2 * Unit tests for security functions
4 * Copyright (c) 2004 Mike McCormack
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
25 #define WIN32_NO_STATUS
36 #include "wine/test.h"
38 typedef VOID (WINAPI
*fnBuildTrusteeWithSidA
)( PTRUSTEEA pTrustee
, PSID pSid
);
39 typedef VOID (WINAPI
*fnBuildTrusteeWithNameA
)( PTRUSTEEA pTrustee
, LPSTR pName
);
40 typedef VOID (WINAPI
*fnBuildTrusteeWithObjectsAndNameA
)( PTRUSTEEA pTrustee
,
41 POBJECTS_AND_NAME_A pObjName
,
42 SE_OBJECT_TYPE ObjectType
,
44 LPSTR InheritedObjectTypeName
,
46 typedef VOID (WINAPI
*fnBuildTrusteeWithObjectsAndSidA
)( PTRUSTEEA pTrustee
,
47 POBJECTS_AND_SID pObjSid
,
49 GUID
* pInheritedObjectGuid
,
51 typedef LPSTR (WINAPI
*fnGetTrusteeNameA
)( PTRUSTEEA pTrustee
);
52 typedef BOOL (WINAPI
*fnConvertSidToStringSidA
)( PSID pSid
, LPSTR
*str
);
53 typedef BOOL (WINAPI
*fnConvertStringSidToSidA
)( LPCSTR str
, PSID pSid
);
54 static BOOL (WINAPI
*pConvertStringSecurityDescriptorToSecurityDescriptorA
)(LPCSTR
, DWORD
,
55 PSECURITY_DESCRIPTOR
*, PULONG
);
56 static BOOL (WINAPI
*pConvertSecurityDescriptorToStringSecurityDescriptorA
)(PSECURITY_DESCRIPTOR
, DWORD
,
57 SECURITY_INFORMATION
, LPSTR
*, PULONG
);
58 typedef BOOL (WINAPI
*fnGetFileSecurityA
)(LPCSTR
, SECURITY_INFORMATION
,
59 PSECURITY_DESCRIPTOR
, DWORD
, LPDWORD
);
60 static DWORD (WINAPI
*pGetNamedSecurityInfoA
)(LPSTR
, SE_OBJECT_TYPE
, SECURITY_INFORMATION
,
61 PSID
*, PSID
*, PACL
*, PACL
*,
62 PSECURITY_DESCRIPTOR
*);
63 typedef DWORD (WINAPI
*fnRtlAdjustPrivilege
)(ULONG
,BOOLEAN
,BOOLEAN
,PBOOLEAN
);
64 typedef BOOL (WINAPI
*fnCreateWellKnownSid
)(WELL_KNOWN_SID_TYPE
,PSID
,PSID
,DWORD
*);
65 typedef BOOL (WINAPI
*fnDuplicateTokenEx
)(HANDLE
,DWORD
,LPSECURITY_ATTRIBUTES
,
66 SECURITY_IMPERSONATION_LEVEL
,TOKEN_TYPE
,PHANDLE
);
68 typedef NTSTATUS (WINAPI
*fnLsaQueryInformationPolicy
)(LSA_HANDLE
,POLICY_INFORMATION_CLASS
,PVOID
*);
69 typedef NTSTATUS (WINAPI
*fnLsaClose
)(LSA_HANDLE
);
70 typedef NTSTATUS (WINAPI
*fnLsaFreeMemory
)(PVOID
);
71 typedef NTSTATUS (WINAPI
*fnLsaOpenPolicy
)(PLSA_UNICODE_STRING
,PLSA_OBJECT_ATTRIBUTES
,ACCESS_MASK
,PLSA_HANDLE
);
72 static NTSTATUS (WINAPI
*pNtQueryObject
)(HANDLE
,OBJECT_INFORMATION_CLASS
,PVOID
,ULONG
,PULONG
);
73 static DWORD (WINAPI
*pSetEntriesInAclW
)(ULONG
, PEXPLICIT_ACCESSW
, PACL
, PACL
*);
79 fnBuildTrusteeWithSidA pBuildTrusteeWithSidA
;
80 fnBuildTrusteeWithNameA pBuildTrusteeWithNameA
;
81 fnBuildTrusteeWithObjectsAndNameA pBuildTrusteeWithObjectsAndNameA
;
82 fnBuildTrusteeWithObjectsAndSidA pBuildTrusteeWithObjectsAndSidA
;
83 fnGetTrusteeNameA pGetTrusteeNameA
;
84 fnConvertSidToStringSidA pConvertSidToStringSidA
;
85 fnConvertStringSidToSidA pConvertStringSidToSidA
;
86 fnGetFileSecurityA pGetFileSecurityA
;
87 fnRtlAdjustPrivilege pRtlAdjustPrivilege
;
88 fnCreateWellKnownSid pCreateWellKnownSid
;
89 fnDuplicateTokenEx pDuplicateTokenEx
;
90 fnLsaQueryInformationPolicy pLsaQueryInformationPolicy
;
92 fnLsaFreeMemory pLsaFreeMemory
;
93 fnLsaOpenPolicy pLsaOpenPolicy
;
97 SID_IDENTIFIER_AUTHORITY auth
;
101 static void init(void)
105 hntdll
= GetModuleHandleA("ntdll.dll");
106 pNtQueryObject
= (void *)GetProcAddress( hntdll
, "NtQueryObject" );
108 hmod
= GetModuleHandle("advapi32.dll");
109 pConvertStringSecurityDescriptorToSecurityDescriptorA
=
110 (void *)GetProcAddress(hmod
, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
111 pConvertSecurityDescriptorToStringSecurityDescriptorA
=
112 (void *)GetProcAddress(hmod
, "ConvertSecurityDescriptorToStringSecurityDescriptorA" );
113 pGetNamedSecurityInfoA
= (void *)GetProcAddress(hmod
, "GetNamedSecurityInfoA");
114 pSetEntriesInAclW
= (void *)GetProcAddress(hmod
, "SetEntriesInAclW");
116 myARGC
= winetest_get_mainargs( &myARGV
);
119 static void test_str_sid(const char *str_sid
)
124 if (pConvertStringSidToSidA(str_sid
, &psid
))
126 if (pConvertSidToStringSidA(psid
, &temp
))
128 trace(" %s: %s\n", str_sid
, temp
);
135 if (GetLastError() != ERROR_INVALID_SID
)
136 trace(" %s: couldn't be converted, returned %d\n", str_sid
, GetLastError());
138 trace(" %s: couldn't be converted\n", str_sid
);
142 static void test_sid(void)
144 struct sidRef refs
[] = {
145 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
146 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
147 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
148 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
149 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
150 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
152 const char noSubAuthStr
[] = "S-1-5";
159 pConvertSidToStringSidA
= (fnConvertSidToStringSidA
)
160 GetProcAddress( hmod
, "ConvertSidToStringSidA" );
161 if( !pConvertSidToStringSidA
)
163 pConvertStringSidToSidA
= (fnConvertStringSidToSidA
)
164 GetProcAddress( hmod
, "ConvertStringSidToSidA" );
165 if( !pConvertStringSidToSidA
)
168 r
= pConvertStringSidToSidA( NULL
, NULL
);
169 ok( !r
, "expected failure with NULL parameters\n" );
170 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
172 ok( GetLastError() == ERROR_INVALID_PARAMETER
,
173 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
176 r
= pConvertStringSidToSidA( refs
[0].refStr
, NULL
);
177 ok( !r
&& GetLastError() == ERROR_INVALID_PARAMETER
,
178 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
181 r
= pConvertStringSidToSidA( NULL
, &str
);
182 ok( !r
&& GetLastError() == ERROR_INVALID_PARAMETER
,
183 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
186 r
= pConvertStringSidToSidA( noSubAuthStr
, &psid
);
188 "expected failure with no sub authorities\n" );
189 ok( GetLastError() == ERROR_INVALID_SID
,
190 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
193 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid
), "ConvertStringSidToSidA failed\n");
195 ok(pisid
->SubAuthorityCount
== 4, "Invalid sub authority count - expected 4, got %d\n", pisid
->SubAuthorityCount
);
196 ok(pisid
->SubAuthority
[0] == 21, "Invalid subauthority 0 - expceted 21, got %d\n", pisid
->SubAuthority
[0]);
197 ok(pisid
->SubAuthority
[3] == 4576, "Invalid subauthority 0 - expceted 4576, got %d\n", pisid
->SubAuthority
[3]);
200 for( i
= 0; i
< sizeof(refs
) / sizeof(refs
[0]); i
++ )
204 r
= AllocateAndInitializeSid( &refs
[i
].auth
, 1,1,0,0,0,0,0,0,0,
206 ok( r
, "failed to allocate sid\n" );
207 r
= pConvertSidToStringSidA( psid
, &str
);
208 ok( r
, "failed to convert sid\n" );
211 ok( !strcmp( str
, refs
[i
].refStr
),
212 "incorrect sid, expected %s, got %s\n", refs
[i
].refStr
, str
);
218 r
= pConvertStringSidToSidA( refs
[i
].refStr
, &psid
);
219 ok( r
, "failed to parse sid string\n" );
222 !memcmp( pisid
->IdentifierAuthority
.Value
, refs
[i
].auth
.Value
,
223 sizeof(refs
[i
].auth
) ),
224 "string sid %s didn't parse to expected value\n"
225 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
227 MAKEWORD( pisid
->IdentifierAuthority
.Value
[1],
228 pisid
->IdentifierAuthority
.Value
[0] ),
229 MAKELONG( MAKEWORD( pisid
->IdentifierAuthority
.Value
[5],
230 pisid
->IdentifierAuthority
.Value
[4] ),
231 MAKEWORD( pisid
->IdentifierAuthority
.Value
[3],
232 pisid
->IdentifierAuthority
.Value
[2] ) ),
233 MAKEWORD( refs
[i
].auth
.Value
[1], refs
[i
].auth
.Value
[0] ),
234 MAKELONG( MAKEWORD( refs
[i
].auth
.Value
[5], refs
[i
].auth
.Value
[4] ),
235 MAKEWORD( refs
[i
].auth
.Value
[3], refs
[i
].auth
.Value
[2] ) ) );
240 trace("String SIDs:\n");
281 static void test_trustee(void)
283 GUID ObjectType
= {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
284 GUID InheritedObjectType
= {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
286 OBJECTS_AND_NAME_ oan
;
290 char szObjectTypeName
[] = "ObjectTypeName";
291 char szInheritedObjectTypeName
[] = "InheritedObjectTypeName";
292 char szTrusteeName
[] = "szTrusteeName";
293 SID_IDENTIFIER_AUTHORITY auth
= { {0x11,0x22,0,0,0, 0} };
295 memset( &ZeroGuid
, 0x00, sizeof (ZeroGuid
) );
297 pBuildTrusteeWithSidA
= (fnBuildTrusteeWithSidA
)
298 GetProcAddress( hmod
, "BuildTrusteeWithSidA" );
299 pBuildTrusteeWithNameA
= (fnBuildTrusteeWithNameA
)
300 GetProcAddress( hmod
, "BuildTrusteeWithNameA" );
301 pBuildTrusteeWithObjectsAndNameA
= (fnBuildTrusteeWithObjectsAndNameA
)
302 GetProcAddress (hmod
, "BuildTrusteeWithObjectsAndNameA" );
303 pBuildTrusteeWithObjectsAndSidA
= (fnBuildTrusteeWithObjectsAndSidA
)
304 GetProcAddress (hmod
, "BuildTrusteeWithObjectsAndSidA" );
305 pGetTrusteeNameA
= (fnGetTrusteeNameA
)
306 GetProcAddress (hmod
, "GetTrusteeNameA" );
307 if( !pBuildTrusteeWithSidA
|| !pBuildTrusteeWithNameA
||
308 !pBuildTrusteeWithObjectsAndNameA
|| !pBuildTrusteeWithObjectsAndSidA
||
312 if ( ! AllocateAndInitializeSid( &auth
, 1, 42, 0,0,0,0,0,0,0,&psid
) )
314 trace( "failed to init SID\n" );
318 /* test BuildTrusteeWithSidA */
319 memset( &trustee
, 0xff, sizeof trustee
);
320 pBuildTrusteeWithSidA( &trustee
, psid
);
322 ok( trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
323 ok( trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
,
324 "MultipleTrusteeOperation wrong\n");
325 ok( trustee
.TrusteeForm
== TRUSTEE_IS_SID
, "TrusteeForm wrong\n");
326 ok( trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
327 ok( trustee
.ptstrName
== (LPSTR
) psid
, "ptstrName wrong\n" );
329 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
