?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
advapi32: Basic test for CreateRestrictedToken.
[wine/multimedia.git] / dlls / advapi32 / tests / security.c
bloba21989c28eae3e18b5ed09981b35e9deeda4dcd8
1 /*
2 * Unit tests for security functions
3 *
4 * Copyright (c) 2004 Mike McCormack
5 * Copyright (c) 2011 Dmitry Timoshkov
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
20 */
21
22 #include <stdarg.h>
23 #include <stdio.h>
24
25 #include "ntstatus.h"
26 #define WIN32_NO_STATUS
27 #include "windef.h"
28 #include "winbase.h"
29 #include "winerror.h"
30 #include "aclapi.h"
31 #include "winnt.h"
32 #include "sddl.h"
33 #include "ntsecapi.h"
34 #include "lmcons.h"
35
36 #include "wine/test.h"
37
38 /* copied from Wine winternl.h - not included in the Windows SDK */
39 typedef enum _OBJECT_INFORMATION_CLASS {
40 ObjectBasicInformation,
41 ObjectNameInformation,
42 ObjectTypeInformation,
43 ObjectAllInformation,
44 ObjectDataInformation
45 } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
46
47 typedef struct _OBJECT_BASIC_INFORMATION {
48 ULONG Attributes;
49 ACCESS_MASK GrantedAccess;
50 ULONG HandleCount;
51 ULONG PointerCount;
52 ULONG PagedPoolUsage;
53 ULONG NonPagedPoolUsage;
54 ULONG Reserved[3];
55 ULONG NameInformationLength;
56 ULONG TypeInformationLength;
57 ULONG SecurityDescriptorLength;
58 LARGE_INTEGER CreateTime;
59 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
60
61 #define expect_eq(expr, value, type, format) { type ret = expr; ok((value) == ret, #expr " expected " format " got " format "\n", (value), (ret)); }
62
63 static BOOL (WINAPI *pAddAccessAllowedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
64 static BOOL (WINAPI *pAddAccessDeniedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
65 static BOOL (WINAPI *pAddAuditAccessAceEx)(PACL, DWORD, DWORD, DWORD, PSID, BOOL, BOOL);
66 static VOID (WINAPI *pBuildTrusteeWithSidA)( PTRUSTEEA pTrustee, PSID pSid );
67 static VOID (WINAPI *pBuildTrusteeWithNameA)( PTRUSTEEA pTrustee, LPSTR pName );
68 static VOID (WINAPI *pBuildTrusteeWithObjectsAndNameA)( PTRUSTEEA pTrustee,
69 POBJECTS_AND_NAME_A pObjName,
70 SE_OBJECT_TYPE ObjectType,
71 LPSTR ObjectTypeName,
72 LPSTR InheritedObjectTypeName,
73 LPSTR Name );
74 static VOID (WINAPI *pBuildTrusteeWithObjectsAndSidA)( PTRUSTEEA pTrustee,
75 POBJECTS_AND_SID pObjSid,
76 GUID* pObjectGuid,
77 GUID* pInheritedObjectGuid,
78 PSID pSid );
79 static LPSTR (WINAPI *pGetTrusteeNameA)( PTRUSTEEA pTrustee );
80 static BOOL (WINAPI *pMakeSelfRelativeSD)( PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR, LPDWORD );
81 static BOOL (WINAPI *pConvertSidToStringSidA)( PSID pSid, LPSTR *str );
82 static BOOL (WINAPI *pConvertStringSidToSidA)( LPCSTR str, PSID pSid );
83 static BOOL (WINAPI *pCheckTokenMembership)(HANDLE, PSID, PBOOL);
84 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorA)(LPCSTR, DWORD,
85 PSECURITY_DESCRIPTOR*, PULONG );
86 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorW)(LPCWSTR, DWORD,
87 PSECURITY_DESCRIPTOR*, PULONG );
88 static BOOL (WINAPI *pConvertSecurityDescriptorToStringSecurityDescriptorA)(PSECURITY_DESCRIPTOR, DWORD,
89 SECURITY_INFORMATION, LPSTR *, PULONG );
90 static BOOL (WINAPI *pGetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
91 PSECURITY_DESCRIPTOR, DWORD, LPDWORD);
92 static BOOL (WINAPI *pSetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
93 PSECURITY_DESCRIPTOR);
94 static DWORD (WINAPI *pGetNamedSecurityInfoA)(LPSTR, SE_OBJECT_TYPE, SECURITY_INFORMATION,
95 PSID*, PSID*, PACL*, PACL*,
96 PSECURITY_DESCRIPTOR*);
97 static PDWORD (WINAPI *pGetSidSubAuthority)(PSID, DWORD);
98 static PUCHAR (WINAPI *pGetSidSubAuthorityCount)(PSID);
99 static BOOL (WINAPI *pIsValidSid)(PSID);
100 static DWORD (WINAPI *pRtlAdjustPrivilege)(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
101 static BOOL (WINAPI *pCreateWellKnownSid)(WELL_KNOWN_SID_TYPE,PSID,PSID,DWORD*);
102 static BOOL (WINAPI *pDuplicateTokenEx)(HANDLE,DWORD,LPSECURITY_ATTRIBUTES,
103 SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
104
105 static NTSTATUS (WINAPI *pLsaQueryInformationPolicy)(LSA_HANDLE,POLICY_INFORMATION_CLASS,PVOID*);
106 static NTSTATUS (WINAPI *pLsaClose)(LSA_HANDLE);
107 static NTSTATUS (WINAPI *pLsaFreeMemory)(PVOID);
108 static NTSTATUS (WINAPI *pLsaOpenPolicy)(PLSA_UNICODE_STRING,PLSA_OBJECT_ATTRIBUTES,ACCESS_MASK,PLSA_HANDLE);
109 static NTSTATUS (WINAPI *pNtQueryObject)(HANDLE,OBJECT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
110 static DWORD (WINAPI *pSetEntriesInAclW)(ULONG, PEXPLICIT_ACCESSW, PACL, PACL*);
111 static DWORD (WINAPI *pSetEntriesInAclA)(ULONG, PEXPLICIT_ACCESSA, PACL, PACL*);
112 static BOOL (WINAPI *pSetSecurityDescriptorControl)(PSECURITY_DESCRIPTOR, SECURITY_DESCRIPTOR_CONTROL,
113 SECURITY_DESCRIPTOR_CONTROL);
114 static DWORD (WINAPI *pGetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION,
115 PSID*, PSID*, PACL*, PACL*, PSECURITY_DESCRIPTOR*);
116 static NTSTATUS (WINAPI *pNtAccessCheck)(PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK, PGENERIC_MAPPING,
117 PPRIVILEGE_SET, PULONG, PULONG, NTSTATUS*);
118 static BOOL (WINAPI *pCreateRestrictedToken)(HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD,
119 PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE);
120
121 static HMODULE hmod;
122 static int myARGC;
123 static char** myARGV;
124
125 struct sidRef
126 {
127 SID_IDENTIFIER_AUTHORITY auth;
128 const char *refStr;
129 };
130
131 static void init(void)
132 {
133 HMODULE hntdll;
134
135 hntdll = GetModuleHandleA("ntdll.dll");
136 pNtQueryObject = (void *)GetProcAddress( hntdll, "NtQueryObject" );
137 pNtAccessCheck = (void *)GetProcAddress( hntdll, "NtAccessCheck" );
138
139 hmod = GetModuleHandle("advapi32.dll");
140 pAddAccessAllowedAceEx = (void *)GetProcAddress(hmod, "AddAccessAllowedAceEx");
141 pAddAccessDeniedAceEx = (void *)GetProcAddress(hmod, "AddAccessDeniedAceEx");
142 pAddAuditAccessAceEx = (void *)GetProcAddress(hmod, "AddAuditAccessAceEx");
143 pCheckTokenMembership = (void *)GetProcAddress(hmod, "CheckTokenMembership");
144 pConvertStringSecurityDescriptorToSecurityDescriptorA =
145 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
146 pConvertStringSecurityDescriptorToSecurityDescriptorW =
147 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorW" );
148 pConvertSecurityDescriptorToStringSecurityDescriptorA =
149 (void *)GetProcAddress(hmod, "ConvertSecurityDescriptorToStringSecurityDescriptorA" );
150 pGetFileSecurityA = (void *)GetProcAddress(hmod, "GetFileSecurityA" );
151 pSetFileSecurityA = (void *)GetProcAddress(hmod, "SetFileSecurityA" );
152 pCreateWellKnownSid = (void *)GetProcAddress( hmod, "CreateWellKnownSid" );
153 pGetNamedSecurityInfoA = (void *)GetProcAddress(hmod, "GetNamedSecurityInfoA");
154 pGetSidSubAuthority = (void *)GetProcAddress(hmod, "GetSidSubAuthority");
155 pGetSidSubAuthorityCount = (void *)GetProcAddress(hmod, "GetSidSubAuthorityCount");
156 pIsValidSid = (void *)GetProcAddress(hmod, "IsValidSid");
157 pMakeSelfRelativeSD = (void *)GetProcAddress(hmod, "MakeSelfRelativeSD");
158 pSetEntriesInAclW = (void *)GetProcAddress(hmod, "SetEntriesInAclW");
159 pSetEntriesInAclA = (void *)GetProcAddress(hmod, "SetEntriesInAclA");
160 pSetSecurityDescriptorControl = (void *)GetProcAddress(hmod, "SetSecurityDescriptorControl");
161 pGetSecurityInfo = (void *)GetProcAddress(hmod, "GetSecurityInfo");
162 pCreateRestrictedToken = (void *)GetProcAddress(hmod, "CreateRestrictedToken");
163
164 myARGC = winetest_get_mainargs( &myARGV );
165 }
166
167 static void test_str_sid(const char *str_sid)
168 {
169 PSID psid;
170 char *temp;
171
172 if (pConvertStringSidToSidA(str_sid, &psid))
173 {
174 if (pConvertSidToStringSidA(psid, &temp))
175 {
176 trace(" %s: %s\n", str_sid, temp);
177 LocalFree(temp);
178 }
179 LocalFree(psid);
180 }
181 else
182 {
183 if (GetLastError() != ERROR_INVALID_SID)
184 trace(" %s: couldn't be converted, returned %d\n", str_sid, GetLastError());
185 else
186 trace(" %s: couldn't be converted\n", str_sid);
187 }
188 }
189
190 static void test_sid(void)
191 {
192 struct sidRef refs[] = {
193 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
194 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
195 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
196 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
197 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
198 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
199 };
200 const char noSubAuthStr[] = "S-1-5";
201 unsigned int i;
202 PSID psid = NULL;
203 SID *pisid;
204 BOOL r;
205 LPSTR str = NULL;
206
207 pConvertSidToStringSidA = (void *)GetProcAddress( hmod, "ConvertSidToStringSidA" );
208 if( !pConvertSidToStringSidA )
209 return;
210 pConvertStringSidToSidA = (void *)GetProcAddress( hmod, "ConvertStringSidToSidA" );
211 if( !pConvertStringSidToSidA )
212 return;
213
214 r = pConvertStringSidToSidA( NULL, NULL );
215 ok( !r, "expected failure with NULL parameters\n" );
216 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED )
217 return;
218 ok( GetLastError() == ERROR_INVALID_PARAMETER,
219 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
220 GetLastError() );
221
222 r = pConvertStringSidToSidA( refs[0].refStr, NULL );
223 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
224 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
225 GetLastError() );
226
227 r = pConvertStringSidToSidA( NULL, &str );
228 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
229 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
230 GetLastError() );
231
232 r = pConvertStringSidToSidA( noSubAuthStr, &psid );
233 ok( !r,
234 "expected failure with no sub authorities\n" );
235 ok( GetLastError() == ERROR_INVALID_SID,
236 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
237 GetLastError() );
238
239 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid), "ConvertStringSidToSidA failed\n");
240 pisid = psid;
241 ok(pisid->SubAuthorityCount == 4, "Invalid sub authority count - expected 4, got %d\n", pisid->SubAuthorityCount);
242 ok(pisid->SubAuthority[0] == 21, "Invalid subauthority 0 - expceted 21, got %d\n", pisid->SubAuthority[0]);
243 ok(pisid->SubAuthority[3] == 4576, "Invalid subauthority 0 - expceted 4576, got %d\n", pisid->SubAuthority[3]);
244 LocalFree(str);
245 LocalFree(psid);
246
247 for( i = 0; i < sizeof(refs) / sizeof(refs[0]); i++ )
248 {
249 PISID pisid;
250
251 r = AllocateAndInitializeSid( &refs[i].auth, 1,1,0,0,0,0,0,0,0,
252 &psid );
253 ok( r, "failed to allocate sid\n" );
254 r = pConvertSidToStringSidA( psid, &str );
255 ok( r, "failed to convert sid\n" );
256 if (r)
257 {
258 ok( !strcmp( str, refs[i].refStr ),
259 "incorrect sid, expected %s, got %s\n", refs[i].refStr, str );
260 LocalFree( str );
261 }
262 if( psid )
263 FreeSid( psid );
264
265 r = pConvertStringSidToSidA( refs[i].refStr, &psid );
266 ok( r, "failed to parse sid string\n" );
267 pisid = psid;
268 ok( pisid &&
269 !memcmp( pisid->IdentifierAuthority.Value, refs[i].auth.Value,
270 sizeof(refs[i].auth) ),
271 "string sid %s didn't parse to expected value\n"
272 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
273 refs[i].refStr,
274 MAKEWORD( pisid->IdentifierAuthority.Value[1],
275 pisid->IdentifierAuthority.Value[0] ),
276 MAKELONG( MAKEWORD( pisid->IdentifierAuthority.Value[5],
277 pisid->IdentifierAuthority.Value[4] ),
278 MAKEWORD( pisid->IdentifierAuthority.Value[3],
279 pisid->IdentifierAuthority.Value[2] ) ),
280 MAKEWORD( refs[i].auth.Value[1], refs[i].auth.Value[0] ),
281 MAKELONG( MAKEWORD( refs[i].auth.Value[5], refs[i].auth.Value[4] ),
282 MAKEWORD( refs[i].auth.Value[3], refs[i].auth.Value[2] ) ) );
283 if( psid )
284 LocalFree( psid );
285 }
286
287 trace("String SIDs:\n");
288 test_str_sid("AO");
289 test_str_sid("RU");
290 test_str_sid("AN");
291 test_str_sid("AU");
292 test_str_sid("BA");
293 test_str_sid("BG");
294 test_str_sid("BO");
295 test_str_sid("BU");
296 test_str_sid("CA");
297 test_str_sid("CG");
298 test_str_sid("CO");
299 test_str_sid("DA");
300 test_str_sid("DC");
301 test_str_sid("DD");
302 test_str_sid("DG");
303 test_str_sid("DU");
304 test_str_sid("EA");
305 test_str_sid("ED");
306 test_str_sid("WD");
307 test_str_sid("PA");
308 test_str_sid("IU");
309 test_str_sid("LA");
310 test_str_sid("LG");
311 test_str_sid("LS");
312 test_str_sid("SY");
313 test_str_sid("NU");
314 test_str_sid("NO");
315 test_str_sid("NS");
316 test_str_sid("PO");
317 test_str_sid("PS");
318 test_str_sid("PU");
319 test_str_sid("RS");
320 test_str_sid("RD");
321 test_str_sid("RE");
322 test_str_sid("RC");
323 test_str_sid("SA");
324 test_str_sid("SO");
325 test_str_sid("SU");
326 }
327
328 static void test_trustee(void)
329 {
330 GUID ObjectType = {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
331 GUID InheritedObjectType = {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
332 GUID ZeroGuid;
333 OBJECTS_AND_NAME_ oan;
334 OBJECTS_AND_SID oas;
335 TRUSTEE trustee;
336 PSID psid;
337 char szObjectTypeName[] = "ObjectTypeName";
338 char szInheritedObjectTypeName[] = "InheritedObjectTypeName";
339 char szTrusteeName[] = "szTrusteeName";
340 SID_IDENTIFIER_AUTHORITY auth = { {0x11,0x22,0,0,0, 0} };
341
342 memset( &ZeroGuid, 0x00, sizeof (ZeroGuid) );
343
344 pBuildTrusteeWithSidA = (void *)GetProcAddress( hmod, "BuildTrusteeWithSidA" );
345 pBuildTrusteeWithNameA = (void *)GetProcAddress( hmod, "BuildTrusteeWithNameA" );
346 pBuildTrusteeWithObjectsAndNameA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndNameA" );
347 pBuildTrusteeWithObjectsAndSidA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndSidA" );
348 pGetTrusteeNameA = (void *)GetProcAddress (hmod, "GetTrusteeNameA" );
349 if( !pBuildTrusteeWithSidA || !pBuildTrusteeWithNameA ||
350 !pBuildTrusteeWithObjectsAndNameA || !pBuildTrusteeWithObjectsAndSidA ||
351 !pGetTrusteeNameA )
352 return;
353
354 if ( ! AllocateAndInitializeSid( &auth, 1, 42, 0,0,0,0,0,0,0,&psid ) )
355 {
356 trace( "failed to init SID\n" );
357 return;
358 }
359
360 /* test BuildTrusteeWithSidA */
361 memset( &trustee, 0xff, sizeof trustee );
362 pBuildTrusteeWithSidA( &trustee, psid );
363
364 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
365 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
366 "MultipleTrusteeOperation wrong\n");
367 ok( trustee.TrusteeForm == TRUSTEE_IS_SID, "TrusteeForm wrong\n");
368 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
369 ok( trustee.ptstrName == psid, "ptstrName wrong\n" );
370
371 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
372 memset( &trustee, 0xff, sizeof trustee );
373 memset( &oas, 0xff, sizeof(oas) );
374 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, &ObjectType,
375 &InheritedObjectType, psid);
376
377 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
378 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
379 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
380 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
381 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
382
383 ok(oas.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
384 ok(!memcmp(&oas.ObjectTypeGuid, &ObjectType, sizeof(GUID)), "ObjectTypeGuid wrong\n");
385 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
386 ok(oas.pSid == psid, "pSid wrong\n");
387
388 /* test GetTrusteeNameA */
389 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oas, "GetTrusteeName returned wrong value\n");
390
391 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
392 memset( &trustee, 0xff, sizeof trustee );
393 memset( &oas, 0xff, sizeof(oas) );
394 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, NULL,
395 &InheritedObjectType, psid);
396
397 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
398 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
399 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
400 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
401 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
402
403 ok(oas.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
404 ok(!memcmp(&oas.ObjectTypeGuid, &ZeroGuid, sizeof(GUID)), "ObjectTypeGuid wrong\n");
405 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
406 ok(oas.pSid == psid, "pSid wrong\n");
407
408 FreeSid( psid );
409
410 /* test BuildTrusteeWithNameA */
411 memset( &trustee, 0xff, sizeof trustee );
412 pBuildTrusteeWithNameA( &trustee, szTrusteeName );
413
414 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
415 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
416 "MultipleTrusteeOperation wrong\n");
417 ok( trustee.TrusteeForm == TRUSTEE_IS_NAME, "TrusteeForm wrong\n");
418 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
419 ok( trustee.ptstrName == szTrusteeName, "ptstrName wrong\n" );
420
421 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
422 memset( &trustee, 0xff, sizeof trustee );
423 memset( &oan, 0xff, sizeof(oan) );
424 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
425 szInheritedObjectTypeName, szTrusteeName);
426
427 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
428 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
429 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
430 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
431 ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
432
433 ok(oan.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
434 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
435 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
436 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
437
438 /* test GetTrusteeNameA */
439 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oan, "GetTrusteeName returned wrong value\n");
440
441 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
442 memset( &trustee, 0xff, sizeof trustee );
443 memset( &oan, 0xff, sizeof(oan) );
444 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, NULL,
445 szInheritedObjectTypeName, szTrusteeName);
446
447 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
448 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
449 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
450 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
451 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
452
453 ok(oan.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
454 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
455 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
456 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
457
458 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
459 memset( &trustee, 0xff, sizeof trustee );
460 memset( &oan, 0xff, sizeof(oan) );
461 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
462 NULL, szTrusteeName);
463
464 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
465 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
466 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
467 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
468 ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
469
470 ok(oan.ObjectsPresent == ACE_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
471 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
472 ok(oan.InheritedObjectTypeName == NULL, "InheritedObjectTypeName wrong\n");
473 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
474 }
475
