You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2052 lines
64 KiB
2052 lines
64 KiB
/*++
|
|
|
|
Copyright (c) 1991 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
cmse.c
|
|
|
|
Abstract:
|
|
|
|
This module implements security routines for the configuration manager.
|
|
|
|
Author:
|
|
|
|
John Vert (jvert) 20-Jan-1992
|
|
|
|
Revision History:
|
|
|
|
Richard Ward (richardw) 14-Apr-1992 Changed ACE_HEADER
|
|
|
|
--*/
|
|
#include "cmp.h"
|
|
|
|
|
|
//
|
|
// Function prototypes private to this module
|
|
//
|
|
|
|
//
|
|
// Dragos: modified to use the security cache
|
|
//
|
|
BOOLEAN
|
|
CmpFindMatchingDescriptorCell(
|
|
IN PCMHIVE CmHive,
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN ULONG Type,
|
|
OUT PHCELL_INDEX MatchingCell,
|
|
OUT OPTIONAL PCM_KEY_SECURITY_CACHE *CachedSecurityPointer
|
|
);
|
|
|
|
////////////////
|
|
NTSTATUS
|
|
CmpSetSecurityDescriptorInfo(
|
|
IN PCM_KEY_CONTROL_BLOCK kcb,
|
|
IN PSECURITY_INFORMATION SecurityInformation,
|
|
IN PSECURITY_DESCRIPTOR ModificationDescriptor,
|
|
IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
|
|
IN POOL_TYPE PoolType,
|
|
IN PGENERIC_MAPPING GenericMapping
|
|
);
|
|
|
|
NTSTATUS
|
|
CmpQuerySecurityDescriptorInfo(
|
|
IN PCM_KEY_CONTROL_BLOCK kcb,
|
|
IN PSECURITY_INFORMATION SecurityInformation,
|
|
OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN OUT PULONG Length,
|
|
IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor
|
|
);
|
|
|
|
PCM_KEY_SECURITY
|
|
CmpGetKeySecurity(
|
|
IN PHHIVE Hive,
|
|
IN PCM_KEY_NODE Key,
|
|
OUT PHCELL_INDEX SecurityCell OPTIONAL
|
|
);
|
|
|
|
NTSTATUS
|
|
CmpGetObjectSecurity(
|
|
IN HCELL_INDEX Cell,
|
|
IN PHHIVE Hive,
|
|
OUT PCM_KEY_SECURITY *Security,
|
|
OUT PHCELL_INDEX SecurityCell OPTIONAL
|
|
);
|
|
|
|
BOOLEAN
|
|
CmpInsertSecurityCellList(
|
|
IN PHHIVE Hive,
|
|
IN HCELL_INDEX NodeCell,
|
|
IN HCELL_INDEX SecurityCell
|
|
);
|
|
|
|
VOID
|
|
CmpRemoveSecurityCellList(
|
|
IN PHHIVE Hive,
|
|
IN HCELL_INDEX SecurityCell
|
|
);
|
|
|
|
ULONG
|
|
CmpSecurityExceptionFilter(
|
|
IN PEXCEPTION_POINTERS ExceptionPointers
|
|
);
|
|
|
|
//
|
|
// This macro takes a PSECURITY_DESCRIPTOR and returns the size of the
|
|
// hive cell required to contain the entire security descriptor.
|
|
//
|
|
|
|
#define SECURITY_CELL_LENGTH(pDescriptor) \
|
|
FIELD_OFFSET(CM_KEY_SECURITY,Descriptor) + \
|
|
RtlLengthSecurityDescriptor(pDescriptor)
|
|
|
|
#ifdef ALLOC_PRAGMA
|
|
#pragma alloc_text(PAGE,CmpSecurityMethod )
|
|
#pragma alloc_text(PAGE,CmpSetSecurityDescriptorInfo)
|
|
#pragma alloc_text(PAGE,CmpAssignSecurityDescriptor)
|
|
#pragma alloc_text(PAGE,CmpQuerySecurityDescriptorInfo)
|
|
#pragma alloc_text(PAGE,CmpCheckCreateAccess)
|
|
#pragma alloc_text(PAGE,CmpCheckNotifyAccess)
|
|
#pragma alloc_text(PAGE,CmpGetObjectSecurity)
|
|
#pragma alloc_text(PAGE,CmpGetKeySecurity)
|
|
#pragma alloc_text(PAGE,CmpHiveRootSecurityDescriptor)
|
|
#pragma alloc_text(PAGE,CmpFreeSecurityDescriptor)
|
|
#pragma alloc_text(PAGE,CmpInsertSecurityCellList)
|
|
#pragma alloc_text(PAGE,CmpRemoveSecurityCellList)
|
|
#pragma alloc_text(PAGE,CmpSecurityExceptionFilter)
|
|
#endif
|
|
|
|
ULONG
|
|
CmpSecurityExceptionFilter(
|
|
IN PEXCEPTION_POINTERS ExceptionPointers
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Debug code to find registry security exceptions that are being swallowed
|
|
|
|
Return Value:
|
|
|
|
EXCEPTION_EXECUTE_HANDLER
|
|
|
|
--*/
|
|
|
|
{
|
|
#ifndef _CM_LDR_
|
|
DbgPrintEx(DPFLTR_CONFIG_ID,DPFLTR_ERROR_LEVEL,"CM: Registry security exception %lx, ExceptionPointers = %p\n",
|
|
ExceptionPointers->ExceptionRecord->ExceptionCode,
|
|
ExceptionPointers);
|
|
#endif //_CM_LDR_
|
|
|
|
//
|
|
// This is a request from the base test team; no dbg should be hit on the free builds
|
|
// at the client; after RC2 is shipped we should enable this on free builds too.
|
|
//
|
|
#if DBG
|
|
try {
|
|
DbgBreakPoint();
|
|
} except (EXCEPTION_EXECUTE_HANDLER) {
|
|
|
|
//
|
|
// no debugger enabled, just keep going
|
|
//
|
|
|
|
}
|
|
#endif
|
|
|
|
return(EXCEPTION_EXECUTE_HANDLER);
|
|
}
|
|
|
|
NTSTATUS
|
|
CmpSecurityMethod (
|
|
IN PVOID Object,
|
|
IN SECURITY_OPERATION_CODE OperationCode,
|
|
IN PSECURITY_INFORMATION SecurityInformation,
|
|
IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN OUT PULONG CapturedLength,
|
|
IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
|
|
IN POOL_TYPE PoolType,
|
|
IN PGENERIC_MAPPING GenericMapping
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This is the security method for registry objects. It is responsible for
|
|
retrieving, setting, and deleting the security descriptor of a registry
|
|
object. It is not used to assign the original security descriptor to an
|
|
object (use SeAssignSecurity for that purpose).
|
|
|
|
|
|
IT IS ASSUMED THAT THE OBJECT MANAGER HAS ALREADY DONE THE ACCESS
|
|
VALIDATIONS NECESSARY TO ALLOW THE REQUESTED OPERATIONS TO BE PERFORMED.
|
|
|
|
Arguments:
|
|
|
|
Object - Supplies a pointer to the object being used.
|
|
|
|
OperationCode - Indicates if the operation is for setting, querying, or
|
|
deleting the object's security descriptor.
|
|
|
|
SecurityInformation - Indicates which security information is being
|
|
queried or set. This argument is ignored for the delete operation.
|
|
|
|
SecurityDescriptor - The meaning of this parameter depends on the
|
|
OperationCode:
|
|
|
|
QuerySecurityDescriptor - For the query operation this supplies the
|
|
buffer to copy the descriptor into. The security descriptor is
|
|
assumed to have been probed up to the size passed in in Length.
|
|
Since it still points into user space, it must always be
|
|
accessed in a try clause in case it should suddenly disappear.
|
|
|
|
SetSecurityDescriptor - For a set operation this supplies the
|
|
security descriptor to copy into the object. The security
|
|
descriptor must be captured before this routine is called.
|
|
|
|
DeleteSecurityDescriptor - It is ignored when deleting a security
|
|
descriptor.
|
|
|
|
AssignSecurityDescriptor - For assign operations this is the
|
|
security descriptor that will be assigned to the object.
|
|
It is assumed to be in kernel space, and is therefore not
|
|
probed or captured.
|
|
|
|
CapturedLength - For the query operation this specifies the length, in
|
|
bytes, of the security descriptor buffer, and upon return contains
|
|
the number of bytes needed to store the descriptor. If the length
|
|
needed is greater than the length supplied the operation will fail.
|
|
It is ignored in the set and delete operation.
|
|
|
|
This parameter is assumed to be captured and probed as appropriate.
|
|
|
|
ObjectsSecurityDescriptor - For the Set operation this supplies the address
|
|
of a pointer to the object's current security descriptor. This routine
|
|
will either modify the security descriptor in place or deallocate/
|
|
allocate a new security descriptor and use this variable to indicate
|
|
its new location. For the query operation it simply supplies
|
|
the security descriptor being queried.
