dlls/advapi32/security.c

   1 /*
   2  * Copyright 1999, 2000 Juergen Schmied <juergen.schmied@debitel.net>
   3  * Copyright 2003 CodeWeavers Inc. (Ulrich Czekalla)
   4  * Copyright 2006 Robert Reif
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  */
  21
  22 #include "config.h"
  23
  24 #include <stdarg.h>
  25 #include <string.h>
  26
  27 #include "ntstatus.h"
  28 #define WIN32_NO_STATUS
  29 #include "windef.h"
  30 #include "winbase.h"
  31 #include "winerror.h"
  32 #include "winreg.h"
  33 #include "winsafer.h"
  34 #include "winternl.h"
  35 #include "winioctl.h"
  36 #include "accctrl.h"
  37 #include "sddl.h"
  38 #include "winsvc.h"
  39 #include "aclapi.h"
  40 #include "objbase.h"
  41 #include "iads.h"
  42 #include "advapi32_misc.h"
  43 #include "lmcons.h"
  44
  45 #include "wine/debug.h"
  46 #include "wine/unicode.h"
  47
  48 WINE_DEFAULT_DEBUG_CHANNEL(advapi);
  49
  50 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes);
  51 static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags,
  52     PACL pAcl, LPDWORD cBytes);
  53 static BYTE ParseAceStringFlags(LPCWSTR* StringAcl);
  54 static BYTE ParseAceStringType(LPCWSTR* StringAcl);
  55 static DWORD ParseAceStringRights(LPCWSTR* StringAcl);
  56 static BOOL ParseStringSecurityDescriptorToSecurityDescriptor(
  57     LPCWSTR StringSecurityDescriptor,
  58     SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
  59     LPDWORD cBytes);
  60 static DWORD ParseAclStringFlags(LPCWSTR* StringAcl);
  61
  62 typedef struct _ACEFLAG
  63 {
  64    LPCWSTR wstr;
  65    DWORD value;
  66 } ACEFLAG, *LPACEFLAG;
  67
  68 typedef struct _MAX_SID
  69 {
  70     /* same fields as struct _SID */
  71     BYTE Revision;
  72     BYTE SubAuthorityCount;
  73     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  74     DWORD SubAuthority[SID_MAX_SUB_AUTHORITIES];
  75 } MAX_SID;
  76
  77 typedef struct WELLKNOWNSID
  78 {
  79     WCHAR wstr[2];
  80     WELL_KNOWN_SID_TYPE Type;
  81     MAX_SID Sid;
  82 } WELLKNOWNSID;
  83
  84 static const WELLKNOWNSID WellKnownSids[] =
  85 {
  86     { {0,0}, WinNullSid, { SID_REVISION, 1, { SECURITY_NULL_SID_AUTHORITY }, { SECURITY_NULL_RID } } },
  87     { {'W','D'}, WinWorldSid, { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } } },
  88     { {0,0}, WinLocalSid, { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } } },
  89     { {'C','O'}, WinCreatorOwnerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_RID } } },
  90     { {'C','G'}, WinCreatorGroupSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_RID } } },
  91     { {0,0}, WinCreatorOwnerServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_SERVER_RID } } },
  92     { {0,0}, WinCreatorGroupServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_SERVER_RID } } },
  93     { {0,0}, WinNtAuthoritySid, { SID_REVISION, 0, { SECURITY_NT_AUTHORITY }, { SECURITY_NULL_RID } } },
  94     { {0,0}, WinDialupSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_DIALUP_RID } } },
  95     { {'N','U'}, WinNetworkSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_RID } } },
  96     { {0,0}, WinBatchSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BATCH_RID } } },
  97     { {'I','U'}, WinInteractiveSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } } },
  98     { {'S','U'}, WinServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_SERVICE_RID } } },
  99     { {'A','N'}, WinAnonymousSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } } },
 100     { {0,0}, WinProxySid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PROXY_RID } } },
 101     { {'E','D'}, WinEnterpriseControllersSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ENTERPRISE_CONTROLLERS_RID } } },
 102     { {'P','S'}, WinSelfSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PRINCIPAL_SELF_RID } } },
 103     { {'A','U'}, WinAuthenticatedUserSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } } },
 104     { {'R','C'}, WinRestrictedCodeSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_RESTRICTED_CODE_RID } } },
 105     { {0,0}, WinTerminalServerSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_TERMINAL_SERVER_RID } } },
 106     { {0,0}, WinRemoteLogonIdSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_REMOTE_LOGON_RID } } },
 107     { {'S','Y'}, WinLocalSystemSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } } },
 108     { {'L','S'}, WinLocalServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SERVICE_RID } } },
 109     { {'N','S'}, WinNetworkServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_SERVICE_RID } } },
 110     { {0,0}, WinBuiltinDomainSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID } } },
 111     { {'B','A'}, WinBuiltinAdministratorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } } },
 112     { {'B','U'}, WinBuiltinUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } } },
 113     { {'B','G'}, WinBuiltinGuestsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_GUESTS } } },
 114     { {'P','U'}, WinBuiltinPowerUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_POWER_USERS } } },
 115     { {'A','O'}, WinBuiltinAccountOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ACCOUNT_OPS } } },
 116     { {'S','O'}, WinBuiltinSystemOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_SYSTEM_OPS } } },
 117     { {'P','O'}, WinBuiltinPrintOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PRINT_OPS } } },
 118     { {'B','O'}, WinBuiltinBackupOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_BACKUP_OPS } } },
 119     { {'R','E'}, WinBuiltinReplicatorSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REPLICATOR } } },
 120     { {'R','U'}, WinBuiltinPreWindows2000CompatibleAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PREW2KCOMPACCESS } } },
 121     { {'R','D'}, WinBuiltinRemoteDesktopUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS } } },
 122     { {'N','O'}, WinBuiltinNetworkConfigurationOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS } } },
 123     { {0,0}, WinNTLMAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_NTLM_RID } } },
 124     { {0,0}, WinDigestAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_DIGEST_RID } } },
 125     { {0,0}, WinSChannelAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_SCHANNEL_RID } } },
 126     { {0,0}, WinThisOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_THIS_ORGANIZATION_RID } } },
 127     { {0,0}, WinOtherOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_OTHER_ORGANIZATION_RID } } },
 128     { {0,0}, WinBuiltinIncomingForestTrustBuildersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS  } } },
 129     { {0,0}, WinBuiltinPerfMonitoringUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_MONITORING_USERS } } },
 130     { {0,0}, WinBuiltinPerfLoggingUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_LOGGING_USERS } } },
 131     { {0,0}, WinBuiltinAuthorizationAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS } } },
 132     { {0,0}, WinBuiltinTerminalServerLicenseServersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS } } },
 133     { {0,0}, WinBuiltinDCOMUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_DCOM_USERS } } },
 134     { {'L','W'}, WinLowLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_LOW_RID} } },
 135     { {'M','E'}, WinMediumLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_MEDIUM_RID } } },
 136     { {'H','I'}, WinHighLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_HIGH_RID } } },
 137     { {'S','I'}, WinSystemLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_SYSTEM_RID } } },
 138     { {0,0}, WinBuiltinAnyPackageSid, { SID_REVISION, 2, { SECURITY_APP_PACKAGE_AUTHORITY }, { SECURITY_APP_PACKAGE_BASE_RID, SECURITY_BUILTIN_PACKAGE_ANY_PACKAGE } } },
 139 };
 140
 141 /* these SIDs must be constructed as relative to some domain - only the RID is well-known */
 142 typedef struct WELLKNOWNRID
 143 {
 144     WCHAR wstr[2];
 145     WELL_KNOWN_SID_TYPE Type;
 146     DWORD Rid;
 147 } WELLKNOWNRID;
 148
 149 static const WELLKNOWNRID WellKnownRids[] = {
 150     { {'L','A'}, WinAccountAdministratorSid,    DOMAIN_USER_RID_ADMIN },
 151     { {'L','G'}, WinAccountGuestSid,            DOMAIN_USER_RID_GUEST },
 152     { {0,0}, WinAccountKrbtgtSid,           DOMAIN_USER_RID_KRBTGT },
 153     { {'D','A'}, WinAccountDomainAdminsSid,     DOMAIN_GROUP_RID_ADMINS },
 154     { {'D','U'}, WinAccountDomainUsersSid,      DOMAIN_GROUP_RID_USERS },
 155     { {'D','G'}, WinAccountDomainGuestsSid,     DOMAIN_GROUP_RID_GUESTS },
 156     { {'D','C'}, WinAccountComputersSid,        DOMAIN_GROUP_RID_COMPUTERS },
 157     { {'D','D'}, WinAccountControllersSid,      DOMAIN_GROUP_RID_CONTROLLERS },
 158     { {'C','A'}, WinAccountCertAdminsSid,       DOMAIN_GROUP_RID_CERT_ADMINS },
 159     { {'S','A'}, WinAccountSchemaAdminsSid,     DOMAIN_GROUP_RID_SCHEMA_ADMINS },
 160     { {'E','A'}, WinAccountEnterpriseAdminsSid, DOMAIN_GROUP_RID_ENTERPRISE_ADMINS },
 161     { {'P','A'}, WinAccountPolicyAdminsSid,     DOMAIN_GROUP_RID_POLICY_ADMINS },
 162     { {'R','S'}, WinAccountRasAndIasServersSid, DOMAIN_ALIAS_RID_RAS_SERVERS },
 163 };
 164
 165
 166 static SID const sidWorld = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY} , { SECURITY_WORLD_RID } };
 167
 168 typedef struct _AccountSid {
 169     WELL_KNOWN_SID_TYPE type;
 170     LPCWSTR account;
 171     LPCWSTR domain;
 172     SID_NAME_USE name_use;
 173     LPCWSTR alias;
 174 } AccountSid;
 175
 176 static const WCHAR Account_Operators[] = { 'A','c','c','o','u','n','t',' ','O','p','e','r','a','t','o','r','s',0 };
 177 static const WCHAR Administrator[] = {'A','d','m','i','n','i','s','t','r','a','t','o','r',0 };
 178 static const WCHAR Administrators[] = { 'A','d','m','i','n','i','s','t','r','a','t','o','r','s',0 };
 179 static const WCHAR ALL_APPLICATION_PACKAGES[] = { 'A','L','L',' ','A','P','P','L','I','C','A','T','I','O','N',' ','P','A','C','K','A','G','E','S',0 };
 180 static const WCHAR ANONYMOUS_LOGON[] = { 'A','N','O','N','Y','M','O','U','S',' ','L','O','G','O','N',0 };
 181 static const WCHAR APPLICATION_PACKAGE_AUTHORITY[] = { 'A','P','P','L','I','C','A','T','I','O','N',' ','P','A','C','K','A','G','E',' ','A','U','T','H','O','R','I','T','Y',0 };
 182 static const WCHAR Authenticated_Users[] = { 'A','u','t','h','e','n','t','i','c','a','t','e','d',' ','U','s','e','r','s',0 };
 183 static const WCHAR Backup_Operators[] = { 'B','a','c','k','u','p',' ','O','p','e','r','a','t','o','r','s',0 };
 184 static const WCHAR BATCH[] = { 'B','A','T','C','H',0 };
 185 static const WCHAR Blank[] = { 0 };
 186 static const WCHAR BUILTIN[] = { 'B','U','I','L','T','I','N',0 };
 187 static const WCHAR Cert_Publishers[] = { 'C','e','r','t',' ','P','u','b','l','i','s','h','e','r','s',0 };
 188 static const WCHAR CREATOR_GROUP[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',0 };
 189 static const WCHAR CREATOR_GROUP_SERVER[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',' ','S','E','R','V','E','R',0 };
 190 static const WCHAR CREATOR_OWNER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',0 };
 191 static const WCHAR CREATOR_OWNER_SERVER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',' ','S','E','R','V','E','R',0 };
 192 static const WCHAR CURRENT_USER[] = { 'C','U','R','R','E','N','T','_','U','S','E','R',0 };
 193 static const WCHAR DIALUP[] = { 'D','I','A','L','U','P',0 };
 194 static const WCHAR Digest_Authentication[] = { 'D','i','g','e','s','t',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 195 static const WCHAR Domain_Admins[] = { 'D','o','m','a','i','n',' ','A','d','m','i','n','s',0 };
 196 static const WCHAR Domain_Computers[] = { 'D','o','m','a','i','n',' ','C','o','m','p','u','t','e','r','s',0 };
 197 static const WCHAR Domain_Controllers[] = { 'D','o','m','a','i','n',' ','C','o','n','t','r','o','l','l','e','r','s',0 };
 198 static const WCHAR Domain_Guests[] = { 'D','o','m','a','i','n',' ','G','u','e','s','t','s',0 };
 199 static const WCHAR Domain_Users[] = { 'D','o','m','a','i','n',' ','U','s','e','r','s',0 };
 200 static const WCHAR Enterprise_Admins[] = { 'E','n','t','e','r','p','r','i','s','e',' ','A','d','m','i','n','s',0 };
 201 static const WCHAR ENTERPRISE_DOMAIN_CONTROLLERS[] = { 'E','N','T','E','R','P','R','I','S','E',' ','D','O','M','A','I','N',' ','C','O','N','T','R','O','L','L','E','R','S',0 };
 202 static const WCHAR Everyone[] = { 'E','v','e','r','y','o','n','e',0 };
 203 static const WCHAR Group_Policy_Creator_Owners[] = { 'G','r','o','u','p',' ','P','o','l','i','c','y',' ','C','r','e','a','t','o','r',' ','O','w','n','e','r','s',0 };
 204 static const WCHAR Guest[] = { 'G','u','e','s','t',0 };
 205 static const WCHAR Guests[] = { 'G','u','e','s','t','s',0 };
 206 static const WCHAR INTERACTIVE[] = { 'I','N','T','E','R','A','C','T','I','V','E',0 };
 207 static const WCHAR LOCAL[] = { 'L','O','C','A','L',0 };
 208 static const WCHAR LOCAL_SERVICE[] = { 'L','O','C','A','L',' ','S','E','R','V','I','C','E',0 };
 209 static const WCHAR LOCAL_SERVICE2[] = { 'L','O','C','A','L','S','E','R','V','I','C','E',0 };
 210 static const WCHAR NETWORK[] = { 'N','E','T','W','O','R','K',0 };
 211 static const WCHAR Network_Configuration_Operators[] = { 'N','e','t','w','o','r','k',' ','C','o','n','f','i','g','u','r','a','t','i','o','n',' ','O','p','e','r','a','t','o','r','s',0 };
 212 static const WCHAR NETWORK_SERVICE[] = { 'N','E','T','W','O','R','K',' ','S','E','R','V','I','C','E',0 };
 213 static const WCHAR NETWORK_SERVICE2[] = { 'N','E','T','W','O','R','K','S','E','R','V','I','C','E',0 };
 214 static const WCHAR NT_AUTHORITY[] = { 'N','T',' ','A','U','T','H','O','R','I','T','Y',0 };
 215 static const WCHAR NT_Pseudo_Domain[] = { 'N','T',' ','P','s','e','u','d','o',' ','D','o','m','a','i','n',0 };
 216 static const WCHAR NTML_Authentication[] = { 'N','T','M','L',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 217 static const WCHAR NULL_SID[] = { 'N','U','L','L',' ','S','I','D',0 };
 218 static const WCHAR Other_Organization[] = { 'O','t','h','e','r',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 };
 219 static const WCHAR Performance_Log_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','L','o','g',' ','U','s','e','r','s',0 };
 220 static const WCHAR Performance_Monitor_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','M','o','n','i','t','o','r',' ','U','s','e','r','s',0 };
 221 static const WCHAR Power_Users[] = { 'P','o','w','e','r',' ','U','s','e','r','s',0 };
 222 static const WCHAR Pre_Windows_2000_Compatible_Access[] = { 'P','r','e','-','W','i','n','d','o','w','s',' ','2','0','0','0',' ','C','o','m','p','a','t','i','b','l','e',' ','A','c','c','e','s','s',0 };
 223 static const WCHAR Print_Operators[] = { 'P','r','i','n','t',' ','O','p','e','r','a','t','o','r','s',0 };
 224 static const WCHAR PROXY[] = { 'P','R','O','X','Y',0 };
 225 static const WCHAR RAS_and_IAS_Servers[] = { 'R','A','S',' ','a','n','d',' ','I','A','S',' ','S','e','r','v','e','r','s',0 };
 226 static const WCHAR Remote_Desktop_Users[] = { 'R','e','m','o','t','e',' ','D','e','s','k','t','o','p',' ','U','s','e','r','s',0 };
 227 static const WCHAR REMOTE_INTERACTIVE_LOGON[] = { 'R','E','M','O','T','E',' ','I','N','T','E','R','A','C','T','I','V','E',' ','L','O','G','O','N',0 };
 228 static const WCHAR Replicators[] = { 'R','e','p','l','i','c','a','t','o','r','s',0 };
 229 static const WCHAR RESTRICTED[] = { 'R','E','S','T','R','I','C','T','E','D',0 };
 230 static const WCHAR SChannel_Authentication[] = { 'S','C','h','a','n','n','e','l',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 231 static const WCHAR Schema_Admins[] = { 'S','c','h','e','m','a',' ','A','d','m','i','n','s',0 };
 232 static const WCHAR SELF[] = { 'S','E','L','F',0 };
 233 static const WCHAR Server_Operators[] = { 'S','e','r','v','e','r',' ','O','p','e','r','a','t','o','r','s',0 };
 234 static const WCHAR SERVICE[] = { 'S','E','R','V','I','C','E',0 };
 235 static const WCHAR SYSTEM[] = { 'S','Y','S','T','E','M',0 };
 236 static const WCHAR TERMINAL_SERVER_USER[] = { 'T','E','R','M','I','N','A','L',' ','S','E','R','V','E','R',' ','U','S','E','R',0 };
 237 static const WCHAR This_Organization[] = { 'T','h','i','s',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 };
 238 static const WCHAR Users[] = { 'U','s','e','r','s',0 };
 239
 240 static const AccountSid ACCOUNT_SIDS[] = {
 241     { WinNullSid, NULL_SID, Blank, SidTypeWellKnownGroup },
 242     { WinWorldSid, Everyone, Blank, SidTypeWellKnownGroup },
 243     { WinLocalSid, LOCAL, Blank, SidTypeWellKnownGroup },
 244     { WinCreatorOwnerSid, CREATOR_OWNER, Blank, SidTypeWellKnownGroup },
 245     { WinCreatorGroupSid, CREATOR_GROUP, Blank, SidTypeWellKnownGroup },
 246     { WinCreatorOwnerServerSid, CREATOR_OWNER_SERVER, Blank, SidTypeWellKnownGroup },
 247     { WinCreatorGroupServerSid, CREATOR_GROUP_SERVER, Blank, SidTypeWellKnownGroup },
 248     { WinNtAuthoritySid, NT_Pseudo_Domain, NT_Pseudo_Domain, SidTypeDomain },
 249     { WinDialupSid, DIALUP, NT_AUTHORITY, SidTypeWellKnownGroup },
 250     { WinNetworkSid, NETWORK, NT_AUTHORITY, SidTypeWellKnownGroup },
 251     { WinBatchSid, BATCH, NT_AUTHORITY, SidTypeWellKnownGroup },
 252     { WinInteractiveSid, INTERACTIVE, NT_AUTHORITY, SidTypeWellKnownGroup },
 253     { WinServiceSid, SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup },
 254     { WinAnonymousSid, ANONYMOUS_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup },
 255     { WinProxySid, PROXY, NT_AUTHORITY, SidTypeWellKnownGroup },
 256     { WinEnterpriseControllersSid, ENTERPRISE_DOMAIN_CONTROLLERS, NT_AUTHORITY, SidTypeWellKnownGroup },
 257     { WinSelfSid, SELF, NT_AUTHORITY, SidTypeWellKnownGroup },
 258     { WinAuthenticatedUserSid, Authenticated_Users, NT_AUTHORITY, SidTypeWellKnownGroup },
 259     { WinRestrictedCodeSid, RESTRICTED, NT_AUTHORITY, SidTypeWellKnownGroup },
 260     { WinTerminalServerSid, TERMINAL_SERVER_USER, NT_AUTHORITY, SidTypeWellKnownGroup },
 261     { WinRemoteLogonIdSid, REMOTE_INTERACTIVE_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup },
 262     { WinLocalSystemSid, SYSTEM, NT_AUTHORITY, SidTypeWellKnownGroup },
 263     { WinLocalServiceSid, LOCAL_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup, LOCAL_SERVICE2 },
 264     { WinNetworkServiceSid, NETWORK_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup , NETWORK_SERVICE2},
 265     { WinBuiltinDomainSid, BUILTIN, BUILTIN, SidTypeDomain },
 266     { WinBuiltinAdministratorsSid, Administrators, BUILTIN, SidTypeAlias },
 267     { WinBuiltinUsersSid, Users, BUILTIN, SidTypeAlias },
 268     { WinBuiltinGuestsSid, Guests, BUILTIN, SidTypeAlias },
 269     { WinBuiltinPowerUsersSid, Power_Users, BUILTIN, SidTypeAlias },
 270     { WinBuiltinAccountOperatorsSid, Account_Operators, BUILTIN, SidTypeAlias },
 271     { WinBuiltinSystemOperatorsSid, Server_Operators, BUILTIN, SidTypeAlias },
 272     { WinBuiltinPrintOperatorsSid, Print_Operators, BUILTIN, SidTypeAlias },
 273     { WinBuiltinBackupOperatorsSid, Backup_Operators, BUILTIN, SidTypeAlias },
 274     { WinBuiltinReplicatorSid, Replicators, BUILTIN, SidTypeAlias },
 275     { WinBuiltinPreWindows2000CompatibleAccessSid, Pre_Windows_2000_Compatible_Access, BUILTIN, SidTypeAlias },
 276     { WinBuiltinRemoteDesktopUsersSid, Remote_Desktop_Users, BUILTIN, SidTypeAlias },
 277     { WinBuiltinNetworkConfigurationOperatorsSid, Network_Configuration_Operators, BUILTIN, SidTypeAlias },
 278     { WinNTLMAuthenticationSid, NTML_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 279     { WinDigestAuthenticationSid, Digest_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 280     { WinSChannelAuthenticationSid, SChannel_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 281     { WinThisOrganizationSid, This_Organization, NT_AUTHORITY, SidTypeWellKnownGroup },
 282     { WinOtherOrganizationSid, Other_Organization, NT_AUTHORITY, SidTypeWellKnownGroup },
 283     { WinBuiltinPerfMonitoringUsersSid, Performance_Monitor_Users, BUILTIN, SidTypeAlias },
 284     { WinBuiltinPerfLoggingUsersSid, Performance_Log_Users, BUILTIN, SidTypeAlias },
 285     { WinBuiltinAnyPackageSid, ALL_APPLICATION_PACKAGES, APPLICATION_PACKAGE_AUTHORITY, SidTypeWellKnownGroup },
 286 };
 287 /*
 288  * ACE access rights
 289  */
 290 static const WCHAR SDDL_READ_CONTROL[]     = {'R','C',0};
 291 static const WCHAR SDDL_WRITE_DAC[]        = {'W','D',0};
 292 static const WCHAR SDDL_WRITE_OWNER[]      = {'W','O',0};
 293 static const WCHAR SDDL_STANDARD_DELETE[]  = {'S','D',0};
 294
 295 static const WCHAR SDDL_READ_PROPERTY[]    = {'R','P',0};
 296 static const WCHAR SDDL_WRITE_PROPERTY[]   = {'W','P',0};
 297 static const WCHAR SDDL_CREATE_CHILD[]     = {'C','C',0};
 298 static const WCHAR SDDL_DELETE_CHILD[]     = {'D','C',0};
 299 static const WCHAR SDDL_LIST_CHILDREN[]    = {'L','C',0};
 300 static const WCHAR SDDL_SELF_WRITE[]       = {'S','W',0};
 301 static const WCHAR SDDL_LIST_OBJECT[]      = {'L','O',0};
 302 static const WCHAR SDDL_DELETE_TREE[]      = {'D','T',0};
 303 static const WCHAR SDDL_CONTROL_ACCESS[]   = {'C','R',0};
 304
 305 static const WCHAR SDDL_FILE_ALL[]         = {'F','A',0};
 306 static const WCHAR SDDL_FILE_READ[]        = {'F','R',0};
 307 static const WCHAR SDDL_FILE_WRITE[]       = {'F','W',0};
 308 static const WCHAR SDDL_FILE_EXECUTE[]     = {'F','X',0};
 309
 310 static const WCHAR SDDL_KEY_ALL[]          = {'K','A',0};
 311 static const WCHAR SDDL_KEY_READ[]         = {'K','R',0};
 312 static const WCHAR SDDL_KEY_WRITE[]        = {'K','W',0};
 313 static const WCHAR SDDL_KEY_EXECUTE[]      = {'K','X',0};
 314
 315 static const WCHAR SDDL_GENERIC_ALL[]      = {'G','A',0};
 316 static const WCHAR SDDL_GENERIC_READ[]     = {'G','R',0};
 317 static const WCHAR SDDL_GENERIC_WRITE[]    = {'G','W',0};
 318 static const WCHAR SDDL_GENERIC_EXECUTE[]  = {'G','X',0};
 319
 320 static const WCHAR SDDL_NO_READ_UP[]       = {'N','R',0};
 321 static const WCHAR SDDL_NO_WRITE_UP[]      = {'N','W',0};
 322 static const WCHAR SDDL_NO_EXECUTE_UP[]    = {'N','X',0};
 323
 324 /*
 325  * ACL flags
 326  */
 327 static const WCHAR SDDL_PROTECTED[]             = {'P',0};
 328 static const WCHAR SDDL_AUTO_INHERIT_REQ[]      = {'A','R',0};
 329 static const WCHAR SDDL_AUTO_INHERITED[]        = {'A','I',0};
 330
 331 /*
 332  * ACE types
 333  */
 334 static const WCHAR SDDL_ACCESS_ALLOWED[]        = {'A',0};
 335 static const WCHAR SDDL_ACCESS_DENIED[]         = {'D',0};
 336 static const WCHAR SDDL_AUDIT[]                 = {'A','U',0};
 337 static const WCHAR SDDL_ALARM[]                 = {'A','L',0};
 338 static const WCHAR SDDL_MANDATORY_LABEL[]       = {'M','L',0};
 339
 340 /*
 341  * ACE flags
 342  */
 343 static const WCHAR SDDL_CONTAINER_INHERIT[]  = {'C','I',0};
 344 static const WCHAR SDDL_OBJECT_INHERIT[]     = {'O','I',0};
 345 static const WCHAR SDDL_NO_PROPAGATE[]       = {'N','P',0};
 346 static const WCHAR SDDL_INHERIT_ONLY[]       = {'I','O',0};
 347 static const WCHAR SDDL_INHERITED[]          = {'I','D',0};
 348 static const WCHAR SDDL_AUDIT_SUCCESS[]      = {'S','A',0};
 349 static const WCHAR SDDL_AUDIT_FAILURE[]      = {'F','A',0};
 350
 351 const char * debugstr_sid(PSID sid)
 352 {
 353     int auth = 0;
 354     SID * psid = sid;
 355
 356     if (psid == NULL)
 357         return "(null)";
 358
 359     auth = psid->IdentifierAuthority.Value[5] +
 360            (psid->IdentifierAuthority.Value[4] << 8) +
 361            (psid->IdentifierAuthority.Value[3] << 16) +
 362            (psid->IdentifierAuthority.Value[2] << 24);
 363
 364     switch (psid->SubAuthorityCount) {
 365     case 0:
 366         return wine_dbg_sprintf("S-%d-%d", psid->Revision, auth);
 367     case 1:
 368         return wine_dbg_sprintf("S-%d-%d-%u", psid->Revision, auth,
 369             psid->SubAuthority[0]);
 370     case 2:
 371         return wine_dbg_sprintf("S-%d-%d-%u-%u", psid->Revision, auth,
 372             psid->SubAuthority[0], psid->SubAuthority[1]);
 373     case 3:
 374         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u", psid->Revision, auth,
 375             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2]);
 376     case 4:
 377         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u", psid->Revision, auth,
 378             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 379             psid->SubAuthority[3]);
 380     case 5:
 381         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u", psid->Revision, auth,
 382             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 383             psid->SubAuthority[3], psid->SubAuthority[4]);
 384     case 6:
 385         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 386             psid->SubAuthority[3], psid->SubAuthority[1], psid->SubAuthority[2],
 387             psid->SubAuthority[0], psid->SubAuthority[4], psid->SubAuthority[5]);
 388     case 7:
 389         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 390             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 391             psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
 392             psid->SubAuthority[6]);
 393     case 8:
 394         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 395             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 396             psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
 397             psid->SubAuthority[6], psid->SubAuthority[7]);
 398     }
 399     return "(too-big)";
 400 }
 401
 402 /* set last error code from NT status and get the proper boolean return value */
 403 /* used for functions that are a simple wrapper around the corresponding ntdll API */
 404 static inline BOOL set_ntstatus( NTSTATUS status )
 405 {
 406     if (status) SetLastError( RtlNtStatusToDosError( status ));
 407     return !status;
 408 }
 409
 410 /* helper function for SE_FILE_OBJECT objects in [Get|Set]NamedSecurityInfo */
 411 static inline DWORD get_security_file( LPCWSTR full_file_name, DWORD access, HANDLE *file )
 412 {
 413     UNICODE_STRING file_nameW;
 414     OBJECT_ATTRIBUTES attr;
 415     IO_STATUS_BLOCK io;
 416     NTSTATUS status;
 417
 418     if (!RtlDosPathNameToNtPathName_U( full_file_name, &file_nameW, NULL, NULL ))
 419         return ERROR_PATH_NOT_FOUND;
 420     attr.Length = sizeof(attr);
 421     attr.RootDirectory = 0;
 422     attr.Attributes = OBJ_CASE_INSENSITIVE;
 423     attr.ObjectName = &file_nameW;
 424     attr.SecurityDescriptor = NULL;
 425     status = NtCreateFile( file, access|SYNCHRONIZE, &attr, &io, NULL, FILE_FLAG_BACKUP_SEMANTICS,
 426                            FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, FILE_OPEN,
 427                            FILE_OPEN_FOR_BACKUP_INTENT, NULL, 0 );
 428     RtlFreeUnicodeString( &file_nameW );
 429     return RtlNtStatusToDosError( status );
 430 }
 431
 432 /* helper function for SE_SERVICE objects in [Get|Set]NamedSecurityInfo */
 433 static inline DWORD get_security_service( LPWSTR full_service_name, DWORD access, HANDLE *service )
 434 {
 435     SC_HANDLE manager = 0;
 436     DWORD err;
 437
 438     err = SERV_OpenSCManagerW( NULL, NULL, access, (SC_HANDLE *)&manager );
 439     if (err == ERROR_SUCCESS)
 440     {
 441         err = SERV_OpenServiceW( manager, full_service_name, access, (SC_HANDLE *)service );
 442         CloseServiceHandle( manager );
 443     }
 444     return err;
 445 }
 446
 447 /* helper function for SE_REGISTRY_KEY objects in [Get|Set]NamedSecurityInfo */
 448 static inline DWORD get_security_regkey( LPWSTR full_key_name, DWORD access, HANDLE *key )
 449 {
 450     WCHAR classes_rootW[] = {'C','L','A','S','S','E','S','_','R','O','O','T',0};
 451     WCHAR current_userW[] = {'C','U','R','R','E','N','T','_','U','S','E','R',0};
 452     WCHAR machineW[] = {'M','A','C','H','I','N','E',0};
 453     WCHAR usersW[] = {'U','S','E','R','S',0};
 454     LPWSTR p = strchrW(full_key_name, '\\');
 455     int len = p-full_key_name;
 456     HKEY hParent;
 457
 458     if (!p) return ERROR_INVALID_PARAMETER;
 459     if (strncmpW( full_key_name, classes_rootW, len ) == 0)
 460         hParent = HKEY_CLASSES_ROOT;
 461     else if (strncmpW( full_key_name, current_userW, len ) == 0)
 462         hParent = HKEY_CURRENT_USER;
 463     else if (strncmpW( full_key_name, machineW, len ) == 0)
 464         hParent = HKEY_LOCAL_MACHINE;
 465     else if (strncmpW( full_key_name, usersW, len ) == 0)
 466         hParent = HKEY_USERS;
 467     else
 468         return ERROR_INVALID_PARAMETER;
 469     return RegOpenKeyExW( hParent, p+1, 0, access, (HKEY *)key );
 470 }
 471
 472 #define WINE_SIZE_OF_WORLD_ACCESS_ACL   (sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD))
 473
 474 static void GetWorldAccessACL(PACL pACL)
 475 {
 476     PACCESS_ALLOWED_ACE pACE = (PACCESS_ALLOWED_ACE) (pACL + 1);
 477
 478     pACL->AclRevision = ACL_REVISION;
 479     pACL->Sbz1 = 0;
 480     pACL->AclSize = WINE_SIZE_OF_WORLD_ACCESS_ACL;
 481     pACL->AceCount = 1;
 482     pACL->Sbz2 = 0;
 483
 484     pACE->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 485     pACE->Header.AceFlags = CONTAINER_INHERIT_ACE;
 486     pACE->Header.AceSize = sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD);
 487     pACE->Mask = 0xf3ffffff; /* Everything except reserved bits */
 488     memcpy(&pACE->SidStart, &sidWorld, sizeof(sidWorld));
 489 }
 490
 491 /************************************************************
 492  *                ADVAPI_IsLocalComputer
 493  *
 494  * Checks whether the server name indicates local machine.
