windows-xp/Source/XPSP1/NT/base/cluster/admin/cluadmex/editacl.cpp

/////////////////////////////////////////////////////////////////////////////
//
//	Copyright (c) 1996-1997 Microsoft Corporation
//
//	Module Name:
//		EditAcl.cpp
//
//	Abstract:
//		Implementation of ACL editor methods.
//
//	Author:
//		David Potter (davidp)	October 9, 1996
//			From \nt\private\window\shell\lmui\ntshrui\acl.cxx
//			by BruceFo
//
//	Revision History:
//
//	Notes:
//
/////////////////////////////////////////////////////////////////////////////

#include "stdafx.h"
#include <lmerr.h>

extern "C"
{
#include <sedapi.h>
}

#include "EditAcl.h"
#include "AclHelp.h"
#include "resource.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif

//////////////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////////////

#define ARRAYLEN(a) (sizeof(a) / sizeof((a)[0]))


enum SED_PERM_TYPE{
	SED_AUDITS,
	SED_ACCESSES,
	SED_OWNER
};

enum MAP_DIRECTION 
{
	SPECIFIC_TO_GENERIC = 0,
	GENERIC_TO_SPECIFIC = 1
};

const DWORD LOCAL_ACCOUNTS_FILTERED = 2L;
const BOOL bIsFile = 0;
 
//#define MAPBITS
BOOL MapBitsInSD(PSECURITY_DESCRIPTOR pSecDesc, MAP_DIRECTION direction);
BOOL MapBitsInACL(PACL paclACL, MAP_DIRECTION direction);
BOOL MapSpecificBitsInAce(PACCESS_ALLOWED_ACE pAce);
BOOL MapGenericBitsInAce(PACCESS_ALLOWED_ACE pAce);


typedef
DWORD
(*SedDiscretionaryAclEditorType)(
		HWND						 Owner,
		HANDLE						 Instance,
		LPWSTR						 Server,
		PSED_OBJECT_TYPE_DESCRIPTOR  ObjectType,
		PSED_APPLICATION_ACCESSES	 ApplicationAccesses,
		LPWSTR						 ObjectName,
		PSED_FUNC_APPLY_SEC_CALLBACK ApplySecurityCallbackRoutine,
		ULONG						 CallbackContext,
		PSECURITY_DESCRIPTOR		 SecurityDescriptor,
		BOOLEAN 					 CouldntReadDacl,
		BOOLEAN 					 CantWriteDacl,
		LPDWORD 					 SEDStatusReturn,
		DWORD						 Flags
		);

// NOTE: the SedDiscretionaryAclEditor string is used in GetProcAddress to
// get the correct entrypoint. Since GetProcAddress is not UNICODE, this string
// must be ANSI.
#define ACLEDIT_DLL_STRING					TEXT("acledit.dll")
#define ACLEDIT_HELPFILENAME				TEXT("ntshrui.hlp")
#define SEDDISCRETIONARYACLEDITOR_STRING	("SedDiscretionaryAclEditor")

//
// Declare the callback routine based on typedef in sedapi.h.
//

DWORD
SedCallback(
	HWND					hwndParent,
	HANDLE					hInstance,
	ULONG					ulCallbackContext,
	PSECURITY_DESCRIPTOR	pSecDesc,
	PSECURITY_DESCRIPTOR	pSecDescNewObjects,
	BOOLEAN 				fApplyToSubContainers,
	BOOLEAN 				fApplyToSubObjects,
	LPDWORD 				StatusReturn
	);

//
// Structure for callback function's usage. A pointer to this is passed as
// ulCallbackContext. The callback functions sets bSecDescModified to TRUE
// and makes a copy of the security descriptor. The caller of EditShareAcl
// is responsible for deleting the memory in pSecDesc if bSecDescModified is
// TRUE. This flag will be FALSE if the user hit CANCEL in the ACL editor.
//
struct SHARE_CALLBACK_INFO
{
	BOOL					bSecDescModified;
	PSECURITY_DESCRIPTOR	pSecDesc;
	LPCTSTR 				pszClusterNameNode;
};

//
// Local function prototypes
//

VOID
InitializeShareGenericMapping(
	IN OUT PGENERIC_MAPPING pSHAREGenericMapping
	);

PWSTR
GetResourceString(
	IN DWORD dwId
	);

PWSTR
NewDup(
	IN const WCHAR* psz
	);

//
// The following two arrays define the permission names for NT Files.  Note
// that each index in one array corresponds to the index in the other array.
// The second array will be modifed to contain a string pointer pointing to
// a loaded string corresponding to the IDS_* in the first array.
//

DWORD g_dwSharePermNames[] =
{
	IDS_ACLEDIT_PERM_GEN_NO_ACCESS,
	IDS_ACLEDIT_PERM_GEN_READ,
	IDS_ACLEDIT_PERM_GEN_MODIFY,
	IDS_ACLEDIT_PERM_GEN_ALL
};

