/*++

Copyright (c) 1999, 2000  Microsoft Corporation

Module Name:

    vs_sec.hxx

Abstract:

    Declaration of IsAdministrator


    Adi Oltean  [aoltean]  10/05/1999

Revision History:

    Name        Date        Comments
    aoltean     09/27/1999  Created
    aoltean     10/05/1999  Moved into security.hxx from admin.hxx
    aoltean     12/16/1999  Moved into vs_sec.hxx
    brianb      04/27/2000  Added IsRestoreOperator, TurnOnSecurityPrivilegeRestore, TurnOnSecurityPrivilegeBackup
    brianb      05/03/2000  Added GetClientTokenOwner method

--*/

#ifndef __VSS_SECURITY_HXX__
#define __VSS_SECURITY_HXX__

#if _MSC_VER > 1000
#pragma once
#endif

////////////////////////////////////////////////////////////////////////
//  Standard foo for file name aliasing.  This code block must be after
//  all includes of VSS header files.
//
#ifdef VSS_FILE_ALIAS
#undef VSS_FILE_ALIAS
#endif
#define VSS_FILE_ALIAS "INCSECH"
//
////////////////////////////////////////////////////////////////////////



/////////////////////////////////////////////////////////////////////////////
// global methods



// is caller member of administrators group
bool IsAdministrator() throw (HRESULT);

// is caller member of administrators group or has SE_BACKUP_NAME privilege
// enabled
bool IsBackupOperator() throw(HRESULT);

// is caller member of administrators group or has SE_RESTORE_NAME privilege
// enabled
bool IsRestoreOperator() throw(HRESULT);

// enable SE_BACKUP_NAME privilege
HRESULT TurnOnSecurityPrivilegeBackup();

// enable SE_RESTORE_NAME privilege
HRESULT TurnOnSecurityPrivilegeRestore();

// determine if process has ADMIN privileges
bool IsProcessAdministrator() throw(HRESULT);

// determine if process has backup privilege enabled
bool IsProcessBackupOperator() throw(HRESULT);

// determine if the process has the restore privilege enabeled
bool IsProcessRestoreOperator() throw(HRESULT);


// get SID of calling client process
TOKEN_OWNER *GetClientTokenOwner(BOOL bImpersonate) throw(HRESULT);

// get SID of the user running the client process
TOKEN_USER *GetClientTokenUser(BOOL bImpersonate) throw(HRESULT);


// auto sid class,  destroys sid when going out of scope
class CAutoSid : public CVssAuto<SID*, CVssAutoGenericValue_Storage<SID*, NULL, LocalFreeType, ::LocalFree> >
    {
    typedef CVssAuto<SID*, CVssAutoGenericValue_Storage<SID*, NULL, LocalFreeType, ::LocalFree> > Base;
public:
    CAutoSid() 
        {
        }

    // create a sid base on a well known sid type
    void CreateBasicSid(WELL_KNOWN_SID_TYPE type);

    // create a sid from a string
    void CreateFromString(LPCWSTR wsz);
    };


//////////////////////////////////////////////////////////////////////////////
// CVssSecurityDescriptor

class CVssSecurityDescriptor
{
public:
        CVssSecurityDescriptor();
        ~CVssSecurityDescriptor();

public:
        HRESULT Attach(PSECURITY_DESCRIPTOR pSelfRelativeSD);
        HRESULT AttachObject(HANDLE hObject);
        HRESULT Initialize();
        HRESULT InitializeFromProcessToken(BOOL bDefaulted = FALSE);
        HRESULT InitializeFromThreadToken(BOOL bDefaulted = FALSE, BOOL bRevertToProcessToken = TRUE);
        HRESULT SetOwner(PSID pOwnerSid, BOOL bDefaulted = FALSE);
        HRESULT SetGroup(PSID pGroupSid, BOOL bDefaulted = FALSE);
        HRESULT Allow(LPCTSTR pszPrincipal, DWORD dwAccessMask, DWORD dwAceFlags = 0);
        HRESULT Deny(LPCTSTR pszPrincipal, DWORD dwAccessMask, DWORD dwAceFlags = 0);
        HRESULT Allow(PSID pSid, DWORD dwAccessMask, DWORD dwAceFlags = 0);
        HRESULT Deny(PSID pSid, DWORD dwAccessMask, DWORD dwAceFlags = 0);
        HRESULT Revoke(LPCTSTR pszPrincipal);

