windows-server-2003/ds/security/winsafer/safecat.c

//depot/main/DS/security/winsafer/safecat.c#8 - integrate change 7547 (text)
/*++

Copyright (c) 1997-2000  Microsoft Corporation

Module Name:

    safecat.cpp         (SAFER SaferComputeTokenFromLevel)

Abstract:

    This module implements the WinSAFER APIs to compute a new restricted
    token from a more privileged one, utilizing an "Code Authorization
    Level Object", which specifies the actions to perform to apply
    the restrictions.

Author:

    Jeffrey Lawson (JLawson) - Nov 1999

Environment:

    User mode only.

Exported Functions:

    CodeAuthzpGetTokenInformation               (private)
    CodeAuthzpSidInSidAndAttributes             (private)
    CodeAuthzpModifyTokenPermissions            (private)
    CodeAuthzpInvertPrivs                       (private)
    SaferComputeTokenFromLevel
    CompareCodeAuthzObjectWithToken
    CodeAuthzpGetAuthzObjectRestrictions        (private)

Revision History:

    Created - Nov 1999

--*/

#include "pch.h"
#pragma hdrstop
#include <seopaque.h>       // needed for sertlp.h
#include <sertlp.h>         // RtlpDaclAddrSecurityDescriptor
#include <winsafer.h>
#include <winsaferp.h>
#include "saferp.h"



//
// Internal prototypes of other functions defined locally within this file.
//

NTSTATUS NTAPI
CodeAuthzpModifyTokenPermissions(
    IN HANDLE   hToken,
    IN PSID     pExplicitSid,
    IN DWORD    dwExplicitPerms,
    IN PSID     pExplicitSid2       OPTIONAL,
    IN DWORD    dwExplicitPerms2    OPTIONAL
    );

NTSTATUS NTAPI
CodeAuthzpModifyTokenOwner(
    IN HANDLE   hToken,
    IN PSID     NewOwnerSid
    );

BOOL
IsSaferDisabled(
    void
    )
{
    static int g_nDisableSafer = -1;
            // -1 means we didn't check yet
            //  0 means safer is enabled
            //  1 means safer is disabled

    static const UNICODE_STRING KeyNameSafeBoot =
        RTL_CONSTANT_STRING(L"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option");
    static const UNICODE_STRING ValueNameSafeBoot =
        RTL_CONSTANT_STRING(L"OptionValue");
    static const OBJECT_ATTRIBUTES objaSafeBoot =
        RTL_CONSTANT_OBJECT_ATTRIBUTES(&KeyNameSafeBoot, OBJ_CASE_INSENSITIVE);

    HANDLE                      hKey;
    BYTE ValueBuffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(DWORD)];
    PKEY_VALUE_PARTIAL_INFORMATION pKeyValueInformation =
            (PKEY_VALUE_PARTIAL_INFORMATION)ValueBuffer;
    DWORD                       ValueLength;
    NTSTATUS                    Status;

    //
    // First see if we already checked the registry
    //
    if (g_nDisableSafer == 1) {
        return TRUE;
    }

    if (g_nDisableSafer == 0) {
        return FALSE;
    }

    //
    // This is the only time we check for safeboot by going to the registry
    // Opening the key for "write" tells us if we are an admin.
	// 
    Status = NtOpenKey(&hKey, KEY_QUERY_VALUE | KEY_SET_VALUE, (POBJECT_ATTRIBUTES) &objaSafeBoot);
    if (NT_SUCCESS(Status)) {
        Status = NtQueryValueKey(hKey,
                                 (PUNICODE_STRING) &ValueNameSafeBoot,
                                 KeyValuePartialInformation,
                                 pKeyValueInformation,
                                 sizeof(ValueBuffer),
                                 &ValueLength);

        NtClose(hKey);

        if (NT_SUCCESS(Status) &&
            pKeyValueInformation->Type == REG_DWORD &&
            pKeyValueInformation->DataLength == sizeof(DWORD)) {
            //
            // If the value exists and it's not 0 then we are in one of SafeBoot modes.
            // Return TRUE in this case to disable the shim infrastructure
            //
            if (*((PDWORD) pKeyValueInformation->Data) > 0) {
                g_nDisableSafer = 1;
                return TRUE;
            }
        }
    }

    g_nDisableSafer = 0;

    return FALSE;
}


LPVOID NTAPI
CodeAuthzpGetTokenInformation(
    IN HANDLE                       TokenHandle,
    IN TOKEN_INFORMATION_CLASS      TokenInformationClass
    )
/*++

Routine Description:

    Returns a pointer to allocated memory containing a specific
    type of information class about the specified token.  This
    wrapper function around GetTokenInformation() handles the
    allocation of memory of the appropriate size needed.

Arguments:

    TokenHandle - specifies the token that should be used
        to obtain the specified information from.

    TokenInformationClass - specifies the information class wanted.

Return Value:

    Returns NULL on error.  Otherwise caller must free the returned
    structure with RtlFreeHeap().

--*/
{
    DWORD dwSize = 128;
    LPVOID pTokenInfo = NULL;

    if (ARGUMENT_PRESENT(TokenHandle))
    {
        pTokenInfo = (LPVOID)RtlAllocateHeap(RtlProcessHeap(), 0, dwSize);
        if (pTokenInfo != NULL)
        {
            DWORD dwNewSize;
            NTSTATUS Status;

            Status = NtQueryInformationToken(
                    TokenHandle, TokenInformationClass,
                    pTokenInfo, dwSize, &dwNewSize);
            if (Status == STATUS_BUFFER_TOO_SMALL)
            {
                RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) pTokenInfo);

                pTokenInfo = (LPVOID)RtlAllocateHeap(RtlProcessHeap(), 0, dwNewSize);
                if (pTokenInfo != NULL)
                {
                    Status = NtQueryInformationToken(
                        TokenHandle, TokenInformationClass,
                        pTokenInfo, dwNewSize, &dwNewSize);
                }
            }
            if (!NT_SUCCESS(Status))
            {
                RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) pTokenInfo);
                pTokenInfo = NULL;
            }
        }
    }

    return pTokenInfo;
}



BOOLEAN NTAPI
CodeAuthzpSidInSidAndAttributes (
    IN PSID_AND_ATTRIBUTES  SidAndAttributes,
    IN ULONG                SidCount,
    OPTIONAL IN PSID        SePrincipalSelfSid,
    OPTIONAL IN PSID        PrincipalSelfSid,
    IN PSID                 Sid,
    BOOLEAN                 HonorEnabledAttribute
    )
/*++

Routine Description:

    Checks to see if a given SID is in the given token.

    N.B. The code to compute the length of a SID and test for equality
         is duplicated from the security runtime since this is such a
         frequently used routine.

    This function is mostly copied from the SepSidInSidAndAttributes
    found in ntos\se\tokendup.c, except it handles PrincipalSelfSid
    within the list as well as the passed in Sid.  SePrincipalSelfSid
    is also a parameter here, instead of an ntoskrnl global.  also the
    HonorEnabledAttribute argument was added.

Arguments:

    SidAndAttributes - Pointer to the sid and attributes to be examined

    SidCount - Number of entries in the SidAndAttributes array.

    SePrincipalSelfSid - This parameter should optionally be the SID that
        will be replaced with the PrincipalSelfSid if this SID is encountered
        in any ACE.  This SID should be generated from SECURITY_PRINCIPAL_SELF_RID

        The parameter should be NULL if the object does not represent a principal.


    PrincipalSelfSid - If the object being access checked is an object which
        represents a principal (e.g., a user object), this parameter should
        be the SID of the object.  Any ACE containing the constant
        SECURITY_PRINCIPAL_SELF_RID is replaced by this SID.

        The parameter should be NULL if the object does not represent a principal.


    Sid - Pointer to the SID of interest


    HonorEnabledAttribute - If this argument is TRUE, then only Sids in the
        SidsAndAttributes array that have the Attribute SE_GROUP_ENABLED set
        will be processed during the evaluation.

Return Value:

    A value of TRUE indicates that the SID is in the token, FALSE
    otherwise.

