You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1694 lines
48 KiB
1694 lines
48 KiB
/*++
|
|
|
|
Copyright (c) 1997-2000 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
SafeInit.c (WinSAFER Initialization)
|
|
|
|
Abstract:
|
|
|
|
This module implements the WinSAFER APIs to initialize and
|
|
deinitialize all housekeeping and handle tracking structures.
|
|
|
|
Author:
|
|
|
|
Jeffrey Lawson (JLawson) - Nov 1999
|
|
|
|
Environment:
|
|
|
|
User mode only.
|
|
|
|
Exported Functions:
|
|
|
|
CodeAuthzInitialize (privately exported)
|
|
SaferiChangeRegistryScope (privately exported)
|
|
|
|
Revision History:
|
|
|
|
Created - Nov 1999
|
|
|
|
--*/
|
|
|
|
#include "pch.h"
|
|
#pragma hdrstop
|
|
#include <winsafer.h>
|
|
#include <winsaferp.h>
|
|
#include <winsafer.rh>
|
|
#include "saferp.h"
|
|
|
|
|
|
//#define SAFER_REGISTRY_NOTIFICATIONS
|
|
|
|
|
|
//
|
|
// Controls the maximum number of level handles that we will
|
|
// permit to be opened at any time.
|
|
//
|
|
#define MAXIMUM_LEVEL_HANDLES 64
|
|
|
|
|
|
|
|
//
|
|
// Various globals that are used for the cache of levels and
|
|
// identities so that we do not need to go to the registry each time.
|
|
//
|
|
BOOLEAN g_bInitializedFirstTime = FALSE;
|
|
|
|
CRITICAL_SECTION g_TableCritSec;
|
|
HANDLE g_hKeyCustomRoot;
|
|
DWORD g_dwKeyOptions;
|
|
|
|
DWORD g_dwLevelHandleSequence = 1; // monotonically increasing
|
|
DWORD g_dwNumHandlesAllocated = 0; // Number of outstanding handles
|
|
|
|
|
|
//
|
|
// All of the following global variables are cached settings that are
|
|
// read and parsed from the policy the first time it is needed.
|
|
// All of the variables within this block should be considered "stale"
|
|
// when the g_bNeedCacheReload flag is TRUE.
|
|
//
|
|
BOOLEAN g_bNeedCacheReload; // indicates the following vars are stale.
|
|
|
|
RTL_GENERIC_TABLE g_CodeLevelObjTable;
|
|
RTL_GENERIC_TABLE g_CodeIdentitiesTable;
|
|
RTL_HANDLE_TABLE g_LevelHandleTable;
|
|
|
|
BOOLEAN g_bHonorScopeUser;
|
|
|
|
PAUTHZLEVELTABLERECORD g_DefaultCodeLevel; // effective
|
|
PAUTHZLEVELTABLERECORD g_DefaultCodeLevelUser;
|
|
PAUTHZLEVELTABLERECORD g_DefaultCodeLevelMachine;
|
|
LARGE_INTEGER g_SaferPolicyTimeStamp;
|
|
|
|
|
|
//
|
|
// Handles used to receive registry change notifications against the
|
|
// currently loaded policy and invalidate the internal cache.
|
|
//
|
|
#ifdef SAFER_REGISTRY_NOTIFICATIONS
|
|
HANDLE g_hRegNotifyEvent; // from CreateEvent
|
|
HANDLE g_hWaitNotifyObject; // from RegisterWaitForSingleObject
|
|
HANDLE g_hKeyNotifyBase1, g_hKeyNotifyBase2;
|
|
#endif
|
|
|
|
|
|
|
|
NTSTATUS NTAPI
|
|
SaferpSetSingleIdentificationPath(
|
|
IN BOOLEAN bAllowCreation,
|
|
IN OUT PAUTHZIDENTSTABLERECORD pIdentRecord,
|
|
IN PSAFER_PATHNAME_IDENTIFICATION pIdentChanges,
|
|
IN BOOL UpdateCache
|
|
);
|
|
|
|
|
|
FORCEINLINE BOOLEAN
|
|
CodeAuthzpIsPowerOfTwo(
|
|
ULONG ulValue
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Determines if the specified value is a whole power of 2.
|
|
(ie, exactly one of the following: 1, 2, 4, 8, 16, 32, 64, ...)
|
|
|
|
Arguments:
|
|
|
|
ulValue - Integer value to test.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE on success, FALSE on failure.
|
|
|
|
--*/
|
|
{
|
|
while (ulValue != 0) {
|
|
if (ulValue & 1) {
|
|
ulValue >>= 1;
|
|
break;
|
|
}
|
|
ulValue >>= 1;
|
|
}
|
|
return (ulValue == 0);
|
|
}
|
|
|
|
|
|
FORCEINLINE ULONG
|
|
CodeAuthzpMakePowerOfTwo(
|
|
ULONG ulValue
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Rounds the specified number up to the next whole power of 2.
|
|
(ie, exactly one of the following: 1, 2, 4, 8, 16, 32, 64, ...)
|
|
|
|
Arguments:
|
|
|
|
ulValue - Integer value to operate on.
|
|
|
|
Return Value:
|
|
|
|
Returns the rounded result.
|
|
|
|
--*/
|
|
{
|
|
if (ulValue) {
|
|
ULONG ulOriginal = ulValue;
|
|
ULONG bitmask;
|
|
for (bitmask = 1; ulValue != 0 && bitmask != 0 &&
|
|
(ulValue & ~bitmask) != 0; bitmask <<= 1) {
|
|
ulValue = ulValue & ~bitmask;
|
|
}
|
|
ASSERTMSG("failed to make a power of two",
|
|
CodeAuthzpIsPowerOfTwo(ulValue));
|
|
if (ulOriginal > ulValue) {
|
|
// if we ended up rounding down, then round it up!
|
|
ulValue <<= 1;
|
|
}
|
|
ASSERT(ulValue >= ulOriginal);
|
|
}
|
|
return ulValue;
|
|
}
|
|
|
|
|
|
|
|
|
|
BOOLEAN
|
|
CodeAuthzInitialize (
|
|
IN HANDLE Handle,
|
|
IN DWORD Reason,
|
|
IN PVOID Reserved
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This is the callback procedure used by the Advapi initialization
|
|
and deinitialization.
|
|
|
|
Arguments:
|
|
|
|
Handle -
|
|
|
|
Reason -
|
|
|
|
Reserved -
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE on success, FALSE on failure.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
|
|
UNREFERENCED_PARAMETER(Reserved);
|
|
UNREFERENCED_PARAMETER(Handle);
|
|
if (Reason == DLL_PROCESS_ATTACH) {
|
|
Status = CodeAuthzInitializeGlobals();
|
|
if (!NT_SUCCESS(Status)) return FALSE;
|
|
} else if (Reason == DLL_PROCESS_DETACH) {
|
|
CodeAuthzDeinitializeGlobals();
|
|
}
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
#ifdef SAFER_REGISTRY_NOTIFICATIONS
|
|
static VOID NTAPI
|
|
SaferpRegistryNotificationRegister(VOID)
|
|
{
|
|
if (g_hRegNotifyEvent != NULL)
|
|
{
|
|
// Note that it is okay to call RNCKV again on the same
|
|
// registry handle even if there is still an outstanding
|
|
// change notification registered.