        // utility functions
        // Any PSID you get from these functions should be free()ed
        static HRESULT SetPrivilege(LPCTSTR Privilege, BOOL bEnable = TRUE, HANDLE hToken = NULL);
        static HRESULT GetTokenSids(HANDLE hToken, PSID* ppUserSid, PSID* ppGroupSid);
        static HRESULT GetProcessSids(PSID* ppUserSid, PSID* ppGroupSid = NULL);
        static HRESULT GetThreadSids(PSID* ppUserSid, PSID* ppGroupSid = NULL, BOOL bOpenAsSelf = FALSE);
        static HRESULT CopyACL(PACL pDest, PACL pSrc);
        static HRESULT GetCurrentUserSID(PSID *ppSid);
        static HRESULT GetPrincipalSID(LPCTSTR pszPrincipal, PSID *ppSid);
        static HRESULT AddAccessAllowedACEToACL(PACL *Acl, LPCTSTR pszPrincipal, DWORD dwAccessMask, DWORD dwAceFlags);
        static HRESULT AddAccessDeniedACEToACL(PACL *Acl, LPCTSTR pszPrincipal, DWORD dwAccessMask, DWORD dwAceFlags);
        static HRESULT AddAccessAllowedACEToACL(PACL *Acl, PSID principalSID, DWORD dwAccessMask, DWORD dwAceFlags);
        static HRESULT AddAccessDeniedACEToACL(PACL *Acl, PSID principalSID, DWORD dwAccessMask, DWORD dwAceFlags);
        static HRESULT RemovePrincipalFromACL(PACL Acl, LPCTSTR pszPrincipal);

        operator PSECURITY_DESCRIPTOR()
        {
                return m_pSD;
        }

public:
        PSECURITY_DESCRIPTOR m_pSD;
        PSID m_pOwner;
        PSID m_pGroup;
        PACL m_pDACL;
        PACL m_pSACL;
};



//////////////////////////////////////////////////////////////////////////////
// Class - CVssSidCollection
//

class CVssSidCollection
{
// Constructors/destructors
private:
    CVssSidCollection(const CVssSidCollection&);
    CVssSidCollection& operator=(const CVssSidCollection&);
public:
    CVssSidCollection();
    ~CVssSidCollection();

// Accessors
public:
    // Get the total count of stored SIDs
    INT GetSidCount();

    // Get the SID with the given index (starts with 0)
    PSID GetSid(INT nIndex) throw(HRESULT);

    // Get the SID use with the given index
    SID_NAME_USE GetSidUse(INT nIndex) throw(HRESULT);

    // Check if the SID with the given index is allowed
    bool IsSidAllowed(INT nIndex) throw(HRESULT);

    // Check if the SID with the given index is a local user/group
    bool IsLocal(INT nIndex) throw(HRESULT);

    // Get the principal for the SID with the given index
    LPWSTR GetPrincipal(INT nIndex) throw(HRESULT);

    // Get the principal for the SID with the given index
    LPWSTR GetName(INT nIndex) throw(HRESULT);

    // Get the principal for the SID with the given index
    LPWSTR GetDomain(INT nIndex) throw(HRESULT);

    // Determine if the current process can be a writer
    bool IsProcessValidWriter() throw(HRESULT);

    // determine if a SID is allowed to fire
    bool IsSidAllowedToFire(PSID psid) throw(HRESULT);

    // determine if the sid is a member of a well-known group
    bool IsSidRelatedWithLocalSid(
            IN  PSID pSid,
            IN  LPWSTR pwszWellKnownPrincipal,
            IN  PSID pWellKnownSid
            ) throw(HRESULT);

    PSECURITY_DESCRIPTOR GetSecurityDescriptor()  { return m_SD; };

// Operations
public:

    // Initialize SID from registry and add the implicit Admin, BO, System SID
    void Initialize() throw(HRESULT);

// Implementation
private: 

    class CVssSidWrapper
    {
    public:
        CVssSidWrapper(bool bAllow, 
            PSID pSid, 
            SID_NAME_USE use,
            LPWSTR pwszName, 
            LPWSTR pwszDomain,
            bool bIsLocal
        ): 
            m_bAllow(bAllow), m_pSid(pSid), 
            m_use(use), m_pwszName(pwszName), m_pwszDomain(pwszDomain),
            m_bIsLocal(bIsLocal) {};
        bool IsSidAllowed() const { return m_bAllow; };
        PSID GetSid() const { return m_pSid; };
        SID_NAME_USE GetUse() const { return m_use; };
        LPWSTR GetName() const { return m_pwszName; };
        LPWSTR GetDomain() const { return m_pwszDomain; };
        bool IsLocal() const { return m_bIsLocal; };
    private:
        bool m_bAllow;
        PSID m_pSid;
        SID_NAME_USE m_use;
        LPWSTR m_pwszName;
        LPWSTR m_pwszDomain;
        bool m_bIsLocal;
    };

    bool AddUser( 
        IN  LPCWSTR pwszUser,
        IN  bool bAllow
        ) throw(HRESULT);
    
    void AddWellKnownSid( 
        IN  WELL_KNOWN_SID_TYPE type 
        ) throw(HRESULT);

    bool VerifyIsLocal(
        IN  LPCWSTR pwszDomain,
        IN  bool bIsAdministratorsAccount
        );

    // determine if a SID is allowed to fire
    bool CheckIfExplicitelySpecified(
        IN  PSID psid,
        IN  bool bChechAllowed
        ) throw(HRESULT);

    // List of sids
    CVssSimpleMap<LPWSTR, CVssSidWrapper> m_SidArray;

    // Only for assertions
    bool m_bInitialized;

    // Security descriptor
    CVssSecurityDescriptor    m_SD;

    // Name of the "BUILTIN" domain
    //
    // This is filled in when the SYSTEM well-known SID is added
    // (the SYSTEM account must be added first)
    CVssAutoLocalString     m_pwszBuiltinDomain;
};


#endif // __VSS_SECURITY_HXX__