?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
server: Explicitly add FILE_DELETE_CHILD permission when file write access is allowed.
[wine/wine-gecko.git] / dlls / advapi32 / tests / security.c
blob43406eb92e6a80a5d9e3416d625beb4b4108b303
1 /*
2 * Unit tests for security functions
3 *
4 * Copyright (c) 2004 Mike McCormack
5 * Copyright (c) 2011 Dmitry Timoshkov
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
20 */
21
22 #include <stdarg.h>
23 #include <stdio.h>
24
25 #include "ntstatus.h"
26 #define WIN32_NO_STATUS
27 #include "windef.h"
28 #include "winbase.h"
29 #include "winerror.h"
30 #include "aclapi.h"
31 #include "winnt.h"
32 #include "sddl.h"
33 #include "ntsecapi.h"
34 #include "lmcons.h"
35
36 #include "wine/test.h"
37
38 /* copied from Wine winternl.h - not included in the Windows SDK */
39 typedef enum _OBJECT_INFORMATION_CLASS {
40 ObjectBasicInformation,
41 ObjectNameInformation,
42 ObjectTypeInformation,
43 ObjectAllInformation,
44 ObjectDataInformation
45 } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
46
47 typedef struct _OBJECT_BASIC_INFORMATION {
48 ULONG Attributes;
49 ACCESS_MASK GrantedAccess;
50 ULONG HandleCount;
51 ULONG PointerCount;
52 ULONG PagedPoolUsage;
53 ULONG NonPagedPoolUsage;
54 ULONG Reserved[3];
55 ULONG NameInformationLength;
56 ULONG TypeInformationLength;
57 ULONG SecurityDescriptorLength;
58 LARGE_INTEGER CreateTime;
59 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
60
61 #define expect_eq(expr, value, type, format) { type ret = expr; ok((value) == ret, #expr " expected " format " got " format "\n", (value), (ret)); }
62
63 static BOOL (WINAPI *pAddAccessAllowedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
64 static BOOL (WINAPI *pAddAccessDeniedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
65 static BOOL (WINAPI *pAddAuditAccessAceEx)(PACL, DWORD, DWORD, DWORD, PSID, BOOL, BOOL);
66 static VOID (WINAPI *pBuildTrusteeWithSidA)( PTRUSTEEA pTrustee, PSID pSid );
67 static VOID (WINAPI *pBuildTrusteeWithNameA)( PTRUSTEEA pTrustee, LPSTR pName );
68 static VOID (WINAPI *pBuildTrusteeWithObjectsAndNameA)( PTRUSTEEA pTrustee,
69 POBJECTS_AND_NAME_A pObjName,
70 SE_OBJECT_TYPE ObjectType,
71 LPSTR ObjectTypeName,
72 LPSTR InheritedObjectTypeName,
73 LPSTR Name );
74 static VOID (WINAPI *pBuildTrusteeWithObjectsAndSidA)( PTRUSTEEA pTrustee,
75 POBJECTS_AND_SID pObjSid,
76 GUID* pObjectGuid,
77 GUID* pInheritedObjectGuid,
78 PSID pSid );
79 static LPSTR (WINAPI *pGetTrusteeNameA)( PTRUSTEEA pTrustee );
80 static BOOL (WINAPI *pMakeSelfRelativeSD)( PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR, LPDWORD );
81 static BOOL (WINAPI *pConvertSidToStringSidA)( PSID pSid, LPSTR *str );
82 static BOOL (WINAPI *pConvertStringSidToSidA)( LPCSTR str, PSID pSid );
83 static BOOL (WINAPI *pCheckTokenMembership)(HANDLE, PSID, PBOOL);
84 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorA)(LPCSTR, DWORD,
85 PSECURITY_DESCRIPTOR*, PULONG );
86 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorW)(LPCWSTR, DWORD,
87 PSECURITY_DESCRIPTOR*, PULONG );
88 static BOOL (WINAPI *pConvertSecurityDescriptorToStringSecurityDescriptorA)(PSECURITY_DESCRIPTOR, DWORD,
89 SECURITY_INFORMATION, LPSTR *, PULONG );
90 static BOOL (WINAPI *pGetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
91 PSECURITY_DESCRIPTOR, DWORD, LPDWORD);
92 static BOOL (WINAPI *pSetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
93 PSECURITY_DESCRIPTOR);
94 static DWORD (WINAPI *pGetNamedSecurityInfoA)(LPSTR, SE_OBJECT_TYPE, SECURITY_INFORMATION,
95 PSID*, PSID*, PACL*, PACL*,
96 PSECURITY_DESCRIPTOR*);
97 static PDWORD (WINAPI *pGetSidSubAuthority)(PSID, DWORD);
98 static PUCHAR (WINAPI *pGetSidSubAuthorityCount)(PSID);
99 static BOOL (WINAPI *pIsValidSid)(PSID);
100 static DWORD (WINAPI *pRtlAdjustPrivilege)(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
101 static BOOL (WINAPI *pCreateWellKnownSid)(WELL_KNOWN_SID_TYPE,PSID,PSID,DWORD*);
102 static BOOL (WINAPI *pDuplicateTokenEx)(HANDLE,DWORD,LPSECURITY_ATTRIBUTES,
103 SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
104
105 static NTSTATUS (WINAPI *pLsaQueryInformationPolicy)(LSA_HANDLE,POLICY_INFORMATION_CLASS,PVOID*);
106 static NTSTATUS (WINAPI *pLsaClose)(LSA_HANDLE);
107 static NTSTATUS (WINAPI *pLsaFreeMemory)(PVOID);
108 static NTSTATUS (WINAPI *pLsaOpenPolicy)(PLSA_UNICODE_STRING,PLSA_OBJECT_ATTRIBUTES,ACCESS_MASK,PLSA_HANDLE);
109 static NTSTATUS (WINAPI *pNtQueryObject)(HANDLE,OBJECT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
110 static DWORD (WINAPI *pSetEntriesInAclW)(ULONG, PEXPLICIT_ACCESSW, PACL, PACL*);
111 static DWORD (WINAPI *pSetEntriesInAclA)(ULONG, PEXPLICIT_ACCESSA, PACL, PACL*);
112 static BOOL (WINAPI *pSetSecurityDescriptorControl)(PSECURITY_DESCRIPTOR, SECURITY_DESCRIPTOR_CONTROL,
113 SECURITY_DESCRIPTOR_CONTROL);
114 static DWORD (WINAPI *pGetSecurityInfo)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION,
115 PSID*, PSID*, PACL*, PACL*, PSECURITY_DESCRIPTOR*);
116 static NTSTATUS (WINAPI *pNtAccessCheck)(PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK, PGENERIC_MAPPING,
117 PPRIVILEGE_SET, PULONG, PULONG, NTSTATUS*);
118
119 static HMODULE hmod;
120 static int myARGC;
121 static char** myARGV;
122
123 struct sidRef
124 {
125 SID_IDENTIFIER_AUTHORITY auth;
126 const char *refStr;
127 };
128
129 static void init(void)
130 {
131 HMODULE hntdll;
132
133 hntdll = GetModuleHandleA("ntdll.dll");
134 pNtQueryObject = (void *)GetProcAddress( hntdll, "NtQueryObject" );
135 pNtAccessCheck = (void *)GetProcAddress( hntdll, "NtAccessCheck" );
136
137 hmod = GetModuleHandle("advapi32.dll");
138 pAddAccessAllowedAceEx = (void *)GetProcAddress(hmod, "AddAccessAllowedAceEx");
139 pAddAccessDeniedAceEx = (void *)GetProcAddress(hmod, "AddAccessDeniedAceEx");
140 pAddAuditAccessAceEx = (void *)GetProcAddress(hmod, "AddAuditAccessAceEx");
141 pCheckTokenMembership = (void *)GetProcAddress(hmod, "CheckTokenMembership");
142 pConvertStringSecurityDescriptorToSecurityDescriptorA =
143 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
144 pConvertStringSecurityDescriptorToSecurityDescriptorW =
145 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorW" );
146 pConvertSecurityDescriptorToStringSecurityDescriptorA =
147 (void *)GetProcAddress(hmod, "ConvertSecurityDescriptorToStringSecurityDescriptorA" );
148 pGetFileSecurityA = (void *)GetProcAddress(hmod, "GetFileSecurityA" );
149 pSetFileSecurityA = (void *)GetProcAddress(hmod, "SetFileSecurityA" );
150 pCreateWellKnownSid = (void *)GetProcAddress( hmod, "CreateWellKnownSid" );
151 pGetNamedSecurityInfoA = (void *)GetProcAddress(hmod, "GetNamedSecurityInfoA");
152 pGetSidSubAuthority = (void *)GetProcAddress(hmod, "GetSidSubAuthority");
153 pGetSidSubAuthorityCount = (void *)GetProcAddress(hmod, "GetSidSubAuthorityCount");
154 pIsValidSid = (void *)GetProcAddress(hmod, "IsValidSid");
155 pMakeSelfRelativeSD = (void *)GetProcAddress(hmod, "MakeSelfRelativeSD");
156 pSetEntriesInAclW = (void *)GetProcAddress(hmod, "SetEntriesInAclW");
157 pSetEntriesInAclA = (void *)GetProcAddress(hmod, "SetEntriesInAclA");
158 pSetSecurityDescriptorControl = (void *)GetProcAddress(hmod, "SetSecurityDescriptorControl");
159 pGetSecurityInfo = (void *)GetProcAddress(hmod, "GetSecurityInfo");
160
161 myARGC = winetest_get_mainargs( &myARGV );
162 }
163
164 static void test_str_sid(const char *str_sid)
165 {
166 PSID psid;
167 char *temp;
168
169 if (pConvertStringSidToSidA(str_sid, &psid))
170 {
171 if (pConvertSidToStringSidA(psid, &temp))
172 {
173 trace(" %s: %s\n", str_sid, temp);
174 LocalFree(temp);
175 }
176 LocalFree(psid);
177 }
178 else
179 {
180 if (GetLastError() != ERROR_INVALID_SID)
181 trace(" %s: couldn't be converted, returned %d\n", str_sid, GetLastError());
182 else
183 trace(" %s: couldn't be converted\n", str_sid);
184 }
185 }
186
187 static void test_sid(void)
188 {
189 struct sidRef refs[] = {
190 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
191 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
192 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
193 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
194 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
195 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
196 };
197 const char noSubAuthStr[] = "S-1-5";
198 unsigned int i;
199 PSID psid = NULL;
200 SID *pisid;
201 BOOL r;
202 LPSTR str = NULL;
203
204 pConvertSidToStringSidA = (void *)GetProcAddress( hmod, "ConvertSidToStringSidA" );
205 if( !pConvertSidToStringSidA )
206 return;
207 pConvertStringSidToSidA = (void *)GetProcAddress( hmod, "ConvertStringSidToSidA" );
208 if( !pConvertStringSidToSidA )
209 return;
210
211 r = pConvertStringSidToSidA( NULL, NULL );
212 ok( !r, "expected failure with NULL parameters\n" );
213 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED )
214 return;
215 ok( GetLastError() == ERROR_INVALID_PARAMETER,
216 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
217 GetLastError() );
218
219 r = pConvertStringSidToSidA( refs[0].refStr, NULL );
220 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
221 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
222 GetLastError() );
223
224 r = pConvertStringSidToSidA( NULL, &str );
225 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
226 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
227 GetLastError() );
228
229 r = pConvertStringSidToSidA( noSubAuthStr, &psid );
230 ok( !r,
231 "expected failure with no sub authorities\n" );
232 ok( GetLastError() == ERROR_INVALID_SID,
233 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
234 GetLastError() );
235
236 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid), "ConvertStringSidToSidA failed\n");
237 pisid = psid;
238 ok(pisid->SubAuthorityCount == 4, "Invalid sub authority count - expected 4, got %d\n", pisid->SubAuthorityCount);
239 ok(pisid->SubAuthority[0] == 21, "Invalid subauthority 0 - expceted 21, got %d\n", pisid->SubAuthority[0]);
240 ok(pisid->SubAuthority[3] == 4576, "Invalid subauthority 0 - expceted 4576, got %d\n", pisid->SubAuthority[3]);
241 LocalFree(str);
242 LocalFree(psid);
243
244 for( i = 0; i < sizeof(refs) / sizeof(refs[0]); i++ )
245 {
246 PISID pisid;
247
248 r = AllocateAndInitializeSid( &refs[i].auth, 1,1,0,0,0,0,0,0,0,
249 &psid );
250 ok( r, "failed to allocate sid\n" );
251 r = pConvertSidToStringSidA( psid, &str );
252 ok( r, "failed to convert sid\n" );
253 if (r)
254 {
255 ok( !strcmp( str, refs[i].refStr ),
256 "incorrect sid, expected %s, got %s\n", refs[i].refStr, str );
257 LocalFree( str );
258 }
259 if( psid )
260 FreeSid( psid );
261
262 r = pConvertStringSidToSidA( refs[i].refStr, &psid );
263 ok( r, "failed to parse sid string\n" );
264 pisid = psid;
265 ok( pisid &&
266 !memcmp( pisid->IdentifierAuthority.Value, refs[i].auth.Value,
267 sizeof(refs[i].auth) ),
268 "string sid %s didn't parse to expected value\n"
269 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
270 refs[i].refStr,
271 MAKEWORD( pisid->IdentifierAuthority.Value[1],
272 pisid->IdentifierAuthority.Value[0] ),
273 MAKELONG( MAKEWORD( pisid->IdentifierAuthority.Value[5],
274 pisid->IdentifierAuthority.Value[4] ),
275 MAKEWORD( pisid->IdentifierAuthority.Value[3],
276 pisid->IdentifierAuthority.Value[2] ) ),
277 MAKEWORD( refs[i].auth.Value[1], refs[i].auth.Value[0] ),
278 MAKELONG( MAKEWORD( refs[i].auth.Value[5], refs[i].auth.Value[4] ),
279 MAKEWORD( refs[i].auth.Value[3], refs[i].auth.Value[2] ) ) );
280 if( psid )
281 LocalFree( psid );
282 }
283
284 trace("String SIDs:\n");
285 test_str_sid("AO");
286 test_str_sid("RU");
287 test_str_sid("AN");
288 test_str_sid("AU");
289 test_str_sid("BA");
290 test_str_sid("BG");
291 test_str_sid("BO");
292 test_str_sid("BU");
293 test_str_sid("CA");
294 test_str_sid("CG");
295 test_str_sid("CO");
296 test_str_sid("DA");
297 test_str_sid("DC");
298 test_str_sid("DD");
299 test_str_sid("DG");
300 test_str_sid("DU");
301 test_str_sid("EA");
302 test_str_sid("ED");
303 test_str_sid("WD");
304 test_str_sid("PA");
305 test_str_sid("IU");
306 test_str_sid("LA");
307 test_str_sid("LG");
308 test_str_sid("LS");
309 test_str_sid("SY");
310 test_str_sid("NU");
311 test_str_sid("NO");
312 test_str_sid("NS");
313 test_str_sid("PO");
314 test_str_sid("PS");
315 test_str_sid("PU");
316 test_str_sid("RS");
317 test_str_sid("RD");
318 test_str_sid("RE");
319 test_str_sid("RC");
320 test_str_sid("SA");
321 test_str_sid("SO");
322 test_str_sid("SU");
323 }
324
325 static void test_trustee(void)
326 {
327 GUID ObjectType = {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
328 GUID InheritedObjectType = {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
329 GUID ZeroGuid;
330 OBJECTS_AND_NAME_ oan;
331 OBJECTS_AND_SID oas;
332 TRUSTEE trustee;
333 PSID psid;
334 char szObjectTypeName[] = "ObjectTypeName";
335 char szInheritedObjectTypeName[] = "InheritedObjectTypeName";
336 char szTrusteeName[] = "szTrusteeName";
337 SID_IDENTIFIER_AUTHORITY auth = { {0x11,0x22,0,0,0, 0} };
338
339 memset( &ZeroGuid, 0x00, sizeof (ZeroGuid) );
340
341 pBuildTrusteeWithSidA = (void *)GetProcAddress( hmod, "BuildTrusteeWithSidA" );
342 pBuildTrusteeWithNameA = (void *)GetProcAddress( hmod, "BuildTrusteeWithNameA" );
343 pBuildTrusteeWithObjectsAndNameA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndNameA" );
344 pBuildTrusteeWithObjectsAndSidA = (void *)GetProcAddress (hmod, "BuildTrusteeWithObjectsAndSidA" );
345 pGetTrusteeNameA = (void *)GetProcAddress (hmod, "GetTrusteeNameA" );
346 if( !pBuildTrusteeWithSidA || !pBuildTrusteeWithNameA ||
347 !pBuildTrusteeWithObjectsAndNameA || !pBuildTrusteeWithObjectsAndSidA ||
348 !pGetTrusteeNameA )
349 return;
350
351 if ( ! AllocateAndInitializeSid( &auth, 1, 42, 0,0,0,0,0,0,0,&psid ) )
352 {
353 trace( "failed to init SID\n" );
354 return;
355 }
356
357 /* test BuildTrusteeWithSidA */
358 memset( &trustee, 0xff, sizeof trustee );
359 pBuildTrusteeWithSidA( &trustee, psid );
360
361 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
362 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
363 "MultipleTrusteeOperation wrong\n");
364 ok( trustee.TrusteeForm == TRUSTEE_IS_SID, "TrusteeForm wrong\n");
365 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
366 ok( trustee.ptstrName == psid, "ptstrName wrong\n" );
367
368 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
369 memset( &trustee, 0xff, sizeof trustee );
370 memset( &oas, 0xff, sizeof(oas) );
371 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, &ObjectType,
372 &InheritedObjectType, psid);
373
374 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
375 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
376 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
377 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
378 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
379
380 ok(oas.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
381 ok(!memcmp(&oas.ObjectTypeGuid, &ObjectType, sizeof(GUID)), "ObjectTypeGuid wrong\n");
382 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
383 ok(oas.pSid == psid, "pSid wrong\n");
384
385 /* test GetTrusteeNameA */
386 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oas, "GetTrusteeName returned wrong value\n");
387
388 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
389 memset( &trustee, 0xff, sizeof trustee );
390 memset( &oas, 0xff, sizeof(oas) );
391 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, NULL,
392 &InheritedObjectType, psid);
393
394 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
395 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
396 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
397 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
398 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
399
400 ok(oas.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
401 ok(!memcmp(&oas.ObjectTypeGuid, &ZeroGuid, sizeof(GUID)), "ObjectTypeGuid wrong\n");
402 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
403 ok(oas.pSid == psid, "pSid wrong\n");
404
405 FreeSid( psid );
406
407 /* test BuildTrusteeWithNameA */
408 memset( &trustee, 0xff, sizeof trustee );
409 pBuildTrusteeWithNameA( &trustee, szTrusteeName );
410
411 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
412 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
413 "MultipleTrusteeOperation wrong\n");
414 ok( trustee.TrusteeForm == TRUSTEE_IS_NAME, "TrusteeForm wrong\n");
415 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
416 ok( trustee.ptstrName == szTrusteeName, "ptstrName wrong\n" );
417
418 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
419 memset( &trustee, 0xff, sizeof trustee );
420 memset( &oan, 0xff, sizeof(oan) );
421 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
422 szInheritedObjectTypeName, szTrusteeName);
423
424 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
425 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
426 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
427 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
428 ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
429
430 ok(oan.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
431 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
432 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
433 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
434
435 /* test GetTrusteeNameA */
436 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oan, "GetTrusteeName returned wrong value\n");
437
438 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
439 memset( &trustee, 0xff, sizeof trustee );
440 memset( &oan, 0xff, sizeof(oan) );
441 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, NULL,
442 szInheritedObjectTypeName, szTrusteeName);
443
444 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
445 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
446 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
447 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
448 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
449
450 ok(oan.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
