server/token.c

   1 /*
   2  * Tokens
   3  *
   4  * Copyright (C) 1998 Alexandre Julliard
   5  * Copyright (C) 2003 Mike McCormack
   6  * Copyright (C) 2005 Robert Shearman
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #include "config.h"
  24
  25 #include <assert.h>
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28 #include <stdarg.h>
  29
  30 #include "ntstatus.h"
  31 #define WIN32_NO_STATUS
  32 #include "windef.h"
  33 #include "winternl.h"
  34
  35 #include "handle.h"
  36 #include "thread.h"
  37 #include "process.h"
  38 #include "request.h"
  39 #include "security.h"
  40
  41 #include "wine/unicode.h"
  42
  43 #define MAX_SUBAUTH_COUNT 1
  44
  45 const LUID SeIncreaseQuotaPrivilege        = {  5, 0 };
  46 const LUID SeSecurityPrivilege             = {  8, 0 };
  47 const LUID SeTakeOwnershipPrivilege        = {  9, 0 };
  48 const LUID SeLoadDriverPrivilege           = { 10, 0 };
  49 const LUID SeSystemProfilePrivilege        = { 11, 0 };
  50 const LUID SeSystemtimePrivilege           = { 12, 0 };
  51 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
  52 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
  53 const LUID SeCreatePagefilePrivilege       = { 15, 0 };
  54 const LUID SeBackupPrivilege               = { 17, 0 };
  55 const LUID SeRestorePrivilege              = { 18, 0 };
  56 const LUID SeShutdownPrivilege             = { 19, 0 };
  57 const LUID SeDebugPrivilege                = { 20, 0 };
  58 const LUID SeSystemEnvironmentPrivilege    = { 22, 0 };
  59 const LUID SeChangeNotifyPrivilege         = { 23, 0 };
  60 const LUID SeRemoteShutdownPrivilege       = { 24, 0 };
  61 const LUID SeUndockPrivilege               = { 25, 0 };
  62 const LUID SeManageVolumePrivilege         = { 28, 0 };
  63 const LUID SeImpersonatePrivilege          = { 29, 0 };
  64 const LUID SeCreateGlobalPrivilege         = { 30, 0 };
  65
  66 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
  67 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
  68 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
  69 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
  70 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
  71 static const PSID security_world_sid = (PSID)&world_sid;
  72 static const PSID security_local_sid = (PSID)&local_sid;
  73 const PSID security_interactive_sid = (PSID)&interactive_sid;
  74 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
  75 static const PSID security_local_system_sid = (PSID)&local_system_sid;
  76
  77 static luid_t prev_luid_value = { 1000, 0 };
  78
  79 struct token
  80 {
  81     struct object  obj;             /* object header */
  82     luid_t         token_id;        /* system-unique id of token */
  83     luid_t         modified_id;     /* new id allocated every time token is modified */
  84     struct list    privileges;      /* privileges available to the token */
  85     struct list    groups;          /* groups that the user of this token belongs to (sid_and_attributes) */
  86     SID           *user;            /* SID of user this token represents */
  87     SID           *primary_group;   /* SID of user's primary group */
  88     unsigned       primary;         /* is this a primary or impersonation token? */
  89     ACL           *default_dacl;    /* the default DACL to assign to objects created by this user */
  90     TOKEN_SOURCE   source;          /* source of the token */
  91     SECURITY_IMPERSONATION_LEVEL impersonation_level; /* impersonation level this token is capable of if non-primary token */
  92 };
  93
  94 struct privilege
  95 {
  96     struct list entry;
  97     LUID        luid;
  98     unsigned    enabled  : 1; /* is the privilege currently enabled? */
  99     unsigned    def      : 1; /* is the privilege enabled by default? */
 100 };
 101
 102 struct group
 103 {
 104     struct list entry;
 105     unsigned    enabled  : 1; /* is the sid currently enabled? */
 106     unsigned    def      : 1; /* is the sid enabled by default? */
 107     unsigned    logon    : 1; /* is this a logon sid? */
 108     unsigned    mandatory: 1; /* is this sid always enabled? */
 109     unsigned    owner    : 1; /* can this sid be an owner of an object? */
 110     unsigned    resource : 1; /* is this a domain-local group? */
 111     unsigned    deny_only: 1; /* is this a sid that should be use for denying only? */
 112     SID         sid;
 113 };
 114
 115 static void token_dump( struct object *obj, int verbose );
 116 static unsigned int token_map_access( struct object *obj, unsigned int access );
 117 static void token_destroy( struct object *obj );
 118
 119 static const struct object_ops token_ops =
 120 {
 121     sizeof(struct token),      /* size */
 122     token_dump,                /* dump */
 123     no_add_queue,              /* add_queue */
 124     NULL,                      /* remove_queue */
 125     NULL,                      /* signaled */
 126     NULL,                      /* satisfied */
 127     no_signal,                 /* signal */
 128     no_get_fd,                 /* get_fd */
 129     token_map_access,          /* map_access */
 130     no_lookup_name,            /* lookup_name */
 131     no_close_handle,           /* close_handle */
 132     token_destroy              /* destroy */
 133 };
 134
 135
 136 static void token_dump( struct object *obj, int verbose )
 137 {
 138     fprintf( stderr, "Security token\n" );
 139     /* FIXME: dump token members */
 140 }
 141
 142 static unsigned int token_map_access( struct object *obj, unsigned int access )
 143 {
 144     if (access & GENERIC_READ)    access |= TOKEN_READ;
 145     if (access & GENERIC_WRITE)   access |= TOKEN_WRITE;
 146     if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
 147     if (access & GENERIC_ALL)     access |= TOKEN_ALL_ACCESS;
 148     return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
 149 }
 150
 151 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
 152 {
 153     int i;
 154     SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
 155     if (!sid) return NULL;
 156     sid->Revision = SID_REVISION;
 157     sid->SubAuthorityCount = subauthcount;
 158     sid->IdentifierAuthority = *idauthority;
 159     for (i = 0; i < subauthcount; i++)
 160         sid->SubAuthority[i] = subauth[i];
 161     return sid;
 162 }
 163
 164 static inline int security_equal_sid( const SID *sid1, const SID *sid2 )
 165 {
 166     return ((sid1->SubAuthorityCount == sid2->SubAuthorityCount) &&
 167         !memcmp( sid1, sid2, FIELD_OFFSET(SID, SubAuthority[sid1->SubAuthorityCount]) ));
 168 }
 169
 170 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
 171 {
 172     if (!handle)
 173     {
 174         if (thread->token)
 175             release_object( thread->token );
 176         thread->token = NULL;
 177     }
 178     else
 179     {
 180         struct token *token = (struct token *)get_handle_obj( current->process,
 181                                                               handle,
 182                                                               TOKEN_IMPERSONATE,
 183                                                               &token_ops );
 184         if (token)
