server/token.c

   1 /*
   2  * Tokens
   3  *
   4  * Copyright (C) 1998 Alexandre Julliard
   5  * Copyright (C) 2003 Mike McCormack
   6  * Copyright (C) 2005 Robert Shearman
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #include "config.h"
  24
  25 #include <assert.h>
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28 #include <stdarg.h>
  29 #include <unistd.h>
  30
  31 #include "ntstatus.h"
  32 #define WIN32_NO_STATUS
  33 #include "windef.h"
  34 #include "winternl.h"
  35
  36 #include "handle.h"
  37 #include "thread.h"
  38 #include "process.h"
  39 #include "request.h"
  40 #include "security.h"
  41
  42 #include "wine/unicode.h"
  43
  44 #define MAX_SUBAUTH_COUNT 1
  45
  46 const LUID SeIncreaseQuotaPrivilege        = {  5, 0 };
  47 const LUID SeSecurityPrivilege             = {  8, 0 };
  48 const LUID SeTakeOwnershipPrivilege        = {  9, 0 };
  49 const LUID SeLoadDriverPrivilege           = { 10, 0 };
  50 const LUID SeSystemProfilePrivilege        = { 11, 0 };
  51 const LUID SeSystemtimePrivilege           = { 12, 0 };
  52 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
  53 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
  54 const LUID SeCreatePagefilePrivilege       = { 15, 0 };
  55 const LUID SeBackupPrivilege               = { 17, 0 };
  56 const LUID SeRestorePrivilege              = { 18, 0 };
  57 const LUID SeShutdownPrivilege             = { 19, 0 };
  58 const LUID SeDebugPrivilege                = { 20, 0 };
  59 const LUID SeSystemEnvironmentPrivilege    = { 22, 0 };
  60 const LUID SeChangeNotifyPrivilege         = { 23, 0 };
  61 const LUID SeRemoteShutdownPrivilege       = { 24, 0 };
  62 const LUID SeUndockPrivilege               = { 25, 0 };
  63 const LUID SeManageVolumePrivilege         = { 28, 0 };
  64 const LUID SeImpersonatePrivilege          = { 29, 0 };
  65 const LUID SeCreateGlobalPrivilege         = { 30, 0 };
  66
  67 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
  68 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
  69 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
  70 static const SID anonymous_logon_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } };
  71 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
  72 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
  73 static const struct /* same fields as struct SID */
  74 {
  75     BYTE Revision;
  76     BYTE SubAuthorityCount;
  77     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  78     DWORD SubAuthority[5];
  79 } local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
  80 static const struct /* same fields as struct SID */
  81 {
  82     BYTE Revision;
  83     BYTE SubAuthorityCount;
  84     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  85     DWORD SubAuthority[2];
  86 } builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
  87 static const struct /* same fields as struct SID */
  88 {
  89     BYTE Revision;
  90     BYTE SubAuthorityCount;
  91     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  92     DWORD SubAuthority[2];
  93 } builtin_users_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
  94
  95 const PSID security_world_sid = (PSID)&world_sid;
  96 static const PSID security_local_sid = (PSID)&local_sid;
  97 static const PSID security_interactive_sid = (PSID)&interactive_sid;
  98 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
  99 const PSID security_local_system_sid = (PSID)&local_system_sid;
 100 const PSID security_local_user_sid = (PSID)&local_user_sid;
 101 const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
 102 const PSID security_builtin_users_sid = (PSID)&builtin_users_sid;
 103
 104 static luid_t prev_luid_value = { 1000, 0 };
 105
 106 struct token
 107 {
 108     struct object  obj;             /* object header */
 109     luid_t         token_id;        /* system-unique id of token */
 110     luid_t         modified_id;     /* new id allocated every time token is modified */
 111     struct list    privileges;      /* privileges available to the token */
 112     struct list    groups;          /* groups that the user of this token belongs to (sid_and_attributes) */
 113     SID           *user;            /* SID of user this token represents */
 114     SID           *primary_group;   /* SID of user's primary group */
 115     unsigned       primary;         /* is this a primary or impersonation token? */
 116     ACL           *default_dacl;    /* the default DACL to assign to objects created by this user */
 117     TOKEN_SOURCE   source;          /* source of the token */
 118     int            impersonation_level; /* impersonation level this token is capable of if non-primary token */
 119 };
 120
 121 struct privilege
 122 {
 123     struct list entry;
 124     LUID        luid;
 125     unsigned    enabled  : 1; /* is the privilege currently enabled? */
 126     unsigned    def      : 1; /* is the privilege enabled by default? */
 127 };
 128
 129 struct group
 130 {
 131     struct list entry;
 132     unsigned    enabled  : 1; /* is the sid currently enabled? */
 133     unsigned    def      : 1; /* is the sid enabled by default? */
 134     unsigned    logon    : 1; /* is this a logon sid? */
 135     unsigned    mandatory: 1; /* is this sid always enabled? */
 136     unsigned    owner    : 1; /* can this sid be an owner of an object? */
 137     unsigned    resource : 1; /* is this a domain-local group? */
 138     unsigned    deny_only: 1; /* is this a sid that should be use for denying only? */
 139     SID         sid;
 140 };
 141
 142 static void token_dump( struct object *obj, int verbose );
 143 static unsigned int token_map_access( struct object *obj, unsigned int access );
 144 static void token_destroy( struct object *obj );
 145
 146 static const struct object_ops token_ops =
 147 {
 148     sizeof(struct token),      /* size */
 149     token_dump,                /* dump */
 150     no_get_type,               /* get_type */
 151     no_add_queue,              /* add_queue */
 152     NULL,                      /* remove_queue */
 153     NULL,                      /* signaled */
 154     NULL,                      /* satisfied */
 155     no_signal,                 /* signal */
 156     no_get_fd,                 /* get_fd */
 157     token_map_access,          /* map_access */
 158     default_get_sd,            /* get_sd */
 159     default_set_sd,            /* set_sd */
 160     no_lookup_name,            /* lookup_name */
 161     no_open_file,              /* open_file */
 162     no_close_handle,           /* close_handle */
 163     token_destroy              /* destroy */
 164 };
 165
 166
