server/token.c

   1 /*
   2  * Tokens
   3  *
   4  * Copyright (C) 1998 Alexandre Julliard
   5  * Copyright (C) 2003 Mike McCormack
   6  * Copyright (C) 2005 Robert Shearman
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  */
  22
  23 #include "config.h"
  24
  25 #include <assert.h>
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28 #include <stdarg.h>
  29
  30 #include "ntstatus.h"
  31 #define WIN32_NO_STATUS
  32 #include "windef.h"
  33 #include "winternl.h"
  34
  35 #include "handle.h"
  36 #include "thread.h"
  37 #include "process.h"
  38 #include "request.h"
  39 #include "security.h"
  40
  41 #include "wine/unicode.h"
  42
  43 #define MAX_SUBAUTH_COUNT 1
  44
  45 const LUID SeIncreaseQuotaPrivilege        = {  5, 0 };
  46 const LUID SeSecurityPrivilege             = {  8, 0 };
  47 const LUID SeTakeOwnershipPrivilege        = {  9, 0 };
  48 const LUID SeLoadDriverPrivilege           = { 10, 0 };
  49 const LUID SeSystemProfilePrivilege        = { 11, 0 };
  50 const LUID SeSystemtimePrivilege           = { 12, 0 };
  51 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
  52 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
  53 const LUID SeCreatePagefilePrivilege       = { 15, 0 };
  54 const LUID SeBackupPrivilege               = { 17, 0 };
  55 const LUID SeRestorePrivilege              = { 18, 0 };
  56 const LUID SeShutdownPrivilege             = { 19, 0 };
  57 const LUID SeDebugPrivilege                = { 20, 0 };
  58 const LUID SeSystemEnvironmentPrivilege    = { 22, 0 };
  59 const LUID SeChangeNotifyPrivilege         = { 23, 0 };
  60 const LUID SeRemoteShutdownPrivilege       = { 24, 0 };
  61 const LUID SeUndockPrivilege               = { 25, 0 };
  62 const LUID SeManageVolumePrivilege         = { 28, 0 };
  63 const LUID SeImpersonatePrivilege          = { 29, 0 };
  64 const LUID SeCreateGlobalPrivilege         = { 30, 0 };
  65
  66 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
  67 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
  68 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
  69 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
  70 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
  71 static const PSID security_world_sid = (PSID)&world_sid;
  72 static const PSID security_local_sid = (PSID)&local_sid;
  73 const PSID security_interactive_sid = (PSID)&interactive_sid;
  74 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
  75 static const PSID security_local_system_sid = (PSID)&local_system_sid;
  76
  77 struct token
  78 {
  79     struct object  obj;             /* object header */
  80     struct list    privileges;      /* privileges available to the token */
  81     struct list    groups;          /* groups that the user of this token belongs to (sid_and_attributes) */
  82     SID           *user;            /* SID of user this token represents */
  83     unsigned       primary;         /* is this a primary or impersonation token? */
  84     ACL           *default_dacl;    /* the default DACL to assign to objects created by this user */
  85 };
  86
  87 struct privilege
  88 {
  89     struct list entry;
  90     LUID        luid;
  91     unsigned    enabled  : 1; /* is the privilege currently enabled? */
  92     unsigned    def      : 1; /* is the privilege enabled by default? */
  93 };
  94
  95 struct sid_and_attributes
  96 {
  97     struct list entry;
  98     unsigned    enabled  : 1; /* is the sid currently enabled? */
  99     unsigned    def      : 1; /* is the sid enabled by default? */
 100     unsigned    logon    : 1; /* is this a logon sid? */
 101     unsigned    mandatory: 1; /* is this sid always enabled? */
 102     unsigned    owner    : 1; /* can this sid be an owner of an object? */
 103     unsigned    resource : 1; /* is this a domain-local group? */
 104     unsigned    deny_only: 1; /* is this a sid that should be use for denying only? */
 105     SID         sid;
 106 };
 107
 108 static void token_dump( struct object *obj, int verbose );
 109 static void token_destroy( struct object *obj );
 110
 111 static const struct object_ops token_ops =
 112 {
 113     sizeof(struct token),      /* size */
 114     token_dump,                /* dump */
 115     no_add_queue,              /* add_queue */
 116     NULL,                      /* remove_queue */
 117     NULL,                      /* signaled */
 118     NULL,                      /* satisfied */
 119     no_signal,                 /* signal */
 120     no_get_fd,                 /* get_fd */
 121     no_lookup_name,            /* lookup_name */
 122     no_close_handle,           /* close_handle */
 123     token_destroy              /* destroy */
 124 };