476 /* If the first isn't defined, assume none is */
477 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
478 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
479 #define SE_CREATE_TOKEN_PRIVILEGE 2L
480 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
481 #define SE_LOCK_MEMORY_PRIVILEGE 4L
482 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
483 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
484 #define SE_TCB_PRIVILEGE 7L
485 #define SE_SECURITY_PRIVILEGE 8L
486 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
487 #define SE_LOAD_DRIVER_PRIVILEGE 10L
488 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
489 #define SE_SYSTEMTIME_PRIVILEGE 12L
490 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
491 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
492 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
493 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
494 #define SE_BACKUP_PRIVILEGE 17L
495 #define SE_RESTORE_PRIVILEGE 18L
496 #define SE_SHUTDOWN_PRIVILEGE 19L
497 #define SE_DEBUG_PRIVILEGE 20L
498 #define SE_AUDIT_PRIVILEGE 21L
499 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
500 #define SE_CHANGE_NOTIFY_PRIVILEGE 23L
501 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
502 #define SE_UNDOCK_PRIVILEGE 25L
503 #define SE_SYNC_AGENT_PRIVILEGE 26L
504 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
505 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
506 #define SE_IMPERSONATE_PRIVILEGE 29L
507 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
508 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
509 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
510
511 static void test_allocateLuid(void)
512 {
513 BOOL (WINAPI *pAllocateLocallyUniqueId)(PLUID);
514 LUID luid1, luid2;
515 BOOL ret;
516
517 pAllocateLocallyUniqueId = (void*)GetProcAddress(hmod, "AllocateLocallyUniqueId");
518 if (!pAllocateLocallyUniqueId) return;
519
520 ret = pAllocateLocallyUniqueId(&luid1);
521 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
522 return;
523
524 ok(ret,
525 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
526 ret = pAllocateLocallyUniqueId(&luid2);
527 ok( ret,
528 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
529 ok(luid1.LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE || luid1.HighPart != 0,
530 "AllocateLocallyUniqueId returned a well-known LUID\n");
531 ok(luid1.LowPart != luid2.LowPart || luid1.HighPart != luid2.HighPart,
532 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
533 ret = pAllocateLocallyUniqueId(NULL);
534 ok( !ret && GetLastError() == ERROR_NOACCESS,
535 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
536 GetLastError());
537 }
538
539 static void test_lookupPrivilegeName(void)
540 {
541 BOOL (WINAPI *pLookupPrivilegeNameA)(LPCSTR, PLUID, LPSTR, LPDWORD);
542 char buf[MAX_PATH]; /* arbitrary, seems long enough */
543 DWORD cchName = sizeof(buf);
544 LUID luid = { 0, 0 };
545 LONG i;
546 BOOL ret;
547
548 /* check whether it's available first */
549 pLookupPrivilegeNameA = (void*)GetProcAddress(hmod, "LookupPrivilegeNameA");
550 if (!pLookupPrivilegeNameA) return;
551 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
552 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
553 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
554 return;
555
556 /* check with a short buffer */
557 cchName = 0;
558 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
559 ret = pLookupPrivilegeNameA(NULL, &luid, NULL, &cchName);
560 ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
561 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
562 GetLastError());
563 ok(cchName == strlen("SeCreateTokenPrivilege") + 1,
564 "LookupPrivilegeNameA returned an incorrect required length for\n"
565 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
566 lstrlenA("SeCreateTokenPrivilege") + 1);
567 /* check a known value and its returned length on success */
568 cchName = sizeof(buf);
569 ok(pLookupPrivilegeNameA(NULL, &luid, buf, &cchName) &&
570 cchName == strlen("SeCreateTokenPrivilege"),
571 "LookupPrivilegeNameA returned an incorrect output length for\n"
572 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
573 (int)strlen("SeCreateTokenPrivilege"));
574 /* check known values */
575 for (i = SE_MIN_WELL_KNOWN_PRIVILEGE; i <= SE_MAX_WELL_KNOWN_PRIVILEGE; i++)
576 {
577 luid.LowPart = i;
578 cchName = sizeof(buf);
579 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
580 ok( ret || GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
581 "LookupPrivilegeNameA(0.%d) failed: %d\n", i, GetLastError());
582 }
583 /* check a bogus LUID */
584 luid.LowPart = 0xdeadbeef;
585 cchName = sizeof(buf);
586 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
587 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
588 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
589 GetLastError());
590 /* check on a bogus system */
591 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
592 cchName = sizeof(buf);
593 ret = pLookupPrivilegeNameA("b0gu5.Nam3", &luid, buf, &cchName);
594 ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
595 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
596 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
597 GetLastError());
598 }
599
600 struct NameToLUID
601 {
602 const char *name;
603 DWORD lowPart;
604 };
605
606 static void test_lookupPrivilegeValue(void)
607 {
608 static const struct NameToLUID privs[] = {
609 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE },
610 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE },
611 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE },
612 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE },
613 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE },
614 { "SeTcbPrivilege", SE_TCB_PRIVILEGE },
615 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE },
616 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE },
617 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE },
618 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE },
619 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE },
620 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE },
621 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE },
622 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE },
623 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE },
624 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE },
625 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE },
626 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE },
627 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE },
628 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE },
629 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE },
630 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILEGE },
631 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE },
632 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE },
633 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE },
634 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE },
635 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE },
636 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE },
637 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE },
638 };
639 BOOL (WINAPI *pLookupPrivilegeValueA)(LPCSTR, LPCSTR, PLUID);
640 unsigned int i;
641 LUID luid;
642 BOOL ret;
643
644 /* check whether it's available first */
645 pLookupPrivilegeValueA = (void*)GetProcAddress(hmod, "LookupPrivilegeValueA");
646 if (!pLookupPrivilegeValueA) return;
647 ret = pLookupPrivilegeValueA(NULL, "SeCreateTokenPrivilege", &luid);
648 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
649 return;
650
651 /* check a bogus system name */
652 ret = pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid);
653 ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
654 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
655 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
656 GetLastError());
657 /* check a NULL string */
658 ret = pLookupPrivilegeValueA(NULL, 0, &luid);
659 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
660 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
661 GetLastError());
662 /* check a bogus privilege name */
663 ret = pLookupPrivilegeValueA(NULL, "SeBogusPrivilege", &luid);
664 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
665 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
666 GetLastError());
667 /* check case insensitive */
668 ret = pLookupPrivilegeValueA(NULL, "sEcREATEtOKENpRIVILEGE", &luid);
669 ok( ret,
670 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
671 GetLastError());
672 for (i = 0; i < sizeof(privs) / sizeof(privs[0]); i++)
673 {
674 /* Not all privileges are implemented on all Windows versions, so
675 * don't worry if the call fails
676 */
677 if (pLookupPrivilegeValueA(NULL, privs[i].name, &luid))
678 {
679 ok(luid.LowPart == privs[i].lowPart,
680 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
681 privs[i].name);
682 }
683 }
684 }
685
686 static void test_luid(void)
687 {
688 test_allocateLuid();
689 test_lookupPrivilegeName();
690 test_lookupPrivilegeValue();
691 }
692
693 static void test_FileSecurity(void)
694 {
695 char wintmpdir [MAX_PATH];
696 char path [MAX_PATH];
697 char file [MAX_PATH];
698 HANDLE fh, token;
699 DWORD sdSize, retSize, rc, granted, priv_set_len;
700 PRIVILEGE_SET priv_set;
701 BOOL status;
702 BYTE *sd;
703 GENERIC_MAPPING mapping = { FILE_READ_DATA, FILE_WRITE_DATA, FILE_EXECUTE, FILE_ALL_ACCESS };
704 const SECURITY_INFORMATION request = OWNER_SECURITY_INFORMATION
705 | GROUP_SECURITY_INFORMATION
706 | DACL_SECURITY_INFORMATION;
707
708 if (!pGetFileSecurityA) {
709 win_skip ("GetFileSecurity is not available\n");
710 return;
711 }
712
713 if (!pSetFileSecurityA) {
714 win_skip ("SetFileSecurity is not available\n");
715 return;
716 }
717
718 if (!GetTempPathA (sizeof (wintmpdir), wintmpdir)) {
719 win_skip ("GetTempPathA failed\n");
720 return;
721 }
722
723 /* Create a temporary directory and in it a temporary file */
724 strcat (strcpy (path, wintmpdir), "rary");
725 SetLastError(0xdeadbeef);
726 rc = CreateDirectoryA (path, NULL);
727 ok (rc || GetLastError() == ERROR_ALREADY_EXISTS, "CreateDirectoryA "
728 "failed for '%s' with %d\n", path, GetLastError());
729
730 strcat (strcpy (file, path), "\\ess");
731 SetLastError(0xdeadbeef);
732 fh = CreateFileA (file, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
733 ok (fh != INVALID_HANDLE_VALUE, "CreateFileA "
734 "failed for '%s' with %d\n", file, GetLastError());
735 CloseHandle (fh);
736
737 /* For the temporary file ... */
738
739 /* Get size needed */
740 retSize = 0;
741 SetLastError(0xdeadbeef);
742 rc = pGetFileSecurityA (file, request, NULL, 0, &retSize);
743 if (!rc && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)) {
744 win_skip("GetFileSecurityA is not implemented\n");
745 goto cleanup;
746 }
747 ok (!rc, "GetFileSecurityA "
748 "was expected to fail for '%s'\n", file);
749 ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
750 "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
751 ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
752
753 sdSize = retSize;
754 sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
755
756 /* Get security descriptor for real */
757 retSize = -1;
758 SetLastError(0xdeadbeef);
759 rc = pGetFileSecurityA (file, request, sd, sdSize, &retSize);
760 ok (rc, "GetFileSecurityA "
761 "was not expected to fail '%s': %d\n", file, GetLastError());
762 ok (retSize == sdSize ||
763 broken(retSize == 0), /* NT4 */
764 "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
765
766 /* Use it to set security descriptor */
767 SetLastError(0xdeadbeef);
768 rc = pSetFileSecurityA (file, request, sd);
769 ok (rc, "SetFileSecurityA "
770 "was not expected to fail '%s': %d\n", file, GetLastError());
771
772 HeapFree (GetProcessHeap (), 0, sd);
773
774 /* Repeat for the temporary directory ... */
775
776 /* Get size needed */
777 retSize = 0;
778 SetLastError(0xdeadbeef);
779 rc = pGetFileSecurityA (path, request, NULL, 0, &retSize);
780 ok (!rc, "GetFileSecurityA "
781 "was expected to fail for '%s'\n", path);
782 ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
783 "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
784 ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
785
786 sdSize = retSize;
787 sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
788
789 /* Get security descriptor for real */
790 retSize = -1;
791 SetLastError(0xdeadbeef);
792 rc = pGetFileSecurityA (path, request, sd, sdSize, &retSize);
793 ok (rc, "GetFileSecurityA "
794 "was not expected to fail '%s': %d\n", path, GetLastError());
795 ok (retSize == sdSize ||
796 broken(retSize == 0), /* NT4 */
797 "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
798
799 /* Use it to set security descriptor */
800 SetLastError(0xdeadbeef);
801 rc = pSetFileSecurityA (path, request, sd);
802 ok (rc, "SetFileSecurityA "
803 "was not expected to fail '%s': %d\n", path, GetLastError());
804 HeapFree (GetProcessHeap (), 0, sd);
805
806 /* Old test */
807 strcpy (wintmpdir, "\\Should not exist");
808 SetLastError(0xdeadbeef);
809 rc = pGetFileSecurityA (wintmpdir, OWNER_SECURITY_INFORMATION, NULL, 0, &sdSize);
810 ok (!rc, "GetFileSecurityA should fail for not existing directories/files\n");
811 ok (GetLastError() == ERROR_FILE_NOT_FOUND,
812 "last error ERROR_FILE_NOT_FOUND expected, got %d\n", GetLastError());
813
814 cleanup:
815 /* Remove temporary file and directory */
816 DeleteFileA(file);
817 RemoveDirectoryA(path);
818
819 /* Test file access permissions for a file with FILE_ATTRIBUTE_ARCHIVE */
820 SetLastError(0xdeadbeef);
821 rc = GetTempPath(sizeof(wintmpdir), wintmpdir);
822 ok(rc, "GetTempPath error %d\n", GetLastError());
823
824 SetLastError(0xdeadbeef);
825 rc = GetTempFileName(wintmpdir, "tmp", 0, file);
826 ok(rc, "GetTempFileName error %d\n", GetLastError());
827
828 rc = GetFileAttributes(file);
829 rc &= ~FILE_ATTRIBUTE_NOT_CONTENT_INDEXED;
830 ok(rc == FILE_ATTRIBUTE_ARCHIVE, "expected FILE_ATTRIBUTE_ARCHIVE got %#x\n", rc);
831
832 retSize = 0xdeadbeef;
833 rc = GetFileSecurity(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
834 NULL, 0, &sdSize);
835 ok(!rc, "GetFileSecurity should fail\n");
836 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
837 "expected ERROR_INSUFFICIENT_BUFFER got %d\n", GetLastError());
838 ok(sdSize > sizeof(SECURITY_DESCRIPTOR), "got sd size %d\n", sdSize);
839
840 sd = HeapAlloc(GetProcessHeap (), 0, sdSize);
841 retSize = 0xdeadbeef;
842 SetLastError(0xdeadbeef);
843 rc = GetFileSecurity(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
844 sd, sdSize, &retSize);
845 ok(rc, "GetFileSecurity error %d\n", GetLastError());
846 ok(retSize == sdSize || broken(retSize == 0) /* NT4 */, "expected %d, got %d\n", sdSize, retSize);
847
848 SetLastError(0xdeadbeef);
849 rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
850 ok(!rc, "OpenThreadToken should fail\n");
851 ok(GetLastError() == ERROR_NO_TOKEN, "expected ERROR_NO_TOKEN, got %d\n", GetLastError());
852
853 SetLastError(0xdeadbeef);
854 rc = ImpersonateSelf(SecurityIdentification);
855 ok(rc, "ImpersonateSelf error %d\n", GetLastError());
856
857 SetLastError(0xdeadbeef);
858 rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
859 ok(rc, "OpenThreadToken error %d\n", GetLastError());
860
861 SetLastError(0xdeadbeef);
862 rc = RevertToSelf();
863 ok(rc, "RevertToSelf error %d\n", GetLastError());
864
865 priv_set_len = sizeof(priv_set);
866 granted = 0xdeadbeef;
867 status = 0xdeadbeef;
868 SetLastError(0xdeadbeef);
869 rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
870 ok(rc, "AccessCheck error %d\n", GetLastError());
871 ok(status == 1, "expected 1, got %d\n", status);
872 ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
873
874 granted = 0xdeadbeef;
875 status = 0xdeadbeef;
876 SetLastError(0xdeadbeef);
877 rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
878 ok(rc, "AccessCheck error %d\n", GetLastError());
879 ok(status == 1, "expected 1, got %d\n", status);
880 ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
881
882 granted = 0xdeadbeef;
883 status = 0xdeadbeef;
884 SetLastError(0xdeadbeef);
885 rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
886 ok(rc, "AccessCheck error %d\n", GetLastError());
887 ok(status == 1, "expected 1, got %d\n", status);
888 ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
889
890 granted = 0xdeadbeef;
891 status = 0xdeadbeef;
892 SetLastError(0xdeadbeef);
893 rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status);
894 ok(rc, "AccessCheck error %d\n", GetLastError());
895 ok(status == 1, "expected 1, got %d\n", status);
896 ok(granted == DELETE, "expected DELETE, got %#x\n", granted);
897
898 granted = 0xdeadbeef;
899 status = 0xdeadbeef;
900 SetLastError(0xdeadbeef);
901 rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
902 ok(rc, "AccessCheck error %d\n", GetLastError());
903 ok(status == 1, "expected 1, got %d\n", status);
904 ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
905
906 granted = 0xdeadbeef;
907 status = 0xdeadbeef;
908 SetLastError(0xdeadbeef);
909 rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
910 ok(rc, "AccessCheck error %d\n", GetLastError());
911 ok(status == 1, "expected 1, got %d\n", status);
912 ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
913
914 granted = 0xdeadbeef;
915 status = 0xdeadbeef;
916 SetLastError(0xdeadbeef);
917 rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
918 ok(rc, "AccessCheck error %d\n", GetLastError());
919 ok(status == 1, "expected 1, got %d\n", status);
920 ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
921
922 SetLastError(0xdeadbeef);
923 rc = AccessCheck(sd, token, 0xffffffff, &mapping, &priv_set, &priv_set_len, &granted, &status);
924 ok(!rc, "AccessCheck should fail\n");
925 ok(GetLastError() == ERROR_GENERIC_NOT_MAPPED, "expected ERROR_GENERIC_NOT_MAPPED, got %d\n", GetLastError());
926
927 /* Test file access permissions for a file with FILE_ATTRIBUTE_READONLY */
928 SetLastError(0xdeadbeef);
929 fh = CreateFile(file, FILE_READ_DATA, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_READONLY, 0);
930 ok(fh != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
931 retSize = 0xdeadbeef;
932 SetLastError(0xdeadbeef);
933 rc = WriteFile(fh, "1", 1, &retSize, NULL);
934 ok(!rc, "WriteFile should fail\n");
935 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
936 ok(retSize == 0, "expected 0, got %d\n", retSize);
937 CloseHandle(fh);
938
939 rc = GetFileAttributes(file);
940 rc &= ~FILE_ATTRIBUTE_NOT_CONTENT_INDEXED;
941 todo_wine
942 ok(rc == (FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY),
943 "expected FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY got %#x\n", rc);
944
945 SetLastError(0xdeadbeef);
946 rc = SetFileAttributes(file, FILE_ATTRIBUTE_ARCHIVE);
947 ok(rc, "SetFileAttributes error %d\n", GetLastError());
948 SetLastError(0xdeadbeef);
949 rc = DeleteFile(file);
950 ok(rc, "DeleteFile error %d\n", GetLastError());
951
952 SetLastError(0xdeadbeef);
953 fh = CreateFile(file, FILE_READ_DATA, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_READONLY, 0);
954 ok(fh != INVALID_HANDLE_VALUE, "CreateFile error %d\n", GetLastError());
955 retSize = 0xdeadbeef;