330 memset( &trustee
, 0xff, sizeof trustee
);
331 memset( &oas
, 0xff, sizeof(oas
) );
332 pBuildTrusteeWithObjectsAndSidA(&trustee
, &oas
, &ObjectType
,
333 &InheritedObjectType
, psid
);
335 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
336 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
337 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_SID
, "TrusteeForm wrong\n");
338 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
339 ok(trustee
.ptstrName
== (LPSTR
)&oas
, "ptstrName wrong\n");
341 ok(oas
.ObjectsPresent
== (ACE_OBJECT_TYPE_PRESENT
| ACE_INHERITED_OBJECT_TYPE_PRESENT
), "ObjectsPresent wrong\n");
342 ok(!memcmp(&oas
.ObjectTypeGuid
, &ObjectType
, sizeof(GUID
)), "ObjectTypeGuid wrong\n");
343 ok(!memcmp(&oas
.InheritedObjectTypeGuid
, &InheritedObjectType
, sizeof(GUID
)), "InheritedObjectTypeGuid wrong\n");
344 ok(oas
.pSid
== psid
, "pSid wrong\n");
346 /* test GetTrusteeNameA */
347 ok(pGetTrusteeNameA(&trustee
) == (LPSTR
)&oas
, "GetTrusteeName returned wrong value\n");
349 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
350 memset( &trustee
, 0xff, sizeof trustee
);
351 memset( &oas
, 0xff, sizeof(oas
) );
352 pBuildTrusteeWithObjectsAndSidA(&trustee
, &oas
, NULL
,
353 &InheritedObjectType
, psid
);
355 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
356 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
357 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_SID
, "TrusteeForm wrong\n");
358 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
359 ok(trustee
.ptstrName
== (LPSTR
)&oas
, "ptstrName wrong\n");
361 ok(oas
.ObjectsPresent
== ACE_INHERITED_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
362 ok(!memcmp(&oas
.ObjectTypeGuid
, &ZeroGuid
, sizeof(GUID
)), "ObjectTypeGuid wrong\n");
363 ok(!memcmp(&oas
.InheritedObjectTypeGuid
, &InheritedObjectType
, sizeof(GUID
)), "InheritedObjectTypeGuid wrong\n");
364 ok(oas
.pSid
== psid
, "pSid wrong\n");
368 /* test BuildTrusteeWithNameA */
369 memset( &trustee
, 0xff, sizeof trustee
);
370 pBuildTrusteeWithNameA( &trustee
, szTrusteeName
);
372 ok( trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
373 ok( trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
,
374 "MultipleTrusteeOperation wrong\n");
375 ok( trustee
.TrusteeForm
== TRUSTEE_IS_NAME
, "TrusteeForm wrong\n");
376 ok( trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
377 ok( trustee
.ptstrName
== szTrusteeName
, "ptstrName wrong\n" );
379 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
380 memset( &trustee
, 0xff, sizeof trustee
);
381 memset( &oan
, 0xff, sizeof(oan
) );
382 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, szObjectTypeName
,
383 szInheritedObjectTypeName
, szTrusteeName
);
385 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
386 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
387 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
388 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
389 ok(trustee
.ptstrName
== (LPTSTR
)&oan
, "ptstrName wrong\n");
391 ok(oan
.ObjectsPresent
== (ACE_OBJECT_TYPE_PRESENT
| ACE_INHERITED_OBJECT_TYPE_PRESENT
), "ObjectsPresent wrong\n");
392 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
393 ok(oan
.InheritedObjectTypeName
== szInheritedObjectTypeName
, "InheritedObjectTypeName wrong\n");
394 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
396 /* test GetTrusteeNameA */
397 ok(pGetTrusteeNameA(&trustee
) == (LPSTR
)&oan
, "GetTrusteeName returned wrong value\n");
399 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
400 memset( &trustee
, 0xff, sizeof trustee
);
401 memset( &oan
, 0xff, sizeof(oan
) );
402 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, NULL
,
403 szInheritedObjectTypeName
, szTrusteeName
);
405 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
406 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
407 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
408 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
409 ok(trustee
.ptstrName
== (LPSTR
)&oan
, "ptstrName wrong\n");
411 ok(oan
.ObjectsPresent
== ACE_INHERITED_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
412 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
413 ok(oan
.InheritedObjectTypeName
== szInheritedObjectTypeName
, "InheritedObjectTypeName wrong\n");
414 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
416 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
417 memset( &trustee
, 0xff, sizeof trustee
);
418 memset( &oan
, 0xff, sizeof(oan
) );
419 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, szObjectTypeName
,
420 NULL
, szTrusteeName
);
422 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
423 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
424 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
425 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
426 ok(trustee
.ptstrName
== (LPTSTR
)&oan
, "ptstrName wrong\n");
428 ok(oan
.ObjectsPresent
== ACE_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
429 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
430 ok(oan
.InheritedObjectTypeName
== NULL
, "InheritedObjectTypeName wrong\n");
431 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
434 /* If the first isn't defined, assume none is */
435 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
436 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
437 #define SE_CREATE_TOKEN_PRIVILEGE 2L
438 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
439 #define SE_LOCK_MEMORY_PRIVILEGE 4L
440 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
441 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
442 #define SE_TCB_PRIVILEGE 7L
443 #define SE_SECURITY_PRIVILEGE 8L
444 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
445 #define SE_LOAD_DRIVER_PRIVILEGE 10L
446 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
447 #define SE_SYSTEMTIME_PRIVILEGE 12L
448 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
449 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
450 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
451 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
452 #define SE_BACKUP_PRIVILEGE 17L
453 #define SE_RESTORE_PRIVILEGE 18L
454 #define SE_SHUTDOWN_PRIVILEGE 19L
455 #define SE_DEBUG_PRIVILEGE 20L
456 #define SE_AUDIT_PRIVILEGE 21L
457 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
458 #define SE_CHANGE_NOTIFY_PRIVILLEGE 23L
459 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
460 #define SE_UNDOCK_PRIVILEGE 25L
461 #define SE_SYNC_AGENT_PRIVILEGE 26L
462 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
463 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
464 #define SE_IMPERSONATE_PRIVILEGE 29L
465 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
466 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
467 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
469 static void test_allocateLuid(void)
471 BOOL (WINAPI
*pAllocateLocallyUniqueId
)(PLUID
);
475 pAllocateLocallyUniqueId
= (void*)GetProcAddress(hmod
, "AllocateLocallyUniqueId");
476 if (!pAllocateLocallyUniqueId
) return;
478 ret
= pAllocateLocallyUniqueId(&luid1
);
479 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
483 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
484 ret
= pAllocateLocallyUniqueId(&luid2
);
486 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
487 ok(luid1
.LowPart
> SE_MAX_WELL_KNOWN_PRIVILEGE
|| luid1
.HighPart
!= 0,
488 "AllocateLocallyUniqueId returned a well-known LUID\n");
489 ok(luid1
.LowPart
!= luid2
.LowPart
|| luid1
.HighPart
!= luid2
.HighPart
,
490 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
491 ret
= pAllocateLocallyUniqueId(NULL
);
492 ok( !ret
&& GetLastError() == ERROR_NOACCESS
,
493 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
497 static void test_lookupPrivilegeName(void)
499 BOOL (WINAPI
*pLookupPrivilegeNameA
)(LPCSTR
, PLUID
, LPSTR
, LPDWORD
);
500 char buf
[MAX_PATH
]; /* arbitrary, seems long enough */
501 DWORD cchName
= sizeof(buf
);
502 LUID luid
= { 0, 0 };
506 /* check whether it's available first */
507 pLookupPrivilegeNameA
= (void*)GetProcAddress(hmod
, "LookupPrivilegeNameA");
508 if (!pLookupPrivilegeNameA
) return;
509 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
510 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
511 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
514 /* check with a short buffer */
516 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
517 ret
= pLookupPrivilegeNameA(NULL
, &luid
, NULL
, &cchName
);
518 ok( !ret
&& GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
519 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
521 ok(cchName
== strlen("SeCreateTokenPrivilege") + 1,
522 "LookupPrivilegeNameA returned an incorrect required length for\n"
523 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName
,
524 lstrlenA("SeCreateTokenPrivilege") + 1);
525 /* check a known value and its returned length on success */
526 cchName
= sizeof(buf
);
527 ok(pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
) &&
528 cchName
== strlen("SeCreateTokenPrivilege"),
529 "LookupPrivilegeNameA returned an incorrect output length for\n"
530 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName
,
531 (int)strlen("SeCreateTokenPrivilege"));
