server/token.c

   1 /*
   2  * Tokens
   3  *
   4  * Copyright (C) 1998 Alexandre Julliard
   5  * Copyright (C) 2003 Mike McCormack
   6  * Copyright (C) 2005 Robert Shearman
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #include "config.h"
  24
  25 #include <assert.h>
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28 #include <stdarg.h>
  29
  30 #include "ntstatus.h"
  31 #define WIN32_NO_STATUS
  32 #include "windef.h"
  33 #include "winternl.h"
  34
  35 #include "handle.h"
  36 #include "thread.h"
  37 #include "process.h"
  38 #include "request.h"
  39 #include "security.h"
  40
  41 #include "wine/unicode.h"
  42
  43 #define MAX_SUBAUTH_COUNT 1
  44
  45 const LUID SeIncreaseQuotaPrivilege        = {  5, 0 };
  46 const LUID SeSecurityPrivilege             = {  8, 0 };
  47 const LUID SeTakeOwnershipPrivilege        = {  9, 0 };
  48 const LUID SeLoadDriverPrivilege           = { 10, 0 };
  49 const LUID SeSystemProfilePrivilege        = { 11, 0 };
  50 const LUID SeSystemtimePrivilege           = { 12, 0 };
  51 const LUID SeProfileSingleProcessPrivilege = { 13, 0 };
  52 const LUID SeIncreaseBasePriorityPrivilege = { 14, 0 };
  53 const LUID SeCreatePagefilePrivilege       = { 15, 0 };
  54 const LUID SeBackupPrivilege               = { 17, 0 };
  55 const LUID SeRestorePrivilege              = { 18, 0 };
  56 const LUID SeShutdownPrivilege             = { 19, 0 };
  57 const LUID SeDebugPrivilege                = { 20, 0 };
  58 const LUID SeSystemEnvironmentPrivilege    = { 22, 0 };
  59 const LUID SeChangeNotifyPrivilege         = { 23, 0 };
  60 const LUID SeRemoteShutdownPrivilege       = { 24, 0 };
  61 const LUID SeUndockPrivilege               = { 25, 0 };
  62 const LUID SeManageVolumePrivilege         = { 28, 0 };
  63 const LUID SeImpersonatePrivilege          = { 29, 0 };
  64 const LUID SeCreateGlobalPrivilege         = { 30, 0 };
  65
  66 static const SID world_sid = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } };
  67 static const SID local_sid = { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } };
  68 static const SID interactive_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } };
  69 static const SID authenticated_user_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } };
  70 static const SID local_system_sid = { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } };
  71 static const PSID security_world_sid = (PSID)&world_sid;
  72 static const PSID security_local_sid = (PSID)&local_sid;
  73 const PSID security_interactive_sid = (PSID)&interactive_sid;
  74 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
  75 static const PSID security_local_system_sid = (PSID)&local_system_sid;
  76
  77 struct token
  78 {
  79     struct object  obj;             /* object header */
  80     struct list    privileges;      /* privileges available to the token */
  81     struct list    groups;          /* groups that the user of this token belongs to (sid_and_attributes) */
  82     SID           *user;            /* SID of user this token represents */
  83     unsigned       primary;         /* is this a primary or impersonation token? */
  84     ACL           *default_dacl;    /* the default DACL to assign to objects created by this user */
  85     TOKEN_SOURCE   source;          /* source of the token */
  86 };
  87
  88 struct privilege
  89 {
  90     struct list entry;
  91     LUID        luid;
  92     unsigned    enabled  : 1; /* is the privilege currently enabled? */
  93     unsigned    def      : 1; /* is the privilege enabled by default? */
  94 };
  95
  96 struct group
  97 {
  98     struct list entry;
  99     unsigned    enabled  : 1; /* is the sid currently enabled? */
 100     unsigned    def      : 1; /* is the sid enabled by default? */
 101     unsigned    logon    : 1; /* is this a logon sid? */
 102     unsigned    mandatory: 1; /* is this sid always enabled? */
 103     unsigned    owner    : 1; /* can this sid be an owner of an object? */
 104     unsigned    resource : 1; /* is this a domain-local group? */
 105     unsigned    deny_only: 1; /* is this a sid that should be use for denying only? */
 106     SID         sid;
 107 };
 108
 109 static void token_dump( struct object *obj, int verbose );
 110 static unsigned int token_map_access( struct object *obj, unsigned int access );
 111 static void token_destroy( struct object *obj );
 112
 113 static const struct object_ops token_ops =
 114 {
 115     sizeof(struct token),      /* size */
 116     token_dump,                /* dump */
 117     no_add_queue,              /* add_queue */
 118     NULL,                      /* remove_queue */
 119     NULL,                      /* signaled */
 120     NULL,                      /* satisfied */
 121     no_signal,                 /* signal */
 122     no_get_fd,                 /* get_fd */
 123     token_map_access,          /* map_access */
 124     no_lookup_name,            /* lookup_name */
 125     no_close_handle,           /* close_handle */
 126     token_destroy              /* destroy */
 127 };
 128
 129