956 SetLastError(0xdeadbeef);
957 rc = WriteFile(fh, "1", 1, &retSize, NULL);
958 ok(!rc, "WriteFile should fail\n");
959 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
960 ok(retSize == 0, "expected 0, got %d\n", retSize);
961 CloseHandle(fh);
962
963 rc = GetFileAttributes(file);
964 rc &= ~FILE_ATTRIBUTE_NOT_CONTENT_INDEXED;
965 ok(rc == (FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY),
966 "expected FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY got %#x\n", rc);
967
968 retSize = 0xdeadbeef;
969 SetLastError(0xdeadbeef);
970 rc = GetFileSecurity(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
971 sd, sdSize, &retSize);
972 ok(rc, "GetFileSecurity error %d\n", GetLastError());
973 ok(retSize == sdSize || broken(retSize == 0) /* NT4 */, "expected %d, got %d\n", sdSize, retSize);
974
975 priv_set_len = sizeof(priv_set);
976 granted = 0xdeadbeef;
977 status = 0xdeadbeef;
978 SetLastError(0xdeadbeef);
979 rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
980 ok(rc, "AccessCheck error %d\n", GetLastError());
981 ok(status == 1, "expected 1, got %d\n", status);
982 ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
983
984 granted = 0xdeadbeef;
985 status = 0xdeadbeef;
986 SetLastError(0xdeadbeef);
987 rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
988 ok(rc, "AccessCheck error %d\n", GetLastError());
989 todo_wine {
990 ok(status == 1, "expected 1, got %d\n", status);
991 ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
992 }
993 granted = 0xdeadbeef;
994 status = 0xdeadbeef;
995 SetLastError(0xdeadbeef);
996 rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
997 ok(rc, "AccessCheck error %d\n", GetLastError());
998 ok(status == 1, "expected 1, got %d\n", status);
999 ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
1000
1001 granted = 0xdeadbeef;
1002 status = 0xdeadbeef;
1003 SetLastError(0xdeadbeef);
1004 rc = AccessCheck(sd, token, DELETE, &mapping, &priv_set, &priv_set_len, &granted, &status);
1005 ok(rc, "AccessCheck error %d\n", GetLastError());
1006 todo_wine {
1007 ok(status == 1, "expected 1, got %d\n", status);
1008 ok(granted == DELETE, "expected DELETE, got %#x\n", granted);
1009 }
1010 granted = 0xdeadbeef;
1011 status = 0xdeadbeef;
1012 SetLastError(0xdeadbeef);
1013 rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
1014 ok(rc, "AccessCheck error %d\n", GetLastError());
1015 todo_wine {
1016 ok(status == 1, "expected 1, got %d\n", status);
1017 ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
1018 }
1019 granted = 0xdeadbeef;
1020 status = 0xdeadbeef;
1021 SetLastError(0xdeadbeef);
1022 rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
1023 ok(rc, "AccessCheck error %d\n", GetLastError());
1024 todo_wine {
1025 ok(status == 1, "expected 1, got %d\n", status);
1026 ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
1027 }
1028 granted = 0xdeadbeef;
1029 status = 0xdeadbeef;
1030 SetLastError(0xdeadbeef);
1031 rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
1032 ok(rc, "AccessCheck error %d\n", GetLastError());
1033 todo_wine {
1034 ok(status == 1, "expected 1, got %d\n", status);
1035 ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
1036 }
1037 SetLastError(0xdeadbeef);
1038 rc = DeleteFile(file);
1039 ok(!rc, "DeleteFile should fail\n");
1040 ok(GetLastError() == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %d\n", GetLastError());
1041 SetLastError(0xdeadbeef);
1042 rc = SetFileAttributes(file, FILE_ATTRIBUTE_ARCHIVE);
1043 ok(rc, "SetFileAttributes error %d\n", GetLastError());
1044 SetLastError(0xdeadbeef);
1045 rc = DeleteFile(file);
1046 ok(rc, "DeleteFile error %d\n", GetLastError());
1047
1048 CloseHandle(token);
1049 HeapFree(GetProcessHeap(), 0, sd);
1050 }
1051
1052 static void test_AccessCheck(void)
1053 {
1054 PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL;
1055 PACL Acl = NULL;
1056 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
1057 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
1058 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1059 GENERIC_MAPPING Mapping = { KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS };
1060 ACCESS_MASK Access;
1061 BOOL AccessStatus;
1062 HANDLE Token;
1063 HANDLE ProcessToken;
1064 BOOL ret;
1065 DWORD PrivSetLen;
1066 PRIVILEGE_SET *PrivSet;
1067 BOOL res;
1068 HMODULE NtDllModule;
1069 BOOLEAN Enabled;
1070 DWORD err;
1071 NTSTATUS ntret, ntAccessStatus;
1072
1073 NtDllModule = GetModuleHandle("ntdll.dll");
1074 if (!NtDllModule)
1075 {
1076 skip("not running on NT, skipping test\n");
1077 return;
1078 }
1079 pRtlAdjustPrivilege = (void *)GetProcAddress(NtDllModule, "RtlAdjustPrivilege");
1080 if (!pRtlAdjustPrivilege)
1081 {
1082 win_skip("missing RtlAdjustPrivilege, skipping test\n");
1083 return;
1084 }
1085
1086 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
1087 res = InitializeAcl(Acl, 256, ACL_REVISION);
1088 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
1089 {
1090 skip("ACLs not implemented - skipping tests\n");
1091 HeapFree(GetProcessHeap(), 0, Acl);
1092 return;
1093 }
1094 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
1095
1096 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
1097 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1098
1099 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1100 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdminSid);
1101 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1102
1103 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1104 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
1105 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1106
1107 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
1108
1109 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
1110 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1111
1112 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1113 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1114
1115 PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
1116 PrivSet = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PrivSetLen);
1117 PrivSet->PrivilegeCount = 16;
1118
1119 res = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &ProcessToken);
1120 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
1121
1122 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, FALSE, TRUE, &Enabled);
1123
1124 res = DuplicateToken(ProcessToken, SecurityImpersonation, &Token);
1125 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1126
1127 /* SD without owner/group */
1128 SetLastError(0xdeadbeef);
1129 Access = AccessStatus = 0x1abe11ed;
1130 ret = AccessCheck(SecurityDescriptor, Token, KEY_QUERY_VALUE, &Mapping,
1131 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1132 err = GetLastError();
1133 ok(!ret && err == ERROR_INVALID_SECURITY_DESCR, "AccessCheck should have "
1134 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err);
1135 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1136 "Access and/or AccessStatus were changed!\n");
1137
1138 /* Set owner and group */
1139 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
1140 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1141 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, TRUE);
1142 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1143
1144 /* Generic access mask */
1145 SetLastError(0xdeadbeef);
1146 Access = AccessStatus = 0x1abe11ed;
1147 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1148 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1149 err = GetLastError();
1150 ok(!ret && err == ERROR_GENERIC_NOT_MAPPED, "AccessCheck should have failed "
1151 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err);
1152 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1153 "Access and/or AccessStatus were changed!\n");
1154
1155 /* Generic access mask - no privilegeset buffer */
1156 SetLastError(0xdeadbeef);
1157 Access = AccessStatus = 0x1abe11ed;
1158 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1159 NULL, &PrivSetLen, &Access, &AccessStatus);
1160 err = GetLastError();
1161 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1162 "with ERROR_NOACCESS, instead of %d\n", err);
1163 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1164 "Access and/or AccessStatus were changed!\n");
1165
1166 /* Generic access mask - no returnlength */
1167 SetLastError(0xdeadbeef);
1168 Access = AccessStatus = 0x1abe11ed;
1169 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1170 PrivSet, NULL, &Access, &AccessStatus);
1171 err = GetLastError();
1172 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1173 "with ERROR_NOACCESS, instead of %d\n", err);
1174 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1175 "Access and/or AccessStatus were changed!\n");
1176
1177 /* Generic access mask - no privilegeset buffer, no returnlength */
1178 SetLastError(0xdeadbeef);
1179 Access = AccessStatus = 0x1abe11ed;
1180 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1181 NULL, NULL, &Access, &AccessStatus);
1182 err = GetLastError();
1183 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1184 "with ERROR_NOACCESS, instead of %d\n", err);
1185 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1186 "Access and/or AccessStatus were changed!\n");
1187
1188 /* sd with no dacl present */
1189 Access = AccessStatus = 0x1abe11ed;
1190 ret = SetSecurityDescriptorDacl(SecurityDescriptor, FALSE, NULL, FALSE);
1191 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1192 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1193 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1194 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1195 ok(AccessStatus && (Access == KEY_READ),
1196 "AccessCheck failed to grant access with error %d\n",
1197 GetLastError());
1198
1199 /* sd with no dacl present - no privilegeset buffer */
1200 SetLastError(0xdeadbeef);
1201 Access = AccessStatus = 0x1abe11ed;
1202 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1203 NULL, &PrivSetLen, &Access, &AccessStatus);
1204 err = GetLastError();
1205 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1206 "with ERROR_NOACCESS, instead of %d\n", err);
1207 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1208 "Access and/or AccessStatus were changed!\n");
1209
1210 if(pNtAccessCheck)
1211 {
1212 /* Generic access mask - no privilegeset buffer */
1213 SetLastError(0xdeadbeef);
1214 Access = ntAccessStatus = 0x1abe11ed;
1215 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1216 NULL, &PrivSetLen, &Access, &ntAccessStatus);
1217 err = GetLastError();
1218 ok(ntret == STATUS_ACCESS_VIOLATION,
1219 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1220 ok(err == 0xdeadbeef,
1221 "NtAccessCheck shouldn't set last error, got %d\n", err);
1222 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1223 "Access and/or AccessStatus were changed!\n");
1224
1225 /* Generic access mask - no returnlength */
1226 SetLastError(0xdeadbeef);
1227 Access = ntAccessStatus = 0x1abe11ed;
1228 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1229 PrivSet, NULL, &Access, &ntAccessStatus);
1230 err = GetLastError();
1231 ok(ntret == STATUS_ACCESS_VIOLATION,
1232 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1233 ok(err == 0xdeadbeef,
1234 "NtAccessCheck shouldn't set last error, got %d\n", err);
1235 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1236 "Access and/or AccessStatus were changed!\n");
1237
1238 /* Generic access mask - no privilegeset buffer, no returnlength */
1239 SetLastError(0xdeadbeef);
1240 Access = ntAccessStatus = 0x1abe11ed;
1241 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1242 NULL, NULL, &Access, &ntAccessStatus);
1243 err = GetLastError();
1244 ok(ntret == STATUS_ACCESS_VIOLATION,
1245 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1246 ok(err == 0xdeadbeef,
1247 "NtAccessCheck shouldn't set last error, got %d\n", err);
1248 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1249 "Access and/or AccessStatus were changed!\n");
1250 }
1251 else
1252 win_skip("NtAccessCheck unavailable. Skipping.\n");
1253
1254 /* sd with NULL dacl */
1255 Access = AccessStatus = 0x1abe11ed;
1256 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, NULL, FALSE);
1257 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1258 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1259 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1260 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1261 ok(AccessStatus && (Access == KEY_READ),
1262 "AccessCheck failed to grant access with error %d\n",
1263 GetLastError());
1264
1265 /* sd with blank dacl */
1266 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1267 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1268 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1269 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1270 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1271 err = GetLastError();
1272 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1273 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1274 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1275
1276 res = AddAccessAllowedAce(Acl, ACL_REVISION, KEY_READ, EveryoneSid);
1277 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
1278
1279 res = AddAccessDeniedAce(Acl, ACL_REVISION, KEY_SET_VALUE, AdminSid);
1280 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1281
1282 /* sd with dacl */
1283 Access = AccessStatus = 0x1abe11ed;
1284 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1285 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1286 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1287 ok(AccessStatus && (Access == KEY_READ),
1288 "AccessCheck failed to grant access with error %d\n",
1289 GetLastError());
1290
1291 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1292 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1293 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1294 ok(AccessStatus,
1295 "AccessCheck failed to grant any access with error %d\n",
1296 GetLastError());
1297 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access);
1298
1299 /* Access denied by SD */
1300 SetLastError(0xdeadbeef);
1301 Access = AccessStatus = 0x1abe11ed;
1302 ret = AccessCheck(SecurityDescriptor, Token, KEY_WRITE, &Mapping,
1303 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1304 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1305 err = GetLastError();
1306 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1307 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1308 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1309
1310 SetLastError(0);
1311 PrivSet->PrivilegeCount = 16;
1312 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1313 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1314 ok(ret && !AccessStatus && GetLastError() == ERROR_PRIVILEGE_NOT_HELD,
1315 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
1316 GetLastError());
1317
1318 ret = ImpersonateLoggedOnUser(Token);
1319 ok(ret, "ImpersonateLoggedOnUser failed with error %d\n", GetLastError());
1320 ret = pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, TRUE, TRUE, &Enabled);
1321 if (!ret)
1322 {
1323 SetLastError(0);
1324 PrivSet->PrivilegeCount = 16;
1325 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1326 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1327 ok(ret && AccessStatus && GetLastError() == 0,
1328 "AccessCheck should have succeeded, error %d\n",
1329 GetLastError());
1330 ok(Access == ACCESS_SYSTEM_SECURITY,
1331 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
1332 Access);
1333 }
1334 else
1335 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
1336 ret);
1337 ret = RevertToSelf();
1338 ok(ret, "RevertToSelf failed with error %d\n", GetLastError());
1339
1340 /* test INHERIT_ONLY_ACE */
1341 ret = InitializeAcl(Acl, 256, ACL_REVISION);
1342 ok(ret, "InitializeAcl failed with error %d\n", GetLastError());
1343
1344 /* NT doesn't have AddAccessAllowedAceEx. Skipping this call/test doesn't influence
1345 * the next ones.
1346 */
1347 if (pAddAccessAllowedAceEx)
1348 {
1349 ret = pAddAccessAllowedAceEx(Acl, ACL_REVISION, INHERIT_ONLY_ACE, KEY_READ, EveryoneSid);
1350 ok(ret, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1351 }
1352 else
1353 win_skip("AddAccessAllowedAceEx is not available\n");
1354
1355 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1356 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1357 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1358 err = GetLastError();
1359 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1360 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1361 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1362
1363 CloseHandle(Token);
1364
1365 res = DuplicateToken(ProcessToken, SecurityAnonymous, &Token);
1366 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1367
1368 SetLastError(0xdeadbeef);
1369 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1370 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1371 err = GetLastError();
1372 ok(!ret && err == ERROR_BAD_IMPERSONATION_LEVEL, "AccessCheck should have failed "
1373 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err);
1374
1375 CloseHandle(Token);
1376
1377 SetLastError(0xdeadbeef);
1378 ret = AccessCheck(SecurityDescriptor, ProcessToken, KEY_READ, &Mapping,
1379 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1380 err = GetLastError();
1381 ok(!ret && err == ERROR_NO_IMPERSONATION_TOKEN, "AccessCheck should have failed "
1382 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err);
1383
1384 CloseHandle(ProcessToken);
1385
1386 if (EveryoneSid)
1387 FreeSid(EveryoneSid);
1388 if (AdminSid)
1389 FreeSid(AdminSid);
1390 if (UsersSid)
1391 FreeSid(UsersSid);
1392 HeapFree(GetProcessHeap(), 0, Acl);
1393 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
1394 HeapFree(GetProcessHeap(), 0, PrivSet);
1395 }
1396
1397 /* test GetTokenInformation for the various attributes */
1398 static void test_token_attr(void)
1399 {
1400 HANDLE Token, ImpersonationToken;
1401 DWORD Size, Size2;
1402 TOKEN_PRIVILEGES *Privileges;
1403 TOKEN_GROUPS *Groups;
1404 TOKEN_USER *User;
1405 TOKEN_DEFAULT_DACL *Dacl;
1406 BOOL ret;
1407 DWORD i, GLE;
1408 LPSTR SidString;
1409 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1410 ACL *acl;
1411
1412 /* cygwin-like use case */
1413 SetLastError(0xdeadbeef);
1414 ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &Token);
1415 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1416 {
1417 win_skip("OpenProcessToken is not implemented\n");
1418 return;
1419 }
1420 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1421 if (ret)
1422 {
1423 DWORD buf[256]; /* GetTokenInformation wants a dword-aligned buffer */
1424 Size = sizeof(buf);
1425 ret = GetTokenInformation(Token, TokenUser,(void*)buf, Size, &Size);
1426 ok(ret, "GetTokenInformation failed with error %d\n", GetLastError());
1427 Size = sizeof(ImpersonationLevel);
1428 ret = GetTokenInformation(Token, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1429 GLE = GetLastError();
1430 ok(!ret && (GLE == ERROR_INVALID_PARAMETER), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE);
1431 CloseHandle(Token);
1432 }
1433
1434 if(!pConvertSidToStringSidA)
1435 {
1436 win_skip("ConvertSidToStringSidA is not available\n");
1437 return;
1438 }
