2 * Unit tests for security functions
4 * Copyright (c) 2004 Mike McCormack
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
25 #define WIN32_NO_STATUS
35 #include "wine/test.h"
37 typedef VOID (WINAPI
*fnBuildTrusteeWithSidA
)( PTRUSTEEA pTrustee
, PSID pSid
);
38 typedef VOID (WINAPI
*fnBuildTrusteeWithNameA
)( PTRUSTEEA pTrustee
, LPSTR pName
);
39 typedef VOID (WINAPI
*fnBuildTrusteeWithObjectsAndNameA
)( PTRUSTEEA pTrustee
,
40 POBJECTS_AND_NAME_A pObjName
,
41 SE_OBJECT_TYPE ObjectType
,
43 LPSTR InheritedObjectTypeName
,
45 typedef VOID (WINAPI
*fnBuildTrusteeWithObjectsAndSidA
)( PTRUSTEEA pTrustee
,
46 POBJECTS_AND_SID pObjSid
,
48 GUID
* pInheritedObjectGuid
,
50 typedef LPSTR (WINAPI
*fnGetTrusteeNameA
)( PTRUSTEEA pTrustee
);
51 typedef BOOL (WINAPI
*fnConvertSidToStringSidA
)( PSID pSid
, LPSTR
*str
);
52 typedef BOOL (WINAPI
*fnConvertStringSidToSidA
)( LPCSTR str
, PSID pSid
);
53 typedef BOOL (WINAPI
*fnGetFileSecurityA
)(LPCSTR
, SECURITY_INFORMATION
,
54 PSECURITY_DESCRIPTOR
, DWORD
, LPDWORD
);
55 typedef DWORD (WINAPI
*fnRtlAdjustPrivilege
)(ULONG
,BOOLEAN
,BOOLEAN
,PBOOLEAN
);
56 typedef BOOL (WINAPI
*fnCreateWellKnownSid
)(WELL_KNOWN_SID_TYPE
,PSID
,PSID
,DWORD
*);
58 typedef NTSTATUS (WINAPI
*fnLsaQueryInformationPolicy
)(LSA_HANDLE
,POLICY_INFORMATION_CLASS
,PVOID
*);
59 typedef NTSTATUS (WINAPI
*fnLsaClose
)(LSA_HANDLE
);
60 typedef NTSTATUS (WINAPI
*fnLsaFreeMemory
)(PVOID
);
61 typedef NTSTATUS (WINAPI
*fnLsaOpenPolicy
)(PLSA_UNICODE_STRING
,PLSA_OBJECT_ATTRIBUTES
,ACCESS_MASK
,PLSA_HANDLE
);
65 fnBuildTrusteeWithSidA pBuildTrusteeWithSidA
;
66 fnBuildTrusteeWithNameA pBuildTrusteeWithNameA
;
67 fnBuildTrusteeWithObjectsAndNameA pBuildTrusteeWithObjectsAndNameA
;
68 fnBuildTrusteeWithObjectsAndSidA pBuildTrusteeWithObjectsAndSidA
;
69 fnGetTrusteeNameA pGetTrusteeNameA
;
70 fnConvertSidToStringSidA pConvertSidToStringSidA
;
71 fnConvertStringSidToSidA pConvertStringSidToSidA
;
72 fnGetFileSecurityA pGetFileSecurityA
;
73 fnRtlAdjustPrivilege pRtlAdjustPrivilege
;
74 fnCreateWellKnownSid pCreateWellKnownSid
;
75 fnLsaQueryInformationPolicy pLsaQueryInformationPolicy
;
77 fnLsaFreeMemory pLsaFreeMemory
;
78 fnLsaOpenPolicy pLsaOpenPolicy
;
82 SID_IDENTIFIER_AUTHORITY auth
;
86 static void init(void)
88 hmod
= GetModuleHandle("advapi32.dll");
91 static void test_str_sid(const char *str_sid
)
96 if (pConvertStringSidToSidA(str_sid
, &psid
))
98 if (pConvertSidToStringSidA(psid
, &temp
))
100 trace(" %s: %s\n", str_sid
, temp
);
107 if (GetLastError() != ERROR_INVALID_SID
)
108 trace(" %s: couldn't be converted, returned %d\n", str_sid
, GetLastError());
110 trace(" %s: couldn't be converted\n", str_sid
);
114 static void test_sid(void)
116 struct sidRef refs
[] = {
117 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
118 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
119 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
120 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
121 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
122 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
124 const char noSubAuthStr
[] = "S-1-5";
130 pConvertSidToStringSidA
= (fnConvertSidToStringSidA
)
131 GetProcAddress( hmod
, "ConvertSidToStringSidA" );
132 if( !pConvertSidToStringSidA
)
134 pConvertStringSidToSidA
= (fnConvertStringSidToSidA
)
135 GetProcAddress( hmod
, "ConvertStringSidToSidA" );
136 if( !pConvertStringSidToSidA
)
139 r
= pConvertStringSidToSidA( NULL
, NULL
);
140 ok( !r
, "expected failure with NULL parameters\n" );
141 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
143 ok( GetLastError() == ERROR_INVALID_PARAMETER
,
144 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
147 r
= pConvertStringSidToSidA( refs
[0].refStr
, NULL
);
148 ok( !r
&& GetLastError() == ERROR_INVALID_PARAMETER
,
149 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
152 r
= pConvertStringSidToSidA( NULL
, &str
);
153 ok( !r
&& GetLastError() == ERROR_INVALID_PARAMETER
,
154 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
157 r
= pConvertStringSidToSidA( noSubAuthStr
, &psid
);
159 "expected failure with no sub authorities\n" );
160 ok( GetLastError() == ERROR_INVALID_SID
,
161 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
164 for( i
= 0; i
< sizeof(refs
) / sizeof(refs
[0]); i
++ )
168 r
= AllocateAndInitializeSid( &refs
[i
].auth
, 1,1,0,0,0,0,0,0,0,
170 ok( r
, "failed to allocate sid\n" );
171 r
= pConvertSidToStringSidA( psid
, &str
);
172 ok( r
, "failed to convert sid\n" );
175 ok( !strcmp( str
, refs
[i
].refStr
),
176 "incorrect sid, expected %s, got %s\n", refs
[i
].refStr
, str
);
182 r
= pConvertStringSidToSidA( refs
[i
].refStr
, &psid
);
183 ok( r
, "failed to parse sid string\n" );
186 !memcmp( pisid
->IdentifierAuthority
.Value
, refs
[i
].auth
.Value
,
187 sizeof(refs
[i
].auth
) ),
188 "string sid %s didn't parse to expected value\n"
189 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
191 MAKEWORD( pisid
->IdentifierAuthority
.Value
[1],
192 pisid
->IdentifierAuthority
.Value
[0] ),
193 MAKELONG( MAKEWORD( pisid
->IdentifierAuthority
.Value
[5],
194 pisid
->IdentifierAuthority
