2 * Unit tests for security functions
4 * Copyright (c) 2004 Mike McCormack
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
25 #define WIN32_NO_STATUS
35 #include "wine/test.h"
37 /* copied from Wine winternl.h - not included in the Windows SDK */
38 typedef enum _OBJECT_INFORMATION_CLASS
{
39 ObjectBasicInformation
,
40 ObjectNameInformation
,
41 ObjectTypeInformation
,
44 } OBJECT_INFORMATION_CLASS
, *POBJECT_INFORMATION_CLASS
;
46 typedef struct _OBJECT_BASIC_INFORMATION
{
48 ACCESS_MASK GrantedAccess
;
52 ULONG NonPagedPoolUsage
;
54 ULONG NameInformationLength
;
55 ULONG TypeInformationLength
;
56 ULONG SecurityDescriptorLength
;
57 LARGE_INTEGER CreateTime
;
58 } OBJECT_BASIC_INFORMATION
, *POBJECT_BASIC_INFORMATION
;
60 #define expect_eq(expr, value, type, format) { type ret = expr; ok((value) == ret, #expr " expected " format " got " format "\n", (value), (ret)); }
62 typedef VOID (WINAPI
*fnBuildTrusteeWithSidA
)( PTRUSTEEA pTrustee
, PSID pSid
);
63 typedef VOID (WINAPI
*fnBuildTrusteeWithNameA
)( PTRUSTEEA pTrustee
, LPSTR pName
);
64 typedef VOID (WINAPI
*fnBuildTrusteeWithObjectsAndNameA
)( PTRUSTEEA pTrustee
,
65 POBJECTS_AND_NAME_A pObjName
,
66 SE_OBJECT_TYPE ObjectType
,
68 LPSTR InheritedObjectTypeName
,
70 typedef VOID (WINAPI
*fnBuildTrusteeWithObjectsAndSidA
)( PTRUSTEEA pTrustee
,
71 POBJECTS_AND_SID pObjSid
,
73 GUID
* pInheritedObjectGuid
,
75 typedef LPSTR (WINAPI
*fnGetTrusteeNameA
)( PTRUSTEEA pTrustee
);
76 typedef BOOL (WINAPI
*fnMakeSelfRelativeSD
)( PSECURITY_DESCRIPTOR
, PSECURITY_DESCRIPTOR
, LPDWORD
);
77 typedef BOOL (WINAPI
*fnConvertSidToStringSidA
)( PSID pSid
, LPSTR
*str
);
78 typedef BOOL (WINAPI
*fnConvertStringSidToSidA
)( LPCSTR str
, PSID pSid
);
79 static BOOL (WINAPI
*pConvertStringSecurityDescriptorToSecurityDescriptorA
)(LPCSTR
, DWORD
,
80 PSECURITY_DESCRIPTOR
*, PULONG
);
81 static BOOL (WINAPI
*pConvertSecurityDescriptorToStringSecurityDescriptorA
)(PSECURITY_DESCRIPTOR
, DWORD
,
82 SECURITY_INFORMATION
, LPSTR
*, PULONG
);
83 typedef BOOL (WINAPI
*fnGetFileSecurityA
)(LPCSTR
, SECURITY_INFORMATION
,
84 PSECURITY_DESCRIPTOR
, DWORD
, LPDWORD
);
85 static DWORD (WINAPI
*pGetNamedSecurityInfoA
)(LPSTR
, SE_OBJECT_TYPE
, SECURITY_INFORMATION
,
86 PSID
*, PSID
*, PACL
*, PACL
*,
87 PSECURITY_DESCRIPTOR
*);
88 typedef DWORD (WINAPI
*fnRtlAdjustPrivilege
)(ULONG
,BOOLEAN
,BOOLEAN
,PBOOLEAN
);
89 typedef BOOL (WINAPI
*fnCreateWellKnownSid
)(WELL_KNOWN_SID_TYPE
,PSID
,PSID
,DWORD
*);
90 typedef BOOL (WINAPI
*fnDuplicateTokenEx
)(HANDLE
,DWORD
,LPSECURITY_ATTRIBUTES
,
91 SECURITY_IMPERSONATION_LEVEL
,TOKEN_TYPE
,PHANDLE
);
93 typedef NTSTATUS (WINAPI
*fnLsaQueryInformationPolicy
)(LSA_HANDLE
,POLICY_INFORMATION_CLASS
,PVOID
*);
94 typedef NTSTATUS (WINAPI
*fnLsaClose
)(LSA_HANDLE
);
95 typedef NTSTATUS (WINAPI
*fnLsaFreeMemory
)(PVOID
);
96 typedef NTSTATUS (WINAPI
*fnLsaOpenPolicy
)(PLSA_UNICODE_STRING
,PLSA_OBJECT_ATTRIBUTES
,ACCESS_MASK
,PLSA_HANDLE
);
97 static NTSTATUS (WINAPI
*pNtQueryObject
)(HANDLE
,OBJECT_INFORMATION_CLASS
,PVOID
,ULONG
,PULONG
);
98 static DWORD (WINAPI
*pSetEntriesInAclW
)(ULONG
, PEXPLICIT_ACCESSW
, PACL
, PACL
*);
102 static char** myARGV
;
104 fnBuildTrusteeWithSidA pBuildTrusteeWithSidA
;
105 fnBuildTrusteeWithNameA pBuildTrusteeWithNameA
;
106 fnBuildTrusteeWithObjectsAndNameA pBuildTrusteeWithObjectsAndNameA
;
107 fnBuildTrusteeWithObjectsAndSidA pBuildTrusteeWithObjectsAndSidA
;
108 fnGetTrusteeNameA pGetTrusteeNameA
;
109 fnMakeSelfRelativeSD pMakeSelfRelativeSD
;
110 fnConvertSidToStringSidA pConvertSidToStringSidA
;
111 fnConvertStringSidToSidA pConvertStringSidToSidA
;
112 fnGetFileSecurityA pGetFileSecurityA
;
113 fnRtlAdjustPrivilege pRtlAdjustPrivilege
;
114 fnCreateWellKnownSid pCreateWellKnownSid
;
115 fnDuplicateTokenEx pDuplicateTokenEx
;
116 fnLsaQueryInformationPolicy pLsaQueryInformationPolicy
;
117 fnLsaClose pLsaClose
;
118 fnLsaFreeMemory pLsaFreeMemory
;
119 fnLsaOpenPolicy pLsaOpenPolicy
;
123 SID_IDENTIFIER_AUTHORITY auth
;
127 static void init(void)
131 hntdll
= GetModuleHandleA("ntdll.dll");
132 pNtQueryObject
= (void *)GetProcAddress( hntdll
, "NtQueryObject" );
134 hmod
= GetModuleHandle("advapi32.dll");
135 pConvertStringSecurityDescriptorToSecurityDescriptorA
=
136 (void *)GetProcAddress(hmod
, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
137 pConvertSecurityDescriptorToStringSecurityDescriptorA
=
138 (void *)GetProcAddress(hmod
, "ConvertSecurityDescriptorToStringSecurityDescriptorA" );
139 pMakeSelfRelativeSD
= (void *)GetProcAddress(hmod
, "MakeSelfRelativeSD");
140 pGetNamedSecurityInfoA
= (void *)GetProcAddress(hmod
, "GetNamedSecurityInfoA");
141 pSetEntriesInAclW
= (void *)GetProcAddress(hmod
, "SetEntriesInAclW");
142 pCreateWellKnownSid
= (fnCreateWellKnownSid
)GetProcAddress( hmod
, "CreateWellKnownSid" );
144 myARGC
= winetest_get_mainargs( &myARGV
);
147 static void test_str_sid(const char *str_sid
)
152 if (pConvertStringSidToSidA(str_sid
, &psid
))
154 if (pConvertSidToStringSidA(psid
, &temp
))
156 trace(" %s: %s\n", str_sid
, temp
);
163 if (GetLastError() != ERROR_INVALID_SID
)
164 trace(" %s: couldn't be converted, returned %d\n", str_sid
, GetLastError());
166 trace(" %s: couldn't be converted\n", str_sid
);
170 static void test_sid(void)
172 struct sidRef refs
[] = {
173 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
174 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
175 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
176 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
177 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
178 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
180 const char noSubAuthStr
[] = "S-1-5";
187 pConvertSidToStringSidA
= (fnConvertSidToStringSidA
)
188 GetProcAddress( hmod
, "ConvertSidToStringSidA" );
189 if( !pConvertSidToStringSidA
)
191 pConvertStringSidToSidA
= (fnConvertStringSidToSidA
)
192 GetProcAddress( hmod
, "ConvertStringSidToSidA" );
193 if( !pConvertStringSidToSidA
)
196 r
= pConvertStringSidToSidA( NULL
, NULL
);
197 ok( !r
, "expected failure with NULL parameters\n" );
198 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
200 ok( GetLastError() == ERROR_INVALID_PARAMETER
,
201 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
204 r
= pConvertStringSidToSidA( refs
[0].refStr
, NULL
);
205 ok( !r
&& GetLastError() == ERROR_INVALID_PARAMETER
,
206 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
209 r
= pConvertStringSidToSidA( NULL
, &str
);
210 ok( !r
&& GetLastError() == ERROR_INVALID_PARAMETER
,
211 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
214 r
= pConvertStringSidToSidA( noSubAuthStr
, &psid
);
216 "expected failure with no sub authorities\n" );
217 ok( GetLastError() == ERROR_INVALID_SID
,
218 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
221 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid
), "ConvertStringSidToSidA failed\n");
223 ok(pisid
->SubAuthorityCount
== 4, "Invalid sub authority count - expected 4, got %d\n", pisid
->SubAuthorityCount
);
224 ok(pisid
->SubAuthority
[0] == 21, "Invalid subauthority 0 - expceted 21, got %d\n", pisid
->SubAuthority
[0]);
225 ok(pisid
->SubAuthority
[3] == 4576, "Invalid subauthority 0 - expceted 4576, got %d\n", pisid
->SubAuthority
[3]);
228 for( i
= 0; i
< sizeof(refs
) / sizeof(refs
[0]); i
++ )
232 r
= AllocateAndInitializeSid( &refs
[i
].auth
, 1,1,0,0,0,0,0,0,0,
234 ok( r
, "failed to allocate sid\n" );
235 r
= pConvertSidToStringSidA( psid
, &str
);
236 ok( r
, "failed to convert sid\n" );
239 ok( !strcmp( str
, refs
[i
].refStr
),
240 "incorrect sid, expected %s, got %s\n", refs
[i
].refStr
, str
);
246 r
= pConvertStringSidToSidA( refs
[i
].refStr
, &psid
);
247 ok( r
, "failed to parse sid string\n" );
250 !memcmp( pisid
->IdentifierAuthority
.Value
, refs
[i
].auth
.Value
,
251 sizeof(refs
[i
].auth
) ),
252 "string sid %s didn't parse to expected value\n"
253 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
255 MAKEWORD( pisid
->IdentifierAuthority
.Value
[1],
256 pisid
->IdentifierAuthority
.Value
[0] ),
257 MAKELONG( MAKEWORD( pisid
->IdentifierAuthority
.Value
[5],
258 pisid
->IdentifierAuthority
.Value
[4] ),
259 MAKEWORD( pisid
->IdentifierAuthority
.Value
[3],
260 pisid
->IdentifierAuthority
.Value
[2] ) ),
261 MAKEWORD( refs
[i
].auth
.Value
[1], refs
[i
].auth
.Value
[0] ),
262 MAKELONG( MAKEWORD( refs
[i
].auth
.Value
[5], refs
[i
].auth
.Value
[4] ),
263 MAKEWORD( refs
[i
].auth
.Value
[3], refs
[i
].auth
.Value
[2] ) ) );
268 trace("String SIDs:\n");
309 static void test_trustee(void)
311 GUID ObjectType
= {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
312 GUID InheritedObjectType
= {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
314 OBJECTS_AND_NAME_ oan
;
318 char szObjectTypeName
[] = "ObjectTypeName";
319 char szInheritedObjectTypeName
[] = "InheritedObjectTypeName";
320 char szTrusteeName
[] = "szTrusteeName";
321 SID_IDENTIFIER_AUTHORITY auth
= { {0x11,0x22,0,0,0, 0} };
323 memset( &ZeroGuid
, 0x00, sizeof (ZeroGuid
) );
325 pBuildTrusteeWithSidA
= (fnBuildTrusteeWithSidA
)
326 GetProcAddress( hmod
, "BuildTrusteeWithSidA" );
327 pBuildTrusteeWithNameA
= (fnBuildTrusteeWithNameA
)
328 GetProcAddress( hmod
, "BuildTrusteeWithNameA" );
329 pBuildTrusteeWithObjectsAndNameA
= (fnBuildTrusteeWithObjectsAndNameA
)
330 GetProcAddress (hmod
, "BuildTrusteeWithObjectsAndNameA" );
331 pBuildTrusteeWithObjectsAndSidA
= (fnBuildTrusteeWithObjectsAndSidA
)
332 GetProcAddress (hmod
, "BuildTrusteeWithObjectsAndSidA" );
333 pGetTrusteeNameA
= (fnGetTrusteeNameA
)
334 GetProcAddress (hmod
, "GetTrusteeNameA" );
335 if( !pBuildTrusteeWithSidA
|| !pBuildTrusteeWithNameA
||
336 !pBuildTrusteeWithObjectsAndNameA
|| !pBuildTrusteeWithObjectsAndSidA
||
340 if ( ! AllocateAndInitializeSid( &auth
, 1, 42, 0,0,0,0,0,0,0,&psid
) )
342 trace( "failed to init SID\n" );
346 /* test BuildTrusteeWithSidA */
347 memset( &trustee
, 0xff, sizeof trustee
);
348 pBuildTrusteeWithSidA( &trustee
, psid
);
350 ok( trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
351 ok( trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
,
352 "MultipleTrusteeOperation wrong\n");
353 ok( trustee
.TrusteeForm
== TRUSTEE_IS_SID
, "TrusteeForm wrong\n");
354 ok( trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
355 ok( trustee
.ptstrName
== (LPSTR
) psid
, "ptstrName wrong\n" );
357 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
358 memset( &trustee
, 0xff, sizeof trustee
);
359 memset( &oas
, 0xff, sizeof(oas
) );
360 pBuildTrusteeWithObjectsAndSidA(&trustee
, &oas
, &ObjectType
,
361 &InheritedObjectType
, psid
);
363 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
364 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
365 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_SID
, "TrusteeForm wrong\n");
366 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
367 ok(trustee
.ptstrName
== (LPSTR