 167 static void token_dump( struct object *obj, int verbose )
 168 {
 169     fprintf( stderr, "Security token\n" );
 170     /* FIXME: dump token members */
 171 }
 172
 173 static unsigned int token_map_access( struct object *obj, unsigned int access )
 174 {
 175     if (access & GENERIC_READ)    access |= TOKEN_READ;
 176     if (access & GENERIC_WRITE)   access |= TOKEN_WRITE;
 177     if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
 178     if (access & GENERIC_ALL)     access |= TOKEN_ALL_ACCESS;
 179     return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
 180 }
 181
 182 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
 183 {
 184     int i;
 185     SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
 186     if (!sid) return NULL;
 187     sid->Revision = SID_REVISION;
 188     sid->SubAuthorityCount = subauthcount;
 189     sid->IdentifierAuthority = *idauthority;
 190     for (i = 0; i < subauthcount; i++)
 191         sid->SubAuthority[i] = subauth[i];
 192     return sid;
 193 }
 194
 195 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
 196 {
 197     if (!handle)
 198     {
 199         if (thread->token)
 200             release_object( thread->token );
 201         thread->token = NULL;
 202     }
 203     else
 204     {
 205         struct token *token = (struct token *)get_handle_obj( current->process,
 206                                                               handle,
 207                                                               TOKEN_IMPERSONATE,
 208                                                               &token_ops );
 209         if (token)
 210         {
 211             if (thread->token)
 212                 release_object( thread->token );
 213             thread->token = token;
 214         }
 215     }
 216 }
 217
 218 const SID *security_unix_uid_to_sid( uid_t uid )
 219 {
 220     /* very simple mapping: either the current user or not the current user */
 221     if (uid == getuid())
 222         return (const SID *)&local_user_sid;
 223     else
 224         return &anonymous_logon_sid;
 225 }
 226
 227 static int acl_is_valid( const ACL *acl, data_size_t size )
 228 {
 229     ULONG i;
 230     const ACE_HEADER *ace;
 231
 232     if (size < sizeof(ACL))
 233         return FALSE;
 234
 235     size = min(size, MAX_ACL_LEN);
 236
 237     size -= sizeof(ACL);
 238
 239     ace = (const ACE_HEADER *)(acl + 1);
 240     for (i = 0; i < acl->AceCount; i++)
 241     {
 242         const SID *sid;
 243         data_size_t sid_size;
 244
 245         if (size < sizeof(ACE_HEADER))
 246             return FALSE;
 247         if (size < ace->AceSize)
 248             return FALSE;
 249         size -= ace->AceSize;
 250         switch (ace->AceType)
 251         {
 252         case ACCESS_DENIED_ACE_TYPE:
 253             sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
 254             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
 255             break;
 256         case ACCESS_ALLOWED_ACE_TYPE:
 257             sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
 258             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
 259             break;
 260         case SYSTEM_AUDIT_ACE_TYPE:
 261             sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
 262             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
 263             break;
 264         case SYSTEM_ALARM_ACE_TYPE:
 265             sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
 266             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
 267             break;
 268         case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
 269             sid = (const SID *)&((const SYSTEM_MANDATORY_LABEL_ACE *)ace)->SidStart;
 270             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_MANDATORY_LABEL_ACE, SidStart);
 271             break;
 272         default:
 273             return FALSE;
 274         }
 275         if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) || sid_size < security_sid_len( sid ))
 276             return FALSE;
 277         ace = ace_next( ace );
 278     }
 279     return TRUE;
 280 }
 281
 282 /* checks whether all members of a security descriptor fit inside the size
 283  * of memory specified */
 284 int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
 285 {
 286     size_t offset = sizeof(struct security_descriptor);
 287     const SID *group;
 288     const SID *owner;
 289     const ACL *sacl;
 290     const ACL *dacl;
 291     int dummy;
 292
 293     if (size < offset)
 294         return FALSE;
 295
 296     if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 297         (offset + sd->owner_len > size))
 298         return FALSE;
 299     owner = sd_get_owner( sd );
 300     if (owner)
 301     {
 302         size_t needed_size = security_sid_len( owner );
 303         if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
 304             return FALSE;
 305     }
 306     offset += sd->owner_len;
 307
 308     if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 309         (offset + sd->group_len > size))
 310         return FALSE;
 311     group = sd_get_group( sd );
 312     if (group)
 313     {
 314         size_t needed_size = security_sid_len( group );
 315         if ((sd->group_len < sizeof(SID)) || (needed_size > sd->group_len))
 316             return FALSE;
 317     }
 318     offset += sd->group_len;
 319
 320     if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
 321         return FALSE;
 322     sacl = sd_get_sacl( sd, &dummy );
 323     if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
 324         return FALSE;
 325     offset += sd->sacl_len;
 326
 327     if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
 328         return FALSE;
 329     dacl = sd_get_dacl( sd, &dummy );
 330     if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
 331         return FALSE;
 332     offset += sd->dacl_len;
 333
 334     return TRUE;
 335 }
 336
 337 /* determines whether an object_attributes struct is valid in a buffer
 338  * and calls set_error appropriately */
 339 int objattr_is_valid( const struct object_attributes *objattr, data_size_t size )
 340 {
 341     if ((size < sizeof(*objattr)) || (size - sizeof(*objattr) < objattr->sd_len) ||
 342         (size - sizeof(*objattr) - objattr->sd_len < objattr->name_len))
 343     {
 344         set_error( STATUS_ACCESS_VIOLATION );
 345         return FALSE;
 346     }
 347
 348     if (objattr->sd_len)
 349     {
 350         const struct security_descriptor *sd = (const struct security_descriptor *)(objattr + 1);
 351         if (!sd_is_valid( sd, objattr->sd_len ))
 352         {
