You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
779 lines
15 KiB
779 lines
15 KiB
/*++
|
|
|
|
Copyright (c) 1994-1999 Microsoft Corporation
|
|
|
|
Module Name :
|
|
|
|
accentry.cpp
|
|
|
|
Abstract:
|
|
|
|
CAccessEntry class implementation
|
|
|
|
Author:
|
|
|
|
Ronald Meijer (ronaldm)
|
|
|
|
Project:
|
|
|
|
Internet Services Manager
|
|
|
|
Revision History:
|
|
1/9/2000 sergeia Cleaned out from usrbrows.cpp
|
|
|
|
--*/
|
|
|
|
//
|
|
// Include Files
|
|
//
|
|
#include "stdafx.h"
|
|
#include <iiscnfgp.h>
|
|
#include "common.h"
|
|
#include "objpick.h"
|
|
#include "accentry.h"
|
|
|
|
|
|
|
|
#ifdef _DEBUG
|
|
#undef THIS_FILE
|
|
static char BASED_CODE THIS_FILE[] = __FILE__;
|
|
#endif
|
|
|
|
|
|
#define new DEBUG_NEW
|
|
#define SZ_USER_CLASS _T("user")
|
|
#define SZ_GROUP_CLASS _T("group")
|
|
|
|
BOOL
|
|
CAccessEntry::LookupAccountSid(
|
|
OUT CString & strFullUserName,
|
|
OUT int & nPictureID,
|
|
IN PSID pSid,
|
|
IN LPCTSTR lpstrSystemName /* OPTIONAL */
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Get a full user name and picture ID from the SID
|
|
|
|
Arguments:
|
|
|
|
CString &strFullUserName : Returns the user name
|
|
int & nPictureID : Returns offset into the imagemap that
|
|
represents the account type.
|
|
PSID pSid : Input SID pointer
|
|
LPCTSTR lpstrSystemName : System name or NULL
|
|
|
|
Return Value:
|
|
|
|
TRUE for success, FALSE for failure.
|
|
|
|
--*/
|
|
{
|
|
DWORD cbUserName = PATHLEN * sizeof(TCHAR);
|
|
DWORD cbRefDomainName = PATHLEN * sizeof(TCHAR);
|
|
|
|
CString strUserName;
|
|
CString strRefDomainName;
|
|
SID_NAME_USE SidToNameUse;
|
|
|
|
LPTSTR lpUserName = strUserName.GetBuffer(PATHLEN);
|
|
LPTSTR lpRefDomainName = strRefDomainName.GetBuffer(PATHLEN);
|
|
BOOL fLookUpOK = ::LookupAccountSid(
|
|
lpstrSystemName,
|
|
pSid,
|
|
lpUserName,
|
|
&cbUserName,
|
|
lpRefDomainName,
|
|
&cbRefDomainName,
|
|
&SidToNameUse
|
|
);
|
|
|
|
strUserName.ReleaseBuffer();
|
|
strRefDomainName.ReleaseBuffer();
|
|
|
|
strFullUserName.Empty();
|
|
|
|
if (fLookUpOK)
|
|
{
|
|
if (!strRefDomainName.IsEmpty()
|
|
&& strRefDomainName.CompareNoCase(_T("BUILTIN")))
|
|
{
|
|
strFullUserName += strRefDomainName;
|
|
strFullUserName += "\\";
|
|
}
|
|
|
|
strFullUserName += strUserName;
|
|
|
|
nPictureID = SidToNameUse;
|
|
}
|
|
else
|
|
{
|
|
strFullUserName.LoadString(IDS_UNKNOWN_USER);
|
|
nPictureID = SidTypeUnknown;
|
|
}
|
|
|
|
//
|
|
// SID_NAME_USE is 1-based
|
|
//
|
|
--nPictureID ;
|
|
|
|
return fLookUpOK;
|
|
}
|
|
|
|
|
|
|
|
CAccessEntry::CAccessEntry(
|
|
IN LPVOID pAce,
|
|
IN BOOL fResolveSID
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Construct from an ACE
|
|
|
|
Arguments:
|
|
|
|
LPVOID pAce : Pointer to ACE object
|
|
BOOL fResolveSID : TRUE to resolve the SID immediately
|
|
|
|
Return Value:
|
|
|
|
N/A
|
|
|
|
--*/
|
|
: m_pSid(NULL),
|
|
m_fSIDResolved(FALSE),
|
|
m_fDeletable(TRUE),
|
|
m_fInvisible(FALSE),
|
|
m_nPictureID(SidTypeUnknown-1), // SID_NAME_USE is 1-based
|
|
m_lpstrSystemName(NULL),
|
|
m_accMask(0L),
|
|
m_fDeleted(FALSE),
|
|
m_strUserName()
|
|
{
|
|
MarkEntryAsClean();
|
|
|
|
PACE_HEADER ph = (PACE_HEADER)pAce;
|
|
PSID pSID = NULL;
|
|
|
|
switch(ph->AceType)
|
|
{
|
|
case ACCESS_ALLOWED_ACE_TYPE:
|
|
pSID = (PSID)&((PACCESS_ALLOWED_ACE)pAce)->SidStart;
|
|
m_accMask = ((PACCESS_ALLOWED_ACE)pAce)->Mask;
|
|
break;
|
|
|
|
case ACCESS_DENIED_ACE_TYPE:
|
|
case SYSTEM_AUDIT_ACE_TYPE:
|
|
case SYSTEM_ALARM_ACE_TYPE:
|
|
default:
|
|
//
|
|
// Not supported!