)&oas
, "ptstrName wrong\n");
369 ok(oas
.ObjectsPresent
== (ACE_OBJECT_TYPE_PRESENT
| ACE_INHERITED_OBJECT_TYPE_PRESENT
), "ObjectsPresent wrong\n");
370 ok(!memcmp(&oas
.ObjectTypeGuid
, &ObjectType
, sizeof(GUID
)), "ObjectTypeGuid wrong\n");
371 ok(!memcmp(&oas
.InheritedObjectTypeGuid
, &InheritedObjectType
, sizeof(GUID
)), "InheritedObjectTypeGuid wrong\n");
372 ok(oas
.pSid
== psid
, "pSid wrong\n");
374 /* test GetTrusteeNameA */
375 ok(pGetTrusteeNameA(&trustee
) == (LPSTR
)&oas
, "GetTrusteeName returned wrong value\n");
377 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
378 memset( &trustee
, 0xff, sizeof trustee
);
379 memset( &oas
, 0xff, sizeof(oas
) );
380 pBuildTrusteeWithObjectsAndSidA(&trustee
, &oas
, NULL
,
381 &InheritedObjectType
, psid
);
383 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
384 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
385 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_SID
, "TrusteeForm wrong\n");
386 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
387 ok(trustee
.ptstrName
== (LPSTR
)&oas
, "ptstrName wrong\n");
389 ok(oas
.ObjectsPresent
== ACE_INHERITED_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
390 ok(!memcmp(&oas
.ObjectTypeGuid
, &ZeroGuid
, sizeof(GUID
)), "ObjectTypeGuid wrong\n");
391 ok(!memcmp(&oas
.InheritedObjectTypeGuid
, &InheritedObjectType
, sizeof(GUID
)), "InheritedObjectTypeGuid wrong\n");
392 ok(oas
.pSid
== psid
, "pSid wrong\n");
396 /* test BuildTrusteeWithNameA */
397 memset( &trustee
, 0xff, sizeof trustee
);
398 pBuildTrusteeWithNameA( &trustee
, szTrusteeName
);
400 ok( trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
401 ok( trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
,
402 "MultipleTrusteeOperation wrong\n");
403 ok( trustee
.TrusteeForm
== TRUSTEE_IS_NAME
, "TrusteeForm wrong\n");
404 ok( trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
405 ok( trustee
.ptstrName
== szTrusteeName
, "ptstrName wrong\n" );
407 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
408 memset( &trustee
, 0xff, sizeof trustee
);
409 memset( &oan
, 0xff, sizeof(oan
) );
410 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, szObjectTypeName
,
411 szInheritedObjectTypeName
, szTrusteeName
);
413 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
414 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
415 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
416 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
417 ok(trustee
.ptstrName
== (LPTSTR
)&oan
, "ptstrName wrong\n");
419 ok(oan
.ObjectsPresent
== (ACE_OBJECT_TYPE_PRESENT
| ACE_INHERITED_OBJECT_TYPE_PRESENT
), "ObjectsPresent wrong\n");
420 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
421 ok(oan
.InheritedObjectTypeName
== szInheritedObjectTypeName
, "InheritedObjectTypeName wrong\n");
422 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
424 /* test GetTrusteeNameA */
425 ok(pGetTrusteeNameA(&trustee
) == (LPSTR
)&oan
, "GetTrusteeName returned wrong value\n");
427 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
428 memset( &trustee
, 0xff, sizeof trustee
);
429 memset( &oan
, 0xff, sizeof(oan
) );
430 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, NULL
,
431 szInheritedObjectTypeName
, szTrusteeName
);
433 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
434 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
435 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
436 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
437 ok(trustee
.ptstrName
== (LPSTR
)&oan
, "ptstrName wrong\n");
439 ok(oan
.ObjectsPresent
== ACE_INHERITED_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
440 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
441 ok(oan
.InheritedObjectTypeName
== szInheritedObjectTypeName
, "InheritedObjectTypeName wrong\n");
442 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
444 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
445 memset( &trustee
, 0xff, sizeof trustee
);
446 memset( &oan
, 0xff, sizeof(oan
) );
447 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, szObjectTypeName
,
448 NULL
, szTrusteeName
);
450 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
451 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
452 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
453 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
454 ok(trustee
.ptstrName
== (LPTSTR
)&oan
, "ptstrName wrong\n");
456 ok(oan
.ObjectsPresent
== ACE_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
457 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
458 ok(oan
.InheritedObjectTypeName
== NULL
, "InheritedObjectTypeName wrong\n");
459 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
462 /* If the first isn't defined, assume none is */
463 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
464 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
465 #define SE_CREATE_TOKEN_PRIVILEGE 2L
466 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
467 #define SE_LOCK_MEMORY_PRIVILEGE 4L
468 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
469 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
470 #define SE_TCB_PRIVILEGE 7L
471 #define SE_SECURITY_PRIVILEGE 8L
472 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
473 #define SE_LOAD_DRIVER_PRIVILEGE 10L
474 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
475 #define SE_SYSTEMTIME_PRIVILEGE 12L
476 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
477 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
478 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
479 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
480 #define SE_BACKUP_PRIVILEGE 17L
481 #define SE_RESTORE_PRIVILEGE 18L
482 #define SE_SHUTDOWN_PRIVILEGE 19L
483 #define SE_DEBUG_PRIVILEGE 20L
484 #define SE_AUDIT_PRIVILEGE 21L
485 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
486 #define SE_CHANGE_NOTIFY_PRIVILLEGE 23L
487 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
488 #define SE_UNDOCK_PRIVILEGE 25L
489 #define SE_SYNC_AGENT_PRIVILEGE 26L
490 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
491 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
492 #define SE_IMPERSONATE_PRIVILEGE 29L
493 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
494 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
495 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
497 static void test_allocateLuid(void)
499 BOOL (WINAPI
*pAllocateLocallyUniqueId
)(PLUID
);
503 pAllocateLocallyUniqueId
= (void*)GetProcAddress(hmod
, "AllocateLocallyUniqueId");
504 if (!pAllocateLocallyUniqueId
) return;
506 ret
= pAllocateLocallyUniqueId(&luid1
);
507 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
511 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
512 ret
= pAllocateLocallyUniqueId(&luid2
);
514 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
515 ok(luid1
.LowPart
> SE_MAX_WELL_KNOWN_PRIVILEGE
|| luid1
.HighPart
!= 0,
516 "AllocateLocallyUniqueId returned a well-known LUID\n");
517 ok(luid1
.LowPart
!= luid2
.LowPart
|| luid1
.HighPart
!= luid2
.HighPart
,
518 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
519 ret
= pAllocateLocallyUniqueId(NULL
);
520 ok( !ret
&& GetLastError() == ERROR_NOACCESS
,
521 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
525 static void test_lookupPrivilegeName(void)
527 BOOL (WINAPI
*pLookupPrivilegeNameA
)(LPCSTR
, PLUID
, LPSTR
, LPDWORD
);
528 char buf
[MAX_PATH
]; /* arbitrary, seems long enough */
529 DWORD cchName
= sizeof(buf
);
530 LUID luid
= { 0, 0 };
534 /* check whether it's available first */
535 pLookupPrivilegeNameA
= (void*)GetProcAddress(hmod
, "LookupPrivilegeNameA");
536 if (!pLookupPrivilegeNameA
) return;
537 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
538 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
539 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
542 /* check with a short buffer */
544 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
545 ret
= pLookupPrivilegeNameA(NULL
, &luid
, NULL
, &cchName
);
546 ok( !ret
&& GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
547 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
549 ok(cchName
== strlen("SeCreateTokenPrivilege") + 1,
550 "LookupPrivilegeNameA returned an incorrect required length for\n"
551 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName
,
552 lstrlenA("SeCreateTokenPrivilege") + 1);
553 /* check a known value and its returned length on success */
554 cchName
= sizeof(buf
);
555 ok(pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
) &&
556 cchName
== strlen("SeCreateTokenPrivilege"),
557 "LookupPrivilegeNameA returned an incorrect output length for\n"
558 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName
,
559 (int)strlen("SeCreateTokenPrivilege"));
560 /* check known values */
561 for (i
= SE_MIN_WELL_KNOWN_PRIVILEGE
; i
< SE_MAX_WELL_KNOWN_PRIVILEGE
; i
++)
564 cchName
= sizeof(buf
);
565 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
566 ok( ret
|| GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
567 "LookupPrivilegeNameA(0.%d) failed: %d\n", i
, GetLastError());
569 /* check a bogus LUID */
570 luid
.LowPart
= 0xdeadbeef;
571 cchName
= sizeof(buf
);
572 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
573 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
574 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
576 /* check on a bogus system */
577 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
578 cchName
= sizeof(buf
);
579 ret
= pLookupPrivilegeNameA("b0gu5.Nam3", &luid
, buf
, &cchName
);
580 ok( !ret
&& GetLastError() == RPC_S_SERVER_UNAVAILABLE
,
581 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
591 static void test_lookupPrivilegeValue(void)
593 static const struct NameToLUID privs
[] = {
594 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE
},
595 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE
},
596 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE
},
597 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE
},
598 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE
},
599 { "SeTcbPrivilege", SE_TCB_PRIVILEGE
},
600 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE
},
601 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE
},
602 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE
},
603 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE
},
604 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE
},
605 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE
},
606 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE
},
607 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE
},
608 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE
},
609 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE
},
610 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE
},
611 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE
},
