?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ntdll: Simplify the platform-specific dispatcher interface.
[wine.git] / server / token.c
blobad5d7cda323a1d38e9fbdfc6711268a68432bfe2
1 /*
2 * Tokens
3 *
4 * Copyright (C) 1998 Alexandre Julliard
5 * Copyright (C) 2003 Mike McCormack
6 * Copyright (C) 2005 Robert Shearman
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 */
22
23 #include "config.h"
24
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <stdarg.h>
29 #include <unistd.h>
30
31 #include "ntstatus.h"
32 #define WIN32_NO_STATUS
33 #include "windef.h"
34 #include "winternl.h"
35
36 #include "handle.h"
37 #include "thread.h"
38 #include "process.h"
39 #include "request.h"
40 #include "security.h"
41
42 #define MAX_SUBAUTH_COUNT 1
43
44 const LUID SeIncreaseQuotaPrivilege = { 5, 0 };
45 const LUID SeTcbPrivilege = { 7, 0 };
46 const LUID SeSecurityPrivilege = { 8, 0 };
47 const LUID SeTakeOwnershipPrivilege = { 9, 0 };
48 const LUID SeLoadDriverPrivilege = { 10, 0 };
49 const LUID SeSystemProfilePrivilege = { 11, 0 };
50 const LUID SeSystemtimePrivilege = { 12, 0 };
51 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
52 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
53 const LUID SeCreatePagefilePrivilege = { 15, 0 };
54 const LUID SeBackupPrivilege = { 17, 0 };
55 const LUID SeRestorePrivilege = { 18, 0 };
56 const LUID SeShutdownPrivilege = { 19, 0 };
57 const LUID SeDebugPrivilege = { 20, 0 };
58 const LUID SeSystemEnvironmentPrivilege = { 22, 0 };
59 const LUID SeChangeNotifyPrivilege = { 23, 0 };
60 const LUID SeRemoteShutdownPrivilege = { 24, 0 };
61 const LUID SeUndockPrivilege = { 25, 0 };
62 const LUID SeManageVolumePrivilege = { 28, 0 };
63 const LUID SeImpersonatePrivilege = { 29, 0 };
64 const LUID SeCreateGlobalPrivilege = { 30, 0 };
65
66 #define SID_N(n) struct /* same fields as struct SID */ \
67 { \
68 BYTE Revision; \
69 BYTE SubAuthorityCount; \
70 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
71 DWORD SubAuthority[n]; \
72 }
73
74 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
75 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
76 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
77 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
78 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
79 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
80 static const SID high_label_sid = { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY }, { SECURITY_MANDATORY_HIGH_RID } };
81 static const SID_N(5) local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
82 static const SID_N(2) builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
83 static const SID_N(2) builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
84 static const SID_N(3) builtin_logon_sid = { SID_REVISION, 3, { SECURITY_NT_AUTHORITY }, { SECURITY_LOGON_IDS_RID, 0, 0 } };
85 static const SID_N(5) domain_users_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, DOMAIN_GROUP_RID_USERS } };
86
87 const PSID security_world_sid = (PSID)&world_sid;
88 static const PSID security_local_sid = (PSID)&local_sid;
89 static const PSID security_interactive_sid = (PSID)&interactive_sid;
90 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
91 const PSID security_local_system_sid = (PSID)&local_system_sid;
92 const PSID security_local_user_sid = (PSID)&local_user_sid;
93 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
94 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
95 const PSID security_domain_users_sid = (PSID)&domain_users_sid;
96 const PSID security_high_label_sid = (PSID)&high_label_sid;
97
98 static luid_t prev_luid_value = { 1000, 0 };
99
100 static const WCHAR token_name[] = {'T','o','k','e','n'};
101
102 struct type_descr token_type =
103 {
104 { token_name, sizeof(token_name) }, /* name */
105 TOKEN_ALL_ACCESS | SYNCHRONIZE, /* valid_access */
106 { /* mapping */
107 STANDARD_RIGHTS_READ | TOKEN_QUERY_SOURCE | TOKEN_QUERY | TOKEN_DUPLICATE,
108 STANDARD_RIGHTS_WRITE | TOKEN_ADJUST_SESSIONID | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_GROUPS
109 | TOKEN_ADJUST_PRIVILEGES,
110 STANDARD_RIGHTS_EXECUTE | TOKEN_IMPERSONATE | TOKEN_ASSIGN_PRIMARY,
111 TOKEN_ALL_ACCESS
112 },
113 };
114
115 struct token
116 {
117 struct object obj; /* object header */
118 luid_t token_id; /* system-unique id of token */
119 luid_t modified_id; /* new id allocated every time token is modified */
120 struct list privileges; /* privileges available to the token */
121 struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
122 SID *user; /* SID of user this token represents */
123 SID *owner; /* SID of owner (points to user or one of groups) */
124 SID *primary_group; /* SID of user's primary group (points to one of groups) */
125 unsigned primary; /* is this a primary or impersonation token? */
126 ACL *default_dacl; /* the default DACL to assign to objects created by this user */
127 TOKEN_SOURCE source; /* source of the token */
128 int impersonation_level; /* impersonation level this token is capable of if non-primary token */
129 int elevation; /* elevation type */
130 };
131
132 struct privilege
133 {
134 struct list entry;
135 LUID luid;
136 unsigned enabled : 1; /* is the privilege currently enabled? */
137 unsigned def : 1; /* is the privilege enabled by default? */
138 };
139
140 struct group
141 {
142 struct list entry;
143 unsigned enabled : 1; /* is the sid currently enabled? */
144 unsigned def : 1; /* is the sid enabled by default? */
145 unsigned logon : 1; /* is this a logon sid? */
146 unsigned mandatory: 1; /* is this sid always enabled? */
147 unsigned owner : 1; /* can this sid be an owner of an object? */
148 unsigned resource : 1; /* is this a domain-local group? */
149 unsigned deny_only: 1; /* is this a sid that should be use for denying only? */
150 SID sid;
151 };
152
153 static void token_dump( struct object *obj, int verbose );
154 static void token_destroy( struct object *obj );
155
156 static const struct object_ops token_ops =
157 {
158 sizeof(struct token), /* size */
159 &token_type, /* type */
160 token_dump, /* dump */
161 no_add_queue, /* add_queue */
162 NULL, /* remove_queue */
163 NULL, /* signaled */
164 NULL, /* satisfied */
165 no_signal, /* signal */
166 no_get_fd, /* get_fd */
167 default_map_access, /* map_access */
168 default_get_sd, /* get_sd */
169 default_set_sd, /* set_sd */
170 no_get_full_name, /* get_full_name */
171 no_lookup_name, /* lookup_name */
172 no_link_name, /* link_name */
173 NULL, /* unlink_name */
174 no_open_file, /* open_file */
175 no_kernel_obj_list, /* get_kernel_obj_list */
176 no_close_handle, /* close_handle */
177 token_destroy /* destroy */
178 };
179