 125
 126
 127 static void token_dump( struct object *obj, int verbose )
 128 {
 129     fprintf( stderr, "Security token\n" );
 130     /* FIXME: dump token members */
 131 }
 132
 133 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
 134 {
 135     int i;
 136     SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
 137     if (!sid) return NULL;
 138     sid->Revision = SID_REVISION;
 139     sid->SubAuthorityCount = subauthcount;
 140     sid->IdentifierAuthority = *idauthority;
 141     for (i = 0; i < subauthcount; i++)
 142         sid->SubAuthority[i] = subauth[i];
 143     return sid;
 144 }
 145
 146 static inline int security_equal_sid( const SID *sid1, const SID *sid2 )
 147 {
 148     return ((sid1->SubAuthorityCount == sid2->SubAuthorityCount) &&
 149         !memcmp( sid1, sid2, FIELD_OFFSET(SID, SubAuthority[sid1->SubAuthorityCount]) ));
 150 }
 151
 152 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
 153 {
 154     if (!handle)
 155     {
 156         if (thread->token)
 157             release_object( thread->token );
 158         thread->token = NULL;
 159     }
 160     else
 161     {
 162         struct token *token = (struct token *)get_handle_obj( current->process,
 163                                                               handle,
 164                                                               TOKEN_IMPERSONATE,
 165                                                               &token_ops );
 166         if (token)
 167         {
 168             if (thread->token)
 169                 release_object( thread->token );
 170             thread->token = token;
 171         }
 172     }
 173 }
 174
 175 static const ACE_HEADER *ace_next( const ACE_HEADER *ace )
 176 {
 177     return (const ACE_HEADER *)((const char *)ace + ace->AceSize);
 178 }
 179
 180 static int acl_is_valid( const ACL *acl, size_t size )
 181 {
 182     ULONG i;
 183     const ACE_HEADER *ace;
 184
 185     if (size < sizeof(ACL))
 186         return FALSE;
 187
 188     size = min(size, MAX_ACL_LEN);
 189
 190     size -= sizeof(ACL);
 191
 192     ace = (const ACE_HEADER *)(acl + 1);
 193     for (i = 0; i < acl->AceCount; i++)
 194     {
 195         const SID *sid;
 196         size_t sid_size;
 197
 198         if (size < sizeof(ACE_HEADER))
 199             return FALSE;
 200         if (size < ace->AceSize)
 201             return FALSE;
 202         size -= ace->AceSize;
 203         switch (ace->AceType)
 204         {
 205         case ACCESS_DENIED_ACE_TYPE:
 206             sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
 207             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
 208             break;
 209         case ACCESS_ALLOWED_ACE_TYPE:
 210             sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
 211             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
 212             break;
 213         case SYSTEM_AUDIT_ACE_TYPE:
 214             sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
 215             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
 216             break;
 217         case SYSTEM_ALARM_ACE_TYPE:
 218             sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
 219             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
 220             break;
 221         default:
 222             return FALSE;
 223         }
 224         if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) ||
 225             sid_size < FIELD_OFFSET(SID, SubAuthority[sid->SubAuthorityCount]))
 226             return FALSE;
 227         ace = ace_next( ace );
 228     }
 229     return TRUE;
 230 }
 231
 232 /* gets the discretionary access control list from a security descriptor */
 233 static inline const ACL *sd_get_dacl( const struct security_descriptor *sd, int *present )
 234 {
 235     *present = (sd->control & SE_DACL_PRESENT ? TRUE : FALSE);
 236
 237     if (sd->dacl_len)
 238         return (const ACL *)((const char *)(sd + 1) +
 239             sd->owner_len + sd->group_len + sd->sacl_len);
 240     else
 241         return NULL;
 242 }
 243
 244 /* gets the system access control list from a security descriptor */
 245 static inline const ACL *sd_get_sacl( const struct security_descriptor *sd, int *present )
 246 {
 247     *present = (sd->control & SE_SACL_PRESENT ? TRUE : FALSE);
 248
 249     if (sd->sacl_len)
 250         return (const ACL *)((const char *)(sd + 1) +
 251             sd->owner_len + sd->group_len);
 252     else
 253         return NULL;
 254 }
 255
 256 /* gets the owner from a security descriptor */
 257 static inline const SID *sd_get_owner( const struct security_descriptor *sd )
 258 {
 259     if (sd->owner_len)