|
|
|
|
PoolType - For the set operation this specifies the pool type to use if
|
|
a new security descriptor needs to be allocated. It is ignored
|
|
in the query and delete operation.
|
|
|
|
GenericMapping - Passed only for the set operation, this argument provides
|
|
the mapping of generic to specific/standard access types for the object
|
|
being accessed. This mapping structure is expected to be safe to
|
|
access (i.e., captured if necessary) prior to be passed to this routine.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - STATUS_SUCCESS if the operation is successful and an
|
|
appropriate error status otherwise.
|
|
|
|
--*/
|
|
|
|
{
|
|
PCM_KEY_CONTROL_BLOCK kcb;
|
|
NTSTATUS Status = STATUS_UNSUCCESSFUL;
|
|
PCM_KEY_NODE TempNode;
|
|
|
|
//
|
|
// Make sure the common parts of our input are proper
|
|
//
|
|
|
|
PAGED_CODE();
|
|
ASSERT_KEY_OBJECT(Object);
|
|
|
|
ASSERT( (OperationCode == SetSecurityDescriptor) ||
|
|
(OperationCode == QuerySecurityDescriptor) ||
|
|
(OperationCode == AssignSecurityDescriptor) ||
|
|
(OperationCode == DeleteSecurityDescriptor) );
|
|
|
|
//
|
|
// Lock hive for shared or exclusive, depending on what we need
|
|
// to do.
|
|
//
|
|
if (OperationCode == QuerySecurityDescriptor) {
|
|
CmpLockRegistry();
|
|
} else {
|
|
CmpLockRegistryExclusive();
|
|
#ifdef CHECK_REGISTRY_USECOUNT
|
|
CmpCheckRegistryUseCount();
|
|
#endif //CHECK_REGISTRY_USECOUNT
|
|
}
|
|
|
|
if (((PCM_KEY_BODY)Object)->KeyControlBlock->Delete) {
|
|
//
|
|
// Key has been deleted, performing security operations on
|
|
// it is Not Allowed.
|
|
//
|
|
CmpUnlockRegistry();
|
|
return(STATUS_KEY_DELETED);
|
|
}
|
|
|
|
kcb = ((PCM_KEY_BODY)Object)->KeyControlBlock;
|
|
|
|
try {
|
|
|
|
//
|
|
// This routine simply cases off of the operation code to decide
|
|
// which support routine to call
|
|
//
|
|
|
|
switch (OperationCode) {
|
|
|
|
case SetSecurityDescriptor:
|
|
|
|
//
|
|
// check the rest of our input and call the set security
|
|
// method
|
|
//
|
|
ASSERT( (PoolType == PagedPool) || (PoolType == NonPagedPool) );
|
|
|
|
Status = CmpSetSecurityDescriptorInfo( kcb,
|
|
SecurityInformation,
|
|
SecurityDescriptor,
|
|
ObjectsSecurityDescriptor,
|
|
PoolType,
|
|
GenericMapping );
|
|
|
|
//
|
|
// this is the one and only path on which a user could change
|
|
// a security descriptor, therefore, report such changes for
|
|
// notification here.
|
|
//
|
|
if (NT_SUCCESS(Status)) {
|
|
CmpReportNotify(kcb,
|
|
kcb->KeyHive,
|
|
kcb->KeyCell,
|
|
REG_NOTIFY_CHANGE_ATTRIBUTES | REG_NOTIFY_CHANGE_SECURITY);
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case QuerySecurityDescriptor:
|
|
|
|
//
|
|
// check the rest of our input and call the default query security
|
|
// method
|
|
//
|
|
ASSERT( CapturedLength != NULL );
|
|
Status = CmpQuerySecurityDescriptorInfo( kcb,
|
|
SecurityInformation,
|
|
SecurityDescriptor,
|
|
CapturedLength,
|
|
ObjectsSecurityDescriptor );
|
|
break;
|
|
|
|
case DeleteSecurityDescriptor:
|
|
|
|
//
|
|
// Nobody should ever call the delete method. When the key is
|
|
// freed, the security descriptor associated with it is
|
|
// explicitly freed (CmpFreeSecurityDescriptor)
|
|
//
|
|
ASSERT(FALSE);
|
|
|
|
break;
|
|
|
|
case AssignSecurityDescriptor:
|
|
|
|
//
|
|
// Set the SecurityDescriptor field in the object's header to
|
|
// NULL. This indicates that our security method needs to be
|
|
// called for any security descriptor operations.
|
|
//
|
|
|
|
Status = ObAssignObjectSecurityDescriptor(Object, NULL, PagedPool);
|
|
|
|
ASSERT( NT_SUCCESS( Status ));
|
|
|
|
TempNode = (PCM_KEY_NODE)HvGetCell(kcb->KeyHive, kcb->KeyCell);
|
|
if( TempNode == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
Status = STATUS_INSUFFICIENT_RESOURCES;
|
|
// step thru exit
|
|
break;
|
|
}
|
|
|
|
ASSERT_CM_LOCK_OWNED_EXCLUSIVE();
|
|
// release the cell right here as we are holding the reglock exclusive
|
|
HvReleaseCell(kcb->KeyHive, kcb->KeyCell);
|
|
//
|
|
// Assign the actual descriptor.
|
|
//
|
|
Status = CmpAssignSecurityDescriptor( kcb->KeyHive,
|
|
kcb->KeyCell,
|
|
TempNode,
|
|
SecurityDescriptor );
|
|
//
|
|
// Security has been changed, update the cache.
|
|
//
|
|
ASSERT_CM_LOCK_OWNED_EXCLUSIVE();
|
|
CmpAssignSecurityToKcb(kcb,TempNode->Security);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
//
|
|
// Bugcheck on any other operation code, We won't get here if
|
|
// the earlier asserts are still checked.
|
|
//
|
|
CM_BUGCHECK( REGISTRY_ERROR,BAD_SECURITY_METHOD,1,kcb,OperationCode);
|
|
|
|
}
|
|
|
|
} except (CmpSecurityExceptionFilter(GetExceptionInformation())) {
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_EXCEPTION,"!!CmpSecurityMethod: code:%08lx\n", GetExceptionCode()));
|
|
Status = GetExceptionCode();
|
|
}
|
|
|
|
CmpUnlockRegistry();
|
|
return(Status);
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
CmpSetSecurityDescriptorInfo(
|
|
IN PCM_KEY_CONTROL_BLOCK Key,
|
|
IN PSECURITY_INFORMATION SecurityInformation,
|
|
IN PSECURITY_DESCRIPTOR ModificationDescriptor,
|
|
IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
|
|
IN POOL_TYPE PoolType,
|
|
IN PGENERIC_MAPPING GenericMapping
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine will set a node's security descriptor. The input
|
|
security descriptor must be previously captured.
|
|
|
|
Arguments:
|
|
|
|
Key - Supplies a pointer to the KEY_CONTROL_BLOCK for the node whose
|
|
security descriptor will be set.
|
|
|
|
SecurityInformation - Indicates which security information is
|
|
to be applied to the object. The value(s) to be assigned are
|
|
passed in the SecurityDescriptor parameter.
|
|
|
|
ModificationDescriptor - Supplies the input security descriptor to be
|
|
applied to the object. The caller of this routine is expected
|
|
to probe and capture the passed security descriptor before calling
|
|
and release it after calling.
|
|
|
|
ObjectsSecurityDescriptor - Supplies the address of a pointer to
|
|
the objects security descriptor that is going to be altered by
|
|
this procedure
|
|
|
|
PoolType - Specifies the type of pool to allocate for the objects
|
|
security descriptor.
|
|
|
|
GenericMapping - This argument provides the mapping of generic to
|
|
specific/standard access types for the object being accessed.
|
|
This mapping structure is expected to be safe to access
|
|
(i.e., captured if necessary) prior to be passed to this routine.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - STATUS_SUCCESS if successful and an appropriate error
|
|
value otherwise
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
HCELL_INDEX SecurityCell;
|
|
HCELL_INDEX MatchSecurityCell;
|
|
HCELL_INDEX NewCell;
|
|
HCELL_INDEX OldCell;
|
|
PCM_KEY_SECURITY Security;
|
|
PCM_KEY_SECURITY NewSecurity;
|
|
PCM_KEY_SECURITY FlinkSecurity;
|
|
PCM_KEY_SECURITY BlinkSecurity;
|
|
PCM_KEY_NODE Node;
|
|
ULONG DescriptorLength;
|
|
PSECURITY_DESCRIPTOR DescriptorCopy;
|
|
ULONG Type;
|
|
LARGE_INTEGER SystemTime;
|
|
PHHIVE Hive;
|
|
PCM_KEY_SECURITY_CACHE CachedSecurity;
|
|
|
|
PAGED_CODE();
|
|
|
|
UNREFERENCED_PARAMETER (ObjectsSecurityDescriptor);
|
|
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpSetSecurityDescriptorInfo:\n"));
|
|
|
|
ASSERT_CM_LOCK_OWNED_EXCLUSIVE();
|
|
|
|
Node = (PCM_KEY_NODE)HvGetCell(Key->KeyHive, Key->KeyCell);
|
|
if( Node == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell;
|
|
// this shouldn't happen as we are about to modify the cell
|
|
// (i.e. it should be dirty/pinned by this time)
|
|
//
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
// release the cell right here as we are holding the reglock exclusive
|
|
HvReleaseCell(Key->KeyHive, Key->KeyCell);
|
|
|
|
//
|
|
// Map in the hive cell for the security descriptor before we make
|
|
// the call to SeSetSecurityDescriptorInfo. This prevents us from
|
|
// changing its security descriptor and then being unable to bring
|
|
// the hive cell into memory for updating.