451 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
452 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
453 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
454
455 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
456 memset( &trustee, 0xff, sizeof trustee );
457 memset( &oan, 0xff, sizeof(oan) );
458 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
459 NULL, szTrusteeName);
460
461 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
462 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
463 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
464 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
465 ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
466
467 ok(oan.ObjectsPresent == ACE_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
468 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
469 ok(oan.InheritedObjectTypeName == NULL, "InheritedObjectTypeName wrong\n");
470 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
471 }
472
473 /* If the first isn't defined, assume none is */
474 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
475 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
476 #define SE_CREATE_TOKEN_PRIVILEGE 2L
477 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
478 #define SE_LOCK_MEMORY_PRIVILEGE 4L
479 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
480 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
481 #define SE_TCB_PRIVILEGE 7L
482 #define SE_SECURITY_PRIVILEGE 8L
483 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
484 #define SE_LOAD_DRIVER_PRIVILEGE 10L
485 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
486 #define SE_SYSTEMTIME_PRIVILEGE 12L
487 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
488 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
489 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
490 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
491 #define SE_BACKUP_PRIVILEGE 17L
492 #define SE_RESTORE_PRIVILEGE 18L
493 #define SE_SHUTDOWN_PRIVILEGE 19L
494 #define SE_DEBUG_PRIVILEGE 20L
495 #define SE_AUDIT_PRIVILEGE 21L
496 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
497 #define SE_CHANGE_NOTIFY_PRIVILEGE 23L
498 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
499 #define SE_UNDOCK_PRIVILEGE 25L
500 #define SE_SYNC_AGENT_PRIVILEGE 26L
501 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
502 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
503 #define SE_IMPERSONATE_PRIVILEGE 29L
504 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
505 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
506 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
507
508 static void test_allocateLuid(void)
509 {
510 BOOL (WINAPI *pAllocateLocallyUniqueId)(PLUID);
511 LUID luid1, luid2;
512 BOOL ret;
513
514 pAllocateLocallyUniqueId = (void*)GetProcAddress(hmod, "AllocateLocallyUniqueId");
515 if (!pAllocateLocallyUniqueId) return;
516
517 ret = pAllocateLocallyUniqueId(&luid1);
518 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
519 return;
520
521 ok(ret,
522 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
523 ret = pAllocateLocallyUniqueId(&luid2);
524 ok( ret,
525 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
526 ok(luid1.LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE || luid1.HighPart != 0,
527 "AllocateLocallyUniqueId returned a well-known LUID\n");
528 ok(luid1.LowPart != luid2.LowPart || luid1.HighPart != luid2.HighPart,
529 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
530 ret = pAllocateLocallyUniqueId(NULL);
531 ok( !ret && GetLastError() == ERROR_NOACCESS,
532 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
533 GetLastError());
534 }
535
536 static void test_lookupPrivilegeName(void)
537 {
538 BOOL (WINAPI *pLookupPrivilegeNameA)(LPCSTR, PLUID, LPSTR, LPDWORD);
539 char buf[MAX_PATH]; /* arbitrary, seems long enough */
540 DWORD cchName = sizeof(buf);
541 LUID luid = { 0, 0 };
542 LONG i;
543 BOOL ret;
544
545 /* check whether it's available first */
546 pLookupPrivilegeNameA = (void*)GetProcAddress(hmod, "LookupPrivilegeNameA");
547 if (!pLookupPrivilegeNameA) return;
548 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
549 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
550 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
551 return;
552
553 /* check with a short buffer */
554 cchName = 0;
555 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
556 ret = pLookupPrivilegeNameA(NULL, &luid, NULL, &cchName);
557 ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
558 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
559 GetLastError());
560 ok(cchName == strlen("SeCreateTokenPrivilege") + 1,
561 "LookupPrivilegeNameA returned an incorrect required length for\n"
562 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
563 lstrlenA("SeCreateTokenPrivilege") + 1);
564 /* check a known value and its returned length on success */
565 cchName = sizeof(buf);
566 ok(pLookupPrivilegeNameA(NULL, &luid, buf, &cchName) &&
567 cchName == strlen("SeCreateTokenPrivilege"),
568 "LookupPrivilegeNameA returned an incorrect output length for\n"
569 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
570 (int)strlen("SeCreateTokenPrivilege"));
571 /* check known values */
572 for (i = SE_MIN_WELL_KNOWN_PRIVILEGE; i <= SE_MAX_WELL_KNOWN_PRIVILEGE; i++)
573 {
574 luid.LowPart = i;
575 cchName = sizeof(buf);
576 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
577 ok( ret || GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
578 "LookupPrivilegeNameA(0.%d) failed: %d\n", i, GetLastError());
579 }
580 /* check a bogus LUID */
581 luid.LowPart = 0xdeadbeef;
582 cchName = sizeof(buf);
583 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
584 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
585 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
586 GetLastError());
587 /* check on a bogus system */
588 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
589 cchName = sizeof(buf);
590 ret = pLookupPrivilegeNameA("b0gu5.Nam3", &luid, buf, &cchName);
591 ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
592 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
593 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
594 GetLastError());
595 }
596
597 struct NameToLUID
598 {
599 const char *name;
600 DWORD lowPart;
601 };
602
603 static void test_lookupPrivilegeValue(void)
604 {
605 static const struct NameToLUID privs[] = {
606 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE },
607 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE },
608 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE },
609 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE },
610 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE },
611 { "SeTcbPrivilege", SE_TCB_PRIVILEGE },
612 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE },
613 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE },
614 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE },
615 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE },
616 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE },
617 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE },
618 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE },
619 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE },
620 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE },
621 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE },
622 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE },
623 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE },
624 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE },
625 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE },
626 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE },
627 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILEGE },
628 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE },
629 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE },
630 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE },
631 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE },
632 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE },
633 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE },
634 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE },
635 };
636 BOOL (WINAPI *pLookupPrivilegeValueA)(LPCSTR, LPCSTR, PLUID);
637 unsigned int i;
638 LUID luid;
639 BOOL ret;
640
641 /* check whether it's available first */
642 pLookupPrivilegeValueA = (void*)GetProcAddress(hmod, "LookupPrivilegeValueA");
643 if (!pLookupPrivilegeValueA) return;
644 ret = pLookupPrivilegeValueA(NULL, "SeCreateTokenPrivilege", &luid);
645 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
646 return;
647
648 /* check a bogus system name */
649 ret = pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid);
650 ok( !ret && (GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
651 GetLastError() == RPC_S_INVALID_NET_ADDR) /* w2k8 */,
652 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR: %d\n",
653 GetLastError());
654 /* check a NULL string */
655 ret = pLookupPrivilegeValueA(NULL, 0, &luid);
656 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
657 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
658 GetLastError());
659 /* check a bogus privilege name */
660 ret = pLookupPrivilegeValueA(NULL, "SeBogusPrivilege", &luid);
661 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
662 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
663 GetLastError());
664 /* check case insensitive */
665 ret = pLookupPrivilegeValueA(NULL, "sEcREATEtOKENpRIVILEGE", &luid);
666 ok( ret,
667 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
668 GetLastError());
669 for (i = 0; i < sizeof(privs) / sizeof(privs[0]); i++)
670 {
671 /* Not all privileges are implemented on all Windows versions, so
672 * don't worry if the call fails
673 */
674 if (pLookupPrivilegeValueA(NULL, privs[i].name, &luid))
675 {
676 ok(luid.LowPart == privs[i].lowPart,
677 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
678 privs[i].name);
679 }
680 }
681 }
682
683 static void test_luid(void)
684 {
685 test_allocateLuid();
686 test_lookupPrivilegeName();
687 test_lookupPrivilegeValue();
688 }
689
690 static void test_FileSecurity(void)
691 {
692 char wintmpdir [MAX_PATH];
693 char path [MAX_PATH];
694 char file [MAX_PATH];
695 HANDLE fh, token;
696 DWORD sdSize, retSize, rc, granted, priv_set_len;
697 PRIVILEGE_SET priv_set;
698 BOOL status;
699 BYTE *sd;
700 GENERIC_MAPPING mapping = { FILE_READ_DATA, FILE_WRITE_DATA, FILE_EXECUTE, FILE_ALL_ACCESS };
701 const SECURITY_INFORMATION request = OWNER_SECURITY_INFORMATION
702 | GROUP_SECURITY_INFORMATION
703 | DACL_SECURITY_INFORMATION;
704
705 if (!pGetFileSecurityA) {
706 win_skip ("GetFileSecurity is not available\n");
707 return;
708 }
709
710 if (!pSetFileSecurityA) {
711 win_skip ("SetFileSecurity is not available\n");
712 return;
713 }
714
715 if (!GetTempPathA (sizeof (wintmpdir), wintmpdir)) {
716 win_skip ("GetTempPathA failed\n");
717 return;
718 }
719
720 /* Create a temporary directory and in it a temporary file */
721 strcat (strcpy (path, wintmpdir), "rary");
722 SetLastError(0xdeadbeef);
723 rc = CreateDirectoryA (path, NULL);
724 ok (rc || GetLastError() == ERROR_ALREADY_EXISTS, "CreateDirectoryA "
725 "failed for '%s' with %d\n", path, GetLastError());
726
727 strcat (strcpy (file, path), "\\ess");
728 SetLastError(0xdeadbeef);
729 fh = CreateFileA (file, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
730 ok (fh != INVALID_HANDLE_VALUE, "CreateFileA "
731 "failed for '%s' with %d\n", file, GetLastError());
732 CloseHandle (fh);
733
734 /* For the temporary file ... */
735
736 /* Get size needed */
737 retSize = 0;
738 SetLastError(0xdeadbeef);
739 rc = pGetFileSecurityA (file, request, NULL, 0, &retSize);
740 if (!rc && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)) {
741 win_skip("GetFileSecurityA is not implemented\n");
742 goto cleanup;
743 }
744 ok (!rc, "GetFileSecurityA "
745 "was expected to fail for '%s'\n", file);
746 ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
747 "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
748 ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
749
750 sdSize = retSize;
751 sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
752
753 /* Get security descriptor for real */
754 retSize = -1;
755 SetLastError(0xdeadbeef);
756 rc = pGetFileSecurityA (file, request, sd, sdSize, &retSize);
757 ok (rc, "GetFileSecurityA "
758 "was not expected to fail '%s': %d\n", file, GetLastError());
759 ok (retSize == sdSize ||
760 broken(retSize == 0), /* NT4 */
761 "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
762
763 /* Use it to set security descriptor */
764 SetLastError(0xdeadbeef);
765 rc = pSetFileSecurityA (file, request, sd);
766 ok (rc, "SetFileSecurityA "
767 "was not expected to fail '%s': %d\n", file, GetLastError());
768
769 HeapFree (GetProcessHeap (), 0, sd);
770
771 /* Repeat for the temporary directory ... */
772
773 /* Get size needed */
774 retSize = 0;
775 SetLastError(0xdeadbeef);
776 rc = pGetFileSecurityA (path, request, NULL, 0, &retSize);
777 ok (!rc, "GetFileSecurityA "
778 "was expected to fail for '%s'\n", path);
779 ok (GetLastError() == ERROR_INSUFFICIENT_BUFFER, "GetFileSecurityA "
780 "returned %d; expected ERROR_INSUFFICIENT_BUFFER\n", GetLastError());
781 ok (retSize > sizeof (SECURITY_DESCRIPTOR), "GetFileSecurityA returned size %d\n", retSize);
782
783 sdSize = retSize;
784 sd = HeapAlloc (GetProcessHeap (), 0, sdSize);
785
786 /* Get security descriptor for real */
787 retSize = -1;
788 SetLastError(0xdeadbeef);
789 rc = pGetFileSecurityA (path, request, sd, sdSize, &retSize);
790 ok (rc, "GetFileSecurityA "
791 "was not expected to fail '%s': %d\n", path, GetLastError());
792 ok (retSize == sdSize ||
793 broken(retSize == 0), /* NT4 */
794 "GetFileSecurityA returned size %d; expected %d\n", retSize, sdSize);
795
796 /* Use it to set security descriptor */
797 SetLastError(0xdeadbeef);
798 rc = pSetFileSecurityA (path, request, sd);
799 ok (rc, "SetFileSecurityA "
800 "was not expected to fail '%s': %d\n", path, GetLastError());
801 HeapFree (GetProcessHeap (), 0, sd);
802
803 /* Old test */
804 strcpy (wintmpdir, "\\Should not exist");
805 SetLastError(0xdeadbeef);
806 rc = pGetFileSecurityA (wintmpdir, OWNER_SECURITY_INFORMATION, NULL, 0, &sdSize);
807 ok (!rc, "GetFileSecurityA should fail for not existing directories/files\n");
808 ok (GetLastError() == ERROR_FILE_NOT_FOUND,
809 "last error ERROR_FILE_NOT_FOUND expected, got %d\n", GetLastError());
810
811 cleanup:
812 /* Remove temporary file and directory */
813 DeleteFileA(file);
814 RemoveDirectoryA(path);
815
816
817 SetLastError(0xdeadbeef);
818 rc = GetTempPath(sizeof(wintmpdir), wintmpdir);
819 ok(rc, "GetTempPath error %d\n", GetLastError());
820
821 SetLastError(0xdeadbeef);
822 rc = GetTempFileName(wintmpdir, "tmp", 0, file);
823 ok(rc, "GetTempFileName error %d\n", GetLastError());
824
825 rc = GetFileAttributes(file);
826 rc &= ~FILE_ATTRIBUTE_NOT_CONTENT_INDEXED;
827 ok(rc == FILE_ATTRIBUTE_ARCHIVE, "expected FILE_ATTRIBUTE_ARCHIVE got %#x\n", rc);
828
829 retSize = 0xdeadbeef;
830 rc = GetFileSecurity(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
831 NULL, 0, &sdSize);
832 ok(!rc, "GetFileSecurity should fail\n");
833 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
834 "expected ERROR_INSUFFICIENT_BUFFER got %d\n", GetLastError());
835 ok(sdSize > sizeof(SECURITY_DESCRIPTOR), "got sd size %d\n", sdSize);
836
837 sd = HeapAlloc(GetProcessHeap (), 0, sdSize);
838 retSize = 0xdeadbeef;
839 SetLastError(0xdeadbeef);
840 rc = GetFileSecurity(file, OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
841 sd, sdSize, &retSize);
842 ok(rc, "GetFileSecurity error %d\n", GetLastError());
843
844 SetLastError(0xdeadbeef);
845 rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
846 ok(!rc, "OpenThreadToken should fail\n");
847 ok(GetLastError() == ERROR_NO_TOKEN, "expected ERROR_NO_TOKEN, got %d\n", GetLastError());
848
849 SetLastError(0xdeadbeef);
850 rc = ImpersonateSelf(SecurityIdentification);
851 ok(rc, "ImpersonateSelf error %d\n", GetLastError());
852
853 SetLastError(0xdeadbeef);
854 rc = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &token);
855 ok(rc, "OpenThreadToken error %d\n", GetLastError());
856
857 SetLastError(0xdeadbeef);
858 rc = RevertToSelf();
859 ok(rc, "RevertToSelf error %d\n", GetLastError());
860
861 priv_set_len = sizeof(priv_set);
862 granted = 0xdeadbeef;
863 status = 0xdeadbeef;
864 SetLastError(0xdeadbeef);
865 rc = AccessCheck(sd, token, FILE_READ_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
866 ok(rc, "AccessCheck error %d\n", GetLastError());
867 ok(status == 1, "expected 1, got %d\n", status);
868 ok(granted == FILE_READ_DATA, "expected FILE_READ_DATA, got %#x\n", granted);
869
870 granted = 0xdeadbeef;
871 status = 0xdeadbeef;
872 SetLastError(0xdeadbeef);
873 rc = AccessCheck(sd, token, FILE_WRITE_DATA, &mapping, &priv_set, &priv_set_len, &granted, &status);
874 ok(rc, "AccessCheck error %d\n", GetLastError());
875 ok(status == 1, "expected 1, got %d\n", status);
876 ok(granted == FILE_WRITE_DATA, "expected FILE_WRITE_DATA, got %#x\n", granted);
877
878 granted = 0xdeadbeef;
879 status = 0xdeadbeef;
880 SetLastError(0xdeadbeef);
881 rc = AccessCheck(sd, token, FILE_EXECUTE, &mapping, &priv_set, &priv_set_len, &granted, &status);
882 ok(rc, "AccessCheck error %d\n", GetLastError());
883 todo_wine {
884 ok(status == 1, "expected 1, got %d\n", status);
885 ok(granted == FILE_EXECUTE, "expected FILE_EXECUTE, got %#x\n", granted);
886 }
887 granted = 0xdeadbeef;
888 status = 0xdeadbeef;
889 SetLastError(0xdeadbeef);
890 rc = AccessCheck(sd, token, FILE_DELETE_CHILD, &mapping, &priv_set, &priv_set_len, &granted, &status);
891 ok(rc, "AccessCheck error %d\n", GetLastError());
892 ok(status == 1, "expected 1, got %d\n", status);
893 ok(granted == FILE_DELETE_CHILD, "expected FILE_DELETE_CHILD, got %#x\n", granted);
894
895 granted = 0xdeadbeef;