1439
1440 SetLastError(0xdeadbeef);
1441 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &Token);
1442 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1443
1444 /* groups */
1445 SetLastError(0xdeadbeef);
1446 ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size);
1447 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1448 "GetTokenInformation(TokenGroups) %s with error %d\n",
1449 ret ? "succeeded" : "failed", GetLastError());
1450 Groups = HeapAlloc(GetProcessHeap(), 0, Size);
1451 SetLastError(0xdeadbeef);
1452 ret = GetTokenInformation(Token, TokenGroups, Groups, Size, &Size);
1453 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
1454 ok(GetLastError() == 0xdeadbeef,
1455 "GetTokenInformation shouldn't have set last error to %d\n",
1456 GetLastError());
1457 trace("TokenGroups:\n");
1458 for (i = 0; i < Groups->GroupCount; i++)
1459 {
1460 DWORD NameLength = 255;
1461 TCHAR Name[255];
1462 DWORD DomainLength = 255;
1463 TCHAR Domain[255];
1464 SID_NAME_USE SidNameUse;
1465 Name[0] = '\0';
1466 Domain[0] = '\0';
1467 ret = LookupAccountSid(NULL, Groups->Groups[i].Sid, Name, &NameLength, Domain, &DomainLength, &SidNameUse);
1468 if (ret)
1469 {
1470 pConvertSidToStringSidA(Groups->Groups[i].Sid, &SidString);
1471 trace("%s, %s\\%s use: %d attr: 0x%08x\n", SidString, Domain, Name, SidNameUse, Groups->Groups[i].Attributes);
1472 LocalFree(SidString);
1473 }
1474 else trace("attr: 0x%08x LookupAccountSid failed with error %d\n", Groups->Groups[i].Attributes, GetLastError());
1475 }
1476 HeapFree(GetProcessHeap(), 0, Groups);
1477
1478 /* user */
1479 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
1480 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1481 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1482 User = HeapAlloc(GetProcessHeap(), 0, Size);
1483 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
1484 ok(ret,
1485 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1486
1487 pConvertSidToStringSidA(User->User.Sid, &SidString);
1488 trace("TokenUser: %s attr: 0x%08x\n", SidString, User->User.Attributes);
1489 LocalFree(SidString);
1490 HeapFree(GetProcessHeap(), 0, User);
1491
1492 /* privileges */
1493 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
1494 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1495 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1496 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
1497 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
1498 ok(ret,
1499 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1500 trace("TokenPrivileges:\n");
1501 for (i = 0; i < Privileges->PrivilegeCount; i++)
1502 {
1503 TCHAR Name[256];
1504 DWORD NameLen = sizeof(Name)/sizeof(Name[0]);
1505 LookupPrivilegeName(NULL, &Privileges->Privileges[i].Luid, Name, &NameLen);
1506 trace("\t%s, 0x%x\n", Name, Privileges->Privileges[i].Attributes);
1507 }
1508 HeapFree(GetProcessHeap(), 0, Privileges);
1509
1510 ret = DuplicateToken(Token, SecurityAnonymous, &ImpersonationToken);
1511 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
1512
1513 Size = sizeof(ImpersonationLevel);
1514 ret = GetTokenInformation(ImpersonationToken, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1515 ok(ret, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
1516 ok(ImpersonationLevel == SecurityAnonymous, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel);
1517
1518 CloseHandle(ImpersonationToken);
1519
1520 /* default dacl */
1521 ret = GetTokenInformation(Token, TokenDefaultDacl, NULL, 0, &Size);
1522 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1523 "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1524
1525 Dacl = HeapAlloc(GetProcessHeap(), 0, Size);
1526 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size);
1527 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1528
1529 SetLastError(0xdeadbeef);
1530 ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, 0);
1531 GLE = GetLastError();
1532 ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1533 ok(GLE == ERROR_BAD_LENGTH, "expected ERROR_BAD_LENGTH got %u\n", GLE);
1534
1535 SetLastError(0xdeadbeef);
1536 ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, Size);
1537 GLE = GetLastError();
1538 ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1539 ok(GLE == ERROR_NOACCESS, "expected ERROR_NOACCESS got %u\n", GLE);
1540
1541 acl = Dacl->DefaultDacl;
1542 Dacl->DefaultDacl = NULL;
1543
1544 ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1545 ok(ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1546
1547 Size2 = 0;
1548 Dacl->DefaultDacl = (ACL *)0xdeadbeef;
1549 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1550 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1551 ok(Dacl->DefaultDacl == NULL, "expected NULL, got %p\n", Dacl->DefaultDacl);
1552 ok(Size2 == sizeof(TOKEN_DEFAULT_DACL) || broken(Size2 == 2*sizeof(TOKEN_DEFAULT_DACL)), /* WoW64 */
1553 "got %u expected sizeof(TOKEN_DEFAULT_DACL)\n", Size2);
1554
1555 Dacl->DefaultDacl = acl;
1556 ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1557 ok(ret, "SetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1558
1559 if (Size2 == sizeof(TOKEN_DEFAULT_DACL)) {
1560 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1561 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1562 } else
1563 win_skip("TOKEN_DEFAULT_DACL size too small on WoW64\n");
1564
1565 HeapFree(GetProcessHeap(), 0, Dacl);
1566 CloseHandle(Token);
1567 }
1568
1569 typedef union _MAX_SID
1570 {
1571 SID sid;
1572 char max[SECURITY_MAX_SID_SIZE];
1573 } MAX_SID;
1574
1575 static void test_sid_str(PSID * sid)
1576 {
1577 char *str_sid;
1578 BOOL ret = pConvertSidToStringSidA(sid, &str_sid);
1579 ok(ret, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
1580 if (ret)
1581 {
1582 char account[MAX_PATH], domain[MAX_PATH];
1583 SID_NAME_USE use;
1584 DWORD acc_size = MAX_PATH;
1585 DWORD dom_size = MAX_PATH;
1586 ret = LookupAccountSid(NULL, sid, account, &acc_size, domain, &dom_size, &use);
1587 ok(ret || (!ret && (GetLastError() == ERROR_NONE_MAPPED)),
1588 "LookupAccountSid(%s) failed: %d\n", str_sid, GetLastError());
1589 if (ret)
1590 trace(" %s %s\\%s %d\n", str_sid, domain, account, use);
1591 else if (GetLastError() == ERROR_NONE_MAPPED)
1592 trace(" %s couldn't be mapped\n", str_sid);
1593 LocalFree(str_sid);
1594 }
1595 }
1596
1597 static const struct well_known_sid_value
1598 {
1599 BOOL without_domain;
1600 const char *sid_string;
1601 } well_known_sid_values[] = {
1602 /* 0 */ {TRUE, "S-1-0-0"}, {TRUE, "S-1-1-0"}, {TRUE, "S-1-2-0"}, {TRUE, "S-1-3-0"},
1603 /* 4 */ {TRUE, "S-1-3-1"}, {TRUE, "S-1-3-2"}, {TRUE, "S-1-3-3"}, {TRUE, "S-1-5"},
1604 /* 8 */ {FALSE, "S-1-5-1"}, {TRUE, "S-1-5-2"}, {TRUE, "S-1-5-3"}, {TRUE, "S-1-5-4"},
1605 /* 12 */ {TRUE, "S-1-5-6"}, {TRUE, "S-1-5-7"}, {TRUE, "S-1-5-8"}, {TRUE, "S-1-5-9"},
1606 /* 16 */ {TRUE, "S-1-5-10"}, {TRUE, "S-1-5-11"}, {TRUE, "S-1-5-12"}, {TRUE, "S-1-5-13"},
1607 /* 20 */ {TRUE, "S-1-5-14"}, {FALSE, NULL}, {TRUE, "S-1-5-18"}, {TRUE, "S-1-5-19"},
1608 /* 24 */ {TRUE, "S-1-5-20"}, {TRUE, "S-1-5-32"},
1609 /* 26 */ {FALSE, "S-1-5-32-544"}, {TRUE, "S-1-5-32-545"}, {TRUE, "S-1-5-32-546"},
1610 /* 29 */ {TRUE, "S-1-5-32-547"}, {TRUE, "S-1-5-32-548"}, {TRUE, "S-1-5-32-549"},
1611 /* 32 */ {TRUE, "S-1-5-32-550"}, {TRUE, "S-1-5-32-551"}, {TRUE, "S-1-5-32-552"},
1612 /* 35 */ {TRUE, "S-1-5-32-554"}, {TRUE, "S-1-5-32-555"}, {TRUE, "S-1-5-32-556"},
1613 /* 38 */ {FALSE, "S-1-5-21-12-23-34-45-56-500"}, {FALSE, "S-1-5-21-12-23-34-45-56-501"},
1614 /* 40 */ {FALSE, "S-1-5-21-12-23-34-45-56-502"}, {FALSE, "S-1-5-21-12-23-34-45-56-512"},
1615 /* 42 */ {FALSE, "S-1-5-21-12-23-34-45-56-513"}, {FALSE, "S-1-5-21-12-23-34-45-56-514"},
1616 /* 44 */ {FALSE, "S-1-5-21-12-23-34-45-56-515"}, {FALSE, "S-1-5-21-12-23-34-45-56-516"},
1617 /* 46 */ {FALSE, "S-1-5-21-12-23-34-45-56-517"}, {FALSE, "S-1-5-21-12-23-34-45-56-518"},
1618 /* 48 */ {FALSE, "S-1-5-21-12-23-34-45-56-519"}, {FALSE, "S-1-5-21-12-23-34-45-56-520"},
1619 /* 50 */ {FALSE, "S-1-5-21-12-23-34-45-56-553"},
1620 /* Added in Windows Server 2003 */
1621 /* 51 */ {TRUE, "S-1-5-64-10"}, {TRUE, "S-1-5-64-21"}, {TRUE, "S-1-5-64-14"},
1622 /* 54 */ {TRUE, "S-1-5-15"}, {TRUE, "S-1-5-1000"}, {FALSE, "S-1-5-32-557"},
1623 /* 57 */ {TRUE, "S-1-5-32-558"}, {TRUE, "S-1-5-32-559"}, {TRUE, "S-1-5-32-560"},
1624 /* 60 */ {TRUE, "S-1-5-32-561"}, {TRUE, "S-1-5-32-562"},
1625 /* Added in Windows Vista: */
1626 /* 62 */ {TRUE, "S-1-5-32-568"},
1627 /* 63 */ {TRUE, "S-1-5-17"}, {FALSE, "S-1-5-32-569"}, {TRUE, "S-1-16-0"},
1628 /* 66 */ {TRUE, "S-1-16-4096"}, {TRUE, "S-1-16-8192"}, {TRUE, "S-1-16-12288"},
1629 /* 69 */ {TRUE, "S-1-16-16384"}, {TRUE, "S-1-5-33"}, {TRUE, "S-1-3-4"},
1630 /* 72 */ {FALSE, "S-1-5-21-12-23-34-45-56-571"}, {FALSE, "S-1-5-21-12-23-34-45-56-572"},
1631 /* 74 */ {TRUE, "S-1-5-22"}, {FALSE, "S-1-5-21-12-23-34-45-56-521"}, {TRUE, "S-1-5-32-573"}
1632 };
1633
1634 static void test_CreateWellKnownSid(void)
1635 {
1636 SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
1637 PSID domainsid, sid;
1638 DWORD size, error;
1639 BOOL ret;
1640 unsigned int i;
1641
1642 if (!pCreateWellKnownSid)
1643 {
1644 win_skip("CreateWellKnownSid not available\n");
1645 return;
1646 }
1647
1648 size = 0;
1649 SetLastError(0xdeadbeef);
1650 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1651 error = GetLastError();
1652 ok(!ret, "CreateWellKnownSid succeeded\n");
1653 ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
1654 ok(size, "expected size > 0\n");
1655
1656 SetLastError(0xdeadbeef);
1657 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1658 error = GetLastError();
1659 ok(!ret, "CreateWellKnownSid succeeded\n");
1660 ok(error == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %u\n", error);
1661
1662 sid = HeapAlloc(GetProcessHeap(), 0, size);
1663 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, sid, &size);
1664 ok(ret, "CreateWellKnownSid failed %u\n", GetLastError());
1665 HeapFree(GetProcessHeap(), 0, sid);
1666
1667 /* a domain sid usually have three subauthorities but we test that CreateWellKnownSid doesn't check it */
1668 AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
1669
1670 for (i = 0; i < sizeof(well_known_sid_values)/sizeof(well_known_sid_values[0]); i++)
1671 {
1672 const struct well_known_sid_value *value = &well_known_sid_values[i];
1673 char sid_buffer[SECURITY_MAX_SID_SIZE];
1674 LPSTR str;
1675 DWORD cb;
1676
1677 if (value->sid_string == NULL)
1678 continue;
1679
1680 if (i > WinAccountRasAndIasServersSid)
1681 {
1682 /* These SIDs aren't implemented by all Windows versions - detect it and break the loop */
1683 cb = sizeof(sid_buffer);
1684 if (!pCreateWellKnownSid(i, domainsid, sid_buffer, &cb))
1685 {
1686 skip("Well known SIDs starting from %u are not implemented\n", i);
1687 break;
1688 }
1689 }
1690
1691 cb = sizeof(sid_buffer);
1692 ok(pCreateWellKnownSid(i, value->without_domain ? NULL : domainsid, sid_buffer, &cb), "Couldn't create well known sid %u\n", i);
1693 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
1694 ok(IsValidSid(sid_buffer), "The sid is not valid\n");
1695 ok(pConvertSidToStringSidA(sid_buffer, &str), "Couldn't convert SID to string\n");
1696 ok(strcmp(str, value->sid_string) == 0, "SID mismatch - expected %s, got %s\n",
1697 value->sid_string, str);
1698 LocalFree(str);
1699
1700 if (value->without_domain)
1701 {
1702 char buf2[SECURITY_MAX_SID_SIZE];
1703 cb = sizeof(buf2);
1704 ok(pCreateWellKnownSid(i, domainsid, buf2, &cb), "Couldn't create well known sid %u with optional domain\n", i);
1705 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
1706 ok(memcmp(buf2, sid_buffer, cb) == 0, "SID create with domain is different than without (%u)\n", i);
1707 }
1708 }
1709
1710 FreeSid(domainsid);
1711 }
1712
1713 static void test_LookupAccountSid(void)
1714 {
1715 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1716 CHAR accountA[MAX_PATH], domainA[MAX_PATH], usernameA[MAX_PATH];
1717 DWORD acc_sizeA, dom_sizeA, user_sizeA;
1718 DWORD real_acc_sizeA, real_dom_sizeA;
1719 WCHAR accountW[MAX_PATH], domainW[MAX_PATH];
1720 DWORD acc_sizeW, dom_sizeW;
1721 DWORD real_acc_sizeW, real_dom_sizeW;
1722 PSID pUsersSid = NULL;
1723 SID_NAME_USE use;
1724 BOOL ret;
1725 DWORD error, size, cbti = 0;
1726 MAX_SID max_sid;
1727 CHAR *str_sidA;
1728 int i;
1729 HANDLE hToken;
1730 PTOKEN_USER ptiUser = NULL;
1731
1732 /* native windows crashes if account size, domain size, or name use is NULL */
1733
1734 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1735 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &pUsersSid);
1736 ok(ret || (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED),
1737 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1738
1739 /* not running on NT so give up */
1740 if (!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1741 return;
1742
1743 real_acc_sizeA = MAX_PATH;
1744 real_dom_sizeA = MAX_PATH;
1745 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1746 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1747
1748 /* try NULL account */
1749 acc_sizeA = MAX_PATH;
1750 dom_sizeA = MAX_PATH;
1751 ret = LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1752 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1753
1754 /* try NULL domain */
1755 acc_sizeA = MAX_PATH;
1756 dom_sizeA = MAX_PATH;
1757 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1758 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1759
1760 /* try a small account buffer */
1761 acc_sizeA = 1;
1762 dom_sizeA = MAX_PATH;
1763 accountA[0] = 0;
1764 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1765 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1766 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1767 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1768
1769 /* try a 0 sized account buffer */
1770 acc_sizeA = 0;
1771 dom_sizeA = MAX_PATH;
1772 accountA[0] = 0;
1773 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1774 /* this can fail or succeed depending on OS version but the size will always be returned */
1775 ok(acc_sizeA == real_acc_sizeA + 1,
1776 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1777 real_acc_sizeA + 1, acc_sizeA);
1778
1779 /* try a 0 sized account buffer */
1780 acc_sizeA = 0;
1781 dom_sizeA = MAX_PATH;
1782 LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1783 /* this can fail or succeed depending on OS version but the size will always be returned */
1784 ok(acc_sizeA == real_acc_sizeA + 1,
1785 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1786 real_acc_sizeA + 1, acc_sizeA);
1787
1788 /* try a small domain buffer */
1789 dom_sizeA = 1;
1790 acc_sizeA = MAX_PATH;
1791 accountA[0] = 0;
1792 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1793 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1794 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1795 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1796
1797 /* try a 0 sized domain buffer */
1798 dom_sizeA = 0;
1799 acc_sizeA = MAX_PATH;
1800 accountA[0] = 0;
1801 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1802 /* this can fail or succeed depending on OS version but the size will always be returned */
1803 ok(dom_sizeA == real_dom_sizeA + 1,
1804 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1805 real_dom_sizeA + 1, dom_sizeA);
1806
1807 /* try a 0 sized domain buffer */
1808 dom_sizeA = 0;
1809 acc_sizeA = MAX_PATH;
1810 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1811 /* this can fail or succeed depending on OS version but the size will always be returned */
1812 ok(dom_sizeA == real_dom_sizeA + 1,
1813 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1814 real_dom_sizeA + 1, dom_sizeA);
1815
1816 real_acc_sizeW = MAX_PATH;
1817 real_dom_sizeW = MAX_PATH;
1818 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &real_acc_sizeW, domainW, &real_dom_sizeW, &use);
1819 ok(ret, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1820
1821 /* try an invalid system name */
1822 real_acc_sizeA = MAX_PATH;
1823 real_dom_sizeA = MAX_PATH;
1824 ret = LookupAccountSidA("deepthought", pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1825 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1826 ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
1827 "LookupAccountSidA() Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %u\n", GetLastError());
1828
1829 /* native windows crashes if domainW or accountW is NULL */
1830
1831 /* try a small account buffer */
1832 acc_sizeW = 1;
1833 dom_sizeW = MAX_PATH;
1834 accountW[0] = 0;
1835 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1836 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1837 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1838 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1839
1840 /* try a 0 sized account buffer */
1841 acc_sizeW = 0;
1842 dom_sizeW = MAX_PATH;
1843 accountW[0] = 0;
1844 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1845 /* this can fail or succeed depending on OS version but the size will always be returned */
1846 ok(acc_sizeW == real_acc_sizeW + 1,
1847 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1848 real_acc_sizeW + 1, acc_sizeW);
1849
1850 /* try a 0 sized account buffer */
1851 acc_sizeW = 0;
1852 dom_sizeW = MAX_PATH;
1853 LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, domainW, &dom_sizeW, &use);
1854 /* this can fail or succeed depending on OS version but the size will always be returned */
1855 ok(acc_sizeW == real_acc_sizeW + 1,
1856 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1857 real_acc_sizeW + 1, acc_sizeW);
1858
1859 /* try a small domain buffer */
1860 dom_sizeW = 1;
1861 acc_sizeW = MAX_PATH;
1862 accountW[0] = 0;
1863 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1864 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1865 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1866 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1867
1868 /* try a 0 sized domain buffer */
1869 dom_sizeW = 0;
1870 acc_sizeW = MAX_PATH;
1871 accountW[0] = 0;
1872 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1873 /* this can fail or succeed depending on OS version but the size will always be returned */
1874 ok(dom_sizeW == real_dom_sizeW + 1,
1875 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1876 real_dom_sizeW + 1, dom_sizeW);
1877
1878 /* try a 0 sized domain buffer */
1879 dom_sizeW = 0;
1880 acc_sizeW = MAX_PATH;
1881 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, NULL, &dom_sizeW, &use);
1882 /* this can fail or succeed depending on OS version but the size will always be returned */
1883 ok(dom_sizeW == real_dom_sizeW + 1,
1884 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1885 real_dom_sizeW + 1, dom_sizeW);
1886
1887 acc_sizeW = dom_sizeW = use = 0;
1888 SetLastError(0xdeadbeef);
1889 ret = LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, NULL, &dom_sizeW, &use);
1890 error = GetLastError();
1891 ok(!ret, "LookupAccountSidW failed %u\n", GetLastError());
1892 ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
1893 ok(acc_sizeW, "expected non-zero account size\n");
1894 ok(dom_sizeW, "expected non-zero domain size\n");
1895 ok(!use, "expected zero use %u\n", use);
1896
1897 FreeSid(pUsersSid);
1898
1899 /* Test LookupAccountSid with Sid retrieved from token information.
