2 * Unit tests for security functions
4 * Copyright (c) 2004 Mike McCormack
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
25 #define WIN32_NO_STATUS
35 #include "wine/test.h"
37 /* copied from Wine winternl.h - not included in the Windows SDK */
38 typedef enum _OBJECT_INFORMATION_CLASS
{
39 ObjectBasicInformation
,
40 ObjectNameInformation
,
41 ObjectTypeInformation
,
44 } OBJECT_INFORMATION_CLASS
, *POBJECT_INFORMATION_CLASS
;
46 typedef struct _OBJECT_BASIC_INFORMATION
{
48 ACCESS_MASK GrantedAccess
;
52 ULONG NonPagedPoolUsage
;
54 ULONG NameInformationLength
;
55 ULONG TypeInformationLength
;
56 ULONG SecurityDescriptorLength
;
57 LARGE_INTEGER CreateTime
;
58 } OBJECT_BASIC_INFORMATION
, *POBJECT_BASIC_INFORMATION
;
60 #define expect_eq(expr, value, type, format) { type ret = expr; ok((value) == ret, #expr " expected " format " got " format "\n", (value), (ret)); }
62 typedef VOID (WINAPI
*fnBuildTrusteeWithSidA
)( PTRUSTEEA pTrustee
, PSID pSid
);
63 typedef VOID (WINAPI
*fnBuildTrusteeWithNameA
)( PTRUSTEEA pTrustee
, LPSTR pName
);
64 typedef VOID (WINAPI
*fnBuildTrusteeWithObjectsAndNameA
)( PTRUSTEEA pTrustee
,
65 POBJECTS_AND_NAME_A pObjName
,
66 SE_OBJECT_TYPE ObjectType
,
68 LPSTR InheritedObjectTypeName
,
70 typedef VOID (WINAPI
*fnBuildTrusteeWithObjectsAndSidA
)( PTRUSTEEA pTrustee
,
71 POBJECTS_AND_SID pObjSid
,
73 GUID
* pInheritedObjectGuid
,
75 typedef LPSTR (WINAPI
*fnGetTrusteeNameA
)( PTRUSTEEA pTrustee
);
76 typedef BOOL (WINAPI
*fnMakeSelfRelativeSD
)( PSECURITY_DESCRIPTOR
, PSECURITY_DESCRIPTOR
, LPDWORD
);
77 typedef BOOL (WINAPI
*fnConvertSidToStringSidA
)( PSID pSid
, LPSTR
*str
);
78 typedef BOOL (WINAPI
*fnConvertStringSidToSidA
)( LPCSTR str
, PSID pSid
);
79 static BOOL (WINAPI
*pConvertStringSecurityDescriptorToSecurityDescriptorA
)(LPCSTR
, DWORD
,
80 PSECURITY_DESCRIPTOR
*, PULONG
);
81 static BOOL (WINAPI
*pConvertSecurityDescriptorToStringSecurityDescriptorA
)(PSECURITY_DESCRIPTOR
, DWORD
,
82 SECURITY_INFORMATION
, LPSTR
*, PULONG
);
83 typedef BOOL (WINAPI
*fnGetFileSecurityA
)(LPCSTR
, SECURITY_INFORMATION
,
84 PSECURITY_DESCRIPTOR
, DWORD
, LPDWORD
);
85 static DWORD (WINAPI
*pGetNamedSecurityInfoA
)(LPSTR
, SE_OBJECT_TYPE
, SECURITY_INFORMATION
,
86 PSID
*, PSID
*, PACL
*, PACL
*,
87 PSECURITY_DESCRIPTOR
*);
88 typedef DWORD (WINAPI
*fnRtlAdjustPrivilege
)(ULONG
,BOOLEAN
,BOOLEAN
,PBOOLEAN
);
89 typedef BOOL (WINAPI
*fnCreateWellKnownSid
)(WELL_KNOWN_SID_TYPE
,PSID
,PSID
,DWORD
*);
90 typedef BOOL (WINAPI
*fnDuplicateTokenEx
)(HANDLE
,DWORD
,LPSECURITY_ATTRIBUTES
,
91 SECURITY_IMPERSONATION_LEVEL
,TOKEN_TYPE
,PHANDLE
);
93 typedef NTSTATUS (WINAPI
*fnLsaQueryInformationPolicy
)(LSA_HANDLE
,POLICY_INFORMATION_CLASS
,PVOID
*);
94 typedef NTSTATUS (WINAPI
*fnLsaClose
)(LSA_HANDLE
);
95 typedef NTSTATUS (WINAPI
*fnLsaFreeMemory
)(PVOID
);
96 typedef NTSTATUS (WINAPI
*fnLsaOpenPolicy
)(PLSA_UNICODE_STRING
,PLSA_OBJECT_ATTRIBUTES
,ACCESS_MASK
,PLSA_HANDLE
);
97 static NTSTATUS (WINAPI
*pNtQueryObject
)(HANDLE
,OBJECT_INFORMATION_CLASS
,PVOID
,ULONG
,PULONG
);
98 static DWORD (WINAPI
*pSetEntriesInAclW
)(ULONG
, PEXPLICIT_ACCESSW
, PACL
, PACL
*);
102 static char** myARGV
;
104 fnBuildTrusteeWithSidA pBuildTrusteeWithSidA
;
105 fnBuildTrusteeWithNameA pBuildTrusteeWithNameA
;
106 fnBuildTrusteeWithObjectsAndNameA pBuildTrusteeWithObjectsAndNameA
;
107 fnBuildTrusteeWithObjectsAndSidA pBuildTrusteeWithObjectsAndSidA
;
108 fnGetTrusteeNameA pGetTrusteeNameA
;
109 fnMakeSelfRelativeSD pMakeSelfRelativeSD
;
110 fnConvertSidToStringSidA pConvertSidToStringSidA
;
111 fnConvertStringSidToSidA pConvertStringSidToSidA
;
112 fnGetFileSecurityA pGetFileSecurityA
;
113 fnRtlAdjustPrivilege pRtlAdjustPrivilege
;
114 fnCreateWellKnownSid pCreateWellKnownSid
;
115 fnDuplicateTokenEx pDuplicateTokenEx
;
116 fnLsaQueryInformationPolicy pLsaQueryInformationPolicy
;
117 fnLsaClose pLsaClose
;
118 fnLsaFreeMemory pLsaFreeMemory
;
119 fnLsaOpenPolicy pLsaOpenPolicy
;
123 SID_IDENTIFIER_AUTHORITY auth
;
127 static void init(void)
131 hntdll
= GetModuleHandleA("ntdll.dll");
132 pNtQueryObject
= (void *)GetProcAddress( hntdll
, "NtQueryObject" );
134 hmod
= GetModuleHandle("advapi32.dll");
135 pConvertStringSecurityDescriptorToSecurityDescriptorA
=
136 (void *)GetProcAddress(hmod
, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
137 pConvertSecurityDescriptorToStringSecurityDescriptorA
=
138 (void *)GetProcAddress(hmod
, "ConvertSecurityDescriptorToStringSecurityDescriptorA" );
139 pMakeSelfRelativeSD
= (void *)GetProcAddress(hmod
, "MakeSelfRelativeSD");
140 pGetNamedSecurityInfoA
= (void *)GetProcAddress(hmod
, "GetNamedSecurityInfoA");
141 pSetEntriesInAclW
= (void *)GetProcAddress(hmod
, "SetEntriesInAclW");
142 pCreateWellKnownSid
= (fnCreateWellKnownSid
)GetProcAddress( hmod
, "CreateWellKnownSid" );
144 myARGC
= winetest_get_mainargs( &myARGV
);
147 static void test_str_sid(const char *str_sid
)
152 if (pConvertStringSidToSidA(str_sid
, &psid
))
154 if (pConvertSidToStringSidA(psid
, &temp
))
156 trace(" %s: %s\n", str_sid
, temp
);
163 if (GetLastError() != ERROR_INVALID_SID
)
164 trace(" %s: couldn't be converted, returned %d\n", str_sid
, GetLastError());
166 trace(" %s: couldn't be converted\n", str_sid
);
170 static void test_sid(void)
172 struct sidRef refs
[] = {
173 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
174 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
175 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
176 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
177 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
178 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
180 const char noSubAuthStr
[] = "S-1-5";
187 pConvertSidToStringSidA
= (fnConvertSidToStringSidA
)
188 GetProcAddress( hmod
, "ConvertSidToStringSidA" );
189 if( !pConvertSidToStringSidA
)
191 pConvertStringSidToSidA
= (fnConvertStringSidToSidA
)
192 GetProcAddress( hmod
, "ConvertStringSidToSidA" );
193 if( !pConvertStringSidToSidA
)
196 r
= pConvertStringSidToSidA( NULL
, NULL
);
197 ok( !r
, "expected failure with NULL parameters\n" );
198 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
200 ok( GetLastError() == ERROR_INVALID_PARAMETER
,
201 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
204 r
= pConvertStringSidToSidA( refs
[0].refStr
, NULL
);
205 ok( !r
&& GetLastError() == ERROR_INVALID_PARAMETER
,
206 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
209 r
= pConvertStringSidToSidA( NULL
, &str
);
210 ok( !r
&& GetLastError() == ERROR_INVALID_PARAMETER
,
211 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
214 r
= pConvertStringSidToSidA( noSubAuthStr
, &psid
);
216 "expected failure with no sub authorities\n" );
217 ok( GetLastError() == ERROR_INVALID_SID
,
218 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
221 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid
), "ConvertStringSidToSidA failed\n");
223 ok(pisid
->SubAuthorityCount
== 4, "Invalid sub authority count - expected 4, got %d\n", pisid
->SubAuthorityCount
);
224 ok(pisid
->SubAuthority
[0] == 21, "Invalid subauthority 0 - expceted 21, got %d\n", pisid
->SubAuthority
[0]);
225 ok(pisid
->SubAuthority
[3] == 4576, "Invalid subauthority 0 - expceted 4576, got %d\n", pisid
->SubAuthority
[3]);
228 for( i
= 0; i
< sizeof(refs
) / sizeof(refs
[0]); i
++ )
232 r
= AllocateAndInitializeSid( &refs
[i
].auth
, 1,1,0,0,0,0,0,0,0,
234 ok( r
, "failed to allocate sid\n" );
235 r
= pConvertSidToStringSidA( psid
, &str
);
236 ok( r
, "failed to convert sid\n" );
239 ok( !strcmp( str
, refs
[i
].refStr
),
240 "incorrect sid, expected %s, got %s\n", refs
[i
].refStr
, str
);
246 r
= pConvertStringSidToSidA( refs
[i
].refStr
, &psid
);
247 ok( r
, "failed to parse sid string\n" );
250 !memcmp( pisid
->IdentifierAuthority
.Value
, refs
[i
].auth
.Value
,
251 sizeof(refs
[i
].auth
) ),
252 "string sid %s didn't parse to expected value\n"
253 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
255 MAKEWORD( pisid
->IdentifierAuthority
.Value
[1],
256 pisid
->IdentifierAuthority
.Value
[0] ),
257 MAKELONG( MAKEWORD( pisid
->IdentifierAuthority
.Value
[5],
258 pisid
->IdentifierAuthority
.Value
[4] ),
259 MAKEWORD( pisid
->IdentifierAuthority
.Value
[3],
260 pisid
->IdentifierAuthority
.Value
[2] ) ),
261 MAKEWORD( refs
[i
].auth
.Value
[1], refs
[i
].auth
.Value
[0] ),
262 MAKELONG( MAKEWORD( refs
[i
].auth
.Value
[5], refs
[i
].auth
.Value
[4] ),
263 MAKEWORD( refs
[i
].auth
.Value
[3], refs
[i
].auth
.Value
[2] ) ) );
268 trace("String SIDs:\n");
309 static void test_trustee(void)
311 GUID ObjectType
= {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
312 GUID InheritedObjectType
= {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
314 OBJECTS_AND_NAME_ oan
;
318 char szObjectTypeName
[] = "ObjectTypeName";
319 char szInheritedObjectTypeName
[] = "InheritedObjectTypeName";
320 char szTrusteeName
[] = "szTrusteeName";
321 SID_IDENTIFIER_AUTHORITY auth
= { {0x11,0x22,0,0,0, 0} };
323 memset( &ZeroGuid
, 0x00, sizeof (ZeroGuid
) );
325 pBuildTrusteeWithSidA
= (fnBuildTrusteeWithSidA
)
326 GetProcAddress( hmod
, "BuildTrusteeWithSidA" );
327 pBuildTrusteeWithNameA
= (fnBuildTrusteeWithNameA
)
328 GetProcAddress( hmod
, "BuildTrusteeWithNameA" );
329 pBuildTrusteeWithObjectsAndNameA
= (fnBuildTrusteeWithObjectsAndNameA
)
330 GetProcAddress (hmod
, "BuildTrusteeWithObjectsAndNameA" );
331 pBuildTrusteeWithObjectsAndSidA
= (fnBuildTrusteeWithObjectsAndSidA
)
332 GetProcAddress (hmod
, "BuildTrusteeWithObjectsAndSidA" );
333 pGetTrusteeNameA
= (fnGetTrusteeNameA
)
334 GetProcAddress (hmod
, "GetTrusteeNameA" );
335 if( !pBuildTrusteeWithSidA
|| !pBuildTrusteeWithNameA
||
336 !pBuildTrusteeWithObjectsAndNameA
|| !pBuildTrusteeWithObjectsAndSidA
||
340 if ( ! AllocateAndInitializeSid( &auth
, 1, 42, 0,0,0,0,0,0,0,&psid
) )
342 trace( "failed to init SID\n" );
346 /* test BuildTrusteeWithSidA */
347 memset( &trustee
, 0xff, sizeof trustee
);
348 pBuildTrusteeWithSidA( &trustee
, psid
);
350 ok( trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
351 ok( trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
,
352 "MultipleTrusteeOperation wrong\n");
353 ok( trustee
.TrusteeForm
== TRUSTEE_IS_SID
, "TrusteeForm wrong\n");
354 ok( trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
355 ok( trustee
.ptstrName
== (LPSTR
) psid
, "ptstrName wrong\n" );
357 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
358 memset( &trustee
, 0xff, sizeof trustee
);
359 memset( &oas
, 0xff, sizeof(oas
) );
360 pBuildTrusteeWithObjectsAndSidA(&trustee
, &oas
, &ObjectType
,
361 &InheritedObjectType
, psid
);
363 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
364 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
365 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_SID
, "TrusteeForm wrong\n");
366 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
367 ok(trustee
.ptstrName
== (LPSTR
)&oas
, "ptstrName wrong\n");
369 ok(oas
.ObjectsPresent
== (ACE_OBJECT_TYPE_PRESENT
| ACE_INHERITED_OBJECT_TYPE_PRESENT
), "ObjectsPresent wrong\n");
370 ok(!memcmp(&oas
.ObjectTypeGuid
, &ObjectType
, sizeof(GUID
)), "ObjectTypeGuid wrong\n");
371 ok(!memcmp(&oas
.InheritedObjectTypeGuid
, &InheritedObjectType