532 /* check known values */
533 for (i
= SE_MIN_WELL_KNOWN_PRIVILEGE
; i
< SE_MAX_WELL_KNOWN_PRIVILEGE
; i
++)
536 cchName
= sizeof(buf
);
537 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
538 ok( ret
|| GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
539 "LookupPrivilegeNameA(0.%d) failed: %d\n", i
, GetLastError());
541 /* check a bogus LUID */
542 luid
.LowPart
= 0xdeadbeef;
543 cchName
= sizeof(buf
);
544 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
545 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
546 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
548 /* check on a bogus system */
549 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
550 cchName
= sizeof(buf
);
551 ret
= pLookupPrivilegeNameA("b0gu5.Nam3", &luid
, buf
, &cchName
);
552 ok( !ret
&& GetLastError() == RPC_S_SERVER_UNAVAILABLE
,
553 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
563 static void test_lookupPrivilegeValue(void)
565 static const struct NameToLUID privs
[] = {
566 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE
},
567 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE
},
568 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE
},
569 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE
},
570 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE
},
571 { "SeTcbPrivilege", SE_TCB_PRIVILEGE
},
572 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE
},
573 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE
},
574 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE
},
575 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE
},
576 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE
},
577 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE
},
578 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE
},
579 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE
},
580 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE
},
581 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE
},
582 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE
},
583 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE
},
584 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE
},
585 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE
},
586 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE
},
587 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILLEGE
},
588 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE
},
589 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE
},
590 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE
},
591 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE
},
592 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE
},
593 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE
},
594 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE
},
596 BOOL (WINAPI
*pLookupPrivilegeValueA
)(LPCSTR
, LPCSTR
, PLUID
);
601 /* check whether it's available first */
602 pLookupPrivilegeValueA
= (void*)GetProcAddress(hmod
, "LookupPrivilegeValueA");
603 if (!pLookupPrivilegeValueA
) return;
604 ret
= pLookupPrivilegeValueA(NULL
, "SeCreateTokenPrivilege", &luid
);
605 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
608 /* check a bogus system name */
609 ret
= pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid
);
610 ok( !ret
&& GetLastError() == RPC_S_SERVER_UNAVAILABLE
,
611 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
613 /* check a NULL string */
614 ret
= pLookupPrivilegeValueA(NULL
, 0, &luid
);
615 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
616 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
618 /* check a bogus privilege name */
619 ret
= pLookupPrivilegeValueA(NULL
, "SeBogusPrivilege", &luid
);
620 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
621 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
623 /* check case insensitive */
624 ret
= pLookupPrivilegeValueA(NULL
, "sEcREATEtOKENpRIVILEGE", &luid
);
626 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
628 for (i
= 0; i
< sizeof(privs
) / sizeof(privs
[0]); i
++)
630 /* Not all privileges are implemented on all Windows versions, so
631 * don't worry if the call fails
633 if (pLookupPrivilegeValueA(NULL
, privs
[i
].name
, &luid
))
635 ok(luid
.LowPart
== privs
[i
].lowPart
,
636 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
642 static void test_luid(void)
645 test_lookupPrivilegeName();
646 test_lookupPrivilegeValue();
649 static void test_FileSecurity(void)
651 char directory
[MAX_PATH
];
652 DWORD retval
, outSize
;
656 pGetFileSecurityA
= (fnGetFileSecurityA
)
657 GetProcAddress( hmod
, "GetFileSecurityA" );
658 if( !pGetFileSecurityA
)
661 retval
= GetTempPathA(sizeof(directory
), directory
);
663 trace("GetTempPathA failed\n");
667 strcpy(directory
, "\\Should not exist");
669 SetLastError(NO_ERROR
);
670 result
= pGetFileSecurityA( directory
,OWNER_SECURITY_INFORMATION
,buffer
,0x40,&outSize
);
671 ok(!result
, "GetFileSecurityA should fail for not existing directories/files\n");
672 ok( (GetLastError() == ERROR_FILE_NOT_FOUND
) ||
673 (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
) ,
674 "last error ERROR_FILE_NOT_FOUND / ERROR_CALL_NOT_IMPLEMENTED (98) "
675 "expected, got %d\n", GetLastError());
678 static void test_AccessCheck(void)
680 PSID EveryoneSid
= NULL
, AdminSid
= NULL
, UsersSid
= NULL
;
682 SECURITY_DESCRIPTOR
*SecurityDescriptor
= NULL
;
683 SID_IDENTIFIER_AUTHORITY SIDAuthWorld
= { SECURITY_WORLD_SID_AUTHORITY
};
684 SID_IDENTIFIER_AUTHORITY SIDAuthNT
= { SECURITY_NT_AUTHORITY
};
685 GENERIC_MAPPING Mapping
= { KEY_READ
, KEY_WRITE
, KEY_EXECUTE
, KEY_ALL_ACCESS
};
692 PRIVILEGE_SET
*PrivSet
;
698 NtDllModule
= GetModuleHandle("ntdll.dll");
701 skip("not running on NT, skipping test\n");
704 pRtlAdjustPrivilege
= (fnRtlAdjustPrivilege
)
705 GetProcAddress(NtDllModule
, "RtlAdjustPrivilege");
706 if (!pRtlAdjustPrivilege
)
708 skip("missing RtlAdjustPrivilege, skipping test\n");
712 Acl
= HeapAlloc(GetProcessHeap(), 0, 256);
713 res
= InitializeAcl(Acl
, 256, ACL_REVISION
);
714 if(!res
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
716 skip("ACLs not implemented - skipping tests\n");
719 ok(res
, "InitializeAcl failed with error %d\n", GetLastError());
721 res
= AllocateAndInitializeSid( &SIDAuthWorld
, 1, SECURITY_WORLD_RID
, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid
);
722 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
724 res
= AllocateAndInitializeSid( &SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
725 DOMAIN_ALIAS_RID_ADMINS
, 0, 0, 0, 0, 0, 0, &AdminSid
);
726 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
728 res
= AllocateAndInitializeSid( &SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
729 DOMAIN_ALIAS_RID_USERS
, 0, 0, 0, 0, 0, 0, &UsersSid
);
730 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
732 res
= AddAccessAllowedAce(Acl
, ACL_REVISION
, KEY_READ
, EveryoneSid
);
733 ok(res
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
735 res
= AddAccessDeniedAce(Acl
, ACL_REVISION
, KEY_SET_VALUE
, AdminSid
);
736 ok(res
, "AddAccessDeniedAce failed with error %d\n", GetLastError());
738 SecurityDescriptor
= HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH
);
740 res
= InitializeSecurityDescriptor(SecurityDescriptor
, SECURITY_DESCRIPTOR_REVISION
);
741 ok(res
, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
743 res
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
744 ok(res
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
746 PrivSetLen
= FIELD_OFFSET(PRIVILEGE_SET
, Privilege
[16]);
747 PrivSet
= HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY
, PrivSetLen
);
748 PrivSet
->PrivilegeCount
= 16;
750 res
= OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE
|TOKEN_QUERY
, &ProcessToken
);
751 ok(res
, "OpenProcessToken failed with error %d\n", GetLastError());
753 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE
, FALSE
, TRUE
, &Enabled
);
755 res
= DuplicateToken(ProcessToken
, SecurityIdentification
, &Token
);
756 ok(res
, "DuplicateToken failed with error %d\n", GetLastError());
758 /* SD without owner/group */
759 SetLastError(0xdeadbeef);
760 Access
= AccessStatus
= 0xdeadbeef;
761 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_QUERY_VALUE
, &Mapping
,
762 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
763 err
= GetLastError();
764 ok(!ret
&& err
== ERROR_INVALID_SECURITY_DESCR
, "AccessCheck should have "
765 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err
);
766 ok(Access
== 0xdeadbeef && AccessStatus
== 0xdeadbeef,
767 "Access and/or AccessStatus were changed!\n");
769 /* Set owner and group */
770 res
= SetSecurityDescriptorOwner(SecurityDescriptor
, AdminSid
, FALSE
);
771 ok(res
, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
772 res
= SetSecurityDescriptorGroup(SecurityDescriptor
, UsersSid
, TRUE
);
773 ok(res
, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
775 /* Generic access mask */
776 SetLastError(0xdeadbeef);
777 ret
= AccessCheck(SecurityDescriptor
, Token
, GENERIC_READ
, &Mapping
,
778 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
779 err
= GetLastError();
780 ok(!ret
&& err
== ERROR_GENERIC_NOT_MAPPED
, "AccessCheck should have failed "
781 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err
);
782 ok(Access
== 0xdeadbeef && AccessStatus