.Value
[4] ),
195 MAKEWORD( pisid
->IdentifierAuthority
.Value
[3],
196 pisid
->IdentifierAuthority
.Value
[2] ) ),
197 MAKEWORD( refs
[i
].auth
.Value
[1], refs
[i
].auth
.Value
[0] ),
198 MAKELONG( MAKEWORD( refs
[i
].auth
.Value
[5], refs
[i
].auth
.Value
[4] ),
199 MAKEWORD( refs
[i
].auth
.Value
[3], refs
[i
].auth
.Value
[2] ) ) );
204 trace("String SIDs:\n");
245 static void test_trustee(void)
247 GUID ObjectType
= {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
248 GUID InheritedObjectType
= {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
250 OBJECTS_AND_NAME_ oan
;
254 char szObjectTypeName
[] = "ObjectTypeName";
255 char szInheritedObjectTypeName
[] = "InheritedObjectTypeName";
256 char szTrusteeName
[] = "szTrusteeName";
257 SID_IDENTIFIER_AUTHORITY auth
= { {0x11,0x22,0,0,0, 0} };
259 memset( &ZeroGuid
, 0x00, sizeof (ZeroGuid
) );
261 pBuildTrusteeWithSidA
= (fnBuildTrusteeWithSidA
)
262 GetProcAddress( hmod
, "BuildTrusteeWithSidA" );
263 pBuildTrusteeWithNameA
= (fnBuildTrusteeWithNameA
)
264 GetProcAddress( hmod
, "BuildTrusteeWithNameA" );
265 pBuildTrusteeWithObjectsAndNameA
= (fnBuildTrusteeWithObjectsAndNameA
)
266 GetProcAddress (hmod
, "BuildTrusteeWithObjectsAndNameA" );
267 pBuildTrusteeWithObjectsAndSidA
= (fnBuildTrusteeWithObjectsAndSidA
)
268 GetProcAddress (hmod
, "BuildTrusteeWithObjectsAndSidA" );
269 pGetTrusteeNameA
= (fnGetTrusteeNameA
)
270 GetProcAddress (hmod
, "GetTrusteeNameA" );
271 if( !pBuildTrusteeWithSidA
|| !pBuildTrusteeWithNameA
||
272 !pBuildTrusteeWithObjectsAndNameA
|| !pBuildTrusteeWithObjectsAndSidA
||
276 if ( ! AllocateAndInitializeSid( &auth
, 1, 42, 0,0,0,0,0,0,0,&psid
) )
278 trace( "failed to init SID\n" );
282 /* test BuildTrusteeWithSidA */
283 memset( &trustee
, 0xff, sizeof trustee
);
284 pBuildTrusteeWithSidA( &trustee
, psid
);
286 ok( trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
287 ok( trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
,
288 "MultipleTrusteeOperation wrong\n");
289 ok( trustee
.TrusteeForm
== TRUSTEE_IS_SID
, "TrusteeForm wrong\n");
290 ok( trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
291 ok( trustee
.ptstrName
== (LPSTR
) psid
, "ptstrName wrong\n" );
293 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
294 memset( &trustee
, 0xff, sizeof trustee
);
295 memset( &oas
, 0xff, sizeof(oas
) );
296 pBuildTrusteeWithObjectsAndSidA(&trustee
, &oas
, &ObjectType
,
297 &InheritedObjectType
, psid
);
299 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
300 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
301 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_SID
, "TrusteeForm wrong\n");
302 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
303 ok(trustee
.ptstrName
== (LPSTR
)&oas
, "ptstrName wrong\n");
305 ok(oas
.ObjectsPresent
== (ACE_OBJECT_TYPE_PRESENT
| ACE_INHERITED_OBJECT_TYPE_PRESENT
), "ObjectsPresent wrong\n");
306 ok(!memcmp(&oas
.ObjectTypeGuid
, &ObjectType
, sizeof(GUID
)), "ObjectTypeGuid wrong\n");
307 ok(!memcmp(&oas
.InheritedObjectTypeGuid
, &InheritedObjectType
, sizeof(GUID
)), "InheritedObjectTypeGuid wrong\n");
308 ok(oas
.pSid
== psid
, "pSid wrong\n");
310 /* test GetTrusteeNameA */
311 ok(pGetTrusteeNameA(&trustee
) == (LPSTR
)&oas
, "GetTrusteeName returned wrong value\n");
313 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
314 memset( &trustee
, 0xff, sizeof trustee
);
315 memset( &oas
, 0xff, sizeof(oas
) );
316 pBuildTrusteeWithObjectsAndSidA(&trustee
, &oas
, NULL
,
317 &InheritedObjectType
, psid
);
319 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
320 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
321 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_SID
, "TrusteeForm wrong\n");
322 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
323 ok(trustee
.ptstrName
== (LPSTR
)&oas
, "ptstrName wrong\n");
325 ok(oas
.ObjectsPresent
== ACE_INHERITED_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
326 ok(!memcmp(&oas
.ObjectTypeGuid
, &ZeroGuid
, sizeof(GUID
)), "ObjectTypeGuid wrong\n");
327 ok(!memcmp(&oas
.InheritedObjectTypeGuid
, &InheritedObjectType
, sizeof(GUID
)), "InheritedObjectTypeGuid wrong\n");
328 ok(oas
.pSid
== psid
, "pSid wrong\n");
332 /* test BuildTrusteeWithNameA */
333 memset( &trustee
, 0xff, sizeof trustee
);
334 pBuildTrusteeWithNameA( &trustee
, szTrusteeName
);
336 ok( trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
337 ok( trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
,
338 "MultipleTrusteeOperation wrong\n");
339 ok( trustee
.TrusteeForm
== TRUSTEE_IS_NAME
, "TrusteeForm wrong\n");
340 ok( trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
341 ok( trustee
.ptstrName
== szTrusteeName
, "ptstrName wrong\n" );
343 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
344 memset( &trustee
, 0xff, sizeof trustee
);
345 memset( &oan
, 0xff, sizeof(oan
) );
346 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, szObjectTypeName
,
347 szInheritedObjectTypeName
, szTrusteeName
);
349 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
350 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