, sizeof(GUID
)), "InheritedObjectTypeGuid wrong\n");
372 ok(oas
.pSid
== psid
, "pSid wrong\n");
374 /* test GetTrusteeNameA */
375 ok(pGetTrusteeNameA(&trustee
) == (LPSTR
)&oas
, "GetTrusteeName returned wrong value\n");
377 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
378 memset( &trustee
, 0xff, sizeof trustee
);
379 memset( &oas
, 0xff, sizeof(oas
) );
380 pBuildTrusteeWithObjectsAndSidA(&trustee
, &oas
, NULL
,
381 &InheritedObjectType
, psid
);
383 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
384 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
385 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_SID
, "TrusteeForm wrong\n");
386 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
387 ok(trustee
.ptstrName
== (LPSTR
)&oas
, "ptstrName wrong\n");
389 ok(oas
.ObjectsPresent
== ACE_INHERITED_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
390 ok(!memcmp(&oas
.ObjectTypeGuid
, &ZeroGuid
, sizeof(GUID
)), "ObjectTypeGuid wrong\n");
391 ok(!memcmp(&oas
.InheritedObjectTypeGuid
, &InheritedObjectType
, sizeof(GUID
)), "InheritedObjectTypeGuid wrong\n");
392 ok(oas
.pSid
== psid
, "pSid wrong\n");
396 /* test BuildTrusteeWithNameA */
397 memset( &trustee
, 0xff, sizeof trustee
);
398 pBuildTrusteeWithNameA( &trustee
, szTrusteeName
);
400 ok( trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
401 ok( trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
,
402 "MultipleTrusteeOperation wrong\n");
403 ok( trustee
.TrusteeForm
== TRUSTEE_IS_NAME
, "TrusteeForm wrong\n");
404 ok( trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
405 ok( trustee
.ptstrName
== szTrusteeName
, "ptstrName wrong\n" );
407 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
408 memset( &trustee
, 0xff, sizeof trustee
);
409 memset( &oan
, 0xff, sizeof(oan
) );
410 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, szObjectTypeName
,
411 szInheritedObjectTypeName
, szTrusteeName
);
413 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
414 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
415 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
416 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
417 ok(trustee
.ptstrName
== (LPTSTR
)&oan
, "ptstrName wrong\n");
419 ok(oan
.ObjectsPresent
== (ACE_OBJECT_TYPE_PRESENT
| ACE_INHERITED_OBJECT_TYPE_PRESENT
), "ObjectsPresent wrong\n");
420 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
421 ok(oan
.InheritedObjectTypeName
== szInheritedObjectTypeName
, "InheritedObjectTypeName wrong\n");
422 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
424 /* test GetTrusteeNameA */
425 ok(pGetTrusteeNameA(&trustee
) == (LPSTR
)&oan
, "GetTrusteeName returned wrong value\n");
427 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
428 memset( &trustee
, 0xff, sizeof trustee
);
429 memset( &oan
, 0xff, sizeof(oan
) );
430 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, NULL
,
431 szInheritedObjectTypeName
, szTrusteeName
);
433 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
434 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
435 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
436 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
437 ok(trustee
.ptstrName
== (LPSTR
)&oan
, "ptstrName wrong\n");
439 ok(oan
.ObjectsPresent
== ACE_INHERITED_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
440 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
441 ok(oan
.InheritedObjectTypeName
== szInheritedObjectTypeName
, "InheritedObjectTypeName wrong\n");
442 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
444 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
445 memset( &trustee
, 0xff, sizeof trustee
);
446 memset( &oan
, 0xff, sizeof(oan
) );
447 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, szObjectTypeName
,
448 NULL
, szTrusteeName
);
450 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
451 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
452 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
453 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
454 ok(trustee
.ptstrName
== (LPTSTR
)&oan
, "ptstrName wrong\n");
456 ok(oan
.ObjectsPresent
== ACE_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
457 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
458 ok(oan
.InheritedObjectTypeName
== NULL
, "InheritedObjectTypeName wrong\n");
459 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
462 /* If the first isn't defined, assume none is */
463 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
464 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
465 #define SE_CREATE_TOKEN_PRIVILEGE 2L
466 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
467 #define SE_LOCK_MEMORY_PRIVILEGE 4L
468 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
469 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
470 #define SE_TCB_PRIVILEGE 7L
471 #define SE_SECURITY_PRIVILEGE 8L
472 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
473 #define SE_LOAD_DRIVER_PRIVILEGE 10L
474 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
475 #define SE_SYSTEMTIME_PRIVILEGE 12L
476 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
477 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
478 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
479 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
480 #define SE_BACKUP_PRIVILEGE 17L
481 #define SE_RESTORE_PRIVILEGE 18L
482 #define SE_SHUTDOWN_PRIVILEGE 19L
483 #define SE_DEBUG_PRIVILEGE 20L
484 #define SE_AUDIT_PRIVILEGE 21L
485 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
486 #define SE_CHANGE_NOTIFY_PRIVILLEGE 23L
487 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
488 #define SE_UNDOCK_PRIVILEGE 25L
489 #define SE_SYNC_AGENT_PRIVILEGE 26L
490 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
491 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
492 #define SE_IMPERSONATE_PRIVILEGE 29L
493 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
494 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
495 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
497 static void test_allocateLuid(void)
499 BOOL (WINAPI
*pAllocateLocallyUniqueId
)(PLUID
);
503 pAllocateLocallyUniqueId
= (void*)GetProcAddress(hmod
, "AllocateLocallyUniqueId");
504 if (!pAllocateLocallyUniqueId
) return;
506 ret
= pAllocateLocallyUniqueId(&luid1
);
507 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
511 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
512 ret
= pAllocateLocallyUniqueId(&luid2
);
514 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
515 ok(luid1
.LowPart
> SE_MAX_WELL_KNOWN_PRIVILEGE
|| luid1
.HighPart
!= 0,
516 "AllocateLocallyUniqueId returned a well-known LUID\n");
517 ok(luid1
.LowPart
!= luid2
.LowPart
|| luid1
.HighPart
!= luid2
.HighPart
,
518 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
519 ret
= pAllocateLocallyUniqueId(NULL
);
520 ok( !ret
&& GetLastError() == ERROR_NOACCESS
,
521 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
525 static void test_lookupPrivilegeName(void)
527 BOOL (WINAPI
*pLookupPrivilegeNameA
)(LPCSTR
, PLUID
, LPSTR
, LPDWORD
);
528 char buf
[MAX_PATH
]; /* arbitrary, seems long enough */
529 DWORD cchName
= sizeof(buf
);
530 LUID luid
= { 0, 0 };
534 /* check whether it's available first */
535 pLookupPrivilegeNameA
= (void*)GetProcAddress(hmod
, "LookupPrivilegeNameA");
536 if (!pLookupPrivilegeNameA
) return;
537 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
538 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
539 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
542 /* check with a short buffer */
544 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
545 ret
= pLookupPrivilegeNameA(NULL
, &luid
, NULL
, &cchName
);
546 ok( !ret
&& GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
547 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
549 ok(cchName
== strlen("SeCreateTokenPrivilege") + 1,
550 "LookupPrivilegeNameA returned an incorrect required length for\n"
551 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName
,
552 lstrlenA("SeCreateTokenPrivilege") + 1);
553 /* check a known value and its returned length on success */
554 cchName
= sizeof(buf
);
555 ok(pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
) &&
556 cchName
== strlen("SeCreateTokenPrivilege"),
557 "LookupPrivilegeNameA returned an incorrect output length for\n"
558 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName
,
559 (int)strlen("SeCreateTokenPrivilege"));
560 /* check known values */
561 for (i
= SE_MIN_WELL_KNOWN_PRIVILEGE
; i
< SE_MAX_WELL_KNOWN_PRIVILEGE
; i
++)
564 cchName
= sizeof(buf
);
565 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
566 ok( ret
|| GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
567 "LookupPrivilegeNameA(0.%d) failed: %d\n", i
, GetLastError());
569 /* check a bogus LUID */
570 luid
.LowPart
= 0xdeadbeef;
571 cchName
= sizeof(buf
);
572 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
573 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
574 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
576 /* check on a bogus system */
577 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
578 cchName
= sizeof(buf
);
579 ret
= pLookupPrivilegeNameA("b0gu5.Nam3", &luid
, buf
, &cchName
);
580 ok( !ret
&& GetLastError() == RPC_S_SERVER_UNAVAILABLE
,
581 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
591 static void test_lookupPrivilegeValue(void)
593 static const struct NameToLUID privs
[] = {
594 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE
},
595 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE
},
596 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE
},
597 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE
},
598 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE
},
599 { "SeTcbPrivilege", SE_TCB_PRIVILEGE
},
600 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE
},
601 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE
},
602 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE
},
603 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE
},
604 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE
},
605 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE
},
606 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE
},
607 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE
},
608 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE
},
609 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE
},
610 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE
},
611 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE
},
612 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE
},
613 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE
},
614 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE
},
615 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILLEGE
},
616 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE
},
617 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE
},
618 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE
},
619 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE
},
620 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE
},
621 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE
},
622 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE
},
624 BOOL (WINAPI
*pLookupPrivilegeValueA
)(LPCSTR
, LPCSTR
, PLUID
);
629 /* check whether it's available first */
630 pLookupPrivilegeValueA
= (void*)GetProcAddress(hmod
, "LookupPrivilegeValueA");
631 if (!pLookupPrivilegeValueA
) return;
632 ret
= pLookupPrivilegeValueA(NULL
, "SeCreateTokenPrivilege", &luid
);
633 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
636 /* check a bogus system name */
637 ret
= pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid
);
638 ok( !ret
&& GetLastError() == RPC_S_SERVER_UNAVAILABLE
,
639 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
641 /* check a NULL string */
642 ret
= pLookupPrivilegeValueA(NULL
, 0, &luid
);
643 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
644 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
646 /* check a bogus privilege name */
647 ret
= pLookupPrivilegeValueA(NULL
, "SeBogusPrivilege", &luid
);
648 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
649 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
651 /* check case insensitive */
652 ret
= pLookupPrivilegeValueA(NULL
, "sEcREATEtOKENpRIVILEGE", &luid
);
654 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
656 for (i
= 0; i
< sizeof(privs
) / sizeof(privs
[0]); i
++)
658 /* Not all privileges are implemented on all Windows versions, so
659 * don't worry if the call fails
661 if (pLookupPrivilegeValueA(NULL
, privs
[i
].name
, &luid
))
663 ok(luid
.LowPart
== privs
[i
].lowPart
,
664 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
670 static void test_luid(void)
673 test_lookupPrivilegeName();
674 test_lookupPrivilegeValue();
677 static void test_FileSecurity(void)
679 char directory
[MAX_PATH
];
680 DWORD retval
, outSize
;
684 pGetFileSecurityA
= (fnGetFileSecurityA
)
685 GetProcAddress( hmod
, "GetFileSecurityA" );
686 if( !pGetFileSecurityA
)
689 retval
= GetTempPathA(sizeof(directory
), directory
);
691 trace("GetTempPathA failed\n");
695 strcpy(directory
, "\\Should not exist");
697 SetLastError(NO_ERROR
);
698 result
= pGetFileSecurityA( directory
,OWNER_SECURITY_INFORMATION
,buffer
,0x40,&outSize
);
699 ok(!result
, "GetFileSecurityA should fail for not existing directories/files\n");
700 ok( (GetLastError() == ERROR_FILE_NOT_FOUND
) ||
701 (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
) ,
702 "last error ERROR_FILE_NOT_FOUND / ERROR_CALL_NOT_IMPLEMENTED (98) "
703 "expected, got %d\n", GetLastError());
706 static void test_AccessCheck(void)
708 PSID EveryoneSid
= NULL
, AdminSid
= NULL
, UsersSid
= NULL
;
710 SECURITY_DESCRIPTOR
*SecurityDescriptor
= NULL
;
711 SID_IDENTIFIER_AUTHORITY SIDAuthWorld
= { SECURITY_WORLD_SID_AUTHORITY
};
712 SID_IDENTIFIER_AUTHORITY SIDAuthNT
= { SECURITY_NT_AUTHORITY
};
713 GENERIC_MAPPING Mapping
= { KEY_READ
, KEY_WRITE
, KEY_EXECUTE
, KEY_ALL_ACCESS
};
720 PRIVILEGE_SET
*PrivSet
;
726 NtDllModule
= GetModuleHandle("ntdll.dll");
729 skip("not running on NT, skipping test\n");
732 pRtlAdjustPrivilege
= (fnRtlAdjustPrivilege
)
733 GetProcAddress(NtDllModule
, "RtlAdjustPrivilege");
734 if (!pRtlAdjustPrivilege
)
736 skip("missing RtlAdjustPrivilege, skipping test\n");
740 Acl
= HeapAlloc(GetProcessHeap(), 0, 256);
741 res
= InitializeAcl(Acl
, 256, ACL_REVISION
);
742 if(!res
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
744 skip("ACLs not implemented - skipping tests\n");
745 HeapFree(GetProcessHeap(), 0, Acl
);
748 ok(res
, "InitializeAcl failed with error %d\n", GetLastError());
750 res
= AllocateAndInitializeSid( &SIDAuthWorld
, 1, SECURITY_WORLD_RID
, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid
);
751 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
753 res
= AllocateAndInitializeSid( &SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
754 DOMAIN_ALIAS_RID_ADMINS
, 0, 0, 0, 0, 0, 0, &AdminSid
);
755 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
757 res
= AllocateAndInitializeSid( &SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
758 DOMAIN_ALIAS_RID_USERS
, 0, 0, 0, 0, 0, 0, &UsersSid
);
759 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
761 SecurityDescriptor
= HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH
);
763 res
= InitializeSecurityDescriptor(SecurityDescriptor
, SECURITY_DESCRIPTOR_REVISION
);
764 ok(res
, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
766 res
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
767 ok(res
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
769 PrivSetLen
= FIELD_OFFSET(PRIVILEGE_SET
, Privilege
[16]);
770 PrivSet
= HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY
, PrivSetLen
);
771 PrivSet
->PrivilegeCount
= 16;
773 res
= OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE
|TOKEN_QUERY
, &ProcessToken
);
774 ok(res
, "OpenProcessToken failed with error %d\n", GetLastError());
776 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE
, FALSE
, TRUE
, &Enabled
);
778 res
= DuplicateToken(ProcessToken
, SecurityIdentification
, &Token
);
779 ok(res
, "DuplicateToken failed with error %d\n", GetLastError());
781 /* SD without owner/group */
782 SetLastError(0xdeadbeef);
783 Access
= AccessStatus
= 0xdeadbeef;
784 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_QUERY_VALUE
, &Mapping
,
785 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
786 err
= GetLastError();
787 ok(!ret
&& err
== ERROR_INVALID_SECURITY_DESCR
, "AccessCheck should have "
788 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err
);
789 ok(Access
== 0xdeadbeef && AccessStatus
== 0xdeadbeef,
790 "Access and/or AccessStatus were changed!\n");
792 /* Set owner and group */
793 res
= SetSecurityDescriptorOwner(SecurityDescriptor
, AdminSid
, FALSE
);
794 ok(res
, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
795 res
= SetSecurityDescriptorGroup(SecurityDescriptor
, UsersSid
, TRUE
);
796 ok(res
, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
798 /* Generic access mask */
799 SetLastError(0xdeadbeef);
800 ret
= AccessCheck(SecurityDescriptor
, Token
, GENERIC_READ
, &Mapping
,
801 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
802 err
= GetLastError();
803 ok(!ret
&& err
== ERROR_GENERIC_NOT_MAPPED
, "AccessCheck should have failed "
804 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err
);
805 ok(Access
== 0xdeadbeef && AccessStatus
== 0xdeadbeef,
806 "Access and/or AccessStatus were changed!\n");
808 /* sd with no dacl present */
809 ret
= SetSecurityDescriptorDacl(SecurityDescriptor
, FALSE
, NULL
, FALSE
);
810 ok(ret
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
811 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
812 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
813 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
814 ok(AccessStatus
&& (Access
== KEY_READ
),
815 "AccessCheck failed to grant access with error %d\n",
818 /* sd with NULL dacl */
819 ret
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, NULL
, FALSE
);
820 ok(ret
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
821 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
822 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
823 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
824 ok(AccessStatus
&& (Access
== KEY_READ
),
825 "AccessCheck failed to grant access with error %d\n",
828 /* sd with blank dacl */
829 ret
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
830 ok(ret
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
831 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
832 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
833 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
834 err
= GetLastError();
835 ok(!AccessStatus
&& err
== ERROR_ACCESS_DENIED
, "AccessCheck should have failed "
836 "with ERROR_ACCESS_DENIED, instead of %d\n", err
);
837 ok(!Access
, "Should have failed to grant any access, got 0x%08x\n", Access
);
839 res
= AddAccessAllowedAce(Acl
, ACL_REVISION
, KEY_READ
, EveryoneSid
);
840 ok(res
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
842 res
= AddAccessDeniedAce(Acl
, ACL_REVISION
, KEY_SET_VALUE
, AdminSid
);
843 ok(res
, "AddAccessDeniedAce failed with error %d\n", GetLastError());
846 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
847 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
848 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
849 ok(AccessStatus
&& (Access
== KEY_READ
),
850 "AccessCheck failed to grant access with error %d\n",
853 ret
= AccessCheck(SecurityDescriptor
, Token
, MAXIMUM_ALLOWED
, &Mapping
,
854 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
855 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
857 "AccessCheck failed to grant any access with error %d\n",
859 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access
);
861 /* Access denied by SD */
862 SetLastError(0xdeadbeef);
863 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_WRITE
, &Mapping
,
864 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
865 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
866 err
= GetLastError();
867 ok(!AccessStatus
&& err
== ERROR_ACCESS_DENIED
, "AccessCheck should have failed "
868 "with ERROR_ACCESS_DENIED, instead of %d\n", err
);
869 ok(!Access
, "Should have failed to grant any access, got 0x%08x\n", Access
);
872 PrivSet
->PrivilegeCount
= 16;
873 ret
= AccessCheck(SecurityDescriptor
, Token
, ACCESS_SYSTEM_SECURITY
, &Mapping
,
874 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
875 ok(ret
&& !AccessStatus
&& GetLastError() == ERROR_PRIVILEGE_NOT_HELD
,
876 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
879 ret
= ImpersonateLoggedOnUser(Token
);
880 ok(ret
, "ImpersonateLoggedOnUser failed with error %d\n", GetLastError());
881 ret
= pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE
, TRUE
, TRUE
, &Enabled
);
885 PrivSet
->PrivilegeCount
= 16;
886 ret
= AccessCheck(SecurityDescriptor
, Token
, ACCESS_SYSTEM_SECURITY
, &Mapping
,
887 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
888 ok(ret
&& AccessStatus
&& GetLastError() == 0,
889 "AccessCheck should have succeeded, error %d\n",
891 ok(Access
== ACCESS_SYSTEM_SECURITY
,
892 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
896 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
898 ret
= RevertToSelf();
899 ok(ret
, "RevertToSelf failed with error %d\n", GetLastError());
901 /* test INHERIT_ONLY_ACE */
902 ret
= InitializeAcl(Acl
, 256, ACL_REVISION
);
903 ok(ret
, "InitializeAcl failed with error %d\n", GetLastError());
904 ret
= AddAccessAllowedAceEx(Acl
, ACL_REVISION
, INHERIT_ONLY_ACE
, KEY_READ
, EveryoneSid
);
905 ok(ret
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
907 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
908 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
909 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
910 err
= GetLastError();
911 ok(!AccessStatus
&& err
== ERROR_ACCESS_DENIED
, "AccessCheck should have failed "
912 "with ERROR_ACCESS_DENIED, instead of %d\n", err
);
913 ok(!Access
, "Should have failed to grant any access, got 0x%08x\n", Access
);
917 res
= DuplicateToken(ProcessToken
, SecurityAnonymous
, &Token
);
918 ok(res