 495  */
 496 BOOL ADVAPI_IsLocalComputer(LPCWSTR ServerName)
 497 {
 498     DWORD dwSize = MAX_COMPUTERNAME_LENGTH + 1;
 499     BOOL Result;
 500     LPWSTR buf;
 501
 502     if (!ServerName || !ServerName[0])
 503         return TRUE;
 504
 505     buf = heap_alloc(dwSize * sizeof(WCHAR));
 506     Result = GetComputerNameW(buf,  &dwSize);
 507     if (Result && (ServerName[0] == '\\') && (ServerName[1] == '\\'))
 508         ServerName += 2;
 509     Result = Result && !lstrcmpW(ServerName, buf);
 510     heap_free(buf);
 511
 512     return Result;
 513 }
 514
 515 /************************************************************
 516  *                ADVAPI_GetComputerSid
 517  */
 518 BOOL ADVAPI_GetComputerSid(PSID sid)
 519 {
 520     static const struct /* same fields as struct SID */
 521     {
 522         BYTE Revision;
 523         BYTE SubAuthorityCount;
 524         SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
 525         DWORD SubAuthority[4];
 526     } computer_sid =
 527     { SID_REVISION, 4, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0 } };
 528
 529     memcpy( sid, &computer_sid, sizeof(computer_sid) );
 530     return TRUE;
 531 }
 532
 533 /*      ##############################
 534         ######  TOKEN FUNCTIONS ######
 535         ##############################
 536 */
 537
 538 /******************************************************************************
 539  * OpenProcessToken                     [ADVAPI32.@]
 540  * Opens the access token associated with a process handle.
 541  *
 542  * PARAMS
 543  *   ProcessHandle [I] Handle to process
 544  *   DesiredAccess [I] Desired access to process
 545  *   TokenHandle   [O] Pointer to handle of open access token
 546  *
 547  * RETURNS
 548  *  Success: TRUE. TokenHandle contains the access token.
 549  *  Failure: FALSE.
 550  *
 551  * NOTES
 552  *  See NtOpenProcessToken.
 553  */
 554 BOOL WINAPI
 555 OpenProcessToken( HANDLE ProcessHandle, DWORD DesiredAccess,
 556                   HANDLE *TokenHandle )
 557 {
 558         return set_ntstatus(NtOpenProcessToken( ProcessHandle, DesiredAccess, TokenHandle ));
 559 }
 560
 561 /******************************************************************************
 562  * OpenThreadToken [ADVAPI32.@]
 563  *
 564  * Opens the access token associated with a thread handle.
 565  *
 566  * PARAMS
 567  *   ThreadHandle  [I] Handle to process
 568  *   DesiredAccess [I] Desired access to the thread
 569  *   OpenAsSelf    [I] ???
 570  *   TokenHandle   [O] Destination for the token handle
 571  *
 572  * RETURNS
 573  *  Success: TRUE. TokenHandle contains the access token.
 574  *  Failure: FALSE.
 575  *
 576  * NOTES
 577  *  See NtOpenThreadToken.
 578  */
 579 BOOL WINAPI
 580 OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess,
 581                  BOOL OpenAsSelf, HANDLE *TokenHandle)
 582 {
 583         return set_ntstatus( NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle));
 584 }
 585
 586 BOOL WINAPI
 587 AdjustTokenGroups( HANDLE TokenHandle, BOOL ResetToDefault, PTOKEN_GROUPS NewState,
 588                    DWORD BufferLength, PTOKEN_GROUPS PreviousState, PDWORD ReturnLength )
 589 {
 590     return set_ntstatus( NtAdjustGroupsToken(TokenHandle, ResetToDefault, NewState, BufferLength,
 591                                              PreviousState, ReturnLength));
 592 }
 593
 594 /******************************************************************************
 595  * AdjustTokenPrivileges [ADVAPI32.@]
 596  *
 597  * Adjust the privileges of an open token handle.
 598  *
 599  * PARAMS
 600  *  TokenHandle          [I]   Handle from OpenProcessToken() or OpenThreadToken()
 601  *  DisableAllPrivileges [I]   TRUE=Remove all privileges, FALSE=Use NewState
 602  *  NewState             [I]   Desired new privileges of the token
 603  *  BufferLength         [I]   Length of NewState
 604  *  PreviousState        [O]   Destination for the previous state
 605  *  ReturnLength         [I/O] Size of PreviousState
 606  *
 607  *
 608  * RETURNS
 609  *  Success: TRUE. Privileges are set to NewState and PreviousState is updated.
 610  *  Failure: FALSE.
 611  *
 612  * NOTES
 613  *  See NtAdjustPrivilegesToken.
 614  */
 615 BOOL WINAPI
 616 AdjustTokenPrivileges( HANDLE TokenHandle, BOOL DisableAllPrivileges,
 617                        PTOKEN_PRIVILEGES NewState, DWORD BufferLength,
 618                        PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength )
 619 {
 620     NTSTATUS status;
 621
 622     TRACE("(%p %d %p %d %p %p)\n", TokenHandle, DisableAllPrivileges, NewState, BufferLength,
 623         PreviousState, ReturnLength);
 624
 625     status = NtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges,
 626                                                      NewState, BufferLength, PreviousState,
 627                                                      ReturnLength);
 628     SetLastError( RtlNtStatusToDosError( status ));
 629     if ((status == STATUS_SUCCESS) || (status == STATUS_NOT_ALL_ASSIGNED))
 630         return TRUE;
 631     else
 632         return FALSE;
 633 }
 634
 635 /******************************************************************************
 636  * CheckTokenMembership [ADVAPI32.@]
 637  *
 638  * Determine if an access token is a member of a SID.
 639  *
 640  * PARAMS
 641  *   TokenHandle [I] Handle from OpenProcessToken() or OpenThreadToken()
 642  *   SidToCheck  [I] SID that possibly contains the token
 643  *   IsMember    [O] Destination for result.
 644  *
 645  * RETURNS
 646  *  Success: TRUE. IsMember is TRUE if TokenHandle is a member, FALSE otherwise.
 647  *  Failure: FALSE.
 648  */
 649 BOOL WINAPI
 650 CheckTokenMembership( HANDLE token, PSID sid_to_check,
 651                       PBOOL is_member )
 652 {
 653     PTOKEN_GROUPS token_groups = NULL;
 654     HANDLE thread_token = NULL;
 655     DWORD size, i;
 656     BOOL ret;
 657
 658     TRACE("(%p %s %p)\n", token, debugstr_sid(sid_to_check), is_member);
 659
 660     *is_member = FALSE;
 661
 662     if (!token)
 663     {
 664         if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &thread_token))
 665         {
 666             HANDLE process_token;
 667             ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &process_token);
 668             if (!ret)
 669                 goto exit;
 670             ret = DuplicateTokenEx(process_token, TOKEN_QUERY,
 671                 NULL, SecurityImpersonation, TokenImpersonation,
 672                 &thread_token);
 673             CloseHandle(process_token);
 674             if (!ret)
 675                 goto exit;
 676         }
 677         token = thread_token;
 678     }
 679     else
 680     {
 681         TOKEN_TYPE type;
 682
 683         ret = GetTokenInformation(token, TokenType, &type, sizeof(TOKEN_TYPE), &size);
 684         if (!ret) goto exit;
 685
 686         if (type == TokenPrimary)
 687         {
 688             SetLastError(ERROR_NO_IMPERSONATION_TOKEN);
 689             return FALSE;
 690         }
 691     }
 692
 693     ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
 694     if (!ret && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
 695         goto exit;
 696
 697     token_groups = heap_alloc(size);
 698     if (!token_groups)
 699     {
 700         ret = FALSE;
 701         goto exit;
 702     }
 703
 704     ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
 705     if (!ret)
 706         goto exit;
 707
 708     for (i = 0; i < token_groups->GroupCount; i++)
 709     {
 710         TRACE("Groups[%d]: {0x%x, %s}\n", i,
 711             token_groups->Groups[i].Attributes,
 712             debugstr_sid(token_groups->Groups[i].Sid));
 713         if ((token_groups->Groups[i].Attributes & SE_GROUP_ENABLED) &&
 714             EqualSid(sid_to_check, token_groups->Groups[i].Sid))
 715         {
 716             *is_member = TRUE;
 717             TRACE("sid enabled and found in token\n");
 718             break;
 719         }
 720     }
 721
 722 exit:
 723     heap_free(token_groups);
 724     if (thread_token != NULL) CloseHandle(thread_token);
 725
 726     return ret;
 727 }
 728
 729 /******************************************************************************
 730  * GetTokenInformation [ADVAPI32.@]
 731  *
 732  * Get a type of information about an access token.
 733  *
 734  * PARAMS
 735  *   token           [I] Handle from OpenProcessToken() or OpenThreadToken()
 736  *   tokeninfoclass  [I] A TOKEN_INFORMATION_CLASS from "winnt.h"
 737  *   tokeninfo       [O] Destination for token information
 738  *   tokeninfolength [I] Length of tokeninfo
 739  *   retlen          [O] Destination for returned token information length
 740  *
 741  * RETURNS
 742  *  Success: TRUE. tokeninfo contains retlen bytes of token information
 743  *  Failure: FALSE.
 744  *
 745  * NOTES
 746  *  See NtQueryInformationToken.
 747  */
 748 BOOL WINAPI
 749 GetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
 750                      LPVOID tokeninfo, DWORD tokeninfolength, LPDWORD retlen )
 751 {
 752     TRACE("(%p, %s, %p, %d, %p):\n",
 753           token,
 754           (tokeninfoclass == TokenUser) ? "TokenUser" :
 755           (tokeninfoclass == TokenGroups) ? "TokenGroups" :
 756           (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" :
 757           (tokeninfoclass == TokenOwner) ? "TokenOwner" :
 758           (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" :
 759           (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" :
 760           (tokeninfoclass == TokenSource) ? "TokenSource" :
 761           (tokeninfoclass == TokenType) ? "TokenType" :
 762           (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" :
 763           (tokeninfoclass == TokenStatistics) ? "TokenStatistics" :
 764           (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" :
 765           (tokeninfoclass == TokenSessionId) ? "TokenSessionId" :
 766           (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" :
 767           (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" :
 768           (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" :
 769           "Unknown",
 770           tokeninfo, tokeninfolength, retlen);
 771     return set_ntstatus( NtQueryInformationToken( token, tokeninfoclass, tokeninfo,
 772                                                   tokeninfolength, retlen));
 773 }
 774
 775 /******************************************************************************
 776  * SetTokenInformation [ADVAPI32.@]
 777  *
 778  * Set information for an access token.
 779  *
 780  * PARAMS
 781  *   token           [I] Handle from OpenProcessToken() or OpenThreadToken()
 782  *   tokeninfoclass  [I] A TOKEN_INFORMATION_CLASS from "winnt.h"
 783  *   tokeninfo       [I] Token information to set
 784  *   tokeninfolength [I] Length of tokeninfo
 785  *
 786  * RETURNS
 787  *  Success: TRUE. The information for the token is set to tokeninfo.
 788  *  Failure: FALSE.
 789  */
 790 BOOL WINAPI
 791 SetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
 792                      LPVOID tokeninfo, DWORD tokeninfolength )
 793 {
 794     TRACE("(%p, %s, %p, %d)\n",
 795           token,
 796           (tokeninfoclass == TokenUser) ? "TokenUser" :
 797           (tokeninfoclass == TokenGroups) ? "TokenGroups" :
 798           (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" :
 799           (tokeninfoclass == TokenOwner) ? "TokenOwner" :
 800           (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" :
 801           (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" :
 802           (tokeninfoclass == TokenSource) ? "TokenSource" :
 803           (tokeninfoclass == TokenType) ? "TokenType" :
 804           (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" :
 805           (tokeninfoclass == TokenStatistics) ? "TokenStatistics" :
 806           (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" :
 807           (tokeninfoclass == TokenSessionId) ? "TokenSessionId" :
 808           (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" :
 809           (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" :
 810           (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" :
 811           "Unknown",
 812           tokeninfo, tokeninfolength);
 813
 814     return set_ntstatus( NtSetInformationToken( token, tokeninfoclass, tokeninfo, tokeninfolength ));
 815 }
 816
 817 /*************************************************************************
 818  * SetThreadToken [ADVAPI32.@]
 819  *
 820  * Assigns an 'impersonation token' to a thread so it can assume the
 821  * security privileges of another thread or process.  Can also remove
 822  * a previously assigned token.
 823  *
 824  * PARAMS
 825  *   thread          [O] Handle to thread to set the token for
 826  *   token           [I] Token to set
 827  *
 828  * RETURNS
 829  *  Success: TRUE. The threads access token is set to token
 830  *  Failure: FALSE.
 831  *
 832  * NOTES
 833  *  Only supported on NT or higher. On Win9X this function does nothing.
 834  *  See SetTokenInformation.
 835  */
 836 BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token)
 837 {
 838     return set_ntstatus( NtSetInformationThread( thread ? *thread : GetCurrentThread(),
 839                                                  ThreadImpersonationToken, &token, sizeof token ));
 840 }
 841
 842 /*************************************************************************
 843  * CreateRestrictedToken [ADVAPI32.@]
 844  *
 845  * Create a new more restricted token from an existing token.
 846  *
 847  * PARAMS
 848  *   baseToken       [I] Token to base the new restricted token on
 849  *   flags           [I] Options
 850  *   nDisableSids    [I] Length of disableSids array
 851  *   disableSids     [I] Array of SIDs to disable in the new token
 852  *   nDeletePrivs    [I] Length of deletePrivs array
 853  *   deletePrivs     [I] Array of privileges to delete in the new token
 854  *   nRestrictSids   [I] Length of restrictSids array
 855  *   restrictSids    [I] Array of SIDs to restrict in the new token
 856  *   newToken        [O] Address where the new token is stored
 857  *
 858  * RETURNS
 859  *  Success: TRUE
 860  *  Failure: FALSE
 861  */
 862 BOOL WINAPI CreateRestrictedToken(
 863     HANDLE baseToken,
 864     DWORD flags,
 865     DWORD nDisableSids,
 866     PSID_AND_ATTRIBUTES disableSids,
 867     DWORD nDeletePrivs,
 868     PLUID_AND_ATTRIBUTES deletePrivs,
 869     DWORD nRestrictSids,
 870     PSID_AND_ATTRIBUTES restrictSids,
 871     PHANDLE newToken)
 872 {
 873     TOKEN_TYPE type;
 874     SECURITY_IMPERSONATION_LEVEL level = SecurityAnonymous;
 875     DWORD size;
 876
 877     FIXME("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p): stub\n",
 878           baseToken, flags, nDisableSids, disableSids,
 879           nDeletePrivs, deletePrivs,
 880           nRestrictSids, restrictSids,
 881           newToken);
 882
 883     size = sizeof(type);
 884     if (!GetTokenInformation( baseToken, TokenType, &type, size, &size )) return FALSE;
 885     if (type == TokenImpersonation)
 886     {
 887         size = sizeof(level);
 888         if (!GetTokenInformation( baseToken, TokenImpersonationLevel, &level, size, &size ))
 889             return FALSE;
 890     }
 891     return DuplicateTokenEx( baseToken, MAXIMUM_ALLOWED, NULL, level, type, newToken );
 892 }
 893
 894 /*      ##############################
 895         ######  SID FUNCTIONS   ######
 896         ##############################
 897 */
 898
 899 /******************************************************************************
 900  * AllocateAndInitializeSid [ADVAPI32.@]
 901  *
 902  * PARAMS
 903  *   pIdentifierAuthority []
 904  *   nSubAuthorityCount   []
 905  *   nSubAuthority0       []
 906  *   nSubAuthority1       []
 907  *   nSubAuthority2       []
 908  *   nSubAuthority3       []
 909  *   nSubAuthority4       []
 910  *   nSubAuthority5       []
 911  *   nSubAuthority6       []
 912  *   nSubAuthority7       []
 913  *   pSid                 []
 914  */
 915 BOOL WINAPI
 916 AllocateAndInitializeSid( PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
 917                           BYTE nSubAuthorityCount,
 918                           DWORD nSubAuthority0, DWORD nSubAuthority1,
 919                           DWORD nSubAuthority2, DWORD nSubAuthority3,
 920                           DWORD nSubAuthority4, DWORD nSubAuthority5,
 921                           DWORD nSubAuthority6, DWORD nSubAuthority7,
 922                           PSID *pSid )
 923 {
 924     return set_ntstatus( RtlAllocateAndInitializeSid(
 925                              pIdentifierAuthority, nSubAuthorityCount,
 926                              nSubAuthority0, nSubAuthority1, nSubAuthority2, nSubAuthority3,
 927                              nSubAuthority4, nSubAuthority5, nSubAuthority6, nSubAuthority7,
 928                              pSid ));
 929 }
 930
 931 /******************************************************************************
 932  * FreeSid [ADVAPI32.@]
 933  *
 934  * PARAMS
 935  *   pSid []
 936  */
 937 PVOID WINAPI
 938 FreeSid( PSID pSid )
 939 {
 940         RtlFreeSid(pSid);
 941         return NULL; /* is documented like this */
 942 }
 943
 944 /******************************************************************************
 945  * CopySid [ADVAPI32.@]
 946  *
 947  * PARAMS
 948  *   nDestinationSidLength []
 949  *   pDestinationSid       []
 950  *   pSourceSid            []
 951  */
 952 BOOL WINAPI
 953 CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid )
 954 {
 955         return RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid);
 956 }
 957
 958 /******************************************************************************
 959  * CreateWellKnownSid [ADVAPI32.@]
 960  */
 961 BOOL WINAPI
 962 CreateWellKnownSid( WELL_KNOWN_SID_TYPE WellKnownSidType,
 963                     PSID DomainSid,
 964                     PSID pSid,
 965                     DWORD* cbSid)
 966 {
 967     unsigned int i;
 968     TRACE("(%d, %s, %p, %p)\n", WellKnownSidType, debugstr_sid(DomainSid), pSid, cbSid);
 969
 970     if (cbSid == NULL || (DomainSid && !IsValidSid(DomainSid)))
 971     {
 972         SetLastError(ERROR_INVALID_PARAMETER);
 973         return FALSE;
 974     }
 975
 976     for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++) {
 977         if (WellKnownSids[i].Type == WellKnownSidType) {
 978             DWORD length = GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
 979
 980             if (*cbSid < length)
 981             {
 982                 *cbSid = length;
 983                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
 984                 return FALSE;
 985             }
 986             if (!pSid)
 987             {
 988                 SetLastError(ERROR_INVALID_PARAMETER);
 989                 return FALSE;
 990             }
 991             CopyMemory(pSid, &WellKnownSids[i].Sid.Revision, length);
 992             *cbSid = length;
 993             return TRUE;
 994         }
 995     }
 996
 997     if (DomainSid == NULL || *GetSidSubAuthorityCount(DomainSid) == SID_MAX_SUB_AUTHORITIES)
 998     {
 999         SetLastError(ERROR_INVALID_PARAMETER);
1000         return FALSE;
1001     }
1002
1003     for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
1004         if (WellKnownRids[i].Type == WellKnownSidType) {
1005             UCHAR domain_subauth = *GetSidSubAuthorityCount(DomainSid);
1006             DWORD domain_sid_length = GetSidLengthRequired(domain_subauth);
1007             DWORD output_sid_length = GetSidLengthRequired(domain_subauth + 1);
1008
1009             if (*cbSid < output_sid_length)
1010             {
1011                 *cbSid = output_sid_length;
1012                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
1013                 return FALSE;
1014             }
1015             if (!pSid)
1016             {
1017                 SetLastError(ERROR_INVALID_PARAMETER);
1018                 return FALSE;
1019             }
1020             CopyMemory(pSid, DomainSid, domain_sid_length);
1021             (*GetSidSubAuthorityCount(pSid))++;
1022             (*GetSidSubAuthority(pSid, domain_subauth)) = WellKnownRids[i].Rid;
1023             *cbSid = output_sid_length;
1024             return TRUE;
1025         }
1026
1027     SetLastError(ERROR_INVALID_PARAMETER);
1028     return FALSE;
1029 }
1030
1031 /******************************************************************************
1032  * IsWellKnownSid [ADVAPI32.@]
1033  */
1034 BOOL WINAPI
1035 IsWellKnownSid( PSID pSid, WELL_KNOWN_SID_TYPE WellKnownSidType )
1036 {
1037     unsigned int i;
1038     TRACE("(%s, %d)\n", debugstr_sid(pSid), WellKnownSidType);
1039
1040     for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
1041         if (WellKnownSids[i].Type == WellKnownSidType)
1042             if (EqualSid(pSid, (PSID)&(WellKnownSids[i].Sid.Revision)))
1043                 return TRUE;
1044
1045     return FALSE;
1046 }
1047
1048 BOOL WINAPI
1049 IsTokenRestricted( HANDLE TokenHandle )
1050 {
1051     TOKEN_GROUPS *groups;
1052     DWORD size;
1053     NTSTATUS status;
1054     BOOL restricted;
1055
1056     TRACE("(%p)\n", TokenHandle);
1057
1058     status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, NULL, 0, &size);
1059     if (status != STATUS_BUFFER_TOO_SMALL)
1060         return FALSE;
1061
1062     groups = heap_alloc(size);
1063     if (!groups)
1064     {
1065         SetLastError(ERROR_OUTOFMEMORY);
1066         return FALSE;
1067     }
1068
1069     status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, groups, size, &size);
1070     if (status != STATUS_SUCCESS)
1071     {
1072         heap_free(groups);
1073         return set_ntstatus(status);
1074     }
1075
1076     restricted = groups->GroupCount > 0;
1077     heap_free(groups);
1078
1079     return restricted;
1080 }
1081
1082 /******************************************************************************
1083  * IsValidSid [ADVAPI32.@]
1084  *
1085  * PARAMS
1086  *   pSid []
1087  */
1088 BOOL WINAPI
1089 IsValidSid( PSID pSid )
1090 {
1091         return RtlValidSid( pSid );
1092 }
1093
1094 /******************************************************************************
1095  * EqualSid [ADVAPI32.@]
1096  *
1097  * PARAMS
1098  *   pSid1 []
1099  *   pSid2 []
1100  */
1101 BOOL WINAPI
1102 EqualSid( PSID pSid1, PSID pSid2 )
1103 {
1104         BOOL ret = RtlEqualSid( pSid1, pSid2 );
1105         SetLastError(ERROR_SUCCESS);
1106         return ret;
1107 }
1108
1109 /******************************************************************************
1110  * EqualPrefixSid [ADVAPI32.@]
1111  */
1112 BOOL WINAPI EqualPrefixSid (PSID pSid1, PSID pSid2)
1113 {
1114         return RtlEqualPrefixSid(pSid1, pSid2);
1115 }
1116
1117 /******************************************************************************
1118  * GetSidLengthRequired [ADVAPI32.@]
1119  *
1120  * PARAMS
1121  *   nSubAuthorityCount []
1122  */
1123 DWORD WINAPI
1124 GetSidLengthRequired( BYTE nSubAuthorityCount )
1125 {
1126         return RtlLengthRequiredSid(nSubAuthorityCount);
1127 }
1128
1129 /******************************************************************************
1130  * InitializeSid [ADVAPI32.@]
1131  *
1132  * PARAMS
1133  *   pIdentifierAuthority []
1134  */
1135 BOOL WINAPI
1136 InitializeSid (
1137         PSID pSid,
1138         PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
1139         BYTE nSubAuthorityCount)
1140 {
1141         return RtlInitializeSid(pSid, pIdentifierAuthority, nSubAuthorityCount);
1142 }
1143
1144 DWORD WINAPI
1145 GetEffectiveRightsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pAccessRights )
1146 {
1147     FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights);
1148
1149     *pAccessRights = STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL;
1150     return 0;
1151 }
1152
1153 DWORD WINAPI
1154 GetEffectiveRightsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pAccessRights )
1155 {
1156     FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights);
1157
1158     return 1;
1159 }
1160
1161 /******************************************************************************
1162  * GetSidIdentifierAuthority [ADVAPI32.@]
1163  *
1164  * PARAMS
1165  *   pSid []
1166  */
1167 PSID_IDENTIFIER_AUTHORITY WINAPI
1168 GetSidIdentifierAuthority( PSID pSid )
1169 {
1170     SetLastError(ERROR_SUCCESS);
1171     return RtlIdentifierAuthoritySid(pSid);
1172 }
1173
1174 /******************************************************************************
1175  * GetSidSubAuthority [ADVAPI32.@]
1176  *
1177  * PARAMS
1178  *   pSid          []
1179  *   nSubAuthority []
1180  */
1181 PDWORD WINAPI
1182 GetSidSubAuthority( PSID pSid, DWORD nSubAuthority )
1183 {
1184         SetLastError(ERROR_SUCCESS);
1185         return RtlSubAuthoritySid(pSid, nSubAuthority);
1186 }
1187
1188 /******************************************************************************
1189  * GetSidSubAuthorityCount [ADVAPI32.@]
1190  *
1191  * PARAMS
1192  *   pSid []
1193  */
1194 PUCHAR WINAPI
1195 GetSidSubAuthorityCount (PSID pSid)
1196 {
1197         SetLastError(ERROR_SUCCESS);
1198         return RtlSubAuthorityCountSid(pSid);
1199 }
1200
1201 /******************************************************************************
1202  * GetLengthSid [ADVAPI32.@]
1203  *
1204  * PARAMS
1205  *   pSid []
1206  */
1207 DWORD WINAPI
1208 GetLengthSid (PSID pSid)
1209 {
1210         return RtlLengthSid(pSid);
1211 }
1212
1213 /*      ##############################################
1214         ######  SECURITY DESCRIPTOR FUNCTIONS   ######
1215         ##############################################
1216 */
1217
1218  /******************************************************************************
1219  * BuildSecurityDescriptorA [ADVAPI32.@]
1220  *
1221  * Builds a SD from
1222  *
1223  * PARAMS
1224  *  pOwner                [I]
1225  *  pGroup                [I]
1226  *  cCountOfAccessEntries [I]
1227  *  pListOfAccessEntries  [I]
1228  *  cCountOfAuditEntries  [I]
1229  *  pListofAuditEntries   [I]
1230  *  pOldSD                [I]
1231  *  lpdwBufferLength      [I/O]
1232  *  pNewSD                [O]
1233  *
1234  * RETURNS
1235  *  Success: ERROR_SUCCESS
1236  *  Failure: nonzero error code from Winerror.h
1237  */
1238 DWORD WINAPI BuildSecurityDescriptorA(
1239     IN PTRUSTEEA pOwner,
1240     IN PTRUSTEEA pGroup,
1241     IN ULONG cCountOfAccessEntries,
1242     IN PEXPLICIT_ACCESSA pListOfAccessEntries,
1243     IN ULONG cCountOfAuditEntries,
1244     IN PEXPLICIT_ACCESSA pListofAuditEntries,
1245     IN PSECURITY_DESCRIPTOR pOldSD,
1246     IN OUT PULONG lpdwBufferLength,
1247     OUT PSECURITY_DESCRIPTOR* pNewSD)
1248 {
1249     FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup,
1250           cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries,
1251           pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD);
1252
1253     return ERROR_CALL_NOT_IMPLEMENTED;
1254 }
1255
1256 /******************************************************************************
1257  * BuildSecurityDescriptorW [ADVAPI32.@]
1258  *
1259  * See BuildSecurityDescriptorA.