 260         return (const SID *)(sd + 1);
 261     else
 262         return NULL;
 263 }
 264
 265 /* gets the primary group from a security descriptor */
 266 static inline const SID *sd_get_group( const struct security_descriptor *sd )
 267 {
 268     if (sd->group_len)
 269         return (const SID *)((const char *)(sd + 1) + sd->owner_len);
 270     else
 271         return NULL;
 272 }
 273
 274 /* checks whether all members of a security descriptor fit inside the size
 275  * of memory specified */
 276 static int sd_is_valid( const struct security_descriptor *sd, size_t size )
 277 {
 278     size_t offset = sizeof(struct security_descriptor);
 279     const SID *group;
 280     const SID *owner;
 281     const ACL *sacl;
 282     const ACL *dacl;
 283     int dummy;
 284
 285     if (size < offset)
 286         return FALSE;
 287
 288     if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 289         (offset + sd->owner_len > size))
 290         return FALSE;
 291     owner = sd_get_owner( sd );
 292     if (owner)
 293     {
 294         size_t needed_size = FIELD_OFFSET(SID, SubAuthority[owner->SubAuthorityCount]);
 295         if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
 296             return FALSE;
 297     }
 298     offset += sd->owner_len;
 299
 300     if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 301         (offset + sd->group_len > size))
 302         return FALSE;
 303     group = sd_get_group( sd );
 304     if (group)
 305     {
 306         size_t needed_size = FIELD_OFFSET(SID, SubAuthority[group->SubAuthorityCount]);
 307         if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
 308             return FALSE;
 309     }
 310     offset += sd->group_len;
 311
 312     if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
 313         return FALSE;
 314     sacl = sd_get_sacl( sd, &dummy );
 315     if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
 316         return FALSE;
 317     offset += sd->sacl_len;
 318
 319     if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
 320         return FALSE;
 321     dacl = sd_get_dacl( sd, &dummy );
 322     if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
 323         return FALSE;
 324     offset += sd->dacl_len;
 325
 326     return TRUE;
 327 }
 328
 329 /* maps from generic rights to specific rights as given by a mapping */
 330 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
 331 {
 332     if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
 333     if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
 334     if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
 335     if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
 336     *mask &= 0x0FFFFFFF;
 337 }
 338
 339 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
 340 {
 341     return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
 342 }
 343
 344 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
 345 {
 346     out->Luid = in->luid;
 347     out->Attributes =
 348         (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
 349         (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
 350 }
 351
 352 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
 353 {
 354     struct privilege *privilege = mem_alloc( sizeof(*privilege) );
 355     if (privilege)
 356     {
 357         privilege->luid = *luid;
 358         privilege->def = privilege->enabled = (enabled != 0);
 359         list_add_tail( &token->privileges, &privilege->entry );
 360     }
 361     return privilege;
 362 }
 363
 364 static inline void privilege_remove( struct privilege *privilege )
 365 {
 366     list_remove( &privilege->entry );
 367     free( privilege );
 368 }
 369
 370 static void token_destroy( struct object *obj )
 371 {
 372     struct token* token;
 373     struct list *cursor, *cursor_next;
 374
 375     assert( obj->ops == &token_ops );
 376     token = (struct token *)obj;
 377
 378     free( token->user );
 379
 380     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
 381     {
 382         struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
 383         privilege_remove( privilege );
 384     }
 385
 386     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
 387     {
 388         struct sid_and_attributes *group = LIST_ENTRY( cursor, struct sid_and_attributes, entry );
 389         list_remove( &group->entry );
 390         free( group );
 391     }
 392
 393     free( token->default_dacl );
 394 }
 395
 396 /* creates a new token.
 397  *  groups may be NULL if group_count is 0.
 398  *  privs may be NULL if priv_count is 0.
 399  *  default_dacl may be NULL, indicating that all objects created by the user
 400  *   are unsecured.
