?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ntdll/tests: Remove an accidental, unused macro in arm64 exception tests.
[wine.git] / server / token.c
blob820a7a0e07da62616d2a244b389f8614bb1ae568
1 /*
2 * Tokens
3 *
4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 */
22
23 #include "config.h"
24
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <stdarg.h>
29 #include <sys/types.h>
30 #include <unistd.h>
31
32 #include "ntstatus.h"
33 #define WIN32_NO_STATUS
34 #include "windef.h"
35 #include "winternl.h"
36
37 #include "handle.h"
38 #include "thread.h"
39 #include "process.h"
40 #include "request.h"
41 #include "security.h"
42
43 #define MAX_SUBAUTH_COUNT 1
44
45 const LUID SeIncreaseQuotaPrivilege = { 5, 0 };
46 const LUID SeTcbPrivilege = { 7, 0 };
47 const LUID SeSecurityPrivilege = { 8, 0 };
48 const LUID SeTakeOwnershipPrivilege = { 9, 0 };
49 const LUID SeLoadDriverPrivilege = { 10, 0 };
50 const LUID SeSystemProfilePrivilege = { 11, 0 };
51 const LUID SeSystemtimePrivilege = { 12, 0 };
52 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
53 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
54 const LUID SeCreatePagefilePrivilege = { 15, 0 };
55 const LUID SeBackupPrivilege = { 17, 0 };
56 const LUID SeRestorePrivilege = { 18, 0 };
57 const LUID SeShutdownPrivilege = { 19, 0 };
58 const LUID SeDebugPrivilege = { 20, 0 };
59 const LUID SeSystemEnvironmentPrivilege = { 22, 0 };
60 const LUID SeChangeNotifyPrivilege = { 23, 0 };
61 const LUID SeRemoteShutdownPrivilege = { 24, 0 };
62 const LUID SeUndockPrivilege = { 25, 0 };
63 const LUID SeManageVolumePrivilege = { 28, 0 };
64 const LUID SeImpersonatePrivilege = { 29, 0 };
65 const LUID SeCreateGlobalPrivilege = { 30, 0 };
66
67 #define SID_N(n) struct /* same fields as struct SID */ \
68 { \
69 BYTE Revision; \
70 BYTE SubAuthorityCount; \
71 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
72 DWORD SubAuthority[n]; \
73 }
74
75 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
76 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
77 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
78 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
79 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
80 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
81 static const SID high_label_sid = { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY }, { SECURITY_MANDATORY_HIGH_RID } };
82 static const SID_N(5) local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
83 static const SID_N(2) builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
84 static const SID_N(2) builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
85 static const SID_N(3) builtin_logon_sid = { SID_REVISION, 3, { SECURITY_NT_AUTHORITY }, { SECURITY_LOGON_IDS_RID, 0, 0 } };
86 static const SID_N(5) domain_users_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, DOMAIN_GROUP_RID_USERS } };
87
88 const PSID security_world_sid = (PSID)&world_sid;
89 static const PSID security_local_sid = (PSID)&local_sid;
90 static const PSID security_interactive_sid = (PSID)&interactive_sid;
91 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
92 const PSID security_local_system_sid = (PSID)&local_system_sid;
93 const PSID security_local_user_sid = (PSID)&local_user_sid;
94 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
95 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
96 const PSID security_domain_users_sid = (PSID)&domain_users_sid;
97 const PSID security_high_label_sid = (PSID)&high_label_sid;
98
99 static luid_t prev_luid_value = { 1000, 0 };
100
101 static const WCHAR token_name[] = {'T','o','k','e','n'};
102
103 struct type_descr token_type =
104 {
105 { token_name, sizeof(token_name) }, /* name */
106 TOKEN_ALL_ACCESS | SYNCHRONIZE, /* valid_access */
107 { /* mapping */
108 STANDARD_RIGHTS_READ | TOKEN_QUERY_SOURCE | TOKEN_QUERY | TOKEN_DUPLICATE,
109 STANDARD_RIGHTS_WRITE | TOKEN_ADJUST_SESSIONID | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_GROUPS
110 | TOKEN_ADJUST_PRIVILEGES,
111 STANDARD_RIGHTS_EXECUTE | TOKEN_IMPERSONATE | TOKEN_ASSIGN_PRIMARY,
112 TOKEN_ALL_ACCESS
113 },
114 };
115
116 struct token
117 {
118 struct object obj; /* object header */
119 luid_t token_id; /* system-unique id of token */
120 luid_t modified_id; /* new id allocated every time token is modified */
121 struct list privileges; /* privileges available to the token */
122 struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
123 SID *user; /* SID of user this token represents */
124 SID *owner; /* SID of owner (points to user or one of groups) */
125 SID *primary_group; /* SID of user's primary group (points to one of groups) */
126 unsigned int primary; /* is this a primary or impersonation token? */
127 unsigned int session_id; /* token session id */
128 ACL *default_dacl; /* the default DACL to assign to objects created by this user */
129 TOKEN_SOURCE source; /* source of the token */
130 int impersonation_level; /* impersonation level this token is capable of if non-primary token */
131 int elevation; /* elevation type */
132 };
133
134 struct privilege
135 {
136 struct list entry;
137 LUID luid;
138 unsigned enabled : 1; /* is the privilege currently enabled? */
139 unsigned def : 1; /* is the privilege enabled by default? */
140 };
141
142 struct group
143 {
144 struct list entry;
145 unsigned enabled : 1; /* is the sid currently enabled? */
146 unsigned def : 1; /* is the sid enabled by default? */
147 unsigned logon : 1; /* is this a logon sid? */
148 unsigned mandatory: 1; /* is this sid always enabled? */
149 unsigned owner : 1; /* can this sid be an owner of an object? */
150 unsigned resource : 1; /* is this a domain-local group? */
151 unsigned deny_only: 1; /* is this a sid that should be use for denying only? */
152 SID sid;
153 };
154
155 static void token_dump( struct object *obj, int verbose );
156 static void token_destroy( struct object *obj );
157
158 static const struct object_ops token_ops =
159 {
160 sizeof(struct token), /* size */
161 &token_type, /* type */
162 token_dump, /* dump */
163 no_add_queue, /* add_queue */
164 NULL, /* remove_queue */
165 NULL, /* signaled */
166 NULL, /* satisfied */
167 no_signal, /* signal */
168 no_get_fd, /* get_fd */
169 default_map_access, /* map_access */
170 default_get_sd, /* get_sd */
171 default_set_sd, /* set_sd */
172 no_get_full_name, /* get_full_name */
173 no_lookup_name, /* lookup_name */
174 no_link_name, /* link_name */
175 NULL, /* unlink_name */
176 no_open_file, /* open_file */
177 no_kernel_obj_list, /* get_kernel_obj_list */
178 no_close_handle, /* close_handle */
179 token_destroy /* destroy */
180 };
181
182 static void token_dump( struct object *obj, int verbose )