== 0xdeadbeef,
783 "Access and/or AccessStatus were changed!\n");
785 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
786 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
787 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
788 ok(AccessStatus
&& (Access
== KEY_READ
),
789 "AccessCheck failed to grant access with error %d\n",
792 ret
= AccessCheck(SecurityDescriptor
, Token
, MAXIMUM_ALLOWED
, &Mapping
,
793 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
794 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
796 "AccessCheck failed to grant any access with error %d\n",
798 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access
);
800 /* Access denied by SD */
801 SetLastError(0xdeadbeef);
802 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_WRITE
, &Mapping
,
803 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
804 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
805 err
= GetLastError();
806 ok(!AccessStatus
&& err
== ERROR_ACCESS_DENIED
, "AccessCheck should have failed "
807 "with ERROR_ACCESS_DENIED, instead of %d\n", err
);
808 ok(!Access
, "Should have failed to grant any access, got 0x%08x\n", Access
);
811 PrivSet
->PrivilegeCount
= 16;
812 ret
= AccessCheck(SecurityDescriptor
, Token
, ACCESS_SYSTEM_SECURITY
, &Mapping
,
813 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
814 ok(ret
&& !AccessStatus
&& GetLastError() == ERROR_PRIVILEGE_NOT_HELD
,
815 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
818 ret
= pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE
, TRUE
, TRUE
, &Enabled
);
822 PrivSet
->PrivilegeCount
= 16;
823 ret
= AccessCheck(SecurityDescriptor
, Token
, ACCESS_SYSTEM_SECURITY
, &Mapping
,
824 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
825 ok(ret
&& AccessStatus
&& GetLastError() == 0,
826 "AccessCheck should have succeeded, error %d\n",
828 ok(Access
== ACCESS_SYSTEM_SECURITY
,
829 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
833 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
838 res
= DuplicateToken(ProcessToken
, SecurityAnonymous
, &Token
);
839 ok(res
, "DuplicateToken failed with error %d\n", GetLastError());
841 SetLastError(0xdeadbeef);
842 ret
= AccessCheck(SecurityDescriptor
, Token
, MAXIMUM_ALLOWED
, &Mapping
,
843 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
844 err
= GetLastError();
845 ok(!ret
&& err
== ERROR_BAD_IMPERSONATION_LEVEL
, "AccessCheck should have failed "
846 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err
);
850 SetLastError(0xdeadbeef);
851 ret
= AccessCheck(SecurityDescriptor
, ProcessToken
, KEY_READ
, &Mapping
,
852 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
853 err
= GetLastError();
854 ok(!ret
&& err
== ERROR_NO_IMPERSONATION_TOKEN
, "AccessCheck should have failed "
855 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err
);
857 CloseHandle(ProcessToken
);
860 FreeSid(EveryoneSid
);
865 HeapFree(GetProcessHeap(), 0, Acl
);
866 HeapFree(GetProcessHeap(), 0, SecurityDescriptor
);
867 HeapFree(GetProcessHeap(), 0, PrivSet
);
870 /* test GetTokenInformation for the various attributes */
871 static void test_token_attr(void)
873 HANDLE Token
, ImpersonationToken
;
875 TOKEN_PRIVILEGES
*Privileges
;
876 TOKEN_GROUPS
*Groups
;
881 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
883 /* cygwin-like use case */
884 SetLastError(0xdeadbeef);
885 ret
= OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED
, &Token
);
886 if(!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
888 skip("OpenProcessToken is not implemented\n");
891 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
896 ret
= GetTokenInformation(Token
, TokenUser
,(void*)buf
, Size
, &Size
);
897 ok(ret
, "GetTokenInformation failed with error %d\n", GetLastError());
898 Size
= sizeof(ImpersonationLevel
);
899 ret
= GetTokenInformation(Token
, TokenImpersonationLevel
, &ImpersonationLevel
, Size
, &Size
);
900 GLE
= GetLastError();
901 ok(!ret
&& (GLE
== ERROR_INVALID_PARAMETER
), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE
);
905 if(!pConvertSidToStringSidA
)
907 skip("ConvertSidToStringSidA is not available\n");
911 SetLastError(0xdeadbeef);
912 ret
= OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY
|TOKEN_DUPLICATE
, &Token
);
913 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
916 ret
= GetTokenInformation(Token
, TokenGroups
, NULL
, 0, &Size
);
917 Groups
= HeapAlloc(GetProcessHeap(), 0, Size
);
918 ret
= GetTokenInformation(Token
, TokenGroups
, Groups
, Size
, &Size
);
919 ok(ret
, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
920 trace("TokenGroups:\n");
921 for (i
= 0; i
< Groups
->GroupCount
; i
++)
923 DWORD NameLength
= 255;
925 DWORD DomainLength
= 255;
927 SID_NAME_USE SidNameUse
;
928 pConvertSidToStringSidA(Groups
->Groups
[i
].Sid
, &SidString
);
931 ret
= LookupAccountSid(NULL
, Groups
->Groups
[i
].Sid
, Name
, &NameLength
, Domain
, &DomainLength
, &SidNameUse
);
933 trace("\t%s, %s\\%s use: %d attr: 0x%08x\n", SidString
, Domain
, Name
, SidNameUse
, Groups
->Groups
[i
].Attributes
);
935 trace("\t%s, attr: 0x%08x LookupAccountSid failed with error %d\n", SidString
, Groups
->Groups
[i
].Attributes
, GetLastError());
936 LocalFree(SidString
);
938 HeapFree(GetProcessHeap(), 0, Groups
);
941 ret
= GetTokenInformation(Token
, TokenUser
, NULL
, 0, &Size
);
942 ok(!ret
&& (GetLastError() == ERROR_INSUFFICIENT_BUFFER
),
943 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
944 User
= HeapAlloc(GetProcessHeap(), 0, Size
);
945 ret
= GetTokenInformation(Token
, TokenUser
, User
, Size
, &Size
);
947 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
949 pConvertSidToStringSidA(User
->User
.Sid
, &SidString
);
950 trace("TokenUser: %s attr: 0x%08x\n", SidString
, User
->User
.Attributes
);
951 LocalFree(SidString
);
952 HeapFree(GetProcessHeap(), 0, User
);
955 ret
= GetTokenInformation(Token
, TokenPrivileges
, NULL
, 0, &Size
);
956 ok(!ret
&& (GetLastError() == ERROR_INSUFFICIENT_BUFFER
),
957 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
958 Privileges
= HeapAlloc(GetProcessHeap(), 0, Size
);
959 ret
= GetTokenInformation(Token
, TokenPrivileges
, Privileges
, Size
, &Size
);
961 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
962 trace("TokenPrivileges:\n");
963 for (i
= 0; i
< Privileges
->PrivilegeCount
; i
++)
966 DWORD NameLen
= sizeof(Name
)/sizeof(Name
[0]);
967 LookupPrivilegeName(NULL
, &Privileges
->Privileges
[i
].Luid
, Name
, &NameLen
);
968 trace("\t%s, 0x%x\n", Name
, Privileges
->Privileges
[i
].Attributes
);
970 HeapFree(GetProcessHeap(), 0, Privileges
);
972 ret
= DuplicateToken(Token
, SecurityAnonymous
, &ImpersonationToken
);
973 ok(ret
, "DuplicateToken failed with error %d\n", GetLastError());
975 Size
= sizeof(ImpersonationLevel
);
976 ret
= GetTokenInformation(ImpersonationToken
, TokenImpersonationLevel
, &ImpersonationLevel
, Size
, &Size
);
977 ok(ret
, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
978 ok(ImpersonationLevel
== SecurityAnonymous
, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel
);
980 CloseHandle(ImpersonationToken
);
984 typedef union _MAX_SID
987 char max
[SECURITY_MAX_SID_SIZE
];
990 static void test_sid_str(PSID
* sid
)
993 BOOL ret
= pConvertSidToStringSidA(sid
, &str_sid
);
994 ok(ret
, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
997 char account
[MAX_PATH
], domain
[MAX_PATH
];
999 DWORD acc_size
= MAX_PATH
;
1000 DWORD dom_size
= MAX_PATH
;
1001 ret
= LookupAccountSid(NULL
, sid
, account
, &acc_size
, domain
, &dom_size
, &use
);
1002 ok(ret
|| (!ret
&& (GetLastError() == ERROR_NONE_MAPPED
)),
1003 "LookupAccountSid(%s) failed: %d\n", str_sid
, GetLastError());
1005 trace(" %s %s\\%s %d\n", str_sid
, domain
, account
, use
);
1006 else if (GetLastError() == ERROR_NONE_MAPPED
)
1007 trace(" %s couldn't be mapped\n", str_sid
);
1012 static void test_LookupAccountSid(void)
1014 SID_IDENTIFIER_AUTHORITY SIDAuthNT
= { SECURITY_NT_AUTHORITY
};
1015 CHAR accountA
[MAX_PATH
], domainA
[MAX_PATH
];
1016 DWORD acc_sizeA
, dom_sizeA
;
1017 DWORD real_acc_sizeA
, real_dom_sizeA
;
1018 WCHAR accountW
[MAX_PATH
], domainW
[MAX_PATH
];
1019 DWORD acc_sizeW
, dom_sizeW
;
1020 DWORD real_acc_sizeW
, real_dom_sizeW
;
1021 PSID pUsersSid
= NULL
;
1029 /* native windows crashes if account size, domain size, or name use is NULL */
1031 ret
= AllocateAndInitializeSid(&SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
1032 DOMAIN_ALIAS_RID_USERS
, 0, 0, 0, 0, 0, 0, &pUsersSid
);
1033 ok(ret
|| (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
),
1034 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1036 /* not running on NT so give up */
1037 if (!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1040 real_acc_sizeA
= MAX_PATH
;
1041 real_dom_sizeA
= MAX_PATH
;
1042 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &real_acc_sizeA
, domainA
, &real_dom_sizeA
, &use
);
1043 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1045 /* try NULL account */
1046 acc_sizeA
= MAX_PATH
;
1047 dom_sizeA
= MAX_PATH
;
1048 ret
= LookupAccountSidA(NULL
, pUsersSid
, NULL
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1049 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1051 /* try NULL domain */
1052 acc_sizeA
= MAX_PATH
;
1053 dom_sizeA
= MAX_PATH
;