 401  */
 402 static struct token *create_token( unsigned primary, const SID *user,
 403                                    const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
 404                                    const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
 405                                    const ACL *default_dacl )
 406 {
 407     struct token *token = alloc_object( &token_ops );
 408     if (token)
 409     {
 410         int i;
 411
 412         list_init( &token->privileges );
 413         list_init( &token->groups );
 414         token->primary = primary;
 415
 416         /* copy user */
 417         token->user = memdup( user, FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]) );
 418         if (!token->user)
 419         {
 420             release_object( token );
 421             return NULL;
 422         }
 423
 424         /* copy groups */
 425         for (i = 0; i < group_count; i++)
 426         {
 427             size_t size = FIELD_OFFSET( struct sid_and_attributes, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
 428             struct sid_and_attributes *group = mem_alloc( size );
 429             memcpy( &group->sid, groups[i].Sid, FIELD_OFFSET( SID, SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] ) );
 430             group->enabled = TRUE;
 431             group->def = TRUE;
 432             group->logon = FALSE;
 433             group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) ? TRUE : FALSE;
 434             group->owner = FALSE;
 435             group->resource = FALSE;
 436             group->deny_only = FALSE;
 437             list_add_tail( &token->groups, &group->entry );
 438         }
 439
 440         /* copy privileges */
 441         for (i = 0; i < priv_count; i++)
 442         {
 443             /* note: we don't check uniqueness: the caller must make sure
 444              * privs doesn't contain any duplicate luids */
 445             if (!privilege_add( token, &privs[i].Luid,
 446                                 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
 447             {
 448                 release_object( token );
 449                 return NULL;
 450             }
 451         }
 452
 453         if (default_dacl)
 454         {
 455             token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
 456             if (!token->default_dacl)
 457             {
 458                 release_object( token );
 459                 return NULL;
 460             }
 461         }
 462         else
 463             token->default_dacl = NULL;
 464     }
 465     return token;
 466 }
 467
 468 static ACL *create_default_dacl( const SID *user )
 469 {
 470     ACCESS_ALLOWED_ACE *aaa;
 471     ACL *default_dacl;
 472     SID *sid;
 473     size_t default_dacl_size = sizeof(ACL) +
 474                                2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 475                                sizeof(local_system_sid) +
 476                                FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]);
 477
 478     default_dacl = mem_alloc( default_dacl_size );
 479     if (!default_dacl) return NULL;
 480
 481     default_dacl->AclRevision = MAX_ACL_REVISION;
 482     default_dacl->Sbz1 = 0;
 483     default_dacl->AclSize = default_dacl_size;
 484     default_dacl->AceCount = 2;
 485     default_dacl->Sbz2 = 0;
 486
 487     /* GENERIC_ALL for Local System */
 488     aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
 489     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 490     aaa->Header.AceFlags = 0;
 491     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 492                           sizeof(local_system_sid);
 493     aaa->Mask = GENERIC_ALL;
 494     sid = (SID *)&aaa->SidStart;
 495     memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
 496
 497     /* GENERIC_ALL for specified user */
 498     aaa = (ACCESS_ALLOWED_ACE *)((const char *)aaa + aaa->Header.AceSize);
 499     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 500     aaa->Header.AceFlags = 0;
 501     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 502                           FIELD_OFFSET( SID, SubAuthority[user->SubAuthorityCount] );
 503     aaa->Mask = GENERIC_ALL;
 504     sid = (SID *)&aaa->SidStart;
 505     memcpy( sid, user, FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]) );
 506
 507     return default_dacl;
 508 }
 509
 510 struct sid_data
 511 {
 512     SID_IDENTIFIER_AUTHORITY idauth;
 513     int count;
 514     unsigned int subauth[MAX_SUBAUTH_COUNT];
 515 };
 516
 517 struct token *token_create_admin( void )
 518 {
 519     struct token *token = NULL;
 520     static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
 521     static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
 522     static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
 523     PSID alias_admins_sid;
 524     PSID alias_users_sid;
 525     ACL *default_dacl = create_default_dacl( &local_system_sid );
 526
 527     alias_admins_sid = security_sid_alloc( &nt_authority, sizeof(alias_admins_subauth)/sizeof(alias_admins_subauth[0]),
 528                                            alias_admins_subauth );
 529     alias_users_sid = security_sid_alloc( &nt_authority, sizeof(alias_users_subauth)/sizeof(alias_users_subauth[0]),
 530                                           alias_users_subauth );
 531
 532     if (alias_admins_sid && alias_users_sid && default_dacl)
 533     {
 534         const LUID_AND_ATTRIBUTES admin_privs[] =
 535         {
 536             { SeChangeNotifyPrivilege        , SE_PRIVILEGE_ENABLED },
 537             { SeSecurityPrivilege            , 0                    },
 538             { SeBackupPrivilege              , 0                    },
 539             { SeRestorePrivilege             , 0                    },
 540             { SeSystemtimePrivilege          , 0                    },
 541             { SeShutdownPrivilege            , 0                    },