 185         {
 186             if (thread->token)
 187                 release_object( thread->token );
 188             thread->token = token;
 189         }
 190     }
 191 }
 192
 193 static const ACE_HEADER *ace_next( const ACE_HEADER *ace )
 194 {
 195     return (const ACE_HEADER *)((const char *)ace + ace->AceSize);
 196 }
 197
 198 static int acl_is_valid( const ACL *acl, data_size_t size )
 199 {
 200     ULONG i;
 201     const ACE_HEADER *ace;
 202
 203     if (size < sizeof(ACL))
 204         return FALSE;
 205
 206     size = min(size, MAX_ACL_LEN);
 207
 208     size -= sizeof(ACL);
 209
 210     ace = (const ACE_HEADER *)(acl + 1);
 211     for (i = 0; i < acl->AceCount; i++)
 212     {
 213         const SID *sid;
 214         data_size_t sid_size;
 215
 216         if (size < sizeof(ACE_HEADER))
 217             return FALSE;
 218         if (size < ace->AceSize)
 219             return FALSE;
 220         size -= ace->AceSize;
 221         switch (ace->AceType)
 222         {
 223         case ACCESS_DENIED_ACE_TYPE:
 224             sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
 225             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
 226             break;
 227         case ACCESS_ALLOWED_ACE_TYPE:
 228             sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
 229             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
 230             break;
 231         case SYSTEM_AUDIT_ACE_TYPE:
 232             sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
 233             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
 234             break;
 235         case SYSTEM_ALARM_ACE_TYPE:
 236             sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
 237             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
 238             break;
 239         default:
 240             return FALSE;
 241         }
 242         if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) ||
 243             sid_size < FIELD_OFFSET(SID, SubAuthority[sid->SubAuthorityCount]))
 244             return FALSE;
 245         ace = ace_next( ace );
 246     }
 247     return TRUE;
 248 }
 249
 250 /* gets the discretionary access control list from a security descriptor */
 251 static inline const ACL *sd_get_dacl( const struct security_descriptor *sd, int *present )
 252 {
 253     *present = (sd->control & SE_DACL_PRESENT ? TRUE : FALSE);
 254
 255     if (sd->dacl_len)
 256         return (const ACL *)((const char *)(sd + 1) +
 257             sd->owner_len + sd->group_len + sd->sacl_len);
 258     else
 259         return NULL;
 260 }
 261
 262 /* gets the system access control list from a security descriptor */
 263 static inline const ACL *sd_get_sacl( const struct security_descriptor *sd, int *present )
 264 {
 265     *present = (sd->control & SE_SACL_PRESENT ? TRUE : FALSE);
 266
 267     if (sd->sacl_len)
 268         return (const ACL *)((const char *)(sd + 1) +
 269             sd->owner_len + sd->group_len);
 270     else
 271         return NULL;
 272 }
 273
 274 /* gets the owner from a security descriptor */
 275 static inline const SID *sd_get_owner( const struct security_descriptor *sd )
 276 {
 277     if (sd->owner_len)
 278         return (const SID *)(sd + 1);
 279     else
 280         return NULL;
 281 }
 282
 283 /* gets the primary group from a security descriptor */
 284 static inline const SID *sd_get_group( const struct security_descriptor *sd )
 285 {
 286     if (sd->group_len)
 287         return (const SID *)((const char *)(sd + 1) + sd->owner_len);
 288     else
 289         return NULL;
 290 }
 291
 292 /* checks whether all members of a security descriptor fit inside the size
 293  * of memory specified */
 294 static int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
 295 {
 296     size_t offset = sizeof(struct security_descriptor);
 297     const SID *group;
 298     const SID *owner;
 299     const ACL *sacl;
 300     const ACL *dacl;
 301     int dummy;
 302
 303     if (size < offset)
 304         return FALSE;
 305
 306     if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 307         (offset + sd->owner_len > size))
 308         return FALSE;
 309     owner = sd_get_owner( sd );
 310     if (owner)
 311     {
 312         size_t needed_size = FIELD_OFFSET(SID, SubAuthority[owner->SubAuthorityCount]);
 313         if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
 314             return FALSE;
 315     }
 316     offset += sd->owner_len;
 317
 318     if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 319         (offset + sd->group_len > size))
 320         return FALSE;
 321     group = sd_get_group( sd );
 322     if (group)
 323     {
 324         size_t needed_size = FIELD_OFFSET(SID, SubAuthority[group->SubAuthorityCount]);
 325         if ((sd->group_len < sizeof(SID)) || (needed_size > sd->group_len))
 326             return FALSE;
 327     }
 328     offset += sd->group_len;
 329
 330     if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
 331         return FALSE;
 332     sacl = sd_get_sacl( sd, &dummy );
 333     if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
 334         return FALSE;
 335     offset += sd->sacl_len;
 336
 337     if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
 338         return FALSE;
 339     dacl = sd_get_dacl( sd, &dummy );
 340     if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
 341         return FALSE;
 342     offset += sd->dacl_len;
 343
 344     return TRUE;
 345 }
 346
 347 /* maps from generic rights to specific rights as given by a mapping */
 348 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
 349 {
 350     if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
 351     if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
 352     if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
 353     if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
 354     *mask &= 0x0FFFFFFF;
 355 }
 356
 357 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
 358 {
 359     return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
 360 }
 361
 362 static inline void allocate_luid( luid_t *luid )
 363 {
 364     prev_luid_value.low_part++;
 365     *luid = prev_luid_value;
 366 }
 367
 368 DECL_HANDLER( allocate_locally_unique_id )
 369 {
 370     allocate_luid( &reply->luid );
 371 }
 372
 373 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
 374 {
 375     out->Luid = in->luid;
 376     out->Attributes =
 377         (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
 378         (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
 379 }
 380
 381 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
 382 {
 383     struct privilege *privilege = mem_alloc( sizeof(*privilege) );
 384     if (privilege)
 385     {
 386         privilege->luid = *luid;
 387         privilege->def = privilege->enabled = (enabled != 0);
 388         list_add_tail( &token->privileges, &privilege->entry );
 389     }
 390     return privilege;
 391 }
 392
 393 static inline void privilege_remove( struct privilege *privilege )
 394 {
 395     list_remove( &privilege->entry );
 396     free( privilege );
 397 }
 398