|
|
if (g_hKeyNotifyBase1 != NULL) {
|
|
RegNotifyChangeKeyValue(
|
|
g_hKeyNotifyBase1, TRUE,
|
|
REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET,
|
|
g_hRegNotifyEvent,
|
|
TRUE);
|
|
}
|
|
if (g_hKeyNotifyBase2 != NULL) {
|
|
RegNotifyChangeKeyValue(
|
|
g_hKeyNotifyBase2, TRUE,
|
|
REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET,
|
|
g_hRegNotifyEvent,
|
|
TRUE);
|
|
}
|
|
}
|
|
}
|
|
|
|
static VOID NTAPI
|
|
SaferpRegistryNotificationCallback (PVOID pvArg1, BOOLEAN bArg2)
|
|
{
|
|
UNREFERENCED_PARAMETER(pvArg1);
|
|
UNREFERENCED_PARAMETER(bArg2);
|
|
g_bNeedCacheReload = TRUE;
|
|
}
|
|
#endif
|
|
|
|
|
|
NTSTATUS NTAPI
|
|
CodeAuthzInitializeGlobals(VOID)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Performs one-time startup operations that should be done before
|
|
any other handle or cache table operations are attempted.
|
|
|
|
Arguments:
|
|
|
|
nothing
|
|
|
|
Return Value:
|
|
|
|
Returns STATUS_SUCCESS on success.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
ULONG ulHandleEntrySize;
|
|
|
|
|
|
if (g_bInitializedFirstTime) {
|
|
// Already initialized.
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
|
|
//
|
|
// Initialize a bunch of tables for their first usage.
|
|
//
|
|
Status = RtlInitializeCriticalSection(&g_TableCritSec);
|
|
if (!NT_SUCCESS(Status)) {
|
|
return Status;
|
|
}
|
|
g_bInitializedFirstTime = g_bNeedCacheReload = TRUE;
|
|
CodeAuthzLevelObjpInitializeTable(&g_CodeLevelObjTable);
|
|
CodeAuthzGuidIdentsInitializeTable(&g_CodeIdentitiesTable);
|
|
g_hKeyCustomRoot = NULL;
|
|
g_dwKeyOptions = 0;
|
|
|
|
|
|
//
|
|
// Initialize the table that will be used to track opened
|
|
// WinSafer Level handles. Note that RtlInitializeHandleTable
|
|
// requires a structure size that is a whole power of 2.
|
|
//
|
|
ulHandleEntrySize = CodeAuthzpMakePowerOfTwo(sizeof(AUTHZLEVELHANDLESTRUCT));
|
|
|
|
RtlInitializeHandleTable(
|
|
MAXIMUM_LEVEL_HANDLES,
|
|
ulHandleEntrySize, // was sizeof(AUTHZLEVELHANDLESTRUCT)
|
|
&g_LevelHandleTable);
|
|
g_dwNumHandlesAllocated = 0;
|
|
|
|
|
|
#ifdef SAFER_REGISTRY_NOTIFICATIONS
|
|
//
|
|
// Create the event to catch modifications to the registry changes.
|
|
// This allows us to notice policy changes and reload as necessary.
|
|
//
|
|
g_hRegNotifyEvent = CreateEvent(
|
|
NULL, // Security Descriptor
|
|
TRUE, // reset type
|
|
FALSE, // initial state
|
|
NULL // object name
|
|
);
|
|
if (g_hRegNotifyEvent != INVALID_HANDLE_VALUE) {
|
|
if (!RegisterWaitForSingleObject(
|
|
&g_hWaitNotifyObject,
|
|
g_hRegNotifyEvent,
|
|
SaferpRegistryNotificationCallback,
|
|
NULL,
|
|
INFINITE,
|
|
WT_EXECUTEINWAITTHREAD))
|
|
{
|
|
CloseHandle(g_hRegNotifyEvent);
|
|
g_hRegNotifyEvent = g_hWaitNotifyObject = NULL;
|
|
}
|
|
} else {
|
|
g_hRegNotifyEvent = g_hWaitNotifyObject = NULL;
|
|
}
|
|
g_hKeyNotifyBase1 = g_hKeyNotifyBase2 = NULL;
|
|
#endif
|
|
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
|
|
VOID NTAPI
|
|
CodeAuthzDeinitializeGlobals(VOID)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Performs one-time deinitialization operations.
|
|
|
|
Arguments:
|
|
|
|
nothing
|
|
|
|
Return Value:
|
|
|
|
Returns STATUS_SUCCESS on success.
|
|
|
|
--*/
|
|
{
|
|
if (g_bInitializedFirstTime) {
|
|
#ifdef SAFER_REGISTRY_NOTIFICATIONS
|
|
if (g_hWaitNotifyObject != NULL) {
|
|
UnregisterWait(g_hWaitNotifyObject);
|
|
CloseHandle(g_hWaitNotifyObject);
|
|
}
|
|
if (g_hRegNotifyEvent != NULL) {
|
|
CloseHandle(g_hRegNotifyEvent);
|
|
}
|
|
if (g_hKeyNotifyBase1 != NULL) {
|
|
NtClose(g_hKeyNotifyBase1);
|
|
}
|
|
if (g_hKeyNotifyBase2 != NULL) {
|
|
NtClose(g_hKeyNotifyBase2);
|
|
}
|
|
#endif
|
|
CodeAuthzLevelObjpEntireTableFree(&g_CodeLevelObjTable);
|
|
CodeAuthzGuidIdentsEntireTableFree(&g_CodeIdentitiesTable);
|
|
RtlDestroyHandleTable(&g_LevelHandleTable);
|
|
g_dwNumHandlesAllocated = 0;
|
|
if (g_hKeyCustomRoot != NULL) {
|
|
NtClose(g_hKeyCustomRoot);
|
|
g_hKeyCustomRoot = NULL;
|
|
g_dwKeyOptions = 0;
|
|
}
|
|
g_bInitializedFirstTime = FALSE;
|
|
RtlDeleteCriticalSection(&g_TableCritSec);
|
|
}
|
|
}
|
|
|
|
|
|
BOOL WINAPI
|
|
SaferiChangeRegistryScope(
|
|
IN HKEY hKeyCustomRoot OPTIONAL,
|
|
IN DWORD dwKeyOptions
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Closes and invalidates all currently open level handles and
|
|
reloads all cached levels and identities. The outstanding
|
|
handles are closed and freed during this operation.
|
|
|
|
If a hKeyCustomRoot is specified, all future level and identity
|
|
operations will be performed on the levels and identies defined
|
|
within that registry scope. Otherwise, such operations will be
|
|
done on the normal HKLM/HKCU policy store locations.
|
|
|
|
Arguments:
|
|
|
|
hKeyCustomRoot - If specified, this should be an opened
|
|
registry key handle to the base of the policy
|
|
storage that should be used for all future operations.
|
|
|
|
dwKeyOptions - Additional flags that should be passed in with
|
|
the dwOptions parameter to any RegCreateKey operations,
|
|
such as REG_OPTION_VOLATILE.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE on success, FALSE on failure. On error, GetLastError()
|
|
will return a more specific indicator of the nature of the failure.
