mirror of https://github.com/lianthony/NT4.0
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1924 lines
50 KiB
1924 lines
50 KiB
/*++
|
|
|
|
Copyright (c) 1989 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
Seassign.c
|
|
|
|
Abstract:
|
|
|
|
This Module implements the SeAssignSecurity procedure. For a description
|
|
of the pool allocation strategy please see the comments in semethod.c
|
|
|
|
Author:
|
|
|
|
Gary Kimura (GaryKi) 9-Nov-1989
|
|
|
|
Environment:
|
|
|
|
Kernel Mode
|
|
|
|
Revision History:
|
|
|
|
Richard Ward (RichardW) 14-April-92
|
|
Robert Reichel (RobertRe) 28-February-95
|
|
Added Compound ACEs
|
|
|
|
--*/
|
|
|
|
|
|
#include "sep.h"
|
|
#include "tokenp.h"
|
|
#include "sertlp.h"
|
|
#include "zwapi.h"
|
|
|
|
|
|
|
|
//
|
|
// Local macros and procedures
|
|
//
|
|
|
|
//
|
|
// Macros to determine if an ACE contains one of the Creator SIDs
|
|
//
|
|
|
|
#define ContainsCreatorOwnerSid(Ace) ( \
|
|
RtlEqualSid( &((PKNOWN_ACE)( Ace ))->SidStart, SeCreatorOwnerSid ) \
|
|
)
|
|
|
|
#define ContainsCreatorGroupSid(Ace) ( \
|
|
RtlEqualSid( &((PKNOWN_ACE)( Ace ))->SidStart, SeCreatorGroupSid ) \
|
|
)
|
|
|
|
|
|
|
|
VOID
|
|
SepApplyAclToObject (
|
|
IN PACL Acl,
|
|
IN PGENERIC_MAPPING GenericMapping
|
|
);
|
|
|
|
NTSTATUS
|
|
SepInheritAcl (
|
|
IN PACL Acl,
|
|
IN BOOLEAN IsDirectoryObject,
|
|
IN PSID OwnerSid,
|
|
IN PSID GroupSid,
|
|
IN PSID ServerSid OPTIONAL,
|
|
IN PSID ClientSid OPTIONAL,
|
|
IN PGENERIC_MAPPING GenericMapping,
|
|
IN POOL_TYPE PoolType,
|
|
OUT PACL *NewAcl
|
|
);
|
|
|
|
|
|
#ifdef ALLOC_PRAGMA
|
|
#pragma alloc_text(PAGE,SeAssignSecurity)
|
|
#pragma alloc_text(PAGE,SeDeassignSecurity)
|
|
#pragma alloc_text(PAGE,SepApplyAclToObject)
|
|
#pragma alloc_text(PAGE,SepInheritAcl)
|
|
#pragma alloc_text(PAGE,SeAssignWorldSecurityDescriptor)
|
|
#pragma alloc_text(PAGE,SepDumpSecurityDescriptor)
|
|
#pragma alloc_text(PAGE,SepPrintAcl)
|
|
#pragma alloc_text(PAGE,SepPrintSid)
|
|
#pragma alloc_text(PAGE,SepDumpTokenInfo)
|
|
#pragma alloc_text(PAGE,SepSidTranslation)
|
|
#endif
|
|
|
|
|
|
//
|
|
// These variables control whether security descriptors and token
|
|
// information are dumped by their dump routines. This allows
|
|
// selective turning on and off of debugging output by both program
|
|
// control and via the kernel debugger.
|
|
//
|
|
|
|
#if DBG
|
|
|
|
BOOLEAN SepDumpSD = FALSE;
|
|
BOOLEAN SepDumpToken = FALSE;
|
|
|
|
#endif
|
|
|
|
|
|
NTSTATUS
|
|
SeAssignSecurity (
|
|
IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL,
|
|
IN PSECURITY_DESCRIPTOR ExplicitDescriptor OPTIONAL,
|
|
OUT PSECURITY_DESCRIPTOR *NewDescriptor,
|
|
IN BOOLEAN IsDirectoryObject,
|
|
IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
|
|
IN PGENERIC_MAPPING GenericMapping,
|
|
IN POOL_TYPE PoolType
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine assumes privilege checking HAS NOT yet been performed
|
|
and so will be performed by this routine.
|
|
|
|
This procedure is used to build a security descriptor for a new object
|
|
given the security descriptor of its parent directory and any originally
|
|
requested security for the object. The final security descriptor
|
|
returned to the caller may contain a mix of information, some explicitly
|
|
provided other from the new object's parent.
|
|
|
|
System and Discretionary ACL Assignment
|
|
---------------------------------------
|
|
|
|
The assignment of system and discretionary ACLs is governed by the
|
|
logic illustrated in the following table (numbers in the cells refer
|
|
to comments in the code):
|
|
|
|
| Explicit | Explicit |
|
|
| (non-default) | Default | No
|
|
| Acl | Acl | Acl
|
|
| Specified | Specified | Specified
|
|
-------------+----------------+---------------+--------------
|
|
| (1)| (3)| (5)
|
|
Inheritable | Assign | Assign | Assign
|
|
Acl From | Specified | Inherited | Inherited
|
|
Parent | Acl | Acl | Acl
|
|
| | |
|
|
-------------+----------------+---------------+--------------
|
|
No | (2)| (4)| (6)
|
|
Inheritable | Assign | Assign | Assign
|
|
Acl From | Specified | Default | No Acl
|
|
Parent | Acl | Acl |
|
|
| | |
|
|
-------------+----------------+---------------+--------------
|
|
|
|
Note that an explicitly specified ACL, whether a default ACL or
|
|
not, may be empty or null.
|
|
|
|
If the caller is explicitly assigning a system acl, default or
|
|
non-default, the caller must either be a kernel mode client or
|
|
must be appropriately privileged.
|
|
|
|
|
|
Owner and Group Assignment
|
|
--------------------------
|
|
|
|
The assignment of the new object's owner and group is governed
|
|
by the following logic:
|
|
|
|
1) If the passed security descriptor includes an owner, it
|
|
is assigned as the new object's owner. Otherwise, the
|
|
caller's token is looked in for the owner. Within the
|
|
token, if there is a default owner, it is assigned.
|
|
Otherwise, the caller's user ID is assigned.
|
|
|
|
2) If the passed security descriptor includes a group, it
|
|
is assigned as the new object's group. Otherwise, the
|
|
caller's token is looked in for the group. Within the
|
|
token, if there is a default group, it is assigned.
|
|
Otherwise, the caller's primary group ID is assigned.
|
|
|
|
|
|
|
|
Arguments:
|
|
|
|
ParentDescriptor - Optionally supplies the security descriptor of the
|
|
parent directory under which this new object is being created.
|
|
|
|
ExplicitDescriptor - Supplies the address of a pointer to the security
|
|
descriptor as specified by the user that is to be applied to
|
|
the new object.
|
|
|
|
NewDescriptor - Returns the actual security descriptor for the new
|
|
object that has been modified according to above rules.
|
|
|
|
IsDirectoryObject - Specifies if the new object is itself a directory
|
|
object. A value of TRUE indicates the object is a container of other
|
|
objects.
|
|
|
|
SubjectContext - Supplies the security context of the subject creating the
|
|
object. This is used to retrieve default security information for the
|
|
new object, such as default owner, primary group, and discretionary
|
|
access control.
|
|
|
|
GenericMapping - Supplies a pointer to an array of access mask values
|
|
denoting the mapping between each generic right to non-generic rights.
|
|
|
|
PoolType - Specifies the pool type to use to when allocating a new
|
|
security descriptor.
|
|
|
|
Return Value:
|
|
|
|
STATUS_SUCCESS - indicates the operation was successful.
|
|
|
|
STATUS_INVALID_OWNER - The owner SID provided as the owner of the
|
|
target security descriptor is not one the caller is authorized
|
|
to assign as the owner of an object.