1900 This assumes this process is running under the account of the current user.*/
1901 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY|TOKEN_DUPLICATE, &hToken);
1902 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1903 ret = GetTokenInformation(hToken, TokenUser, NULL, 0, &cbti);
1904 ok(!ret, "GetTokenInformation failed with error %d\n", GetLastError());
1905 ptiUser = HeapAlloc(GetProcessHeap(), 0, cbti);
1906 if (GetTokenInformation(hToken, TokenUser, ptiUser, cbti, &cbti))
1907 {
1908 acc_sizeA = dom_sizeA = MAX_PATH;
1909 ret = LookupAccountSidA(NULL, ptiUser->User.Sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1910 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1911 user_sizeA = MAX_PATH;
1912 ret = GetUserNameA(usernameA , &user_sizeA);
1913 ok(ret, "GetUserNameA() Expected TRUE, got FALSE\n");
1914 ok(lstrcmpA(usernameA, accountA) == 0, "LookupAccountSidA() Expected account name: %s got: %s\n", usernameA, accountA );
1915 }
1916 HeapFree(GetProcessHeap(), 0, ptiUser);
1917
1918 if (pCreateWellKnownSid && pConvertSidToStringSidA)
1919 {
1920 trace("Well Known SIDs:\n");
1921 for (i = 0; i <= 60; i++)
1922 {
1923 size = SECURITY_MAX_SID_SIZE;
1924 if (pCreateWellKnownSid(i, NULL, &max_sid.sid, &size))
1925 {
1926 if (pConvertSidToStringSidA(&max_sid.sid, &str_sidA))
1927 {
1928 acc_sizeA = MAX_PATH;
1929 dom_sizeA = MAX_PATH;
1930 if (LookupAccountSidA(NULL, &max_sid.sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use))
1931 trace(" %d: %s %s\\%s %d\n", i, str_sidA, domainA, accountA, use);
1932 LocalFree(str_sidA);
1933 }
1934 }
1935 else
1936 {
1937 if (GetLastError() != ERROR_INVALID_PARAMETER)
1938 trace(" CreateWellKnownSid(%d) failed: %d\n", i, GetLastError());
1939 else
1940 trace(" %d: not supported\n", i);
1941 }
1942 }
1943
1944 pLsaQueryInformationPolicy = (void *)GetProcAddress( hmod, "LsaQueryInformationPolicy");
1945 pLsaOpenPolicy = (void *)GetProcAddress( hmod, "LsaOpenPolicy");
1946 pLsaFreeMemory = (void *)GetProcAddress( hmod, "LsaFreeMemory");
1947 pLsaClose = (void *)GetProcAddress( hmod, "LsaClose");
1948
1949 if (pLsaQueryInformationPolicy && pLsaOpenPolicy && pLsaFreeMemory && pLsaClose)
1950 {
1951 NTSTATUS status;
1952 LSA_HANDLE handle;
1953 LSA_OBJECT_ATTRIBUTES object_attributes;
1954
1955 ZeroMemory(&object_attributes, sizeof(object_attributes));
1956 object_attributes.Length = sizeof(object_attributes);
1957
1958 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_ALL_ACCESS, &handle);
1959 ok(status == STATUS_SUCCESS || status == STATUS_ACCESS_DENIED,
1960 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status);
1961
1962 /* try a more restricted access mask if necessary */
1963 if (status == STATUS_ACCESS_DENIED) {
1964 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
1965 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_VIEW_LOCAL_INFORMATION, &handle);
1966 ok(status == STATUS_SUCCESS, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status);
1967 }
1968
1969 if (status == STATUS_SUCCESS)
1970 {
1971 PPOLICY_ACCOUNT_DOMAIN_INFO info;
1972 status = pLsaQueryInformationPolicy(handle, PolicyAccountDomainInformation, (PVOID*)&info);
1973 ok(status == STATUS_SUCCESS, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status);
1974 if (status == STATUS_SUCCESS)
1975 {
1976 ok(info->DomainSid!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
1977 if (info->DomainSid)
1978 {
1979 int count = *GetSidSubAuthorityCount(info->DomainSid);
1980 CopySid(GetSidLengthRequired(count), &max_sid, info->DomainSid);
1981 test_sid_str((PSID)&max_sid.sid);
1982 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_ADMIN;
1983 max_sid.sid.SubAuthorityCount = count + 1;
1984 test_sid_str((PSID)&max_sid.sid);
1985 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_GUEST;
1986 test_sid_str((PSID)&max_sid.sid);
1987 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ADMINS;
1988 test_sid_str((PSID)&max_sid.sid);
1989 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_USERS;
1990 test_sid_str((PSID)&max_sid.sid);
1991 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_GUESTS;
1992 test_sid_str((PSID)&max_sid.sid);
1993 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_COMPUTERS;
1994 test_sid_str((PSID)&max_sid.sid);
1995 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CONTROLLERS;
1996 test_sid_str((PSID)&max_sid.sid);
1997 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CERT_ADMINS;
1998 test_sid_str((PSID)&max_sid.sid);
1999 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_SCHEMA_ADMINS;
2000 test_sid_str((PSID)&max_sid.sid);
2001 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS;
2002 test_sid_str((PSID)&max_sid.sid);
2003 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_POLICY_ADMINS;
2004 test_sid_str((PSID)&max_sid.sid);
2005 max_sid.sid.SubAuthority[count] = DOMAIN_ALIAS_RID_RAS_SERVERS;
2006 test_sid_str((PSID)&max_sid.sid);
2007 max_sid.sid.SubAuthority[count] = 1000; /* first user account */
2008 test_sid_str((PSID)&max_sid.sid);
2009 }
2010
2011 pLsaFreeMemory((LPVOID)info);
2012 }
2013
2014 status = pLsaClose(handle);
2015 ok(status == STATUS_SUCCESS, "LsaClose() failed, returned 0x%08x\n", status);
2016 }
2017 }
2018 }
2019 }
2020
2021 static BOOL get_sid_info(PSID psid, LPSTR *user, LPSTR *dom)
2022 {
2023 static CHAR account[UNLEN + 1];
2024 static CHAR domain[UNLEN + 1];
2025 DWORD size, dom_size;
2026 SID_NAME_USE use;
2027
2028 *user = account;
2029 *dom = domain;
2030
2031 size = dom_size = UNLEN + 1;
2032 account[0] = '\0';
2033 domain[0] = '\0';
2034 SetLastError(0xdeadbeef);
2035 return LookupAccountSidA(NULL, psid, account, &size, domain, &dom_size, &use);
2036 }
2037
2038 static void check_wellknown_name(const char* name, WELL_KNOWN_SID_TYPE result)
2039 {
2040 SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
2041 PSID domainsid = NULL;
2042 char wk_sid[SECURITY_MAX_SID_SIZE];
2043 DWORD cb;
2044
2045 DWORD sid_size, domain_size;
2046 SID_NAME_USE sid_use;
2047 LPSTR domain, account, sid_domain, wk_domain, wk_account;
2048 PSID psid;
2049 BOOL ret ,ret2;
2050
2051 sid_size = 0;
2052 domain_size = 0;
2053 ret = LookupAccountNameA(NULL, name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2054 ok(!ret, " %s Should have failed to lookup account name\n", name);
2055 psid = HeapAlloc(GetProcessHeap(),0,sid_size);
2056 domain = HeapAlloc(GetProcessHeap(),0,domain_size);
2057 ret = LookupAccountNameA(NULL, name, psid, &sid_size, domain, &domain_size, &sid_use);
2058
2059 if (!result)
2060 {
2061 ok(!ret, " %s Should have failed to lookup account name\n",name);
2062 goto cleanup;
2063 }
2064
2065 AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
2066 cb = sizeof(wk_sid);
2067 if (!pCreateWellKnownSid(result, domainsid, wk_sid, &cb))
2068 {
2069 win_skip("SID %i is not available on the system\n",result);
2070 goto cleanup;
2071 }
2072
2073 ret2 = get_sid_info(wk_sid, &wk_account, &wk_domain);
2074 if (!ret2 && GetLastError() == ERROR_NONE_MAPPED)
2075 {
2076 win_skip("CreateWellKnownSid() succeeded but the account '%s' is not present (W2K)\n", name);
2077 goto cleanup;
2078 }
2079
2080 get_sid_info(psid, &account, &sid_domain);
2081
2082 ok(ret, "Failed to lookup account name %s\n",name);
2083 ok(sid_size != 0, "sid_size was zero\n");
2084
2085 ok(EqualSid(psid,wk_sid),"(%s) Sids fail to match well known sid!\n",name);
2086
2087 ok(!lstrcmp(account, wk_account), "Expected %s , got %s\n", account, wk_account);
2088 ok(!lstrcmp(domain, wk_domain), "Expected %s, got %s\n", wk_domain, domain);
2089 ok(sid_use == SidTypeWellKnownGroup , "Expected Use (5), got %d\n", sid_use);
2090
2091 cleanup:
2092 FreeSid(domainsid);
2093 HeapFree(GetProcessHeap(),0,psid);
2094 HeapFree(GetProcessHeap(),0,domain);
2095 }
2096
2097 static void test_LookupAccountName(void)
2098 {
2099 DWORD sid_size, domain_size, user_size;
2100 DWORD sid_save, domain_save;
2101 CHAR user_name[UNLEN + 1];
2102 CHAR computer_name[UNLEN + 1];
2103 SID_NAME_USE sid_use;
2104 LPSTR domain, account, sid_dom;
2105 PSID psid;
2106 BOOL ret;
2107
2108 /* native crashes if (assuming all other parameters correct):
2109 * - peUse is NULL
2110 * - Sid is NULL and cbSid is > 0
2111 * - cbSid or cchReferencedDomainName are NULL
2112 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
2113 */
2114
2115 user_size = UNLEN + 1;
2116 SetLastError(0xdeadbeef);
2117 ret = GetUserNameA(user_name, &user_size);
2118 ok(ret, "Failed to get user name : %d\n", GetLastError());
2119
2120 /* get sizes */
2121 sid_size = 0;
2122 domain_size = 0;
2123 sid_use = 0xcafebabe;
2124 SetLastError(0xdeadbeef);
2125 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2126 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2127 {
2128 win_skip("LookupAccountNameA is not implemented\n");
2129 return;
2130 }
2131 ok(!ret, "Expected 0, got %d\n", ret);
2132 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2133 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2134 ok(sid_size != 0, "Expected non-zero sid size\n");
2135 ok(domain_size != 0, "Expected non-zero domain size\n");
2136 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2137
2138 sid_save = sid_size;
2139 domain_save = domain_size;
2140
2141 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2142 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2143
2144 /* try valid account name */
2145 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, domain, &domain_size, &sid_use);
2146 get_sid_info(psid, &account, &sid_dom);
2147 ok(ret, "Failed to lookup account name\n");
2148 ok(sid_size == GetLengthSid(psid), "Expected %d, got %d\n", GetLengthSid(psid), sid_size);
2149 ok(!lstrcmp(account, user_name), "Expected %s, got %s\n", user_name, account);
2150 ok(!lstrcmp(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2151 ok(domain_size == domain_save - 1, "Expected %d, got %d\n", domain_save - 1, domain_size);
2152 ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlen(domain), domain_size);
2153 ok(sid_use == SidTypeUser, "Expected SidTypeUser (%d), got %d\n", SidTypeUser, sid_use);
2154 domain_size = domain_save;
2155 sid_size = sid_save;
2156
2157 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2158 {
2159 skip("Non-english locale (test with hardcoded 'Everyone')\n");
2160 }
2161 else
2162 {
2163 ret = LookupAccountNameA(NULL, "Everyone", psid, &sid_size, domain, &domain_size, &sid_use);
2164 get_sid_info(psid, &account, &sid_dom);
2165 ok(ret, "Failed to lookup account name\n");
2166 ok(sid_size != 0, "sid_size was zero\n");
2167 ok(!lstrcmp(account, "Everyone"), "Expected Everyone, got %s\n", account);
2168 ok(!lstrcmp(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2169 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2170 ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlen(domain), domain_size);
2171 ok(sid_use == SidTypeWellKnownGroup, "Expected SidTypeWellKnownGroup (%d), got %d\n", SidTypeWellKnownGroup, sid_use);
2172 domain_size = domain_save;
2173 }
2174
2175 /* NULL Sid with zero sid size */
2176 SetLastError(0xdeadbeef);
2177 sid_size = 0;
2178 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2179 ok(!ret, "Expected 0, got %d\n", ret);
2180 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2181 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2182 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2183 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2184
2185 /* try cchReferencedDomainName - 1 */
2186 SetLastError(0xdeadbeef);
2187 domain_size--;
2188 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2189 ok(!ret, "Expected 0, got %d\n", ret);
2190 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2191 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2192 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2193 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2194
2195 /* NULL ReferencedDomainName with zero domain name size */
2196 SetLastError(0xdeadbeef);
2197 domain_size = 0;
2198 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, NULL, &domain_size, &sid_use);
2199 ok(!ret, "Expected 0, got %d\n", ret);
2200 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2201 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2202 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2203 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2204
2205 HeapFree(GetProcessHeap(), 0, psid);
2206 HeapFree(GetProcessHeap(), 0, domain);
2207
2208 /* get sizes for NULL account name */
2209 sid_size = 0;
2210 domain_size = 0;
2211 sid_use = 0xcafebabe;
2212 SetLastError(0xdeadbeef);
2213 ret = LookupAccountNameA(NULL, NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2214 if (!ret && GetLastError() == ERROR_NONE_MAPPED)
2215 win_skip("NULL account name doesn't work on NT4\n");
2216 else
2217 {
2218 ok(!ret, "Expected 0, got %d\n", ret);
2219 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2220 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2221 ok(sid_size != 0, "Expected non-zero sid size\n");
2222 ok(domain_size != 0, "Expected non-zero domain size\n");
2223 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2224
2225 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2226 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2227
2228 /* try NULL account name */
2229 ret = LookupAccountNameA(NULL, NULL, psid, &sid_size, domain, &domain_size, &sid_use);
2230 get_sid_info(psid, &account, &sid_dom);
2231 ok(ret, "Failed to lookup account name\n");
2232 /* Using a fixed string will not work on different locales */
2233 ok(!lstrcmp(account, domain),
2234 "Got %s for account and %s for domain, these should be the same\n",
2235 account, domain);
2236 ok(sid_use == SidTypeDomain, "Expected SidTypeDomain (%d), got %d\n", SidTypeDomain, sid_use);
2237
2238 HeapFree(GetProcessHeap(), 0, psid);
2239 HeapFree(GetProcessHeap(), 0, domain);
2240 }
2241
2242 /* try an invalid account name */
2243 SetLastError(0xdeadbeef);
2244 sid_size = 0;
2245 domain_size = 0;
2246 ret = LookupAccountNameA(NULL, "oogabooga", NULL, &sid_size, NULL, &domain_size, &sid_use);
2247 ok(!ret, "Expected 0, got %d\n", ret);
2248 ok(GetLastError() == ERROR_NONE_MAPPED ||
2249 broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE),
2250 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
2251 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2252 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2253
2254 /* try an invalid system name */
2255 SetLastError(0xdeadbeef);
2256 sid_size = 0;
2257 domain_size = 0;
2258 ret = LookupAccountNameA("deepthought", NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2259 ok(!ret, "Expected 0, got %d\n", ret);
2260 ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
2261 "Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %d\n", GetLastError());
2262 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2263 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2264
2265 /* try with the computer name as the account name */
2266 domain_size = sizeof(computer_name);
2267 GetComputerNameA(computer_name, &domain_size);
2268 sid_size = 0;
2269 domain_size = 0;
2270 ret = LookupAccountNameA(NULL, computer_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2271 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER ||
2272 GetLastError() == ERROR_NONE_MAPPED /* in a domain */ ||
2273 broken(GetLastError() == ERROR_TRUSTED_DOMAIN_FAILURE) ||
2274 broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE)),
2275 "LookupAccountNameA failed: %d\n", GetLastError());
2276 if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
2277 {
2278 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2279 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2280 ret = LookupAccountNameA(NULL, computer_name, psid, &sid_size, domain, &domain_size, &sid_use);
2281 ok(ret, "LookupAccountNameA failed: %d\n", GetLastError());
2282 ok(sid_use == SidTypeDomain ||
2283 (sid_use == SidTypeUser && ! strcmp(computer_name, user_name)), "expected SidTypeDomain for %s, got %d\n", computer_name, sid_use);
2284 HeapFree(GetProcessHeap(), 0, domain);
2285 HeapFree(GetProcessHeap(), 0, psid);
2286 }
2287
2288 /* Well Known names */
2289 if (!pCreateWellKnownSid)
2290 {
2291 win_skip("CreateWellKnownSid not available\n");
2292 return;
2293 }
2294
2295 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2296 {
2297 skip("Non-english locale (skipping well known name creation tests)\n");
2298 return;
2299 }
2300
2301 check_wellknown_name("LocalService", WinLocalServiceSid);
2302 check_wellknown_name("Local Service", WinLocalServiceSid);
2303 /* 2 spaces */
2304 check_wellknown_name("Local Service", 0);
2305 check_wellknown_name("NetworkService", WinNetworkServiceSid);
2306 check_wellknown_name("Network Service", WinNetworkServiceSid);
2307
2308 /* example of some names where the spaces are not optional */
2309 check_wellknown_name("Terminal Server User", WinTerminalServerSid);
2310 check_wellknown_name("TerminalServer User", 0);
2311 check_wellknown_name("TerminalServerUser", 0);
2312 check_wellknown_name("Terminal ServerUser", 0);
2313
2314 check_wellknown_name("enterprise domain controllers",WinEnterpriseControllersSid);
2315 check_wellknown_name("enterprisedomain controllers", 0);
2316 check_wellknown_name("enterprise domaincontrollers", 0);
2317 check_wellknown_name("enterprisedomaincontrollers", 0);
2318
2319 /* case insensitivity */
2320 check_wellknown_name("lOCAlServICE", WinLocalServiceSid);
2321
2322 /* fully qualified account names */
2323 check_wellknown_name("NT AUTHORITY\\LocalService", WinLocalServiceSid);
2324 check_wellknown_name("nt authority\\Network Service", WinNetworkServiceSid);
2325 check_wellknown_name("nt authority test\\Network Service", 0);
2326 check_wellknown_name("Dummy\\Network Service", 0);
2327 check_wellknown_name("ntauthority\\Network Service", 0);
2328 }
2329
2330 static void test_security_descriptor(void)
2331 {
2332 SECURITY_DESCRIPTOR sd;
2333 char buf[8192];
2334 DWORD size;
2335 BOOL isDefault, isPresent, ret;
2336 PACL pacl;
2337 PSID psid;
2338
2339 SetLastError(0xdeadbeef);
2340 ret = InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION);
2341 if (ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2342 {
2343 win_skip("InitializeSecurityDescriptor is not implemented\n");
2344 return;
2345 }
2346
2347 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2348 expect_eq(psid, NULL, PSID, "%p");
2349 expect_eq(isDefault, FALSE, BOOL, "%d");
2350 sd.Control |= SE_DACL_PRESENT | SE_SACL_PRESENT;
2351
2352 SetLastError(0xdeadbeef);
2353 size = 5;
2354 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), FALSE, BOOL, "%d");
2355 expect_eq(GetLastError(), ERROR_INSUFFICIENT_BUFFER, DWORD, "%u");
2356 ok(size > 5, "Size not increased\n");
2357 if (size <= 8192)
2358 {
2359 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), TRUE, BOOL, "%d");
2360 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2361 expect_eq(psid, NULL, PSID, "%p");
2362 expect_eq(isDefault, FALSE, BOOL, "%d");
2363 ok(GetSecurityDescriptorGroup(&sd, &psid, &isDefault), "GetSecurityDescriptorGroup failed\n");
2364 expect_eq(psid, NULL, PSID, "%p");
2365 expect_eq(isDefault, FALSE, BOOL, "%d");
2366 ok(GetSecurityDescriptorDacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorDacl failed\n");
2367 expect_eq(isPresent, TRUE, BOOL, "%d");
2368 expect_eq(psid, NULL, PSID, "%p");
2369 expect_eq(isDefault, FALSE, BOOL, "%d");
2370 ok(GetSecurityDescriptorSacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorSacl failed\n");
2371 expect_eq(isPresent, TRUE, BOOL, "%d");
2372 expect_eq(psid, NULL, PSID, "%p");
2373 expect_eq(isDefault, FALSE, BOOL, "%d");
2374 }
2375 }
2376
2377 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,0,__LINE__)
2378 #define TEST_GRANTED_ACCESS2(a,b,c) test_granted_access(a,b,c,__LINE__)
2379 static void test_granted_access(HANDLE handle, ACCESS_MASK access,
2380 ACCESS_MASK alt, int line)
2381 {
2382 OBJECT_BASIC_INFORMATION obj_info;
2383 NTSTATUS status;
2384
2385 if (!pNtQueryObject)
2386 {
2387 skip_(__FILE__, line)("Not NT platform - skipping tests\n");
2388 return;
2389 }
2390
2391 status = pNtQueryObject( handle, ObjectBasicInformation, &obj_info,
2392 sizeof(obj_info), NULL );
2393 ok_(__FILE__, line)(!status, "NtQueryObject with err: %08x\n", status);
2394 if (alt)
2395 ok_(__FILE__, line)(obj_info.GrantedAccess == access ||
2396 obj_info.GrantedAccess == alt, "Granted access should be 0x%08x "
2397 "or 0x%08x, instead of 0x%08x\n", access, alt, obj_info.GrantedAccess);
2398 else
2399 ok_(__FILE__, line)(obj_info.GrantedAccess == access, "Granted access should "
2400 "be 0x%08x, instead of 0x%08x\n", access, obj_info.GrantedAccess);
2401 }
2402
2403 #define CHECK_SET_SECURITY(o,i,e) \
2404 do{ \
2405 BOOL res; \
2406 DWORD err; \
2407 SetLastError( 0xdeadbeef ); \