 130 static void token_dump( struct object *obj, int verbose )
 131 {
 132     fprintf( stderr, "Security token\n" );
 133     /* FIXME: dump token members */
 134 }
 135
 136 static unsigned int token_map_access( struct object *obj, unsigned int access )
 137 {
 138     if (access & GENERIC_READ)    access |= TOKEN_READ;
 139     if (access & GENERIC_WRITE)   access |= TOKEN_WRITE;
 140     if (access & GENERIC_EXECUTE) access |= STANDARD_RIGHTS_EXECUTE;
 141     if (access & GENERIC_ALL)     access |= TOKEN_ALL_ACCESS;
 142     return access & ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL);
 143 }
 144
 145 static SID *security_sid_alloc( const SID_IDENTIFIER_AUTHORITY *idauthority, int subauthcount, const unsigned int subauth[] )
 146 {
 147     int i;
 148     SID *sid = mem_alloc( FIELD_OFFSET(SID, SubAuthority[subauthcount]) );
 149     if (!sid) return NULL;
 150     sid->Revision = SID_REVISION;
 151     sid->SubAuthorityCount = subauthcount;
 152     sid->IdentifierAuthority = *idauthority;
 153     for (i = 0; i < subauthcount; i++)
 154         sid->SubAuthority[i] = subauth[i];
 155     return sid;
 156 }
 157
 158 static inline int security_equal_sid( const SID *sid1, const SID *sid2 )
 159 {
 160     return ((sid1->SubAuthorityCount == sid2->SubAuthorityCount) &&
 161         !memcmp( sid1, sid2, FIELD_OFFSET(SID, SubAuthority[sid1->SubAuthorityCount]) ));
 162 }
 163
 164 void security_set_thread_token( struct thread *thread, obj_handle_t handle )
 165 {
 166     if (!handle)
 167     {
 168         if (thread->token)
 169             release_object( thread->token );
 170         thread->token = NULL;
 171     }
 172     else
 173     {
 174         struct token *token = (struct token *)get_handle_obj( current->process,
 175                                                               handle,
 176                                                               TOKEN_IMPERSONATE,
 177                                                               &token_ops );
 178         if (token)
 179         {
 180             if (thread->token)
 181                 release_object( thread->token );
 182             thread->token = token;
 183         }
 184     }
 185 }
 186
 187 static const ACE_HEADER *ace_next( const ACE_HEADER *ace )
 188 {
 189     return (const ACE_HEADER *)((const char *)ace + ace->AceSize);
 190 }
 191
 192 static int acl_is_valid( const ACL *acl, data_size_t size )
 193 {
 194     ULONG i;
 195     const ACE_HEADER *ace;
 196
 197     if (size < sizeof(ACL))
 198         return FALSE;
 199
 200     size = min(size, MAX_ACL_LEN);
 201
 202     size -= sizeof(ACL);
 203
 204     ace = (const ACE_HEADER *)(acl + 1);
 205     for (i = 0; i < acl->AceCount; i++)
 206     {
 207         const SID *sid;
 208         data_size_t sid_size;
 209
 210         if (size < sizeof(ACE_HEADER))
 211             return FALSE;
 212         if (size < ace->AceSize)
 213             return FALSE;
 214         size -= ace->AceSize;
 215         switch (ace->AceType)
 216         {
 217         case ACCESS_DENIED_ACE_TYPE:
 218             sid = (const SID *)&((const ACCESS_DENIED_ACE *)ace)->SidStart;
 219             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart);
 220             break;
 221         case ACCESS_ALLOWED_ACE_TYPE:
 222             sid = (const SID *)&((const ACCESS_ALLOWED_ACE *)ace)->SidStart;
 223             sid_size = ace->AceSize - FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
 224             break;
 225         case SYSTEM_AUDIT_ACE_TYPE:
 226             sid = (const SID *)&((const SYSTEM_AUDIT_ACE *)ace)->SidStart;
 227             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart);
 228             break;
 229         case SYSTEM_ALARM_ACE_TYPE:
 230             sid = (const SID *)&((const SYSTEM_ALARM_ACE *)ace)->SidStart;
 231             sid_size = ace->AceSize - FIELD_OFFSET(SYSTEM_ALARM_ACE, SidStart);
 232             break;
 233         default:
 234             return FALSE;
 235         }
 236         if (sid_size < FIELD_OFFSET(SID, SubAuthority[0]) ||
 237             sid_size < FIELD_OFFSET(SID, SubAuthority[sid->SubAuthorityCount]))
 238             return FALSE;
 239         ace = ace_next( ace );
 240     }
 241     return TRUE;
 242 }
 243
 244 /* gets the discretionary access control list from a security descriptor */
 245 static inline const ACL *sd_get_dacl( const struct security_descriptor *sd, int *present )
 246 {
 247     *present = (sd->control & SE_DACL_PRESENT ? TRUE : FALSE);
 248
 249     if (sd->dacl_len)
 250         return (const ACL *)((const char *)(sd + 1) +
 251             sd->owner_len + sd->group_len + sd->sacl_len);
 252     else
 253         return NULL;
 254 }
 255
 256 /* gets the system access control list from a security descriptor */
 257 static inline const ACL *sd_get_sacl( const struct security_descriptor *sd, int *present )
 258 {
 259     *present = (sd->control & SE_SACL_PRESENT ? TRUE : FALSE);
 260
 261     if (sd->sacl_len)
 262         return (const ACL *)((const char *)(sd + 1) +
 263             sd->owner_len + sd->group_len);