896 status = 0xdeadbeef;
897 SetLastError(0xdeadbeef);
898 rc = AccessCheck(sd, token, 0x1ff, &mapping, &priv_set, &priv_set_len, &granted, &status);
899 ok(rc, "AccessCheck error %d\n", GetLastError());
900 todo_wine {
901 ok(status == 1, "expected 1, got %d\n", status);
902 ok(granted == 0x1ff, "expected 0x1ff, got %#x\n", granted);
903 }
904 granted = 0xdeadbeef;
905 status = 0xdeadbeef;
906 SetLastError(0xdeadbeef);
907 rc = AccessCheck(sd, token, FILE_ALL_ACCESS, &mapping, &priv_set, &priv_set_len, &granted, &status);
908 ok(rc, "AccessCheck error %d\n", GetLastError());
909 todo_wine {
910 ok(status == 1, "expected 1, got %d\n", status);
911 ok(granted == FILE_ALL_ACCESS, "expected FILE_ALL_ACCESS, got %#x\n", granted);
912 }
913 SetLastError(0xdeadbeef);
914 rc = AccessCheck(sd, token, 0xffffffff, &mapping, &priv_set, &priv_set_len, &granted, &status);
915 ok(!rc, "AccessCheck should fail\n");
916 ok(GetLastError() == ERROR_GENERIC_NOT_MAPPED, "expected ERROR_GENERIC_NOT_MAPPED, got %d\n", GetLastError());
917
918 CloseHandle(token);
919 HeapFree(GetProcessHeap (), 0, sd);
920 DeleteFile(file);
921 }
922
923 static void test_AccessCheck(void)
924 {
925 PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL;
926 PACL Acl = NULL;
927 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
928 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
929 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
930 GENERIC_MAPPING Mapping = { KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS };
931 ACCESS_MASK Access;
932 BOOL AccessStatus;
933 HANDLE Token;
934 HANDLE ProcessToken;
935 BOOL ret;
936 DWORD PrivSetLen;
937 PRIVILEGE_SET *PrivSet;
938 BOOL res;
939 HMODULE NtDllModule;
940 BOOLEAN Enabled;
941 DWORD err;
942 NTSTATUS ntret, ntAccessStatus;
943
944 NtDllModule = GetModuleHandle("ntdll.dll");
945 if (!NtDllModule)
946 {
947 skip("not running on NT, skipping test\n");
948 return;
949 }
950 pRtlAdjustPrivilege = (void *)GetProcAddress(NtDllModule, "RtlAdjustPrivilege");
951 if (!pRtlAdjustPrivilege)
952 {
953 win_skip("missing RtlAdjustPrivilege, skipping test\n");
954 return;
955 }
956
957 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
958 res = InitializeAcl(Acl, 256, ACL_REVISION);
959 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
960 {
961 skip("ACLs not implemented - skipping tests\n");
962 HeapFree(GetProcessHeap(), 0, Acl);
963 return;
964 }
965 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
966
967 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
968 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
969
970 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
971 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdminSid);
972 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
973
974 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
975 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
976 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
977
978 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
979
980 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
981 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
982
983 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
984 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
985
986 PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
987 PrivSet = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PrivSetLen);
988 PrivSet->PrivilegeCount = 16;
989
990 res = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &ProcessToken);
991 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
992
993 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, FALSE, TRUE, &Enabled);
994
995 res = DuplicateToken(ProcessToken, SecurityImpersonation, &Token);
996 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
997
998 /* SD without owner/group */
999 SetLastError(0xdeadbeef);
1000 Access = AccessStatus = 0x1abe11ed;
1001 ret = AccessCheck(SecurityDescriptor, Token, KEY_QUERY_VALUE, &Mapping,
1002 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1003 err = GetLastError();
1004 ok(!ret && err == ERROR_INVALID_SECURITY_DESCR, "AccessCheck should have "
1005 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err);
1006 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1007 "Access and/or AccessStatus were changed!\n");
1008
1009 /* Set owner and group */
1010 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
1011 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1012 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, TRUE);
1013 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1014
1015 /* Generic access mask */
1016 SetLastError(0xdeadbeef);
1017 Access = AccessStatus = 0x1abe11ed;
1018 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1019 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1020 err = GetLastError();
1021 ok(!ret && err == ERROR_GENERIC_NOT_MAPPED, "AccessCheck should have failed "
1022 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err);
1023 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1024 "Access and/or AccessStatus were changed!\n");
1025
1026 /* Generic access mask - no privilegeset buffer */
1027 SetLastError(0xdeadbeef);
1028 Access = AccessStatus = 0x1abe11ed;
1029 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1030 NULL, &PrivSetLen, &Access, &AccessStatus);
1031 err = GetLastError();
1032 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1033 "with ERROR_NOACCESS, instead of %d\n", err);
1034 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1035 "Access and/or AccessStatus were changed!\n");
1036
1037 /* Generic access mask - no returnlength */
1038 SetLastError(0xdeadbeef);
1039 Access = AccessStatus = 0x1abe11ed;
1040 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1041 PrivSet, NULL, &Access, &AccessStatus);
1042 err = GetLastError();
1043 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1044 "with ERROR_NOACCESS, instead of %d\n", err);
1045 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1046 "Access and/or AccessStatus were changed!\n");
1047
1048 /* Generic access mask - no privilegeset buffer, no returnlength */
1049 SetLastError(0xdeadbeef);
1050 Access = AccessStatus = 0x1abe11ed;
1051 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1052 NULL, NULL, &Access, &AccessStatus);
1053 err = GetLastError();
1054 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1055 "with ERROR_NOACCESS, instead of %d\n", err);
1056 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1057 "Access and/or AccessStatus were changed!\n");
1058
1059 /* sd with no dacl present */
1060 Access = AccessStatus = 0x1abe11ed;
1061 ret = SetSecurityDescriptorDacl(SecurityDescriptor, FALSE, NULL, FALSE);
1062 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1063 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1064 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1065 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1066 ok(AccessStatus && (Access == KEY_READ),
1067 "AccessCheck failed to grant access with error %d\n",
1068 GetLastError());
1069
1070 /* sd with no dacl present - no privilegeset buffer */
1071 SetLastError(0xdeadbeef);
1072 Access = AccessStatus = 0x1abe11ed;
1073 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1074 NULL, &PrivSetLen, &Access, &AccessStatus);
1075 err = GetLastError();
1076 ok(!ret && err == ERROR_NOACCESS, "AccessCheck should have failed "
1077 "with ERROR_NOACCESS, instead of %d\n", err);
1078 ok(Access == 0x1abe11ed && AccessStatus == 0x1abe11ed,
1079 "Access and/or AccessStatus were changed!\n");
1080
1081 if(pNtAccessCheck)
1082 {
1083 /* Generic access mask - no privilegeset buffer */
1084 SetLastError(0xdeadbeef);
1085 Access = ntAccessStatus = 0x1abe11ed;
1086 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1087 NULL, &PrivSetLen, &Access, &ntAccessStatus);
1088 err = GetLastError();
1089 ok(ntret == STATUS_ACCESS_VIOLATION,
1090 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1091 ok(err == 0xdeadbeef,
1092 "NtAccessCheck shouldn't set last error, got %d\n", err);
1093 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1094 "Access and/or AccessStatus were changed!\n");
1095
1096 /* Generic access mask - no returnlength */
1097 SetLastError(0xdeadbeef);
1098 Access = ntAccessStatus = 0x1abe11ed;
1099 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1100 PrivSet, NULL, &Access, &ntAccessStatus);
1101 err = GetLastError();
1102 ok(ntret == STATUS_ACCESS_VIOLATION,
1103 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1104 ok(err == 0xdeadbeef,
1105 "NtAccessCheck shouldn't set last error, got %d\n", err);
1106 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1107 "Access and/or AccessStatus were changed!\n");
1108
1109 /* Generic access mask - no privilegeset buffer, no returnlength */
1110 SetLastError(0xdeadbeef);
1111 Access = ntAccessStatus = 0x1abe11ed;
1112 ntret = pNtAccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
1113 NULL, NULL, &Access, &ntAccessStatus);
1114 err = GetLastError();
1115 ok(ntret == STATUS_ACCESS_VIOLATION,
1116 "NtAccessCheck should have failed with STATUS_ACCESS_VIOLATION, got %x\n", ntret);
1117 ok(err == 0xdeadbeef,
1118 "NtAccessCheck shouldn't set last error, got %d\n", err);
1119 ok(Access == 0x1abe11ed && ntAccessStatus == 0x1abe11ed,
1120 "Access and/or AccessStatus were changed!\n");
1121 }
1122 else
1123 win_skip("NtAccessCheck unavailable. Skipping.\n");
1124
1125 /* sd with NULL dacl */
1126 Access = AccessStatus = 0x1abe11ed;
1127 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, NULL, FALSE);
1128 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1129 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1130 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1131 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1132 ok(AccessStatus && (Access == KEY_READ),
1133 "AccessCheck failed to grant access with error %d\n",
1134 GetLastError());
1135
1136 /* sd with blank dacl */
1137 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1138 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1139 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1140 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1141 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1142 err = GetLastError();
1143 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1144 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1145 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1146
1147 res = AddAccessAllowedAce(Acl, ACL_REVISION, KEY_READ, EveryoneSid);
1148 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
1149
1150 res = AddAccessDeniedAce(Acl, ACL_REVISION, KEY_SET_VALUE, AdminSid);
1151 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1152
1153 /* sd with dacl */
1154 Access = AccessStatus = 0x1abe11ed;
1155 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1156 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1157 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1158 ok(AccessStatus && (Access == KEY_READ),
1159 "AccessCheck failed to grant access with error %d\n",
1160 GetLastError());
1161
1162 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1163 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1164 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1165 ok(AccessStatus,
1166 "AccessCheck failed to grant any access with error %d\n",
1167 GetLastError());
1168 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access);
1169
1170 /* Access denied by SD */
1171 SetLastError(0xdeadbeef);
1172 Access = AccessStatus = 0x1abe11ed;
1173 ret = AccessCheck(SecurityDescriptor, Token, KEY_WRITE, &Mapping,
1174 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1175 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1176 err = GetLastError();
1177 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1178 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1179 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1180
1181 SetLastError(0);
1182 PrivSet->PrivilegeCount = 16;
1183 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1184 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1185 ok(ret && !AccessStatus && GetLastError() == ERROR_PRIVILEGE_NOT_HELD,
1186 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
1187 GetLastError());
1188
1189 ret = ImpersonateLoggedOnUser(Token);
1190 ok(ret, "ImpersonateLoggedOnUser failed with error %d\n", GetLastError());
1191 ret = pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, TRUE, TRUE, &Enabled);
1192 if (!ret)
1193 {
1194 SetLastError(0);
1195 PrivSet->PrivilegeCount = 16;
1196 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
1197 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1198 ok(ret && AccessStatus && GetLastError() == 0,
1199 "AccessCheck should have succeeded, error %d\n",
1200 GetLastError());
1201 ok(Access == ACCESS_SYSTEM_SECURITY,
1202 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
1203 Access);
1204 }
1205 else
1206 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
1207 ret);
1208 ret = RevertToSelf();
1209 ok(ret, "RevertToSelf failed with error %d\n", GetLastError());
1210
1211 /* test INHERIT_ONLY_ACE */
1212 ret = InitializeAcl(Acl, 256, ACL_REVISION);
1213 ok(ret, "InitializeAcl failed with error %d\n", GetLastError());
1214
1215 /* NT doesn't have AddAccessAllowedAceEx. Skipping this call/test doesn't influence
1216 * the next ones.
1217 */
1218 if (pAddAccessAllowedAceEx)
1219 {
1220 ret = pAddAccessAllowedAceEx(Acl, ACL_REVISION, INHERIT_ONLY_ACE, KEY_READ, EveryoneSid);
1221 ok(ret, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1222 }
1223 else
1224 win_skip("AddAccessAllowedAceEx is not available\n");
1225
1226 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
1227 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1228 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
1229 err = GetLastError();
1230 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
1231 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
1232 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
1233
1234 CloseHandle(Token);
1235
1236 res = DuplicateToken(ProcessToken, SecurityAnonymous, &Token);
1237 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
1238
1239 SetLastError(0xdeadbeef);
1240 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
1241 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1242 err = GetLastError();
1243 ok(!ret && err == ERROR_BAD_IMPERSONATION_LEVEL, "AccessCheck should have failed "
1244 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err);
1245
1246 CloseHandle(Token);
1247
1248 SetLastError(0xdeadbeef);
1249 ret = AccessCheck(SecurityDescriptor, ProcessToken, KEY_READ, &Mapping,
1250 PrivSet, &PrivSetLen, &Access, &AccessStatus);
1251 err = GetLastError();
1252 ok(!ret && err == ERROR_NO_IMPERSONATION_TOKEN, "AccessCheck should have failed "
1253 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err);
1254
1255 CloseHandle(ProcessToken);
1256
1257 if (EveryoneSid)
1258 FreeSid(EveryoneSid);
1259 if (AdminSid)
1260 FreeSid(AdminSid);
1261 if (UsersSid)
1262 FreeSid(UsersSid);
1263 HeapFree(GetProcessHeap(), 0, Acl);
1264 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
1265 HeapFree(GetProcessHeap(), 0, PrivSet);
1266 }
1267
1268 /* test GetTokenInformation for the various attributes */
1269 static void test_token_attr(void)
1270 {
1271 HANDLE Token, ImpersonationToken;
1272 DWORD Size, Size2;
1273 TOKEN_PRIVILEGES *Privileges;
1274 TOKEN_GROUPS *Groups;
1275 TOKEN_USER *User;
1276 TOKEN_DEFAULT_DACL *Dacl;
1277 BOOL ret;
1278 DWORD i, GLE;
1279 LPSTR SidString;
1280 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1281 ACL *acl;
1282
1283 /* cygwin-like use case */
1284 SetLastError(0xdeadbeef);
1285 ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &Token);
1286 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1287 {
1288 win_skip("OpenProcessToken is not implemented\n");
1289 return;
1290 }
1291 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1292 if (ret)
1293 {
1294 DWORD buf[256]; /* GetTokenInformation wants a dword-aligned buffer */
1295 Size = sizeof(buf);
1296 ret = GetTokenInformation(Token, TokenUser,(void*)buf, Size, &Size);
1297 ok(ret, "GetTokenInformation failed with error %d\n", GetLastError());
1298 Size = sizeof(ImpersonationLevel);
1299 ret = GetTokenInformation(Token, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1300 GLE = GetLastError();
1301 ok(!ret && (GLE == ERROR_INVALID_PARAMETER), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE);
1302 CloseHandle(Token);
1303 }
1304
1305 if(!pConvertSidToStringSidA)
1306 {
1307 win_skip("ConvertSidToStringSidA is not available\n");
1308 return;
1309 }
1310
1311 SetLastError(0xdeadbeef);
1312 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &Token);
1313 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1314
1315 /* groups */
1316 SetLastError(0xdeadbeef);
1317 ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size);
1318 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1319 "GetTokenInformation(TokenGroups) %s with error %d\n",
1320 ret ? "succeeded" : "failed", GetLastError());
1321 Groups = HeapAlloc(GetProcessHeap(), 0, Size);
1322 SetLastError(0xdeadbeef);
1323 ret = GetTokenInformation(Token, TokenGroups, Groups, Size, &Size);
1324 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
1325 ok(GetLastError() == 0xdeadbeef,
1326 "GetTokenInformation shouldn't have set last error to %d\n",
1327 GetLastError());
1328 trace("TokenGroups:\n");
1329 for (i = 0; i < Groups->GroupCount; i++)
1330 {
1331 DWORD NameLength = 255;
1332 TCHAR Name[255];
1333 DWORD DomainLength = 255;
1334 TCHAR Domain[255];
1335 SID_NAME_USE SidNameUse;
1336 Name[0] = '\0';
1337 Domain[0] = '\0';
1338 ret = LookupAccountSid(NULL, Groups->Groups[i].Sid, Name, &NameLength, Domain, &DomainLength, &SidNameUse);
1339 if (ret)
1340 {
1341 pConvertSidToStringSidA(Groups->Groups[i].Sid, &SidString);
1342 trace("%s, %s\\%s use: %d attr: 0x%08x\n", SidString, Domain, Name, SidNameUse, Groups->Groups[i].Attributes);
1343 LocalFree(SidString);
