windows-xp/Source/XPSP1/NT/base/screg/sc/server/scsec.cxx

/*++

Copyright (c) 1992  Microsoft Corporation

Module Name:

    scsec.cxx

Abstract:

    This module contains security related routines:
        RQueryServiceObjectSecurity
        RSetServiceObjectSecurity
        ScCreateScManagerObject
        ScCreateScServiceObject
        ScGrantAccess
        ScPrivilegeCheckAndAudit
        ScAccessValidate
        ScAccessCheckAndAudit
        ScGetPrivilege
        ScReleasePrivilege

Author:

    Rita Wong (ritaw)     10-Mar-1992

Environment:

    Calls NT native APIs.

Revision History:

    10-Mar-1992     ritaw
        created
    16-Apr-1992     JohnRo
        Process services which are marked for delete accordingly.
    06-Aug-1992     Danl
        Fixed a debug print statement.  It indicated it was from the
        ScLoadDeviceDriver function - rather than in ScGetPrivilege.
    21-Jan-1995     AnirudhS
        Added ScGrantAccess and ScPrivilegeCheckAndAudit.
--*/

#include "precomp.hxx"
#include "scconfig.h"   // ScOpenServiceConfigKey
#include "scsec.h"      // Object names and security functions
#include "control.h"    // SERVICE_SET_STATUS
#include "account.h"    // ScLookupServiceAccount
#include "align.h"      // ROUND_UP_COUNT


#define PRIVILEGE_BUF_SIZE  512


//-------------------------------------------------------------------//
//                                                                   //
// Static global variables                                           //
//                                                                   //
//-------------------------------------------------------------------//

//
// Security descriptor of the SCManager objects to control user accesses
// to the Service Control Manager and its database.
//
PSECURITY_DESCRIPTOR ScManagerSd;

//
// Structure that describes the mapping of Generic access rights to
// object specific access rights for the ScManager object.
//
GENERIC_MAPPING ScManagerObjectMapping = {

    STANDARD_RIGHTS_READ             |     // Generic read
        SC_MANAGER_ENUMERATE_SERVICE |
        SC_MANAGER_QUERY_LOCK_STATUS,

    STANDARD_RIGHTS_WRITE         |        // Generic write
        SC_MANAGER_CREATE_SERVICE |
        SC_MANAGER_MODIFY_BOOT_CONFIG,

    STANDARD_RIGHTS_EXECUTE |              // Generic execute
        SC_MANAGER_CONNECT  |
        SC_MANAGER_LOCK,

    SC_MANAGER_ALL_ACCESS                  // Generic all
    };

//
// Structure that describes the mapping of generic access rights to
// object specific access rights for the Service object.
//
GENERIC_MAPPING ScServiceObjectMapping = {

    STANDARD_RIGHTS_READ             |     // Generic read
        SERVICE_QUERY_CONFIG         |
        SERVICE_QUERY_STATUS         |
        SERVICE_ENUMERATE_DEPENDENTS |
        SERVICE_INTERROGATE,

    STANDARD_RIGHTS_WRITE     |            // Generic write
        SERVICE_CHANGE_CONFIG,

    STANDARD_RIGHTS_EXECUTE    |           // Generic execute
        SERVICE_START          |
        SERVICE_STOP           |
        SERVICE_PAUSE_CONTINUE |
        SERVICE_USER_DEFINED_CONTROL,

    SERVICE_ALL_ACCESS                     // Generic all
    };


//-------------------------------------------------------------------//
//                                                                   //
// Functions                                                         //
//                                                                   //
//-------------------------------------------------------------------//

DWORD
RQueryServiceObjectSecurity(
    IN  SC_RPC_HANDLE hService,
    IN  SECURITY_INFORMATION dwSecurityInformation,
    OUT LPBYTE lpSecurityDescriptor,
    IN  DWORD cbBufSize,
    OUT LPDWORD pcbBytesNeeded
    )
/*++

Routine Description:

    This is the worker function for QueryServiceObjectSecurity API.
    It returns the security descriptor information of a service
    object.

Arguments:

    hService - Supplies the context handle to an existing service object.

    dwSecurityInformation - Supplies the bitwise flags describing the
        security information being queried.

    lpSecurityInformation - Supplies the output buffer from the user
        which security descriptor information will be written to on
        return.

    cbBufSize - Supplies the size of lpSecurityInformation buffer.

    pcbBytesNeeded - Returns the number of bytes needed of the
        lpSecurityInformation buffer to get all the requested
        information.