, "DuplicateToken failed with error %d\n", GetLastError());
920 SetLastError(0xdeadbeef);
921 ret
= AccessCheck(SecurityDescriptor
, Token
, MAXIMUM_ALLOWED
, &Mapping
,
922 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
923 err
= GetLastError();
924 ok(!ret
&& err
== ERROR_BAD_IMPERSONATION_LEVEL
, "AccessCheck should have failed "
925 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err
);
929 SetLastError(0xdeadbeef);
930 ret
= AccessCheck(SecurityDescriptor
, ProcessToken
, KEY_READ
, &Mapping
,
931 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
932 err
= GetLastError();
933 ok(!ret
&& err
== ERROR_NO_IMPERSONATION_TOKEN
, "AccessCheck should have failed "
934 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err
);
936 CloseHandle(ProcessToken
);
939 FreeSid(EveryoneSid
);
944 HeapFree(GetProcessHeap(), 0, Acl
);
945 HeapFree(GetProcessHeap(), 0, SecurityDescriptor
);
946 HeapFree(GetProcessHeap(), 0, PrivSet
);
949 /* test GetTokenInformation for the various attributes */
950 static void test_token_attr(void)
952 HANDLE Token
, ImpersonationToken
;
954 TOKEN_PRIVILEGES
*Privileges
;
955 TOKEN_GROUPS
*Groups
;
960 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
962 /* cygwin-like use case */
963 SetLastError(0xdeadbeef);
964 ret
= OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED
, &Token
);
965 if(!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
967 skip("OpenProcessToken is not implemented\n");
970 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
975 ret
= GetTokenInformation(Token
, TokenUser
,(void*)buf
, Size
, &Size
);
976 ok(ret
, "GetTokenInformation failed with error %d\n", GetLastError());
977 Size
= sizeof(ImpersonationLevel
);
978 ret
= GetTokenInformation(Token
, TokenImpersonationLevel
, &ImpersonationLevel
, Size
, &Size
);
979 GLE
= GetLastError();
980 ok(!ret
&& (GLE
== ERROR_INVALID_PARAMETER
), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE
);
984 if(!pConvertSidToStringSidA
)
986 skip("ConvertSidToStringSidA is not available\n");
990 SetLastError(0xdeadbeef);
991 ret
= OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY
|TOKEN_DUPLICATE
, &Token
);
992 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
995 ret
= GetTokenInformation(Token
, TokenGroups
, NULL
, 0, &Size
);
996 Groups
= HeapAlloc(GetProcessHeap(), 0, Size
);
997 ret
= GetTokenInformation(Token
, TokenGroups
, Groups
, Size
, &Size
);
998 ok(ret
, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
999 trace("TokenGroups:\n");
1000 for (i
= 0; i
< Groups
->GroupCount
; i
++)
1002 DWORD NameLength
= 255;
1004 DWORD DomainLength
= 255;
1006 SID_NAME_USE SidNameUse
;
1007 pConvertSidToStringSidA(Groups
->Groups
[i
].Sid
, &SidString
);
1010 ret
= LookupAccountSid(NULL
, Groups
->Groups
[i
].Sid
, Name
, &NameLength
, Domain
, &DomainLength
, &SidNameUse
);
1012 trace("\t%s, %s\\%s use: %d attr: 0x%08x\n", SidString
, Domain
, Name
, SidNameUse
, Groups
->Groups
[i
].Attributes
);
1014 trace("\t%s, attr: 0x%08x LookupAccountSid failed with error %d\n", SidString
, Groups
->Groups
[i
].Attributes
, GetLastError());
1015 LocalFree(SidString
);
1017 HeapFree(GetProcessHeap(), 0, Groups
);
1020 ret
= GetTokenInformation(Token
, TokenUser
, NULL
, 0, &Size
);
1021 ok(!ret
&& (GetLastError() == ERROR_INSUFFICIENT_BUFFER
),
1022 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1023 User
= HeapAlloc(GetProcessHeap(), 0, Size
);
1024 ret
= GetTokenInformation(Token
, TokenUser
, User
, Size
, &Size
);
1026 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1028 pConvertSidToStringSidA(User
->User
.Sid
, &SidString
);
1029 trace("TokenUser: %s attr: 0x%08x\n", SidString
, User
->User
.Attributes
);
1030 LocalFree(SidString
);
1031 HeapFree(GetProcessHeap(), 0, User
);
1034 ret
= GetTokenInformation(Token
, TokenPrivileges
, NULL
, 0, &Size
);
1035 ok(!ret
&& (GetLastError() == ERROR_INSUFFICIENT_BUFFER
),
1036 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1037 Privileges
= HeapAlloc(GetProcessHeap(), 0, Size
);
1038 ret
= GetTokenInformation(Token
, TokenPrivileges
, Privileges
, Size
, &Size
);
1040 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1041 trace("TokenPrivileges:\n");
1042 for (i
= 0; i
< Privileges
->PrivilegeCount
; i
++)
1045 DWORD NameLen
= sizeof(Name
)/sizeof(Name
[0]);
1046 LookupPrivilegeName(NULL
, &Privileges
->Privileges
[i
].Luid
, Name
, &NameLen
);
1047 trace("\t%s, 0x%x\n", Name
, Privileges
->Privileges
[i
].Attributes
);
1049 HeapFree(GetProcessHeap(), 0, Privileges
);
1051 ret
= DuplicateToken(Token
, SecurityAnonymous
, &ImpersonationToken
);
1052 ok(ret
, "DuplicateToken failed with error %d\n", GetLastError());
1054 Size
= sizeof(ImpersonationLevel
);
1055 ret
= GetTokenInformation(ImpersonationToken
, TokenImpersonationLevel
, &ImpersonationLevel
, Size
, &Size
);
1056 ok(ret
, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
1057 ok(ImpersonationLevel
== SecurityAnonymous
, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel
);
1059 CloseHandle(ImpersonationToken
);
1063 typedef union _MAX_SID
1066 char max
[SECURITY_MAX_SID_SIZE
];
1069 static void test_sid_str(PSID
* sid
)
1072 BOOL ret
= pConvertSidToStringSidA(sid
, &str_sid
);
1073 ok(ret
, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
1076 char account
[MAX_PATH
], domain
[MAX_PATH
];
1078 DWORD acc_size
= MAX_PATH
;
1079 DWORD dom_size
= MAX_PATH
;
1080 ret
= LookupAccountSid(NULL
, sid
, account
, &acc_size
, domain
, &dom_size
, &use
);
1081 ok(ret
|| (!ret
&& (GetLastError() == ERROR_NONE_MAPPED
)),
1082 "LookupAccountSid(%s) failed: %d\n", str_sid
, GetLastError());
1084 trace(" %s %s\\%s %d\n", str_sid
, domain
, account
, use
);
1085 else if (GetLastError() == ERROR_NONE_MAPPED
)
1086 trace(" %s couldn't be mapped\n", str_sid
);
1091 struct well_known_sid_value
1093 BOOL without_domain
;
1094 const char *sid_string
;
1095 } well_known_sid_values
[] = {
1096 /* 0 */ {TRUE
, "S-1-0-0"}, {TRUE
, "S-1-1-0"}, {TRUE
, "S-1-2-0"}, {TRUE
, "S-1-3-0"},
1097 /* 4 */ {TRUE
, "S-1-3-1"}, {TRUE
, "S-1-3-2"}, {TRUE
, "S-1-3-3"}, {TRUE
, "S-1-5"},
1098 /* 8 */ {FALSE
, "S-1-5-1"}, {TRUE
, "S-1-5-2"}, {TRUE
, "S-1-5-3"}, {TRUE
, "S-1-5-4"},
1099 /* 12 */ {TRUE
, "S-1-5-6"}, {TRUE
, "S-1-5-7"}, {TRUE
, "S-1-5-8"}, {TRUE
, "S-1-5-9"},
1100 /* 16 */ {TRUE
, "S-1-5-10"}, {TRUE
, "S-1-5-11"}, {TRUE
, "S-1-5-12"}, {TRUE
, "S-1-5-13"},
1101 /* 20 */ {TRUE
, "S-1-5-14"}, {FALSE
, NULL
}, {TRUE
, "S-1-5-18"}, {TRUE
, "S-1-5-19"},
1102 /* 24 */ {TRUE
, "S-1-5-20"}, {TRUE
, "S-1-5-32"},
1103 /* 26 */ {FALSE
, "S-1-5-32-544"}, {TRUE
, "S-1-5-32-545"}, {TRUE
, "S-1-5-32-546"},
1104 /* 29 */ {TRUE
, "S-1-5-32-547"}, {TRUE
, "S-1-5-32-548"}, {TRUE
, "S-1-5-32-549"},
1105 /* 32 */ {TRUE
, "S-1-5-32-550"}, {TRUE
, "S-1-5-32-551"}, {TRUE
, "S-1-5-32-552"},
1106 /* 35 */ {TRUE
, "S-1-5-32-554"}, {TRUE
, "S-1-5-32-555"}, {TRUE
, "S-1-5-32-556"},
1107 /* 38 */ {FALSE
, "S-1-5-21-12-23-34-45-56-500"}, {FALSE
, "S-1-5-21-12-23-34-45-56-501"},
1108 /* 40 */ {FALSE
, "S-1-5-21-12-23-34-45-56-502"}, {FALSE
, "S-1-5-21-12-23-34-45-56-512"},
1109 /* 42 */ {FALSE
, "S-1-5-21-12-23-34-45-56-513"}, {FALSE
, "S-1-5-21-12-23-34-45-56-514"},
1110 /* 44 */ {FALSE
, "S-1-5-21-12-23-34-45-56-515"}, {FALSE
, "S-1-5-21-12-23-34-45-56-516"},
1111 /* 46 */ {FALSE
, "S-1-5-21-12-23-34-45-56-517"}, {FALSE
, "S-1-5-21-12-23-34-45-56-518"},
1112 /* 48 */ {FALSE
, "S-1-5-21-12-23-34-45-56-519"}, {FALSE
, "S-1-5-21-12-23-34-45-56-520"},
1113 /* 50 */ {FALSE
, "S-1-5-21-12-23-34-45-56-553"},
1114 /* Added in Windows Server 2003 */
1115 /* 51 */ {TRUE
, "S-1-5-64-10"}, {TRUE
, "S-1-5-64-21"}, {TRUE
, "S-1-5-64-14"},
1116 /* 54 */ {TRUE
, "S-1-5-15"}, {TRUE
, "S-1-5-1000"}, {FALSE
, "S-1-5-32-557"},
1117 /* 57 */ {TRUE
, "S-1-5-32-558"}, {TRUE
, "S-1-5-32-559"}, {TRUE
, "S-1-5-32-560"},
1118 /* 60 */ {TRUE
, "S-1-5-32-561"}, {TRUE
, "S-1-5-32-562"},
1119 /* Added in Windows Vista: */
1120 /* 62 */ {TRUE
, "S-1-5-32-568"},
1121 /* 63 */ {TRUE
, "S-1-5-17"}, {FALSE
, "S-1-5-32-569"}, {TRUE
, "S-1-16-0"},
1122 /* 66 */ {TRUE
, "S-1-16-4096"}, {TRUE
, "S-1-16-8192"}, {TRUE
, "S-1-16-12288"},
1123 /* 69 */ {TRUE
, "S-1-16-16384"}, {TRUE
, "S-1-5-33"}, {TRUE
, "S-1-3-4"},
1124 /* 72 */ {FALSE
, "S-1-5-21-12-23-34-45-56-571"}, {FALSE
, "S-1-5-21-12-23-34-45-56-572"},
1125 /* 74 */ {TRUE
, "S-1-5-22"}, {FALSE
, "S-1-5-21-12-23-34-45-56-521"}, {TRUE
, "S-1-5-32-573"}
1128 static void test_CreateWellKnownSid()
1130 SID_IDENTIFIER_AUTHORITY ident
= { SECURITY_NT_AUTHORITY
};
1134 if (!pCreateWellKnownSid
)
1136 skip("CreateWellKnownSid not available\n");
1140 /* a domain sid usually have three subauthorities but we test that CreateWellKnownSid doesn't check it */
1141 AllocateAndInitializeSid(&ident
, 6, SECURITY_NT_NON_UNIQUE
, 12, 23, 34, 45, 56, 0, 0, &domainsid
);
1143 for (i
= 0; i
< sizeof(well_known_sid_values
)/sizeof(well_known_sid_values
[0]); i
++)
1145 struct well_known_sid_value
*value
= &well_known_sid_values
[i
];
1146 char sid_buffer
[SECURITY_MAX_SID_SIZE
];
1150 if (value
->sid_string
== NULL
)
1153 if (i
> WinAccountRasAndIasServersSid
)
1155 /* These SIDs aren't implemented by all Windows versions - detect it and break the loop */
1156 cb
= sizeof(sid_buffer
);
1157 if (!pCreateWellKnownSid(i
, domainsid
, sid_buffer
, &cb
))
1159 skip("Well know SIDs starting from %d are not implemented\n", i
);
1164 cb
= sizeof(sid_buffer
);
1165 ok(pCreateWellKnownSid(i
, value
->without_domain
? NULL
: domainsid
, sid_buffer
, &cb
), "Couldn't create well known sid %d\n", i
);
1166 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer
)), cb
, DWORD
, "%d");
1167 ok(IsValidSid(sid_buffer
), "The sid is not valid\n");
1168 ok(ConvertSidToStringSid(sid_buffer
, &str
), "Couldn't convert SID to string\n");
1169 ok(strcmp(str
, value
->sid_string
) == 0, "SID mismatch - expected %s, got %s\n",
1170 value
->sid_string
, str
);
1173 if (value
->without_domain
)
1175 char buf2
[SECURITY_MAX_SID_SIZE
];
1177 ok(pCreateWellKnownSid(i
, domainsid
, buf2
, &cb
), "Couldn't create well known sid %d with optional domain\n", i
);
1178 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer
)), cb
, DWORD
, "%d");
1179 ok(memcmp(buf2
, sid_buffer
, cb
) == 0, "SID create with domain is different than without (%d)\n", i
);
1184 static void test_LookupAccountSid(void)
1186 SID_IDENTIFIER_AUTHORITY SIDAuthNT
= { SECURITY_NT_AUTHORITY
};
1187 CHAR accountA
[MAX_PATH
], domainA
[MAX_PATH
];
1188 DWORD acc_sizeA
, dom_sizeA
;
1189 DWORD real_acc_sizeA
, real_dom_sizeA
;
1190 WCHAR accountW
[MAX_PATH
], domainW
[MAX_PATH
];
1191 DWORD acc_sizeW
, dom_sizeW
;
1192 DWORD real_acc_sizeW
, real_dom_sizeW
;
1193 PSID pUsersSid
= NULL
;
1201 /* native windows crashes if account size, domain size, or name use is NULL */
1203 ret
= AllocateAndInitializeSid(&SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
1204 DOMAIN_ALIAS_RID_USERS
, 0, 0, 0, 0, 0, 0, &pUsersSid
);
1205 ok(ret
|| (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
),
1206 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1208 /* not running on NT so give up */
1209 if (!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1212 real_acc_sizeA
= MAX_PATH
;
1213 real_dom_sizeA
= MAX_PATH
;