|
|
//
|
|
Security = CmpGetKeySecurity(Key->KeyHive,
|
|
Node,
|
|
&SecurityCell);
|
|
if( Security == NULL ) {
|
|
//
|
|
// couldn't map view inside
|
|
//
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
//
|
|
// SeSetSecurityDescriptorInfo takes a pointer to the original
|
|
// descriptor. This pointer is not freed, but a new pointer will
|
|
// be returned.
|
|
//
|
|
DescriptorCopy = &Security->Descriptor;
|
|
Status = SeSetSecurityDescriptorInfo( NULL,
|
|
SecurityInformation,
|
|
ModificationDescriptor,
|
|
&DescriptorCopy,
|
|
PoolType,
|
|
GenericMapping );
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
return(Status);
|
|
}
|
|
|
|
//
|
|
// Set Security operation succeeded, so we update the security
|
|
// descriptor in the hive.
|
|
//
|
|
DescriptorLength = RtlLengthSecurityDescriptor(DescriptorCopy);
|
|
Type = HvGetCellType(Key->KeyCell);
|
|
Hive = Key->KeyHive;
|
|
|
|
if (! (HvMarkCellDirty(Hive, Key->KeyCell) &&
|
|
HvMarkCellDirty(Hive, SecurityCell)))
|
|
{
|
|
ExFreePool(DescriptorCopy);
|
|
return STATUS_NO_LOG_SPACE;
|
|
}
|
|
|
|
//
|
|
// Try to find an existing security descriptor that we can share.
|
|
//
|
|
if (CmpFindMatchingDescriptorCell((PCMHIVE)Hive, DescriptorCopy, Type, &MatchSecurityCell,&CachedSecurity)) {
|
|
//
|
|
// A match was found.
|
|
//
|
|
if( MatchSecurityCell == SecurityCell ) {
|
|
//
|
|
// Whoops !!!; what we want to set is already here ! bail out
|
|
// (office instalation does this !!!!)
|
|
//
|
|
ExFreePool(DescriptorCopy);
|
|
|
|
//
|
|
// Update the LastWriteTime of the key. Do we need to do that? ==> Ask John.
|
|
//
|
|
#pragma message ("Dragos ==> John - Do we need to update the time even though nothing changed?")
|
|
|
|
KeQuerySystemTime(&SystemTime);
|
|
Node->LastWriteTime = SystemTime;
|
|
// update the time in kcb too, to keep the cache in sync
|
|
Key->KcbLastWriteTime = SystemTime;
|
|
|
|
return STATUS_SUCCESS;
|
|
} else {
|
|
if (!HvMarkCellDirty(Hive, MatchSecurityCell)) {
|
|
ExFreePool(DescriptorCopy);
|
|
return(STATUS_NO_LOG_SPACE);
|
|
}
|
|
if (Security->ReferenceCount == 1) {
|
|
//
|
|
// No more references to the old security cell, so we can free it now.
|
|
//
|
|
if (! (HvMarkCellDirty(Hive, Security->Flink) &&
|
|
HvMarkCellDirty(Hive, Security->Blink))) {
|
|
ExFreePool(DescriptorCopy);
|
|
return(STATUS_NO_LOG_SPACE);
|
|
}
|
|
CmpRemoveSecurityCellList(Hive, SecurityCell);
|
|
HvFreeCell(Hive, SecurityCell);
|
|
} else {
|
|
|
|
//
|
|
// Just decrement the count on the old security cell
|
|
//
|
|
Security->ReferenceCount -= 1;
|
|
}
|
|
|
|
//
|
|
// Set the node to point at the matching security cell.
|
|
//
|
|
Security = (PCM_KEY_SECURITY)HvGetCell(Hive, MatchSecurityCell);
|
|
if( Security == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
// this should not happen as we just marked the cell dirty
|
|
//
|
|
ASSERT( FALSE );
|
|
ExFreePool(DescriptorCopy);
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
// release the cell right here as we are holding the reglock exclusive
|
|
HvReleaseCell(Hive, MatchSecurityCell);
|
|
|
|
Security->ReferenceCount += 1;
|
|
Node->Security = MatchSecurityCell;
|
|
}
|
|
} else {
|
|
|
|
//
|
|
// No match was found, we need to create a new cell.
|
|
//
|
|
if (Security->ReferenceCount > 1) {
|
|
|
|
//
|
|
// We can't change the existing security cell, since it is shared
|
|
// by multiple keys. Allocate a new cell and decrement the existing
|
|
// one's reference count.
|
|
//
|
|
NewCell = HvAllocateCell(Key->KeyHive,
|
|
SECURITY_CELL_LENGTH(DescriptorCopy),
|
|
Type,
|
|
HCELL_NIL);
|
|
if (NewCell == HCELL_NIL) {
|
|
ExFreePool(DescriptorCopy);
|
|
return(STATUS_INSUFFICIENT_RESOURCES);
|
|
}
|
|
|
|
if (! HvMarkCellDirty(Key->KeyHive, Security->Flink)) {
|
|
ExFreePool(DescriptorCopy);
|
|
return STATUS_NO_LOG_SPACE;
|
|
}
|
|
|
|
Security->ReferenceCount -= 1;
|
|
|
|
//
|
|
// Map in the new cell and insert it into the linked list.
|
|
//
|
|
NewSecurity = (PCM_KEY_SECURITY) HvGetCell(Key->KeyHive, NewCell);
|
|
if( NewSecurity == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
ExFreePool(DescriptorCopy);
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
// release the cell right here as we are holding the reglock exclusive
|
|
HvReleaseCell(Key->KeyHive, NewCell);
|
|
|
|
NewSecurity->Blink = SecurityCell;
|
|
NewSecurity->Flink = Security->Flink;
|
|
FlinkSecurity = (PCM_KEY_SECURITY) HvGetCell(Key->KeyHive, Security->Flink);
|
|
if( FlinkSecurity == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
ExFreePool(DescriptorCopy);
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
// release the cell right here as we are holding the reglock exclusive
|
|
HvReleaseCell(Key->KeyHive, Security->Flink);
|
|
|
|
Security->Flink = FlinkSecurity->Blink = NewCell;
|
|
|
|
//
|
|
// initialize new cell
|
|
//
|
|
NewSecurity->Signature = CM_KEY_SECURITY_SIGNATURE;
|
|
NewSecurity->ReferenceCount = 1;
|
|
NewSecurity->DescriptorLength = DescriptorLength;
|
|
Security=NewSecurity;
|
|
|
|
//
|
|
// copy the descriptor
|
|
//
|
|
RtlCopyMemory( &(Security->Descriptor),
|
|
DescriptorCopy,
|
|
DescriptorLength );
|
|
|
|
//
|
|
// Add the new created security cell to the cache
|
|
//
|
|
if( !NT_SUCCESS(CmpAddSecurityCellToCache( (PCMHIVE)Key->KeyHive,NewCell,FALSE,NULL)) ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
// this shouldn't happen as we just allocated (marked dirty) the cell
|
|
//
|
|
ASSERT( FALSE );
|
|
ExFreePool(DescriptorCopy);
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
//
|
|
// Update the pointer in the node cell.
|
|
//
|
|
Node->Security = NewCell;
|
|
|
|
} else {
|
|
//
|
|
// when this is FALSE, the new cell is ADDED to cache;
|
|
// Otherwise (the cell index and size did not change),
|
|
// the new sd is copied over the one in cache
|
|
//
|
|
BOOLEAN UpdateCache;
|
|
|
|
if (DescriptorLength != Security->DescriptorLength) {
|
|
|
|
//
|
|
// The security descriptor's size has changed, and it is not shared
|
|
// by any other cells, so reallocate the cell.