Return Value:

    NO_ERROR - The operation was successful.

    ERROR_INVALID_HANDLE - The specified handle was invalid.

    ERROR_ACCESS_DENIED - The specified handle was not opened for
        either READ_CONTROL or ACCESS_SYSTEM_SECURITY
        access.

    ERROR_INVALID_PARAMETER - The dwSecurityInformation parameter is
        invalid.

    ERROR_INSUFFICIENT_BUFFER - The specified output buffer is smaller
        than the required size returned in pcbBytesNeeded.  None of
        the security descriptor is returned.

Note:

    It is expected that the RPC Stub functions will find the following
    parameter problems:

        Bad pointers for lpSecurityDescriptor, and pcbBytesNeeded.

--*/
{
    NTSTATUS ntstatus;
    ACCESS_MASK DesiredAccess = 0;
    PSECURITY_DESCRIPTOR ServiceSd;
    DWORD ServiceSdSize = 0;


    //
    // Check the handle.
    //
    if (!ScIsValidServiceHandle(hService))
    {
        return ERROR_INVALID_HANDLE;
    }

    //
    // Check the validity of dwSecurityInformation
    //
    if ((dwSecurityInformation == 0) ||
        ((dwSecurityInformation &
          (OWNER_SECURITY_INFORMATION |
           GROUP_SECURITY_INFORMATION |
           DACL_SECURITY_INFORMATION  |
           SACL_SECURITY_INFORMATION)) != dwSecurityInformation))
    {

        return ERROR_INVALID_PARAMETER;
    }

    //
    // Set the desired access based on the requested SecurityInformation
    //
    if (dwSecurityInformation & SACL_SECURITY_INFORMATION) {
        DesiredAccess |= ACCESS_SYSTEM_SECURITY;
    }

    if (dwSecurityInformation & (DACL_SECURITY_INFORMATION  |
                                 OWNER_SECURITY_INFORMATION |
                                 GROUP_SECURITY_INFORMATION)) {
        DesiredAccess |= READ_CONTROL;
    }

    //
    // Was the handle opened for the requested access?
    //
    if (! RtlAreAllAccessesGranted(
              ((LPSC_HANDLE_STRUCT)hService)->AccessGranted,
              DesiredAccess
              )) {
        return ERROR_ACCESS_DENIED;
    }

    //
    //
    RtlZeroMemory(lpSecurityDescriptor, cbBufSize);

    //
    // Get the database lock for reading
    //
    CServiceRecordSharedLock RLock;

    //
    // The most up-to-date service security descriptor is always kept in
    // the service record.
    //
    ServiceSd =
        ((LPSC_HANDLE_STRUCT)hService)->Type.ScServiceObject.ServiceRecord->ServiceSd;


    //
    // Retrieve the appropriate security information from ServiceSd
    // and place it in the user supplied buffer.
    //
    ntstatus = RtlQuerySecurityObject(
                   ServiceSd,
                   dwSecurityInformation,
                   (PSECURITY_DESCRIPTOR) lpSecurityDescriptor,
                   cbBufSize,
                   &ServiceSdSize
                   );

    if (! NT_SUCCESS(ntstatus)) {

        if (ntstatus == STATUS_BAD_DESCRIPTOR_FORMAT) {

            //
            // Internal error: our security descriptor is bad!
            //
            SC_LOG0(ERROR,
                "RQueryServiceObjectSecurity: Our security descriptor is bad!\n");
            ASSERT(FALSE);
            return ERROR_GEN_FAILURE;

        }
        else if (ntstatus == STATUS_BUFFER_TOO_SMALL) {

            //
            // Return the required size to the user
            //
            *pcbBytesNeeded = ServiceSdSize;
            return ERROR_INSUFFICIENT_BUFFER;

        }
        else {
            return RtlNtStatusToDosError(ntstatus);
        }
    }

    //
    // Return the required size to the user
    //
    *pcbBytesNeeded = ServiceSdSize;

    return NO_ERROR;
}


DWORD
RSetServiceObjectSecurity(
    IN  SC_RPC_HANDLE hService,
    IN  SECURITY_INFORMATION dwSecurityInformation,
    IN  LPBYTE lpSecurityDescriptor,
    IN  DWORD cbBufSize
    )
/*++

Routine Description:

    This is the worker function for SetServiceObjectSecurity API.
    It modifies the security descriptor information of a service
    object.