 264     else
 265         return NULL;
 266 }
 267
 268 /* gets the owner from a security descriptor */
 269 static inline const SID *sd_get_owner( const struct security_descriptor *sd )
 270 {
 271     if (sd->owner_len)
 272         return (const SID *)(sd + 1);
 273     else
 274         return NULL;
 275 }
 276
 277 /* gets the primary group from a security descriptor */
 278 static inline const SID *sd_get_group( const struct security_descriptor *sd )
 279 {
 280     if (sd->group_len)
 281         return (const SID *)((const char *)(sd + 1) + sd->owner_len);
 282     else
 283         return NULL;
 284 }
 285
 286 /* checks whether all members of a security descriptor fit inside the size
 287  * of memory specified */
 288 static int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
 289 {
 290     size_t offset = sizeof(struct security_descriptor);
 291     const SID *group;
 292     const SID *owner;
 293     const ACL *sacl;
 294     const ACL *dacl;
 295     int dummy;
 296
 297     if (size < offset)
 298         return FALSE;
 299
 300     if ((sd->owner_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 301         (offset + sd->owner_len > size))
 302         return FALSE;
 303     owner = sd_get_owner( sd );
 304     if (owner)
 305     {
 306         size_t needed_size = FIELD_OFFSET(SID, SubAuthority[owner->SubAuthorityCount]);
 307         if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
 308             return FALSE;
 309     }
 310     offset += sd->owner_len;
 311
 312     if ((sd->group_len >= FIELD_OFFSET(SID, SubAuthority[255])) ||
 313         (offset + sd->group_len > size))
 314         return FALSE;
 315     group = sd_get_group( sd );
 316     if (group)
 317     {
 318         size_t needed_size = FIELD_OFFSET(SID, SubAuthority[group->SubAuthorityCount]);
 319         if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
 320             return FALSE;
 321     }
 322     offset += sd->group_len;
 323
 324     if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
 325         return FALSE;
 326     sacl = sd_get_sacl( sd, &dummy );
 327     if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
 328         return FALSE;
 329     offset += sd->sacl_len;
 330
 331     if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
 332         return FALSE;
 333     dacl = sd_get_dacl( sd, &dummy );
 334     if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
 335         return FALSE;
 336     offset += sd->dacl_len;
 337
 338     return TRUE;
 339 }
 340
 341 /* maps from generic rights to specific rights as given by a mapping */
 342 static inline void map_generic_mask(unsigned int *mask, const GENERIC_MAPPING *mapping)
 343 {
 344     if (*mask & GENERIC_READ) *mask |= mapping->GenericRead;
 345     if (*mask & GENERIC_WRITE) *mask |= mapping->GenericWrite;
 346     if (*mask & GENERIC_EXECUTE) *mask |= mapping->GenericExecute;
 347     if (*mask & GENERIC_ALL) *mask |= mapping->GenericAll;
 348     *mask &= 0x0FFFFFFF;
 349 }
 350
 351 static inline int is_equal_luid( const LUID *luid1, const LUID *luid2 )
 352 {
 353     return (luid1->LowPart == luid2->LowPart && luid1->HighPart == luid2->HighPart);
 354 }
 355
 356 static inline void luid_and_attr_from_privilege( LUID_AND_ATTRIBUTES *out, const struct privilege *in)
 357 {
 358     out->Luid = in->luid;
 359     out->Attributes =
 360         (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
 361         (in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
 362 }
 363
 364 static struct privilege *privilege_add( struct token *token, const LUID *luid, int enabled )
 365 {
 366     struct privilege *privilege = mem_alloc( sizeof(*privilege) );
 367     if (privilege)
 368     {
 369         privilege->luid = *luid;
 370         privilege->def = privilege->enabled = (enabled != 0);
 371         list_add_tail( &token->privileges, &privilege->entry );
 372     }
 373     return privilege;
 374 }
 375
 376 static inline void privilege_remove( struct privilege *privilege )
 377 {
 378     list_remove( &privilege->entry );
 379     free( privilege );
 380 }
 381
 382 static void token_destroy( struct object *obj )
 383 {
 384     struct token* token;
 385     struct list *cursor, *cursor_next;
 386
 387     assert( obj->ops == &token_ops );
 388     token = (struct token *)obj;
 389
 390     free( token->user );
 391
 392     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
 393     {
 394         struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
 395         privilege_remove( privilege );
 396     }
 397
 398     LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
 399     {
 400         struct group *group = LIST_ENTRY( cursor, struct group, entry );
 401         list_remove( &group->entry );
 402         free( group );
 403     }
 404
 405     free( token->default_dacl );
 406 }
 407
 408 /* creates a new token.
 409  *  groups may be NULL if group_count is 0.
 410  *  privs may be NULL if priv_count is 0.
 411  *  default_dacl may be NULL, indicating that all objects created by the user
 412  *   are unsecured.