 399 static void token_destroy( struct object *obj )
 400 {
 401     struct token* token;
 402     struct list *cursor, *cursor_next;
 403
 404     assert( obj->ops == &token_ops );
 405     token = (struct token *)obj;
 406
 407     free( token->user );
 408
 409     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
 410     {
 411         struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
 412         privilege_remove( privilege );
 413     }
 414
 415     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
 416     {
 417         struct group *group = LIST_ENTRY( cursor, struct group, entry );
 418         list_remove( &group->entry );
 419         free( group );
 420     }
 421
 422     free( token->default_dacl );
 423 }
 424
 425 /* creates a new token.
 426  *  groups may be NULL if group_count is 0.
 427  *  privs may be NULL if priv_count is 0.
 428  *  default_dacl may be NULL, indicating that all objects created by the user
 429  *   are unsecured.
 430  *  modified_id may be NULL, indicating that a new modified_id luid should be
 431  *   allocated.
 432  */
 433 static struct token *create_token( unsigned primary, const SID *user,
 434                                    const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
 435                                    const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
 436                                    const ACL *default_dacl, TOKEN_SOURCE source,
 437                                    const luid_t *modified_id,
 438                                    SECURITY_IMPERSONATION_LEVEL impersonation_level )
 439 {
 440     struct token *token = alloc_object( &token_ops );
 441     if (token)
 442     {
 443         unsigned int i;
 444
 445         allocate_luid( &token->token_id );
 446         if (modified_id)
 447             token->modified_id = *modified_id;
 448         else
 449             allocate_luid( &token->modified_id );
 450         list_init( &token->privileges );
 451         list_init( &token->groups );
 452         token->primary = primary;
 453         /* primary tokens don't have impersonation levels */
 454         if (primary)
 455             token->impersonation_level = -1;
 456         else
 457             token->impersonation_level = impersonation_level;
 458         token->default_dacl = NULL;
 459         token->primary_group = NULL;
 460
 461         /* copy user */
 462         token->user = memdup( user, FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]) );
 463         if (!token->user)
 464         {
 465             release_object( token );
 466             return NULL;
 467         }
 468
 469         /* copy groups */
 470         for (i = 0; i < group_count; i++)
 471         {
 472             size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
 473             struct group *group = mem_alloc( size );
 474
 475             if (!group)
 476             {
 477                 release_object( token );
 478                 return NULL;
 479             }
 480             memcpy( &group->sid, groups[i].Sid, FIELD_OFFSET( SID, SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] ) );
 481             group->enabled = TRUE;
 482             group->def = TRUE;
 483             group->logon = FALSE;
 484             group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) ? TRUE : FALSE;
 485             group->owner = groups[i].Attributes & SE_GROUP_OWNER ? TRUE : FALSE;
 486             group->resource = FALSE;
 487             group->deny_only = FALSE;
 488             list_add_tail( &token->groups, &group->entry );
 489             /* Use first owner capable group as an owner */
 490             if (!token->primary_group && group->owner)
 491                 token->primary_group = &group->sid;
 492         }
 493
 494         /* copy privileges */
 495         for (i = 0; i < priv_count; i++)
 496         {
 497             /* note: we don't check uniqueness: the caller must make sure
 498              * privs doesn't contain any duplicate luids */
 499             if (!privilege_add( token, &privs[i].Luid,
 500                                 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
 501             {
 502                 release_object( token );
 503                 return NULL;
 504             }
 505         }
 506
 507         if (default_dacl)
 508         {
 509             token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
 510             if (!token->default_dacl)
 511             {
 512                 release_object( token );
 513                 return NULL;
 514             }
 515         }
 516
 517         token->source = source;
 518     }
 519     return token;
 520 }
 521
 522 static ACL *create_default_dacl( const SID *user )
 523 {
 524     ACCESS_ALLOWED_ACE *aaa;
 525     ACL *default_dacl;
 526     SID *sid;
 527     size_t default_dacl_size = sizeof(ACL) +
 528                                2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 529                                sizeof(local_system_sid) +
 530                                FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]);
 531
 532     default_dacl = mem_alloc( default_dacl_size );
 533     if (!default_dacl) return NULL;
 534
 535     default_dacl->AclRevision = MAX_ACL_REVISION;
 536     default_dacl->Sbz1 = 0;
 537     default_dacl->AclSize = default_dacl_size;
 538     default_dacl->AceCount = 2;
 539     default_dacl->Sbz2 = 0;
 540
 541     /* GENERIC_ALL for Local System */
 542     aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
 543     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 544     aaa->Header.AceFlags = 0;
 545     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 546                           sizeof(local_system_sid);
 547     aaa->Mask = GENERIC_ALL;
 548     sid = (SID *)&aaa->SidStart;
 549     memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
 550
 551     /* GENERIC_ALL for specified user */
 552     aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
 553     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 554     aaa->Header.AceFlags = 0;
 555     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 556                           FIELD_OFFSET( SID, SubAuthority[user->SubAuthorityCount] );
 557     aaa->Mask = GENERIC_ALL;
 558     sid = (SID *)&aaa->SidStart;
 559     memcpy( sid, user, FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]) );
 560
 561     return default_dacl;
 562 }
 563
 564 struct sid_data
 565 {
 566     SID_IDENTIFIER_AUTHORITY idauth;
 567     int count;
 568     unsigned int subauth[MAX_SUBAUTH_COUNT];
 569 };
 570
 571 struct token *token_create_admin( void )
 572 {
 573     struct token *token = NULL;
 574     static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
 575     static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
 576     static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
 577     PSID alias_admins_sid;
 578     PSID alias_users_sid;
 579     /* note: should be the owner specified in the token */
 580     ACL *default_dacl = create_default_dacl( &interactive_sid );
 581
 582     alias_admins_sid = security_sid_alloc( &nt_authority, sizeof(alias_admins_subauth)/sizeof(alias_admins_subauth[0]),