612 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE
},
613 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE
},
614 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE
},
615 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILLEGE
},
616 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE
},
617 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE
},
618 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE
},
619 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE
},
620 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE
},
621 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE
},
622 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE
},
624 BOOL (WINAPI
*pLookupPrivilegeValueA
)(LPCSTR
, LPCSTR
, PLUID
);
629 /* check whether it's available first */
630 pLookupPrivilegeValueA
= (void*)GetProcAddress(hmod
, "LookupPrivilegeValueA");
631 if (!pLookupPrivilegeValueA
) return;
632 ret
= pLookupPrivilegeValueA(NULL
, "SeCreateTokenPrivilege", &luid
);
633 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
636 /* check a bogus system name */
637 ret
= pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid
);
638 ok( !ret
&& GetLastError() == RPC_S_SERVER_UNAVAILABLE
,
639 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
641 /* check a NULL string */
642 ret
= pLookupPrivilegeValueA(NULL
, 0, &luid
);
643 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
644 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
646 /* check a bogus privilege name */
647 ret
= pLookupPrivilegeValueA(NULL
, "SeBogusPrivilege", &luid
);
648 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
649 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
651 /* check case insensitive */
652 ret
= pLookupPrivilegeValueA(NULL
, "sEcREATEtOKENpRIVILEGE", &luid
);
654 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
656 for (i
= 0; i
< sizeof(privs
) / sizeof(privs
[0]); i
++)
658 /* Not all privileges are implemented on all Windows versions, so
659 * don't worry if the call fails
661 if (pLookupPrivilegeValueA(NULL
, privs
[i
].name
, &luid
))
663 ok(luid
.LowPart
== privs
[i
].lowPart
,
664 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
670 static void test_luid(void)
673 test_lookupPrivilegeName();
674 test_lookupPrivilegeValue();
677 static void test_FileSecurity(void)
679 char directory
[MAX_PATH
];
680 DWORD retval
, outSize
;
684 pGetFileSecurityA
= (fnGetFileSecurityA
)
685 GetProcAddress( hmod
, "GetFileSecurityA" );
686 if( !pGetFileSecurityA
)
689 retval
= GetTempPathA(sizeof(directory
), directory
);
691 trace("GetTempPathA failed\n");
695 strcpy(directory
, "\\Should not exist");
697 SetLastError(NO_ERROR
);
698 result
= pGetFileSecurityA( directory
,OWNER_SECURITY_INFORMATION
,buffer
,0x40,&outSize
);
699 ok(!result
, "GetFileSecurityA should fail for not existing directories/files\n");
700 ok( (GetLastError() == ERROR_FILE_NOT_FOUND
) ||
701 (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
) ,
702 "last error ERROR_FILE_NOT_FOUND / ERROR_CALL_NOT_IMPLEMENTED (98) "
703 "expected, got %d\n", GetLastError());
706 static void test_AccessCheck(void)
708 PSID EveryoneSid
= NULL
, AdminSid
= NULL
, UsersSid
= NULL
;
710 SECURITY_DESCRIPTOR
*SecurityDescriptor
= NULL
;
711 SID_IDENTIFIER_AUTHORITY SIDAuthWorld
= { SECURITY_WORLD_SID_AUTHORITY
};
712 SID_IDENTIFIER_AUTHORITY SIDAuthNT
= { SECURITY_NT_AUTHORITY
};
713 GENERIC_MAPPING Mapping
= { KEY_READ
, KEY_WRITE
, KEY_EXECUTE
, KEY_ALL_ACCESS
};
720 PRIVILEGE_SET
*PrivSet
;
726 NtDllModule
= GetModuleHandle("ntdll.dll");
729 skip("not running on NT, skipping test\n");
732 pRtlAdjustPrivilege
= (fnRtlAdjustPrivilege
)
733 GetProcAddress(NtDllModule
, "RtlAdjustPrivilege");
734 if (!pRtlAdjustPrivilege
)
736 skip("missing RtlAdjustPrivilege, skipping test\n");
740 Acl
= HeapAlloc(GetProcessHeap(), 0, 256);
741 res
= InitializeAcl(Acl
, 256, ACL_REVISION
);
742 if(!res
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
744 skip("ACLs not implemented - skipping tests\n");
745 HeapFree(GetProcessHeap(), 0, Acl
);
748 ok(res
, "InitializeAcl failed with error %d\n", GetLastError());
750 res
= AllocateAndInitializeSid( &SIDAuthWorld
, 1, SECURITY_WORLD_RID
, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid
);
751 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
753 res
= AllocateAndInitializeSid( &SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
754 DOMAIN_ALIAS_RID_ADMINS
, 0, 0, 0, 0, 0, 0, &AdminSid
);
755 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
757 res
= AllocateAndInitializeSid( &SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
758 DOMAIN_ALIAS_RID_USERS
, 0, 0, 0, 0, 0, 0, &UsersSid
);
759 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
761 SecurityDescriptor
= HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH
);
763 res
= InitializeSecurityDescriptor(SecurityDescriptor
, SECURITY_DESCRIPTOR_REVISION
);
764 ok(res
, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
766 res
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
767 ok(res
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
769 PrivSetLen
= FIELD_OFFSET(PRIVILEGE_SET
, Privilege
[16]);
770 PrivSet
= HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY
, PrivSetLen
);
771 PrivSet
->PrivilegeCount
= 16;
773 res
= OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE
|TOKEN_QUERY
, &ProcessToken
);
774 ok(res
, "OpenProcessToken failed with error %d\n", GetLastError());
776 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE
, FALSE
, TRUE
, &Enabled
);
778 res
= DuplicateToken(ProcessToken
, SecurityIdentification
, &Token
);
779 ok(res
, "DuplicateToken failed with error %d\n", GetLastError());
781 /* SD without owner/group */
782 SetLastError(0xdeadbeef);
783 Access
= AccessStatus
= 0xdeadbeef;
784 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_QUERY_VALUE
, &Mapping
,
785 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
786 err
= GetLastError();
787 ok(!ret
&& err
== ERROR_INVALID_SECURITY_DESCR
, "AccessCheck should have "
788 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err
);
789 ok(Access
== 0xdeadbeef && AccessStatus
== 0xdeadbeef,
790 "Access and/or AccessStatus were changed!\n");
792 /* Set owner and group */
793 res
= SetSecurityDescriptorOwner(SecurityDescriptor
, AdminSid
, FALSE
);
794 ok(res
, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
795 res
= SetSecurityDescriptorGroup(SecurityDescriptor
, UsersSid
, TRUE
);
796 ok(res
, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
798 /* Generic access mask */
799 SetLastError(0xdeadbeef);
800 ret
= AccessCheck(SecurityDescriptor
, Token
, GENERIC_READ
, &Mapping
,
801 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
802 err
= GetLastError();
803 ok(!ret
&& err
== ERROR_GENERIC_NOT_MAPPED
, "AccessCheck should have failed "
804 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err
);
805 ok(Access
== 0xdeadbeef && AccessStatus
== 0xdeadbeef,
806 "Access and/or AccessStatus were changed!\n");
808 /* sd with no dacl present */
809 ret
= SetSecurityDescriptorDacl(SecurityDescriptor
, FALSE
, NULL
, FALSE
);
810 ok(ret
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
811 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
812 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
813 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
814 ok(AccessStatus
&& (Access
== KEY_READ
),
815 "AccessCheck failed to grant access with error %d\n",
818 /* sd with NULL dacl */
819 ret
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, NULL
, FALSE
);
820 ok(ret
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
821 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
822 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
823 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
824 ok(AccessStatus
&& (Access
== KEY_READ
),
825 "AccessCheck failed to grant access with error %d\n",
828 /* sd with blank dacl */
829 ret
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
830 ok(ret
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
831 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
832 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
833 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
834 err
= GetLastError();
835 ok(!AccessStatus
&& err
== ERROR_ACCESS_DENIED
, "AccessCheck should have failed "
836 "with ERROR_ACCESS_DENIED, instead of %d\n", err
);
837 ok(!Access
, "Should have failed to grant any access, got 0x%08x\n", Access
);
839 res
= AddAccessAllowedAce(Acl
, ACL_REVISION
, KEY_READ
, EveryoneSid
);
840 ok(res
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
842 res
= AddAccessDeniedAce(Acl
, ACL_REVISION
, KEY_SET_VALUE
, AdminSid
);
843 ok(res
, "AddAccessDeniedAce failed with error %d\n", GetLastError());
846 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
847 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
848 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
849 ok(AccessStatus
&& (Access
== KEY_READ
),
850 "AccessCheck failed to grant access with error %d\n",
853 ret
= AccessCheck(SecurityDescriptor
, Token
, MAXIMUM_ALLOWED
, &Mapping
,
854 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
855 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
857 "AccessCheck failed to grant any access with error %d\n",
859 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access
);
861 /* Access denied by SD */
862 SetLastError(0xdeadbeef);
863 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_WRITE
, &Mapping
,
864 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
865 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
866 err
= GetLastError();
867 ok(!AccessStatus
&& err
== ERROR_ACCESS_DENIED
, "AccessCheck should have failed "
868 "with ERROR_ACCESS_DENIED, instead of %d\n", err
);
869 ok(!Access
, "Should have failed to grant any access, got 0x%08x\n", Access
);
872 PrivSet
->PrivilegeCount
= 16;
873 ret
= AccessCheck(SecurityDescriptor
, Token
, ACCESS_SYSTEM_SECURITY
, &Mapping
,
874 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
875 ok(ret
&& !AccessStatus
&& GetLastError() == ERROR_PRIVILEGE_NOT_HELD
,
876 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
879 ret
= pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE
, TRUE
, TRUE
, &Enabled
);
883 PrivSet
->PrivilegeCount
= 16;
884 ret
= AccessCheck(SecurityDescriptor
, Token
, ACCESS_SYSTEM_SECURITY
, &Mapping
,
885 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
886 ok(ret
&& AccessStatus
&& GetLastError() == 0,
887 "AccessCheck should have succeeded, error %d\n",
889 ok(Access
== ACCESS_SYSTEM_SECURITY
,
890 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
894 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
899 res
= DuplicateToken(ProcessToken
, SecurityAnonymous
, &Token
);
900 ok(res
, "DuplicateToken failed with error %d\n", GetLastError());