 413  */
 414 static struct token *create_token( unsigned primary, const SID *user,
 415                                    const SID_AND_ATTRIBUTES *groups, unsigned int group_count,
 416                                    const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
 417                                    const ACL *default_dacl, TOKEN_SOURCE source )
 418 {
 419     struct token *token = alloc_object( &token_ops );
 420     if (token)
 421     {
 422         unsigned int i;
 423
 424         list_init( &token->privileges );
 425         list_init( &token->groups );
 426         token->primary = primary;
 427
 428         /* copy user */
 429         token->user = memdup( user, FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]) );
 430         if (!token->user)
 431         {
 432             release_object( token );
 433             return NULL;
 434         }
 435
 436         /* copy groups */
 437         for (i = 0; i < group_count; i++)
 438         {
 439             size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] );
 440             struct group *group = mem_alloc( size );
 441
 442             if (!group)
 443             {
 444                 release_object( token );
 445                 return NULL;
 446             }
 447             memcpy( &group->sid, groups[i].Sid, FIELD_OFFSET( SID, SubAuthority[((const SID *)groups[i].Sid)->SubAuthorityCount] ) );
 448             group->enabled = TRUE;
 449             group->def = TRUE;
 450             group->logon = FALSE;
 451             group->mandatory = (groups[i].Attributes & SE_GROUP_MANDATORY) ? TRUE : FALSE;
 452             group->owner = FALSE;
 453             group->resource = FALSE;
 454             group->deny_only = FALSE;
 455             list_add_tail( &token->groups, &group->entry );
 456         }
 457
 458         /* copy privileges */
 459         for (i = 0; i < priv_count; i++)
 460         {
 461             /* note: we don't check uniqueness: the caller must make sure
 462              * privs doesn't contain any duplicate luids */
 463             if (!privilege_add( token, &privs[i].Luid,
 464                                 privs[i].Attributes & SE_PRIVILEGE_ENABLED ))
 465             {
 466                 release_object( token );
 467                 return NULL;
 468             }
 469         }
 470
 471         if (default_dacl)
 472         {
 473             token->default_dacl = memdup( default_dacl, default_dacl->AclSize );
 474             if (!token->default_dacl)
 475             {
 476                 release_object( token );
 477                 return NULL;
 478             }
 479         }
 480         else
 481             token->default_dacl = NULL;
 482
 483         token->source = source;
 484     }
 485     return token;
 486 }
 487
 488 static ACL *create_default_dacl( const SID *user )
 489 {
 490     ACCESS_ALLOWED_ACE *aaa;
 491     ACL *default_dacl;
 492     SID *sid;
 493     size_t default_dacl_size = sizeof(ACL) +
 494                                2*(sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 495                                sizeof(local_system_sid) +
 496                                FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]);
 497
 498     default_dacl = mem_alloc( default_dacl_size );
 499     if (!default_dacl) return NULL;
 500
 501     default_dacl->AclRevision = MAX_ACL_REVISION;
 502     default_dacl->Sbz1 = 0;
 503     default_dacl->AclSize = default_dacl_size;
 504     default_dacl->AceCount = 2;
 505     default_dacl->Sbz2 = 0;
 506
 507     /* GENERIC_ALL for Local System */
 508     aaa = (ACCESS_ALLOWED_ACE *)(default_dacl + 1);
 509     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 510     aaa->Header.AceFlags = 0;
 511     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 512                           sizeof(local_system_sid);
 513     aaa->Mask = GENERIC_ALL;
 514     sid = (SID *)&aaa->SidStart;
 515     memcpy( sid, &local_system_sid, sizeof(local_system_sid) );
 516
 517     /* GENERIC_ALL for specified user */
 518     aaa = (ACCESS_ALLOWED_ACE *)((const char *)aaa + aaa->Header.AceSize);
 519     aaa->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 520     aaa->Header.AceFlags = 0;
 521     aaa->Header.AceSize = (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
 522                           FIELD_OFFSET( SID, SubAuthority[user->SubAuthorityCount] );
 523     aaa->Mask = GENERIC_ALL;
 524     sid = (SID *)&aaa->SidStart;
 525     memcpy( sid, user, FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]) );
 526
 527     return default_dacl;
 528 }
 529
 530 struct sid_data
 531 {
 532     SID_IDENTIFIER_AUTHORITY idauth;
 533     int count;
 534     unsigned int subauth[MAX_SUBAUTH_COUNT];
 535 };
 536
 537 struct token *token_create_admin( void )
 538 {
 539     struct token *token = NULL;
 540     static const SID_IDENTIFIER_AUTHORITY nt_authority = { SECURITY_NT_AUTHORITY };
 541     static const unsigned int alias_admins_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS };
 542     static const unsigned int alias_users_subauth[] = { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS };
 543     PSID alias_admins_sid;
 544     PSID alias_users_sid;
 545     ACL *default_dacl = create_default_dacl( &local_system_sid );
 546
 547     alias_admins_sid = security_sid_alloc( &nt_authority, sizeof(alias_admins_subauth)/sizeof(alias_admins_subauth[0]),
 548                                            alias_admins_subauth );
 549     alias_users_sid = security_sid_alloc( &nt_authority, sizeof(alias_users_subauth)/sizeof(alias_users_subauth[0]),
 550                                           alias_users_subauth );
 551
 552     if (alias_admins_sid && alias_users_sid && default_dacl)
 553     {
 554         const LUID_AND_ATTRIBUTES admin_privs[] =
 555         {
 556             { SeChangeNotifyPrivilege        , SE_PRIVILEGE_ENABLED },
 557             { SeSecurityPrivilege            , 0                    },
 558             { SeBackupPrivilege              , 0                    },
 559             { SeRestorePrivilege             , 0                    },