 583                                            alias_admins_subauth );
 584     alias_users_sid = security_sid_alloc( &nt_authority, sizeof(alias_users_subauth)/sizeof(alias_users_subauth[0]),
 585                                           alias_users_subauth );
 586
 587     if (alias_admins_sid && alias_users_sid && default_dacl)
 588     {
 589         const LUID_AND_ATTRIBUTES admin_privs[] =
 590         {
 591             { SeChangeNotifyPrivilege        , SE_PRIVILEGE_ENABLED },
 592             { SeSecurityPrivilege            , 0                    },
 593             { SeBackupPrivilege              , 0                    },
 594             { SeRestorePrivilege             , 0                    },
 595             { SeSystemtimePrivilege          , 0                    },
 596             { SeShutdownPrivilege            , 0                    },
 597             { SeRemoteShutdownPrivilege      , 0                    },
 598             { SeTakeOwnershipPrivilege       , 0                    },
 599             { SeDebugPrivilege               , 0                    },
 600             { SeSystemEnvironmentPrivilege   , 0                    },
 601             { SeSystemProfilePrivilege       , 0                    },
 602             { SeProfileSingleProcessPrivilege, 0                    },
 603             { SeIncreaseBasePriorityPrivilege, 0                    },
 604             { SeLoadDriverPrivilege          , 0                    },
 605             { SeCreatePagefilePrivilege      , 0                    },
 606             { SeIncreaseQuotaPrivilege       , 0                    },
 607             { SeUndockPrivilege              , 0                    },
 608             { SeManageVolumePrivilege        , 0                    },
 609             { SeImpersonatePrivilege         , SE_PRIVILEGE_ENABLED },
 610             { SeCreateGlobalPrivilege        , SE_PRIVILEGE_ENABLED },
 611         };
 612         /* note: we don't include non-builtin groups here for the user -
 613          * telling us these is the job of a client-side program */
 614         const SID_AND_ATTRIBUTES admin_groups[] =
 615         {
 616             { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 617             { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 618             { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 619             { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 620             { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
 621             { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 622         };
 623         static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
 624         /* note: we just set the user sid to be the interactive builtin sid -
 625          * we should really translate the UNIX user id to a sid */
 626         token = create_token( TRUE, &interactive_sid,
 627                             admin_groups, sizeof(admin_groups)/sizeof(admin_groups[0]),
 628                             admin_privs, sizeof(admin_privs)/sizeof(admin_privs[0]),
 629                             default_dacl, admin_source, NULL, -1 );
 630         /* we really need a primary group */
 631         assert( token->primary_group );
 632     }
 633
 634     free( alias_admins_sid );
 635     free( alias_users_sid );
 636     free( default_dacl );
 637
 638     return token;
 639 }
 640
 641 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
 642 {
 643     struct privilege *privilege;
 644     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 645     {
 646         if (is_equal_luid( luid, &privilege->luid ))
 647         {
 648             if (enabled_only && !privilege->enabled)
 649                 return NULL;
 650             return privilege;
 651         }
 652     }
 653     return NULL;
 654 }
 655
 656 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
 657                                              unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
 658                                              unsigned int mod_privs_count )
 659 {
 660     unsigned int i, modified_count = 0;
 661
 662     /* mark as modified */
 663     allocate_luid( &token->modified_id );
 664
 665     for (i = 0; i < count; i++)
 666     {
 667         struct privilege *privilege =
 668             token_find_privilege( token, &privs[i].Luid, FALSE );
 669         if (!privilege)
 670         {
 671             set_error( STATUS_NOT_ALL_ASSIGNED );
 672             continue;
 673         }
 674
 675         if (privs[i].Attributes & SE_PRIVILEGE_REMOVE)
 676             privilege_remove( privilege );
 677         else
 678         {
 679             /* save previous state for caller */
 680             if (mod_privs_count)
 681             {
 682                 luid_and_attr_from_privilege(mod_privs, privilege);
 683                 mod_privs++;
 684                 mod_privs_count--;
 685                 modified_count++;
 686             }
 687
 688             if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
 689                 privilege->enabled = TRUE;
 690             else
 691                 privilege->enabled = FALSE;
 692         }
 693     }
 694     return modified_count;
 695 }
 696
 697 static void token_disable_privileges( struct token *token )
 698 {
 699     struct privilege *privilege;
 700
 701     /* mark as modified */
 702     allocate_luid( &token->modified_id );
 703
 704     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 705         privilege->enabled = FALSE;
 706 }
 707
 708 int token_check_privileges( struct token *token, int all_required,
 709                             const LUID_AND_ATTRIBUTES *reqprivs,
 710                             unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
 711 {
 712     unsigned int i, enabled_count = 0;
 713
 714     for (i = 0; i < count; i++)
 715     {
 716         struct privilege *privilege =
 717             token_find_privilege( token, &reqprivs[i].Luid, TRUE );
 718
 719         if (usedprivs)
 720             usedprivs[i] = reqprivs[i];
 721
 722         if (privilege && privilege->enabled)
 723         {
 724             enabled_count++;
 725             if (usedprivs)
 726                 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
 727         }
 728     }
 729
 730     if (all_required)
 731         return (enabled_count == count);
 732     else
 733         return (enabled_count > 0);
 734 }
 735
 736 static int token_sid_present( struct token *token, const SID *sid, int deny )
 737 {
 738     struct group *group;
 739
 740     if (security_equal_sid( token->user, sid )) return TRUE;
 741
 742     LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
 743     {
 744         if (!group->enabled) continue;
 745         if (group->deny_only && !deny) continue;
 746
 747         if (security_equal_sid( &group->sid, sid )) return TRUE;
 748     }
 749
 750     return FALSE;
 751 }
 752
 753 /* Checks access to a security descriptor. 'sd' must have been validated by
 754  * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
 755  * the reason. 'status' parameter will indicate if access is granted or denied.