183 {
184 struct token *token = (struct token *)obj;
185 assert( obj->ops == &token_ops );
186 fprintf( stderr, "Token id=%d.%u primary=%u impersonation level=%d\n", token->token_id.high_part,
187 token->token_id.low_part, token->primary, token->impersonation_level );
188 }
189
190 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
191 {
192 int i;
193 SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
194 if (!sid) return NULL;
195 sid->Revision = SID_REVISION;
196 sid->SubAuthorityCount = subauthcount;
197 sid->IdentifierAuthority = *idauthority;
198 for (i = 0; i < subauthcount; i++)
199 sid->SubAuthority[i] = subauth[i];
200 return sid;
201 }
202
203 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
204 {
205 if (!handle)
206 {
207 if (thread->token)
208 release_object( thread->token );
209 thread->token = NULL;
210 }
211 else
212 {
213 struct token *token = (struct token *)get_handle_obj( current->process,
214 handle,
215 TOKEN_IMPERSONATE,
216 &token_ops );
217 if (token)
218 {
219 if (thread->token)
220 release_object( thread->token );
221 thread->token = token;
222 }
223 }
224 }
225
226 const SID *security_unix_uid_to_sid( uid_t uid )
227 {
228 /* very simple mapping: either the current user or not the current user */
229 if (uid == getuid())
230 return (const SID *)&local_user_sid;
231 else
232 return &anonymous_logon_sid;
233 }
234
235 static int acl_is_valid( const ACL *acl, data_size_t size )
236 {
237 ULONG i;
238 const ACE_HEADER *ace;
239
240 if (size < sizeof(ACL))
241 return FALSE;
242
243 size = min(size, MAX_ACL_LEN);
244
245 size -= sizeof(ACL);
246
247 ace = (const ACE_HEADER *)(acl + 1);
248 for (i = 0; i < acl->AceCount; i++)
249 {
250 const SID *sid;
251 data_size_t sid_size;
252
253 if (size < sizeof(ACE_HEADER))
254 return FALSE;
255 if (size < ace->AceSize)
256 return FALSE;
257 size -= ace->AceSize;
258 switch (ace->AceType)
259 {
260 case ACCESS_DENIED_ACE_TYPE:
261 sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
262 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
263 break;
264 case ACCESS_ALLOWED_ACE_TYPE:
265 sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
266 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
267 break;
268 case SYSTEM_AUDIT_ACE_TYPE:
269 sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
270 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
271 break;
272 case SYSTEM_ALARM_ACE_TYPE:
273 sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
274 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
275 break;
276 case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
277 sid = (const SID *)&((const SYSTEM_MANDATORY_LABEL_ACE *)ace)->SidStart;
278 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart);
279 break;
280 default:
281 return FALSE;
282 }
283 if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
284 return FALSE;
285 ace = ace_next( ace );
286 }
287 return TRUE;
288 }
289
290 static unsigned int get_sid_count( const SID *sid, data_size_t size )
291 {
292 unsigned int count;
293
294 for (count = 0; size >= sizeof(SID) && security_sid_len( sid ) <= size; count++)
295 {
296 size -= security_sid_len( sid );
297 sid = (const SID *)((char *)sid + security_sid_len( sid ));
298 }
299
300 return count;
301 }
302
303 /* checks whether all members of a security descriptor fit inside the size
304 * of memory specified */
305 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
306 {
307 size_t offset = sizeof(struct security_descriptor);
308 const SID *group;
309 const SID *owner;
310 const ACL *sacl;
311 const ACL *dacl;
312 int dummy;
313
314 if (size < offset)
315 return FALSE;
316
317 if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
318 (offset + sd->owner_len > size))
319 return FALSE;
320 owner = sd_get_owner( sd );
321 if (owner)
322 {
323 if ((sd->owner_len < sizeof(SID)) || (security_sid_len( owner ) > sd->owner_len))
324 return FALSE;
325 }
326 offset += sd->owner_len;
327
328 if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
329 (offset + sd->group_len > size))
330 return FALSE;
331 group = sd_get_group( sd );
332 if (group)
333 {
334 if ((sd->group_len < sizeof(SID)) || (security_sid_len( group ) > sd->group_len))
335 return FALSE;
336 }
337 offset += sd->group_len;
338
339 if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
340 return FALSE;
341 sacl = sd_get_sacl( sd, &dummy );
342 if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
343 return FALSE;
344 offset += sd->sacl_len;
345
346 if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
347 return FALSE;
348 dacl = sd_get_dacl( sd, &dummy );
349 if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
350 return FALSE;
351 offset += sd->dacl_len;
352
353 return TRUE;
354 }
355
356 /* extract security labels from SACL */
357 ACL *extract_security_labels( const ACL *sacl )
358 {
359 size_t size = sizeof(ACL);
360 const ACE_HEADER *ace;
361 ACE_HEADER *label_ace;
362 unsigned int i, count = 0;
363 ACL *label_acl;
364
365 ace = (const ACE_HEADER *)(sacl + 1);
366 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
367 {
368 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
369 {
370 size += ace->AceSize;
371 count++;
372 }
373 }
374
375 label_acl = mem_alloc( size );
376 if (!label_acl) return NULL;
377
378 label_acl->AclRevision = sacl->AclRevision;
379 label_acl->Sbz1 = 0;
380 label_acl->AclSize = size;
381 label_acl->AceCount = count;
382 label_acl->Sbz2 = 0;
383 label_ace = (ACE_HEADER *)(label_acl + 1);
384
385 ace = (const ACE_HEADER *)(sacl + 1);
386 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
387 {
388 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
389 {
390 memcpy( label_ace, ace, ace->AceSize );
391 label_ace = (ACE_HEADER *)ace_next( label_ace );
392 }
393 }
394 return label_acl;
395 }
396
397 /* replace security labels in an existing SACL */
398 ACL *replace_security_labels( const ACL *old_sacl, const ACL *new_sacl )
399 {
400 const ACE_HEADER *ace;
401 ACE_HEADER *replaced_ace;
402 size_t size = sizeof(ACL);
403 unsigned int i, count = 0;
404 BYTE revision = ACL_REVISION;
405 ACL *replaced_acl;
406
407 if (old_sacl)
408 {
409 revision = max( revision, old_sacl->AclRevision );
410 ace = (const ACE_HEADER *)(old_sacl + 1);
411 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
412 {
413 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
414 size += ace->AceSize;
415 count++;
416 }
417 }
418
419 if (new_sacl)
420 {
421 revision = max( revision, new_sacl->AclRevision );
422 ace = (const ACE_HEADER *)(new_sacl + 1);
423 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
424 {
425 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
426 size += ace->AceSize;
427 count++;