|
|
|
|
STATUS_PRIVILEGE_NOT_HELD - The caller does not have the privilege
|
|
necessary to explicitly assign the specified system ACL.
|
|
SeSecurityPrivilege privilege is needed to explicitly assign
|
|
system ACLs to objects.
|
|
--*/
|
|
|
|
{
|
|
|
|
|
|
KPROCESSOR_MODE RequestorMode;
|
|
|
|
SECURITY_DESCRIPTOR *CapturedDescriptor;
|
|
SECURITY_DESCRIPTOR InCaseOneNotPassed;
|
|
BOOLEAN SecurityDescriptorPassed;
|
|
|
|
NTSTATUS Status;
|
|
|
|
BOOLEAN RequestorCanAssignDescriptor = TRUE;
|
|
|
|
PACL NewSacl = NULL;
|
|
BOOLEAN NewSaclPresent = FALSE;
|
|
BOOLEAN NewSaclInherited = FALSE;
|
|
|
|
PACL NewDacl = NULL;
|
|
BOOLEAN NewDaclPresent = FALSE;
|
|
BOOLEAN NewDaclInherited = FALSE;
|
|
|
|
PACL ServerDacl = NULL;
|
|
BOOLEAN ServerDaclAllocated = FALSE;
|
|
|
|
PSID NewOwner = NULL;
|
|
PSID NewGroup = NULL;
|
|
|
|
BOOLEAN CleanUp = FALSE;
|
|
BOOLEAN SaclExplicitlyAssigned = FALSE;
|
|
BOOLEAN DaclExplicitlyAssigned = FALSE;
|
|
BOOLEAN OwnerExplicitlyAssigned = FALSE;
|
|
|
|
BOOLEAN ServerObject;
|
|
BOOLEAN DaclUntrusted;
|
|
|
|
BOOLEAN HasPrivilege;
|
|
|
|
PSID SubjectContextOwner;
|
|
PSID SubjectContextGroup;
|
|
PSID SubjectContextServerOwner;
|
|
PSID SubjectContextServerGroup;
|
|
PACL SubjectContextDacl;
|
|
|
|
ULONG AllocationSize;
|
|
ULONG NewOwnerSize;
|
|
ULONG NewGroupSize;
|
|
ULONG NewSaclSize;
|
|
ULONG NewDaclSize;
|
|
|
|
PCHAR Field;
|
|
PCHAR Base;
|
|
|
|
PAGED_CODE();
|
|
|
|
PoolType = PagedPool;
|
|
|
|
//
|
|
// The desired end result is to build a self-relative security descriptor.
|
|
// This means that a single block of memory will be allocated and all
|
|
// security information copied into it. To minimize work along the way,
|
|
// it is desirable to reference (rather than copy) each field as we
|
|
// determine its source. This can not be done with inherited ACLs, however,
|
|
// since they must be built from another ACL. So, explicitly assigned
|
|
// and defaulted SIDs and ACLs are just referenced until they are copied
|
|
// into the self-relative descriptor. Inherited ACLs are built in a
|
|
// temporary buffer which must be deallocated after being copied to the
|
|
// self-relative descriptor.
|
|
//
|
|
|
|
|
|
//
|
|
// Get the previous mode of the caller
|
|
//
|
|
|
|
RequestorMode = KeGetPreviousMode();
|
|
|
|
//
|
|
// If a security descriptor has been passed, capture it, otherwise
|
|
// cobble up a fake one to simplify the code that follows.
|
|
//
|
|
|
|
if (ARGUMENT_PRESENT(ExplicitDescriptor)) {
|
|
|
|
CapturedDescriptor = ExplicitDescriptor;
|
|
SecurityDescriptorPassed = TRUE;
|
|
|
|
} else {
|
|
|
|
//
|
|
// No descriptor passed, make a fake one
|
|
//
|
|
|
|
SecurityDescriptorPassed = FALSE;
|
|
RtlCreateSecurityDescriptor((PSECURITY_DESCRIPTOR)&InCaseOneNotPassed,
|
|
SECURITY_DESCRIPTOR_REVISION);
|
|
CapturedDescriptor = &InCaseOneNotPassed;
|
|
|
|
}
|
|
|
|
#if DBG
|
|
SepDumpSecurityDescriptor( (PSECURITY_DESCRIPTOR)CapturedDescriptor,
|
|
"\nSeAssignSecurity: Input security descriptor = \n"
|
|
);
|
|
|
|
if (ARGUMENT_PRESENT( ParentDescriptor )) {
|
|
SepDumpSecurityDescriptor( (PSECURITY_DESCRIPTOR)ParentDescriptor,
|
|
"\nSeAssignSecurity: Parent security descriptor = \n"
|
|
);
|
|
}
|
|
#endif // DBG
|
|
//
|
|
// Grab pointers to the default owner, primary group, and
|
|
// discretionary ACL.
|
|
//
|
|
|
|
//
|
|
// Lock the subject context for read access so that the pointers
|
|
// we copy out of it don't disappear on us at random
|
|
//
|
|
|
|
SeLockSubjectContext( SubjectContext );
|
|
|
|
SepGetDefaultsSubjectContext(
|
|
SubjectContext,
|
|
&SubjectContextOwner,
|
|
&SubjectContextGroup,
|
|
&SubjectContextServerOwner,
|
|
&SubjectContextServerGroup,
|
|
&SubjectContextDacl
|
|
);
|
|
|
|
|
|
if ( CapturedDescriptor->Control & SE_SERVER_SECURITY ) {
|
|
ServerObject = TRUE;
|
|
} else {
|
|
ServerObject = FALSE;
|
|
}
|
|
|
|
if ( CapturedDescriptor->Control & SE_DACL_UNTRUSTED ) {
|
|
DaclUntrusted = TRUE;
|
|
} else {
|
|
DaclUntrusted = FALSE;
|
|
}
|
|
|
|
|
|
if (!CleanUp) {
|
|
|
|
//
|
|
// Establish System Acl
|
|
//
|
|
|
|
if ( (CapturedDescriptor->Control & SE_SACL_PRESENT) &&
|
|
!(CapturedDescriptor->Control & SE_SACL_DEFAULTED) ) {
|
|
|
|
//
|
|
// Explicitly provided, not defaulted (Cases 1 and 2)
|
|
//
|
|
|
|
NewSacl = SepSaclAddrSecurityDescriptor(CapturedDescriptor);
|
|
NewSaclPresent = TRUE;
|
|
SaclExplicitlyAssigned = TRUE;
|
|
|
|
} else {
|
|
|
|
//
|
|
// See if there is an inheritable ACL (copy it if there is one.)
|
|
// This maps all ACEs for the target object type too.
|
|
//
|
|
|
|
Status = STATUS_SUCCESS;
|
|
|
|
if (ARGUMENT_PRESENT(ParentDescriptor) &&
|
|
NT_SUCCESS(Status = SepInheritAcl(
|
|
SepSaclAddrSecurityDescriptor(
|
|
((SECURITY_DESCRIPTOR *)ParentDescriptor)
|
|
),
|
|
IsDirectoryObject,
|
|
SubjectContextOwner,
|
|
SubjectContextGroup,
|
|
SubjectContextServerOwner,
|
|
SubjectContextServerGroup,
|
|
GenericMapping,
|
|
PoolType,
|
|
&NewSacl )
|
|
)) {
|
|
|
|
//
|
|
// There is an inheritable ACL from the parent. Assign
|
|
// it. (Cases 3 and 5)
|
|
//
|
|
|
|
NewSaclPresent = TRUE;
|
|
NewSaclInherited = TRUE;
|
|
|
|
} else if (!ARGUMENT_PRESENT(ParentDescriptor) || (Status == STATUS_NO_INHERITANCE)) {
|
|
|
|
//
|
|
// No inheritable ACL - check for a defaulted one
|
|
// (Cases 4 and 6)
|
|
//
|
|
|
|
if ( (CapturedDescriptor->Control & SE_SACL_PRESENT) &&
|
|
(CapturedDescriptor->Control & SE_SACL_DEFAULTED) ) {
|
|
|
|
//
|
|
// Reference the default ACL (case 4)
|
|
//
|
|
|
|
NewSacl = SepSaclAddrSecurityDescriptor(CapturedDescriptor);
|
|
NewSaclPresent = TRUE;
|
|
|
|
//
|
|
// Set SaclExplicitlyAssigned, because the caller
|
|
// must have SeSecurityPrivilege to do this. We
|
|
// will examine this flag and check for this privilege
|
|
// later.