Arguments:

    hService - Supplies the context handle to the service.

    dwSecurityInformation - Supplies the bitwise flags of security
        information being queried.

    lpSecurityInformation - Supplies a buffer which contains a
        well-formed self-relative security descriptor.

    cbBufSize - Supplies the size of lpSecurityInformation buffer.

Return Value:

    NO_ERROR - The operation was successful.

    ERROR_INVALID_HANDLE - The specified handle was invalid.

    ERROR_ACCESS_DENIED - The specified handle was not opened for
        either WRITE_OWNER, WRITE_DAC, or ACCESS_SYSTEM_SECURITY
        access.

    ERROR_INVALID_PARAMETER - The lpSecurityDescriptor or dwSecurityInformation
        parameter is invalid.

Note:

    It is expected that the RPC Stub functions will find the following
    parameter problems:

        Bad pointers for lpSecurityDescriptor.

--*/
{
    DWORD status;
    NTSTATUS ntstatus;
    RPC_STATUS rpcstatus;
    ACCESS_MASK DesiredAccess = 0;
    LPSERVICE_RECORD serviceRecord;
    HANDLE ClientTokenHandle = NULL;
    LPBYTE lpTempSD = lpSecurityDescriptor;


    UNREFERENCED_PARAMETER(cbBufSize);  // for RPC marshalling code

    //
    // Check the handle.
    //
    if (!ScIsValidServiceHandle(hService))
    {
        return ERROR_INVALID_HANDLE;
    }

    //
    // Silently ignore flags we don't understand that may come
    // from higher-level object managers.
    //
    dwSecurityInformation &= (OWNER_SECURITY_INFORMATION |
                                GROUP_SECURITY_INFORMATION |
                                DACL_SECURITY_INFORMATION  |
                                SACL_SECURITY_INFORMATION);

    if (dwSecurityInformation == 0)
    {
        return NO_ERROR;
    }


#ifdef _WIN64

    if (PtrToUlong(lpSecurityDescriptor) & (sizeof(PVOID) - 1))
    {
        //
        // SD isn't properly aligned.  Alloc an aligned heap buffer
        // and copy it in to fix things up.
        //

        lpTempSD = (LPBYTE) LocalAlloc(LMEM_FIXED, cbBufSize);

        if (lpTempSD == NULL)
        {
            status = ERROR_NOT_ENOUGH_MEMORY;
            goto CleanExit;
        }

        RtlCopyMemory(lpTempSD, lpSecurityDescriptor, cbBufSize);
    }

#endif // _WIN64
    

    //
    // Check the validity of lpSecurityInformation
    //
    if (! RtlValidRelativeSecurityDescriptor(
              (PSECURITY_DESCRIPTOR) lpTempSD,
              cbBufSize,
              dwSecurityInformation
              ))
    {
        status = ERROR_INVALID_PARAMETER;
        goto CleanExit;
    }

    //
    // Set the desired access based on the specified SecurityInformation
    //
    if (dwSecurityInformation & SACL_SECURITY_INFORMATION) {
        DesiredAccess |= ACCESS_SYSTEM_SECURITY;
    }

    if (dwSecurityInformation & (OWNER_SECURITY_INFORMATION |
                                 GROUP_SECURITY_INFORMATION)) {
        DesiredAccess |= WRITE_OWNER;
    }

    if (dwSecurityInformation & DACL_SECURITY_INFORMATION) {
        DesiredAccess |= WRITE_DAC;
    }

    //
    // Make sure the specified fields are present in the provided
    // security descriptor.
    // Security descriptors must have owner and group fields.
    //
    if (dwSecurityInformation & OWNER_SECURITY_INFORMATION)
    {
        if (((PISECURITY_DESCRIPTOR_RELATIVE) lpTempSD)->Owner == 0)
        {
            status = ERROR_INVALID_PARAMETER;
            goto CleanExit;
        }
    }

    if (dwSecurityInformation & GROUP_SECURITY_INFORMATION)
    {
        if (((PISECURITY_DESCRIPTOR_RELATIVE) lpTempSD)->Group == 0)
        {
            status = ERROR_INVALID_PARAMETER;
            goto CleanExit;
        }
    }

    //
    // Was the handle opened for the requested access?
    //
    if (! RtlAreAllAccessesGranted(
              ((LPSC_HANDLE_STRUCT)hService)->AccessGranted,
              DesiredAccess
              ))
    {
        status = ERROR_ACCESS_DENIED;
        goto CleanExit;
    }