--*/
{
    ULONG i;
    PISID MatchSid;
    ULONG SidLength;
    PSID_AND_ATTRIBUTES TokenSid;
    ULONG UserAndGroupCount;



    if (!ARGUMENT_PRESENT( SidAndAttributes ) ) {
        return(FALSE);
    }
    ASSERT(Sid != NULL);

    //
    // If Sid is the constant PrincipalSelfSid,
    //  replace it with the passed in PrincipalSelfSid.
    //

    if ( ARGUMENT_PRESENT(PrincipalSelfSid) &&
         ARGUMENT_PRESENT(SePrincipalSelfSid) &&
         RtlEqualSid( SePrincipalSelfSid, Sid ) ) {

        ASSERT(!RtlEqualSid(SePrincipalSelfSid, PrincipalSelfSid));
        Sid = PrincipalSelfSid;
    }

    //
    // Get the length of the source SID since this only needs to be computed
    // once.
    //

    SidLength = 8 + (4 * ((PISID)Sid)->SubAuthorityCount);

    //
    // Get address of user/group array and number of user/groups.
    //

    ASSERT(SidAndAttributes != NULL);
    TokenSid = SidAndAttributes;
    UserAndGroupCount = SidCount;

    //
    // Scan through the user/groups and attempt to find a match with the
    // specified SID.
    //

    for (i = 0 ; i < UserAndGroupCount ; i++)
    {
        if (!HonorEnabledAttribute ||
            (TokenSid->Attributes & SE_GROUP_ENABLED) != 0)
        {
            MatchSid = (PISID)TokenSid->Sid;
            ASSERT(MatchSid != NULL);

            //
            // If the SID is the principal self SID, then replace it.
            //

            if ( ARGUMENT_PRESENT(SePrincipalSelfSid) &&
                 ARGUMENT_PRESENT(PrincipalSelfSid) &&
                 RtlEqualSid(SePrincipalSelfSid, MatchSid)) {

                MatchSid = (PISID) PrincipalSelfSid;
            }


            //
            // If the SID revision and length matches, then compare the SIDs
            // for equality.
            //

            if ((((PISID)Sid)->Revision == MatchSid->Revision) &&
                (SidLength == (8 + (4 * (ULONG)MatchSid->SubAuthorityCount)))) {

                if (RtlEqualMemory(Sid, MatchSid, SidLength)) {

                    return TRUE;

                }
            }
        }

        TokenSid++;
    }

    return FALSE;
}


NTSTATUS NTAPI
CodeAuthzpModifyTokenPermissions(
    IN HANDLE   hToken,
    IN PSID     pExplicitSid,
    IN DWORD    dwExplicitPerms,
    IN PSID     pExplicitSid2       OPTIONAL,
    IN DWORD    dwExplicitPerms2    OPTIONAL
    )

/*++

Routine Description:

    An internal function to make some additional permission modifications
    on a newly created restricted token.

Arguments:

    hToken - token to modify

    pExplicitSid - explicitly named SID to add to the token's DACL.

    dwExplicitPerms - permissions given to the explicitly named SID
            when it is added to the DACL.

    pExplicitSid2 - (optional) secondary named SID to add to the DACL.

    dwExplicitPerms2 - (optional) secondary permissions given to the
            secondary SID when it is added to the DACL.

Return Value:

    A value of TRUE indicates that the operation was successful,
    FALSE otherwise.

--*/

{
    NTSTATUS            Status       = STATUS_SUCCESS;
    PACL                pTokenDacl   = NULL;
    PUCHAR              Buffer       = NULL;
    TOKEN_DEFAULT_DACL  TokenDefDacl = {0};
    ULONG               BufferLength = 0;
    ULONG               AclLength    = 0;

    //
    // Verify that our arguments were supplied.  Since this is
    // an internal function, we just assert instead of doing
    // real argument checking.
    //

    ASSERT(ARGUMENT_PRESENT(hToken));
    ASSERT(ARGUMENT_PRESENT(pExplicitSid) && RtlValidSid(pExplicitSid));
    ASSERT(!ARGUMENT_PRESENT(pExplicitSid2) || RtlValidSid(pExplicitSid2));

    //
    // Retrieve the default acl in the token.
    //

    Status = NtQueryInformationToken(
                    hToken,
                    TokenDefaultDacl,
                    NULL,
                    0, 
                    (PULONG) &BufferLength
                    );

    if (Status == STATUS_BUFFER_TOO_SMALL)
    {
        //
        // Allocate memory for the buffer.
        //

        Buffer = (PUCHAR) RtlAllocateHeap(RtlProcessHeap(), 0, BufferLength);

        if (!Buffer) 
        {
            Status = STATUS_NO_MEMORY;
            goto ExitHandler;
        }

        //
        // Perform the query again and actually get it.
        //

        Status = NtQueryInformationToken(
                        hToken,
                        TokenDefaultDacl,
                        Buffer, 
                        BufferLength, 
                        (PULONG) &BufferLength
                        );

        if (!NT_SUCCESS(Status)) 
        {
            goto ExitHandler;
        }

        AclLength = ((PTOKEN_DEFAULT_DACL) Buffer)->DefaultDacl->AclSize;

        //
        // Calculate how much size we might need in the worst case where
        // we have to enlarge the DACL.
        //

        AclLength += (sizeof(ACCESS_ALLOWED_ACE) +
                      RtlLengthSid(pExplicitSid) -
                      sizeof(DWORD));

        if (ARGUMENT_PRESENT(pExplicitSid2)) 
        {
            AclLength += (sizeof(ACCESS_ALLOWED_ACE) +
                          RtlLengthSid(pExplicitSid2) -
                          sizeof(DWORD));
        }

        //
        // Allocate memory to hold the new acl.
        //

        pTokenDacl = (PACL) RtlAllocateHeap(RtlProcessHeap(), 0, AclLength);

        if (!pTokenDacl) 
        {
            Status = STATUS_NO_MEMORY;
            goto ExitHandler;
        }

        //
        // Copy the old acl into allocated memory.
        //

        RtlCopyMemory(
            pTokenDacl, 
            ((PTOKEN_DEFAULT_DACL) Buffer)->DefaultDacl,
            ((PTOKEN_DEFAULT_DACL) Buffer)->DefaultDacl->AclSize
            );

        //
        // Set the acl size to the new size.
        //

        pTokenDacl->AclSize = (USHORT) AclLength;

    } 
    else if (!NT_SUCCESS(Status)) 
    {
        goto ExitHandler;
    } 
    else 
    {
        //
        // If we get here, there's a bug in Nt code.
        //

        ASSERT(FALSE);
        Status = STATUS_UNSUCCESSFUL;
        goto ExitHandler;
    }

    ASSERT(RtlValidAcl(pTokenDacl));

    //
    // Create the new DACL that includes the extra ACEs that we want.
    //

    Status = RtlAddAccessAllowedAceEx(
                    pTokenDacl,
                    ACL_REVISION,
                    CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE,
                    dwExplicitPerms,
                    pExplicitSid
                    );

    if (!NT_SUCCESS(Status)) 
    {
        ASSERT(Status != STATUS_ALLOTTED_SPACE_EXCEEDED);
        goto ExitHandler;
    }

    if (ARGUMENT_PRESENT(pExplicitSid2))
    {
        Status = RtlAddAccessAllowedAceEx(
                        pTokenDacl,
                        ACL_REVISION,
                        CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE,
                        dwExplicitPerms2,
                        pExplicitSid2
                        );

        if (!NT_SUCCESS(Status)) 
        {
            ASSERT(Status != STATUS_ALLOTTED_SPACE_EXCEEDED);
            goto ExitHandler;
        }

    }

    ASSERT(RtlValidAcl(pTokenDacl));

    //
    // Set the Default DACL within the token to the DACL that we built.
    //

    RtlZeroMemory(&TokenDefDacl, sizeof(TOKEN_DEFAULT_DACL));
    TokenDefDacl.DefaultDacl = pTokenDacl;

    Status = NtSetInformationToken(
                    hToken,
                    TokenDefaultDacl,
                    &TokenDefDacl,
                    sizeof(TOKEN_DEFAULT_DACL)
                    );

    if (!NT_SUCCESS(Status)) 
    {
        goto ExitHandler;
    }

    Status = STATUS_SUCCESS;      // success


ExitHandler:
    if (pTokenDacl != NULL)
    {
        RtlFreeHeap(RtlProcessHeap(), 0, pTokenDacl);
    }

    if (Buffer != NULL)
    {
        RtlFreeHeap(RtlProcessHeap(), 0, Buffer);
    }

    return Status;
}



NTSTATUS NTAPI
CodeAuthzpModifyTokenOwner(
    IN HANDLE       hToken,
    IN PSID         NewOwnerSid
    )
{
    NTSTATUS Status;
    TOKEN_OWNER tokenowner;