180 static void token_dump( struct object *obj, int verbose )
181 {
182 struct token *token = (struct token *)obj;
183 assert( obj->ops == &token_ops );
184 fprintf( stderr, "Token id=%d.%u primary=%u impersonation level=%d\n", token->token_id.high_part,
185 token->token_id.low_part, token->primary, token->impersonation_level );
186 }
187
188 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
189 {
190 int i;
191 SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
192 if (!sid) return NULL;
193 sid->Revision = SID_REVISION;
194 sid->SubAuthorityCount = subauthcount;
195 sid->IdentifierAuthority = *idauthority;
196 for (i = 0; i < subauthcount; i++)
197 sid->SubAuthority[i] = subauth[i];
198 return sid;
199 }
200
201 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
202 {
203 if (!handle)
204 {
205 if (thread->token)
206 release_object( thread->token );
207 thread->token = NULL;
208 }
209 else
210 {
211 struct token *token = (struct token *)get_handle_obj( current->process,
212 handle,
213 TOKEN_IMPERSONATE,
214 &token_ops );
215 if (token)
216 {
217 if (thread->token)
218 release_object( thread->token );
219 thread->token = token;
220 }
221 }
222 }
223
224 const SID *security_unix_uid_to_sid( uid_t uid )
225 {
226 /* very simple mapping: either the current user or not the current user */
227 if (uid == getuid())
228 return (const SID *)&local_user_sid;
229 else
230 return &anonymous_logon_sid;
231 }
232
233 static int acl_is_valid( const ACL *acl, data_size_t size )
234 {
235 ULONG i;
236 const ACE_HEADER *ace;
237
238 if (size < sizeof(ACL))
239 return FALSE;
240
241 size = min(size, MAX_ACL_LEN);
242
243 size -= sizeof(ACL);
244
245 ace = (const ACE_HEADER *)(acl + 1);
246 for (i = 0; i < acl->AceCount; i++)
247 {
248 const SID *sid;
249 data_size_t sid_size;
250
251 if (size < sizeof(ACE_HEADER))
252 return FALSE;
253 if (size < ace->AceSize)
254 return FALSE;
255 size -= ace->AceSize;
256 switch (ace->AceType)
257 {
258 case ACCESS_DENIED_ACE_TYPE:
259 sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
260 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
261 break;
262 case ACCESS_ALLOWED_ACE_TYPE:
263 sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
264 sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
265 break;
266 case SYSTEM_AUDIT_ACE_TYPE:
267 sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
268 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
269 break;
270 case SYSTEM_ALARM_ACE_TYPE:
271 sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
272 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
273 break;
274 case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
275 sid = (const SID *)&((const SYSTEM_MANDATORY_LABEL_ACE *)ace)->SidStart;
276 sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart);
277 break;
278 default:
279 return FALSE;
280 }
281 if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
282 return FALSE;
283 ace = ace_next( ace );
284 }
285 return TRUE;
286 }
287
288 static unsigned int get_sid_count( const SID *sid, data_size_t size )
289 {
290 unsigned int count;
291
292 for (count = 0; size >= sizeof(SID) && security_sid_len( sid ) <= size; count++)
293 {
294 size -= security_sid_len( sid );
295 sid = (const SID *)((char *)sid + security_sid_len( sid ));
296 }
297
298 return count;
299 }
300
301 /* checks whether all members of a security descriptor fit inside the size
302 * of memory specified */
303 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
304 {
305 size_t offset = sizeof(struct security_descriptor);
306 const SID *group;
307 const SID *owner;
308 const ACL *sacl;
309 const ACL *dacl;
310 int dummy;
311
312 if (size < offset)
313 return FALSE;
314
315 if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
316 (offset + sd->owner_len > size))
317 return FALSE;
318 owner = sd_get_owner( sd );
319 if (owner)
320 {
321 if ((sd->owner_len < sizeof(SID)) || (security_sid_len( owner ) > sd->owner_len))
322 return FALSE;
323 }
324 offset += sd->owner_len;
325
326 if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
327 (offset + sd->group_len > size))
328 return FALSE;
329 group = sd_get_group( sd );
330 if (group)
331 {
332 if ((sd->group_len < sizeof(SID)) || (security_sid_len( group ) > sd->group_len))
333 return FALSE;
334 }
335 offset += sd->group_len;
336
337 if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
338 return FALSE;
339 sacl = sd_get_sacl( sd, &dummy );
340 if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
341 return FALSE;
342 offset += sd->sacl_len;
343
344 if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
345 return FALSE;
346 dacl = sd_get_dacl( sd, &dummy );
347 if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
348 return FALSE;
349 offset += sd->dacl_len;
350
351 return TRUE;
352 }
353
354 /* extract security labels from SACL */
355 ACL *extract_security_labels( const ACL *sacl )
356 {
357 size_t size = sizeof(ACL);
358 const ACE_HEADER *ace;
359 ACE_HEADER *label_ace;
360 unsigned int i, count = 0;
361 ACL *label_acl;
362
363 ace = (const ACE_HEADER *)(sacl + 1);
364 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
365 {
366 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
367 {
368 size += ace->AceSize;
369 count++;
370 }
371 }
372
373 label_acl = mem_alloc( size );
374 if (!label_acl) return NULL;
375
376 label_acl->AclRevision = sacl->AclRevision;
377 label_acl->Sbz1 = 0;
378 label_acl->AclSize = size;
379 label_acl->AceCount = count;
380 label_acl->Sbz2 = 0;
381 label_ace = (ACE_HEADER *)(label_acl + 1);
382
383 ace = (const ACE_HEADER *)(sacl + 1);
384 for (i = 0; i < sacl->AceCount; i++, ace = ace_next( ace ))
385 {
386 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
387 {
388 memcpy( label_ace, ace, ace->AceSize );
389 label_ace = (ACE_HEADER *)ace_next( label_ace );
390 }
391 }
392 return label_acl;
393 }
394
395 /* replace security labels in an existing SACL */
396 ACL *replace_security_labels( const ACL *old_sacl, const ACL *new_sacl )
397 {
398 const ACE_HEADER *ace;
399 ACE_HEADER *replaced_ace;
400 size_t size = sizeof(ACL);
401 unsigned int i, count = 0;
402 BYTE revision = ACL_REVISION;
403 ACL *replaced_acl;
404
405 if (old_sacl)
406 {
407 revision = max( revision, old_sacl->AclRevision );
408 ace = (const ACE_HEADER *)(old_sacl + 1);
409 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
410 {
411 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
412 size += ace->AceSize;
413 count++;
414 }
415 }
416
417 if (new_sacl)
418 {
419 revision = max( revision, new_sacl->AclRevision );
420 ace = (const ACE_HEADER *)(new_sacl + 1);
421 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
422 {
423 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