 353             set_error( STATUS_INVALID_SECURITY_DESCR );
 354             return FALSE;
 355         }
 356     }
 357
 358     return TRUE;
 359 }
 360
 361 /* maps from generic rights to specific rights as given by a mapping */
 362 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
 363 {
 364     if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
 365     if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
 366     if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
 367     if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
 368     *mask &= 0x0FFFFFFF;
 369 }
 370
 371 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
 372 {
 373     return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
 374 }
 375
 376 static inline void allocate_luid( luid_t *luid )
 377 {
 378     prev_luid_value.low_part++;
 379     *luid = prev_luid_value;
 380 }
 381
 382 DECL_HANDLER( allocate_locally_unique_id )
 383 {
 384     allocate_luid( &reply->luid );
 385 }
 386
 387 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
 388 {
 389     out->Luid = in->luid;
 390     out->Attributes =
 391         (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
 392         (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
 393 }
 394
 395 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
 396 {
 397     struct privilege *privilege = mem_alloc( sizeof(*privilege) );
 398     if (privilege)
 399     {
 400         privilege->luid = *luid;
 401         privilege->def = privilege->enabled = (enabled != 0);
 402         list_add_tail( &token->privileges, &privilege->entry );
 403     }
 404     return privilege;
 405 }
 406
 407 static inline void privilege_remove( struct privilege *privilege )
 408 {
 409     list_remove( &privilege->entry );
 410     free( privilege );
 411 }
 412
 413 static void token_destroy( struct object *obj )
 414 {
 415     struct token* token;
 416     struct list *cursor, *cursor_next;
 417
 418     assert( obj->ops == &token_ops );
 419     token = (struct token *)obj;
 420
 421     free( token->user );
 422
 423     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
 424     {
 425         struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
 426         privilege_remove( privilege );
 427     }
 428
 429     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
 430     {
 431         struct group *group = LIST_ENTRY( cursor, struct group, entry );
 432         list_remove( &group->entry );
 433         free( group );
 434     }
 435
 436     free( token->default_dacl );
 437 }
 438
 439 /* creates a new token.
 440  *  groups may be NULL if group_count is 0.
 441  *  privs may be NULL if priv_count is 0.
 442  *  default_dacl may be NULL, indicating that all objects created by the user
 443  *   are unsecured.
 444  *  modified_id may be NULL, indicating that a new modified_id luid should be
 445  *   allocated.
 446  */
 447 static struct token *create_token( unsigned primary, const SID *user,
 448                                    const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
 449                                    const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
 450                                    const ACL *default_dacl, TOKEN_SOURCE source,
 451                                    const luid_t *modified_id,
 452                                    int impersonation_level )
 453 {
 454     struct token *token = alloc_object( &token_ops );
 455     if (token)
 456     {
 457         unsigned int i;
 458
 459         allocate_luid( &token->token_id );
 460         if (modified_id)
 461             token->modified_id = *modified_id;
 462         else
 463             allocate_luid( &token->modified_id );
 464         list_init( &token->privileges );
 465         list_init( &token->groups );
 466         token->primary = primary;
 467         /* primary tokens don't have impersonation levels */
 468         if (primary)
 469             token->impersonation_level = -1;
 470         else
 471             token->impersonation_level = impersonation_level;
 472         token->default_dacl = NULL;
 473         token->primary_group = NULL;
 474
 475         /* copy user */
 476         token->user = memdup( user, security_sid_len( user ));
 477         if (!token->user)
 478         {
 479             release_object( token );
 480             return NULL;
 481         }
 482
 483         /* copy groups */
 484         for (i = 0; i < group_count; i++)
 485         {
 486             size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
 487             struct group *group = mem_alloc( size );
 488
 489             if (!group)
 490             {
 491                 release_object( token );
 492                 return NULL;
 493             }
 494             memcpy( &group->sid, groups[i].Sid, security_sid_len( groups[i].Sid ));
 495             group->enabled = TRUE;
 496             group->def = TRUE;
 497             group->logon = (groups[i].Attributes & SE_GROUP_LOGON_ID) != 0;
 498             group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) != 0;
 499             group->owner = (groups[i].Attributes & SE_GROUP_OWNER) != 0;
 500             group->resource = FALSE;
 501             group->deny_only = FALSE;
 502             list_add_tail( &token->groups, &group->entry );
 503             /* Use first owner capable group as an owner */
 504             if (!token->primary_group && group->owner)
 505                 token->primary_group = &group->sid;
 506         }
 507
 508         /* copy privileges */
 509         for (i = 0; i < priv_count; i++)
 510         {
 511             /* note: we don't check uniqueness: the caller must make sure
 512              * privs doesn't contain any duplicate luids */
 513             if (!privilege_add( token, &privs[i].Luid,
 514                                 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
 515             {
 516                 release_object( token );
 517                 return NULL;
 518             }
 519         }
 520
 521         if (default_dacl)
 522         {
 523             token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
 524             if (!token->default_dacl)
 525             {
 526                 release_object( token );
 527                 return NULL;
 528             }
 529         }
 530
 531         token->source = source;
 532     }
 533     return token;
 534 }
 535
 536 struct token *token_duplicate( struct token *src_token, unsigned primary,
 537                                int impersonation_level )
 538 {
 539     const luid_t *modified_id =
 540         primary || (impersonation_level == src_token->impersonation_level) ?