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
|
|
Status = CodeAuthzReloadCacheTables(
|
|
(HANDLE) hKeyCustomRoot,
|
|
dwKeyOptions,
|
|
FALSE
|
|
);
|
|
if (NT_SUCCESS(Status)) {
|
|
return TRUE;
|
|
} else {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
|
|
NTSTATUS NTAPI
|
|
CodeAuthzReloadCacheTables(
|
|
IN HANDLE hKeyCustomRoot OPTIONAL,
|
|
IN DWORD dwKeyOptions,
|
|
IN BOOLEAN bImmediateLoad
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Closes and invalidates all currently open level handles and
|
|
reloads all cached levels and identities. The outstanding
|
|
handles are closed and freed during this operation.
|
|
|
|
If a hKeyCustomRoot is specified, all future level and identity
|
|
operations will be performed on the levels and identies defined
|
|
within that registry scope. Otherwise, such operations will be
|
|
done on the normal HKLM/HKCU policy store locations.
|
|
|
|
Arguments:
|
|
|
|
hKeyCustomRoot - If specified, this should be an opened
|
|
registry key handle to the base of the policy
|
|
storage that should be used for all future operations.
|
|
|
|
bPopulateDefaults - If TRUE, then the default set of Level definitions
|
|
will be inserted into the Registry if no existing Levels
|
|
were found at the specified scope.
|
|
|
|
Return Value:
|
|
|
|
Returns STATUS_SUCCESS on success.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
|
|
|
|
//
|
|
// Ensure that the general globals have been initialized.
|
|
//
|
|
if (!g_bInitializedFirstTime) {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
goto ExitHandler;
|
|
}
|
|
RtlEnterCriticalSection(&g_TableCritSec);
|
|
|
|
|
|
//
|
|
// Initialize and blank out the tables we will be using.
|
|
//
|
|
CodeAuthzLevelObjpEntireTableFree(&g_CodeLevelObjTable);
|
|
CodeAuthzGuidIdentsEntireTableFree(&g_CodeIdentitiesTable);
|
|
|
|
|
|
//
|
|
// Increment the sequence number. This has the effect of
|
|
// immediately invalidating all currently open handles, but
|
|
// allows the caller to still close them properly. Any
|
|
// attempt by the caller to actually use one of the old
|
|
// handles will result in a STATUS_INVALID_HANDLE error.
|
|
//
|
|
g_dwLevelHandleSequence++;
|
|
|
|
|
|
//
|
|
// Reset the rest of our variables.
|
|
//
|
|
if (g_hKeyCustomRoot != NULL) {
|
|
NtClose(g_hKeyCustomRoot);
|
|
g_hKeyCustomRoot = NULL;
|
|
}
|
|
#ifdef SAFER_REGISTRY_NOTIFICATIONS
|
|
if (g_hKeyNotifyBase1 != NULL) {
|
|
NtClose(g_hKeyNotifyBase1);
|
|
g_hKeyNotifyBase1 = NULL;
|
|
}
|
|
if (g_hKeyNotifyBase2 != NULL) {
|
|
NtClose(g_hKeyNotifyBase2);
|
|
g_hKeyNotifyBase2 = NULL;
|
|
}
|
|
#endif
|
|
g_DefaultCodeLevel = g_DefaultCodeLevelMachine =
|
|
g_DefaultCodeLevelUser = NULL;
|
|
g_bHonorScopeUser = FALSE;
|
|
g_bNeedCacheReload = FALSE;
|
|
g_dwKeyOptions = 0;
|
|
|
|
|
|
|
|
//
|
|
// Save a duplicated copy of the custom registry handle.
|
|
//
|
|
if (ARGUMENT_PRESENT(hKeyCustomRoot))
|
|
{
|
|
const static UNICODE_STRING SubKeyName = { 0, 0, NULL };
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
|
|
InitializeObjectAttributes(&ObjectAttributes,
|
|
(PUNICODE_STRING) &SubKeyName,
|
|
OBJ_CASE_INSENSITIVE,
|
|
hKeyCustomRoot,
|
|
NULL
|
|
);
|
|
Status = NtOpenKey(&g_hKeyCustomRoot,
|
|
KEY_READ,
|
|
&ObjectAttributes);
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto ExitHandler2;
|
|
}
|
|
g_dwKeyOptions = dwKeyOptions;
|
|
#ifdef SAFER_REGISTRY_NOTIFICATIONS
|
|
#error "open for KEY_NOTIFY"
|
|
#endif
|
|
}
|
|
else
|
|
{
|
|
#ifdef SAFER_REGISTRY_NOTIFICATIONS
|
|
#endif
|
|
}
|
|
|
|
//
|
|
// Perform the actual load now, if needed.
|
|
//
|
|
g_bNeedCacheReload = TRUE;
|
|
if (bImmediateLoad) {
|
|
Status = CodeAuthzpImmediateReloadCacheTables();
|
|
} else {
|
|
Status = STATUS_SUCCESS;
|
|
}
|
|
|
|
|
|
|
|
ExitHandler2:
|
|
RtlLeaveCriticalSection(&g_TableCritSec);
|
|
|
|
ExitHandler:
|
|
return Status;
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS NTAPI
|
|
CodeAuthzpImmediateReloadCacheTables(
|
|
VOID
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Assumes that CodeAuthzReloadCacheTables() has already been called
|
|
with the specified scope already, and that this function has not
|
|
yet been called since the last reload.
|
|
|
|
Arguments:
|
|
|
|
none
|
|
|
|
Return Value:
|
|
|
|
returns STATUS_SUCCESS on successful completion.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
DWORD dwFlagValue;
|
|
|
|
|
|
ASSERT(g_TableCritSec.OwningThread == UlongToHandle(GetCurrentThreadId()));
|
|
ASSERT(RtlIsGenericTableEmpty(&g_CodeIdentitiesTable) &&
|
|
RtlIsGenericTableEmpty(&g_CodeLevelObjTable));
|
|
ASSERT(g_bNeedCacheReload != FALSE);
|
|
|
|
|
|
//
|
|
// Need to clear the cache reload flag, otherwise we
|
|
// might cause undesired infinite recursion later with
|
|
// some of the CodeAuthzPol_xxx functions.
|
|
//
|
|
g_bNeedCacheReload = FALSE;
|
|
|
|
|
|
//
|
|
// Begin loading the new policy settings from the specified location.
|
|
//
|
|
if (g_hKeyCustomRoot != NULL)
|
|
{
|
|
//
|
|
// Read in the definitions of all WinSafer Levels from
|
|
// the custom registry root specified.
|
|
//
|
|
CodeAuthzLevelObjpLoadTable(
|
|
&g_CodeLevelObjTable,
|
|
SAFER_SCOPEID_REGISTRY,
|
|
g_hKeyCustomRoot);
|
|
|
|
//
|
|
// The HonorScopeUser flag is not relevant when a custom
|
|
// registry scope is used, but we set it to false anyways.
|
|
//
|
|
g_bHonorScopeUser = FALSE;
|
|
|
|
|
|
//
|
|
// Load the Code Identities from the custom registry root.
|
|
//
|
|
CodeAuthzGuidIdentsLoadTableAll(
|
|
&g_CodeLevelObjTable,
|
|
&g_CodeIdentitiesTable,
|
|
SAFER_SCOPEID_REGISTRY,
|
|
g_hKeyCustomRoot);
|
|
|
|
//
|
|
// Load the Default Level specified by the custom registry root.
|
|
//
|
|
Status = CodeAuthzPol_GetInfoRegistry_DefaultLevel(
|
|
SAFER_SCOPEID_REGISTRY,
|
|
sizeof(DWORD), &dwFlagValue, NULL);
|
|
if (NT_SUCCESS(Status)) {
|
|
g_DefaultCodeLevelMachine =
|
|
CodeAuthzLevelObjpLookupByLevelId(
|
|
&g_CodeLevelObjTable, dwFlagValue);
|
|
} else {
|
|
g_DefaultCodeLevelMachine = NULL;
|
|
}
|
|
g_DefaultCodeLevelUser = NULL;
|
|
}
|
|
else // !ARGUMENT_PRESENT(hKeyCustomRoot)
|
|
{
|
|
g_hKeyCustomRoot = NULL;
|
|
|
|
//
|
|
// Read in the definitions of all WinSafer Levels from
|
|
// the HKEY_LOCAL_MACHINE registry scope.