 542             { SeRemoteShutdownPrivilege      , 0                    },
 543             { SeTakeOwnershipPrivilege       , 0                    },
 544             { SeDebugPrivilege               , 0                    },
 545             { SeSystemEnvironmentPrivilege   , 0                    },
 546             { SeSystemProfilePrivilege       , 0                    },
 547             { SeProfileSingleProcessPrivilege, 0                    },
 548             { SeIncreaseBasePriorityPrivilege, 0                    },
 549             { SeLoadDriverPrivilege          , 0                    },
 550             { SeCreatePagefilePrivilege      , 0                    },
 551             { SeIncreaseQuotaPrivilege       , 0                    },
 552             { SeUndockPrivilege              , 0                    },
 553             { SeManageVolumePrivilege        , 0                    },
 554             { SeImpersonatePrivilege         , SE_PRIVILEGE_ENABLED },
 555             { SeCreateGlobalPrivilege        , SE_PRIVILEGE_ENABLED },
 556         };
 557         /* note: we don't include non-builtin groups here for the user -
 558          * telling us these is the job of a client-side program */
 559         const SID_AND_ATTRIBUTES admin_groups[] =
 560         {
 561             { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 562             { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 563             { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 564             { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 565             { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 566             { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 567         };
 568         /* note: we just set the user sid to be the interactive builtin sid -
 569          * we should really translate the UNIX user id to a sid */
 570         token = create_token( TRUE, &interactive_sid,
 571                             admin_groups, sizeof(admin_groups)/sizeof(admin_groups[0]),
 572                             admin_privs, sizeof(admin_privs)/sizeof(admin_privs[0]),
 573                             default_dacl );
 574     }
 575
 576     if (alias_admins_sid)
 577         free( alias_admins_sid );
 578     if (alias_users_sid)
 579         free( alias_users_sid );
 580     if (default_dacl)
 581         free( default_dacl );
 582
 583     return token;
 584 }
 585
 586 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
 587 {
 588     struct privilege *privilege;
 589     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 590     {
 591         if (is_equal_luid( luid, &privilege->luid ))
 592         {
 593             if (enabled_only && !privilege->enabled)
 594                 return NULL;
 595             return privilege;
 596         }
 597     }
 598     return NULL;
 599 }
 600
 601 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
 602                                              unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
 603                                              unsigned int mod_privs_count )
 604 {
 605     int i;
 606     unsigned int modified_count = 0;
 607
 608     for (i = 0; i < count; i++)
 609     {
 610         struct privilege *privilege =
 611             token_find_privilege( token, &privs[i].Luid, FALSE );
 612         if (!privilege)
 613         {
 614             set_error( STATUS_NOT_ALL_ASSIGNED );
 615             continue;
 616         }
 617
 618         if (privs[i].Attributes & SE_PRIVILEGE_REMOVE)
 619             privilege_remove( privilege );
 620         else
 621         {
 622             /* save previous state for caller */
 623             if (mod_privs_count)
 624             {
 625                 luid_and_attr_from_privilege(mod_privs, privilege);
 626                 mod_privs++;
 627                 mod_privs_count--;
 628                 modified_count++;
 629             }
 630
 631             if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
 632                 privilege->enabled = TRUE;
 633             else
 634                 privilege->enabled = FALSE;
 635         }
 636     }
 637     return modified_count;
 638 }
 639
 640 static void token_disable_privileges( struct token *token )
 641 {
 642     struct privilege *privilege;
 643     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 644         privilege->enabled = FALSE;
 645 }
 646
 647 int token_check_privileges( struct token *token, int all_required,
 648                             const LUID_AND_ATTRIBUTES *reqprivs,
 649                             unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
 650 {
 651     int i;
 652     unsigned int enabled_count = 0;
 653
 654     for (i = 0; i < count; i++)
 655     {
 656         struct privilege *privilege =
 657             token_find_privilege( token, &reqprivs[i].Luid, TRUE );
 658
 659         if (usedprivs)
 660             usedprivs[i] = reqprivs[i];
 661
 662         if (privilege && privilege->enabled)
 663         {
 664             enabled_count++;
 665             if (usedprivs)
 666                 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
 667         }
 668     }
 669
 670     if (all_required)
 671         return (enabled_count == count);
 672     else
 673         return (enabled_count > 0);
 674 }
 675
 676 static int token_sid_present( struct token *token, const SID *sid, int deny )
 677 {
 678     struct sid_and_attributes *group;
 679
 680     if (security_equal_sid( token->user, sid )) return TRUE;
 681
 682     LIST_FOR_EACH_ENTRY( group, &token->groups, struct sid_and_attributes, entry )
 683     {
 684         if (!group->enabled) continue;
 685         if (group->deny_only && !deny) continue;
 686
 687         if (security_equal_sid( &group->sid, sid )) return TRUE;
 688     }
 689
 690     return FALSE;
 691 }
 692
 693 /* checks access to a security descriptor. sd must have been validated by caller.
