|
|
//+-------------------------------------------------------------------------
//
// Microsoft Windows
// Copyright (C) Microsoft Corporation, 1998 - 1999.
//
// File: secutil.cxx
//
// Contents: security utility routines
//
// History: 10-April-98 dlee Created from 4 other copies in NT
//
//--------------------------------------------------------------------------
#include <pch.cxx>
#pragma hdrstop
#include "secutil.hxx"
//+-------------------------------------------------------------------------
//
// Function: InitAllowedAce
//
// Synopsis: Assignes the ACE values into the allowed ACE
//
// Arguments: [pAllowedAce] - Supplies a pointer to the ACE that is
// initialized.
// [AceSize] - Supplies the size of the ACE in bytes.
// [InheritFlags] - Supplies ACE inherit flags.
// [AceFlags] - Supplies ACE type specific control flags.
// [Mask] - Supplies the allowed access masks.
// [pAllowedSid] - Supplies the pointer to the SID of user/
// group which is allowed the specified access.
//
// History: 10-April-98 dlee Stole from 4 other places in NT
//
//--------------------------------------------------------------------------
void InitAllowedAce( ACCESS_ALLOWED_ACE * pAllowedAce, USHORT AceSize, BYTE InheritFlags, BYTE AceFlags, ACCESS_MASK Mask, SID * pAllowedSid ){ pAllowedAce->Header.AceType = ACCESS_ALLOWED_ACE_TYPE; pAllowedAce->Header.AceSize = AceSize; pAllowedAce->Header.AceFlags = AceFlags | InheritFlags; pAllowedAce->Mask = Mask;
if ( !CopySid( GetLengthSid( pAllowedSid ), &(pAllowedAce->SidStart), pAllowedSid ) ) THROW( CException() );} //InitAllowedAce
//+-------------------------------------------------------------------------
//
// Function: InitDeniedAce
//
// Synopsis: Assignes the ACE values into the denied ACE
//
// Arguments: [pDeniedAce] - Supplies a pointer to the ACE that is
// initialized.
// [AceSize] - Supplies the size of the ACE in bytes.
// [InheritFlags] - Supplies ACE inherit flags.
// [AceFlags] - Supplies ACE type specific control flags.
// [Mask] - Supplies the allowed access masks.
// [pDeniedSid] - Supplies the pointer to the SID of user/
// group which is denied the specified access.
//
// History: 10-April-98 dlee Stole from 4 other places in NT
//
//--------------------------------------------------------------------------
void InitDeniedAce( ACCESS_DENIED_ACE * pDeniedAce, USHORT AceSize, BYTE InheritFlags, BYTE AceFlags, ACCESS_MASK Mask, SID * pDeniedSid ){ pDeniedAce->Header.AceType = ACCESS_DENIED_ACE_TYPE; pDeniedAce->Header.AceSize = AceSize; pDeniedAce->Header.AceFlags = AceFlags | InheritFlags; pDeniedAce->Mask = Mask;
if( !CopySid( GetLengthSid( pDeniedSid ), &(pDeniedAce->SidStart), pDeniedSid ) ) THROW( CException() );} //InitDeniedAce
//+-------------------------------------------------------------------------
//
// Function: InitAuditAce
//
// Synopsis: Assignes the ACE values into the audit ACE
//
// Arguments: [pAuditAce] - Supplies a pointer to the ACE that is
// initialized.
// [AceSize] - Supplies the size of the ACE in bytes.
// [InheritFlags] - Supplies ACE inherit flags.
// [AceFlags] - Supplies ACE type specific control flags.
// [Mask] - Supplies the allowed access masks.
// [pAuditSid] - Supplies the pointer to the SID of user/
// group which is audited
//
// History: 10-April-98 dlee Stole from 4 other places in NT
//
//--------------------------------------------------------------------------
void InitAuditAce( ACCESS_ALLOWED_ACE * pAuditAce, USHORT AceSize, BYTE InheritFlags, BYTE AceFlags, ACCESS_MASK Mask, SID * pAuditSid ){ pAuditAce->Header.AceType = SYSTEM_AUDIT_ACE_TYPE; pAuditAce->Header.AceSize = AceSize; pAuditAce->Header.AceFlags = AceFlags | InheritFlags; pAuditAce->Mask = Mask;
if ( !CopySid( GetLengthSid( pAuditSid ), &(pAuditAce->SidStart), pAuditSid ) ) THROW( CException() );} //InitAuditAce
//+-------------------------------------------------------------------------
//
// Function: CiCreateSecurityDescriptor
//
// Synopsis: Creates a security descriptor from input data
//
// Arguments: [pAceData] - Array of input data
// [cAces] - Count of items in pAceData
// [OwnerSid] - 0 or the owner of the descriptor
// [GroupSid] - 0 or group of the descriptor
// [xAcls] - Resulting absolute SECURITY_DESCRIPTOR,
// allocated to the required size.
//
// History: 10-April-98 dlee Stole from 4 other places in NT
//
//--------------------------------------------------------------------------
void CiCreateSecurityDescriptor( ACE_DATA const * const pAceData, ULONG cAces, SID * pOwnerSid, SID * pGroupSid, XArray<BYTE> & xAcls ){ //
// This function returns a pointer to memory dynamically allocated to
// hold the absolute security descriptor, the DACL, the SACL, and all
// the ACEs:
//
// +---------------------------------------------------------------+
// | Security Descriptor |
// +-------------------------------+-------+---------------+-------+
// | DACL | ACE 1 | . . . | ACE n |
// +-------------------------------+-------+---------------+-------+
// | SACL | ACE 1 | . . . | ACE n |
// +-------------------------------+-------+---------------+-------+
//
DWORD cbDacl = sizeof ACL; DWORD cbSacl = sizeof ACL; DWORD cbMaxAce = 0;
//
// Compute the total size of the DACL and SACL ACEs and the maximum
// size of any ACE.