1054 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, NULL
, &dom_sizeA
, &use
);
1055 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1057 /* try a small account buffer */
1059 dom_sizeA
= MAX_PATH
;
1061 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1062 ok(!ret
, "LookupAccountSidA() Expected FALSE got TRUE\n");
1063 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1064 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1066 /* try a 0 sized account buffer */
1068 dom_sizeA
= MAX_PATH
;
1070 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1071 /* this can fail or succeed depending on OS version but the size will always be returned */
1072 ok(acc_sizeA
== real_acc_sizeA
+ 1,
1073 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1074 real_acc_sizeA
+ 1, acc_sizeA
);
1076 /* try a 0 sized account buffer */
1078 dom_sizeA
= MAX_PATH
;
1079 ret
= LookupAccountSidA(NULL
, pUsersSid
, NULL
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1080 /* this can fail or succeed depending on OS version but the size will always be returned */
1081 ok(acc_sizeA
== real_acc_sizeA
+ 1,
1082 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1083 real_acc_sizeA
+ 1, acc_sizeA
);
1085 /* try a small domain buffer */
1087 acc_sizeA
= MAX_PATH
;
1089 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1090 ok(!ret
, "LookupAccountSidA() Expected FALSE got TRUE\n");
1091 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1092 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1094 /* try a 0 sized domain buffer */
1096 acc_sizeA
= MAX_PATH
;
1098 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1099 /* this can fail or succeed depending on OS version but the size will always be returned */
1100 ok(dom_sizeA
== real_dom_sizeA
+ 1,
1101 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1102 real_dom_sizeA
+ 1, dom_sizeA
);
1104 /* try a 0 sized domain buffer */
1106 acc_sizeA
= MAX_PATH
;
1107 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, NULL
, &dom_sizeA
, &use
);
1108 /* this can fail or succeed depending on OS version but the size will always be returned */
1109 ok(dom_sizeA
== real_dom_sizeA
+ 1,
1110 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1111 real_dom_sizeA
+ 1, dom_sizeA
);
1113 real_acc_sizeW
= MAX_PATH
;
1114 real_dom_sizeW
= MAX_PATH
;
1115 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &real_acc_sizeW
, domainW
, &real_dom_sizeW
, &use
);
1116 ok(ret
, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1118 /* native windows crashes if domainW or accountW is NULL */
1120 /* try a small account buffer */
1122 dom_sizeW
= MAX_PATH
;
1124 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1125 ok(!ret
, "LookupAccountSidW() Expected FALSE got TRUE\n");
1126 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1127 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1129 /* try a 0 sized account buffer */
1131 dom_sizeW
= MAX_PATH
;
1133 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1134 /* this can fail or succeed depending on OS version but the size will always be returned */
1135 ok(acc_sizeW
== real_acc_sizeW
+ 1,
1136 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1137 real_acc_sizeW
+ 1, acc_sizeW
);
1139 /* try a 0 sized account buffer */
1141 dom_sizeW
= MAX_PATH
;
1142 ret
= LookupAccountSidW(NULL
, pUsersSid
, NULL
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1143 /* this can fail or succeed depending on OS version but the size will always be returned */
1144 ok(acc_sizeW
== real_acc_sizeW
+ 1,
1145 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1146 real_acc_sizeW
+ 1, acc_sizeW
);
1148 /* try a small domain buffer */
1150 acc_sizeW
= MAX_PATH
;
1152 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1153 ok(!ret
, "LookupAccountSidW() Expected FALSE got TRUE\n");
1154 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1155 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1157 /* try a 0 sized domain buffer */
1159 acc_sizeW
= MAX_PATH
;
1161 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1162 /* this can fail or succeed depending on OS version but the size will always be returned */
1163 ok(dom_sizeW
== real_dom_sizeW
+ 1,
1164 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1165 real_dom_sizeW
+ 1, dom_sizeW
);
1167 /* try a 0 sized domain buffer */
1169 acc_sizeW
= MAX_PATH
;
1170 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, NULL
, &dom_sizeW
, &use
);
1171 /* this can fail or succeed depending on OS version but the size will always be returned */
1172 ok(dom_sizeW
== real_dom_sizeW
+ 1,
1173 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1174 real_dom_sizeW
+ 1, dom_sizeW
);
1178 pCreateWellKnownSid
= (fnCreateWellKnownSid
)GetProcAddress( hmod
, "CreateWellKnownSid" );
1180 if (pCreateWellKnownSid
&& pConvertSidToStringSidA
)
1182 trace("Well Known SIDs:\n");
1183 for (i
= 0; i
<= 60; i
++)
1185 size
= SECURITY_MAX_SID_SIZE
;
1186 if (pCreateWellKnownSid(i
, NULL
, &max_sid
.sid
, &size
))
1188 if (pConvertSidToStringSidA(&max_sid
.sid
, &str_sidA
))
1190 acc_sizeA
= MAX_PATH
;
1191 dom_sizeA
= MAX_PATH
;
1192 if (LookupAccountSidA(NULL
, &max_sid
.sid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
))
1193 trace(" %d: %s %s\\%s %d\n", i
, str_sidA
, domainA
, accountA
, use
);
1194 LocalFree(str_sidA
);
1199 if (GetLastError() != ERROR_INVALID_PARAMETER
)
1200 trace(" CreateWellKnownSid(%d) failed: %d\n", i
, GetLastError());
1202 trace(" %d: not supported\n", i
);
1206 pLsaQueryInformationPolicy
= (fnLsaQueryInformationPolicy
)GetProcAddress( hmod
, "LsaQueryInformationPolicy");
1207 pLsaOpenPolicy
= (fnLsaOpenPolicy
)GetProcAddress( hmod
, "LsaOpenPolicy");
1208 pLsaFreeMemory
= (fnLsaFreeMemory
)GetProcAddress( hmod
, "LsaFreeMemory");
1209 pLsaClose
= (fnLsaClose
)GetProcAddress( hmod
, "LsaClose");
1211 if (pLsaQueryInformationPolicy
&& pLsaOpenPolicy
&& pLsaFreeMemory
&& pLsaClose
)
1215 LSA_OBJECT_ATTRIBUTES object_attributes
;
1217 ZeroMemory(&object_attributes
, sizeof(object_attributes
));
1218 object_attributes
.Length
= sizeof(object_attributes
);
1220 status
= pLsaOpenPolicy( NULL
, &object_attributes
, POLICY_ALL_ACCESS
, &handle
);
1221 ok(status
== STATUS_SUCCESS
|| status
== STATUS_ACCESS_DENIED
,
1222 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status
);
1224 /* try a more restricted access mask if necessary */
1225 if (status
== STATUS_ACCESS_DENIED
) {
1226 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
1227 status
= pLsaOpenPolicy( NULL
, &object_attributes
, POLICY_VIEW_LOCAL_INFORMATION
, &handle
);
1228 ok(status
== STATUS_SUCCESS
, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status
);
1231 if (status
== STATUS_SUCCESS
)
1233 PPOLICY_ACCOUNT_DOMAIN_INFO info
;
1234 status
= pLsaQueryInformationPolicy(handle
, PolicyAccountDomainInformation
, (PVOID
*)&info
);
1235 ok(status
== STATUS_SUCCESS
, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status
);
1236 if (status
== STATUS_SUCCESS
)
1238 ok(info
->DomainSid
!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
1239 if (info
->DomainSid
)
1241 int count
= *GetSidSubAuthorityCount(info
->DomainSid
);
1242 CopySid(GetSidLengthRequired(count
), &max_sid
, info
->DomainSid
);
1243 test_sid_str((PSID
)&max_sid
.sid
);
1244 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_USER_RID_ADMIN
;
1245 max_sid
.sid
.SubAuthorityCount
= count
+ 1;
1246 test_sid_str((PSID
)&max_sid
.sid
);
1247 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_USER_RID_GUEST
;
1248 test_sid_str((PSID
)&max_sid
.sid
);
1249 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_ADMINS
;
1250 test_sid_str((PSID
)&max_sid
.sid
);
1251 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_USERS
;
1252 test_sid_str((PSID
)&max_sid
.sid
);
1253 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_GUESTS
;
1254 test_sid_str((PSID
)&max_sid
.sid
);
1255 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_COMPUTERS
;
1256 test_sid_str((PSID
)&max_sid
.sid
);
1257 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_CONTROLLERS
;
1258 test_sid_str((PSID
)&max_sid
.sid
);
1259 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_CERT_ADMINS
;
1260 test_sid_str((PSID
)&max_sid
.sid
);
1261 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_SCHEMA_ADMINS
;
1262 test_sid_str((PSID
)&max_sid
.sid
);
1263 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS
;
1264 test_sid_str((PSID
)&max_sid
.sid
);
1265 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_POLICY_ADMINS
;
1266 test_sid_str((PSID
)&max_sid
.sid
);
1267 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_ALIAS_RID_RAS_SERVERS
;
1268 test_sid_str((PSID
)&max_sid
.sid
);
1269 max_sid
.sid
.SubAuthority
[count
] = 1000; /* first user account */
1270 test_sid_str((PSID
)&max_sid
.sid
);
1273 pLsaFreeMemory((LPVOID
)info
);
1276 status
= pLsaClose(handle
);
1277 ok(status
== STATUS_SUCCESS
, "LsaClose() failed, returned 0x%08x\n", status
);
1283 static void get_sid_info(PSID psid
, LPSTR
*user
, LPSTR
*dom
)
1285 static CHAR account
[UNLEN
+ 1];
1286 static CHAR domain
[UNLEN
+ 1];
1287 DWORD size
, dom_size
;
1293 size
= dom_size
= UNLEN
+ 1;
1296 LookupAccountSidA(NULL
, psid
, account
, &size
, domain
, &dom_size
, &use
);
1299 static void test_LookupAccountName(void)