    //
    // Is this service marked for delete?
    //
    serviceRecord =
        ((LPSC_HANDLE_STRUCT)hService)->Type.ScServiceObject.ServiceRecord;

    SC_ASSERT( serviceRecord != NULL );

    if (DELETE_FLAG_IS_SET(serviceRecord))
    {
        status = ERROR_SERVICE_MARKED_FOR_DELETE;
        goto CleanExit;
    }

    //
    // If caller wants to replace the owner, get a handle to the impersonation
    // token.
    //
    if (dwSecurityInformation & OWNER_SECURITY_INFORMATION)
    {
        if ((rpcstatus = RpcImpersonateClient(NULL)) != RPC_S_OK)
        {
            SC_LOG1(
                ERROR,
                "RSetServiceObjectSecurity: Failed to impersonate client " FORMAT_RPC_STATUS "\n",
                rpcstatus
                );

            ScLogEvent(
                NEVENT_CALL_TO_FUNCTION_FAILED,
                SC_RPC_IMPERSONATE,
                rpcstatus
                );

            status = rpcstatus;
            goto CleanExit;
        }

        ntstatus = NtOpenThreadToken(
                       NtCurrentThread(),
                       TOKEN_QUERY,
                       TRUE,              // OpenAsSelf
                       &ClientTokenHandle
                       );

        //
        // Stop impersonating the client
        //
        if ((rpcstatus = RpcRevertToSelf()) != RPC_S_OK) {
            SC_LOG1(
               ERROR,
               "RSetServiceObjectSecurity: Failed to revert to self " FORMAT_RPC_STATUS "\n",
               rpcstatus
               );

            ScLogEvent(
                NEVENT_CALL_TO_FUNCTION_FAILED,
                SC_RPC_REVERT,
                rpcstatus
                );

            ASSERT(FALSE);
            status = rpcstatus;
            goto CleanExit;
        }

        if (! NT_SUCCESS(ntstatus))
        {
            SC_LOG(ERROR,
                   "RSetServiceObjectSecurity: NtOpenThreadToken failed %08lx\n",
                   ntstatus);

            status = RtlNtStatusToDosError(ntstatus);
            goto CleanExit;
        }
    }

    {
        CServiceRecordExclusiveLock RLock;

        //
        // Replace the service security descriptor with the appropriate
        // security information specified in the caller supplied security
        // descriptor.  This routine may reallocate the memory needed to
        // contain the new service security descriptor.
        //
        ntstatus = RtlSetSecurityObject(
                       dwSecurityInformation,
                       (PSECURITY_DESCRIPTOR) lpTempSD,
                       &serviceRecord->ServiceSd,
                       &ScServiceObjectMapping,
                       ClientTokenHandle
                       );

        status = RtlNtStatusToDosError(ntstatus);

        if (! NT_SUCCESS(ntstatus))
        {
            SC_LOG1(ERROR,
                    "RSetServiceObjectSecurity: RtlSetSecurityObject failed %08lx\n",
                    ntstatus);
        }
        else
        {
            HKEY ServiceKey;

            //
            // Write new security descriptor to the registry
            //
            status = ScOpenServiceConfigKey(
                         serviceRecord->ServiceName,
                         KEY_WRITE,
                         FALSE,
                         &ServiceKey
                         );

            if (status == NO_ERROR)
            {
                status = ScWriteSd(
                             ServiceKey,
                             serviceRecord->ServiceSd
                             );

                if (status != NO_ERROR)
                {
                    SC_LOG1(ERROR,
                            "RSetServiceObjectSecurity: ScWriteSd failed %lu\n",
                            status);
                }

                ScRegFlushKey(ServiceKey);
                ScRegCloseKey(ServiceKey);
            }
        }
    }

CleanExit:

#ifdef _WIN64

    if (lpTempSD != lpSecurityDescriptor)
    {
        LocalFree(lpTempSD);
    }

#endif // _WIN64

    if (ClientTokenHandle != NULL)
    {
        NtClose(ClientTokenHandle);
    }

    return status;
}


DWORD
ScCreateScManagerObject(
    VOID
    )
/*++

Routine Description:

    This function creates the security descriptor which represents
    the ScManager object for both the "ServiceActive" and
    "ServicesFailed" databases.

Arguments:

    None.