1260  */
1261 DWORD WINAPI BuildSecurityDescriptorW(
1262     IN PTRUSTEEW pOwner,
1263     IN PTRUSTEEW pGroup,
1264     IN ULONG cCountOfAccessEntries,
1265     IN PEXPLICIT_ACCESSW pListOfAccessEntries,
1266     IN ULONG cCountOfAuditEntries,
1267     IN PEXPLICIT_ACCESSW pListofAuditEntries,
1268     IN PSECURITY_DESCRIPTOR pOldSD,
1269     IN OUT PULONG lpdwBufferLength,
1270     OUT PSECURITY_DESCRIPTOR* pNewSD)
1271 {
1272     FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup,
1273           cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries,
1274           pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD);
1275
1276     return ERROR_CALL_NOT_IMPLEMENTED;
1277 }
1278
1279 /******************************************************************************
1280  * InitializeSecurityDescriptor [ADVAPI32.@]
1281  *
1282  * PARAMS
1283  *   pDescr   []
1284  *   revision []
1285  */
1286 BOOL WINAPI
1287 InitializeSecurityDescriptor( PSECURITY_DESCRIPTOR pDescr, DWORD revision )
1288 {
1289         return set_ntstatus( RtlCreateSecurityDescriptor(pDescr, revision ));
1290 }
1291
1292
1293 /******************************************************************************
1294  * MakeAbsoluteSD [ADVAPI32.@]
1295  */
1296 BOOL WINAPI MakeAbsoluteSD (
1297         IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
1298         OUT PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
1299         OUT LPDWORD lpdwAbsoluteSecurityDescriptorSize,
1300         OUT PACL pDacl,
1301         OUT LPDWORD lpdwDaclSize,
1302         OUT PACL pSacl,
1303         OUT LPDWORD lpdwSaclSize,
1304         OUT PSID pOwner,
1305         OUT LPDWORD lpdwOwnerSize,
1306         OUT PSID pPrimaryGroup,
1307         OUT LPDWORD lpdwPrimaryGroupSize)
1308 {
1309     return set_ntstatus( RtlSelfRelativeToAbsoluteSD(pSelfRelativeSecurityDescriptor,
1310                                                      pAbsoluteSecurityDescriptor,
1311                                                      lpdwAbsoluteSecurityDescriptorSize,
1312                                                      pDacl, lpdwDaclSize, pSacl, lpdwSaclSize,
1313                                                      pOwner, lpdwOwnerSize,
1314                                                      pPrimaryGroup, lpdwPrimaryGroupSize));
1315 }
1316
1317 /******************************************************************************
1318  * GetKernelObjectSecurity [ADVAPI32.@]
1319  */
1320 BOOL WINAPI GetKernelObjectSecurity(
1321         HANDLE Handle,
1322         SECURITY_INFORMATION RequestedInformation,
1323         PSECURITY_DESCRIPTOR pSecurityDescriptor,
1324         DWORD nLength,
1325         LPDWORD lpnLengthNeeded )
1326 {
1327     TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", Handle, RequestedInformation,
1328           pSecurityDescriptor, nLength, lpnLengthNeeded);
1329
1330     return set_ntstatus( NtQuerySecurityObject(Handle, RequestedInformation, pSecurityDescriptor,
1331                                                nLength, lpnLengthNeeded ));
1332 }
1333
1334 /******************************************************************************
1335  * GetPrivateObjectSecurity [ADVAPI32.@]
1336  */
1337 BOOL WINAPI GetPrivateObjectSecurity(
1338         PSECURITY_DESCRIPTOR ObjectDescriptor,
1339         SECURITY_INFORMATION SecurityInformation,
1340         PSECURITY_DESCRIPTOR ResultantDescriptor,
1341         DWORD DescriptorLength,
1342         PDWORD ReturnLength )
1343 {
1344     SECURITY_DESCRIPTOR desc;
1345     BOOL defaulted, present;
1346     PACL pacl;
1347     PSID psid;
1348
1349     TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", ObjectDescriptor, SecurityInformation,
1350           ResultantDescriptor, DescriptorLength, ReturnLength);
1351
1352     if (!InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION))
1353         return FALSE;
1354
1355     if (SecurityInformation & OWNER_SECURITY_INFORMATION)
1356     {
1357         if (!GetSecurityDescriptorOwner(ObjectDescriptor, &psid, &defaulted))
1358             return FALSE;
1359         SetSecurityDescriptorOwner(&desc, psid, defaulted);
1360     }
1361
1362     if (SecurityInformation & GROUP_SECURITY_INFORMATION)
1363     {
1364         if (!GetSecurityDescriptorGroup(ObjectDescriptor, &psid, &defaulted))
1365             return FALSE;
1366         SetSecurityDescriptorGroup(&desc, psid, defaulted);
1367     }
1368
1369     if (SecurityInformation & DACL_SECURITY_INFORMATION)
1370     {
1371         if (!GetSecurityDescriptorDacl(ObjectDescriptor, &present, &pacl, &defaulted))
1372             return FALSE;
1373         SetSecurityDescriptorDacl(&desc, present, pacl, defaulted);
1374     }
1375
1376     if (SecurityInformation & SACL_SECURITY_INFORMATION)
1377     {
1378         if (!GetSecurityDescriptorSacl(ObjectDescriptor, &present, &pacl, &defaulted))
1379             return FALSE;
1380         SetSecurityDescriptorSacl(&desc, present, pacl, defaulted);
1381     }
1382
1383     *ReturnLength = DescriptorLength;
1384     return MakeSelfRelativeSD(&desc, ResultantDescriptor, ReturnLength);
1385 }
1386
1387 /******************************************************************************
1388  * GetSecurityDescriptorLength [ADVAPI32.@]
1389  */
1390 DWORD WINAPI GetSecurityDescriptorLength( PSECURITY_DESCRIPTOR pDescr)
1391 {
1392         return RtlLengthSecurityDescriptor(pDescr);
1393 }
1394
1395 /******************************************************************************
1396  * GetSecurityDescriptorOwner [ADVAPI32.@]
1397  *
1398  * PARAMS
1399  *   pOwner            []
1400  *   lpbOwnerDefaulted []
1401  */
1402 BOOL WINAPI
1403 GetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pDescr, PSID *pOwner,
1404                             LPBOOL lpbOwnerDefaulted )
1405 {
1406     BOOLEAN defaulted;
1407     BOOL ret = set_ntstatus( RtlGetOwnerSecurityDescriptor( pDescr, pOwner, &defaulted ));
1408     *lpbOwnerDefaulted = defaulted;
1409     return ret;
1410 }
1411
1412 /******************************************************************************
1413  * SetSecurityDescriptorOwner [ADVAPI32.@]
1414  *
1415  * PARAMS
1416  */
1417 BOOL WINAPI SetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1418                                    PSID pOwner, BOOL bOwnerDefaulted)
1419 {
1420     return set_ntstatus( RtlSetOwnerSecurityDescriptor(pSecurityDescriptor, pOwner, bOwnerDefaulted));
1421 }
1422 /******************************************************************************
1423  * GetSecurityDescriptorGroup                   [ADVAPI32.@]
1424  */
1425 BOOL WINAPI GetSecurityDescriptorGroup(
1426         PSECURITY_DESCRIPTOR SecurityDescriptor,
1427         PSID *Group,
1428         LPBOOL GroupDefaulted)
1429 {
1430     BOOLEAN defaulted;
1431     BOOL ret = set_ntstatus( RtlGetGroupSecurityDescriptor(SecurityDescriptor, Group, &defaulted ));
1432     *GroupDefaulted = defaulted;
1433     return ret;
1434 }
1435 /******************************************************************************
1436  * SetSecurityDescriptorGroup [ADVAPI32.@]
1437  */
1438 BOOL WINAPI SetSecurityDescriptorGroup ( PSECURITY_DESCRIPTOR SecurityDescriptor,
1439                                            PSID Group, BOOL GroupDefaulted)
1440 {
1441     return set_ntstatus( RtlSetGroupSecurityDescriptor( SecurityDescriptor, Group, GroupDefaulted));
1442 }
1443
1444 /******************************************************************************
1445  * IsValidSecurityDescriptor [ADVAPI32.@]
1446  *
1447  * PARAMS
1448  *   lpsecdesc []
1449  */
1450 BOOL WINAPI
1451 IsValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor )
1452 {
1453     return set_ntstatus( RtlValidSecurityDescriptor(SecurityDescriptor));
1454 }
1455
1456 /******************************************************************************
1457  *  GetSecurityDescriptorDacl                   [ADVAPI32.@]
1458  */
1459 BOOL WINAPI GetSecurityDescriptorDacl(
1460         IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
1461         OUT LPBOOL lpbDaclPresent,
1462         OUT PACL *pDacl,
1463         OUT LPBOOL lpbDaclDefaulted)
1464 {
1465     BOOLEAN present, defaulted;
1466     BOOL ret = set_ntstatus( RtlGetDaclSecurityDescriptor(pSecurityDescriptor, &present, pDacl, &defaulted));
1467     *lpbDaclPresent = present;
1468     *lpbDaclDefaulted = defaulted;
1469     return ret;
1470 }
1471
1472 /******************************************************************************
1473  *  SetSecurityDescriptorDacl                   [ADVAPI32.@]
1474  */
1475 BOOL WINAPI
1476 SetSecurityDescriptorDacl (
1477         PSECURITY_DESCRIPTOR lpsd,
1478         BOOL daclpresent,
1479         PACL dacl,
1480         BOOL dacldefaulted )
1481 {
1482     return set_ntstatus( RtlSetDaclSecurityDescriptor (lpsd, daclpresent, dacl, dacldefaulted ) );
1483 }
1484 /******************************************************************************
1485  *  GetSecurityDescriptorSacl                   [ADVAPI32.@]
1486  */
1487 BOOL WINAPI GetSecurityDescriptorSacl(
1488         IN PSECURITY_DESCRIPTOR lpsd,
1489         OUT LPBOOL lpbSaclPresent,
1490         OUT PACL *pSacl,
1491         OUT LPBOOL lpbSaclDefaulted)
1492 {
1493     BOOLEAN present, defaulted;
1494     BOOL ret = set_ntstatus( RtlGetSaclSecurityDescriptor(lpsd, &present, pSacl, &defaulted) );
1495     *lpbSaclPresent = present;
1496     *lpbSaclDefaulted = defaulted;
1497     return ret;
1498 }
1499
1500 /**************************************************************************
1501  * SetSecurityDescriptorSacl                    [ADVAPI32.@]
1502  */
1503 BOOL WINAPI SetSecurityDescriptorSacl (
1504         PSECURITY_DESCRIPTOR lpsd,
1505         BOOL saclpresent,
1506         PACL lpsacl,
1507         BOOL sacldefaulted)
1508 {
1509     return set_ntstatus (RtlSetSaclSecurityDescriptor(lpsd, saclpresent, lpsacl, sacldefaulted));
1510 }
1511 /******************************************************************************
1512  * MakeSelfRelativeSD [ADVAPI32.@]
1513  *
1514  * PARAMS
1515  *   lpabssecdesc  []
1516  *   lpselfsecdesc []
1517  *   lpbuflen      []
1518  */
1519 BOOL WINAPI
1520 MakeSelfRelativeSD(
1521         IN PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
1522         IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
1523         IN OUT LPDWORD lpdwBufferLength)
1524 {
1525     return set_ntstatus( RtlMakeSelfRelativeSD( pAbsoluteSecurityDescriptor,
1526                                                 pSelfRelativeSecurityDescriptor, lpdwBufferLength));
1527 }
1528
1529 /******************************************************************************
1530  * GetSecurityDescriptorControl                 [ADVAPI32.@]
1531  */
1532
1533 BOOL WINAPI GetSecurityDescriptorControl ( PSECURITY_DESCRIPTOR  pSecurityDescriptor,
1534                  PSECURITY_DESCRIPTOR_CONTROL pControl, LPDWORD lpdwRevision)
1535 {
1536     return set_ntstatus( RtlGetControlSecurityDescriptor(pSecurityDescriptor,pControl,lpdwRevision));
1537 }
1538
1539 /******************************************************************************
1540  * SetSecurityDescriptorControl                 [ADVAPI32.@]
1541  */
1542 BOOL WINAPI SetSecurityDescriptorControl( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1543   SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest,
1544   SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet )
1545 {
1546     return set_ntstatus( RtlSetControlSecurityDescriptor(
1547         pSecurityDescriptor, ControlBitsOfInterest, ControlBitsToSet ) );
1548 }
1549
1550 /******************************************************************************
1551  * GetWindowsAccountDomainSid         [ADVAPI32.@]
1552  */
1553 BOOL WINAPI GetWindowsAccountDomainSid( PSID sid, PSID domain_sid, DWORD *size )
1554 {
1555     SID_IDENTIFIER_AUTHORITY domain_ident = { SECURITY_NT_AUTHORITY };
1556     DWORD required_size;
1557     int i;
1558
1559     FIXME( "(%p %p %p): semi-stub\n", sid, domain_sid, size );
1560
1561     if (!sid || !IsValidSid( sid ))
1562     {
1563         SetLastError( ERROR_INVALID_SID );
1564         return FALSE;
1565     }
1566
1567     if (!size)
1568     {
1569         SetLastError( ERROR_INVALID_PARAMETER );
1570         return FALSE;
1571     }
1572
1573     if (*GetSidSubAuthorityCount( sid ) < 4)
1574     {
1575         SetLastError( ERROR_INVALID_SID );
1576         return FALSE;
1577     }
1578
1579     required_size = GetSidLengthRequired( 4 );
1580     if (*size < required_size || !domain_sid)
1581     {
1582         *size = required_size;
1583         SetLastError( domain_sid ? ERROR_INSUFFICIENT_BUFFER :
1584                                    ERROR_INVALID_PARAMETER );
1585         return FALSE;
1586     }
1587
1588     InitializeSid( domain_sid, &domain_ident, 4 );
1589     for (i = 0; i < 4; i++)
1590         *GetSidSubAuthority( domain_sid, i ) = *GetSidSubAuthority( sid, i );
1591
1592     *size = required_size;
1593     return TRUE;
1594 }
1595
1596 /*      ##############################
1597         ######  ACL FUNCTIONS   ######
1598         ##############################
1599 */
1600
1601 /*************************************************************************
1602  * InitializeAcl [ADVAPI32.@]
1603  */
1604 BOOL WINAPI InitializeAcl(PACL acl, DWORD size, DWORD rev)
1605 {
1606     return set_ntstatus( RtlCreateAcl(acl, size, rev));
1607 }
1608
1609 BOOL WINAPI ImpersonateNamedPipeClient( HANDLE hNamedPipe )
1610 {
1611     IO_STATUS_BLOCK io_block;
1612
1613     TRACE("(%p)\n", hNamedPipe);
1614
1615     return set_ntstatus( NtFsControlFile(hNamedPipe, NULL, NULL, NULL,
1616                          &io_block, FSCTL_PIPE_IMPERSONATE, NULL, 0, NULL, 0) );
1617 }
1618
1619 /******************************************************************************
1620  *  AddAccessAllowedAce [ADVAPI32.@]
1621  */
1622 BOOL WINAPI AddAccessAllowedAce(
1623         IN OUT PACL pAcl,
1624         IN DWORD dwAceRevision,
1625         IN DWORD AccessMask,
1626         IN PSID pSid)
1627 {
1628     return set_ntstatus(RtlAddAccessAllowedAce(pAcl, dwAceRevision, AccessMask, pSid));
1629 }
1630
1631 /******************************************************************************
1632  *  AddAccessAllowedAceEx [ADVAPI32.@]
1633  */
1634 BOOL WINAPI AddAccessAllowedAceEx(
1635         IN OUT PACL pAcl,
1636         IN DWORD dwAceRevision,
1637         IN DWORD AceFlags,
1638         IN DWORD AccessMask,
1639         IN PSID pSid)
1640 {
1641     return set_ntstatus(RtlAddAccessAllowedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid));
1642 }
1643
1644 /******************************************************************************
1645  *  AddAccessAllowedObjectAce [ADVAPI32.@]
1646  */
1647 BOOL WINAPI AddAccessAllowedObjectAce(
1648         IN OUT PACL pAcl,
1649         IN DWORD dwAceRevision,
1650         IN DWORD dwAceFlags,
1651         IN DWORD dwAccessMask,
1652         IN GUID* pObjectTypeGuid,
1653         IN GUID* pInheritedObjectTypeGuid,
1654         IN PSID pSid)
1655 {
1656     return set_ntstatus(RtlAddAccessAllowedObjectAce(pAcl, dwAceRevision, dwAceFlags, dwAccessMask,
1657                         pObjectTypeGuid, pInheritedObjectTypeGuid, pSid));
1658 }
1659
1660 /******************************************************************************
1661  *  AddAccessDeniedAce [ADVAPI32.@]
1662  */
1663 BOOL WINAPI AddAccessDeniedAce(
1664         IN OUT PACL pAcl,
1665         IN DWORD dwAceRevision,
1666         IN DWORD AccessMask,
1667         IN PSID pSid)
1668 {
1669     return set_ntstatus(RtlAddAccessDeniedAce(pAcl, dwAceRevision, AccessMask, pSid));
1670 }
1671
1672 /******************************************************************************
1673  *  AddAccessDeniedAceEx [ADVAPI32.@]
1674  */
1675 BOOL WINAPI AddAccessDeniedAceEx(
1676         IN OUT PACL pAcl,
1677         IN DWORD dwAceRevision,
1678         IN DWORD AceFlags,
1679         IN DWORD AccessMask,
1680         IN PSID pSid)
1681 {
1682     return set_ntstatus(RtlAddAccessDeniedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid));
1683 }
1684
1685 /******************************************************************************
1686  *  AddAccessDeniedObjectAce [ADVAPI32.@]
1687  */
1688 BOOL WINAPI AddAccessDeniedObjectAce(
1689     IN OUT PACL pAcl,
1690     IN DWORD dwAceRevision,
1691     IN DWORD dwAceFlags,
1692     IN DWORD dwAccessMask,
1693     IN GUID* pObjectTypeGuid,
1694     IN GUID* pInheritedObjectTypeGuid,
1695     IN PSID pSid)
1696 {
1697     return set_ntstatus( RtlAddAccessDeniedObjectAce(pAcl, dwAceRevision, dwAceFlags, dwAccessMask,
1698                          pObjectTypeGuid, pInheritedObjectTypeGuid, pSid) );
1699 }
1700
1701 /******************************************************************************
1702  *  AddAce [ADVAPI32.@]
1703  */
1704 BOOL WINAPI AddAce(
1705         IN OUT PACL pAcl,
1706         IN DWORD dwAceRevision,
1707         IN DWORD dwStartingAceIndex,
1708         LPVOID pAceList,
1709         DWORD nAceListLength)
1710 {
1711     return set_ntstatus(RtlAddAce(pAcl, dwAceRevision, dwStartingAceIndex, pAceList, nAceListLength));
1712 }
1713
1714 /******************************************************************************
1715  *  AddMandatoryAce [ADVAPI32.@]
1716  */
1717 BOOL WINAPI AddMandatoryAce(ACL *acl, DWORD ace_revision, DWORD ace_flags, DWORD mandatory_policy, PSID label_sid)
1718 {
1719     return set_ntstatus(RtlAddMandatoryAce(acl, ace_revision, ace_flags, mandatory_policy,
1720                                            SYSTEM_MANDATORY_LABEL_ACE_TYPE, label_sid));
1721 }
1722
1723 /******************************************************************************
1724  * DeleteAce [ADVAPI32.@]
1725  */
1726 BOOL WINAPI DeleteAce(PACL pAcl, DWORD dwAceIndex)
1727 {
1728     return set_ntstatus(RtlDeleteAce(pAcl, dwAceIndex));
1729 }
1730
1731 /******************************************************************************
1732  *  FindFirstFreeAce [ADVAPI32.@]
1733  */
1734 BOOL WINAPI FindFirstFreeAce(IN PACL pAcl, LPVOID * pAce)
1735 {
1736         return RtlFirstFreeAce(pAcl, (PACE_HEADER *)pAce);
1737 }
1738
1739 /******************************************************************************
1740  * GetAce [ADVAPI32.@]
1741  */
1742 BOOL WINAPI GetAce(PACL pAcl,DWORD dwAceIndex,LPVOID *pAce )
1743 {
1744     return set_ntstatus(RtlGetAce(pAcl, dwAceIndex, pAce));
1745 }
1746
1747 /******************************************************************************
1748  * GetAclInformation [ADVAPI32.@]
1749  */
1750 BOOL WINAPI GetAclInformation(
1751   PACL pAcl,
1752   LPVOID pAclInformation,
1753   DWORD nAclInformationLength,
1754   ACL_INFORMATION_CLASS dwAclInformationClass)
1755 {
1756     return set_ntstatus(RtlQueryInformationAcl(pAcl, pAclInformation,
1757                                                nAclInformationLength, dwAclInformationClass));
1758 }
1759
1760 /******************************************************************************
1761  *  IsValidAcl [ADVAPI32.@]
1762  */
1763 BOOL WINAPI IsValidAcl(IN PACL pAcl)
1764 {
1765         return RtlValidAcl(pAcl);
1766 }
1767
1768 /*      ##############################
1769         ######  MISC FUNCTIONS  ######
1770         ##############################
1771 */
1772
1773 /******************************************************************************
1774  * AllocateLocallyUniqueId [ADVAPI32.@]
1775  *
1776  * PARAMS
1777  *   lpLuid []
1778  */
1779 BOOL WINAPI AllocateLocallyUniqueId( PLUID lpLuid )
1780 {
1781     return set_ntstatus(NtAllocateLocallyUniqueId(lpLuid));
1782 }
1783
1784 static const WCHAR SE_CREATE_TOKEN_NAME_W[] =
1785  { 'S','e','C','r','e','a','t','e','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 };
1786 static const WCHAR SE_ASSIGNPRIMARYTOKEN_NAME_W[] =
1787  { 'S','e','A','s','s','i','g','n','P','r','i','m','a','r','y','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 };
1788 static const WCHAR SE_LOCK_MEMORY_NAME_W[] =
1789  { 'S','e','L','o','c','k','M','e','m','o','r','y','P','r','i','v','i','l','e','g','e',0 };
1790 static const WCHAR SE_INCREASE_QUOTA_NAME_W[] =
1791  { 'S','e','I','n','c','r','e','a','s','e','Q','u','o','t','a','P','r','i','v','i','l','e','g','e',0 };
1792 static const WCHAR SE_MACHINE_ACCOUNT_NAME_W[] =
1793  { 'S','e','M','a','c','h','i','n','e','A','c','c','o','u','n','t','P','r','i','v','i','l','e','g','e',0 };
1794 static const WCHAR SE_TCB_NAME_W[] =
1795  { 'S','e','T','c','b','P','r','i','v','i','l','e','g','e',0 };
1796 static const WCHAR SE_SECURITY_NAME_W[] =
1797  { 'S','e','S','e','c','u','r','i','t','y','P','r','i','v','i','l','e','g','e',0 };
1798 static const WCHAR SE_TAKE_OWNERSHIP_NAME_W[] =
1799  { 'S','e','T','a','k','e','O','w','n','e','r','s','h','i','p','P','r','i','v','i','l','e','g','e',0 };
1800 static const WCHAR SE_LOAD_DRIVER_NAME_W[] =
1801  { 'S','e','L','o','a','d','D','r','i','v','e','r','P','r','i','v','i','l','e','g','e',0 };
1802 static const WCHAR SE_SYSTEM_PROFILE_NAME_W[] =
1803  { 'S','e','S','y','s','t','e','m','P','r','o','f','i','l','e','P','r','i','v','i','l','e','g','e',0 };
1804 static const WCHAR SE_SYSTEMTIME_NAME_W[] =
1805  { 'S','e','S','y','s','t','e','m','t','i','m','e','P','r','i','v','i','l','e','g','e',0 };
1806 static const WCHAR SE_PROF_SINGLE_PROCESS_NAME_W[] =
1807  { 'S','e','P','r','o','f','i','l','e','S','i','n','g','l','e','P','r','o','c','e','s','s','P','r','i','v','i','l','e','g','e',0 };
1808 static const WCHAR SE_INC_BASE_PRIORITY_NAME_W[] =
1809  { 'S','e','I','n','c','r','e','a','s','e','B','a','s','e','P','r','i','o','r','i','t','y','P','r','i','v','i','l','e','g','e',0 };
1810 static const WCHAR SE_CREATE_PAGEFILE_NAME_W[] =
1811  { 'S','e','C','r','e','a','t','e','P','a','g','e','f','i','l','e','P','r','i','v','i','l','e','g','e',0 };
1812 static const WCHAR SE_CREATE_PERMANENT_NAME_W[] =
1813  { 'S','e','C','r','e','a','t','e','P','e','r','m','a','n','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1814 static const WCHAR SE_BACKUP_NAME_W[] =
1815  { 'S','e','B','a','c','k','u','p','P','r','i','v','i','l','e','g','e',0 };
1816 static const WCHAR SE_RESTORE_NAME_W[] =
1817  { 'S','e','R','e','s','t','o','r','e','P','r','i','v','i','l','e','g','e',0 };
1818 static const WCHAR SE_SHUTDOWN_NAME_W[] =
1819  { 'S','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 };
1820 static const WCHAR SE_DEBUG_NAME_W[] =
1821  { 'S','e','D','e','b','u','g','P','r','i','v','i','l','e','g','e',0 };
1822 static const WCHAR SE_AUDIT_NAME_W[] =
1823  { 'S','e','A','u','d','i','t','P','r','i','v','i','l','e','g','e',0 };
1824 static const WCHAR SE_SYSTEM_ENVIRONMENT_NAME_W[] =
1825  { 'S','e','S','y','s','t','e','m','E','n','v','i','r','o','n','m','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1826 static const WCHAR SE_CHANGE_NOTIFY_NAME_W[] =
1827  { 'S','e','C','h','a','n','g','e','N','o','t','i','f','y','P','r','i','v','i','l','e','g','e',0 };
1828 static const WCHAR SE_REMOTE_SHUTDOWN_NAME_W[] =
1829  { 'S','e','R','e','m','o','t','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 };
1830 static const WCHAR SE_UNDOCK_NAME_W[] =
1831  { 'S','e','U','n','d','o','c','k','P','r','i','v','i','l','e','g','e',0 };
1832 static const WCHAR SE_SYNC_AGENT_NAME_W[] =
1833  { 'S','e','S','y','n','c','A','g','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1834 static const WCHAR SE_ENABLE_DELEGATION_NAME_W[] =
1835  { 'S','e','E','n','a','b','l','e','D','e','l','e','g','a','t','i','o','n','P','r','i','v','i','l','e','g','e',0 };
1836 static const WCHAR SE_MANAGE_VOLUME_NAME_W[] =
1837  { 'S','e','M','a','n','a','g','e','V','o','l','u','m','e','P','r','i','v','i','l','e','g','e',0 };
1838 static const WCHAR SE_IMPERSONATE_NAME_W[] =
1839  { 'S','e','I','m','p','e','r','s','o','n','a','t','e','P','r','i','v','i','l','e','g','e',0 };
1840 static const WCHAR SE_CREATE_GLOBAL_NAME_W[] =
1841  { 'S','e','C','r','e','a','t','e','G','l','o','b','a','l','P','r','i','v','i','l','e','g','e',0 };
1842
1843 static const WCHAR * const WellKnownPrivNames[SE_MAX_WELL_KNOWN_PRIVILEGE + 1] =
1844 {
1845     NULL,
1846     NULL,
1847     SE_CREATE_TOKEN_NAME_W,
1848     SE_ASSIGNPRIMARYTOKEN_NAME_W,
1849     SE_LOCK_MEMORY_NAME_W,
1850     SE_INCREASE_QUOTA_NAME_W,
1851     SE_MACHINE_ACCOUNT_NAME_W,
1852     SE_TCB_NAME_W,
1853     SE_SECURITY_NAME_W,
1854     SE_TAKE_OWNERSHIP_NAME_W,
1855     SE_LOAD_DRIVER_NAME_W,
1856     SE_SYSTEM_PROFILE_NAME_W,
1857     SE_SYSTEMTIME_NAME_W,
1858     SE_PROF_SINGLE_PROCESS_NAME_W,
1859     SE_INC_BASE_PRIORITY_NAME_W,
1860     SE_CREATE_PAGEFILE_NAME_W,
1861     SE_CREATE_PERMANENT_NAME_W,
1862     SE_BACKUP_NAME_W,
1863     SE_RESTORE_NAME_W,
1864     SE_SHUTDOWN_NAME_W,
1865     SE_DEBUG_NAME_W,
1866     SE_AUDIT_NAME_W,
1867     SE_SYSTEM_ENVIRONMENT_NAME_W,
1868     SE_CHANGE_NOTIFY_NAME_W,
1869     SE_REMOTE_SHUTDOWN_NAME_W,
1870     SE_UNDOCK_NAME_W,
1871     SE_SYNC_AGENT_NAME_W,
1872     SE_ENABLE_DELEGATION_NAME_W,
1873     SE_MANAGE_VOLUME_NAME_W,
1874     SE_IMPERSONATE_NAME_W,
1875     SE_CREATE_GLOBAL_NAME_W,
1876 };
1877
1878 /******************************************************************************
1879  * LookupPrivilegeValueW                        [ADVAPI32.@]
1880  *
1881  * See LookupPrivilegeValueA.
1882  */
1883 BOOL WINAPI
1884 LookupPrivilegeValueW( LPCWSTR lpSystemName, LPCWSTR lpName, PLUID lpLuid )
1885 {
1886     UINT i;
1887
1888     TRACE("%s,%s,%p\n",debugstr_w(lpSystemName), debugstr_w(lpName), lpLuid);
1889
1890     if (!ADVAPI_IsLocalComputer(lpSystemName))
1891     {
1892         SetLastError(RPC_S_SERVER_UNAVAILABLE);
1893         return FALSE;
1894     }
1895     if (!lpName)
1896     {
1897         SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1898         return FALSE;
1899     }
1900     for( i=SE_MIN_WELL_KNOWN_PRIVILEGE; i<=SE_MAX_WELL_KNOWN_PRIVILEGE; i++ )
1901     {
1902         if( !WellKnownPrivNames[i] )
1903             continue;
1904         if( strcmpiW( WellKnownPrivNames[i], lpName) )
1905             continue;
1906         lpLuid->LowPart = i;
1907         lpLuid->HighPart = 0;
1908         TRACE( "%s -> %08x-%08x\n",debugstr_w( lpSystemName ),
1909                lpLuid->HighPart, lpLuid->LowPart );
1910         return TRUE;
1911     }
1912     SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1913     return FALSE;
1914 }
1915
1916 /******************************************************************************
1917  * LookupPrivilegeValueA                        [ADVAPI32.@]
1918  *
1919  * Retrieves LUID used on a system to represent the privilege name.
1920  *
1921  * PARAMS
1922  *  lpSystemName [I] Name of the system
1923  *  lpName       [I] Name of the privilege
1924  *  lpLuid       [O] Destination for the resulting LUID
1925  *
1926  * RETURNS
1927  *  Success: TRUE. lpLuid contains the requested LUID.
1928  *  Failure: FALSE.
1929  */
1930 BOOL WINAPI
1931 LookupPrivilegeValueA( LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid )
1932 {
1933     UNICODE_STRING lpSystemNameW;
1934     UNICODE_STRING lpNameW;
1935     BOOL ret;
1936
1937     RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
1938     RtlCreateUnicodeStringFromAsciiz(&lpNameW,lpName);
1939     ret = LookupPrivilegeValueW(lpSystemNameW.Buffer, lpNameW.Buffer, lpLuid);
1940     RtlFreeUnicodeString(&lpNameW);
1941     RtlFreeUnicodeString(&lpSystemNameW);
1942     return ret;
1943 }
1944
1945 BOOL WINAPI LookupPrivilegeDisplayNameA( LPCSTR lpSystemName, LPCSTR lpName, LPSTR lpDisplayName,
1946                                          LPDWORD cchDisplayName, LPDWORD lpLanguageId )
1947 {
1948     FIXME("%s %s %s %p %p - stub\n", debugstr_a(lpSystemName), debugstr_a(lpName),
1949           debugstr_a(lpDisplayName), cchDisplayName, lpLanguageId);
1950
1951     return FALSE;
1952 }
1953
1954 BOOL WINAPI LookupPrivilegeDisplayNameW( LPCWSTR lpSystemName, LPCWSTR lpName, LPWSTR lpDisplayName,
1955                                          LPDWORD cchDisplayName, LPDWORD lpLanguageId )
1956 {
1957     FIXME("%s %s %s %p %p - stub\n", debugstr_w(lpSystemName), debugstr_w(lpName),
1958           debugstr_w(lpDisplayName), cchDisplayName, lpLanguageId);
1959
1960     return FALSE;
1961 }
1962
1963 /******************************************************************************
1964  * LookupPrivilegeNameA                 [ADVAPI32.@]
1965  *
1966  * See LookupPrivilegeNameW.
1967  */
1968 BOOL WINAPI
1969 LookupPrivilegeNameA( LPCSTR lpSystemName, PLUID lpLuid, LPSTR lpName,
1970  LPDWORD cchName)
1971 {
1972     UNICODE_STRING lpSystemNameW;
1973     BOOL ret;
1974     DWORD wLen = 0;
1975
1976     TRACE("%s %p %p %p\n", debugstr_a(lpSystemName), lpLuid, lpName, cchName);
1977
1978     RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
1979     ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, NULL, &wLen);
1980     if (!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
1981     {
1982         LPWSTR lpNameW = heap_alloc(wLen * sizeof(WCHAR));
1983
1984         ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, lpNameW,
1985          &wLen);
1986         if (ret)
1987         {
1988             /* Windows crashes if cchName is NULL, so will I */
1989             unsigned int len = WideCharToMultiByte(CP_ACP, 0, lpNameW, -1, lpName,
1990              *cchName, NULL, NULL);
1991
1992             if (len == 0)
1993             {
1994                 /* WideCharToMultiByte failed */
1995                 ret = FALSE;
1996             }
1997             else if (len > *cchName)
1998             {
1999                 *cchName = len;
2000                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2001                 ret = FALSE;
2002             }
2003             else
2004             {
2005                 /* WideCharToMultiByte succeeded, output length needs to be
2006                  * length not including NULL terminator
2007                  */
2008                 *cchName = len - 1;
2009             }
2010         }
2011         heap_free(lpNameW);
2012     }
2013     RtlFreeUnicodeString(&lpSystemNameW);
2014     return ret;
2015 }
2016
2017 /******************************************************************************
2018  * LookupPrivilegeNameW                 [ADVAPI32.@]
2019  *
2020  * Retrieves the privilege name referred to by the LUID lpLuid.
2021  *
2022  * PARAMS
2023  *  lpSystemName [I]   Name of the system
2024  *  lpLuid       [I]   Privilege value
2025  *  lpName       [O]   Name of the privilege
2026  *  cchName      [I/O] Number of characters in lpName.
2027  *
2028  * RETURNS
2029  *  Success: TRUE. lpName contains the name of the privilege whose value is
2030  *  *lpLuid.
2031  *  Failure: FALSE.
2032  *
2033  * REMARKS
2034  *  Only well-known privilege names (those defined in winnt.h) can be retrieved
2035  *  using this function.