|
|
//
|
|
|
|
SaclExplicitlyAssigned = TRUE;
|
|
}
|
|
} else {
|
|
|
|
//
|
|
// Some unusual error occured
|
|
//
|
|
|
|
CleanUp = TRUE;
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!CleanUp) {
|
|
|
|
//
|
|
// Establish Discretionary Acl
|
|
//
|
|
|
|
if ( (CapturedDescriptor->Control & SE_DACL_PRESENT) &&
|
|
!(CapturedDescriptor->Control & SE_DACL_DEFAULTED) ) {
|
|
|
|
//
|
|
// Explicitly provided, not defaulted (Cases 1 and 2)
|
|
//
|
|
|
|
NewDacl = SepDaclAddrSecurityDescriptor(CapturedDescriptor);
|
|
NewDaclPresent = TRUE;
|
|
DaclExplicitlyAssigned = TRUE;
|
|
|
|
} else {
|
|
|
|
//
|
|
// See if there is an inheritable ACL (copy it if there is one.)
|
|
// This maps the ACEs to the target object type too.
|
|
//
|
|
|
|
Status = STATUS_SUCCESS;
|
|
|
|
if (ARGUMENT_PRESENT(ParentDescriptor) &&
|
|
NT_SUCCESS(Status = SepInheritAcl(
|
|
SepDaclAddrSecurityDescriptor(
|
|
((SECURITY_DESCRIPTOR *)ParentDescriptor)
|
|
),
|
|
IsDirectoryObject,
|
|
SubjectContextOwner,
|
|
SubjectContextGroup,
|
|
SubjectContextServerOwner,
|
|
SubjectContextServerGroup,
|
|
GenericMapping,
|
|
PoolType,
|
|
&NewDacl )
|
|
)) {
|
|
|
|
//
|
|
// There is an inheritable ACL from the parent. Assign
|
|
// it. (Cases 3 and 5)
|
|
//
|
|
|
|
NewDaclPresent = TRUE;
|
|
NewDaclInherited = TRUE;
|
|
|
|
} else if (!ARGUMENT_PRESENT(ParentDescriptor) || (Status == STATUS_NO_INHERITANCE)) {
|
|
|
|
//
|
|
// No inheritable ACL - check for a defaulted one in the
|
|
// security descriptor. If there isn't one there, then look
|
|
// for one in the subject's security context (Cases 4 and 6)
|
|
//
|
|
|
|
if ( (CapturedDescriptor->Control & SE_DACL_PRESENT) &&
|
|
(CapturedDescriptor->Control & SE_DACL_DEFAULTED) ) {
|
|
|
|
//
|
|
// reference the default ACL (Case 4)
|
|
//
|
|
|
|
NewDacl = SepDaclAddrSecurityDescriptor(CapturedDescriptor);
|
|
NewDaclPresent = TRUE;
|
|
|
|
//
|
|
// This counts as an explicit assignment.
|
|
//
|
|
|
|
DaclExplicitlyAssigned = TRUE;
|
|
|
|
} else {
|
|
|
|
if (ARGUMENT_PRESENT(SubjectContextDacl)) {
|
|
|
|
NewDacl = SubjectContextDacl;
|
|
NewDaclPresent = TRUE;
|
|
}
|
|
}
|
|
|
|
} else {
|
|
|
|
//
|
|
// Some unusual error occured
|
|
//
|
|
|
|
CleanUp = TRUE;
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
if (!CleanUp) {
|
|
//
|
|
// Establish an owner SID
|
|
//
|
|
|
|
if ((CapturedDescriptor->Owner) != NULL) {
|
|
|
|
//
|
|
// Use the specified owner
|
|
//
|
|
|
|
NewOwner = SepOwnerAddrSecurityDescriptor(CapturedDescriptor);
|
|
OwnerExplicitlyAssigned = TRUE;
|
|
|
|
} else {
|
|
|
|
//
|
|
// Pick up the default from the subject's security context.
|
|
//
|
|
// This does NOT constitute explicit assignment of owner
|
|
// and does not have to be checked as an ID that can be
|
|
// assigned as owner. This is because a default can not
|
|
// be established in a token unless the user of the token
|
|
// can assign it as an owner.
|
|
//
|
|
|
|
//
|
|
// If we've been asked to create a ServerObject, we need to
|
|
// make sure to pick up the new owner from the Primary token,
|
|
// not the client token. If we're not impersonating, they will
|
|
// end up being the same.
|
|
//
|
|
|
|
NewOwner = ServerObject ? SubjectContextServerOwner : SubjectContextOwner;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
if (!CleanUp) {
|
|
//
|
|
// Establish a Group SID
|
|
//
|
|
|
|
if ((CapturedDescriptor->Group) != NULL) {
|
|
|
|
//
|
|
// Use the specified Group
|
|
//
|
|
|
|
NewGroup = SepGroupAddrSecurityDescriptor(CapturedDescriptor);
|
|
|
|
} else {
|
|
|
|
//
|
|
// Pick up the primary group from the subject's security context.
|
|
//
|
|
// If we're creating a Server object, use the group from the server
|
|
// context.
|
|
//
|
|
|
|
NewGroup = ServerObject ? SubjectContextServerGroup : SubjectContextGroup;
|
|
}
|
|
}
|
|
|
|
|
|
if (!CleanUp) {
|
|
|
|
//
|
|
// Now make sure that the caller has the right to assign
|
|
// everything in the descriptor. If requestor is kernel mode,
|
|
// then anything is legitimate. Otherwise, the requestor
|
|
// is subjected to privilege and restriction tests for some
|
|
// assignments.
|
|
//
|
|
|
|
if (RequestorMode == UserMode) {
|
|
|
|
//
|
|
// Anybody can assign any Discretionary ACL or group that they want to.
|
|
//
|
|
|
|
//
|
|
// See if the system ACL was explicitly specified
|
|
//
|
|
|
|
if (SaclExplicitlyAssigned) {
|
|
|
|
//
|
|
// Check for appropriate Privileges
|
|
// Audit/Alarm messages need to be generated due to the attempt
|
|
// to perform a privileged operation.
|
|
//
|
|
|
|
HasPrivilege = SeSinglePrivilegeCheck(
|
|
SeSecurityPrivilege,
|
|
RequestorMode
|
|
);
|
|
|
|
if (!HasPrivilege) {
|
|
|
|
RequestorCanAssignDescriptor = FALSE;
|
|
Status = STATUS_PRIVILEGE_NOT_HELD;
|
|
}
|
|
|
|
}
|
|
|
|
//
|
|
// See if the owner field is one the requestor can assign
|
|
//
|
|
|
|
if (OwnerExplicitlyAssigned) {
|
|
|
|
|
|
if (!SepValidOwnerSubjectContext(
|
|
SubjectContext,
|
|
NewOwner,
|
|
ServerObject)
|
|
) {
|
|
|
|
RequestorCanAssignDescriptor = FALSE;
|
|
Status = STATUS_INVALID_OWNER;
|
|
}
|
|
}
|
|
|
|
if (DaclExplicitlyAssigned) {
|
|
|
|
//
|
|
// Perform analysis of compound ACEs to make sure they're all
|
|
// legitimate.