    //
    // Verify that we have our arguments.
    //
    if (!ARGUMENT_PRESENT(hToken) ||
        !ARGUMENT_PRESENT(NewOwnerSid)) {
        Status = STATUS_INVALID_PARAMETER;
        goto ExitHandler;
    }


    //
    // Set the owner of the Token.
    //
    RtlZeroMemory(&tokenowner, sizeof(TOKEN_OWNER));
    tokenowner.Owner = NewOwnerSid;
    Status = NtSetInformationToken(hToken, TokenOwner,
                    &tokenowner, sizeof(TOKEN_OWNER));

ExitHandler:
    return Status;
}



BOOLEAN NTAPI
CodeAuthzpInvertPrivs(
    IN HANDLE                   InAccessToken,
    IN DWORD                    dwNumInvertedPrivs,
    IN PLUID_AND_ATTRIBUTES     pInvertedPrivs,
    OUT PDWORD                  dwOutNumPrivs,
    OUT PLUID_AND_ATTRIBUTES   *pResultingPrivs
    )
/*++

Routine Description:


Arguments:

    InAccessToken -

    dwNumInvertedPrivs -

    pInvertedPrivs -

    dwOutNumPrivs -

    pResultingPrivs -

Return Value:

    Returns FALSE on error, TRUE on success.

--*/
{
    PTOKEN_PRIVILEGES pTokenPrivileges;
    DWORD Index, InnerIndex;


    //
    // Obtain the list of currently held privileges.
    //
    ASSERT( ARGUMENT_PRESENT(InAccessToken) );
    pTokenPrivileges = (PTOKEN_PRIVILEGES)
        CodeAuthzpGetTokenInformation(InAccessToken, TokenPrivileges);
    if (!pTokenPrivileges) goto ExitHandler;


    //
    // Squeeze out any privileges that were specified to us,
    // leaving only those privileges that weren't specified.
    //
    ASSERT( ARGUMENT_PRESENT(pInvertedPrivs) );
    for (Index = 0; Index < pTokenPrivileges->PrivilegeCount; Index++)
    {
        for (InnerIndex = 0; InnerIndex < dwNumInvertedPrivs; InnerIndex++)
        {
            if (RtlEqualMemory(&pTokenPrivileges->Privileges[Index].Luid,
                    &pInvertedPrivs[InnerIndex].Luid, sizeof(LUID)) )
            {
                pTokenPrivileges->PrivilegeCount--;
                RtlMoveMemory(&pTokenPrivileges->Privileges[Index],
                    &pTokenPrivileges->Privileges[Index + 1],
                    pTokenPrivileges->PrivilegeCount - Index);
                Index--;
                break;
            }
        }
    }


    //
    // Return the number of final privileges.  Also, convert the
    // TOKEN_PRIVILEGES structure into just a LUID_AND_ATTRIBUTES array.
    // There will be some unused slack at the end of the used portion
    // of the array, but that is fine (some array entries have probably
    // already been squeezed out).
    //
    *dwOutNumPrivs = pTokenPrivileges->PrivilegeCount;
    RtlMoveMemory(pTokenPrivileges, &pTokenPrivileges->Privileges[0],
         pTokenPrivileges->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES) );
    *pResultingPrivs = (PLUID_AND_ATTRIBUTES) pTokenPrivileges;
    return TRUE;


ExitHandler:
    return FALSE;
}



NTSTATUS NTAPI
__CodeAuthzpComputeAccessTokenFromCodeAuthzObject (
    IN PAUTHZLEVELTABLERECORD     pLevelRecord,
    IN HANDLE                   InAccessToken OPTIONAL,
    OUT PHANDLE                 OutAccessToken,
    IN DWORD                    dwFlags,
    IN LPVOID                   lpReserved,
    IN DWORD                    dwSaferIdentFlags OPTIONAL
    )
/*++

Routine Description:

    Uses the specified WinSafer Level to apply various restrictions
    or modifications to the specified InAccessToken to produce a
    Restricted Token that can be used to execute processes with.
    Alternatively, the returned Restricted Token can be used for
    thread impersonation to selectively perform operations within a
    less-privileged environment.

Arguments:

    pLevelRecord - the record structure of the Level to evaluate.

    InAccessToken - Optionally specifies the input Token that will be
        modified with restrictions.  If this argument is NULL, then the
        Token for the currently executing process will be opened and used.

    OutAccessToken - Specifies the memory region to receive the resulting
        Restricted Token.

    dwFlags - Specifies additional flags that can be used to control the
        restricted token creation:

            SAFER_TOKEN_MAKE_INERT -
            SAFER_TOKEN_NULL_IF_EQUAL -
            SAFER_TOKEN_WANT_FLAGS -

    lpReserved - extra parameter used for some dwFlag combinations.

    dwSaferIdentFlags - extra SaferFlags bits derived from the matched
        Code Identifier record entry.  These extra bits are ORed to
        combine them with the SaferFlags associated with the Level.

Return Value:

    Returns -1 if the input Level record is the Disallowed level.

    Returns STATUS_SUCCESS on a successful operation, otherwise the
    errorcode of the failure that occurred.

--*/
{
    SID_IDENTIFIER_AUTHORITY SIDAuth = SECURITY_NT_AUTHORITY;
    NTSTATUS Status;
    BOOL InAccessTokenWasSupplied = FALSE;
    HANDLE RestrictedToken = NULL;
    DWORD FinalFilterFlags;
    DWORD SaferFlags;
    BOOL InertStateChanged = FALSE;

    PSID restrictedSid = NULL;
    PTOKEN_USER pTokenUser = NULL;
    PSID principalSelfSid = NULL;

    DWORD FinalDisabledSidCount;
    PSID_AND_ATTRIBUTES FinalSidsToDisable = NULL;
    BOOL FreeFinalDisabledSids = FALSE;

    DWORD FinalRestrictedSidCount;
    PSID_AND_ATTRIBUTES FinalSidsToRestrict = NULL;
    BOOL FreeFinalRestrictedSids = FALSE;

    DWORD FinalPrivsToDeleteCount;
    PLUID_AND_ATTRIBUTES FinalPrivsToDelete = NULL;
    BOOL FreeFinalPrivsToDelete = FALSE;


    OBJECT_ATTRIBUTES ObjAttr = {0};
    SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService = {0};
    SECURITY_DESCRIPTOR sd = {0};

    //
    // Verify that our input arguments were supplied.
    //
    if (!ARGUMENT_PRESENT(pLevelRecord)) {
        Status = STATUS_INVALID_PARAMETER_1;
        goto ExitHandler;
    }
    if (!ARGUMENT_PRESENT(OutAccessToken)) {
        Status = STATUS_ACCESS_VIOLATION;
        goto ExitHandler;
    }


    //
    // Ensure that we have the parent token that will be
    // used for the creation of the restricted token.
    //
    if (ARGUMENT_PRESENT(InAccessToken)) {
        InAccessTokenWasSupplied = TRUE;
    } else {
        Status = NtOpenThreadToken(NtCurrentThread(),
                TOKEN_DUPLICATE | READ_CONTROL | TOKEN_QUERY,
                TRUE, &InAccessToken);
        if (!NT_SUCCESS(Status)) {
            Status = NtOpenProcessToken(NtCurrentProcess(),
                    TOKEN_DUPLICATE | READ_CONTROL | TOKEN_QUERY,
                    &InAccessToken);
            if (!NT_SUCCESS(Status)) {
                goto ExitHandler;       // could not obtain default token
            }
        }
    }



    //
    // Figure out the combined effect of the "SaferFlags".
    // Also figure out what flags we'll pass to NtFilterToken.
    // Note that all of the bits within the SaferFlags can be
    // combined by bitwise-OR, except for the JOBID portion.
    //
    FinalFilterFlags = (pLevelRecord->DisableMaxPrivileges ?
                        DISABLE_MAX_PRIVILEGE : 0);
    if ((dwSaferIdentFlags & SAFER_POLICY_JOBID_MASK) != 0) {
        SaferFlags = dwSaferIdentFlags |
            (pLevelRecord->SaferFlags & ~SAFER_POLICY_JOBID_MASK);
    } else {
        SaferFlags = pLevelRecord->SaferFlags | dwSaferIdentFlags;
    }
    if ((dwFlags & SAFER_TOKEN_MAKE_INERT) != 0 ||
        (SaferFlags & SAFER_POLICY_SANDBOX_INERT) != 0)
    {
        SaferFlags |= SAFER_POLICY_SANDBOX_INERT;
        FinalFilterFlags |= SANDBOX_INERT;
    }