|
|
//
|
|
if (! (HvMarkCellDirty(Key->KeyHive, Security->Flink) &&
|
|
HvMarkCellDirty(Key->KeyHive, Security->Blink))) {
|
|
ExFreePool(DescriptorCopy);
|
|
return(STATUS_INSUFFICIENT_RESOURCES);
|
|
}
|
|
|
|
DCmCheckRegistry((PCMHIVE)(Key->KeyHive));
|
|
OldCell = SecurityCell;
|
|
SecurityCell = HvReallocateCell( Key->KeyHive,
|
|
SecurityCell,
|
|
SECURITY_CELL_LENGTH(DescriptorCopy) );
|
|
if (SecurityCell == HCELL_NIL) {
|
|
ExFreePool(DescriptorCopy);
|
|
return(STATUS_INSUFFICIENT_RESOURCES);
|
|
}
|
|
|
|
//
|
|
// remove the old cell from security cache and signal that the new one should be added
|
|
//
|
|
CmpRemoveFromSecurityCache ((PCMHIVE)Key->KeyHive,OldCell);
|
|
UpdateCache = FALSE;
|
|
|
|
//
|
|
// Update the Node's security data.
|
|
//
|
|
Node->Security = SecurityCell;
|
|
|
|
//
|
|
// Update Security to point to where the new security object is
|
|
//
|
|
Security = (PCM_KEY_SECURITY) HvGetCell(Key->KeyHive, SecurityCell);
|
|
if( Security == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
// this shouldn't happen as we just allocated this cell
|
|
// (i.e. it should be pinned into memory at this point)
|
|
//
|
|
ASSERT( FALSE );
|
|
ExFreePool(DescriptorCopy);
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
// release the cell right here as we are holding the reglock exclusive
|
|
HvReleaseCell(Key->KeyHive, SecurityCell);
|
|
|
|
ASSERT_SECURITY(Security);
|
|
|
|
//
|
|
// Update other list references to the node
|
|
//
|
|
if (Security->Flink == OldCell) {
|
|
Security->Flink = SecurityCell; // point to new self
|
|
} else {
|
|
FlinkSecurity = (PCM_KEY_SECURITY) HvGetCell(
|
|
Key->KeyHive,
|
|
Security->Flink
|
|
);
|
|
if( FlinkSecurity == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
ExFreePool(DescriptorCopy);
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
// release the cell right here as we are holding the reglock exclusive
|
|
HvReleaseCell(Key->KeyHive, Security->Flink);
|
|
|
|
FlinkSecurity->Blink = SecurityCell;
|
|
}
|
|
|
|
if (Security->Blink == OldCell) {
|
|
Security->Blink = SecurityCell; // point to new self
|
|
} else {
|
|
BlinkSecurity = (PCM_KEY_SECURITY) HvGetCell(
|
|
Key->KeyHive,
|
|
Security->Blink
|
|
);
|
|
if( BlinkSecurity == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
ExFreePool(DescriptorCopy);
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
// release the cell right here as we are holding the reglock exclusive
|
|
HvReleaseCell(Key->KeyHive,Security->Blink);
|
|
|
|
BlinkSecurity->Flink = SecurityCell;
|
|
}
|
|
|
|
//
|
|
// Finally, update the length field in the cell
|
|
//
|
|
Security->DescriptorLength = DescriptorLength;
|
|
DCmCheckRegistry((PCMHIVE)(Key->KeyHive));
|
|
|
|
} else {
|
|
|
|
//
|
|
// Size hasn't changed, and it's not shared by any other cells, so
|
|
// we can just write the new bits over the old bits.
|
|
//
|
|
|
|
//
|
|
// new bits should be copied over the cached security
|
|
// descriptor too, to keep cache consistency
|
|
//
|
|
//
|
|
// get the cached security structure for this security cell
|
|
//
|
|
ULONG Index;
|
|
|
|
if( CmpFindSecurityCellCacheIndex ((PCMHIVE)Hive,SecurityCell,&Index) == FALSE ) {
|
|
//
|
|
// this cannot happen !!!
|
|
//
|
|
CM_BUGCHECK( REGISTRY_ERROR,BAD_SECURITY_CACHE,2,Key,SecurityCell);
|
|
}
|
|
CachedSecurity = ((PCMHIVE)Hive)->SecurityCache[Index].CachedSecurity;
|
|
|
|
UpdateCache = TRUE;
|
|
}
|
|
|
|
RtlCopyMemory( &(Security->Descriptor),
|
|
DescriptorCopy,
|
|
DescriptorLength );
|
|
|
|
if( UpdateCache == TRUE ) {
|
|
//
|
|
// we just need to copy the descriptor over the existing one
|
|
// (keep the security cache in sync !!!)
|
|
//
|
|
RtlCopyMemory( &(CachedSecurity->Descriptor),
|
|
DescriptorCopy,
|
|
DescriptorLength );
|
|
//
|
|
// recalculate the conv key and insert the sd in the proper place in the hash
|
|
//
|
|
CmpRemoveEntryList(&(CachedSecurity->List));
|
|
CachedSecurity->ConvKey = CmpSecConvKey(DescriptorLength,(PULONG)(DescriptorCopy));
|
|
InsertTailList( &(((PCMHIVE)Hive)->SecurityHash[CachedSecurity->ConvKey % CmpSecHashTableSize]),
|
|
&(CachedSecurity->List)
|
|
);
|
|
|
|
|
|
} else {
|
|
//
|
|
// add new cell to the security cache
|
|
//
|
|
if( !NT_SUCCESS(CmpAddSecurityCellToCache( (PCMHIVE)Hive,SecurityCell,FALSE,NULL)) ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
// this shouldn't happen as we just allocated (marked dirty) the cell
|
|
//
|
|
ASSERT( FALSE );
|
|
ExFreePool(DescriptorCopy);
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"\tObject's SD has been changed\n"));
|
|
//CmpDumpSecurityDescriptor(DescriptorCopy, "NEW DESCRIPTOR\n");
|
|
|
|
ExFreePool(DescriptorCopy);
|
|
|
|
//
|
|
// Update the LastWriteTime of the key.
|
|
//
|
|
KeQuerySystemTime(&SystemTime);
|
|
Node->LastWriteTime = SystemTime;
|
|
|
|
// update the time in kcb too, to keep the cache in sync
|
|
Key->KcbLastWriteTime = SystemTime;
|
|
|
|
//
|
|
// Security has changed, update the cache.
|
|
//
|
|
ASSERT_CM_LOCK_OWNED_EXCLUSIVE();
|
|
CmpAssignSecurityToKcb(Key,Node->Security);
|
|
|
|
return(STATUS_SUCCESS);
|
|
}
|
|
|
|
NTSTATUS
|
|
CmpAssignSecurityDescriptor(
|
|
IN PHHIVE Hive,
|
|
IN HCELL_INDEX Cell,
|
|
IN PCM_KEY_NODE Node,
|
|
IN PSECURITY_DESCRIPTOR SecurityDescriptor
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine assigns the given security descriptor to the specified
|
|
node in the configuration tree.
|
|
|
|
Arguments:
|
|
|
|
Hive - Supplies a pointer to the Hive for the node whose security
|
|
descriptor will be assigned.
|
|
|
|
Cell - Supplies the HCELL_INDEX of the node whose security descriptor
|
|
will be assigned.
|
|
|
|
Node - Supplies a pointer to the node whose security descriptor will
|
|
be assigned.
|
|
|
|
SecurityDescriptor - Supplies a pointer to the security descriptor to
|
|
be assigned to the node.
|
|
|
|
PoolType - Supplies the type of pool the SecurityDescriptor was a
|
|
allocated from.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - STATUS_SUCCESS if successful and an appropriate error value
|
|
otherwise
|
|
|
|
--*/
|
|
|
|
{
|
|
HCELL_INDEX SecurityCell;
|
|
PCM_KEY_SECURITY Security;
|
|
ULONG DescriptorLength;
|
|
ULONG Type;
|
|
|
|
PAGED_CODE();
|
|
//
|
|
// Map the node that we need to assign the security descriptor to.
|
|
//
|
|
if (! HvMarkCellDirty(Hive, Cell)) {
|
|
return STATUS_NO_LOG_SPACE;
|
|
}
|
|
ASSERT_NODE(Node);
|
|
|
|
ASSERT_CM_EXCLUSIVE_HIVE_ACCESS(Hive);
|
|
|
|
#if DBG
|
|
{
|
|
UNICODE_STRING Name;
|
|
|
|
Name.MaximumLength = Name.Length = Node->NameLength;
|
|
Name.Buffer = Node->Name;
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpAssignSecurityDescriptor: '%wZ' (H %p C %lx)\n",&Name,Hive,Cell ));
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"\tSecurityCell = %lx\n",Node->Security));
|
|
}
|
|
#endif
|
|
|
|
ASSERT(Node->Security==HCELL_NIL);
|
|
|
|
//
|
|
// This is a CreateKey, so the registry node has just been created and
|
|
// the security descriptor we have been passed needs to be associated
|
|
// with the new registry node and inserted into the hive.
|
|
//
|
|
//CmpDumpSecurityDescriptor(SecurityDescriptor, "ASSIGN DESCRIPTOR\n");
|
|
|
|
//
|
|
// Try to find an existing security descriptor that matches this one.
|
|
// If successful, then we don't need to allocate a new cell, we can
|
|
// just point to the existing one and increment its reference count.