|
|
//
|
|
|
|
if (ServerObject) {
|
|
|
|
//
|
|
// Pass in the Server Owner as the default server SID.
|
|
//
|
|
|
|
Status = SepCreateServerAcl(
|
|
NewDacl,
|
|
DaclUntrusted,
|
|
SubjectContextServerOwner,
|
|
&ServerDacl,
|
|
&ServerDaclAllocated
|
|
);
|
|
|
|
if (!NT_SUCCESS( Status )) {
|
|
|
|
RequestorCanAssignDescriptor = FALSE;
|
|
|
|
} else {
|
|
|
|
NewDacl = ServerDacl;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (RequestorCanAssignDescriptor) {
|
|
|
|
//
|
|
// Everything is assignable by the requestor.
|
|
// Calculate the memory needed to house all the information in
|
|
// a self-relative security descriptor.
|
|
//
|
|
// Also map the ACEs for application to the target object
|
|
// type, if they haven't already been mapped.
|
|
//
|
|
|
|
NewOwnerSize = (ULONG)LongAlign(SeLengthSid(NewOwner));
|
|
|
|
if (NewGroup != NULL) {
|
|
NewGroupSize = (ULONG)LongAlign(SeLengthSid(NewGroup));
|
|
} else {
|
|
NewGroupSize = 0;
|
|
}
|
|
|
|
if (NewSaclPresent && (NewSacl != NULL)) {
|
|
NewSaclSize = (ULONG)LongAlign(NewSacl->AclSize);
|
|
} else {
|
|
NewSaclSize = 0;
|
|
}
|
|
|
|
if (NewDaclPresent && (NewDacl != NULL)) {
|
|
NewDaclSize = (ULONG)LongAlign(NewDacl->AclSize);
|
|
} else {
|
|
NewDaclSize = 0;
|
|
}
|
|
|
|
AllocationSize = (ULONG)LongAlign(sizeof(SECURITY_DESCRIPTOR)) +
|
|
NewOwnerSize +
|
|
NewGroupSize +
|
|
NewSaclSize +
|
|
NewDaclSize;
|
|
|
|
//
|
|
// Allocate and initialize the security descriptor as
|
|
// self-relative form.
|
|
//
|
|
|
|
*NewDescriptor = (PSECURITY_DESCRIPTOR)ExAllocatePoolWithTag( PoolType, AllocationSize, 'dSeS');
|
|
|
|
if ((*NewDescriptor) == NULL) {
|
|
|
|
Status = STATUS_INSUFFICIENT_RESOURCES;
|
|
|
|
} else {
|
|
|
|
RtlCreateSecurityDescriptor(
|
|
(*NewDescriptor),
|
|
SECURITY_DESCRIPTOR_REVISION
|
|
);
|
|
((SECURITY_DESCRIPTOR *)(*NewDescriptor))->Control |=
|
|
SE_SELF_RELATIVE;
|
|
|
|
|
|
Base = (PCHAR)(*NewDescriptor);
|
|
Field = Base + (ULONG)sizeof(SECURITY_DESCRIPTOR);
|
|
|
|
//
|
|
// Map and Copy in the Sacl
|
|
//
|
|
|
|
if (NewSaclPresent) {
|
|
((SECURITY_DESCRIPTOR *)(*NewDescriptor))->Control |=
|
|
SE_SACL_PRESENT;
|
|
if (NewSacl != NULL) {
|
|
RtlMoveMemory( Field, NewSacl, NewSacl->AclSize );
|
|
if (!NewSaclInherited) {
|
|
SepApplyAclToObject( (PACL)Field, GenericMapping );
|
|
}
|
|
((SECURITY_DESCRIPTOR *)(*NewDescriptor))->Sacl = (PACL)RtlPointerToOffset(Base,Field);
|
|
Field += NewSaclSize;
|
|
} else {
|
|
((SECURITY_DESCRIPTOR *)(*NewDescriptor))->Sacl = NULL;
|
|
}
|
|
|
|
}
|
|
|
|
//
|
|
// Map and Copy in the Dacl
|
|
//
|
|
|
|
if (NewDaclPresent) {
|
|
((SECURITY_DESCRIPTOR *)(*NewDescriptor))->Control |=
|
|
SE_DACL_PRESENT;
|
|
if (NewDacl != NULL) {
|
|
RtlMoveMemory( Field, NewDacl, NewDacl->AclSize );
|
|
if (!NewDaclInherited) {
|
|
SepApplyAclToObject( (PACL)Field, GenericMapping );
|
|
}
|
|
((SECURITY_DESCRIPTOR *)(*NewDescriptor))->Dacl = (PACL)RtlPointerToOffset(Base,Field);
|
|
Field += NewDaclSize;
|
|
} else {
|
|
((SECURITY_DESCRIPTOR *)(*NewDescriptor))->Dacl = NULL;
|
|
}
|
|
}
|
|
|
|
|
|
//
|
|
// Assign the owner
|
|
//
|
|
|
|
RtlMoveMemory( Field, NewOwner, SeLengthSid(NewOwner) );
|
|
((SECURITY_DESCRIPTOR *)(*NewDescriptor))->Owner = (PSID)RtlPointerToOffset(Base,Field);
|
|
Field += NewOwnerSize;
|
|
|
|
if (NewGroup != NULL) {
|
|
RtlMoveMemory( Field, NewGroup, SeLengthSid(NewGroup) );
|
|
}
|
|
((SECURITY_DESCRIPTOR *)(*NewDescriptor))->Group = (PSID)RtlPointerToOffset(Base,Field);
|
|
|
|
Status = STATUS_SUCCESS;
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
//
|
|
// If we allocated memory for a Server DACL, free it now.
|
|
//
|
|
|
|
if (ServerDaclAllocated) {
|
|
ExFreePool( ServerDacl );
|
|
}
|
|
|
|
//
|
|
// Either an error was encountered or the requestor the assignment has
|
|
// completed successfully. In either case, we have to clean up any
|
|
// memory.
|
|
//
|
|
|
|
SeUnlockSubjectContext( SubjectContext );
|
|
|
|
if (NewSaclInherited) {
|
|
ExFreePool( NewSacl );
|
|
}
|
|
|
|
if (NewDaclInherited) {
|
|
ExFreePool( NewDacl );
|
|
}
|
|
|
|
#if DBG
|
|
SepDumpSecurityDescriptor( *NewDescriptor,
|
|
"SeAssignSecurity: Final security descriptor = \n"
|
|
);
|
|
#endif
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
SeDeassignSecurity (
|
|
IN OUT PSECURITY_DESCRIPTOR *SecurityDescriptor
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine deallocates the memory associated with a security descriptor
|
|
that was assigned using SeAssignSecurity.
|
|
|
|
|
|
Arguments:
|
|
|
|
SecurityDescriptor - Supplies the address of a pointer to the security
|
|
descriptor being deleted.
|
|
|
|
Return Value:
|
|
|
|
STATUS_SUCCESS - The deallocation was successful.
|
|
|
|
--*/
|
|
|
|
{
|
|
PAGED_CODE();
|
|
|
|
if ((*SecurityDescriptor) != NULL) {
|
|
ExFreePool( (*SecurityDescriptor) );
|
|
}
|
|
|
|
//
|
|
// And zero out the pointer to it for safety sake
|
|
//
|
|
|
|
(*SecurityDescriptor) = NULL;
|
|
|
|
return( STATUS_SUCCESS );
|
|
|
|
}
|
|
|
|
|
|
VOID
|
|
SepApplyAclToObject (
|
|
IN PACL Acl,
|
|
IN PGENERIC_MAPPING GenericMapping
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This is a private routine that maps Access Masks of an ACL so that
|
|
they are applicable to the object type the ACL is being applied to.