    //
    // Retrieve the User's personal SID.
    // (user's SID is accessible afterwards with "pTokenUser->User.Sid")
    //

    pTokenUser = (PTOKEN_USER) CodeAuthzpGetTokenInformation(
                                   InAccessToken, 
                                   TokenUser
                                   );

    if (pTokenUser == NULL) {
        Status = STATUS_UNSUCCESSFUL;
        goto ExitHandler;
    }

    //
    // Quick check to see if we can expect a change in the
    // token's "Sandbox Inert" state to occur.
    //
    {
        ULONG bIsInert = 0;
        ULONG ulReturnLength;

        Status = NtQueryInformationToken(
                    InAccessToken,
                    TokenSandBoxInert,
                    &bIsInert,
                    sizeof(bIsInert),
                    &ulReturnLength);
        if (NT_SUCCESS(Status) && bIsInert) {
            if ( (dwFlags & SAFER_TOKEN_NULL_IF_EQUAL) != 0) {
                // The output token was not made any more restrictive during
                // this operation, so pass back NULL and return success.
                *OutAccessToken = NULL;
                Status = STATUS_SUCCESS;
                goto ExitHandler;
            } else {
                
                SecurityQualityOfService.Length = sizeof( SECURITY_QUALITY_OF_SERVICE  );
                SecurityQualityOfService.ImpersonationLevel = SecurityAnonymous;
                SecurityQualityOfService.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
                SecurityQualityOfService.EffectiveOnly = FALSE;

                Status = RtlCreateSecurityDescriptor(
                            &sd, 
                            SECURITY_DESCRIPTOR_REVISION
                            );

                if (!NT_SUCCESS(Status)) {
                    goto ExitHandler;
                }
                Status = RtlSetOwnerSecurityDescriptor(
                             &sd, 
                             pTokenUser->User.Sid, 
                             FALSE
                             );

                if (!NT_SUCCESS(Status)) {
                    goto ExitHandler;
                }

                InitializeObjectAttributes(
                        &ObjAttr,
                        NULL,
                        OBJ_INHERIT,
                        NULL,
                        &sd
                        );

                ObjAttr.SecurityQualityOfService = &SecurityQualityOfService;

                Status = NtDuplicateToken(
                             InAccessToken,
                             TOKEN_ALL_ACCESS,
                             &ObjAttr,
                             FALSE,
                             TokenPrimary,
                             OutAccessToken
                             );
                
                goto ExitHandler;
            }
        } else {
            if ((FinalFilterFlags & SANDBOX_INERT) != 0) {
                // the input token was not "SandBox Inert" and
                // we're being requested to make it.
                InertStateChanged = TRUE;
            }
        }
    }

    //
    // If this is not allowed to execute, then break out now.
    //
    if (pLevelRecord->DisallowExecution) {
        Status = -1;            // special status code
        goto ExitHandler;
    }


    //
    // Process PrivsToDelete inversion.
    //
    if (pLevelRecord->InvertDeletePrivs != FALSE)
    {
        if (!CodeAuthzpInvertPrivs(
                InAccessToken,
                pLevelRecord->DeletePrivilegeUsedCount,
                pLevelRecord->PrivilegesToDelete,
                &FinalPrivsToDeleteCount,
                &FinalPrivsToDelete))
        {
            Status = STATUS_UNSUCCESSFUL;
            goto ExitHandler;
        }
        FreeFinalPrivsToDelete = TRUE;
    }
    else
    {
        FinalPrivsToDeleteCount = pLevelRecord->DeletePrivilegeUsedCount;
        FinalPrivsToDelete = pLevelRecord->PrivilegesToDelete;
    }


    //
    // Process SidsToDisable inversion.
    //
    if (pLevelRecord->InvertDisableSids != FALSE)
    {
        if (!CodeAuthzpInvertAndAddSids(
                InAccessToken,
                pTokenUser->User.Sid,
                pLevelRecord->DisableSidUsedCount,
                pLevelRecord->SidsToDisable,
                0,
                NULL,
                &FinalDisabledSidCount,
                &FinalSidsToDisable))
        {
            Status = STATUS_UNSUCCESSFUL;
            goto ExitHandler;
        }
        FreeFinalDisabledSids = TRUE;
    }
    else
    {
        if (pLevelRecord->DisableSidUsedCount == 0 ||
            pLevelRecord->SidsToDisable == NULL)
        {
            FinalSidsToDisable = NULL;
            FinalDisabledSidCount = 0;
            FreeFinalDisabledSids = FALSE;
        } else {
            if (!CodeAuthzpExpandWildcardList(
                InAccessToken,
                pTokenUser->User.Sid,
                pLevelRecord->DisableSidUsedCount,
                pLevelRecord->SidsToDisable,
                &FinalDisabledSidCount,
                &FinalSidsToDisable))
            {
                Status = STATUS_UNSUCCESSFUL;
                goto ExitHandler;
            }
            FreeFinalDisabledSids = TRUE;
        }
    }


    //
    // Process RestrictingSids inversion.
    //
    if (pLevelRecord->RestrictedSidsInvUsedCount != 0)
    {
        if (!CodeAuthzpInvertAndAddSids(
                InAccessToken,
                pTokenUser->User.Sid,
                pLevelRecord->RestrictedSidsInvUsedCount,
                pLevelRecord->RestrictedSidsInv,
                pLevelRecord->RestrictedSidsAddedUsedCount,
                pLevelRecord->RestrictedSidsAdded,
                &FinalRestrictedSidCount,
                &FinalSidsToRestrict))
        {
            Status = STATUS_UNSUCCESSFUL;
            goto ExitHandler;
        }
        FreeFinalRestrictedSids = TRUE;
    }
    else
    {
        FinalRestrictedSidCount = pLevelRecord->RestrictedSidsAddedUsedCount;
        FinalSidsToRestrict = pLevelRecord->RestrictedSidsAdded;
    }


    //
    // In some cases, we can bail out early if we were called with
    // the compare-only flag, and we know that there should not be
    // any actual changes being made to the token.
    //
    if (!InertStateChanged &&
        FinalDisabledSidCount == 0 &&
        FinalPrivsToDeleteCount == 0 &&
        FinalRestrictedSidCount == 0 &&
        (FinalFilterFlags & DISABLE_MAX_PRIVILEGE) == 0)
    {
        if ( (dwFlags & SAFER_TOKEN_NULL_IF_EQUAL) != 0) {
            // The output token was not made any more restrictive during
            // this operation, so pass back NULL and return success.
            *OutAccessToken = NULL;
            Status = STATUS_SUCCESS;
            goto ExitHandler;
        } else {
            // OPTIMIZATION: for this case we can consider using DuplicateToken
        }
    }


    //
    // Create the actual restricted token.
    //
    if (!CreateRestrictedToken(
            InAccessToken,              // handle to existing token
            FinalFilterFlags,           // privilege options and inert
            FinalDisabledSidCount,      // number of deny-only SIDs
            FinalSidsToDisable,         // deny-only SIDs
            FinalPrivsToDeleteCount,    // number of privileges
            FinalPrivsToDelete,         // privileges
            FinalRestrictedSidCount,    // number of restricting SIDs
            FinalSidsToRestrict,        // list of restricting SIDs
            &RestrictedToken            // handle to new token
        ))
    {
        Status = STATUS_UNSUCCESSFUL;
        goto ExitHandler;
    }


    //
    // If the caller requested SAFER_TOKEN_NULL_IF_EQUAL
    // then do the evaluation now.
    // Notice that NtCompareTokens intentionally does not
    // consider possible differences in the SandboxInert
    // flag, so we have to handle that case ourself.
    //
    if ( (dwFlags & SAFER_TOKEN_NULL_IF_EQUAL) != 0 &&
         !InertStateChanged )
    {
        BOOLEAN bResult = FALSE;

        Status = NtCompareTokens(InAccessToken, RestrictedToken, &bResult);
        if (!NT_SUCCESS(Status)) {
            // An error occurred during the comparison.
            goto ExitHandler;
        }
        if (bResult) {
            // The output token was not made any more restrictive during
            // this operation, so pass back NULL and return success.
            *OutAccessToken = NULL;
            Status = STATUS_SUCCESS;
            goto ExitHandler;
        }
    }