1344 }
1345 else trace("attr: 0x%08x LookupAccountSid failed with error %d\n", Groups->Groups[i].Attributes, GetLastError());
1346 }
1347 HeapFree(GetProcessHeap(), 0, Groups);
1348
1349 /* user */
1350 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
1351 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1352 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1353 User = HeapAlloc(GetProcessHeap(), 0, Size);
1354 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
1355 ok(ret,
1356 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1357
1358 pConvertSidToStringSidA(User->User.Sid, &SidString);
1359 trace("TokenUser: %s attr: 0x%08x\n", SidString, User->User.Attributes);
1360 LocalFree(SidString);
1361 HeapFree(GetProcessHeap(), 0, User);
1362
1363 /* privileges */
1364 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
1365 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1366 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1367 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
1368 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
1369 ok(ret,
1370 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1371 trace("TokenPrivileges:\n");
1372 for (i = 0; i < Privileges->PrivilegeCount; i++)
1373 {
1374 TCHAR Name[256];
1375 DWORD NameLen = sizeof(Name)/sizeof(Name[0]);
1376 LookupPrivilegeName(NULL, &Privileges->Privileges[i].Luid, Name, &NameLen);
1377 trace("\t%s, 0x%x\n", Name, Privileges->Privileges[i].Attributes);
1378 }
1379 HeapFree(GetProcessHeap(), 0, Privileges);
1380
1381 ret = DuplicateToken(Token, SecurityAnonymous, &ImpersonationToken);
1382 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
1383
1384 Size = sizeof(ImpersonationLevel);
1385 ret = GetTokenInformation(ImpersonationToken, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1386 ok(ret, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
1387 ok(ImpersonationLevel == SecurityAnonymous, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel);
1388
1389 CloseHandle(ImpersonationToken);
1390
1391 /* default dacl */
1392 ret = GetTokenInformation(Token, TokenDefaultDacl, NULL, 0, &Size);
1393 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1394 "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1395
1396 Dacl = HeapAlloc(GetProcessHeap(), 0, Size);
1397 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size);
1398 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1399
1400 SetLastError(0xdeadbeef);
1401 ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, 0);
1402 GLE = GetLastError();
1403 ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1404 ok(GLE == ERROR_BAD_LENGTH, "expected ERROR_BAD_LENGTH got %u\n", GLE);
1405
1406 SetLastError(0xdeadbeef);
1407 ret = SetTokenInformation(Token, TokenDefaultDacl, NULL, Size);
1408 GLE = GetLastError();
1409 ok(!ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1410 ok(GLE == ERROR_NOACCESS, "expected ERROR_NOACCESS got %u\n", GLE);
1411
1412 acl = Dacl->DefaultDacl;
1413 Dacl->DefaultDacl = NULL;
1414
1415 ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1416 ok(ret, "SetTokenInformation(TokenDefaultDacl) succeeded\n");
1417
1418 Size2 = 0;
1419 Dacl->DefaultDacl = (ACL *)0xdeadbeef;
1420 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1421 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1422 ok(Dacl->DefaultDacl == NULL, "expected NULL, got %p\n", Dacl->DefaultDacl);
1423 ok(Size2 == sizeof(TOKEN_DEFAULT_DACL) || broken(Size2 == 2*sizeof(TOKEN_DEFAULT_DACL)), /* WoW64 */
1424 "got %u expected sizeof(TOKEN_DEFAULT_DACL)\n", Size2);
1425
1426 Dacl->DefaultDacl = acl;
1427 ret = SetTokenInformation(Token, TokenDefaultDacl, Dacl, Size);
1428 ok(ret, "SetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1429
1430 if (Size2 == sizeof(TOKEN_DEFAULT_DACL)) {
1431 ret = GetTokenInformation(Token, TokenDefaultDacl, Dacl, Size, &Size2);
1432 ok(ret, "GetTokenInformation(TokenDefaultDacl) failed with error %u\n", GetLastError());
1433 } else
1434 win_skip("TOKEN_DEFAULT_DACL size too small on WoW64\n");
1435
1436 HeapFree(GetProcessHeap(), 0, Dacl);
1437 CloseHandle(Token);
1438 }
1439
1440 typedef union _MAX_SID
1441 {
1442 SID sid;
1443 char max[SECURITY_MAX_SID_SIZE];
1444 } MAX_SID;
1445
1446 static void test_sid_str(PSID * sid)
1447 {
1448 char *str_sid;
1449 BOOL ret = pConvertSidToStringSidA(sid, &str_sid);
1450 ok(ret, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
1451 if (ret)
1452 {
1453 char account[MAX_PATH], domain[MAX_PATH];
1454 SID_NAME_USE use;
1455 DWORD acc_size = MAX_PATH;
1456 DWORD dom_size = MAX_PATH;
1457 ret = LookupAccountSid(NULL, sid, account, &acc_size, domain, &dom_size, &use);
1458 ok(ret || (!ret && (GetLastError() == ERROR_NONE_MAPPED)),
1459 "LookupAccountSid(%s) failed: %d\n", str_sid, GetLastError());
1460 if (ret)
1461 trace(" %s %s\\%s %d\n", str_sid, domain, account, use);
1462 else if (GetLastError() == ERROR_NONE_MAPPED)
1463 trace(" %s couldn't be mapped\n", str_sid);
1464 LocalFree(str_sid);
1465 }
1466 }
1467
1468 static const struct well_known_sid_value
1469 {
1470 BOOL without_domain;
1471 const char *sid_string;
1472 } well_known_sid_values[] = {
1473 /* 0 */ {TRUE, "S-1-0-0"}, {TRUE, "S-1-1-0"}, {TRUE, "S-1-2-0"}, {TRUE, "S-1-3-0"},
1474 /* 4 */ {TRUE, "S-1-3-1"}, {TRUE, "S-1-3-2"}, {TRUE, "S-1-3-3"}, {TRUE, "S-1-5"},
1475 /* 8 */ {FALSE, "S-1-5-1"}, {TRUE, "S-1-5-2"}, {TRUE, "S-1-5-3"}, {TRUE, "S-1-5-4"},
1476 /* 12 */ {TRUE, "S-1-5-6"}, {TRUE, "S-1-5-7"}, {TRUE, "S-1-5-8"}, {TRUE, "S-1-5-9"},
1477 /* 16 */ {TRUE, "S-1-5-10"}, {TRUE, "S-1-5-11"}, {TRUE, "S-1-5-12"}, {TRUE, "S-1-5-13"},
1478 /* 20 */ {TRUE, "S-1-5-14"}, {FALSE, NULL}, {TRUE, "S-1-5-18"}, {TRUE, "S-1-5-19"},
1479 /* 24 */ {TRUE, "S-1-5-20"}, {TRUE, "S-1-5-32"},
1480 /* 26 */ {FALSE, "S-1-5-32-544"}, {TRUE, "S-1-5-32-545"}, {TRUE, "S-1-5-32-546"},
1481 /* 29 */ {TRUE, "S-1-5-32-547"}, {TRUE, "S-1-5-32-548"}, {TRUE, "S-1-5-32-549"},
1482 /* 32 */ {TRUE, "S-1-5-32-550"}, {TRUE, "S-1-5-32-551"}, {TRUE, "S-1-5-32-552"},
1483 /* 35 */ {TRUE, "S-1-5-32-554"}, {TRUE, "S-1-5-32-555"}, {TRUE, "S-1-5-32-556"},
1484 /* 38 */ {FALSE, "S-1-5-21-12-23-34-45-56-500"}, {FALSE, "S-1-5-21-12-23-34-45-56-501"},
1485 /* 40 */ {FALSE, "S-1-5-21-12-23-34-45-56-502"}, {FALSE, "S-1-5-21-12-23-34-45-56-512"},
1486 /* 42 */ {FALSE, "S-1-5-21-12-23-34-45-56-513"}, {FALSE, "S-1-5-21-12-23-34-45-56-514"},
1487 /* 44 */ {FALSE, "S-1-5-21-12-23-34-45-56-515"}, {FALSE, "S-1-5-21-12-23-34-45-56-516"},
1488 /* 46 */ {FALSE, "S-1-5-21-12-23-34-45-56-517"}, {FALSE, "S-1-5-21-12-23-34-45-56-518"},
1489 /* 48 */ {FALSE, "S-1-5-21-12-23-34-45-56-519"}, {FALSE, "S-1-5-21-12-23-34-45-56-520"},
1490 /* 50 */ {FALSE, "S-1-5-21-12-23-34-45-56-553"},
1491 /* Added in Windows Server 2003 */
1492 /* 51 */ {TRUE, "S-1-5-64-10"}, {TRUE, "S-1-5-64-21"}, {TRUE, "S-1-5-64-14"},
1493 /* 54 */ {TRUE, "S-1-5-15"}, {TRUE, "S-1-5-1000"}, {FALSE, "S-1-5-32-557"},
1494 /* 57 */ {TRUE, "S-1-5-32-558"}, {TRUE, "S-1-5-32-559"}, {TRUE, "S-1-5-32-560"},
1495 /* 60 */ {TRUE, "S-1-5-32-561"}, {TRUE, "S-1-5-32-562"},
1496 /* Added in Windows Vista: */
1497 /* 62 */ {TRUE, "S-1-5-32-568"},
1498 /* 63 */ {TRUE, "S-1-5-17"}, {FALSE, "S-1-5-32-569"}, {TRUE, "S-1-16-0"},
1499 /* 66 */ {TRUE, "S-1-16-4096"}, {TRUE, "S-1-16-8192"}, {TRUE, "S-1-16-12288"},
1500 /* 69 */ {TRUE, "S-1-16-16384"}, {TRUE, "S-1-5-33"}, {TRUE, "S-1-3-4"},
1501 /* 72 */ {FALSE, "S-1-5-21-12-23-34-45-56-571"}, {FALSE, "S-1-5-21-12-23-34-45-56-572"},
1502 /* 74 */ {TRUE, "S-1-5-22"}, {FALSE, "S-1-5-21-12-23-34-45-56-521"}, {TRUE, "S-1-5-32-573"}
1503 };
1504
1505 static void test_CreateWellKnownSid(void)
1506 {
1507 SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
1508 PSID domainsid, sid;
1509 DWORD size, error;
1510 BOOL ret;
1511 unsigned int i;
1512
1513 if (!pCreateWellKnownSid)
1514 {
1515 win_skip("CreateWellKnownSid not available\n");
1516 return;
1517 }
1518
1519 size = 0;
1520 SetLastError(0xdeadbeef);
1521 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1522 error = GetLastError();
1523 ok(!ret, "CreateWellKnownSid succeeded\n");
1524 ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
1525 ok(size, "expected size > 0\n");
1526
1527 SetLastError(0xdeadbeef);
1528 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, NULL, &size);
1529 error = GetLastError();
1530 ok(!ret, "CreateWellKnownSid succeeded\n");
1531 ok(error == ERROR_INVALID_PARAMETER, "expected ERROR_INVALID_PARAMETER, got %u\n", error);
1532
1533 sid = HeapAlloc(GetProcessHeap(), 0, size);
1534 ret = pCreateWellKnownSid(WinInteractiveSid, NULL, sid, &size);
1535 ok(ret, "CreateWellKnownSid failed %u\n", GetLastError());
1536 HeapFree(GetProcessHeap(), 0, sid);
1537
1538 /* a domain sid usually have three subauthorities but we test that CreateWellKnownSid doesn't check it */
1539 AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
1540
1541 for (i = 0; i < sizeof(well_known_sid_values)/sizeof(well_known_sid_values[0]); i++)
1542 {
1543 const struct well_known_sid_value *value = &well_known_sid_values[i];
1544 char sid_buffer[SECURITY_MAX_SID_SIZE];
1545 LPSTR str;
1546 DWORD cb;
1547
1548 if (value->sid_string == NULL)
1549 continue;
1550
1551 if (i > WinAccountRasAndIasServersSid)
1552 {
1553 /* These SIDs aren't implemented by all Windows versions - detect it and break the loop */
1554 cb = sizeof(sid_buffer);
1555 if (!pCreateWellKnownSid(i, domainsid, sid_buffer, &cb))
1556 {
1557 skip("Well known SIDs starting from %u are not implemented\n", i);
1558 break;
1559 }
1560 }
1561
1562 cb = sizeof(sid_buffer);
1563 ok(pCreateWellKnownSid(i, value->without_domain ? NULL : domainsid, sid_buffer, &cb), "Couldn't create well known sid %u\n", i);
1564 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
1565 ok(IsValidSid(sid_buffer), "The sid is not valid\n");
1566 ok(pConvertSidToStringSidA(sid_buffer, &str), "Couldn't convert SID to string\n");
1567 ok(strcmp(str, value->sid_string) == 0, "SID mismatch - expected %s, got %s\n",
1568 value->sid_string, str);
1569 LocalFree(str);
1570
1571 if (value->without_domain)
1572 {
1573 char buf2[SECURITY_MAX_SID_SIZE];
1574 cb = sizeof(buf2);
1575 ok(pCreateWellKnownSid(i, domainsid, buf2, &cb), "Couldn't create well known sid %u with optional domain\n", i);
1576 expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d");
1577 ok(memcmp(buf2, sid_buffer, cb) == 0, "SID create with domain is different than without (%u)\n", i);
1578 }
1579 }
1580
1581 FreeSid(domainsid);
1582 }
1583
1584 static void test_LookupAccountSid(void)
1585 {
1586 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1587 CHAR accountA[MAX_PATH], domainA[MAX_PATH], usernameA[MAX_PATH];
1588 DWORD acc_sizeA, dom_sizeA, user_sizeA;
1589 DWORD real_acc_sizeA, real_dom_sizeA;
1590 WCHAR accountW[MAX_PATH], domainW[MAX_PATH];
1591 DWORD acc_sizeW, dom_sizeW;
1592 DWORD real_acc_sizeW, real_dom_sizeW;
1593 PSID pUsersSid = NULL;
1594 SID_NAME_USE use;
1595 BOOL ret;
1596 DWORD error, size, cbti = 0;
1597 MAX_SID max_sid;
1598 CHAR *str_sidA;
1599 int i;
1600 HANDLE hToken;
1601 PTOKEN_USER ptiUser = NULL;
1602
1603 /* native windows crashes if account size, domain size, or name use is NULL */
1604
1605 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1606 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &pUsersSid);
1607 ok(ret || (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED),
1608 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1609
1610 /* not running on NT so give up */
1611 if (!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1612 return;
1613
1614 real_acc_sizeA = MAX_PATH;
1615 real_dom_sizeA = MAX_PATH;
1616 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1617 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1618
1619 /* try NULL account */
1620 acc_sizeA = MAX_PATH;
1621 dom_sizeA = MAX_PATH;
1622 ret = LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1623 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1624
1625 /* try NULL domain */
1626 acc_sizeA = MAX_PATH;
1627 dom_sizeA = MAX_PATH;
1628 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1629 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1630
1631 /* try a small account buffer */
1632 acc_sizeA = 1;
1633 dom_sizeA = MAX_PATH;
1634 accountA[0] = 0;
1635 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1636 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1637 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1638 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1639
1640 /* try a 0 sized account buffer */
1641 acc_sizeA = 0;
1642 dom_sizeA = MAX_PATH;
1643 accountA[0] = 0;
1644 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1645 /* this can fail or succeed depending on OS version but the size will always be returned */
1646 ok(acc_sizeA == real_acc_sizeA + 1,
1647 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1648 real_acc_sizeA + 1, acc_sizeA);
1649
1650 /* try a 0 sized account buffer */
1651 acc_sizeA = 0;
1652 dom_sizeA = MAX_PATH;
1653 LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1654 /* this can fail or succeed depending on OS version but the size will always be returned */
1655 ok(acc_sizeA == real_acc_sizeA + 1,
1656 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1657 real_acc_sizeA + 1, acc_sizeA);
1658
1659 /* try a small domain buffer */
1660 dom_sizeA = 1;
1661 acc_sizeA = MAX_PATH;
1662 accountA[0] = 0;
1663 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1664 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1665 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1666 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1667
1668 /* try a 0 sized domain buffer */
1669 dom_sizeA = 0;
1670 acc_sizeA = MAX_PATH;
1671 accountA[0] = 0;
1672 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1673 /* this can fail or succeed depending on OS version but the size will always be returned */
1674 ok(dom_sizeA == real_dom_sizeA + 1,
1675 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1676 real_dom_sizeA + 1, dom_sizeA);
1677
1678 /* try a 0 sized domain buffer */
1679 dom_sizeA = 0;
1680 acc_sizeA = MAX_PATH;
1681 LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1682 /* this can fail or succeed depending on OS version but the size will always be returned */
1683 ok(dom_sizeA == real_dom_sizeA + 1,
1684 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1685 real_dom_sizeA + 1, dom_sizeA);
1686
1687 real_acc_sizeW = MAX_PATH;
1688 real_dom_sizeW = MAX_PATH;
1689 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &real_acc_sizeW, domainW, &real_dom_sizeW, &use);
1690 ok(ret, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1691
1692 /* try an invalid system name */
1693 real_acc_sizeA = MAX_PATH;
1694 real_dom_sizeA = MAX_PATH;
1695 ret = LookupAccountSidA("deepthought", pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1696 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1697 ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
1698 "LookupAccountSidA() Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %u\n", GetLastError());
1699
1700 /* native windows crashes if domainW or accountW is NULL */
1701
1702 /* try a small account buffer */
1703 acc_sizeW = 1;
1704 dom_sizeW = MAX_PATH;
1705 accountW[0] = 0;
1706 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1707 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1708 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1709 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1710
1711 /* try a 0 sized account buffer */
1712 acc_sizeW = 0;
1713 dom_sizeW = MAX_PATH;
1714 accountW[0] = 0;
1715 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1716 /* this can fail or succeed depending on OS version but the size will always be returned */
1717 ok(acc_sizeW == real_acc_sizeW + 1,
1718 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1719 real_acc_sizeW + 1, acc_sizeW);
1720
1721 /* try a 0 sized account buffer */
1722 acc_sizeW = 0;
1723 dom_sizeW = MAX_PATH;
1724 LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, domainW, &dom_sizeW, &use);
1725 /* this can fail or succeed depending on OS version but the size will always be returned */
1726 ok(acc_sizeW == real_acc_sizeW + 1,
1727 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1728 real_acc_sizeW + 1, acc_sizeW);
1729
1730 /* try a small domain buffer */
1731 dom_sizeW = 1;
1732 acc_sizeW = MAX_PATH;
1733 accountW[0] = 0;
1734 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1735 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1736 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1737 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1738
1739 /* try a 0 sized domain buffer */
1740 dom_sizeW = 0;
1741 acc_sizeW = MAX_PATH;
1742 accountW[0] = 0;
1743 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1744 /* this can fail or succeed depending on OS version but the size will always be returned */
1745 ok(dom_sizeW == real_dom_sizeW + 1,
1746 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1747 real_dom_sizeW + 1, dom_sizeW);
1748
1749 /* try a 0 sized domain buffer */
1750 dom_sizeW = 0;
1751 acc_sizeW = MAX_PATH;
1752 LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, NULL, &dom_sizeW, &use);
1753 /* this can fail or succeed depending on OS version but the size will always be returned */
1754 ok(dom_sizeW == real_dom_sizeW + 1,
1755 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1756 real_dom_sizeW + 1, dom_sizeW);
1757
1758 acc_sizeW = dom_sizeW = use = 0;
1759 SetLastError(0xdeadbeef);
1760 ret = LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, NULL, &dom_sizeW, &use);
1761 error = GetLastError();
1762 ok(!ret, "LookupAccountSidW failed %u\n", GetLastError());
1763 ok(error == ERROR_INSUFFICIENT_BUFFER, "expected ERROR_INSUFFICIENT_BUFFER, got %u\n", error);
1764 ok(acc_sizeW, "expected non-zero account size\n");
1765 ok(dom_sizeW, "expected non-zero domain size\n");
1766 ok(!use, "expected zero use %u\n", use);
1767
1768 FreeSid(pUsersSid);
1769
1770 /* Test LookupAccountSid with Sid retrieved from token information.