|
|
//
|
|
Type = HvGetCellType(Cell);
|
|
if (!CmpFindMatchingDescriptorCell( (PCMHIVE)Hive,
|
|
SecurityDescriptor,
|
|
Type,
|
|
&SecurityCell,
|
|
NULL)) {
|
|
//
|
|
// No matching descriptor found, allocate and initialize a new one.
|
|
//
|
|
SecurityCell = HvAllocateCell(Hive,
|
|
SECURITY_CELL_LENGTH(SecurityDescriptor),
|
|
Type,
|
|
HCELL_NIL);
|
|
if (SecurityCell == HCELL_NIL) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
//
|
|
// Map the security cell
|
|
//
|
|
Security = (PCM_KEY_SECURITY) HvGetCell(Hive, SecurityCell);
|
|
if( Security == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
// this shouldn't happen as we just allocated this cell
|
|
// (i.e. it should be PINNED into memory at this point)
|
|
//
|
|
ASSERT( FALSE );
|
|
HvFreeCell(Hive, SecurityCell);
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
// release the cell right here as we are holding the reglock exclusive
|
|
HvReleaseCell(Hive, SecurityCell);
|
|
|
|
//
|
|
// Initialize the security cell
|
|
//
|
|
DescriptorLength = RtlLengthSecurityDescriptor(SecurityDescriptor);
|
|
|
|
Security->Signature = CM_KEY_SECURITY_SIGNATURE;
|
|
Security->ReferenceCount = 1;
|
|
Security->DescriptorLength = DescriptorLength;
|
|
RtlCopyMemory( &(Security->Descriptor),
|
|
SecurityDescriptor,
|
|
DescriptorLength );
|
|
|
|
//
|
|
// Insert the new security descriptor into the list of security
|
|
// cells; takes care of cache too
|
|
//
|
|
if (!CmpInsertSecurityCellList(Hive,Cell,SecurityCell))
|
|
{
|
|
HvFreeCell(Hive, SecurityCell);
|
|
return STATUS_NO_LOG_SPACE;
|
|
}
|
|
|
|
} else {
|
|
|
|
//
|
|
// Found identical descriptor already existing. Map it in and
|
|
// increment its reference count.
|
|
//
|
|
if (! HvMarkCellDirty(Hive, SecurityCell)) {
|
|
return STATUS_NO_LOG_SPACE;
|
|
}
|
|
Security = (PCM_KEY_SECURITY) HvGetCell(Hive, SecurityCell);
|
|
if( Security == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
// this shouldn't happen as we just marked the cell dirty
|
|
// (dirty means PIN !)
|
|
//
|
|
ASSERT( FALSE );
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
// release the cell right here as we are holding the reglock exclusive
|
|
HvReleaseCell(Hive, SecurityCell);
|
|
|
|
Security->ReferenceCount += 1;
|
|
}
|
|
|
|
//
|
|
// Initialize the reference in the node cell
|
|
//
|
|
Node->Security = SecurityCell;
|
|
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"\tSecurityCell = %lx\n",Node->Security));
|
|
|
|
return(STATUS_SUCCESS);
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
CmpQuerySecurityDescriptorInfo(
|
|
IN PCM_KEY_CONTROL_BLOCK kcb,
|
|
IN PSECURITY_INFORMATION SecurityInformation,
|
|
OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
IN OUT PULONG Length,
|
|
IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine will extract the desired information from the
|
|
passed security descriptor and return the information in
|
|
the passed buffer as a security descriptor in absolute format.
|
|
|
|
Arguments:
|
|
|
|
Key - Supplies a pointer to the CM_KEY_REFERENCE for the node whose
|
|
security descriptor will be deleted.
|
|
|
|
SecurityInformation - Specifies what information is being queried.
|
|
|
|
SecurityDescriptor - Supplies the buffer to output the requested
|
|
information into.
|
|
|
|
This buffer has been probed only to the size indicated by
|
|
the Length parameter. Since it still points into user space,
|
|
it must always be accessed in a try clause.
|
|
|
|
Length - Supplies the address of a variable containing the length of
|
|
the security descriptor buffer. Upon return this variable will
|
|
contain the length needed to store the requested information.
|
|
|
|
ObjectsSecurityDescriptor - Supplies the address of a pointer to
|
|
the objects security descriptor. The passed security descriptor
|
|
must be in self-relative format.
|
|
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - STATUS_SUCCESS if successful and an appropriate error value
|
|
otherwise
|
|
|
|
Note:
|
|
|
|
In the new implementation this function looks just in the security cache
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
PSECURITY_DESCRIPTOR CellSecurityDescriptor;
|
|
|
|
PAGED_CODE();
|
|
|
|
UNREFERENCED_PARAMETER (ObjectsSecurityDescriptor);
|
|
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpQuerySecurityDescriptorInfo:\n"));
|
|
|
|
|
|
|
|
CellSecurityDescriptor = &(kcb->CachedSecurity->Descriptor);
|
|
|
|
Status = SeQuerySecurityDescriptorInfo( SecurityInformation,
|
|
SecurityDescriptor,
|
|
Length,
|
|
&CellSecurityDescriptor );
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
BOOLEAN
|
|
CmpCheckCreateAccess(
|
|
IN PUNICODE_STRING RelativeName,
|
|
IN PSECURITY_DESCRIPTOR Descriptor,
|
|
IN PACCESS_STATE AccessState,
|
|
IN KPROCESSOR_MODE PreviousMode,
|
|
IN ACCESS_MASK AdditionalAccess,
|
|
OUT PNTSTATUS AccessStatus
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine checks to see if we are allowed to create a sub-key in the
|
|
given key, and performs auditing as appropriate.
|
|
|
|
Arguments:
|
|
|
|
RelativeName - Supplies the relative name of the key being created.
|
|
|
|
Descriptor - Supplies the security descriptor of the key in which
|
|
the sub-key is to be created.
|
|
|
|
CreateAccess - The access mask corresponding to create access for
|
|
this directory type.
|
|
|
|
AccessState - Checks for traverse access will typically be incidental
|
|
to some other access attempt. Information on the current state of
|
|
that access attempt is required so that the constituent access
|
|
attempts may be associated with each other in the audit log.
|
|
|
|
PreviousMode - The previous processor mode.
|
|
|
|
AdditionalAccess - access rights in addition to KEY_CREATE_SUB_KEY
|
|
that are required. (e.g. KEY_CREATE_LINK)
|
|
|
|
AccessStatus - Pointer to a variable to return the status code of the
|
|
access attempt. In the case of failure this status code must be
|
|
propagated back to the user.
|
|
|
|
Return Value:
|
|
|
|
BOOLEAN - TRUE if access is allowed and FALSE otherwise. AccessStatus
|
|
contains the status code to be passed back to the caller. It is not
|
|
correct to simply pass back STATUS_ACCESS_DENIED, since this will have
|
|
to change with the advent of mandatory access control.
|
|
|
|
--*/
|
|
|
|
{
|
|
BOOLEAN AccessAllowed;
|
|
ACCESS_MASK GrantedAccess = 0;
|
|
|
|
PAGED_CODE();
|
|
|
|
UNREFERENCED_PARAMETER (RelativeName);
|
|
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpCheckCreateAccess:\n"));
|
|
|
|
SeLockSubjectContext( &AccessState->SubjectSecurityContext );
|
|
|
|
AccessAllowed = SeAccessCheck(
|
|
Descriptor,
|
|
&AccessState->SubjectSecurityContext,
|
|
TRUE, // Token is read locked
|
|
(KEY_CREATE_SUB_KEY | AdditionalAccess),
|
|
0,
|
|
NULL,
|
|
&CmpKeyObjectType->TypeInfo.GenericMapping,
|
|
PreviousMode,
|
|
&GrantedAccess,
|
|
AccessStatus
|
|
);
|
|
|
|
SeUnlockSubjectContext( &AccessState->SubjectSecurityContext );
|
|
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"Create access %s\n",AccessAllowed ? "granted" : "denied"));
|
|
/*
|
|
#if DBG
|
|
if (!AccessAllowed) {
|
|
CmpDumpSecurityDescriptor(Descriptor, "DENYING DESCRIPTOR");
|
|
}
|
|
#endif
|
|
*/
|
|
return(AccessAllowed);
|
|
}
|
|
|
|
|
|
BOOLEAN
|
|
CmpCheckNotifyAccess(
|
|
IN PCM_NOTIFY_BLOCK NotifyBlock,
|
|
IN PHHIVE Hive,
|
|
IN PCM_KEY_NODE Node
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Check whether the subject process/thread/user specified by the
|
|
security data in the NotifyBlock has required access to the
|
|
key specified by Hive.Cell.
|
|
|
|
Arguments:
|
|
|
|
NotifyBlock - pointer to structure that describes the notify
|
|
operation, including the identity of the subject
|
|
that opened the notify.
|
|
|
|
Hive - Supplies pointer to hive containing Node.
