windows-server-2003/base/screg/sc/lib/scseclib.cxx

/*++

Copyright (c) 1991-92  Microsoft Corporation

Module Name:

    scseclib.c

Abstract:

    This module provides support routines to simplify the creation of
    security descriptors.

Author:

    Rita Wong      (ritaw)  27-Feb-1991
    Cliff Van Dyke (cliffv)
    Richard Ward   (richardw) 8-April-92  Modified for Cairo

Environment:

    Contains NT specific code.

Revision History:

    13-Apr-1992 JohnRo
        Made changes suggested by PC-LINT.
--*/

#include <scpragma.h>

extern "C"
{
#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
}
#include <windef.h>     // DWORD (needed by scdebug.h).
#include <winbase.h>
#include <stdlib.h>        // max()
#include <scdebug.h>    // STATIC.
#include <scseclib.h>


//-------------------------------------------------------------------//
//                                                                   //
// Local function prototypes                                         //
//                                                                   //
//-------------------------------------------------------------------//

NTSTATUS
ScInitializeAllowedAce(
    IN  PACCESS_ALLOWED_ACE AllowedAce,
    IN  USHORT AceSize,
    IN  UCHAR InheritFlags,
    IN  UCHAR AceFlags,
    IN  ACCESS_MASK Mask,
    IN  PSID AllowedSid
    );

NTSTATUS
ScInitializeDeniedAce(
    IN  PACCESS_DENIED_ACE DeniedAce,
    IN  USHORT AceSize,
    IN  UCHAR InheritFlags,
    IN  UCHAR AceFlags,
    IN  ACCESS_MASK Mask,
    IN  PSID DeniedSid
    );

NTSTATUS
ScInitializeAuditAce(
    IN  PACCESS_ALLOWED_ACE AuditAce,
    IN  USHORT AceSize,
    IN  UCHAR InheritFlags,
    IN  UCHAR AceFlags,
    IN  ACCESS_MASK Mask,
    IN  PSID AuditSid
    );

//-------------------------------------------------------------------//
//                                                                   //
// Global variables                                                  //
//                                                                   //
//-------------------------------------------------------------------//


//
// NT well-known SIDs
//

PSID NullSid              = NULL;     // No members SID
PSID WorldSid             = NULL;     // All users SID
PSID LocalSid             = NULL;     // NT local users SID
PSID NetworkSid           = NULL;     // NT remote users SID
PSID LocalSystemSid       = NULL;     // NT system processes SID
PSID LocalServiceSid      = NULL;     // NT LocalService SID
PSID NetworkServiceSid    = NULL;     // NT NetworkService SID
PSID BuiltinDomainSid     = NULL;     // Domain Id of the Builtin Domain
PSID AuthenticatedUserSid = NULL;     // NT authenticated users SID
PSID AnonymousLogonSid    = NULL;     // Anonymous Logon SID

//
// Well Known Aliases.
//
// These are aliases that are relative to the built-in domain.
//
PSID AliasAdminsSid       = NULL;
PSID AliasUsersSid        = NULL;
PSID AliasGuestsSid       = NULL;
PSID AliasPowerUsersSid   = NULL;
PSID AliasAccountOpsSid   = NULL;
PSID AliasSystemOpsSid    = NULL;
PSID AliasPrintOpsSid     = NULL;
PSID AliasBackupOpsSid    = NULL;


//
// Data describing the well-known SIDs created by ScCreateWellKnownSids.
//

struct _SID_DATA {
    PSID *Sid;
    SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
    ULONG SubAuthority;
} SidData[] = {
 {&NullSid,              SECURITY_NULL_SID_AUTHORITY,  SECURITY_NULL_RID},
 {&WorldSid,             SECURITY_WORLD_SID_AUTHORITY, SECURITY_WORLD_RID},
 {&LocalSid,             SECURITY_LOCAL_SID_AUTHORITY, SECURITY_LOCAL_RID},
 {&NetworkSid,           SECURITY_NT_AUTHORITY,        SECURITY_NETWORK_RID},
 {&LocalSystemSid,       SECURITY_NT_AUTHORITY,        SECURITY_LOCAL_SYSTEM_RID},
 {&LocalServiceSid,      SECURITY_NT_AUTHORITY,        SECURITY_LOCAL_SERVICE_RID},
 {&NetworkServiceSid,    SECURITY_NT_AUTHORITY,        SECURITY_NETWORK_SERVICE_RID},
 {&BuiltinDomainSid,     SECURITY_NT_AUTHORITY,        SECURITY_BUILTIN_DOMAIN_RID},
 {&AuthenticatedUserSid, SECURITY_NT_AUTHORITY,        SECURITY_AUTHENTICATED_USER_RID},
 {&AnonymousLogonSid,    SECURITY_NT_AUTHORITY,        SECURITY_ANONYMOUS_LOGON_RID}
};