902 SetLastError(0xdeadbeef);
903 ret
= AccessCheck(SecurityDescriptor
, Token
, MAXIMUM_ALLOWED
, &Mapping
,
904 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
905 err
= GetLastError();
906 ok(!ret
&& err
== ERROR_BAD_IMPERSONATION_LEVEL
, "AccessCheck should have failed "
907 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err
);
911 SetLastError(0xdeadbeef);
912 ret
= AccessCheck(SecurityDescriptor
, ProcessToken
, KEY_READ
, &Mapping
,
913 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
914 err
= GetLastError();
915 ok(!ret
&& err
== ERROR_NO_IMPERSONATION_TOKEN
, "AccessCheck should have failed "
916 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err
);
918 CloseHandle(ProcessToken
);
921 FreeSid(EveryoneSid
);
926 HeapFree(GetProcessHeap(), 0, Acl
);
927 HeapFree(GetProcessHeap(), 0, SecurityDescriptor
);
928 HeapFree(GetProcessHeap(), 0, PrivSet
);
931 /* test GetTokenInformation for the various attributes */
932 static void test_token_attr(void)
934 HANDLE Token
, ImpersonationToken
;
936 TOKEN_PRIVILEGES
*Privileges
;
937 TOKEN_GROUPS
*Groups
;
942 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
944 /* cygwin-like use case */
945 SetLastError(0xdeadbeef);
946 ret
= OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED
, &Token
);
947 if(!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
949 skip("OpenProcessToken is not implemented\n");
952 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
957 ret
= GetTokenInformation(Token
, TokenUser
,(void*)buf
, Size
, &Size
);
958 ok(ret
, "GetTokenInformation failed with error %d\n", GetLastError());
959 Size
= sizeof(ImpersonationLevel
);
960 ret
= GetTokenInformation(Token
, TokenImpersonationLevel
, &ImpersonationLevel
, Size
, &Size
);
961 GLE
= GetLastError();
962 ok(!ret
&& (GLE
== ERROR_INVALID_PARAMETER
), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE
);
966 if(!pConvertSidToStringSidA
)
968 skip("ConvertSidToStringSidA is not available\n");
972 SetLastError(0xdeadbeef);
973 ret
= OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY
|TOKEN_DUPLICATE
, &Token
);
974 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
977 ret
= GetTokenInformation(Token
, TokenGroups
, NULL
, 0, &Size
);
978 Groups
= HeapAlloc(GetProcessHeap(), 0, Size
);
979 ret
= GetTokenInformation(Token
, TokenGroups
, Groups
, Size
, &Size
);
980 ok(ret
, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
981 trace("TokenGroups:\n");
982 for (i
= 0; i
< Groups
->GroupCount
; i
++)
984 DWORD NameLength
= 255;
986 DWORD DomainLength
= 255;
988 SID_NAME_USE SidNameUse
;
989 pConvertSidToStringSidA(Groups
->Groups
[i
].Sid
, &SidString
);
992 ret
= LookupAccountSid(NULL
, Groups
->Groups
[i
].Sid
, Name
, &NameLength
, Domain
, &DomainLength
, &SidNameUse
);
994 trace("\t%s, %s\\%s use: %d attr: 0x%08x\n", SidString
, Domain
, Name
, SidNameUse
, Groups
->Groups
[i
].Attributes
);
996 trace("\t%s, attr: 0x%08x LookupAccountSid failed with error %d\n", SidString
, Groups
->Groups
[i
].Attributes
, GetLastError());
997 LocalFree(SidString
);
999 HeapFree(GetProcessHeap(), 0, Groups
);
1002 ret
= GetTokenInformation(Token
, TokenUser
, NULL
, 0, &Size
);
1003 ok(!ret
&& (GetLastError() == ERROR_INSUFFICIENT_BUFFER
),
1004 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1005 User
= HeapAlloc(GetProcessHeap(), 0, Size
);
1006 ret
= GetTokenInformation(Token
, TokenUser
, User
, Size
, &Size
);
1008 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1010 pConvertSidToStringSidA(User
->User
.Sid
, &SidString
);
1011 trace("TokenUser: %s attr: 0x%08x\n", SidString
, User
->User
.Attributes
);
1012 LocalFree(SidString
);
1013 HeapFree(GetProcessHeap(), 0, User
);
1016 ret
= GetTokenInformation(Token
, TokenPrivileges
, NULL
, 0, &Size
);
1017 ok(!ret
&& (GetLastError() == ERROR_INSUFFICIENT_BUFFER
),
1018 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1019 Privileges
= HeapAlloc(GetProcessHeap(), 0, Size
);
1020 ret
= GetTokenInformation(Token
, TokenPrivileges
, Privileges
, Size
, &Size
);
1022 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1023 trace("TokenPrivileges:\n");
1024 for (i
= 0; i
< Privileges
->PrivilegeCount
; i
++)
1027 DWORD NameLen
= sizeof(Name
)/sizeof(Name
[0]);
1028 LookupPrivilegeName(NULL
, &Privileges
->Privileges
[i
].Luid
, Name
, &NameLen
);
1029 trace("\t%s, 0x%x\n", Name
, Privileges
->Privileges
[i
].Attributes
);
1031 HeapFree(GetProcessHeap(), 0, Privileges
);
1033 ret
= DuplicateToken(Token
, SecurityAnonymous
, &ImpersonationToken
);
1034 ok(ret
, "DuplicateToken failed with error %d\n", GetLastError());
1036 Size
= sizeof(ImpersonationLevel
);
1037 ret
= GetTokenInformation(ImpersonationToken
, TokenImpersonationLevel
, &ImpersonationLevel
, Size
, &Size
);
1038 ok(ret
, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
1039 ok(ImpersonationLevel
== SecurityAnonymous
, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel
);
1041 CloseHandle(ImpersonationToken
);
1045 typedef union _MAX_SID
1048 char max
[SECURITY_MAX_SID_SIZE
];
1051 static void test_sid_str(PSID
* sid
)
1054 BOOL ret
= pConvertSidToStringSidA(sid
, &str_sid
);
1055 ok(ret
, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
1058 char account
[MAX_PATH
], domain
[MAX_PATH
];
1060 DWORD acc_size
= MAX_PATH
;
1061 DWORD dom_size
= MAX_PATH
;
1062 ret
= LookupAccountSid(NULL
, sid
, account
, &acc_size
, domain
, &dom_size
, &use
);
1063 ok(ret
|| (!ret
&& (GetLastError() == ERROR_NONE_MAPPED
)),
1064 "LookupAccountSid(%s) failed: %d\n", str_sid
, GetLastError());
1066 trace(" %s %s\\%s %d\n", str_sid
, domain
, account
, use
);
1067 else if (GetLastError() == ERROR_NONE_MAPPED
)
1068 trace(" %s couldn't be mapped\n", str_sid
);
1073 struct well_known_sid_value
1075 BOOL without_domain
;
1076 const char *sid_string
;
1077 } well_known_sid_values
[] = {
1078 /* 0 */ {TRUE
, "S-1-0-0"}, {TRUE
, "S-1-1-0"}, {TRUE
, "S-1-2-0"}, {TRUE
, "S-1-3-0"},
1079 /* 4 */ {TRUE
, "S-1-3-1"}, {TRUE
, "S-1-3-2"}, {TRUE
, "S-1-3-3"}, {TRUE
, "S-1-5"},
1080 /* 8 */ {FALSE
, "S-1-5-1"}, {TRUE
, "S-1-5-2"}, {TRUE
, "S-1-5-3"}, {TRUE
, "S-1-5-4"},
1081 /* 12 */ {TRUE
, "S-1-5-6"}, {TRUE
, "S-1-5-7"}, {TRUE
, "S-1-5-8"}, {TRUE
, "S-1-5-9"},
1082 /* 16 */ {TRUE
, "S-1-5-10"}, {TRUE
, "S-1-5-11"}, {TRUE
, "S-1-5-12"}, {TRUE
, "S-1-5-13"},
1083 /* 20 */ {TRUE
, "S-1-5-14"}, {FALSE
, NULL
}, {TRUE
, "S-1-5-18"}, {TRUE
, "S-1-5-19"},
1084 /* 24 */ {TRUE
, "S-1-5-20"}, {TRUE
, "S-1-5-32"},
1085 /* 26 */ {FALSE
, "S-1-5-32-544"}, {TRUE
, "S-1-5-32-545"}, {TRUE
, "S-1-5-32-546"},
1086 /* 29 */ {TRUE
, "S-1-5-32-547"}, {TRUE
, "S-1-5-32-548"}, {TRUE
, "S-1-5-32-549"},
1087 /* 32 */ {TRUE
, "S-1-5-32-550"}, {TRUE
, "S-1-5-32-551"}, {TRUE
, "S-1-5-32-552"},
1088 /* 35 */ {TRUE
, "S-1-5-32-554"}, {TRUE
, "S-1-5-32-555"}, {TRUE
, "S-1-5-32-556"},
1089 /* 38 */ {FALSE
, "S-1-5-21-12-23-34-45-56-500"}, {FALSE
, "S-1-5-21-12-23-34-45-56-501"},
1090 /* 40 */ {FALSE
, "S-1-5-21-12-23-34-45-56-502"}, {FALSE
, "S-1-5-21-12-23-34-45-56-512"},
1091 /* 42 */ {FALSE
, "S-1-5-21-12-23-34-45-56-513"}, {FALSE
, "S-1-5-21-12-23-34-45-56-514"},
1092 /* 44 */ {FALSE
, "S-1-5-21-12-23-34-45-56-515"}, {FALSE
, "S-1-5-21-12-23-34-45-56-516"},
1093 /* 46 */ {FALSE
, "S-1-5-21-12-23-34-45-56-517"}, {FALSE
, "S-1-5-21-12-23-34-45-56-518"},
1094 /* 48 */ {FALSE
, "S-1-5-21-12-23-34-45-56-519"}, {FALSE
, "S-1-5-21-12-23-34-45-56-520"},
1095 /* 50 */ {FALSE
, "S-1-5-21-12-23-34-45-56-553"},
1096 /* 51 */ {TRUE
, "S-1-5-64-10"}, {TRUE
, "S-1-5-64-21"}, {TRUE
, "S-1-5-64-14"},
1097 /* 54 */ {TRUE
, "S-1-5-15"}, {TRUE
, "S-1-5-1000"}, {FALSE
, "S-1-5-32-557"},
1098 /* 57 */ {TRUE
, "S-1-5-32-558"}, {TRUE
, "S-1-5-32-559"}, {TRUE
, "S-1-5-32-560"},
1099 /* 60 */ {TRUE
, "S-1-5-32-561"},
1100 /* Added in Windows Vista: */
1101 /* 61 */ {TRUE
, "S-1-5-32-562"}, {TRUE
, "S-1-5-32-568"},
1102 /* 63 */ {TRUE
, "S-1-5-17"}, {FALSE
, "S-1-5-32-569"}, {TRUE
, "S-1-16-0"},
1103 /* 66 */ {TRUE
, "S-1-16-4096"}, {TRUE
, "S-1-16-8192"}, {TRUE
, "S-1-16-12288"},
1104 /* 69 */ {TRUE
, "S-1-16-16384"}, {TRUE
, "S-1-5-33"}, {TRUE
, "S-1-3-4"},
1105 /* 72 */ {FALSE
, "S-1-5-21-12-23-34-45-56-571"}, {FALSE
, "S-1-5-21-12-23-34-45-56-572"},
1106 /* 74 */ {TRUE
, "S-1-5-22"}, {FALSE
, "S-1-5-21-12-23-34-45-56-521"}, {TRUE
, "S-1-5-32-573"}
1109 static void test_CreateWellKnownSid()
1111 SID_IDENTIFIER_AUTHORITY ident
= { SECURITY_NT_AUTHORITY
};
1115 if (!pCreateWellKnownSid
)
1117 skip("CreateWellKnownSid not available\n");
1121 /* a domain sid usually have three subauthorities but we test that CreateWellKnownSid doesn't check it */
1122 AllocateAndInitializeSid(&ident
, 6, SECURITY_NT_NON_UNIQUE
, 12, 23, 34, 45, 56, 0, 0, &domainsid
);
1124 for (i
= 0; i
< sizeof(well_known_sid_values
)/sizeof(well_known_sid_values
[0]); i
++)
1126 struct well_known_sid_value
*value
= &well_known_sid_values
[i
];
1127 char sid_buffer
[SECURITY_MAX_SID_SIZE
];
1131 if (value
->sid_string
== NULL
)
1134 if (i
>= WinBuiltinTerminalServerLicenseServersSid
+ 1)
1136 /* These SIDs aren't implemented by all Windows versions - detect it and break the loop */
1137 cb
= sizeof(sid_buffer
);
1138 if (!pCreateWellKnownSid(i
, domainsid
, sid_buffer
, &cb
))
1140 skip("Well know SIDs starting from %d are not implemented\n", i
);
1145 cb
= sizeof(sid_buffer
);
1146 ok(CreateWellKnownSid(i
, value
->without_domain
? NULL
: domainsid
, sid_buffer
, &cb
), "Couldn't create well known sid %d\n", i
);
1147 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer
)), cb
, DWORD
, "%d");
1148 ok(IsValidSid(sid_buffer
), "The sid is not valid\n");
1149 ok(ConvertSidToStringSid(sid_buffer
, &str
), "Couldn't convert SID to string\n");
1150 ok(strcmp(str
, value
->sid_string
) == 0, "SID mismatch - expected %s, got %s\n",
1151 value
->sid_string
, str
);
1154 if (value
->without_domain
)
1156 char buf2
[SECURITY_MAX_SID_SIZE
];
1158 ok(CreateWellKnownSid(i
, domainsid
, buf2
, &cb
), "Couldn't create well known sid %d with optional domain\n", i
);
1159 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer
)), cb
, DWORD
, "%d");
1160 ok(memcmp(buf2
, sid_buffer
, cb
) == 0, "SID create with domain is different than without (%d)\n", i
);
1165 static void test_LookupAccountSid(void)
1167 SID_IDENTIFIER_AUTHORITY SIDAuthNT
= { SECURITY_NT_AUTHORITY
};
1168 CHAR accountA
[MAX_PATH
], domainA
[MAX_PATH
];
1169 DWORD acc_sizeA
, dom_sizeA
;
1170 DWORD real_acc_sizeA
, real_dom_sizeA
;
1171 WCHAR accountW
[MAX_PATH
], domainW
[MAX_PATH
];
1172 DWORD acc_sizeW
, dom_sizeW
;
1173 DWORD real_acc_sizeW
, real_dom_sizeW
;
1174 PSID pUsersSid
= NULL
;
1182 /* native windows crashes if account size, domain size, or name use is NULL */
1184 ret
= AllocateAndInitializeSid(&SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
1185 DOMAIN_ALIAS_RID_USERS
, 0, 0, 0, 0, 0, 0, &pUsersSid
);
1186 ok(ret
|| (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
),