SED_APPLICATION_ACCESS g_SedAppAccessSharePerms[] =
{
	{ SED_DESC_TYPE_RESOURCE, FILE_PERM_NO_ACCESS, 0, NULL },
	{ SED_DESC_TYPE_RESOURCE, FILE_PERM_READ,	   0, NULL },
	{ SED_DESC_TYPE_RESOURCE, FILE_PERM_MODIFY,    0, NULL },
	{ SED_DESC_TYPE_RESOURCE, FILE_PERM_ALL,	   0, NULL }
/*
	{ SED_DESC_TYPE_RESOURCE, FILE_PERM_GEN_NO_ACCESS, 0, NULL },
	{ SED_DESC_TYPE_RESOURCE, FILE_PERM_GEN_READ,	   0, NULL },
	{ SED_DESC_TYPE_RESOURCE, FILE_PERM_GEN_MODIFY,    0, NULL },
	{ SED_DESC_TYPE_RESOURCE, FILE_PERM_GEN_ALL,	   0, NULL }
*/
};


//////////////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////////////

//+-------------------------------------------------------------------------
//
//	Function:	EditShareAcl
//
//	Synopsis:	Invokes the generic ACL editor, specifically for NT shares
//
//	Arguments:	[hwndParent] - Parent window handle
//				[pszServerName] - Name of server on which the object resides.
//				[pszShareName] - Fully qualified name of resource we will
//					edit, basically a share name.
//				[pSecDesc] - The initial security descriptor. If NULL, we will
//					create a default that is "World all" access.
//				[pbSecDescModified] - Set to TRUE if the security descriptor
//					was modified (i.e., the user hit "OK"), or FALSE if not
//					(i.e., the user hit "Cancel")
//				[ppSecDesc] - *ppSecDesc points to a new security descriptor
//					if *pbSecDescModified is TRUE. This memory must be freed
//					by the caller.
//
//	History:
//		  ChuckC   10-Aug-1992	Created. Culled from NTFS ACL code.
//		  Yi-HsinS 09-Oct-1992	Added ulHelpContextBase
//		  BruceFo  4-Apr-95 	Stole and used in ntshrui.dll
//		  DavidP   10-Oct-1996	Modified for use with CLUADMIN
//
//--------------------------------------------------------------------------

LONG
EditShareAcl(
	IN HWND 					hwndParent,
	IN LPCTSTR					pszServerName,
	IN LPCTSTR					pszShareName,
	IN LPCTSTR					pszClusterNameNode,
	IN PSECURITY_DESCRIPTOR 	pSecDesc,
	OUT BOOL *					pbSecDescModified,
	OUT PSECURITY_DESCRIPTOR *	ppSecDesc
	)
{
	ASSERT(pszShareName != NULL);
	ASSERT(pszClusterNameNode != NULL);
	TRACE(_T("EditShareAcl, share %ws\n"), pszShareName);

	ASSERT((pSecDesc == NULL) || IsValidSecurityDescriptor(pSecDesc));
	ASSERT(pbSecDescModified != NULL);
	ASSERT(ppSecDesc != NULL);

	*pbSecDescModified = FALSE;

	LONG err = 0 ;
	PWSTR pszPermName;
	BOOL bCreatedDefaultSecDesc = FALSE;

	do // error breakout
	{
		/*
		 * if pSecDesc is NULL, this is new file share or a file share with no
		 * security descriptor.
		 * we go and create a new (default) security descriptor.
		 */
		if( NULL == pSecDesc )
		{
			TRACE(_T("Security Descriptor is NULL.  Grant everyone Full Control\n") );
			LONG err = CreateDefaultSecDesc( &pSecDesc );
			if (err != NERR_Success)
			{
				err = GetLastError();
				TRACE(_T("CreateDefaultSecDesc failed, 0x%08lx\n"), err);
				break;
			}
			TRACE(_T("CreateDefaultSecDesc descriptor = 0x%08lx\n"), pSecDesc);
			bCreatedDefaultSecDesc = TRUE;
			
		}
		ASSERT(IsValidSecurityDescriptor(pSecDesc));

		/* Retrieve the resource strings appropriate for the type of object we
		 * are looking at
		 */

		CString strTypeName;
		CString strDefaultPermName;

		try
		{
			strTypeName.LoadString(IDS_ACLEDIT_TITLE);
			strDefaultPermName.LoadString(IDS_ACLEDIT_PERM_GEN_ALL);
		}  // try
		catch (CMemoryException * pme)
		{
			pme->Delete();
		}

		/*
		 * other misc stuff we need pass to security editor
		 */
		SED_OBJECT_TYPE_DESCRIPTOR sedObjDesc ;
		SED_HELP_INFO sedHelpInfo ;
		GENERIC_MAPPING SHAREGenericMapping ;

		// setup mappings
		InitializeShareGenericMapping( &SHAREGenericMapping ) ;

		WCHAR szHelpFile[50] = ACLEDIT_HELPFILENAME;
		sedHelpInfo.pszHelpFileName = szHelpFile;

		sedHelpInfo.aulHelpContext[HC_MAIN_DLG] =				 HC_UI_SHELL_BASE + HC_NTSHAREPERMS ;
		sedHelpInfo.aulHelpContext[HC_ADD_USER_DLG] =			 HC_UI_SHELL_BASE + HC_SHAREADDUSER ;
		sedHelpInfo.aulHelpContext[HC_ADD_USER_MEMBERS_GG_DLG] = HC_UI_SHELL_BASE + HC_SHAREADDUSER_GLOBALGROUP ;
		sedHelpInfo.aulHelpContext[HC_ADD_USER_SEARCH_DLG] =	 HC_UI_SHELL_BASE + HC_SHAREADDUSER_FINDUSER ;

		// These are not used, set to zero
		sedHelpInfo.aulHelpContext[HC_SPECIAL_ACCESS_DLG]		   = 0 ;
		sedHelpInfo.aulHelpContext[HC_NEW_ITEM_SPECIAL_ACCESS_DLG] = 0 ;