2036  *  If the length of lpName is too small, on return *cchName will contain the
2037  *  number of WCHARs needed to contain the privilege, including the NULL
2038  *  terminator, and GetLastError will return ERROR_INSUFFICIENT_BUFFER.
2039  *  On success, *cchName will contain the number of characters stored in
2040  *  lpName, NOT including the NULL terminator.
2041  */
2042 BOOL WINAPI
2043 LookupPrivilegeNameW( LPCWSTR lpSystemName, PLUID lpLuid, LPWSTR lpName,
2044  LPDWORD cchName)
2045 {
2046     size_t privNameLen;
2047
2048     TRACE("%s,%p,%p,%p\n",debugstr_w(lpSystemName), lpLuid, lpName, cchName);
2049
2050     if (!ADVAPI_IsLocalComputer(lpSystemName))
2051     {
2052         SetLastError(RPC_S_SERVER_UNAVAILABLE);
2053         return FALSE;
2054     }
2055     if (lpLuid->HighPart || (lpLuid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
2056      lpLuid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE))
2057     {
2058         SetLastError(ERROR_NO_SUCH_PRIVILEGE);
2059         return FALSE;
2060     }
2061     privNameLen = strlenW(WellKnownPrivNames[lpLuid->LowPart]);
2062     /* Windows crashes if cchName is NULL, so will I */
2063     if (*cchName <= privNameLen)
2064     {
2065         *cchName = privNameLen + 1;
2066         SetLastError(ERROR_INSUFFICIENT_BUFFER);
2067         return FALSE;
2068     }
2069     else
2070     {
2071         strcpyW(lpName, WellKnownPrivNames[lpLuid->LowPart]);
2072         *cchName = privNameLen;
2073         return TRUE;
2074     }
2075 }
2076
2077 /******************************************************************************
2078  * GetFileSecurityA [ADVAPI32.@]
2079  *
2080  * Obtains Specified information about the security of a file or directory.
2081  *
2082  * PARAMS
2083  *  lpFileName           [I] Name of the file to get info for
2084  *  RequestedInformation [I] SE_ flags from "winnt.h"
2085  *  pSecurityDescriptor  [O] Destination for security information
2086  *  nLength              [I] Length of pSecurityDescriptor
2087  *  lpnLengthNeeded      [O] Destination for length of returned security information
2088  *
2089  * RETURNS
2090  *  Success: TRUE. pSecurityDescriptor contains the requested information.
2091  *  Failure: FALSE. lpnLengthNeeded contains the required space to return the info.
2092  *
2093  * NOTES
2094  *  The information returned is constrained by the callers access rights and
2095  *  privileges.
2096  */
2097 BOOL WINAPI
2098 GetFileSecurityA( LPCSTR lpFileName,
2099                     SECURITY_INFORMATION RequestedInformation,
2100                     PSECURITY_DESCRIPTOR pSecurityDescriptor,
2101                     DWORD nLength, LPDWORD lpnLengthNeeded )
2102 {
2103     BOOL r;
2104     LPWSTR name;
2105
2106     name = SERV_dup(lpFileName);
2107     r = GetFileSecurityW( name, RequestedInformation, pSecurityDescriptor,
2108                           nLength, lpnLengthNeeded );
2109     heap_free( name );
2110
2111     return r;
2112 }
2113
2114 /******************************************************************************
2115  * GetFileSecurityW [ADVAPI32.@]
2116  *
2117  * See GetFileSecurityA.
2118  */
2119 BOOL WINAPI
2120 GetFileSecurityW( LPCWSTR lpFileName,
2121                     SECURITY_INFORMATION RequestedInformation,
2122                     PSECURITY_DESCRIPTOR pSecurityDescriptor,
2123                     DWORD nLength, LPDWORD lpnLengthNeeded )
2124 {
2125     HANDLE hfile;
2126     NTSTATUS status;
2127     DWORD access = 0, err;
2128
2129     TRACE("(%s,%d,%p,%d,%p)\n", debugstr_w(lpFileName),
2130           RequestedInformation, pSecurityDescriptor,
2131           nLength, lpnLengthNeeded);
2132
2133     if (RequestedInformation & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|
2134                                 DACL_SECURITY_INFORMATION))
2135         access |= READ_CONTROL;
2136     if (RequestedInformation & SACL_SECURITY_INFORMATION)
2137         access |= ACCESS_SYSTEM_SECURITY;
2138
2139     err = get_security_file( lpFileName, access, &hfile);
2140     if (err)
2141     {
2142         SetLastError(err);
2143         return FALSE;
2144     }
2145
2146     status = NtQuerySecurityObject( hfile, RequestedInformation, pSecurityDescriptor,
2147                                     nLength, lpnLengthNeeded );
2148     CloseHandle( hfile );
2149     return set_ntstatus( status );
2150 }
2151
2152
2153 /******************************************************************************
2154  * LookupAccountSidA [ADVAPI32.@]
2155  */
2156 BOOL WINAPI
2157 LookupAccountSidA(
2158         IN LPCSTR system,
2159         IN PSID sid,
2160         OUT LPSTR account,
2161         IN OUT LPDWORD accountSize,
2162         OUT LPSTR domain,
2163         IN OUT LPDWORD domainSize,
2164         OUT PSID_NAME_USE name_use )
2165 {
2166     DWORD len;
2167     BOOL r;
2168     LPWSTR systemW;
2169     LPWSTR accountW = NULL;
2170     LPWSTR domainW = NULL;
2171     DWORD accountSizeW = *accountSize;
2172     DWORD domainSizeW = *domainSize;
2173
2174     systemW = SERV_dup(system);
2175     if (account)
2176         accountW = heap_alloc( accountSizeW * sizeof(WCHAR) );
2177     if (domain)
2178         domainW = heap_alloc( domainSizeW * sizeof(WCHAR) );
2179
2180     r = LookupAccountSidW( systemW, sid, accountW, &accountSizeW, domainW, &domainSizeW, name_use );
2181
2182     if (r) {
2183         if (accountW && *accountSize) {
2184             len = WideCharToMultiByte( CP_ACP, 0, accountW, -1, NULL, 0, NULL, NULL );
2185             WideCharToMultiByte( CP_ACP, 0, accountW, -1, account, len, NULL, NULL );
2186             *accountSize = len;
2187         } else
2188             *accountSize = accountSizeW + 1;
2189
2190         if (domainW && *domainSize) {
2191             len = WideCharToMultiByte( CP_ACP, 0, domainW, -1, NULL, 0, NULL, NULL );
2192             WideCharToMultiByte( CP_ACP, 0, domainW, -1, domain, len, NULL, NULL );
2193             *domainSize = len;
2194         } else
2195             *domainSize = domainSizeW + 1;
2196     }
2197     else
2198     {
2199         *accountSize = accountSizeW + 1;
2200         *domainSize = domainSizeW + 1;
2201     }
2202
2203     heap_free( systemW );
2204     heap_free( accountW );
2205     heap_free( domainW );
2206
2207     return r;
2208 }
2209
2210 /******************************************************************************
2211  * LookupAccountSidW [ADVAPI32.@]
2212  *
2213  * PARAMS
2214  *   system      []
2215  *   sid         []
2216  *   account     []
2217  *   accountSize []
2218  *   domain      []
2219  *   domainSize  []
2220  *   name_use    []
2221  */
2222
2223 BOOL WINAPI
2224 LookupAccountSidW(
2225         IN LPCWSTR system,
2226         IN PSID sid,
2227         OUT LPWSTR account,
2228         IN OUT LPDWORD accountSize,
2229         OUT LPWSTR domain,
2230         IN OUT LPDWORD domainSize,
2231         OUT PSID_NAME_USE name_use )
2232 {
2233     unsigned int i, j;
2234     const WCHAR * ac = NULL;
2235     const WCHAR * dm = NULL;
2236     SID_NAME_USE use = 0;
2237     LPWSTR computer_name = NULL;
2238     LPWSTR account_name = NULL;
2239
2240     TRACE("(%s,sid=%s,%p,%p(%u),%p,%p(%u),%p)\n",
2241           debugstr_w(system),debugstr_sid(sid),
2242           account,accountSize,accountSize?*accountSize:0,
2243           domain,domainSize,domainSize?*domainSize:0,
2244           name_use);
2245
2246     if (!ADVAPI_IsLocalComputer(system)) {
2247         FIXME("Only local computer supported!\n");
2248         SetLastError(RPC_S_SERVER_UNAVAILABLE);
2249         return FALSE;
2250     }
2251
2252     /* check the well known SIDs first */
2253     for (i = 0; i <= WinAccountProtectedUsersSid; i++) {
2254         if (IsWellKnownSid(sid, i)) {
2255             for (j = 0; j < (sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0])); j++) {
2256                 if (ACCOUNT_SIDS[j].type == i) {
2257                     ac = ACCOUNT_SIDS[j].account;
2258                     dm = ACCOUNT_SIDS[j].domain;
2259                     use = ACCOUNT_SIDS[j].name_use;
2260                 }
2261             }
2262             break;
2263         }
2264     }
2265
2266     if (dm == NULL) {
2267         MAX_SID local;
2268
2269         /* check for the local computer next */
2270         if (ADVAPI_GetComputerSid(&local)) {
2271             DWORD size = MAX_COMPUTERNAME_LENGTH + 1;
2272             BOOL result;
2273
2274             computer_name = heap_alloc(size * sizeof(WCHAR));
2275             result = GetComputerNameW(computer_name,  &size);
2276
2277             if (result) {
2278                 if (EqualSid(sid, &local)) {
2279                     dm = computer_name;
2280                     ac = Blank;
2281                     use = 3;
2282                 } else {
2283                     local.SubAuthorityCount++;
2284
2285                     if (EqualPrefixSid(sid, &local)) {
2286                         dm = computer_name;
2287                         use = 1;
2288                         switch (((MAX_SID *)sid)->SubAuthority[4]) {
2289                         case DOMAIN_USER_RID_ADMIN:
2290                             ac = Administrator;
2291                             break;
2292                         case DOMAIN_USER_RID_GUEST:
2293                             ac = Guest;
2294                             break;
2295                         case DOMAIN_GROUP_RID_ADMINS:
2296                             ac = Domain_Admins;
2297                             break;
2298                         case DOMAIN_GROUP_RID_USERS:
2299                             ac = Domain_Users;
2300                             break;
2301                         case DOMAIN_GROUP_RID_GUESTS:
2302                             ac = Domain_Guests;
2303                             break;
2304                         case DOMAIN_GROUP_RID_COMPUTERS:
2305                             ac = Domain_Computers;
2306                             break;
2307                         case DOMAIN_GROUP_RID_CONTROLLERS:
2308                             ac = Domain_Controllers;
2309                             break;
2310                         case DOMAIN_GROUP_RID_CERT_ADMINS:
2311                             ac = Cert_Publishers;
2312                             break;
2313                         case DOMAIN_GROUP_RID_SCHEMA_ADMINS:
2314                             ac = Schema_Admins;
2315                             break;
2316                         case DOMAIN_GROUP_RID_ENTERPRISE_ADMINS:
2317                             ac = Enterprise_Admins;
2318                             break;
2319                         case DOMAIN_GROUP_RID_POLICY_ADMINS:
2320                             ac = Group_Policy_Creator_Owners;
2321                             break;
2322                         case DOMAIN_ALIAS_RID_RAS_SERVERS:
2323                             ac = RAS_and_IAS_Servers;
2324                             break;
2325                         case 1000:      /* first user account */
2326                             size = UNLEN + 1;
2327                             account_name = heap_alloc(size * sizeof(WCHAR));
2328                             if (GetUserNameW(account_name, &size))
2329                                 ac = account_name;
2330                             else
2331                                 dm = NULL;
2332
2333                             break;
2334                         default:
2335                             dm = NULL;
2336                             break;
2337                         }
2338                     }
2339                 }
2340             }
2341         }
2342     }
2343
2344     if (dm) {
2345         DWORD ac_len = lstrlenW(ac);
2346         DWORD dm_len = lstrlenW(dm);
2347         BOOL status = TRUE;
2348
2349         if (*accountSize > ac_len) {
2350             if (account)
2351                 lstrcpyW(account, ac);
2352         }
2353         if (*domainSize > dm_len) {
2354             if (domain)
2355                 lstrcpyW(domain, dm);
2356         }
2357         if ((*accountSize && *accountSize < ac_len) ||
2358             (!account && !*accountSize && ac_len)   ||
2359             (*domainSize && *domainSize < dm_len)   ||
2360             (!domain && !*domainSize && dm_len))
2361         {
2362             SetLastError(ERROR_INSUFFICIENT_BUFFER);
2363             status = FALSE;
2364         }
2365         if (*domainSize)
2366             *domainSize = dm_len;
2367         else
2368             *domainSize = dm_len + 1;
2369         if (*accountSize)
2370             *accountSize = ac_len;
2371         else
2372             *accountSize = ac_len + 1;
2373
2374         heap_free(account_name);
2375         heap_free(computer_name);
2376         if (status) *name_use = use;
2377         return status;
2378     }
2379
2380     heap_free(account_name);
2381     heap_free(computer_name);
2382     SetLastError(ERROR_NONE_MAPPED);
2383     return FALSE;
2384 }
2385
2386 /******************************************************************************
2387  * SetFileSecurityA [ADVAPI32.@]
2388  *
2389  * See SetFileSecurityW.
2390  */
2391 BOOL WINAPI SetFileSecurityA( LPCSTR lpFileName,
2392                                 SECURITY_INFORMATION RequestedInformation,
2393                                 PSECURITY_DESCRIPTOR pSecurityDescriptor)
2394 {
2395     BOOL r;
2396     LPWSTR name;
2397
2398     name = SERV_dup(lpFileName);
2399     r = SetFileSecurityW( name, RequestedInformation, pSecurityDescriptor );
2400     heap_free( name );
2401
2402     return r;
2403 }
2404
2405 /******************************************************************************
2406  * SetFileSecurityW [ADVAPI32.@]
2407  *
2408  * Sets the security of a file or directory.
2409  *
2410  * PARAMS
2411  *   lpFileName           []
2412  *   RequestedInformation []
2413  *   pSecurityDescriptor  []
2414  *
2415  * RETURNS
2416  *  Success: TRUE.
2417  *  Failure: FALSE.
2418  */
2419 BOOL WINAPI
2420 SetFileSecurityW( LPCWSTR lpFileName,
2421                     SECURITY_INFORMATION RequestedInformation,
2422                     PSECURITY_DESCRIPTOR pSecurityDescriptor )
2423 {
2424     HANDLE file;
2425     DWORD access = 0, err;
2426     NTSTATUS status;
2427
2428     TRACE("(%s, 0x%x, %p)\n", debugstr_w(lpFileName), RequestedInformation,
2429           pSecurityDescriptor );
2430
2431     if (RequestedInformation & OWNER_SECURITY_INFORMATION ||
2432         RequestedInformation & GROUP_SECURITY_INFORMATION)
2433         access |= WRITE_OWNER;
2434     if (RequestedInformation & SACL_SECURITY_INFORMATION)
2435         access |= ACCESS_SYSTEM_SECURITY;
2436     if (RequestedInformation & DACL_SECURITY_INFORMATION)
2437         access |= WRITE_DAC;
2438
2439     err = get_security_file( lpFileName, access, &file);
2440     if (err)
2441     {
2442         SetLastError(err);
2443         return FALSE;
2444     }
2445
2446     status = NtSetSecurityObject( file, RequestedInformation, pSecurityDescriptor );
2447     CloseHandle( file );
2448     return set_ntstatus( status );
2449 }
2450
2451 /******************************************************************************
2452  * QueryWindows31FilesMigration [ADVAPI32.@]
2453  *
2454  * PARAMS
2455  *   x1 []
2456  */
2457 BOOL WINAPI
2458 QueryWindows31FilesMigration( DWORD x1 )
2459 {
2460         FIXME("(%d):stub\n",x1);
2461         return TRUE;
2462 }
2463
2464 /******************************************************************************
2465  * SynchronizeWindows31FilesAndWindowsNTRegistry [ADVAPI32.@]
2466  *
2467  * PARAMS
2468  *   x1 []
2469  *   x2 []
2470  *   x3 []
2471  *   x4 []
2472  */
2473 BOOL WINAPI
2474 SynchronizeWindows31FilesAndWindowsNTRegistry( DWORD x1, DWORD x2, DWORD x3,
2475                                                DWORD x4 )
2476 {
2477         FIXME("(0x%08x,0x%08x,0x%08x,0x%08x):stub\n",x1,x2,x3,x4);
2478         return TRUE;
2479 }
2480
2481 /******************************************************************************
2482  * NotifyBootConfigStatus [ADVAPI32.@]
2483  *
2484  * PARAMS
2485  *   x1 []
2486  */
2487 BOOL WINAPI
2488 NotifyBootConfigStatus( BOOL x1 )
2489 {
2490         FIXME("(0x%08d):stub\n",x1);
2491         return TRUE;
2492 }
2493
2494 /******************************************************************************
2495  * RevertToSelf [ADVAPI32.@]
2496  *
2497  * Ends the impersonation of a user.
2498  *
2499  * PARAMS
2500  *   void []
2501  *
2502  * RETURNS
2503  *  Success: TRUE.
2504  *  Failure: FALSE.
2505  */
2506 BOOL WINAPI
2507 RevertToSelf( void )
2508 {
2509     HANDLE Token = NULL;
2510     return set_ntstatus( NtSetInformationThread( GetCurrentThread(),
2511         ThreadImpersonationToken, &Token, sizeof(Token) ) );
2512 }
2513
2514 /******************************************************************************
2515  * ImpersonateSelf [ADVAPI32.@]
2516  *
2517  * Makes an impersonation token that represents the process user and assigns
2518  * to the current thread.
2519  *
2520  * PARAMS
2521  *  ImpersonationLevel [I] Level at which to impersonate.
2522  *
2523  * RETURNS
2524  *  Success: TRUE.
2525  *  Failure: FALSE.
2526  */
2527 BOOL WINAPI
2528 ImpersonateSelf(SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
2529 {
2530     return set_ntstatus( RtlImpersonateSelf( ImpersonationLevel ) );
2531 }
2532
2533 /******************************************************************************
2534  * ImpersonateLoggedOnUser [ADVAPI32.@]
2535  */
2536 BOOL WINAPI ImpersonateLoggedOnUser(HANDLE hToken)
2537 {
2538     DWORD size;
2539     NTSTATUS Status;
2540     HANDLE ImpersonationToken;
2541     TOKEN_TYPE Type;
2542     static BOOL warn = TRUE;
2543
2544     if (warn)
2545     {
2546         FIXME( "(%p)\n", hToken );
2547         warn = FALSE;
2548     }
2549     if (!GetTokenInformation( hToken, TokenType, &Type,
2550                               sizeof(TOKEN_TYPE), &size ))
2551         return FALSE;
2552
2553     if (Type == TokenPrimary)
2554     {
2555         OBJECT_ATTRIBUTES ObjectAttributes;
2556
2557         InitializeObjectAttributes( &ObjectAttributes, NULL, 0, NULL, NULL );
2558
2559         Status = NtDuplicateToken( hToken,
2560                                    TOKEN_IMPERSONATE | TOKEN_QUERY,
2561                                    &ObjectAttributes,
2562                                    SecurityImpersonation,
2563                                    TokenImpersonation,
2564                                    &ImpersonationToken );
2565         if (Status != STATUS_SUCCESS)
2566         {
2567             ERR( "NtDuplicateToken failed with error 0x%08x\n", Status );
2568             SetLastError( RtlNtStatusToDosError( Status ) );
2569             return FALSE;
2570         }
2571     }
2572     else
2573         ImpersonationToken = hToken;
2574
2575     Status = NtSetInformationThread( GetCurrentThread(),
2576                                      ThreadImpersonationToken,
2577                                      &ImpersonationToken,
2578                                      sizeof(ImpersonationToken) );
2579
2580     if (Type == TokenPrimary)
2581         NtClose( ImpersonationToken );
2582
2583     if (Status != STATUS_SUCCESS)
2584     {
2585         ERR( "NtSetInformationThread failed with error 0x%08x\n", Status );
2586         SetLastError( RtlNtStatusToDosError( Status ) );
2587         return FALSE;
2588     }
2589
2590     return TRUE;
2591 }
2592
2593 /******************************************************************************
2594  * ImpersonateAnonymousToken [ADVAPI32.@]
2595  */
2596 BOOL WINAPI ImpersonateAnonymousToken( HANDLE thread )
2597 {
2598     TRACE("(%p)\n", thread);
2599     return set_ntstatus( NtImpersonateAnonymousToken( thread ) );
2600 }
2601
2602 /******************************************************************************
2603  * AccessCheck [ADVAPI32.@]
2604  */
2605 BOOL WINAPI
2606 AccessCheck(
2607         PSECURITY_DESCRIPTOR SecurityDescriptor,
2608         HANDLE ClientToken,
2609         DWORD DesiredAccess,
2610         PGENERIC_MAPPING GenericMapping,
2611         PPRIVILEGE_SET PrivilegeSet,
2612         LPDWORD PrivilegeSetLength,
2613         LPDWORD GrantedAccess,
2614         LPBOOL AccessStatus)
2615 {
2616     NTSTATUS access_status;
2617     BOOL ret = set_ntstatus( NtAccessCheck(SecurityDescriptor, ClientToken, DesiredAccess,
2618                                            GenericMapping, PrivilegeSet, PrivilegeSetLength,
2619                                            GrantedAccess, &access_status) );
2620     if (ret) *AccessStatus = set_ntstatus( access_status );
2621     return ret;
2622 }
2623
2624
2625 /******************************************************************************
2626  * AccessCheckByType [ADVAPI32.@]
2627  */
2628 BOOL WINAPI AccessCheckByType(
2629     PSECURITY_DESCRIPTOR pSecurityDescriptor,
2630     PSID PrincipalSelfSid,
2631     HANDLE ClientToken,
2632     DWORD DesiredAccess,
2633     POBJECT_TYPE_LIST ObjectTypeList,
2634     DWORD ObjectTypeListLength,
2635     PGENERIC_MAPPING GenericMapping,
2636     PPRIVILEGE_SET PrivilegeSet,
2637     LPDWORD PrivilegeSetLength,
2638     LPDWORD GrantedAccess,
2639     LPBOOL AccessStatus)
2640 {
2641         FIXME("stub\n");
2642
2643         *AccessStatus = TRUE;
2644
2645         return !*AccessStatus;
2646 }
2647
2648 /******************************************************************************
2649  * MapGenericMask [ADVAPI32.@]
2650  *
2651  * Maps generic access rights into specific access rights according to the
2652  * supplied mapping.
2653  *
2654  * PARAMS
2655  *  AccessMask     [I/O] Access rights.
2656  *  GenericMapping [I] The mapping between generic and specific rights.
2657  *
2658  * RETURNS
2659  *  Nothing.