 694  * it returns STATUS_SUCCESS if access was granted to the object, or an error
 695  * status code if not, giving the reason. errors not relating to giving access
 696  * to the object are returned in the status parameter. granted_access and
 697  * status always have a valid value stored in them on return. */
 698 static unsigned int token_access_check( struct token *token,
 699                                  const struct security_descriptor *sd,
 700                                  unsigned int desired_access,
 701                                  LUID_AND_ATTRIBUTES *privs,
 702                                  unsigned int *priv_count,
 703                                  const GENERIC_MAPPING *mapping,
 704                                  unsigned int *granted_access,
 705                                  unsigned int *status )
 706 {
 707     unsigned int current_access = 0;
 708     unsigned int denied_access = 0;
 709     ULONG i;
 710     const ACL *dacl;
 711     int dacl_present;
 712     const ACE_HEADER *ace;
 713     const SID *owner;
 714
 715     /* assume success, but no access rights */
 716     *status = STATUS_SUCCESS;
 717     *granted_access = 0;
 718
 719     /* fail if desired_access contains generic rights */
 720     if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
 721     {
 722         *priv_count = 0;
 723         *status = STATUS_GENERIC_NOT_MAPPED;
 724         return STATUS_ACCESS_DENIED;
 725     }
 726
 727     dacl = sd_get_dacl( sd, &dacl_present );
 728     owner = sd_get_owner( sd );
 729     if (!owner || !sd_get_group( sd ))
 730     {
 731         *priv_count = 0;
 732         *status = STATUS_INVALID_SECURITY_DESCR;
 733         return STATUS_ACCESS_DENIED;
 734     }
 735
 736     /* 1: Grant desired access if the object is unprotected */
 737     if (!dacl_present)
 738     {
 739         *priv_count = 0;
 740         *granted_access = desired_access;
 741         return STATUS_SUCCESS;
 742     }
 743     if (!dacl)
 744     {
 745         *priv_count = 0;
 746         return STATUS_ACCESS_DENIED;
 747     }
 748
 749     /* 2: Check if caller wants access to system security part. Note: access
 750      * is only granted if specifically asked for */
 751     if (desired_access & ACCESS_SYSTEM_SECURITY)
 752     {
 753         const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
 754         LUID_AND_ATTRIBUTES retpriv = security_priv;
 755         if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
 756         {
 757             if (priv_count)
 758             {
 759                 /* assumes that there will only be one privilege to return */
 760                 if (*priv_count >= 1)
 761                 {
 762                     *priv_count = 1;
 763                     *privs = retpriv;
 764                 }
 765                 else
 766                 {
 767                     *priv_count = 1;
 768                     return STATUS_BUFFER_TOO_SMALL;
 769                 }
 770             }
 771             current_access |= ACCESS_SYSTEM_SECURITY;
 772             if (desired_access == current_access)
 773             {
 774                 *granted_access = current_access;
 775                 return STATUS_SUCCESS;
 776             }
 777         }
 778         else
 779         {
 780             *priv_count = 0;
 781             return STATUS_PRIVILEGE_NOT_HELD;
 782         }
 783     }
 784     else if (priv_count) *priv_count = 0;
 785
 786     /* 3: Check whether the token is the owner */
 787     /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
 788      * checked when a "set owner" call is made, overriding the access rights
 789      * determined here. */
 790     if (token_sid_present( token, owner, FALSE ))
 791     {
 792         current_access |= (READ_CONTROL | WRITE_DAC);
 793         if (desired_access == current_access)
 794         {
 795             *granted_access = current_access;
 796             return STATUS_SUCCESS;
 797         }
 798     }
 799
 800     /* 4: Grant rights according to the DACL */
 801     ace = (const ACE_HEADER *)(dacl + 1);
 802     for (i = 0; i < dacl->AceCount; i++)
 803     {
 804         const ACCESS_ALLOWED_ACE *aa_ace;
 805         const ACCESS_DENIED_ACE *ad_ace;
 806         const SID *sid;
 807         switch (ace->AceType)
 808         {
 809         case ACCESS_DENIED_ACE_TYPE:
 810             ad_ace = (const ACCESS_DENIED_ACE *)ace;
 811             sid = (const SID *)&ad_ace->SidStart;
 812             if (token_sid_present( token, sid, TRUE ))
 813             {
 814                 unsigned int access = ad_ace->Mask;
 815                 map_generic_mask(&access, mapping);
 816                 if (desired_access & MAXIMUM_ALLOWED)
 817                     denied_access |= access;
 818                 else
 819                 {
 820                     denied_access |= (access & ~current_access);
 821                     if (desired_access & access)
 822                     {
 823                         *granted_access = 0;
 824                         return STATUS_SUCCESS;
 825                     }
 826                 }
 827             }
 828             break;
 829         case ACCESS_ALLOWED_ACE_TYPE:
 830             aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
 831             sid = (const SID *)&aa_ace->SidStart;
 832             if (token_sid_present( token, sid, FALSE ))