1771 This assumes this process is running under the account of the current user.*/
1772 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY|TOKEN_DUPLICATE, &hToken);
1773 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1774 ret = GetTokenInformation(hToken, TokenUser, NULL, 0, &cbti);
1775 ok(!ret, "GetTokenInformation failed with error %d\n", GetLastError());
1776 ptiUser = HeapAlloc(GetProcessHeap(), 0, cbti);
1777 if (GetTokenInformation(hToken, TokenUser, ptiUser, cbti, &cbti))
1778 {
1779 acc_sizeA = dom_sizeA = MAX_PATH;
1780 ret = LookupAccountSidA(NULL, ptiUser->User.Sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1781 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1782 user_sizeA = MAX_PATH;
1783 ret = GetUserNameA(usernameA , &user_sizeA);
1784 ok(ret, "GetUserNameA() Expected TRUE, got FALSE\n");
1785 ok(lstrcmpA(usernameA, accountA) == 0, "LookupAccountSidA() Expected account name: %s got: %s\n", usernameA, accountA );
1786 }
1787 HeapFree(GetProcessHeap(), 0, ptiUser);
1788
1789 if (pCreateWellKnownSid && pConvertSidToStringSidA)
1790 {
1791 trace("Well Known SIDs:\n");
1792 for (i = 0; i <= 60; i++)
1793 {
1794 size = SECURITY_MAX_SID_SIZE;
1795 if (pCreateWellKnownSid(i, NULL, &max_sid.sid, &size))
1796 {
1797 if (pConvertSidToStringSidA(&max_sid.sid, &str_sidA))
1798 {
1799 acc_sizeA = MAX_PATH;
1800 dom_sizeA = MAX_PATH;
1801 if (LookupAccountSidA(NULL, &max_sid.sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use))
1802 trace(" %d: %s %s\\%s %d\n", i, str_sidA, domainA, accountA, use);
1803 LocalFree(str_sidA);
1804 }
1805 }
1806 else
1807 {
1808 if (GetLastError() != ERROR_INVALID_PARAMETER)
1809 trace(" CreateWellKnownSid(%d) failed: %d\n", i, GetLastError());
1810 else
1811 trace(" %d: not supported\n", i);
1812 }
1813 }
1814
1815 pLsaQueryInformationPolicy = (void *)GetProcAddress( hmod, "LsaQueryInformationPolicy");
1816 pLsaOpenPolicy = (void *)GetProcAddress( hmod, "LsaOpenPolicy");
1817 pLsaFreeMemory = (void *)GetProcAddress( hmod, "LsaFreeMemory");
1818 pLsaClose = (void *)GetProcAddress( hmod, "LsaClose");
1819
1820 if (pLsaQueryInformationPolicy && pLsaOpenPolicy && pLsaFreeMemory && pLsaClose)
1821 {
1822 NTSTATUS status;
1823 LSA_HANDLE handle;
1824 LSA_OBJECT_ATTRIBUTES object_attributes;
1825
1826 ZeroMemory(&object_attributes, sizeof(object_attributes));
1827 object_attributes.Length = sizeof(object_attributes);
1828
1829 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_ALL_ACCESS, &handle);
1830 ok(status == STATUS_SUCCESS || status == STATUS_ACCESS_DENIED,
1831 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status);
1832
1833 /* try a more restricted access mask if necessary */
1834 if (status == STATUS_ACCESS_DENIED) {
1835 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
1836 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_VIEW_LOCAL_INFORMATION, &handle);
1837 ok(status == STATUS_SUCCESS, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status);
1838 }
1839
1840 if (status == STATUS_SUCCESS)
1841 {
1842 PPOLICY_ACCOUNT_DOMAIN_INFO info;
1843 status = pLsaQueryInformationPolicy(handle, PolicyAccountDomainInformation, (PVOID*)&info);
1844 ok(status == STATUS_SUCCESS, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status);
1845 if (status == STATUS_SUCCESS)
1846 {
1847 ok(info->DomainSid!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
1848 if (info->DomainSid)
1849 {
1850 int count = *GetSidSubAuthorityCount(info->DomainSid);
1851 CopySid(GetSidLengthRequired(count), &max_sid, info->DomainSid);
1852 test_sid_str((PSID)&max_sid.sid);
1853 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_ADMIN;
1854 max_sid.sid.SubAuthorityCount = count + 1;
1855 test_sid_str((PSID)&max_sid.sid);
1856 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_GUEST;
1857 test_sid_str((PSID)&max_sid.sid);
1858 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ADMINS;
1859 test_sid_str((PSID)&max_sid.sid);
1860 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_USERS;
1861 test_sid_str((PSID)&max_sid.sid);
1862 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_GUESTS;
1863 test_sid_str((PSID)&max_sid.sid);
1864 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_COMPUTERS;
1865 test_sid_str((PSID)&max_sid.sid);
1866 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CONTROLLERS;
1867 test_sid_str((PSID)&max_sid.sid);
1868 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CERT_ADMINS;
1869 test_sid_str((PSID)&max_sid.sid);
1870 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_SCHEMA_ADMINS;
1871 test_sid_str((PSID)&max_sid.sid);
1872 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS;
1873 test_sid_str((PSID)&max_sid.sid);
1874 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_POLICY_ADMINS;
1875 test_sid_str((PSID)&max_sid.sid);
1876 max_sid.sid.SubAuthority[count] = DOMAIN_ALIAS_RID_RAS_SERVERS;
1877 test_sid_str((PSID)&max_sid.sid);
1878 max_sid.sid.SubAuthority[count] = 1000; /* first user account */
1879 test_sid_str((PSID)&max_sid.sid);
1880 }
1881
1882 pLsaFreeMemory((LPVOID)info);
1883 }
1884
1885 status = pLsaClose(handle);
1886 ok(status == STATUS_SUCCESS, "LsaClose() failed, returned 0x%08x\n", status);
1887 }
1888 }
1889 }
1890 }
1891
1892 static BOOL get_sid_info(PSID psid, LPSTR *user, LPSTR *dom)
1893 {
1894 static CHAR account[UNLEN + 1];
1895 static CHAR domain[UNLEN + 1];
1896 DWORD size, dom_size;
1897 SID_NAME_USE use;
1898
1899 *user = account;
1900 *dom = domain;
1901
1902 size = dom_size = UNLEN + 1;
1903 account[0] = '\0';
1904 domain[0] = '\0';
1905 SetLastError(0xdeadbeef);
1906 return LookupAccountSidA(NULL, psid, account, &size, domain, &dom_size, &use);
1907 }
1908
1909 static void check_wellknown_name(const char* name, WELL_KNOWN_SID_TYPE result)
1910 {
1911 SID_IDENTIFIER_AUTHORITY ident = { SECURITY_NT_AUTHORITY };
1912 PSID domainsid = NULL;
1913 char wk_sid[SECURITY_MAX_SID_SIZE];
1914 DWORD cb;
1915
1916 DWORD sid_size, domain_size;
1917 SID_NAME_USE sid_use;
1918 LPSTR domain, account, sid_domain, wk_domain, wk_account;
1919 PSID psid;
1920 BOOL ret ,ret2;
1921
1922 sid_size = 0;
1923 domain_size = 0;
1924 ret = LookupAccountNameA(NULL, name, NULL, &sid_size, NULL, &domain_size, &sid_use);
1925 ok(!ret, " %s Should have failed to lookup account name\n", name);
1926 psid = HeapAlloc(GetProcessHeap(),0,sid_size);
1927 domain = HeapAlloc(GetProcessHeap(),0,domain_size);
1928 ret = LookupAccountNameA(NULL, name, psid, &sid_size, domain, &domain_size, &sid_use);
1929
1930 if (!result)
1931 {
1932 ok(!ret, " %s Should have failed to lookup account name\n",name);
1933 goto cleanup;
1934 }
1935
1936 AllocateAndInitializeSid(&ident, 6, SECURITY_NT_NON_UNIQUE, 12, 23, 34, 45, 56, 0, 0, &domainsid);
1937 cb = sizeof(wk_sid);
1938 if (!pCreateWellKnownSid(result, domainsid, wk_sid, &cb))
1939 {
1940 win_skip("SID %i is not available on the system\n",result);
1941 goto cleanup;
1942 }
1943
1944 ret2 = get_sid_info(wk_sid, &wk_account, &wk_domain);
1945 if (!ret2 && GetLastError() == ERROR_NONE_MAPPED)
1946 {
1947 win_skip("CreateWellKnownSid() succeeded but the account '%s' is not present (W2K)\n", name);
1948 goto cleanup;
1949 }
1950
1951 get_sid_info(psid, &account, &sid_domain);
1952
1953 ok(ret, "Failed to lookup account name %s\n",name);
1954 ok(sid_size != 0, "sid_size was zero\n");
1955
1956 ok(EqualSid(psid,wk_sid),"(%s) Sids fail to match well known sid!\n",name);
1957
1958 ok(!lstrcmp(account, wk_account), "Expected %s , got %s\n", account, wk_account);
1959 ok(!lstrcmp(domain, wk_domain), "Expected %s, got %s\n", wk_domain, domain);
1960 ok(sid_use == SidTypeWellKnownGroup , "Expected Use (5), got %d\n", sid_use);
1961
1962 cleanup:
1963 FreeSid(domainsid);
1964 HeapFree(GetProcessHeap(),0,psid);
1965 HeapFree(GetProcessHeap(),0,domain);
1966 }
1967
1968 static void test_LookupAccountName(void)
1969 {
1970 DWORD sid_size, domain_size, user_size;
1971 DWORD sid_save, domain_save;
1972 CHAR user_name[UNLEN + 1];
1973 CHAR computer_name[UNLEN + 1];
1974 SID_NAME_USE sid_use;
1975 LPSTR domain, account, sid_dom;
1976 PSID psid;
1977 BOOL ret;
1978
1979 /* native crashes if (assuming all other parameters correct):
1980 * - peUse is NULL
1981 * - Sid is NULL and cbSid is > 0
1982 * - cbSid or cchReferencedDomainName are NULL
1983 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
1984 */
1985
1986 user_size = UNLEN + 1;
1987 SetLastError(0xdeadbeef);
1988 ret = GetUserNameA(user_name, &user_size);
1989 ok(ret, "Failed to get user name : %d\n", GetLastError());
1990
1991 /* get sizes */
1992 sid_size = 0;
1993 domain_size = 0;
1994 sid_use = 0xcafebabe;
1995 SetLastError(0xdeadbeef);
1996 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
1997 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1998 {
1999 win_skip("LookupAccountNameA is not implemented\n");
2000 return;
2001 }
2002 ok(!ret, "Expected 0, got %d\n", ret);
2003 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2004 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2005 ok(sid_size != 0, "Expected non-zero sid size\n");
2006 ok(domain_size != 0, "Expected non-zero domain size\n");
2007 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2008
2009 sid_save = sid_size;
2010 domain_save = domain_size;
2011
2012 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2013 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2014
2015 /* try valid account name */
2016 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, domain, &domain_size, &sid_use);
2017 get_sid_info(psid, &account, &sid_dom);
2018 ok(ret, "Failed to lookup account name\n");
2019 ok(sid_size == GetLengthSid(psid), "Expected %d, got %d\n", GetLengthSid(psid), sid_size);
2020 ok(!lstrcmp(account, user_name), "Expected %s, got %s\n", user_name, account);
2021 ok(!lstrcmp(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2022 ok(domain_size == domain_save - 1, "Expected %d, got %d\n", domain_save - 1, domain_size);
2023 ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlen(domain), domain_size);
2024 ok(sid_use == SidTypeUser, "Expected SidTypeUser (%d), got %d\n", SidTypeUser, sid_use);
2025 domain_size = domain_save;
2026 sid_size = sid_save;
2027
2028 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2029 {
2030 skip("Non-english locale (test with hardcoded 'Everyone')\n");
2031 }
2032 else
2033 {
2034 ret = LookupAccountNameA(NULL, "Everyone", psid, &sid_size, domain, &domain_size, &sid_use);
2035 get_sid_info(psid, &account, &sid_dom);
2036 ok(ret, "Failed to lookup account name\n");
2037 ok(sid_size != 0, "sid_size was zero\n");
2038 ok(!lstrcmp(account, "Everyone"), "Expected Everyone, got %s\n", account);
2039 ok(!lstrcmp(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
2040 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2041 ok(strlen(domain) == domain_size, "Expected %d, got %d\n", lstrlen(domain), domain_size);
2042 ok(sid_use == SidTypeWellKnownGroup, "Expected SidTypeWellKnownGroup (%d), got %d\n", SidTypeWellKnownGroup, sid_use);
2043 domain_size = domain_save;
2044 }
2045
2046 /* NULL Sid with zero sid size */
2047 SetLastError(0xdeadbeef);
2048 sid_size = 0;
2049 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2050 ok(!ret, "Expected 0, got %d\n", ret);
2051 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2052 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2053 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2054 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2055
2056 /* try cchReferencedDomainName - 1 */
2057 SetLastError(0xdeadbeef);
2058 domain_size--;
2059 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
2060 ok(!ret, "Expected 0, got %d\n", ret);
2061 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2062 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2063 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2064 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2065
2066 /* NULL ReferencedDomainName with zero domain name size */
2067 SetLastError(0xdeadbeef);
2068 domain_size = 0;
2069 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, NULL, &domain_size, &sid_use);
2070 ok(!ret, "Expected 0, got %d\n", ret);
2071 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2072 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2073 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
2074 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
2075
2076 HeapFree(GetProcessHeap(), 0, psid);
2077 HeapFree(GetProcessHeap(), 0, domain);
2078
2079 /* get sizes for NULL account name */
2080 sid_size = 0;
2081 domain_size = 0;
2082 sid_use = 0xcafebabe;
2083 SetLastError(0xdeadbeef);
2084 ret = LookupAccountNameA(NULL, NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2085 if (!ret && GetLastError() == ERROR_NONE_MAPPED)
2086 win_skip("NULL account name doesn't work on NT4\n");
2087 else
2088 {
2089 ok(!ret, "Expected 0, got %d\n", ret);
2090 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2091 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2092 ok(sid_size != 0, "Expected non-zero sid size\n");
2093 ok(domain_size != 0, "Expected non-zero domain size\n");
2094 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
2095
2096 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2097 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2098
2099 /* try NULL account name */
2100 ret = LookupAccountNameA(NULL, NULL, psid, &sid_size, domain, &domain_size, &sid_use);
2101 get_sid_info(psid, &account, &sid_dom);
2102 ok(ret, "Failed to lookup account name\n");
2103 /* Using a fixed string will not work on different locales */
2104 ok(!lstrcmp(account, domain),
2105 "Got %s for account and %s for domain, these should be the same\n",
2106 account, domain);
2107 ok(sid_use == SidTypeDomain, "Expected SidTypeDomain (%d), got %d\n", SidTypeDomain, sid_use);
2108
2109 HeapFree(GetProcessHeap(), 0, psid);
2110 HeapFree(GetProcessHeap(), 0, domain);
2111 }
2112
2113 /* try an invalid account name */
2114 SetLastError(0xdeadbeef);
2115 sid_size = 0;
2116 domain_size = 0;
2117 ret = LookupAccountNameA(NULL, "oogabooga", NULL, &sid_size, NULL, &domain_size, &sid_use);
2118 ok(!ret, "Expected 0, got %d\n", ret);
2119 ok(GetLastError() == ERROR_NONE_MAPPED ||
2120 broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE),
2121 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
2122 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2123 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2124
2125 /* try an invalid system name */
2126 SetLastError(0xdeadbeef);
2127 sid_size = 0;
2128 domain_size = 0;
2129 ret = LookupAccountNameA("deepthought", NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
2130 ok(!ret, "Expected 0, got %d\n", ret);
2131 ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE || GetLastError() == RPC_S_INVALID_NET_ADDR /* Vista */,
2132 "Expected RPC_S_SERVER_UNAVAILABLE or RPC_S_INVALID_NET_ADDR, got %d\n", GetLastError());
2133 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
2134 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
2135
2136 /* try with the computer name as the account name */
2137 domain_size = sizeof(computer_name);
2138 GetComputerNameA(computer_name, &domain_size);
2139 sid_size = 0;
2140 domain_size = 0;
2141 ret = LookupAccountNameA(NULL, computer_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
2142 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER ||
2143 GetLastError() == ERROR_NONE_MAPPED /* in a domain */ ||
2144 broken(GetLastError() == ERROR_TRUSTED_DOMAIN_FAILURE) ||
2145 broken(GetLastError() == ERROR_TRUSTED_RELATIONSHIP_FAILURE)),
2146 "LookupAccountNameA failed: %d\n", GetLastError());
2147 if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
2148 {
2149 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
2150 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
2151 ret = LookupAccountNameA(NULL, computer_name, psid, &sid_size, domain, &domain_size, &sid_use);
2152 ok(ret, "LookupAccountNameA failed: %d\n", GetLastError());
2153 ok(sid_use == SidTypeDomain ||
2154 (sid_use == SidTypeUser && ! strcmp(computer_name, user_name)), "expected SidTypeDomain for %s, got %d\n", computer_name, sid_use);
2155 HeapFree(GetProcessHeap(), 0, domain);
2156 HeapFree(GetProcessHeap(), 0, psid);
2157 }
2158
2159 /* Well Known names */
2160 if (!pCreateWellKnownSid)
2161 {
2162 win_skip("CreateWellKnownSid not available\n");
2163 return;
2164 }
2165
2166 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2167 {
2168 skip("Non-english locale (skipping well known name creation tests)\n");
2169 return;
2170 }
2171
2172 check_wellknown_name("LocalService", WinLocalServiceSid);
2173 check_wellknown_name("Local Service", WinLocalServiceSid);
2174 /* 2 spaces */
2175 check_wellknown_name("Local Service", 0);
2176 check_wellknown_name("NetworkService", WinNetworkServiceSid);
2177 check_wellknown_name("Network Service", WinNetworkServiceSid);
2178
2179 /* example of some names where the spaces are not optional */
2180 check_wellknown_name("Terminal Server User", WinTerminalServerSid);
2181 check_wellknown_name("TerminalServer User", 0);
2182 check_wellknown_name("TerminalServerUser", 0);
2183 check_wellknown_name("Terminal ServerUser", 0);
2184
2185 check_wellknown_name("enterprise domain controllers",WinEnterpriseControllersSid);
2186 check_wellknown_name("enterprisedomain controllers", 0);
2187 check_wellknown_name("enterprise domaincontrollers", 0);
2188 check_wellknown_name("enterprisedomaincontrollers", 0);
2189
2190 /* case insensitivity */
2191 check_wellknown_name("lOCAlServICE", WinLocalServiceSid);
2192
2193 /* fully qualified account names */
2194 check_wellknown_name("NT AUTHORITY\\LocalService", WinLocalServiceSid);
2195 check_wellknown_name("nt authority\\Network Service", WinNetworkServiceSid);
2196 check_wellknown_name("nt authority test\\Network Service", 0);
2197 check_wellknown_name("Dummy\\Network Service", 0);
2198 check_wellknown_name("ntauthority\\Network Service", 0);
2199 }
2200
2201 static void test_security_descriptor(void)
2202 {
2203 SECURITY_DESCRIPTOR sd;
2204 char buf[8192];
2205 DWORD size;
2206 BOOL isDefault, isPresent, ret;
2207 PACL pacl;
2208 PSID psid;
2209
2210 SetLastError(0xdeadbeef);
2211 ret = InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION);
2212 if (ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2213 {
2214 win_skip("InitializeSecurityDescriptor is not implemented\n");
2215 return;
2216 }
2217
2218 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2219 expect_eq(psid, NULL, PSID, "%p");
2220 expect_eq(isDefault, FALSE, BOOL, "%d");
2221 sd.Control |= SE_DACL_PRESENT | SE_SACL_PRESENT;
2222
2223 SetLastError(0xdeadbeef);
2224 size = 5;
2225 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), FALSE, BOOL, "%d");
2226 expect_eq(GetLastError(), ERROR_INSUFFICIENT_BUFFER, DWORD, "%u");