 541             &src_token->modified_id : NULL;
 542     struct token *token = NULL;
 543     struct privilege *privilege;
 544     struct group *group;
 545
 546     if (!primary &&
 547         (impersonation_level < SecurityAnonymous ||
 548          impersonation_level > SecurityDelegation ||
 549          (!src_token->primary && (impersonation_level > src_token->impersonation_level))))
 550     {
 551         set_error( STATUS_BAD_IMPERSONATION_LEVEL );
 552         return NULL;
 553     }
 554
 555     token = create_token( primary, src_token->user, NULL, 0,
 556                           NULL, 0, src_token->default_dacl,
 557                           src_token->source, modified_id,
 558                           impersonation_level );
 559     if (!token) return token;
 560
 561     /* copy groups */
 562     token->primary_group = NULL;
 563     LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
 564     {
 565         size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
 566         struct group *newgroup = mem_alloc( size );
 567         if (!newgroup)
 568         {
 569             release_object( token );
 570             return NULL;
 571         }
 572         memcpy( newgroup, group, size );
 573         list_add_tail( &token->groups, &newgroup->entry );
 574         if (src_token->primary_group == &group->sid)
 575             token->primary_group = &newgroup->sid;
 576     }
 577     assert( token->primary_group );
 578
 579     /* copy privileges */
 580     LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
 581         if (!privilege_add( token, &privilege->luid, privilege->enabled ))
 582         {
 583             release_object( token );
 584             return NULL;
 585         }
 586
 587     return token;
 588 }
 589
 590 static ACL *create_default_dacl( const SID *user )
 591 {
 592     ACCESS_ALLOWED_ACE *aaa;
 593     ACL *default_dacl;
 594     SID *sid;
 595     size_t default_dacl_size = sizeof(ACL) +
 596                                2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 597                                sizeof(local_system_sid) +
 598                                security_sid_len( user );
 599
 600     default_dacl = mem_alloc( default_dacl_size );
 601     if (!default_dacl) return NULL;
 602
 603     default_dacl->AclRevision = ACL_REVISION;
 604     default_dacl->Sbz1 = 0;
 605     default_dacl->AclSize = default_dacl_size;
 606     default_dacl->AceCount = 2;
 607     default_dacl->Sbz2 = 0;
 608
 609     /* GENERIC_ALL for Local System */
 610     aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
 611     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 612     aaa->Header.AceFlags = 0;
 613     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 614                           sizeof(local_system_sid);
 615     aaa->Mask = GENERIC_ALL;
 616     sid = (SID *)&aaa->SidStart;
 617     memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
 618
 619     /* GENERIC_ALL for specified user */
 620     aaa = (ACCESS_ALLOWED_ACE *)((char *)aaa + aaa->Header.AceSize);
 621     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 622     aaa->Header.AceFlags = 0;
 623     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) + security_sid_len( user );
 624     aaa->Mask = GENERIC_ALL;
 625     sid = (SID *)&aaa->SidStart;
 626     memcpy( sid, user, security_sid_len( user ));
 627
 628     return default_dacl;
 629 }
 630
 631 struct sid_data
 632 {
 633     SID_IDENTIFIER_AUTHORITY idauth;
 634     int count;
 635     unsigned int subauth[MAX_SUBAUTH_COUNT];
 636 };
 637
 638 struct token *token_create_admin( void )
 639 {
 640     struct token *token = NULL;
 641     static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
 642     static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
 643     static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
 644     /* on Windows, this value changes every time the user logs on */
 645     static const unsigned int logon_subauth[] = { SECURITY_LOGON_IDS_RID, 0, 1 /* FIXME: should be randomly generated when tokens are inherited by new processes */ };
 646     PSID alias_admins_sid;
 647     PSID alias_users_sid;
 648     PSID logon_sid;
 649     const SID *user_sid = security_unix_uid_to_sid( getuid() );
 650     ACL *default_dacl = create_default_dacl( user_sid );
 651
 652     alias_admins_sid = security_sid_alloc( &nt_authority, sizeof(alias_admins_subauth)/sizeof(alias_admins_subauth[0]),
 653                                            alias_admins_subauth );
 654     alias_users_sid = security_sid_alloc( &nt_authority, sizeof(alias_users_subauth)/sizeof(alias_users_subauth[0]),
 655                                           alias_users_subauth );
 656     logon_sid = security_sid_alloc( &nt_authority, sizeof(logon_subauth)/sizeof(logon_subauth[0]),
 657                                     logon_subauth );
 658
 659     if (alias_admins_sid && alias_users_sid && logon_sid && default_dacl)
 660     {
 661         const LUID_AND_ATTRIBUTES admin_privs[] =
 662         {
 663             { SeChangeNotifyPrivilege        , SE_PRIVILEGE_ENABLED },
 664             { SeSecurityPrivilege            , 0                    },
 665             { SeBackupPrivilege              , 0                    },
 666             { SeRestorePrivilege             , 0                    },
 667             { SeSystemtimePrivilege          , 0                    },
 668             { SeShutdownPrivilege            , 0                    },
 669             { SeRemoteShutdownPrivilege      , 0                    },
 670             { SeTakeOwnershipPrivilege       , 0                    },
 671             { SeDebugPrivilege               , 0                    },
 672             { SeSystemEnvironmentPrivilege   , 0                    },
 673             { SeSystemProfilePrivilege       , 0                    },