|
|
|
|
Only known DSA ACEs are mapped. Unknown ACE types are ignored.
|
|
|
|
Only access types in the GenericAll mapping for the target object
|
|
type will be non-zero upon return.
|
|
|
|
Arguments:
|
|
|
|
Acl - Supplies the acl being applied.
|
|
|
|
GenericMapping - Specifies the generic mapping to use.
|
|
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
//////////////////////////////////////////////////////////////////////////////
|
|
// //
|
|
// The logic in the ACL inheritance code must mirror the code for //
|
|
// inheritance in the user mode runtime (in sertl.c). Do not make changes //
|
|
// here without also making changes in that module. //
|
|
// //
|
|
//////////////////////////////////////////////////////////////////////////////
|
|
|
|
ULONG i;
|
|
|
|
PACE_HEADER Ace;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// First check if the acl is null
|
|
//
|
|
|
|
if (Acl == NULL) {
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
//
|
|
// Now walk the ACL, mapping each ACE as we go.
|
|
//
|
|
|
|
for (i = 0, Ace = FirstAce(Acl);
|
|
i < Acl->AceCount;
|
|
i += 1, Ace = NextAce(Ace)) {
|
|
|
|
if (IsMSAceType( Ace )) {
|
|
|
|
RtlApplyAceToObject( Ace, GenericMapping );
|
|
}
|
|
|
|
}
|
|
|
|
return;
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
SepInheritAcl (
|
|
IN PACL Acl,
|
|
IN BOOLEAN IsDirectoryObject,
|
|
IN PSID ClientOwnerSid,
|
|
IN PSID ClientGroupSid,
|
|
IN PSID ServerOwnerSid OPTIONAL,
|
|
IN PSID ServerGroupSid OPTIONAL,
|
|
IN PGENERIC_MAPPING GenericMapping,
|
|
IN POOL_TYPE PoolType,
|
|
OUT PACL *NewAcl
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This is a private routine that produces an inherited acl from
|
|
a parent acl according to the rules of inheritance
|
|
|
|
Arguments:
|
|
|
|
Acl - Supplies the acl being inherited.
|
|
|
|
IsDirectoryObject - Specifies if the new acl is for a directory.
|
|
|
|
OwnerSid - Specifies the owner Sid to use.
|
|
|
|
GroupSid - Specifies the group SID to use.
|
|
|
|
ServerSid - Specifies the Server SID to use.
|
|
|
|
ClientSid - Specifies the Client SID to use.
|
|
|
|
GenericMapping - Specifies the generic mapping to use.
|
|
|
|
PoolType - Specifies the pool type for the new acl.
|
|
|
|
NewAcl - Receives a pointer to the new (inherited) acl.
|
|
|
|
Return Value:
|
|
|
|
STATUS_SUCCESS - An inheritable ACL was successfully generated.
|
|
|
|
STATUS_NO_INHERITANCE - An inheritable ACL was not successfully generated.
|
|
This is a warning completion status.
|
|
|
|
STATUS_BAD_INHERITANCE_ACL - Indicates the acl built was not a valid ACL.
|
|
This can becaused by a number of things. One of the more probable
|
|
causes is the replacement of a CreatorId with an SID that didn't fit
|
|
into the ACE or ACL.
|
|
|
|
STATUS_UNKNOWN_REVISION - Indicates the source ACL is a revision that
|
|
is unknown to this routine.
|
|
|
|
--*/
|
|
|
|
{
|
|
//////////////////////////////////////////////////////////////////////////////
|
|
// //
|
|
// The logic in the ACL inheritance code must mirror the code for //
|
|
// inheritance in the user mode runtime (in sertl.c). Do not make changes //
|
|
// here without also making changes in that module. //
|
|
// //
|
|
//////////////////////////////////////////////////////////////////////////////
|
|
|
|
|
|
NTSTATUS Status;
|
|
ULONG NewAclLength;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// First check if the acl is null
|
|
//
|
|
|
|
if (Acl == NULL) {
|
|
|
|
return STATUS_NO_INHERITANCE;
|
|
}
|
|
|
|
if (Acl->AclRevision != ACL_REVISION2 && Acl->AclRevision != ACL_REVISION3) {
|
|
return STATUS_UNKNOWN_REVISION;
|
|
}
|
|
|
|
//
|
|
// Generating an inheritable ACL is a two-pass operation.
|
|
// First you must see if there is anything to inherit, and if so,
|
|
// allocate enough room to hold it. then you must actually copy
|
|
// the generated ACEs.
|
|
//
|
|
|
|
Status = RtlpLengthInheritAcl(
|
|
Acl,
|
|
IsDirectoryObject,
|
|
ClientOwnerSid,
|
|
ClientGroupSid,
|
|
ServerOwnerSid,
|
|
ServerGroupSid,
|
|
GenericMapping,
|
|
&NewAclLength
|
|
);
|
|
|
|
if ( !NT_SUCCESS(Status) ) {
|
|
return Status;
|
|
}
|
|
if (NewAclLength == 0) {
|
|
return STATUS_NO_INHERITANCE;
|
|
}
|
|
|
|
(*NewAcl) = (PACL)ExAllocatePoolWithTag( PoolType, NewAclLength, 'cAeS' );
|
|
if ((*NewAcl) == NULL) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
RtlCreateAcl( (*NewAcl), NewAclLength, Acl->AclRevision );
|
|
|
|
Status = RtlpGenerateInheritAcl(
|
|
Acl,
|
|
IsDirectoryObject,
|
|
ClientOwnerSid,
|
|
ClientGroupSid,
|
|
ServerOwnerSid,
|
|
ServerGroupSid,
|
|
GenericMapping,
|
|
(*NewAcl)
|
|
);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
ExFreePool( (*NewAcl) );
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS
|
|
SeAssignWorldSecurityDescriptor(
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN OUT PULONG Length,
|
|
IN PSECURITY_INFORMATION SecurityInformation
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is called by the I/O system to properly initialize a
|
|
security descriptor for a FAT file. It will take a pointer to a
|
|
buffer containing an emptry security descriptor, and create in the
|
|
buffer a self-relative security descriptor with
|
|
|
|
Owner = WorldSid,
|
|
|
|
Group = WorldSid.
|
|
|
|
Thus, a FAT file is accessable to all.
|
|
|
|
Arguments:
|
|
|
|
SecurityDescriptor - Supplies a pointer to a buffer in which will be
|
|
created a self-relative security descriptor as described above.
|
|
|
|
Length - The length in bytes of the buffer. If the length is too
|
|
small, it will contain the minimum size required upon exit.
|
|
|
|
|
|
Return Value:
|
|
|
|
STATUS_BUFFER_TOO_SMALL - The buffer was not big enough to contain
|
|
the requested information.