 756  *
 757  * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
 758  */
 759 static unsigned int token_access_check( struct token *token,
 760                                  const struct security_descriptor *sd,
 761                                  unsigned int desired_access,
 762                                  LUID_AND_ATTRIBUTES *privs,
 763                                  unsigned int *priv_count,
 764                                  const GENERIC_MAPPING *mapping,
 765                                  unsigned int *granted_access,
 766                                  unsigned int *status )
 767 {
 768     unsigned int current_access = 0;
 769     unsigned int denied_access = 0;
 770     ULONG i;
 771     const ACL *dacl;
 772     int dacl_present;
 773     const ACE_HEADER *ace;
 774     const SID *owner;
 775
 776     /* assume no access rights */
 777     *granted_access = 0;
 778
 779     /* fail if desired_access contains generic rights */
 780     if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
 781     {
 782         *priv_count = 0;
 783         return STATUS_GENERIC_NOT_MAPPED;
 784     }
 785
 786     dacl = sd_get_dacl( sd, &dacl_present );
 787     owner = sd_get_owner( sd );
 788     if (!owner || !sd_get_group( sd ))
 789     {
 790         *priv_count = 0;
 791         return STATUS_INVALID_SECURITY_DESCR;
 792     }
 793
 794     /* 1: Grant desired access if the object is unprotected */
 795     if (!dacl_present)
 796     {
 797         *priv_count = 0;
 798         *granted_access = desired_access;
 799         return *status = STATUS_SUCCESS;
 800     }
 801     if (!dacl)
 802     {
 803         *priv_count = 0;
 804         *status = STATUS_ACCESS_DENIED;
 805         return STATUS_SUCCESS;
 806     }
 807
 808     /* 2: Check if caller wants access to system security part. Note: access
 809      * is only granted if specifically asked for */
 810     if (desired_access & ACCESS_SYSTEM_SECURITY)
 811     {
 812         const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
 813         LUID_AND_ATTRIBUTES retpriv = security_priv;
 814         if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
 815         {
 816             if (priv_count)
 817             {
 818                 /* assumes that there will only be one privilege to return */
 819                 if (*priv_count >= 1)
 820                 {
 821                     *priv_count = 1;
 822                     *privs = retpriv;
 823                 }
 824                 else
 825                 {
 826                     *priv_count = 1;
 827                     return STATUS_BUFFER_TOO_SMALL;
 828                 }
 829             }
 830             current_access |= ACCESS_SYSTEM_SECURITY;
 831             if (desired_access == current_access)
 832             {
 833                 *granted_access = current_access;
 834                 return *status = STATUS_SUCCESS;
 835             }
 836         }
 837         else
 838         {
 839             *priv_count = 0;
 840             *status = STATUS_PRIVILEGE_NOT_HELD;
 841             return STATUS_SUCCESS;
 842         }
 843     }
 844     else if (priv_count) *priv_count = 0;
 845
 846     /* 3: Check whether the token is the owner */
 847     /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
 848      * checked when a "set owner" call is made, overriding the access rights
 849      * determined here. */
 850     if (token_sid_present( token, owner, FALSE ))
 851     {
 852         current_access |= (READ_CONTROL | WRITE_DAC);
 853         if (desired_access == current_access)
 854         {
 855             *granted_access = current_access;
 856             return *status = STATUS_SUCCESS;
 857         }
 858     }
 859
 860     /* 4: Grant rights according to the DACL */
 861     ace = (const ACE_HEADER *)(dacl + 1);
 862     for (i = 0; i < dacl->AceCount; i++)
 863     {
 864         const ACCESS_ALLOWED_ACE *aa_ace;
 865         const ACCESS_DENIED_ACE *ad_ace;
 866         const SID *sid;
 867         switch (ace->AceType)
 868         {
 869         case ACCESS_DENIED_ACE_TYPE:
 870             ad_ace = (const ACCESS_DENIED_ACE *)ace;
 871             sid = (const SID *)&ad_ace->SidStart;
 872             if (token_sid_present( token, sid, TRUE ))
 873             {
 874                 unsigned int access = ad_ace->Mask;
 875                 map_generic_mask(&access, mapping);
 876                 if (desired_access & MAXIMUM_ALLOWED)
 877                     denied_access |= access;
 878                 else
 879                 {
 880                     denied_access |= (access & ~current_access);
 881                     if (desired_access & access) goto done;
 882                 }
 883             }
 884             break;
 885         case ACCESS_ALLOWED_ACE_TYPE:
 886             aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
 887             sid = (const SID *)&aa_ace->SidStart;
 888             if (token_sid_present( token, sid, FALSE ))
 889             {
 890                 unsigned int access = aa_ace->Mask;
 891                 map_generic_mask(&access, mapping);