|
|
//
|
|
CodeAuthzLevelObjpLoadTable(
|
|
&g_CodeLevelObjTable,
|
|
SAFER_SCOPEID_MACHINE,
|
|
NULL);
|
|
|
|
g_bHonorScopeUser = TRUE;
|
|
|
|
//
|
|
// Load in all Code Identities from the HKEY_LOCAL_MACHINE
|
|
// and possibly the HKEY_CURRENT_USER scope too.
|
|
//
|
|
CodeAuthzGuidIdentsLoadTableAll(
|
|
&g_CodeLevelObjTable,
|
|
&g_CodeIdentitiesTable,
|
|
SAFER_SCOPEID_MACHINE,
|
|
NULL);
|
|
|
|
if (g_bHonorScopeUser) {
|
|
CodeAuthzGuidIdentsLoadTableAll(
|
|
&g_CodeLevelObjTable,
|
|
&g_CodeIdentitiesTable,
|
|
SAFER_SCOPEID_USER,
|
|
NULL);
|
|
}
|
|
|
|
//
|
|
// Load the Default Level specified by the machine scope.
|
|
//
|
|
Status = CodeAuthzPol_GetInfoRegistry_DefaultLevel(
|
|
SAFER_SCOPEID_MACHINE,
|
|
sizeof(DWORD), &dwFlagValue, NULL);
|
|
if (NT_SUCCESS(Status)) {
|
|
g_DefaultCodeLevelMachine =
|
|
CodeAuthzLevelObjpLookupByLevelId(
|
|
&g_CodeLevelObjTable, dwFlagValue);
|
|
} else {
|
|
g_DefaultCodeLevelMachine = NULL;
|
|
}
|
|
|
|
|
|
//
|
|
// Load the Default Level specified by the user scope.
|
|
//
|
|
Status = CodeAuthzPol_GetInfoRegistry_DefaultLevel(
|
|
SAFER_SCOPEID_USER,
|
|
sizeof(DWORD), &dwFlagValue, NULL);
|
|
if (NT_SUCCESS(Status)) {
|
|
g_DefaultCodeLevelUser =
|
|
CodeAuthzLevelObjpLookupByLevelId(
|
|
&g_CodeLevelObjTable, dwFlagValue);
|
|
} else {
|
|
g_DefaultCodeLevelUser = NULL;
|
|
}
|
|
}
|
|
|
|
|
|
//
|
|
// Compute the effective Default Level (take the least privileged).
|
|
//
|
|
CodeAuthzpRecomputeEffectiveDefaultLevel();
|
|
|
|
GetSystemTimeAsFileTime((LPFILETIME) &g_SaferPolicyTimeStamp);
|
|
|
|
|
|
//
|
|
// Now that we have fully loaded the policy, set a change
|
|
// notification hook so that we can be alerted to updates.
|
|
//
|
|
#ifdef SAFER_REGISTRY_NOTIFICATIONS
|
|
g_bNeedCacheReload = FALSE;
|
|
SaferpRegistryNotificationRegister();
|
|
#endif
|
|
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
|
|
|
|
VOID NTAPI
|
|
CodeAuthzpRecomputeEffectiveDefaultLevel(
|
|
VOID
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Arguments:
|
|
|
|
nothing
|
|
|
|
Return Value:
|
|
|
|
nothing.
|
|
|
|
--*/
|
|
{
|
|
if (g_DefaultCodeLevelMachine != NULL &&
|
|
g_DefaultCodeLevelUser != NULL &&
|
|
g_bHonorScopeUser)
|
|
{
|
|
g_DefaultCodeLevel =
|
|
(g_DefaultCodeLevelMachine->dwLevelId <
|
|
g_DefaultCodeLevelUser->dwLevelId ?
|
|
g_DefaultCodeLevelMachine : g_DefaultCodeLevelUser);
|
|
} else if (g_DefaultCodeLevelMachine != NULL) {
|
|
g_DefaultCodeLevel = g_DefaultCodeLevelMachine;
|
|
} else if (g_bHonorScopeUser) {
|
|
g_DefaultCodeLevel = g_DefaultCodeLevelUser;
|
|
} else {
|
|
g_DefaultCodeLevel = NULL;
|
|
}
|
|
|
|
//
|
|
// If we still don't have a default Level, then try to pick
|
|
// the Fully Trusted level as default. It still might fail
|
|
// in the case where the Fully Trusted level doesn't exist,
|
|
// but that shouldn't ever happen.
|
|
//
|
|
if (!g_DefaultCodeLevel) {
|
|
g_DefaultCodeLevel = CodeAuthzLevelObjpLookupByLevelId(
|
|
&g_CodeLevelObjTable, SAFER_LEVELID_FULLYTRUSTED);
|
|
// ASSERT(g_DefaultCodeLevel != NULL);
|
|
}
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS NTAPI
|
|
CodeAuthzpDeleteKeyRecursively(
|
|
IN HANDLE hBaseKey,
|
|
IN PUNICODE_STRING pSubKey OPTIONAL
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Recursively delete the key, including all child values and keys.
|
|
|
|
Arguments:
|
|
|
|
hkey - the base registry key handle to start from.
|
|
|
|
pszSubKey - subkey to delete from.
|
|
|
|
Return Value:
|
|
|
|
Returns ERROR_SUCCESS on success, otherwise error.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
BOOLEAN bCloseSubKey;
|
|
HANDLE hSubKey;
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
UNICODE_STRING UnicodeString;
|
|
PKEY_BASIC_INFORMATION pKeyBasicInfo;
|
|
DWORD dwQueryBufferSize = 0, dwActualSize = 0;
|
|
|
|
|
|
//
|
|
// Open the subkey so we can enumerate any children
|
|
//
|
|
if (ARGUMENT_PRESENT(pSubKey) &&
|
|
pSubKey->Buffer != NULL)
|
|
{
|
|
InitializeObjectAttributes(&ObjectAttributes,
|
|
pSubKey,
|
|
OBJ_CASE_INSENSITIVE,
|
|
hBaseKey,
|
|
NULL
|
|
);
|
|
Status = NtOpenKey(&hSubKey, KEY_READ | DELETE, &ObjectAttributes);
|
|
if (!NT_SUCCESS(Status)) {
|
|
return Status;
|
|
}
|
|
bCloseSubKey = TRUE;
|
|
} else {
|
|
hSubKey = hBaseKey;
|
|
bCloseSubKey = FALSE;
|
|
}
|
|
|
|
|
|
|
|
//
|
|
// To delete a registry key, we must first ensure that all
|
|
// children subkeys are deleted (registry values do not need
|
|
// to be deleted in order to delete the key itself). To do
|
|
// this we loop enumerate
|
|
//
|
|
|
|
dwQueryBufferSize = 256;
|
|
pKeyBasicInfo = RtlAllocateHeap(RtlProcessHeap(), 0,
|
|
dwQueryBufferSize);
|
|
for (;;)
|
|
{
|
|
Status = NtEnumerateKey(
|
|
hSubKey, 0, KeyBasicInformation,
|
|
pKeyBasicInfo, dwQueryBufferSize, &dwActualSize);
|
|
|
|
if (Status == STATUS_BUFFER_TOO_SMALL ||
|
|
Status == STATUS_BUFFER_OVERFLOW)
|
|
{
|
|
if (dwActualSize <= dwQueryBufferSize) {
|
|
ASSERT(FALSE);
|
|
break; // should not happen, so stop now.