2660  */
2661 VOID WINAPI MapGenericMask( PDWORD AccessMask, PGENERIC_MAPPING GenericMapping )
2662 {
2663     RtlMapGenericMask( AccessMask, GenericMapping );
2664 }
2665
2666 /*************************************************************************
2667  * SetKernelObjectSecurity [ADVAPI32.@]
2668  */
2669 BOOL WINAPI SetKernelObjectSecurity (
2670         IN HANDLE Handle,
2671         IN SECURITY_INFORMATION SecurityInformation,
2672         IN PSECURITY_DESCRIPTOR SecurityDescriptor )
2673 {
2674     return set_ntstatus (NtSetSecurityObject (Handle, SecurityInformation, SecurityDescriptor));
2675 }
2676
2677
2678 /******************************************************************************
2679  *  AddAuditAccessAce [ADVAPI32.@]
2680  */
2681 BOOL WINAPI AddAuditAccessAce(
2682     IN OUT PACL pAcl,
2683     IN DWORD dwAceRevision,
2684     IN DWORD dwAccessMask,
2685     IN PSID pSid,
2686     IN BOOL bAuditSuccess,
2687     IN BOOL bAuditFailure)
2688 {
2689     return set_ntstatus( RtlAddAuditAccessAce(pAcl, dwAceRevision, dwAccessMask, pSid,
2690                                               bAuditSuccess, bAuditFailure) );
2691 }
2692
2693 /******************************************************************************
2694  *  AddAuditAccessAceEx [ADVAPI32.@]
2695  */
2696 BOOL WINAPI AddAuditAccessAceEx(
2697     IN OUT PACL pAcl,
2698     IN DWORD dwAceRevision,
2699     IN DWORD dwAceFlags,
2700     IN DWORD dwAccessMask,
2701     IN PSID pSid,
2702     IN BOOL bAuditSuccess,
2703     IN BOOL bAuditFailure)
2704 {
2705     return set_ntstatus( RtlAddAuditAccessAceEx(pAcl, dwAceRevision, dwAceFlags, dwAccessMask, pSid,
2706                                               bAuditSuccess, bAuditFailure) );
2707 }
2708
2709 /******************************************************************************
2710  *  AddAuditAccessObjectAce [ADVAPI32.@]
2711  */
2712 BOOL WINAPI AddAuditAccessObjectAce(
2713     IN OUT PACL pAcl,
2714     IN DWORD dwAceRevision,
2715     IN DWORD dwAceFlags,
2716     IN DWORD dwAccessMask,
2717     IN GUID* pObjectTypeGuid,
2718     IN GUID* pInheritedObjectTypeGuid,
2719     IN PSID pSid,
2720     IN BOOL bAuditSuccess,
2721     IN BOOL bAuditFailure)
2722 {
2723     return set_ntstatus( RtlAddAuditAccessObjectAce(pAcl, dwAceRevision, dwAceFlags, dwAccessMask,
2724            pObjectTypeGuid, pInheritedObjectTypeGuid, pSid, bAuditSuccess, bAuditFailure) );
2725 }
2726
2727 /******************************************************************************
2728  * LookupAccountNameA [ADVAPI32.@]
2729  */
2730 BOOL WINAPI
2731 LookupAccountNameA(
2732         IN LPCSTR system,
2733         IN LPCSTR account,
2734         OUT PSID sid,
2735         OUT LPDWORD cbSid,
2736         LPSTR ReferencedDomainName,
2737         IN OUT LPDWORD cbReferencedDomainName,
2738         OUT PSID_NAME_USE name_use )
2739 {
2740     BOOL ret;
2741     UNICODE_STRING lpSystemW;
2742     UNICODE_STRING lpAccountW;
2743     LPWSTR lpReferencedDomainNameW = NULL;
2744
2745     RtlCreateUnicodeStringFromAsciiz(&lpSystemW, system);
2746     RtlCreateUnicodeStringFromAsciiz(&lpAccountW, account);
2747
2748     if (ReferencedDomainName)
2749         lpReferencedDomainNameW = heap_alloc(*cbReferencedDomainName * sizeof(WCHAR));
2750
2751     ret = LookupAccountNameW(lpSystemW.Buffer, lpAccountW.Buffer, sid, cbSid, lpReferencedDomainNameW,
2752         cbReferencedDomainName, name_use);
2753
2754     if (ret && lpReferencedDomainNameW)
2755     {
2756         WideCharToMultiByte(CP_ACP, 0, lpReferencedDomainNameW, -1,
2757             ReferencedDomainName, *cbReferencedDomainName+1, NULL, NULL);
2758     }
2759
2760     RtlFreeUnicodeString(&lpSystemW);
2761     RtlFreeUnicodeString(&lpAccountW);
2762     heap_free(lpReferencedDomainNameW);
2763
2764     return ret;
2765 }
2766
2767 /******************************************************************************
2768  * lookup_user_account_name
2769  */
2770 static BOOL lookup_user_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName,
2771                                      LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2772 {
2773     char buffer[sizeof(TOKEN_USER) + sizeof(SID) + sizeof(DWORD)*SID_MAX_SUB_AUTHORITIES];
2774     DWORD len = sizeof(buffer);
2775     HANDLE token;
2776     BOOL ret;
2777     PSID pSid;
2778     WCHAR domainName[MAX_COMPUTERNAME_LENGTH + 1];
2779     DWORD nameLen;
2780
2781     if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
2782     {
2783         if (GetLastError() != ERROR_NO_TOKEN) return FALSE;
2784         if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) return FALSE;
2785     }
2786
2787     ret = GetTokenInformation(token, TokenUser, buffer, len, &len);
2788     CloseHandle( token );
2789
2790     if (!ret) return FALSE;
2791
2792     pSid = ((TOKEN_USER *)buffer)->User.Sid;
2793
2794     if (Sid != NULL && (*cbSid >= GetLengthSid(pSid)))
2795        CopySid(*cbSid, Sid, pSid);
2796     if (*cbSid < GetLengthSid(pSid))
2797     {
2798        SetLastError(ERROR_INSUFFICIENT_BUFFER);
2799        ret = FALSE;
2800     }
2801     *cbSid = GetLengthSid(pSid);
2802
2803     nameLen = MAX_COMPUTERNAME_LENGTH + 1;
2804     if (!GetComputerNameW(domainName, &nameLen))
2805     {
2806         domainName[0] = 0;
2807         nameLen = 0;
2808     }
2809     if (*cchReferencedDomainName <= nameLen || !ret)
2810     {
2811         SetLastError(ERROR_INSUFFICIENT_BUFFER);
2812         nameLen += 1;
2813         ret = FALSE;
2814     }
2815     else if (ReferencedDomainName)
2816         strcpyW(ReferencedDomainName, domainName);
2817
2818     *cchReferencedDomainName = nameLen;
2819
2820     if (ret)
2821         *peUse = SidTypeUser;
2822
2823     return ret;
2824 }
2825
2826 /******************************************************************************
2827  * lookup_computer_account_name
2828  */
2829 static BOOL lookup_computer_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName,
2830                                          LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2831 {
2832     MAX_SID local;
2833     BOOL ret;
2834     WCHAR domainName[MAX_COMPUTERNAME_LENGTH + 1];
2835     DWORD nameLen;
2836
2837     if ((ret = ADVAPI_GetComputerSid(&local)))
2838     {
2839         if (Sid != NULL && (*cbSid >= GetLengthSid(&local)))
2840            CopySid(*cbSid, Sid, &local);
2841         if (*cbSid < GetLengthSid(&local))
2842         {
2843            SetLastError(ERROR_INSUFFICIENT_BUFFER);
2844            ret = FALSE;
2845         }
2846         *cbSid = GetLengthSid(&local);
2847     }
2848
2849     nameLen = MAX_COMPUTERNAME_LENGTH + 1;
2850     if (!GetComputerNameW(domainName, &nameLen))
2851     {
2852         domainName[0] = 0;
2853         nameLen = 0;
2854     }
2855     if (*cchReferencedDomainName <= nameLen || !ret)
2856     {
2857         SetLastError(ERROR_INSUFFICIENT_BUFFER);
2858         nameLen += 1;
2859         ret = FALSE;
2860     }
2861     else if (ReferencedDomainName)
2862         strcpyW(ReferencedDomainName, domainName);
2863
2864     *cchReferencedDomainName = nameLen;
2865
2866     if (ret)
2867         *peUse = SidTypeDomain;
2868
2869     return ret;
2870 }
2871
2872 static void split_domain_account( const LSA_UNICODE_STRING *str, LSA_UNICODE_STRING *account,
2873                                   LSA_UNICODE_STRING *domain )
2874 {
2875     WCHAR *p = str->Buffer + str->Length / sizeof(WCHAR) - 1;
2876
2877     while (p > str->Buffer && *p != '\\') p--;
2878
2879     if (*p == '\\')
2880     {
2881         domain->Buffer = str->Buffer;
2882         domain->Length = (p - str->Buffer) * sizeof(WCHAR);
2883
2884         account->Buffer = p + 1;
2885         account->Length = str->Length - ((p - str->Buffer + 1) * sizeof(WCHAR));
2886     }
2887     else
2888     {
2889         domain->Buffer = NULL;
2890         domain->Length = 0;
2891
2892         account->Buffer = str->Buffer;
2893         account->Length = str->Length;
2894     }
2895 }
2896
2897 static BOOL match_domain( ULONG idx, const LSA_UNICODE_STRING *domain )
2898 {
2899     ULONG len = strlenW( ACCOUNT_SIDS[idx].domain );
2900
2901     if (len == domain->Length / sizeof(WCHAR) && !strncmpiW( domain->Buffer, ACCOUNT_SIDS[idx].domain, len ))
2902         return TRUE;
2903
2904     return FALSE;
2905 }
2906
2907 static BOOL match_account( ULONG idx, const LSA_UNICODE_STRING *account )
2908 {
2909     ULONG len = strlenW( ACCOUNT_SIDS[idx].account );
2910
2911     if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].account, len ))
2912         return TRUE;
2913
2914     if (ACCOUNT_SIDS[idx].alias)
2915     {
2916         len = strlenW( ACCOUNT_SIDS[idx].alias );
2917         if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].alias, len ))
2918             return TRUE;
2919     }
2920     return FALSE;
2921 }
2922
2923 /*
2924  * Helper function for LookupAccountNameW
2925  */
2926 BOOL lookup_local_wellknown_name( const LSA_UNICODE_STRING *account_and_domain,
2927                                   PSID Sid, LPDWORD cbSid,
2928                                   LPWSTR ReferencedDomainName,
2929                                   LPDWORD cchReferencedDomainName,
2930                                   PSID_NAME_USE peUse, BOOL *handled )
2931 {
2932     PSID pSid;
2933     LSA_UNICODE_STRING account, domain;
2934     BOOL ret = TRUE;
2935     ULONG i;
2936
2937     *handled = FALSE;
2938     split_domain_account( account_and_domain, &account, &domain );
2939
2940     for (i = 0; i < sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0]); i++)
2941     {
2942         /* check domain first */
2943         if (domain.Buffer && !match_domain( i, &domain )) continue;
2944
2945         if (match_account( i, &account ))
2946         {
2947             DWORD len, sidLen = SECURITY_MAX_SID_SIZE;
2948
2949             if (!(pSid = heap_alloc( sidLen ))) return FALSE;
2950
2951             if ((ret = CreateWellKnownSid( ACCOUNT_SIDS[i].type, NULL, pSid, &sidLen )))
2952             {
2953                 if (*cbSid < sidLen)
2954                 {
2955                     SetLastError(ERROR_INSUFFICIENT_BUFFER);
2956                     ret = FALSE;
2957                 }
2958                 else if (Sid)
2959                 {
2960                     CopySid(*cbSid, Sid, pSid);
2961                 }
2962                 *cbSid = sidLen;
2963             }
2964
2965             len = strlenW( ACCOUNT_SIDS[i].domain );
2966             if (*cchReferencedDomainName <= len || !ret)
2967             {
2968                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2969                 len++;
2970                 ret = FALSE;
2971             }
2972             else if (ReferencedDomainName)
2973             {
2974                 strcpyW( ReferencedDomainName, ACCOUNT_SIDS[i].domain );
2975             }
2976
2977             *cchReferencedDomainName = len;
2978             if (ret)
2979                 *peUse = ACCOUNT_SIDS[i].name_use;
2980
2981             heap_free(pSid);
2982             *handled = TRUE;
2983             return ret;
2984         }
2985     }
2986     return ret;
2987 }
2988
2989 BOOL lookup_local_user_name( const LSA_UNICODE_STRING *account_and_domain,
2990                              PSID Sid, LPDWORD cbSid,
2991                              LPWSTR ReferencedDomainName,
2992                              LPDWORD cchReferencedDomainName,
2993                              PSID_NAME_USE peUse, BOOL *handled )
2994 {
2995     DWORD nameLen;
2996     LPWSTR userName = NULL;
2997     LSA_UNICODE_STRING account, domain;
2998     BOOL ret = TRUE;
2999
3000     *handled = FALSE;
3001     split_domain_account( account_and_domain, &account, &domain );
3002
3003     /* Let the current Unix user id masquerade as first Windows user account */
3004
3005     nameLen = UNLEN + 1;
3006     if (!(userName = heap_alloc( nameLen * sizeof(WCHAR) ))) return FALSE;
3007
3008     if (domain.Buffer)
3009     {
3010         /* check to make sure this account is on this computer */
3011         if (GetComputerNameW( userName, &nameLen ) &&
3012             (domain.Length / sizeof(WCHAR) != nameLen || strncmpW( domain.Buffer, userName, nameLen )))
3013         {
3014             SetLastError(ERROR_NONE_MAPPED);
3015             ret = FALSE;
3016         }
3017         nameLen = UNLEN + 1;
3018     }
3019
3020     if (GetUserNameW( userName, &nameLen ) &&
3021         account.Length / sizeof(WCHAR) == nameLen - 1 && !strncmpW( account.Buffer, userName, nameLen - 1 ))
3022     {
3023             ret = lookup_user_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse );
3024             *handled = TRUE;
3025     }
3026     else
3027     {
3028         nameLen = UNLEN + 1;
3029         if (GetComputerNameW( userName, &nameLen ) &&
3030             account.Length / sizeof(WCHAR) == nameLen && !strncmpW( account.Buffer, userName , nameLen ))
3031         {
3032             ret = lookup_computer_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse );
3033             *handled = TRUE;
3034         }
3035     }
3036
3037     heap_free(userName);
3038     return ret;
3039 }
3040
3041 /******************************************************************************
3042  * LookupAccountNameW [ADVAPI32.@]
3043  */
3044 BOOL WINAPI LookupAccountNameW( LPCWSTR lpSystemName, LPCWSTR lpAccountName, PSID Sid,
3045                                 LPDWORD cbSid, LPWSTR ReferencedDomainName,
3046                                 LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
3047 {
3048     BOOL ret, handled;
3049     LSA_UNICODE_STRING account;
3050
3051     TRACE("%s %s %p %p %p %p %p\n", debugstr_w(lpSystemName), debugstr_w(lpAccountName),
3052           Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse);
3053
3054     if (!ADVAPI_IsLocalComputer( lpSystemName ))
3055     {
3056         FIXME("remote computer not supported\n");
3057         SetLastError( RPC_S_SERVER_UNAVAILABLE );
3058         return FALSE;
3059     }
3060
3061     if (!lpAccountName || !strcmpW( lpAccountName, Blank ))
3062     {
3063         lpAccountName = BUILTIN;
3064     }
3065
3066     RtlInitUnicodeString( &account, lpAccountName );
3067
3068     /* Check well known SIDs first */
3069     ret = lookup_local_wellknown_name( &account, Sid, cbSid, ReferencedDomainName,
3070                                        cchReferencedDomainName, peUse, &handled );
3071     if (handled)
3072         return ret;
3073
3074     /* Check user names */
3075     ret = lookup_local_user_name( &account, Sid, cbSid, ReferencedDomainName,
3076                                   cchReferencedDomainName, peUse, &handled);
3077     if (handled)
3078         return ret;
3079
3080     SetLastError( ERROR_NONE_MAPPED );
3081     return FALSE;
3082 }
3083
3084 /******************************************************************************
3085  * PrivilegeCheck [ADVAPI32.@]
3086  */
3087 BOOL WINAPI PrivilegeCheck( HANDLE ClientToken, PPRIVILEGE_SET RequiredPrivileges, LPBOOL pfResult)
3088 {
3089     BOOL ret;
3090     BOOLEAN Result;
3091
3092     TRACE("%p %p %p\n", ClientToken, RequiredPrivileges, pfResult);
3093
3094     ret = set_ntstatus (NtPrivilegeCheck (ClientToken, RequiredPrivileges, &Result));
3095     if (ret)
3096         *pfResult = Result;
3097     return ret;
3098 }
3099
3100 /******************************************************************************
3101  * AccessCheckAndAuditAlarmA [ADVAPI32.@]
3102  */
3103 BOOL WINAPI AccessCheckAndAuditAlarmA(LPCSTR Subsystem, LPVOID HandleId, LPSTR ObjectTypeName,
3104   LPSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess,
3105   PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess,
3106   LPBOOL AccessStatus, LPBOOL pfGenerateOnClose)
3107 {
3108         FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_a(Subsystem),
3109                 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName),
3110                 SecurityDescriptor, DesiredAccess, GenericMapping,
3111                 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose);
3112         return TRUE;
3113 }
3114
3115 /******************************************************************************
3116  * AccessCheckAndAuditAlarmW [ADVAPI32.@]
3117  */
3118 BOOL WINAPI AccessCheckAndAuditAlarmW(LPCWSTR Subsystem, LPVOID HandleId, LPWSTR ObjectTypeName,
3119   LPWSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess,
3120   PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess,
3121   LPBOOL AccessStatus, LPBOOL pfGenerateOnClose)
3122 {
3123         FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_w(Subsystem),
3124                 HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName),
3125                 SecurityDescriptor, DesiredAccess, GenericMapping,
3126                 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose);
3127         return TRUE;
3128 }
3129
3130 BOOL WINAPI ObjectCloseAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
3131 {
3132     FIXME("stub (%s,%p,%x)\n", debugstr_a(SubsystemName), HandleId, GenerateOnClose);
3133
3134     return TRUE;
3135 }
3136
3137 BOOL WINAPI ObjectCloseAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
3138 {
3139     FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose);
3140
3141     return TRUE;
3142 }
3143
3144 BOOL WINAPI ObjectDeleteAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
3145 {
3146     FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose);
3147
3148     return TRUE;
3149 }
3150
3151 BOOL WINAPI ObjectOpenAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, LPSTR ObjectTypeName,
3152   LPSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess,
3153   DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted,
3154   LPBOOL GenerateOnClose)
3155 {
3156         FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_a(SubsystemName),
3157                 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName), pSecurityDescriptor,
3158         ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted,
3159         GenerateOnClose);
3160
3161     return TRUE;
3162 }
3163
3164 BOOL WINAPI ObjectOpenAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, LPWSTR ObjectTypeName,
3165   LPWSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess,
3166   DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted,
3167   LPBOOL GenerateOnClose)
3168 {
3169     FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_w(SubsystemName),
3170         HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName), pSecurityDescriptor,
3171         ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted,
3172         GenerateOnClose);
3173
3174     return TRUE;
3175 }
3176
3177 BOOL WINAPI ObjectPrivilegeAuditAlarmA( LPCSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken,
3178   DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3179 {
3180     FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_a(SubsystemName), HandleId, ClientToken,
3181           DesiredAccess, Privileges, AccessGranted);
3182
3183     return TRUE;
3184 }
3185
3186 BOOL WINAPI ObjectPrivilegeAuditAlarmW( LPCWSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken,
3187   DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3188 {
3189     FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_w(SubsystemName), HandleId, ClientToken,
3190           DesiredAccess, Privileges, AccessGranted);
3191
3192     return TRUE;
3193 }
3194
3195 BOOL WINAPI PrivilegedServiceAuditAlarmA( LPCSTR SubsystemName, LPCSTR ServiceName, HANDLE ClientToken,
3196                                    PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3197 {
3198     FIXME("stub (%s,%s,%p,%p,%x)\n", debugstr_a(SubsystemName), debugstr_a(ServiceName),
3199           ClientToken, Privileges, AccessGranted);
3200
3201     return TRUE;
3202 }
3203
3204 BOOL WINAPI PrivilegedServiceAuditAlarmW( LPCWSTR SubsystemName, LPCWSTR ServiceName, HANDLE ClientToken,
3205                                    PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3206 {
3207     FIXME("stub %s,%s,%p,%p,%x)\n", debugstr_w(SubsystemName), debugstr_w(ServiceName),
3208           ClientToken, Privileges, AccessGranted);
3209
3210     return TRUE;
3211 }
3212
3213 /******************************************************************************
3214  * GetSecurityInfo [ADVAPI32.@]
3215  *
3216  * Retrieves a copy of the security descriptor associated with an object.
3217  *
3218  * PARAMS
3219  *  hObject              [I] A handle for the object.
3220  *  ObjectType           [I] The type of object.
3221  *  SecurityInfo         [I] A bitmask indicating what info to retrieve.
3222  *  ppsidOwner           [O] If non-null, receives a pointer to the owner SID.
3223  *  ppsidGroup           [O] If non-null, receives a pointer to the group SID.
3224  *  ppDacl               [O] If non-null, receives a pointer to the DACL.
3225  *  ppSacl               [O] If non-null, receives a pointer to the SACL.
3226  *  ppSecurityDescriptor [O] Receives a pointer to the security descriptor,
3227  *                           which must be freed with LocalFree.
3228  *
3229  * RETURNS
3230  *  ERROR_SUCCESS if all's well, and a WIN32 error code otherwise.
3231  */
3232 DWORD WINAPI GetSecurityInfo(
3233     HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3234     SECURITY_INFORMATION SecurityInfo, PSID *ppsidOwner,
3235     PSID *ppsidGroup, PACL *ppDacl, PACL *ppSacl,
3236     PSECURITY_DESCRIPTOR *ppSecurityDescriptor
3237 )
3238 {
3239     PSECURITY_DESCRIPTOR sd;
3240     NTSTATUS status;
3241     ULONG n1, n2;
3242     BOOL present, defaulted;
3243
3244     /* A NULL descriptor is allowed if any one of the other pointers is not NULL */
3245     if (!(ppsidOwner||ppsidGroup||ppDacl||ppSacl||ppSecurityDescriptor)) return ERROR_INVALID_PARAMETER;
3246
3247     /* If no descriptor, we have to check that there's a pointer for the requested information */
3248     if( !ppSecurityDescriptor && (
3249         ((SecurityInfo & OWNER_SECURITY_INFORMATION) && !ppsidOwner)
3250     ||  ((SecurityInfo & GROUP_SECURITY_INFORMATION) && !ppsidGroup)
3251     ||  ((SecurityInfo & DACL_SECURITY_INFORMATION)  && !ppDacl)
3252     ||  ((SecurityInfo & SACL_SECURITY_INFORMATION)  && !ppSacl)  ))
3253         return ERROR_INVALID_PARAMETER;
3254
3255     switch (ObjectType)
3256     {
3257     case SE_SERVICE:
3258         status = SERV_QueryServiceObjectSecurity(hObject, SecurityInfo, NULL, 0, &n1);
3259         break;
3260     default:
3261         status = NtQuerySecurityObject(hObject, SecurityInfo, NULL, 0, &n1);
3262         break;
3263     }
3264     if (status != STATUS_BUFFER_TOO_SMALL && status != STATUS_SUCCESS)
3265         return RtlNtStatusToDosError(status);
3266
3267     sd = LocalAlloc(0, n1);
3268     if (!sd)
3269         return ERROR_NOT_ENOUGH_MEMORY;
3270
3271     switch (ObjectType)
3272     {
3273     case SE_SERVICE:
3274         status = SERV_QueryServiceObjectSecurity(hObject, SecurityInfo, sd, n1, &n2);
3275         break;
3276     default:
3277         status = NtQuerySecurityObject(hObject, SecurityInfo, sd, n1, &n2);
3278         break;
3279     }
3280     if (status != STATUS_SUCCESS)
3281     {
3282         LocalFree(sd);
3283         return RtlNtStatusToDosError(status);
3284     }
3285
3286     if (ppsidOwner)
3287     {
3288         *ppsidOwner = NULL;
3289         GetSecurityDescriptorOwner(sd, ppsidOwner, &defaulted);
3290     }
3291     if (ppsidGroup)
3292     {
3293         *ppsidGroup = NULL;
3294         GetSecurityDescriptorGroup(sd, ppsidGroup, &defaulted);
3295     }
3296     if (ppDacl)
3297     {
3298         *ppDacl = NULL;
3299         GetSecurityDescriptorDacl(sd, &present, ppDacl, &defaulted);
3300     }
3301     if (ppSacl)
3302     {
3303         *ppSacl = NULL;
3304         GetSecurityDescriptorSacl(sd, &present, ppSacl, &defaulted);
3305     }
3306     if (ppSecurityDescriptor)
3307         *ppSecurityDescriptor = sd;
3308
3309     /* The security descriptor (sd) cannot be freed if ppSecurityDescriptor is
3310      * NULL, because native happily returns the SIDs and ACLs that are requested
3311      * in this case.
3312      */
3313
3314     return ERROR_SUCCESS;
3315 }
3316
3317 /******************************************************************************
3318  * GetSecurityInfoExA [ADVAPI32.@]
3319  */
3320 DWORD WINAPI GetSecurityInfoExA(
3321         HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3322         SECURITY_INFORMATION SecurityInfo, LPCSTR lpProvider,
3323         LPCSTR lpProperty, PACTRL_ACCESSA *ppAccessList,
3324         PACTRL_AUDITA *ppAuditList, LPSTR *lppOwner, LPSTR *lppGroup
3325 )
3326 {
3327   FIXME("stub!\n");
3328   return ERROR_BAD_PROVIDER;
3329 }
3330
3331 /******************************************************************************
3332  * GetSecurityInfoExW [ADVAPI32.@]
3333  */
3334 DWORD WINAPI GetSecurityInfoExW(
3335         HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3336         SECURITY_INFORMATION SecurityInfo, LPCWSTR lpProvider,
3337         LPCWSTR lpProperty, PACTRL_ACCESSW *ppAccessList,
3338         PACTRL_AUDITW *ppAuditList, LPWSTR *lppOwner, LPWSTR *lppGroup
3339 )
3340 {
3341   FIXME("stub!\n");
3342   return ERROR_BAD_PROVIDER;
3343 }
3344
3345 /******************************************************************************
3346  * BuildExplicitAccessWithNameA [ADVAPI32.@]
3347  */
3348 VOID WINAPI BuildExplicitAccessWithNameA( PEXPLICIT_ACCESSA pExplicitAccess,
3349                                           LPSTR pTrusteeName, DWORD AccessPermissions,
3350                                           ACCESS_MODE AccessMode, DWORD Inheritance )
3351 {
3352     TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_a(pTrusteeName),
3353           AccessPermissions, AccessMode, Inheritance);
3354
3355     pExplicitAccess->grfAccessPermissions = AccessPermissions;
3356     pExplicitAccess->grfAccessMode = AccessMode;
3357     pExplicitAccess->grfInheritance = Inheritance;
3358
3359     pExplicitAccess->Trustee.pMultipleTrustee = NULL;
3360     pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3361     pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3362     pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3363     pExplicitAccess->Trustee.ptstrName = pTrusteeName;
3364 }
3365
3366 /******************************************************************************
3367  * BuildExplicitAccessWithNameW [ADVAPI32.@]
3368  */
3369 VOID WINAPI BuildExplicitAccessWithNameW( PEXPLICIT_ACCESSW pExplicitAccess,
3370                                           LPWSTR pTrusteeName, DWORD AccessPermissions,
3371                                           ACCESS_MODE AccessMode, DWORD Inheritance )
3372 {
3373     TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_w(pTrusteeName),
3374           AccessPermissions, AccessMode, Inheritance);
3375
3376     pExplicitAccess->grfAccessPermissions = AccessPermissions;
3377     pExplicitAccess->grfAccessMode = AccessMode;
3378     pExplicitAccess->grfInheritance = Inheritance;
3379
3380     pExplicitAccess->Trustee.pMultipleTrustee = NULL;
3381     pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3382     pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3383     pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3384     pExplicitAccess->Trustee.ptstrName = pTrusteeName;
3385 }
3386
3387 /******************************************************************************
3388  * BuildTrusteeWithObjectsAndNameA [ADVAPI32.@]
3389  */
3390 VOID WINAPI BuildTrusteeWithObjectsAndNameA( PTRUSTEEA pTrustee, POBJECTS_AND_NAME_A pObjName,
3391                                              SE_OBJECT_TYPE ObjectType, LPSTR ObjectTypeName,
3392                                              LPSTR InheritedObjectTypeName, LPSTR Name )
3393 {
3394     DWORD ObjectsPresent = 0;
3395
3396     TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
3397           ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_a(Name));
3398
3399     /* Fill the OBJECTS_AND_NAME structure */
3400     pObjName->ObjectType = ObjectType;
3401     if (ObjectTypeName != NULL)
3402     {
3403         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3404     }
3405
3406     pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
3407     if (InheritedObjectTypeName != NULL)
3408     {
3409         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3410     }
3411
3412     pObjName->ObjectsPresent = ObjectsPresent;
3413     pObjName->ptstrName = Name;
3414
3415     /* Fill the TRUSTEE structure */
3416     pTrustee->pMultipleTrustee = NULL;
3417     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3418     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
3419     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3420     pTrustee->ptstrName = (LPSTR)pObjName;
3421 }
3422
3423 /******************************************************************************
3424  * BuildTrusteeWithObjectsAndNameW [ADVAPI32.@]
3425  */
3426 VOID WINAPI BuildTrusteeWithObjectsAndNameW( PTRUSTEEW pTrustee, POBJECTS_AND_NAME_W pObjName,
3427                                              SE_OBJECT_TYPE ObjectType, LPWSTR ObjectTypeName,
3428                                              LPWSTR InheritedObjectTypeName, LPWSTR Name )
3429 {
3430     DWORD ObjectsPresent = 0;
3431
3432     TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
3433           ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_w(Name));
3434
3435     /* Fill the OBJECTS_AND_NAME structure */
3436     pObjName->ObjectType = ObjectType;
3437     if (ObjectTypeName != NULL)
3438     {
3439         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3440     }
3441
3442     pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
3443     if (InheritedObjectTypeName != NULL)
3444     {
3445         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3446     }
3447
3448     pObjName->ObjectsPresent = ObjectsPresent;
3449     pObjName->ptstrName = Name;
3450
3451     /* Fill the TRUSTEE structure */
3452     pTrustee->pMultipleTrustee = NULL;
3453     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3454     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
3455     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3456     pTrustee->ptstrName = (LPWSTR)pObjName;
3457 }
3458
3459 /******************************************************************************
3460  * BuildTrusteeWithObjectsAndSidA [ADVAPI32.@]
3461  */
3462 VOID WINAPI BuildTrusteeWithObjectsAndSidA( PTRUSTEEA pTrustee, POBJECTS_AND_SID pObjSid,
3463                                             GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid )
3464 {
3465     DWORD ObjectsPresent = 0;
3466
3467     TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
3468
3469     /* Fill the OBJECTS_AND_SID structure */
3470     if (pObjectGuid != NULL)
3471     {
3472         pObjSid->ObjectTypeGuid = *pObjectGuid;
3473         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3474     }
3475     else
3476     {
3477         ZeroMemory(&pObjSid->ObjectTypeGuid,