		// setup the object description
		sedObjDesc.Revision 				   = SED_REVISION1 ;
		sedObjDesc.IsContainer				   = FALSE ;
		sedObjDesc.AllowNewObjectPerms		   = FALSE ;
		sedObjDesc.MapSpecificPermsToGeneric   = TRUE ;
		sedObjDesc.GenericMapping			   = &SHAREGenericMapping ;
		sedObjDesc.GenericMappingNewObjects    = &SHAREGenericMapping ;
		sedObjDesc.ObjectTypeName			   = (LPWSTR) (LPCWSTR) strTypeName ;
		sedObjDesc.HelpInfo 				   = &sedHelpInfo ;
		sedObjDesc.SpecialObjectAccessTitle    = NULL ;

		/* Now we need to load the global arrays with the permission names
		 * from the resource file.
		 */
		UINT cArrayItems  = ARRAYLEN(g_SedAppAccessSharePerms);
		PSED_APPLICATION_ACCESS aSedAppAccess = g_SedAppAccessSharePerms ;

		/* Loop through each permission title retrieving the text from the
		 * resource file and setting the pointer in the array.
		 */

		for ( UINT i = 0 ; i < cArrayItems ; i++ )
		{
			pszPermName = GetResourceString(g_dwSharePermNames[i]) ;
			if (NULL == pszPermName)
			{
				TRACE(_T("GetResourceString failed\n"));
				break ;
			}
			aSedAppAccess[i].PermissionTitle = pszPermName;
		}
		if (i < cArrayItems)
		{
			TRACE(_T("failed to get all share permission names\n"));
			break ;
		}

		SED_APPLICATION_ACCESSES sedAppAccesses ;
		sedAppAccesses.Count		   = cArrayItems ;
		sedAppAccesses.AccessGroup	   = aSedAppAccess ;
		sedAppAccesses.DefaultPermName = (LPWSTR) (LPCWSTR) strDefaultPermName;

		/*
		 * pass this along so when the call back function is called,
		 * we can set it.
		 */
		SHARE_CALLBACK_INFO callbackinfo ;
		callbackinfo.pSecDesc			= NULL;
		callbackinfo.bSecDescModified	= FALSE;
		callbackinfo.pszClusterNameNode = pszClusterNameNode;

		//
		// Now, load up the ACL editor and invoke it. We don't keep it around
		// because our DLL is loaded whenever the system is, so we don't want
		// the netui*.dll's hanging around as well...
		//

		HINSTANCE hInstanceAclEditor = NULL;
		SedDiscretionaryAclEditorType pAclEditor = NULL;

		hInstanceAclEditor = LoadLibrary(ACLEDIT_DLL_STRING);


		if (NULL == hInstanceAclEditor)
		{
			err = GetLastError();
			TRACE(_T("LoadLibrary of acledit.dll failed, 0x%08lx\n"), err);
			break;
		}

		pAclEditor = (SedDiscretionaryAclEditorType) GetProcAddress(
														hInstanceAclEditor,
														SEDDISCRETIONARYACLEDITOR_STRING
														);
		if ( pAclEditor == NULL )
		{
			err = GetLastError();
			TRACE(_T("GetProcAddress of SedDiscretionaryAclEditorType failed, 0x%08lx\n"), err);
			break;
		}

#ifdef MAPBITS
		MapBitsInSD( pSecDesc, SPECIFIC_TO_GENERIC );
#endif

		DWORD dwSedReturnStatus ;

		ASSERT(pAclEditor != NULL);
		err = (*pAclEditor)(
						hwndParent,
						AfxGetInstanceHandle(),
						(LPTSTR) pszServerName,
						&sedObjDesc,
						&sedAppAccesses,
						(LPTSTR) pszShareName,
						SedCallback,
						(ULONG) &callbackinfo,
						pSecDesc,
						FALSE, // always can read
						FALSE, // if we can read, we can write
						(LPDWORD) &dwSedReturnStatus,
						0
						);


		if (pSecDesc != NULL)
		{
#ifdef MAPBITS
			MapBitsInSD( pSecDesc, GENERIC_TO_SPECIFIC );
#endif
			ASSERT(IsValidSecurityDescriptor(pSecDesc));
		}  // if:  no security descriptor returned

		if (!FreeLibrary(hInstanceAclEditor))
		{
			LONG err2 = GetLastError();
			TRACE(_T("FreeLibrary of acledit.dll failed, 0x%08lx\n"), err2);
			// not fatal: continue...
		}

		if (0 != err)
		{
			TRACE(_T("SedDiscretionaryAclEditor failed, 0x%08lx\n"), err);
			break ;
		}

		*pbSecDescModified = callbackinfo.bSecDescModified ;

		if (*pbSecDescModified)
		{
			*ppSecDesc = callbackinfo.pSecDesc;
#ifdef MAPBITS
			MapBitsInSD( *ppSecDesc, GENERIC_TO_SPECIFIC );
#endif
			TRACE(_T("After calling acl editor, *ppSecDesc = 0x%08lx\n"), *ppSecDesc);
			ASSERT(IsValidSecurityDescriptor(*ppSecDesc));
		}

	} while (FALSE) ;