428 }
429 }
430
431 replaced_acl = mem_alloc( size );
432 if (!replaced_acl) return NULL;
433
434 replaced_acl->AclRevision = revision;
435 replaced_acl->Sbz1 = 0;
436 replaced_acl->AclSize = size;
437 replaced_acl->AceCount = count;
438 replaced_acl->Sbz2 = 0;
439 replaced_ace = (ACE_HEADER *)(replaced_acl + 1);
440
441 if (old_sacl)
442 {
443 ace = (const ACE_HEADER *)(old_sacl + 1);
444 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
445 {
446 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
447 memcpy( replaced_ace, ace, ace->AceSize );
448 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
449 }
450 }
451
452 if (new_sacl)
453 {
454 ace = (const ACE_HEADER *)(new_sacl + 1);
455 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
456 {
457 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
458 memcpy( replaced_ace, ace, ace->AceSize );
459 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
460 }
461 }
462
463 return replaced_acl;
464 }
465
466 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
467 {
468 return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
469 }
470
471 static inline void allocate_luid( luid_t *luid )
472 {
473 prev_luid_value.low_part++;
474 *luid = prev_luid_value;
475 }
476
477 DECL_HANDLER( allocate_locally_unique_id )
478 {
479 allocate_luid( &reply->luid );
480 }
481
482 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
483 {
484 out->Luid = in->luid;
485 out->Attributes =
486 (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
487 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
488 }
489
490 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
491 {
492 struct privilege *privilege = mem_alloc( sizeof(*privilege) );
493 if (privilege)
494 {
495 privilege->luid = *luid;
496 privilege->def = privilege->enabled = (enabled != 0);
497 list_add_tail( &token->privileges, &privilege->entry );
498 }
499 return privilege;
500 }
501
502 static inline void privilege_remove( struct privilege *privilege )
503 {
504 list_remove( &privilege->entry );
505 free( privilege );
506 }
507
508 static void token_destroy( struct object *obj )
509 {
510 struct token* token;
511 struct list *cursor, *cursor_next;
512
513 assert( obj->ops == &token_ops );
514 token = (struct token *)obj;
515
516 free( token->user );
517
518 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
519 {
520 struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
521 privilege_remove( privilege );
522 }
523
524 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
525 {
526 struct group *group = LIST_ENTRY( cursor, struct group, entry );
527 list_remove( &group->entry );
528 free( group );
529 }
530
531 free( token->default_dacl );
532 }
533
534 /* creates a new token.
535 * groups may be NULL if group_count is 0.
536 * privs may be NULL if priv_count is 0.
537 * default_dacl may be NULL, indicating that all objects created by the user
538 * are unsecured.
539 * modified_id may be NULL, indicating that a new modified_id luid should be
540 * allocated.
541 */
542 static struct token *create_token( unsigned int primary, unsigned int session_id, const SID *user,
543 const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
544 const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
545 const ACL *default_dacl, TOKEN_SOURCE source,
546 const luid_t *modified_id,
547 int impersonation_level, int elevation )
548 {
549 struct token *token = alloc_object( &token_ops );
550 if (token)
551 {
552 unsigned int i;
553
554 allocate_luid( &token->token_id );
555 if (modified_id)
556 token->modified_id = *modified_id;
557 else
558 allocate_luid( &token->modified_id );
559 list_init( &token->privileges );
560 list_init( &token->groups );
561 token->primary = primary;
562 token->session_id = session_id;
563 /* primary tokens don't have impersonation levels */
564 if (primary)
565 token->impersonation_level = -1;
566 else
567 token->impersonation_level = impersonation_level;
568 token->default_dacl = NULL;
569 token->primary_group = NULL;
570 token->elevation = elevation;
571
572 /* copy user */
573 token->user = memdup( user, security_sid_len( user ));
574 if (!token->user)
575 {
576 release_object( token );
577 return NULL;
578 }
579
580 /* copy groups */
581 for (i = 0; i < group_count; i++)
582 {
583 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
584 struct group *group = mem_alloc( size );
585
586 if (!group)
587 {
588 release_object( token );
589 return NULL;
590 }
591 memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
592 group->enabled = TRUE;
593 group->def = TRUE;
594 group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
595 group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
596 group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
597 group->resource = FALSE;
598 group->deny_only = FALSE;
599 list_add_tail( &token->groups, &group->entry );
600 /* Use first owner capable group as owner and primary group */
601 if (!token->primary_group && group->owner)
602 {
603 token->owner = &group->sid;
604 token->primary_group = &group->sid;
605 }
606 }
607
608 /* copy privileges */
609 for (i = 0; i < priv_count; i++)
610 {
611 /* note: we don't check uniqueness: the caller must make sure
612 * privs doesn't contain any duplicate luids */
613 if (!privilege_add( token, &privs[i].Luid,
614 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
615 {
616 release_object( token );
617 return NULL;
618 }
619 }
620
621 if (default_dacl)
622 {
623 token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
624 if (!token->default_dacl)
625 {
626 release_object( token );
627 return NULL;
628 }
629 }
630
631 token->source = source;
632 }
633 return token;
634 }
635
636 static int filter_group( struct group *group, const SID *filter, unsigned int count )
637 {
638 unsigned int i;
639
640 for (i = 0; i < count; i++)
641 {
642 if (security_equal_sid( &group->sid, filter )) return 1;
643 filter = (const SID *)((char *)filter + security_sid_len( filter ));
644 }
645
646 return 0;
647 }
648
649 static int filter_privilege( struct privilege *privilege, const LUID_AND_ATTRIBUTES *filter, unsigned int count )
650 {
651 unsigned int i;
652
653 for (i = 0; i < count; i++)
654 {
655 if (!memcmp( &privilege->luid, &filter[i].Luid, sizeof(LUID) ))
656 return 1;
657 }
658
659 return 0;
660 }
661
662 struct token *token_duplicate( struct token *src_token, unsigned primary,
663 int impersonation_level, const struct security_descriptor *sd,
664 const LUID_AND_ATTRIBUTES *remove_privs, unsigned int remove_priv_count,
665 const SID *remove_groups, unsigned int remove_group_count)
666 {
667 const luid_t *modified_id =
668 primary || (impersonation_level == src_token->impersonation_level) ?