2227 ok(size > 5, "Size not increased\n");
2228 if (size <= 8192)
2229 {
2230 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), TRUE, BOOL, "%d");
2231 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
2232 expect_eq(psid, NULL, PSID, "%p");
2233 expect_eq(isDefault, FALSE, BOOL, "%d");
2234 ok(GetSecurityDescriptorGroup(&sd, &psid, &isDefault), "GetSecurityDescriptorGroup failed\n");
2235 expect_eq(psid, NULL, PSID, "%p");
2236 expect_eq(isDefault, FALSE, BOOL, "%d");
2237 ok(GetSecurityDescriptorDacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorDacl failed\n");
2238 expect_eq(isPresent, TRUE, BOOL, "%d");
2239 expect_eq(psid, NULL, PSID, "%p");
2240 expect_eq(isDefault, FALSE, BOOL, "%d");
2241 ok(GetSecurityDescriptorSacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorSacl failed\n");
2242 expect_eq(isPresent, TRUE, BOOL, "%d");
2243 expect_eq(psid, NULL, PSID, "%p");
2244 expect_eq(isDefault, FALSE, BOOL, "%d");
2245 }
2246 }
2247
2248 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,0,__LINE__)
2249 #define TEST_GRANTED_ACCESS2(a,b,c) test_granted_access(a,b,c,__LINE__)
2250 static void test_granted_access(HANDLE handle, ACCESS_MASK access,
2251 ACCESS_MASK alt, int line)
2252 {
2253 OBJECT_BASIC_INFORMATION obj_info;
2254 NTSTATUS status;
2255
2256 if (!pNtQueryObject)
2257 {
2258 skip_(__FILE__, line)("Not NT platform - skipping tests\n");
2259 return;
2260 }
2261
2262 status = pNtQueryObject( handle, ObjectBasicInformation, &obj_info,
2263 sizeof(obj_info), NULL );
2264 ok_(__FILE__, line)(!status, "NtQueryObject with err: %08x\n", status);
2265 if (alt)
2266 ok_(__FILE__, line)(obj_info.GrantedAccess == access ||
2267 obj_info.GrantedAccess == alt, "Granted access should be 0x%08x "
2268 "or 0x%08x, instead of 0x%08x\n", access, alt, obj_info.GrantedAccess);
2269 else
2270 ok_(__FILE__, line)(obj_info.GrantedAccess == access, "Granted access should "
2271 "be 0x%08x, instead of 0x%08x\n", access, obj_info.GrantedAccess);
2272 }
2273
2274 #define CHECK_SET_SECURITY(o,i,e) \
2275 do{ \
2276 BOOL res; \
2277 DWORD err; \
2278 SetLastError( 0xdeadbeef ); \
2279 res = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
2280 err = GetLastError(); \
2281 if (e == ERROR_SUCCESS) \
2282 ok(res, "SetKernelObjectSecurity failed with %d\n", err); \
2283 else \
2284 ok(!res && err == e, "SetKernelObjectSecurity should have failed " \
2285 "with %s, instead of %d\n", #e, err); \
2286 }while(0)
2287
2288 static void test_process_security(void)
2289 {
2290 BOOL res;
2291 PTOKEN_OWNER owner;
2292 PTOKEN_PRIMARY_GROUP group;
2293 PSID AdminSid = NULL, UsersSid = NULL;
2294 PACL Acl = NULL;
2295 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
2296 char buffer[MAX_PATH];
2297 PROCESS_INFORMATION info;
2298 STARTUPINFOA startup;
2299 SECURITY_ATTRIBUTES psa;
2300 HANDLE token, event;
2301 DWORD size;
2302
2303 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
2304 res = InitializeAcl(Acl, 256, ACL_REVISION);
2305 if (!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2306 {
2307 win_skip("ACLs not implemented - skipping tests\n");
2308 HeapFree(GetProcessHeap(), 0, Acl);
2309 return;
2310 }
2311 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2312
2313 /* get owner from the token we might be running as a user not admin */
2314 res = OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED, &token );
2315 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
2316 if (!res)
2317 {
2318 HeapFree(GetProcessHeap(), 0, Acl);
2319 return;
2320 }
2321
2322 res = GetTokenInformation( token, TokenOwner, NULL, 0, &size );
2323 ok(!res, "Expected failure, got %d\n", res);
2324 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2325 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2326
2327 owner = HeapAlloc(GetProcessHeap(), 0, size);
2328 res = GetTokenInformation( token, TokenOwner, owner, size, &size );
2329 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2330 AdminSid = ((TOKEN_OWNER*)owner)->Owner;
2331
2332 res = GetTokenInformation( token, TokenPrimaryGroup, NULL, 0, &size );
2333 ok(!res, "Expected failure, got %d\n", res);
2334 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
2335 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
2336
2337 group = HeapAlloc(GetProcessHeap(), 0, size);
2338 res = GetTokenInformation( token, TokenPrimaryGroup, group, size, &size );
2339 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
2340 UsersSid = ((TOKEN_PRIMARY_GROUP*)group)->PrimaryGroup;
2341
2342 CloseHandle( token );
2343 if (!res)
2344 {
2345 HeapFree(GetProcessHeap(), 0, group);
2346 HeapFree(GetProcessHeap(), 0, owner);
2347 HeapFree(GetProcessHeap(), 0, Acl);
2348 return;
2349 }
2350
2351 res = AddAccessDeniedAce(Acl, ACL_REVISION, PROCESS_VM_READ, AdminSid);
2352 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
2353 res = AddAccessAllowedAce(Acl, ACL_REVISION, PROCESS_ALL_ACCESS, AdminSid);
2354 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2355
2356 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
2357 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
2358 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
2359
2360 event = CreateEvent( NULL, TRUE, TRUE, "test_event" );
2361 ok(event != NULL, "CreateEvent %d\n", GetLastError());
2362
2363 SecurityDescriptor->Revision = 0;
2364 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_UNKNOWN_REVISION );
2365 SecurityDescriptor->Revision = SECURITY_DESCRIPTOR_REVISION;
2366
2367 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2368 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
2369 CHECK_SET_SECURITY( event, SACL_SECURITY_INFORMATION, ERROR_ACCESS_DENIED );
2370 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2371 /* NULL DACL is valid and means default DACL from token */
2372 SecurityDescriptor->Control |= SE_DACL_PRESENT;
2373 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2374
2375 /* Set owner and group and dacl */
2376 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
2377 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
2378 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_SUCCESS );
2379 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, FALSE);
2380 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2381 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_SUCCESS );
2382 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
2383 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
2384 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
2385
2386 sprintf(buffer, "%s tests/security.c test", myARGV[0]);
2387 memset(&startup, 0, sizeof(startup));
2388 startup.cb = sizeof(startup);
2389 startup.dwFlags = STARTF_USESHOWWINDOW;
2390 startup.wShowWindow = SW_SHOWNORMAL;
2391
2392 psa.nLength = sizeof(psa);
2393 psa.lpSecurityDescriptor = SecurityDescriptor;
2394 psa.bInheritHandle = TRUE;
2395
2396 /* Doesn't matter what ACL say we should get full access for ourselves */
2397 res = CreateProcessA( NULL, buffer, &psa, NULL, FALSE, 0, NULL, NULL, &startup, &info );
2398 ok(res, "CreateProcess with err:%d\n", GetLastError());
2399 TEST_GRANTED_ACCESS2( info.hProcess, PROCESS_ALL_ACCESS,
2400 STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
2401 winetest_wait_child_process( info.hProcess );
2402
2403 CloseHandle( info.hProcess );
2404 CloseHandle( info.hThread );
2405 CloseHandle( event );
2406 HeapFree(GetProcessHeap(), 0, group);
2407 HeapFree(GetProcessHeap(), 0, owner);
2408 HeapFree(GetProcessHeap(), 0, Acl);
2409 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
2410 }
2411
2412 static void test_process_security_child(void)
2413 {
2414 HANDLE handle, handle1;
2415 BOOL ret;
2416 DWORD err;
2417
2418 handle = OpenProcess( PROCESS_TERMINATE, FALSE, GetCurrentProcessId() );
2419 ok(handle != NULL, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
2420 TEST_GRANTED_ACCESS( handle, PROCESS_TERMINATE );
2421
2422 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2423 &handle1, 0, TRUE, DUPLICATE_SAME_ACCESS );
2424 ok(ret, "duplicating handle err:%d\n", GetLastError());
2425 TEST_GRANTED_ACCESS( handle1, PROCESS_TERMINATE );
2426
2427 CloseHandle( handle1 );
2428
2429 SetLastError( 0xdeadbeef );
2430 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2431 &handle1, PROCESS_ALL_ACCESS, TRUE, 0 );
2432 err = GetLastError();
2433 todo_wine
2434 ok(!ret && err == ERROR_ACCESS_DENIED, "duplicating handle should have failed "
2435 "with STATUS_ACCESS_DENIED, instead of err:%d\n", err);
2436
2437 CloseHandle( handle );
2438
2439 /* These two should fail - they are denied by ACL */
2440 handle = OpenProcess( PROCESS_VM_READ, FALSE, GetCurrentProcessId() );
2441 todo_wine
2442 ok(handle == NULL, "OpenProcess(PROCESS_VM_READ) should have failed\n");
2443 handle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId() );
2444 todo_wine
2445 ok(handle == NULL, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
2446
2447 /* Documented privilege elevation */
2448 ret = DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
2449 &handle, 0, TRUE, DUPLICATE_SAME_ACCESS );
2450 ok(ret, "duplicating handle err:%d\n", GetLastError());
2451 TEST_GRANTED_ACCESS2( handle, PROCESS_ALL_ACCESS,
2452 STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL );
2453
2454 CloseHandle( handle );
2455
2456 /* Same only explicitly asking for all access rights */
2457 ret = DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
2458 &handle, PROCESS_ALL_ACCESS, TRUE, 0 );
2459 ok(ret, "duplicating handle err:%d\n", GetLastError());
2460 TEST_GRANTED_ACCESS2( handle, PROCESS_ALL_ACCESS,
2461 PROCESS_ALL_ACCESS | PROCESS_QUERY_LIMITED_INFORMATION );
2462 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
2463 &handle1, PROCESS_VM_READ, TRUE, 0 );
2464 ok(ret, "duplicating handle err:%d\n", GetLastError());
2465 TEST_GRANTED_ACCESS( handle1, PROCESS_VM_READ );
2466 CloseHandle( handle1 );
2467 CloseHandle( handle );
2468 }
2469
2470 static void test_impersonation_level(void)
2471 {
2472 HANDLE Token, ProcessToken;
2473 HANDLE Token2;
2474 DWORD Size;
2475 TOKEN_PRIVILEGES *Privileges;
2476 TOKEN_USER *User;
2477 PRIVILEGE_SET *PrivilegeSet;
2478 BOOL AccessGranted;
2479 BOOL ret;
2480 HKEY hkey;
2481 DWORD error;
2482
2483 pDuplicateTokenEx = (void *)GetProcAddress(hmod, "DuplicateTokenEx");
2484 if( !pDuplicateTokenEx ) {
2485 win_skip("DuplicateTokenEx is not available\n");
2486 return;
2487 }
2488 SetLastError(0xdeadbeef);
2489 ret = ImpersonateSelf(SecurityAnonymous);
2490 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2491 {
2492 win_skip("ImpersonateSelf is not implemented\n");
2493 return;
2494 }
2495 ok(ret, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
2496 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2497 ok(!ret, "OpenThreadToken should have failed\n");
2498 error = GetLastError();
2499 ok(error == ERROR_CANT_OPEN_ANONYMOUS, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error);
2500 /* can't perform access check when opening object against an anonymous impersonation token */
2501 todo_wine {
2502 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2503 ok(error == ERROR_INVALID_HANDLE || error == ERROR_CANT_OPEN_ANONYMOUS,
2504 "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE or ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error);
2505 }
2506 RevertToSelf();
2507
2508 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &ProcessToken);
2509 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
2510
2511 ret = pDuplicateTokenEx(ProcessToken,
2512 TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE, NULL,
2513 SecurityAnonymous, TokenImpersonation, &Token);
2514 ok(ret, "DuplicateTokenEx failed with error %d\n", GetLastError());
2515 /* can't increase the impersonation level */
2516 ret = DuplicateToken(Token, SecurityIdentification, &Token2);
2517 error = GetLastError();
2518 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL,
2519 "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2520 /* we can query anything from an anonymous token, including the user */
2521 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
2522 error = GetLastError();
2523 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
2524 User = HeapAlloc(GetProcessHeap(), 0, Size);
2525 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
2526 ok(ret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
2527 HeapFree(GetProcessHeap(), 0, User);
2528
2529 /* PrivilegeCheck fails with SecurityAnonymous level */
2530 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
2531 error = GetLastError();
2532 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
2533 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
2534 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
2535 ok(ret, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
2536
2537 PrivilegeSet = HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET, Privilege[Privileges->PrivilegeCount]));
2538 PrivilegeSet->PrivilegeCount = Privileges->PrivilegeCount;
2539 memcpy(PrivilegeSet->Privilege, Privileges->Privileges, PrivilegeSet->PrivilegeCount * sizeof(PrivilegeSet->Privilege[0]));
2540 PrivilegeSet->Control = PRIVILEGE_SET_ALL_NECESSARY;
2541 HeapFree(GetProcessHeap(), 0, Privileges);
2542
2543 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2544 error = GetLastError();
2545 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2546
2547 CloseHandle(Token);
2548
2549 ret = ImpersonateSelf(SecurityIdentification);
2550 ok(ret, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
2551 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2552 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
2553
2554 /* can't perform access check when opening object against an identification impersonation token */
2555 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2556 todo_wine {
2557 ok(error == ERROR_INVALID_HANDLE || error == ERROR_BAD_IMPERSONATION_LEVEL,
2558 "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE or ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
2559 }
2560 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2561 ok(ret, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
2562 CloseHandle(Token);
2563 RevertToSelf();
2564
2565 ret = ImpersonateSelf(SecurityImpersonation);
2566 ok(ret, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
2567 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
2568 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
2569 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
2570 ok(error == ERROR_SUCCESS, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error);
2571 RegCloseKey(hkey);
2572 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
2573 ok(ret, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
2574 RevertToSelf();
2575
2576 CloseHandle(Token);
2577 CloseHandle(ProcessToken);
2578
2579 HeapFree(GetProcessHeap(), 0, PrivilegeSet);
2580 }
2581
2582 static void test_SetEntriesInAclW(void)
2583 {
2584 DWORD res;
2585 PSID EveryoneSid = NULL, UsersSid = NULL;
2586 PACL OldAcl = NULL, NewAcl;
2587 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2588 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
2589 EXPLICIT_ACCESSW ExplicitAccess;
2590 static const WCHAR wszEveryone[] = {'E','v','e','r','y','o','n','e',0};
2591 static const WCHAR wszCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
2592
2593 if (!pSetEntriesInAclW)
2594 {
2595 win_skip("SetEntriesInAclW is not available\n");
2596 return;
2597 }
2598
2599 NewAcl = (PACL)0xdeadbeef;
2600 res = pSetEntriesInAclW(0, NULL, NULL, &NewAcl);
2601 if(res == ERROR_CALL_NOT_IMPLEMENTED)
2602 {
2603 win_skip("SetEntriesInAclW is not implemented\n");
2604 return;
2605 }
2606 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2607 ok(NewAcl == NULL ||
2608 broken(NewAcl != NULL), /* NT4 */
2609 "NewAcl=%p, expected NULL\n", NewAcl);
2610 LocalFree(NewAcl);
2611
2612 OldAcl = HeapAlloc(GetProcessHeap(), 0, 256);
2613 res = InitializeAcl(OldAcl, 256, ACL_REVISION);
2614 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2615 {
2616 win_skip("ACLs not implemented - skipping tests\n");
2617 HeapFree(GetProcessHeap(), 0, OldAcl);
2618 return;
2619 }
2620 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2621
2622 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
2623 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2624
2625 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
2626 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
2627 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2628
2629 res = AddAccessAllowedAce(OldAcl, ACL_REVISION, KEY_READ, UsersSid);
2630 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2631
2632 ExplicitAccess.grfAccessPermissions = KEY_WRITE;
2633 ExplicitAccess.grfAccessMode = GRANT_ACCESS;
2634 ExplicitAccess.grfInheritance = NO_INHERITANCE;
2635 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
2636 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2637 ExplicitAccess.Trustee.ptstrName = EveryoneSid;
2638 ExplicitAccess.Trustee.MultipleTrusteeOperation = 0xDEADBEEF;
2639 ExplicitAccess.Trustee.pMultipleTrustee = (PVOID)0xDEADBEEF;
2640 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2641 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2642 ok(NewAcl != NULL, "returned acl was NULL\n");
2643 LocalFree(NewAcl);
2644
2645 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
2646 ExplicitAccess.Trustee.pMultipleTrustee = NULL;
2647 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2648 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2649 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2650 ok(NewAcl != NULL, "returned acl was NULL\n");
2651 LocalFree(NewAcl);
2652
2653 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2654 {
2655 skip("Non-english locale (test with hardcoded 'Everyone')\n");
2656 }
2657 else
2658 {
2659 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_USER;
2660 ExplicitAccess.Trustee.ptstrName = (LPWSTR)wszEveryone;
2661 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2662 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2663 ok(NewAcl != NULL, "returned acl was NULL\n");
2664 LocalFree(NewAcl);
2665
2666 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_BAD_FORM;
2667 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2668 ok(res == ERROR_INVALID_PARAMETER ||
2669 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2670 "SetEntriesInAclW failed: %u\n", res);
2671 ok(NewAcl == NULL ||
2672 broken(NewAcl != NULL), /* NT4 */
2673 "returned acl wasn't NULL: %p\n", NewAcl);
2674
2675 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_USER;
2676 ExplicitAccess.Trustee.MultipleTrusteeOperation = TRUSTEE_IS_IMPERSONATE;
2677 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2678 ok(res == ERROR_INVALID_PARAMETER ||