1187 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1189 /* not running on NT so give up */
1190 if (!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1193 real_acc_sizeA
= MAX_PATH
;
1194 real_dom_sizeA
= MAX_PATH
;
1195 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &real_acc_sizeA
, domainA
, &real_dom_sizeA
, &use
);
1196 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1198 /* try NULL account */
1199 acc_sizeA
= MAX_PATH
;
1200 dom_sizeA
= MAX_PATH
;
1201 ret
= LookupAccountSidA(NULL
, pUsersSid
, NULL
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1202 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1204 /* try NULL domain */
1205 acc_sizeA
= MAX_PATH
;
1206 dom_sizeA
= MAX_PATH
;
1207 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, NULL
, &dom_sizeA
, &use
);
1208 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1210 /* try a small account buffer */
1212 dom_sizeA
= MAX_PATH
;
1214 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1215 ok(!ret
, "LookupAccountSidA() Expected FALSE got TRUE\n");
1216 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1217 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1219 /* try a 0 sized account buffer */
1221 dom_sizeA
= MAX_PATH
;
1223 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1224 /* this can fail or succeed depending on OS version but the size will always be returned */
1225 ok(acc_sizeA
== real_acc_sizeA
+ 1,
1226 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1227 real_acc_sizeA
+ 1, acc_sizeA
);
1229 /* try a 0 sized account buffer */
1231 dom_sizeA
= MAX_PATH
;
1232 ret
= LookupAccountSidA(NULL
, pUsersSid
, NULL
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1233 /* this can fail or succeed depending on OS version but the size will always be returned */
1234 ok(acc_sizeA
== real_acc_sizeA
+ 1,
1235 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1236 real_acc_sizeA
+ 1, acc_sizeA
);
1238 /* try a small domain buffer */
1240 acc_sizeA
= MAX_PATH
;
1242 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1243 ok(!ret
, "LookupAccountSidA() Expected FALSE got TRUE\n");
1244 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1245 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1247 /* try a 0 sized domain buffer */
1249 acc_sizeA
= MAX_PATH
;
1251 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
1252 /* this can fail or succeed depending on OS version but the size will always be returned */
1253 ok(dom_sizeA
== real_dom_sizeA
+ 1,
1254 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1255 real_dom_sizeA
+ 1, dom_sizeA
);
1257 /* try a 0 sized domain buffer */
1259 acc_sizeA
= MAX_PATH
;
1260 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, NULL
, &dom_sizeA
, &use
);
1261 /* this can fail or succeed depending on OS version but the size will always be returned */
1262 ok(dom_sizeA
== real_dom_sizeA
+ 1,
1263 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1264 real_dom_sizeA
+ 1, dom_sizeA
);
1266 real_acc_sizeW
= MAX_PATH
;
1267 real_dom_sizeW
= MAX_PATH
;
1268 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &real_acc_sizeW
, domainW
, &real_dom_sizeW
, &use
);
1269 ok(ret
, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1271 /* native windows crashes if domainW or accountW is NULL */
1273 /* try a small account buffer */
1275 dom_sizeW
= MAX_PATH
;
1277 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1278 ok(!ret
, "LookupAccountSidW() Expected FALSE got TRUE\n");
1279 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1280 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1282 /* try a 0 sized account buffer */
1284 dom_sizeW
= MAX_PATH
;
1286 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1287 /* this can fail or succeed depending on OS version but the size will always be returned */
1288 ok(acc_sizeW
== real_acc_sizeW
+ 1,
1289 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1290 real_acc_sizeW
+ 1, acc_sizeW
);
1292 /* try a 0 sized account buffer */
1294 dom_sizeW
= MAX_PATH
;
1295 ret
= LookupAccountSidW(NULL
, pUsersSid
, NULL
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1296 /* this can fail or succeed depending on OS version but the size will always be returned */
1297 ok(acc_sizeW
== real_acc_sizeW
+ 1,
1298 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1299 real_acc_sizeW
+ 1, acc_sizeW
);
1301 /* try a small domain buffer */
1303 acc_sizeW
= MAX_PATH
;
1305 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1306 ok(!ret
, "LookupAccountSidW() Expected FALSE got TRUE\n");
1307 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1308 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1310 /* try a 0 sized domain buffer */
1312 acc_sizeW
= MAX_PATH
;
1314 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1315 /* this can fail or succeed depending on OS version but the size will always be returned */
1316 ok(dom_sizeW
== real_dom_sizeW
+ 1,
1317 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1318 real_dom_sizeW
+ 1, dom_sizeW
);
1320 /* try a 0 sized domain buffer */
1322 acc_sizeW
= MAX_PATH
;
1323 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, NULL
, &dom_sizeW
, &use
);
1324 /* this can fail or succeed depending on OS version but the size will always be returned */
1325 ok(dom_sizeW
== real_dom_sizeW
+ 1,
1326 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1327 real_dom_sizeW
+ 1, dom_sizeW
);
1331 if (pCreateWellKnownSid
&& pConvertSidToStringSidA
)
1333 trace("Well Known SIDs:\n");
1334 for (i
= 0; i
<= 60; i
++)
1336 size
= SECURITY_MAX_SID_SIZE
;
1337 if (pCreateWellKnownSid(i
, NULL
, &max_sid
.sid
, &size
))
1339 if (pConvertSidToStringSidA(&max_sid
.sid
, &str_sidA
))
1341 acc_sizeA
= MAX_PATH
;
1342 dom_sizeA
= MAX_PATH
;
1343 if (LookupAccountSidA(NULL
, &max_sid
.sid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
))
1344 trace(" %d: %s %s\\%s %d\n", i
, str_sidA
, domainA
, accountA
, use
);
1345 LocalFree(str_sidA
);
1350 if (GetLastError() != ERROR_INVALID_PARAMETER
)
1351 trace(" CreateWellKnownSid(%d) failed: %d\n", i
, GetLastError());
1353 trace(" %d: not supported\n", i
);
1357 pLsaQueryInformationPolicy
= (fnLsaQueryInformationPolicy
)GetProcAddress( hmod
, "LsaQueryInformationPolicy");
1358 pLsaOpenPolicy
= (fnLsaOpenPolicy
)GetProcAddress( hmod
, "LsaOpenPolicy");
1359 pLsaFreeMemory
= (fnLsaFreeMemory
)GetProcAddress( hmod
, "LsaFreeMemory");
1360 pLsaClose
= (fnLsaClose
)GetProcAddress( hmod
, "LsaClose");
1362 if (pLsaQueryInformationPolicy
&& pLsaOpenPolicy
&& pLsaFreeMemory
&& pLsaClose
)
1366 LSA_OBJECT_ATTRIBUTES object_attributes
;
1368 ZeroMemory(&object_attributes
, sizeof(object_attributes
));
1369 object_attributes
.Length
= sizeof(object_attributes
);
1371 status
= pLsaOpenPolicy( NULL
, &object_attributes
, POLICY_ALL_ACCESS
, &handle
);
1372 ok(status
== STATUS_SUCCESS
|| status
== STATUS_ACCESS_DENIED
,
1373 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status
);
1375 /* try a more restricted access mask if necessary */
1376 if (status
== STATUS_ACCESS_DENIED
) {
1377 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
1378 status
= pLsaOpenPolicy( NULL
, &object_attributes
, POLICY_VIEW_LOCAL_INFORMATION
, &handle
);
1379 ok(status
== STATUS_SUCCESS
, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status
);
1382 if (status
== STATUS_SUCCESS
)
1384 PPOLICY_ACCOUNT_DOMAIN_INFO info
;
1385 status
= pLsaQueryInformationPolicy(handle
, PolicyAccountDomainInformation
, (PVOID
*)&info
);
1386 ok(status
== STATUS_SUCCESS
, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status
);
1387 if (status
== STATUS_SUCCESS
)
1389 ok(info
->DomainSid
!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
1390 if (info
->DomainSid
)
1392 int count
= *GetSidSubAuthorityCount(info
->DomainSid
);
1393 CopySid(GetSidLengthRequired(count
), &max_sid
, info
->DomainSid
);
1394 test_sid_str((PSID
)&max_sid
.sid
);
1395 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_USER_RID_ADMIN
;
1396 max_sid
.sid
.SubAuthorityCount
= count
+ 1;
1397 test_sid_str((PSID
)&max_sid
.sid
);
1398 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_USER_RID_GUEST
;
1399 test_sid_str((PSID
)&max_sid
.sid
);
1400 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_ADMINS
;
1401 test_sid_str((PSID
)&max_sid
.sid
);
1402 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_USERS
;
1403 test_sid_str((PSID
)&max_sid
.sid
);
1404 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_GUESTS
;
1405 test_sid_str((PSID
)&max_sid
.sid
);
1406 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_COMPUTERS
;
1407 test_sid_str((PSID
)&max_sid
.sid
);
1408 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_CONTROLLERS
;
1409 test_sid_str((PSID
)&max_sid
.sid
);
1410 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_CERT_ADMINS
;
1411 test_sid_str((PSID
)&max_sid
.sid
);
1412 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_SCHEMA_ADMINS
;
1413 test_sid_str((PSID
)&max_sid
.sid
);
1414 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS
;
1415 test_sid_str((PSID
)&max_sid
.sid
);
1416 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_POLICY_ADMINS
;
1417 test_sid_str((PSID
)&max_sid
.sid
);
1418 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_ALIAS_RID_RAS_SERVERS
;
1419 test_sid_str((PSID
)&max_sid
.sid
);
1420 max_sid
.sid
.SubAuthority
[count
] = 1000; /* first user account */
1421 test_sid_str((PSID
)&max_sid
.sid
);
1424 pLsaFreeMemory((LPVOID
)info
);
1427 status
= pLsaClose(handle
);
1428 ok(status
== STATUS_SUCCESS
, "LsaClose() failed, returned 0x%08x\n", status
);
1434 static void get_sid_info(PSID psid
, LPSTR
*user
, LPSTR
*dom
)
1436 static CHAR account
[UNLEN
+ 1];
1437 static CHAR domain
[UNLEN
+ 1];
1438 DWORD size
, dom_size
;
1444 size
= dom_size
= UNLEN
+ 1;
1447 LookupAccountSidA(NULL
, psid
, account
, &size
, domain
, &dom_size
, &use
);
1450 static void test_LookupAccountName(void)
1452 DWORD sid_size
, domain_size
, user_size
;
1453 DWORD sid_save
, domain_save
;
1454 CHAR user_name
[UNLEN
+ 1];
1455 SID_NAME_USE sid_use
;
1456 LPSTR domain
, account
, sid_dom
;
1460 /* native crashes if (assuming all other parameters correct):
1462 * - Sid is NULL and cbSid is > 0
1463 * - cbSid or cchReferencedDomainName are NULL
1464 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
1467 user_size
= UNLEN
+ 1;
1468 SetLastError(0xdeadbeef);
1469 ret
= GetUserNameA(user_name
, &user_size
);
1470 if (!ret
&& (GetLastError() == ERROR_NOT_LOGGED_ON
))
1472 /* Probably on win9x where the user used 'Cancel' instead of properly logging in */
1473 skip("Cannot get the user name (win9x and not logged in properly)\n");
1476 ok(ret
, "Failed to get user name : %d\n", GetLastError());
1481 sid_use
= 0xcafebabe;
1482 SetLastError(0xdeadbeef);
1483 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1484 if(!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1486 skip("LookupAccountNameA is not implemented\n");