|
|
|
|
|
|
--*/
|
|
|
|
{
|
|
|
|
PCHAR Field;
|
|
PCHAR Base;
|
|
ULONG WorldSidLength;
|
|
PISECURITY_DESCRIPTOR ISecurityDescriptor;
|
|
ULONG MinSize;
|
|
NTSTATUS Status;
|
|
|
|
PAGED_CODE();
|
|
|
|
if ( !ARGUMENT_PRESENT( SecurityInformation )) {
|
|
|
|
return( STATUS_ACCESS_DENIED );
|
|
}
|
|
|
|
WorldSidLength = SeLengthSid( SeWorldSid );
|
|
|
|
MinSize = sizeof( SECURITY_DESCRIPTOR ) + 2 * WorldSidLength;
|
|
|
|
if ( *Length < MinSize ) {
|
|
|
|
*Length = MinSize;
|
|
return( STATUS_BUFFER_TOO_SMALL );
|
|
}
|
|
|
|
*Length = MinSize;
|
|
|
|
ISecurityDescriptor = (SECURITY_DESCRIPTOR *)SecurityDescriptor;
|
|
|
|
Status = RtlCreateSecurityDescriptor( ISecurityDescriptor,
|
|
SECURITY_DESCRIPTOR_REVISION );
|
|
|
|
if (!NT_SUCCESS( Status )) {
|
|
return( Status );
|
|
}
|
|
|
|
Base = (PCHAR)(ISecurityDescriptor);
|
|
Field = Base + (ULONG)sizeof(SECURITY_DESCRIPTOR);
|
|
|
|
if ( *SecurityInformation & OWNER_SECURITY_INFORMATION ) {
|
|
|
|
RtlMoveMemory( Field, SeWorldSid, WorldSidLength );
|
|
ISecurityDescriptor->Owner = (PSID)RtlPointerToOffset(Base,Field);
|
|
Field += WorldSidLength;
|
|
}
|
|
|
|
if ( *SecurityInformation & GROUP_SECURITY_INFORMATION ) {
|
|
|
|
RtlMoveMemory( Field, SeWorldSid, WorldSidLength );
|
|
ISecurityDescriptor->Group = (PSID)RtlPointerToOffset(Base,Field);
|
|
}
|
|
|
|
if ( *SecurityInformation & DACL_SECURITY_INFORMATION ) {
|
|
SepSetControlBits( ISecurityDescriptor, SE_DACL_PRESENT );
|
|
}
|
|
|
|
if ( *SecurityInformation & SACL_SECURITY_INFORMATION ) {
|
|
SepSetControlBits( ISecurityDescriptor, SE_SACL_PRESENT );
|
|
}
|
|
|
|
SepSetControlBits( ISecurityDescriptor, SE_SELF_RELATIVE );
|
|
|
|
return( STATUS_SUCCESS );
|
|
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS
|
|
SepCreateServerAcl(
|
|
IN PACL Acl,
|
|
IN BOOLEAN AclUntrusted,
|
|
IN PSID ServerSid,
|
|
OUT PACL *ServerAcl,
|
|
OUT BOOLEAN *ServerAclAllocated
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine takes an ACL and converts it into a server ACL.
|
|
Currently, that means converting all of the GRANT ACEs into
|
|
Compount Grants, and if necessary sanitizing any Compound
|
|
Grants that are encountered.
|
|
|
|
Arguments:
|
|
|
|
|
|
|
|
Return Value:
|
|
|
|
|
|
--*/
|
|
|
|
{
|
|
USHORT RequiredSize = sizeof(ACL);
|
|
USHORT AceSizeAdjustment;
|
|
USHORT ServerSidSize;
|
|
PACE_HEADER Ace;
|
|
ULONG i;
|
|
PVOID Target;
|
|
PVOID AcePosition;
|
|
PSID UntrustedSid;
|
|
PSID ClientSid;
|
|
NTSTATUS Status;
|
|
|
|
if (Acl == NULL) {
|
|
*ServerAclAllocated = FALSE;
|
|
*ServerAcl = NULL;
|
|
return( STATUS_SUCCESS );
|
|
}
|
|
|
|
AceSizeAdjustment = sizeof( KNOWN_COMPOUND_ACE ) - sizeof( KNOWN_ACE );
|
|
ASSERT( sizeof( KNOWN_COMPOUND_ACE ) >= sizeof( KNOWN_ACE ) );
|
|
|
|
ServerSidSize = (USHORT)SeLengthSid( ServerSid );
|
|
|
|
//
|
|
// Do this in two passes. First, determine how big the final
|
|
// result is going to be, and then allocate the space and make
|
|
// the changes.
|
|
//
|
|
|
|
for (i = 0, Ace = FirstAce(Acl);
|
|
i < Acl->AceCount;
|
|
i += 1, Ace = NextAce(Ace)) {
|
|
|
|
//
|
|
// If it's an ACCESS_ALLOWED_ACE_TYPE, we'll need to add in the
|
|
// size of the Server SID.
|
|
//
|
|
|
|
if (Ace->AceType == ACCESS_ALLOWED_ACE_TYPE) {
|
|
|
|
//
|
|
// Simply add the size of the new Server SID plus whatever
|
|
// adjustment needs to be made to increase the size of the ACE.
|
|
//
|
|
|
|
RequiredSize += ( ServerSidSize + AceSizeAdjustment );
|
|
|
|
} else {
|
|
|
|
if (AclUntrusted && Ace->AceType == ACCESS_ALLOWED_COMPOUND_ACE_TYPE ) {
|
|
|
|
//
|
|
// Since the Acl is untrusted, we don't care what is in the
|
|
// server SID, we're going to replace it.
|
|
//
|
|
|
|
UntrustedSid = RtlCompoundAceServerSid( Ace );
|
|
if ((USHORT)SeLengthSid(UntrustedSid) > ServerSidSize) {
|
|
RequiredSize += ((USHORT)SeLengthSid(UntrustedSid) - ServerSidSize);
|
|
} else {
|
|
RequiredSize += (ServerSidSize - (USHORT)SeLengthSid(UntrustedSid));
|
|
|
|
}
|
|
}
|
|
}
|
|
|
|
RequiredSize += Ace->AceSize;
|
|
}
|
|
|
|
(*ServerAcl) = (PACL)ExAllocatePoolWithTag( PagedPool, RequiredSize, 'cAeS' );
|
|
|
|
if ((*ServerAcl) == NULL) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
//
|
|
// Mark as allocated so caller knows to free it.
|
|
//
|
|
|
|
*ServerAclAllocated = TRUE;
|
|
|
|
Status = RtlCreateAcl( (*ServerAcl), RequiredSize, ACL_REVISION3 );
|
|
ASSERT( NT_SUCCESS( Status ));
|
|
|
|
for (i = 0, Ace = FirstAce(Acl), Target=FirstAce( *ServerAcl );
|
|
i < Acl->AceCount;
|
|
i += 1, Ace = NextAce(Ace)) {
|
|
|
|
//
|
|
// If it's an ACCESS_ALLOWED_ACE_TYPE, convert to a Server ACE.
|
|
//
|
|
|
|
if (Ace->AceType == ACCESS_ALLOWED_ACE_TYPE ||
|
|
(AclUntrusted && Ace->AceType == ACCESS_ALLOWED_COMPOUND_ACE_TYPE )) {
|
|
|
|
AcePosition = Target;
|
|
|
|
if (Ace->AceType == ACCESS_ALLOWED_ACE_TYPE) {
|
|
ClientSid = &((PKNOWN_ACE)Ace)->SidStart;
|
|
} else {
|
|
ClientSid = RtlCompoundAceClientSid( Ace );
|
|
}
|
|
|
|
//
|
|
// Copy up to the access mask.
|
|
//
|
|
|
|
RtlMoveMemory(
|
|
Target,
|
|
Ace,
|
|
FIELD_OFFSET(KNOWN_ACE, SidStart)
|
|
);
|
|
|
|
//
|
|
// Now copy the correct Server SID
|
|
//
|
|
|
|
Target = (PVOID)((ULONG)Target + (UCHAR)(FIELD_OFFSET(KNOWN_COMPOUND_ACE, SidStart)));
|
|
|
|
RtlMoveMemory(
|
|
Target,
|
|
ServerSid,
|
|
SeLengthSid(ServerSid)
|
|
);
|
|
|
|
Target = (PVOID)((ULONG)Target + (UCHAR)SeLengthSid(ServerSid));
|
|
|
|
//
|
|
// Now copy in the correct client SID. We can copy this right out of
|
|
// the original ACE.