 560             { SeSystemtimePrivilege          , 0                    },
 561             { SeShutdownPrivilege            , 0                    },
 562             { SeRemoteShutdownPrivilege      , 0                    },
 563             { SeTakeOwnershipPrivilege       , 0                    },
 564             { SeDebugPrivilege               , 0                    },
 565             { SeSystemEnvironmentPrivilege   , 0                    },
 566             { SeSystemProfilePrivilege       , 0                    },
 567             { SeProfileSingleProcessPrivilege, 0                    },
 568             { SeIncreaseBasePriorityPrivilege, 0                    },
 569             { SeLoadDriverPrivilege          , 0                    },
 570             { SeCreatePagefilePrivilege      , 0                    },
 571             { SeIncreaseQuotaPrivilege       , 0                    },
 572             { SeUndockPrivilege              , 0                    },
 573             { SeManageVolumePrivilege        , 0                    },
 574             { SeImpersonatePrivilege         , SE_PRIVILEGE_ENABLED },
 575             { SeCreateGlobalPrivilege        , SE_PRIVILEGE_ENABLED },
 576         };
 577         /* note: we don't include non-builtin groups here for the user -
 578          * telling us these is the job of a client-side program */
 579         const SID_AND_ATTRIBUTES admin_groups[] =
 580         {
 581             { security_world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 582             { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 583             { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 584             { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 585             { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 586             { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
 587         };
 588         static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
 589         /* note: we just set the user sid to be the interactive builtin sid -
 590          * we should really translate the UNIX user id to a sid */
 591         token = create_token( TRUE, &interactive_sid,
 592                             admin_groups, sizeof(admin_groups)/sizeof(admin_groups[0]),
 593                             admin_privs, sizeof(admin_privs)/sizeof(admin_privs[0]),
 594                             default_dacl, admin_source );
 595     }
 596
 597     if (alias_admins_sid)
 598         free( alias_admins_sid );
 599     if (alias_users_sid)
 600         free( alias_users_sid );
 601     if (default_dacl)
 602         free( default_dacl );
 603
 604     return token;
 605 }
 606
 607 static struct privilege *token_find_privilege( struct token *token, const LUID *luid, int enabled_only )
 608 {
 609     struct privilege *privilege;
 610     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 611     {
 612         if (is_equal_luid( luid, &privilege->luid ))
 613         {
 614             if (enabled_only && !privilege->enabled)
 615                 return NULL;
 616             return privilege;
 617         }
 618     }
 619     return NULL;
 620 }
 621
 622 static unsigned int token_adjust_privileges( struct token *token, const LUID_AND_ATTRIBUTES *privs,
 623                                              unsigned int count, LUID_AND_ATTRIBUTES *mod_privs,
 624                                              unsigned int mod_privs_count )
 625 {
 626     unsigned int i, modified_count = 0;
 627
 628     for (i = 0; i < count; i++)
 629     {
 630         struct privilege *privilege =
 631             token_find_privilege( token, &privs[i].Luid, FALSE );
 632         if (!privilege)
 633         {
 634             set_error( STATUS_NOT_ALL_ASSIGNED );
 635             continue;
 636         }
 637
 638         if (privs[i].Attributes & SE_PRIVILEGE_REMOVE)
 639             privilege_remove( privilege );
 640         else
 641         {
 642             /* save previous state for caller */
 643             if (mod_privs_count)
 644             {
 645                 luid_and_attr_from_privilege(mod_privs, privilege);
 646                 mod_privs++;
 647                 mod_privs_count--;
 648                 modified_count++;
 649             }
 650
 651             if (privs[i].Attributes & SE_PRIVILEGE_ENABLED)
 652                 privilege->enabled = TRUE;
 653             else
 654                 privilege->enabled = FALSE;
 655         }
 656     }
 657     return modified_count;
 658 }
 659
 660 static void token_disable_privileges( struct token *token )
 661 {
 662     struct privilege *privilege;
 663     LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 664         privilege->enabled = FALSE;
 665 }
 666
 667 int token_check_privileges( struct token *token, int all_required,
 668                             const LUID_AND_ATTRIBUTES *reqprivs,
 669                             unsigned int count, LUID_AND_ATTRIBUTES *usedprivs)
 670 {
 671     unsigned int i, enabled_count = 0;
 672
 673     for (i = 0; i < count; i++)
 674     {
 675         struct privilege *privilege =
 676             token_find_privilege( token, &reqprivs[i].Luid, TRUE );
 677
 678         if (usedprivs)
 679             usedprivs[i] = reqprivs[i];
 680
 681         if (privilege && privilege->enabled)
 682         {
 683             enabled_count++;
 684             if (usedprivs)
 685                 usedprivs[i].Attributes |= SE_PRIVILEGE_USED_FOR_ACCESS;
 686         }
 687     }
 688
 689     if (all_required)
 690         return (enabled_count == count);
 691     else
 692         return (enabled_count > 0);
 693 }
 694
 695 static int token_sid_present( struct token *token, const SID *sid, int deny )
 696 {
 697     struct group *group;
 698
 699     if (security_equal_sid( token->user, sid )) return TRUE;
 700
 701     LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
 702     {
 703         if (!group->enabled) continue;
 704         if (group->deny_only && !deny) continue;
 705
 706         if (security_equal_sid( &group->sid, sid )) return TRUE;
 707     }
 708
 709     return FALSE;
 710 }
 711
 712 /* checks access to a security descriptor. sd must have been validated by caller.