|
|
|
|
Node - Supplies pointer to key of interest.
|
|
|
|
Return Value:
|
|
|
|
TRUE if RequiredAccess is in fact possessed by the subject,
|
|
else FALSE.
|
|
|
|
Note:
|
|
|
|
In the new implementation get the sd from the security cache.
|
|
|
|
--*/
|
|
{
|
|
PSECURITY_DESCRIPTOR SecurityDescriptor;
|
|
BOOLEAN AccessAllowed;
|
|
NTSTATUS Status;
|
|
ACCESS_MASK GrantedAccess = 0;
|
|
ULONG Index;
|
|
|
|
PAGED_CODE();
|
|
|
|
ASSERT_CM_LOCK_OWNED();
|
|
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpCheckAccessForNotify:\n"));
|
|
|
|
if( CmpFindSecurityCellCacheIndex ((PCMHIVE)Hive,Node->Security,&Index) == FALSE ) {
|
|
return FALSE;
|
|
}
|
|
|
|
|
|
SeLockSubjectContext( &NotifyBlock->SubjectContext );
|
|
|
|
SecurityDescriptor = &(((PCMHIVE)Hive)->SecurityCache[Index].CachedSecurity->Descriptor);
|
|
|
|
|
|
AccessAllowed = SeAccessCheck( SecurityDescriptor,
|
|
&NotifyBlock->SubjectContext,
|
|
TRUE,
|
|
KEY_NOTIFY,
|
|
0,
|
|
NULL,
|
|
&CmpKeyObjectType->TypeInfo.GenericMapping,
|
|
UserMode,
|
|
&GrantedAccess,
|
|
&Status );
|
|
|
|
SeUnlockSubjectContext( &NotifyBlock->SubjectContext );
|
|
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"Notify access %s\n",AccessAllowed ? "granted" : "denied"));
|
|
/*
|
|
#if DBG
|
|
if (!AccessAllowed) {
|
|
CmpDumpSecurityDescriptor(SecurityDescriptor, "DENYING DESCRIPTOR");
|
|
}
|
|
#endif
|
|
*/
|
|
return AccessAllowed;
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
CmpGetObjectSecurity(
|
|
IN HCELL_INDEX Cell,
|
|
IN PHHIVE Hive,
|
|
OUT PCM_KEY_SECURITY *Security,
|
|
OUT PHCELL_INDEX SecurityCell OPTIONAL
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine maps in the security cell of a registry object.
|
|
|
|
Arguments:
|
|
|
|
Cell - Supplies the cell index of the object.
|
|
|
|
Hive - Supplies the hive the object's cell is in.
|
|
|
|
Security - Returns a pointer to the security cell of the object.
|
|
|
|
SecurityCell - Returns the index of the security cell
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS.
|
|
|
|
--*/
|
|
|
|
{
|
|
PCM_KEY_NODE Node;
|
|
|
|
PAGED_CODE();
|
|
//
|
|
// Map the node we need to get the security descriptor for
|
|
//
|
|
Node = (PCM_KEY_NODE) HvGetCell(Hive, Cell);
|
|
|
|
if( Node == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
#if DBG
|
|
{
|
|
UNICODE_STRING Name;
|
|
|
|
Name.MaximumLength = Name.Length = Node->NameLength;
|
|
Name.Buffer = Node->Name;
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpGetObjectSecurity for: "));
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"%wZ\n", &Name));
|
|
}
|
|
#endif
|
|
|
|
*Security = CmpGetKeySecurity(Hive,Node,SecurityCell);
|
|
|
|
HvReleaseCell(Hive, Cell);
|
|
|
|
if( *Security == NULL ) {
|
|
//
|
|
// couldn't map view inside
|
|
//
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
PCM_KEY_SECURITY
|
|
CmpGetKeySecurity(
|
|
IN PHHIVE Hive,
|
|
IN PCM_KEY_NODE Key,
|
|
OUT PHCELL_INDEX SecurityCell OPTIONAL
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine returns the security of a registry key.
|
|
|
|
Arguments:
|
|
|
|
Hive - Supplies the hive the object's cell is in.
|
|
|
|
Key - Supplies a pointer to the key node.
|
|
|
|
SecurityCell - Returns the index of the security cell
|
|
|
|
Return Value:
|
|
|
|
Returns a pointer to the security cell of the object
|
|
|
|
NULL, if resources problem
|
|
--*/
|
|
|
|
{
|
|
HCELL_INDEX CellIndex;
|
|
PCM_KEY_SECURITY Security;
|
|
|
|
PAGED_CODE();
|
|
|
|
ASSERT(Key->Signature == CM_KEY_NODE_SIGNATURE);
|
|
ASSERT_NODE(Key);
|
|
|
|
#if DBG
|
|
{
|
|
UNICODE_STRING Name;
|
|
|
|
Name.MaximumLength = Name.Length = Key->NameLength;
|
|
Name.Buffer = Key->Name;
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpGetObjectSecurity for: "));
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"%wZ\n", &Name));
|
|
}
|
|
#endif
|
|
|
|
CellIndex = Key->Security;
|
|
|
|
//
|
|
// Map in the security descriptor cell
|
|
//
|
|
Security = (PCM_KEY_SECURITY) HvGetCell(Hive, CellIndex);
|
|
if( Security == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
return NULL;
|
|
}
|
|
ASSERT_CM_LOCK_OWNED_EXCLUSIVE();
|
|
HvReleaseCell(Hive, CellIndex);
|
|
ASSERT_SECURITY(Security);
|
|
|
|
if (ARGUMENT_PRESENT(SecurityCell)) {
|
|
*SecurityCell = CellIndex;
|
|
}
|
|
|
|
return(Security);
|
|
}
|
|
|
|
PSECURITY_DESCRIPTOR
|
|
CmpHiveRootSecurityDescriptor(
|
|
VOID
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine allocates and initializes the default security descriptor
|
|
for a system-created registry key.
|
|
|
|
The caller is responsible for freeing the allocated security descriptor
|
|
when he is done with it.
|
|
|
|
Arguments:
|
|
|
|
None
|
|
|
|
Return Value:
|
|
|
|
Pointer to an initialized security descriptor if successful.
|
|
|
|
Bugcheck otherwise.
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
PSECURITY_DESCRIPTOR SecurityDescriptor=NULL;
|
|
PACL Acl=NULL;
|
|
PACL AclCopy;
|
|
PSID WorldSid=NULL;
|
|
PSID RestrictedSid=NULL;
|
|
PSID SystemSid=NULL;
|
|
PSID AdminSid=NULL;
|
|
SID_IDENTIFIER_AUTHORITY WorldAuthority = SECURITY_WORLD_SID_AUTHORITY;
|
|
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
|
|
ULONG AceLength;
|
|
ULONG AclLength;
|
|
PACE_HEADER AceHeader;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Allocate and initialize the SIDs we will need.