|
|
}
|
|
if (pKeyBasicInfo != NULL) {
|
|
RtlFreeHeap(RtlProcessHeap(), 0, pKeyBasicInfo);
|
|
}
|
|
dwQueryBufferSize = dwActualSize; // request a little more.
|
|
pKeyBasicInfo = RtlAllocateHeap(RtlProcessHeap(), 0,
|
|
dwQueryBufferSize);
|
|
if (!pKeyBasicInfo) {
|
|
break; // stop now, but we don't care about the error.
|
|
}
|
|
|
|
Status = NtEnumerateKey(
|
|
hSubKey, 0, KeyBasicInformation,
|
|
pKeyBasicInfo, dwQueryBufferSize, &dwActualSize);
|
|
|
|
}
|
|
|
|
if (Status == STATUS_NO_MORE_ENTRIES) {
|
|
// we've finished deleting all subkeys, stop now.
|
|
Status = STATUS_SUCCESS;
|
|
break;
|
|
}
|
|
if (!NT_SUCCESS(Status) || !pKeyBasicInfo) {
|
|
break;
|
|
}
|
|
|
|
|
|
UnicodeString.Buffer = pKeyBasicInfo->Name;
|
|
UnicodeString.MaximumLength = (USHORT) pKeyBasicInfo->NameLength;
|
|
UnicodeString.Length = (USHORT) (pKeyBasicInfo->NameLength - sizeof(WCHAR));
|
|
Status = CodeAuthzpDeleteKeyRecursively(hSubKey, &UnicodeString);
|
|
if (!NT_SUCCESS(Status)) {
|
|
break;
|
|
}
|
|
}
|
|
if (pKeyBasicInfo != NULL) {
|
|
RtlFreeHeap(RtlProcessHeap(), 0, pKeyBasicInfo);
|
|
}
|
|
Status = NtDeleteKey(hSubKey);
|
|
|
|
if (bCloseSubKey) {
|
|
NtClose(hSubKey);
|
|
}
|
|
return Status;
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS NTAPI
|
|
CodeAuthzpFormatLevelKeyPath(
|
|
IN DWORD dwLevelId,
|
|
IN OUT PUNICODE_STRING UnicodeSuffix
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Internal function to generate the path to a given subkey within the
|
|
WinSafer policy store for the storage of a given Level. The
|
|
resulting path can then be supplied to CodeAuthzpOpenPolicyRootKey
|
|
|
|
Arguments:
|
|
|
|
dwLevelId - the LevelId to process.
|
|
|
|
UnicodeSuffix - Specifies the output buffer. The Buffer and
|
|
MaximumLength fields must be supplied, but the Length
|
|
field is ignored.
|
|
|
|
Return Value:
|
|
|
|
Returns STATUS_SUCCESS on success.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
UNICODE_STRING UnicodeTemp;
|
|
|
|
|
|
if (!ARGUMENT_PRESENT(UnicodeSuffix)) {
|
|
Status = STATUS_ACCESS_VIOLATION;
|
|
goto ExitHandler;
|
|
}
|
|
UnicodeSuffix->Length = 0;
|
|
Status = RtlAppendUnicodeToString(
|
|
UnicodeSuffix,
|
|
SAFER_OBJECTS_REGSUBKEY L"\\");
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto ExitHandler;
|
|
}
|
|
UnicodeTemp.Buffer = &UnicodeSuffix->Buffer[
|
|
UnicodeSuffix->Length / sizeof(WCHAR) ];
|
|
UnicodeTemp.MaximumLength = (UnicodeSuffix->MaximumLength -
|
|
UnicodeSuffix->Length);
|
|
Status = RtlIntegerToUnicodeString(dwLevelId,
|
|
10,
|
|
&UnicodeTemp);
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto ExitHandler;
|
|
}
|
|
UnicodeSuffix->Length += UnicodeTemp.Length;
|
|
|
|
|
|
ExitHandler:
|
|
return Status;
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS NTAPI
|
|
CodeAuthzpFormatIdentityKeyPath(
|
|
IN DWORD dwLevelId,
|
|
IN LPCWSTR szIdentityType,
|
|
IN REFGUID refIdentGuid,
|
|
IN OUT PUNICODE_STRING UnicodeSuffix
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Internal function to generate the path to a given subkey within the
|
|
WinSafer policy store for the storage of a given Code Identity. The
|
|
resulting path can then be supplied to CodeAuthzpOpenPolicyRootKey
|
|
|
|
Arguments:
|
|
|
|
dwLevelId - the LevelId to process.
|
|
|
|
szIdentityType - should be one of the following string constants:
|
|
SAFER_PATHS_REGSUBKEY,
|
|
SAFER_HASHMD5_REGSUBKEY,
|
|
SAFER_SOURCEURL_REGSUBKEY
|
|
|
|
refIdentGuid - the GUID of the code identity.
|
|
|
|
UnicodeSuffix - Specifies the output buffer. The Buffer and
|
|
MaximumLength fields must be supplied, but the Length
|
|
field is ignored.
|
|
|
|
Return Value:
|
|
|
|
Returns STATUS_SUCCESS on success.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
UNICODE_STRING UnicodeTemp;
|
|
|
|
|
|
if (!ARGUMENT_PRESENT(refIdentGuid)) {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
goto ExitHandler;
|
|
}
|
|
if (!ARGUMENT_PRESENT(UnicodeSuffix)) {
|
|
Status = STATUS_ACCESS_VIOLATION;
|
|
goto ExitHandler;
|
|
}
|
|
|
|
UnicodeSuffix->Length = 0;
|
|
Status = RtlAppendUnicodeToString(
|
|
UnicodeSuffix,
|
|
SAFER_CODEIDS_REGSUBKEY L"\\");
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto ExitHandler;
|
|
}
|
|
UnicodeTemp.Buffer = &UnicodeSuffix->Buffer[
|
|
UnicodeSuffix->Length / sizeof(WCHAR) ];
|
|
UnicodeTemp.MaximumLength = (UnicodeSuffix->MaximumLength -
|
|
UnicodeSuffix->Length);
|
|
Status = RtlIntegerToUnicodeString(dwLevelId,
|
|
10,
|
|
&UnicodeTemp);
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto ExitHandler;
|
|
}
|
|
UnicodeSuffix->Length += UnicodeTemp.Length;
|
|
Status = RtlAppendUnicodeToString(
|
|
UnicodeSuffix,
|
|
L"\\");
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto ExitHandler;
|
|
}
|
|
|
|
Status = RtlAppendUnicodeToString(
|
|
UnicodeSuffix,
|
|
szIdentityType);
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto ExitHandler;
|
|
}
|
|
|
|
Status = RtlAppendUnicodeToString(
|
|
UnicodeSuffix,
|
|
L"\\");
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto ExitHandler;
|
|
}
|
|
|
|
Status = RtlStringFromGUID(refIdentGuid, &UnicodeTemp);
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto ExitHandler;
|
|
}
|
|
Status = RtlAppendUnicodeStringToString(
|
|
UnicodeSuffix, &UnicodeTemp);
|
|
RtlFreeUnicodeString(&UnicodeTemp);
|
|
|
|
ExitHandler:
|
|
return Status;
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS NTAPI
|
|
CodeAuthzpOpenPolicyRootKey(
|
|
IN DWORD dwScopeId,
|
|
IN HANDLE hKeyCustomBase OPTIONAL,
|
|
IN LPCWSTR szRegistrySuffix OPTIONAL,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN BOOLEAN bCreateKey,
|
|
OUT HANDLE *OpenedHandle
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Internal function to generate the path to a given subkey within the
|
|
WinSAFER policy store within the registry and then open that key.