 713  * it returns STATUS_SUCCESS if access was granted to the object, or an error
 714  * status code if not, giving the reason. errors not relating to giving access
 715  * to the object are returned in the status parameter. granted_access and
 716  * status always have a valid value stored in them on return. */
 717 static unsigned int token_access_check( struct token *token,
 718                                  const struct security_descriptor *sd,
 719                                  unsigned int desired_access,
 720                                  LUID_AND_ATTRIBUTES *privs,
 721                                  unsigned int *priv_count,
 722                                  const GENERIC_MAPPING *mapping,
 723                                  unsigned int *granted_access,
 724                                  unsigned int *status )
 725 {
 726     unsigned int current_access = 0;
 727     unsigned int denied_access = 0;
 728     ULONG i;
 729     const ACL *dacl;
 730     int dacl_present;
 731     const ACE_HEADER *ace;
 732     const SID *owner;
 733
 734     /* assume success, but no access rights */
 735     *status = STATUS_SUCCESS;
 736     *granted_access = 0;
 737
 738     /* fail if desired_access contains generic rights */
 739     if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
 740     {
 741         *priv_count = 0;
 742         *status = STATUS_GENERIC_NOT_MAPPED;
 743         return STATUS_ACCESS_DENIED;
 744     }
 745
 746     dacl = sd_get_dacl( sd, &dacl_present );
 747     owner = sd_get_owner( sd );
 748     if (!owner || !sd_get_group( sd ))
 749     {
 750         *priv_count = 0;
 751         *status = STATUS_INVALID_SECURITY_DESCR;
 752         return STATUS_ACCESS_DENIED;
 753     }
 754
 755     /* 1: Grant desired access if the object is unprotected */
 756     if (!dacl_present)
 757     {
 758         *priv_count = 0;
 759         *granted_access = desired_access;
 760         return STATUS_SUCCESS;
 761     }
 762     if (!dacl)
 763     {
 764         *priv_count = 0;
 765         return STATUS_ACCESS_DENIED;
 766     }
 767
 768     /* 2: Check if caller wants access to system security part. Note: access
 769      * is only granted if specifically asked for */
 770     if (desired_access & ACCESS_SYSTEM_SECURITY)
 771     {
 772         const LUID_AND_ATTRIBUTES security_priv = { SeSecurityPrivilege, 0 };
 773         LUID_AND_ATTRIBUTES retpriv = security_priv;
 774         if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
 775         {
 776             if (priv_count)
 777             {
 778                 /* assumes that there will only be one privilege to return */
 779                 if (*priv_count >= 1)
 780                 {
 781                     *priv_count = 1;
 782                     *privs = retpriv;
 783                 }
 784                 else
 785                 {
 786                     *priv_count = 1;
 787                     return STATUS_BUFFER_TOO_SMALL;
 788                 }
 789             }
 790             current_access |= ACCESS_SYSTEM_SECURITY;
 791             if (desired_access == current_access)
 792             {
 793                 *granted_access = current_access;
 794                 return STATUS_SUCCESS;
 795             }
 796         }
 797         else
 798         {
 799             *priv_count = 0;
 800             return STATUS_PRIVILEGE_NOT_HELD;
 801         }
 802     }
 803     else if (priv_count) *priv_count = 0;
 804
 805     /* 3: Check whether the token is the owner */
 806     /* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
 807      * checked when a "set owner" call is made, overriding the access rights
 808      * determined here. */
 809     if (token_sid_present( token, owner, FALSE ))
 810     {
 811         current_access |= (READ_CONTROL | WRITE_DAC);
 812         if (desired_access == current_access)
 813         {
 814             *granted_access = current_access;
 815             return STATUS_SUCCESS;
 816         }
 817     }
 818
 819     /* 4: Grant rights according to the DACL */
 820     ace = (const ACE_HEADER *)(dacl + 1);
 821     for (i = 0; i < dacl->AceCount; i++)
 822     {
 823         const ACCESS_ALLOWED_ACE *aa_ace;
 824         const ACCESS_DENIED_ACE *ad_ace;
 825         const SID *sid;
 826         switch (ace->AceType)
 827         {
 828         case ACCESS_DENIED_ACE_TYPE:
 829             ad_ace = (const ACCESS_DENIED_ACE *)ace;
 830             sid = (const SID *)&ad_ace->SidStart;
 831             if (token_sid_present( token, sid, TRUE ))
 832             {
 833                 unsigned int access = ad_ace->Mask;
 834                 map_generic_mask(&access, mapping);
 835                 if (desired_access & MAXIMUM_ALLOWED)
 836                     denied_access |= access;
 837                 else
 838                 {
 839                     denied_access |= (access & ~current_access);
 840                     if (desired_access & access)
 841                     {
 842                         *granted_access = 0;
 843                         return STATUS_SUCCESS;
 844                     }
 845                 }
 846             }
 847             break;
 848         case ACCESS_ALLOWED_ACE_TYPE:
 849             aa_ace = (const ACCESS_ALLOWED_ACE *)ace;
 850             sid = (const SID *)&aa_ace->SidStart;
 851             if (token_sid_present( token, sid, FALSE ))
 852             {
 853                 unsigned int access = aa_ace->Mask;
 854                 map_generic_mask(&access, mapping);
 855                 if (desired_access & MAXIMUM_ALLOWED)
 856                     current_access |= access;
 857                 else
 858                     current_access |= (access & ~denied_access);
 859             }
 860             break;
 861         }
 862
 863         /* don't bother carrying on checking if we've already got all of
 864             * rights we need */
 865         if (desired_access == *granted_access)
 866             break;
 867
 868         ace = ace_next( ace );
 869     }
 870
 871     if (desired_access & MAXIMUM_ALLOWED)
 872     {
 873         *granted_access = current_access & ~denied_access;
 874         if (*granted_access)
 875             return STATUS_SUCCESS;
 876         else
 877             return STATUS_ACCESS_DENIED;
 878     }
 879     else
 880     {
 881         if ((current_access & desired_access) == desired_access)