|
|
//
|
|
ASSERT_MSG("Unsupported ACE type");
|
|
break;
|
|
}
|
|
|
|
if (pSID == NULL)
|
|
{
|
|
return;
|
|
}
|
|
|
|
//
|
|
// Allocate a new copy of the sid.
|
|
//
|
|
DWORD cbSize = ::RtlLengthSid(pSID);
|
|
m_pSid = (PSID)AllocMem(cbSize);
|
|
if (m_pSid != NULL)
|
|
{
|
|
DWORD err = ::RtlCopySid(cbSize, m_pSid, pSID);
|
|
ASSERT(err == ERROR_SUCCESS);
|
|
}
|
|
|
|
//
|
|
// Only the non-deletable administrators have execute
|
|
// privileges
|
|
//
|
|
m_fDeletable = (m_accMask & FILE_EXECUTE) == 0L;
|
|
|
|
//
|
|
// Enum_keys is a special access right that literally "everyone"
|
|
// has, but it doesn't designate an operator, so it should not
|
|
// show up in the operator list if this is the only right it has.
|
|
//
|
|
m_fInvisible = (m_accMask == MD_ACR_ENUM_KEYS);
|
|
|
|
//SetAccessMask(lpAccessEntry);
|
|
|
|
if (fResolveSID)
|
|
{
|
|
ResolveSID();
|
|
}
|
|
}
|
|
|
|
|
|
|
|
CAccessEntry::CAccessEntry(
|
|
IN ACCESS_MASK accPermissions,
|
|
IN PSID pSid,
|
|
IN LPCTSTR lpstrSystemName, OPTIONAL
|
|
IN BOOL fResolveSID
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Constructor from access permissions and SID.
|
|
|
|
Arguments:
|
|
|
|
ACCESS_MASK accPermissions : Access mask
|
|
PSID pSid : Pointer to SID
|
|
LPCTSTR lpstrSystemName : Optional system name
|
|
BOOL fResolveSID : TRUE to resolve SID immediately
|
|
|
|
Return Value:
|
|
|
|
N/A
|
|
|
|
--*/
|
|
: m_pSid(NULL),
|
|
m_fSIDResolved(FALSE),
|
|
m_fDeletable(TRUE),
|
|
m_fInvisible(FALSE),
|
|
m_fDeleted(FALSE),
|
|
m_nPictureID(SidTypeUnknown-1), // SID_NAME_USE is 1-based
|
|
m_strUserName(),
|
|
m_lpstrSystemName(NULL),
|
|
m_accMask(accPermissions)
|
|
{
|
|
MarkEntryAsClean();
|
|
|
|
//
|
|
// Allocate a new copy of the sid.
|
|
//
|
|
DWORD cbSize = ::RtlLengthSid(pSid);
|
|
m_pSid = (PSID)AllocMem(cbSize);
|
|
if (m_pSid != NULL)
|
|
{
|
|
DWORD err = ::RtlCopySid(cbSize, m_pSid, pSid);
|
|
ASSERT(err == ERROR_SUCCESS);
|
|
}
|
|
if (lpstrSystemName != NULL)
|
|
{
|
|
m_lpstrSystemName = AllocTString(::lstrlen(lpstrSystemName) + 1);
|
|
if (m_lpstrSystemName != NULL)
|
|
{
|
|
::lstrcpy(m_lpstrSystemName, lpstrSystemName);
|
|
}
|
|
}
|
|
|
|
if (fResolveSID)
|
|
{
|
|
TRACEEOLID("Bogus SID");
|
|
ResolveSID();
|
|
}
|
|
}
|
|
|
|
|
|
|
|
CAccessEntry::CAccessEntry(
|
|
IN PSID pSid,
|
|
IN LPCTSTR pszUserName,
|
|
IN LPCTSTR pszClassName
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Constructor from access sid and user/class name.