669 &src_token->modified_id : NULL;
670 struct token *token = NULL;
671 struct privilege *privilege;
672 struct group *group;
673
674 if (!primary &&
675 (impersonation_level < SecurityAnonymous ||
676 impersonation_level > SecurityDelegation ||
677 (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
678 {
679 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
680 return NULL;
681 }
682
683 token = create_token( primary, src_token->session_id, src_token->user, NULL, 0,
684 NULL, 0, src_token->default_dacl,
685 src_token->source, modified_id,
686 impersonation_level, src_token->elevation );
687 if (!token) return token;
688
689 /* copy groups */
690 token->primary_group = NULL;
691 LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
692 {
693 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
694 struct group *newgroup = mem_alloc( size );
695 if (!newgroup)
696 {
697 release_object( token );
698 return NULL;
699 }
700 memcpy( newgroup, group, size );
701 if (filter_group( group, remove_groups, remove_group_count ))
702 {
703 newgroup->enabled = 0;
704 newgroup->def = 0;
705 newgroup->deny_only = 1;
706 }
707 list_add_tail( &token->groups, &newgroup->entry );
708 if (src_token->primary_group == &group->sid)
709 {
710 token->owner = &newgroup->sid;
711 token->primary_group = &newgroup->sid;
712 }
713 }
714 assert( token->primary_group );
715
716 /* copy privileges */
717 LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
718 {
719 if (filter_privilege( privilege, remove_privs, remove_priv_count )) continue;
720 if (!privilege_add( token, &privilege->luid, privilege->enabled ))
721 {
722 release_object( token );
723 return NULL;
724 }
725 }
726
727 if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
728 DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
729
730 return token;
731 }
732
733 static ACL *create_default_dacl( const SID *user )
734 {
735 ACCESS_ALLOWED_ACE *aaa;
736 ACL *default_dacl;
737 SID *sid;
738 size_t default_dacl_size = sizeof(ACL) +
739 2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
740 sizeof(local_system_sid) +
741 security_sid_len( user );
742
743 default_dacl = mem_alloc( default_dacl_size );
744 if (!default_dacl) return NULL;
745
746 default_dacl->AclRevision = ACL_REVISION;
747 default_dacl->Sbz1 = 0;
748 default_dacl->AclSize = default_dacl_size;
749 default_dacl->AceCount = 2;
750 default_dacl->Sbz2 = 0;
751
752 /* GENERIC_ALL for Local System */
753 aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
754 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
755 aaa->Header.AceFlags = 0;
756 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
757 sizeof(local_system_sid);
758 aaa->Mask = GENERIC_ALL;
759 sid = (SID *)&aaa->SidStart;
760 memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
761
762 /* GENERIC_ALL for specified user */
763 aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
764 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
765 aaa->Header.AceFlags = 0;
766 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
767 aaa->Mask = GENERIC_ALL;
768 sid = (SID *)&aaa->SidStart;
769 memcpy( sid, user, security_sid_len( user ));
770
771 return default_dacl;
772 }
773
774 struct sid_data
775 {
776 SID_IDENTIFIER_AUTHORITY idauth;
777 int count;
778 unsigned int subauth[MAX_SUBAUTH_COUNT];
779 };
780
781 static struct security_descriptor *create_security_label_sd( struct token *token, PSID label_sid )
782 {
783 size_t sid_len = security_sid_len( label_sid ), sacl_size, sd_size;
784 SYSTEM_MANDATORY_LABEL_ACE *smla;
785 struct security_descriptor *sd;
786 ACL *sacl;
787
788 sacl_size = sizeof(ACL) + FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
789 sd_size = sizeof(struct security_descriptor) + sacl_size;
790 if (!(sd = mem_alloc( sd_size )))
791 return NULL;
792
793 sd->control = SE_SACL_PRESENT;
794 sd->owner_len = 0;
795 sd->group_len = 0;
796 sd->sacl_len = sacl_size;
797 sd->dacl_len = 0;
798
799 sacl = (ACL *)(sd + 1);
800 sacl->AclRevision = ACL_REVISION;
801 sacl->Sbz1 = 0;
802 sacl->AclSize = sacl_size;
803 sacl->AceCount = 1;
804 sacl->Sbz2 = 0;
805
806 smla = (SYSTEM_MANDATORY_LABEL_ACE *)(sacl + 1);
807 smla->Header.AceType = SYSTEM_MANDATORY_LABEL_ACE_TYPE;
808 smla->Header.AceFlags = 0;
809 smla->Header.AceSize = FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
810 smla->Mask = SYSTEM_MANDATORY_LABEL_NO_WRITE_UP;
811 memcpy( &smla->SidStart, label_sid, sid_len );
812
813 assert( sd_is_valid( sd, sd_size ) );
814 return sd;
815 }
816
817 int token_assign_label( struct token *token, PSID label )
818 {
819 struct security_descriptor *sd;
820 int ret = 0;
821
822 if ((sd = create_security_label_sd( token, label )))
823 {
824 ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
825 free( sd );
826 }
827
828 return ret;
829 }
830
831 struct token *get_token_obj( struct process *process, obj_handle_t handle, unsigned int access )
832 {
833 return (struct token *)get_handle_obj( process, handle, access, &token_ops );
834 }
835
836 struct token *token_create_admin( unsigned primary, int impersonation_level, int elevation, unsigned int session_id )
837 {
838 struct token *token = NULL;
839 static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
840 static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
841 static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
842 /* on Windows, this value changes every time the user logs on */
843 static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
844 PSID alias_admins_sid;
845 PSID alias_users_sid;
846 PSID logon_sid;