|
|
The specified subkeys can optionally be automatically created if
|
|
they do not already exist.
|
|
|
|
Arguments:
|
|
|
|
dwScopeId - input scope identifier. This must be one of
|
|
SAFER_SCOPEID_MACHINE or SAFER_SCOPEID_USER or SAFER_SCOPEID_REGISTRY.
|
|
|
|
hKeyCustomBase - only used if dwScopeId is SAFER_SCOPEID_REGISTRY.
|
|
|
|
szRegistrySuffix - optionally specifies a subkey name to open under
|
|
the scope being referenced.
|
|
|
|
DesiredAccess - specifies the access that should be used to open
|
|
the registry key. For example, use KEY_READ for read access.
|
|
|
|
bCreateKey - if true, the key will be created if it does not exist.
|
|
|
|
OpenedHandle - pointer that recieves the opened handle. This handle
|
|
must be closed by the caller with NtClose()
|
|
|
|
Return Value:
|
|
|
|
Returns STATUS_SUCCESS on success.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
WCHAR KeyPathBuffer[MAX_PATH];
|
|
HANDLE hKeyPolicyBase;
|
|
UNICODE_STRING SubKeyName;
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
|
|
USHORT KeyLength = 0;
|
|
|
|
//
|
|
// Verify that we were given a pointer to write the final handle to.
|
|
//
|
|
if (!ARGUMENT_PRESENT(OpenedHandle)) {
|
|
return STATUS_INVALID_PARAMETER_4;
|
|
}
|
|
|
|
if (ARGUMENT_PRESENT(szRegistrySuffix))
|
|
{
|
|
KeyLength = (wcslen(szRegistrySuffix) + 1 ) * sizeof(WCHAR);
|
|
}
|
|
|
|
//
|
|
// Evaluate the Scope and build the full registry path that we will
|
|
// use to open a handle to this key.
|
|
//
|
|
SubKeyName.Buffer = KeyPathBuffer;
|
|
SubKeyName.Length = 0;
|
|
SubKeyName.MaximumLength = sizeof(KeyPathBuffer);
|
|
|
|
if (dwScopeId == SAFER_SCOPEID_MACHINE)
|
|
{
|
|
KeyLength += sizeof(WCHAR) + sizeof(SAFER_HKCU_REGBASE) + sizeof(L"\\Registry\\Machine\\");
|
|
|
|
if (SubKeyName.MaximumLength < KeyLength)
|
|
{
|
|
SubKeyName.Buffer = RtlAllocateHeap(RtlProcessHeap(), 0,
|
|
KeyLength);
|
|
if (SubKeyName.Buffer == NULL)
|
|
{
|
|
return STATUS_NO_MEMORY;
|
|
}
|
|
SubKeyName.MaximumLength = KeyLength;
|
|
}
|
|
Status = RtlAppendUnicodeToString(&SubKeyName,
|
|
L"\\Registry\\Machine\\" SAFER_HKLM_REGBASE );
|
|
hKeyPolicyBase = NULL;
|
|
}
|
|
else if (dwScopeId == SAFER_SCOPEID_USER)
|
|
{
|
|
UNICODE_STRING CurrentUserKeyPath;
|
|
|
|
Status = RtlFormatCurrentUserKeyPath( &CurrentUserKeyPath );
|
|
if (NT_SUCCESS( Status ) )
|
|
{
|
|
KeyLength += CurrentUserKeyPath.Length + sizeof(WCHAR) +
|
|
sizeof(SAFER_HKCU_REGBASE);
|
|
|
|
if (SubKeyName.MaximumLength < KeyLength)
|
|
{
|
|
SubKeyName.Buffer = RtlAllocateHeap(RtlProcessHeap(), 0,
|
|
KeyLength);
|
|
|
|
if (SubKeyName.Buffer == NULL)
|
|
{
|
|
return STATUS_NO_MEMORY;
|
|
}
|
|
|
|
SubKeyName.MaximumLength = KeyLength;
|
|
}
|
|
|
|
Status = RtlAppendUnicodeStringToString(
|
|
&SubKeyName, &CurrentUserKeyPath );
|
|
RtlFreeUnicodeString( &CurrentUserKeyPath );
|
|
}
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto Cleanup;
|
|
}
|
|
|
|
Status = RtlAppendUnicodeToString( &SubKeyName,
|
|
L"\\" SAFER_HKCU_REGBASE );
|
|
if (!NT_SUCCESS( Status )) {
|
|
goto Cleanup;
|
|
}
|
|
hKeyPolicyBase = NULL;
|
|
}
|
|
else if (dwScopeId == SAFER_SCOPEID_REGISTRY)
|
|
{
|
|
ASSERT(hKeyCustomBase != NULL);
|
|
|
|
hKeyPolicyBase = hKeyCustomBase;
|
|
|
|
if (SubKeyName.MaximumLength < KeyLength)
|
|
{
|
|
SubKeyName.Buffer = RtlAllocateHeap(RtlProcessHeap(), 0,
|
|
KeyLength);
|
|
if (SubKeyName.Buffer == NULL)
|
|
{
|
|
return STATUS_NO_MEMORY;
|
|
}
|
|
SubKeyName.MaximumLength = KeyLength;
|
|
}
|
|
}
|
|
else {
|
|
return STATUS_INVALID_PARAMETER_1;
|
|
}
|
|
|
|
|
|
//
|
|
// Append whatever suffix we're supposed to append if one was given.
|
|
//
|
|
if (ARGUMENT_PRESENT(szRegistrySuffix)) {
|
|
if (SubKeyName.Length > 0)
|
|
{
|
|
// We are appending a suffix to a partial path, so
|
|
// make sure there is at least a single backslash
|
|
// dividing the two strings (extra are fine).
|
|
if (*szRegistrySuffix != L'\\') {
|
|
Status = RtlAppendUnicodeToString(&SubKeyName, L"\\");
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto Cleanup;
|
|
}
|
|
}
|
|
} else if (hKeyPolicyBase != NULL) {
|
|
// Otherwise we are opening a key relative to a custom
|
|
// specified key, and the supplied suffix happens to be
|
|
// the first part of the path, so ensure there are no
|
|
// leading backslashes.
|
|
while (*szRegistrySuffix != UNICODE_NULL &&
|
|
*szRegistrySuffix == L'\\') szRegistrySuffix++;
|
|
}
|
|
|
|
Status = RtlAppendUnicodeToString(&SubKeyName, szRegistrySuffix);
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto Cleanup;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Open a handle to the registry path that we are supposed to open.
|
|
//
|
|
InitializeObjectAttributes(&ObjectAttributes,
|
|
&SubKeyName,
|
|
OBJ_CASE_INSENSITIVE,
|
|
hKeyPolicyBase,
|
|
NULL
|
|
);
|
|
if (bCreateKey) {
|
|
Status = NtCreateKey(OpenedHandle, DesiredAccess,
|
|
&ObjectAttributes, 0, NULL,
|
|
g_dwKeyOptions, NULL);
|
|
if (Status == STATUS_OBJECT_NAME_NOT_FOUND)
|
|
{
|
|
BOOLEAN bAtLeastOnce;
|
|
USHORT uIndex, uFinalLength;
|
|
|
|
//
|
|
// If we fail on the first try to open the full path, then
|
|
// it is possible that one or more of the parent keys did
|
|
// not already exist, so we have to retry for each.