|
|
|
|
Arguments:
|
|
|
|
PSID pSid, Pointer to SID
|
|
LPCTSTR pszUserName User name
|
|
LPCTSTR pszClassName User Class name
|
|
|
|
Return Value:
|
|
|
|
N/A
|
|
|
|
--*/
|
|
: m_pSid(NULL),
|
|
m_fSIDResolved(pszUserName != NULL),
|
|
m_fDeletable(TRUE),
|
|
m_fInvisible(FALSE),
|
|
m_fDeleted(FALSE),
|
|
m_nPictureID(SidTypeUnknown-1), // SID_NAME_USE is 1-based
|
|
m_strUserName(pszUserName),
|
|
m_lpstrSystemName(NULL),
|
|
m_accMask(0)
|
|
{
|
|
MarkEntryAsClean();
|
|
|
|
//
|
|
// Allocate a new copy of the sid.
|
|
//
|
|
DWORD cbSize = ::RtlLengthSid(pSid);
|
|
m_pSid = (PSID)AllocMem(cbSize);
|
|
if (m_pSid != NULL)
|
|
{
|
|
DWORD err = ::RtlCopySid(cbSize, m_pSid, pSid);
|
|
ASSERT(err == ERROR_SUCCESS);
|
|
}
|
|
if (_tcsicmp(SZ_USER_CLASS, pszClassName) == 0)
|
|
{
|
|
m_nPictureID = SidTypeUser - 1;
|
|
}
|
|
else if (_tcsicmp(SZ_GROUP_CLASS, pszClassName) == 0)
|
|
{
|
|
m_nPictureID = SidTypeGroup - 1;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
CAccessEntry::CAccessEntry(
|
|
IN CAccessEntry & ae
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Copy constructor
|
|
|
|
Arguments:
|
|
|
|
CAccessEntry & ae : Source to copy from
|
|
|
|
Return Value:
|
|
|
|
N/A
|
|
|
|
--*/
|
|
: m_fSIDResolved(ae.m_fSIDResolved),
|
|
m_fDeletable(ae.m_fDeletable),
|
|
m_fInvisible(ae.m_fInvisible),
|
|
m_fDeleted(ae.m_fDeleted),
|
|
m_fDirty(ae.m_fDirty),
|
|
m_nPictureID(ae.m_nPictureID),
|
|
m_strUserName(ae.m_strUserName),
|
|
m_lpstrSystemName(ae.m_lpstrSystemName),
|
|
m_accMask(ae.m_accMask)
|
|
{
|
|
DWORD cbSize = ::RtlLengthSid(ae.m_pSid);
|
|
m_pSid = (PSID)AllocMem(cbSize);
|
|
if (m_pSid != NULL)
|
|
{
|
|
DWORD err = ::RtlCopySid(cbSize, m_pSid, ae.m_pSid);
|
|
ASSERT(err == ERROR_SUCCESS);
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
CAccessEntry::~CAccessEntry()
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Destructor
|
|
|
|
Arguments:
|
|
|
|
N/A
|
|
|
|
Return Value:
|
|
|
|
N/A
|
|
|
|
--*/
|
|
{
|
|
TRACEEOLID(_T("Destroying local copy of the SID"));
|
|
ASSERT_PTR(m_pSid);
|
|
FreeMem(m_pSid);
|
|
|
|
if (m_lpstrSystemName != NULL)
|
|
{
|
|
FreeMem(m_lpstrSystemName);
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
BOOL
|
|
CAccessEntry::ResolveSID()
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Look up the user name and type.
|
|
|
|
Arguments:
|
|
|
|
None
|
|
|
|
Return Value:
|
|
|
|
TRUE for success, FALSE for failure.
|
|
|
|
Notes:
|
|
|
|
This could take some time.
|
|
|
|
--*/
|
|
{
|
|
//
|
|
// Even if it fails, it will be considered
|
|
// resolved
|
|
//
|
|
m_fSIDResolved = TRUE;
|
|
|
|
return CAccessEntry::LookupAccountSid(
|
|
m_strUserName,
|
|
m_nPictureID,
|
|
m_pSid,
|
|
m_lpstrSystemName
|
|
);
|
|
}
|
|
|
|
|
|
|
|
void
|
|
CAccessEntry::AddPermissions(
|
|
IN ACCESS_MASK accNewPermissions
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Add permissions to this entry.