1301 DWORD sid_size
, domain_size
, user_size
;
1302 DWORD sid_save
, domain_save
;
1303 CHAR user_name
[UNLEN
+ 1];
1304 SID_NAME_USE sid_use
;
1305 LPSTR domain
, account
, sid_dom
;
1309 /* native crashes if (assuming all other parameters correct):
1311 * - Sid is NULL and cbSid is > 0
1312 * - cbSid or cchReferencedDomainName are NULL
1313 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
1316 user_size
= UNLEN
+ 1;
1317 SetLastError(0xdeadbeef);
1318 ret
= GetUserNameA(user_name
, &user_size
);
1319 if (!ret
&& (GetLastError() == ERROR_NOT_LOGGED_ON
))
1321 /* Probably on win9x where the user used 'Cancel' instead of properly logging in */
1322 skip("Cannot get the user name (win9x and not logged in properly)\n");
1325 ok(ret
, "Failed to get user name : %d\n", GetLastError());
1330 sid_use
= 0xcafebabe;
1331 SetLastError(0xdeadbeef);
1332 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1333 if(!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1335 skip("LookupAccountNameA is not implemented\n");
1338 ok(!ret
, "Expected 0, got %d\n", ret
);
1339 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1340 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1341 ok(sid_size
!= 0, "Expected non-zero sid size\n");
1342 ok(domain_size
!= 0, "Expected non-zero domain size\n");
1343 ok(sid_use
== 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use
);
1345 sid_save
= sid_size
;
1346 domain_save
= domain_size
;
1348 psid
= HeapAlloc(GetProcessHeap(), 0, sid_size
);
1349 domain
= HeapAlloc(GetProcessHeap(), 0, domain_size
);
1351 /* try valid account name */
1352 ret
= LookupAccountNameA(NULL
, user_name
, psid
, &sid_size
, domain
, &domain_size
, &sid_use
);
1353 get_sid_info(psid
, &account
, &sid_dom
);
1354 ok(ret
, "Failed to lookup account name\n");
1355 ok(sid_size
== GetLengthSid(psid
), "Expected %d, got %d\n", GetLengthSid(psid
), sid_size
);
1358 ok(!lstrcmp(account
, user_name
), "Expected %s, got %s\n", user_name
, account
);
1359 ok(!lstrcmp(domain
, sid_dom
), "Expected %s, got %s\n", sid_dom
, domain
);
1360 ok(domain_size
== domain_save
- 1, "Expected %d, got %d\n", domain_save
- 1, domain_size
);
1361 ok(lstrlen(domain
) == domain_size
, "Expected %d\n", lstrlen(domain
));
1362 ok(sid_use
== SidTypeUser
, "Expected SidTypeUser, got %d\n", SidTypeUser
);
1364 domain_size
= domain_save
;
1366 /* NULL Sid with zero sid size */
1367 SetLastError(0xdeadbeef);
1369 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, domain
, &domain_size
, &sid_use
);
1370 ok(!ret
, "Expected 0, got %d\n", ret
);
1371 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1372 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1373 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1374 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1376 /* try cchReferencedDomainName - 1 */
1377 SetLastError(0xdeadbeef);
1379 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, domain
, &domain_size
, &sid_use
);
1380 ok(!ret
, "Expected 0, got %d\n", ret
);
1381 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1382 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1383 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1384 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1386 /* NULL ReferencedDomainName with zero domain name size */
1387 SetLastError(0xdeadbeef);
1389 ret
= LookupAccountNameA(NULL
, user_name
, psid
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1390 ok(!ret
, "Expected 0, got %d\n", ret
);
1391 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1392 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1393 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1394 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1396 HeapFree(GetProcessHeap(), 0, psid
);
1397 HeapFree(GetProcessHeap(), 0, domain
);
1399 /* get sizes for NULL account name */
1402 sid_use
= 0xcafebabe;
1403 SetLastError(0xdeadbeef);
1404 ret
= LookupAccountNameA(NULL
, NULL
, NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1405 ok(!ret
, "Expected 0, got %d\n", ret
);
1406 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1407 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1408 ok(sid_size
!= 0, "Expected non-zero sid size\n");
1409 ok(domain_size
!= 0, "Expected non-zero domain size\n");
1410 ok(sid_use
== 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use
);
1412 psid
= HeapAlloc(GetProcessHeap(), 0, sid_size
);
1413 domain
= HeapAlloc(GetProcessHeap(), 0, domain_size
);
1415 /* try NULL account name */
1416 ret
= LookupAccountNameA(NULL
, NULL
, psid
, &sid_size
, domain
, &domain_size
, &sid_use
);
1417 get_sid_info(psid
, &account
, &sid_dom
);
1418 ok(ret
, "Failed to lookup account name\n");
1421 /* Using a fixed string will not work on different locales */
1422 ok(!lstrcmp(account
, domain
),
1423 "Got %s for account and %s for domain, these should be the same\n",
1425 ok(sid_use
== SidTypeDomain
, "Expected SidTypeDomain, got %d\n", SidTypeDomain
);
1428 /* try an invalid account name */
1429 SetLastError(0xdeadbeef);
1432 ret
= LookupAccountNameA(NULL
, "oogabooga", NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1433 ok(!ret
, "Expected 0, got %d\n", ret
);
1436 ok(GetLastError() == ERROR_NONE_MAPPED
,
1437 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
1438 ok(sid_size
== 0, "Expected 0, got %d\n", sid_size
);
1439 ok(domain_size
== 0, "Expected 0, got %d\n", domain_size
);
1442 HeapFree(GetProcessHeap(), 0, psid
);
1443 HeapFree(GetProcessHeap(), 0, domain
);
1446 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,__LINE__)
1447 static void test_granted_access(HANDLE handle
, ACCESS_MASK access
, int line
)
1449 OBJECT_BASIC_INFORMATION obj_info
;
1452 if (!pNtQueryObject
)
1454 skip_(__FILE__
, line
)("Not NT platform - skipping tests\n");
1458 status
= pNtQueryObject( handle
, ObjectBasicInformation
, &obj_info
,
1459 sizeof(obj_info
), NULL
);
1460 ok_(__FILE__
, line
)(!status
, "NtQueryObject with err: %08x\n", status
);
1461 ok_(__FILE__
, line
)(obj_info
.GrantedAccess
== access
, "Granted access should "
1462 "be 0x%08x, instead of 0x%08x\n", access
, obj_info
.GrantedAccess
);
1465 #define CHECK_SET_SECURITY(o,i,e) \
1469 SetLastError( 0xdeadbeef ); \
1470 res = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
1471 err = GetLastError(); \
1472 if (e == ERROR_SUCCESS) \
1473 ok(res, "SetKernelObjectSecurity failed with %d\n", err); \
1475 ok(!res && err == e, "SetKernelObjectSecurity should have failed " \
1476 "with %s, instead of %d\n", #e, err); \
1479 static void test_process_security(void)
1482 char owner
[32], group
[32];
1483 PSID AdminSid
= NULL
, UsersSid
= NULL
;
1485 SECURITY_DESCRIPTOR
*SecurityDescriptor
= NULL
;
1486 char buffer
[MAX_PATH
];
1487 PROCESS_INFORMATION info
;
1488 STARTUPINFOA startup
;
1489 SECURITY_ATTRIBUTES psa
;
1490 HANDLE token
, event
;
1493 Acl
= HeapAlloc(GetProcessHeap(), 0, 256);
1494 res
= InitializeAcl(Acl
, 256, ACL_REVISION
);
1495 if (!res
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
1497 skip("ACLs not implemented - skipping tests\n");
1500 ok(res
, "InitializeAcl failed with error %d\n", GetLastError());
1502 /* get owner from the token we might be running as a user not admin */
1503 res
= OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED
, &token
);
1504 ok(res
, "OpenProcessToken failed with error %d\n", GetLastError());
1507 res
= GetTokenInformation( token
, TokenOwner
, owner
, sizeof(owner
), &tmp
);
1508 ok(res
, "GetTokenInformation failed with error %d\n", GetLastError());
1509 AdminSid
= ((TOKEN_OWNER
*)owner
)->Owner
;
1510 res
= GetTokenInformation( token
, TokenPrimaryGroup
, group
, sizeof(group
), &tmp
);
1511 ok(res
, "GetTokenInformation failed with error %d\n", GetLastError());
1512 UsersSid
= ((TOKEN_PRIMARY_GROUP
*)group
)->PrimaryGroup
;
1514 CloseHandle( token
);
1517 res
= AddAccessDeniedAce(Acl
, ACL_REVISION
, PROCESS_VM_READ
, AdminSid
);
1518 ok(res
, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1519 res
= AddAccessAllowedAce(Acl
, ACL_REVISION
, PROCESS_ALL_ACCESS
, AdminSid
);
1520 ok(res
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1522 SecurityDescriptor
= HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH
);
1523 res
= InitializeSecurityDescriptor(SecurityDescriptor
, SECURITY_DESCRIPTOR_REVISION
);
1524 ok(res
, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1526 event
= CreateEvent( NULL
, TRUE
, TRUE
, "test_event" );
1527 ok(event
!= NULL
, "CreateEvent %d\n", GetLastError());
1529 SecurityDescriptor
->Revision
= 0;
1530 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_UNKNOWN_REVISION
);
1531 SecurityDescriptor
->Revision
= SECURITY_DESCRIPTOR_REVISION
;
1533 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_INVALID_SECURITY_DESCR
);
1534 CHECK_SET_SECURITY( event
, GROUP_SECURITY_INFORMATION
, ERROR_INVALID_SECURITY_DESCR
);
1535 CHECK_SET_SECURITY( event
, SACL_SECURITY_INFORMATION
, ERROR_ACCESS_DENIED
);
1536 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1537 /* NULL DACL is valid and means default DACL from token */
1538 SecurityDescriptor
->Control
|= SE_DACL_PRESENT
;
1539 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1541 /* Set owner and group and dacl */
1542 res
= SetSecurityDescriptorOwner(SecurityDescriptor