 892                 if (desired_access & MAXIMUM_ALLOWED)
 893                     current_access |= access;
 894                 else
 895                     current_access |= (access & ~denied_access);
 896             }
 897             break;
 898         }
 899
 900         /* don't bother carrying on checking if we've already got all of
 901             * rights we need */
 902         if (desired_access == *granted_access)
 903             break;
 904
 905         ace = ace_next( ace );
 906     }
 907
 908 done:
 909     if (desired_access & MAXIMUM_ALLOWED)
 910         *granted_access = current_access & ~denied_access;
 911     else
 912         if ((current_access & desired_access) == desired_access)
 913             *granted_access = current_access & desired_access;
 914         else
 915             *granted_access = 0;
 916
 917     *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
 918     return STATUS_SUCCESS;
 919 }
 920
 921 const ACL *token_get_default_dacl( struct token *token )
 922 {
 923     return token->default_dacl;
 924 }
 925
 926 static void set_object_sd( struct object *obj, const struct security_descriptor *sd,
 927                            unsigned int set_info )
 928 {
 929     struct security_descriptor new_sd, *pnew_sd;
 930     int present;
 931     const SID *owner, *group;
 932     const ACL *sacl, *dacl;
 933     char *ptr;
 934
 935     if (!set_info) return;
 936
 937     new_sd.control = sd->control & ~SE_SELF_RELATIVE;
 938
 939     owner = sd_get_owner( sd );
 940     if (set_info & OWNER_SECURITY_INFORMATION && owner)
 941         new_sd.owner_len = sd->owner_len;
 942     else
 943     {
 944         owner = current->process->token->user;
 945         new_sd.owner_len = FIELD_OFFSET(SID, SubAuthority[owner->SubAuthorityCount]);
 946         new_sd.control |= SE_OWNER_DEFAULTED;
 947     }
 948
 949     group = sd_get_group( sd );
 950     if (set_info & GROUP_SECURITY_INFORMATION && group)
 951         new_sd.group_len = sd->group_len;
 952     else
 953     {
 954         group = current->process->token->primary_group;
 955         new_sd.group_len = FIELD_OFFSET(SID, SubAuthority[group->SubAuthorityCount]);
 956         new_sd.control |= SE_GROUP_DEFAULTED;
 957     }
 958
 959     new_sd.control |= SE_SACL_PRESENT;
 960     sacl = sd_get_sacl( sd, &present );
 961     if (set_info & SACL_SECURITY_INFORMATION && present)
 962         new_sd.sacl_len = sd->sacl_len;
 963     else
 964     {
 965         if (obj->sd) sacl = sd_get_sacl( obj->sd, &present );
 966
 967         if (obj->sd && present)
 968             new_sd.sacl_len = obj->sd->sacl_len;
 969         else
 970         {
 971             new_sd.sacl_len = 0;
 972             new_sd.control |= SE_SACL_DEFAULTED;
 973         }
 974     }
 975
 976     new_sd.control |= SE_DACL_PRESENT;
 977     dacl = sd_get_dacl( sd, &present );
 978     if (set_info & DACL_SECURITY_INFORMATION && present)
 979         new_sd.dacl_len = sd->dacl_len;
 980     else
 981     {
 982         if (obj->sd) dacl = sd_get_dacl( obj->sd, &present );
 983
 984         if (obj->sd && present)
 985             new_sd.dacl_len = obj->sd->dacl_len;
 986         else
 987         {
 988             dacl = token_get_default_dacl( current->process->token );
 989             new_sd.dacl_len = dacl->AclSize;
 990             new_sd.control |= SE_DACL_DEFAULTED;
 991         }
 992     }
 993
 994     ptr = mem_alloc( sizeof(new_sd) + new_sd.owner_len + new_sd.group_len +
 995                      new_sd.sacl_len + new_sd.dacl_len );
 996     if (!ptr) return;
 997     pnew_sd = (struct security_descriptor*)ptr;
 998
 999     memcpy( ptr, &new_sd, sizeof(new_sd) );
1000     ptr += sizeof(new_sd);
1001     memcpy( ptr, owner, new_sd.owner_len );
1002     ptr += new_sd.owner_len;
1003     memcpy( ptr, group, new_sd.group_len );
1004     ptr += new_sd.group_len;
1005     memcpy( ptr, sacl, new_sd.sacl_len );
1006     ptr += new_sd.sacl_len;
1007     memcpy( ptr, dacl, new_sd.dacl_len );
1008
1009     free( obj->sd );
1010     obj->sd = pnew_sd;
1011 }
1012
1013 int check_object_access(struct object *obj, unsigned int *access)
1014 {
1015     GENERIC_MAPPING mapping;
1016     struct token *token = current->token ? current->token : current->process->token;
1017     LUID_AND_ATTRIBUTES priv;
1018     unsigned int status, priv_count = 1;
1019     int res;
1020
1021     mapping.GenericAll = obj->ops->map_access( obj, GENERIC_ALL );
1022
1023     if (!obj->sd)
1024     {
1025         if (*access & MAXIMUM_ALLOWED)
1026             *access = mapping.GenericAll;
1027         return TRUE;
1028     }
1029
1030     mapping.GenericRead  = obj->ops->map_access( obj, GENERIC_READ );
1031     mapping.GenericWrite = obj->ops->map_access( obj, GENERIC_WRITE );
1032     mapping.GenericExecute = obj->ops->map_access( obj, GENERIC_EXECUTE );
1033
1034     res = token_access_check( token, obj->sd, *access, &priv, &priv_count,
1035                               &mapping, access, &status ) == STATUS_SUCCESS &&
1036           status == STATUS_SUCCESS;
1037
1038     if (!res) set_error( STATUS_ACCESS_DENIED );