3478                    sizeof(GUID));
3479     }
3480
3481     if (pInheritedObjectGuid != NULL)
3482     {
3483         pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
3484         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3485     }
3486     else
3487     {
3488         ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
3489                    sizeof(GUID));
3490     }
3491
3492     pObjSid->ObjectsPresent = ObjectsPresent;
3493     pObjSid->pSid = pSid;
3494
3495     /* Fill the TRUSTEE structure */
3496     pTrustee->pMultipleTrustee = NULL;
3497     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3498     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
3499     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3500     pTrustee->ptstrName = (LPSTR) pObjSid;
3501 }
3502
3503 /******************************************************************************
3504  * BuildTrusteeWithObjectsAndSidW [ADVAPI32.@]
3505  */
3506 VOID WINAPI BuildTrusteeWithObjectsAndSidW( PTRUSTEEW pTrustee, POBJECTS_AND_SID pObjSid,
3507                                             GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid )
3508 {
3509     DWORD ObjectsPresent = 0;
3510
3511     TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
3512
3513     /* Fill the OBJECTS_AND_SID structure */
3514     if (pObjectGuid != NULL)
3515     {
3516         pObjSid->ObjectTypeGuid = *pObjectGuid;
3517         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3518     }
3519     else
3520     {
3521         ZeroMemory(&pObjSid->ObjectTypeGuid,
3522                    sizeof(GUID));
3523     }
3524
3525     if (pInheritedObjectGuid != NULL)
3526     {
3527         pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
3528         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3529     }
3530     else
3531     {
3532         ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
3533                    sizeof(GUID));
3534     }
3535
3536     pObjSid->ObjectsPresent = ObjectsPresent;
3537     pObjSid->pSid = pSid;
3538
3539     /* Fill the TRUSTEE structure */
3540     pTrustee->pMultipleTrustee = NULL;
3541     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3542     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
3543     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3544     pTrustee->ptstrName = (LPWSTR) pObjSid;
3545 }
3546
3547 /******************************************************************************
3548  * BuildTrusteeWithSidA [ADVAPI32.@]
3549  */
3550 VOID WINAPI BuildTrusteeWithSidA(PTRUSTEEA pTrustee, PSID pSid)
3551 {
3552     TRACE("%p %p\n", pTrustee, pSid);
3553
3554     pTrustee->pMultipleTrustee = NULL;
3555     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3556     pTrustee->TrusteeForm = TRUSTEE_IS_SID;
3557     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3558     pTrustee->ptstrName = pSid;
3559 }
3560
3561 /******************************************************************************
3562  * BuildTrusteeWithSidW [ADVAPI32.@]
3563  */
3564 VOID WINAPI BuildTrusteeWithSidW(PTRUSTEEW pTrustee, PSID pSid)
3565 {
3566     TRACE("%p %p\n", pTrustee, pSid);
3567
3568     pTrustee->pMultipleTrustee = NULL;
3569     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3570     pTrustee->TrusteeForm = TRUSTEE_IS_SID;
3571     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3572     pTrustee->ptstrName = pSid;
3573 }
3574
3575 /******************************************************************************
3576  * BuildTrusteeWithNameA [ADVAPI32.@]
3577  */
3578 VOID WINAPI BuildTrusteeWithNameA(PTRUSTEEA pTrustee, LPSTR name)
3579 {
3580     TRACE("%p %s\n", pTrustee, debugstr_a(name) );
3581
3582     pTrustee->pMultipleTrustee = NULL;
3583     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3584     pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
3585     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3586     pTrustee->ptstrName = name;
3587 }
3588
3589 /******************************************************************************
3590  * BuildTrusteeWithNameW [ADVAPI32.@]
3591  */
3592 VOID WINAPI BuildTrusteeWithNameW(PTRUSTEEW pTrustee, LPWSTR name)
3593 {
3594     TRACE("%p %s\n", pTrustee, debugstr_w(name) );
3595
3596     pTrustee->pMultipleTrustee = NULL;
3597     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3598     pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
3599     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3600     pTrustee->ptstrName = name;
3601 }
3602
3603 /******************************************************************************
3604  * GetTrusteeFormA [ADVAPI32.@]
3605  */
3606 TRUSTEE_FORM WINAPI GetTrusteeFormA(PTRUSTEEA pTrustee)
3607 {
3608     TRACE("(%p)\n", pTrustee);
3609
3610     if (!pTrustee)
3611         return TRUSTEE_BAD_FORM;
3612
3613     return pTrustee->TrusteeForm;
3614 }
3615
3616 /******************************************************************************
3617  * GetTrusteeFormW [ADVAPI32.@]
3618  */
3619 TRUSTEE_FORM WINAPI GetTrusteeFormW(PTRUSTEEW pTrustee)
3620 {
3621     TRACE("(%p)\n", pTrustee);
3622
3623     if (!pTrustee)
3624         return TRUSTEE_BAD_FORM;
3625
3626     return pTrustee->TrusteeForm;
3627 }
3628
3629 /******************************************************************************
3630  * GetTrusteeNameA [ADVAPI32.@]
3631  */
3632 LPSTR WINAPI GetTrusteeNameA(PTRUSTEEA pTrustee)
3633 {
3634     TRACE("(%p)\n", pTrustee);
3635
3636     if (!pTrustee)
3637         return NULL;
3638
3639     return pTrustee->ptstrName;
3640 }
3641
3642 /******************************************************************************
3643  * GetTrusteeNameW [ADVAPI32.@]
3644  */
3645 LPWSTR WINAPI GetTrusteeNameW(PTRUSTEEW pTrustee)
3646 {
3647     TRACE("(%p)\n", pTrustee);
3648
3649     if (!pTrustee)
3650         return NULL;
3651
3652     return pTrustee->ptstrName;
3653 }
3654
3655 /******************************************************************************
3656  * GetTrusteeTypeA [ADVAPI32.@]
3657  */
3658 TRUSTEE_TYPE WINAPI GetTrusteeTypeA(PTRUSTEEA pTrustee)
3659 {
3660     TRACE("(%p)\n", pTrustee);
3661
3662     if (!pTrustee)
3663         return TRUSTEE_IS_UNKNOWN;
3664
3665     return pTrustee->TrusteeType;
3666 }
3667
3668 /******************************************************************************
3669  * GetTrusteeTypeW [ADVAPI32.@]
3670  */
3671 TRUSTEE_TYPE WINAPI GetTrusteeTypeW(PTRUSTEEW pTrustee)
3672 {
3673     TRACE("(%p)\n", pTrustee);
3674
3675     if (!pTrustee)
3676         return TRUSTEE_IS_UNKNOWN;
3677
3678     return pTrustee->TrusteeType;
3679 }
3680
3681 BOOL WINAPI SetAclInformation( PACL pAcl, LPVOID pAclInformation,
3682                                DWORD nAclInformationLength,
3683                                ACL_INFORMATION_CLASS dwAclInformationClass )
3684 {
3685     FIXME("%p %p 0x%08x 0x%08x - stub\n", pAcl, pAclInformation,
3686           nAclInformationLength, dwAclInformationClass);
3687
3688     return TRUE;
3689 }
3690
3691 static DWORD trustee_name_A_to_W(TRUSTEE_FORM form, char *trustee_nameA, WCHAR **ptrustee_nameW)
3692 {
3693     switch (form)
3694     {
3695     case TRUSTEE_IS_NAME:
3696     {
3697         *ptrustee_nameW = SERV_dup(trustee_nameA);
3698         return ERROR_SUCCESS;
3699     }
3700     case TRUSTEE_IS_OBJECTS_AND_NAME:
3701     {
3702         OBJECTS_AND_NAME_A *objA = (OBJECTS_AND_NAME_A *)trustee_nameA;
3703         OBJECTS_AND_NAME_W *objW = NULL;
3704
3705         if (objA)
3706         {
3707             if (!(objW = heap_alloc( sizeof(OBJECTS_AND_NAME_W) )))
3708                 return ERROR_NOT_ENOUGH_MEMORY;
3709
3710             objW->ObjectsPresent = objA->ObjectsPresent;
3711             objW->ObjectType = objA->ObjectType;
3712             objW->ObjectTypeName = SERV_dup(objA->ObjectTypeName);
3713             objW->InheritedObjectTypeName = SERV_dup(objA->InheritedObjectTypeName);
3714             objW->ptstrName = SERV_dup(objA->ptstrName);
3715         }
3716
3717         *ptrustee_nameW = (WCHAR *)objW;
3718         return ERROR_SUCCESS;
3719     }
3720     /* These forms do not require conversion. */
3721     case TRUSTEE_IS_SID:
3722     case TRUSTEE_IS_OBJECTS_AND_SID:
3723         *ptrustee_nameW = (WCHAR *)trustee_nameA;
3724         return ERROR_SUCCESS;
3725     default:
3726         return ERROR_INVALID_PARAMETER;
3727     }
3728 }
3729
3730 static void free_trustee_name(TRUSTEE_FORM form, WCHAR *trustee_nameW)
3731 {
3732     switch (form)
3733     {
3734     case TRUSTEE_IS_NAME:
3735         heap_free( trustee_nameW );
3736         break;
3737     case TRUSTEE_IS_OBJECTS_AND_NAME:
3738     {
3739         OBJECTS_AND_NAME_W *objW = (OBJECTS_AND_NAME_W *)trustee_nameW;
3740
3741         if (objW)
3742         {
3743             heap_free( objW->ptstrName );
3744             heap_free( objW->InheritedObjectTypeName );
3745             heap_free( objW->ObjectTypeName );
3746             heap_free( objW );
3747         }
3748
3749         break;
3750     }
3751     /* Other forms did not require allocation, so no freeing is necessary. */
3752     default:
3753         break;
3754     }
3755 }
3756
3757 /******************************************************************************
3758  * SetEntriesInAclA [ADVAPI32.@]
3759  */
3760 DWORD WINAPI SetEntriesInAclA( ULONG count, PEXPLICIT_ACCESSA pEntries,
3761                                PACL OldAcl, PACL* NewAcl )
3762 {
3763     DWORD err = ERROR_SUCCESS;
3764     EXPLICIT_ACCESSW *pEntriesW;
3765     UINT alloc_index, free_index;
3766
3767     TRACE("%d %p %p %p\n", count, pEntries, OldAcl, NewAcl);
3768
3769     if (NewAcl)
3770         *NewAcl = NULL;
3771
3772     if (!count && !OldAcl)
3773         return ERROR_SUCCESS;
3774
3775     pEntriesW = heap_alloc( count * sizeof(EXPLICIT_ACCESSW) );
3776     if (!pEntriesW)
3777         return ERROR_NOT_ENOUGH_MEMORY;
3778
3779     for (alloc_index = 0; alloc_index < count; ++alloc_index)
3780     {
3781         pEntriesW[alloc_index].grfAccessPermissions = pEntries[alloc_index].grfAccessPermissions;
3782         pEntriesW[alloc_index].grfAccessMode = pEntries[alloc_index].grfAccessMode;
3783         pEntriesW[alloc_index].grfInheritance = pEntries[alloc_index].grfInheritance;
3784         pEntriesW[alloc_index].Trustee.pMultipleTrustee = NULL; /* currently not supported */
3785         pEntriesW[alloc_index].Trustee.MultipleTrusteeOperation = pEntries[alloc_index].Trustee.MultipleTrusteeOperation;
3786         pEntriesW[alloc_index].Trustee.TrusteeForm = pEntries[alloc_index].Trustee.TrusteeForm;
3787         pEntriesW[alloc_index].Trustee.TrusteeType = pEntries[alloc_index].Trustee.TrusteeType;
3788
3789         err = trustee_name_A_to_W( pEntries[alloc_index].Trustee.TrusteeForm,
3790                                    pEntries[alloc_index].Trustee.ptstrName,
3791                                    &pEntriesW[alloc_index].Trustee.ptstrName );
3792         if (err != ERROR_SUCCESS)
3793         {
3794             if (err == ERROR_INVALID_PARAMETER)
3795                 WARN("bad trustee form %d for trustee %d\n",
3796                      pEntries[alloc_index].Trustee.TrusteeForm, alloc_index);
3797
3798             goto cleanup;
3799         }
3800     }
3801
3802     err = SetEntriesInAclW( count, pEntriesW, OldAcl, NewAcl );
3803
3804 cleanup:
3805     /* Free any previously allocated trustee name buffers, taking into account
3806      * a possible out-of-memory condition while building the EXPLICIT_ACCESSW
3807      * list. */
3808     for (free_index = 0; free_index < alloc_index; ++free_index)
3809         free_trustee_name( pEntriesW[free_index].Trustee.TrusteeForm, pEntriesW[free_index].Trustee.ptstrName );
3810
3811     heap_free( pEntriesW );
3812     return err;
3813 }
3814
3815 /******************************************************************************
3816  * SetEntriesInAclW [ADVAPI32.@]
3817  */
3818 DWORD WINAPI SetEntriesInAclW( ULONG count, PEXPLICIT_ACCESSW pEntries,
3819                                PACL OldAcl, PACL* NewAcl )
3820 {
3821     ULONG i;
3822     PSID *ppsid;
3823     DWORD ret = ERROR_SUCCESS;
3824     DWORD acl_size = sizeof(ACL);
3825     NTSTATUS status;
3826
3827     TRACE("%d %p %p %p\n", count, pEntries, OldAcl, NewAcl);
3828
3829     if (NewAcl)
3830         *NewAcl = NULL;
3831
3832     if (!count && !OldAcl)
3833         return ERROR_SUCCESS;
3834
3835     /* allocate array of maximum sized sids allowed */
3836     ppsid = heap_alloc(count * (sizeof(SID *) + FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES])));
3837     if (!ppsid)
3838         return ERROR_OUTOFMEMORY;
3839
3840     for (i = 0; i < count; i++)
3841     {
3842         ppsid[i] = (char *)&ppsid[count] + i * FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]);
3843
3844         TRACE("[%d]:\n\tgrfAccessPermissions = 0x%x\n\tgrfAccessMode = %d\n\tgrfInheritance = 0x%x\n\t"
3845               "Trustee.pMultipleTrustee = %p\n\tMultipleTrusteeOperation = %d\n\tTrusteeForm = %d\n\t"
3846               "Trustee.TrusteeType = %d\n\tptstrName = %p\n", i,
3847               pEntries[i].grfAccessPermissions, pEntries[i].grfAccessMode, pEntries[i].grfInheritance,
3848               pEntries[i].Trustee.pMultipleTrustee, pEntries[i].Trustee.MultipleTrusteeOperation,
3849               pEntries[i].Trustee.TrusteeForm, pEntries[i].Trustee.TrusteeType,
3850               pEntries[i].Trustee.ptstrName);
3851
3852         if (pEntries[i].Trustee.MultipleTrusteeOperation == TRUSTEE_IS_IMPERSONATE)
3853         {
3854             WARN("bad multiple trustee operation %d for trustee %d\n", pEntries[i].Trustee.MultipleTrusteeOperation, i);
3855             ret = ERROR_INVALID_PARAMETER;
3856             goto exit;
3857         }
3858
3859         switch (pEntries[i].Trustee.TrusteeForm)
3860         {
3861         case TRUSTEE_IS_SID:
3862             if (!CopySid(FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]),
3863                          ppsid[i], pEntries[i].Trustee.ptstrName))
3864             {
3865                 WARN("bad sid %p for trustee %d\n", pEntries[i].Trustee.ptstrName, i);
3866                 ret = ERROR_INVALID_PARAMETER;
3867                 goto exit;
3868             }
3869             break;
3870         case TRUSTEE_IS_NAME:
3871         {
3872             DWORD sid_size = FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]);
3873             DWORD domain_size = MAX_COMPUTERNAME_LENGTH + 1;
3874             SID_NAME_USE use;
3875             if (!strcmpW( pEntries[i].Trustee.ptstrName, CURRENT_USER ))
3876             {
3877                 if (!lookup_user_account_name( ppsid[i], &sid_size, NULL, &domain_size, &use ))
3878                 {
3879                     ret = GetLastError();
3880                     goto exit;
3881                 }
3882             }
3883             else if (!LookupAccountNameW(NULL, pEntries[i].Trustee.ptstrName, ppsid[i], &sid_size, NULL, &domain_size, &use))
3884             {
3885                 WARN("bad user name %s for trustee %d\n", debugstr_w(pEntries[i].Trustee.ptstrName), i);
3886                 ret = ERROR_INVALID_PARAMETER;
3887                 goto exit;
3888             }
3889             break;
3890         }
3891         case TRUSTEE_IS_OBJECTS_AND_SID:
3892             FIXME("TRUSTEE_IS_OBJECTS_AND_SID unimplemented\n");
3893             break;
3894         case TRUSTEE_IS_OBJECTS_AND_NAME:
3895             FIXME("TRUSTEE_IS_OBJECTS_AND_NAME unimplemented\n");
3896             break;
3897         default:
3898             WARN("bad trustee form %d for trustee %d\n", pEntries[i].Trustee.TrusteeForm, i);
3899             ret = ERROR_INVALID_PARAMETER;
3900             goto exit;
3901         }
3902
3903         /* Note: we overestimate the ACL size here as a tradeoff between
3904          * instructions (simplicity) and memory */
3905         switch (pEntries[i].grfAccessMode)
3906         {
3907         case GRANT_ACCESS:
3908         case SET_ACCESS:
3909             acl_size += FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart) + GetLengthSid(ppsid[i]);
3910             break;
3911         case DENY_ACCESS:
3912             acl_size += FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart) + GetLengthSid(ppsid[i]);
3913             break;
3914         case SET_AUDIT_SUCCESS:
3915         case SET_AUDIT_FAILURE:
3916             acl_size += FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart) + GetLengthSid(ppsid[i]);
3917             break;
3918         case REVOKE_ACCESS:
3919             break;
3920         default:
3921             WARN("bad access mode %d for trustee %d\n", pEntries[i].grfAccessMode, i);
3922             ret = ERROR_INVALID_PARAMETER;
3923             goto exit;
3924         }
3925     }
3926
3927     if (OldAcl)
3928     {
3929         ACL_SIZE_INFORMATION size_info;
3930
3931         status = RtlQueryInformationAcl(OldAcl, &size_info, sizeof(size_info), AclSizeInformation);
3932         if (status != STATUS_SUCCESS)
3933         {
3934             ret = RtlNtStatusToDosError(status);
3935             goto exit;
3936         }
3937         acl_size += size_info.AclBytesInUse - sizeof(ACL);
3938     }
3939
3940     *NewAcl = LocalAlloc(0, acl_size);
3941     if (!*NewAcl)
3942     {
3943         ret = ERROR_OUTOFMEMORY;
3944         goto exit;
3945     }
3946
3947     status = RtlCreateAcl( *NewAcl, acl_size, ACL_REVISION );
3948     if (status != STATUS_SUCCESS)
3949     {
3950         ret = RtlNtStatusToDosError(status);
3951         goto exit;
3952     }
3953
3954     for (i = 0; i < count; i++)
3955     {
3956         switch (pEntries[i].grfAccessMode)
3957         {
3958         case GRANT_ACCESS:
3959             status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION,
3960                                               pEntries[i].grfInheritance,
3961                                               pEntries[i].grfAccessPermissions,
3962                                               ppsid[i]);
3963             break;
3964         case SET_ACCESS:
3965         {
3966             ULONG j;
3967             BOOL add = TRUE;
3968             if (OldAcl)
3969             {
3970                 for (j = 0; ; j++)
3971                 {
3972                     const ACE_HEADER *existing_ace_header;
3973                     status = RtlGetAce(OldAcl, j, (LPVOID *)&existing_ace_header);
3974                     if (status != STATUS_SUCCESS)
3975                         break;
3976                     if (pEntries[i].grfAccessMode == SET_ACCESS &&
3977                         existing_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE &&
3978                         EqualSid(ppsid[i], &((ACCESS_ALLOWED_ACE *)existing_ace_header)->SidStart))
3979                     {
3980                         add = FALSE;
3981                         break;
3982                     }
3983                 }
3984             }
3985             if (add)
3986                 status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION,
3987                                                   pEntries[i].grfInheritance,
3988                                                   pEntries[i].grfAccessPermissions,
3989                                                   ppsid[i]);
3990             break;
3991         }
3992         case DENY_ACCESS:
3993             status = RtlAddAccessDeniedAceEx(*NewAcl, ACL_REVISION,
3994                                              pEntries[i].grfInheritance,
3995                                              pEntries[i].grfAccessPermissions,
3996                                              ppsid[i]);
3997             break;
3998         case SET_AUDIT_SUCCESS:
3999             status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION,
4000                                             pEntries[i].grfInheritance,
4001                                             pEntries[i].grfAccessPermissions,
4002                                             ppsid[i], TRUE, FALSE);
4003             break;
4004         case SET_AUDIT_FAILURE:
4005             status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION,
4006                                             pEntries[i].grfInheritance,
4007                                             pEntries[i].grfAccessPermissions,
4008                                             ppsid[i], FALSE, TRUE);
4009             break;
4010         default:
4011             FIXME("unhandled access mode %d\n", pEntries[i].grfAccessMode);
4012         }
4013     }
4014
4015     if (OldAcl)
4016     {
4017         for (i = 0; ; i++)
4018         {
4019             BOOL add = TRUE;
4020             ULONG j;
4021             const ACE_HEADER *old_ace_header;
4022             status = RtlGetAce(OldAcl, i, (LPVOID *)&old_ace_header);
4023             if (status != STATUS_SUCCESS) break;
4024             for (j = 0; j < count; j++)
4025             {
4026                 if (pEntries[j].grfAccessMode == SET_ACCESS &&
4027                     old_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE &&
4028                     EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart))
4029                 {
4030                     status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION, pEntries[j].grfInheritance, pEntries[j].grfAccessPermissions, ppsid[j]);
4031                     add = FALSE;
4032                     break;
4033                 }
4034                 else if (pEntries[j].grfAccessMode == REVOKE_ACCESS)
4035                 {
4036                     switch (old_ace_header->AceType)
4037                     {
4038                     case ACCESS_ALLOWED_ACE_TYPE:
4039                         if (EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart))
4040                             add = FALSE;
4041                         break;
4042                     case ACCESS_DENIED_ACE_TYPE:
4043                         if (EqualSid(ppsid[j], &((ACCESS_DENIED_ACE *)old_ace_header)->SidStart))
4044                             add = FALSE;
4045                         break;
4046                     case SYSTEM_AUDIT_ACE_TYPE:
4047                         if (EqualSid(ppsid[j], &((SYSTEM_AUDIT_ACE *)old_ace_header)->SidStart))
4048                             add = FALSE;
4049                         break;
4050                     case SYSTEM_ALARM_ACE_TYPE:
4051                         if (EqualSid(ppsid[j], &((SYSTEM_ALARM_ACE *)old_ace_header)->SidStart))
4052                             add = FALSE;
4053                         break;
4054                     default:
4055                         FIXME("unhandled ace type %d\n", old_ace_header->AceType);
4056                     }
4057
4058                     if (!add)
4059                         break;
4060                 }
4061             }
4062             if (add)
4063                 status = RtlAddAce(*NewAcl, ACL_REVISION, 1, (PACE_HEADER)old_ace_header, old_ace_header->AceSize);
4064             if (status != STATUS_SUCCESS)
4065             {
4066                 WARN("RtlAddAce failed with error 0x%08x\n", status);
4067                 ret = RtlNtStatusToDosError(status);
4068                 break;
4069             }
4070         }
4071     }
4072
4073 exit:
4074     heap_free(ppsid);
4075     return ret;
4076 }
4077
4078 /******************************************************************************
4079  * SetNamedSecurityInfoA [ADVAPI32.@]
4080  */
4081 DWORD WINAPI SetNamedSecurityInfoA(LPSTR pObjectName,
4082         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
4083         PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
4084 {
4085     LPWSTR wstr;
4086     DWORD r;
4087
4088     TRACE("%s %d %d %p %p %p %p\n", debugstr_a(pObjectName), ObjectType,
4089            SecurityInfo, psidOwner, psidGroup, pDacl, pSacl);
4090
4091     wstr = SERV_dup(pObjectName);
4092     r = SetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, psidOwner,
4093                            psidGroup, pDacl, pSacl );
4094
4095     heap_free( wstr );
4096
4097     return r;
4098 }
4099
4100 BOOL WINAPI SetPrivateObjectSecurity( SECURITY_INFORMATION SecurityInformation,
4101     PSECURITY_DESCRIPTOR ModificationDescriptor,
4102     PSECURITY_DESCRIPTOR* ObjectsSecurityDescriptor,
4103     PGENERIC_MAPPING GenericMapping,
4104     HANDLE Token )
4105 {
4106     FIXME("0x%08x %p %p %p %p - stub\n", SecurityInformation, ModificationDescriptor,
4107           ObjectsSecurityDescriptor, GenericMapping, Token);
4108
4109     return TRUE;
4110 }
4111
4112 BOOL WINAPI AreAllAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess )
4113 {
4114     return RtlAreAllAccessesGranted( GrantedAccess, DesiredAccess );
4115 }
4116
4117 /******************************************************************************
4118  * AreAnyAccessesGranted [ADVAPI32.@]
4119  *
4120  * Determines whether or not any of a set of specified access permissions have
4121  * been granted or not.
4122  *
4123  * PARAMS
4124  *   GrantedAccess [I] The permissions that have been granted.
4125  *   DesiredAccess [I] The permissions that you want to have.
4126  *
4127  * RETURNS
4128  *   Nonzero if any of the permissions have been granted, zero if none of the
4129  *   permissions have been granted.
4130  */
4131
4132 BOOL WINAPI AreAnyAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess )
4133 {
4134     return RtlAreAnyAccessesGranted( GrantedAccess, DesiredAccess );
4135 }
4136
4137 /******************************************************************************
4138  * SetNamedSecurityInfoW [ADVAPI32.@]
4139  */
4140 DWORD WINAPI SetNamedSecurityInfoW(LPWSTR pObjectName,
4141         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
4142         PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
4143 {
4144     DWORD access = 0;
4145     HANDLE handle;
4146     DWORD err;
4147
4148     TRACE( "%s %d %d %p %p %p %p\n", debugstr_w(pObjectName), ObjectType,
4149            SecurityInfo, psidOwner, psidGroup, pDacl, pSacl);
4150
4151     if (!pObjectName) return ERROR_INVALID_PARAMETER;
4152
4153     if (SecurityInfo & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION))
4154         access |= WRITE_OWNER;
4155     if (SecurityInfo & DACL_SECURITY_INFORMATION)
4156         access |= WRITE_DAC;
4157     if (SecurityInfo & SACL_SECURITY_INFORMATION)
4158         access |= ACCESS_SYSTEM_SECURITY;
4159
4160     switch (ObjectType)
4161     {
4162     case SE_SERVICE:
4163         if (!(err = get_security_service( pObjectName, access, &handle )))
4164         {
4165             err = SetSecurityInfo( handle, ObjectType, SecurityInfo, psidOwner, psidGroup, pDacl, pSacl );
4166             CloseServiceHandle( handle );
4167         }
4168         break;
4169     case SE_REGISTRY_KEY:
4170         if (!(err = get_security_regkey( pObjectName, access, &handle )))
4171         {
4172             err = SetSecurityInfo( handle, ObjectType, SecurityInfo, psidOwner, psidGroup, pDacl, pSacl );
4173             RegCloseKey( handle );
4174         }
4175         break;
4176     case SE_FILE_OBJECT:
4177         if (SecurityInfo & DACL_SECURITY_INFORMATION)
4178             access |= READ_CONTROL;
4179         if (!(err = get_security_file( pObjectName, access, &handle )))
4180         {
4181             err = SetSecurityInfo( handle, ObjectType, SecurityInfo, psidOwner, psidGroup, pDacl, pSacl );
4182             CloseHandle( handle );
4183         }
4184         break;
4185     default:
4186         FIXME( "Object type %d is not currently supported.\n", ObjectType );
4187         return ERROR_SUCCESS;
4188     }
4189     return err;
4190 }
4191
4192 /******************************************************************************
4193  * GetExplicitEntriesFromAclA [ADVAPI32.@]
4194  */
4195 DWORD WINAPI GetExplicitEntriesFromAclA( PACL pacl, PULONG pcCountOfExplicitEntries,
4196         PEXPLICIT_ACCESSA* pListOfExplicitEntries)
4197 {
4198     FIXME("%p %p %p\n",pacl, pcCountOfExplicitEntries, pListOfExplicitEntries);
4199     return ERROR_CALL_NOT_IMPLEMENTED;
4200 }
4201
4202 /******************************************************************************
4203  * GetExplicitEntriesFromAclW [ADVAPI32.@]
4204  */
4205 DWORD WINAPI GetExplicitEntriesFromAclW( PACL pacl, PULONG pcCountOfExplicitEntries,
4206         PEXPLICIT_ACCESSW* pListOfExplicitEntries)
4207 {
4208     FIXME("%p %p %p\n",pacl, pcCountOfExplicitEntries, pListOfExplicitEntries);
4209     return ERROR_CALL_NOT_IMPLEMENTED;
4210 }
4211
4212 /******************************************************************************
4213  * GetAuditedPermissionsFromAclA [ADVAPI32.@]
4214  */
4215 DWORD WINAPI GetAuditedPermissionsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pSuccessfulAuditedRights,
4216         PACCESS_MASK pFailedAuditRights)
4217 {
4218     FIXME("%p %p %p %p\n",pacl, pTrustee, pSuccessfulAuditedRights, pFailedAuditRights);
4219     return ERROR_CALL_NOT_IMPLEMENTED;
4220
4221 }
4222
4223 /******************************************************************************
4224  * GetAuditedPermissionsFromAclW [ADVAPI32.@]
4225  */
4226 DWORD WINAPI GetAuditedPermissionsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pSuccessfulAuditedRights,
4227         PACCESS_MASK pFailedAuditRights)
4228 {
4229     FIXME("%p %p %p %p\n",pacl, pTrustee, pSuccessfulAuditedRights, pFailedAuditRights);
4230     return ERROR_CALL_NOT_IMPLEMENTED;
4231
4232 }
4233
4234 /******************************************************************************
4235  * ParseAclStringFlags
4236  */
4237 static DWORD ParseAclStringFlags(LPCWSTR* StringAcl)
4238 {
4239     DWORD flags = 0;
4240     LPCWSTR szAcl = *StringAcl;
4241
4242     while (*szAcl != '(')
4243     {
4244         if (*szAcl == 'P')
4245         {
4246             flags |= SE_DACL_PROTECTED;
4247         }
4248         else if (*szAcl == 'A')
4249         {
4250             szAcl++;
4251             if (*szAcl == 'R')
4252                 flags |= SE_DACL_AUTO_INHERIT_REQ;
4253             else if (*szAcl == 'I')
4254                 flags |= SE_DACL_AUTO_INHERITED;
4255         }
4256         szAcl++;
4257     }
4258
4259     *StringAcl = szAcl;
4260     return flags;
4261 }
4262
4263 /******************************************************************************
4264  * ParseAceStringType
4265  */
4266 static const ACEFLAG AceType[] =
4267 {
4268     { SDDL_ALARM,          SYSTEM_ALARM_ACE_TYPE },
4269     { SDDL_AUDIT,          SYSTEM_AUDIT_ACE_TYPE },
4270     { SDDL_ACCESS_ALLOWED, ACCESS_ALLOWED_ACE_TYPE },
4271     { SDDL_ACCESS_DENIED,  ACCESS_DENIED_ACE_TYPE },
4272     { SDDL_MANDATORY_LABEL,SYSTEM_MANDATORY_LABEL_ACE_TYPE },
4273     /*
4274     { SDDL_OBJECT_ACCESS_ALLOWED, ACCESS_ALLOWED_OBJECT_ACE_TYPE },
4275     { SDDL_OBJECT_ACCESS_DENIED,  ACCESS_DENIED_OBJECT_ACE_TYPE },
4276     { SDDL_OBJECT_ALARM,          SYSTEM_ALARM_OBJECT_ACE_TYPE },
4277     { SDDL_OBJECT_AUDIT,          SYSTEM_AUDIT_OBJECT_ACE_TYPE },
4278     */
4279     { NULL, 0 },
4280 };
4281
4282 static BYTE ParseAceStringType(LPCWSTR* StringAcl)
4283 {
4284     UINT len = 0;
4285     LPCWSTR szAcl = *StringAcl;