 882         {
 883             *granted_access = current_access & desired_access;
 884             return STATUS_SUCCESS;
 885         }
 886         else
 887             return STATUS_ACCESS_DENIED;
 888     }
 889 }
 890
 891 const ACL *token_get_default_dacl( struct token *token )
 892 {
 893     return token->default_dacl;
 894 }
 895
 896 /* open a security token */
 897 DECL_HANDLER(open_token)
 898 {
 899     if (req->flags & OPEN_TOKEN_THREAD)
 900     {
 901         struct thread *thread = get_thread_from_handle( req->handle, 0 );
 902         if (thread)
 903         {
 904             if (thread->token)
 905                 reply->token = alloc_handle( current->process, thread->token, req->access,
 906                                              req->attributes );
 907             else
 908                 set_error(STATUS_NO_TOKEN);
 909             release_object( thread );
 910         }
 911     }
 912     else
 913     {
 914         struct process *process = get_process_from_handle( req->handle, 0 );
 915         if (process)
 916         {
 917             if (process->token)
 918                 reply->token = alloc_handle( current->process, process->token, req->access,
 919                                              req->attributes );
 920             else
 921                 set_error(STATUS_NO_TOKEN);
 922             release_object( process );
 923         }
 924     }
 925 }
 926
 927 /* adjust the privileges held by a token */
 928 DECL_HANDLER(adjust_token_privileges)
 929 {
 930     struct token *token;
 931     unsigned int access = TOKEN_ADJUST_PRIVILEGES;
 932
 933     if (req->get_modified_state) access |= TOKEN_QUERY;
 934
 935     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
 936                                                  access, &token_ops )))
 937     {
 938         const LUID_AND_ATTRIBUTES *privs = get_req_data();
 939         LUID_AND_ATTRIBUTES *modified_privs = NULL;
 940         unsigned int priv_count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
 941         unsigned int modified_priv_count = 0;
 942
 943         if (req->get_modified_state && !req->disable_all)
 944         {
 945             unsigned int i;
 946             /* count modified privs */
 947             for (i = 0; i < priv_count; i++)
 948             {
 949                 struct privilege *privilege =
 950                     token_find_privilege( token, &privs[i].Luid, FALSE );
 951                 if (privilege && req->get_modified_state)
 952                     modified_priv_count++;
 953             }
 954             reply->len = modified_priv_count;
 955             modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
 956             if (modified_priv_count)
 957                 modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
 958         }
 959         reply->len = modified_priv_count * sizeof(*modified_privs);
 960
 961         if (req->disable_all)
 962             token_disable_privileges( token );
 963         else
 964             modified_priv_count = token_adjust_privileges( token, privs,
 965                 priv_count, modified_privs, modified_priv_count );
 966
 967         release_object( token );
 968     }
 969 }
 970
 971 /* retrieves the list of privileges that may be held be the token */
 972 DECL_HANDLER(get_token_privileges)
 973 {
 974     struct token *token;
 975
 976     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
 977                                                  TOKEN_QUERY,
 978                                                  &token_ops )))
 979     {
 980         int priv_count = 0;
 981         LUID_AND_ATTRIBUTES *privs;
 982         struct privilege *privilege;
 983
 984         LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 985             priv_count++;
 986
 987         reply->len = priv_count * sizeof(*privs);
 988         if (reply->len <= get_reply_max_size())
 989         {
 990             privs = set_reply_data_size( priv_count * sizeof(*privs) );
 991             if (privs)
 992             {
 993                 int i = 0;
 994                 LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
 995                 {
 996                     luid_and_attr_from_privilege( &privs[i], privilege );
 997                     i++;
 998                 }
 999             }
1000         }
1001         else
1002             set_error(STATUS_BUFFER_TOO_SMALL);
1003
1004         release_object( token );
1005     }
1006 }
1007
1008 /* creates a duplicate of the token */
1009 DECL_HANDLER(duplicate_token)
1010 {
1011     struct token *src_token;
1012     if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
1013                                                      TOKEN_DUPLICATE,
1014                                                      &token_ops )))
1015     {
1016         /* FIXME: use req->impersonation_level */
1017         struct token *token = create_token( req->primary, src_token->user,
1018                                             NULL, 0, NULL, 0,
1019                                             src_token->default_dacl,
1020                                             src_token->source );
1021         if (token)
1022         {
1023             struct privilege *privilege;
1024             struct group *group;
1025             unsigned int access;
1026
1027             /* copy groups */
1028             LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
1029             {
1030                 size_t size = FIELD_OFFSET( struct group, sid.SubAuthority[group->sid.SubAuthorityCount] );
1031                 struct group *newgroup = mem_alloc( size );
1032                 if (!newgroup)
1033                 {
1034                     release_object( token );
1035                     release_object( src_token );
1036                     return;
1037                 }
1038                 memcpy( newgroup, group, size );
1039                 list_add_tail( &token->groups, &newgroup->entry );
1040             }
1041
1042             /* copy privileges */
1043             LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
1044                 privilege_add( token, &privilege->luid, privilege->enabled );
1045
1046             access = req->access;
1047             if (access & MAXIMUM_ALLOWED) access = TOKEN_ALL_ACCESS; /* FIXME: needs general solution */