1039     return res;
1040 }
1041
1042
1043 /* open a security token */
1044 DECL_HANDLER(open_token)
1045 {
1046     if (req->flags & OPEN_TOKEN_THREAD)
1047     {
1048         struct thread *thread = get_thread_from_handle( req->handle, 0 );
1049         if (thread)
1050         {
1051             if (thread->token)
1052             {
1053                 if (thread->token->impersonation_level <= SecurityAnonymous)
1054                     set_error( STATUS_CANT_OPEN_ANONYMOUS );
1055                 else
1056                     reply->token = alloc_handle( current->process, thread->token,
1057                                                  req->access, req->attributes );
1058             }
1059             else
1060                 set_error( STATUS_NO_TOKEN );
1061             release_object( thread );
1062         }
1063     }
1064     else
1065     {
1066         struct process *process = get_process_from_handle( req->handle, 0 );
1067         if (process)
1068         {
1069             if (process->token)
1070                 reply->token = alloc_handle( current->process, process->token, req->access,
1071                                              req->attributes );
1072             else
1073                 set_error( STATUS_NO_TOKEN );
1074             release_object( process );
1075         }
1076     }
1077 }
1078
1079 /* adjust the privileges held by a token */
1080 DECL_HANDLER(adjust_token_privileges)
1081 {
1082     struct token *token;
1083     unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1084
1085     if (req->get_modified_state) access |= TOKEN_QUERY;
1086
1087     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1088                                                  access, &token_ops )))
1089     {
1090         const LUID_AND_ATTRIBUTES *privs = get_req_data();
1091         LUID_AND_ATTRIBUTES *modified_privs = NULL;
1092         unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1093         unsigned int modified_priv_count = 0;
1094
1095         if (req->get_modified_state && !req->disable_all)
1096         {
1097             unsigned int i;
1098             /* count modified privs */
1099             for (i = 0; i < priv_count; i++)
1100             {
1101                 struct privilege *privilege =
1102                     token_find_privilege( token, &privs[i].Luid, FALSE );
1103                 if (privilege && req->get_modified_state)
1104                     modified_priv_count++;
1105             }
1106             reply->len = modified_priv_count;
1107             modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1108             if (modified_priv_count)
1109                 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1110         }
1111         reply->len = modified_priv_count * sizeof(*modified_privs);
1112
1113         if (req->disable_all)
1114             token_disable_privileges( token );
1115         else
1116             modified_priv_count = token_adjust_privileges( token, privs,
1117                 priv_count, modified_privs, modified_priv_count );
1118
1119         release_object( token );
1120     }
1121 }
1122
1123 /* retrieves the list of privileges that may be held be the token */
1124 DECL_HANDLER(get_token_privileges)
1125 {
1126     struct token *token;
1127
1128     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1129                                                  TOKEN_QUERY,
1130                                                  &token_ops )))
1131     {
1132         int priv_count = 0;
1133         LUID_AND_ATTRIBUTES *privs;
1134         struct privilege *privilege;
1135
1136         LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1137             priv_count++;
1138
1139         reply->len = priv_count * sizeof(*privs);
1140         if (reply->len <= get_reply_max_size())
1141         {
1142             privs = set_reply_data_size( priv_count * sizeof(*privs) );
1143             if (privs)
1144             {
1145                 int i = 0;
1146                 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1147                 {
1148                     luid_and_attr_from_privilege( &privs[i], privilege );
1149                     i++;
1150                 }
1151             }
1152         }
1153         else
1154             set_error(STATUS_BUFFER_TOO_SMALL);
1155
1156         release_object( token );
1157     }
1158 }
1159
1160 /* creates a duplicate of the token */
1161 DECL_HANDLER(duplicate_token)
1162 {
1163     struct token *src_token;
1164
1165     if ((req->impersonation_level < SecurityAnonymous) ||
1166         (req->impersonation_level > SecurityDelegation))
1167     {
1168         set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1169         return;
1170     }
1171
1172     if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1173                                                      TOKEN_DUPLICATE,
1174                                                      &token_ops )))
1175     {
1176         const luid_t *modified_id =
1177             req->primary || (req->impersonation_level == src_token->impersonation_level) ?