2408 res = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
2409 err = GetLastError(); \
2410 if (e == ERROR_SUCCESS) \
2411 ok(res, "SetKernelObjectSecurity failed with %d\n", err); \
2412 else \
2413 ok(!res && err == e, "SetKernelObjectSecurity should have failed " \
2414 "with %s, instead of %d\n", #e, err); \
2415 }while(0)
2416
2417 static void test_process_security(void)
2418 {
2419 BOOL res;
2420 PTOKEN_OWNER owner;
2421 PTOKEN_PRIMARY_GROUP group;
2422 PSID AdminSid = NULL, UsersSid = NULL;
2423 PACL Acl = NULL;
2424 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
2425 char buffer[MAX_PATH];
2426 PROCESS_INFORMATION info;
2427 STARTUPINFOA startup;
2428 SECURITY_ATTRIBUTES psa;
2429 HANDLE token, event;
2430 DWORD size;
2431
2432 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
2433 res = InitializeAcl(Acl, 256, ACL_REVISION);
2434 if (!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2435 {
2436 win_skip("ACLs not implemented - skipping tests\n");
2437 HeapFree(GetProcessHeap(), 0, Acl);
2438 return;
2439 }
2440 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2441
2442 /* get owner from the token we might be running as a user not admin */
2443 res = OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED, &token );
2444 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
2445 if (!res)
2446 {
2447 HeapFree(GetProcessHeap(), 0, Acl);
2448 return;
2449 }
2450
2451 res = GetTokenInformation( token, TokenOwner, NULL, 0, &size );
2452 ok(!res, "Expected failure, got %d\n", res);
2453 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2454 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2455
2456 owner = HeapAlloc(GetProcessHeap(), 0, size);
2457 res = GetTokenInformation( token, TokenOwner, owner, size, &size );
2458 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2459 AdminSid = ((TOKEN_OWNER*)owner)->Owner;
2460
2461 res = GetTokenInformation( token, TokenPrimaryGroup, NULL, 0, &size );
2462 ok(!res, "Expected failure, got %d\n", res);
2463 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2464 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2465
2466 group = HeapAlloc(GetProcessHeap(), 0, size);
2467 res = GetTokenInformation( token, TokenPrimaryGroup, group, size, &size );
2468 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2469 UsersSid = ((TOKEN_PRIMARY_GROUP*)group)->PrimaryGroup;
2470
2471 CloseHandle( token );
2472 if (!res)
2473 {
2474 HeapFree(GetProcessHeap(), 0, group);
2475 HeapFree(GetProcessHeap(), 0, owner);
2476 HeapFree(GetProcessHeap(), 0, Acl);
2477 return;
2478 }
2479
2480 res = AddAccessDeniedAce(Acl, ACL_REVISION, PROCESS_VM_READ, AdminSid);
2481 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
2482 res = AddAccessAllowedAce(Acl, ACL_REVISION, PROCESS_ALL_ACCESS, AdminSid);
2483 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2484
2485 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
2486 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
2487 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
2488
2489 event = CreateEvent( NULL, TRUE, TRUE, "test_event" );
2490 ok(event != NULL, "CreateEvent %d\n", GetLastError());
2491
2492 SecurityDescriptor->Revision = 0;
2493 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_UNKNOWN_REVISION );
2494 SecurityDescriptor->Revision = SECURITY_DESCRIPTOR_REVISION;
2495
2496 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2497 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2498 CHECK_SET_SECURITY( event, SACL_SECURITY_INFORMATION, ERROR_ACCESS_DENIED );
2499 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2500 /* NULL DACL is valid and means default DACL from token */
2501 SecurityDescriptor->Control |= SE_DACL_PRESENT;
2502 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2503
2504 /* Set owner and group and dacl */
2505 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
2506 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
2507 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_SUCCESS );
2508 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, FALSE);
2509 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2510 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_SUCCESS );
2511 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
2512 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
2513 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2514
2515 sprintf(buffer, "%s tests/security.c test", myARGV[0]);
2516 memset(&startup, 0, sizeof(startup));
2517 startup.cb = sizeof(startup);
2518 startup.dwFlags = STARTF_USESHOWWINDOW;
2519 startup.wShowWindow = SW_SHOWNORMAL;
2520
2521 psa.nLength = sizeof(psa);
2522 psa.lpSecurityDescriptor = SecurityDescriptor;
2523 psa.bInheritHandle = TRUE;
2524
2525 /* Doesn't matter what ACL say we should get full access for ourselves */
2526 res = CreateProcessA( NULL, buffer, &psa, NULL, FALSE, 0, NULL, NULL, &startup, &info );
2527 ok(res, "CreateProcess with err:%d\n", GetLastError());
2528 TEST_GRANTED_ACCESS2( info.hProcess, PROCESS_ALL_ACCESS,
2529 STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
2530 winetest_wait_child_process( info.hProcess );
2531
2532 CloseHandle( info.hProcess );
2533 CloseHandle( info.hThread );
2534 CloseHandle( event );
2535 HeapFree(GetProcessHeap(), 0, group);
2536 HeapFree(GetProcessHeap(), 0, owner);
2537 HeapFree(GetProcessHeap(), 0, Acl);
2538 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
2539 }
2540
2541 static void test_process_security_child(void)
2542 {
2543 HANDLE handle, handle1;
2544 BOOL ret;
2545 DWORD err;
2546
2547 handle = OpenProcess( PROCESS_TERMINATE, FALSE, GetCurrentProcessId() );
2548 ok(handle != NULL, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
2549 TEST_GRANTED_ACCESS( handle, PROCESS_TERMINATE );
2550
2551 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2552 &handle1, 0, TRUE, DUPLICATE_SAME_ACCESS );
2553 ok(ret, "duplicating handle err:%d\n", GetLastError());
2554 TEST_GRANTED_ACCESS( handle1, PROCESS_TERMINATE );
2555
2556 CloseHandle( handle1 );
2557
2558 SetLastError( 0xdeadbeef );
2559 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2560 &handle1, PROCESS_ALL_ACCESS, TRUE, 0 );
2561 err = GetLastError();
2562 todo_wine
2563 ok(!ret && err == ERROR_ACCESS_DENIED, "duplicating handle should have failed "
2564 "with STATUS_ACCESS_DENIED, instead of err:%d\n", err);
2565
2566 CloseHandle( handle );
2567
2568 /* These two should fail - they are denied by ACL */
2569 handle = OpenProcess( PROCESS_VM_READ, FALSE, GetCurrentProcessId() );
2570 todo_wine
2571 ok(handle == NULL, "OpenProcess(PROCESS_VM_READ) should have failed\n");
2572 handle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId() );
2573 todo_wine
2574 ok(handle == NULL, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
2575
2576 /* Documented privilege elevation */
2577 ret = DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
2578 &handle, 0, TRUE, DUPLICATE_SAME_ACCESS );
2579 ok(ret, "duplicating handle err:%d\n", GetLastError());
2580 TEST_GRANTED_ACCESS2( handle, PROCESS_ALL_ACCESS,
2581 STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
2582
2583 CloseHandle( handle );
2584
2585 /* Same only explicitly asking for all access rights */
2586 ret = DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
2587 &handle, PROCESS_ALL_ACCESS, TRUE, 0 );
2588 ok(ret, "duplicating handle err:%d\n", GetLastError());
2589 TEST_GRANTED_ACCESS2( handle, PROCESS_ALL_ACCESS,
2590 PROCESS_ALL_ACCESS | PROCESS_QUERY_LIMITED_INFORMATION );
2591 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2592 &handle1, PROCESS_VM_READ, TRUE, 0 );
2593 ok(ret, "duplicating handle err:%d\n", GetLastError());
2594 TEST_GRANTED_ACCESS( handle1, PROCESS_VM_READ );
2595 CloseHandle( handle1 );
2596 CloseHandle( handle );
2597 }
2598
2599 static void test_impersonation_level(void)
2600 {
2601 HANDLE Token, ProcessToken;
2602 HANDLE Token2;
2603 DWORD Size;
2604 TOKEN_PRIVILEGES *Privileges;
2605 TOKEN_USER *User;
2606 PRIVILEGE_SET *PrivilegeSet;
2607 BOOL AccessGranted;
2608 BOOL ret;
2609 HKEY hkey;
2610 DWORD error;
2611
2612 pDuplicateTokenEx = (void *)GetProcAddress(hmod, "DuplicateTokenEx");
2613 if( !pDuplicateTokenEx ) {
2614 win_skip("DuplicateTokenEx is not available\n");
2615 return;
2616 }
2617 SetLastError(0xdeadbeef);
2618 ret = ImpersonateSelf(SecurityAnonymous);
2619 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2620 {
2621 win_skip("ImpersonateSelf is not implemented\n");
2622 return;
2623 }
2624 ok(ret, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
2625 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2626 ok(!ret, "OpenThreadToken should have failed\n");
2627 error = GetLastError();
2628 ok(error == ERROR_CANT_OPEN_ANONYMOUS, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error);
2629 /* can't perform access check when opening object against an anonymous impersonation token */
2630 todo_wine {
2631 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2632 ok(error == ERROR_INVALID_HANDLE || error == ERROR_CANT_OPEN_ANONYMOUS,
2633 "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE or ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error);
2634 }
2635 RevertToSelf();
2636
2637 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &ProcessToken);
2638 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
2639
2640 ret = pDuplicateTokenEx(ProcessToken,
2641 TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE, NULL,
2642 SecurityAnonymous, TokenImpersonation, &Token);
2643 ok(ret, "DuplicateTokenEx failed with error %d\n", GetLastError());
2644 /* can't increase the impersonation level */
2645 ret = DuplicateToken(Token, SecurityIdentification, &Token2);
2646 error = GetLastError();
2647 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL,
2648 "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2649 /* we can query anything from an anonymous token, including the user */
2650 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
2651 error = GetLastError();
2652 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
2653 User = HeapAlloc(GetProcessHeap(), 0, Size);
2654 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
2655 ok(ret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
2656 HeapFree(GetProcessHeap(), 0, User);
2657
2658 /* PrivilegeCheck fails with SecurityAnonymous level */
2659 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
2660 error = GetLastError();
2661 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
2662 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
2663 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
2664 ok(ret, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
2665
2666 PrivilegeSet = HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET, Privilege[Privileges->PrivilegeCount]));
2667 PrivilegeSet->PrivilegeCount = Privileges->PrivilegeCount;
2668 memcpy(PrivilegeSet->Privilege, Privileges->Privileges, PrivilegeSet->PrivilegeCount * sizeof(PrivilegeSet->Privilege[0]));
2669 PrivilegeSet->Control = PRIVILEGE_SET_ALL_NECESSARY;
2670 HeapFree(GetProcessHeap(), 0, Privileges);
2671
2672 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2673 error = GetLastError();
2674 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2675
2676 CloseHandle(Token);
2677
2678 ret = ImpersonateSelf(SecurityIdentification);
2679 ok(ret, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
2680 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2681 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
2682
2683 /* can't perform access check when opening object against an identification impersonation token */
2684 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2685 todo_wine {
2686 ok(error == ERROR_INVALID_HANDLE || error == ERROR_BAD_IMPERSONATION_LEVEL,
2687 "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE or ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2688 }
2689 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2690 ok(ret, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
2691 CloseHandle(Token);
2692 RevertToSelf();
2693
2694 ret = ImpersonateSelf(SecurityImpersonation);
2695 ok(ret, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
2696 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2697 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
2698 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2699 ok(error == ERROR_SUCCESS, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error);
2700 RegCloseKey(hkey);
2701 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2702 ok(ret, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
2703 RevertToSelf();
2704
2705 CloseHandle(Token);
2706 CloseHandle(ProcessToken);
2707
2708 HeapFree(GetProcessHeap(), 0, PrivilegeSet);
2709 }
2710
2711 static void test_SetEntriesInAclW(void)
2712 {
2713 DWORD res;
2714 PSID EveryoneSid = NULL, UsersSid = NULL;
2715 PACL OldAcl = NULL, NewAcl;
2716 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2717 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
2718 EXPLICIT_ACCESSW ExplicitAccess;
2719 static const WCHAR wszEveryone[] = {'E','v','e','r','y','o','n','e',0};
2720 static const WCHAR wszCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
2721
2722 if (!pSetEntriesInAclW)
2723 {
2724 win_skip("SetEntriesInAclW is not available\n");
2725 return;
2726 }
2727
2728 NewAcl = (PACL)0xdeadbeef;
2729 res = pSetEntriesInAclW(0, NULL, NULL, &NewAcl);
2730 if(res == ERROR_CALL_NOT_IMPLEMENTED)
2731 {
2732 win_skip("SetEntriesInAclW is not implemented\n");
2733 return;
2734 }
2735 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2736 ok(NewAcl == NULL ||
2737 broken(NewAcl != NULL), /* NT4 */
2738 "NewAcl=%p, expected NULL\n", NewAcl);
2739 LocalFree(NewAcl);
2740
2741 OldAcl = HeapAlloc(GetProcessHeap(), 0, 256);
2742 res = InitializeAcl(OldAcl, 256, ACL_REVISION);
2743 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2744 {
2745 win_skip("ACLs not implemented - skipping tests\n");
2746 HeapFree(GetProcessHeap(), 0, OldAcl);
2747 return;
2748 }
2749 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2750
2751 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
2752 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2753
2754 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
2755 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
2756 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2757
2758 res = AddAccessAllowedAce(OldAcl, ACL_REVISION, KEY_READ, UsersSid);
2759 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2760
2761 ExplicitAccess.grfAccessPermissions = KEY_WRITE;
2762 ExplicitAccess.grfAccessMode = GRANT_ACCESS;
2763 ExplicitAccess.grfInheritance = NO_INHERITANCE;
2764 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
2765 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2766 ExplicitAccess.Trustee.ptstrName = EveryoneSid;
2767 ExplicitAccess.Trustee.MultipleTrusteeOperation = 0xDEADBEEF;
2768 ExplicitAccess.Trustee.pMultipleTrustee = (PVOID)0xDEADBEEF;
2769 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2770 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2771 ok(NewAcl != NULL, "returned acl was NULL\n");
2772 LocalFree(NewAcl);
2773
2774 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
2775 ExplicitAccess.Trustee.pMultipleTrustee = NULL;
2776 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2777 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2778 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2779 ok(NewAcl != NULL, "returned acl was NULL\n");
2780 LocalFree(NewAcl);
2781
2782 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2783 {
2784 skip("Non-english locale (test with hardcoded 'Everyone')\n");
2785 }
2786 else
2787 {
2788 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2789 ExplicitAccess.Trustee.ptstrName = (LPWSTR)wszEveryone;
2790 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2791 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2792 ok(NewAcl != NULL, "returned acl was NULL\n");
2793 LocalFree(NewAcl);
2794
2795 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_BAD_FORM;
2796 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2797 ok(res == ERROR_INVALID_PARAMETER ||
2798 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2799 "SetEntriesInAclW failed: %u\n", res);
2800 ok(NewAcl == NULL ||
2801 broken(NewAcl != NULL), /* NT4 */
2802 "returned acl wasn't NULL: %p\n", NewAcl);
2803
2804 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2805 ExplicitAccess.Trustee.MultipleTrusteeOperation = TRUSTEE_IS_IMPERSONATE;
2806 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2807 ok(res == ERROR_INVALID_PARAMETER ||
2808 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2809 "SetEntriesInAclW failed: %u\n", res);
2810 ok(NewAcl == NULL ||
2811 broken(NewAcl != NULL), /* NT4 */
2812 "returned acl wasn't NULL: %p\n", NewAcl);
2813
2814 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2815 ExplicitAccess.grfAccessMode = SET_ACCESS;
2816 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2817 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2818 ok(NewAcl != NULL, "returned acl was NULL\n");
2819 LocalFree(NewAcl);
2820 }
2821
2822 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2823 ExplicitAccess.Trustee.ptstrName = (LPWSTR)wszCurrentUser;
2824 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2825 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2826 ok(NewAcl != NULL, "returned acl was NULL\n");
2827 LocalFree(NewAcl);
2828
2829 ExplicitAccess.grfAccessMode = REVOKE_ACCESS;
2830 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2831 ExplicitAccess.Trustee.ptstrName = UsersSid;
2832 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2833 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2834 ok(NewAcl != NULL, "returned acl was NULL\n");
2835 LocalFree(NewAcl);
2836
2837 FreeSid(UsersSid);
2838 FreeSid(EveryoneSid);
2839 HeapFree(GetProcessHeap(), 0, OldAcl);
2840 }
2841
2842 static void test_SetEntriesInAclA(void)
2843 {
2844 DWORD res;
2845 PSID EveryoneSid = NULL, UsersSid = NULL;
2846 PACL OldAcl = NULL, NewAcl;
2847 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2848 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
2849 EXPLICIT_ACCESS ExplicitAccess;
2850 static const CHAR szEveryone[] = {'E','v','e','r','y','o','n','e',0};
2851 static const CHAR szCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
2852
2853 if (!pSetEntriesInAclA)
2854 {
2855 win_skip("SetEntriesInAclA is not available\n");
2856 return;
2857 }
2858
2859 NewAcl = (PACL)0xdeadbeef;
2860 res = pSetEntriesInAclA(0, NULL, NULL, &NewAcl);
2861 if(res == ERROR_CALL_NOT_IMPLEMENTED)
2862 {
2863 win_skip("SetEntriesInAclA is not implemented\n");
2864 return;
2865 }
2866 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2867 ok(NewAcl == NULL ||
2868 broken(NewAcl != NULL), /* NT4 */
2869 "NewAcl=%p, expected NULL\n", NewAcl);
2870 LocalFree(NewAcl);
2871
2872 OldAcl = HeapAlloc(GetProcessHeap(), 0, 256);
2873 res = InitializeAcl(OldAcl, 256, ACL_REVISION);
2874 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2875 {
2876 win_skip("ACLs not implemented - skipping tests\n");
2877 HeapFree(GetProcessHeap(), 0, OldAcl);
2878 return;
2879 }
2880 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2881
2882 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
2883 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2884
2885 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
2886 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
2887 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2888
2889 res = AddAccessAllowedAce(OldAcl, ACL_REVISION, KEY_READ, UsersSid);
2890 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2891
2892 ExplicitAccess.grfAccessPermissions = KEY_WRITE;
2893 ExplicitAccess.grfAccessMode = GRANT_ACCESS;
2894 ExplicitAccess.grfInheritance = NO_INHERITANCE;
2895 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
2896 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2897 ExplicitAccess.Trustee.ptstrName = EveryoneSid;
2898 ExplicitAccess.Trustee.MultipleTrusteeOperation = 0xDEADBEEF;
2899 ExplicitAccess.Trustee.pMultipleTrustee = (PVOID)0xDEADBEEF;
2900 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2901 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2902 ok(NewAcl != NULL, "returned acl was NULL\n");
2903 LocalFree(NewAcl);
2904
2905 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
2906 ExplicitAccess.Trustee.pMultipleTrustee = NULL;
2907 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2908 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2909 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2910 ok(NewAcl != NULL, "returned acl was NULL\n");
2911 LocalFree(NewAcl);
2912
2913 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2914 {
2915 skip("Non-english locale (test with hardcoded 'Everyone')\n");