424 size += ace->AceSize;
425 count++;
426 }
427 }
428
429 replaced_acl = mem_alloc( size );
430 if (!replaced_acl) return NULL;
431
432 replaced_acl->AclRevision = revision;
433 replaced_acl->Sbz1 = 0;
434 replaced_acl->AclSize = size;
435 replaced_acl->AceCount = count;
436 replaced_acl->Sbz2 = 0;
437 replaced_ace = (ACE_HEADER *)(replaced_acl + 1);
438
439 if (old_sacl)
440 {
441 ace = (const ACE_HEADER *)(old_sacl + 1);
442 for (i = 0; i < old_sacl->AceCount; i++, ace = ace_next( ace ))
443 {
444 if (ace->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
445 memcpy( replaced_ace, ace, ace->AceSize );
446 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
447 }
448 }
449
450 if (new_sacl)
451 {
452 ace = (const ACE_HEADER *)(new_sacl + 1);
453 for (i = 0; i < new_sacl->AceCount; i++, ace = ace_next( ace ))
454 {
455 if (ace->AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
456 memcpy( replaced_ace, ace, ace->AceSize );
457 replaced_ace = (ACE_HEADER *)ace_next( replaced_ace );
458 }
459 }
460
461 return replaced_acl;
462 }
463
464 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
465 {
466 return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
467 }
468
469 static inline void allocate_luid( luid_t *luid )
470 {
471 prev_luid_value.low_part++;
472 *luid = prev_luid_value;
473 }
474
475 DECL_HANDLER( allocate_locally_unique_id )
476 {
477 allocate_luid( &reply->luid );
478 }
479
480 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
481 {
482 out->Luid = in->luid;
483 out->Attributes =
484 (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
485 (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
486 }
487
488 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
489 {
490 struct privilege *privilege = mem_alloc( sizeof(*privilege) );
491 if (privilege)
492 {
493 privilege->luid = *luid;
494 privilege->def = privilege->enabled = (enabled != 0);
495 list_add_tail( &token->privileges, &privilege->entry );
496 }
497 return privilege;
498 }
499
500 static inline void privilege_remove( struct privilege *privilege )
501 {
502 list_remove( &privilege->entry );
503 free( privilege );
504 }
505
506 static void token_destroy( struct object *obj )
507 {
508 struct token* token;
509 struct list *cursor, *cursor_next;
510
511 assert( obj->ops == &token_ops );
512 token = (struct token *)obj;
513
514 free( token->user );
515
516 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
517 {
518 struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
519 privilege_remove( privilege );
520 }
521
522 LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
523 {
524 struct group *group = LIST_ENTRY( cursor, struct group, entry );
525 list_remove( &group->entry );
526 free( group );
527 }
528
529 free( token->default_dacl );
530 }
531
532 /* creates a new token.
533 * groups may be NULL if group_count is 0.
534 * privs may be NULL if priv_count is 0.
535 * default_dacl may be NULL, indicating that all objects created by the user
536 * are unsecured.
537 * modified_id may be NULL, indicating that a new modified_id luid should be
538 * allocated.
539 */
540 static struct token *create_token( unsigned primary, const SID *user,
541 const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
542 const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
543 const ACL *default_dacl, TOKEN_SOURCE source,
544 const luid_t *modified_id,
545 int impersonation_level, int elevation )
546 {
547 struct token *token = alloc_object( &token_ops );
548 if (token)
549 {
550 unsigned int i;
551
552 allocate_luid( &token->token_id );
553 if (modified_id)
554 token->modified_id = *modified_id;
555 else
556 allocate_luid( &token->modified_id );
557 list_init( &token->privileges );
558 list_init( &token->groups );
559 token->primary = primary;
560 /* primary tokens don't have impersonation levels */
561 if (primary)
562 token->impersonation_level = -1;
563 else
564 token->impersonation_level = impersonation_level;
565 token->default_dacl = NULL;
566 token->primary_group = NULL;
567 token->elevation = elevation;
568
569 /* copy user */
570 token->user = memdup( user, security_sid_len( user ));
571 if (!token->user)
572 {
573 release_object( token );
574 return NULL;
575 }
576
577 /* copy groups */
578 for (i = 0; i < group_count; i++)
579 {
580 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
581 struct group *group = mem_alloc( size );
582
583 if (!group)
584 {
585 release_object( token );
586 return NULL;
587 }
588 memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
589 group->enabled = TRUE;
590 group->def = TRUE;
591 group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
592 group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
593 group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
594 group->resource = FALSE;
595 group->deny_only = FALSE;
596 list_add_tail( &token->groups, &group->entry );
597 /* Use first owner capable group as owner and primary group */
598 if (!token->primary_group && group->owner)
599 {
600 token->owner = &group->sid;
601 token->primary_group = &group->sid;
602 }
603 }
604
605 /* copy privileges */
606 for (i = 0; i < priv_count; i++)
607 {
608 /* note: we don't check uniqueness: the caller must make sure
609 * privs doesn't contain any duplicate luids */
610 if (!privilege_add( token, &privs[i].Luid,
611 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
612 {
613 release_object( token );
614 return NULL;
615 }
616 }
617
618 if (default_dacl)
619 {
620 token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
621 if (!token->default_dacl)
622 {
623 release_object( token );
624 return NULL;
625 }
626 }
627
628 token->source = source;
629 }
630 return token;
631 }
632
633 static int filter_group( struct group *group, const SID *filter, unsigned int count )
634 {
635 unsigned int i;
636
637 for (i = 0; i < count; i++)
638 {
639 if (security_equal_sid( &group->sid, filter )) return 1;
640 filter = (const SID *)((char *)filter + security_sid_len( filter ));
641 }
642
643 return 0;
644 }
645
646 static int filter_privilege( struct privilege *privilege, const LUID_AND_ATTRIBUTES *filter, unsigned int count )
647 {
648 unsigned int i;
649
650 for (i = 0; i < count; i++)
651 {
652 if (!memcmp( &privilege->luid, &filter[i].Luid, sizeof(LUID) ))
653 return 1;
654 }
655
656 return 0;
657 }
658
659 struct token *token_duplicate( struct token *src_token, unsigned primary,
660 int impersonation_level, const struct security_descriptor *sd,
661 const LUID_AND_ATTRIBUTES *remove_privs, unsigned int remove_priv_count,
662 const SID *remove_groups, unsigned int remove_group_count)
663 {
664 const luid_t *modified_id =
665 primary || (impersonation_level == src_token->impersonation_level) ?