351 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
352 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
353 ok(trustee
.ptstrName
== (LPTSTR
)&oan
, "ptstrName wrong\n");
355 ok(oan
.ObjectsPresent
== (ACE_OBJECT_TYPE_PRESENT
| ACE_INHERITED_OBJECT_TYPE_PRESENT
), "ObjectsPresent wrong\n");
356 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
357 ok(oan
.InheritedObjectTypeName
== szInheritedObjectTypeName
, "InheritedObjectTypeName wrong\n");
358 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
360 /* test GetTrusteeNameA */
361 ok(pGetTrusteeNameA(&trustee
) == (LPSTR
)&oan
, "GetTrusteeName returned wrong value\n");
363 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
364 memset( &trustee
, 0xff, sizeof trustee
);
365 memset( &oan
, 0xff, sizeof(oan
) );
366 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, NULL
,
367 szInheritedObjectTypeName
, szTrusteeName
);
369 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
370 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
371 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
372 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
373 ok(trustee
.ptstrName
== (LPSTR
)&oan
, "ptstrName wrong\n");
375 ok(oan
.ObjectsPresent
== ACE_INHERITED_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
376 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
377 ok(oan
.InheritedObjectTypeName
== szInheritedObjectTypeName
, "InheritedObjectTypeName wrong\n");
378 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
380 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
381 memset( &trustee
, 0xff, sizeof trustee
);
382 memset( &oan
, 0xff, sizeof(oan
) );
383 pBuildTrusteeWithObjectsAndNameA(&trustee
, &oan
, SE_KERNEL_OBJECT
, szObjectTypeName
,
384 NULL
, szTrusteeName
);
386 ok(trustee
.pMultipleTrustee
== NULL
, "pMultipleTrustee wrong\n");
387 ok(trustee
.MultipleTrusteeOperation
== NO_MULTIPLE_TRUSTEE
, "MultipleTrusteeOperation wrong\n");
388 ok(trustee
.TrusteeForm
== TRUSTEE_IS_OBJECTS_AND_NAME
, "TrusteeForm wrong\n");
389 ok(trustee
.TrusteeType
== TRUSTEE_IS_UNKNOWN
, "TrusteeType wrong\n");
390 ok(trustee
.ptstrName
== (LPTSTR
)&oan
, "ptstrName wrong\n");
392 ok(oan
.ObjectsPresent
== ACE_OBJECT_TYPE_PRESENT
, "ObjectsPresent wrong\n");
393 ok(oan
.ObjectType
== SE_KERNEL_OBJECT
, "ObjectType wrong\n");
394 ok(oan
.InheritedObjectTypeName
== NULL
, "InheritedObjectTypeName wrong\n");
395 ok(oan
.ptstrName
== szTrusteeName
, "szTrusteeName wrong\n");
398 /* If the first isn't defined, assume none is */
399 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
400 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
401 #define SE_CREATE_TOKEN_PRIVILEGE 2L
402 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
403 #define SE_LOCK_MEMORY_PRIVILEGE 4L
404 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
405 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
406 #define SE_TCB_PRIVILEGE 7L
407 #define SE_SECURITY_PRIVILEGE 8L
408 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
409 #define SE_LOAD_DRIVER_PRIVILEGE 10L
410 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
411 #define SE_SYSTEMTIME_PRIVILEGE 12L
412 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
413 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
414 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
415 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
416 #define SE_BACKUP_PRIVILEGE 17L
417 #define SE_RESTORE_PRIVILEGE 18L
418 #define SE_SHUTDOWN_PRIVILEGE 19L
419 #define SE_DEBUG_PRIVILEGE 20L
420 #define SE_AUDIT_PRIVILEGE 21L
421 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
422 #define SE_CHANGE_NOTIFY_PRIVILLEGE 23L
423 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
424 #define SE_UNDOCK_PRIVILEGE 25L
425 #define SE_SYNC_AGENT_PRIVILEGE 26L
426 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
427 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
428 #define SE_IMPERSONATE_PRIVILEGE 29L
429 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
430 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
431 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
433 static void test_allocateLuid(void)
435 BOOL (WINAPI
*pAllocateLocallyUniqueId
)(PLUID
);
439 pAllocateLocallyUniqueId
= (void*)GetProcAddress(hmod
, "AllocateLocallyUniqueId");
440 if (!pAllocateLocallyUniqueId
) return;
442 ret
= pAllocateLocallyUniqueId(&luid1
);
443 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
447 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
448 ret
= pAllocateLocallyUniqueId(&luid2
);
450 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
451 ok(luid1
.LowPart
> SE_MAX_WELL_KNOWN_PRIVILEGE
|| luid1
.HighPart
!= 0,
452 "AllocateLocallyUniqueId returned a well-known LUID\n");
453 ok(luid1
.LowPart
!= luid2
.LowPart
|| luid1
.HighPart
!= luid2
.HighPart
,
454 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
455 ret
= pAllocateLocallyUniqueId(NULL
);
456 ok( !ret
&& GetLastError() == ERROR_NOACCESS
,
457 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
461 static void test_lookupPrivilegeName(void)
463 BOOL (WINAPI