|
|
//
|
|
WorldSid = ExAllocatePool(PagedPool, RtlLengthRequiredSid(1));
|
|
RestrictedSid = ExAllocatePool(PagedPool, RtlLengthRequiredSid(1));
|
|
SystemSid = ExAllocatePool(PagedPool, RtlLengthRequiredSid(1));
|
|
AdminSid = ExAllocatePool(PagedPool, RtlLengthRequiredSid(2));
|
|
if ((WorldSid == NULL) ||
|
|
(RestrictedSid == NULL) ||
|
|
(SystemSid == NULL) ||
|
|
(AdminSid == NULL)) {
|
|
|
|
CM_BUGCHECK(REGISTRY_ERROR, ALLOCATE_SECURITY_DESCRIPTOR, 1, 0, 0);
|
|
}
|
|
|
|
if ((!NT_SUCCESS(RtlInitializeSid(WorldSid, &WorldAuthority, 1))) ||
|
|
(!NT_SUCCESS(RtlInitializeSid(RestrictedSid, &NtAuthority, 1))) ||
|
|
(!NT_SUCCESS(RtlInitializeSid(SystemSid, &NtAuthority, 1))) ||
|
|
(!NT_SUCCESS(RtlInitializeSid(AdminSid, &NtAuthority, 2)))) {
|
|
CM_BUGCHECK(REGISTRY_ERROR, ALLOCATE_SECURITY_DESCRIPTOR, 2, 0, 0);
|
|
}
|
|
|
|
*(RtlSubAuthoritySid(WorldSid, 0)) = SECURITY_WORLD_RID;
|
|
|
|
*(RtlSubAuthoritySid(RestrictedSid, 0)) = SECURITY_RESTRICTED_CODE_RID;
|
|
|
|
*(RtlSubAuthoritySid(SystemSid, 0)) = SECURITY_LOCAL_SYSTEM_RID;
|
|
|
|
*(RtlSubAuthoritySid(AdminSid, 0)) = SECURITY_BUILTIN_DOMAIN_RID;
|
|
*(RtlSubAuthoritySid(AdminSid, 1)) = DOMAIN_ALIAS_RID_ADMINS;
|
|
|
|
ASSERT(RtlValidSid(WorldSid));
|
|
ASSERT(RtlValidSid(RestrictedSid));
|
|
ASSERT(RtlValidSid(SystemSid));
|
|
ASSERT(RtlValidSid(AdminSid));
|
|
|
|
//
|
|
// Compute the size of the ACE list
|
|
//
|
|
|
|
AceLength = (SeLengthSid(WorldSid) -
|
|
sizeof(ULONG) +
|
|
sizeof(ACCESS_ALLOWED_ACE))
|
|
+ (SeLengthSid(RestrictedSid) -
|
|
sizeof(ULONG) +
|
|
sizeof(ACCESS_ALLOWED_ACE))
|
|
+ (SeLengthSid(SystemSid) -
|
|
sizeof(ULONG) +
|
|
sizeof(ACCESS_ALLOWED_ACE))
|
|
+ (SeLengthSid(AdminSid) -
|
|
sizeof(ULONG) +
|
|
sizeof(ACCESS_ALLOWED_ACE));
|
|
|
|
//
|
|
// Allocate and initialize the ACL
|
|
//
|
|
|
|
AclLength = AceLength + sizeof(ACL);
|
|
Acl = ExAllocatePool(PagedPool, AclLength);
|
|
if (Acl == NULL) {
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpHiveRootSecurityDescriptor: couldn't allocate ACL\n"));
|
|
|
|
CM_BUGCHECK(REGISTRY_ERROR, ALLOCATE_SECURITY_DESCRIPTOR, 3, 0, 0);
|
|
}
|
|
|
|
Status = RtlCreateAcl(Acl, AclLength, ACL_REVISION);
|
|
if (!NT_SUCCESS(Status)) {
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpHiveRootSecurityDescriptor: couldn't initialize ACL\n"));
|
|
CM_BUGCHECK(REGISTRY_ERROR, ALLOCATE_SECURITY_DESCRIPTOR, 4, Status, 0);
|
|
}
|
|
|
|
//
|
|
// Now add the ACEs to the ACL
|
|
//
|
|
Status = RtlAddAccessAllowedAce(Acl,
|
|
ACL_REVISION,
|
|
KEY_ALL_ACCESS,
|
|
SystemSid);
|
|
if (NT_SUCCESS(Status)) {
|
|
Status = RtlAddAccessAllowedAce(Acl,
|
|
ACL_REVISION,
|
|
KEY_ALL_ACCESS,
|
|
AdminSid);
|
|
}
|
|
if (NT_SUCCESS(Status)) {
|
|
Status = RtlAddAccessAllowedAce(Acl,
|
|
ACL_REVISION,
|
|
KEY_READ,
|
|
WorldSid);
|
|
}
|
|
if (NT_SUCCESS(Status)) {
|
|
Status = RtlAddAccessAllowedAce(Acl,
|
|
ACL_REVISION,
|
|
KEY_READ,
|
|
RestrictedSid);
|
|
}
|
|
if (!NT_SUCCESS(Status)) {
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpHiveRootSecurityDescriptor: RtlAddAce failed status %08lx\n", Status));
|
|
|
|
CM_BUGCHECK(REGISTRY_ERROR, ALLOCATE_SECURITY_DESCRIPTOR, 5, Status, 0);
|
|
}
|
|
|
|
//
|
|
// Make the ACEs inheritable
|
|
//
|
|
Status = RtlGetAce(Acl,0,&AceHeader);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
AceHeader->AceFlags |= CONTAINER_INHERIT_ACE;
|
|
|
|
Status = RtlGetAce(Acl,1,&AceHeader);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
AceHeader->AceFlags |= CONTAINER_INHERIT_ACE;
|
|
|
|
Status = RtlGetAce(Acl,2,&AceHeader);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
AceHeader->AceFlags |= CONTAINER_INHERIT_ACE;
|
|
|
|
Status = RtlGetAce(Acl,3,&AceHeader);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
AceHeader->AceFlags |= CONTAINER_INHERIT_ACE;
|
|
//
|
|
// We are finally ready to allocate and initialize the security descriptor
|
|
// Allocate enough space to hold both the security descriptor and the
|
|
// ACL. This allows us to free the whole thing at once when we are
|
|
// done with it.
|
|
//
|
|
|
|
SecurityDescriptor = ExAllocatePool(
|
|
PagedPool,
|
|
sizeof(SECURITY_DESCRIPTOR) + AclLength
|
|
);
|
|
|
|
if (SecurityDescriptor == NULL) {
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpHiveRootSecurityDescriptor: Couldn't allocate Sec. Desc.\n"));
|
|
CM_BUGCHECK(REGISTRY_ERROR, ALLOCATE_SECURITY_DESCRIPTOR, 6, 0, 0);
|
|
}
|
|
|
|
AclCopy = (PACL)((PISECURITY_DESCRIPTOR)SecurityDescriptor+1);
|
|
RtlCopyMemory(AclCopy, Acl, AclLength);
|
|
|
|
Status = RtlCreateSecurityDescriptor( SecurityDescriptor,
|
|
SECURITY_DESCRIPTOR_REVISION );
|
|
if (!NT_SUCCESS(Status)) {
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpHiveRootSecurityDescriptor: CreateSecDesc failed %08lx\n",Status));
|
|
ExFreePool(SecurityDescriptor);
|
|
SecurityDescriptor=NULL;
|
|
CM_BUGCHECK(REGISTRY_ERROR, ALLOCATE_SECURITY_DESCRIPTOR, 7, Status, 0);
|
|
}
|
|
|
|
Status = RtlSetDaclSecurityDescriptor( SecurityDescriptor,
|
|
TRUE,
|
|
AclCopy,
|
|
FALSE );
|
|
if (!NT_SUCCESS(Status)) {
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpHiveRootSecurityDescriptor: SetDacl failed %08lx\n",Status));
|
|
ExFreePool(SecurityDescriptor);
|
|
SecurityDescriptor=NULL;
|
|
CM_BUGCHECK(REGISTRY_ERROR, ALLOCATE_SECURITY_DESCRIPTOR, 8, Status, 0);
|
|
}
|
|
|
|
//
|
|
// free any allocations we made
|
|
//
|
|
if (WorldSid!=NULL) {
|
|
ExFreePool(WorldSid);
|
|
}
|
|
if (RestrictedSid!=NULL) {
|
|
ExFreePool(RestrictedSid);
|
|
}
|
|
if (SystemSid!=NULL) {
|
|
ExFreePool(SystemSid);
|
|
}
|
|
if (AdminSid!=NULL) {
|
|
ExFreePool(AdminSid);
|
|
}
|
|
if (Acl!=NULL) {
|
|
ExFreePool(Acl);
|
|
}
|
|
|
|
return(SecurityDescriptor);
|
|
}
|
|
|
|
VOID
|
|
CmpFreeSecurityDescriptor(
|
|
IN PHHIVE Hive,
|
|
IN HCELL_INDEX Cell
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Frees the security descriptor associated with a particular node. This
|
|
can only happen when the node is actually being deleted from the
|
|
registry.
|
|
|
|
NOTE: Caller is expected to have already marked relevent cells dirty.
|
|
|
|
Arguments:
|
|
|
|
Hive - Supplies thepointer to hive control structure for hive of interest
|
|
|
|
Cell - Supplies index for cell to free storage for (the target)
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
PCELL_DATA Node;
|
|
PCELL_DATA Security;
|
|
HCELL_INDEX SecurityCell;
|
|
|
|
PAGED_CODE();
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpFreeSecurityDescriptor for cell %ld\n",Cell));
|
|
|
|
ASSERT_CM_EXCLUSIVE_HIVE_ACCESS(Hive);
|
|
//
|
|
// Map in the cell whose security descriptor is being freed
|
|
//
|
|
Node = HvGetCell(Hive, Cell);
|
|
if( Node == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
// Sorry, we cannot free the descriptor
|
|
return;
|
|
}
|
|
|
|
ASSERT_NODE(&(Node->u.KeyNode));
|
|
|
|
//
|
|
// Map in the cell containing the security descriptor.
|
|
//
|
|
SecurityCell = Node->u.KeyNode.Security;
|
|
Security = HvGetCell(Hive, SecurityCell);
|
|
if( Security == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
// Sorry, we cannot free the descriptor
|
|
HvReleaseCell(Hive, Cell);
|
|
return;
|
|
}
|
|
|
|
ASSERT_SECURITY(&(Security->u.KeySecurity));
|
|
|
|
|
|
if (Security->u.KeySecurity.ReferenceCount == 1) {
|
|
|
|
//
|
|
// This is the only cell that references this security descriptor,
|
|
// so it is ok to free it now.
|
|
//
|
|
CmpRemoveSecurityCellList(Hive, SecurityCell);
|
|
HvFreeCell(Hive, SecurityCell);
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpFreeSecurityDescriptor: freeing security cell\n"));
|
|
} else {
|
|
|
|
//
|
|
// More than one node references this security descriptor, so
|
|
// just decrement the reference count.