1214 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &real_acc_sizeA
, domainA
, &real_dom_sizeA
, &use
);
1215 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1217 /* try NULL account */
1218 acc_sizeA
= MAX_PATH
;
1219 dom_sizeA
= MAX_PATH
;
1220 ret
= LookupAccountSidA(NULL
, pUsersSid
, NULL
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1221 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1223 /* try NULL domain */
1224 acc_sizeA
= MAX_PATH
;
1225 dom_sizeA
= MAX_PATH
;
1226 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, NULL
, &dom_sizeA
, &use
);
1227 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1229 /* try a small account buffer */
1231 dom_sizeA
= MAX_PATH
;
1233 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1234 ok(!ret
, "LookupAccountSidA() Expected FALSE got TRUE\n");
1235 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1236 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1238 /* try a 0 sized account buffer */
1240 dom_sizeA
= MAX_PATH
;
1242 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1243 /* this can fail or succeed depending on OS version but the size will always be returned */
1244 ok(acc_sizeA
== real_acc_sizeA
+ 1,
1245 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1246 real_acc_sizeA
+ 1, acc_sizeA
);
1248 /* try a 0 sized account buffer */
1250 dom_sizeA
= MAX_PATH
;
1251 ret
= LookupAccountSidA(NULL
, pUsersSid
, NULL
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1252 /* this can fail or succeed depending on OS version but the size will always be returned */
1253 ok(acc_sizeA
== real_acc_sizeA
+ 1,
1254 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1255 real_acc_sizeA
+ 1, acc_sizeA
);
1257 /* try a small domain buffer */
1259 acc_sizeA
= MAX_PATH
;
1261 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1262 ok(!ret
, "LookupAccountSidA() Expected FALSE got TRUE\n");
1263 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1264 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1266 /* try a 0 sized domain buffer */
1268 acc_sizeA
= MAX_PATH
;
1270 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1271 /* this can fail or succeed depending on OS version but the size will always be returned */
1272 ok(dom_sizeA
== real_dom_sizeA
+ 1,
1273 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1274 real_dom_sizeA
+ 1, dom_sizeA
);
1276 /* try a 0 sized domain buffer */
1278 acc_sizeA
= MAX_PATH
;
1279 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, NULL
, &dom_sizeA
, &use
);
1280 /* this can fail or succeed depending on OS version but the size will always be returned */
1281 ok(dom_sizeA
== real_dom_sizeA
+ 1,
1282 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1283 real_dom_sizeA
+ 1, dom_sizeA
);
1285 real_acc_sizeW
= MAX_PATH
;
1286 real_dom_sizeW
= MAX_PATH
;
1287 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &real_acc_sizeW
, domainW
, &real_dom_sizeW
, &use
);
1288 ok(ret
, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1290 /* native windows crashes if domainW or accountW is NULL */
1292 /* try a small account buffer */
1294 dom_sizeW
= MAX_PATH
;
1296 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1297 ok(!ret
, "LookupAccountSidW() Expected FALSE got TRUE\n");
1298 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1299 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1301 /* try a 0 sized account buffer */
1303 dom_sizeW
= MAX_PATH
;
1305 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1306 /* this can fail or succeed depending on OS version but the size will always be returned */
1307 ok(acc_sizeW
== real_acc_sizeW
+ 1,
1308 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1309 real_acc_sizeW
+ 1, acc_sizeW
);
1311 /* try a 0 sized account buffer */
1313 dom_sizeW
= MAX_PATH
;
1314 ret
= LookupAccountSidW(NULL
, pUsersSid
, NULL
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1315 /* this can fail or succeed depending on OS version but the size will always be returned */
1316 ok(acc_sizeW
== real_acc_sizeW
+ 1,
1317 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1318 real_acc_sizeW
+ 1, acc_sizeW
);
1320 /* try a small domain buffer */
1322 acc_sizeW
= MAX_PATH
;
1324 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1325 ok(!ret
, "LookupAccountSidW() Expected FALSE got TRUE\n");
1326 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1327 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1329 /* try a 0 sized domain buffer */
1331 acc_sizeW
= MAX_PATH
;
1333 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1334 /* this can fail or succeed depending on OS version but the size will always be returned */
1335 ok(dom_sizeW
== real_dom_sizeW
+ 1,
1336 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1337 real_dom_sizeW
+ 1, dom_sizeW
);
1339 /* try a 0 sized domain buffer */
1341 acc_sizeW
= MAX_PATH
;
1342 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, NULL
, &dom_sizeW
, &use
);
1343 /* this can fail or succeed depending on OS version but the size will always be returned */
1344 ok(dom_sizeW
== real_dom_sizeW
+ 1,
1345 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1346 real_dom_sizeW
+ 1, dom_sizeW
);
1350 if (pCreateWellKnownSid
&& pConvertSidToStringSidA
)
1352 trace("Well Known SIDs:\n");
1353 for (i
= 0; i
<= 60; i
++)
1355 size
= SECURITY_MAX_SID_SIZE
;
1356 if (pCreateWellKnownSid(i
, NULL
, &max_sid
.sid
, &size
))
1358 if (pConvertSidToStringSidA(&max_sid
.sid
, &str_sidA
))
1360 acc_sizeA
= MAX_PATH
;
1361 dom_sizeA
= MAX_PATH
;
1362 if (LookupAccountSidA(NULL
, &max_sid
.sid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
))
1363 trace(" %d: %s %s\\%s %d\n", i
, str_sidA
, domainA
, accountA
, use
);
1364 LocalFree(str_sidA
);
1369 if (GetLastError() != ERROR_INVALID_PARAMETER
)
1370 trace(" CreateWellKnownSid(%d) failed: %d\n", i
, GetLastError());
1372 trace(" %d: not supported\n", i
);
1376 pLsaQueryInformationPolicy
= (fnLsaQueryInformationPolicy
)GetProcAddress( hmod
, "LsaQueryInformationPolicy");
1377 pLsaOpenPolicy
= (fnLsaOpenPolicy
)GetProcAddress( hmod
, "LsaOpenPolicy");
1378 pLsaFreeMemory
= (fnLsaFreeMemory
)GetProcAddress( hmod
, "LsaFreeMemory");
1379 pLsaClose
= (fnLsaClose
)GetProcAddress( hmod
, "LsaClose");
1381 if (pLsaQueryInformationPolicy
&& pLsaOpenPolicy
&& pLsaFreeMemory
&& pLsaClose
)
1385 LSA_OBJECT_ATTRIBUTES object_attributes
;
1387 ZeroMemory(&object_attributes
, sizeof(object_attributes
));
1388 object_attributes
.Length
= sizeof(object_attributes
);
1390 status
= pLsaOpenPolicy( NULL
, &object_attributes
, POLICY_ALL_ACCESS
, &handle
);
1391 ok(status
== STATUS_SUCCESS
|| status
== STATUS_ACCESS_DENIED
,
1392 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status
);
1394 /* try a more restricted access mask if necessary */
1395 if (status
== STATUS_ACCESS_DENIED
) {
1396 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
1397 status
= pLsaOpenPolicy( NULL
, &object_attributes
, POLICY_VIEW_LOCAL_INFORMATION
, &handle
);
1398 ok(status
== STATUS_SUCCESS
, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status
);
1401 if (status
== STATUS_SUCCESS
)
1403 PPOLICY_ACCOUNT_DOMAIN_INFO info
;
1404 status
= pLsaQueryInformationPolicy(handle
, PolicyAccountDomainInformation
, (PVOID
*)&info
);
1405 ok(status
== STATUS_SUCCESS
, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status
);
1406 if (status
== STATUS_SUCCESS
)
1408 ok(info
->DomainSid
!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
1409 if (info
->DomainSid
)
1411 int count
= *GetSidSubAuthorityCount(info
->DomainSid
);
1412 CopySid(GetSidLengthRequired(count
), &max_sid
, info
->DomainSid
);
1413 test_sid_str((PSID
)&max_sid
.sid
);
1414 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_USER_RID_ADMIN
;
1415 max_sid
.sid
.SubAuthorityCount
= count
+ 1;
1416 test_sid_str((PSID
)&max_sid
.sid
);
1417 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_USER_RID_GUEST
;
1418 test_sid_str((PSID
)&max_sid
.sid
);
1419 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_ADMINS
;
1420 test_sid_str((PSID
)&max_sid
.sid
);
1421 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_USERS
;
1422 test_sid_str((PSID
)&max_sid
.sid
);
1423 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_GUESTS
;
1424 test_sid_str((PSID
)&max_sid
.sid
);
1425 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_COMPUTERS
;
1426 test_sid_str((PSID
)&max_sid
.sid
);
1427 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_CONTROLLERS
;
1428 test_sid_str((PSID
)&max_sid
.sid
);
1429 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_CERT_ADMINS
;
1430 test_sid_str((PSID
)&max_sid
.sid
);
1431 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_SCHEMA_ADMINS
;
1432 test_sid_str((PSID
)&max_sid
.sid
);
1433 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS
;
1434 test_sid_str((PSID
)&max_sid
.sid
);
1435 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_POLICY_ADMINS
;
1436 test_sid_str((PSID
)&max_sid
.sid
);
1437 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_ALIAS_RID_RAS_SERVERS
;
1438 test_sid_str((PSID
)&max_sid
.sid
);
1439 max_sid
.sid
.SubAuthority
[count
] = 1000; /* first user account */
1440 test_sid_str((PSID
)&max_sid
.sid
);
1443 pLsaFreeMemory((LPVOID
)info
);
1446 status
= pLsaClose(handle
);
1447 ok(status
== STATUS_SUCCESS
, "LsaClose() failed, returned 0x%08x\n", status
);
1453 static void get_sid_info(PSID psid
, LPSTR
*user
, LPSTR
*dom
)
1455 static CHAR account
[UNLEN
+ 1];
1456 static CHAR domain
[UNLEN
+ 1];
1457 DWORD size
, dom_size
;
1463 size
= dom_size
= UNLEN
+ 1;
1466 LookupAccountSidA(NULL
, psid
, account
, &size
, domain
, &dom_size
, &use
);
1469 static void test_LookupAccountName(void)
1471 DWORD sid_size
, domain_size
, user_size
;
1472 DWORD sid_save
, domain_save
;
1473 CHAR user_name
[UNLEN
+ 1];
1474 SID_NAME_USE sid_use
;
1475 LPSTR domain
, account
, sid_dom
;
1479 /* native crashes if (assuming all other parameters correct):
1481 * - Sid is NULL and cbSid is > 0
1482 * - cbSid or cchReferencedDomainName are NULL
1483 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
1486 user_size
= UNLEN
+ 1;
1487 SetLastError(0xdeadbeef);
1488 ret
= GetUserNameA(user_name
, &user_size
);
1489 if (!ret
&& (GetLastError() == ERROR_NOT_LOGGED_ON
))
1491 /* Probably on win9x where the user used 'Cancel' instead of properly logging in */
1492 skip("Cannot get the user name (win9x and not logged in properly)\n");
1495 ok(ret
, "Failed to get user name : %d\n", GetLastError());
1500 sid_use
= 0xcafebabe;
1501 SetLastError(0xdeadbeef);
1502 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1503 if(!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1505 skip("LookupAccountNameA is not implemented\n");
1508 ok(!ret
, "Expected 0, got %d\n", ret
);
1509 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1510 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1511 ok(sid_size
!= 0, "Expected non-zero sid size\n");
1512 ok(domain_size
!= 0, "Expected non-zero domain size\n");
1513 ok(sid_use
== 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use
);
1515 sid_save
= sid_size
;
1516 domain_save
= domain_size
;
1518 psid
= HeapAlloc(GetProcessHeap(), 0, sid_size