*pLookupPrivilegeNameA
)(LPCSTR
, PLUID
, LPSTR
, LPDWORD
);
464 char buf
[MAX_PATH
]; /* arbitrary, seems long enough */
465 DWORD cchName
= sizeof(buf
);
466 LUID luid
= { 0, 0 };
470 /* check whether it's available first */
471 pLookupPrivilegeNameA
= (void*)GetProcAddress(hmod
, "LookupPrivilegeNameA");
472 if (!pLookupPrivilegeNameA
) return;
473 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
474 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
475 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
478 /* check with a short buffer */
480 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
481 ret
= pLookupPrivilegeNameA(NULL
, &luid
, NULL
, &cchName
);
482 ok( !ret
&& GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
483 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
485 ok(cchName
== strlen("SeCreateTokenPrivilege") + 1,
486 "LookupPrivilegeNameA returned an incorrect required length for\n"
487 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName
,
488 lstrlenA("SeCreateTokenPrivilege") + 1);
489 /* check a known value and its returned length on success */
490 cchName
= sizeof(buf
);
491 ok(pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
) &&
492 cchName
== strlen("SeCreateTokenPrivilege"),
493 "LookupPrivilegeNameA returned an incorrect output length for\n"
494 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName
,
495 (int)strlen("SeCreateTokenPrivilege"));
496 /* check known values */
497 for (i
= SE_MIN_WELL_KNOWN_PRIVILEGE
; i
< SE_MAX_WELL_KNOWN_PRIVILEGE
; i
++)
500 cchName
= sizeof(buf
);
501 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
502 ok( ret
|| GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
503 "LookupPrivilegeNameA(0.%d) failed: %d\n", i
, GetLastError());
505 /* check a bogus LUID */
506 luid
.LowPart
= 0xdeadbeef;
507 cchName
= sizeof(buf
);
508 ret
= pLookupPrivilegeNameA(NULL
, &luid
, buf
, &cchName
);
509 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
510 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
512 /* check on a bogus system */
513 luid
.LowPart
= SE_CREATE_TOKEN_PRIVILEGE
;
514 cchName
= sizeof(buf
);
515 ret
= pLookupPrivilegeNameA("b0gu5.Nam3", &luid
, buf
, &cchName
);
516 ok( !ret
&& GetLastError() == RPC_S_SERVER_UNAVAILABLE
,
517 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
527 static void test_lookupPrivilegeValue(void)
529 static const struct NameToLUID privs
[] = {
530 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE
},
531 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE
},
532 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE
},
533 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE
},
534 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE
},
535 { "SeTcbPrivilege", SE_TCB_PRIVILEGE
},
536 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE
},
537 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE
},
538 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE
},
539 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE
},
540 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE
},
541 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE
},
542 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE
},
543 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE
},
544 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE
},
545 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE
},
546 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE
},
547 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE
},
548 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE
},
549 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE
},
550 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE
},
551 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILLEGE
},
552 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE
},
553 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE
},
554 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE
},
555 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE
},
556 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE
},
557 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE
},
558 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE
},
560 BOOL (WINAPI
*pLookupPrivilegeValueA
)(LPCSTR
, LPCSTR
, PLUID
);
565 /* check whether it's available first */
566 pLookupPrivilegeValueA
= (void*)GetProcAddress(hmod
, "LookupPrivilegeValueA");
567 if (!pLookupPrivilegeValueA
) return;
568 ret
= pLookupPrivilegeValueA(NULL
, "SeCreateTokenPrivilege", &luid
);
569 if (!ret
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
572 /* check a bogus system name */
573 ret
= pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid
);
574 ok( !ret
&& GetLastError() == RPC_S_SERVER_UNAVAILABLE
,
575 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
577 /* check a NULL string */
578 ret
= pLookupPrivilegeValueA(NULL
, 0, &luid
);
579 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
580 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
582 /* check a bogus privilege name */
583 ret
= pLookupPrivilegeValueA(NULL
, "SeBogusPrivilege", &luid
);
584 ok( !ret