847 const SID *user_sid = security_unix_uid_to_sid( getuid() );
848 ACL *default_dacl = create_default_dacl( user_sid );
849
850 alias_admins_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_admins_subauth ),
851 alias_admins_subauth );
852 alias_users_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_users_subauth ),
853 alias_users_subauth );
854 logon_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( logon_subauth ), logon_subauth );
855
856 if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
857 {
858 const LUID_AND_ATTRIBUTES admin_privs[] =
859 {
860 { SeChangeNotifyPrivilege , SE_PRIVILEGE_ENABLED },
861 { SeTcbPrivilege , 0 },
862 { SeSecurityPrivilege , 0 },
863 { SeBackupPrivilege , 0 },
864 { SeRestorePrivilege , 0 },
865 { SeSystemtimePrivilege , 0 },
866 { SeShutdownPrivilege , 0 },
867 { SeRemoteShutdownPrivilege , 0 },
868 { SeTakeOwnershipPrivilege , 0 },
869 { SeDebugPrivilege , 0 },
870 { SeSystemEnvironmentPrivilege , 0 },
871 { SeSystemProfilePrivilege , 0 },
872 { SeProfileSingleProcessPrivilege, 0 },
873 { SeIncreaseBasePriorityPrivilege, 0 },
874 { SeLoadDriverPrivilege , SE_PRIVILEGE_ENABLED },
875 { SeCreatePagefilePrivilege , 0 },
876 { SeIncreaseQuotaPrivilege , 0 },
877 { SeUndockPrivilege , 0 },
878 { SeManageVolumePrivilege , 0 },
879 { SeImpersonatePrivilege , SE_PRIVILEGE_ENABLED },
880 { SeCreateGlobalPrivilege , SE_PRIVILEGE_ENABLED },
881 };
882 /* note: we don't include non-builtin groups here for the user -
883 * telling us these is the job of a client-side program */
884 const SID_AND_ATTRIBUTES admin_groups[] =
885 {
886 { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
887 { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
888 { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
889 { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
890 { security_domain_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
891 { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
892 { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
893 { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
894 };
895 static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
896 token = create_token( primary, session_id, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
897 admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
898 admin_source, NULL, impersonation_level, elevation );
899 /* we really need a primary group */
900 assert( token->primary_group );
901 }
902
903 free( logon_sid );
904 free( alias_admins_sid );
905 free( alias_users_sid );
906 free( default_dacl );
907
908 return token;
909 }
910
911 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
912 {
913 struct privilege *privilege;
914 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
915 {
916 if (is_equal_luid( luid, &privilege->luid ))
917 {
918 if (enabled_only && !privilege->enabled)
919 return NULL;
920 return privilege;
921 }
922 }
923 return NULL;
924 }
925
926 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
927 unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
928 unsigned int mod_privs_count )
929 {
930 unsigned int i, modified_count = 0;
931
932 /* mark as modified */
933 allocate_luid( &token->modified_id );
934
935 for (i = 0; i < count; i++)
936 {
937 struct privilege *privilege =
938 token_find_privilege( token, &privs[i].Luid, FALSE );
939 if (!privilege)
940 {
941 set_error( STATUS_NOT_ALL_ASSIGNED );
942 continue;
943 }
944
945 if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
946 privilege_remove( privilege );
947 else
948 {
949 /* save previous state for caller */
950 if (mod_privs_count)
951 {
952 luid_and_attr_from_privilege(mod_privs, privilege);
953 mod_privs++;
954 mod_privs_count--;
955 modified_count++;
956 }
957
958 if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
959 privilege->enabled = TRUE;
960 else
961 privilege->enabled = FALSE;
962 }
963 }
964 return modified_count;
965 }
966
967 static void token_disable_privileges( struct token *token )
968 {
969 struct privilege *privilege;
970
971 /* mark as modified */
972 allocate_luid( &token->modified_id );
973
974 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
975 privilege->enabled = FALSE;
976 }
977
978 int token_check_privileges( struct token *token, int all_required,
979 const LUID_AND_ATTRIBUTES *reqprivs,
980 unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
981 {
982 unsigned int i, enabled_count = 0;
983
984 for (i = 0; i < count; i++)
985 {
986 struct privilege *privilege =
987 token_find_privilege( token, &reqprivs[i].Luid, TRUE );
988
989 if (usedprivs)
990 usedprivs[i] = reqprivs[i];
991
992 if (privilege && privilege->enabled)
993 {
994 enabled_count++;
995 if (usedprivs)
996 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
997 }
998 }
999
1000 if (all_required)
1001 return (enabled_count == count);
1002 else
1003 return (enabled_count > 0);
1004 }
1005
1006 int token_sid_present( struct token *token, const SID *sid, int deny )
1007 {
1008 struct group *group;
1009
1010 if (security_equal_sid( token->user, sid )) return TRUE;
1011
1012 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
1013 {
1014 if (!group->enabled) continue;
1015 if (group->deny_only && !deny) continue;
1016
1017 if (security_equal_sid( &group->sid, sid )) return TRUE;
1018 }
1019
1020 return FALSE;
1021 }
1022
1023 /* Checks access to a security descriptor. 'sd' must have been validated by
1024 * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
1025 * the reason. 'status' parameter will indicate if access is granted or denied.