1489 ok(!ret
, "Expected 0, got %d\n", ret
);
1490 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1491 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1492 ok(sid_size
!= 0, "Expected non-zero sid size\n");
1493 ok(domain_size
!= 0, "Expected non-zero domain size\n");
1494 ok(sid_use
== 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use
);
1496 sid_save
= sid_size
;
1497 domain_save
= domain_size
;
1499 psid
= HeapAlloc(GetProcessHeap(), 0, sid_size
);
1500 domain
= HeapAlloc(GetProcessHeap(), 0, domain_size
);
1502 /* try valid account name */
1503 ret
= LookupAccountNameA(NULL
, user_name
, psid
, &sid_size
, domain
, &domain_size
, &sid_use
);
1504 get_sid_info(psid
, &account
, &sid_dom
);
1505 ok(ret
, "Failed to lookup account name\n");
1506 ok(sid_size
== GetLengthSid(psid
), "Expected %d, got %d\n", GetLengthSid(psid
), sid_size
);
1509 ok(!lstrcmp(account
, user_name
), "Expected %s, got %s\n", user_name
, account
);
1510 ok(!lstrcmp(domain
, sid_dom
), "Expected %s, got %s\n", sid_dom
, domain
);
1511 ok(domain_size
== domain_save
- 1, "Expected %d, got %d\n", domain_save
- 1, domain_size
);
1512 ok(lstrlen(domain
) == domain_size
, "Expected %d\n", lstrlen(domain
));
1513 ok(sid_use
== SidTypeUser
, "Expected SidTypeUser, got %d\n", SidTypeUser
);
1515 domain_size
= domain_save
;
1517 /* NULL Sid with zero sid size */
1518 SetLastError(0xdeadbeef);
1520 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, domain
, &domain_size
, &sid_use
);
1521 ok(!ret
, "Expected 0, got %d\n", ret
);
1522 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1523 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1524 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1525 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1527 /* try cchReferencedDomainName - 1 */
1528 SetLastError(0xdeadbeef);
1530 ret
= LookupAccountNameA(NULL
, user_name
, NULL
, &sid_size
, domain
, &domain_size
, &sid_use
);
1531 ok(!ret
, "Expected 0, got %d\n", ret
);
1532 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1533 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1534 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1535 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1537 /* NULL ReferencedDomainName with zero domain name size */
1538 SetLastError(0xdeadbeef);
1540 ret
= LookupAccountNameA(NULL
, user_name
, psid
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1541 ok(!ret
, "Expected 0, got %d\n", ret
);
1542 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1543 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1544 ok(sid_size
== sid_save
, "Expected %d, got %d\n", sid_save
, sid_size
);
1545 ok(domain_size
== domain_save
, "Expected %d, got %d\n", domain_save
, domain_size
);
1547 HeapFree(GetProcessHeap(), 0, psid
);
1548 HeapFree(GetProcessHeap(), 0, domain
);
1550 /* get sizes for NULL account name */
1553 sid_use
= 0xcafebabe;
1554 SetLastError(0xdeadbeef);
1555 ret
= LookupAccountNameA(NULL
, NULL
, NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1556 ok(!ret
, "Expected 0, got %d\n", ret
);
1557 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1558 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1559 ok(sid_size
!= 0, "Expected non-zero sid size\n");
1560 ok(domain_size
!= 0, "Expected non-zero domain size\n");
1561 ok(sid_use
== 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use
);
1563 psid
= HeapAlloc(GetProcessHeap(), 0, sid_size
);
1564 domain
= HeapAlloc(GetProcessHeap(), 0, domain_size
);
1566 /* try NULL account name */
1567 ret
= LookupAccountNameA(NULL
, NULL
, psid
, &sid_size
, domain
, &domain_size
, &sid_use
);
1568 get_sid_info(psid
, &account
, &sid_dom
);
1569 ok(ret
, "Failed to lookup account name\n");
1572 /* Using a fixed string will not work on different locales */
1573 ok(!lstrcmp(account
, domain
),
1574 "Got %s for account and %s for domain, these should be the same\n",
1576 ok(sid_use
== SidTypeDomain
, "Expected SidTypeDomain, got %d\n", SidTypeDomain
);
1579 /* try an invalid account name */
1580 SetLastError(0xdeadbeef);
1583 ret
= LookupAccountNameA(NULL
, "oogabooga", NULL
, &sid_size
, NULL
, &domain_size
, &sid_use
);
1584 ok(!ret
, "Expected 0, got %d\n", ret
);
1587 ok(GetLastError() == ERROR_NONE_MAPPED
,
1588 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
1589 ok(sid_size
== 0, "Expected 0, got %d\n", sid_size
);
1590 ok(domain_size
== 0, "Expected 0, got %d\n", domain_size
);
1593 HeapFree(GetProcessHeap(), 0, psid
);
1594 HeapFree(GetProcessHeap(), 0, domain
);
1597 static void test_security_descriptor(void)
1599 SECURITY_DESCRIPTOR sd
;
1602 BOOL isDefault
, isPresent
;
1606 InitializeSecurityDescriptor(&sd
, SECURITY_DESCRIPTOR_REVISION
);
1607 ok(GetSecurityDescriptorOwner(&sd
, &psid
, &isDefault
), "GetSecurityDescriptorOwner failed\n");
1608 expect_eq(psid
, NULL
, PSID
, "%p");
1609 expect_eq(isDefault
, FALSE
, BOOL
, "%d");
1610 sd
.Control
|= SE_DACL_PRESENT
| SE_SACL_PRESENT
;
1612 SetLastError(0xdeadbeef);
1614 expect_eq(MakeSelfRelativeSD(&sd
, buf
, &size
), FALSE
, BOOL
, "%d");
1615 expect_eq(GetLastError(), ERROR_INSUFFICIENT_BUFFER
, DWORD
, "%u");
1616 ok(size
> 5, "Size not increased\n");
1619 expect_eq(MakeSelfRelativeSD(&sd
, buf
, &size
), TRUE
, BOOL
, "%d");
1620 ok(GetSecurityDescriptorOwner(&sd
, &psid
, &isDefault
), "GetSecurityDescriptorOwner failed\n");
1621 expect_eq(psid
, NULL
, PSID
, "%p");
1622 expect_eq(isDefault
, FALSE
, BOOL
, "%d");
1623 ok(GetSecurityDescriptorGroup(&sd
, &psid
, &isDefault
), "GetSecurityDescriptorOwner failed\n");
1624 expect_eq(psid
, NULL
, PSID
, "%p");
1625 expect_eq(isDefault
, FALSE
, BOOL
, "%d");
1626 ok(GetSecurityDescriptorDacl(&sd
, &isPresent
, &pacl
, &isDefault
), "GetSecurityDescriptorOwner failed\n");
1627 expect_eq(isPresent
, TRUE
, BOOL
, "%d");
1628 expect_eq(psid
, NULL
, PSID
, "%p");
1629 expect_eq(isDefault
, FALSE
, BOOL
, "%d");
1630 ok(GetSecurityDescriptorSacl(&sd
, &isPresent
, &pacl
, &isDefault
), "GetSecurityDescriptorOwner failed\n");
1631 expect_eq(isPresent
, TRUE
, BOOL
, "%d");
1632 expect_eq(psid
, NULL
, PSID
, "%p");
1633 expect_eq(isDefault
, FALSE
, BOOL
, "%d");
1637 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,__LINE__)
1638 static void test_granted_access(HANDLE handle
, ACCESS_MASK access
, int line
)
1640 OBJECT_BASIC_INFORMATION obj_info
;
1643 if (!pNtQueryObject
)
1645 skip_(__FILE__
, line
)("Not NT platform - skipping tests\n");
1649 status
= pNtQueryObject( handle
, ObjectBasicInformation
, &obj_info
,
1650 sizeof(obj_info
), NULL
);
1651 ok_(__FILE__
, line
)(!status
, "NtQueryObject with err: %08x\n", status
);
1652 ok_(__FILE__
, line
)(obj_info
.GrantedAccess
== access
, "Granted access should "
1653 "be 0x%08x, instead of 0x%08x\n", access
, obj_info
.GrantedAccess
);
1656 #define CHECK_SET_SECURITY(o,i,e) \
1660 SetLastError( 0xdeadbeef ); \
1661 res = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
1662 err = GetLastError(); \
1663 if (e == ERROR_SUCCESS) \
1664 ok(res, "SetKernelObjectSecurity failed with %d\n", err); \
1666 ok(!res && err == e, "SetKernelObjectSecurity should have failed " \
1667 "with %s, instead of %d\n", #e, err); \
1670 static void test_process_security(void)
1673 char owner
[32], group
[32];
1674 PSID AdminSid
= NULL
, UsersSid
= NULL
;
1676 SECURITY_DESCRIPTOR
*SecurityDescriptor
= NULL
;
1677 char buffer
[MAX_PATH
];
1678 PROCESS_INFORMATION info
;
1679 STARTUPINFOA startup
;
1680 SECURITY_ATTRIBUTES psa
;
1681 HANDLE token
, event
;
1684 Acl
= HeapAlloc(GetProcessHeap(), 0, 256);
1685 res
= InitializeAcl(Acl
, 256, ACL_REVISION
);
1686 if (!res
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
1688 skip("ACLs not implemented - skipping tests\n");
1689 HeapFree(GetProcessHeap(), 0, Acl
);
1692 ok(res
, "InitializeAcl failed with error %d\n", GetLastError());
1694 /* get owner from the token we might be running as a user not admin */
1695 res
= OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED
, &token
);
1696 ok(res
, "OpenProcessToken failed with error %d\n", GetLastError());
1699 HeapFree(GetProcessHeap(), 0, Acl
);
1703 res
= GetTokenInformation( token
, TokenOwner
, owner
, sizeof(owner
), &tmp
);
1704 ok(res
, "GetTokenInformation failed with error %d\n", GetLastError());
1705 AdminSid
= ((TOKEN_OWNER
*)owner
)->Owner
;
1706 res
= GetTokenInformation( token
, TokenPrimaryGroup
, group
, sizeof(group
), &tmp
);
1707 ok(res
, "GetTokenInformation failed with error %d\n", GetLastError());
1708 UsersSid
= ((TOKEN_PRIMARY_GROUP
*)group
)->PrimaryGroup
;
1710 CloseHandle( token
);
1713 HeapFree(GetProcessHeap(), 0, Acl
);
1717 res
= AddAccessDeniedAce(Acl
, ACL_REVISION
, PROCESS_VM_READ
, AdminSid
);
1718 ok(res
, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1719 res
= AddAccessAllowedAce(Acl
, ACL_REVISION
, PROCESS_ALL_ACCESS
, AdminSid
);
1720 ok(res
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1722 SecurityDescriptor
= HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH
);
1723 res
= InitializeSecurityDescriptor(SecurityDescriptor
, SECURITY_DESCRIPTOR_REVISION
);
1724 ok(res
, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1726 event
= CreateEvent( NULL
, TRUE
, TRUE
, "test_event" );
1727 ok(event
!= NULL
, "CreateEvent %d\n", GetLastError());
1729 SecurityDescriptor
->Revision
= 0;
1730 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_UNKNOWN_REVISION
);
1731 SecurityDescriptor
->Revision
= SECURITY_DESCRIPTOR_REVISION
;
1733 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_INVALID_SECURITY_DESCR
);
1734 CHECK_SET_SECURITY( event
, GROUP_SECURITY_INFORMATION
, ERROR_INVALID_SECURITY_DESCR
);
1735 CHECK_SET_SECURITY( event
, SACL_SECURITY_INFORMATION
, ERROR_ACCESS_DENIED
);
1736 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1737 /* NULL DACL is valid and means default DACL from token */
1738 SecurityDescriptor
->Control
|= SE_DACL_PRESENT
;
1739 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1741 /* Set owner and group and dacl */
1742 res
= SetSecurityDescriptorOwner(SecurityDescriptor
, AdminSid
, FALSE
);
1743 ok(res
, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1744 CHECK_SET_SECURITY( event
, OWNER_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1745 res
= SetSecurityDescriptorGroup(SecurityDescriptor
, UsersSid
, FALSE
);
1746 ok(res
, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1747 CHECK_SET_SECURITY( event
, GROUP_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1748 res
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
1749 ok(res
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1750 CHECK_SET_SECURITY( event
, DACL_SECURITY_INFORMATION
, ERROR_SUCCESS
);
1752 sprintf(buffer
, "%s tests/security.c test", myARGV
[0]);
1753 memset(&startup
, 0, sizeof(startup
));
1754 startup
.cb