&& GetLastError() == ERROR_NO_SUCH_PRIVILEGE
,
585 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
587 /* check case insensitive */
588 ret
= pLookupPrivilegeValueA(NULL
, "sEcREATEtOKENpRIVILEGE", &luid
);
590 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
592 for (i
= 0; i
< sizeof(privs
) / sizeof(privs
[0]); i
++)
594 /* Not all privileges are implemented on all Windows versions, so
595 * don't worry if the call fails
597 if (pLookupPrivilegeValueA(NULL
, privs
[i
].name
, &luid
))
599 ok(luid
.LowPart
== privs
[i
].lowPart
,
600 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
606 static void test_luid(void)
609 test_lookupPrivilegeName();
610 test_lookupPrivilegeValue();
613 static void test_FileSecurity(void)
615 char directory
[MAX_PATH
];
616 DWORD retval
, outSize
;
620 pGetFileSecurityA
= (fnGetFileSecurityA
)
621 GetProcAddress( hmod
, "GetFileSecurityA" );
622 if( !pGetFileSecurityA
)
625 retval
= GetTempPathA(sizeof(directory
), directory
);
627 trace("GetTempPathA failed\n");
631 strcpy(directory
, "\\Should not exist");
633 SetLastError(NO_ERROR
);
634 result
= pGetFileSecurityA( directory
,OWNER_SECURITY_INFORMATION
,buffer
,0x40,&outSize
);
635 ok(!result
, "GetFileSecurityA should fail for not existing directories/files\n");
636 ok( (GetLastError() == ERROR_FILE_NOT_FOUND
) ||
637 (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
) ,
638 "last error ERROR_FILE_NOT_FOUND / ERROR_CALL_NOT_IMPLEMENTED (98) "
639 "expected, got %d\n", GetLastError());
642 static void test_AccessCheck(void)
644 PSID EveryoneSid
= NULL
, AdminSid
= NULL
, UsersSid
= NULL
;
646 SECURITY_DESCRIPTOR
*SecurityDescriptor
= NULL
;
647 SID_IDENTIFIER_AUTHORITY SIDAuthWorld
= { SECURITY_WORLD_SID_AUTHORITY
};
648 SID_IDENTIFIER_AUTHORITY SIDAuthNT
= { SECURITY_NT_AUTHORITY
};
649 GENERIC_MAPPING Mapping
= { KEY_READ
, KEY_WRITE
, KEY_EXECUTE
, KEY_ALL_ACCESS
};
655 PRIVILEGE_SET
*PrivSet
;
660 NtDllModule
= GetModuleHandle("ntdll.dll");
664 trace("not running on NT, skipping test\n");
667 pRtlAdjustPrivilege
= (fnRtlAdjustPrivilege
)
668 GetProcAddress(NtDllModule
, "RtlAdjustPrivilege");
669 if (!pRtlAdjustPrivilege
) return;
671 Acl
= HeapAlloc(GetProcessHeap(), 0, 256);
672 res
= InitializeAcl(Acl
, 256, ACL_REVISION
);
673 if(!res
&& GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
)
675 trace("ACLs not implemented - skipping tests\n");
678 ok(res
, "InitializeAcl failed with error %d\n", GetLastError());
680 res
= AllocateAndInitializeSid( &SIDAuthWorld
, 1, SECURITY_WORLD_RID
, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid
);
681 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
683 res
= AllocateAndInitializeSid( &SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
684 DOMAIN_ALIAS_RID_ADMINS
, 0, 0, 0, 0, 0, 0, &AdminSid
);
685 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
687 res
= AllocateAndInitializeSid( &SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
688 DOMAIN_ALIAS_RID_USERS
, 0, 0, 0, 0, 0, 0, &UsersSid
);
689 ok(res
, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
691 res
= AddAccessAllowedAce(Acl
, ACL_REVISION
, KEY_READ
, EveryoneSid
);
692 ok(res
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
694 res
= AddAccessAllowedAce(Acl
, ACL_REVISION
, KEY_ALL_ACCESS
, AdminSid
);
695 ok(res
, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
697 SecurityDescriptor
= HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH
);
699 res
= InitializeSecurityDescriptor(SecurityDescriptor
, SECURITY_DESCRIPTOR_REVISION
);
700 ok(res
, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
702 res
= SetSecurityDescriptorDacl(SecurityDescriptor
, TRUE
, Acl
, FALSE
);
703 ok(res
, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
705 res
= SetSecurityDescriptorOwner(SecurityDescriptor
, AdminSid
, FALSE
);
706 ok(res
, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
708 res
= SetSecurityDescriptorGroup(SecurityDescriptor
, UsersSid
, TRUE
);
709 ok(res
, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
711 PrivSetLen
= FIELD_OFFSET(PRIVILEGE_SET
, Privilege
[16]);
712 PrivSet
= HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY
, PrivSetLen
);
713 PrivSet
->PrivilegeCount
= 16;
715 ImpersonateSelf(SecurityImpersonation
);
717 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE
, FALSE
, TRUE
, &Enabled
);
719 ret
= OpenThreadToken(GetCurrentThread(),
720 TOKEN_QUERY
, TRUE
, &Token
);
721 ok(ret
, "OpenThreadToken failed with error %d\n", GetLastError());
723 ret
= AccessCheck(SecurityDescriptor
, Token
, KEY_READ
, &Mapping
,
724 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
725 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
726 ok(AccessStatus
&& (Access
== KEY_READ
),
727 "AccessCheck failed to grant access with error %d\n",
730 ret
= AccessCheck(SecurityDescriptor
, Token
, MAXIMUM_ALLOWED
, &Mapping
,
731 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
732 ok(ret
, "AccessCheck failed with error %d\n", GetLastError());
734 "AccessCheck failed to grant any access with error %d\n",
736 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access