);
1519 domain
= HeapAlloc(GetProcessHeap(), 0, domain_size
);
1521 /* try valid account name */
1522 ret
= LookupAccountNameA(NULL
, user_name
, psid
, &sid_size
, domain
, &domain_size
, &sid_use
);
1523 get_sid_info(psid
, &account
, &sid_dom
);
1524 ok(ret
, "Failed to lookup account name\n");
1525 ok(sid_size
== GetLengthSid(psid
), "Expected %d, got %d\n", GetLengthSid(psid
), sid_size
);
1528 ok(!lstrcmp(account
, user_name
), "Expected %s, got %s\n", user_name
, account
);
1529 ok(!lstrcmp(domain
, sid_dom
), "Expected %s, got %s\n", sid_dom
, domain
);
1530 ok(domain_size
== domain_save
- 1, "Expected %d, got %d\n", domain_save
- 1, domain_size
);
1531 ok(lstrlen(domain
) == domain_size
, "Expected %d\n", lstrlen(domain
));
1532 ok(sid_use
== SidTypeUser
, "Expected SidTypeUser, got %d\n", sid_use
);
1534 domain_size
= domain_save
;
1536 /* NULL Sid with zero sid size */
1537 SetLastError(0xdeadbeef);
1539 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, domain
, &domain_size
, &sid_use
);
1540 ok(!ret
, "Expected 0, got %d\n", ret
);
1541 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1542 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1543 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1544 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1546 /* try cchReferencedDomainName - 1 */
1547 SetLastError(0xdeadbeef);
1549 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, domain
, &domain_size
, &sid_use
);
1550 ok(!ret
, "Expected 0, got %d\n", ret
);
1551 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1552 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1553 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1554 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1556 /* NULL ReferencedDomainName with zero domain name size */
1557 SetLastError(0xdeadbeef);
1559 ret
= LookupAccountNameA(NULL
, user_name
, psid
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1560 ok(!ret
, "Expected 0, got %d\n", ret
);
1561 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1562 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1563 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1564 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1566 HeapFree(GetProcessHeap(), 0, psid
);
1567 HeapFree(GetProcessHeap(), 0, domain
);
1569 /* get sizes for NULL account name */
1572 sid_use
= 0xcafebabe;
1573 SetLastError(0xdeadbeef);
1574 ret
= LookupAccountNameA(NULL
, NULL
, NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1575 ok(!ret
, "Expected 0, got %d\n", ret
);
1576 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1577 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1578 ok(sid_size
!= 0, "Expected non-zero sid size\n");
1579 ok(domain_size
!= 0, "Expected non-zero domain size\n");
1580 ok(sid_use
== 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use
);
1582 psid
= HeapAlloc(GetProcessHeap(), 0, sid_size
);
1583 domain
= HeapAlloc(GetProcessHeap(), 0, domain_size
);
1585 /* try NULL account name */
1586 ret
= LookupAccountNameA(NULL
, NULL
, psid
, &sid_size
, domain
, &domain_size
, &sid_use
);
1587 get_sid_info(psid
, &account
, &sid_dom
);
1588 ok(ret
, "Failed to lookup account name\n");
1591 /* Using a fixed string will not work on different locales */
1592 ok(!lstrcmp(account
, domain
),
1593 "Got %s for account and %s for domain, these should be the same\n",
1595 ok(sid_use
== SidTypeDomain
, "Expected SidTypeDomain, got %d\n", SidTypeDomain
);
1598 /* try an invalid account name */
1599 SetLastError(0xdeadbeef);
1602 ret
= LookupAccountNameA(NULL
, "oogabooga", NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1603 ok(!ret
, "Expected 0, got %d\n", ret
);
1606 ok(GetLastError() == ERROR_NONE_MAPPED
,
1607 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
1608 ok(sid_size
== 0, "Expected 0, got %d\n", sid_size
);
1609 ok(domain_size
== 0, "Expected 0, got %d\n", domain_size
);
1612 HeapFree(GetProcessHeap(), 0, psid
);
1613 HeapFree(GetProcessHeap(), 0, domain
);
1616 static void test_security_descriptor(void)
1618 SECURITY_DESCRIPTOR sd
;
1621 BOOL isDefault
, isPresent
;
1625 InitializeSecurityDescriptor(&sd
, SECURITY_DESCRIPTOR_REVISION
);
1626 ok(GetSecurityDescriptorOwner(&sd
, &psid
, &isDefault
), "GetSecurityDescriptorOwner failed\n");
1627 expect_eq(psid
, NULL
, PSID
, "%p");
1628 expect_eq(isDefault
, FALSE
, BOOL
, "%d");
1629 sd
.Control
|= SE_DACL_PRESENT
| SE_SACL_PRESENT
;
1631 SetLastError(0xdeadbeef);
1633 expect_eq(MakeSelfRelativeSD(&sd
, buf
, &size
), FALSE
, BOOL
, "%d");
1634 expect_eq(GetLastError(), ERROR_INSUFFICIENT_BUFFER
, DWORD
, "%u");
1635 ok(size
> 5, "Size not increased\n");
1638 expect_eq(MakeSelfRelativeSD(&sd
, buf
, &size
), TRUE
, BOOL
, "%d");
1639 ok(GetSecurityDescriptorOwner(&sd
, &psid
, &isDefault
), "GetSecurityDescriptorOwner failed\n");
1640 expect_eq(psid
, NULL
, PSID
, "%p");
1641 expect_eq(isDefault
, FALSE
, BOOL
, "%d");
1642 ok(GetSecurityDescriptorGroup(&sd
, &psid
, &isDefault
), "GetSecurityDescriptorOwner failed\n");
1643 expect_eq(psid
, NULL
, PSID
, "%p");
1644 expect_eq(isDefault
, FALSE
, BOOL
, "%d");
1645 ok(GetSecurityDescriptorDacl(&sd
, &isPresent
, &pacl
, &isDefault
), "GetSecurityDescriptorOwner failed\n");
1646 expect_eq(isPresent
, TRUE
, BOOL
, "%d");
1647 expect_eq(psid
, NULL
, PSID
, "%p");
1648 expect_eq(isDefault
, FALSE
, BOOL
, "%d");
1649 ok(GetSecurityDescriptorSacl(&sd
, &isPresent
, &pacl
, &isDefault
), "GetSecurityDescriptorOwner failed\n");
1650 expect_eq(isPresent
, TRUE
, BOOL
, "%d");
1651 expect_eq(psid
, NULL
, PSID
, "%p");
1652 expect_eq(isDefault
, FALSE
, BOOL
, "%d");
1656 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,__LINE__)
1657 static void test_granted_access(HANDLE handle
, ACCESS_MASK access
, int line
)
1659 OBJECT_BASIC_INFORMATION obj_info
;
1662 if (!pNtQueryObject
)
1664 skip_(__FILE__
, line
)("Not NT platform - skipping tests\n");
1668 status
= pNtQueryObject( handle
, ObjectBasicInformation
, &obj_info
,
1669 sizeof(obj_info
), NULL
);
1670 ok_(__FILE__
, line
)(!status
, "NtQueryObject with err: %08x\n", status
);
1671 ok_(__FILE__
, line
)(obj_info
.GrantedAccess
== access
, "Granted access should "
1672 "be 0x%08x, instead of 0x%08x\n", access
, obj_info
.GrantedAccess
);
1675 #define CHECK_SET_SECURITY(o,i,e) \
1679 SetLastError( 0xdeadbeef ); \
1680 res = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
1681 err = GetLastError(); \
1682 if (e == ERROR_SUCCESS) \
1683 ok(res, "SetKernelObjectSecurity failed with %d\n", err); \
1685 ok(!res && err == e, "SetKernelObjectSecurity should have failed " \
1686 "with %s, instead of %d\n", #e, err); \
1689 static void test_process_security(void)
1692 char owner
[32], group
[32];
1693 PSID AdminSid
= NULL
, UsersSid
= NULL
;
1695 SECURITY_DESCRIPTOR
*SecurityDescriptor
= NULL
;
1696 char buffer
[MAX_PATH
];
1697 PROCESS_INFORMATION info
;
1698 STARTUPINFOA startup
;
1699 SECURITY_ATTRIBUTES psa
;
1700 HANDLE token
, event
;
1703 Acl
= HeapAlloc(GetProcessHeap(), 0, 256);
1704 res
= InitializeAcl(Acl
, 256, ACL_REVISION
);
1705 if (!res
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
1707 skip("ACLs not implemented - skipping tests\n");
1708 HeapFree(GetProcessHeap(), 0, Acl
);
1711 ok(res
, "InitializeAcl failed with error %d\n", GetLastError());
1713 /* get owner from the token we might be running as a user not admin */
1714 res
= OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED
, &token
);
1715 ok(res
, "OpenProcessToken failed with error %d\n", GetLastError());
1718 HeapFree(GetProcessHeap(), 0, Acl
);
1722 res
= GetTokenInformation( token
, TokenOwner
, owner
, sizeof(owner
), &tmp
);
1723 ok(res
, "GetTokenInformation failed with error %d\n", GetLastError());
1724 AdminSid
= ((TOKEN_OWNER
*)owner
)->Owner
;
1725 res
= GetTokenInformation( token
, TokenPrimaryGroup
, group
, sizeof(group
), &tmp
);
1726 ok(res
, "GetTokenInformation failed with error %d\n", GetLastError());
1727 UsersSid
= ((TOKEN_PRIMARY_GROUP
*)group
)->PrimaryGroup
;
1729 CloseHandle( token
);
1732 HeapFree(GetProcessHeap(), 0, Acl
);
1736 res
= AddAccessDeniedAce(Acl
, ACL_REVISION
, PROCESS_VM_READ
, AdminSid
);
1737 ok(res
, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1738 res
= AddAccessAllowedAce(Acl
, ACL_REVISION
, PROCESS_ALL_ACCESS
, AdminSid
);
1739 ok(res
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1741 SecurityDescriptor
= HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH
);
1742 res
= InitializeSecurityDescriptor(SecurityDescriptor
, SECURITY_DESCRIPTOR_REVISION
);
1743 ok(res
, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1745 event
= CreateEvent( NULL
, TRUE
, TRUE
, "test_event" );
1746 ok(event
!= NULL
, "CreateEvent %d\n", GetLastError());
1748 SecurityDescriptor
->Revision
= 0;
1749 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_UNKNOWN_REVISION
);
1750 SecurityDescriptor
->Revision
= SECURITY_DESCRIPTOR_REVISION
;
1752 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_INVALID_SECURITY_DESCR
);
1753 CHECK_SET_SECURITY( event
, GROUP_SECURITY_INFORMATION
, ERROR_INVALID_SECURITY_DESCR
);
1754 CHECK_SET_SECURITY( event
, SACL_SECURITY_INFORMATION
, ERROR_ACCESS_DENIED
);
1755 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1756 /* NULL DACL is valid and means default DACL from token */
1757 SecurityDescriptor
->Control
|= SE_DACL_PRESENT
;
1758 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1760 /* Set owner and group and dacl */
1761 res
= SetSecurityDescriptorOwner(SecurityDescriptor
, AdminSid
, FALSE
);
1762 ok(res
, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1763 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1764 res
= SetSecurityDescriptorGroup(SecurityDescriptor
, UsersSid
, FALSE
);
1765 ok(res
, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1766 CHECK_SET_SECURITY( event
, GROUP_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1767 res
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
1768 ok(res
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1769 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1771 sprintf(buffer
, "%s tests/security.c test", myARGV
[0]);
1772 memset(&startup
, 0, sizeof(startup
));
1773 startup
.cb
= sizeof(startup
);
1774 startup
.dwFlags
= STARTF_USESHOWWINDOW
;
1775 startup
.wShowWindow
= SW_SHOWNORMAL
;
1777 psa
.nLength
= sizeof(psa
);
1778 psa
.lpSecurityDescriptor
= SecurityDescriptor
;
1779 psa
.bInheritHandle
= TRUE
;
1781 /* Doesn't matter what ACL say we should get full access for ourselves */
1782 ok(CreateProcessA( NULL
, buffer
, &psa
, NULL
, FALSE
, 0, NULL
, NULL
, &startup
, &info
),
1783 "CreateProcess with err:%d\n", GetLastError());
1784 TEST_GRANTED_ACCESS( info
.hProcess
, PROCESS_ALL_ACCESS
);
1785 ok(WaitForSingleObject(info
.hProcess
, 30000) == WAIT_OBJECT_0
, "Child process termination\n");
1787 CloseHandle( event
);
1788 HeapFree(GetProcessHeap(), 0, Acl
);
1789 HeapFree(GetProcessHeap(), 0, SecurityDescriptor
);
1792 static void test_process_security_child(void)
1794 HANDLE handle
, handle1
;
1798 handle
= OpenProcess( PROCESS_TERMINATE
, FALSE
, GetCurrentProcessId() );
1799 ok(handle
!= NULL
, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
1800 TEST_GRANTED_ACCESS( handle
, PROCESS_TERMINATE
);
1802 ok(DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1803 &handle1
, 0, TRUE
, DUPLICATE_SAME_ACCESS
),
1804 "duplicating handle err:%d\n", GetLastError());
1805 TEST_GRANTED_ACCESS( handle1
, PROCESS_TERMINATE
);
1807 CloseHandle( handle1
);
1809 SetLastError( 0xdeadbeef );
1810 ret
= DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1811 &handle1
, PROCESS_ALL_ACCESS
, TRUE
, 0 );
1812 err
= GetLastError();
1814 ok(!ret
&& err
== ERROR_ACCESS_DENIED
, "duplicating handle should have failed "
1815 "with STATUS_ACCESS_DENIED, instead of err:%d\n", err
);
1817 CloseHandle( handle
);
1819 /* These two should fail - they are denied by ACL */
1820 handle
= OpenProcess( PROCESS_VM_READ
, FALSE
, GetCurrentProcessId() );
1822 ok(handle
== NULL
, "OpenProcess(PROCESS_VM_READ) should have failed\n");
1823 handle
= OpenProcess( PROCESS_ALL_ACCESS
, FALSE
, GetCurrentProcessId() );
1825 ok(handle
== NULL
, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
1827 /* Documented privilege elevation */
1828 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1829 &handle
, 0, TRUE
, DUPLICATE_SAME_ACCESS
),
1830 "duplicating handle err:%d\n", GetLastError());
1831 TEST_GRANTED_ACCESS( handle
, PROCESS_ALL_ACCESS
);
1833 CloseHandle( handle
);
1835 /* Same only explicitly asking for all access rights */
1836 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1837 &handle
, PROCESS_ALL_ACCESS
, TRUE
, 0 ),
1838 "duplicating handle err:%d\n", GetLastError());
1839 TEST_GRANTED_ACCESS( handle
, PROCESS_ALL_ACCESS
);
1840 ok(DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1841 &handle1
, PROCESS_VM_READ
, TRUE
, 0 ),
1842 "duplicating handle err:%d\n", GetLastError());
1843 TEST_GRANTED_ACCESS( handle1
, PROCESS_VM_READ
);
1844 CloseHandle( handle1
);
1845 CloseHandle( handle
);
1848 static void test_impersonation_level(void)
1850 HANDLE Token
, ProcessToken
;
1853 TOKEN_PRIVILEGES
*Privileges
;
1855 PRIVILEGE_SET
*PrivilegeSet
;
1861 pDuplicateTokenEx
= (fnDuplicateTokenEx
) GetProcAddress(hmod
, "DuplicateTokenEx");
1862 if( !pDuplicateTokenEx
) {
1863 skip("DuplicateTokenEx is not available\n");
1866 SetLastError(0xdeadbeef);
1867 ret
= ImpersonateSelf(SecurityAnonymous
);
1868 if(!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1870 skip("ImpersonateSelf is not implemented\n");
1873 ok(ret
, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
1874 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1875 ok(!ret
, "OpenThreadToken should have failed\n");
1876 error
= GetLastError();
1877 ok(error
== ERROR_CANT_OPEN_ANONYMOUS
, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error
);
1878 /* can't perform access check when opening object against an anonymous impersonation token */
1880 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1881 ok(error
== ERROR_INVALID_HANDLE
, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error
);
1885 ret
= OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE
, &ProcessToken
);
1886 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
1888 ret
= pDuplicateTokenEx(ProcessToken
,
1889 TOKEN_QUERY
| TOKEN_DUPLICATE
| TOKEN_IMPERSONATE
, NULL
,
1890 SecurityAnonymous
, TokenImpersonation
, &Token
);
1891 ok(ret
, "DuplicateTokenEx failed with error %d\n", GetLastError());
1892 /* can't increase the impersonation level */
1893 ret
= DuplicateToken(Token
, SecurityIdentification
, &Token2
);
1894 error
= GetLastError();
1895 ok(!ret
&& error
== ERROR_BAD_IMPERSONATION_LEVEL
,
1896 "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error
);
1897 /* we can query anything from an anonymous token, including the user */
1898 ret
= GetTokenInformation(Token
, TokenUser
, NULL
, 0, &Size
);
1899 error
= GetLastError();
1900 ok(!ret
&& error
== ERROR_INSUFFICIENT_BUFFER
, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error
);
1901 User
= (TOKEN_USER
*)HeapAlloc(GetProcessHeap(), 0, Size
);
1902 ret
= GetTokenInformation(Token
, TokenUser
, User
, Size
, &Size
);
1903 ok(ret
, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1904 HeapFree(GetProcessHeap(), 0, User
);
1906 /* PrivilegeCheck fails with SecurityAnonymous level */
1907 ret
= GetTokenInformation(Token
, TokenPrivileges
, NULL
, 0, &Size
);
1908 error
= GetLastError();
1909 ok(!ret
&& error
== ERROR_INSUFFICIENT_BUFFER
, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error
);
1910 Privileges
= (TOKEN_PRIVILEGES
*)HeapAlloc(GetProcessHeap(), 0, Size
);
1911 ret
= GetTokenInformation(Token
, TokenPrivileges
, Privileges
, Size
, &Size
);
1912 ok(ret
, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1914 PrivilegeSet
= (PRIVILEGE_SET
*)HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET
, Privilege
[Privileges
->PrivilegeCount
]));
1915 PrivilegeSet
->PrivilegeCount
= Privileges
->PrivilegeCount
;
1916 memcpy(PrivilegeSet
->Privilege
, Privileges
->Privileges
, PrivilegeSet
->PrivilegeCount
* sizeof(PrivilegeSet
->Privilege
[0]));
1917 PrivilegeSet
->Control
= PRIVILEGE_SET_ALL_NECESSARY
;
1918 HeapFree(GetProcessHeap(), 0, Privileges
);
1920 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1921 error
= GetLastError();
1922 ok(!ret
&& error
== ERROR_BAD_IMPERSONATION_LEVEL
, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error
);
1926 ret
= ImpersonateSelf(SecurityIdentification
);
1927 ok(ret
, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
1928 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1929 ok(ret
, "OpenThreadToken failed with error %d\n", GetLastError());
1931 /* can't perform access check when opening object against an identification impersonation token */
1932 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1934 ok(error
== ERROR_INVALID_HANDLE
, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error
);
1936 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1937 ok(ret
, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
1941 ret
= ImpersonateSelf(SecurityImpersonation
);
1942 ok(ret
, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
1943 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1944 ok(ret
, "OpenThreadToken failed with error %d\n", GetLastError());
1945 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1946 ok(error
== ERROR_SUCCESS
, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error
);
1948 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1949 ok(ret
, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
1953 CloseHandle(ProcessToken
);
1955 HeapFree(GetProcessHeap(), 0, PrivilegeSet
);
1958 static void test_SetEntriesInAcl(void)
1960 ACL
*acl
= (ACL
*)0xdeadbeef;
1963 if (!pSetEntriesInAclW
)
1965 skip("SetEntriesInAclW is not available\n");
1969 res
= pSetEntriesInAclW(0, NULL
, NULL
, &acl
);
1970 if(res
== ERROR_CALL_NOT_IMPLEMENTED
)
1972 skip("SetEntriesInAclW is not implemented\n");
1975 ok(res
== ERROR_SUCCESS
, "SetEntriesInAclW failed: %u\n", res
);
1976 ok(acl
== NULL
, "acl=%p, expected NULL\n", acl
);
1979 static void test_GetNamedSecurityInfoA(void)
1981 PSECURITY_DESCRIPTOR pSecDesc
;
1983 SECURITY_DESCRIPTOR_CONTROL control
;
1986 BOOL owner_defaulted
;
1987 BOOL group_defaulted
;
1990 CHAR windows_dir
[MAX_PATH
];
1992 if (!pGetNamedSecurityInfoA
)
1994 skip("GetNamedSecurityInfoA is not available\n");
1998 ret
= GetWindowsDirectoryA(windows_dir
, MAX_PATH
);
1999 ok(ret
, "GetWindowsDirectory failed with error %d\n", GetLastError());
2001 SetLastError(0xdeadbeef);
2002 error
= pGetNamedSecurityInfoA(windows_dir
, SE_FILE_OBJECT
,
2003 OWNER_SECURITY_INFORMATION
|GROUP_SECURITY_INFORMATION
|DACL_SECURITY_INFORMATION
,
2004 NULL
, NULL
, NULL
, NULL
, &pSecDesc
);
2005 if (error
!= ERROR_SUCCESS
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
2007 skip("GetNamedSecurityInfoA is not implemented\n");
2010 ok(!error
, "GetNamedSecurityInfo failed with error %d\n", error
);
2012 ret
= GetSecurityDescriptorControl(pSecDesc
, &control
, &revision
);
2013 ok(ret
, "GetSecurityDescriptorControl failed with error %d\n", GetLastError());
2014 ok((control
& (SE_SELF_RELATIVE
|SE_DACL_PRESENT
)) == (SE_SELF_RELATIVE
|SE_DACL_PRESENT
),
2015 "control (0x%x) doesn't have (SE_SELF_RELATIVE|SE_DACL_PRESENT) flags set\n", control
);
2016 ok(revision
== SECURITY_DESCRIPTOR_REVISION1
, "revision was %d instead of 1\n", revision
);
2017 ret
= GetSecurityDescriptorOwner(pSecDesc
, &owner
, &owner_defaulted
);
2018 ok(ret
, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
2019 ok(owner
!= NULL
, "owner should not be NULL\n");
2020 ret
= GetSecurityDescriptorGroup(pSecDesc
, &group
, &group_defaulted
);
2021 ok(ret
, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2022 ok(group
!= NULL
, "group should not be NULL\n");
2025 static void test_ConvertStringSecurityDescriptor(void)
2028 PSECURITY_DESCRIPTOR pSD
;
2030 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA
)
2032 skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
2036 SetLastError(0xdeadbeef);
2037 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2038 "D:(A;;GA;;;WD)", 0xdeadbeef, &pSD
, NULL
);
2039 ok(!ret
&& GetLastError() == ERROR_UNKNOWN_REVISION
,
2040 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_UNKNOWN_REVISION instead of %d\n",
2043 /* test ACE string type */
2044 SetLastError(0xdeadbeef);
2045 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2046 "D:(A;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2047 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2050 SetLastError(0xdeadbeef);
2051 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2052 "D:(D;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2053 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2056 SetLastError(0xdeadbeef);
2057 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2058 "ERROR:(D;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2059 ok(!ret
&& GetLastError() == ERROR_INVALID_PARAMETER
,
2060 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
2063 /* test ACE string access rights */
2064 SetLastError(0xdeadbeef);
2065 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2066 "D:(A;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2067 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2069 SetLastError(0xdeadbeef);
2070 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2071 "D:(A;;GRGWGX;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2072 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2074 SetLastError(0xdeadbeef);
2075 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2076 "D:(A;;RCSDWDWO;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2077 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2079 SetLastError(0xdeadbeef);
2080 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2081 "D:(A;;RPWPCCDCLCSWLODTCR;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2082 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2084 SetLastError(0xdeadbeef);
2085 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2086 "D:(A;;FAFRFWFX;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2087 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2089 SetLastError(0xdeadbeef);