, AdminSid
, FALSE
);
1543 ok(res
, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1544 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1545 res
= SetSecurityDescriptorGroup(SecurityDescriptor
, UsersSid
, FALSE
);
1546 ok(res
, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1547 CHECK_SET_SECURITY( event
, GROUP_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1548 res
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
1549 ok(res
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1550 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1552 sprintf(buffer
, "%s tests/security.c test", myARGV
[0]);
1553 memset(&startup
, 0, sizeof(startup
));
1554 startup
.cb
= sizeof(startup
);
1555 startup
.dwFlags
= STARTF_USESHOWWINDOW
;
1556 startup
.wShowWindow
= SW_SHOWNORMAL
;
1558 psa
.nLength
= sizeof(psa
);
1559 psa
.lpSecurityDescriptor
= SecurityDescriptor
;
1560 psa
.bInheritHandle
= TRUE
;
1562 /* Doesn't matter what ACL say we should get full access for ourselves */
1563 ok(CreateProcessA( NULL
, buffer
, &psa
, NULL
, FALSE
, 0, NULL
, NULL
, &startup
, &info
),
1564 "CreateProcess with err:%d\n", GetLastError());
1565 TEST_GRANTED_ACCESS( info
.hProcess
, PROCESS_ALL_ACCESS
);
1566 ok(WaitForSingleObject(info
.hProcess
, 30000) == WAIT_OBJECT_0
, "Child process termination\n");
1568 CloseHandle( event
);
1569 HeapFree(GetProcessHeap(), 0, Acl
);
1570 HeapFree(GetProcessHeap(), 0, SecurityDescriptor
);
1573 static void test_process_security_child(void)
1575 HANDLE handle
, handle1
;
1579 handle
= OpenProcess( PROCESS_TERMINATE
, FALSE
, GetCurrentProcessId() );
1580 ok(handle
!= NULL
, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
1581 TEST_GRANTED_ACCESS( handle
, PROCESS_TERMINATE
);
1583 ok(DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1584 &handle1
, 0, TRUE
, DUPLICATE_SAME_ACCESS
),
1585 "duplicating handle err:%d\n", GetLastError());
1586 TEST_GRANTED_ACCESS( handle1
, PROCESS_TERMINATE
);
1588 CloseHandle( handle1
);
1590 SetLastError( 0xdeadbeef );
1591 ret
= DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1592 &handle1
, PROCESS_ALL_ACCESS
, TRUE
, 0 );
1593 err
= GetLastError();
1595 ok(!ret
&& err
== ERROR_ACCESS_DENIED
, "duplicating handle should have failed "
1596 "with STATUS_ACCESS_DENIED, instead of err:%d\n", err
);
1598 CloseHandle( handle
);
1600 /* These two should fail - they are denied by ACL */
1601 handle
= OpenProcess( PROCESS_VM_READ
, FALSE
, GetCurrentProcessId() );
1603 ok(handle
== NULL
, "OpenProcess(PROCESS_VM_READ) should have failed\n");
1604 handle
= OpenProcess( PROCESS_ALL_ACCESS
, FALSE
, GetCurrentProcessId() );
1606 ok(handle
== NULL
, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
1608 /* Documented privilege elevation */
1609 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1610 &handle
, 0, TRUE
, DUPLICATE_SAME_ACCESS
),
1611 "duplicating handle err:%d\n", GetLastError());
1612 TEST_GRANTED_ACCESS( handle
, PROCESS_ALL_ACCESS
);
1614 CloseHandle( handle
);
1616 /* Same only explicitly asking for all access rights */
1617 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1618 &handle
, PROCESS_ALL_ACCESS
, TRUE
, 0 ),
1619 "duplicating handle err:%d\n", GetLastError());
1620 TEST_GRANTED_ACCESS( handle
, PROCESS_ALL_ACCESS
);
1621 ok(DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1622 &handle1
, PROCESS_VM_READ
, TRUE
, 0 ),
1623 "duplicating handle err:%d\n", GetLastError());
1624 TEST_GRANTED_ACCESS( handle1
, PROCESS_VM_READ
);
1625 CloseHandle( handle1
);
1626 CloseHandle( handle
);
1629 static void test_impersonation_level(void)
1631 HANDLE Token
, ProcessToken
;
1634 TOKEN_PRIVILEGES
*Privileges
;
1636 PRIVILEGE_SET
*PrivilegeSet
;
1642 pDuplicateTokenEx
= (fnDuplicateTokenEx
) GetProcAddress(hmod
, "DuplicateTokenEx");
1643 if( !pDuplicateTokenEx
) {
1644 skip("DuplicateTokenEx is not available\n");
1647 SetLastError(0xdeadbeef);
1648 ret
= ImpersonateSelf(SecurityAnonymous
);
1649 if(!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1651 skip("ImpersonateSelf is not implemented\n");
1654 ok(ret
, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
1655 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1656 ok(!ret
, "OpenThreadToken should have failed\n");
1657 error
= GetLastError();
1658 ok(error
== ERROR_CANT_OPEN_ANONYMOUS
, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error
);
1659 /* can't perform access check when opening object against an anonymous impersonation token */
1661 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1662 ok(error
== ERROR_INVALID_HANDLE
, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error
);
1666 ret
= OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE
, &ProcessToken
);
1667 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
1669 ret
= pDuplicateTokenEx(ProcessToken
,
1670 TOKEN_QUERY
| TOKEN_DUPLICATE
| TOKEN_IMPERSONATE
, NULL
,
1671 SecurityAnonymous
, TokenImpersonation
, &Token
);
1672 ok(ret
, "DuplicateTokenEx failed with error %d\n", GetLastError());
1673 /* can't increase the impersonation level */
1674 ret
= DuplicateToken(Token
, SecurityIdentification
, &Token2
);
1675 error
= GetLastError();
1676 ok(!ret
&& error
== ERROR_BAD_IMPERSONATION_LEVEL
,
1677 "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error
);
1678 /* we can query anything from an anonymous token, including the user */
1679 ret
= GetTokenInformation(Token
, TokenUser
, NULL
, 0, &Size
);
1680 error
= GetLastError();
1681 ok(!ret
&& error
== ERROR_INSUFFICIENT_BUFFER
, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error
);
1682 User
= (TOKEN_USER
*)HeapAlloc(GetProcessHeap(), 0, Size
);
1683 ret
= GetTokenInformation(Token
, TokenUser
, User
, Size
, &Size
);
1684 ok(ret
, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1685 HeapFree(GetProcessHeap(), 0, User
);
1687 /* PrivilegeCheck fails with SecurityAnonymous level */
1688 ret
= GetTokenInformation(Token
, TokenPrivileges
, NULL
, 0, &Size
);
1689 error
= GetLastError();
1690 ok(!ret
&& error
== ERROR_INSUFFICIENT_BUFFER
, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error
);
1691 Privileges
= (TOKEN_PRIVILEGES
*)HeapAlloc(GetProcessHeap(), 0, Size
);
1692 ret
= GetTokenInformation(Token
, TokenPrivileges
, Privileges
, Size
, &Size
);
1693 ok(ret
, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1695 PrivilegeSet
= (PRIVILEGE_SET
*)HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET
, Privilege
[Privileges
->PrivilegeCount
]));
1696 PrivilegeSet
->PrivilegeCount
= Privileges
->PrivilegeCount
;
1697 memcpy(PrivilegeSet
->Privilege
, Privileges
->Privileges
, PrivilegeSet
->PrivilegeCount
* sizeof(PrivilegeSet
->Privilege
[0]));
1698 PrivilegeSet
->Control
= PRIVILEGE_SET_ALL_NECESSARY
;
1699 HeapFree(GetProcessHeap(), 0, Privileges
);
1701 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1702 error
= GetLastError();
1703 ok(!ret
&& error
== ERROR_BAD_IMPERSONATION_LEVEL
, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error
);
1707 ret
= ImpersonateSelf(SecurityIdentification
);
1708 ok(ret
, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
1709 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1710 ok(ret
, "OpenThreadToken failed with error %d\n", GetLastError());
1712 /* can't perform access check when opening object against an identification impersonation token */
1713 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1715 ok(error
== ERROR_INVALID_HANDLE
, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error
);
1717 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1718 ok(ret
, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
1722 ret
= ImpersonateSelf(SecurityImpersonation
);
1723 ok(ret
, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
1724 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1725 ok(ret
, "OpenThreadToken failed with error %d\n", GetLastError());
1726 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1727 ok(error
== ERROR_SUCCESS
, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error
);
1729 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1730 ok(ret
, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
1734 CloseHandle(ProcessToken
);
1736 HeapFree(GetProcessHeap(), 0, PrivilegeSet
);
1739 static void test_SetEntriesInAcl(void)
1741 ACL
*acl
= (ACL
*)0xdeadbeef;
1744 if (!pSetEntriesInAclW
)
1746 skip("SetEntriesInAclW is not available\n");
1750 res
= pSetEntriesInAclW(0, NULL
, NULL
, &acl
);
1751 if(res
== ERROR_CALL_NOT_IMPLEMENTED
)
1753 skip("SetEntriesInAclW is not implemented\n");
1756 ok(res
== ERROR_SUCCESS
, "SetEntriesInAclW failed: %u\n", res
);
1757 ok(acl
== NULL
, "acl=%p, expected NULL\n", acl
);
1760 static void test_GetNamedSecurityInfoA(void)
1762 PSECURITY_DESCRIPTOR pSecDesc
;
1764 SECURITY_DESCRIPTOR_CONTROL control
;
1767 BOOL owner_defaulted
;
1768 BOOL group_defaulted
;
1771 CHAR windows_dir
[MAX_PATH
];
1773 if (!pGetNamedSecurityInfoA
)
1775 skip("GetNamedSecurityInfoA is not available\n");
1779 ret
= GetWindowsDirectoryA(windows_dir
, MAX_PATH
);
1780 ok(ret
, "GetWindowsDirectory failed with error %d\n", GetLastError());
1782 SetLastError(0xdeadbeef);
1783 error
= pGetNamedSecurityInfoA(windows_dir
, SE_FILE_OBJECT
,
1784 OWNER_SECURITY_INFORMATION
|GROUP_SECURITY_INFORMATION
|DACL_SECURITY_INFORMATION