 833             {
 834                 unsigned int access = aa_ace->Mask;
 835                 map_generic_mask(&access, mapping);
 836                 if (desired_access & MAXIMUM_ALLOWED)
 837                     current_access |= access;
 838                 else
 839                     current_access |= (access & ~denied_access);
 840             }
 841             break;
 842         }
 843
 844         /* don't bother carrying on checking if we've already got all of
 845             * rights we need */
 846         if (desired_access == *granted_access)
 847             break;
 848
 849         ace = ace_next( ace );
 850     }
 851
 852     if (desired_access & MAXIMUM_ALLOWED)
 853     {
 854         *granted_access = current_access & ~denied_access;
 855         if (*granted_access)
 856             return STATUS_SUCCESS;
 857         else
 858             return STATUS_ACCESS_DENIED;
 859     }
 860     else
 861     {
 862         if ((current_access & desired_access) == desired_access)
 863         {
 864             *granted_access = current_access & desired_access;
 865             return STATUS_SUCCESS;
 866         }
 867         else
 868             return STATUS_ACCESS_DENIED;
 869     }
 870 }
 871
 872 const ACL *token_get_default_dacl( struct token *token )
 873 {
 874     return token->default_dacl;
 875 }
 876
 877 /* open a security token */
 878 DECL_HANDLER(open_token)
 879 {
 880     if (req->flags & OPEN_TOKEN_THREAD)
 881     {
 882         struct thread *thread = get_thread_from_handle( req->handle, 0 );
 883         if (thread)
 884         {
 885             if (thread->token)
 886                 reply->token = alloc_handle( current->process, thread->token, TOKEN_ALL_ACCESS, 0);
 887             else
 888                 set_error(STATUS_NO_TOKEN);
 889             release_object( thread );
 890         }
 891     }
 892     else
 893     {
 894         struct process *process = get_process_from_handle( req->handle, 0 );
 895         if (process)
 896         {
 897             if (process->token)
 898                 reply->token = alloc_handle( current->process, process->token, TOKEN_ALL_ACCESS, 0);
 899             else
 900                 set_error(STATUS_NO_TOKEN);
 901             release_object( process );
 902         }
 903     }
 904 }
 905
 906 /* adjust the privileges held by a token */
 907 DECL_HANDLER(adjust_token_privileges)
 908 {
 909     struct token *token;
 910     unsigned int access = TOKEN_ADJUST_PRIVILEGES;
 911
 912     if (req->get_modified_state) access |= TOKEN_QUERY;
 913
 914     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
 915                                                  access, &token_ops )))
 916     {
 917         const LUID_AND_ATTRIBUTES *privs = get_req_data();
 918         LUID_AND_ATTRIBUTES *modified_privs = NULL;
 919         unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
 920         unsigned int modified_priv_count = 0;
 921
 922         if (req->get_modified_state && !req->disable_all)
 923         {
 924             int i;
 925             /* count modified privs */
 926             for (i = 0; i < priv_count; i++)
 927             {
 928                 struct privilege *privilege =
 929                     token_find_privilege( token, &privs[i].Luid, FALSE );
 930                 if (privilege && req->get_modified_state)
 931                     modified_priv_count++;
 932             }
 933             reply->len = modified_priv_count;
 934             modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
 935             if (modified_priv_count)
 936                 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
 937         }
 938         reply->len = modified_priv_count * sizeof(*modified_privs);
 939
 940         if (req->disable_all)
 941             token_disable_privileges( token );
 942         else
 943             modified_priv_count = token_adjust_privileges( token, privs,
 944                 priv_count, modified_privs, modified_priv_count );
 945
 946         release_object( token );
 947     }
 948 }
 949
 950 /* retrieves the list of privileges that may be held be the token */
 951 DECL_HANDLER(get_token_privileges)
 952 {
 953     struct token *token;
 954
 955     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
 956                                                  TOKEN_QUERY,
 957                                                  &token_ops )))
 958     {
 959         int priv_count = 0;
 960         LUID_AND_ATTRIBUTES *privs;
 961         struct privilege *privilege;
 962
 963         LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 964             priv_count++;
 965
 966         reply->len = priv_count * sizeof(*privs);
 967         if (reply->len <= get_reply_max_size())
 968         {
 969             privs = set_reply_data_size( priv_count * sizeof(*privs) );
 970             if (privs)
 971             {
 972                 int i = 0;
 973                 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 974                 {
 975                     luid_and_attr_from_privilege( &privs[i], privilege );
 976                     i++;
 977                 }
 978             }
 979         }
 980         else
 981             set_error(STATUS_BUFFER_TOO_SMALL);
 982
 983         release_object( token );
 984     }
 985 }
 986