666 &src_token->modified_id : NULL;
667 struct token *token = NULL;
668 struct privilege *privilege;
669 struct group *group;
670
671 if (!primary &&
672 (impersonation_level < SecurityAnonymous ||
673 impersonation_level > SecurityDelegation ||
674 (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
675 {
676 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
677 return NULL;
678 }
679
680 token = create_token( primary, src_token->user, NULL, 0,
681 NULL, 0, src_token->default_dacl,
682 src_token->source, modified_id,
683 impersonation_level, src_token->elevation );
684 if (!token) return token;
685
686 /* copy groups */
687 token->primary_group = NULL;
688 LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
689 {
690 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
691 struct group *newgroup = mem_alloc( size );
692 if (!newgroup)
693 {
694 release_object( token );
695 return NULL;
696 }
697 memcpy( newgroup, group, size );
698 if (filter_group( group, remove_groups, remove_group_count ))
699 {
700 newgroup->enabled = 0;
701 newgroup->def = 0;
702 newgroup->deny_only = 1;
703 }
704 list_add_tail( &token->groups, &newgroup->entry );
705 if (src_token->primary_group == &group->sid)
706 {
707 token->owner = &newgroup->sid;
708 token->primary_group = &newgroup->sid;
709 }
710 }
711 assert( token->primary_group );
712
713 /* copy privileges */
714 LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
715 {
716 if (filter_privilege( privilege, remove_privs, remove_priv_count )) continue;
717 if (!privilege_add( token, &privilege->luid, privilege->enabled ))
718 {
719 release_object( token );
720 return NULL;
721 }
722 }
723
724 if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
725 DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
726
727 return token;
728 }
729
730 static ACL *create_default_dacl( const SID *user )
731 {
732 ACCESS_ALLOWED_ACE *aaa;
733 ACL *default_dacl;
734 SID *sid;
735 size_t default_dacl_size = sizeof(ACL) +
736 2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
737 sizeof(local_system_sid) +
738 security_sid_len( user );
739
740 default_dacl = mem_alloc( default_dacl_size );
741 if (!default_dacl) return NULL;
742
743 default_dacl->AclRevision = ACL_REVISION;
744 default_dacl->Sbz1 = 0;
745 default_dacl->AclSize = default_dacl_size;
746 default_dacl->AceCount = 2;
747 default_dacl->Sbz2 = 0;
748
749 /* GENERIC_ALL for Local System */
750 aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
751 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
752 aaa->Header.AceFlags = 0;
753 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
754 sizeof(local_system_sid);
755 aaa->Mask = GENERIC_ALL;
756 sid = (SID *)&aaa->SidStart;
757 memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
758
759 /* GENERIC_ALL for specified user */
760 aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
761 aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
762 aaa->Header.AceFlags = 0;
763 aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
764 aaa->Mask = GENERIC_ALL;
765 sid = (SID *)&aaa->SidStart;
766 memcpy( sid, user, security_sid_len( user ));
767
768 return default_dacl;
769 }
770
771 struct sid_data
772 {
773 SID_IDENTIFIER_AUTHORITY idauth;
774 int count;
775 unsigned int subauth[MAX_SUBAUTH_COUNT];
776 };
777
778 static struct security_descriptor *create_security_label_sd( struct token *token, PSID label_sid )
779 {
780 size_t sid_len = security_sid_len( label_sid ), sacl_size, sd_size;
781 SYSTEM_MANDATORY_LABEL_ACE *smla;
782 struct security_descriptor *sd;
783 ACL *sacl;
784
785 sacl_size = sizeof(ACL) + FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
786 sd_size = sizeof(struct security_descriptor) + sacl_size;
787 if (!(sd = mem_alloc( sd_size )))
788 return NULL;
789
790 sd->control = SE_SACL_PRESENT;
791 sd->owner_len = 0;
792 sd->group_len = 0;
793 sd->sacl_len = sacl_size;
794 sd->dacl_len = 0;
795
796 sacl = (ACL *)(sd + 1);
797 sacl->AclRevision = ACL_REVISION;
798 sacl->Sbz1 = 0;
799 sacl->AclSize = sacl_size;
800 sacl->AceCount = 1;
801 sacl->Sbz2 = 0;
802
803 smla = (SYSTEM_MANDATORY_LABEL_ACE *)(sacl + 1);
804 smla->Header.AceType = SYSTEM_MANDATORY_LABEL_ACE_TYPE;
805 smla->Header.AceFlags = 0;
806 smla->Header.AceSize = FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart) + sid_len;
807 smla->Mask = SYSTEM_MANDATORY_LABEL_NO_WRITE_UP;
808 memcpy( &smla->SidStart, label_sid, sid_len );
809
810 assert( sd_is_valid( sd, sd_size ) );
811 return sd;
812 }
813
814 int token_assign_label( struct token *token, PSID label )
815 {
816 struct security_descriptor *sd;
817 int ret = 0;
818
819 if ((sd = create_security_label_sd( token, label )))
820 {
821 ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
822 free( sd );
823 }
824
825 return ret;
826 }
827
828 struct token *get_token_obj( struct process *process, obj_handle_t handle, unsigned int access )
829 {
830 return (struct token *)get_handle_obj( process, handle, access, &token_ops );
831 }
832
833 struct token *token_create_admin( int elevation )
834 {
835 struct token *token = NULL;
836 static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
837 static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
838 static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
839 /* on Windows, this value changes every time the user logs on */
840 static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
841 PSID alias_admins_sid;
842 PSID alias_users_sid;
843 PSID logon_sid;
