DWORD flags, LPVOID reserved)
6125 {
6126     FIXME("(%p, %p, %p, %x, %p) stub\n", handle, token, access_token, flags, reserved);
6127
6128     *access_token = (HANDLE)0xdeadbeef;
6129     return TRUE;
6130 }
6131
6132 /******************************************************************************
6133  * SaferCloseLevel   [ADVAPI32.@]
6134  */
6135 BOOL WINAPI SaferCloseLevel(SAFER_LEVEL_HANDLE handle)
6136 {
6137     FIXME("(%p) stub\n", handle);
6138     return TRUE;
6139 }
6140
6141 /******************************************************************************
6142  * TreeResetNamedSecurityInfoW   [ADVAPI32.@]
6143  */
6144 DWORD WINAPI TreeResetNamedSecurityInfoW( LPWSTR pObjectName,
6145                 SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
6146                 PSID pOwner, PSID pGroup, PACL pDacl, PACL pSacl,
6147                 BOOL KeepExplicit, FN_PROGRESS fnProgress,
6148                 PROG_INVOKE_SETTING ProgressInvokeSetting, PVOID Args)
6149 {
6150     FIXME("(%s, %i, %i, %p, %p, %p, %p, %i, %p, %i, %p) stub\n",
6151         debugstr_w(pObjectName), ObjectType, SecurityInfo, pOwner, pGroup,
6152         pDacl, pSacl, KeepExplicit, fnProgress, ProgressInvokeSetting, Args);
6153
6154     return ERROR_SUCCESS;
6155 }
6156
6157 /******************************************************************************
6158  * SaferGetPolicyInformation   [ADVAPI32.@]
6159  */
6160 BOOL WINAPI SaferGetPolicyInformation(DWORD scope, SAFER_POLICY_INFO_CLASS class, DWORD size,
6161                                       PVOID buffer, PDWORD required, LPVOID lpReserved)
6162 {
6163     FIXME("(%u %u %u %p %p %p) stub\n", scope, class, size, buffer, required, lpReserved);
6164     return FALSE;
6165 }
6166
6167 /******************************************************************************
6168  * SaferSetLevelInformation   [ADVAPI32.@]
6169  */
6170 BOOL WINAPI SaferSetLevelInformation(SAFER_LEVEL_HANDLE handle, SAFER_OBJECT_INFO_CLASS infotype,
6171                                      LPVOID buffer, DWORD size)
6172 {
6173     FIXME("(%p %u %p %u) stub\n", handle, infotype, buffer, size);
6174     return FALSE;
6175 }
6176
6177 /******************************************************************************
6178  * LookupSecurityDescriptorPartsA   [ADVAPI32.@]
6179  */
6180 DWORD WINAPI LookupSecurityDescriptorPartsA(TRUSTEEA *owner, TRUSTEEA *group, ULONG *access_count,
6181                                             EXPLICIT_ACCESSA *access_list, ULONG *audit_count,
6182                                             EXPLICIT_ACCESSA *audit_list, SECURITY_DESCRIPTOR *descriptor)
6183 {
6184     FIXME("(%p %p %p %p %p %p %p) stub\n", owner, group, access_count,
6185           access_list, audit_count, audit_list, descriptor);
6186     return ERROR_CALL_NOT_IMPLEMENTED;
6187 }
6188
6189 /******************************************************************************
6190  * LookupSecurityDescriptorPartsW   [ADVAPI32.@]
6191  */
6192 DWORD WINAPI LookupSecurityDescriptorPartsW(TRUSTEEW *owner, TRUSTEEW *group, ULONG *access_count,
6193                                             EXPLICIT_ACCESSW *access_list, ULONG *audit_count,
6194                                             EXPLICIT_ACCESSW *audit_list, SECURITY_DESCRIPTOR *descriptor)
6195 {
6196     FIXME("(%p %p %p %p %p %p %p) stub\n", owner, group, access_count,
6197           access_list, audit_count, audit_list, descriptor);
6198     return ERROR_CALL_NOT_IMPLEMENTED;
6199 }