1048             reply->new_handle = alloc_handle( current->process, token, access, req->attributes);
1049             release_object( token );
1050         }
1051         release_object( src_token );
1052     }
1053 }
1054
1055 /* checks the specified privileges are held by the token */
1056 DECL_HANDLER(check_token_privileges)
1057 {
1058     struct token *token;
1059
1060     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1061                                                  TOKEN_QUERY,
1062                                                  &token_ops )))
1063     {
1064         unsigned int count = get_req_data_size() / sizeof(LUID_AND_ATTRIBUTES);
1065         if (get_reply_max_size() >= count * sizeof(LUID_AND_ATTRIBUTES))
1066         {
1067             LUID_AND_ATTRIBUTES *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
1068             reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
1069         }
1070         else
1071             set_error( STATUS_BUFFER_OVERFLOW );
1072         release_object( token );
1073     }
1074 }
1075
1076 /* checks that a user represented by a token is allowed to access an object
1077  * represented by a security descriptor */
1078 DECL_HANDLER(access_check)
1079 {
1080     data_size_t sd_size = get_req_data_size();
1081     const struct security_descriptor *sd = get_req_data();
1082     struct token *token;
1083
1084     if (!sd_is_valid( sd, sd_size ))
1085     {
1086         set_error( STATUS_ACCESS_VIOLATION );
1087         return;
1088     }
1089
1090     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1091                                                  TOKEN_QUERY,
1092                                                  &token_ops )))
1093     {
1094         GENERIC_MAPPING mapping;
1095         unsigned int status;
1096         LUID_AND_ATTRIBUTES priv;
1097         unsigned int priv_count = 1;
1098
1099         memset(&priv, 0, sizeof(priv));
1100
1101         /* only impersonation tokens may be used with this function */
1102         if (token->primary)
1103         {
1104             set_error( STATUS_NO_IMPERSONATION_TOKEN );
1105             release_object( token );
1106             return;
1107         }
1108
1109         mapping.GenericRead = req->mapping_read;
1110         mapping.GenericWrite = req->mapping_write;
1111         mapping.GenericExecute = req->mapping_execute;
1112         mapping.GenericAll = req->mapping_all;
1113
1114         reply->access_status = token_access_check(
1115             token, sd, req->desired_access, &priv, &priv_count, &mapping,
1116             &reply->access_granted, &status );
1117
1118         reply->privileges_len = priv_count*sizeof(LUID_AND_ATTRIBUTES);
1119
1120         if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
1121         {
1122             LUID_AND_ATTRIBUTES *privs = set_reply_data_size( priv_count * sizeof(*privs) );
1123             memcpy( privs, &priv, sizeof(priv) );
1124         }
1125
1126         if (status != STATUS_SUCCESS)
1127             set_error( status );
1128
1129         release_object( token );
1130     }
1131 }
1132
1133 /* retrieves the SID of the user that the token represents */
1134 DECL_HANDLER(get_token_user)
1135 {
1136     struct token *token;
1137
1138     reply->user_len = 0;
1139
1140     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1141                                                  TOKEN_QUERY,
1142                                                  &token_ops )))
1143     {
1144         const SID *user = token->user;
1145
1146         reply->user_len = FIELD_OFFSET(SID, SubAuthority[user->SubAuthorityCount]);
1147         if (reply->user_len <= get_reply_max_size())
1148         {
1149             SID *user_reply = set_reply_data_size( reply->user_len );
1150             if (user_reply)
1151                 memcpy( user_reply, user, reply->user_len );
1152         }
1153         else set_error( STATUS_BUFFER_TOO_SMALL );
1154
1155         release_object( token );
1156     }
1157 }
1158
1159 /* retrieves the groups that the user represented by the token belongs to */
1160 DECL_HANDLER(get_token_groups)
1161 {
1162     struct token *token;
1163
1164     reply->user_len = 0;
1165
1166     if ((token = (struct token *)get_handle_obj( current->process, req->handle,
1167                                                  TOKEN_QUERY,
1168                                                  &token_ops )))
1169     {
1170         size_t size_needed = sizeof(struct token_groups);
1171         unsigned int group_count = 0;
1172         const struct group *group;
1173
1174         LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1175         {
1176             group_count++;
1177             size_needed += FIELD_OFFSET(SID, SubAuthority[group->sid.SubAuthorityCount]);
1178         }
1179         size_needed += sizeof(unsigned int) * group_count;
1180
1181         reply->user_len = size_needed;
1182
1183         if (size_needed <= get_reply_max_size())
1184         {
1185             struct token_groups *tg = set_reply_data_size( size_needed );
1186             if (tg)
1187             {
1188                 unsigned int *attr_ptr = (unsigned int *)(tg + 1);
1189                 SID *sid_ptr = (SID *)(attr_ptr + group_count);
1190
1191                 tg->count = group_count;
1192
1193                 LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
1194                 {
1195
1196                     *attr_ptr = 0;
1197                     if (group->mandatory) *attr_ptr |= SE_GROUP_MANDATORY;
1198                     if (group->def) *attr_ptr |= SE_GROUP_ENABLED_BY_DEFAULT;
1199                     if (group->enabled) *attr_ptr |= SE_GROUP_ENABLED;
1200                     if (group->owner) *attr_ptr |= SE_GROUP_OWNER;
1201                     if (group->deny_only) *attr_ptr |= SE_GROUP_USE_FOR_DENY_ONLY;
1202                     if (group->resource) *attr_ptr |= SE_GROUP_RESOURCE;
1203
1204                     memcpy(sid_ptr, &group->sid, FIELD_OFFSET(SID, SubAuthority[group->sid.SubAuthorityCount]));
1205
1206                     sid_ptr = (SID *)((char *)sid_ptr + FIELD_OFFSET(SID, SubAuthority[group->sid.SubAuthorityCount]));
1207                     attr_ptr++;
1208                 }
1209             }
1210         }
1211         else set_error( STATUS_BUFFER_TOO_SMALL );
1212
1213         release_object( token );
1214     }
1215 }