2090 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2091 "D:(A;;KAKRKWKX;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2092 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2094 SetLastError(0xdeadbeef);
2095 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2096 "D:(A;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2097 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2099 SetLastError(0xdeadbeef);
2100 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2101 "S:(AU;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2102 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2105 /* test ACE string access right error case */
2106 SetLastError(0xdeadbeef);
2107 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2108 "D:(A;;ROB;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2110 ok(!ret
&& GetLastError() == ERROR_INVALID_ACL
,
2111 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_ACL instead of %d\n",
2114 /* test ACE string SID */
2115 SetLastError(0xdeadbeef);
2116 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2117 "D:(D;;GA;;;S-1-0-0)", SDDL_REVISION_1
, &pSD
, NULL
);
2118 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2121 SetLastError(0xdeadbeef);
2122 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2123 "D:(D;;GA;;;Nonexistent account)", SDDL_REVISION_1
, &pSD
, NULL
);
2125 ok(!ret
&& GetLastError() == ERROR_INVALID_ACL
,
2126 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_ACL instead of %d\n",
2130 static void test_ConvertSecurityDescriptorToString()
2132 SECURITY_DESCRIPTOR desc
;
2133 SECURITY_INFORMATION sec_info
= OWNER_SECURITY_INFORMATION
|GROUP_SECURITY_INFORMATION
|DACL_SECURITY_INFORMATION
|SACL_SECURITY_INFORMATION
;
2142 if (!pConvertSecurityDescriptorToStringSecurityDescriptorA
)
2144 skip("ConvertSecurityDescriptorToStringSecurityDescriptor is not available\n");
2147 if (!pCreateWellKnownSid
)
2149 skip("CreateWellKnownSid is not available\n");
2153 /* It seems Windows XP adds an extra character to the length of the string for each ACE in an ACL. We
2154 * don't replicate this feature so we only test len >= strlen+1. */
2155 #define CHECK_RESULT_AND_FREE(exp_str) \
2156 ok(strcmp(string, (exp_str)) == 0, "String mismatch (expected \"%s\", got \"%s\")\n", (exp_str), string); \
2157 ok(len >= (strlen(exp_str) + 1), "Length mismatch (expected %d, got %d)\n", strlen(exp_str) + 1, len); \
2160 #define CHECK_ONE_OF_AND_FREE(exp_str1, exp_str2) \
2161 ok(strcmp(string, (exp_str1)) == 0 || strcmp(string, (exp_str2)) == 0, "String mismatch (expected\n\"%s\" or\n\"%s\", got\n\"%s\")\n", (exp_str1), (exp_str2), string); \
2162 ok(len >= (strlen(string) + 1), "Length mismatch (expected %d, got %d)\n", strlen(string) + 1, len); \
2165 InitializeSecurityDescriptor(&desc
, SECURITY_DESCRIPTOR_REVISION
);
2166 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2167 CHECK_RESULT_AND_FREE("");
2170 pCreateWellKnownSid(WinLocalSid
, NULL
, sid_buf
, &size
);
2171 SetSecurityDescriptorOwner(&desc
, (PSID
)sid_buf
, FALSE
);
2172 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2173 CHECK_RESULT_AND_FREE("O:S-1-2-0");
2175 SetSecurityDescriptorOwner(&desc
, (PSID
)sid_buf
, TRUE
);
2176 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2177 CHECK_RESULT_AND_FREE("O:S-1-2-0");
2179 size
= sizeof(sid_buf
);
2180 pCreateWellKnownSid(WinLocalSystemSid
, NULL
, sid_buf
, &size
);
2181 SetSecurityDescriptorOwner(&desc
, (PSID
)sid_buf
, TRUE
);
2182 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2183 CHECK_RESULT_AND_FREE("O:SY");
2185 ConvertStringSidToSid("S-1-5-21-93476-23408-4576", &psid
);
2186 SetSecurityDescriptorGroup(&desc
, psid
, TRUE
);
2187 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2188 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576");
2190 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, GROUP_SECURITY_INFORMATION
, &string
, &len
), "Conversion failed\n");
2191 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
2193 pacl
= (PACL
)acl_buf
;
2194 InitializeAcl(pacl
, sizeof(acl_buf
), ACL_REVISION
);
2195 SetSecurityDescriptorDacl(&desc
, TRUE
, pacl
, TRUE
);
2196 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2197 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
2199 SetSecurityDescriptorDacl(&desc
, TRUE
, pacl
, FALSE
);
2200 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2201 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
2203 ConvertStringSidToSid("S-1-5-6", &psid2
);
2204 AddAccessAllowedAceEx(pacl
, ACL_REVISION
, NO_PROPAGATE_INHERIT_ACE
, 0xf0000000, psid2
);
2205 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2206 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)");
2208 AddAccessAllowedAceEx(pacl
, ACL_REVISION
, INHERIT_ONLY_ACE
|INHERITED_ACE
, 0x00000003, psid2
);
2209 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2210 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)");
2212 AddAccessDeniedAceEx(pacl
, ACL_REVISION
, OBJECT_INHERIT_ACE
|CONTAINER_INHERIT_ACE
, 0xffffffff, psid
);
2213 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2214 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
2217 pacl
= (PACL
)acl_buf
;
2218 InitializeAcl(pacl
, sizeof(acl_buf
), ACL_REVISION
);
2219 SetSecurityDescriptorSacl(&desc
, TRUE
, pacl
, FALSE
);
2220 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2221 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:");
2223 SetSecurityDescriptorDacl(&desc
, TRUE
, NULL
, FALSE
);
2224 AddAuditAccessAceEx(pacl
, ACL_REVISION
, VALID_INHERIT_FLAGS
, KEY_READ
|KEY_WRITE
, psid2
, TRUE
, TRUE
);
2225 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2226 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)", /* XP */
2227 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)" /* Vista */);
2229 AddAuditAccessAceEx(pacl
, ACL_REVISION
, NO_PROPAGATE_INHERIT_ACE
, FILE_GENERIC_READ
|FILE_GENERIC_WRITE
, psid2
, TRUE
, FALSE
);
2230 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2231 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", /* XP */
2232 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)" /* Vista */);
2235 static void test_PrivateObjectSecurity(void)
2237 SECURITY_INFORMATION sec_info
= OWNER_SECURITY_INFORMATION
|GROUP_SECURITY_INFORMATION
|DACL_SECURITY_INFORMATION
|SACL_SECURITY_INFORMATION
;
2238 SECURITY_DESCRIPTOR_CONTROL ctrl
;
2239 PSECURITY_DESCRIPTOR sec
;
2245 PSECURITY_DESCRIPTOR buf
;
2247 ok(ConvertStringSecurityDescriptorToSecurityDescriptorA(
2249 "G:S-1-5-21-93476-23408-4576"
2250 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
2251 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", SDDL_REVISION_1
, &sec
, &dwDescSize
), "Creating descriptor failed\n");
2252 buf
= HeapAlloc(GetProcessHeap(), 0, dwDescSize
);
2253 SetSecurityDescriptorControl(sec
, SE_DACL_PROTECTED
, SE_DACL_PROTECTED
);
2254 GetSecurityDescriptorControl(sec
, &ctrl
, &dwRevision
);
2255 todo_wine
expect_eq(ctrl
, 0x9014, int, "%x");
2257 ok(GetPrivateObjectSecurity(sec
, GROUP_SECURITY_INFORMATION
, buf
, dwDescSize
, &retSize
),
2258 "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
2259 ok(retSize
<= dwDescSize
, "Buffer too small (%d vs %d)\n", retSize
, dwDescSize
);
2260 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2261 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
2262 GetSecurityDescriptorControl(buf
, &ctrl
, &dwRevision
);
2263 expect_eq(ctrl
, 0x8000, int, "%x");
2265 ok(GetPrivateObjectSecurity(sec
, GROUP_SECURITY_INFORMATION
|DACL_SECURITY_INFORMATION
, buf
, dwDescSize
, &retSize
),
2266 "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
2267 ok(retSize
<= dwDescSize
, "Buffer too small (%d vs %d)\n", retSize
, dwDescSize
);
2268 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed err=%u\n", GetLastError());
2269 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
2270 GetSecurityDescriptorControl(buf
, &ctrl
, &dwRevision
);
2271 expect_eq(ctrl
, 0x8004, int, "%x");
2273 ok(GetPrivateObjectSecurity(sec
, sec_info
, buf
, dwDescSize
, &retSize
),
2274 "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
2275 ok(retSize
== dwDescSize
, "Buffer too small (%d vs %d)\n", retSize
, dwDescSize
);
2276 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2277 CHECK_RESULT_AND_FREE("O:SY"
2278 "G:S-1-5-21-93476-23408-4576"
2279 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
2280 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)");
2281 GetSecurityDescriptorControl(buf
, &ctrl
, &dwRevision
);
2282 expect_eq(ctrl
, 0x8014, int, "%x");
2284 SetLastError(0xdeadbeef);
2285 ok(GetPrivateObjectSecurity(sec
, sec_info
, buf
, 5, &retSize
) == FALSE
, "GetPrivateObjectSecurity should have failed\n");
2286 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
, "Expected error ERROR_INSUFFICIENT_BUFFER, got %u\n", GetLastError());
2289 HeapFree(GetProcessHeap(), 0, buf
);
2291 #undef CHECK_RESULT_AND_FREE
2292 #undef CHECK_ONE_OF_AND_FREE
2294 static void test_acls(void)
2297 PACL pAcl
= (PACL
)buffer
;
2300 SetLastError(0xdeadbeef);
2301 ret
= InitializeAcl(pAcl
, sizeof(ACL
) - 1, ACL_REVISION
);
2302 ok(!ret
&& GetLastError() == ERROR_INSUFFICIENT_BUFFER
, "InitializeAcl with too small a buffer should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", GetLastError());
2304 SetLastError(0xdeadbeef);
2305 ret
= InitializeAcl(pAcl
, 0xffffffff, ACL_REVISION
);
2306 ok(!ret
&& GetLastError() == ERROR_INVALID_PARAMETER
, "InitializeAcl with too large a buffer should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
2308 SetLastError(0xdeadbeef);
2309 ret
= InitializeAcl(pAcl
, sizeof(buffer
), ACL_REVISION1
);
2310 ok(!ret
&& GetLastError() == ERROR_INVALID_PARAMETER
, "InitializeAcl(ACL_REVISION1) should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
2312 ret
= InitializeAcl(pAcl
, sizeof(buffer
), ACL_REVISION2
);
2313 ok(ret
, "InitializeAcl(ACL_REVISION2) failed with error %d\n", GetLastError());
2315 ret
= IsValidAcl(pAcl
);
2316 ok(ret
, "IsValidAcl failed with error %d\n", GetLastError());
2318 ret
= InitializeAcl(pAcl
, sizeof(buffer
), ACL_REVISION3
);
2319 ok(ret
, "InitializeAcl(ACL_REVISION3) failed with error %d\n", GetLastError());
2321 ret
= IsValidAcl(pAcl
);
2322 ok(ret
, "IsValidAcl failed with error %d\n", GetLastError());
2324 ret
= InitializeAcl(pAcl
, sizeof(buffer
), ACL_REVISION4
);
2325 ok(ret
, "InitializeAcl(ACL_REVISION4) failed with error %d\n", GetLastError());
2327 ret
= IsValidAcl(pAcl
);
2328 ok(ret
, "IsValidAcl failed with error %d\n", GetLastError());
2330 SetLastError(0xdeadbeef);
2331 ret
= InitializeAcl(pAcl
, sizeof(buffer
), -1);
2332 ok(!ret
&& GetLastError() == ERROR_INVALID_PARAMETER
, "InitializeAcl(-1) failed with error %d\n", GetLastError());
2335 START_TEST(security
)
2342 test_process_security_child();
2348 test_CreateWellKnownSid();
2349 test_FileSecurity();
2352 test_LookupAccountSid();
2353 test_LookupAccountName();
2354 test_security_descriptor();
2355 test_process_security();
2356 test_impersonation_level();
2357 test_SetEntriesInAcl();
2358 test_GetNamedSecurityInfoA();
2359 test_ConvertStringSecurityDescriptor();
2360 test_ConvertSecurityDescriptorToString();
2361 test_PrivateObjectSecurity();