|
|
//
|
|
Security->u.KeySecurity.ReferenceCount -= 1;
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpFreeSecurityDescriptor: decrementing reference count\n"));
|
|
}
|
|
|
|
//
|
|
// Zero out the pointer to the security descriptdr in the main cell
|
|
//
|
|
Node->u.KeyNode.Security = HCELL_NIL;
|
|
// release the cells
|
|
HvReleaseCell(Hive, Cell);
|
|
HvReleaseCell(Hive, SecurityCell);
|
|
}
|
|
|
|
BOOLEAN
|
|
CmpInsertSecurityCellList(
|
|
IN PHHIVE Hive,
|
|
IN HCELL_INDEX NodeCell,
|
|
IN HCELL_INDEX SecurityCell
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Inserts a newly-created security cell into the per-hive linked list of
|
|
security cells.
|
|
|
|
NOTE: Assumes that NodeCell and SecurityCell have already been
|
|
marked dirty.
|
|
|
|
Arguments:
|
|
|
|
Hive - Supplies a pointer to the hive control structure.
|
|
|
|
NodeCell - Supplies the cell index of the node that owns the security cell
|
|
|
|
SecurityCell - Supplies the cell index of the security cell.
|
|
|
|
Return Value:
|
|
|
|
TRUE - it worked
|
|
|
|
FALSE - some failure - generally STATUS_NO_LOG_SPACE
|
|
|
|
--*/
|
|
|
|
{
|
|
PCM_KEY_SECURITY FlinkCell;
|
|
PCM_KEY_SECURITY BlinkCell;
|
|
PCM_KEY_SECURITY Cell;
|
|
PCM_KEY_NODE Node;
|
|
PCM_KEY_NODE ParentNode;
|
|
|
|
PAGED_CODE();
|
|
//
|
|
// If the new cell's storage type is Volatile, simply make it the
|
|
// anchor of it's own list. (Volatile security entries will disappear
|
|
// at reboot, restore, etc, so we don't need the list to hunt them
|
|
// down at those times.)
|
|
//
|
|
// Else, the storage type is Stable.
|
|
// Map in the node that owns the new security cell. If it is a root
|
|
// cell, then we are creating the hive for the first time, so this is
|
|
// the only security cell in the list. If it is not a root cell, then
|
|
// we simply find its parent's security cell and stick the new security
|
|
// cell into the list immediately after it.
|
|
//
|
|
//
|
|
// we have the lock exclusive or nobody is operating inside this hive
|
|
//
|
|
//ASSERT_CM_LOCK_OWNED_EXCLUSIVE();
|
|
ASSERT_CM_EXCLUSIVE_HIVE_ACCESS(Hive);
|
|
|
|
Cell = (PCM_KEY_SECURITY) HvGetCell(Hive, SecurityCell);
|
|
if( Cell == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
return FALSE;
|
|
}
|
|
|
|
// release the cell as we hold the reglock exclusive
|
|
HvReleaseCell(Hive, SecurityCell);
|
|
|
|
ASSERT_SECURITY(Cell);
|
|
|
|
if (HvGetCellType(SecurityCell) == Volatile) {
|
|
|
|
Cell->Flink = Cell->Blink = SecurityCell;
|
|
|
|
} else {
|
|
|
|
Node = (PCM_KEY_NODE) HvGetCell(Hive, NodeCell);
|
|
if( Node == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
return FALSE;
|
|
}
|
|
|
|
// release the cell as we hold the reglock exclusive
|
|
HvReleaseCell(Hive, NodeCell);
|
|
|
|
ASSERT_NODE(Node);
|
|
|
|
if (Node->Flags & KEY_HIVE_ENTRY) {
|
|
//
|
|
// This must be the hive creation, so this cell becomes the anchor
|
|
// for the list.
|
|
//
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpInsertSecurityCellList: hive creation\n"));
|
|
Cell->Flink = Cell->Blink = SecurityCell;
|
|
|
|
} else {
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpInsertSecurityCellList: insert at parent\n"));
|
|
//
|
|
// Map in the node's parent's security cell, so we can hook into
|
|
// the list there.
|
|
//
|
|
ParentNode = (PCM_KEY_NODE) HvGetCell(Hive, Node->Parent);
|
|
if( ParentNode == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
return FALSE;
|
|
}
|
|
// release the cell as we hold the reglock exclusive
|
|
HvReleaseCell(Hive, Node->Parent);
|
|
|
|
ASSERT_NODE(ParentNode);
|
|
BlinkCell = (PCM_KEY_SECURITY) HvGetCell(
|
|
Hive,
|
|
ParentNode->Security
|
|
);
|
|
if( BlinkCell == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
return FALSE;
|
|
}
|
|
// release the cell as we hold the reglock exclusive
|
|
HvReleaseCell(Hive, ParentNode->Security);
|
|
|
|
ASSERT_SECURITY(BlinkCell);
|
|
|
|
//
|
|
// Map in the Flink of the parent's security cell.
|
|
//
|
|
FlinkCell = (PCM_KEY_SECURITY) HvGetCell(
|
|
Hive,
|
|
BlinkCell->Flink
|
|
);
|
|
if( FlinkCell == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing this cell
|
|
//
|
|
return FALSE;
|
|
}
|
|
// release the cell as we hold the reglock exclusive
|
|
HvReleaseCell(Hive, BlinkCell->Flink);
|
|
|
|
ASSERT_SECURITY(FlinkCell);
|
|
|
|
if (! (HvMarkCellDirty(Hive, ParentNode->Security) &&
|
|
HvMarkCellDirty(Hive, BlinkCell->Flink)))
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// Insert the new security cell in between the Flink and Blink cells
|
|
//
|
|
Cell->Flink = BlinkCell->Flink;
|
|
Cell->Blink = FlinkCell->Blink;
|
|
BlinkCell->Flink = SecurityCell;
|
|
FlinkCell->Blink = SecurityCell;
|
|
}
|
|
}
|
|
|
|
//
|
|
// add the new security cell to the hive's security cache
|
|
//
|
|
if( !NT_SUCCESS( CmpAddSecurityCellToCache ( (PCMHIVE)Hive,SecurityCell,FALSE,NULL) ) ) {
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
VOID
|
|
CmpRemoveSecurityCellList(
|
|
IN PHHIVE Hive,
|
|
IN HCELL_INDEX SecurityCell
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Removes a security cell from the per-hive linked list of security cells.
|
|
(This means the cell is going to be deleted!)
|
|
|
|
NOTE: Caller is expected to have already marked relevent cells dirty
|
|
|
|
Arguments:
|
|
|
|
Hive - Supplies a pointer to the hive control structure
|
|
|
|
SecurityCell - Supplies the cell index of the security cell to be
|
|
removed
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
PCM_KEY_SECURITY FlinkCell;
|
|
PCM_KEY_SECURITY BlinkCell;
|
|
PCM_KEY_SECURITY Cell;
|
|
|
|
PAGED_CODE();
|
|
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_SEC,"CmpRemoveSecurityCellList: index %ld\n",SecurityCell));
|
|
|
|
ASSERT_CM_EXCLUSIVE_HIVE_ACCESS(Hive);
|
|
|
|
Cell = (PCM_KEY_SECURITY) HvGetCell(Hive, SecurityCell);
|
|
if( Cell == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing one of these cells
|
|
//
|
|
return;
|
|
}
|
|
|
|
FlinkCell = (PCM_KEY_SECURITY) HvGetCell(Hive, Cell->Flink);
|
|
if( FlinkCell == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing one of these cells
|
|
//
|
|
HvReleaseCell(Hive, SecurityCell);
|
|
return;
|
|
}
|
|
|
|
BlinkCell = (PCM_KEY_SECURITY) HvGetCell(Hive, Cell->Blink);
|
|
if( BlinkCell == NULL ) {
|
|
//
|
|
// we couldn't map the bin containing one of these cells
|
|
//
|
|
HvReleaseCell(Hive, SecurityCell);
|
|
HvReleaseCell(Hive, Cell->Flink);
|
|
return;
|
|
}
|
|
|
|
ASSERT(FlinkCell->Blink == SecurityCell);
|
|
ASSERT(BlinkCell->Flink == SecurityCell);
|
|
|
|
FlinkCell->Blink = Cell->Blink;
|
|
BlinkCell->Flink = Cell->Flink;
|
|
|
|
//
|
|
// finally, remove the security cell from cache, as it'll be freed
|
|
//
|
|
CmpRemoveFromSecurityCache ( (PCMHIVE)Hive,SecurityCell);
|
|
|
|
//
|
|
// release used cells
|
|
//
|
|
HvReleaseCell(Hive, Cell->Blink);
|
|
HvReleaseCell(Hive, Cell->Flink);
|
|
HvReleaseCell(Hive, SecurityCell);
|
|
}
|
|
|