 987 /* creates a duplicate of the token */
 988 DECL_HANDLER(duplicate_token)
 989 {
 990     struct token *src_token;
 991     if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
 992                                                      TOKEN_DUPLICATE,
 993                                                      &token_ops )))
 994     {
 995         /* FIXME: use req->impersonation_level */
 996         struct token *token = create_token( req->primary, src_token->user, NULL, 0, NULL, 0, src_token->default_dacl );
 997         if (token)
 998         {
 999             struct privilege *privilege;
1000             struct sid_and_attributes *group;
1001             unsigned int access;
1002
1003             /* copy groups */
1004             LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct sid_and_attributes, entry )
1005             {
1006                 size_t size = FIELD_OFFSET( struct sid_and_attributes, sid.SubAuthority[group->sid.SubAuthorityCount] );
1007                 struct sid_and_attributes *newgroup = mem_alloc( size );
1008                 memcpy( newgroup, group, size );
1009                 list_add_tail( &token->groups, &newgroup->entry );
1010             }
1011
1012             /* copy privileges */
1013             LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
1014                 privilege_add( token, &privilege->luid, privilege->enabled );
1015
1016             access = req->access;
1017             if (access & MAXIMUM_ALLOWED) access = TOKEN_ALL_ACCESS; /* FIXME: needs general solution */
1018             reply->new_handle = alloc_handle( current->process, token, access, req->inherit);
1019             release_object( token );
1020         }
1021         release_object( src_token );
1022     }
1023 }
1024
1025 /* checks the specified privileges are held by the token */
1026 DECL_HANDLER(check_token_privileges)
1027 {
1028     struct token *token;
1029
1030     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1031                                                  TOKEN_QUERY,
1032                                                  &token_ops )))
1033     {
1034         unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1035         if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1036         {
1037             LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1038             reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1039         }
1040         else
1041             set_error( STATUS_BUFFER_OVERFLOW );
1042         release_object( token );
1043     }
1044 }
1045
1046 /* checks that a user represented by a token is allowed to access an object
1047  * represented by a security descriptor */
1048 DECL_HANDLER(access_check)
1049 {
1050     size_t sd_size = get_req_data_size();
1051     const struct security_descriptor *sd = get_req_data();
1052     struct token *token;
1053
1054     if (!sd_is_valid( sd, sd_size ))
1055     {
1056         set_error( STATUS_ACCESS_VIOLATION );
1057         return;
1058     }
1059
1060     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1061                                                  TOKEN_QUERY,
1062                                                  &token_ops )))
1063     {
1064         GENERIC_MAPPING mapping;
1065         unsigned int status;
1066         LUID_AND_ATTRIBUTES priv;
1067         unsigned int priv_count = 1;
1068
1069         memset(&priv, 0, sizeof(priv));
1070
1071         /* only impersonation tokens may be used with this function */
1072         if (token->primary)
1073         {
1074             set_error( STATUS_NO_IMPERSONATION_TOKEN );
1075             release_object( token );
1076             return;
1077         }
1078
1079         mapping.GenericRead = req->mapping_read;
1080         mapping.GenericWrite = req->mapping_write;
1081         mapping.GenericExecute = req->mapping_execute;
1082         mapping.GenericAll = req->mapping_all;
1083
1084         reply->access_status = token_access_check(
1085             token, sd, req->desired_access, &priv, &priv_count, &mapping,
1086             &reply->access_granted, &status );
1087
1088         reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1089
1090         if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1091         {
1092             LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1093             memcpy( privs, &priv, sizeof(priv) );
1094         }
1095
1096         if (status != STATUS_SUCCESS)
1097             set_error( status );
1098
1099         release_object( token );
1100     }
1101 }
1102
1103 /* */
1104 DECL_HANDLER(get_token_user)
1105 {
1106     struct token *token;
1107
1108     reply->user_len = 0;
1109
1110     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1111                                                  TOKEN_QUERY,
1112                                                  &token_ops )))
1113     {
1114         const SID *user = token->user;
1115
1116         reply->user_len = FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]);
1117         if (reply->user_len <= get_reply_max_size())
1118         {
1119             SID *user_reply = set_reply_data_size( reply->user_len );
1120             if (user_reply)
1121                 memcpy( user_reply, user, reply->user_len );
1122         }
1123         else set_error( STATUS_BUFFER_TOO_SMALL );
1124
1125         release_object( token );
1126     }
1127 }