struct _BUILTIN_DOMAIN_SID_DATA {
    PSID *Sid;
    ULONG RelativeId;
} BuiltinDomainSidData[] = {
    { &AliasAdminsSid,      DOMAIN_ALIAS_RID_ADMINS },
    { &AliasUsersSid,       DOMAIN_ALIAS_RID_USERS },
    { &AliasGuestsSid,      DOMAIN_ALIAS_RID_GUESTS },
    { &AliasPowerUsersSid,  DOMAIN_ALIAS_RID_POWER_USERS },
    { &AliasAccountOpsSid,  DOMAIN_ALIAS_RID_ACCOUNT_OPS },
    { &AliasSystemOpsSid,   DOMAIN_ALIAS_RID_SYSTEM_OPS },
    { &AliasPrintOpsSid,    DOMAIN_ALIAS_RID_PRINT_OPS },
    { &AliasBackupOpsSid,   DOMAIN_ALIAS_RID_BACKUP_OPS }
};



NTSTATUS
ScCreateWellKnownSids(
    VOID
    )
/*++

Routine Description:

    This function creates some well-known SIDs and store them in global
    variables:

        //
        // NT well-known SIDs
        //

        PSID NullSid;                     // No members SID
        PSID WorldSid;                    // All users SID
        PSID LocalSid;                    // NT local users SID
        PSID NetworkSid;                  // NT remote users SID
        PSID LocalSystemSid;              // NT system processes SID
        PSID LocalServiceSid;             // NT LocalService SID
        PSID NetworkServiceSid;           // NT NetworkService SID
        PSID BuiltinDomainSid;            // Domain Id of the Builtin Domain
        PSID AuthenticatedUserSid;        // NT authenticated users SID
        PSID AnonymousLogonSid;           // NT anonymous logon

        //
        // Well Known Aliases.
        //
        // These are aliases that are relative to the built-in domain.
        //

        PSID AliasAdminsSid;
        PSID AliasUsersSid;
        PSID AliasGuestsSid;
        PSID AliasPowerUsersSid;
        PSID AliasAccountOpsSid;
        PSID AliasSystemOpsSid;
        PSID AliasPrintOpsSid;
        PSID AliasBackupOpsSid;

Arguments:

    None.

Return Value:

    STATUS_SUCCESS - if successful
    STATUS_NO_MEMORY - if cannot allocate memory for SID

--*/
{
    NTSTATUS ntstatus;
    ULONG i;


    //
    // Allocate and initialize well-known SIDs which aren't relative to
    // the domain Id.
    //

    for (i = 0; i < (sizeof(SidData) / sizeof(SidData[0])) ; i++) {

        ntstatus = ScAllocateAndInitializeSid(
                       SidData[i].Sid,
                       &(SidData[i].IdentifierAuthority),
                       1);

        if (! NT_SUCCESS(ntstatus)) {
            return STATUS_NO_MEMORY;
        }

        *(RtlSubAuthoritySid(*(SidData[i].Sid), 0)) = SidData[i].SubAuthority;
    }

    //
    // Build each SID which is relative to the Builtin Domain Id.
    //

    for ( i = 0;
          i < (sizeof(BuiltinDomainSidData) / sizeof(BuiltinDomainSidData[0]));
          i++) {

        ntstatus = ScDomainIdToSid(
                       BuiltinDomainSid,
                       BuiltinDomainSidData[i].RelativeId,
                       BuiltinDomainSidData[i].Sid );

        if (! NT_SUCCESS(ntstatus)) {
            return STATUS_NO_MEMORY;
        }
    }

    return STATUS_SUCCESS;
}


NTSTATUS
ScAllocateAndInitializeSid(
    OUT PSID *Sid,
    IN  PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
    IN  ULONG SubAuthorityCount
    )
/*++

Routine Description:

    This function allocates memory for a SID and initializes it.

Arguments:

    None.