,
1785 NULL
, NULL
, NULL
, NULL
, &pSecDesc
);
1786 if (error
!= ERROR_SUCCESS
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1788 skip("GetNamedSecurityInfoA is not implemented\n");
1791 ok(!error
, "GetNamedSecurityInfo failed with error %d\n", error
);
1793 ret
= GetSecurityDescriptorControl(pSecDesc
, &control
, &revision
);
1794 ok(ret
, "GetSecurityDescriptorControl failed with error %d\n", GetLastError());
1795 ok((control
& (SE_SELF_RELATIVE
|SE_DACL_PRESENT
)) == (SE_SELF_RELATIVE
|SE_DACL_PRESENT
),
1796 "control (0x%x) doesn't have (SE_SELF_RELATIVE|SE_DACL_PRESENT) flags set\n", control
);
1797 ok(revision
== SECURITY_DESCRIPTOR_REVISION1
, "revision was %d instead of 1\n", revision
);
1798 ret
= GetSecurityDescriptorOwner(pSecDesc
, &owner
, &owner_defaulted
);
1799 ok(ret
, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1800 ok(owner
!= NULL
, "owner should not be NULL\n");
1801 ret
= GetSecurityDescriptorGroup(pSecDesc
, &group
, &group_defaulted
);
1802 ok(ret
, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1803 ok(group
!= NULL
, "group should not be NULL\n");
1806 static void test_ConvertStringSecurityDescriptor(void)
1809 PSECURITY_DESCRIPTOR pSD
;
1811 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA
)
1813 skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
1817 SetLastError(0xdeadbeef);
1818 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1819 "D:(A;;GA;;;WD)", 0xdeadbeef, &pSD
, NULL
);
1820 ok(!ret
&& GetLastError() == ERROR_UNKNOWN_REVISION
,
1821 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_UNKNOWN_REVISION instead of %d\n",
1824 /* test ACE string type */
1825 SetLastError(0xdeadbeef);
1826 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1827 "D:(A;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1828 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1831 SetLastError(0xdeadbeef);
1832 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1833 "D:(D;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1834 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1837 SetLastError(0xdeadbeef);
1838 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1839 "ERROR:(D;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1840 ok(!ret
&& GetLastError() == ERROR_INVALID_PARAMETER
,
1841 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
1844 /* test ACE string access rights */
1845 SetLastError(0xdeadbeef);
1846 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1847 "D:(A;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1848 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1850 SetLastError(0xdeadbeef);
1851 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1852 "D:(A;;GRGWGX;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1853 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1855 SetLastError(0xdeadbeef);
1856 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1857 "D:(A;;RCSDWDWO;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1858 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1860 SetLastError(0xdeadbeef);
1861 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1862 "D:(A;;RPWPCCDCLCSWLODTCR;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1863 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1865 SetLastError(0xdeadbeef);
1866 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1867 "D:(A;;FAFRFWFX;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1868 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1870 SetLastError(0xdeadbeef);
1871 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1872 "D:(A;;KAKRKWKX;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1873 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1875 SetLastError(0xdeadbeef);
1876 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1877 "D:(A;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1878 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1881 /* test ACE string access right error case */
1882 SetLastError(0xdeadbeef);
1883 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1884 "D:(A;;ROB;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
1886 ok(!ret
&& GetLastError() == ERROR_INVALID_ACL
,
1887 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_ACL instead of %d\n",
1890 /* test ACE string SID */
1891 SetLastError(0xdeadbeef);
1892 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1893 "D:(D;;GA;;;S-1-0-0)", SDDL_REVISION_1
, &pSD
, NULL
);
1894 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1897 SetLastError(0xdeadbeef);
1898 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
1899 "D:(D;;GA;;;Nonexistent account)", SDDL_REVISION_1
, &pSD
, NULL
);
1901 ok(!ret
&& GetLastError() == ERROR_INVALID_ACL
,
1902 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_ACL instead of %d\n",
1906 static void test_ConvertSecurityDescriptorToString()
1908 SECURITY_DESCRIPTOR desc
;
1909 SECURITY_INFORMATION sec_info
= OWNER_SECURITY_INFORMATION
|GROUP_SECURITY_INFORMATION
|DACL_SECURITY_INFORMATION
|SACL_SECURITY_INFORMATION
;
1918 if (!pConvertSecurityDescriptorToStringSecurityDescriptorA
)
1920 skip("ConvertSecurityDescriptorToStringSecurityDescriptor is not available\n");
1924 /* It seems Windows XP add an extra character to the length of the string for each ACE in an ACL. We
1925 * don't replicate this feature so we only test len >= strlen+1. */
1926 #define CHECK_RESULT_AND_FREE(exp_str) \
1927 ok(strcmp(string, (exp_str)) == 0, "String mismatch (expected \"%s\", got \"%s\")\n", (exp_str), string); \
1928 ok(len >= (strlen(exp_str) + 1), "Length mismatch (expected %d, got %d)\n", strlen(exp_str) + 1, len); \
1931 InitializeSecurityDescriptor(&desc
, SECURITY_DESCRIPTOR_REVISION
);
1932 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1933 CHECK_RESULT_AND_FREE("");
1936 CreateWellKnownSid(WinLocalSid
, NULL
, sid_buf
, &size
);
1937 SetSecurityDescriptorOwner(&desc
, (PSID
)sid_buf
, FALSE
);
1938 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1939 CHECK_RESULT_AND_FREE("O:S-1-2-0");
1941 SetSecurityDescriptorOwner(&desc
, (PSID
)sid_buf
, TRUE
);
1942 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1943 CHECK_RESULT_AND_FREE("O:S-1-2-0");
1945 size
= sizeof(sid_buf
);
1946 CreateWellKnownSid(WinLocalSystemSid
, NULL
, sid_buf
, &size
);
1947 SetSecurityDescriptorOwner(&desc
, (PSID
)sid_buf
, TRUE
);
1948 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1949 CHECK_RESULT_AND_FREE("O:SY");
1951 ConvertStringSidToSid("S-1-5-21-93476-23408-4576", &psid
);
1952 SetSecurityDescriptorGroup(&desc
, psid
, TRUE
);
1953 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1954 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576");
1956 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, GROUP_SECURITY_INFORMATION
, &string
, &len
), "Convertion failed\n");
1957 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
1959 pacl
= (PACL
)acl_buf
;
1960 InitializeAcl(pacl
, sizeof(acl_buf
), ACL_REVISION
);
1961 SetSecurityDescriptorDacl(&desc
, TRUE
, pacl
, TRUE
);
1962 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1963 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
1965 SetSecurityDescriptorDacl(&desc
, TRUE
, pacl
, FALSE
);
1966 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1967 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
1969 ConvertStringSidToSid("S-1-5-6", &psid2
);
1970 AddAccessAllowedAceEx(pacl
, ACL_REVISION
, NO_PROPAGATE_INHERIT_ACE
, 0xf0000000, psid2
);
1971 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1972 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)");
1974 AddAccessAllowedAceEx(pacl
, ACL_REVISION
, INHERIT_ONLY_ACE
|INHERITED_ACE
, 0x00000003, psid2
);
1975 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1976 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)");
1978 AddAccessDeniedAceEx(pacl
, ACL_REVISION
, OBJECT_INHERIT_ACE
|CONTAINER_INHERIT_ACE
, 0xffffffff, psid
);
1979 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1980 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
1983 pacl
= (PACL
)acl_buf
;
1984 InitializeAcl(pacl
, sizeof(acl_buf
), ACL_REVISION
);
1985 SetSecurityDescriptorSacl(&desc
, TRUE
, pacl
, FALSE
);
1986 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1987 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:");
1989 SetSecurityDescriptorDacl(&desc
, TRUE
, NULL
, FALSE
);
1990 AddAuditAccessAceEx(pacl
, ACL_REVISION
, VALID_INHERIT_FLAGS
, KEY_READ
|KEY_WRITE
, psid2
, TRUE
, TRUE
);
1991 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1992 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)");
1994 AddAuditAccessAceEx(pacl
, ACL_REVISION
, NO_PROPAGATE_INHERIT_ACE
, FILE_GENERIC_READ
|FILE_GENERIC_WRITE
, psid2
, TRUE
, FALSE
);
1995 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Convertion failed\n");
1996 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)");
1999 #undef CHECK_RESULT_AND_FREE
2002 START_TEST(security
)
2009 test_process_security_child();
2015 test_FileSecurity();
2018 test_LookupAccountSid();
2019 test_LookupAccountName();
2020 test_process_security();
2021 test_impersonation_level();
2022 test_SetEntriesInAcl();
2023 test_GetNamedSecurityInfoA();
2024 test_ConvertStringSecurityDescriptor();
2025 test_ConvertSecurityDescriptorToString();