4286     const ACEFLAG *lpaf = AceType;
4287
4288     while (*szAcl == ' ')
4289         szAcl++;
4290
4291     while (lpaf->wstr &&
4292         (len = strlenW(lpaf->wstr)) &&
4293         strncmpW(lpaf->wstr, szAcl, len))
4294         lpaf++;
4295
4296     if (!lpaf->wstr)
4297         return 0;
4298
4299     *StringAcl = szAcl + len;
4300     return lpaf->value;
4301 }
4302
4303
4304 /******************************************************************************
4305  * ParseAceStringFlags
4306  */
4307 static const ACEFLAG AceFlags[] =
4308 {
4309     { SDDL_CONTAINER_INHERIT, CONTAINER_INHERIT_ACE },
4310     { SDDL_AUDIT_FAILURE,     FAILED_ACCESS_ACE_FLAG },
4311     { SDDL_INHERITED,         INHERITED_ACE },
4312     { SDDL_INHERIT_ONLY,      INHERIT_ONLY_ACE },
4313     { SDDL_NO_PROPAGATE,      NO_PROPAGATE_INHERIT_ACE },
4314     { SDDL_OBJECT_INHERIT,    OBJECT_INHERIT_ACE },
4315     { SDDL_AUDIT_SUCCESS,     SUCCESSFUL_ACCESS_ACE_FLAG },
4316     { NULL, 0 },
4317 };
4318
4319 static BYTE ParseAceStringFlags(LPCWSTR* StringAcl)
4320 {
4321     UINT len = 0;
4322     BYTE flags = 0;
4323     LPCWSTR szAcl = *StringAcl;
4324
4325     while (*szAcl == ' ')
4326         szAcl++;
4327
4328     while (*szAcl != ';')
4329     {
4330         const ACEFLAG *lpaf = AceFlags;
4331
4332         while (lpaf->wstr &&
4333                (len = strlenW(lpaf->wstr)) &&
4334                strncmpW(lpaf->wstr, szAcl, len))
4335             lpaf++;
4336
4337         if (!lpaf->wstr)
4338             return 0;
4339
4340         flags |= lpaf->value;
4341         szAcl += len;
4342     }
4343
4344     *StringAcl = szAcl;
4345     return flags;
4346 }
4347
4348
4349 /******************************************************************************
4350  * ParseAceStringRights
4351  */
4352 static const ACEFLAG AceRights[] =
4353 {
4354     { SDDL_GENERIC_ALL,     GENERIC_ALL },
4355     { SDDL_GENERIC_READ,    GENERIC_READ },
4356     { SDDL_GENERIC_WRITE,   GENERIC_WRITE },
4357     { SDDL_GENERIC_EXECUTE, GENERIC_EXECUTE },
4358
4359     { SDDL_READ_CONTROL,    READ_CONTROL },
4360     { SDDL_STANDARD_DELETE, DELETE },
4361     { SDDL_WRITE_DAC,       WRITE_DAC },
4362     { SDDL_WRITE_OWNER,     WRITE_OWNER },
4363
4364     { SDDL_READ_PROPERTY,   ADS_RIGHT_DS_READ_PROP},
4365     { SDDL_WRITE_PROPERTY,  ADS_RIGHT_DS_WRITE_PROP},
4366     { SDDL_CREATE_CHILD,    ADS_RIGHT_DS_CREATE_CHILD},
4367     { SDDL_DELETE_CHILD,    ADS_RIGHT_DS_DELETE_CHILD},
4368     { SDDL_LIST_CHILDREN,   ADS_RIGHT_ACTRL_DS_LIST},
4369     { SDDL_SELF_WRITE,      ADS_RIGHT_DS_SELF},
4370     { SDDL_LIST_OBJECT,     ADS_RIGHT_DS_LIST_OBJECT},
4371     { SDDL_DELETE_TREE,     ADS_RIGHT_DS_DELETE_TREE},
4372     { SDDL_CONTROL_ACCESS,  ADS_RIGHT_DS_CONTROL_ACCESS},
4373
4374     { SDDL_FILE_ALL,        FILE_ALL_ACCESS },
4375     { SDDL_FILE_READ,       FILE_GENERIC_READ },
4376     { SDDL_FILE_WRITE,      FILE_GENERIC_WRITE },
4377     { SDDL_FILE_EXECUTE,    FILE_GENERIC_EXECUTE },
4378
4379     { SDDL_KEY_ALL,         KEY_ALL_ACCESS },
4380     { SDDL_KEY_READ,        KEY_READ },
4381     { SDDL_KEY_WRITE,       KEY_WRITE },
4382     { SDDL_KEY_EXECUTE,     KEY_EXECUTE },
4383
4384     { SDDL_NO_READ_UP,      SYSTEM_MANDATORY_LABEL_NO_READ_UP },
4385     { SDDL_NO_WRITE_UP,     SYSTEM_MANDATORY_LABEL_NO_WRITE_UP },
4386     { SDDL_NO_EXECUTE_UP,   SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP },
4387     { NULL, 0 },
4388 };
4389
4390 static DWORD ParseAceStringRights(LPCWSTR* StringAcl)
4391 {
4392     UINT len = 0;
4393     DWORD rights = 0;
4394     LPCWSTR szAcl = *StringAcl;
4395
4396     while (*szAcl == ' ')
4397         szAcl++;
4398
4399     if ((*szAcl == '0') && (*(szAcl + 1) == 'x'))
4400     {
4401         LPCWSTR p = szAcl;
4402
4403         while (*p && *p != ';')
4404             p++;
4405
4406         if (p - szAcl <= 10 /* 8 hex digits + "0x" */ )
4407         {
4408             rights = strtoulW(szAcl, NULL, 16);
4409             szAcl = p;
4410         }
4411         else
4412             WARN("Invalid rights string format: %s\n", debugstr_wn(szAcl, p - szAcl));
4413     }
4414     else
4415     {
4416         while (*szAcl != ';')
4417         {
4418             const ACEFLAG *lpaf = AceRights;
4419
4420             while (lpaf->wstr &&
4421                (len = strlenW(lpaf->wstr)) &&
4422                strncmpW(lpaf->wstr, szAcl, len))
4423             {
4424                lpaf++;
4425             }
4426
4427             if (!lpaf->wstr)
4428                 return 0;
4429
4430             rights |= lpaf->value;
4431             szAcl += len;
4432         }
4433     }
4434
4435     *StringAcl = szAcl;
4436     return rights;
4437 }
4438
4439
4440 /******************************************************************************
4441  * ParseStringAclToAcl
4442  *
4443  * dacl_flags(string_ace1)(string_ace2)... (string_acen)
4444  */
4445 static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags,
4446     PACL pAcl, LPDWORD cBytes)
4447 {
4448     DWORD val;
4449     DWORD sidlen;
4450     DWORD length = sizeof(ACL);
4451     DWORD acesize = 0;
4452     DWORD acecount = 0;
4453     PACCESS_ALLOWED_ACE pAce = NULL; /* pointer to current ACE */
4454     DWORD error = ERROR_INVALID_ACL;
4455
4456     TRACE("%s\n", debugstr_w(StringAcl));
4457
4458     if (!StringAcl)
4459         return FALSE;
4460
4461     if (pAcl) /* pAce is only useful if we're setting values */
4462         pAce = (PACCESS_ALLOWED_ACE) (pAcl + 1);
4463
4464     /* Parse ACL flags */
4465     *lpdwFlags = ParseAclStringFlags(&StringAcl);
4466
4467     /* Parse ACE */
4468     while (*StringAcl == '(')
4469     {
4470         StringAcl++;
4471
4472         /* Parse ACE type */
4473         val = ParseAceStringType(&StringAcl);
4474         if (pAce)
4475             pAce->Header.AceType = (BYTE) val;
4476         if (*StringAcl != ';')
4477         {
4478             error = RPC_S_INVALID_STRING_UUID;
4479             goto lerr;
4480         }
4481         StringAcl++;
4482
4483         /* Parse ACE flags */
4484         val = ParseAceStringFlags(&StringAcl);
4485         if (pAce)
4486             pAce->Header.AceFlags = (BYTE) val;
4487         if (*StringAcl != ';')
4488             goto lerr;
4489         StringAcl++;
4490
4491         /* Parse ACE rights */
4492         val = ParseAceStringRights(&StringAcl);
4493         if (pAce)
4494             pAce->Mask = val;
4495         if (*StringAcl != ';')
4496             goto lerr;
4497         StringAcl++;
4498
4499         /* Parse ACE object guid */
4500         while (*StringAcl == ' ')
4501             StringAcl++;
4502         if (*StringAcl != ';')
4503         {
4504             FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
4505             goto lerr;
4506         }
4507         StringAcl++;
4508
4509         /* Parse ACE inherit object guid */
4510         while (*StringAcl == ' ')
4511             StringAcl++;
4512         if (*StringAcl != ';')
4513         {
4514             FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
4515             goto lerr;
4516         }
4517         StringAcl++;
4518
4519         /* Parse ACE account sid */
4520         if (ParseStringSidToSid(StringAcl, pAce ? &pAce->SidStart : NULL, &sidlen))
4521         {
4522             while (*StringAcl && *StringAcl != ')')
4523                 StringAcl++;
4524         }
4525
4526         if (*StringAcl != ')')
4527             goto lerr;
4528         StringAcl++;
4529
4530         acesize = sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) + sidlen;
4531         length += acesize;
4532         if (pAce)
4533         {
4534             pAce->Header.AceSize = acesize;
4535             pAce = (PACCESS_ALLOWED_ACE)((LPBYTE)pAce + acesize);
4536         }
4537         acecount++;
4538     }
4539
4540     *cBytes = length;
4541
4542     if (length > 0xffff)
4543     {
4544         ERR("ACL too large\n");
4545         goto lerr;
4546     }
4547
4548     if (pAcl)
4549     {
4550         pAcl->AclRevision = ACL_REVISION;
4551         pAcl->Sbz1 = 0;
4552         pAcl->AclSize = length;
4553         pAcl->AceCount = acecount++;
4554         pAcl->Sbz2 = 0;
4555     }
4556     return TRUE;
4557
4558 lerr:
4559     SetLastError(error);
4560     WARN("Invalid ACE string format\n");
4561     return FALSE;
4562 }
4563
4564
4565 /******************************************************************************
4566  * ParseStringSecurityDescriptorToSecurityDescriptor
4567  */
4568 static BOOL ParseStringSecurityDescriptorToSecurityDescriptor(
4569     LPCWSTR StringSecurityDescriptor,
4570     SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
4571     LPDWORD cBytes)
4572 {
4573     BOOL bret = FALSE;
4574     WCHAR toktype;
4575     WCHAR *tok;
4576     LPCWSTR lptoken;
4577     LPBYTE lpNext = NULL;
4578     DWORD len;
4579
4580     *cBytes = sizeof(SECURITY_DESCRIPTOR);
4581
4582     tok = heap_alloc( (lstrlenW(StringSecurityDescriptor) + 1) * sizeof(WCHAR));
4583
4584     if (SecurityDescriptor)
4585         lpNext = (LPBYTE)(SecurityDescriptor + 1);
4586
4587     while (*StringSecurityDescriptor == ' ')
4588         StringSecurityDescriptor++;
4589
4590     while (*StringSecurityDescriptor)
4591     {
4592         toktype = *StringSecurityDescriptor;
4593
4594         /* Expect char identifier followed by ':' */
4595         StringSecurityDescriptor++;
4596         if (*StringSecurityDescriptor != ':')
4597         {
4598             SetLastError(ERROR_INVALID_PARAMETER);
4599             goto lend;
4600         }
4601         StringSecurityDescriptor++;
4602
4603         /* Extract token */
4604         lptoken = StringSecurityDescriptor;
4605         while (*lptoken && *lptoken != ':')
4606             lptoken++;
4607
4608         if (*lptoken)
4609             lptoken--;
4610
4611         len = lptoken - StringSecurityDescriptor;
4612         memcpy( tok, StringSecurityDescriptor, len * sizeof(WCHAR) );
4613         tok[len] = 0;
4614
4615         switch (toktype)
4616         {
4617             case 'O':
4618             {
4619                 DWORD bytes;
4620
4621                 if (!ParseStringSidToSid(tok, lpNext, &bytes))
4622                     goto lend;
4623
4624                 if (SecurityDescriptor)
4625                 {
4626                     SecurityDescriptor->Owner = lpNext - (LPBYTE)SecurityDescriptor;
4627                     lpNext += bytes; /* Advance to next token */
4628                 }
4629
4630                 *cBytes += bytes;
4631
4632                 break;
4633             }
4634
4635             case 'G':
4636             {
4637                 DWORD bytes;
4638
4639                 if (!ParseStringSidToSid(tok, lpNext, &bytes))
4640                     goto lend;
4641
4642                 if (SecurityDescriptor)
4643                 {
4644                     SecurityDescriptor->Group = lpNext - (LPBYTE)SecurityDescriptor;
4645                     lpNext += bytes; /* Advance to next token */
4646                 }
4647
4648                 *cBytes += bytes;
4649
4650                 break;
4651             }
4652
4653             case 'D':
4654             {
4655                 DWORD flags;
4656                 DWORD bytes;
4657
4658                 if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
4659                     goto lend;
4660
4661                 if (SecurityDescriptor)
4662                 {
4663                     SecurityDescriptor->Control |= SE_DACL_PRESENT | flags;
4664                     SecurityDescriptor->Dacl = lpNext - (LPBYTE)SecurityDescriptor;
4665                     lpNext += bytes; /* Advance to next token */
4666                 }
4667
4668                 *cBytes += bytes;
4669
4670                 break;
4671             }
4672
4673             case 'S':
4674             {
4675                 DWORD flags;
4676                 DWORD bytes;
4677
4678                 if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
4679                     goto lend;
4680
4681                 if (SecurityDescriptor)
4682                 {
4683                     SecurityDescriptor->Control |= SE_SACL_PRESENT | flags;
4684                     SecurityDescriptor->Sacl = lpNext - (LPBYTE)SecurityDescriptor;
4685                     lpNext += bytes; /* Advance to next token */
4686                 }
4687
4688                 *cBytes += bytes;
4689
4690                 break;
4691             }
4692
4693             default:
4694                 FIXME("Unknown token\n");
4695                 SetLastError(ERROR_INVALID_PARAMETER);
4696                 goto lend;
4697         }
4698
4699         StringSecurityDescriptor = lptoken;
4700     }
4701
4702     bret = TRUE;
4703
4704 lend:
4705     heap_free(tok);
4706     return bret;
4707 }
4708
4709 /******************************************************************************
4710  * ConvertStringSecurityDescriptorToSecurityDescriptorA [ADVAPI32.@]
4711  */
4712 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorA(
4713         LPCSTR StringSecurityDescriptor,
4714         DWORD StringSDRevision,
4715         PSECURITY_DESCRIPTOR* SecurityDescriptor,
4716         PULONG SecurityDescriptorSize)
4717 {
4718     BOOL ret;
4719     LPWSTR StringSecurityDescriptorW;
4720
4721     if(!StringSecurityDescriptor)
4722         return FALSE;
4723
4724     StringSecurityDescriptorW = SERV_dup(StringSecurityDescriptor);
4725     ret = ConvertStringSecurityDescriptorToSecurityDescriptorW(StringSecurityDescriptorW,
4726                                                                StringSDRevision, SecurityDescriptor,
4727                                                                SecurityDescriptorSize);
4728     heap_free(StringSecurityDescriptorW);
4729
4730     return ret;
4731 }
4732
4733 /******************************************************************************
4734  * ConvertStringSecurityDescriptorToSecurityDescriptorW [ADVAPI32.@]
4735  */
4736 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorW(
4737         LPCWSTR StringSecurityDescriptor,
4738         DWORD StringSDRevision,
4739         PSECURITY_DESCRIPTOR* SecurityDescriptor,
4740         PULONG SecurityDescriptorSize)
4741 {
4742     DWORD cBytes;
4743     SECURITY_DESCRIPTOR* psd;
4744     BOOL bret = FALSE;
4745
4746     TRACE("%s\n", debugstr_w(StringSecurityDescriptor));
4747
4748     if (GetVersion() & 0x80000000)
4749     {
4750         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4751         goto lend;
4752     }
4753     else if (!StringSecurityDescriptor || !SecurityDescriptor)
4754     {
4755         SetLastError(ERROR_INVALID_PARAMETER);
4756         goto lend;
4757     }
4758     else if (StringSDRevision != SID_REVISION)
4759     {
4760         SetLastError(ERROR_UNKNOWN_REVISION);
4761         goto lend;
4762     }
4763
4764     /* Compute security descriptor length */
4765     if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
4766         NULL, &cBytes))
4767         goto lend;
4768
4769     psd = *SecurityDescriptor = LocalAlloc(GMEM_ZEROINIT, cBytes);
4770     if (!psd) goto lend;
4771
4772     psd->Revision = SID_REVISION;
4773     psd->Control |= SE_SELF_RELATIVE;
4774
4775     if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
4776              (SECURITY_DESCRIPTOR_RELATIVE *)psd, &cBytes))
4777     {
4778         LocalFree(psd);
4779         goto lend;
4780     }
4781
4782     if (SecurityDescriptorSize)
4783         *SecurityDescriptorSize = cBytes;
4784
4785     bret = TRUE;
4786
4787 lend:
4788     TRACE(" ret=%d\n", bret);
4789     return bret;
4790 }
4791
4792 static void DumpString(LPCWSTR string, int cch, WCHAR **pwptr, ULONG *plen)
4793 {
4794     if (cch == -1)
4795         cch = strlenW(string);
4796
4797     if (plen)
4798         *plen += cch;
4799
4800     if (pwptr)
4801     {
4802         memcpy(*pwptr, string, sizeof(WCHAR)*cch);
4803         *pwptr += cch;
4804     }
4805 }
4806
4807 static BOOL DumpSidNumeric(PSID psid, WCHAR **pwptr, ULONG *plen)
4808 {
4809     DWORD i;
4810     WCHAR fmt[] = { 'S','-','%','u','-','%','d',0 };
4811     WCHAR subauthfmt[] = { '-','%','u',0 };
4812     WCHAR buf[26];
4813     SID *pisid = psid;
4814
4815     if( !IsValidSid( psid ) || pisid->Revision != SDDL_REVISION)
4816     {
4817         SetLastError(ERROR_INVALID_SID);
4818         return FALSE;
4819     }
4820
4821     if (pisid->IdentifierAuthority.Value[0] ||
4822      pisid->IdentifierAuthority.Value[1])
4823     {
4824         FIXME("not matching MS' bugs\n");
4825         SetLastError(ERROR_INVALID_SID);
4826         return FALSE;
4827     }
4828
4829     sprintfW( buf, fmt, pisid->Revision,
4830         MAKELONG(
4831             MAKEWORD( pisid->IdentifierAuthority.Value[5],
4832                     pisid->IdentifierAuthority.Value[4] ),
4833             MAKEWORD( pisid->IdentifierAuthority.Value[3],
4834                     pisid->IdentifierAuthority.Value[2] )
4835         ) );
4836     DumpString(buf, -1, pwptr, plen);
4837
4838     for( i=0; i<pisid->SubAuthorityCount; i++ )
4839     {
4840         sprintfW( buf, subauthfmt, pisid->SubAuthority[i] );
4841         DumpString(buf, -1, pwptr, plen);
4842     }
4843     return TRUE;
4844 }
4845
4846 static BOOL DumpSid(PSID psid, WCHAR **pwptr, ULONG *plen)
4847 {
4848     size_t i;
4849     for (i = 0; i < sizeof(WellKnownSids) / sizeof(WellKnownSids[0]); i++)
4850     {
4851         if (WellKnownSids[i].wstr[0] && EqualSid(psid, (PSID)&(WellKnownSids[i].Sid.Revision)))
4852         {
4853             DumpString(WellKnownSids[i].wstr, 2, pwptr, plen);
4854             return TRUE;
4855         }
4856     }
4857
4858     return DumpSidNumeric(psid, pwptr, plen);
4859 }
4860
4861 static const LPCWSTR AceRightBitNames[32] = {
4862         SDDL_CREATE_CHILD,        /*  0 */
4863         SDDL_DELETE_CHILD,
4864         SDDL_LIST_CHILDREN,
4865         SDDL_SELF_WRITE,
4866         SDDL_READ_PROPERTY,       /*  4 */
4867         SDDL_WRITE_PROPERTY,
4868         SDDL_DELETE_TREE,
4869         SDDL_LIST_OBJECT,
4870         SDDL_CONTROL_ACCESS,      /*  8 */
4871         NULL,
4872         NULL,
4873         NULL,
4874         NULL,                     /* 12 */
4875         NULL,
4876         NULL,
4877         NULL,
4878         SDDL_STANDARD_DELETE,     /* 16 */
4879         SDDL_READ_CONTROL,
4880         SDDL_WRITE_DAC,
4881         SDDL_WRITE_OWNER,
4882         NULL,                     /* 20 */
4883         NULL,
4884         NULL,
4885         NULL,
4886         NULL,                     /* 24 */
4887         NULL,
4888         NULL,
4889         NULL,
4890         SDDL_GENERIC_ALL,         /* 28 */
4891         SDDL_GENERIC_EXECUTE,
4892         SDDL_GENERIC_WRITE,
4893         SDDL_GENERIC_READ
4894 };
4895
4896 static void DumpRights(DWORD mask, WCHAR **pwptr, ULONG *plen)
4897 {
4898     static const WCHAR fmtW[] = {'0','x','%','x',0};
4899     WCHAR buf[15];
4900     size_t i;
4901
4902     if (mask == 0)
4903         return;
4904
4905     /* first check if the right have name */
4906     for (i = 0; i < sizeof(AceRights)/sizeof(AceRights[0]); i++)
4907     {
4908         if (AceRights[i].wstr == NULL)
4909             break;
4910         if (mask == AceRights[i].value)
4911         {
4912             DumpString(AceRights[i].wstr, -1, pwptr, plen);
4913             return;
4914         }
4915     }
4916
4917     /* then check if it can be built from bit names */
4918     for (i = 0; i < 32; i++)
4919     {
4920         if ((mask & (1 << i)) && (AceRightBitNames[i] == NULL))
4921         {
4922             /* can't be built from bit names */
4923             sprintfW(buf, fmtW, mask);
4924             DumpString(buf, -1, pwptr, plen);
4925             return;
4926         }
4927     }
4928
4929     /* build from bit names */
4930     for (i = 0; i < 32; i++)
4931         if (mask & (1 << i))
4932             DumpString(AceRightBitNames[i], -1, pwptr, plen);
4933 }
4934
4935 static BOOL DumpAce(LPVOID pace, WCHAR **pwptr, ULONG *plen)
4936 {
4937     ACCESS_ALLOWED_ACE *piace; /* all the supported ACEs have the same memory layout */
4938     static const WCHAR openbr = '(';
4939     static const WCHAR closebr = ')';
4940     static const WCHAR semicolon = ';';
4941
4942     if (((PACE_HEADER)pace)->AceType > SYSTEM_ALARM_ACE_TYPE || ((PACE_HEADER)pace)->AceSize < sizeof(ACCESS_ALLOWED_ACE))
4943     {
4944         SetLastError(ERROR_INVALID_ACL);
4945         return FALSE;
4946     }
4947
4948     piace = pace;
4949     DumpString(&openbr, 1, pwptr, plen);
4950     switch (piace->Header.AceType)
4951     {
4952         case ACCESS_ALLOWED_ACE_TYPE:
4953             DumpString(SDDL_ACCESS_ALLOWED, -1, pwptr, plen);
4954             break;
4955         case ACCESS_DENIED_ACE_TYPE:
4956             DumpString(SDDL_ACCESS_DENIED, -1, pwptr, plen);
4957             break;
4958         case SYSTEM_AUDIT_ACE_TYPE:
4959             DumpString(SDDL_AUDIT, -1, pwptr, plen);
4960             break;
4961         case SYSTEM_ALARM_ACE_TYPE:
4962             DumpString(SDDL_ALARM, -1, pwptr, plen);
4963             break;
4964     }
4965     DumpString(&semicolon, 1, pwptr, plen);
4966
4967     if (piace->Header.AceFlags & OBJECT_INHERIT_ACE)
4968         DumpString(SDDL_OBJECT_INHERIT, -1, pwptr, plen);
4969     if (piace->Header.AceFlags & CONTAINER_INHERIT_ACE)
4970         DumpString(SDDL_CONTAINER_INHERIT, -1, pwptr, plen);
4971     if (piace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE)
4972         DumpString(SDDL_NO_PROPAGATE, -1, pwptr, plen);
4973     if (piace->Header.AceFlags & INHERIT_ONLY_ACE)
4974         DumpString(SDDL_INHERIT_ONLY, -1, pwptr, plen);
4975     if (piace->Header.AceFlags & INHERITED_ACE)
4976         DumpString(SDDL_INHERITED, -1, pwptr, plen);
4977     if (piace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG)
4978         DumpString(SDDL_AUDIT_SUCCESS, -1, pwptr, plen);
4979     if (piace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG)
4980         DumpString(SDDL_AUDIT_FAILURE, -1, pwptr, plen);
4981     DumpString(&semicolon, 1, pwptr, plen);
4982     DumpRights(piace->Mask, pwptr, plen);
4983     DumpString(&semicolon, 1, pwptr, plen);
4984     /* objects not supported */
4985     DumpString(&semicolon, 1, pwptr, plen);
4986     /* objects not supported */
4987     DumpString(&semicolon, 1, pwptr, plen);
4988     if (!DumpSid(&piace->SidStart, pwptr, plen))
4989         return FALSE;
4990     DumpString(&closebr, 1, pwptr, plen);
4991     return TRUE;
4992 }
4993
4994 static BOOL DumpAcl(PACL pacl, WCHAR **pwptr, ULONG *plen, BOOL protected, BOOL autoInheritReq, BOOL autoInherited)
4995 {
4996     WORD count;
4997     UINT i;
4998
4999     if (protected)
5000         DumpString(SDDL_PROTECTED, -1, pwptr, plen);
5001     if (autoInheritReq)
5002         DumpString(SDDL_AUTO_INHERIT_REQ, -1, pwptr, plen);
5003     if (autoInherited)
5004         DumpString(SDDL_AUTO_INHERITED, -1, pwptr, plen);
5005
5006     if (pacl == NULL)
5007         return TRUE;
5008
5009     if (!IsValidAcl(pacl))
5010         return FALSE;
5011
5012     count = pacl->AceCount;
5013     for (i = 0; i < count; i++)
5014     {
5015         LPVOID ace;
5016         if (!GetAce(pacl, i, &ace))
5017             return FALSE;
5018         if (!DumpAce(ace, pwptr, plen))
5019             return FALSE;
5020     }
5021
5022     return TRUE;
5023 }
5024
5025 static BOOL DumpOwner(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
5026 {
5027     static const WCHAR prefix[] = {'O',':',0};
5028     BOOL bDefaulted;
5029     PSID psid;
5030
5031     if (!GetSecurityDescriptorOwner(SecurityDescriptor, &psid, &bDefaulted))
5032         return FALSE;
5033
5034     if (psid == NULL)
5035         return TRUE;
5036
5037     DumpString(prefix, -1, pwptr, plen);
5038     if (!DumpSid(psid, pwptr, plen))
5039         return FALSE;
5040     return TRUE;
5041 }
5042
5043 static BOOL DumpGroup(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
5044 {
5045     static const WCHAR prefix[] = {'G',':',0};
5046     BOOL bDefaulted;
5047     PSID psid;
5048
5049     if (!GetSecurityDescriptorGroup(SecurityDescriptor, &psid, &bDefaulted))
5050         return FALSE;
5051
5052     if (psid == NULL)
5053         return TRUE;
5054
5055     DumpString(prefix, -1, pwptr, plen);
5056     if (!DumpSid(psid, pwptr, plen))
5057         return FALSE;
5058     return TRUE;
5059 }
5060
5061 static BOOL DumpDacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
5062 {
5063     static const WCHAR dacl[] = {'D',':',0};
5064     SECURITY_DESCRIPTOR_CONTROL control;
5065     BOOL present, defaulted;
5066     DWORD revision;
5067     PACL pacl;
5068
5069     if (!GetSecurityDescriptorDacl(SecurityDescriptor, &present, &pacl, &defaulted))
5070         return FALSE;
5071
5072     if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
5073         return FALSE;
5074
5075     if (!present)
5076         return TRUE;
5077
5078     DumpString(dacl, 2, pwptr, plen);
5079     if (!DumpAcl(pacl, pwptr, plen, control & SE_DACL_PROTECTED, control & SE_DACL_AUTO_INHERIT_REQ, control & SE_DACL_AUTO_INHERITED))
5080         return FALSE;
5081     return TRUE;
5082 }
5083
5084 static BOOL DumpSacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
5085 {
5086     static const WCHAR sacl[] = {'S',':',0};
5087     SECURITY_DESCRIPTOR_CONTROL control;
5088     BOOL present, defaulted;
5089     DWORD revision;
5090     PACL pacl;
5091
5092     if (!GetSecurityDescriptorSacl(SecurityDescriptor, &present, &pacl, &defaulted))
5093         return FALSE;
5094
5095     if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
5096         return FALSE;
5097
5098     if (!present)
5099         return TRUE;
5100
5101     DumpString(sacl, 2, pwptr, plen);
5102     if (!DumpAcl(pacl, pwptr, plen, control & SE_SACL_PROTECTED, control & SE_SACL_AUTO_INHERIT_REQ, control & SE_SACL_AUTO_INHERITED))
5103         return FALSE;
5104     return TRUE;
5105 }
5106
5107 /******************************************************************************
5108  * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
5109  */
5110 BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorW(PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION RequestedInformation, LPWSTR *OutputString, PULONG OutputLen)
5111 {
5112     ULONG len;
5113     WCHAR *wptr, *wstr;
5114
5115     if (SDRevision != SDDL_REVISION_1)
5116     {
5117         ERR("Program requested unknown SDDL revision %d\n", SDRevision);
5118         SetLastError(ERROR_UNKNOWN_REVISION);
5119         return FALSE;
5120     }
5121
5122     len = 0;
5123     if (RequestedInformation & OWNER_SECURITY_INFORMATION)
5124         if (!DumpOwner(SecurityDescriptor, NULL, &len))
5125             return FALSE;
5126     if (RequestedInformation & GROUP_SECURITY_INFORMATION)
5127         if (!DumpGroup(SecurityDescriptor, NULL, &len))
5128             return FALSE;
5129     if (RequestedInformation & DACL_SECURITY_INFORMATION)
5130         if (!DumpDacl(SecurityDescriptor, NULL, &len))
5131             return FALSE;
5132     if (RequestedInformation & SACL_SECURITY_INFORMATION)
5133         if (!DumpSacl(SecurityDescriptor, NULL, &len))
5134             return FALSE;
5135
5136     wstr = wptr = LocalAlloc(0, (len + 1)*sizeof(WCHAR));
5137     if (RequestedInformation & OWNER_SECURITY_INFORMATION)
5138         if (!DumpOwner(SecurityDescriptor, &wptr, NULL)) {
5139             LocalFree (wstr);
5140             return FALSE;
5141         }
5142     if (RequestedInformation & GROUP_SECURITY_INFORMATION)
5143         if (!DumpGroup(SecurityDescriptor, &wptr, NULL)) {
5144             LocalFree (wstr);
5145             return FALSE;
5146         }
5147     if (RequestedInformation & DACL_SECURITY_INFORMATION)
5148         if (!DumpDacl(SecurityDescriptor, &wptr, NULL)) {
5149             LocalFree (wstr);
5150             return FALSE;
5151         }
5152     if (RequestedInformation & SACL_SECURITY_INFORMATION)
5153         if (!DumpSacl(SecurityDescriptor, &wptr, NULL)) {
5154             LocalFree (wstr);
5155             return FALSE;
5156         }
5157     *wptr = 0;
5158
5159     TRACE("ret: %s, %d\n", wine_dbgstr_w(wstr), len);
5160     *OutputString = wstr;
5161     if (OutputLen)
5162         *OutputLen = strlenW(*OutputString)+1;
5163     return TRUE;
5164 }
5165
5166 /******************************************************************************
5167  * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
5168  */
5169 BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorA(PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION Information, LPSTR *OutputString, PULONG OutputLen)
5170 {
5171     LPWSTR wstr;
5172     ULONG len;
5173     if (ConvertSecurityDescriptorToStringSecurityDescriptorW(SecurityDescriptor, SDRevision, Information, &wstr, &len))
5174     {
5175         int lenA;
5176
5177         lenA = WideCharToMultiByte(CP_ACP, 0, wstr, len, NULL, 0, NULL, NULL);
5178         *OutputString = heap_alloc(lenA);
5179         WideCharToMultiByte(CP_ACP, 0, wstr, len, *OutputString, lenA, NULL, NULL);
5180         LocalFree(wstr);
5181
5182         if (OutputLen != NULL)
5183             *OutputLen = lenA;
5184         return TRUE;
5185     }
5186     else
5187     {
5188         *OutputString = NULL;
5189         if (OutputLen)
5190             *OutputLen = 0;
5191         return FALSE;
5192     }
5193 }
5194
5195 /******************************************************************************
5196  * ConvertStringSidToSidW [ADVAPI32.@]
5197  */
5198 BOOL WINAPI ConvertStringSidToSidW(LPCWSTR StringSid, PSID* Sid)
5199 {
5200     BOOL bret = FALSE;
5201     DWORD cBytes;
5202
5203     TRACE("%s, %p\n", debugstr_w(StringSid), Sid);
5204     if (GetVersion() & 0x80000000)
5205         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
5206     else if (!StringSid || !Sid)
5207         SetLastError(ERROR_INVALID_PARAMETER);
5208     else if (ParseStringSidToSid(StringSid, NULL, &cBytes))
5209     {
5210         PSID pSid = *Sid = LocalAlloc(0, cBytes);
5211
5212         bret = ParseStringSidToSid(StringSid, pSid, &cBytes);
5213         if (!bret)
5214             LocalFree(*Sid);
5215     }
5216     return bret;
5217 }
5218
5219 /******************************************************************************
5220  * ConvertStringSidToSidA [ADVAPI32.@]
5221  */
5222 BOOL WINAPI ConvertStringSidToSidA(LPCSTR StringSid, PSID* Sid)
5223 {
5224     BOOL bret = FALSE;
5225
5226     TRACE("%s, %p\n", debugstr_a(StringSid), Sid);
5227     if (GetVersion() & 0x80000000)
5228         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
5229     else if (!StringSid || !Sid)
5230         SetLastError(ERROR_INVALID_PARAMETER);
5231     else
5232     {
5233         WCHAR *wStringSid = SERV_dup(StringSid);
5234         bret = ConvertStringSidToSidW(wStringSid, Sid);
5235         heap_free(wStringSid);
5236     }
5237     return bret;
5238 }
5239
5240 /******************************************************************************
5241  * ConvertSidToStringSidW [ADVAPI32.@]
5242  *
5243  *  format of SID string is:
5244  *    S-<count>-<auth>-<subauth1>-<subauth2>-<subauth3>...