    //
    // Build the "Restricted Code" SID.
    //
    Status = RtlAllocateAndInitializeSid( &SIDAuth, 1,
        SECURITY_RESTRICTED_CODE_RID, 0, 0, 0, 0, 0, 0, 0,
        &restrictedSid);
    if (! NT_SUCCESS(Status) ) goto ExitHandler;


    //
    // Build the "Principal Self" SID.
    //
    Status = RtlAllocateAndInitializeSid( &SIDAuth, 1,
        SECURITY_PRINCIPAL_SELF_RID, 0, 0, 0, 0, 0, 0, 0,
        &principalSelfSid);
    if (! NT_SUCCESS(Status) ) goto ExitHandler;


    //
    // Duplicate the token into a primary token and simultaneously
    // update the owner to the user's personal SID, instead of the
    // user of the current thread token.
    //
    {
        OBJECT_ATTRIBUTES ObjA;
        HANDLE NewTokenHandle;

        //
        // Initialize a SECURITY_ATTRIBUTES and SECURITY_DESCRIPTOR
        // to force the owner to the personal user SID.
        //
        Status = RtlCreateSecurityDescriptor(
                &sd, SECURITY_DESCRIPTOR_REVISION);
        if (!NT_SUCCESS(Status)) {
            goto ExitHandler;
        }
        Status = RtlSetOwnerSecurityDescriptor(
                &sd, pTokenUser->User.Sid, FALSE);
        if (!NT_SUCCESS(Status)) {
            goto ExitHandler;
        }

        //
        // Only a primary token can be assigned to a process, so
        // we must duplicate the restricted token so we can ensure
        // the we can assign it to the new process.
        //
        SecurityQualityOfService.Length = sizeof( SECURITY_QUALITY_OF_SERVICE  );
        SecurityQualityOfService.ImpersonationLevel = SecurityAnonymous;
        SecurityQualityOfService.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
        SecurityQualityOfService.EffectiveOnly = FALSE;
        InitializeObjectAttributes(
                &ObjA,
                NULL,
                OBJ_INHERIT,
                NULL,
                &sd
                );
        ObjA.SecurityQualityOfService = &SecurityQualityOfService;
        Status = NtDuplicateToken(
                RestrictedToken,   // handle to token to duplicate
                TOKEN_ALL_ACCESS,  // access rights of new token
                &ObjA,             // attributes
                FALSE,
                TokenPrimary,      // primary or impersonation token
                &NewTokenHandle    // handle to duplicated token
                );
        if (Status == STATUS_INVALID_OWNER) {
            // If we failed once, then it might be because the new owner
            // that was specified in the Security Descriptor could not
            // be set, so retry but without the SD specified.
            ObjA.SecurityDescriptor = NULL;
            Status = NtDuplicateToken(
                    RestrictedToken,   // handle to token to duplicate
                    TOKEN_ALL_ACCESS,  // access rights of new token
                    &ObjA,             // attributes
                    FALSE,
                    TokenPrimary,      // primary or impersonation token
                    &NewTokenHandle    // handle to duplicated token
                    );
        }
        if (!NT_SUCCESS(Status)) {
            goto ExitHandler;
        }
        ASSERT(NewTokenHandle != NULL);
        NtClose(RestrictedToken);
        RestrictedToken = NewTokenHandle;
    }


    //
    // Modify permissions on the token.  This involves:
    //    1) edit the DACL on the token to explicitly grant the special
    //       permissions to the User SID and to the Restricted SID.
    //    2) optionally change owner to specified SID.
    //
    {
        PSID defaultOwner = ( (pLevelRecord->DefaultOwner != NULL &&
                    RtlEqualSid(pLevelRecord->DefaultOwner, principalSelfSid)) ?
                        pTokenUser->User.Sid : pLevelRecord->DefaultOwner);

        Status = CodeAuthzpModifyTokenPermissions(
                RestrictedToken,           // token to modify.
                pTokenUser->User.Sid,      // explicitly named SID to add to the DACL.
                GENERIC_ALL,
                (pLevelRecord->dwLevelId < SAFER_LEVELID_NORMALUSER ?
                        restrictedSid : NULL),             // optional secondary named SID to add to the DACL
                GENERIC_ALL
                );

        if (NT_SUCCESS(Status) && defaultOwner != NULL) {
            Status = CodeAuthzpModifyTokenOwner(
                    RestrictedToken,
                    defaultOwner);
        }
        if (!NT_SUCCESS(Status)) {
            NtClose(RestrictedToken);
            goto ExitHandler;
        }
    }


    //
    // Return the result.
    //
    ASSERT(OutAccessToken != NULL);
    *OutAccessToken = RestrictedToken;
    RestrictedToken = NULL;
    Status = STATUS_SUCCESS;


    //
    // Cleanup and epilogue code.
    //
ExitHandler:
    if (RestrictedToken != NULL)
        NtClose(RestrictedToken);
    if (pTokenUser != NULL)
        RtlFreeHeap(RtlProcessHeap(), 0, pTokenUser);
    if (restrictedSid != NULL)
        RtlFreeSid(restrictedSid);
    if (principalSelfSid != NULL)
        RtlFreeSid(principalSelfSid);
    if (FreeFinalDisabledSids)
        RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) FinalSidsToDisable);
    if (FreeFinalRestrictedSids)
        RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) FinalSidsToRestrict);
    if (FreeFinalPrivsToDelete)
        RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) FinalPrivsToDelete);

    //
    // If the caller specified SAFER_TOKEN_WANT_SAFERFLAGS then we
    // need to copy the JobFlags value into the lpReserved parameter.
    //
    if ( Status == STATUS_SUCCESS &&
        (dwFlags & SAFER_TOKEN_WANT_FLAGS) != 0 )
    {
        if (ARGUMENT_PRESENT(lpReserved)) {
            *((LPDWORD)lpReserved) = SaferFlags;
        }
    }

    //
    // Close the process token if it wasn't supplied and we opened it.
    //
    if (!InAccessTokenWasSupplied && InAccessToken != NULL)
        NtClose(InAccessToken);

    return Status;
}


NTSTATUS NTAPI
__CodeAuthzpCompareCodeAuthzLevelWithToken(
    IN PAUTHZLEVELTABLERECORD   pLevelRecord,
    IN HANDLE                   InAccessToken     OPTIONAL,
    IN LPDWORD                  lpResultWord
    )
/*++

Routine Description:

    Performs a "light-weight" evaluation of the token manipulations that
    would be performed if the InAccessToken were restricted with the
    specified WinSafer Level.  The return code indicates if any
    modifications would actually be done to the token (ie: a distinctly
    less-privileged token would be created).

    This function is intended to be used to decide if a DLL (with the
    specified WinSafer Level) is authorized enough to be loaded into
    the specified process context handle, but without actually having
    to create a restricted token since a separate token won't actually
    be needed.

Arguments:

    pLevelRecord - the record structure of the Level to evaluate.

    InAccessToken - optionally the access token to use as a parent token.
            If this argument is not supplied, then the current process
            token will be opened and used.

    lpResultWord - receives the result of the evaluation when function
            is successful (value is left indeterminate if not successful).
            This result will be value 1 if the level is equal or more
            privileged than the InAccessToken, or value -1 if the level
            is less privileged (more restrictions necessary).


Return Value:

    Returns STATUS_SUCCESS on successful evaluation, otherwise returns
    the error status code.  When successful, lpResultWord receives
    the result of the evaluation.