|
|
|
|
Arguments:
|
|
|
|
ACCESS_MASK accNewPermissions : New access permissions to be added
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
{
|
|
m_accMask |= accNewPermissions;
|
|
m_fInvisible = (m_accMask == MD_ACR_ENUM_KEYS);
|
|
m_fDeletable = (m_accMask & FILE_EXECUTE) == 0L;
|
|
MarkEntryAsChanged();
|
|
}
|
|
|
|
|
|
|
|
void
|
|
CAccessEntry::RemovePermissions(
|
|
IN ACCESS_MASK accPermissions
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Remove permissions from this entry.
|
|
|
|
Arguments:
|
|
|
|
ACCESS_MASK accPermissions : Access permissions to be taken away
|
|
|
|
--*/
|
|
{
|
|
m_accMask &= ~accPermissions;
|
|
MarkEntryAsChanged();
|
|
}
|
|
|
|
//
|
|
// Helper Functions
|
|
//
|
|
// <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
|
|
|
|
|
|
|
PSID
|
|
GetOwnerSID()
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Return a pointer to the primary owner SID we're using.
|
|
|
|
Arguments:
|
|
|
|
None
|
|
|
|
Return Value:
|
|
|
|
Pointer to owner SID.
|
|
|
|
--*/
|
|
{
|
|
PSID pSID = NULL;
|
|
|
|
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
|
|
|
|
if (!::AllocateAndInitializeSid(
|
|
&NtAuthority,
|
|
2,
|
|
SECURITY_BUILTIN_DOMAIN_RID,
|
|
DOMAIN_ALIAS_RID_ADMINS,
|
|
0, 0, 0, 0, 0, 0,
|
|
&pSID
|
|
))
|
|
{
|
|
TRACEEOLID("Unable to get primary SID " << ::GetLastError());
|
|
}
|
|
|
|
return pSID;
|
|
}
|
|
|
|
|
|
|
|
BOOL
|
|
BuildAclBlob(
|
|
IN CObListPlus & oblSID,
|
|
OUT CBlob & blob
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Build a security descriptor blob from the access entries in the oblist
|
|
|
|
Arguments:
|
|
|
|
CObListPlus & oblSID : Input list of access entries
|
|
CBlob & blob : Output blob
|
|
|
|
Return Value:
|
|
|
|
TRUE if the list is dirty. If the list had no entries marked
|
|
as dirty, the blob generated will be empty, and this function will
|
|
return FALSE.
|
|
|
|
Notes:
|
|
|
|
Entries marked as deleted will not be added to the list.
|
|
|
|
--*/
|
|
{
|
|
ASSERT(blob.IsEmpty());
|
|
|
|
BOOL fAclDirty = FALSE;
|
|
CAccessEntry * pEntry;
|
|
|
|
DWORD dwAclSize = sizeof(ACL) - sizeof(DWORD);
|
|
CObListIter obli(oblSID);
|
|
int cItems = 0;
|
|
|
|
while(NULL != (pEntry = (CAccessEntry *)obli.Next()))
|
|
{
|
|
if (!pEntry->IsDeleted())
|
|
{
|
|
dwAclSize += GetLengthSid(pEntry->GetSid());
|
|
dwAclSize += sizeof(ACCESS_ALLOWED_ACE);
|
|
++cItems;
|
|
}
|
|
|
|
if (pEntry->IsDirty())
|
|
{
|
|
fAclDirty = TRUE;
|
|
}
|
|
}
|
|
|
|
if (fAclDirty)
|
|
{
|
|
//
|
|
// Build the acl
|
|
//
|
|
PACL pacl = NULL;
|
|
|
|
if (cItems > 0 && dwAclSize > 0)
|
|
{
|
|
pacl = (PACL)AllocMem(dwAclSize);
|
|
if (pacl != NULL)
|
|
{
|
|
if (InitializeAcl(pacl, dwAclSize, ACL_REVISION))
|
|
{
|
|
obli.Reset();
|
|
while(NULL != (pEntry = (CAccessEntry *)obli.Next()))
|
|
{
|
|
if (!pEntry->IsDeleted())
|
|
{
|
|
VERIFY(AddAccessAllowedAce(
|
|
pacl,
|
|
ACL_REVISION,
|
|