	//
	// Free memory...
	//

	UINT cArrayItems  = ARRAYLEN(g_SedAppAccessSharePerms);
	PSED_APPLICATION_ACCESS aSedAppAccess = g_SedAppAccessSharePerms ;
	for ( UINT i = 0 ; i < cArrayItems ; i++ )
	{
		pszPermName = aSedAppAccess[i].PermissionTitle;
		if (NULL == pszPermName)
		{
			// if we hit a NULL, that's it!
			break ;
		}

		delete[] pszPermName;
	}

	if (bCreatedDefaultSecDesc)
	{
		DeleteDefaultSecDesc(pSecDesc);
	}

	ASSERT(!*pbSecDescModified || IsValidSecurityDescriptor(*ppSecDesc));

	if (0 != err)
	{
		CString 	strCaption;
		CString 	strMsg;

		try
		{
			strCaption.LoadString(IDS_MSGTITLE);
			strMsg.LoadString(IDS_NOACLEDITOR);
			MessageBox(hwndParent, strMsg, strCaption, MB_OK | MB_ICONSTOP);
		}  // try
		catch (CException * pe)
		{
			pe->Delete();
		};
	}

	return err;

}  //*** EditShareAcl()



BOOL BLocalAccountsInSD(PSECURITY_DESCRIPTOR pSD, LPCTSTR pszClusterNameNode)
{
/*++

Routine Description:

	Determines if any ACEs for local accounts are in DACL stored in
	Security Descriptor (pSD) after the ACL editor has been called

	Added this function in order to prevent users from selecting local accounts in 
	permissions dialog.
	Rod Sharper 04/29/97

Arguments:

	pSD - Security Descriptor to be checked.

Return Value:

	TRUE if at least one ACE was removed from the DACL, False otherwise.

--*/
	PACL					paclDACL			= NULL;
	BOOL					bHasDACL			= FALSE;
	BOOL					bDaclDefaulted		= FALSE;
	BOOL					bLocalAccountInACL	= FALSE;
	BOOL					bRtn				= FALSE;

	ACL_SIZE_INFORMATION	asiAclSize;
	DWORD					dwBufLength;
	DWORD					dwACL_Index = 0L;
	ACCESS_ALLOWED_ACE *	paaAllowedAce;
	TCHAR					szUserName[128];
	TCHAR					szDomainName[128];
	DWORD					cbUser	= 128;
	DWORD					cbDomain	= 128;
	SID_NAME_USE			SidType;
	PUCHAR					pnSubAuthorityCount;
	PULONG					pnSubAuthority0;
	PULONG					pnSubAuthority1;

	bRtn = IsValidSecurityDescriptor(pSD);
	ASSERT(bRtn);
	if( !bRtn )
		return FALSE;

	bRtn = GetSecurityDescriptorDacl(
									pSD,
									(LPBOOL)&bHasDACL,
									(PACL *)&paclDACL,
									(LPBOOL)&bDaclDefaulted);
	ASSERT(bRtn);
	if( !bRtn )
		return FALSE;
 
	if (NULL == paclDACL)
		return FALSE;

	bRtn = IsValidAcl(paclDACL);
	ASSERT(bRtn);
	if( !bRtn )
		return FALSE;

	dwBufLength = sizeof(asiAclSize);

	bRtn = GetAclInformation(
							paclDACL,
							(LPVOID)&asiAclSize,
							(DWORD)dwBufLength,
							(ACL_INFORMATION_CLASS)AclSizeInformation);
	ASSERT(bRtn);
	if( !bRtn )
		return FALSE;

	// Search the ACL for local account ACEs 
	//
	PSID pSID;
	while( dwACL_Index < asiAclSize.AceCount )
	{
		if (!GetAce(paclDACL, dwACL_Index, (LPVOID *)&paaAllowedAce))
		{
			ASSERT(FALSE);
			return FALSE; 
		}
		if((((PACE_HEADER)paaAllowedAce)->AceType) == ACCESS_ALLOWED_ACE_TYPE)
		{
			//
			//Get SID from ACE
			//

			pSID=(PSID)&((PACCESS_ALLOWED_ACE)paaAllowedAce)->SidStart;
	
			cbUser		= 128;
			cbDomain	= 128;
			if (LookupAccountSid(NULL,
								 pSID,
								 szUserName,
								 &cbUser,
								 szDomainName,
								 &cbDomain,
								 &SidType))
			{
				if (lstrcmpi(szDomainName, _T("BUILTIN")) == 0)
				{
					pnSubAuthorityCount = GetSidSubAuthorityCount( pSID );
					if ( (pnSubAuthorityCount != NULL) && (*pnSubAuthorityCount == 2) )
					{
						// Check to see if this is the local Administrators group.
						pnSubAuthority0 = GetSidSubAuthority( pSID, 0 );
						pnSubAuthority1 = GetSidSubAuthority( pSID, 1 );
						if (   (pnSubAuthority0 == NULL)
							|| (pnSubAuthority1 == NULL)
							|| (   (*pnSubAuthority0 != SECURITY_BUILTIN_DOMAIN_RID)
								&& (*pnSubAuthority1 != SECURITY_BUILTIN_DOMAIN_RID))
							|| (   (*pnSubAuthority0 != DOMAIN_ALIAS_RID_ADMINS)
								&& (*pnSubAuthority1 != DOMAIN_ALIAS_RID_ADMINS)))
						{
							bLocalAccountInACL = TRUE;
							break;
						}  // if:  not the local Administrators group
					}  // if:  exactly 2 sub-authorities
					else
					{
						bLocalAccountInACL = TRUE;
						break;
					}  // else:  unexpected # of sub-authorities
				}  // if:  built-in user or group
				else if (  (lstrcmpi(szDomainName, pszClusterNameNode) == 0)
						&& (SidType != SidTypeDomain) )
				{
					// The domain name is the name of the node on which the
					// cluster name resource is online, so this is a local
					// user or group.
					bLocalAccountInACL = TRUE;
					break;
				}  // else if:	domain is cluster name resource node and not a Domain SID
			}  // if:  LookupAccountSid succeeded
			else
			{
				// If LookupAccountSid failed, assume that the SID is for
				// a user or group that is local to a machine to which we
				// don't have access.
				bLocalAccountInACL = TRUE;
				break;
			}  // else:  LookupAccountSid failed
		}
		dwACL_Index++;
	}