//
for ( DWORD i = 0; i < cAces; i++ ) { DWORD cbAce = GetLengthSid( pAceData[i].pSid );
switch (pAceData[i].AceType) { case ACCESS_ALLOWED_ACE_TYPE: cbAce += sizeof ACCESS_ALLOWED_ACE; cbDacl += cbAce; break;
case ACCESS_DENIED_ACE_TYPE: cbAce += sizeof ACCESS_DENIED_ACE; cbDacl += cbAce; break;
case SYSTEM_AUDIT_ACE_TYPE: cbAce += sizeof SYSTEM_AUDIT_ACE; cbSacl += cbAce; break;
default: Win4Assert( FALSE ); }
cbMaxAce = __max( cbMaxAce, cbAce ); }
//
// Allocate a chunk of memory large enough the security descriptor
// the DACL, the SACL and all ACEs.
// A security descriptor is of opaque data type but
// SECURITY_DESCRIPTOR_MIN_LENGTH is the right size.
//
DWORD cbTotal = SECURITY_DESCRIPTOR_MIN_LENGTH;
if ( cbDacl != sizeof ACL ) cbTotal += cbDacl;
if ( cbSacl != sizeof ACL ) cbTotal += cbSacl;
xAcls.Init( cbTotal ); SECURITY_DESCRIPTOR *pAbsoluteSd = (SECURITY_DESCRIPTOR *) xAcls.Get();
//
// Initialize the Dacl and Sacl
//
BYTE *pbCurrent = (BYTE *) pAbsoluteSd + SECURITY_DESCRIPTOR_MIN_LENGTH; ACL *pDacl = 0; // Pointer to the DACL portion of above buffer
ACL *pSacl = 0; // Pointer to the SACL portion of above buffer
if ( sizeof ACL != cbDacl ) { pDacl = (ACL *) pbCurrent; pbCurrent += cbDacl;
if( !InitializeAcl( pDacl, cbDacl, ACL_REVISION ) ) THROW( CException() ); }
if ( sizeof ACL != cbSacl ) { pSacl = (ACL *) pbCurrent; pbCurrent += cbSacl;
if ( !InitializeAcl( pSacl, cbSacl, ACL_REVISION ) ) THROW( CException() ); }
//
// Allocate a temporary buffer big enough for the biggest ACE.
// This is usually pretty small
//
XGrowable<BYTE> xMaxAce( cbMaxAce );
//
// Initialize each ACE, and append it into the end of the DACL or SACL.
//
for ( i = 0; i < cAces; i++ ) { DWORD cbAce = GetLengthSid( pAceData[i].pSid ); ACL *pCurrentAcl;
switch (pAceData[i].AceType) { case ACCESS_ALLOWED_ACE_TYPE: cbAce += sizeof ACCESS_ALLOWED_ACE; pCurrentAcl = pDacl; InitAllowedAce( (ACCESS_ALLOWED_ACE *) xMaxAce.Get(), (USHORT) cbAce, pAceData[i].InheritFlags, pAceData[i].AceFlags, pAceData[i].Mask, pAceData[i].pSid ); break;
case ACCESS_DENIED_ACE_TYPE: cbAce += sizeof ACCESS_DENIED_ACE; pCurrentAcl = pDacl; InitDeniedAce( (ACCESS_DENIED_ACE *) xMaxAce.Get(), (USHORT) cbAce, pAceData[i].InheritFlags, pAceData[i].AceFlags, pAceData[i].Mask, pAceData[i].pSid ); break;
case SYSTEM_AUDIT_ACE_TYPE: cbAce += sizeof SYSTEM_AUDIT_ACE; pCurrentAcl = pSacl;
// Audit uses ACCESS_ALLOWED_ACE
InitAuditAce( (ACCESS_ALLOWED_ACE *) xMaxAce.Get(), (USHORT) cbAce, pAceData[i].InheritFlags, pAceData[i].AceFlags, pAceData[i].Mask, pAceData[i].pSid ); break; }
//
// Append the initialized ACE to the end of DACL or SACL
//
if ( !AddAce( pCurrentAcl, ACL_REVISION, MAXULONG, xMaxAce.Get(), cbAce ) ) THROW( CException() ); }
//
// Create the security descriptor with absolute pointers to SIDs
// and ACLs.
//
// Owner = pOwnerSid
// Group = pGroupSid
// Dacl = Dacl
// Sacl = Sacl
//
if ( !InitializeSecurityDescriptor( pAbsoluteSd, SECURITY_DESCRIPTOR_REVISION ) || !SetSecurityDescriptorOwner( pAbsoluteSd, pOwnerSid, FALSE ) || !SetSecurityDescriptorGroup( pAbsoluteSd, pGroupSid, FALSE ) || !SetSecurityDescriptorDacl( pAbsoluteSd, TRUE, pDacl, FALSE ) || !SetSecurityDescriptorSacl( pAbsoluteSd, FALSE, pSacl, FALSE ) ) THROW( CException() );} //CiCreateSecurityDescriptor
|