--*/
{
    SID_IDENTIFIER_AUTHORITY SIDAuth = SECURITY_NT_AUTHORITY;
    NTSTATUS Status;
    BOOLEAN TokenWasSupplied = FALSE;
    DWORD Index;

    PTOKEN_USER pTokenUser = NULL;
    PSID principalSelfSid = NULL;
    PTOKEN_PRIVILEGES pTokenPrivs = NULL;
    PTOKEN_GROUPS pTokenGroups = NULL;
    PTOKEN_GROUPS pTokenRestrictedSids = NULL;

    DWORD FinalDisabledSidCount;
    PSID_AND_ATTRIBUTES FinalSidsToDisable;
    BOOLEAN FreeFinalDisabledSids = FALSE;
    DWORD FinalRestrictedSidCount;
    PSID_AND_ATTRIBUTES FinalSidsToRestrict;
    BOOLEAN FreeFinalRestrictedSids = FALSE;
    DWORD FinalPrivsToDeleteCount;
    PLUID_AND_ATTRIBUTES FinalPrivsToDelete;
    BOOLEAN FreeFinalPrivsToDelete = FALSE;
    

    //
    // Ensure that we have a place to write the result.
    //
    if (!ARGUMENT_PRESENT(pLevelRecord)) {
        Status = STATUS_INVALID_PARAMETER_1;
        goto ExitHandler;
    }
    if (!ARGUMENT_PRESENT(lpResultWord)) {
        Status = STATUS_ACCESS_VIOLATION;
        goto ExitHandler;
    }

    //
    // Ensure that we have the token that will be
    // used for the comparison test.
    //
    if (ARGUMENT_PRESENT(InAccessToken)) {
        TokenWasSupplied = TRUE;
    } else {
        Status = NtOpenThreadToken(NtCurrentThread(),
                TOKEN_DUPLICATE | READ_CONTROL | TOKEN_QUERY,
                TRUE, &InAccessToken);
        if (!NT_SUCCESS(Status)) {
            Status = NtOpenProcessToken(NtCurrentProcess(),
                    TOKEN_DUPLICATE | READ_CONTROL | TOKEN_QUERY,
                    &InAccessToken);
            if (!NT_SUCCESS(Status)) {
                goto ExitHandler;       // could not obtain default token
            }
        }
    }


    //
    // If this is not allowed to execute, then break out now and return LESS.
    //
    if (pLevelRecord->DisallowExecution) {
        *lpResultWord = (DWORD) -1;        // Less priv'ed.
        Status = STATUS_SUCCESS;
        goto ExitHandler2;
    }


    //
    // Evaluate the privileges that should be deleted.
    //
    if (pLevelRecord->InvertDeletePrivs != FALSE)
    {
        if (!CodeAuthzpInvertPrivs(
                InAccessToken,
                pLevelRecord->DeletePrivilegeUsedCount,
                pLevelRecord->PrivilegesToDelete,
                &FinalPrivsToDeleteCount,
                &FinalPrivsToDelete))
        {
            Status = STATUS_UNSUCCESSFUL;
            goto ExitHandler2;
        }
        FreeFinalPrivsToDelete = TRUE;

        //
        // If there are any Privileges that need to be deleted, then
        // this object definitely less restricted than the token.
        //
        if (FinalPrivsToDeleteCount != 0)
        {
            *lpResultWord = (DWORD) -1;        // Less priv'ed.
            Status = STATUS_SUCCESS;
            goto ExitHandler3;
        }
    }
    else
    {
        //
        // Get the list of privileges held by the token.
        //
        pTokenPrivs = (PTOKEN_PRIVILEGES) CodeAuthzpGetTokenInformation(
                InAccessToken, TokenPrivileges);
        if (!pTokenPrivs) {
            Status = STATUS_UNSUCCESSFUL;
            goto ExitHandler2;
        }


        //
        // if PrivsToRemove includes a Privilege not yet disabled,
        // then return LESS.
        //
        for (Index = 0; Index < pLevelRecord->DeletePrivilegeUsedCount; Index++)
        {
            DWORD InnerLoop;
            PLUID pLuid = &pLevelRecord->PrivilegesToDelete[Index].Luid;

            for (InnerLoop = 0; InnerLoop < pTokenPrivs->PrivilegeCount; InnerLoop++)
            {
                if ( RtlEqualMemory(&pTokenPrivs->Privileges[InnerLoop].Luid,
                        pLuid, sizeof(LUID)) )
                {
                    *lpResultWord = (DWORD) -1;        // Less priv'ed.
                    Status = STATUS_SUCCESS;
                    goto ExitHandler3;
                }
            }
        }
    }



    //
    // Retrieve the User's personal SID.
    // (user's SID is accessible afterwards with "pTokenUser->User.Sid")
    //
    pTokenUser = (PTOKEN_USER) CodeAuthzpGetTokenInformation(
            InAccessToken, TokenUser);
    if (pTokenUser == NULL) {
        Status = STATUS_UNSUCCESSFUL;
        goto ExitHandler3;
    }


    //
    // Process SidsToDisable inversion.
    //
    if (pLevelRecord->InvertDisableSids != FALSE)
    {
        if (!CodeAuthzpInvertAndAddSids(
                InAccessToken,
                pTokenUser->User.Sid,
                pLevelRecord->DisableSidUsedCount,
                pLevelRecord->SidsToDisable,
                0,
                NULL,
                &FinalDisabledSidCount,
                &FinalSidsToDisable))
        {
            Status = STATUS_UNSUCCESSFUL;
            goto ExitHandler3;
        }
        FreeFinalDisabledSids = TRUE;
    }
    else
    {
        if (pLevelRecord->DisableSidUsedCount == 0 ||
            pLevelRecord->SidsToDisable == NULL)
        {
            FinalSidsToDisable = NULL;
            FinalDisabledSidCount = 0;
            FreeFinalDisabledSids = FALSE;
        } else {
            if (!CodeAuthzpExpandWildcardList(
                InAccessToken,
                pTokenUser->User.Sid,
                pLevelRecord->DisableSidUsedCount,
                pLevelRecord->SidsToDisable,
                &FinalDisabledSidCount,
                &FinalSidsToDisable))
            {
                Status = STATUS_UNSUCCESSFUL;
                goto ExitHandler3;
            }
            FreeFinalDisabledSids = TRUE;
        }
    }



    //
    // Get the list of group membership from the token.
    //
    pTokenGroups = (PTOKEN_GROUPS) CodeAuthzpGetTokenInformation(
            InAccessToken, TokenGroups);
    if (!pTokenGroups) {
        Status = STATUS_UNSUCCESSFUL;
        goto ExitHandler3;
    }



    //
    // Build the "Principal Self" SID.
    //
    Status = RtlAllocateAndInitializeSid( &SIDAuth, 1,
        SECURITY_PRINCIPAL_SELF_RID, 0, 0, 0, 0, 0, 0, 0,
        &principalSelfSid);
    if (! NT_SUCCESS(Status) ) {
        goto ExitHandler3;
    }


    //
    // if SidsToDisable includes a SID in Groups that is not
    // yet disabled, then return LESS.
    //
    for (Index = 0; Index < FinalDisabledSidCount; Index++)
    {
        if (CodeAuthzpSidInSidAndAttributes (
                pTokenGroups->Groups,
                pTokenGroups->GroupCount,
                principalSelfSid,
                pTokenUser->User.Sid,
                FinalSidsToDisable[Index].Sid,
                TRUE))                  // check only SIDs that are still enabled
        {
            Status = STATUS_SUCCESS;
            *lpResultWord = (DWORD) -1;        // Less priv'ed.
            goto ExitHandler3;
        }
    }


    //
    // Process RestrictingSids inversion.
    //
    if (pLevelRecord->RestrictedSidsInvUsedCount != 0)
    {
        if (!CodeAuthzpInvertAndAddSids(
                InAccessToken,
                pTokenUser->User.Sid,
                pLevelRecord->RestrictedSidsInvUsedCount,
                pLevelRecord->RestrictedSidsInv,
                pLevelRecord->RestrictedSidsAddedUsedCount,
                pLevelRecord->RestrictedSidsAdded,
                &FinalRestrictedSidCount,
                &FinalSidsToRestrict))
        {
            Status = STATUS_UNSUCCESSFUL;
            goto ExitHandler3;
        }
        FreeFinalRestrictedSids = TRUE;
    }
    else
    {
        FinalRestrictedSidCount = pLevelRecord->RestrictedSidsAddedUsedCount;
        FinalSidsToRestrict = pLevelRecord->RestrictedSidsAdded;
    }


    //
    // Get the existing Restricted SIDs from the token.
    //
    pTokenRestrictedSids = (PTOKEN_GROUPS) CodeAuthzpGetTokenInformation(
            InAccessToken, TokenRestrictedSids);
    if (!pTokenRestrictedSids) {
        Status = STATUS_UNSUCCESSFUL;
        goto ExitHandler3;
    }


    if (pTokenRestrictedSids->GroupCount != 0)
    {
        //
        // If there are currently no Restricting SIDs and we
        // have to add any, then return LESS.
        //
        if (pTokenRestrictedSids->GroupCount == 0 &&
            FinalRestrictedSidCount != 0)
        {
            *lpResultWord = (DWORD) -1;        // Less priv'ed.
            Status = STATUS_SUCCESS;
            goto ExitHandler3;
        }