|
|
//
|
|
uFinalLength = (SubKeyName.Length / sizeof(WCHAR));
|
|
bAtLeastOnce = FALSE;
|
|
for (uIndex = 0; uIndex < uFinalLength; uIndex++) {
|
|
if (SubKeyName.Buffer[uIndex] == L'\\' ) {
|
|
HANDLE hTempKey;
|
|
SubKeyName.Length = uIndex * sizeof(WCHAR);
|
|
Status = NtCreateKey(&hTempKey, DesiredAccess,
|
|
&ObjectAttributes, 0, NULL,
|
|
g_dwKeyOptions, NULL);
|
|
if (NT_SUCCESS(Status)) {
|
|
NtClose(hTempKey);
|
|
} else if (Status == STATUS_OBJECT_NAME_NOT_FOUND) {
|
|
// one of the keys leading up here still failed.
|
|
break;
|
|
}
|
|
bAtLeastOnce = TRUE;
|
|
}
|
|
}
|
|
|
|
if (bAtLeastOnce) {
|
|
SubKeyName.Length = uFinalLength * sizeof(WCHAR);
|
|
Status = NtCreateKey(OpenedHandle, DesiredAccess,
|
|
&ObjectAttributes, 0, NULL,
|
|
g_dwKeyOptions, NULL);
|
|
}
|
|
}
|
|
|
|
} else {
|
|
Status = NtOpenKey(OpenedHandle, DesiredAccess,
|
|
&ObjectAttributes);
|
|
}
|
|
|
|
Cleanup:
|
|
|
|
if ((SubKeyName.Buffer != NULL) && (SubKeyName.Buffer != KeyPathBuffer))
|
|
{
|
|
RtlFreeHeap(RtlProcessHeap(), 0, SubKeyName.Buffer);
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
BOOL WINAPI
|
|
SaferiPopulateDefaultsInRegistry(
|
|
IN HKEY hKeyBase,
|
|
OUT BOOL *pbSetDefaults
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Winsafer UI will use this API to populate default winsafer values
|
|
in the registry as follows:
|
|
|
|
DefaultLevel: SAFER_LEVELID_FULLYTRUSTED
|
|
ExecutableTypes: initialized to the latest list of attachment types
|
|
TransparentEnabled: 1
|
|
Policy Scope: 0 (enable policy for admins)
|
|
Level descriptions
|
|
|
|
|
|
Arguments:
|
|
|
|
hKeyBase - This should be an opened registry key handle to the
|
|
base of the policy storage that should be used for
|
|
to populate the defaults into. This handle should be
|
|
opened with a miniumum of KEY_SET_VALUE access.
|
|
|
|
pbSetDefaults - Pointer to a boolean that gets set when
|
|
default values are actually set (UI uses this).
|
|
|
|
Return Value:
|
|
|
|
returns STATUS_SUCCESS on successful completion.
|
|
|
|
--*/
|
|
|
|
{
|
|
|
|
#define SAFERP_WINDOWS L"%HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRoot%"
|
|
GUID WindowsGuid = SAFERP_WINDOWS_GUID;
|
|
|
|
#define SAFERP_WINDOWS_EXE L"%HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRoot%\\*.exe"
|
|
GUID WindowsExeGuid = SAFERP_WINDOWS_EXE_GUID;
|
|
|
|
#define SAFERP_SYSTEM_EXE L"%HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRoot%\\System32\\*.exe"
|
|
GUID SystemExeGuid = SAFERP_SYSTEM_EXE_GUID;
|
|
|
|
#define SAFERP_PROGRAMFILES L"%HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir%"
|
|
GUID ProgramFilesGuid = SAFERP_PROGRAMFILES_GUID;
|
|
|
|
NTSTATUS Status;
|
|
DWORD dwValueValue;
|
|
PWSTR pmszFileTypes = NULL;
|
|
UNICODE_STRING ValueName;
|
|
ULONG uResultLength = 0;
|
|
KEY_NAME_INFORMATION pKeyInformation;
|
|
UNICODE_STRING ucSubKeyName;
|
|
WCHAR szSubKeyPath[] = L"Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\0";
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
HKEY hKeyFinal = NULL;
|
|
HANDLE hAdvApiInst;
|
|
AUTHZIDENTSTABLERECORD LocalRecord = {0};
|
|
SAFER_PATHNAME_IDENTIFICATION PathIdent = {0};
|
|
|
|
DWORD dwLevelIndex;
|
|
BYTE QueryBuffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + 64];
|
|
PKEY_VALUE_PARTIAL_INFORMATION pKeyValueInfo = (PKEY_VALUE_PARTIAL_INFORMATION) QueryBuffer;
|
|
DWORD dwActualSize = 0;
|
|
|
|
if (!ARGUMENT_PRESENT(hKeyBase) || !ARGUMENT_PRESENT(pbSetDefaults)) {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
goto ExitHandler;
|
|
}
|
|
|
|
*pbSetDefaults = TRUE;
|
|
|
|
RtlInitUnicodeString(&ucSubKeyName, szSubKeyPath);
|
|
|
|
InitializeObjectAttributes(&ObjectAttributes,
|
|
(PUNICODE_STRING) &ucSubKeyName,
|
|
OBJ_CASE_INSENSITIVE,
|
|
hKeyBase,
|
|
NULL
|
|
);
|
|
|
|
Status = NtOpenKey(&hKeyFinal,
|
|
KEY_WRITE | KEY_READ,
|
|
&ObjectAttributes);
|
|
|
|
if (Status == STATUS_OBJECT_NAME_NOT_FOUND) {
|
|
|
|
Status = NtCreateKey(&hKeyFinal,
|
|
KEY_WRITE | KEY_READ,
|
|
&ObjectAttributes,
|
|
0,
|
|
NULL,
|
|
REG_OPTION_NON_VOLATILE,
|
|
NULL);
|
|
}
|
|
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
goto ExitHandler;
|
|
}
|
|
|
|
//
|
|
// check if any default value is absent
|
|
// if so, populate all the defaults again
|
|
// if not, do not populate any values and return
|
|
//
|
|
|
|
RtlInitUnicodeString(&ValueName, SAFER_DEFAULTOBJ_REGVALUE);
|
|
|
|
Status = NtQueryValueKey(
|
|
hKeyFinal,
|
|
(PUNICODE_STRING) &ValueName,
|
|
KeyValuePartialInformation,
|
|
pKeyValueInfo,
|
|
sizeof(QueryBuffer),
|
|
&dwActualSize
|
|
);
|
|
|
|
if ( Status == STATUS_OBJECT_NAME_NOT_FOUND ) {
|
|
goto PopulateAllDefaults;
|
|
}
|
|
|
|
RtlInitUnicodeString(&ValueName, SAFER_TRANSPARENTENABLED_REGVALUE);
|
|
|
|
Status = NtQueryValueKey(
|
|
hKeyFinal,
|
|
(PUNICODE_STRING) &ValueName,
|
|
KeyValuePartialInformation,
|
|
pKeyValueInfo,
|
|
sizeof(QueryBuffer),
|
|
&dwActualSize
|
|
);
|
|
|
|
if ( Status == STATUS_OBJECT_NAME_NOT_FOUND ) {
|
|
goto PopulateAllDefaults;
|