);
739 PrivSet
->PrivilegeCount
= 16;
740 ret
= AccessCheck(SecurityDescriptor
, Token
, ACCESS_SYSTEM_SECURITY
, &Mapping
,
741 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
742 ok(ret
&& !AccessStatus
&& GetLastError() == ERROR_PRIVILEGE_NOT_HELD
,
743 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
746 ret
= pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE
, TRUE
, TRUE
, &Enabled
);
750 PrivSet
->PrivilegeCount
= 16;
751 ret
= AccessCheck(SecurityDescriptor
, Token
, ACCESS_SYSTEM_SECURITY
, &Mapping
,
752 PrivSet
, &PrivSetLen
, &Access
, &AccessStatus
);
753 ok(ret
&& AccessStatus
&& GetLastError() == 0,
754 "AccessCheck should have succeeded, error %d\n",
756 ok(Access
== ACCESS_SYSTEM_SECURITY
,
757 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
761 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
767 FreeSid(EveryoneSid
);
772 HeapFree(GetProcessHeap(), 0, Acl
);
773 HeapFree(GetProcessHeap(), 0, SecurityDescriptor
);
774 HeapFree(GetProcessHeap(), 0, PrivSet
);
777 /* test GetTokenInformation for the various attributes */
778 static void test_token_attr(void)
782 TOKEN_PRIVILEGES
*Privileges
;
783 TOKEN_GROUPS
*Groups
;
789 /* cygwin-like use case */
790 ret
= OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED
, &Token
);
791 ok(ret
, "OpenProcessToken failed with error %d\n", GetLastError());
795 DWORD bufsize
= sizeof(buf
);
796 ret
= GetTokenInformation(Token
, TokenUser
,(void*)buf
, bufsize
, &bufsize
);
797 todo_wine
ok(ret
, "GetTokenInformation failed with error %d\n", GetLastError());
801 if(!pConvertSidToStringSidA
)
804 ret
= OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY
, &Token
);
805 GLE
= GetLastError();
806 ok(ret
|| (GLE
== ERROR_CALL_NOT_IMPLEMENTED
),
807 "OpenProcessToken failed with error %d\n", GLE
);
808 if(!ret
&& (GLE
== ERROR_CALL_NOT_IMPLEMENTED
))
810 trace("OpenProcessToken() not implemented, skipping test_token_attr()\n");
815 ret
= GetTokenInformation(Token
, TokenGroups
, NULL
, 0, &Size
);
816 Groups
= HeapAlloc(GetProcessHeap(), 0, Size
);
817 ret
= GetTokenInformation(Token
, TokenGroups
, Groups
, Size
, &Size
);
818 ok(ret
, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
819 trace("TokenGroups:\n");
820 for (i
= 0; i
< Groups
->GroupCount
; i
++)
822 DWORD NameLength
= 255;
824 DWORD DomainLength
= 255;
826 SID_NAME_USE SidNameUse
;
827 pConvertSidToStringSidA(Groups
->Groups
[i
].Sid
, &SidString
);
830 ret
= LookupAccountSid(NULL
, Groups
->Groups
[i
].Sid
, Name
, &NameLength
, Domain
, &DomainLength
, &SidNameUse
);
831 ok(ret
, "LookupAccountSid(%s) failed with error %d\n", SidString
, GetLastError());
832 trace("\t%s, %s\\%s use: %d attr: 0x%08x\n", SidString
, Domain
, Name
, SidNameUse
, Groups
->Groups
[i
].Attributes
);
833 LocalFree(SidString
);
835 HeapFree(GetProcessHeap(), 0, Groups
);
838 ret
= GetTokenInformation(Token
, TokenUser
, NULL
, 0, &Size
);
839 ok(!ret
&& (GetLastError() == ERROR_INSUFFICIENT_BUFFER
),
840 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
841 User
= HeapAlloc(GetProcessHeap(), 0, Size
);
842 ret
= GetTokenInformation(Token
, TokenUser
, User
, Size
, &Size
);
844 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
846 pConvertSidToStringSidA(User
->User
.Sid
, &SidString
);
847 trace("TokenUser: %s attr: 0x%08x\n", SidString
, User
->User
.Attributes
);
848 LocalFree(SidString
);
849 HeapFree(GetProcessHeap(), 0, User
);
852 ret
= GetTokenInformation(Token
, TokenPrivileges
, NULL
, 0, &Size
);
853 ok(!ret
&& (GetLastError() == ERROR_INSUFFICIENT_BUFFER
),
854 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
855 Privileges
= HeapAlloc(GetProcessHeap(), 0, Size
);
856 ret
= GetTokenInformation(Token
, TokenPrivileges
, Privileges
, Size
, &Size
);
858 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
859 trace("TokenPrivileges:\n");
860 for (i
= 0; i
< Privileges
->PrivilegeCount
; i
++)
863 DWORD NameLen
= sizeof(Name
)/sizeof(Name
[0]);
864 LookupPrivilegeName(NULL
, &Privileges
->Privileges
[i
].Luid
, Name
, &NameLen
);
865 trace("\t%s, 0x%x\n", Name
, Privileges
->Privileges
[i
].Attributes
);
869 typedef union _MAX_SID
872 char max
[SECURITY_MAX_SID_SIZE
];
875 static void test_sid_str(PSID
* sid
)
878 BOOL ret
= pConvertSidToStringSidA(sid
, &str_sid
);
879 ok(ret
, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
882 char account
[MAX_PATH
], domain
[MAX_PATH
];
884 DWORD acc_size
= MAX_PATH
;
885 DWORD dom_size
= MAX_PATH
;
886 ret
= LookupAccountSid(NULL
, sid
, account
, &acc_size
, domain
, &dom_size
, &use
);
887 ok(ret
|| (!ret
&& (GetLastError() == ERROR_NONE_MAPPED
)),
888 "LookupAccountSid(%s) failed: %d\n", str_sid
, GetLastError());
890 trace(" %s %s\\%s %d\n", str_sid
, domain
, account
, use
);
891 else if (GetLastError() == ERROR_NONE_MAPPED
)
892 trace(" %s couldn't be mapped\n", str_sid
);
897 static void test_LookupAccountSid(void)
899 SID_IDENTIFIER_AUTHORITY SIDAuthNT
= { SECURITY_NT_AUTHORITY
};
900 CHAR accountA
[MAX_PATH
], domainA
[MAX_PATH
];
901 DWORD acc_sizeA
, dom_sizeA
;
902 DWORD real_acc_sizeA
, real_dom_sizeA
;
903 WCHAR accountW
[MAX_PATH