= sizeof(startup
);
1755 startup
.dwFlags
= STARTF_USESHOWWINDOW
;
1756 startup
.wShowWindow
= SW_SHOWNORMAL
;
1758 psa
.nLength
= sizeof(psa
);
1759 psa
.lpSecurityDescriptor
= SecurityDescriptor
;
1760 psa
.bInheritHandle
= TRUE
;
1762 /* Doesn't matter what ACL say we should get full access for ourselves */
1763 ok(CreateProcessA( NULL
, buffer
, &psa
, NULL
, FALSE
, 0, NULL
, NULL
, &startup
, &info
),
1764 "CreateProcess with err:%d\n", GetLastError());
1765 TEST_GRANTED_ACCESS( info
.hProcess
, PROCESS_ALL_ACCESS
);
1766 ok(WaitForSingleObject(info
.hProcess
, 30000) == WAIT_OBJECT_0
, "Child process termination\n");
1768 CloseHandle( event
);
1769 HeapFree(GetProcessHeap(), 0, Acl
);
1770 HeapFree(GetProcessHeap(), 0, SecurityDescriptor
);
1773 static void test_process_security_child(void)
1775 HANDLE handle
, handle1
;
1779 handle
= OpenProcess( PROCESS_TERMINATE
, FALSE
, GetCurrentProcessId() );
1780 ok(handle
!= NULL
, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
1781 TEST_GRANTED_ACCESS( handle
, PROCESS_TERMINATE
);
1783 ok(DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1784 &handle1
, 0, TRUE
, DUPLICATE_SAME_ACCESS
),
1785 "duplicating handle err:%d\n", GetLastError());
1786 TEST_GRANTED_ACCESS( handle1
, PROCESS_TERMINATE
);
1788 CloseHandle( handle1
);
1790 SetLastError( 0xdeadbeef );
1791 ret
= DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1792 &handle1
, PROCESS_ALL_ACCESS
, TRUE
, 0 );
1793 err
= GetLastError();
1795 ok(!ret
&& err
== ERROR_ACCESS_DENIED
, "duplicating handle should have failed "
1796 "with STATUS_ACCESS_DENIED, instead of err:%d\n", err
);
1798 CloseHandle( handle
);
1800 /* These two should fail - they are denied by ACL */
1801 handle
= OpenProcess( PROCESS_VM_READ
, FALSE
, GetCurrentProcessId() );
1803 ok(handle
== NULL
, "OpenProcess(PROCESS_VM_READ) should have failed\n");
1804 handle
= OpenProcess( PROCESS_ALL_ACCESS
, FALSE
, GetCurrentProcessId() );
1806 ok(handle
== NULL
, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
1808 /* Documented privilege elevation */
1809 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1810 &handle
, 0, TRUE
, DUPLICATE_SAME_ACCESS
),
1811 "duplicating handle err:%d\n", GetLastError());
1812 TEST_GRANTED_ACCESS( handle
, PROCESS_ALL_ACCESS
);
1814 CloseHandle( handle
);
1816 /* Same only explicitly asking for all access rights */
1817 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1818 &handle
, PROCESS_ALL_ACCESS
, TRUE
, 0 ),
1819 "duplicating handle err:%d\n", GetLastError());
1820 TEST_GRANTED_ACCESS( handle
, PROCESS_ALL_ACCESS
);
1821 ok(DuplicateHandle( GetCurrentProcess(), handle
, GetCurrentProcess(),
1822 &handle1
, PROCESS_VM_READ
, TRUE
, 0 ),
1823 "duplicating handle err:%d\n", GetLastError());
1824 TEST_GRANTED_ACCESS( handle1
, PROCESS_VM_READ
);
1825 CloseHandle( handle1
);
1826 CloseHandle( handle
);
1829 static void test_impersonation_level(void)
1831 HANDLE Token
, ProcessToken
;
1834 TOKEN_PRIVILEGES
*Privileges
;
1836 PRIVILEGE_SET
*PrivilegeSet
;
1842 pDuplicateTokenEx
= (fnDuplicateTokenEx
) GetProcAddress(hmod
, "DuplicateTokenEx");
1843 if( !pDuplicateTokenEx
) {
1844 skip("DuplicateTokenEx is not available\n");
1847 SetLastError(0xdeadbeef);
1848 ret
= ImpersonateSelf(SecurityAnonymous
);
1849 if(!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1851 skip("ImpersonateSelf is not implemented\n");
1854 ok(ret
, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
1855 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1856 ok(!ret
, "OpenThreadToken should have failed\n");
1857 error
= GetLastError();
1858 ok(error
== ERROR_CANT_OPEN_ANONYMOUS
, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error
);
1859 /* can't perform access check when opening object against an anonymous impersonation token */
1861 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1862 ok(error
== ERROR_INVALID_HANDLE
, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error
);
1866 ret
= OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE
, &ProcessToken
);
1867 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
1869 ret
= pDuplicateTokenEx(ProcessToken
,
1870 TOKEN_QUERY
| TOKEN_DUPLICATE
| TOKEN_IMPERSONATE
, NULL
,
1871 SecurityAnonymous
, TokenImpersonation
, &Token
);
1872 ok(ret
, "DuplicateTokenEx failed with error %d\n", GetLastError());
1873 /* can't increase the impersonation level */
1874 ret
= DuplicateToken(Token
, SecurityIdentification
, &Token2
);
1875 error
= GetLastError();
1876 ok(!ret
&& error
== ERROR_BAD_IMPERSONATION_LEVEL
,
1877 "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error
);
1878 /* we can query anything from an anonymous token, including the user */
1879 ret
= GetTokenInformation(Token
, TokenUser
, NULL
, 0, &Size
);
1880 error
= GetLastError();
1881 ok(!ret
&& error
== ERROR_INSUFFICIENT_BUFFER
, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error
);
1882 User
= (TOKEN_USER
*)HeapAlloc(GetProcessHeap(), 0, Size
);
1883 ret
= GetTokenInformation(Token
, TokenUser
, User
, Size
, &Size
);
1884 ok(ret
, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1885 HeapFree(GetProcessHeap(), 0, User
);
1887 /* PrivilegeCheck fails with SecurityAnonymous level */
1888 ret
= GetTokenInformation(Token
, TokenPrivileges
, NULL
, 0, &Size
);
1889 error
= GetLastError();
1890 ok(!ret
&& error
== ERROR_INSUFFICIENT_BUFFER
, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error
);
1891 Privileges
= (TOKEN_PRIVILEGES
*)HeapAlloc(GetProcessHeap(), 0, Size
);
1892 ret
= GetTokenInformation(Token
, TokenPrivileges
, Privileges
, Size
, &Size
);
1893 ok(ret
, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1895 PrivilegeSet
= (PRIVILEGE_SET
*)HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET
, Privilege
[Privileges
->PrivilegeCount
]));
1896 PrivilegeSet
->PrivilegeCount
= Privileges
->PrivilegeCount
;
1897 memcpy(PrivilegeSet
->Privilege
, Privileges
->Privileges
, PrivilegeSet
->PrivilegeCount
* sizeof(PrivilegeSet
->Privilege
[0]));
1898 PrivilegeSet
->Control
= PRIVILEGE_SET_ALL_NECESSARY
;
1899 HeapFree(GetProcessHeap(), 0, Privileges
);
1901 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1902 error
= GetLastError();
1903 ok(!ret
&& error
== ERROR_BAD_IMPERSONATION_LEVEL
, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error
);
1907 ret
= ImpersonateSelf(SecurityIdentification
);
1908 ok(ret
, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
1909 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1910 ok(ret
, "OpenThreadToken failed with error %d\n", GetLastError());
1912 /* can't perform access check when opening object against an identification impersonation token */
1913 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1915 ok(error
== ERROR_INVALID_HANDLE
, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error
);
1917 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1918 ok(ret
, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
1922 ret
= ImpersonateSelf(SecurityImpersonation
);
1923 ok(ret
, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
1924 ret
= OpenThreadToken(GetCurrentThread(), TOKEN_QUERY
| TOKEN_ADJUST_PRIVILEGES
| TOKEN_QUERY_SOURCE
| TOKEN_IMPERSONATE
| TOKEN_ADJUST_DEFAULT
, TRUE
, &Token
);
1925 ok(ret
, "OpenThreadToken failed with error %d\n", GetLastError());
1926 error
= RegOpenKeyEx(HKEY_CURRENT_USER
, "Software", 0, KEY_READ
, &hkey
);
1927 ok(error
== ERROR_SUCCESS
, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error
);
1929 ret
= PrivilegeCheck(Token
, PrivilegeSet
, &AccessGranted
);
1930 ok(ret
, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
1934 CloseHandle(ProcessToken
);
1936 HeapFree(GetProcessHeap(), 0, PrivilegeSet
);
1939 static void test_SetEntriesInAcl(void)
1941 ACL
*acl
= (ACL
*)0xdeadbeef;
1944 if (!pSetEntriesInAclW
)
1946 skip("SetEntriesInAclW is not available\n");
1950 res
= pSetEntriesInAclW(0, NULL
, NULL
, &acl
);
1951 if(res
== ERROR_CALL_NOT_IMPLEMENTED
)
1953 skip("SetEntriesInAclW is not implemented\n");
1956 ok(res
== ERROR_SUCCESS
, "SetEntriesInAclW failed: %u\n", res
);
1957 ok(acl
== NULL
, "acl=%p, expected NULL\n", acl
);
1960 static void test_GetNamedSecurityInfoA(void)
1962 PSECURITY_DESCRIPTOR pSecDesc
;
1964 SECURITY_DESCRIPTOR_CONTROL control
;
1967 BOOL owner_defaulted
;
1968 BOOL group_defaulted
;
1971 CHAR windows_dir
[MAX_PATH
];
1973 if (!pGetNamedSecurityInfoA
)
1975 skip("GetNamedSecurityInfoA is not available\n");
1979 ret
= GetWindowsDirectoryA(windows_dir
, MAX_PATH
);
1980 ok(ret
, "GetWindowsDirectory failed with error %d\n", GetLastError());
1982 SetLastError(0xdeadbeef);
1983 error
= pGetNamedSecurityInfoA(windows_dir
, SE_FILE_OBJECT
,
1984 OWNER_SECURITY_INFORMATION
|GROUP_SECURITY_INFORMATION
|DACL_SECURITY_INFORMATION
,
1985 NULL
, NULL
, NULL
, NULL
, &pSecDesc
);
1986 if (error
!= ERROR_SUCCESS
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
1988 skip("GetNamedSecurityInfoA is not implemented\n");
1991 ok(!error
, "GetNamedSecurityInfo failed with error %d\n", error
);
1993 ret
= GetSecurityDescriptorControl(pSecDesc
, &control
, &revision
);
1994 ok(ret
, "GetSecurityDescriptorControl failed with error %d\n", GetLastError());
1995 ok((control
& (SE_SELF_RELATIVE
|SE_DACL_PRESENT
)) == (SE_SELF_RELATIVE
|SE_DACL_PRESENT
),
1996 "control (0x%x) doesn't have (SE_SELF_RELATIVE|SE_DACL_PRESENT) flags set\n", control
);
1997 ok(revision
== SECURITY_DESCRIPTOR_REVISION1
, "revision was %d instead of 1\n", revision
);
1998 ret
= GetSecurityDescriptorOwner(pSecDesc
, &owner
, &owner_defaulted
);
1999 ok(ret
, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
2000 ok(owner
!= NULL
, "owner should not be NULL\n");
2001 ret
= GetSecurityDescriptorGroup(pSecDesc
, &group
, &group_defaulted
);
2002 ok(ret
, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2003 ok(group
!= NULL
, "group should not be NULL\n");
2006 static void test_ConvertStringSecurityDescriptor(void)
2009 PSECURITY_DESCRIPTOR pSD
;
2011 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA
)
2013 skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
2017 SetLastError(0xdeadbeef);
2018 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2019 "D:(A;;GA;;;WD)", 0xdeadbeef, &pSD
, NULL
);
2020 ok(!ret
&& GetLastError() == ERROR_UNKNOWN_REVISION
,
2021 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_UNKNOWN_REVISION instead of %d\n",
2024 /* test ACE string type */
2025 SetLastError(0xdeadbeef);
2026 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2027 "D:(A;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2028 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2031 SetLastError(0xdeadbeef);
2032 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2033 "D:(D;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2034 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2037 SetLastError(0xdeadbeef);