|
}
|
|
|
|
RtlInitUnicodeString(&ValueName, SAFER_POLICY_SCOPE);
|
|
|
|
Status = NtQueryValueKey(
|
|
hKeyFinal,
|
|
(PUNICODE_STRING) &ValueName,
|
|
KeyValuePartialInformation,
|
|
pKeyValueInfo,
|
|
sizeof(QueryBuffer),
|
|
&dwActualSize
|
|
);
|
|
|
|
if ( Status == STATUS_OBJECT_NAME_NOT_FOUND ) {
|
|
goto PopulateAllDefaults;
|
|
}
|
|
|
|
RtlInitUnicodeString(&ValueName, SAFER_EXETYPES_REGVALUE);
|
|
|
|
Status = NtQueryValueKey(
|
|
hKeyFinal,
|
|
(PUNICODE_STRING) &ValueName,
|
|
KeyValuePartialInformation,
|
|
pKeyValueInfo,
|
|
sizeof(QueryBuffer),
|
|
&dwActualSize
|
|
);
|
|
|
|
if ( Status == STATUS_OBJECT_NAME_NOT_FOUND ) {
|
|
goto PopulateAllDefaults;
|
|
}
|
|
|
|
//
|
|
// all default values are present or there was an error
|
|
// querying one of the values no need to populate any
|
|
//
|
|
|
|
*pbSetDefaults = FALSE;
|
|
|
|
goto ExitHandler;
|
|
|
|
PopulateAllDefaults:
|
|
|
|
RtlInitUnicodeString(&ValueName, SAFER_DEFAULTOBJ_REGVALUE);
|
|
|
|
dwValueValue = SAFER_LEVELID_FULLYTRUSTED;
|
|
|
|
Status = NtSetValueKey(hKeyFinal,
|
|
&ValueName,
|
|
0,
|
|
REG_DWORD,
|
|
&dwValueValue,
|
|
sizeof(DWORD));
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
goto ExitHandler;
|
|
|
|
dwValueValue = 1;
|
|
|
|
RtlInitUnicodeString(&ValueName, SAFER_TRANSPARENTENABLED_REGVALUE);
|
|
|
|
Status = NtSetValueKey(hKeyFinal,
|
|
&ValueName,
|
|
0,
|
|
REG_DWORD,
|
|
&dwValueValue,
|
|
sizeof(DWORD));
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
goto ExitHandler;
|
|
|
|
dwValueValue = 0;
|
|
|
|
RtlInitUnicodeString(&ValueName, SAFER_POLICY_SCOPE);
|
|
|
|
Status = NtSetValueKey(hKeyFinal,
|
|
&ValueName,
|
|
0,
|
|
REG_DWORD,
|
|
&dwValueValue,
|
|
sizeof(DWORD));
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
goto ExitHandler;
|
|
|
|
|
|
//
|
|
// prepare the MULTI_SZ value to write to the registry
|
|
//
|
|
|
|
RtlInitUnicodeString(&ValueName, SAFER_EXETYPES_REGVALUE);
|
|
|
|
pmszFileTypes = RtlAllocateHeap(RtlProcessHeap(),
|
|
0,
|
|
sizeof(SAFER_DEFAULT_EXECUTABLE_FILE_TYPES)
|
|
);
|
|
|
|
if (pmszFileTypes) {
|
|
|
|
RtlCopyMemory(pmszFileTypes,
|
|
SAFER_DEFAULT_EXECUTABLE_FILE_TYPES,
|
|
sizeof(SAFER_DEFAULT_EXECUTABLE_FILE_TYPES));
|
|
|
|
Status = NtSetValueKey(hKeyFinal,
|
|
&ValueName,
|
|
0,
|
|
REG_MULTI_SZ,
|
|
pmszFileTypes,
|
|
sizeof(SAFER_DEFAULT_EXECUTABLE_FILE_TYPES)
|
|
);
|
|
|
|
RtlFreeHeap(RtlProcessHeap(),
|
|
0,
|
|
pmszFileTypes
|
|
);
|
|
}
|
|
|
|
else {
|
|
|
|
Status = STATUS_NO_MEMORY;
|
|
|
|
goto ExitHandler;
|
|
|
|
}
|
|
|
|
//
|
|
// We now generate 4 rules so that the OS binaries are exempt.
|
|
// FULLY TRUSTED
|
|
// %windir%
|
|
// %windir%\*.exe
|
|
// %windir%\system32\*.exe
|
|
// %ProgramFiles%
|
|
//
|
|
|
|
|
|
LocalRecord.dwIdentityType = SaferIdentityTypeImageName;
|
|
LocalRecord.dwLevelId = SAFER_LEVELID_FULLYTRUSTED;
|
|
LocalRecord.dwScopeId = SAFER_SCOPEID_REGISTRY;
|
|
LocalRecord.ImageNameInfo.bExpandVars = TRUE;
|
|
LocalRecord.ImageNameInfo.dwSaferFlags = 0;
|
|
RtlInitUnicodeString(&LocalRecord.ImageNameInfo.ImagePath, SAFERP_WINDOWS);
|
|
LocalRecord.IdentGuid = WindowsGuid;
|
|
|
|
PathIdent.header.cbStructSize = sizeof(SAFER_IDENTIFICATION_HEADER);
|
|
PathIdent.header.dwIdentificationType = SaferIdentityTypeImageName;
|
|
PathIdent.header.IdentificationGuid = LocalRecord.IdentGuid;
|
|
PathIdent.dwSaferFlags = 0;
|
|
PathIdent.ImageName = SAFERP_WINDOWS;
|
|
PathIdent.Description[0] = L'\0';
|
|
|
|
Status = SaferpSetSingleIdentificationPath(TRUE,
|
|
&LocalRecord,
|
|
&PathIdent,
|
|
FALSE
|
|
);
|
|
if (!NT_SUCCESS(Status))
|
|
goto ExitHandler;
|
|
|
|
RtlInitUnicodeString(&LocalRecord.ImageNameInfo.ImagePath, SAFERP_WINDOWS_EXE);
|
|
LocalRecord.IdentGuid = WindowsExeGuid;
|
|
PathIdent.header.IdentificationGuid = LocalRecord.IdentGuid;
|
|
PathIdent.ImageName = SAFERP_WINDOWS_EXE;
|
|
|
|
Status = SaferpSetSingleIdentificationPath(TRUE,
|
|
&LocalRecord,
|
|
&PathIdent,
|
|
FALSE
|
|
);
|
|
if (!NT_SUCCESS(Status))
|
|
goto ExitHandler;
|
|
|
|
RtlInitUnicodeString(&LocalRecord.ImageNameInfo.ImagePath, SAFERP_SYSTEM_EXE);
|
|
LocalRecord.IdentGuid = SystemExeGuid;
|
|
PathIdent.header.IdentificationGuid = LocalRecord.IdentGuid;
|
|
PathIdent.ImageName = SAFERP_SYSTEM_EXE;
|
|
|
|
Status = SaferpSetSingleIdentificationPath(TRUE,
|
|
&LocalRecord,
|
|
&PathIdent,
|
|
FALSE
|
|
);
|
|
if (!NT_SUCCESS(Status))
|
|
goto ExitHandler;
|
|
|
|
RtlInitUnicodeString(&LocalRecord.ImageNameInfo.ImagePath, SAFERP_PROGRAMFILES);
|
|
LocalRecord.IdentGuid = ProgramFilesGuid;
|
|
PathIdent.header.IdentificationGuid = LocalRecord.IdentGuid;
|
|
PathIdent.ImageName = SAFERP_PROGRAMFILES;
|
|
|
|
Status = SaferpSetSingleIdentificationPath(TRUE,
|
|
&LocalRecord,
|
|
&PathIdent,
|
|
FALSE
|
|
);
|
|
if (!NT_SUCCESS(Status))
|
|
goto ExitHandler;
|
|
|
|
ExitHandler:
|
|
|
|
if (hKeyFinal) {
|
|
NtClose(hKeyFinal);
|
|
}
|
|
|
|
if (NT_SUCCESS(Status)) {
|
|
return TRUE;
|
|
} else {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
}
|
|
|