Return Value:

    STATUS_SUCCESS - if successful
    STATUS_NO_MEMORY - if cannot allocate memory for SID

--*/
{
    *Sid = (PSID) RtlAllocateHeap(
                      RtlProcessHeap(), 0,
                      RtlLengthRequiredSid(SubAuthorityCount)
                      );

    if (*Sid == NULL) {
        return STATUS_NO_MEMORY;
    }

    (VOID) RtlInitializeSid(
            *Sid,
            IdentifierAuthority,
            (UCHAR)SubAuthorityCount );

    return STATUS_SUCCESS;
}


NTSTATUS
ScDomainIdToSid(
    IN PSID DomainId,
    IN ULONG RelativeId,
    OUT PSID *Sid
    )
/*++

Routine Description:

    Given a domain Id and a relative ID create a SID.

Arguments:

    DomainId - The template SID to use.

    RelativeId - The relative Id to append to the DomainId.

    Sid - Returns a pointer to an allocated buffer containing the resultant
            Sid.  Free this buffer using RtlFreeHeap.

Return Value:

    STATUS_SUCCESS - if successful
    STATUS_NO_MEMORY - if cannot allocate memory for SID

    Any error status from RtlCopySid

--*/
{
    NTSTATUS ntstatus;
    UCHAR DomainIdSubAuthorityCount; // Number of sub authorities in domain ID
    ULONG SidLength;    // Length of newly allocated SID

    PVOID HeapHandle = RtlProcessHeap();


    //
    // Allocate a Sid which has one more sub-authority than the domain ID.
    //

    DomainIdSubAuthorityCount = *(RtlSubAuthorityCountSid( DomainId ));
    SidLength = RtlLengthRequiredSid(DomainIdSubAuthorityCount+1);

    if ((*Sid = (PSID) RtlAllocateHeap(
                           HeapHandle, 0,
                           SidLength
                           )) == NULL) {
        return STATUS_NO_MEMORY;
    }

    //
    // Initialize the new SID to have the same inital value as the
    // domain ID.
    //
    ntstatus = RtlCopySid(SidLength, *Sid, DomainId);

    if (! NT_SUCCESS(ntstatus)) {
        (void) RtlFreeHeap(HeapHandle, 0, *Sid);
        return ntstatus;
    }

    //
    // Adjust the sub-authority count and
    //  add the relative Id unique to the newly allocated SID
    //

    (*(RtlSubAuthorityCountSid( *Sid ))) ++;
    *RtlSubAuthoritySid( *Sid, DomainIdSubAuthorityCount ) = RelativeId;

    return STATUS_SUCCESS;
}


NTSTATUS
ScCreateAndSetSD(
    IN  PSC_ACE_DATA AceData,
    IN  ULONG AceCount,
    IN  PSID OwnerSid OPTIONAL,
    IN  PSID GroupSid OPTIONAL,
    OUT PSECURITY_DESCRIPTOR *NewDescriptor
    )
/*++

Routine Description:

    This function creates an absolute security descriptor containing
    the supplied ACE information.

    A sample usage of this function:

        //
        // Order matters!  These ACEs are inserted into the DACL in the
        // following order.  Security access is granted or denied based on
        // the order of the ACEs in the DACL.
        //

        SE_ACE_DATA AceData[4] = {
            {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
                   GENERIC_ALL,                  &AliasAdminsSid},

            {ACCESS_DENIED_ACE_TYPE,  0, 0,
                   GENERIC_ALL,                  &NetworkSid},

            {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
                   WKSTA_CONFIG_GUEST_INFO_GET |
                   WKSTA_CONFIG_USER_INFO_GET,   &DomainUsersSid},

            {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
                   WKSTA_CONFIG_GUEST_INFO_GET,  &DomainGuestsSid}
            };

        PSECURITY_DESCRIPTOR WkstaSecurityDescriptor;


        return SeCreateAndSetSD(
                   AceData,
                   4,
                   LocalSystemSid,
                   LocalSystemSid,
                   &WkstaSecurityDescriptor
                   );

Arguments:

    AceData - Supplies the structure of information that describes the DACL.

    AceCount - Supplies the number of entries in AceData structure.

    OwnerSid - Supplies the pointer to the SID of the security descriptor
        owner.  If not specified, a security descriptor with no owner
        will be created.

    GroupSid - Supplies the pointer to the SID of the security descriptor
        primary group.  If not specified, a security descriptor with no primary
        group will be created.

    NewDescriptor - Returns a pointer to the absolute security descriptor
        allocated using RtlAllocateHeap.