|
|
//
|
|
|
|
RtlMoveMemory(
|
|
Target,
|
|
ClientSid,
|
|
SeLengthSid(ClientSid)
|
|
);
|
|
|
|
Target = (PVOID)((ULONG)Target + SeLengthSid(ClientSid));
|
|
|
|
//
|
|
// Set the size of the ACE accordingly
|
|
//
|
|
|
|
((PKNOWN_COMPOUND_ACE)AcePosition)->Header.AceSize =
|
|
(USHORT)FIELD_OFFSET(KNOWN_COMPOUND_ACE, SidStart) +
|
|
(USHORT)SeLengthSid(ServerSid) +
|
|
(USHORT)SeLengthSid(ClientSid);
|
|
|
|
//
|
|
// Set the type
|
|
//
|
|
|
|
((PKNOWN_COMPOUND_ACE)AcePosition)->Header.AceType = ACCESS_ALLOWED_COMPOUND_ACE_TYPE;
|
|
((PKNOWN_COMPOUND_ACE)AcePosition)->CompoundAceType = COMPOUND_ACE_IMPERSONATION;
|
|
|
|
} else {
|
|
|
|
//
|
|
// Just copy the ACE as is.
|
|
//
|
|
|
|
RtlMoveMemory( Target, Ace, Ace->AceSize );
|
|
|
|
Target = (PVOID)((ULONG)Target + Ace->AceSize);
|
|
}
|
|
}
|
|
|
|
(*ServerAcl)->AceCount = Acl->AceCount;
|
|
|
|
return( STATUS_SUCCESS );
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//
|
|
// BUGWARNING The following routines should be in a debug only kernel, since
|
|
// all they do is dump stuff to a debug terminal as appropriate. The same
|
|
// goes for the declarations of the variables SepDumpSD and SepDumpToken
|
|
//
|
|
|
|
|
|
|
|
VOID
|
|
SepDumpSecurityDescriptor(
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN PSZ TitleString
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Private routine to dump a security descriptor to the debug
|
|
screen.
|
|
|
|
Arguments:
|
|
|
|
SecurityDescriptor - Supplies the security descriptor to be dumped.
|
|
|
|
TitleString - A null terminated string to print before dumping
|
|
the security descriptor.
|
|
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
|
|
--*/
|
|
{
|
|
#if DBG
|
|
PISECURITY_DESCRIPTOR ISecurityDescriptor;
|
|
UCHAR Revision;
|
|
SECURITY_DESCRIPTOR_CONTROL Control;
|
|
PSID Owner;
|
|
PSID Group;
|
|
PACL Sacl;
|
|
PACL Dacl;
|
|
|
|
PAGED_CODE();
|
|
|
|
|
|
if (!SepDumpSD) {
|
|
return;
|
|
}
|
|
|
|
if (!ARGUMENT_PRESENT( SecurityDescriptor )) {
|
|
return;
|
|
}
|
|
|
|
DbgPrint(TitleString);
|
|
|
|
ISecurityDescriptor = ( PISECURITY_DESCRIPTOR )SecurityDescriptor;
|
|
|
|
Revision = ISecurityDescriptor->Revision;
|
|
Control = ISecurityDescriptor->Control;
|
|
|
|
Owner = SepOwnerAddrSecurityDescriptor( ISecurityDescriptor );
|
|
Group = SepGroupAddrSecurityDescriptor( ISecurityDescriptor );
|
|
Sacl = SepSaclAddrSecurityDescriptor( ISecurityDescriptor );
|
|
Dacl = SepDaclAddrSecurityDescriptor( ISecurityDescriptor );
|
|
|
|
DbgPrint("\nSECURITY DESCRIPTOR\n");
|
|
|
|
DbgPrint("Revision = %d\n",Revision);
|
|
|
|
//
|
|
// Print control info
|
|
//
|
|
|
|
if (Control & SE_OWNER_DEFAULTED) {
|
|
DbgPrint("Owner defaulted\n");
|
|
}
|
|
if (Control & SE_GROUP_DEFAULTED) {
|
|
DbgPrint("Group defaulted\n");
|
|
}
|
|
if (Control & SE_DACL_PRESENT) {
|
|
DbgPrint("Dacl present\n");
|
|
}
|
|
if (Control & SE_DACL_DEFAULTED) {
|
|
DbgPrint("Dacl defaulted\n");
|
|
}
|
|
if (Control & SE_SACL_PRESENT) {
|
|
DbgPrint("Sacl present\n");
|
|
}
|
|
if (Control & SE_SACL_DEFAULTED) {
|
|
DbgPrint("Sacl defaulted\n");
|
|
}
|
|
if (Control & SE_SELF_RELATIVE) {
|
|
DbgPrint("Self relative\n");
|
|
}
|
|
if (Control & SE_DACL_UNTRUSTED) {
|
|
DbgPrint("Dacl untrusted\n");
|
|
}
|
|
if (Control & SE_SERVER_SECURITY) {
|
|
DbgPrint("Server security\n");
|
|
}
|
|
|
|
DbgPrint("Owner ");
|
|
SepPrintSid( Owner );
|
|
|
|
DbgPrint("Group ");
|
|
SepPrintSid( Group );
|
|
|
|
DbgPrint("Sacl");
|
|
SepPrintAcl( Sacl );
|
|
|
|
DbgPrint("Dacl");
|
|
SepPrintAcl( Dacl );
|
|
#endif
|
|
}
|
|
|
|
|
|
|
|
VOID
|
|
SepPrintAcl (
|
|
IN PACL Acl
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine dumps via (DbgPrint) an Acl for debug purposes. It is
|
|
specialized to dump standard aces.
|
|
|
|
Arguments:
|
|
|
|
Acl - Supplies the Acl to dump
|
|
|
|
Return Value:
|
|
|
|
None
|
|
|
|
--*/
|
|
|
|
|
|
{
|
|
#if DBG
|
|
ULONG i;
|
|
PKNOWN_ACE Ace;
|
|
BOOLEAN KnownType;
|
|
|
|
PAGED_CODE();
|
|
|
|
DbgPrint("@ %8lx\n", Acl);
|
|
|
|
//
|
|
// Check if the Acl is null
|
|
//
|
|
|
|
if (Acl == NULL) {
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
//
|
|
// Dump the Acl header
|
|
//
|
|
|
|
DbgPrint(" Revision: %02x", Acl->AclRevision);
|
|
DbgPrint(" Size: %04x", Acl->AclSize);
|
|
DbgPrint(" AceCount: %04x\n", Acl->AceCount);
|
|
|
|
//
|
|
// Now for each Ace we want do dump it
|
|
//
|
|
|
|
for (i = 0, Ace = FirstAce(Acl);
|
|
i < Acl->AceCount;
|
|
i++, Ace = NextAce(Ace) ) {
|
|
|
|
//
|
|
// print out the ace header
|
|
//
|
|
|
|
DbgPrint("\n AceHeader: %08lx ", *(PULONG)Ace);
|
|
|
|
//
|
|
// special case on the standard ace types
|
|
//
|
|
|
|
if ((Ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE) ||
|
|
(Ace->Header.AceType == ACCESS_DENIED_ACE_TYPE) ||
|
|
(Ace->Header.AceType == SYSTEM_AUDIT_ACE_TYPE) ||
|
|
(Ace->Header.AceType == SYSTEM_ALARM_ACE_TYPE) ||
|
|
(Ace->Header.AceType == ACCESS_ALLOWED_COMPOUND_ACE_TYPE)) {
|
|
|
|
//
|
|
// The following array is indexed by ace types and must
|
|
// follow the allowed, denied, audit, alarm seqeuence
|
|
//
|
|
|
|
PCHAR AceTypes[] = { "Access Allowed",
|
|
"Access Denied ",
|
|
"System Audit ",
|
|
"System Alarm ",
|
|
"Compound Grant",
|
|
};
|
|
|
|
DbgPrint(AceTypes[Ace->Header.AceType]);
|
|
DbgPrint("\n Access Mask: %08lx ", Ace->Mask);
|
|
KnownType = TRUE;
|
|
|
|
} else {
|
|
|
|
DbgPrint(" Unknown Ace Type\n");
|
|
KnownType = FALSE;
|
|
}
|
|
|
|
DbgPrint("\n");
|
|
|
|