844 const SID *user_sid = security_unix_uid_to_sid( getuid() );
845 ACL *default_dacl = create_default_dacl( user_sid );
846
847 alias_admins_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_admins_subauth ),
848 alias_admins_subauth );
849 alias_users_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( alias_users_subauth ),
850 alias_users_subauth );
851 logon_sid = security_sid_alloc( &nt_authority, ARRAY_SIZE( logon_subauth ), logon_subauth );
852
853 if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
854 {
855 const LUID_AND_ATTRIBUTES admin_privs[] =
856 {
857 { SeChangeNotifyPrivilege , SE_PRIVILEGE_ENABLED },
858 { SeTcbPrivilege , 0 },
859 { SeSecurityPrivilege , 0 },
860 { SeBackupPrivilege , 0 },
861 { SeRestorePrivilege , 0 },
862 { SeSystemtimePrivilege , 0 },
863 { SeShutdownPrivilege , 0 },
864 { SeRemoteShutdownPrivilege , 0 },
865 { SeTakeOwnershipPrivilege , 0 },
866 { SeDebugPrivilege , 0 },
867 { SeSystemEnvironmentPrivilege , 0 },
868 { SeSystemProfilePrivilege , 0 },
869 { SeProfileSingleProcessPrivilege, 0 },
870 { SeIncreaseBasePriorityPrivilege, 0 },
871 { SeLoadDriverPrivilege , SE_PRIVILEGE_ENABLED },
872 { SeCreatePagefilePrivilege , 0 },
873 { SeIncreaseQuotaPrivilege , 0 },
874 { SeUndockPrivilege , 0 },
875 { SeManageVolumePrivilege , 0 },
876 { SeImpersonatePrivilege , SE_PRIVILEGE_ENABLED },
877 { SeCreateGlobalPrivilege , SE_PRIVILEGE_ENABLED },
878 };
879 /* note: we don't include non-builtin groups here for the user -
880 * telling us these is the job of a client-side program */
881 const SID_AND_ATTRIBUTES admin_groups[] =
882 {
883 { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
884 { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
885 { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
886 { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
887 { security_domain_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
888 { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
889 { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
890 { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
891 };
892 static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
893 token = create_token( TRUE, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
894 admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
895 admin_source, NULL, -1, elevation );
896 /* we really need a primary group */
897 assert( token->primary_group );
898 }
899
900 free( logon_sid );
901 free( alias_admins_sid );
902 free( alias_users_sid );
903 free( default_dacl );
904
905 return token;
906 }
907
908 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
909 {
910 struct privilege *privilege;
911 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
912 {
913 if (is_equal_luid( luid, &privilege->luid ))
914 {
915 if (enabled_only && !privilege->enabled)
916 return NULL;
917 return privilege;
918 }
919 }
920 return NULL;
921 }
922
923 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
924 unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
925 unsigned int mod_privs_count )
926 {
927 unsigned int i, modified_count = 0;
928
929 /* mark as modified */
930 allocate_luid( &token->modified_id );
931
932 for (i = 0; i < count; i++)
933 {
934 struct privilege *privilege =
935 token_find_privilege( token, &privs[i].Luid, FALSE );
936 if (!privilege)
937 {
938 set_error( STATUS_NOT_ALL_ASSIGNED );
939 continue;
940 }
941
942 if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
943 privilege_remove( privilege );
944 else
945 {
946 /* save previous state for caller */
947 if (mod_privs_count)
948 {
949 luid_and_attr_from_privilege(mod_privs, privilege);
950 mod_privs++;
951 mod_privs_count--;
952 modified_count++;
953 }
954
955 if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
956 privilege->enabled = TRUE;
957 else
958 privilege->enabled = FALSE;
959 }
960 }
961 return modified_count;
962 }
963
964 static void token_disable_privileges( struct token *token )
965 {
966 struct privilege *privilege;
967
968 /* mark as modified */
969 allocate_luid( &token->modified_id );
970
971 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
972 privilege->enabled = FALSE;
973 }
974
975 int token_check_privileges( struct token *token, int all_required,
976 const LUID_AND_ATTRIBUTES *reqprivs,
977 unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
978 {
979 unsigned int i, enabled_count = 0;
980
981 for (i = 0; i < count; i++)
982 {
983 struct privilege *privilege =
984 token_find_privilege( token, &reqprivs[i].Luid, TRUE );
985
986 if (usedprivs)
987 usedprivs[i] = reqprivs[i];
988
989 if (privilege && privilege->enabled)
990 {
991 enabled_count++;
992 if (usedprivs)
993 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
994 }
995 }
996
997 if (all_required)
998 return (enabled_count == count);
999 else
1000 return (enabled_count > 0);
1001 }
1002
1003 int token_sid_present( struct token *token, const SID *sid, int deny )
1004 {
1005 struct group *group;
1006
1007 if (security_equal_sid( token->user, sid )) return TRUE;
1008
1009 LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
1010 {
1011 if (!group->enabled) continue;
1012 if (group->deny_only && !deny) continue;
1013
1014 if (security_equal_sid( &group->sid, sid )) return TRUE;
1015 }
1016
1017 return FALSE;
1018 }
1019
1020 /* Checks access to a security descriptor. 'sd' must have been validated by
1021 * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
1022 * the reason. 'status' parameter will indicate if access is granted or denied.