1026 *
1027 * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
1028 */
1029 static unsigned int token_access_check( struct token *token,
1030 const struct security_descriptor *sd,
1031 unsigned int desired_access,
1032 LUID_AND_ATTRIBUTES *privs,
1033 unsigned int *priv_count,
1034 const generic_map_t *mapping,
1035 unsigned int *granted_access,
1036 unsigned int *status )
1037 {
1038 unsigned int current_access = 0;
1039 unsigned int denied_access = 0;
1040 ULONG i;
1041 const ACL *dacl;
1042 int dacl_present;
1043 const ACE_HEADER *ace;
1044 const SID *owner;
1045
1046 /* assume no access rights */
1047 *granted_access = 0;
1048
1049 /* fail if desired_access contains generic rights */
1050 if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
1051 {
1052 if (priv_count) *priv_count = 0;
1053 return STATUS_GENERIC_NOT_MAPPED;
1054 }
1055
1056 dacl = sd_get_dacl( sd, &dacl_present );
1057 owner = sd_get_owner( sd );
1058 if (!owner || !sd_get_group( sd ))
1059 {
1060 if (priv_count) *priv_count = 0;
1061 return STATUS_INVALID_SECURITY_DESCR;
1062 }
1063
1064 /* 1: Grant desired access if the object is unprotected */
1065 if (!dacl_present || !dacl)
1066 {
1067 if (priv_count) *priv_count = 0;
1068 if (desired_access & MAXIMUM_ALLOWED)
1069 *granted_access = mapping->all;
1070 else
1071 *granted_access = desired_access;
1072 return *status = STATUS_SUCCESS;
1073 }
1074
1075 /* 2: Check if caller wants access to system security part. Note: access
1076 * is only granted if specifically asked for */
1077 if (desired_access & ACCESS_SYSTEM_SECURITY)
1078 {
1079 const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
1080 LUID_AND_ATTRIBUTES retpriv = security_priv;
1081 if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
1082 {
1083 if (priv_count)
1084 {
1085 /* assumes that there will only be one privilege to return */
1086 if (*priv_count >= 1)
1087 {
1088 *priv_count = 1;
1089 *privs = retpriv;
1090 }
1091 else
1092 {
1093 *priv_count = 1;
1094 return STATUS_BUFFER_TOO_SMALL;
1095 }
1096 }
1097 current_access |= ACCESS_SYSTEM_SECURITY;
1098 if (desired_access == current_access)
1099 {
1100 *granted_access = current_access;
1101 return *status = STATUS_SUCCESS;
1102 }
1103 }
1104 else
1105 {
1106 if (priv_count) *priv_count = 0;
1107 *status = STATUS_PRIVILEGE_NOT_HELD;
1108 return STATUS_SUCCESS;
1109 }
1110 }
1111 else if (priv_count) *priv_count = 0;
1112
1113 /* 3: Check whether the token is the owner */
1114 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
1115 * checked when a "set owner" call is made, overriding the access rights
1116 * determined here. */
1117 if (token_sid_present( token, owner, FALSE ))
1118 {
1119 current_access |= (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE);
1120 if (desired_access == current_access)
1121 {
1122 *granted_access = current_access;
1123 return *status = STATUS_SUCCESS;
1124 }
1125 }
1126
1127 /* 4: Grant rights according to the DACL */
1128 ace = (const ACE_HEADER *)(dacl + 1);
1129 for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
1130 {
1131 const ACCESS_ALLOWED_ACE *aa_ace;
1132 const ACCESS_DENIED_ACE *ad_ace;
1133 const SID *sid;
1134
1135 if (ace->AceFlags & INHERIT_ONLY_ACE)
1136 continue;
1137
1138 switch (ace->AceType)
1139 {
1140 case ACCESS_DENIED_ACE_TYPE:
1141 ad_ace = (const ACCESS_DENIED_ACE *)ace;
1142 sid = (const SID *)&ad_ace->SidStart;
1143 if (token_sid_present( token, sid, TRUE ))
1144 {
1145 unsigned int access = map_access( ad_ace->Mask, mapping );
1146 if (desired_access & MAXIMUM_ALLOWED)
1147 denied_access |= access;
1148 else
1149 {
1150 denied_access |= (access & ~current_access);
1151 if (desired_access & access) goto done;
1152 }
1153 }
1154 break;
1155 case ACCESS_ALLOWED_ACE_TYPE:
1156 aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
1157 sid = (const SID *)&aa_ace->SidStart;
1158 if (token_sid_present( token, sid, FALSE ))
1159 {
1160 unsigned int access = map_access( aa_ace->Mask, mapping );
1161 if (desired_access & MAXIMUM_ALLOWED)
1162 current_access |= access;
1163 else
1164 current_access |= (access & ~denied_access);
1165 }
1166 break;
1167 }
1168
1169 /* don't bother carrying on checking if we've already got all of
1170 * rights we need */
1171 if (desired_access == *granted_access)
1172 break;
1173 }
1174
1175 done:
1176 if (desired_access & MAXIMUM_ALLOWED)
1177 *granted_access = current_access & ~denied_access;
1178 else
1179 if ((current_access & desired_access) == desired_access)
1180 *granted_access = current_access & desired_access;
1181 else
1182 *granted_access = 0;
1183
1184 *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1185 return STATUS_SUCCESS;
1186 }
1187
1188 const ACL *token_get_default_dacl( struct token *token )
1189 {
1190 return token->default_dacl;
1191 }
1192
1193 const SID *token_get_user( struct token *token )
1194 {
1195 return token->user;
1196 }
1197
1198 const SID *token_get_primary_group( struct token *token )
1199 {
1200 return token->primary_group;
1201 }
1202
1203 unsigned int token_get_session_id( struct token *token )
1204 {
1205 return token->session_id;
1206 }
1207
1208 int check_object_access(struct token *token, struct object *obj, unsigned int *access)
1209 {
1210 generic_map_t mapping;
1211 unsigned int status;
1212 int res;
1213
1214 if (!token)
1215 token = current->token ? current->token : current->process->token;
1216
1217 mapping.all = obj->ops->map_access( obj, GENERIC_ALL );
1218
1219 if (!obj->sd)
1220 {
1221 if (*access & MAXIMUM_ALLOWED) *access = mapping.all;
1222 return TRUE;
1223 }
1224
1225 mapping.read = obj->ops->map_access( obj, GENERIC_READ );
1226 mapping.write = obj->ops->map_access( obj, GENERIC_WRITE );
1227 mapping.exec = obj->ops->map_access( obj, GENERIC_EXECUTE );
1228
1229 res = token_access_check( token, obj->sd, *access, NULL, NULL,
1230 &mapping, access, &status ) == STATUS_SUCCESS &&
1231 status == STATUS_SUCCESS;
1232
1233 if (!res) set_error( STATUS_ACCESS_DENIED );
1234 return res;
1235 }
1236
1237
1238 /* open a security token */
1239 DECL_HANDLER(open_token)
1240 {
1241 if (req->flags & OPEN_TOKEN_THREAD)
1242 {
1243 struct thread *thread = get_thread_from_handle( req->handle, 0 );
1244 if (thread)
1245 {
1246 if (thread->token)
1247 {
1248 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1249 set_error( STATUS_CANT_OPEN_ANONYMOUS );