], domainW
[MAX_PATH
];
904 DWORD acc_sizeW
, dom_sizeW
;
905 DWORD real_acc_sizeW
, real_dom_sizeW
;
906 PSID pUsersSid
= NULL
;
914 /* native windows crashes if account size, domain size, or name use is NULL */
916 ret
= AllocateAndInitializeSid(&SIDAuthNT
, 2, SECURITY_BUILTIN_DOMAIN_RID
,
917 DOMAIN_ALIAS_RID_USERS
, 0, 0, 0, 0, 0, 0, &pUsersSid
);
918 ok(ret
|| (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
),
919 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
921 /* not running on NT so give up */
922 if (!ret
&& (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED
))
925 real_acc_sizeA
= MAX_PATH
;
926 real_dom_sizeA
= MAX_PATH
;
927 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &real_acc_sizeA
, domainA
, &real_dom_sizeA
, &use
);
928 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
930 /* try NULL account */
931 acc_sizeA
= MAX_PATH
;
932 dom_sizeA
= MAX_PATH
;
933 ret
= LookupAccountSidA(NULL
, pUsersSid
, NULL
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
934 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
936 /* try NULL domain */
937 acc_sizeA
= MAX_PATH
;
938 dom_sizeA
= MAX_PATH
;
939 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, NULL
, &dom_sizeA
, &use
);
940 ok(ret
, "LookupAccountSidA() Expected TRUE, got FALSE\n");
942 /* try a small account buffer */
944 dom_sizeA
= MAX_PATH
;
946 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
947 ok(!ret
, "LookupAccountSidA() Expected FALSE got TRUE\n");
948 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
949 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
951 /* try a 0 sized account buffer */
953 dom_sizeA
= MAX_PATH
;
955 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
956 /* this can fail or succeed depending on OS version but the size will always be returned */
957 ok(acc_sizeA
== real_acc_sizeA
+ 1,
958 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
959 real_acc_sizeA
+ 1, acc_sizeA
);
961 /* try a 0 sized account buffer */
963 dom_sizeA
= MAX_PATH
;
964 ret
= LookupAccountSidA(NULL
, pUsersSid
, NULL
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
965 /* this can fail or succeed depending on OS version but the size will always be returned */
966 ok(acc_sizeA
== real_acc_sizeA
+ 1,
967 "LookupAccountSid() Expected acc_size = %u, got %u\n",
968 real_acc_sizeA
+ 1, acc_sizeA
);
970 /* try a small domain buffer */
972 acc_sizeA
= MAX_PATH
;
974 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
975 ok(!ret
, "LookupAccountSidA() Expected FALSE got TRUE\n");
976 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
977 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
979 /* try a 0 sized domain buffer */
981 acc_sizeA
= MAX_PATH
;
983 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
);
984 /* this can fail or succeed depending on OS version but the size will always be returned */
985 ok(dom_sizeA
== real_dom_sizeA
+ 1,
986 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
987 real_dom_sizeA
+ 1, dom_sizeA
);
989 /* try a 0 sized domain buffer */
991 acc_sizeA
= MAX_PATH
;
992 ret
= LookupAccountSidA(NULL
, pUsersSid
, accountA
, &acc_sizeA
, NULL
, &dom_sizeA
, &use
);
993 /* this can fail or succeed depending on OS version but the size will always be returned */
994 ok(dom_sizeA
== real_dom_sizeA
+ 1,
995 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
996 real_dom_sizeA
+ 1, dom_sizeA
);
998 real_acc_sizeW
= MAX_PATH
;
999 real_dom_sizeW
= MAX_PATH
;
1000 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &real_acc_sizeW
, domainW
, &real_dom_sizeW
, &use
);
1001 ok(ret
, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1003 /* native windows crashes if domainW or accountW is NULL */
1005 /* try a small account buffer */
1007 dom_sizeW
= MAX_PATH
;
1009 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1010 ok(!ret
, "LookupAccountSidW() Expected FALSE got TRUE\n");
1011 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1012 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1014 /* try a 0 sized account buffer */
1016 dom_sizeW
= MAX_PATH
;
1018 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1019 /* this can fail or succeed depending on OS version but the size will always be returned */
1020 ok(acc_sizeW
== real_acc_sizeW
+ 1,
1021 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1022 real_acc_sizeW
+ 1, acc_sizeW
);
1024 /* try a 0 sized account buffer */
1026 dom_sizeW
= MAX_PATH
;
1027 ret
= LookupAccountSidW(NULL
, pUsersSid
, NULL
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1028 /* this can fail or succeed depending on OS version but the size will always be returned */
1029 ok(acc_sizeW
== real_acc_sizeW
+ 1,
1030 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1031 real_acc_sizeW
+ 1, acc_sizeW
);
1033 /* try a small domain buffer */
1035 acc_sizeW
= MAX_PATH
;
1037 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1038 ok(!ret
, "LookupAccountSidW() Expected FALSE got TRUE\n");
1039 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER
,
1040 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1042 /* try a 0 sized domain buffer */