	return bLocalAccountInACL;

}  //*** BLocalAccountsInSD()


//+-------------------------------------------------------------------------
//
//	Function:	SedCallback
//
//	Synopsis:	Security Editor callback for the SHARE ACL Editor
//
//	Arguments:	See sedapi.h
//
//	History:
//		  ChuckC   10-Aug-1992	Created
//		  BruceFo  4-Apr-95 	Stole and used in ntshrui.dll
//		  DavidP   10-Oct-1996	Modified for use with CLUADMIN
//
//--------------------------------------------------------------------------

DWORD
SedCallback(
	HWND					hwndParent,
	HANDLE					hInstance,
	ULONG					ulCallbackContext,
	PSECURITY_DESCRIPTOR	pSecDesc,
	PSECURITY_DESCRIPTOR	pSecDescNewObjects,
	BOOLEAN 				fApplyToSubContainers,
	BOOLEAN 				fApplyToSubObjects,
	LPDWORD 				StatusReturn
	)
{
	SHARE_CALLBACK_INFO * pCallbackInfo = (SHARE_CALLBACK_INFO *)ulCallbackContext;

	TRACE(_T("SedCallback, got pSecDesc = 0x%08lx\n"), pSecDesc);

	ASSERT(pCallbackInfo != NULL);
	ASSERT(IsValidSecurityDescriptor(pSecDesc));

	if ( BLocalAccountsInSD(pSecDesc, pCallbackInfo->pszClusterNameNode) )
	{
		CString strMsg;
		strMsg.LoadString(IDS_LOCAL_ACCOUNTS_SPECIFIED);
		AfxMessageBox(strMsg, MB_OK | MB_ICONSTOP);
		return LOCAL_ACCOUNTS_FILTERED;
	}  // if:  local users or groups were specified


	ASSERT(pCallbackInfo != NULL);

	delete[] (BYTE*)pCallbackInfo->pSecDesc;
	pCallbackInfo->pSecDesc 		= CopySecurityDescriptor(pSecDesc);
	pCallbackInfo->bSecDescModified = TRUE;

	ASSERT(IsValidSecurityDescriptor(pCallbackInfo->pSecDesc));
	TRACE(_T("SedCallback, return pSecDesc = 0x%08lx\n"), pCallbackInfo->pSecDesc);

	return NOERROR;

}  //*** SedCallback()


//+-------------------------------------------------------------------------
//
//	Function:	InitializeShareGenericMapping
//
//	Synopsis:	Initializes the passed generic mapping structure for shares.
//
//	Arguments:	[pSHAREGenericMapping] - Pointer to GENERIC_MAPPING to be init.
//
//	History:
//		  ChuckC   10-Aug-1992	Created. Culled from NTFS ACL code.
//		  BruceFo  4-Apr-95 	Stole and used in ntshrui.dll
//		  DavidP   10-Oct-1996	Modified for use with CLUADMIN
//
//--------------------------------------------------------------------------

VOID
InitializeShareGenericMapping(
	IN OUT PGENERIC_MAPPING pSHAREGenericMapping
	)
{
	TRACE(_T("InitializeShareGenericMapping\n"));
 
	pSHAREGenericMapping->GenericRead	 = GENERIC_READ;
	pSHAREGenericMapping->GenericWrite	 = GENERIC_WRITE;
	pSHAREGenericMapping->GenericExecute = GENERIC_EXECUTE;
	pSHAREGenericMapping->GenericAll	 = GENERIC_ALL;

}  //*** InitializeShareGenericMapping()


//+-------------------------------------------------------------------------
//
//	Function:	CreateDefaultSecDesc
//
//	Synopsis:	Create a default ACL for either a new share or for
//				a share that doesn't exist.
//
//	Arguments:	[ppSecDesc] - *ppSecDesc points to a "world all" access
//					security descriptor on exit. Caller is responsible for
//					freeing it.
//
//	Returns:	NERR_Success if OK, api error otherwise.
//
//	History:
//		  ChuckC   10-Aug-1992	Created. Culled from NTFS ACL code.
//		  BruceFo  4-Apr-95 	Stole and used in ntshrui.dll
//		  DavidP   10-Oct-1996	Modified for use with CLUADMIN
//
//--------------------------------------------------------------------------

LONG
CreateDefaultSecDesc(
	OUT PSECURITY_DESCRIPTOR* ppSecDesc
	)
{
	TRACE(_T("CreateDefaultSecDesc\n"));

	ASSERT(ppSecDesc != NULL) ;
	ASSERT(*ppSecDesc == NULL) ;

	LONG					err = NERR_Success;
	PSECURITY_DESCRIPTOR	pSecDesc = NULL;
	PACL					pAcl = NULL;
	DWORD					cbAcl;
	PSID					pSid = NULL;

	*ppSecDesc = NULL;

	do		  // error breakout
	{
		// First, create a world SID. Next, create an access allowed
		// ACE with "Generic All" access with the world SID. Put the ACE in
		// the ACL and the ACL in the security descriptor.