1250 else
1251 reply->token = alloc_handle( current->process, thread->token,
1252 req->access, req->attributes );
1253 }
1254 else
1255 set_error( STATUS_NO_TOKEN );
1256 release_object( thread );
1257 }
1258 }
1259 else
1260 {
1261 struct process *process = get_process_from_handle( req->handle, 0 );
1262 if (process)
1263 {
1264 if (process->token)
1265 reply->token = alloc_handle( current->process, process->token, req->access,
1266 req->attributes );
1267 else
1268 set_error( STATUS_NO_TOKEN );
1269 release_object( process );
1270 }
1271 }
1272 }
1273
1274 /* adjust the privileges held by a token */
1275 DECL_HANDLER(adjust_token_privileges)
1276 {
1277 struct token *token;
1278 unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1279
1280 if (req->get_modified_state) access |= TOKEN_QUERY;
1281
1282 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1283 access, &token_ops )))
1284 {
1285 const LUID_AND_ATTRIBUTES *privs = get_req_data();
1286 LUID_AND_ATTRIBUTES *modified_privs = NULL;
1287 unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1288 unsigned int modified_priv_count = 0;
1289
1290 if (req->get_modified_state && !req->disable_all)
1291 {
1292 unsigned int i;
1293 /* count modified privs */
1294 for (i = 0; i < priv_count; i++)
1295 {
1296 struct privilege *privilege =
1297 token_find_privilege( token, &privs[i].Luid, FALSE );
1298 if (privilege && req->get_modified_state)
1299 modified_priv_count++;
1300 }
1301 reply->len = modified_priv_count;
1302 modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1303 if (modified_priv_count)
1304 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1305 }
1306 reply->len = modified_priv_count * sizeof(*modified_privs);
1307
1308 if (req->disable_all)
1309 token_disable_privileges( token );
1310 else
1311 token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
1312
1313 release_object( token );
1314 }
1315 }
1316
1317 /* retrieves the list of privileges that may be held be the token */
1318 DECL_HANDLER(get_token_privileges)
1319 {
1320 struct token *token;
1321
1322 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1323 TOKEN_QUERY,
1324 &token_ops )))
1325 {
1326 int priv_count = 0;
1327 LUID_AND_ATTRIBUTES *privs;
1328 struct privilege *privilege;
1329
1330 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1331 priv_count++;
1332
1333 reply->len = priv_count * sizeof(*privs);
1334 if (reply->len <= get_reply_max_size())
1335 {
1336 privs = set_reply_data_size( priv_count * sizeof(*privs) );
1337 if (privs)
1338 {
1339 int i = 0;
1340 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1341 {
1342 luid_and_attr_from_privilege( &privs[i], privilege );
1343 i++;
1344 }
1345 }
1346 }
1347 else
1348 set_error(STATUS_BUFFER_TOO_SMALL);
1349
1350 release_object( token );
1351 }
1352 }
1353
1354 /* creates a duplicate of the token */
1355 DECL_HANDLER(duplicate_token)
1356 {
1357 struct token *src_token;
1358 struct unicode_str name;
1359 const struct security_descriptor *sd;
1360 const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
1361
1362 if (!objattr) return;
1363
1364 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1365 TOKEN_DUPLICATE,
1366 &token_ops )))
1367 {
1368 struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd, NULL, 0, NULL, 0 );
1369 if (token)
1370 {
1371 unsigned int access = req->access ? req->access : get_handle_access( current->process, req->handle );
1372 reply->new_handle = alloc_handle_no_access_check( current->process, token, access, objattr->attributes );
1373 release_object( token );
1374 }
1375 release_object( src_token );
1376 }
1377 }
1378
1379 /* creates a restricted version of a token */
1380 DECL_HANDLER(filter_token)
1381 {
1382 struct token *src_token;
1383
1384 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_DUPLICATE, &token_ops )))
1385 {
1386 const LUID_AND_ATTRIBUTES *filter_privileges = get_req_data();
1387 unsigned int priv_count, group_count;
1388 const SID *filter_groups;
1389 struct token *token;
1390
1391 priv_count = min( req->privileges_size, get_req_data_size() ) / sizeof(LUID_AND_ATTRIBUTES);
1392 filter_groups = (const SID *)((char *)filter_privileges + priv_count * sizeof(LUID_AND_ATTRIBUTES));
1393 group_count = get_sid_count( filter_groups, get_req_data_size() - priv_count * sizeof(LUID_AND_ATTRIBUTES) );
1394
1395 token = token_duplicate( src_token, src_token->primary, src_token->impersonation_level, NULL,
1396 filter_privileges, priv_count, filter_groups, group_count );
1397 if (token)
1398 {
1399 unsigned int access = get_handle_access( current->process, req->handle );
1400 reply->new_handle = alloc_handle_no_access_check( current->process, token, access, 0 );
1401 release_object( token );
1402 }
1403 release_object( src_token );
1404 }
1405 }
1406
1407 /* checks the specified privileges are held by the token */
1408 DECL_HANDLER(check_token_privileges)
1409 {
1410 struct token *token;
1411
1412 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1413 TOKEN_QUERY,
1414 &token_ops )))
1415 {
1416 unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1417
1418 if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1419 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1420 else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1421 {
1422 LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1423 reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1424 }
1425 else
1426 set_error( STATUS_BUFFER_OVERFLOW );
1427 release_object( token );
1428 }
1429 }
1430
1431 /* checks that a user represented by a token is allowed to access an object
1432 * represented by a security descriptor */
1433 DECL_HANDLER(access_check)
1434 {
1435 data_size_t sd_size = get_req_data_size();
1436 const struct security_descriptor *sd = get_req_data();
1437 struct token *token;
1438
1439 if (!sd_is_valid( sd, sd_size ))
1440 {
1441 set_error( STATUS_ACCESS_VIOLATION );
1442 return;
1443 }
1444
1445 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1446 TOKEN_QUERY,
1447 &token_ops )))
1448 {
1449 unsigned int status;
1450 LUID_AND_ATTRIBUTES priv;
1451 unsigned int priv_count = 1;
1452
1453 memset(&priv, 0, sizeof(priv));
1454
1455 /* only impersonation tokens may be used with this function */
1456 if (token->primary)