        //
        // If the token already includes a Restricting SID that is
        // not in RestrictedSidsAdded then return LESS.
        //
        for (Index = 0; Index < pTokenRestrictedSids->GroupCount; Index++)
        {
            if (!CodeAuthzpSidInSidAndAttributes (
                FinalSidsToRestrict,
                FinalRestrictedSidCount,
                principalSelfSid,
                pTokenUser->User.Sid,
                pTokenRestrictedSids->Groups[Index].Sid,
                FALSE))                     // check all SIDs in the list
            {
                *lpResultWord = (DWORD) -1;        // Less priv'ed.
                Status = STATUS_SUCCESS;
                goto ExitHandler3;
            }
        }
    }
    else
    {
        //
        // if RestrictedSidsAdded then return LESS.
        //
        if (FinalRestrictedSidCount != 0)
        {
            *lpResultWord = (DWORD) -1;        // Less priv'ed.
            Status = STATUS_SUCCESS;
            goto ExitHandler3;
        }
    }


    //
    // If we got here, then the Level is equal or greater
    // privileged than the access token and is safe to run.
    // We could conceivably also want to return LESS if the
    // default owner needs to be changed from what it currently is.
    //
    *lpResultWord = +1;
    Status = STATUS_SUCCESS;



    //
    // Cleanup and epilogue code.
    //
ExitHandler3:
    if (principalSelfSid != NULL)
        RtlFreeSid(principalSelfSid);
    if (pTokenRestrictedSids != NULL)
        RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) pTokenRestrictedSids);
    if (pTokenGroups != NULL)
        RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) pTokenGroups);
    if (pTokenPrivs != NULL)
        RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) pTokenPrivs);
    if (pTokenUser != NULL)
        RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) pTokenUser);
    if (FreeFinalDisabledSids)
        RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) FinalSidsToDisable);
    if (FreeFinalRestrictedSids)
        RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) FinalSidsToRestrict);
    if (FreeFinalPrivsToDelete)
        RtlFreeHeap(RtlProcessHeap(), 0, (LPVOID) FinalPrivsToDelete);


ExitHandler2:

ExitHandler:
    if (!TokenWasSupplied && InAccessToken != NULL)
        NtClose(InAccessToken);

    return Status;
}



BOOL WINAPI
SaferComputeTokenFromLevel(
        IN SAFER_LEVEL_HANDLE      hLevelObject,
        IN HANDLE           InAccessToken         OPTIONAL,
        OUT PHANDLE         OutAccessToken,
        IN DWORD            dwFlags,
        IN LPVOID           lpReserved
        )
/*++

Routine Description:

    Uses the specified WinSafer Level handle to apply various
    restrictions or modifications to the specified InAccessToken
    to produce a Restricted Token that can be used to execute
    processes with.

Arguments:

    hLevelObject - the WinSafer Level handle that specifies the
        restrictions that should be applied.

    InAccessToken - Optionally specifies the input Token that will be
        modified with restrictions.  If this argument is NULL, then the
        Token for the currently executing process will be opened and used.

    OutAccessToken - Specifies the memory region to receive the resulting
        Restricted Token.

    dwFlags - Specifies additional flags that can be used to control the
        restricted token creation.

    lpReserved - reserved for future use, must be zero.

Return Value:

    A value of TRUE indicates that the operation was successful,
    FALSE otherwise.

--*/
{
    NTSTATUS Status;
    PAUTHZLEVELHANDLESTRUCT pLevelStruct;
    PAUTHZLEVELTABLERECORD pLevelRecord;
    
    OBJECT_ATTRIBUTES ObjAttr = {0};
    SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService = {0};
    SECURITY_DESCRIPTOR sd;
    PTOKEN_USER pTokenUser = NULL;


    //
    // Verify our input arguments are minimally okay.
    //
    if (!g_bInitializedFirstTime) {
        Status = STATUS_UNSUCCESSFUL;
        goto ExitHandler;
    }
    if (!ARGUMENT_PRESENT(hLevelObject)) {
        Status = STATUS_INVALID_HANDLE;
        goto ExitHandler;
    }

    if (IsSaferDisabled()) {
		Status = STATUS_SUCCESS;
        if ( (dwFlags & SAFER_TOKEN_NULL_IF_EQUAL) != 0) {
            // The output token was not made any more restrictive during
            // this operation, so pass back NULL and return success.
            *OutAccessToken = NULL;
            Status = STATUS_SUCCESS;
        } else {
            
            //
            // Retrieve the User's personal SID.
            // (user's SID is accessible afterwards with "pTokenUser->User.Sid")
            //
            
            pTokenUser = (PTOKEN_USER) CodeAuthzpGetTokenInformation(
                                           InAccessToken, 
                                           TokenUser
                                           );
            
            if (pTokenUser == NULL) {
                Status = STATUS_UNSUCCESSFUL;
                goto ExitHandler;
            }

            SecurityQualityOfService.Length = sizeof( SECURITY_QUALITY_OF_SERVICE  );
            SecurityQualityOfService.ImpersonationLevel = SecurityAnonymous;
            SecurityQualityOfService.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
            SecurityQualityOfService.EffectiveOnly = FALSE;

            Status = RtlCreateSecurityDescriptor(
                        &sd, 
                        SECURITY_DESCRIPTOR_REVISION
                        );

            if (!NT_SUCCESS(Status)) {
                goto ExitHandler;
            }
            Status = RtlSetOwnerSecurityDescriptor(
                         &sd, 
                         pTokenUser->User.Sid, 
                         FALSE
                         );

            if (!NT_SUCCESS(Status)) {
                goto ExitHandler;
            }

            InitializeObjectAttributes(
                    &ObjAttr,
                    NULL,
                    OBJ_INHERIT,
                    NULL,
                    &sd
                    );

            ObjAttr.SecurityQualityOfService = &SecurityQualityOfService;

            Status = NtDuplicateToken(
                         InAccessToken,
                         TOKEN_ALL_ACCESS,
                         &ObjAttr,
                         FALSE,
                         TokenPrimary,
                         OutAccessToken
                         );

        }
        goto ExitHandler;
	} 

    //
    // Obtain the pointer to the level handle structure.
    //
    RtlEnterCriticalSection(&g_TableCritSec);

    Status = CodeAuthzHandleToLevelStruct(hLevelObject, &pLevelStruct);
    if (!NT_SUCCESS(Status)) {
        goto ExitHandler2;
    }
    ASSERT(pLevelStruct != NULL);
    pLevelRecord = CodeAuthzLevelObjpLookupByLevelId(
                &g_CodeLevelObjTable, pLevelStruct->dwLevelId);
    if (!pLevelRecord) {
        Status = STATUS_INVALID_HANDLE;
        goto ExitHandler2;
    }


	// 
	// Perform the actual computation or comparison operation.
    //
    if ((dwFlags & SAFER_TOKEN_COMPARE_ONLY) != 0) {
        ULONG bIsInert = 0;
        ULONG ulReturnLength=0;

        //
        // check if token is inert - if so, this object is definitely not more restrictive 
        //


        Status = NtQueryInformationToken(
                    InAccessToken,
                    TokenSandBoxInert,
                    &bIsInert,
                    sizeof(bIsInert),
                    &ulReturnLength);

        if (NT_SUCCESS(Status)) {
            if ( bIsInert ) {
                *(LPDWORD)lpReserved = +1;
                goto ExitHandler2;
            } else {
                Status = __CodeAuthzpCompareCodeAuthzLevelWithToken(
                                pLevelRecord,
                                InAccessToken,
                                (LPDWORD) lpReserved);
            }
        }
        else {
            Status = STATUS_UNSUCCESSFUL;
            goto ExitHandler2;
        }

    }
    else {
        Status = __CodeAuthzpComputeAccessTokenFromCodeAuthzObject (
                        pLevelRecord,
                        InAccessToken,
                        OutAccessToken,
                        dwFlags,
                        lpReserved,
                        pLevelStruct->dwSaferFlags);
    }


    //
    // Cleanup and return code handling.
    //
ExitHandler2:
    RtlLeaveCriticalSection(&g_TableCritSec);

ExitHandler:
    if (pTokenUser) {
        LocalFree(pTokenUser);
    }
    if (Status == -1) {
        SetLastError(ERROR_ACCESS_DISABLED_BY_POLICY);
        return FALSE;
    }
    if (!NT_SUCCESS(Status)) {
        BaseSetLastNTError(Status);
        return FALSE;
    }
    return TRUE;
}


BOOL WINAPI
IsTokenUntrusted(
        IN HANDLE   hToken
        )
/*++

Routine Description:

    Indicate if the token does is not able to access a DACL against the
    Token User SID.  This is typically the case in these situations:
      - the User SID is disabled (for deny-use only)
      - there are Restricting SIDs and the User SID is not one of them.