1023 *
1024 * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
1025 */
1026 static unsigned int token_access_check( struct token *token,
1027 const struct security_descriptor *sd,
1028 unsigned int desired_access,
1029 LUID_AND_ATTRIBUTES *privs,
1030 unsigned int *priv_count,
1031 const generic_map_t *mapping,
1032 unsigned int *granted_access,
1033 unsigned int *status )
1034 {
1035 unsigned int current_access = 0;
1036 unsigned int denied_access = 0;
1037 ULONG i;
1038 const ACL *dacl;
1039 int dacl_present;
1040 const ACE_HEADER *ace;
1041 const SID *owner;
1042
1043 /* assume no access rights */
1044 *granted_access = 0;
1045
1046 /* fail if desired_access contains generic rights */
1047 if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
1048 {
1049 if (priv_count) *priv_count = 0;
1050 return STATUS_GENERIC_NOT_MAPPED;
1051 }
1052
1053 dacl = sd_get_dacl( sd, &dacl_present );
1054 owner = sd_get_owner( sd );
1055 if (!owner || !sd_get_group( sd ))
1056 {
1057 if (priv_count) *priv_count = 0;
1058 return STATUS_INVALID_SECURITY_DESCR;
1059 }
1060
1061 /* 1: Grant desired access if the object is unprotected */
1062 if (!dacl_present || !dacl)
1063 {
1064 if (priv_count) *priv_count = 0;
1065 if (desired_access & MAXIMUM_ALLOWED)
1066 *granted_access = mapping->all;
1067 else
1068 *granted_access = desired_access;
1069 return *status = STATUS_SUCCESS;
1070 }
1071
1072 /* 2: Check if caller wants access to system security part. Note: access
1073 * is only granted if specifically asked for */
1074 if (desired_access & ACCESS_SYSTEM_SECURITY)
1075 {
1076 const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
1077 LUID_AND_ATTRIBUTES retpriv = security_priv;
1078 if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
1079 {
1080 if (priv_count)
1081 {
1082 /* assumes that there will only be one privilege to return */
1083 if (*priv_count >= 1)
1084 {
1085 *priv_count = 1;
1086 *privs = retpriv;
1087 }
1088 else
1089 {
1090 *priv_count = 1;
1091 return STATUS_BUFFER_TOO_SMALL;
1092 }
1093 }
1094 current_access |= ACCESS_SYSTEM_SECURITY;
1095 if (desired_access == current_access)
1096 {
1097 *granted_access = current_access;
1098 return *status = STATUS_SUCCESS;
1099 }
1100 }
1101 else
1102 {
1103 if (priv_count) *priv_count = 0;
1104 *status = STATUS_PRIVILEGE_NOT_HELD;
1105 return STATUS_SUCCESS;
1106 }
1107 }
1108 else if (priv_count) *priv_count = 0;
1109
1110 /* 3: Check whether the token is the owner */
1111 /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
1112 * checked when a "set owner" call is made, overriding the access rights
1113 * determined here. */
1114 if (token_sid_present( token, owner, FALSE ))
1115 {
1116 current_access |= (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE);
1117 if (desired_access == current_access)
1118 {
1119 *granted_access = current_access;
1120 return *status = STATUS_SUCCESS;
1121 }
1122 }
1123
1124 /* 4: Grant rights according to the DACL */
1125 ace = (const ACE_HEADER *)(dacl + 1);
1126 for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
1127 {
1128 const ACCESS_ALLOWED_ACE *aa_ace;
1129 const ACCESS_DENIED_ACE *ad_ace;
1130 const SID *sid;
1131
1132 if (ace->AceFlags & INHERIT_ONLY_ACE)
1133 continue;
1134
1135 switch (ace->AceType)
1136 {
1137 case ACCESS_DENIED_ACE_TYPE:
1138 ad_ace = (const ACCESS_DENIED_ACE *)ace;
1139 sid = (const SID *)&ad_ace->SidStart;
1140 if (token_sid_present( token, sid, TRUE ))
1141 {
1142 unsigned int access = map_access( ad_ace->Mask, mapping );
1143 if (desired_access & MAXIMUM_ALLOWED)
1144 denied_access |= access;
1145 else
1146 {
1147 denied_access |= (access & ~current_access);
1148 if (desired_access & access) goto done;
1149 }
1150 }
1151 break;
1152 case ACCESS_ALLOWED_ACE_TYPE:
1153 aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
1154 sid = (const SID *)&aa_ace->SidStart;
1155 if (token_sid_present( token, sid, FALSE ))
1156 {
1157 unsigned int access = map_access( aa_ace->Mask, mapping );
1158 if (desired_access & MAXIMUM_ALLOWED)
1159 current_access |= access;
1160 else
1161 current_access |= (access & ~denied_access);
1162 }
1163 break;
1164 }
1165
1166 /* don't bother carrying on checking if we've already got all of
1167 * rights we need */
1168 if (desired_access == *granted_access)
1169 break;
1170 }
1171
1172 done:
1173 if (desired_access & MAXIMUM_ALLOWED)
1174 *granted_access = current_access & ~denied_access;
1175 else
1176 if ((current_access & desired_access) == desired_access)
1177 *granted_access = current_access & desired_access;
1178 else
1179 *granted_access = 0;
1180
1181 *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
1182 return STATUS_SUCCESS;
1183 }
1184
1185 const ACL *token_get_default_dacl( struct token *token )
1186 {
1187 return token->default_dacl;
1188 }
1189
1190 const SID *token_get_user( struct token *token )
1191 {
1192 return token->user;
1193 }
1194
1195 const SID *token_get_primary_group( struct token *token )
1196 {
1197 return token->primary_group;
1198 }
1199
1200 int check_object_access(struct token *token, struct object *obj, unsigned int *access)
1201 {
1202 generic_map_t mapping;
1203 unsigned int status;
1204 int res;
1205
1206 if (!token)
1207 token = current->token ? current->token : current->process->token;
1208
1209 mapping.all = obj->ops->map_access( obj, GENERIC_ALL );
1210
1211 if (!obj->sd)
1212 {
1213 if (*access & MAXIMUM_ALLOWED) *access = mapping.all;
1214 return TRUE;
1215 }
1216
1217 mapping.read = obj->ops->map_access( obj, GENERIC_READ );
1218 mapping.write = obj->ops->map_access( obj, GENERIC_WRITE );
1219 mapping.exec = obj->ops->map_access( obj, GENERIC_EXECUTE );
1220
1221 res = token_access_check( token, obj->sd, *access, NULL, NULL,
1222 &mapping, access, &status ) == STATUS_SUCCESS &&
1223 status == STATUS_SUCCESS;
1224
1225 if (!res) set_error( STATUS_ACCESS_DENIED );
1226 return res;
1227 }
1228
1229
1230 /* open a security token */
1231 DECL_HANDLER(open_token)
1232 {
1233 if (req->flags & OPEN_TOKEN_THREAD)
1234 {
1235 struct thread *thread = get_thread_from_handle( req->handle, 0 );
1236 if (thread)
1237 {
1238 if (thread->token)
1239 {
1240 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1241 set_error( STATUS_CANT_OPEN_ANONYMOUS );