1178                 &src_token->modified_id : NULL;
1179         struct token *token = NULL;
1180
1181         if (req->primary || (req->impersonation_level <= src_token->impersonation_level))
1182             token = create_token( req->primary, src_token->user, NULL, 0,
1183                                   NULL, 0, src_token->default_dacl,
1184                                   src_token->source, modified_id,
1185                                   req->impersonation_level );
1186         else set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1187
1188         if (token)
1189         {
1190             struct privilege *privilege;
1191             struct group *group;
1192             unsigned int access;
1193
1194             /* copy groups */
1195             LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
1196             {
1197                 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
1198                 struct group *newgroup = mem_alloc( size );
1199                 if (!newgroup)
1200                 {
1201                     release_object( token );
1202                     release_object( src_token );
1203                     return;
1204                 }
1205                 memcpy( newgroup, group, size );
1206                 list_add_tail( &token->groups, &newgroup->entry );
1207             }
1208             token->primary_group = src_token->primary_group;
1209             assert( token->primary_group );
1210
1211             /* copy privileges */
1212             LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
1213                 privilege_add( token, &privilege->luid, privilege->enabled );
1214
1215             access = req->access;
1216             reply->new_handle = alloc_handle( current->process, token, access, req->attributes);
1217             release_object( token );
1218         }
1219         release_object( src_token );
1220     }
1221 }
1222
1223 /* checks the specified privileges are held by the token */
1224 DECL_HANDLER(check_token_privileges)
1225 {
1226     struct token *token;
1227
1228     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1229                                                  TOKEN_QUERY,
1230                                                  &token_ops )))
1231     {
1232         unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1233
1234         if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1235             set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1236         else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1237         {
1238             LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1239             reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1240         }
1241         else
1242             set_error( STATUS_BUFFER_OVERFLOW );
1243         release_object( token );
1244     }
1245 }
1246
1247 /* checks that a user represented by a token is allowed to access an object
1248  * represented by a security descriptor */
1249 DECL_HANDLER(access_check)
1250 {
1251     data_size_t sd_size = get_req_data_size();
1252     const struct security_descriptor *sd = get_req_data();
1253     struct token *token;
1254
1255     if (!sd_is_valid( sd, sd_size ))
1256     {
1257         set_error( STATUS_ACCESS_VIOLATION );
1258         return;
1259     }
1260
1261     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1262                                                  TOKEN_QUERY,
1263                                                  &token_ops )))
1264     {
1265         GENERIC_MAPPING mapping;
1266         unsigned int status;
1267         LUID_AND_ATTRIBUTES priv;
1268         unsigned int priv_count = 1;
1269
1270         memset(&priv, 0, sizeof(priv));
1271
1272         /* only impersonation tokens may be used with this function */
1273         if (token->primary)
1274         {
1275             set_error( STATUS_NO_IMPERSONATION_TOKEN );
1276             release_object( token );
1277             return;
1278         }
1279         /* anonymous impersonation tokens can't be used */
1280         if (token->impersonation_level <= SecurityAnonymous)
1281         {
1282             set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1283             release_object( token );
1284             return;
1285         }
1286
1287         mapping.GenericRead = req->mapping_read;
1288         mapping.GenericWrite = req->mapping_write;
1289         mapping.GenericExecute = req->mapping_execute;
1290         mapping.GenericAll = req->mapping_all;
1291
1292         status = token_access_check(
1293             token, sd, req->desired_access, &priv, &priv_count, &mapping,
1294             &reply->access_granted, &reply->access_status );
1295
1296         reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1297
1298         if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1299         {
1300             LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1301             memcpy( privs, &priv, sizeof(priv) );
1302         }
1303
1304         set_error( status );
1305         release_object( token );
1306     }
1307 }
1308
1309 /* retrieves the SID of the user that the token represents */
1310 DECL_HANDLER(get_token_user)
1311 {
1312     struct token *token;
1313
1314     reply->user_len = 0;
1315
1316     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1317                                                  TOKEN_QUERY,
1318                                                  &token_ops )))
1319     {
1320         const SID *user = token->user;
1321
1322         reply->user_len = FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]);
1323         if (reply->user_len <= get_reply_max_size())
1324         {
1325             SID *user_reply = set_reply_data_size( reply->user_len );
1326             if (user_reply)
1327                 memcpy( user_reply, user, reply->user_len );
1328         }
1329         else set_error( STATUS_BUFFER_TOO_SMALL );
1330
1331         release_object( token );
1332     }
1333 }
1334
1335 /* retrieves the groups that the user represented by the token belongs to */
1336 DECL_HANDLER(get_token_groups)
1337 {
1338     struct token *token;
1339
1340     reply->user_len = 0;
1341
1342     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1343                                                  TOKEN_QUERY,
1344                                                  &token_ops )))
1345     {
1346         size_t size_needed = sizeof(struct token_groups);
1347         unsigned int group_count = 0;
1348         const struct group *group;
1349
1350         LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1351         {
1352             group_count++;
1353             size_needed += FIELD_OFFSET(SID, SubAuthority[group->sid.SubAuthorityCount]);
1354         }
1355         size_needed += sizeof(unsigned int) * group_count;
1356
1357         reply->user_len = size_needed;
1358
1359         if (size_needed <= get_reply_max_size())
1360         {
1361             struct token_groups *tg = set_reply_data_size( size_needed );
1362             if (tg)
1363             {
1364                 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1365                 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1366
1367                 tg->count = group_count;
1368
1369                 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1370                 {
1371
1372                     *attr_ptr = 0;
1373                     if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1374                     if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1375                     if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1376                     if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1377                     if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1378                     if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1379
1380                     memcpy(sid_ptr, &group->sid, FIELD_OFFSET(SID, SubAuthority[group->sid.SubAuthorityCount]));
1381
1382                     sid_ptr = (SID *)((char *)sid_ptr + FIELD_OFFSET(SID, SubAuthority[group->sid.SubAuthorityCount]));
1383                     attr_ptr++;
1384                 }
1385             }
1386         }
1387         else set_error( STATUS_BUFFER_TOO_SMALL );
1388
1389         release_object( token );
1390     }
1391 }
1392
1393 DECL_HANDLER(get_token_impersonation_level)
1394 {
1395     struct token *token;
1396
1397     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1398                                                  TOKEN_QUERY,
1399                                                  &token_ops )))
1400     {
1401         if (token->primary)
1402             set_error( STATUS_INVALID_PARAMETER );
1403         else
1404             reply->impersonation_level = token->impersonation_level;
1405
1406         release_object( token );
1407     }
1408 }
1409
1410 DECL_HANDLER(set_security_object)
1411 {
1412     data_size_t sd_size = get_req_data_size();
1413     const struct security_descriptor *sd = get_req_data();
1414     struct object *obj;
1415     unsigned int access = 0;
1416
1417     if (!sd_is_valid( sd, sd_size ))
1418     {
1419         set_error( STATUS_ACCESS_VIOLATION );
1420         return;
1421     }
1422
1423     if (req->security_info & OWNER_SECURITY_INFORMATION ||
1424         req->security_info & GROUP_SECURITY_INFORMATION)
1425         access |= WRITE_OWNER;
1426     if (req->security_info & SACL_SECURITY_INFORMATION)
1427         access |= ACCESS_SYSTEM_SECURITY;
1428     if (req->security_info & DACL_SECURITY_INFORMATION)
1429         access |= WRITE_DAC;
1430
1431     if (!(obj = get_handle_obj( current->process, req->handle, access, NULL ))) return;
1432
1433     set_object_sd( obj, sd, req->security_info );
1434     release_object( obj );
1435 }