Return Value:

    STATUS_SUCCESS - if successful
    STATUS_NO_MEMORY - if cannot allocate memory for DACL, ACEs, and
        security descriptor.

    Any other status codes returned from the security Rtl routines.

    NOTE : the user security object created by calling this function may be
                freed up by calling RtlDeleteSecurityObject().

--*/
{

    NTSTATUS ntstatus;
    ULONG i;

    //
    // Pointer to memory dynamically allocated by this routine to hold
    // the absolute security descriptor, the DACL, the SACL, and all the ACEs.
    //
    // +---------------------------------------------------------------+
    // |                     Security Descriptor                       |
    // +-------------------------------+-------+---------------+-------+
    // |          DACL                 | ACE 1 |   .  .  .     | ACE n |
    // +-------------------------------+-------+---------------+-------+
    // |          SACL                 | ACE 1 |   .  .  .     | ACE n |
    // +-------------------------------+-------+---------------+-------+
    //

    PSECURITY_DESCRIPTOR AbsoluteSd = NULL;
    PACL Dacl = NULL;   // Pointer to the DACL portion of above buffer
    PACL Sacl = NULL;   // Pointer to the SACL portion of above buffer

    ULONG DaclSize = sizeof(ACL);
    ULONG SaclSize = sizeof(ACL);
    ULONG MaxAceSize = 0;
    PACCESS_ALLOWED_ACE MaxAce = NULL;

    PCHAR CurrentAvailable;
    ULONG Size;

    PVOID HeapHandle = RtlProcessHeap();


    ASSERT( AceCount > 0 );

    //
    // Compute the total size of the DACL and SACL ACEs and the maximum
    // size of any ACE.
    //

    for (i = 0; i < AceCount; i++) {
        ULONG AceSize;

        AceSize = RtlLengthSid(*(AceData[i].Sid));

        switch (AceData[i].AceType) {
        case ACCESS_ALLOWED_ACE_TYPE:
            AceSize += sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG);
            DaclSize += AceSize;
            break;

        case ACCESS_DENIED_ACE_TYPE:
            AceSize += sizeof(ACCESS_DENIED_ACE) - sizeof(ULONG);
            DaclSize += AceSize;
            break;

        case SYSTEM_AUDIT_ACE_TYPE:
            AceSize += sizeof(SYSTEM_AUDIT_ACE) - sizeof(ULONG);
            SaclSize += AceSize;
            break;

        default:
            return STATUS_INVALID_PARAMETER;
        }

        MaxAceSize = max( MaxAceSize, AceSize );
    }

    //
    // Allocate a chunk of memory large enough for the security
    // descriptor, the DACL, the SACL and all ACEs.
    //
    // A security descriptor is of opaque data type but
    // SECURITY_DESCRIPTOR_MIN_LENGTH is the right size.
    //

    Size = SECURITY_DESCRIPTOR_MIN_LENGTH;
    if ( DaclSize != sizeof(ACL) ) {
        Size += DaclSize;
    }
    if ( SaclSize != sizeof(ACL) ) {
        Size += SaclSize;
    }

    if ((AbsoluteSd = RtlAllocateHeap(
                          HeapHandle, 0,
                          Size
                          )) == NULL) {
        KdPrint(("SeCreateAndSetSD: No memory to create absolute SD\n"));
        ntstatus = STATUS_NO_MEMORY;
        goto Cleanup;
    }

    //
    // Initialize the Dacl and Sacl
    //

    CurrentAvailable = (PCHAR)AbsoluteSd + SECURITY_DESCRIPTOR_MIN_LENGTH;

    if ( DaclSize != sizeof(ACL) ) {
        Dacl = (PACL)CurrentAvailable;
        CurrentAvailable += DaclSize;

        ntstatus = RtlCreateAcl( Dacl, DaclSize, ACL_REVISION );

        if ( !NT_SUCCESS(ntstatus) ) {
            KdPrint(("ScCreateAndSetSD: Fail DACL Create %08lx\n",
                     ntstatus));
            goto Cleanup;
        }
    }

    if ( SaclSize != sizeof(ACL) ) {
        Sacl = (PACL)CurrentAvailable;
        CurrentAvailable += SaclSize;

        ntstatus = RtlCreateAcl( Sacl, SaclSize, ACL_REVISION );

        if ( !NT_SUCCESS(ntstatus) ) {
            KdPrint(("ScCreateAndSetSD: Fail SACL Create %08lx\n",
                     ntstatus));
            goto Cleanup;
        }
    }