		SID_IDENTIFIER_AUTHORITY IDAuthorityWorld = SECURITY_WORLD_SID_AUTHORITY;

		if (!AllocateAndInitializeSid(
					&IDAuthorityWorld,
					1,
					SECURITY_WORLD_RID,
					0, 0, 0, 0, 0, 0, 0,
					&pSid))
		{
			err = GetLastError();
			TRACE(_T("AllocateAndInitializeSid failed, 0x%08lx\n"), err);
			break;
		}

		ASSERT(IsValidSid(pSid));

		cbAcl = sizeof(ACL)
			  + (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD))
			  + GetLengthSid(pSid)
			  ;

		try
		{
			pAcl = (PACL) new BYTE[cbAcl];
		}  // try
		catch (CMemoryException * pme)
		{
			err = ERROR_OUTOFMEMORY;
			TRACE(_T("new ACL failed\n"));
			pme->Delete();
			break;
		}  // catch:  CMemoryException

		if (!InitializeAcl(pAcl, cbAcl, ACL_REVISION2))
		{
			err = GetLastError();
			TRACE(_T("InitializeAcl failed, 0x%08lx\n"), err);
			break;
		}

		if (!AddAccessAllowedAce(
					pAcl,
					ACL_REVISION2,
					FILE_PERM_ALL,
					pSid))
		{
			err = GetLastError();
			TRACE(_T("AddAccessAllowedAce failed, 0x%08lx\n"), err);
			break;
		}

		ASSERT(IsValidAcl(pAcl));

		try
		{
			pSecDesc = (PSECURITY_DESCRIPTOR) new BYTE[SECURITY_DESCRIPTOR_MIN_LENGTH];
		}  // try
		catch (CMemoryException * pme)
		{
			err = ERROR_OUTOFMEMORY;
			TRACE(_T("new SECURITY_DESCRIPTOR failed\n"));
			pme->Delete();
			break;
		}  // catch:  CMemoryException

		if (!InitializeSecurityDescriptor(
					pSecDesc,
					SECURITY_DESCRIPTOR_REVISION1))
		{
			err = GetLastError();
			TRACE(_T("InitializeSecurityDescriptor failed, 0x%08lx\n"), err);
			break;
		}

		if (!SetSecurityDescriptorDacl(
					pSecDesc,
					TRUE,
					pAcl,
					FALSE))
		{
			err = GetLastError();
			TRACE(_T("SetSecurityDescriptorDacl failed, 0x%08lx\n"), err);
			break;
		}

		ASSERT(IsValidSecurityDescriptor(pSecDesc));

		// Make the security descriptor self-relative

		DWORD dwLen = GetSecurityDescriptorLength(pSecDesc);
		TRACE(_T("SECURITY_DESCRIPTOR length = %d\n"), dwLen);

		PSECURITY_DESCRIPTOR pSelfSecDesc = NULL;
		try
		{
			pSelfSecDesc = (PSECURITY_DESCRIPTOR) new BYTE[dwLen];
		}  // try
		catch (CMemoryException * pme)
		{
			err = ERROR_OUTOFMEMORY;
			TRACE(_T("new SECURITY_DESCRIPTOR (2) failed\n"));
			pme->Delete();
			break;
		}  // catch:  CMemoryException

		DWORD cbSelfSecDesc = dwLen;
		if (!MakeSelfRelativeSD(pSecDesc, pSelfSecDesc, &cbSelfSecDesc))
		{
			err = GetLastError();
			TRACE(_T("MakeSelfRelativeSD failed, 0x%08lx\n"), err);
			break;
		}

		ASSERT(IsValidSecurityDescriptor(pSelfSecDesc));

		//
		// all done: set the security descriptor
		//

		*ppSecDesc = pSelfSecDesc;

	} while (FALSE) ;

	if (NULL != pSid)
	{
		FreeSid(pSid);
	}
	delete[] (BYTE*)pAcl;
	delete[] (BYTE*)pSecDesc;

	ASSERT(IsValidSecurityDescriptor(*ppSecDesc));

	return err;

}  //*** CreateDefaultSecDesc()


//+-------------------------------------------------------------------------
//
//	Function:	DeleteDefaultSecDesc
//
//	Synopsis:	Delete a security descriptor that was created by
//				CreateDefaultSecDesc
//
//	Arguments:	[pSecDesc] - security descriptor to delete
//
//	Returns:	nothing
//
//	History:
//		  BruceFo  4-Apr-95 	Created
//		  DavidP   10-Oct-1996	Modified for use with CLUADMIN
//
//--------------------------------------------------------------------------

VOID
DeleteDefaultSecDesc(
	IN PSECURITY_DESCRIPTOR pSecDesc
	)
{
	TRACE(_T("DeleteDefaultSecDesc\n"));

	delete[] (BYTE*)pSecDesc;

}  //*** DeleteDefaultSecDesc()