 674             { SeProfileSingleProcessPrivilege, 0                    },
 675             { SeIncreaseBasePriorityPrivilege, 0                    },
 676             { SeLoadDriverPrivilege          , SE_PRIVILEGE_ENABLED },
 677             { SeCreatePagefilePrivilege      , 0                    },
 678             { SeIncreaseQuotaPrivilege       , 0                    },
 679             { SeUndockPrivilege              , 0                    },
 680             { SeManageVolumePrivilege        , 0                    },
 681             { SeImpersonatePrivilege         , SE_PRIVILEGE_ENABLED },
 682             { SeCreateGlobalPrivilege        , SE_PRIVILEGE_ENABLED },
 683         };
 684         /* note: we don't include non-builtin groups here for the user -
 685          * telling us these is the job of a client-side program */
 686         const SID_AND_ATTRIBUTES admin_groups[] =
 687         {
 688             { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 689             { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 690             { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 691             { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 692             { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
 693             { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 694             { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
 695         };
 696         static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
 697         token = create_token( TRUE, user_sid, admin_groups, sizeof(admin_groups)/sizeof(admin_groups[0]),
 698                               admin_privs, sizeof(admin_privs)/sizeof(admin_privs[0]), default_dacl,
 699                               admin_source, NULL, -1 );
 700         /* we really need a primary group */
 701         assert( token->primary_group );
 702     }
 703
 704     free( logon_sid );
 705     free( alias_admins_sid );
 706     free( alias_users_sid );
 707     free( default_dacl );
 708
 709     return token;
 710 }
 711
 712 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
 713 {
 714     struct privilege *privilege;
 715     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 716     {
 717         if (is_equal_luid( luid, &privilege->luid ))
 718         {
 719             if (enabled_only && !privilege->enabled)
 720                 return NULL;
 721             return privilege;
 722         }
 723     }
 724     return NULL;
 725 }
 726
 727 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
 728                                              unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
 729                                              unsigned int mod_privs_count )
 730 {
 731     unsigned int i, modified_count = 0;
 732
 733     /* mark as modified */
 734     allocate_luid( &token->modified_id );
 735
 736     for (i = 0; i < count; i++)
 737     {
 738         struct privilege *privilege =
 739             token_find_privilege( token, &privs[i].Luid, FALSE );
 740         if (!privilege)
 741         {
 742             set_error( STATUS_NOT_ALL_ASSIGNED );
 743             continue;
 744         }
 745
 746         if (privs[i].Attributes & SE_PRIVILEGE_REMOVED)
 747             privilege_remove( privilege );
 748         else
 749         {
 750             /* save previous state for caller */
 751             if (mod_privs_count)
 752             {
 753                 luid_and_attr_from_privilege(mod_privs, privilege);
 754                 mod_privs++;
 755                 mod_privs_count--;
 756                 modified_count++;
 757             }
 758
 759             if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
 760                 privilege->enabled = TRUE;
 761             else
 762                 privilege->enabled = FALSE;
 763         }
 764     }
 765     return modified_count;
 766 }
 767
 768 static void token_disable_privileges( struct token *token )
 769 {
 770     struct privilege *privilege;
 771
 772     /* mark as modified */
 773     allocate_luid( &token->modified_id );
 774
 775     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 776         privilege->enabled = FALSE;
 777 }
 778
 779 int token_check_privileges( struct token *token, int all_required,
 780                             const LUID_AND_ATTRIBUTES *reqprivs,
 781                             unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
 782 {
 783     unsigned int i, enabled_count = 0;
 784
 785     for (i = 0; i < count; i++)
 786     {
 787         struct privilege *privilege =
 788             token_find_privilege( token, &reqprivs[i].Luid, TRUE );
 789
 790         if (usedprivs)
 791             usedprivs[i] = reqprivs[i];
 792
 793         if (privilege && privilege->enabled)
 794         {
 795             enabled_count++;
 796             if (usedprivs)
 797                 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
 798         }
 799     }
 800
 801     if (all_required)
 802         return (enabled_count == count);
 803     else
 804         return (enabled_count > 0);
 805 }
 806
 807 int token_sid_present( struct token *token, const SID *sid, int deny )
 808 {
 809     struct group *group;
 810
 811     if (security_equal_sid( token->user, sid )) return TRUE;
 812
 813     LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
 814     {
 815         if (!group->enabled) continue;
 816         if (group->deny_only && !deny) continue;
 817
 818         if (security_equal_sid( &group->sid, sid )) return TRUE;
 819     }
 820
 821     return FALSE;
 822 }
 823
 824 /* Checks access to a security descriptor. 'sd' must have been validated by
 825  * caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
 826  * the reason. 'status' parameter will indicate if access is granted or denied.
 827  *
 828  * If both returned value and 'status' are STATUS_SUCCESS then access is granted.