    //
    // Allocate a temporary buffer big enough for the biggest ACE.
    //

    if ((MaxAce = (PACCESS_ALLOWED_ACE) RtlAllocateHeap(
                      HeapHandle, 0,
                      MaxAceSize
                      )) == NULL ) {
        KdPrint(("ScCreateAndSetSD: No memory to create max ace\n"));
        ntstatus = STATUS_NO_MEMORY;
        goto Cleanup;
    }

    //
    // Initialize each ACE, and append it into the end of the DACL or SACL.
    //

    for (i = 0; i < AceCount; i++) {
        ULONG AceSize;
        PACL CurrentAcl;

        AceSize = RtlLengthSid(*(AceData[i].Sid));

        switch (AceData[i].AceType) {
        case ACCESS_ALLOWED_ACE_TYPE:

            AceSize += sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG);
            CurrentAcl = Dacl;
            ntstatus = ScInitializeAllowedAce(
                           MaxAce,
                           (USHORT) AceSize,
                           AceData[i].InheritFlags,
                           AceData[i].AceFlags,
                           AceData[i].Mask,
                           *(AceData[i].Sid)
                           );
            break;

        case ACCESS_DENIED_ACE_TYPE:
            AceSize += sizeof(ACCESS_DENIED_ACE) - sizeof(ULONG);
            CurrentAcl = Dacl;
            ntstatus = ScInitializeDeniedAce(
                           (PACCESS_DENIED_ACE) MaxAce,
                           (USHORT) AceSize,
                           AceData[i].InheritFlags,
                           AceData[i].AceFlags,
                           AceData[i].Mask,
                           *(AceData[i].Sid)
                           );
            break;

        case SYSTEM_AUDIT_ACE_TYPE:
            AceSize += sizeof(SYSTEM_AUDIT_ACE) - sizeof(ULONG);
            CurrentAcl = Sacl;
            ntstatus = ScInitializeAuditAce(
                           MaxAce,
                           (USHORT) AceSize,
                           AceData[i].InheritFlags,
                           AceData[i].AceFlags,
                           AceData[i].Mask,
                           *(AceData[i].Sid)
                           );
            break;

        default:
            SC_LOG2(ERROR,
                    "ScCreateAndSetSD: Invalid AceType %d in ACE %d\n",
                    AceData[i].AceType,
                    i);

            ASSERT(FALSE);
            CurrentAcl = NULL;
            ntstatus = STATUS_UNSUCCESSFUL;
        }

        if ( !NT_SUCCESS( ntstatus ) ) {
            KdPrint((
                    "ScCreateAndSetSD: Fail InitAce i: %d ntstatus: %08lx\n",
                     i, ntstatus));
            goto Cleanup;
        }

        //
        // Append the initialized ACE to the end of DACL or SACL
        //

        if (! NT_SUCCESS (ntstatus = RtlAddAce(
                                         CurrentAcl,
                                         ACL_REVISION,
                                         MAXULONG,
                                         MaxAce,
                                         AceSize
                                         ))) {
            KdPrint((
                    "ScCreateAndSetSD: Fail add ace i: %d ntstatus: %08lx\n",
                    i, ntstatus));
            goto Cleanup;
        }
    }

    //
    // Create the security descriptor with absolute pointers to SIDs
    // and ACLs.
    //
    // Owner = OwnerSid
    // Group = GroupSid
    // Dacl  = Dacl
    // Sacl  = Sacl
    //

    if (! NT_SUCCESS(ntstatus = RtlCreateSecurityDescriptor(
                                    AbsoluteSd,
                                    SECURITY_DESCRIPTOR_REVISION
                                    ))) {
        goto Cleanup;
    }

    if (! NT_SUCCESS(ntstatus = RtlSetOwnerSecurityDescriptor(
                                    AbsoluteSd,
                                    OwnerSid,
                                    FALSE
                                    ))) {
        goto Cleanup;
    }

    if (! NT_SUCCESS(ntstatus = RtlSetGroupSecurityDescriptor(
                                    AbsoluteSd,
                                    GroupSid,
                                    FALSE
                                    ))) {
        goto Cleanup;
    }

    if (! NT_SUCCESS(ntstatus = RtlSetDaclSecurityDescriptor(
                                    AbsoluteSd,
                                    (BOOLEAN)(Dacl ? TRUE : FALSE),
                                    Dacl,
                                    FALSE
                                    ))) {
        goto Cleanup;
    }

    if (! NT_SUCCESS(ntstatus = RtlSetSaclSecurityDescriptor(
                                    AbsoluteSd,
                                    (BOOLEAN)(Sacl ? TRUE : FALSE),
                                    Sacl,
                                    FALSE
                                    ))) {
        goto Cleanup;
    }