//+-------------------------------------------------------------------------
//
//	Member: 	CopySecurityDescriptor, public
//
//	Synopsis:	Copy an NT security descriptor. The security descriptor must
//				be in self-relative (not absolute) form. Delete the result
//				using "delete[] (BYTE*)pSecDesc".
//
//	History:	19-Apr-95	BruceFo 	Created
//				10-Oct-1996 DavidP		Modified for use with CLUADMIN
//
//--------------------------------------------------------------------------

PSECURITY_DESCRIPTOR
CopySecurityDescriptor(
	IN PSECURITY_DESCRIPTOR pSecDesc
	)
{
	TRACE(_T("CopySecurityDescriptor, pSecDesc = 0x%08lx\n"), pSecDesc);

	if (NULL == pSecDesc)
	{
		return NULL;
	}

	ASSERT(IsValidSecurityDescriptor(pSecDesc));

	DWORD dwLen = GetSecurityDescriptorLength(pSecDesc);
	PSECURITY_DESCRIPTOR pSelfSecDesc = NULL;
	try
	{
		pSelfSecDesc = (PSECURITY_DESCRIPTOR) new BYTE[dwLen];
	}
	catch (CMemoryException * pme)
	{
		TRACE(_T("new SECURITY_DESCRIPTOR (2) failed\n"));
		pme->Delete();
		return NULL;	// actually, should probably return an error
	}  // catch:  CMemoryException

	DWORD cbSelfSecDesc = dwLen;
	if (!MakeSelfRelativeSD(pSecDesc, pSelfSecDesc, &cbSelfSecDesc))
	{
		TRACE(_T("MakeSelfRelativeSD failed, 0x%08lx\n"), GetLastError());

		// assume it failed because it was already self-relative
		CopyMemory(pSelfSecDesc, pSecDesc, dwLen);
	}

	ASSERT(IsValidSecurityDescriptor(pSelfSecDesc));

	return pSelfSecDesc;

}  //*** CopySecurityDescriptor()


//+---------------------------------------------------------------------------
//
//	Function:	GetResourceString
//
//	Synopsis:	Load a resource string, are return a "new"ed copy
//
//	Arguments:	[dwId] -- a resource string ID
//
//	Returns:	new memory copy of a string
//
//	History:	5-Apr-95	BruceFo Created
//				10-Oct-1996 DavidP	Modified for CLUADMIN
//
//----------------------------------------------------------------------------

PWSTR
GetResourceString(
	IN DWORD dwId
	)
{
	CString str;

	if (str.LoadString(dwId))
		return NewDup(str);
	else
		return NULL;

}  //*** GetResourceString()


//+---------------------------------------------------------------------------
//
//	Function:	NewDup
//
//	Synopsis:	Duplicate a string using '::new'
//
//	History:	28-Dec-94	BruceFo   Created
//				10-Oct-1996 DavidP	  Modified for CLUADMIN
//
//----------------------------------------------------------------------------

PWSTR
NewDup(
	IN const WCHAR* psz
	)
{
	PWSTR pszRet = NULL;

	if (NULL == psz)
	{
		TRACE(_T("Illegal string to duplicate: NULL\n"));
		return NULL;
	}

	try
	{
		pszRet = new WCHAR[wcslen(psz) + 1];
	}
	catch (CMemoryException * pme)
	{
		TRACE(_T("OUT OF MEMORY\n"));
		pme->Delete();
		return NULL;
	}  // catch:  CMemoryException

	wcscpy(pszRet, psz);
	return pszRet;

}  //*** NewDup()

//+-------------------------------------------------------------------------
//
//	Function:	MapBitsInSD
//
//	Synopsis:	Maps Specific bits to Generic bit when MAP_DIRECTION is SPECIFIC_TO_GENERIC 
//				Maps Generic bits to Specific bit when MAP_DIRECTION is GENERIC_TO_SPECIFIC

//
//	Arguments:	[pSecDesc] - SECURITY_DESCIRPTOR to be modified
//				[direction] - indicates whether bits are mapped from specific to generic 
//							  or generic to specific.
//	Author:
//		Roderick Sharper (rodsh) April 12, 1997
//
//	History:
//
//--------------------------------------------------------------------------

BOOL MapBitsInSD(PSECURITY_DESCRIPTOR pSecDesc, MAP_DIRECTION direction)
{

	PACL	paclDACL		= NULL;
	BOOL	bHasDACL		= FALSE;
	BOOL	bDaclDefaulted	= FALSE;
	BOOL	bRtn			= FALSE;

	if (!IsValidSecurityDescriptor(pSecDesc))
		return FALSE; 


	if (!GetSecurityDescriptorDacl(pSecDesc,
				 (LPBOOL)&bHasDACL,
				 (PACL *)&paclDACL,
				 (LPBOOL)&bDaclDefaulted))
		return FALSE; 

 
	if (paclDACL)
		bRtn = MapBitsInACL(paclDACL, direction);

 return bRtn;
}


//+-------------------------------------------------------------------------
//
//	Function:	MapBitsInACL
//
//	Synopsis:	Maps Specific bits to Generic bit when MAP_DIRECTION is SPECIFIC_TO_GENERIC 
//				Maps Generic bits to Specific bit when MAP_DIRECTION is GENERIC_TO_SPECIFIC
//
//
//	Arguments:	[paclACL] - ACL (Access Control List) to be modified
//				[direction] - indicates whether bits are mapped from specific to generic 
//							  or generic to specific.
//	Author:
//		Roderick Sharper (rodsh) May 02, 1997
//
//	History:
//
//--------------------------------------------------------------------------