 829  */
 830 static unsigned int token_access_check( struct token *token,
 831                                  const struct security_descriptor *sd,
 832                                  unsigned int desired_access,
 833                                  LUID_AND_ATTRIBUTES *privs,
 834                                  unsigned int *priv_count,
 835                                  const GENERIC_MAPPING *mapping,
 836                                  unsigned int *granted_access,
 837                                  unsigned int *status )
 838 {
 839     unsigned int current_access = 0;
 840     unsigned int denied_access = 0;
 841     ULONG i;
 842     const ACL *dacl;
 843     int dacl_present;
 844     const ACE_HEADER *ace;
 845     const SID *owner;
 846
 847     /* assume no access rights */
 848     *granted_access = 0;
 849
 850     /* fail if desired_access contains generic rights */
 851     if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
 852     {
 853         if (priv_count) *priv_count = 0;
 854         return STATUS_GENERIC_NOT_MAPPED;
 855     }
 856
 857     dacl = sd_get_dacl( sd, &dacl_present );
 858     owner = sd_get_owner( sd );
 859     if (!owner || !sd_get_group( sd ))
 860     {
 861         if (priv_count) *priv_count = 0;
 862         return STATUS_INVALID_SECURITY_DESCR;
 863     }
 864
 865     /* 1: Grant desired access if the object is unprotected */
 866     if (!dacl_present || !dacl)
 867     {
 868         if (priv_count) *priv_count = 0;
 869         *granted_access = desired_access;
 870         return *status = STATUS_SUCCESS;
 871     }
 872
 873     /* 2: Check if caller wants access to system security part. Note: access
 874      * is only granted if specifically asked for */
 875     if (desired_access & ACCESS_SYSTEM_SECURITY)
 876     {
 877         const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
 878         LUID_AND_ATTRIBUTES retpriv = security_priv;
 879         if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
 880         {
 881             if (priv_count)
 882             {
 883                 /* assumes that there will only be one privilege to return */
 884                 if (*priv_count >= 1)
 885                 {
 886                     *priv_count = 1;
 887                     *privs = retpriv;
 888                 }
 889                 else
 890                 {
 891                     *priv_count = 1;
 892                     return STATUS_BUFFER_TOO_SMALL;
 893                 }
 894             }
 895             current_access |= ACCESS_SYSTEM_SECURITY;
 896             if (desired_access == current_access)
 897             {
 898                 *granted_access = current_access;
 899                 return *status = STATUS_SUCCESS;
 900             }
 901         }
 902         else
 903         {
 904             if (priv_count) *priv_count = 0;
 905             *status = STATUS_PRIVILEGE_NOT_HELD;
 906             return STATUS_SUCCESS;
 907         }
 908     }
 909     else if (priv_count) *priv_count = 0;
 910
 911     /* 3: Check whether the token is the owner */
 912     /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
 913      * checked when a "set owner" call is made, overriding the access rights
 914      * determined here. */
 915     if (token_sid_present( token, owner, FALSE ))
 916     {
 917         current_access |= (READ_CONTROL | WRITE_DAC);
 918         if (desired_access == current_access)
 919         {
 920             *granted_access = current_access;
 921             return *status = STATUS_SUCCESS;
 922         }
 923     }
 924
 925     /* 4: Grant rights according to the DACL */
 926     ace = (const ACE_HEADER *)(dacl + 1);
 927     for (i = 0; i < dacl->AceCount; i++, ace = ace_next( ace ))
 928     {
 929         const ACCESS_ALLOWED_ACE *aa_ace;
 930         const ACCESS_DENIED_ACE *ad_ace;
 931         const SID *sid;
 932
 933         if (ace->AceFlags & INHERIT_ONLY_ACE)
 934             continue;
 935
 936         switch (ace->AceType)
 937         {
 938         case ACCESS_DENIED_ACE_TYPE:
 939             ad_ace = (const ACCESS_DENIED_ACE *)ace;
 940             sid = (const SID *)&ad_ace->SidStart;
 941             if (token_sid_present( token, sid, TRUE ))
 942             {
 943                 unsigned int access = ad_ace->Mask;
 944                 map_generic_mask(&access, mapping);
 945                 if (desired_access & MAXIMUM_ALLOWED)
 946                     denied_access |= access;
 947                 else
 948                 {
 949                     denied_access |= (access & ~current_access);
 950                     if (desired_access & access) goto done;
 951                 }
 952             }
 953             break;
 954         case ACCESS_ALLOWED_ACE_TYPE:
 955             aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
 956             sid = (const SID *)&aa_ace->SidStart;
 957             if (token_sid_present( token, sid, FALSE ))
 958             {
 959                 unsigned int access = aa_ace->Mask;
 960                 map_generic_mask(&access, mapping);
 961                 if (desired_access & MAXIMUM_ALLOWED)
 962                     current_access |= access;
 963                 else
 964                     current_access |= (access & ~denied_access);
 965             }
 966             break;
 967         }
 968
 969         /* don't bother carrying on checking if we've already got all of
 970             * rights we need */
 971         if (desired_access == *granted_access)
 972             break;
 973     }
 974
 975 done:
 976     if (desired_access & MAXIMUM_ALLOWED)
 977         *granted_access = current_access & ~denied_access;
 978     else
 979         if ((current_access & desired_access) == desired_access)
 980             *granted_access = current_access & desired_access;
 981         else
 982             *granted_access = 0;
 983
 984     *status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
 985     return STATUS_SUCCESS;
 986 }
 987
 988 const ACL *token_get_default_dacl( struct token *token )
 989 {
 990     return token->default_dacl;
 991 }
 992
 993 const SID *token_get_user( struct token *token )
 994 {
 995     return token->user;
 996 }
 997
 998 const SID *token_get_primary_group( struct token *token )
 999 {
1000     return token->primary_group;
1001 }
1002
1003 int check_object_access(struct object *obj, unsigned int *access)
1004 {
1005     GENERIC_MAPPING mapping;
1006     struct token *token = current->token ? current->token : current->process->token;
1007     unsigned int status;
1008     int res;
1009
1010     mapping.GenericAll = obj->ops->map_access( obj, GENERIC_ALL );
1011
1012     if (!obj->sd)
1013     {
1014         if (*access & MAXIMUM_ALLOWED)
1015             *access = mapping.GenericAll;
1016         return TRUE;
1017     }
1018
1019     mapping.GenericRead  = obj->ops->map_access( obj, GENERIC_READ );
1020     mapping.GenericWrite = obj->ops->map_access( obj, GENERIC_WRITE );
1021     mapping.GenericExecute = obj->ops->map_access( obj, GENERIC_EXECUTE );
1022
1023     res = token_access_check( token, obj->sd, *access, NULL, NULL,
1024                               &mapping, access, &status ) == STATUS_SUCCESS &&
1025           status == STATUS_SUCCESS;
1026
1027     if (!res) set_error( STATUS_ACCESS_DENIED );
1028     return res;
1029 }
1030
1031
1032 /* open a security token */
1033 DECL_HANDLER(open_token)
1034 {
1035     if (req->flags & OPEN_TOKEN_THREAD)
1036     {
1037         struct thread *thread = get_thread_from_handle( req->handle, 0 );