    //
    // Done
    //

    ntstatus = STATUS_SUCCESS;

    //
    // Clean up
    //

Cleanup:
    //
    // Either return the security descriptor to the caller or delete it
    //

    if ( NT_SUCCESS( ntstatus ) ) {
        *NewDescriptor = AbsoluteSd;
    } else if ( AbsoluteSd != NULL ) {
        RtlFreeHeap(HeapHandle, 0, AbsoluteSd);
    }

    //
    // Delete the temporary ACE
    //

    if ( MaxAce != NULL ) {
        RtlFreeHeap(HeapHandle, 0, MaxAce);
    }

    return ntstatus;
}


NTSTATUS
ScCreateUserSecurityObject(
    IN  PSECURITY_DESCRIPTOR ParentSD,
    IN  PSC_ACE_DATA AceData,
    IN  ULONG AceCount,
    IN  PSID OwnerSid,
    IN  PSID GroupSid,
    IN  BOOLEAN IsDirectoryObject,
    IN  BOOLEAN UseImpersonationToken,
    IN  PGENERIC_MAPPING GenericMapping,
    OUT PSECURITY_DESCRIPTOR *NewDescriptor
    )
/*++

Routine Description:

    This function creates the DACL for the security descriptor based on
    on the ACE information specified, and creates the security descriptor
    which becomes the user-mode security object.

    A sample usage of this function:

        //
        // Structure that describes the mapping of Generic access rights to
        // object specific access rights for the ConfigurationInfo object.
        //

        GENERIC_MAPPING WsConfigInfoMapping = {
            STANDARD_RIGHTS_READ            |      // Generic read
                WKSTA_CONFIG_GUEST_INFO_GET |
                WKSTA_CONFIG_USER_INFO_GET  |
                WKSTA_CONFIG_ADMIN_INFO_GET,
            STANDARD_RIGHTS_WRITE |                // Generic write
                WKSTA_CONFIG_INFO_SET,
            STANDARD_RIGHTS_EXECUTE,               // Generic execute
            WKSTA_CONFIG_ALL_ACCESS                // Generic all
            };

        //
        // Order matters!  These ACEs are inserted into the DACL in the
        // following order.  Security access is granted or denied based on
        // the order of the ACEs in the DACL.
        //

        SE_ACE_DATA AceData[4] = {
            {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
                   GENERIC_ALL,                  &AliasAdminsSid},

            {ACCESS_DENIED_ACE_TYPE,  0, 0,
                   GENERIC_ALL,                  &NetworkSid},

            {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
                   WKSTA_CONFIG_GUEST_INFO_GET |
                   WKSTA_CONFIG_USER_INFO_GET,   &DomainUsersSid},

            {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
                   WKSTA_CONFIG_GUEST_INFO_GET,  &DomainGuestsSid}
            };

        PSECURITY_DESCRIPTOR WkstaSecurityObject;


        return ScCreateUserSecurityObject(
                   AceData,
                   4,
                   LocalSystemSid,
                   LocalSystemSid,
                   FALSE,
                   &WsConfigInfoMapping,
                   &WkstaSecurityObject
                   );

Arguments:

    AceData - Supplies the structure of information that describes the DACL.

    AceCount - Supplies the number of entries in AceData structure.

    OwnerSid - Supplies the pointer to the SID of the security descriptor
        owner.

    GroupSid - Supplies the pointer to the SID of the security descriptor
        primary group.

    IsDirectoryObject - Supplies the flag which indicates whether the
        user-mode object is a directory object.

    GenericMapping - Supplies the pointer to a generic mapping array denoting
        the mapping between each generic right to specific rights.

    NewDescriptor - Returns a pointer to the self-relative security descriptor
        which represents the user-mode object.

Return Value:

    STATUS_SUCCESS - if successful
    STATUS_NO_MEMORY - if cannot allocate memory for DACL, ACEs, and
        security descriptor.

    Any other status codes returned from the security Rtl routines.

    NOTE : the user security object created by calling this function may be
                freed up by calling RtlDeleteSecurityObject().