2679 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2680 "SetEntriesInAclW failed: %u\n", res);
2681 ok(NewAcl == NULL ||
2682 broken(NewAcl != NULL), /* NT4 */
2683 "returned acl wasn't NULL: %p\n", NewAcl);
2684
2685 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2686 ExplicitAccess.grfAccessMode = SET_ACCESS;
2687 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2688 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2689 ok(NewAcl != NULL, "returned acl was NULL\n");
2690 LocalFree(NewAcl);
2691 }
2692
2693 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_USER;
2694 ExplicitAccess.Trustee.ptstrName = (LPWSTR)wszCurrentUser;
2695 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2696 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2697 ok(NewAcl != NULL, "returned acl was NULL\n");
2698 LocalFree(NewAcl);
2699
2700 ExplicitAccess.grfAccessMode = REVOKE_ACCESS;
2701 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2702 ExplicitAccess.Trustee.ptstrName = UsersSid;
2703 res = pSetEntriesInAclW(1, &ExplicitAccess, OldAcl, &NewAcl);
2704 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
2705 ok(NewAcl != NULL, "returned acl was NULL\n");
2706 LocalFree(NewAcl);
2707
2708 FreeSid(UsersSid);
2709 FreeSid(EveryoneSid);
2710 HeapFree(GetProcessHeap(), 0, OldAcl);
2711 }
2712
2713 static void test_SetEntriesInAclA(void)
2714 {
2715 DWORD res;
2716 PSID EveryoneSid = NULL, UsersSid = NULL;
2717 PACL OldAcl = NULL, NewAcl;
2718 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
2719 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
2720 EXPLICIT_ACCESS ExplicitAccess;
2721 static const CHAR szEveryone[] = {'E','v','e','r','y','o','n','e',0};
2722 static const CHAR szCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
2723
2724 if (!pSetEntriesInAclA)
2725 {
2726 win_skip("SetEntriesInAclA is not available\n");
2727 return;
2728 }
2729
2730 NewAcl = (PACL)0xdeadbeef;
2731 res = pSetEntriesInAclA(0, NULL, NULL, &NewAcl);
2732 if(res == ERROR_CALL_NOT_IMPLEMENTED)
2733 {
2734 win_skip("SetEntriesInAclA is not implemented\n");
2735 return;
2736 }
2737 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2738 ok(NewAcl == NULL ||
2739 broken(NewAcl != NULL), /* NT4 */
2740 "NewAcl=%p, expected NULL\n", NewAcl);
2741 LocalFree(NewAcl);
2742
2743 OldAcl = HeapAlloc(GetProcessHeap(), 0, 256);
2744 res = InitializeAcl(OldAcl, 256, ACL_REVISION);
2745 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
2746 {
2747 win_skip("ACLs not implemented - skipping tests\n");
2748 HeapFree(GetProcessHeap(), 0, OldAcl);
2749 return;
2750 }
2751 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
2752
2753 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
2754 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2755
2756 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
2757 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
2758 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
2759
2760 res = AddAccessAllowedAce(OldAcl, ACL_REVISION, KEY_READ, UsersSid);
2761 ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError());
2762
2763 ExplicitAccess.grfAccessPermissions = KEY_WRITE;
2764 ExplicitAccess.grfAccessMode = GRANT_ACCESS;
2765 ExplicitAccess.grfInheritance = NO_INHERITANCE;
2766 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
2767 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2768 ExplicitAccess.Trustee.ptstrName = EveryoneSid;
2769 ExplicitAccess.Trustee.MultipleTrusteeOperation = 0xDEADBEEF;
2770 ExplicitAccess.Trustee.pMultipleTrustee = (PVOID)0xDEADBEEF;
2771 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2772 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2773 ok(NewAcl != NULL, "returned acl was NULL\n");
2774 LocalFree(NewAcl);
2775
2776 ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
2777 ExplicitAccess.Trustee.pMultipleTrustee = NULL;
2778 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2779 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2780 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2781 ok(NewAcl != NULL, "returned acl was NULL\n");
2782 LocalFree(NewAcl);
2783
2784 if (PRIMARYLANGID(GetSystemDefaultLangID()) != LANG_ENGLISH)
2785 {
2786 skip("Non-english locale (test with hardcoded 'Everyone')\n");
2787 }
2788 else
2789 {
2790 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_USER;
2791 ExplicitAccess.Trustee.ptstrName = (LPSTR)szEveryone;
2792 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2793 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2794 ok(NewAcl != NULL, "returned acl was NULL\n");
2795 LocalFree(NewAcl);
2796
2797 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_BAD_FORM;
2798 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2799 ok(res == ERROR_INVALID_PARAMETER ||
2800 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2801 "SetEntriesInAclA failed: %u\n", res);
2802 ok(NewAcl == NULL ||
2803 broken(NewAcl != NULL), /* NT4 */
2804 "returned acl wasn't NULL: %p\n", NewAcl);
2805
2806 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_USER;
2807 ExplicitAccess.Trustee.MultipleTrusteeOperation = TRUSTEE_IS_IMPERSONATE;
2808 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2809 ok(res == ERROR_INVALID_PARAMETER ||
2810 broken(res == ERROR_NOT_SUPPORTED), /* NT4 */
2811 "SetEntriesInAclA failed: %u\n", res);
2812 ok(NewAcl == NULL ||
2813 broken(NewAcl != NULL), /* NT4 */
2814 "returned acl wasn't NULL: %p\n", NewAcl);
2815
2816 ExplicitAccess.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
2817 ExplicitAccess.grfAccessMode = SET_ACCESS;
2818 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2819 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2820 ok(NewAcl != NULL, "returned acl was NULL\n");
2821 LocalFree(NewAcl);
2822 }
2823
2824 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_USER;
2825 ExplicitAccess.Trustee.ptstrName = (LPSTR)szCurrentUser;
2826 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2827 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2828 ok(NewAcl != NULL, "returned acl was NULL\n");
2829 LocalFree(NewAcl);
2830
2831 ExplicitAccess.grfAccessMode = REVOKE_ACCESS;
2832 ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;
2833 ExplicitAccess.Trustee.ptstrName = UsersSid;
2834 res = pSetEntriesInAclA(1, &ExplicitAccess, OldAcl, &NewAcl);
2835 ok(res == ERROR_SUCCESS, "SetEntriesInAclA failed: %u\n", res);
2836 ok(NewAcl != NULL, "returned acl was NULL\n");
2837 LocalFree(NewAcl);
2838
2839 FreeSid(UsersSid);
2840 FreeSid(EveryoneSid);
2841 HeapFree(GetProcessHeap(), 0, OldAcl);
2842 }
2843
2844 static void test_GetNamedSecurityInfoA(void)
2845 {
2846 PSECURITY_DESCRIPTOR pSecDesc;
2847 DWORD revision;
2848 SECURITY_DESCRIPTOR_CONTROL control;
2849 PSID owner;
2850 PSID group;
2851 PACL dacl;
2852 BOOL owner_defaulted;
2853 BOOL group_defaulted;
2854 DWORD error;
2855 BOOL ret, isNT4;
2856 CHAR windows_dir[MAX_PATH];
2857
2858 if (!pGetNamedSecurityInfoA)
2859 {
2860 win_skip("GetNamedSecurityInfoA is not available\n");
2861 return;
2862 }
2863
2864 ret = GetWindowsDirectoryA(windows_dir, MAX_PATH);
2865 ok(ret, "GetWindowsDirectory failed with error %d\n", GetLastError());
2866
2867 SetLastError(0xdeadbeef);
2868 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,
2869 OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
2870 NULL, NULL, NULL, NULL, &pSecDesc);
2871 if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
2872 {
2873 win_skip("GetNamedSecurityInfoA is not implemented\n");
2874 return;
2875 }
2876 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
2877
2878 ret = GetSecurityDescriptorControl(pSecDesc, &control, &revision);
2879 ok(ret, "GetSecurityDescriptorControl failed with error %d\n", GetLastError());
2880 ok((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == (SE_SELF_RELATIVE|SE_DACL_PRESENT) ||
2881 broken((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == SE_DACL_PRESENT), /* NT4 */
2882 "control (0x%x) doesn't have (SE_SELF_RELATIVE|SE_DACL_PRESENT) flags set\n", control);
2883 ok(revision == SECURITY_DESCRIPTOR_REVISION1, "revision was %d instead of 1\n", revision);
2884
2885 isNT4 = (control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == SE_DACL_PRESENT;
2886
2887 ret = GetSecurityDescriptorOwner(pSecDesc, &owner, &owner_defaulted);
2888 ok(ret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
2889 ok(owner != NULL, "owner should not be NULL\n");
2890
2891 ret = GetSecurityDescriptorGroup(pSecDesc, &group, &group_defaulted);
2892 ok(ret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
2893 ok(group != NULL, "group should not be NULL\n");
2894 LocalFree(pSecDesc);
2895
2896
2897 /* NULL descriptor tests */
2898 if(isNT4)
2899 {
2900 win_skip("NT4 does not support GetNamedSecutityInfo with a NULL descriptor\n");
2901 return;
2902 }
2903
2904 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,
2905 NULL, NULL, NULL, NULL, NULL);
2906 ok(error==ERROR_INVALID_PARAMETER, "GetNamedSecurityInfo failed with error %d\n", error);
2907
2908 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,DACL_SECURITY_INFORMATION,
2909 NULL, NULL, &dacl, NULL, NULL);
2910 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
2911 ok(dacl != NULL, "dacl should not be NULL\n");
2912
2913 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,OWNER_SECURITY_INFORMATION,
2914 NULL, NULL, &dacl, NULL, NULL);
2915 ok(error==ERROR_INVALID_PARAMETER, "GetNamedSecurityInfo failed with error %d\n", error);
2916 }
2917
2918 static void test_ConvertStringSecurityDescriptor(void)
2919 {
2920 BOOL ret;
2921 PSECURITY_DESCRIPTOR pSD;
2922 static const WCHAR Blank[] = { 0 };
2923 unsigned int i;
2924 static const struct
2925 {
2926 const char *sidstring;
2927 DWORD revision;
2928 BOOL ret;
2929 DWORD GLE;
2930 DWORD altGLE;
2931 } cssd[] =
2932 {
2933 { "D:(A;;GA;;;WD)", 0xdeadbeef, FALSE, ERROR_UNKNOWN_REVISION },
2934 /* test ACE string type */
2935 { "D:(A;;GA;;;WD)", SDDL_REVISION_1, TRUE },
2936 { "D:(D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
2937 { "ERROR:(D;;GA;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_PARAMETER },
2938 /* test ACE string with spaces */
2939 { " D:(D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
2940 { "D: (D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
2941 { "D:( D;;GA;;;WD)", SDDL_REVISION_1, TRUE },
2942 { "D:(D ;;GA;;;WD)", SDDL_REVISION_1, FALSE, RPC_S_INVALID_STRING_UUID, ERROR_INVALID_ACL }, /* Vista+ */
2943 { "D:(D; ;GA;;;WD)", SDDL_REVISION_1, TRUE },
2944 { "D:(D;; GA;;;WD)", SDDL_REVISION_1, TRUE },
2945 { "D:(D;;GA ;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL },
2946 { "D:(D;;GA; ;;WD)", SDDL_REVISION_1, TRUE },
2947 { "D:(D;;GA;; ;WD)", SDDL_REVISION_1, TRUE },
2948 { "D:(D;;GA;;; WD)", SDDL_REVISION_1, TRUE },
2949 { "D:(D;;GA;;;WD )", SDDL_REVISION_1, TRUE },
2950 /* test ACE string access rights */
2951 { "D:(A;;GA;;;WD)", SDDL_REVISION_1, TRUE },
2952 { "D:(A;;GRGWGX;;;WD)", SDDL_REVISION_1, TRUE },
2953 { "D:(A;;RCSDWDWO;;;WD)", SDDL_REVISION_1, TRUE },
2954 { "D:(A;;RPWPCCDCLCSWLODTCR;;;WD)", SDDL_REVISION_1, TRUE },
2955 { "D:(A;;FAFRFWFX;;;WD)", SDDL_REVISION_1, TRUE },
2956 { "D:(A;;KAKRKWKX;;;WD)", SDDL_REVISION_1, TRUE },
2957 { "D:(A;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, TRUE },
2958 { "S:(AU;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, TRUE },
2959 /* test ACE string access right error case */
2960 { "D:(A;;ROB;;;WD)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL },
2961 /* test behaviour with empty strings */
2962 { "", SDDL_REVISION_1, TRUE },
2963 /* test ACE string SID */
2964 { "D:(D;;GA;;;S-1-0-0)", SDDL_REVISION_1, TRUE },
2965 { "D:(D;;GA;;;Nonexistent account)", SDDL_REVISION_1, FALSE, ERROR_INVALID_ACL, ERROR_INVALID_SID } /* W2K */
2966 };
2967
2968 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
2969 {
2970 win_skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
2971 return;
2972 }
2973
2974 for (i = 0; i < sizeof(cssd)/sizeof(cssd[0]); i++)
2975 {
2976 DWORD GLE;
2977
2978 SetLastError(0xdeadbeef);
2979 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
2980 cssd[i].sidstring, cssd[i].revision, &pSD, NULL);
2981 GLE = GetLastError();
2982 ok(ret == cssd[i].ret, "(%02u) Expected %s (%d)\n", i, cssd[i].ret ? "success" : "failure", GLE);
2983 if (!cssd[i].ret)
2984 ok(GLE == cssd[i].GLE ||
2985 (cssd[i].altGLE && GLE == cssd[i].altGLE),
2986 "(%02u) Unexpected last error %d\n", i, GLE);
2987 if (ret)
2988 LocalFree(pSD);
2989 }
2990
2991 /* test behaviour with NULL parameters */
2992 SetLastError(0xdeadbeef);
2993 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
2994 NULL, 0xdeadbeef, &pSD, NULL);
2995 todo_wine
2996 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
2997 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
2998 GetLastError());
2999
3000 SetLastError(0xdeadbeef);
3001 ret = pConvertStringSecurityDescriptorToSecurityDescriptorW(
3002 NULL, 0xdeadbeef, &pSD, NULL);
3003 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3004 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3005 GetLastError());
3006
3007 SetLastError(0xdeadbeef);
3008 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3009 "D:(A;;ROB;;;WD)", 0xdeadbeef, NULL, NULL);
3010 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3011 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3012 GetLastError());
3013
3014 SetLastError(0xdeadbeef);
3015 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
3016 "D:(A;;ROB;;;WD)", SDDL_REVISION_1, NULL, NULL);
3017 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
3018 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
3019 GetLastError());
3020
3021 /* test behaviour with empty strings */
3022 SetLastError(0xdeadbeef);
3023 ret = pConvertStringSecurityDescriptorToSecurityDescriptorW(
3024 Blank, SDDL_REVISION_1, &pSD, NULL);
3025 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
3026 LocalFree(pSD);
3027 }
3028
3029 static void test_ConvertSecurityDescriptorToString(void)
3030 {
3031 SECURITY_DESCRIPTOR desc;
3032 SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
3033 LPSTR string;
3034 DWORD size;
3035 PSID psid, psid2;
3036 PACL pacl;
3037 char sid_buf[256];
3038 char acl_buf[8192];
3039 ULONG len;
3040
3041 if (!pConvertSecurityDescriptorToStringSecurityDescriptorA)
3042 {
3043 win_skip("ConvertSecurityDescriptorToStringSecurityDescriptor is not available\n");
3044 return;
3045 }
3046 if (!pCreateWellKnownSid)
3047 {
3048 win_skip("CreateWellKnownSid is not available\n");
3049 return;
3050 }
3051
3052 /* It seems Windows XP adds an extra character to the length of the string for each ACE in an ACL. We
3053 * don't replicate this feature so we only test len >= strlen+1. */
3054 #define CHECK_RESULT_AND_FREE(exp_str) \
3055 ok(strcmp(string, (exp_str)) == 0, "String mismatch (expected \"%s\", got \"%s\")\n", (exp_str), string); \
3056 ok(len >= (strlen(exp_str) + 1), "Length mismatch (expected %d, got %d)\n", lstrlen(exp_str) + 1, len); \
3057 LocalFree(string);
3058
3059 #define CHECK_ONE_OF_AND_FREE(exp_str1, exp_str2) \
3060 ok(strcmp(string, (exp_str1)) == 0 || strcmp(string, (exp_str2)) == 0, "String mismatch (expected\n\"%s\" or\n\"%s\", got\n\"%s\")\n", (exp_str1), (exp_str2), string); \
3061 ok(len >= (strlen(exp_str1) + 1) || len >= (strlen(exp_str2) + 1), "Length mismatch (expected %d or %d, got %d)\n", lstrlen(exp_str1) + 1, lstrlen(exp_str2) + 1, len); \
3062 LocalFree(string);
3063
3064 InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION);
3065 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3066 CHECK_RESULT_AND_FREE("");
3067
3068 size = 4096;
3069 pCreateWellKnownSid(WinLocalSid, NULL, sid_buf, &size);
3070 SetSecurityDescriptorOwner(&desc, sid_buf, FALSE);
3071 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3072 CHECK_RESULT_AND_FREE("O:S-1-2-0");
3073
3074 SetSecurityDescriptorOwner(&desc, sid_buf, TRUE);
3075 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3076 CHECK_RESULT_AND_FREE("O:S-1-2-0");
3077
3078 size = sizeof(sid_buf);
3079 pCreateWellKnownSid(WinLocalSystemSid, NULL, sid_buf, &size);
3080 SetSecurityDescriptorOwner(&desc, sid_buf, TRUE);
3081 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3082 CHECK_RESULT_AND_FREE("O:SY");
3083
3084 pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid);
3085 SetSecurityDescriptorGroup(&desc, psid, TRUE);
3086 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3087 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576");
3088
3089 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, GROUP_SECURITY_INFORMATION, &string, &len), "Conversion failed\n");
3090 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
3091
3092 pacl = (PACL)acl_buf;
3093 InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
3094 SetSecurityDescriptorDacl(&desc, TRUE, pacl, TRUE);
3095 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3096 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
3097
3098 SetSecurityDescriptorDacl(&desc, TRUE, pacl, FALSE);
3099 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3100 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
3101
3102 pConvertStringSidToSidA("S-1-5-6", &psid2);
3103 pAddAccessAllowedAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, 0xf0000000, psid2);
3104 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3105 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)");
3106
3107 pAddAccessAllowedAceEx(pacl, ACL_REVISION, INHERIT_ONLY_ACE|INHERITED_ACE, 0x00000003, psid2);
3108 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3109 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)");
3110
3111 pAddAccessDeniedAceEx(pacl, ACL_REVISION, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE, 0xffffffff, psid);
3112 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3113 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
3114
3115
3116 pacl = (PACL)acl_buf;
3117 InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
3118 SetSecurityDescriptorSacl(&desc, TRUE, pacl, FALSE);
3119 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3120 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:");
3121
3122 /* fails in win2k */
3123 SetSecurityDescriptorDacl(&desc, TRUE, NULL, FALSE);
3124 pAddAuditAccessAceEx(pacl, ACL_REVISION, VALID_INHERIT_FLAGS, KEY_READ|KEY_WRITE, psid2, TRUE, TRUE);
3125 if (pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len))
3126 {
3127 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)", /* XP */
3128 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)" /* Vista */);
3129 }
3130
3131 /* fails in win2k */
3132 pAddAuditAccessAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, FILE_GENERIC_READ|FILE_GENERIC_WRITE, psid2, TRUE, FALSE);
3133 if (pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len))
3134 {