2916 }
2917 else
2918 {
2919 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2920 ExplicitAccess.Trustee.ptstrName = (LPSTR)szEveryone;
2921 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2922 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2923 ok(NewAcl != NULL, "returned acl was NULL\n");
2924 LocalFree(NewAcl);
2925
2926 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_BAD_FORM;
2927 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2928 ok(res == ERROR_INVALID_PARAMETER ||
2929 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2930 "SetEntriesInAclA failed: %u\n", res);
2931 ok(NewAcl == NULL ||
2932 broken(NewAcl != NULL), /* NT4 */
2933 "returned acl wasn't NULL: %p\n", NewAcl);
2934
2935 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2936 ExplicitAccess.Trustee.MultipleTrusteeOperation = TRUSTEE_IS_IMPERSONATE;
2937 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2938 ok(res == ERROR_INVALID_PARAMETER ||
2939 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2940 "SetEntriesInAclA failed: %u\n", res);
2941 ok(NewAcl == NULL ||
2942 broken(NewAcl != NULL), /* NT4 */
2943 "returned acl wasn't NULL: %p\n", NewAcl);
2944
2945 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2946 ExplicitAccess.grfAccessMode = SET_ACCESS;
2947 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2948 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2949 ok(NewAcl != NULL, "returned acl was NULL\n");
2950 LocalFree(NewAcl);
2951 }
2952
2953 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
2954 ExplicitAccess.Trustee.ptstrName = (LPSTR)szCurrentUser;
2955 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2956 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2957 ok(NewAcl != NULL, "returned acl was NULL\n");
2958 LocalFree(NewAcl);
2959
2960 ExplicitAccess.grfAccessMode = REVOKE_ACCESS;
2961 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2962 ExplicitAccess.Trustee.ptstrName = UsersSid;
2963 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2964 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2965 ok(NewAcl != NULL, "returned acl was NULL\n");
2966 LocalFree(NewAcl);
2967
2968 FreeSid(UsersSid);
2969 FreeSid(EveryoneSid);
2970 HeapFree(GetProcessHeap(), 0, OldAcl);
2971 }
2972
2973 static void test_GetNamedSecurityInfoA(void)
2974 {
2975 PSECURITY_DESCRIPTOR pSecDesc;
2976 DWORD revision;
2977 SECURITY_DESCRIPTOR_CONTROL control;
2978 PSID owner;
2979 PSID group;
2980 PACL dacl;
2981 BOOL owner_defaulted;
2982 BOOL group_defaulted;
2983 DWORD error;
2984 BOOL ret, isNT4;
2985 CHAR windows_dir[MAX_PATH];
2986
2987 if (!pGetNamedSecurityInfoA)
2988 {
2989 win_skip("GetNamedSecurityInfoA is not available\n");
2990 return;
2991 }
2992
2993 ret = GetWindowsDirectoryA(windows_dir, MAX_PATH);
2994 ok(ret, "GetWindowsDirectory failed with error %d\n", GetLastError());
2995
2996 SetLastError(0xdeadbeef);
2997 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,
2998 OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
2999 NULL, NULL, NULL, NULL, &pSecDesc);
3000 if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
3001 {
3002 win_skip("GetNamedSecurityInfoA is not implemented\n");
3003 return;
3004 }
3005 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3006
3007 ret = GetSecurityDescriptorControl(pSecDesc, &control, &revision);
3008 ok(ret, "GetSecurityDescriptorControl failed with error %d\n", GetLastError());
3009 ok((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == (SE_SELF_RELATIVE|SE_DACL_PRESENT) ||
3010 broken((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == SE_DACL_PRESENT), /* NT4 */
3011 "control (0x%x) doesn't have (SE_SELF_RELATIVE|SE_DACL_PRESENT) flags set\n", control);
3012 ok(revision == SECURITY_DESCRIPTOR_REVISION1, "revision was %d instead of 1\n", revision);
3013
3014 isNT4 = (control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == SE_DACL_PRESENT;
3015
3016 ret = GetSecurityDescriptorOwner(pSecDesc, &owner, &owner_defaulted);
3017 ok(ret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
3018 ok(owner != NULL, "owner should not be NULL\n");
3019
3020 ret = GetSecurityDescriptorGroup(pSecDesc, &group, &group_defaulted);
3021 ok(ret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
3022 ok(group != NULL, "group should not be NULL\n");
3023 LocalFree(pSecDesc);
3024
3025
3026 /* NULL descriptor tests */
3027 if(isNT4)
3028 {
3029 win_skip("NT4 does not support GetNamedSecutityInfo with a NULL descriptor\n");
3030 return;
3031 }
3032
3033 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,
3034 NULL, NULL, NULL, NULL, NULL);
3035 ok(error==ERROR_INVALID_PARAMETER, "GetNamedSecurityInfo failed with error %d\n", error);
3036
3037 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,
3038 NULL, NULL, &dacl, NULL, NULL);
3039 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
3040 ok(dacl != NULL, "dacl should not be NULL\n");
3041
3042 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,OWNER_SECURITY_INFORMATION,
3043 NULL, NULL, &dacl, NULL, NULL);
3044 ok(error==ERROR_INVALID_PARAMETER, "GetNamedSecurityInfo failed with error %d\n", error);
3045 }
3046
3047 static void test_ConvertStringSecurityDescriptor(void)
3048 {
3049 BOOL ret;
3050 PSECURITY_DESCRIPTOR pSD;
3051 static const WCHAR Blank[] = { 0 };
3052 unsigned int i;
3053 static const struct
3054 {
3055 const char *sidstring;
3056 DWORD revision;
3057 BOOL ret;
3058 DWORD GLE;
3059 DWORD altGLE;
3060 } cssd[] =
3061 {
3062 { "D:(A;;GA;;;WD)", 0xdeadbeef, FALSE, ERROR_UNKNOWN_REVISION },
3063 /* test ACE string type */
3064 { "D:(A;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3065 { "D:(D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3066 { "ERROR:(D;;GA;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_PARAMETER },
3067 /* test ACE string with spaces */
3068 { " D:(D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3069 { "D: (D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3070 { "D:( D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3071 { "D:(D ;;GA;;;WD)", SDDL_REVISION_1, FALSE, RPC_S_INVALID_STRING_UUID, ERROR_INVALID_ACL }, /* Vista+ */
3072 { "D:(D; ;GA;;;WD)", SDDL_REVISION_1, TRUE },
3073 { "D:(D;; GA;;;WD)", SDDL_REVISION_1, TRUE },
3074 { "D:(D;;GA ;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL },
3075 { "D:(D;;GA; ;;WD)", SDDL_REVISION_1, TRUE },
3076 { "D:(D;;GA;; ;WD)", SDDL_REVISION_1, TRUE },
3077 { "D:(D;;GA;;; WD)", SDDL_REVISION_1, TRUE },
3078 { "D:(D;;GA;;;WD )", SDDL_REVISION_1, TRUE },
3079 /* test ACE string access rights */
3080 { "D:(A;;GA;;;WD)", SDDL_REVISION_1, TRUE },
3081 { "D:(A;;GRGWGX;;;WD)", SDDL_REVISION_1, TRUE },
3082 { "D:(A;;RCSDWDWO;;;WD)", SDDL_REVISION_1, TRUE },
3083 { "D:(A;;RPWPCCDCLCSWLODTCR;;;WD)", SDDL_REVISION_1, TRUE },
3084 { "D:(A;;FAFRFWFX;;;WD)", SDDL_REVISION_1, TRUE },
3085 { "D:(A;;KAKRKWKX;;;WD)", SDDL_REVISION_1, TRUE },
3086 { "D:(A;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, TRUE },
3087 { "S:(AU;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, TRUE },
3088 /* test ACE string access right error case */
3089 { "D:(A;;ROB;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL },
3090 /* test behaviour with empty strings */
3091 { "", SDDL_REVISION_1, TRUE },
3092 /* test ACE string SID */
3093 { "D:(D;;GA;;;S-1-0-0)", SDDL_REVISION_1, TRUE },
3094 { "D:(D;;GA;;;Nonexistent account)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL, ERROR_INVALID_SID } /* W2K */
3095 };
3096
3097 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
3098 {
3099 win_skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
3100 return;
3101 }
3102
3103 for (i = 0; i < sizeof(cssd)/sizeof(cssd[0]); i++)
3104 {
3105 DWORD GLE;
3106
3107 SetLastError(0xdeadbeef);
3108 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3109 cssd[i].sidstring, cssd[i].revision, &pSD, NULL);
3110 GLE = GetLastError();
3111 ok(ret == cssd[i].ret, "(%02u) Expected %s (%d)\n", i, cssd[i].ret ? "success" : "failure", GLE);
3112 if (!cssd[i].ret)
3113 ok(GLE == cssd[i].GLE ||
3114 (cssd[i].altGLE && GLE == cssd[i].altGLE),
3115 "(%02u) Unexpected last error %d\n", i, GLE);
3116 if (ret)
3117 LocalFree(pSD);
3118 }
3119
3120 /* test behaviour with NULL parameters */
3121 SetLastError(0xdeadbeef);
3122 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3123 NULL, 0xdeadbeef, &pSD, NULL);
3124 todo_wine
3125 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3126 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3127 GetLastError());
3128
3129 SetLastError(0xdeadbeef);
3130 ret = pConvertStringSecurityDescriptorToSecurityDescriptorW(
3131 NULL, 0xdeadbeef, &pSD, NULL);
3132 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3133 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3134 GetLastError());
3135
3136 SetLastError(0xdeadbeef);
3137 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3138 "D:(A;;ROB;;;WD)", 0xdeadbeef, NULL, NULL);
3139 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3140 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3141 GetLastError());
3142
3143 SetLastError(0xdeadbeef);
3144 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3145 "D:(A;;ROB;;;WD)", SDDL_REVISION_1, NULL, NULL);
3146 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3147 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3148 GetLastError());
3149
3150 /* test behaviour with empty strings */
3151 SetLastError(0xdeadbeef);
3152 ret = pConvertStringSecurityDescriptorToSecurityDescriptorW(
3153 Blank, SDDL_REVISION_1, &pSD, NULL);
3154 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
3155 LocalFree(pSD);
3156 }
3157
3158 static void test_ConvertSecurityDescriptorToString(void)
3159 {
3160 SECURITY_DESCRIPTOR desc;
3161 SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
3162 LPSTR string;
3163 DWORD size;
3164 PSID psid, psid2;
3165 PACL pacl;
3166 char sid_buf[256];
3167 char acl_buf[8192];
3168 ULONG len;
3169
3170 if (!pConvertSecurityDescriptorToStringSecurityDescriptorA)
3171 {
3172 win_skip("ConvertSecurityDescriptorToStringSecurityDescriptor is not available\n");
3173 return;
3174 }
3175 if (!pCreateWellKnownSid)
3176 {
3177 win_skip("CreateWellKnownSid is not available\n");
3178 return;
3179 }
3180
3181 /* It seems Windows XP adds an extra character to the length of the string for each ACE in an ACL. We
3182 * don't replicate this feature so we only test len >= strlen+1. */
3183 #define CHECK_RESULT_AND_FREE(exp_str) \
3184 ok(strcmp(string, (exp_str)) == 0, "String mismatch (expected \"%s\", got \"%s\")\n", (exp_str), string); \
3185 ok(len >= (strlen(exp_str) + 1), "Length mismatch (expected %d, got %d)\n", lstrlen(exp_str) + 1, len); \
3186 LocalFree(string);
3187
3188 #define CHECK_ONE_OF_AND_FREE(exp_str1, exp_str2) \
3189 ok(strcmp(string, (exp_str1)) == 0 || strcmp(string, (exp_str2)) == 0, "String mismatch (expected\n\"%s\" or\n\"%s\", got\n\"%s\")\n", (exp_str1), (exp_str2), string); \
3190 ok(len >= (strlen(exp_str1) + 1) || len >= (strlen(exp_str2) + 1), "Length mismatch (expected %d or %d, got %d)\n", lstrlen(exp_str1) + 1, lstrlen(exp_str2) + 1, len); \
3191 LocalFree(string);
3192
3193 InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION);
3194 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3195 CHECK_RESULT_AND_FREE("");
3196
3197 size = 4096;
3198 pCreateWellKnownSid(WinLocalSid, NULL, sid_buf, &size);
3199 SetSecurityDescriptorOwner(&desc, sid_buf, FALSE);
3200 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3201 CHECK_RESULT_AND_FREE("O:S-1-2-0");
3202
3203 SetSecurityDescriptorOwner(&desc, sid_buf, TRUE);
3204 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3205 CHECK_RESULT_AND_FREE("O:S-1-2-0");
3206
3207 size = sizeof(sid_buf);
3208 pCreateWellKnownSid(WinLocalSystemSid, NULL, sid_buf, &size);
3209 SetSecurityDescriptorOwner(&desc, sid_buf, TRUE);
3210 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3211 CHECK_RESULT_AND_FREE("O:SY");
3212
3213 pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid);
3214 SetSecurityDescriptorGroup(&desc, psid, TRUE);
3215 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3216 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576");
3217
3218 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, GROUP_SECURITY_INFORMATION, &string, &len), "Conversion failed\n");
3219 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
3220
3221 pacl = (PACL)acl_buf;
3222 InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
3223 SetSecurityDescriptorDacl(&desc, TRUE, pacl, TRUE);
3224 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3225 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
3226
3227 SetSecurityDescriptorDacl(&desc, TRUE, pacl, FALSE);
3228 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3229 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
3230
3231 pConvertStringSidToSidA("S-1-5-6", &psid2);
3232 pAddAccessAllowedAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, 0xf0000000, psid2);
3233 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3234 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)");
3235
3236 pAddAccessAllowedAceEx(pacl, ACL_REVISION, INHERIT_ONLY_ACE|INHERITED_ACE, 0x00000003, psid2);
3237 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3238 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)");
3239
3240 pAddAccessDeniedAceEx(pacl, ACL_REVISION, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE, 0xffffffff, psid);
3241 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3242 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
3243
3244
3245 pacl = (PACL)acl_buf;
3246 InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
3247 SetSecurityDescriptorSacl(&desc, TRUE, pacl, FALSE);
3248 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3249 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:");
3250
3251 /* fails in win2k */
3252 SetSecurityDescriptorDacl(&desc, TRUE, NULL, FALSE);
3253 pAddAuditAccessAceEx(pacl, ACL_REVISION, VALID_INHERIT_FLAGS, KEY_READ|KEY_WRITE, psid2, TRUE, TRUE);
3254 if (pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len))
3255 {
3256 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)", /* XP */
3257 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)" /* Vista */);
3258 }
3259
3260 /* fails in win2k */
3261 pAddAuditAccessAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, FILE_GENERIC_READ|FILE_GENERIC_WRITE, psid2, TRUE, FALSE);
3262 if (pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len))
3263 {
3264 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", /* XP */
3265 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)" /* Vista */);
3266 }
3267
3268 LocalFree(psid2);
3269 LocalFree(psid);
3270 }
3271
3272 static void test_SetSecurityDescriptorControl (PSECURITY_DESCRIPTOR sec)
3273 {
3274 SECURITY_DESCRIPTOR_CONTROL ref;
3275 SECURITY_DESCRIPTOR_CONTROL test;
3276
3277 SECURITY_DESCRIPTOR_CONTROL const mutable
3278 = SE_DACL_AUTO_INHERIT_REQ | SE_SACL_AUTO_INHERIT_REQ
3279 | SE_DACL_AUTO_INHERITED | SE_SACL_AUTO_INHERITED
3280 | SE_DACL_PROTECTED | SE_SACL_PROTECTED
3281 | 0x00000040 | 0x00000080 /* not defined in winnt.h */
3282 ;
3283 SECURITY_DESCRIPTOR_CONTROL const immutable
3284 = SE_OWNER_DEFAULTED | SE_GROUP_DEFAULTED
3285 | SE_DACL_PRESENT | SE_DACL_DEFAULTED
3286 | SE_SACL_PRESENT | SE_SACL_DEFAULTED
3287 | SE_RM_CONTROL_VALID | SE_SELF_RELATIVE
3288 ;
3289
3290 int bit;
3291 DWORD dwRevision;
3292 LPCSTR fmt = "Expected error %s, got %u\n";
3293
3294 GetSecurityDescriptorControl (sec, &ref, &dwRevision);
3295
3296 /* The mutable bits are mutable regardless of the truth of
3297 SE_DACL_PRESENT and/or SE_SACL_PRESENT */
3298
3299 /* Check call barfs if any bit-of-interest is immutable */
3300 for (bit = 0; bit < 16; ++bit)
3301 {
3302 SECURITY_DESCRIPTOR_CONTROL const bitOfInterest = 1 << bit;
3303 SECURITY_DESCRIPTOR_CONTROL setOrClear = ref & bitOfInterest;
3304
3305 SECURITY_DESCRIPTOR_CONTROL ctrl;
3306
3307 DWORD dwExpect = (bitOfInterest & immutable)
3308 ? ERROR_INVALID_PARAMETER : 0xbebecaca;
3309 LPCSTR strExpect = (bitOfInterest & immutable)
3310 ? "ERROR_INVALID_PARAMETER" : "0xbebecaca";
3311
3312 ctrl = (bitOfInterest & mutable) ? ref + bitOfInterest : ref;
3313 setOrClear ^= bitOfInterest;
3314 SetLastError (0xbebecaca);
3315 pSetSecurityDescriptorControl (sec, bitOfInterest, setOrClear);
3316 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3317 GetSecurityDescriptorControl(sec, &test, &dwRevision);
3318 expect_eq(test, ctrl, int, "%x");
3319
3320 setOrClear ^= bitOfInterest;
3321 SetLastError (0xbebecaca);
3322 pSetSecurityDescriptorControl (sec, bitOfInterest, setOrClear);
3323 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3324 GetSecurityDescriptorControl (sec, &test, &dwRevision);
3325 expect_eq(test, ref, int, "%x");
3326 }
3327
3328 /* Check call barfs if any bit-to-set is immutable
3329 even when not a bit-of-interest */
3330 for (bit = 0; bit < 16; ++bit)
3331 {
3332 SECURITY_DESCRIPTOR_CONTROL const bitsOfInterest = mutable;
3333 SECURITY_DESCRIPTOR_CONTROL setOrClear = ref & bitsOfInterest;
3334
3335 SECURITY_DESCRIPTOR_CONTROL ctrl;
3336
3337 DWORD dwExpect = ((1 << bit) & immutable)
3338 ? ERROR_INVALID_PARAMETER : 0xbebecaca;
3339 LPCSTR strExpect = ((1 << bit) & immutable)
3340 ? "ERROR_INVALID_PARAMETER" : "0xbebecaca";
3341
3342 ctrl = ((1 << bit) & immutable) ? test : ref | mutable;
3343 setOrClear ^= bitsOfInterest;
3344 SetLastError (0xbebecaca);
3345 pSetSecurityDescriptorControl (sec, bitsOfInterest, setOrClear | (1 << bit));
3346 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3347 GetSecurityDescriptorControl(sec, &test, &dwRevision);
3348 expect_eq(test, ctrl, int, "%x");
3349
3350 ctrl = ((1 << bit) & immutable) ? test : ref | (1 << bit);
3351 setOrClear ^= bitsOfInterest;
3352 SetLastError (0xbebecaca);
3353 pSetSecurityDescriptorControl (sec, bitsOfInterest, setOrClear | (1 << bit));
3354 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3355 GetSecurityDescriptorControl(sec, &test, &dwRevision);
3356 expect_eq(test, ctrl, int, "%x");
3357 }
3358 }
3359
3360 static void test_PrivateObjectSecurity(void)
3361 {
3362 SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
3363 SECURITY_DESCRIPTOR_CONTROL ctrl;
3364 PSECURITY_DESCRIPTOR sec;
3365 DWORD dwDescSize;
3366 DWORD dwRevision;
3367 DWORD retSize;
3368 LPSTR string;
3369 ULONG len;
3370 PSECURITY_DESCRIPTOR buf;
3371 BOOL ret;
3372
3373 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
3374 {
3375 win_skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
3376 return;
3377 }
3378
3379 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
3380 "O:SY"
3381 "G:S-1-5-21-93476-23408-4576"
3382 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)"
3383 "(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3384 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)",
3385 SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
3386
3387 test_SetSecurityDescriptorControl(sec);
3388
3389 LocalFree(sec);
3390
3391 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
3392 "O:SY"
3393 "G:S-1-5-21-93476-23408-4576",
3394 SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
3395
3396 test_SetSecurityDescriptorControl(sec);
3397
3398 LocalFree(sec);
3399
3400 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
3401 "O:SY"
3402 "G:S-1-5-21-93476-23408-4576"
3403 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3404 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
3405 buf = HeapAlloc(GetProcessHeap(), 0, dwDescSize);
3406 pSetSecurityDescriptorControl(sec, SE_DACL_PROTECTED, SE_DACL_PROTECTED);
3407 GetSecurityDescriptorControl(sec, &ctrl, &dwRevision);
3408 expect_eq(ctrl, 0x9014, int, "%x");
3409
3410 ret = GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION, buf, dwDescSize, &retSize);
3411 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
3412 ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
3413 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3414 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
3415 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
3416 expect_eq(ctrl, 0x8000, int, "%x");
3417
3418 ret = GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, buf, dwDescSize, &retSize);
3419 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
3420 ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
3421 ret = pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len);
3422 ok(ret, "Conversion failed err=%u\n", GetLastError());
3423 CHECK_ONE_OF_AND_FREE("G:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)",
3424 "G:S-1-5-21-93476-23408-4576D:P(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"); /* Win7 */
3425 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
3426 expect_eq(ctrl & (~ SE_DACL_PROTECTED), 0x8004, int, "%x");
3427