1457 {
1458 set_error( STATUS_NO_IMPERSONATION_TOKEN );
1459 release_object( token );
1460 return;
1461 }
1462 /* anonymous impersonation tokens can't be used */
1463 if (token->impersonation_level <= SecurityAnonymous)
1464 {
1465 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1466 release_object( token );
1467 return;
1468 }
1469
1470 status = token_access_check( token, sd, req->desired_access, &priv, &priv_count, &req->mapping,
1471 &reply->access_granted, &reply->access_status );
1472
1473 reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1474
1475 if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1476 {
1477 LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1478 memcpy( privs, &priv, sizeof(priv) );
1479 }
1480
1481 set_error( status );
1482 release_object( token );
1483 }
1484 }
1485
1486 /* retrieves an SID from the token */
1487 DECL_HANDLER(get_token_sid)
1488 {
1489 struct token *token;
1490
1491 reply->sid_len = 0;
1492
1493 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1494 {
1495 const SID *sid = NULL;
1496
1497 switch (req->which_sid)
1498 {
1499 case TokenUser:
1500 assert(token->user);
1501 sid = token->user;
1502 break;
1503 case TokenPrimaryGroup:
1504 sid = token->primary_group;
1505 break;
1506 case TokenOwner:
1507 sid = token->owner;
1508 break;
1509 case TokenLogonSid:
1510 sid = (const SID *)&builtin_logon_sid;
1511 break;
1512 default:
1513 set_error( STATUS_INVALID_PARAMETER );
1514 break;
1515 }
1516
1517 if (sid)
1518 {
1519 reply->sid_len = security_sid_len( sid );
1520 if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1521 else set_error( STATUS_BUFFER_TOO_SMALL );
1522 }
1523 release_object( token );
1524 }
1525 }
1526
1527 /* retrieves the groups that the user represented by the token belongs to */
1528 DECL_HANDLER(get_token_groups)
1529 {
1530 struct token *token;
1531
1532 reply->user_len = 0;
1533
1534 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1535 TOKEN_QUERY,
1536 &token_ops )))
1537 {
1538 size_t size_needed = sizeof(struct token_groups);
1539 size_t sid_size = 0;
1540 unsigned int group_count = 0;
1541 const struct group *group;
1542
1543 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1544 {
1545 group_count++;
1546 sid_size += security_sid_len( &group->sid );
1547 }
1548 size_needed += sid_size;
1549 /* attributes size */
1550 size_needed += sizeof(unsigned int) * group_count;
1551
1552 /* reply buffer contains size_needed bytes formatted as:
1553
1554 unsigned int count;
1555 unsigned int attrib[count];
1556 char sid_data[];
1557
1558 user_len includes extra data needed for TOKEN_GROUPS representation,
1559 required caller buffer size calculated here to avoid extra server call */
1560 reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1561
1562 if (reply->user_len <= get_reply_max_size())
1563 {
1564 struct token_groups *tg = set_reply_data_size( size_needed );
1565 if (tg)
1566 {
1567 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1568 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1569
1570 tg->count = group_count;
1571
1572 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1573 {
1574
1575 *attr_ptr = 0;
1576 if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1577 if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1578 if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1579 if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1580 if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1581 if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1582 if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1583
1584 memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1585
1586 sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1587 attr_ptr++;
1588 }
1589 }
1590 }
1591 else set_error( STATUS_BUFFER_TOO_SMALL );
1592
1593 release_object( token );
1594 }
1595 }
1596
1597 DECL_HANDLER(get_token_info)
1598 {
1599 struct token *token;
1600
1601 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1602 {
1603 reply->token_id = token->token_id;
1604 reply->modified_id = token->modified_id;
1605 reply->session_id = token->session_id;
1606 reply->primary = token->primary;
1607 reply->impersonation_level = token->impersonation_level;
1608 reply->elevation = token->elevation;
1609 reply->group_count = list_count( &token->groups );
1610 reply->privilege_count = list_count( &token->privileges );
1611 release_object( token );
1612 }
1613 }
1614
1615 DECL_HANDLER(get_token_default_dacl)
1616 {
1617 struct token *token;
1618
1619 reply->acl_len = 0;
1620
1621 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1622 TOKEN_QUERY,
1623 &token_ops )))
1624 {
1625 if (token->default_dacl)
1626 reply->acl_len = token->default_dacl->AclSize;
1627
1628 if (reply->acl_len <= get_reply_max_size())
1629 {
1630 ACL *acl_reply = set_reply_data_size( reply->acl_len );
1631 if (acl_reply)
1632 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1633 }
1634 else set_error( STATUS_BUFFER_TOO_SMALL );
1635
1636 release_object( token );
1637 }
1638 }
1639
1640 DECL_HANDLER(set_token_default_dacl)
1641 {
1642 struct token *token;
1643
1644 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1645 TOKEN_ADJUST_DEFAULT,
1646 &token_ops )))
1647 {
1648 const ACL *acl = get_req_data();
1649 unsigned int acl_size = get_req_data_size();
1650
1651 free( token->default_dacl );
1652 token->default_dacl = NULL;
1653
1654 if (acl_size)
1655 token->default_dacl = memdup( acl, acl_size );
1656
1657 release_object( token );
1658 }
1659 }
1660
1661 DECL_HANDLER(create_linked_token)
1662 {
1663 struct token *token, *linked;
1664 int elevation;
1665
1666 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1667 TOKEN_QUERY, &token_ops )))
1668 {
1669 switch (token->elevation)
1670 {
1671 case TokenElevationTypeFull:
1672 elevation = TokenElevationTypeLimited;
1673 break;
1674 case TokenElevationTypeLimited:
1675 elevation = TokenElevationTypeFull;
1676 break;
1677 default:
1678 release_object( token );
1679 return;
1680 }
1681 if ((linked = token_create_admin( FALSE, SecurityIdentification, elevation, token->session_id )))
1682 {
1683 reply->linked = alloc_handle( current->process, linked, TOKEN_ALL_ACCESS, 0 );
1684 release_object( linked );
1685 }
1686 release_object( token );
1687 }
1688 }
Windows API implementation