1044 acc_sizeW
= MAX_PATH
;
1046 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, domainW
, &dom_sizeW
, &use
);
1047 /* this can fail or succeed depending on OS version but the size will always be returned */
1048 ok(dom_sizeW
== real_dom_sizeW
+ 1,
1049 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1050 real_dom_sizeW
+ 1, dom_sizeW
);
1052 /* try a 0 sized domain buffer */
1054 acc_sizeW
= MAX_PATH
;
1055 ret
= LookupAccountSidW(NULL
, pUsersSid
, accountW
, &acc_sizeW
, NULL
, &dom_sizeW
, &use
);
1056 /* this can fail or succeed depending on OS version but the size will always be returned */
1057 ok(dom_sizeW
== real_dom_sizeW
+ 1,
1058 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1059 real_dom_sizeW
+ 1, dom_sizeW
);
1063 pCreateWellKnownSid
= (fnCreateWellKnownSid
)GetProcAddress( hmod
, "CreateWellKnownSid" );
1065 if (pCreateWellKnownSid
&& pConvertSidToStringSidA
)
1067 trace("Well Known SIDs:\n");
1068 for (i
= 0; i
<= 60; i
++)
1070 size
= SECURITY_MAX_SID_SIZE
;
1071 if (pCreateWellKnownSid(i
, NULL
, &max_sid
.sid
, &size
))
1073 if (pConvertSidToStringSidA(&max_sid
.sid
, &str_sidA
))
1075 acc_sizeA
= MAX_PATH
;
1076 dom_sizeA
= MAX_PATH
;
1077 if (LookupAccountSidA(NULL
, &max_sid
.sid
, accountA
, &acc_sizeA
, domainA
, &dom_sizeA
, &use
))
1078 trace(" %d: %s %s\\%s %d\n", i
, str_sidA
, domainA
, accountA
, use
);
1079 LocalFree(str_sidA
);
1084 if (GetLastError() != ERROR_INVALID_PARAMETER
)
1085 trace(" CreateWellKnownSid(%d) failed: %d\n", i
, GetLastError());
1087 trace(" %d: not supported\n", i
);
1091 pLsaQueryInformationPolicy
= (fnLsaQueryInformationPolicy
)GetProcAddress( hmod
, "LsaQueryInformationPolicy");
1092 pLsaOpenPolicy
= (fnLsaOpenPolicy
)GetProcAddress( hmod
, "LsaOpenPolicy");
1093 pLsaFreeMemory
= (fnLsaFreeMemory
)GetProcAddress( hmod
, "LsaFreeMemory");
1094 pLsaClose
= (fnLsaClose
)GetProcAddress( hmod
, "LsaClose");
1096 if (pLsaQueryInformationPolicy
&& pLsaOpenPolicy
&& pLsaFreeMemory
&& pLsaClose
)
1100 LSA_OBJECT_ATTRIBUTES object_attributes
;
1102 ZeroMemory(&object_attributes
, sizeof(object_attributes
));
1103 object_attributes
.Length
= sizeof(object_attributes
);
1105 status
= pLsaOpenPolicy( NULL
, &object_attributes
, POLICY_ALL_ACCESS
, &handle
);
1106 ok(status
== STATUS_SUCCESS
|| status
== STATUS_ACCESS_DENIED
,
1107 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status
);
1109 /* try a more restricted access mask if necessary */
1110 if (status
== STATUS_ACCESS_DENIED
) {
1111 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
1112 status
= pLsaOpenPolicy( NULL
, &object_attributes
, POLICY_VIEW_LOCAL_INFORMATION
, &handle
);
1113 ok(status
== STATUS_SUCCESS
, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status
);
1116 if (status
== STATUS_SUCCESS
)
1118 PPOLICY_ACCOUNT_DOMAIN_INFO info
;
1119 status
= pLsaQueryInformationPolicy(handle
, PolicyAccountDomainInformation
, (PVOID
*)&info
);
1120 ok(status
== STATUS_SUCCESS
, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status
);
1121 if (status
== STATUS_SUCCESS
)
1123 ok(info
->DomainSid
!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
1124 if (info
->DomainSid
)
1126 int count
= *GetSidSubAuthorityCount(info
->DomainSid
);
1127 CopySid(GetSidLengthRequired(count
), &max_sid
, info
->DomainSid
);
1128 test_sid_str((PSID
)&max_sid
.sid
);
1129 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_USER_RID_ADMIN
;
1130 max_sid
.sid
.SubAuthorityCount
= count
+ 1;
1131 test_sid_str((PSID
)&max_sid
.sid
);
1132 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_USER_RID_GUEST
;
1133 test_sid_str((PSID
)&max_sid
.sid
);
1134 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_ADMINS
;
1135 test_sid_str((PSID
)&max_sid
.sid
);
1136 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_USERS
;
1137 test_sid_str((PSID
)&max_sid
.sid
);
1138 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_GUESTS
;
1139 test_sid_str((PSID
)&max_sid
.sid
);
1140 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_COMPUTERS
;
1141 test_sid_str((PSID
)&max_sid
.sid
);
1142 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_CONTROLLERS
;
1143 test_sid_str((PSID
)&max_sid
.sid
);
1144 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_CERT_ADMINS
;
1145 test_sid_str((PSID
)&max_sid
.sid
);
1146 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_SCHEMA_ADMINS
;
1147 test_sid_str((PSID
)&max_sid
.sid
);
1148 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS
;
1149 test_sid_str((PSID
)&max_sid
.sid
);
1150 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_GROUP_RID_POLICY_ADMINS
;
1151 test_sid_str((PSID
)&max_sid
.sid
);
1152 max_sid
.sid
.SubAuthority
[count
] = DOMAIN_ALIAS_RID_RAS_SERVERS
;
1153 test_sid_str((PSID
)&max_sid
.sid
);
1154 max_sid
.sid
.SubAuthority
[count
] = 1000; /* first user account */
1155 test_sid_str((PSID
)&max_sid
.sid
);
1158 pLsaFreeMemory((LPVOID
)info
);
1161 status
= pLsaClose(handle
);
1162 ok(status
== STATUS_SUCCESS
, "LsaClose() failed, returned 0x%08x\n", status
);
1168 START_TEST(security
)
1175 test_FileSecurity();
1178 test_LookupAccountSid();