3428 ret = GetPrivateObjectSecurity(sec, sec_info, buf, dwDescSize, &retSize);
3429 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
3430 ok(retSize == dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
3431 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3432 CHECK_ONE_OF_AND_FREE("O:SY"
3433 "G:S-1-5-21-93476-23408-4576"
3434 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3435 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)",
3436 "O:SY"
3437 "G:S-1-5-21-93476-23408-4576"
3438 "D:P(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3439 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)"); /* Win7 */
3440 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
3441 expect_eq(ctrl & (~ SE_DACL_PROTECTED), 0x8014, int, "%x");
3442
3443 SetLastError(0xdeadbeef);
3444 ok(GetPrivateObjectSecurity(sec, sec_info, buf, 5, &retSize) == FALSE, "GetPrivateObjectSecurity should have failed\n");
3445 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Expected error ERROR_INSUFFICIENT_BUFFER, got %u\n", GetLastError());
3446
3447 LocalFree(sec);
3448 HeapFree(GetProcessHeap(), 0, buf);
3449 }
3450 #undef CHECK_RESULT_AND_FREE
3451 #undef CHECK_ONE_OF_AND_FREE
3452
3453 static void test_acls(void)
3454 {
3455 char buffer[256];
3456 PACL pAcl = (PACL)buffer;
3457 BOOL ret;
3458
3459 SetLastError(0xdeadbeef);
3460 ret = InitializeAcl(pAcl, sizeof(ACL) - 1, ACL_REVISION);
3461 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
3462 {
3463 win_skip("InitializeAcl is not implemented\n");
3464 return;
3465 }
3466
3467 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "InitializeAcl with too small a buffer should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", GetLastError());
3468
3469 SetLastError(0xdeadbeef);
3470 ret = InitializeAcl(pAcl, 0xffffffff, ACL_REVISION);
3471 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl with too large a buffer should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
3472
3473 SetLastError(0xdeadbeef);
3474 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION1);
3475 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl(ACL_REVISION1) should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
3476
3477 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION2);
3478 ok(ret, "InitializeAcl(ACL_REVISION2) failed with error %d\n", GetLastError());
3479
3480 ret = IsValidAcl(pAcl);
3481 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
3482
3483 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION3);
3484 ok(ret, "InitializeAcl(ACL_REVISION3) failed with error %d\n", GetLastError());
3485
3486 ret = IsValidAcl(pAcl);
3487 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
3488
3489 SetLastError(0xdeadbeef);
3490 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION4);
3491 if (GetLastError() != ERROR_INVALID_PARAMETER)
3492 {
3493 ok(ret, "InitializeAcl(ACL_REVISION4) failed with error %d\n", GetLastError());
3494
3495 ret = IsValidAcl(pAcl);
3496 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
3497 }
3498 else
3499 win_skip("ACL_REVISION4 is not implemented on NT4\n");
3500
3501 SetLastError(0xdeadbeef);
3502 ret = InitializeAcl(pAcl, sizeof(buffer), -1);
3503 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl(-1) failed with error %d\n", GetLastError());
3504 }
3505
3506 static void test_GetSecurityInfo(void)
3507 {
3508 HANDLE obj;
3509 PSECURITY_DESCRIPTOR sd;
3510 PSID owner, group;
3511 PACL dacl;
3512 DWORD ret;
3513
3514 if (!pGetSecurityInfo)
3515 {
3516 win_skip("GetSecurityInfo is not available\n");
3517 return;
3518 }
3519
3520 /* Create something. Files have lots of associated security info. */
3521 obj = CreateFile(myARGV[0], GENERIC_READ, FILE_SHARE_READ, NULL,
3522 OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
3523 if (obj == INVALID_HANDLE_VALUE)
3524 {
3525 skip("Couldn't create an object for GetSecurityInfo test\n");
3526 return;
3527 }
3528
3529 ret = pGetSecurityInfo(obj, SE_FILE_OBJECT,
3530 OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3531 &owner, &group, &dacl, NULL, &sd);
3532 if (ret == ERROR_CALL_NOT_IMPLEMENTED)
3533 {
3534 win_skip("GetSecurityInfo is not implemented\n");
3535 CloseHandle(obj);
3536 return;
3537 }
3538 ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
3539 ok(sd != NULL, "GetSecurityInfo\n");
3540 ok(owner != NULL, "GetSecurityInfo\n");
3541 ok(group != NULL, "GetSecurityInfo\n");
3542 if (dacl != NULL)
3543 ok(IsValidAcl(dacl), "GetSecurityInfo\n");
3544 else
3545 win_skip("No ACL information returned\n");
3546
3547 LocalFree(sd);
3548
3549 if (!pCreateWellKnownSid)
3550 {
3551 win_skip("NULL parameter test would crash on NT4\n");
3552 CloseHandle(obj);
3553 return;
3554 }
3555
3556 /* If we don't ask for the security descriptor, Windows will still give us
3557 the other stuff, leaving us no way to free it. */
3558 ret = pGetSecurityInfo(obj, SE_FILE_OBJECT,
3559 OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3560 &owner, &group, &dacl, NULL, NULL);
3561 ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
3562 ok(owner != NULL, "GetSecurityInfo\n");
3563 ok(group != NULL, "GetSecurityInfo\n");
3564 if (dacl != NULL)
3565 ok(IsValidAcl(dacl), "GetSecurityInfo\n");
3566 else
3567 win_skip("No ACL information returned\n");
3568
3569 CloseHandle(obj);
3570 }
3571
3572 static void test_GetSidSubAuthority(void)
3573 {
3574 PSID psid = NULL;
3575
3576 if (!pGetSidSubAuthority || !pConvertStringSidToSidA || !pIsValidSid || !pGetSidSubAuthorityCount)
3577 {
3578 win_skip("Some functions not available\n");
3579 return;
3580 }
3581 /* Note: on windows passing in an invalid index like -1, lets GetSidSubAuthority return 0x05000000 but
3582 still GetLastError returns ERROR_SUCCESS then. We don't test these unlikely cornercases here for now */
3583 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576",&psid),"ConvertStringSidToSidA failed\n");
3584 ok(pIsValidSid(psid),"Sid is not valid\n");
3585 SetLastError(0xbebecaca);
3586 ok(*pGetSidSubAuthorityCount(psid) == 4,"GetSidSubAuthorityCount gave %d expected 4\n",*pGetSidSubAuthorityCount(psid));
3587 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3588 SetLastError(0xbebecaca);
3589 ok(*pGetSidSubAuthority(psid,0) == 21,"GetSidSubAuthority gave %d expected 21\n",*pGetSidSubAuthority(psid,0));
3590 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3591 SetLastError(0xbebecaca);
3592 ok(*pGetSidSubAuthority(psid,1) == 93476,"GetSidSubAuthority gave %d expected 93476\n",*pGetSidSubAuthority(psid,1));
3593 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3594 SetLastError(0xbebecaca);
3595 ok(pGetSidSubAuthority(psid,4) != NULL,"Expected out of bounds GetSidSubAuthority to return a non-NULL pointer\n");
3596 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3597 LocalFree(psid);
3598 }
3599
3600 static void test_CheckTokenMembership(void)
3601 {
3602 PTOKEN_GROUPS token_groups;
3603 DWORD size;
3604 HANDLE process_token, token;
3605 BOOL is_member;
3606 BOOL ret;
3607 DWORD i;
3608
3609 if (!pCheckTokenMembership)
3610 {
3611 win_skip("CheckTokenMembership is not available\n");
3612 return;
3613 }
3614 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token);
3615 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
3616
3617 ret = DuplicateToken(process_token, SecurityImpersonation, &token);
3618 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
3619
3620 /* groups */
3621 ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
3622 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
3623 "GetTokenInformation(TokenGroups) %s with error %d\n",
3624 ret ? "succeeded" : "failed", GetLastError());
3625 token_groups = HeapAlloc(GetProcessHeap(), 0, size);
3626 ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
3627 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
3628
3629 for (i = 0; i < token_groups->GroupCount; i++)
3630 {
3631 if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED)
3632 break;
3633 }
3634
3635 if (i == token_groups->GroupCount)
3636 {
3637 HeapFree(GetProcessHeap(), 0, token_groups);
3638 CloseHandle(token);
3639 skip("user not a member of any group\n");
3640 return;
3641 }
3642
3643 is_member = FALSE;
3644 ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member);
3645 ok(ret, "CheckTokenMembership failed with error %d\n", GetLastError());
3646 ok(is_member, "CheckTokenMembership should have detected sid as member\n");
3647
3648 is_member = FALSE;
3649 ret = pCheckTokenMembership(NULL, token_groups->Groups[i].Sid, &is_member);
3650 ok(ret, "CheckTokenMembership failed with error %d\n", GetLastError());
3651 ok(is_member, "CheckTokenMembership should have detected sid as member\n");
3652
3653 is_member = TRUE;
3654 SetLastError(0xdeadbeef);
3655 ret = pCheckTokenMembership(process_token, token_groups->Groups[i].Sid, &is_member);
3656 ok(!ret && GetLastError() == ERROR_NO_IMPERSONATION_TOKEN,
3657 "CheckTokenMembership with process token %s with error %d\n",
3658 ret ? "succeeded" : "failed", GetLastError());
3659 ok(!is_member, "CheckTokenMembership should have cleared is_member\n");
3660
3661 HeapFree(GetProcessHeap(), 0, token_groups);
3662 CloseHandle(token);
3663 CloseHandle(process_token);
3664 }
3665
3666 static void test_EqualSid(void)
3667 {
3668 PSID sid1, sid2;
3669 BOOL ret;
3670 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
3671 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
3672
3673 SetLastError(0xdeadbeef);
3674 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
3675 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid1);
3676 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
3677 {
3678 win_skip("AllocateAndInitializeSid is not implemented\n");
3679 return;
3680 }
3681 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3682 ok(GetLastError() == 0xdeadbeef,
3683 "AllocateAndInitializeSid shouldn't have set last error to %d\n",
3684 GetLastError());
3685
3686 ret = AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID,
3687 0, 0, 0, 0, 0, 0, 0, &sid2);
3688 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3689
3690 SetLastError(0xdeadbeef);
3691 ret = EqualSid(sid1, sid2);
3692 ok(!ret, "World and domain admins sids shouldn't have been equal\n");
3693 ok(GetLastError() == ERROR_SUCCESS ||
3694 broken(GetLastError() == 0xdeadbeef), /* NT4 */
3695 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
3696 GetLastError());
3697
3698 SetLastError(0xdeadbeef);
3699 sid2 = FreeSid(sid2);
3700 ok(!sid2, "FreeSid should have returned NULL instead of %p\n", sid2);
3701 ok(GetLastError() == 0xdeadbeef,
3702 "FreeSid shouldn't have set last error to %d\n",
3703 GetLastError());
3704
3705 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
3706 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid2);
3707 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3708
3709 SetLastError(0xdeadbeef);
3710 ret = EqualSid(sid1, sid2);
3711 ok(ret, "Same sids should have been equal\n");
3712 ok(GetLastError() == ERROR_SUCCESS ||
3713 broken(GetLastError() == 0xdeadbeef), /* NT4 */
3714 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
3715 GetLastError());
3716
3717 ((SID *)sid2)->Revision = 2;
3718 SetLastError(0xdeadbeef);
3719 ret = EqualSid(sid1, sid2);
3720 ok(!ret, "EqualSid with invalid sid should have returned FALSE\n");
3721 ok(GetLastError() == ERROR_SUCCESS ||
3722 broken(GetLastError() == 0xdeadbeef), /* NT4 */
3723 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
3724 GetLastError());
3725 ((SID *)sid2)->Revision = SID_REVISION;
3726
3727 FreeSid(sid1);
3728 FreeSid(sid2);
3729 }
3730
3731 static void test_GetUserNameA(void)
3732 {
3733 char buffer[UNLEN + 1], filler[UNLEN + 1];
3734 DWORD required_len, buffer_len;
3735 BOOL ret;
3736
3737 /* Test crashes on Windows. */
3738 if (0)
3739 {
3740 SetLastError(0xdeadbeef);
3741 GetUserNameA(NULL, NULL);
3742 }
3743
3744 SetLastError(0xdeadbeef);
3745 required_len = 0;
3746 ret = GetUserNameA(NULL, &required_len);
3747 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
3748 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
3749 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3750
3751 SetLastError(0xdeadbeef);
3752 required_len = 1;
3753 ret = GetUserNameA(NULL, &required_len);
3754 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
3755 ok(required_len != 0 && required_len != 1, "Outputted buffer length was %u\n", required_len);
3756 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3757
3758 /* Tests crashes on Windows. */
3759 if (0)
3760 {
3761 SetLastError(0xdeadbeef);
3762 required_len = UNLEN + 1;
3763 GetUserNameA(NULL, &required_len);
3764
3765 SetLastError(0xdeadbeef);
3766 GetUserNameA(buffer, NULL);
3767 }
3768
3769 memset(filler, 'x', sizeof(filler));
3770
3771 /* Note that GetUserNameA on XP and newer outputs the number of bytes
3772 * required for a Unicode string, which affects a test in the next block. */
3773 SetLastError(0xdeadbeef);
3774 memcpy(buffer, filler, sizeof(filler));
3775 required_len = 0;
3776 ret = GetUserNameA(buffer, &required_len);
3777 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
3778 ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was altered\n");
3779 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
3780 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3781
3782 SetLastError(0xdeadbeef);
3783 memcpy(buffer, filler, sizeof(filler));
3784 buffer_len = required_len;
3785 ret = GetUserNameA(buffer, &buffer_len);
3786 ok(ret == TRUE, "GetUserNameA returned %d, last error %u\n", ret, GetLastError());
3787 ok(memcmp(buffer, filler, sizeof(filler)) != 0, "Output buffer was untouched\n");
3788 ok(buffer_len == required_len ||
3789 broken(buffer_len == required_len / sizeof(WCHAR)), /* XP+ */
3790 "Outputted buffer length was %u\n", buffer_len);
3791
3792 /* Use the reported buffer size from the last GetUserNameA call and pass
3793 * a length that is one less than the required value. */
3794 SetLastError(0xdeadbeef);
3795 memcpy(buffer, filler, sizeof(filler));
3796 buffer_len--;
3797 ret = GetUserNameA(buffer, &buffer_len);
3798 ok(ret == FALSE, "GetUserNameA returned %d\n", ret);
3799 ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was untouched\n");
3800 ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
3801 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3802 }
3803
3804 static void test_GetUserNameW(void)
3805 {
3806 WCHAR buffer[UNLEN + 1], filler[UNLEN + 1];
3807 DWORD required_len, buffer_len;
3808 BOOL ret;
3809
3810 /* Test crashes on Windows. */
3811 if (0)
3812 {
3813 SetLastError(0xdeadbeef);
3814 GetUserNameW(NULL, NULL);
3815 }
3816
3817 SetLastError(0xdeadbeef);
3818 required_len = 0;
3819 ret = GetUserNameW(NULL, &required_len);
3820 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
3821 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
3822 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3823
3824 SetLastError(0xdeadbeef);
3825 required_len = 1;
3826 ret = GetUserNameW(NULL, &required_len);
3827 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
3828 ok(required_len != 0 && required_len != 1, "Outputted buffer length was %u\n", required_len);
3829 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3830
3831 /* Tests crash on Windows. */
3832 if (0)
3833 {
3834 SetLastError(0xdeadbeef);
3835 required_len = UNLEN + 1;
3836 GetUserNameW(NULL, &required_len);
3837
3838 SetLastError(0xdeadbeef);
3839 GetUserNameW(buffer, NULL);
3840 }
3841
3842 memset(filler, 'x', sizeof(filler));
3843
3844 SetLastError(0xdeadbeef);
3845 memcpy(buffer, filler, sizeof(filler));
3846 required_len = 0;
3847 ret = GetUserNameW(buffer, &required_len);
3848 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
3849 ok(!memcmp(buffer, filler, sizeof(filler)), "Output buffer was altered\n");
3850 ok(required_len != 0, "Outputted buffer length was %u\n", required_len);
3851 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3852
3853 SetLastError(0xdeadbeef);
3854 memcpy(buffer, filler, sizeof(filler));
3855 buffer_len = required_len;
3856 ret = GetUserNameW(buffer, &buffer_len);
3857 ok(ret == TRUE, "GetUserNameW returned %d, last error %u\n", ret, GetLastError());
3858 ok(memcmp(buffer, filler, sizeof(filler)) != 0, "Output buffer was untouched\n");
3859 ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
3860
3861 /* GetUserNameW on XP and newer writes a truncated portion of the username string to the buffer. */
3862 SetLastError(0xdeadbeef);
3863 memcpy(buffer, filler, sizeof(filler));
3864 buffer_len--;
3865 ret = GetUserNameW(buffer, &buffer_len);
3866 ok(ret == FALSE, "GetUserNameW returned %d\n", ret);
3867 ok(!memcmp(buffer, filler, sizeof(filler)) ||
3868 broken(memcmp(buffer, filler, sizeof(filler)) != 0), /* XP+ */
3869 "Output buffer was altered\n");
3870 ok(buffer_len == required_len, "Outputted buffer length was %u\n", buffer_len);
3871 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Last error was %u\n", GetLastError());
3872 }
3873
3874 static void test_CreateRestrictedToken(void)
3875 {
3876 HANDLE process_token, token, r_token;
3877 PTOKEN_GROUPS token_groups, groups2;
3878 SID_AND_ATTRIBUTES sattr;
3879 BOOL is_member;
3880 DWORD size;
3881 BOOL ret;
3882 DWORD i, j;
3883
3884 if (!pCreateRestrictedToken)
3885 {
3886 win_skip("CreateRestrictedToken is not available\n");
3887 return;
3888 }
3889
3890 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token);
3891 ok(ret, "got error %d\n", GetLastError());
3892
3893 ret = DuplicateTokenEx(process_token, TOKEN_DUPLICATE|TOKEN_ADJUST_GROUPS|TOKEN_QUERY,
3894 NULL, SecurityImpersonation, TokenImpersonation, &token);
3895 ok(ret, "got error %d\n", GetLastError());
3896
3897 /* groups */
3898 ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
3899 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
3900 "got %d with error %d\n", ret, GetLastError());
3901 token_groups = HeapAlloc(GetProcessHeap(), 0, size);
3902 ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
3903 ok(ret, "got error %d\n", GetLastError());
3904
3905 for (i = 0; i < token_groups->GroupCount; i++)
3906 {
3907 if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED)
3908 break;
3909 }
3910
3911 if (i == token_groups->GroupCount)
3912 {
3913 HeapFree(GetProcessHeap(), 0, token_groups);
3914 CloseHandle(token);
3915 skip("User not a member of any group\n");
3916 return;
3917 }
3918
3919 is_member = FALSE;
3920 ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member);
3921 ok(ret, "got error %d\n", GetLastError());
3922 ok(is_member, "not a member\n");
3923
3924 /* disable a SID in new token */
3925 sattr.Sid = token_groups->Groups[i].Sid;
3926 sattr.Attributes = 0;
3927 ret = pCreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token);
3928 todo_wine ok(ret, "got error %d\n", GetLastError());
3929
3930 if (ret)
3931 {
3932 /* check if a SID is enabled */
3933 is_member = TRUE;
3934 ret = pCheckTokenMembership(r_token, token_groups->Groups[i].Sid, &is_member);
3935 ok(ret, "got error %d\n", GetLastError());
3936 ok(!is_member, "not a member\n");
3937
3938 ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size);
3939 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n",
3940 ret, GetLastError());
3941 groups2 = HeapAlloc(GetProcessHeap(), 0, size);
3942 ret = GetTokenInformation(r_token, TokenGroups, groups2, size, &size);
3943 ok(ret, "got error %d\n", GetLastError());
3944
3945 for (j = 0; j < groups2->GroupCount; j++)
3946 {
3947 if (EqualSid(groups2->Groups[j].Sid, token_groups->Groups[i].Sid))
3948 break;
3949 }
3950
3951 ok(groups2->Groups[j].Attributes & SE_GROUP_USE_FOR_DENY_ONLY,
3952 "got wrong attributes\n");
3953 ok((groups2->Groups[j].Attributes & SE_GROUP_ENABLED) == 0,
3954 "got wrong attributes\n");
3955
3956 HeapFree(GetProcessHeap(), 0, groups2);
3957 }
3958
3959 HeapFree(GetProcessHeap(), 0, token_groups);
3960 CloseHandle(r_token);
3961 CloseHandle(token);
3962 CloseHandle(process_token);
3963 }
3964
3965 START_TEST(security)
3966 {
3967 init();
3968 if (!hmod) return;
3969
3970 if (myARGC >= 3)
3971 {
3972 test_process_security_child();
3973 return;
3974 }
3975 test_sid();
3976 test_trustee();
3977 test_luid();
3978 test_CreateWellKnownSid();
3979 test_FileSecurity();
3980 test_AccessCheck();
3981 test_token_attr();
3982 test_LookupAccountSid();
3983 test_LookupAccountName();
3984 test_security_descriptor();
3985 test_process_security();
3986 test_impersonation_level();
3987 test_SetEntriesInAclW();
3988 test_SetEntriesInAclA();
3989 test_GetNamedSecurityInfoA();
3990 test_ConvertStringSecurityDescriptor();
3991 test_ConvertSecurityDescriptorToString();
3992 test_PrivateObjectSecurity();
3993 test_acls();
3994 test_GetSecurityInfo();
3995 test_GetSidSubAuthority();
3996 test_CheckTokenMembership();
3997 test_EqualSid();
3998 test_GetUserNameA();
3999 test_GetUserNameW();
4000 test_CreateRestrictedToken();
4001 }
Maarten's multimedia branch