--*/
{
    NTSTATUS ntstatus;
    PSECURITY_DESCRIPTOR AbsoluteSd;
    HANDLE TokenHandle;
    PVOID HeapHandle = RtlProcessHeap();

    ntstatus = ScCreateAndSetSD(
                   AceData,
                   AceCount,
                   OwnerSid,
                   GroupSid,
                   &AbsoluteSd
                   );

    if (! NT_SUCCESS(ntstatus)) {
        KdPrint((
                "ScCreateUserSecurityObject: ScCreateAndSetSD returned "
                "%08lx\n", ntstatus));
        return ntstatus;
    }

    if (UseImpersonationToken) {
        ntstatus = NtOpenThreadToken(
                       NtCurrentThread(),
                       TOKEN_QUERY,
                       FALSE,
                       &TokenHandle
                       );
    }
    else {
        ntstatus = NtOpenProcessToken(
                       NtCurrentProcess(),
                       TOKEN_QUERY,
                       &TokenHandle
                       );
    }

    if (! NT_SUCCESS(ntstatus)) {
        KdPrint((
                "ScCreateUserSecurityObject: NtOpen...Token returned "
                "%08lx\n", ntstatus));
        (void) RtlFreeHeap(HeapHandle, 0, AbsoluteSd);
        return ntstatus;
    }

    //
    // Create the security object (a user-mode object is really a pseudo-
    // object represented by a security descriptor that have relative
    // pointers to SIDs and ACLs).  This routine allocates the memory to
    // hold the relative security descriptor so the memory allocated for the
    // DACL, ACEs, and the absolute descriptor can be freed.
    //
    ntstatus = RtlNewSecurityObject(
                   ParentSD,               // Parent descriptor
                   AbsoluteSd,             // Creator descriptor
                   NewDescriptor,          // Pointer to new descriptor
                   IsDirectoryObject,      // Is directory object
                   TokenHandle,            // Token
                   GenericMapping          // Generic mapping
                   );

    (void) NtClose(TokenHandle);

    if (! NT_SUCCESS(ntstatus)) {
        KdPrint((
                "RtlCreateUserSecurityObject: RtlNewSecurityObject returned "
                "%08lx\n", ntstatus));
    }

    //
    // Free dynamic memory before returning
    //
    (void) RtlFreeHeap(HeapHandle, 0, AbsoluteSd);
    return ntstatus;
}


NTSTATUS
ScInitializeAllowedAce(
    IN  PACCESS_ALLOWED_ACE AllowedAce,
    IN  USHORT AceSize,
    IN  UCHAR InheritFlags,
    IN  UCHAR AceFlags,
    IN  ACCESS_MASK Mask,
    IN  PSID AllowedSid
    )
/*++

Routine Description:

    This function assigns the specified ACE values into an allowed type ACE.

Arguments:

    AllowedAce - Supplies a pointer to the ACE that is initialized.

    AceSize - Supplies the size of the ACE in bytes.

    InheritFlags - Supplies ACE inherit flags.

    AceFlags - Supplies ACE type specific control flags.

    Mask - Supplies the allowed access masks.

    AllowedSid - Supplies the pointer to the SID of user/group which is allowed
        the specified access.

Return Value:

    Returns status from RtlCopySid.

--*/
{
    AllowedAce->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
    AllowedAce->Header.AceSize = AceSize;
    AllowedAce->Header.AceFlags = AceFlags | InheritFlags;

    AllowedAce->Mask = Mask;

    return RtlCopySid(
               RtlLengthSid(AllowedSid),
               &(AllowedAce->SidStart),
               AllowedSid
               );
}


NTSTATUS
ScInitializeDeniedAce(
    IN  PACCESS_DENIED_ACE DeniedAce,
    IN  USHORT AceSize,
    IN  UCHAR InheritFlags,
    IN  UCHAR AceFlags,
    IN  ACCESS_MASK Mask,
    IN  PSID DeniedSid
    )
/*++

Routine Description:

    This function assigns the specified ACE values into a denied type ACE.

Arguments:

    DeniedAce - Supplies a pointer to the ACE that is initialized.

    AceSize - Supplies the size of the ACE in bytes.

    InheritFlags - Supplies ACE inherit flags.

    AceFlags - Supplies ACE type specific control flags.

    Mask - Supplies the denied access masks.

    AllowedSid - Supplies the pointer to the SID of user/group which is denied
        the specified access.