    The passed token handle must have been opened for TOKEN_QUERY and
    TOKEN_DUPLICATE access or else the evaluation will fail.

Arguments:

    hToken - Specifies the input Token that will be analyzed.

Return Value:

    Returns TRUE if the token is "untrusted", or FALSE if the token
    represents a "trusted" token.

    If an error occurs during the evaluation of this check, the result
    returned will be TRUE (assumed untrusted).

--*/
{
    BOOL fTrusted = FALSE;
    DWORD dwStatus;
    DWORD dwACLSize;
    DWORD cbps = sizeof(PRIVILEGE_SET);
    PACL pACL = NULL;
    DWORD dwUserSidSize;
    PTOKEN_USER psidUser = NULL;
    PSECURITY_DESCRIPTOR psdUser = NULL;
    PRIVILEGE_SET ps;
    GENERIC_MAPPING gm;
    HANDLE hImpToken;

    const int TESTPERM_READ = 1;
    const int TESTPERM_WRITE = 2;


    // Prepare some memory
    ZeroMemory(&ps, sizeof(ps));
    ZeroMemory(&gm, sizeof(gm));

    // Get the User's SID.
    if (!GetTokenInformation(hToken, TokenUser, NULL, 0, &dwUserSidSize))
    {
        psidUser = (PTOKEN_USER) LocalAlloc(LPTR, dwUserSidSize);
        if (psidUser != NULL)
        {
            if (GetTokenInformation(hToken, TokenUser, psidUser, dwUserSidSize, &dwUserSidSize))
            {
                // Create the Security Descriptor (SD)
                psdUser = LocalAlloc(LPTR,SECURITY_DESCRIPTOR_MIN_LENGTH);
                if (psdUser != NULL)
                {
                    if(InitializeSecurityDescriptor(psdUser,SECURITY_DESCRIPTOR_REVISION))
                    {
                        // Compute size needed for the ACL then allocate the
                        // memory for it
                        dwACLSize = sizeof(ACCESS_ALLOWED_ACE) + 8 +
                                    GetLengthSid(psidUser->User.Sid) - sizeof(DWORD);
                        pACL = (PACL)LocalAlloc(LPTR, dwACLSize);
                        if (pACL != NULL)
                        {
                            // Initialize the new ACL
                            if(InitializeAcl(pACL, dwACLSize, ACL_REVISION2))
                            {
                                // Add the access-allowed ACE to the DACL
                                if(AddAccessAllowedAce(pACL,ACL_REVISION2,
                                                     (TESTPERM_READ | TESTPERM_WRITE),psidUser->User.Sid))
                                {
                                    // Set our DACL to the Administrator's SD
                                    if (SetSecurityDescriptorDacl(psdUser, TRUE, pACL, FALSE))
                                    {
                                        // AccessCheck is downright picky about what is in the SD,
                                        // so set the group and owner
                                        SetSecurityDescriptorGroup(psdUser,psidUser->User.Sid,FALSE);
                                        SetSecurityDescriptorOwner(psdUser,psidUser->User.Sid,FALSE);

                                        // Initialize GenericMapping structure even though we
                                        // won't be using generic rights
                                        gm.GenericRead = TESTPERM_READ;
                                        gm.GenericWrite = TESTPERM_WRITE;
                                        gm.GenericExecute = 0;
                                        gm.GenericAll = TESTPERM_READ | TESTPERM_WRITE;

                                        if (ImpersonateLoggedOnUser(hToken) &&
                                            OpenThreadToken(GetCurrentThread(),
                                                    TOKEN_QUERY, FALSE, &hImpToken))
                                        {

                                            if (!AccessCheck(psdUser, hImpToken, TESTPERM_READ, &gm,
                                                            &ps,&cbps,&dwStatus,&fTrusted))
                                                    fTrusted = FALSE;

                                            CloseHandle(hImpToken);
                                        }
                                    }
                                }
                            }
                            LocalFree(pACL);
                        }
                    }
                    LocalFree(psdUser);
                }
            }
            LocalFree(psidUser);
        }
    }
    RevertToSelf();
    return(!fTrusted);
}



BOOL WINAPI
SaferiCompareTokenLevels (
        IN HANDLE   ClientAccessToken,
        IN HANDLE   ServerAccessToken,
        OUT PDWORD  pdwResult
        )
/*++

Routine Description:

    Private function provided to try to empiracally determine if
    the two access token have been restricted with comparable
    WinSafer authorization Levels.

Arguments:

    ClientAccessToken - handle to the Access Token of the "client"

    ServerAccessToken - handle to the Access Token of the "server"

    pdwResult - When TRUE is returned, the pdwResult output parameter
        will receive any of the following values:
        -1 = Client's access token is more authorized than Server's.
         0 = Client's access token is comparable level to Server's.
         1 = Server's access token is more authorized than Clients's.

Return Value:

    A value of TRUE indicates that the operation was successful,
    FALSE otherwise.

--*/
{
    NTSTATUS Status;
    LPVOID RestartKey;
    PAUTHZLEVELTABLERECORD authzobj;
    DWORD dwCompareResult;


    //
    // Verify our input arguments are minimally okay.
    //
    if (!ARGUMENT_PRESENT(ClientAccessToken) ||
        !ARGUMENT_PRESENT(ServerAccessToken)) {
        Status = STATUS_INVALID_HANDLE;
        goto ExitHandler;
    }
    if (!ARGUMENT_PRESENT(pdwResult)) {
        Status = STATUS_ACCESS_VIOLATION;
        goto ExitHandler;
    }


    //
    // Gain the critical section lock and load the tables as needed.
    //
    if (!g_bInitializedFirstTime) {
        Status = STATUS_UNSUCCESSFUL;
        goto ExitHandler;
    }
    RtlEnterCriticalSection(&g_TableCritSec);
    if (g_bNeedCacheReload) {
        Status = CodeAuthzpImmediateReloadCacheTables();
        if (!NT_SUCCESS(Status)) {
            goto ExitHandler2;
        }
    }
    if (RtlIsGenericTableEmpty(&g_CodeLevelObjTable)) {
        Status = STATUS_NOT_FOUND;
        goto ExitHandler2;
    }


    //
    // Loop through the Authorization Levels and see where we
    // find the first difference in access rights.
    //
    dwCompareResult = 0;
    RestartKey = NULL;
    for (authzobj = (PAUTHZLEVELTABLERECORD)
                RtlEnumerateGenericTableWithoutSplaying(
                    &g_CodeLevelObjTable, &RestartKey);
        authzobj != NULL;
        authzobj = (PAUTHZLEVELTABLERECORD)
                RtlEnumerateGenericTableWithoutSplaying(
                    &g_CodeLevelObjTable, &RestartKey))
    {
        DWORD dwClientResult, dwServerResult;

        Status = __CodeAuthzpCompareCodeAuthzLevelWithToken(
                authzobj,
                ClientAccessToken,
                &dwClientResult);
        if (!NT_SUCCESS(Status)) {
            goto ExitHandler2;
        }

        Status = __CodeAuthzpCompareCodeAuthzLevelWithToken(
                authzobj,
                ServerAccessToken,
                &dwServerResult);
        if (!NT_SUCCESS(Status)) {
            goto ExitHandler2;
        }

        if (dwClientResult == (DWORD) -1 && dwServerResult != (DWORD) -1) {
            dwCompareResult = (DWORD) -1;
            break;
        } else if (dwClientResult != (DWORD) -1 && dwServerResult == (DWORD) -1) {
            dwCompareResult = 1;
            break;
        } else if (dwClientResult != (DWORD) -1 && dwServerResult != (DWORD) -1) {
            dwCompareResult = 0;
            break;
        }
    }
    Status = STATUS_SUCCESS;
    *pdwResult = dwCompareResult;


    //
    // Cleanup and return code handling.
    //
ExitHandler2:
    RtlLeaveCriticalSection(&g_TableCritSec);

ExitHandler:
    if (!NT_SUCCESS(Status)) {
        BaseSetLastNTError(Status);
        return FALSE;
    }
    return TRUE;
}