DbgPrint(" AceSize = %d\n",Ace->Header.AceSize);
|
|
|
|
DbgPrint(" Ace Flags = ");
|
|
if (Ace->Header.AceFlags & OBJECT_INHERIT_ACE) {
|
|
DbgPrint("OBJECT_INHERIT_ACE\n");
|
|
DbgPrint(" ");
|
|
}
|
|
|
|
if (Ace->Header.AceFlags & CONTAINER_INHERIT_ACE) {
|
|
DbgPrint("CONTAINER_INHERIT_ACE\n");
|
|
DbgPrint(" ");
|
|
}
|
|
|
|
if (Ace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE) {
|
|
DbgPrint("NO_PROPAGATE_INHERIT_ACE\n");
|
|
DbgPrint(" ");
|
|
}
|
|
|
|
if (Ace->Header.AceFlags & INHERIT_ONLY_ACE) {
|
|
DbgPrint("INHERIT_ONLY_ACE\n");
|
|
DbgPrint(" ");
|
|
}
|
|
|
|
|
|
if (Ace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG) {
|
|
DbgPrint("SUCCESSFUL_ACCESS_ACE_FLAG\n");
|
|
DbgPrint(" ");
|
|
}
|
|
|
|
if (Ace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG) {
|
|
DbgPrint("FAILED_ACCESS_ACE_FLAG\n");
|
|
DbgPrint(" ");
|
|
}
|
|
|
|
DbgPrint("\n");
|
|
|
|
if (KnownType != TRUE) {
|
|
continue;
|
|
}
|
|
|
|
if (Ace->Header.AceType != ACCESS_ALLOWED_COMPOUND_ACE_TYPE) {
|
|
DbgPrint(" Sid = ");
|
|
SepPrintSid(&Ace->SidStart);
|
|
} else {
|
|
DbgPrint(" Server Sid = ");
|
|
SepPrintSid(RtlCompoundAceServerSid(Ace));
|
|
DbgPrint("\n Client Sid = ");
|
|
SepPrintSid(RtlCompoundAceClientSid( Ace ));
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
|
|
|
|
VOID
|
|
SepPrintSid(
|
|
IN PSID Sid
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Prints a formatted Sid
|
|
|
|
Arguments:
|
|
|
|
Sid - Provides a pointer to the sid to be printed.
|
|
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
#if DBG
|
|
UCHAR i;
|
|
ULONG Tmp;
|
|
PISID ISid;
|
|
STRING AccountName;
|
|
UCHAR Buffer[128];
|
|
|
|
PAGED_CODE();
|
|
|
|
if (Sid == NULL) {
|
|
DbgPrint("Sid is NULL\n");
|
|
return;
|
|
}
|
|
|
|
Buffer[0] = 0;
|
|
|
|
AccountName.MaximumLength = 127;
|
|
AccountName.Length = 0;
|
|
AccountName.Buffer = (PVOID)&Buffer[0];
|
|
|
|
if (SepSidTranslation( Sid, &AccountName )) {
|
|
|
|
DbgPrint("%s ", AccountName.Buffer );
|
|
}
|
|
|
|
ISid = (PISID)Sid;
|
|
|
|
DbgPrint("S-%lu-", (USHORT)ISid->Revision );
|
|
if ( (ISid->IdentifierAuthority.Value[0] != 0) ||
|
|
(ISid->IdentifierAuthority.Value[1] != 0) ){
|
|
DbgPrint("0x%02hx%02hx%02hx%02hx%02hx%02hx",
|
|
(USHORT)ISid->IdentifierAuthority.Value[0],
|
|
(USHORT)ISid->IdentifierAuthority.Value[1],
|
|
(USHORT)ISid->IdentifierAuthority.Value[2],
|
|
(USHORT)ISid->IdentifierAuthority.Value[3],
|
|
(USHORT)ISid->IdentifierAuthority.Value[4],
|
|
(USHORT)ISid->IdentifierAuthority.Value[5] );
|
|
} else {
|
|
Tmp = (ULONG)ISid->IdentifierAuthority.Value[5] +
|
|
(ULONG)(ISid->IdentifierAuthority.Value[4] << 8) +
|
|
(ULONG)(ISid->IdentifierAuthority.Value[3] << 16) +
|
|
(ULONG)(ISid->IdentifierAuthority.Value[2] << 24);
|
|
DbgPrint("%lu", Tmp);
|
|
}
|
|
|
|
|
|
for (i=0;i<ISid->SubAuthorityCount ;i++ ) {
|
|
DbgPrint("-%lu", ISid->SubAuthority[i]);
|
|
}
|
|
DbgPrint("\n");
|
|
#endif
|
|
}
|
|
|
|
|
|
|
|
|
|
VOID
|
|
SepDumpTokenInfo(
|
|
IN PACCESS_TOKEN Token
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Prints interesting information in a token.
|
|
|
|
Arguments:
|
|
|
|
Token - Provides the token to be examined.
|
|
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
#if DBG
|
|
ULONG UserAndGroupCount;
|
|
PSID_AND_ATTRIBUTES TokenSid;
|
|
ULONG i;
|
|
PTOKEN IToken;
|
|
|
|
PAGED_CODE();
|
|
|
|
if (!SepDumpToken) {
|
|
return;
|
|
}
|
|
|
|
IToken = (TOKEN *)Token;
|
|
|
|
UserAndGroupCount = IToken->UserAndGroupCount;
|
|
|
|
DbgPrint("\n\nToken User and Groups Array:\n\n");
|
|
|
|
for ( i = 0 , TokenSid = IToken->UserAndGroups;
|
|
i < UserAndGroupCount ;
|
|
i++, TokenSid++
|
|
) {
|
|
|
|
SepPrintSid( TokenSid->Sid );
|
|
|
|
}
|
|
#endif
|
|
}
|
|
|
|
|
|
|
|
BOOLEAN
|
|
SepSidTranslation(
|
|
PSID Sid,
|
|
PSTRING AccountName
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine translates well-known SIDs into English names.
|
|
|
|
Arguments:
|
|
|
|
Sid - Provides the sid to be examined.
|
|
|
|
AccountName - Provides a string buffer in which to place the
|
|
translated name.
|
|
|
|
Return Value:
|
|
|
|
None
|
|
|
|
--*/
|
|
|
|
// AccountName is expected to have a large maximum length
|
|
|
|
{
|
|
PAGED_CODE();
|
|
|
|
if (RtlEqualSid(Sid, SeWorldSid)) {
|
|
RtlInitString( AccountName, "WORLD ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, SeLocalSid)) {
|
|
RtlInitString( AccountName, "LOCAL ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, SeNetworkSid)) {
|
|
RtlInitString( AccountName, "NETWORK ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, SeBatchSid)) {
|
|
RtlInitString( AccountName, "BATCH ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, SeInteractiveSid)) {
|
|
RtlInitString( AccountName, "INTERACTIVE ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, SeLocalSystemSid)) {
|
|
RtlInitString( AccountName, "SYSTEM ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, SeCreatorOwnerSid)) {
|
|
RtlInitString( AccountName, "CREATOR_OWNER ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, SeCreatorGroupSid)) {
|
|
RtlInitString( AccountName, "CREATOR_GROUP ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, SeCreatorOwnerServerSid)) {
|
|
RtlInitString( AccountName, "CREATOR_OWNER_SERVER ");
|
|
return(TRUE);
|
|
}
|
|
|
|
if (RtlEqualSid(Sid, SeCreatorGroupServerSid)) {
|
|
RtlInitString( AccountName, "CREATOR_GROUP_SERVER ");
|
|
return(TRUE);
|
|
}
|
|
|
|
return(FALSE);
|
|
}
|
|
|
|
//
|
|
// End debug only routines
|
|
//
|