3135 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", /* XP */
3136 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)" /* Vista */);
3137 }
3138
3139 LocalFree(psid2);
3140 LocalFree(psid);
3141 }
3142
3143 static void test_SetSecurityDescriptorControl (PSECURITY_DESCRIPTOR sec)
3144 {
3145 SECURITY_DESCRIPTOR_CONTROL ref;
3146 SECURITY_DESCRIPTOR_CONTROL test;
3147
3148 SECURITY_DESCRIPTOR_CONTROL const mutable
3149 = SE_DACL_AUTO_INHERIT_REQ | SE_SACL_AUTO_INHERIT_REQ
3150 | SE_DACL_AUTO_INHERITED | SE_SACL_AUTO_INHERITED
3151 | SE_DACL_PROTECTED | SE_SACL_PROTECTED
3152 | 0x00000040 | 0x00000080 /* not defined in winnt.h */
3153 ;
3154 SECURITY_DESCRIPTOR_CONTROL const immutable
3155 = SE_OWNER_DEFAULTED | SE_GROUP_DEFAULTED
3156 | SE_DACL_PRESENT | SE_DACL_DEFAULTED
3157 | SE_SACL_PRESENT | SE_SACL_DEFAULTED
3158 | SE_RM_CONTROL_VALID | SE_SELF_RELATIVE
3159 ;
3160
3161 int bit;
3162 DWORD dwRevision;
3163 LPCSTR fmt = "Expected error %s, got %u\n";
3164
3165 GetSecurityDescriptorControl (sec, &ref, &dwRevision);
3166
3167 /* The mutable bits are mutable regardless of the truth of
3168 SE_DACL_PRESENT and/or SE_SACL_PRESENT */
3169
3170 /* Check call barfs if any bit-of-interest is immutable */
3171 for (bit = 0; bit < 16; ++bit)
3172 {
3173 SECURITY_DESCRIPTOR_CONTROL const bitOfInterest = 1 << bit;
3174 SECURITY_DESCRIPTOR_CONTROL setOrClear = ref & bitOfInterest;
3175
3176 SECURITY_DESCRIPTOR_CONTROL ctrl;
3177
3178 DWORD dwExpect = (bitOfInterest & immutable)
3179 ? ERROR_INVALID_PARAMETER : 0xbebecaca;
3180 LPCSTR strExpect = (bitOfInterest & immutable)
3181 ? "ERROR_INVALID_PARAMETER" : "0xbebecaca";
3182
3183 ctrl = (bitOfInterest & mutable) ? ref + bitOfInterest : ref;
3184 setOrClear ^= bitOfInterest;
3185 SetLastError (0xbebecaca);
3186 pSetSecurityDescriptorControl (sec, bitOfInterest, setOrClear);
3187 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3188 GetSecurityDescriptorControl(sec, &test, &dwRevision);
3189 expect_eq(test, ctrl, int, "%x");
3190
3191 setOrClear ^= bitOfInterest;
3192 SetLastError (0xbebecaca);
3193 pSetSecurityDescriptorControl (sec, bitOfInterest, setOrClear);
3194 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3195 GetSecurityDescriptorControl (sec, &test, &dwRevision);
3196 expect_eq(test, ref, int, "%x");
3197 }
3198
3199 /* Check call barfs if any bit-to-set is immutable
3200 even when not a bit-of-interest */
3201 for (bit = 0; bit < 16; ++bit)
3202 {
3203 SECURITY_DESCRIPTOR_CONTROL const bitsOfInterest = mutable;
3204 SECURITY_DESCRIPTOR_CONTROL setOrClear = ref & bitsOfInterest;
3205
3206 SECURITY_DESCRIPTOR_CONTROL ctrl;
3207
3208 DWORD dwExpect = ((1 << bit) & immutable)
3209 ? ERROR_INVALID_PARAMETER : 0xbebecaca;
3210 LPCSTR strExpect = ((1 << bit) & immutable)
3211 ? "ERROR_INVALID_PARAMETER" : "0xbebecaca";
3212
3213 ctrl = ((1 << bit) & immutable) ? test : ref | mutable;
3214 setOrClear ^= bitsOfInterest;
3215 SetLastError (0xbebecaca);
3216 pSetSecurityDescriptorControl (sec, bitsOfInterest, setOrClear | (1 << bit));
3217 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3218 GetSecurityDescriptorControl(sec, &test, &dwRevision);
3219 expect_eq(test, ctrl, int, "%x");
3220
3221 ctrl = ((1 << bit) & immutable) ? test : ref | (1 << bit);
3222 setOrClear ^= bitsOfInterest;
3223 SetLastError (0xbebecaca);
3224 pSetSecurityDescriptorControl (sec, bitsOfInterest, setOrClear | (1 << bit));
3225 ok (GetLastError () == dwExpect, fmt, strExpect, GetLastError ());
3226 GetSecurityDescriptorControl(sec, &test, &dwRevision);
3227 expect_eq(test, ctrl, int, "%x");
3228 }
3229 }
3230
3231 static void test_PrivateObjectSecurity(void)
3232 {
3233 SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
3234 SECURITY_DESCRIPTOR_CONTROL ctrl;
3235 PSECURITY_DESCRIPTOR sec;
3236 DWORD dwDescSize;
3237 DWORD dwRevision;
3238 DWORD retSize;
3239 LPSTR string;
3240 ULONG len;
3241 PSECURITY_DESCRIPTOR buf;
3242 BOOL ret;
3243
3244 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
3245 {
3246 win_skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
3247 return;
3248 }
3249
3250 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
3251 "O:SY"
3252 "G:S-1-5-21-93476-23408-4576"
3253 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)"
3254 "(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3255 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)",
3256 SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
3257
3258 test_SetSecurityDescriptorControl(sec);
3259
3260 LocalFree(sec);
3261
3262 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
3263 "O:SY"
3264 "G:S-1-5-21-93476-23408-4576",
3265 SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
3266
3267 test_SetSecurityDescriptorControl(sec);
3268
3269 LocalFree(sec);
3270
3271 ok(pConvertStringSecurityDescriptorToSecurityDescriptorA(
3272 "O:SY"
3273 "G:S-1-5-21-93476-23408-4576"
3274 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3275 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
3276 buf = HeapAlloc(GetProcessHeap(), 0, dwDescSize);
3277 pSetSecurityDescriptorControl(sec, SE_DACL_PROTECTED, SE_DACL_PROTECTED);
3278 GetSecurityDescriptorControl(sec, &ctrl, &dwRevision);
3279 expect_eq(ctrl, 0x9014, int, "%x");
3280
3281 ret = GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION, buf, dwDescSize, &retSize);
3282 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
3283 ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
3284 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3285 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
3286 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
3287 expect_eq(ctrl, 0x8000, int, "%x");
3288
3289 ret = GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, buf, dwDescSize, &retSize);
3290 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
3291 ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
3292 ret = pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len);
3293 ok(ret, "Conversion failed err=%u\n", GetLastError());
3294 CHECK_ONE_OF_AND_FREE("G:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)",
3295 "G:S-1-5-21-93476-23408-4576D:P(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"); /* Win7 */
3296 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
3297 expect_eq(ctrl & (~ SE_DACL_PROTECTED), 0x8004, int, "%x");
3298
3299 ret = GetPrivateObjectSecurity(sec, sec_info, buf, dwDescSize, &retSize);
3300 ok(ret, "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
3301 ok(retSize == dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
3302 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
3303 CHECK_ONE_OF_AND_FREE("O:SY"
3304 "G:S-1-5-21-93476-23408-4576"
3305 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3306 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)",
3307 "O:SY"
3308 "G:S-1-5-21-93476-23408-4576"
3309 "D:P(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
3310 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)"); /* Win7 */
3311 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
3312 expect_eq(ctrl & (~ SE_DACL_PROTECTED), 0x8014, int, "%x");
3313
3314 SetLastError(0xdeadbeef);
3315 ok(GetPrivateObjectSecurity(sec, sec_info, buf, 5, &retSize) == FALSE, "GetPrivateObjectSecurity should have failed\n");
3316 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Expected error ERROR_INSUFFICIENT_BUFFER, got %u\n", GetLastError());
3317
3318 LocalFree(sec);
3319 HeapFree(GetProcessHeap(), 0, buf);
3320 }
3321 #undef CHECK_RESULT_AND_FREE
3322 #undef CHECK_ONE_OF_AND_FREE
3323
3324 static void test_acls(void)
3325 {
3326 char buffer[256];
3327 PACL pAcl = (PACL)buffer;
3328 BOOL ret;
3329
3330 SetLastError(0xdeadbeef);
3331 ret = InitializeAcl(pAcl, sizeof(ACL) - 1, ACL_REVISION);
3332 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
3333 {
3334 win_skip("InitializeAcl is not implemented\n");
3335 return;
3336 }
3337
3338 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "InitializeAcl with too small a buffer should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", GetLastError());
3339
3340 SetLastError(0xdeadbeef);
3341 ret = InitializeAcl(pAcl, 0xffffffff, ACL_REVISION);
3342 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl with too large a buffer should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
3343
3344 SetLastError(0xdeadbeef);
3345 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION1);
3346 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl(ACL_REVISION1) should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GetLastError());
3347
3348 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION2);
3349 ok(ret, "InitializeAcl(ACL_REVISION2) failed with error %d\n", GetLastError());
3350
3351 ret = IsValidAcl(pAcl);
3352 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
3353
3354 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION3);
3355 ok(ret, "InitializeAcl(ACL_REVISION3) failed with error %d\n", GetLastError());
3356
3357 ret = IsValidAcl(pAcl);
3358 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
3359
3360 SetLastError(0xdeadbeef);
3361 ret = InitializeAcl(pAcl, sizeof(buffer), ACL_REVISION4);
3362 if (GetLastError() != ERROR_INVALID_PARAMETER)
3363 {
3364 ok(ret, "InitializeAcl(ACL_REVISION4) failed with error %d\n", GetLastError());
3365
3366 ret = IsValidAcl(pAcl);
3367 ok(ret, "IsValidAcl failed with error %d\n", GetLastError());
3368 }
3369 else
3370 win_skip("ACL_REVISION4 is not implemented on NT4\n");
3371
3372 SetLastError(0xdeadbeef);
3373 ret = InitializeAcl(pAcl, sizeof(buffer), -1);
3374 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER, "InitializeAcl(-1) failed with error %d\n", GetLastError());
3375 }
3376
3377 static void test_GetSecurityInfo(void)
3378 {
3379 HANDLE obj;
3380 PSECURITY_DESCRIPTOR sd;
3381 PSID owner, group;
3382 PACL dacl;
3383 DWORD ret;
3384
3385 if (!pGetSecurityInfo)
3386 {
3387 win_skip("GetSecurityInfo is not available\n");
3388 return;
3389 }
3390
3391 /* Create something. Files have lots of associated security info. */
3392 obj = CreateFile(myARGV[0], GENERIC_READ, FILE_SHARE_READ, NULL,
3393 OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
3394 if (obj == INVALID_HANDLE_VALUE)
3395 {
3396 skip("Couldn't create an object for GetSecurityInfo test\n");
3397 return;
3398 }
3399
3400 ret = pGetSecurityInfo(obj, SE_FILE_OBJECT,
3401 OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3402 &owner, &group, &dacl, NULL, &sd);
3403 if (ret == ERROR_CALL_NOT_IMPLEMENTED)
3404 {
3405 win_skip("GetSecurityInfo is not implemented\n");
3406 CloseHandle(obj);
3407 return;
3408 }
3409 ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
3410 ok(sd != NULL, "GetSecurityInfo\n");
3411 ok(owner != NULL, "GetSecurityInfo\n");
3412 ok(group != NULL, "GetSecurityInfo\n");
3413 if (dacl != NULL)
3414 ok(IsValidAcl(dacl), "GetSecurityInfo\n");
3415 else
3416 win_skip("No ACL information returned\n");
3417
3418 LocalFree(sd);
3419
3420 if (!pCreateWellKnownSid)
3421 {
3422 win_skip("NULL parameter test would crash on NT4\n");
3423 CloseHandle(obj);
3424 return;
3425 }
3426
3427 /* If we don't ask for the security descriptor, Windows will still give us
3428 the other stuff, leaving us no way to free it. */
3429 ret = pGetSecurityInfo(obj, SE_FILE_OBJECT,
3430 OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
3431 &owner, &group, &dacl, NULL, NULL);
3432 ok(ret == ERROR_SUCCESS, "GetSecurityInfo returned %d\n", ret);
3433 ok(owner != NULL, "GetSecurityInfo\n");
3434 ok(group != NULL, "GetSecurityInfo\n");
3435 if (dacl != NULL)
3436 ok(IsValidAcl(dacl), "GetSecurityInfo\n");
3437 else
3438 win_skip("No ACL information returned\n");
3439
3440 CloseHandle(obj);
3441 }
3442
3443 static void test_GetSidSubAuthority(void)
3444 {
3445 PSID psid = NULL;
3446
3447 if (!pGetSidSubAuthority || !pConvertStringSidToSidA || !pIsValidSid || !pGetSidSubAuthorityCount)
3448 {
3449 win_skip("Some functions not available\n");
3450 return;
3451 }
3452 /* Note: on windows passing in an invalid index like -1, lets GetSidSubAuthority return 0x05000000 but
3453 still GetLastError returns ERROR_SUCCESS then. We don't test these unlikely cornercases here for now */
3454 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576",&psid),"ConvertStringSidToSidA failed\n");
3455 ok(pIsValidSid(psid),"Sid is not valid\n");
3456 SetLastError(0xbebecaca);
3457 ok(*pGetSidSubAuthorityCount(psid) == 4,"GetSidSubAuthorityCount gave %d expected 4\n",*pGetSidSubAuthorityCount(psid));
3458 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3459 SetLastError(0xbebecaca);
3460 ok(*pGetSidSubAuthority(psid,0) == 21,"GetSidSubAuthority gave %d expected 21\n",*pGetSidSubAuthority(psid,0));
3461 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3462 SetLastError(0xbebecaca);
3463 ok(*pGetSidSubAuthority(psid,1) == 93476,"GetSidSubAuthority gave %d expected 93476\n",*pGetSidSubAuthority(psid,1));
3464 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3465 SetLastError(0xbebecaca);
3466 ok(pGetSidSubAuthority(psid,4) != NULL,"Expected out of bounds GetSidSubAuthority to return a non-NULL pointer\n");
3467 ok(GetLastError() == 0,"GetLastError returned %d instead of 0\n",GetLastError());
3468 LocalFree(psid);
3469 }
3470
3471 static void test_CheckTokenMembership(void)
3472 {
3473 PTOKEN_GROUPS token_groups;
3474 DWORD size;
3475 HANDLE process_token, token;
3476 BOOL is_member;
3477 BOOL ret;
3478 DWORD i;
3479
3480 if (!pCheckTokenMembership)
3481 {
3482 win_skip("CheckTokenMembership is not available\n");
3483 return;
3484 }
3485 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token);
3486 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
3487
3488 ret = DuplicateToken(process_token, SecurityImpersonation, &token);
3489 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
3490
3491 /* groups */
3492 ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
3493 ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
3494 "GetTokenInformation(TokenGroups) %s with error %d\n",
3495 ret ? "succeeded" : "failed", GetLastError());
3496 token_groups = HeapAlloc(GetProcessHeap(), 0, size);
3497 ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
3498 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
3499
3500 for (i = 0; i < token_groups->GroupCount; i++)
3501 {
3502 if (token_groups->Groups[i].Attributes & SE_GROUP_ENABLED)
3503 break;
3504 }
3505
3506 if (i == token_groups->GroupCount)
3507 {
3508 HeapFree(GetProcessHeap(), 0, token_groups);
3509 CloseHandle(token);
3510 skip("user not a member of any group\n");
3511 return;
3512 }
3513
3514 ret = pCheckTokenMembership(token, token_groups->Groups[i].Sid, &is_member);
3515 ok(ret, "CheckTokenMembership failed with error %d\n", GetLastError());
3516 ok(is_member, "CheckTokenMembership should have detected sid as member\n");
3517
3518 ret = pCheckTokenMembership(NULL, token_groups->Groups[i].Sid, &is_member);
3519 ok(ret, "CheckTokenMembership failed with error %d\n", GetLastError());
3520 ok(is_member, "CheckTokenMembership should have detected sid as member\n");
3521
3522 ret = pCheckTokenMembership(process_token, token_groups->Groups[i].Sid, &is_member);
3523 todo_wine {
3524 ok(!ret && GetLastError() == ERROR_NO_IMPERSONATION_TOKEN,
3525 "CheckTokenMembership with process token %s with error %d\n",
3526 ret ? "succeeded" : "failed", GetLastError());
3527 ok(!is_member, "CheckTokenMembership should have cleared is_member\n");
3528 }
3529
3530 HeapFree(GetProcessHeap(), 0, token_groups);
3531 CloseHandle(token);
3532 CloseHandle(process_token);
3533 }
3534
3535 static void test_EqualSid(void)
3536 {
3537 PSID sid1, sid2;
3538 BOOL ret;
3539 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
3540 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
3541
3542 SetLastError(0xdeadbeef);
3543 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
3544 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid1);
3545 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
3546 {
3547 win_skip("AllocateAndInitializeSid is not implemented\n");
3548 return;
3549 }
3550 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3551 ok(GetLastError() == 0xdeadbeef,
3552 "AllocateAndInitializeSid shouldn't have set last error to %d\n",
3553 GetLastError());
3554
3555 ret = AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID,
3556 0, 0, 0, 0, 0, 0, 0, &sid2);
3557 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3558
3559 SetLastError(0xdeadbeef);
3560 ret = EqualSid(sid1, sid2);
3561 ok(!ret, "World and domain admins sids shouldn't have been equal\n");
3562 ok(GetLastError() == ERROR_SUCCESS ||
3563 broken(GetLastError() == 0xdeadbeef), /* NT4 */
3564 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
3565 GetLastError());
3566
3567 SetLastError(0xdeadbeef);
3568 sid2 = FreeSid(sid2);
3569 ok(!sid2, "FreeSid should have returned NULL instead of %p\n", sid2);
3570 ok(GetLastError() == 0xdeadbeef,
3571 "FreeSid shouldn't have set last error to %d\n",
3572 GetLastError());
3573
3574 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
3575 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid2);
3576 ok(ret, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
3577
3578 SetLastError(0xdeadbeef);
3579 ret = EqualSid(sid1, sid2);
3580 ok(ret, "Same sids should have been equal\n");
3581 ok(GetLastError() == ERROR_SUCCESS ||
3582 broken(GetLastError() == 0xdeadbeef), /* NT4 */
3583 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
3584 GetLastError());
3585
3586 ((SID *)sid2)->Revision = 2;
3587 SetLastError(0xdeadbeef);
3588 ret = EqualSid(sid1, sid2);
3589 ok(!ret, "EqualSid with invalid sid should have returned FALSE\n");
3590 ok(GetLastError() == ERROR_SUCCESS ||
3591 broken(GetLastError() == 0xdeadbeef), /* NT4 */
3592 "EqualSid should have set last error to ERROR_SUCCESS instead of %d\n",
3593 GetLastError());
3594 ((SID *)sid2)->Revision = SID_REVISION;
3595
3596 FreeSid(sid1);
3597 FreeSid(sid2);
3598 }
3599
3600 START_TEST(security)
3601 {
3602 init();
3603 if (!hmod) return;
3604
3605 if (myARGC >= 3)
3606 {
3607 test_process_security_child();
3608 return;
3609 }
3610 test_sid();
3611 test_trustee();
3612 test_luid();
3613 test_CreateWellKnownSid();
3614 test_FileSecurity();
3615 test_AccessCheck();
3616 test_token_attr();
3617 test_LookupAccountSid();
3618 test_LookupAccountName();
3619 test_security_descriptor();
3620 test_process_security();
3621 test_impersonation_level();
3622 test_SetEntriesInAclW();
3623 test_SetEntriesInAclA();
3624 test_GetNamedSecurityInfoA();
3625 test_ConvertStringSecurityDescriptor();
3626 test_ConvertSecurityDescriptorToString();
3627 test_PrivateObjectSecurity();
3628 test_acls();
3629 test_GetSecurityInfo();
3630 test_GetSidSubAuthority();
3631 test_CheckTokenMembership();
3632 test_EqualSid();
3633 }
Wine tree for Wine Gecko development