2038 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2039 "ERROR:(D;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2040 ok(!ret
&& GetLastError() == ERROR_INVALID_PARAMETER
,
2041 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
2044 /* test ACE string access rights */
2045 SetLastError(0xdeadbeef);
2046 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2047 "D:(A;;GA;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2048 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2050 SetLastError(0xdeadbeef);
2051 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2052 "D:(A;;GRGWGX;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2053 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2055 SetLastError(0xdeadbeef);
2056 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2057 "D:(A;;RCSDWDWO;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2058 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2060 SetLastError(0xdeadbeef);
2061 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2062 "D:(A;;RPWPCCDCLCSWLODTCR;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2063 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2065 SetLastError(0xdeadbeef);
2066 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2067 "D:(A;;FAFRFWFX;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2068 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2070 SetLastError(0xdeadbeef);
2071 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2072 "D:(A;;KAKRKWKX;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2073 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2075 SetLastError(0xdeadbeef);
2076 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2077 "D:(A;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2078 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2080 SetLastError(0xdeadbeef);
2081 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2082 "S:(AU;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2083 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2086 /* test ACE string access right error case */
2087 SetLastError(0xdeadbeef);
2088 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2089 "D:(A;;ROB;;;WD)", SDDL_REVISION_1
, &pSD
, NULL
);
2091 ok(!ret
&& GetLastError() == ERROR_INVALID_ACL
,
2092 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_ACL instead of %d\n",
2095 /* test ACE string SID */
2096 SetLastError(0xdeadbeef);
2097 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2098 "D:(D;;GA;;;S-1-0-0)", SDDL_REVISION_1
, &pSD
, NULL
);
2099 ok(ret
, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2102 SetLastError(0xdeadbeef);
2103 ret
= pConvertStringSecurityDescriptorToSecurityDescriptorA(
2104 "D:(D;;GA;;;Nonexistent account)", SDDL_REVISION_1
, &pSD
, NULL
);
2106 ok(!ret
&& GetLastError() == ERROR_INVALID_ACL
,
2107 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_ACL instead of %d\n",
2111 static void test_ConvertSecurityDescriptorToString()
2113 SECURITY_DESCRIPTOR desc
;
2114 SECURITY_INFORMATION sec_info
= OWNER_SECURITY_INFORMATION
|GROUP_SECURITY_INFORMATION
|DACL_SECURITY_INFORMATION
|SACL_SECURITY_INFORMATION
;
2123 if (!pConvertSecurityDescriptorToStringSecurityDescriptorA
)
2125 skip("ConvertSecurityDescriptorToStringSecurityDescriptor is not available\n");
2128 if (!pCreateWellKnownSid
)
2130 skip("CreateWellKnownSid is not available\n");
2134 /* It seems Windows XP adds an extra character to the length of the string for each ACE in an ACL. We
2135 * don't replicate this feature so we only test len >= strlen+1. */
2136 #define CHECK_RESULT_AND_FREE(exp_str) \
2137 ok(strcmp(string, (exp_str)) == 0, "String mismatch (expected \"%s\", got \"%s\")\n", (exp_str), string); \
2138 ok(len >= (strlen(exp_str) + 1), "Length mismatch (expected %d, got %d)\n", strlen(exp_str) + 1, len); \
2141 #define CHECK_ONE_OF_AND_FREE(exp_str1, exp_str2) \
2142 ok(strcmp(string, (exp_str1)) == 0 || strcmp(string, (exp_str2)) == 0, "String mismatch (expected\n\"%s\" or\n\"%s\", got\n\"%s\")\n", (exp_str1), (exp_str2), string); \
2143 ok(len >= (strlen(string) + 1), "Length mismatch (expected %d, got %d)\n", strlen(string) + 1, len); \
2146 InitializeSecurityDescriptor(&desc
, SECURITY_DESCRIPTOR_REVISION
);
2147 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2148 CHECK_RESULT_AND_FREE("");
2151 pCreateWellKnownSid(WinLocalSid
, NULL
, sid_buf
, &size
);
2152 SetSecurityDescriptorOwner(&desc
, (PSID
)sid_buf
, FALSE
);
2153 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2154 CHECK_RESULT_AND_FREE("O:S-1-2-0");
2156 SetSecurityDescriptorOwner(&desc
, (PSID
)sid_buf
, TRUE
);
2157 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2158 CHECK_RESULT_AND_FREE("O:S-1-2-0");
2160 size
= sizeof(sid_buf
);
2161 pCreateWellKnownSid(WinLocalSystemSid
, NULL
, sid_buf
, &size
);
2162 SetSecurityDescriptorOwner(&desc
, (PSID
)sid_buf
, TRUE
);
2163 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2164 CHECK_RESULT_AND_FREE("O:SY");
2166 ConvertStringSidToSid("S-1-5-21-93476-23408-4576", &psid
);
2167 SetSecurityDescriptorGroup(&desc
, psid
, TRUE
);
2168 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2169 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576");
2171 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, GROUP_SECURITY_INFORMATION
, &string
, &len
), "Conversion failed\n");
2172 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
2174 pacl
= (PACL
)acl_buf
;
2175 InitializeAcl(pacl
, sizeof(acl_buf
), ACL_REVISION
);
2176 SetSecurityDescriptorDacl(&desc
, TRUE
, pacl
, TRUE
);
2177 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2178 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
2180 SetSecurityDescriptorDacl(&desc
, TRUE
, pacl
, FALSE
);
2181 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2182 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
2184 ConvertStringSidToSid("S-1-5-6", &psid2
);
2185 AddAccessAllowedAceEx(pacl
, ACL_REVISION
, NO_PROPAGATE_INHERIT_ACE
, 0xf0000000, psid2
);
2186 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2187 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)");
2189 AddAccessAllowedAceEx(pacl
, ACL_REVISION
, INHERIT_ONLY_ACE
|INHERITED_ACE
, 0x00000003, psid2
);
2190 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2191 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)");
2193 AddAccessDeniedAceEx(pacl
, ACL_REVISION
, OBJECT_INHERIT_ACE
|CONTAINER_INHERIT_ACE
, 0xffffffff, psid
);
2194 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2195 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
2198 pacl
= (PACL
)acl_buf
;
2199 InitializeAcl(pacl
, sizeof(acl_buf
), ACL_REVISION
);
2200 SetSecurityDescriptorSacl(&desc
, TRUE
, pacl
, FALSE
);
2201 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2202 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:");
2204 SetSecurityDescriptorDacl(&desc
, TRUE
, NULL
, FALSE
);
2205 AddAuditAccessAceEx(pacl
, ACL_REVISION
, VALID_INHERIT_FLAGS
, KEY_READ
|KEY_WRITE
, psid2
, TRUE
, TRUE
);
2206 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2207 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)", /* XP */
2208 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)" /* Vista */);
2210 AddAuditAccessAceEx(pacl
, ACL_REVISION
, NO_PROPAGATE_INHERIT_ACE
, FILE_GENERIC_READ
|FILE_GENERIC_WRITE
, psid2
, TRUE
, FALSE
);
2211 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2212 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", /* XP */
2213 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)" /* Vista */);
2216 static void test_PrivateObjectSecurity(void)
2218 SECURITY_INFORMATION sec_info
= OWNER_SECURITY_INFORMATION
|GROUP_SECURITY_INFORMATION
|DACL_SECURITY_INFORMATION
|SACL_SECURITY_INFORMATION
;
2219 SECURITY_DESCRIPTOR_CONTROL ctrl
;
2220 PSECURITY_DESCRIPTOR sec
;
2226 PSECURITY_DESCRIPTOR buf
;
2228 ok(ConvertStringSecurityDescriptorToSecurityDescriptorA(
2230 "G:S-1-5-21-93476-23408-4576"
2231 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
2232 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", SDDL_REVISION_1
, &sec
, &dwDescSize
), "Creating descriptor failed\n");
2233 buf
= HeapAlloc(GetProcessHeap(), 0, dwDescSize
);
2234 SetSecurityDescriptorControl(sec
, SE_DACL_PROTECTED
, SE_DACL_PROTECTED
);
2235 GetSecurityDescriptorControl(sec
, &ctrl
, &dwRevision
);
2236 todo_wine
expect_eq(ctrl
, 0x9014, int, "%x");
2238 ok(GetPrivateObjectSecurity(sec
, GROUP_SECURITY_INFORMATION
, buf
, dwDescSize
, &retSize
),
2239 "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
2240 ok(retSize
<= dwDescSize
, "Buffer too small (%d vs %d)\n", retSize
, dwDescSize
);
2241 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2242 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
2243 GetSecurityDescriptorControl(buf
, &ctrl
, &dwRevision
);
2244 expect_eq(ctrl
, 0x8000, int, "%x");
2246 ok(GetPrivateObjectSecurity(sec
, GROUP_SECURITY_INFORMATION
|DACL_SECURITY_INFORMATION
, buf
, dwDescSize
, &retSize
),
2247 "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
2248 ok(retSize
<= dwDescSize
, "Buffer too small (%d vs %d)\n", retSize
, dwDescSize
);
2249 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed err=%u\n", GetLastError());
2250 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
2251 GetSecurityDescriptorControl(buf
, &ctrl
, &dwRevision
);
2252 expect_eq(ctrl
, 0x8004, int, "%x");
2254 ok(GetPrivateObjectSecurity(sec
, sec_info
, buf
, dwDescSize
, &retSize
),
2255 "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
2256 ok(retSize
== dwDescSize
, "Buffer too small (%d vs %d)\n", retSize
, dwDescSize
);
2257 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf
, SDDL_REVISION_1
, sec_info
, &string
, &len
), "Conversion failed\n");
2258 CHECK_RESULT_AND_FREE("O:SY"
2259 "G:S-1-5-21-93476-23408-4576"
2260 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
2261 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)");
2262 GetSecurityDescriptorControl(buf
, &ctrl
, &dwRevision
);
2263 expect_eq(ctrl
, 0x8014, int, "%x");
2265 SetLastError(0xdeadbeef);
2266 ok(GetPrivateObjectSecurity(sec
, sec_info
, buf
, 5, &retSize
) == FALSE
, "GetPrivateObjectSecurity should have failed\n");
2267 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
, "Expected error ERROR_INSUFFICIENT_BUFFER, got %u\n", GetLastError());
2270 HeapFree(GetProcessHeap(), 0, buf
);
2272 #undef CHECK_RESULT_AND_FREE
2273 #undef CHECK_ONE_OF_AND_FREE
2275 START_TEST(security
)
2282 test_process_security_child();
2288 test_CreateWellKnownSid();
2289 test_FileSecurity();
2292 test_LookupAccountSid();
2293 test_LookupAccountName();
2294 test_security_descriptor();
2295 test_process_security();
2296 test_impersonation_level();
2297 test_SetEntriesInAcl();
2298 test_GetNamedSecurityInfoA();
2299 test_ConvertStringSecurityDescriptor();
2300 test_ConvertSecurityDescriptorToString();
2301 test_PrivateObjectSecurity();