1038         if (thread)
1039         {
1040             if (thread->token)
1041             {
1042                 if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
1043                     set_error( STATUS_CANT_OPEN_ANONYMOUS );
1044                 else
1045                     reply->token = alloc_handle( current->process, thread->token,
1046                                                  req->access, req->attributes );
1047             }
1048             else
1049                 set_error( STATUS_NO_TOKEN );
1050             release_object( thread );
1051         }
1052     }
1053     else
1054     {
1055         struct process *process = get_process_from_handle( req->handle, 0 );
1056         if (process)
1057         {
1058             if (process->token)
1059                 reply->token = alloc_handle( current->process, process->token, req->access,
1060                                              req->attributes );
1061             else
1062                 set_error( STATUS_NO_TOKEN );
1063             release_object( process );
1064         }
1065     }
1066 }
1067
1068 /* adjust the privileges held by a token */
1069 DECL_HANDLER(adjust_token_privileges)
1070 {
1071     struct token *token;
1072     unsigned int access = TOKEN_ADJUST_PRIVILEGES;
1073
1074     if (req->get_modified_state) access |= TOKEN_QUERY;
1075
1076     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1077                                                  access, &token_ops )))
1078     {
1079         const LUID_AND_ATTRIBUTES *privs = get_req_data();
1080         LUID_AND_ATTRIBUTES *modified_privs = NULL;
1081         unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1082         unsigned int modified_priv_count = 0;
1083
1084         if (req->get_modified_state && !req->disable_all)
1085         {
1086             unsigned int i;
1087             /* count modified privs */
1088             for (i = 0; i < priv_count; i++)
1089             {
1090                 struct privilege *privilege =
1091                     token_find_privilege( token, &privs[i].Luid, FALSE );
1092                 if (privilege && req->get_modified_state)
1093                     modified_priv_count++;
1094             }
1095             reply->len = modified_priv_count;
1096             modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
1097             if (modified_priv_count)
1098                 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
1099         }
1100         reply->len = modified_priv_count * sizeof(*modified_privs);
1101
1102         if (req->disable_all)
1103             token_disable_privileges( token );
1104         else
1105             modified_priv_count = token_adjust_privileges( token, privs,
1106                 priv_count, modified_privs, modified_priv_count );
1107
1108         release_object( token );
1109     }
1110 }
1111
1112 /* retrieves the list of privileges that may be held be the token */
1113 DECL_HANDLER(get_token_privileges)
1114 {
1115     struct token *token;
1116
1117     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1118                                                  TOKEN_QUERY,
1119                                                  &token_ops )))
1120     {
1121         int priv_count = 0;
1122         LUID_AND_ATTRIBUTES *privs;
1123         struct privilege *privilege;
1124
1125         LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1126             priv_count++;
1127
1128         reply->len = priv_count * sizeof(*privs);
1129         if (reply->len <= get_reply_max_size())
1130         {
1131             privs = set_reply_data_size( priv_count * sizeof(*privs) );
1132             if (privs)
1133             {
1134                 int i = 0;
1135                 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
1136                 {
1137                     luid_and_attr_from_privilege( &privs[i], privilege );
1138                     i++;
1139                 }
1140             }
1141         }
1142         else
1143             set_error(STATUS_BUFFER_TOO_SMALL);
1144
1145         release_object( token );
1146     }
1147 }
1148
1149 /* creates a duplicate of the token */
1150 DECL_HANDLER(duplicate_token)
1151 {
1152     struct token *src_token;
1153
1154     if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1155                                                      TOKEN_DUPLICATE,
1156                                                      &token_ops )))
1157     {
1158         struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level );
1159         if (token)
1160         {
1161             reply->new_handle = alloc_handle( current->process, token, req->access, req->attributes);
1162             release_object( token );
1163         }
1164         release_object( src_token );
1165     }
1166 }
1167
1168 /* checks the specified privileges are held by the token */
1169 DECL_HANDLER(check_token_privileges)
1170 {
1171     struct token *token;
1172
1173     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1174                                                  TOKEN_QUERY,
1175                                                  &token_ops )))
1176     {
1177         unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1178
1179         if (!token->primary && token->impersonation_level <= SecurityAnonymous)
1180             set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1181         else if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1182         {
1183             LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1184             reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1185         }
1186         else
1187             set_error( STATUS_BUFFER_OVERFLOW );
1188         release_object( token );
1189     }
1190 }
1191
1192 /* checks that a user represented by a token is allowed to access an object
1193  * represented by a security descriptor */
1194 DECL_HANDLER(access_check)
1195 {
1196     data_size_t sd_size = get_req_data_size();
1197     const struct security_descriptor *sd = get_req_data();
1198     struct token *token;
1199
1200     if (!sd_is_valid( sd, sd_size ))
1201     {
1202         set_error( STATUS_ACCESS_VIOLATION );
1203         return;
1204     }
1205
1206     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1207                                                  TOKEN_QUERY,
1208                                                  &token_ops )))
1209     {
1210         GENERIC_MAPPING mapping;
1211         unsigned int status;
1212         LUID_AND_ATTRIBUTES priv;
1213         unsigned int priv_count = 1;
1214
1215         memset(&priv, 0, sizeof(priv));
1216
1217         /* only impersonation tokens may be used with this function */
1218         if (token->primary)
1219         {
1220             set_error( STATUS_NO_IMPERSONATION_TOKEN );
1221             release_object( token );
1222             return;
1223         }
1224         /* anonymous impersonation tokens can't be used */
1225         if (token->impersonation_level <= SecurityAnonymous)
1226         {
1227             set_error( STATUS_BAD_IMPERSONATION_LEVEL );
1228             release_object( token );
1229             return;
1230         }
1231
1232         mapping.GenericRead = req->mapping_read;
1233         mapping.GenericWrite = req->mapping_write;
1234         mapping.GenericExecute = req->mapping_execute;
1235         mapping.GenericAll = req->mapping_all;
1236
1237         status = token_access_check(
1238             token, sd, req->desired_access, &priv, &priv_count, &mapping,