5245  *  where
5246  *    <rev> is the revision of the SID encoded as decimal
5247  *    <auth> is the identifier authority encoded as hex
5248  *    <subauthN> is the subauthority id encoded as decimal
5249  */
5250 BOOL WINAPI ConvertSidToStringSidW( PSID pSid, LPWSTR *pstr )
5251 {
5252     DWORD len = 0;
5253     LPWSTR wstr, wptr;
5254
5255     TRACE("%p %p\n", pSid, pstr );
5256
5257     len = 0;
5258     if (!DumpSidNumeric(pSid, NULL, &len))
5259         return FALSE;
5260     wstr = wptr = LocalAlloc(0, (len+1) * sizeof(WCHAR));
5261     DumpSidNumeric(pSid, &wptr, NULL);
5262     *wptr = 0;
5263
5264     *pstr = wstr;
5265     return TRUE;
5266 }
5267
5268 /******************************************************************************
5269  * ConvertSidToStringSidA [ADVAPI32.@]
5270  */
5271 BOOL WINAPI ConvertSidToStringSidA(PSID pSid, LPSTR *pstr)
5272 {
5273     LPWSTR wstr = NULL;
5274     LPSTR str;
5275     UINT len;
5276
5277     TRACE("%p %p\n", pSid, pstr );
5278
5279     if( !ConvertSidToStringSidW( pSid, &wstr ) )
5280         return FALSE;
5281
5282     len = WideCharToMultiByte( CP_ACP, 0, wstr, -1, NULL, 0, NULL, NULL );
5283     str = LocalAlloc( 0, len );
5284     WideCharToMultiByte( CP_ACP, 0, wstr, -1, str, len, NULL, NULL );
5285     LocalFree( wstr );
5286
5287     *pstr = str;
5288
5289     return TRUE;
5290 }
5291
5292 BOOL WINAPI ConvertToAutoInheritPrivateObjectSecurity(
5293         PSECURITY_DESCRIPTOR pdesc,
5294         PSECURITY_DESCRIPTOR cdesc,
5295         PSECURITY_DESCRIPTOR* ndesc,
5296         GUID* objtype,
5297         BOOL isdir,
5298         PGENERIC_MAPPING genmap )
5299 {
5300     FIXME("%p %p %p %p %d %p - stub\n", pdesc, cdesc, ndesc, objtype, isdir, genmap);
5301
5302     return FALSE;
5303 }
5304
5305 BOOL WINAPI CreatePrivateObjectSecurityEx(
5306     PSECURITY_DESCRIPTOR parent, PSECURITY_DESCRIPTOR creator, PSECURITY_DESCRIPTOR *out,
5307     GUID *objtype, BOOL is_directory, ULONG flags, HANDLE token, PGENERIC_MAPPING mapping)
5308 {
5309     SECURITY_DESCRIPTOR_RELATIVE *relative;
5310     DWORD needed, offset;
5311     BYTE *buffer;
5312
5313     FIXME("%p %p %p %p %d %u %p %p - returns fake SECURITY_DESCRIPTOR\n", parent, creator, out,
5314           objtype, is_directory, flags, token, mapping);
5315
5316     needed = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5317     needed += sizeof(sidWorld);
5318     needed += sizeof(sidWorld);
5319     needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5320     needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5321
5322     if (!(buffer = heap_alloc( needed ))) return FALSE;
5323     relative = (SECURITY_DESCRIPTOR_RELATIVE *)buffer;
5324     if (!InitializeSecurityDescriptor( relative, SECURITY_DESCRIPTOR_REVISION ))
5325     {
5326         heap_free( buffer );
5327         return FALSE;
5328     }
5329     relative->Control |= SE_SELF_RELATIVE;
5330     offset = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5331
5332     memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5333     relative->Owner = offset;
5334     offset += sizeof(sidWorld);
5335
5336     memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5337     relative->Group = offset;
5338     offset += sizeof(sidWorld);
5339
5340     GetWorldAccessACL( (ACL *)(buffer + offset) );
5341     relative->Dacl = offset;
5342     offset += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5343
5344     GetWorldAccessACL( (ACL *)(buffer + offset) );
5345     relative->Sacl = offset;
5346
5347     *out = relative;
5348     return TRUE;
5349 }
5350
5351 BOOL WINAPI CreatePrivateObjectSecurity(
5352     PSECURITY_DESCRIPTOR parent, PSECURITY_DESCRIPTOR creator, PSECURITY_DESCRIPTOR *out,
5353     BOOL is_container, HANDLE token, PGENERIC_MAPPING mapping)
5354 {
5355     return CreatePrivateObjectSecurityEx(parent, creator, out, NULL, is_container, 0, token, mapping);
5356 }
5357
5358 BOOL WINAPI CreatePrivateObjectSecurityWithMultipleInheritance(
5359     PSECURITY_DESCRIPTOR parent, PSECURITY_DESCRIPTOR creator, PSECURITY_DESCRIPTOR *out,
5360     GUID **types, ULONG count, BOOL is_container, ULONG flags, HANDLE token, PGENERIC_MAPPING mapping)
5361 {
5362     FIXME(": semi-stub\n");
5363     return CreatePrivateObjectSecurityEx(parent, creator, out, NULL, is_container, flags, token, mapping);
5364 }
5365
5366 BOOL WINAPI DestroyPrivateObjectSecurity( PSECURITY_DESCRIPTOR* ObjectDescriptor )
5367 {
5368     FIXME("%p - stub\n", ObjectDescriptor);
5369
5370     heap_free( *ObjectDescriptor );
5371     return TRUE;
5372 }
5373
5374 BOOL WINAPI DECLSPEC_HOTPATCH CreateProcessAsUserA(
5375         HANDLE hToken,
5376         LPCSTR lpApplicationName,
5377         LPSTR lpCommandLine,
5378         LPSECURITY_ATTRIBUTES lpProcessAttributes,
5379         LPSECURITY_ATTRIBUTES lpThreadAttributes,
5380         BOOL bInheritHandles,
5381         DWORD dwCreationFlags,
5382         LPVOID lpEnvironment,
5383         LPCSTR lpCurrentDirectory,
5384         LPSTARTUPINFOA lpStartupInfo,
5385         LPPROCESS_INFORMATION lpProcessInformation )
5386 {
5387     BOOL ret;
5388     WCHAR *appW, *cmdlnW, *cwdW;
5389     STARTUPINFOW sinfo;
5390
5391     TRACE("%p %s %s %p %p %d 0x%08x %p %s %p %p\n", hToken, debugstr_a(lpApplicationName),
5392           debugstr_a(lpCommandLine), lpProcessAttributes, lpThreadAttributes, bInheritHandles,
5393           dwCreationFlags, lpEnvironment, debugstr_a(lpCurrentDirectory), lpStartupInfo, lpProcessInformation);
5394
5395     appW = SERV_dup(lpApplicationName);
5396     cmdlnW = SERV_dup(lpCommandLine);
5397     cwdW = SERV_dup(lpCurrentDirectory);
5398     sinfo.cb = sizeof(sinfo);
5399     sinfo.lpReserved = SERV_dup(lpStartupInfo->lpReserved);
5400     sinfo.lpDesktop = SERV_dup(lpStartupInfo->lpDesktop);
5401     sinfo.lpTitle = SERV_dup(lpStartupInfo->lpTitle);
5402     sinfo.dwX = lpStartupInfo->dwX;
5403     sinfo.dwY = lpStartupInfo->dwY;
5404     sinfo.dwXSize = lpStartupInfo->dwXSize;
5405     sinfo.dwYSize = lpStartupInfo->dwYSize;
5406     sinfo.dwXCountChars = lpStartupInfo->dwXCountChars;
5407     sinfo.dwYCountChars = lpStartupInfo->dwYCountChars;
5408     sinfo.dwFillAttribute = lpStartupInfo->dwFillAttribute;
5409     sinfo.dwFlags = lpStartupInfo->dwFlags;
5410     sinfo.wShowWindow = lpStartupInfo->wShowWindow;
5411     sinfo.cbReserved2 = lpStartupInfo->cbReserved2;
5412     sinfo.lpReserved2 = lpStartupInfo->lpReserved2;
5413     sinfo.hStdInput = lpStartupInfo->hStdInput;
5414     sinfo.hStdOutput = lpStartupInfo->hStdOutput;
5415     sinfo.hStdError = lpStartupInfo->hStdError;
5416     ret = CreateProcessAsUserW(hToken, appW, cmdlnW, lpProcessAttributes,
5417             lpThreadAttributes, bInheritHandles, dwCreationFlags,
5418             lpEnvironment, cwdW, &sinfo, lpProcessInformation);
5419     heap_free(appW);
5420     heap_free(cmdlnW);
5421     heap_free(cwdW);
5422     heap_free(sinfo.lpReserved);
5423     heap_free(sinfo.lpDesktop);
5424     heap_free(sinfo.lpTitle);
5425
5426     return ret;
5427 }
5428
5429 BOOL WINAPI DECLSPEC_HOTPATCH CreateProcessAsUserW(
5430         HANDLE hToken,
5431         LPCWSTR lpApplicationName,
5432         LPWSTR lpCommandLine,
5433         LPSECURITY_ATTRIBUTES lpProcessAttributes,
5434         LPSECURITY_ATTRIBUTES lpThreadAttributes,
5435         BOOL bInheritHandles,
5436         DWORD dwCreationFlags,
5437         LPVOID lpEnvironment,
5438         LPCWSTR lpCurrentDirectory,
5439         LPSTARTUPINFOW lpStartupInfo,
5440         LPPROCESS_INFORMATION lpProcessInformation )
5441 {
5442     FIXME("%p %s %s %p %p %d 0x%08x %p %s %p %p - semi-stub\n", hToken,
5443           debugstr_w(lpApplicationName), debugstr_w(lpCommandLine), lpProcessAttributes,
5444           lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment,
5445           debugstr_w(lpCurrentDirectory), lpStartupInfo, lpProcessInformation);
5446
5447     /* We should create the process with a suspended main thread */
5448     if (!CreateProcessW (lpApplicationName,
5449                          lpCommandLine,
5450                          lpProcessAttributes,
5451                          lpThreadAttributes,
5452                          bInheritHandles,
5453                          dwCreationFlags, /* CREATE_SUSPENDED */
5454                          lpEnvironment,
5455                          lpCurrentDirectory,
5456                          lpStartupInfo,
5457                          lpProcessInformation))
5458     {
5459       return FALSE;
5460     }
5461
5462     return TRUE;
5463 }
5464
5465 /******************************************************************************
5466  * CreateProcessWithLogonW
5467  */
5468 BOOL WINAPI CreateProcessWithLogonW( LPCWSTR lpUsername, LPCWSTR lpDomain, LPCWSTR lpPassword, DWORD dwLogonFlags,
5469     LPCWSTR lpApplicationName, LPWSTR lpCommandLine, DWORD dwCreationFlags, LPVOID lpEnvironment,
5470     LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation )
5471 {
5472     FIXME("%s %s %s 0x%08x %s %s 0x%08x %p %s %p %p stub\n", debugstr_w(lpUsername), debugstr_w(lpDomain),
5473     debugstr_w(lpPassword), dwLogonFlags, debugstr_w(lpApplicationName),
5474     debugstr_w(lpCommandLine), dwCreationFlags, lpEnvironment, debugstr_w(lpCurrentDirectory),
5475     lpStartupInfo, lpProcessInformation);
5476
5477     return FALSE;
5478 }
5479
5480 BOOL WINAPI CreateProcessWithTokenW(HANDLE token, DWORD logon_flags, LPCWSTR application_name, LPWSTR command_line,
5481         DWORD creation_flags, void *environment, LPCWSTR current_directory, STARTUPINFOW *startup_info,
5482         PROCESS_INFORMATION *process_information )
5483 {
5484     FIXME("%p 0x%08x %s %s 0x%08x %p %s %p %p - semi-stub\n", token,
5485           logon_flags, debugstr_w(application_name), debugstr_w(command_line),
5486           creation_flags, environment, debugstr_w(current_directory),
5487           startup_info, process_information);
5488
5489     /* FIXME: check if handles should be inherited */
5490     return CreateProcessW( application_name, command_line, NULL, NULL, FALSE, creation_flags, environment,
5491                            current_directory, startup_info, process_information );
5492 }
5493
5494 /******************************************************************************
5495  * DuplicateTokenEx [ADVAPI32.@]
5496  */
5497 BOOL WINAPI DuplicateTokenEx(
5498         HANDLE ExistingTokenHandle, DWORD dwDesiredAccess,
5499         LPSECURITY_ATTRIBUTES lpTokenAttributes,
5500         SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5501         TOKEN_TYPE TokenType,
5502         PHANDLE DuplicateTokenHandle )
5503 {
5504     OBJECT_ATTRIBUTES ObjectAttributes;
5505
5506     TRACE("%p 0x%08x 0x%08x 0x%08x %p\n", ExistingTokenHandle, dwDesiredAccess,
5507           ImpersonationLevel, TokenType, DuplicateTokenHandle);
5508
5509     InitializeObjectAttributes(
5510         &ObjectAttributes,
5511         NULL,
5512         (lpTokenAttributes && lpTokenAttributes->bInheritHandle) ? OBJ_INHERIT : 0,
5513         NULL,
5514         lpTokenAttributes ? lpTokenAttributes->lpSecurityDescriptor : NULL );
5515
5516     return set_ntstatus( NtDuplicateToken( ExistingTokenHandle,
5517                                            dwDesiredAccess,
5518                                            &ObjectAttributes,
5519                                            ImpersonationLevel,
5520                                            TokenType,
5521                                            DuplicateTokenHandle ) );
5522 }
5523
5524 BOOL WINAPI DuplicateToken(
5525         HANDLE ExistingTokenHandle,
5526         SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5527         PHANDLE DuplicateTokenHandle )
5528 {
5529     return DuplicateTokenEx( ExistingTokenHandle, TOKEN_IMPERSONATE | TOKEN_QUERY,
5530                              NULL, ImpersonationLevel, TokenImpersonation,
5531                              DuplicateTokenHandle );
5532 }
5533
5534 /******************************************************************************
5535  * ComputeStringSidSize
5536  */
5537 static DWORD ComputeStringSidSize(LPCWSTR StringSid)
5538 {
5539     if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I(-S)+ */
5540     {
5541         int ctok = 0;
5542         while (*StringSid)
5543         {
5544             if (*StringSid == '-')
5545                 ctok++;
5546             StringSid++;
5547         }
5548
5549         if (ctok >= 3)
5550             return GetSidLengthRequired(ctok - 2);
5551     }
5552     else /* String constant format  - Only available in winxp and above */
5553     {
5554         unsigned int i;
5555
5556         for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
5557             if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
5558                 return GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
5559
5560         for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
5561             if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
5562             {
5563                 MAX_SID local;
5564                 ADVAPI_GetComputerSid(&local);
5565                 return GetSidLengthRequired(*GetSidSubAuthorityCount(&local) + 1);
5566             }
5567
5568     }
5569
5570     return GetSidLengthRequired(0);
5571 }
5572
5573 /******************************************************************************
5574  * ParseStringSidToSid
5575  */
5576 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes)
5577 {
5578     BOOL bret = FALSE;
5579     SID* pisid=pSid;
5580
5581     TRACE("%s, %p, %p\n", debugstr_w(StringSid), pSid, cBytes);
5582     if (!StringSid)
5583     {
5584         SetLastError(ERROR_INVALID_PARAMETER);
5585         TRACE("StringSid is NULL, returning FALSE\n");
5586         return FALSE;
5587     }
5588
5589     while (*StringSid == ' ')
5590         StringSid++;
5591
5592     *cBytes = ComputeStringSidSize(StringSid);
5593     if (!pisid) /* Simply compute the size */
5594     {
5595         TRACE("only size requested, returning TRUE with %d\n", *cBytes);
5596         return TRUE;
5597     }
5598
5599     if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I-S-S */
5600     {
5601         DWORD i = 0, identAuth;
5602         DWORD csubauth = ((*cBytes - GetSidLengthRequired(0)) / sizeof(DWORD));
5603
5604         StringSid += 2; /* Advance to Revision */
5605         pisid->Revision = atoiW(StringSid);
5606
5607         if (pisid->Revision != SDDL_REVISION)
5608         {
5609             TRACE("Revision %d is unknown\n", pisid->Revision);
5610             goto lend; /* ERROR_INVALID_SID */
5611         }
5612         if (csubauth == 0)
5613         {
5614             TRACE("SubAuthorityCount is 0\n");
5615             goto lend; /* ERROR_INVALID_SID */
5616         }
5617
5618         pisid->SubAuthorityCount = csubauth;
5619
5620         /* Advance to identifier authority */
5621         while (*StringSid && *StringSid != '-')
5622             StringSid++;
5623         if (*StringSid == '-')
5624             StringSid++;
5625
5626         /* MS' implementation can't handle values greater than 2^32 - 1, so
5627          * we don't either; assume most significant bytes are always 0
5628          */
5629         pisid->IdentifierAuthority.Value[0] = 0;
5630         pisid->IdentifierAuthority.Value[1] = 0;
5631         identAuth = atoiW(StringSid);
5632         pisid->IdentifierAuthority.Value[5] = identAuth & 0xff;
5633         pisid->IdentifierAuthority.Value[4] = (identAuth & 0xff00) >> 8;
5634         pisid->IdentifierAuthority.Value[3] = (identAuth & 0xff0000) >> 16;
5635         pisid->IdentifierAuthority.Value[2] = (identAuth & 0xff000000) >> 24;
5636
5637         /* Advance to first sub authority */
5638         while (*StringSid && *StringSid != '-')
5639             StringSid++;
5640         if (*StringSid == '-')
5641             StringSid++;
5642
5643         while (*StringSid)
5644         {
5645             pisid->SubAuthority[i++] = atoiW(StringSid);
5646
5647             while (*StringSid && *StringSid != '-')
5648                 StringSid++;
5649             if (*StringSid == '-')
5650                 StringSid++;
5651         }
5652
5653         if (i != pisid->SubAuthorityCount)
5654             goto lend; /* ERROR_INVALID_SID */
5655
5656         bret = TRUE;
5657     }
5658     else /* String constant format  - Only available in winxp and above */
5659     {
5660         unsigned int i;
5661         pisid->Revision = SDDL_REVISION;
5662
5663         for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
5664             if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
5665             {
5666                 DWORD j;
5667                 pisid->SubAuthorityCount = WellKnownSids[i].Sid.SubAuthorityCount;
5668                 pisid->IdentifierAuthority = WellKnownSids[i].Sid.IdentifierAuthority;
5669                 for (j = 0; j < WellKnownSids[i].Sid.SubAuthorityCount; j++)
5670                     pisid->SubAuthority[j] = WellKnownSids[i].Sid.SubAuthority[j];
5671                 bret = TRUE;
5672             }
5673
5674         for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
5675             if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
5676             {
5677                 ADVAPI_GetComputerSid(pisid);
5678                 pisid->SubAuthority[pisid->SubAuthorityCount] = WellKnownRids[i].Rid;
5679                 pisid->SubAuthorityCount++;
5680                 bret = TRUE;
5681             }
5682
5683         if (!bret)
5684             FIXME("String constant not supported: %s\n", debugstr_wn(StringSid, 2));
5685     }
5686
5687 lend:
5688     if (!bret)
5689         SetLastError(ERROR_INVALID_SID);
5690
5691     TRACE("returning %s\n", bret ? "TRUE" : "FALSE");
5692     return bret;
5693 }
5694
5695 /******************************************************************************
5696  * GetNamedSecurityInfoA [ADVAPI32.@]
5697  */
5698 DWORD WINAPI GetNamedSecurityInfoA(LPSTR pObjectName,
5699         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
5700         PSID* ppsidOwner, PSID* ppsidGroup, PACL* ppDacl, PACL* ppSacl,
5701         PSECURITY_DESCRIPTOR* ppSecurityDescriptor)
5702 {
5703     LPWSTR wstr;
5704     DWORD r;
5705
5706     TRACE("%s %d %d %p %p %p %p %p\n", pObjectName, ObjectType, SecurityInfo,
5707         ppsidOwner, ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor);
5708
5709     wstr = SERV_dup(pObjectName);
5710     r = GetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, ppsidOwner,
5711                            ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor );
5712
5713     heap_free( wstr );
5714
5715     return r;
5716 }
5717
5718 /******************************************************************************
5719  * GetNamedSecurityInfoW [ADVAPI32.@]
5720  */
5721 DWORD WINAPI GetNamedSecurityInfoW( LPWSTR name, SE_OBJECT_TYPE type,
5722     SECURITY_INFORMATION info, PSID* owner, PSID* group, PACL* dacl,
5723     PACL* sacl, PSECURITY_DESCRIPTOR* descriptor )
5724 {
5725     DWORD access = 0;
5726     HANDLE handle;
5727     DWORD err;
5728
5729     TRACE( "%s %d %d %p %p %p %p %p\n", debugstr_w(name), type, info, owner,
5730            group, dacl, sacl, descriptor );
5731
5732     /* A NULL descriptor is allowed if any one of the other pointers is not NULL */
5733     if (!name || !(owner||group||dacl||sacl||descriptor) ) return ERROR_INVALID_PARAMETER;
5734
5735     /* If no descriptor, we have to check that there's a pointer for the requested information */
5736     if( !descriptor && (
5737         ((info & OWNER_SECURITY_INFORMATION) && !owner)
5738     ||  ((info & GROUP_SECURITY_INFORMATION) && !group)
5739     ||  ((info & DACL_SECURITY_INFORMATION)  && !dacl)
5740     ||  ((info & SACL_SECURITY_INFORMATION)  && !sacl)  ))
5741         return ERROR_INVALID_PARAMETER;
5742
5743     if (info & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION))
5744         access |= READ_CONTROL;
5745     if (info & SACL_SECURITY_INFORMATION)
5746         access |= ACCESS_SYSTEM_SECURITY;
5747
5748     switch (type)
5749     {
5750     case SE_SERVICE:
5751         if (!(err = get_security_service( name, access, &handle )))
5752         {
5753             err = GetSecurityInfo( handle, type, info, owner, group, dacl, sacl, descriptor );
5754             CloseServiceHandle( handle );
5755         }
5756         break;
5757     case SE_REGISTRY_KEY:
5758         if (!(err = get_security_regkey( name, access, &handle )))
5759         {
5760             err = GetSecurityInfo( handle, type, info, owner, group, dacl, sacl, descriptor );
5761             RegCloseKey( handle );
5762         }
5763         break;
5764     case SE_FILE_OBJECT:
5765         if (!(err = get_security_file( name, access, &handle )))
5766         {
5767             err = GetSecurityInfo( handle, type, info, owner, group, dacl, sacl, descriptor );
5768             CloseHandle( handle );
5769         }
5770         break;
5771     default:
5772         FIXME( "Object type %d is not currently supported.\n", type );
5773         if (owner) *owner = NULL;
5774         if (group) *group = NULL;
5775         if (dacl) *dacl = NULL;
5776         if (sacl) *sacl = NULL;
5777         if (descriptor) *descriptor = NULL;
5778         return ERROR_SUCCESS;
5779     }
5780     return err;
5781 }
5782
5783 /******************************************************************************
5784  * GetNamedSecurityInfoExW [ADVAPI32.@]
5785  */
5786 DWORD WINAPI GetNamedSecurityInfoExW( LPCWSTR object, SE_OBJECT_TYPE type,
5787     SECURITY_INFORMATION info, LPCWSTR provider, LPCWSTR property,
5788     PACTRL_ACCESSW* access_list, PACTRL_AUDITW* audit_list, LPWSTR* owner, LPWSTR* group )
5789 {
5790     FIXME("(%s, %d, %d, %s, %s, %p, %p, %p, %p) stub\n", debugstr_w(object), type, info,
5791         debugstr_w(provider), debugstr_w(property), access_list, audit_list, owner, group);
5792     return ERROR_CALL_NOT_IMPLEMENTED;
5793 }
5794
5795 /******************************************************************************
5796  * GetNamedSecurityInfoExA [ADVAPI32.@]
5797  */
5798 DWORD WINAPI GetNamedSecurityInfoExA( LPCSTR object, SE_OBJECT_TYPE type,
5799     SECURITY_INFORMATION info, LPCSTR provider, LPCSTR property,
5800     PACTRL_ACCESSA* access_list, PACTRL_AUDITA* audit_list, LPSTR* owner, LPSTR* group )
5801 {
5802     FIXME("(%s, %d, %d, %s, %s, %p, %p, %p, %p) stub\n", debugstr_a(object), type, info,
5803         debugstr_a(provider), debugstr_a(property), access_list, audit_list, owner, group);
5804     return ERROR_CALL_NOT_IMPLEMENTED;
5805 }
5806
5807 /******************************************************************************
5808  * DecryptFileW [ADVAPI32.@]
5809  */
5810 BOOL WINAPI DecryptFileW(LPCWSTR lpFileName, DWORD dwReserved)
5811 {
5812     FIXME("(%s, %08x): stub\n", debugstr_w(lpFileName), dwReserved);
5813     return TRUE;
5814 }
5815
5816 /******************************************************************************
5817  * DecryptFileA [ADVAPI32.@]
5818  */
5819 BOOL WINAPI DecryptFileA(LPCSTR lpFileName, DWORD dwReserved)
5820 {
5821     FIXME("(%s, %08x): stub\n", debugstr_a(lpFileName), dwReserved);
5822     return TRUE;
5823 }
5824
5825 /******************************************************************************
5826  * EncryptFileW [ADVAPI32.@]
5827  */
5828 BOOL WINAPI EncryptFileW(LPCWSTR lpFileName)
5829 {
5830     FIXME("(%s): stub\n", debugstr_w(lpFileName));
5831     return TRUE;
5832 }
5833
5834 /******************************************************************************
5835  * EncryptFileA [ADVAPI32.@]
5836  */
5837 BOOL WINAPI EncryptFileA(LPCSTR lpFileName)
5838 {
5839     FIXME("(%s): stub\n", debugstr_a(lpFileName));
5840     return TRUE;
5841 }
5842
5843 /******************************************************************************
5844  * FileEncryptionStatusW [ADVAPI32.@]
5845  */
5846 BOOL WINAPI FileEncryptionStatusW(LPCWSTR lpFileName, LPDWORD lpStatus)
5847 {
5848     FIXME("(%s %p): stub\n", debugstr_w(lpFileName), lpStatus);
5849     if (!lpStatus)
5850         return FALSE;
5851     *lpStatus = FILE_SYSTEM_NOT_SUPPORT;
5852     return TRUE;
5853 }
5854
5855 /******************************************************************************
5856  * FileEncryptionStatusA [ADVAPI32.@]
5857  */
5858 BOOL WINAPI FileEncryptionStatusA(LPCSTR lpFileName, LPDWORD lpStatus)
5859 {
5860     FIXME("(%s %p): stub\n", debugstr_a(lpFileName), lpStatus);
5861     if (!lpStatus)
5862         return FALSE;
5863     *lpStatus = FILE_SYSTEM_NOT_SUPPORT;
5864     return TRUE;
5865 }
5866
5867 /******************************************************************************
5868  * SetSecurityInfo [ADVAPI32.@]
5869  */
5870 DWORD WINAPI SetSecurityInfo(HANDLE handle, SE_OBJECT_TYPE ObjectType,
5871                       SECURITY_INFORMATION SecurityInfo, PSID psidOwner,
5872                       PSID psidGroup, PACL pDacl, PACL pSacl)
5873 {
5874     SECURITY_DESCRIPTOR sd;
5875     PACL dacl = pDacl;
5876     NTSTATUS status;
5877
5878     if (!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION))
5879         return ERROR_INVALID_SECURITY_DESCR;
5880
5881     if (SecurityInfo & OWNER_SECURITY_INFORMATION)
5882         SetSecurityDescriptorOwner(&sd, psidOwner, FALSE);
5883     if (SecurityInfo & GROUP_SECURITY_INFORMATION)
5884         SetSecurityDescriptorGroup(&sd, psidGroup, FALSE);
5885     if (SecurityInfo & DACL_SECURITY_INFORMATION)
5886     {
5887         if (ObjectType == SE_FILE_OBJECT && pDacl)
5888         {
5889             SECURITY_DESCRIPTOR_CONTROL control;
5890             PSECURITY_DESCRIPTOR psd;
5891             OBJECT_NAME_INFORMATION *name_info;
5892             DWORD size, rev;
5893
5894             status = NtQuerySecurityObject(handle, SecurityInfo, NULL, 0, &size);
5895             if (status != STATUS_BUFFER_TOO_SMALL)
5896                 return RtlNtStatusToDosError(status);
5897
5898             psd = heap_alloc(size);
5899             if (!psd)
5900                 return ERROR_NOT_ENOUGH_MEMORY;
5901
5902             status = NtQuerySecurityObject(handle, SecurityInfo, psd, size, &size);
5903             if (status)
5904             {
5905                 heap_free(psd);
5906                 return RtlNtStatusToDosError(status);
5907             }
5908
5909             status = RtlGetControlSecurityDescriptor(psd, &control, &rev);
5910             heap_free(psd);
5911             if (status)
5912                 return RtlNtStatusToDosError(status);
5913             /* TODO: copy some control flags to new sd */
5914
5915             /* inherit parent directory DACL */
5916             if (!(control & SE_DACL_PROTECTED))
5917             {
5918                 status = NtQueryObject(handle, ObjectNameInformation, NULL, 0, &size);
5919                 if (status != STATUS_INFO_LENGTH_MISMATCH)
5920                     return RtlNtStatusToDosError(status);
5921
5922                 name_info = heap_alloc(size);
5923                 if (!name_info)
5924                     return ERROR_NOT_ENOUGH_MEMORY;
5925
5926                 status = NtQueryObject(handle, ObjectNameInformation, name_info, size, NULL);
5927                 if (status)
5928                 {
5929                     heap_free(name_info);
5930                     return RtlNtStatusToDosError(status);
5931                 }
5932
5933                 for (name_info->Name.Length-=2; name_info->Name.Length>0; name_info->Name.Length-=2)
5934                     if (name_info->Name.Buffer[name_info->Name.Length/2-1]=='\\' ||
5935                             name_info->Name.Buffer[name_info->Name.Length/2-1]=='/')
5936                         break;
5937                 if (name_info->Name.Length)
5938                 {
5939                     OBJECT_ATTRIBUTES attr;
5940                     IO_STATUS_BLOCK io;
5941                     HANDLE parent;
5942                     PSECURITY_DESCRIPTOR parent_sd;
5943                     ACL *parent_dacl;
5944                     DWORD err = ERROR_ACCESS_DENIED;
5945
5946                     name_info->Name.Buffer[name_info->Name.Length/2] = 0;
5947
5948                     attr.Length = sizeof(attr);
5949                     attr.RootDirectory = 0;
5950                     attr.Attributes = 0;
5951                     attr.ObjectName = &name_info->Name;
5952                     attr.SecurityDescriptor = NULL;
5953                     status = NtOpenFile(&parent, READ_CONTROL|SYNCHRONIZE, &attr, &io,
5954                             FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
5955                             FILE_OPEN_FOR_BACKUP_INTENT);
5956                     heap_free(name_info);
5957                     if (!status)
5958                     {
5959                         err = GetSecurityInfo(parent, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
5960                                 NULL, NULL, &parent_dacl, NULL, &parent_sd);
5961                         CloseHandle(parent);
5962                     }
5963
5964                     if (!err)
5965                     {
5966                         int i;
5967
5968                         dacl = heap_alloc_zero(pDacl->AclSize+parent_dacl->AclSize);
5969                         if (!dacl)
5970                         {
5971                             LocalFree(parent_sd);
5972                             return ERROR_NOT_ENOUGH_MEMORY;
5973                         }
5974                         memcpy(dacl, pDacl, pDacl->AclSize);
5975                         dacl->AclSize = pDacl->AclSize+parent_dacl->AclSize;
5976
5977                         for (i=0; i<parent_dacl->AceCount; i++)
5978                         {
5979                             ACE_HEADER *ace;
5980
5981                             if (!GetAce(parent_dacl, i, (void*)&ace))
5982                                 continue;
5983                             if (!(ace->AceFlags & (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE)))
5984                                 continue;
5985                             if ((ace->AceFlags & (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE)) !=
5986                                     (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE))
5987                             {
5988                                 FIXME("unsupported flags: %x\n", ace->AceFlags);
5989                                 continue;
5990                             }
5991
5992                             if (ace->AceFlags & NO_PROPAGATE_INHERIT_ACE)
5993                                 ace->AceFlags &= ~(OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE|NO_PROPAGATE_INHERIT_ACE);
5994                             ace->AceFlags &= ~INHERIT_ONLY_ACE;
5995                             ace->AceFlags |= INHERITED_ACE;
5996
5997                             if(!AddAce(dacl, ACL_REVISION, MAXDWORD, ace, ace->AceSize))
5998                                 WARN("error adding inherited ACE\n");
5999                         }
6000                         LocalFree(parent_sd);
6001                     }
6002                 }
6003                 else
6004                     heap_free(name_info);
6005             }
6006         }
6007
6008         SetSecurityDescriptorDacl(&sd, TRUE, dacl, FALSE);
6009     }
6010     if (SecurityInfo & SACL_SECURITY_INFORMATION)
6011         SetSecurityDescriptorSacl(&sd, TRUE, pSacl, FALSE);
6012
6013     switch (ObjectType)
6014     {
6015     case SE_SERVICE:
6016         FIXME("stub: Service objects are not supported at this time.\n");
6017         status = STATUS_SUCCESS; /* Implement SetServiceObjectSecurity */
6018         break;
6019     default:
6020         status = NtSetSecurityObject(handle, SecurityInfo, &sd);
6021         break;
6022     }
6023     if (dacl != pDacl)
6024         heap_free(dacl);
6025     return RtlNtStatusToDosError(status);
6026 }
6027
6028 /******************************************************************************
6029  * SaferCreateLevel   [ADVAPI32.@]
6030  */
6031 BOOL WINAPI SaferCreateLevel(DWORD ScopeId, DWORD LevelId, DWORD OpenFlags,
6032                              SAFER_LEVEL_HANDLE* LevelHandle, LPVOID lpReserved)
6033 {
6034     FIXME("(%u, %x, %u, %p, %p) stub\n", ScopeId, LevelId, OpenFlags, LevelHandle, lpReserved);
6035
6036     *LevelHandle = (SAFER_LEVEL_HANDLE)0xdeadbeef;
6037     return TRUE;
6038 }
6039
6040 /******************************************************************************
6041  * SaferComputeTokenFromLevel   [ADVAPI32.@]
6042  */
6043 BOOL WINAPI SaferComputeTokenFromLevel(SAFER_LEVEL_HANDLE handle, HANDLE token, PHANDLE access_token,
6044                                        DWORD flags, LPVOID reserved)
6045 {
6046     FIXME("(%p, %p, %p, %x, %p) stub\n", handle, token, access_token, flags, reserved);
6047
6048     *access_token = (HANDLE)0xdeadbeef;
6049     return TRUE;
6050 }
6051
6052 /******************************************************************************
6053  * SaferCloseLevel   [ADVAPI32.@]
6054  */
6055 BOOL WINAPI SaferCloseLevel(SAFER_LEVEL_HANDLE handle)
6056 {
6057     FIXME("(%p) stub\n", handle);
6058     return TRUE;
6059 }
6060
6061 /******************************************************************************
6062  * TreeResetNamedSecurityInfoW   [ADVAPI32.@]
6063  */
6064 DWORD WINAPI TreeResetNamedSecurityInfoW( LPWSTR pObjectName,
6065                 SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
6066                 PSID pOwner, PSID pGroup, PACL pDacl, PACL pSacl,
6067                 BOOL KeepExplicit, FN_PROGRESS fnProgress,
6068                 PROG_INVOKE_SETTING ProgressInvokeSetting, PVOID Args)
6069 {
6070     FIXME("(%s, %i, %i, %p, %p, %p, %p, %i, %p, %i, %p) stub\n",
6071         debugstr_w(pObjectName), ObjectType, SecurityInfo, pOwner, pGroup,
6072         pDacl, pSacl, KeepExplicit, fnProgress, ProgressInvokeSetting, Args);
6073
6074     return ERROR_SUCCESS;
6075 }
6076
6077 /******************************************************************************
6078  * SaferGetPolicyInformation   [ADVAPI32.@]
6079  */
6080 BOOL WINAPI SaferGetPolicyInformation(DWORD scope, SAFER_POLICY_INFO_CLASS class, DWORD size,
6081                                       PVOID buffer, PDWORD required, LPVOID lpReserved)
6082 {
6083     FIXME("(%u %u %u %p %p %p) stub\n", scope, class, size, buffer, required, lpReserved);
6084     return FALSE;
6085 }
6086
6087 /******************************************************************************
6088  * SaferSetLevelInformation   [ADVAPI32.@]
6089  */
6090 BOOL WINAPI SaferSetLevelInformation(SAFER_LEVEL_HANDLE handle, SAFER_OBJECT_INFO_CLASS infotype,
6091                                      LPVOID buffer, DWORD size)
6092 {
6093     FIXME("(%p %u %p %u) stub\n", handle, infotype, buffer, size);
6094     return FALSE;
6095 }
6096
6097 /******************************************************************************
6098  * LookupSecurityDescriptorPartsA   [ADVAPI32.@]
6099  */
6100 DWORD WINAPI LookupSecurityDescriptorPartsA(TRUSTEEA *owner, TRUSTEEA *group, ULONG *access_count,
6101                                             EXPLICIT_ACCESSA *access_list, ULONG *audit_count,
6102                                             EXPLICIT_ACCESSA *audit_list, SECURITY_DESCRIPTOR *descriptor)
6103 {
6104     FIXME("(%p %p %p %p %p %p %p) stub\n", owner, group, access_count,
6105           access_list, audit_count, audit_list, descriptor);
6106     return ERROR_CALL_NOT_IMPLEMENTED;
6107 }
6108
6109 /******************************************************************************
6110  * LookupSecurityDescriptorPartsW   [ADVAPI32.@]
6111  */
6112 DWORD WINAPI LookupSecurityDescriptorPartsW(TRUSTEEW *owner, TRUSTEEW *group, ULONG *access_count,
6113                                             EXPLICIT_ACCESSW *access_list, ULONG *audit_count,
6114                                             EXPLICIT_ACCESSW *audit_list, SECURITY_DESCRIPTOR *descriptor)
6115 {
6116     FIXME("(%p %p %p %p %p %p %p) stub\n", owner, group, access_count,
6117           access_list, audit_count, audit_list, descriptor);
6118     return ERROR_CALL_NOT_IMPLEMENTED;
6119 }