pEntry->QueryAccessMask(),
|
|
pEntry->GetSid()
|
|
));
|
|
}
|
|
}
|
|
}
|
|
}
|
|
else
|
|
{
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Build the security descriptor
|
|
//
|
|
PSECURITY_DESCRIPTOR pSD =
|
|
(PSECURITY_DESCRIPTOR)AllocMem(SECURITY_DESCRIPTOR_MIN_LENGTH);
|
|
if (pSD != NULL)
|
|
{
|
|
VERIFY(InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION));
|
|
VERIFY(SetSecurityDescriptorDacl(pSD, TRUE, pacl, FALSE));
|
|
}
|
|
else
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// Set owner and primary group
|
|
//
|
|
PSID pSID = GetOwnerSID();
|
|
ASSERT(pSID);
|
|
VERIFY(SetSecurityDescriptorOwner(pSD, pSID, TRUE));
|
|
VERIFY(SetSecurityDescriptorGroup(pSD, pSID, TRUE));
|
|
|
|
//
|
|
// Convert to self-relative
|
|
//
|
|
PSECURITY_DESCRIPTOR pSDSelfRelative = NULL;
|
|
DWORD dwSize = 0L;
|
|
MakeSelfRelativeSD(pSD, pSDSelfRelative, &dwSize);
|
|
pSDSelfRelative = AllocMem(dwSize);
|
|
if (pSDSelfRelative != NULL)
|
|
{
|
|
MakeSelfRelativeSD(pSD, pSDSelfRelative, &dwSize);
|
|
|
|
//
|
|
// Blob takes ownership
|
|
//
|
|
blob.SetValue(dwSize, (PBYTE)pSDSelfRelative, FALSE);
|
|
}
|
|
|
|
//
|
|
// Clean up
|
|
//
|
|
FreeMem(pSD);
|
|
FreeSid(pSID);
|
|
}
|
|
|
|
return fAclDirty;
|
|
}
|
|
|
|
|
|
|
|
DWORD
|
|
BuildAclOblistFromBlob(
|
|
IN CBlob & blob,
|
|
OUT CObListPlus & oblSID
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Build an oblist of access entries from a security descriptor blob
|
|
|
|
Arguments:
|
|
|
|
CBlob & blob : Input blob
|
|
CObListPlus & oblSID : Output oblist of access entries
|
|
|
|
Return Value:
|
|
|
|
Error return code
|
|
|
|
--*/
|
|
{
|
|
PSECURITY_DESCRIPTOR pSD = NULL;
|
|
|
|
if (!blob.IsEmpty())
|
|
{
|
|
pSD = (PSECURITY_DESCRIPTOR)blob.GetData();
|
|
}
|
|
|
|
if (pSD == NULL)
|
|
{
|
|
//
|
|
// Empty...
|
|
//
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
if (!IsValidSecurityDescriptor(pSD))
|
|
{
|
|
return ::GetLastError();
|
|
}
|
|
|
|
ASSERT(GetSecurityDescriptorLength(pSD) == blob.GetSize());
|
|
|
|
PACL pacl = NULL;
|
|
BOOL fDaclPresent = FALSE;
|
|
BOOL fDaclDef= FALSE;
|
|
|
|
VERIFY(GetSecurityDescriptorDacl(pSD, &fDaclPresent, &pacl, &fDaclDef));
|
|
|
|
if (!fDaclPresent || pacl == NULL)
|
|
{
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
if (!IsValidAcl(pacl))
|
|
{
|
|
return GetLastError();
|
|
}
|
|
|
|
CError err;
|
|
|
|
for (WORD w = 0; w < pacl->AceCount; ++w)
|
|
{
|
|
PVOID pAce;
|
|
|
|
if (GetAce(pacl, w, &pAce))
|
|
{
|
|
CAccessEntry * pEntry = new CAccessEntry(pAce, TRUE);
|
|
|
|
if (pEntry)
|
|
{
|
|
oblSID.AddTail(pEntry);
|
|
}
|
|
else
|
|
{
|
|
TRACEEOLID("BuildAclOblistFromBlob: OOM");
|
|
err = ERROR_NOT_ENOUGH_MEMORY;
|
|
break;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// Save last error, but continue
|
|
//
|
|
err.GetLastWinError();
|
|
}
|
|
}
|
|
|
|
//
|
|
// Return last error
|
|
//
|
|
return err;
|
|
}
|
|
|
|
|
|
|
|
|