1242 else
1243 reply->token = alloc_handle( current->process, thread->token,
1244 req->access, req->attributes );
1245 }
1246 else
1247 set_error( STATUS_NO_TOKEN );
1248 release_object( thread );
1249 }
1250 }
1251 else
1252 {
1253 struct process *process = get_process_from_handle( req->handle, 0 );
1254 if (process)
1255 {
1256 if (process->token)
1257 reply->token = alloc_handle( current->process, process->token, req->access,
1258 req->attributes );
1259 else
1260 set_error( STATUS_NO_TOKEN );
1261 release_object( process );
1262 }
1263 }
1264 }
1265
1266 /* adjust the privileges held by a token */
1267 DECL_HANDLER(adjust_token_privileges)
1268 {
1269 struct token *token;
1270 unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1271
1272 if (req->get_modified_state) access |= TOKEN_QUERY;
1273
1274 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1275 access, &token_ops )))
1276 {
1277 const LUID_AND_ATTRIBUTES *privs = get_req_data();
1278 LUID_AND_ATTRIBUTES *modified_privs = NULL;
1279 unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1280 unsigned int modified_priv_count = 0;
1281
1282 if (req->get_modified_state && !req->disable_all)
1283 {
1284 unsigned int i;
1285 /* count modified privs */
1286 for (i = 0; i < priv_count; i++)
1287 {
1288 struct privilege *privilege =
1289 token_find_privilege( token, &privs[i].Luid, FALSE );
1290 if (privilege && req->get_modified_state)
1291 modified_priv_count++;
1292 }
1293 reply->len = modified_priv_count;
1294 modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1295 if (modified_priv_count)
1296 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1297 }
1298 reply->len = modified_priv_count * sizeof(*modified_privs);
1299
1300 if (req->disable_all)
1301 token_disable_privileges( token );
1302 else
1303 token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
1304
1305 release_object( token );
1306 }
1307 }
1308
1309 /* retrieves the list of privileges that may be held be the token */
1310 DECL_HANDLER(get_token_privileges)
1311 {
1312 struct token *token;
1313
1314 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1315 TOKEN_QUERY,
1316 &token_ops )))
1317 {
1318 int priv_count = 0;
1319 LUID_AND_ATTRIBUTES *privs;
1320 struct privilege *privilege;
1321
1322 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1323 priv_count++;
1324
1325 reply->len = priv_count * sizeof(*privs);
1326 if (reply->len <= get_reply_max_size())
1327 {
1328 privs = set_reply_data_size( priv_count * sizeof(*privs) );
1329 if (privs)
1330 {
1331 int i = 0;
1332 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1333 {
1334 luid_and_attr_from_privilege( &privs[i], privilege );
1335 i++;
1336 }
1337 }
1338 }
1339 else
1340 set_error(STATUS_BUFFER_TOO_SMALL);
1341
1342 release_object( token );
1343 }
1344 }
1345
1346 /* creates a duplicate of the token */
1347 DECL_HANDLER(duplicate_token)
1348 {
1349 struct token *src_token;
1350 struct unicode_str name;
1351 const struct security_descriptor *sd;
1352 const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
1353
1354 if (!objattr) return;
1355
1356 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1357 TOKEN_DUPLICATE,
1358 &token_ops )))
1359 {
1360 struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd, NULL, 0, NULL, 0 );
1361 if (token)
1362 {
1363 unsigned int access = req->access ? req->access : get_handle_access( current->process, req->handle );
1364 reply->new_handle = alloc_handle_no_access_check( current->process, token, access, objattr->attributes );
1365 release_object( token );
1366 }
1367 release_object( src_token );
1368 }
1369 }
1370
1371 /* creates a restricted version of a token */
1372 DECL_HANDLER(filter_token)
1373 {
1374 struct token *src_token;
1375
1376 if ((src_token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_DUPLICATE, &token_ops )))
1377 {
1378 const LUID_AND_ATTRIBUTES *filter_privileges = get_req_data();
1379 unsigned int priv_count, group_count;
1380 const SID *filter_groups;
1381 struct token *token;
1382
1383 priv_count = min( req->privileges_size, get_req_data_size() ) / sizeof(LUID_AND_ATTRIBUTES);
1384 filter_groups = (const SID *)((char *)filter_privileges + priv_count * sizeof(LUID_AND_ATTRIBUTES));
1385 group_count = get_sid_count( filter_groups, get_req_data_size() - priv_count * sizeof(LUID_AND_ATTRIBUTES) );
1386
1387 token = token_duplicate( src_token, src_token->primary, src_token->impersonation_level, NULL,
1388 filter_privileges, priv_count, filter_groups, group_count );
1389 if (token)
1390 {
1391 unsigned int access = get_handle_access( current->process, req->handle );
1392 reply->new_handle = alloc_handle_no_access_check( current->process, token, access, 0 );
1393 release_object( token );
1394 }
1395 release_object( src_token );
1396 }
1397 }
1398
1399 /* checks the specified privileges are held by the token */
1400 DECL_HANDLER(check_token_privileges)
1401 {
1402 struct token *token;
1403
1404 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1405 TOKEN_QUERY,
1406 &token_ops )))
1407 {
1408 unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1409
1410 if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1411 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1412 else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1413 {
1414 LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1415 reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1416 }
1417 else
1418 set_error( STATUS_BUFFER_OVERFLOW );
1419 release_object( token );
1420 }
1421 }
1422
1423 /* checks that a user represented by a token is allowed to access an object
1424 * represented by a security descriptor */
1425 DECL_HANDLER(access_check)
1426 {
1427 data_size_t sd_size = get_req_data_size();
1428 const struct security_descriptor *sd = get_req_data();
1429 struct token *token;
1430
1431 if (!sd_is_valid( sd, sd_size ))
1432 {
1433 set_error( STATUS_ACCESS_VIOLATION );
1434 return;
1435 }
1436
1437 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1438 TOKEN_QUERY,
1439 &token_ops )))
1440 {
1441 unsigned int status;
1442 LUID_AND_ATTRIBUTES priv;
1443 unsigned int priv_count = 1;
1444
1445 memset(&priv, 0, sizeof(priv));
1446
1447 /* only impersonation tokens may be used with this function */