Return Value:

    Returns status from RtlCopySid.

--*/
{
    DeniedAce->Header.AceType = ACCESS_DENIED_ACE_TYPE;
    DeniedAce->Header.AceSize = AceSize;
    DeniedAce->Header.AceFlags = AceFlags | InheritFlags;

    DeniedAce->Mask = Mask;

    return RtlCopySid(
               RtlLengthSid(DeniedSid),
               &(DeniedAce->SidStart),
               DeniedSid
               );
}


NTSTATUS
ScInitializeAuditAce(
    IN  PACCESS_ALLOWED_ACE AuditAce,
    IN  USHORT AceSize,
    IN  UCHAR InheritFlags,
    IN  UCHAR AceFlags,
    IN  ACCESS_MASK Mask,
    IN  PSID AuditSid
    )
/*++

Routine Description:

    This function assigns the specified ACE values into an audit type ACE.

Arguments:

    AuditAce - Supplies a pointer to the ACE that is initialized.

    AceSize - Supplies the size of the ACE in bytes.

    InheritFlags - Supplies ACE inherit flags.

    AceFlags - Supplies ACE type specific control flags.

    Mask - Supplies the allowed access masks.

    AuditSid - Supplies the pointer to the SID of user/group which is to be
        audited.

Return Value:

    Returns status from RtlCopySid.

--*/
{
    AuditAce->Header.AceType = SYSTEM_AUDIT_ACE_TYPE;
    AuditAce->Header.AceSize = AceSize;
    AuditAce->Header.AceFlags = AceFlags | InheritFlags;

    AuditAce->Mask = Mask;

    return RtlCopySid(
               RtlLengthSid(AuditSid),
               &(AuditAce->SidStart),
               AuditSid
               );
}

DWORD
ScCreateStartEventSD(
    PSECURITY_DESCRIPTOR    *pEventSD
    )

/*++

Routine Description:

    This routine creates a security descriptor for the
    SC_INTERNAL_START_EVENT.  This function may be called from
    either the client or server side.

    NOTE:  it is up to the caller to free the memory for the
    security descriptor.

Arguments:

    pEventSD - Pointer to a location where the pointer to
        the newly created security descriptor can be placed.

Return Value:

    NO_ERROR - indicates success.

    all other values indicate failure.

--*/
{
    NTSTATUS                ntstatus;
    PSECURITY_DESCRIPTOR    SecurityDescriptor;

    SID_IDENTIFIER_AUTHORITY    WorldSidAuth[1] = {
            SECURITY_WORLD_SID_AUTHORITY};
    SID_IDENTIFIER_AUTHORITY    LocalSystemSidAuth[1] = {
            SECURITY_NT_AUTHORITY};

    SC_ACE_DATA AceData[2] = {
        {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
            SYNCHRONIZE,    &WorldSid},
        {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
            GENERIC_ALL,    &LocalSystemSid}
        };

    //
    // Check against NULL for these SIDs as the client-side code calls
    // this routine and doesn't call ScCreateWellKnownSids.  These
    // should always be non-NULL by this point in services.exe itself.
    //

    if (WorldSid == NULL) {
        if (!AllocateAndInitializeSid(
                    WorldSidAuth,
                    1,
                    SECURITY_WORLD_RID,
                    0,0,0,0,0,0,0,
                    &WorldSid))  {

            SC_LOG1(ERROR, "AllocateAndInitWorldSid failed %d\n",GetLastError());
            return(GetLastError());
        }
    }

    if (LocalSystemSid == NULL) {
        if (!AllocateAndInitializeSid(
                    LocalSystemSidAuth,
                    1,
                    SECURITY_LOCAL_SYSTEM_RID,
                    0,0,0,0,0,0,0,
                    &LocalSystemSid)) {

            SC_LOG1(ERROR, "AllocateAndInitLocalSysSid failed %d\n",GetLastError());
            return(GetLastError());
        }
    }

    ntstatus = ScCreateAndSetSD(
                AceData,
                2,
                LocalSystemSid,
                LocalSystemSid,
                &SecurityDescriptor);

    if (! NT_SUCCESS(ntstatus)) {
        SC_LOG1(ERROR, "ScCreateAndSetSD failed %0x%lx\n",ntstatus);
        return(RtlNtStatusToDosError(ntstatus));
    }

    *pEventSD = SecurityDescriptor;
    return(NO_ERROR);
}