1239             &reply->access_granted, &reply->access_status );
1240
1241         reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1242
1243         if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1244         {
1245             LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1246             memcpy( privs, &priv, sizeof(priv) );
1247         }
1248
1249         set_error( status );
1250         release_object( token );
1251     }
1252 }
1253
1254 /* retrieves the SID of the user that the token represents */
1255 DECL_HANDLER(get_token_sid)
1256 {
1257     struct token *token;
1258
1259     reply->sid_len = 0;
1260
1261     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1262                                                  TOKEN_QUERY,
1263                                                  &token_ops )))
1264     {
1265         const SID *sid = NULL;
1266
1267         switch (req->which_sid)
1268         {
1269         case TokenUser:
1270             assert(token->user);
1271             sid = token->user;
1272             break;
1273         case TokenPrimaryGroup:
1274             sid = token->primary_group;
1275             break;
1276         case TokenOwner:
1277         {
1278             struct group *group;
1279             LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
1280             {
1281                 if (group->owner)
1282                 {
1283                     sid = &group->sid;
1284                     break;
1285                 }
1286             }
1287             break;
1288         }
1289         default:
1290             set_error( STATUS_INVALID_PARAMETER );
1291             break;
1292         }
1293
1294         if (sid)
1295         {
1296             reply->sid_len = security_sid_len( sid );
1297             if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
1298             else set_error( STATUS_BUFFER_TOO_SMALL );
1299         }
1300         release_object( token );
1301     }
1302 }
1303
1304 /* retrieves the groups that the user represented by the token belongs to */
1305 DECL_HANDLER(get_token_groups)
1306 {
1307     struct token *token;
1308
1309     reply->user_len = 0;
1310
1311     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1312                                                  TOKEN_QUERY,
1313                                                  &token_ops )))
1314     {
1315         size_t size_needed = sizeof(struct token_groups);
1316         size_t sid_size = 0;
1317         unsigned int group_count = 0;
1318         const struct group *group;
1319
1320         LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1321         {
1322             group_count++;
1323             sid_size += security_sid_len( &group->sid );
1324         }
1325         size_needed += sid_size;
1326         /* attributes size */
1327         size_needed += sizeof(unsigned int) * group_count;
1328
1329         /* reply buffer contains size_needed bytes formatted as:
1330
1331            unsigned int count;
1332            unsigned int attrib[count];
1333            char sid_data[];
1334
1335            user_len includes extra data needed for TOKEN_GROUPS representation,
1336            required caller buffer size calculated here to avoid extra server call */
1337         reply->user_len = FIELD_OFFSET( TOKEN_GROUPS, Groups[group_count] ) + sid_size;
1338
1339         if (reply->user_len <= get_reply_max_size())
1340         {
1341             struct token_groups *tg = set_reply_data_size( size_needed );
1342             if (tg)
1343             {
1344                 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1345                 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1346
1347                 tg->count = group_count;
1348
1349                 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1350                 {
1351
1352                     *attr_ptr = 0;
1353                     if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1354                     if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1355                     if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1356                     if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1357                     if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1358                     if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1359                     if (group->logon) *attr_ptr |= SE_GROUP_LOGON_ID;
1360
1361                     memcpy(sid_ptr, &group->sid, security_sid_len( &group->sid ));
1362
1363                     sid_ptr = (SID *)((char *)sid_ptr + security_sid_len( &group->sid ));
1364                     attr_ptr++;
1365                 }
1366             }
1367         }
1368         else set_error( STATUS_BUFFER_TOO_SMALL );
1369
1370         release_object( token );
1371     }
1372 }
1373
1374 DECL_HANDLER(get_token_impersonation_level)
1375 {
1376     struct token *token;
1377
1378     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1379                                                  TOKEN_QUERY,
1380                                                  &token_ops )))
1381     {
1382         if (token->primary)
1383             set_error( STATUS_INVALID_PARAMETER );
1384         else
1385             reply->impersonation_level = token->impersonation_level;
1386
1387         release_object( token );
1388     }
1389 }
1390
1391 DECL_HANDLER(get_token_statistics)
1392 {
1393     struct token *token;
1394
1395     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1396                                                  TOKEN_QUERY,
1397                                                  &token_ops )))
1398     {
1399         reply->token_id = token->token_id;
1400         reply->modified_id = token->modified_id;
1401         reply->primary = token->primary;
1402         reply->impersonation_level = token->impersonation_level;
1403         reply->group_count = list_count( &token->groups );
1404         reply->privilege_count = list_count( &token->privileges );
1405
1406         release_object( token );
1407     }
1408 }
1409
1410 DECL_HANDLER(get_token_default_dacl)
1411 {
1412     struct token *token;
1413
1414     reply->acl_len = 0;
1415
1416     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1417                                                  TOKEN_QUERY,
1418                                                  &token_ops )))
1419     {
1420         if (token->default_dacl)
1421             reply->acl_len = token->default_dacl->AclSize;
1422
1423         if (reply->acl_len <= get_reply_max_size())
1424         {
1425             ACL *acl_reply = set_reply_data_size( reply->acl_len );
1426             if (acl_reply)
1427                 memcpy( acl_reply, token->default_dacl, reply->acl_len );
1428         }
1429         else set_error( STATUS_BUFFER_TOO_SMALL );
1430
1431         release_object( token );
1432     }
1433 }
1434
1435 DECL_HANDLER(set_token_default_dacl)
1436 {
1437     struct token *token;
1438
1439     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1440                                                  TOKEN_ADJUST_DEFAULT,
1441                                                  &token_ops )))
1442     {
1443         const ACL *acl = get_req_data();
1444         unsigned int acl_size = get_req_data_size();
1445
1446         free( token->default_dacl );
1447         token->default_dacl = NULL;
1448
1449         if (acl_size)
1450             token->default_dacl = memdup( acl, acl_size );
1451
1452         release_object( token );
1453     }
1454 }