1448 if (token->primary)
1449 {
1450 set_error( STATUS_NO_IMPERSONATION_TOKEN );
1451 release_object( token );
1452 return;
1453 }
1454 /* anonymous impersonation tokens can't be used */
1455 if (token->impersonation_level <= SecurityAnonymous)
1456 {
1457 set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1458 release_object( token );
1459 return;
1460 }
1461
1462 status = token_access_check( token, sd, req->desired_access, &priv, &priv_count, &req->mapping,
1463 &reply->access_granted, &reply->access_status );
1464
1465 reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1466
1467 if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1468 {
1469 LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1470 memcpy( privs, &priv, sizeof(priv) );
1471 }
1472
1473 set_error( status );
1474 release_object( token );
1475 }
1476 }
1477
1478 /* retrieves an SID from the token */
1479 DECL_HANDLER(get_token_sid)
1480 {
1481 struct token *token;
1482
1483 reply->sid_len = 0;
1484
1485 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1486 {
1487 const SID *sid = NULL;
1488
1489 switch (req->which_sid)
1490 {
1491 case TokenUser:
1492 assert(token->user);
1493 sid = token->user;
1494 break;
1495 case TokenPrimaryGroup:
1496 sid = token->primary_group;
1497 break;
1498 case TokenOwner:
1499 sid = token->owner;
1500 break;
1501 case TokenLogonSid:
1502 sid = (const SID *)&builtin_logon_sid;
1503 break;
1504 default:
1505 set_error( STATUS_INVALID_PARAMETER );
1506 break;
1507 }
1508
1509 if (sid)
1510 {
1511 reply->sid_len = security_sid_len( sid );
1512 if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1513 else set_error( STATUS_BUFFER_TOO_SMALL );
1514 }
1515 release_object( token );
1516 }
1517 }
1518
1519 /* retrieves the groups that the user represented by the token belongs to */
1520 DECL_HANDLER(get_token_groups)
1521 {
1522 struct token *token;
1523
1524 reply->user_len = 0;
1525
1526 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1527 TOKEN_QUERY,
1528 &token_ops )))
1529 {
1530 size_t size_needed = sizeof(struct token_groups);
1531 size_t sid_size = 0;
1532 unsigned int group_count = 0;
1533 const struct group *group;
1534
1535 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1536 {
1537 group_count++;
1538 sid_size += security_sid_len( &group->sid );
1539 }
1540 size_needed += sid_size;
1541 /* attributes size */
1542 size_needed += sizeof(unsigned int) * group_count;
1543
1544 /* reply buffer contains size_needed bytes formatted as:
1545
1546 unsigned int count;
1547 unsigned int attrib[count];
1548 char sid_data[];
1549
1550 user_len includes extra data needed for TOKEN_GROUPS representation,
1551 required caller buffer size calculated here to avoid extra server call */
1552 reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1553
1554 if (reply->user_len <= get_reply_max_size())
1555 {
1556 struct token_groups *tg = set_reply_data_size( size_needed );
1557 if (tg)
1558 {
1559 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1560 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1561
1562 tg->count = group_count;
1563
1564 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1565 {
1566
1567 *attr_ptr = 0;
1568 if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1569 if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1570 if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1571 if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1572 if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1573 if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1574 if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1575
1576 memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1577
1578 sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1579 attr_ptr++;
1580 }
1581 }
1582 }
1583 else set_error( STATUS_BUFFER_TOO_SMALL );
1584
1585 release_object( token );
1586 }
1587 }
1588
1589 DECL_HANDLER(get_token_info)
1590 {
1591 struct token *token;
1592
1593 if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
1594 {
1595 reply->token_id = token->token_id;
1596 reply->modified_id = token->modified_id;
1597 reply->primary = token->primary;
1598 reply->impersonation_level = token->impersonation_level;
1599 reply->elevation = token->elevation;
1600 reply->group_count = list_count( &token->groups );
1601 reply->privilege_count = list_count( &token->privileges );
1602 release_object( token );
1603 }
1604 }
1605
1606 DECL_HANDLER(get_token_default_dacl)
1607 {
1608 struct token *token;
1609
1610 reply->acl_len = 0;
1611
1612 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1613 TOKEN_QUERY,
1614 &token_ops )))
1615 {
1616 if (token->default_dacl)
1617 reply->acl_len = token->default_dacl->AclSize;
1618
1619 if (reply->acl_len <= get_reply_max_size())
1620 {
1621 ACL *acl_reply = set_reply_data_size( reply->acl_len );
1622 if (acl_reply)
1623 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1624 }
1625 else set_error( STATUS_BUFFER_TOO_SMALL );
1626
1627 release_object( token );
1628 }
1629 }
1630
1631 DECL_HANDLER(set_token_default_dacl)
1632 {
1633 struct token *token;
1634
1635 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1636 TOKEN_ADJUST_DEFAULT,
1637 &token_ops )))
1638 {
1639 const ACL *acl = get_req_data();
1640 unsigned int acl_size = get_req_data_size();
1641
1642 free( token->default_dacl );
1643 token->default_dacl = NULL;
1644
1645 if (acl_size)
1646 token->default_dacl = memdup( acl, acl_size );
1647
1648 release_object( token );
1649 }
1650 }
1651
1652 DECL_HANDLER(create_linked_token)
1653 {
1654 struct token *token, *linked;
1655 int elevation;
1656
1657 if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1658 TOKEN_QUERY, &token_ops )))
1659 {
1660 switch (token->elevation)
1661 {
1662 case TokenElevationTypeFull:
1663 elevation = TokenElevationTypeLimited;
1664 break;
1665 case TokenElevationTypeLimited:
1666 elevation = TokenElevationTypeFull;
1667 break;
1668 default:
1669 release_object( token );
1670 return;
1671 }
1672 if ((linked = token_create_admin( elevation )))
1673 {
1674 reply->linked = alloc_handle( current->process, linked, TOKEN_ALL_ACCESS, 0 );
1675 release_object( linked );
1676 }
1677 release_object( token );
1678 }
1679 }
Windows API implementation