BOOL MapBitsInACL(PACL paclACL, MAP_DIRECTION direction)
{
	ACL_SIZE_INFORMATION		asiAclSize;
	BOOL						bRtn = FALSE;
	DWORD						dwBufLength;
	DWORD						dwACL_Index;
	ACCESS_ALLOWED_ACE	 *paaAllowedAce;

	if (!IsValidAcl(paclACL))
		return FALSE; 

	dwBufLength = sizeof(asiAclSize);

	if (!GetAclInformation(paclACL,
			 (LPVOID)&asiAclSize,
			 (DWORD)dwBufLength,
			 (ACL_INFORMATION_CLASS)AclSizeInformation))
		return FALSE; 

	for (dwACL_Index = 0; dwACL_Index < asiAclSize.AceCount;  dwACL_Index++)
	{
		if (!GetAce(paclACL,
			dwACL_Index,
			(LPVOID *)&paaAllowedAce))
		return FALSE; 

		if( direction == SPECIFIC_TO_GENERIC )
			bRtn = MapSpecificBitsInAce( paaAllowedAce );
		else if( direction == GENERIC_TO_SPECIFIC )
			bRtn = MapGenericBitsInAce( paaAllowedAce );
		else
			bRtn = FALSE;
	}

	return bRtn;
}


//+-------------------------------------------------------------------------
//
//	Function:	MapSpecificBitsInAce  
//
//	Synopsis:	Maps specific bits in ACE to generic bits
//
//	Arguments:	[paaAllowedAce] - ACE (Access Control Entry) to be modified
//				[direction] 	- indicates whether bits are mapped from specific to generic 
//								  or generic to specific.
//	Author:
//		Roderick Sharper (rodsh) May 02, 1997
//
//	History:
//
//--------------------------------------------------------------------------

BOOL MapSpecificBitsInAce(PACCESS_ALLOWED_ACE paaAllowedAce)
{
	ACCESS_MASK amMask = paaAllowedAce->Mask;
	BOOL bRtn = FALSE;

	DWORD dwGenericBits;
	DWORD dwSpecificBits;

	dwSpecificBits			  = (amMask & SPECIFIC_RIGHTS_ALL);
	dwGenericBits			  = 0;

	switch( dwSpecificBits )
	{
		case CLUSAPI_READ_ACCESS:	dwGenericBits = GENERIC_READ;	// GENERIC_READ  == 0x80000000L 
									bRtn = TRUE;
									break;

		case CLUSAPI_CHANGE_ACCESS: dwGenericBits = GENERIC_WRITE;	// GENERIC_WRITE == 0x40000000L 
									bRtn = TRUE;
									break;
		
		case CLUSAPI_NO_ACCESS: 	dwGenericBits = GENERIC_EXECUTE;// GENERIC_EXECUTE == 0x20000000L 
									bRtn = TRUE;
									break;
		
		case CLUSAPI_ALL_ACCESS:	dwGenericBits = GENERIC_ALL;	// GENERIC_ALL	 == 0x10000000L
									bRtn = TRUE;
									break;
		
		default:	dwGenericBits = 0x00000000L;	// Invalid,assign no rights. 
									bRtn = FALSE;
									break;
	}

	amMask = dwGenericBits;
	paaAllowedAce->Mask = amMask;

	return bRtn;
}

//+-------------------------------------------------------------------------
//
//	Function:	MapGenericBitsInAce  
//
//	Synopsis:	Maps generic bits in ACE to specific bits
//
//	Arguments:	[paaAllowedAce] - ACE (Access Control Entry) to be modified
//				[direction] 	- indicates whether bits are mapped from specific to generic 
//								  or generic to specific.
//	Author:
//		Roderick Sharper (rodsh) May 02, 1997
//
//	History:
//
//--------------------------------------------------------------------------

BOOL MapGenericBitsInAce  (PACCESS_ALLOWED_ACE paaAllowedAce)
{
	#define GENERIC_RIGHTS_ALL_THE_BITS  0xF0000000L

	ACCESS_MASK amMask = paaAllowedAce->Mask;
	BOOL bRtn = FALSE;

	DWORD dwGenericBits;
	DWORD dwSpecificBits;

	dwSpecificBits			  = 0;
	dwGenericBits			  = (amMask & GENERIC_RIGHTS_ALL_THE_BITS);

		switch( dwGenericBits )
	{
		case GENERIC_ALL:		dwSpecificBits = CLUSAPI_ALL_ACCESS;	// CLUSAPI_ALL_ACCESS		== 3 
								bRtn = TRUE;
								break;
								
		case GENERIC_EXECUTE:	dwSpecificBits = CLUSAPI_NO_ACCESS; 	// CLUSAPI_NO_ACCESS		== 4
								bRtn = TRUE;
								break;

		case GENERIC_WRITE: 	dwSpecificBits = CLUSAPI_CHANGE_ACCESS; // CLUSAPI_CHANGE_ACCESS	== 2
								bRtn = TRUE;
								break;
								
		case GENERIC_READ:		dwSpecificBits = CLUSAPI_READ_ACCESS;	// CLUSAPI_READ_ACCESS		== 1
								bRtn = TRUE;
								break;
		
		default:				dwSpecificBits = 0x00000000L;			// Invalid, assign no rights. 
								bRtn = FALSE;
								break;
	}						

	amMask = dwSpecificBits;
	paaAllowedAce->Mask = amMask;

	return bRtn;
}