Return Value:

    Returns values from calls to:
        ScCreateUserSecurityObject

--*/
{
    NTSTATUS ntstatus;
    ULONG Privilege = SE_SECURITY_PRIVILEGE;

    //
    // World has SC_MANAGER_CONNECT access and GENERIC_READ access.
    // Local admins are allowed GENERIC_ALL access.
    //
#define SC_MANAGER_OBJECT_ACES  5             // Number of ACEs in this DACL

    SC_ACE_DATA AceData[SC_MANAGER_OBJECT_ACES] = {
        {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
               SC_MANAGER_CONNECT |
               GENERIC_READ,                  &AuthenticatedUserSid},

        {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
               SC_MANAGER_CONNECT |
               GENERIC_READ |
               SC_MANAGER_MODIFY_BOOT_CONFIG, &LocalSystemSid},

        {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
               GENERIC_ALL,                   &AliasAdminsSid},

        {SYSTEM_AUDIT_ACE_TYPE, 0, FAILED_ACCESS_ACE_FLAG,
               GENERIC_ALL,                  &WorldSid},

        {SYSTEM_AUDIT_ACE_TYPE, INHERIT_ONLY_ACE | OBJECT_INHERIT_ACE,
               FAILED_ACCESS_ACE_FLAG,
               GENERIC_ALL,                  &WorldSid}
        };


    //
    // You need to have SE_SECURITY_PRIVILEGE privilege to create the SD with a
    // SACL
    //

    ntstatus = ScGetPrivilege(1, &Privilege);
    if (ntstatus != NO_ERROR) {
        SC_LOG1(ERROR, "ScCreateScManagerObject: ScGetPrivilege Failed %d\n",
            ntstatus);
        RevertToSelf();
        return(ntstatus);
    }

    ntstatus = ScCreateUserSecurityObject(
                   NULL,                        // Parent SD
                   AceData,
                   SC_MANAGER_OBJECT_ACES,
                   LocalSystemSid,
                   LocalSystemSid,
                   TRUE,                        // IsDirectoryObject
                   TRUE,                        // UseImpersonationToken
                   &ScManagerObjectMapping,
                   &ScManagerSd
                   );

#undef SC_MANAGER_OBJECT_ACES

    if (! NT_SUCCESS(ntstatus)) {
        SC_LOG(
            ERROR,
            "ScCreateScManagerObject: ScCreateUserSecurityObject failed " FORMAT_NTSTATUS "\n",
            ntstatus
            );
    }

    ScReleasePrivilege();

    return RtlNtStatusToDosError(ntstatus);
}


DWORD
ScCreateScServiceObject(
    OUT PSECURITY_DESCRIPTOR *ServiceSd
    )
/*++

Routine Description:

    This function creates the security descriptor which represents
    the Service object.

Arguments:

    ServiceSd - Returns service object security descriptor.

Return Value:

    Returns values from calls to:
        ScCreateUserSecurityObject

--*/
{
    NTSTATUS ntstatus;

    //
    // Authenticated users have read access.
    // Local system has service start/stop and all read access.
    // Power user has service start and all read access (Workstation and Server).
    // Admin and SystemOp (DC) are allowed all access.
    //

#define SC_SERVICE_OBJECT_ACES    4             // Number of ACEs in this DACL

    SC_ACE_DATA AceData[SC_SERVICE_OBJECT_ACES] = {

        {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
               GENERIC_READ | GENERIC_EXECUTE,
               &LocalSystemSid},

        {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
               GENERIC_ALL,
               &AliasAdminsSid},

        {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
               GENERIC_READ | SERVICE_USER_DEFINED_CONTROL,
               &AuthenticatedUserSid},

        {ACCESS_ALLOWED_ACE_TYPE, 0, 0,
               0,
               0}
        };

    switch(USER_SHARED_DATA->NtProductType)
    {
        case NtProductWinNt:
        case NtProductServer:

            //
            // Power users are only on Workstation and Server
            //
            AceData[SC_SERVICE_OBJECT_ACES - 1].Mask = GENERIC_READ | GENERIC_EXECUTE;
            AceData[SC_SERVICE_OBJECT_ACES - 1].Sid  = &AliasPowerUsersSid;
            break;

        case NtProductLanManNt:

            //
            // System Ops (Server Operators) are only on a DC
            //
            AceData[SC_SERVICE_OBJECT_ACES - 1].Mask = GENERIC_ALL;
            AceData[SC_SERVICE_OBJECT_ACES - 1].Sid  = &AliasSystemOpsSid;
            break;

        default:

            //
            // A new product type has been added -- add code to cover it
            //
            SC_ASSERT(FALSE);
            break;
    }

    ntstatus = ScCreateUserSecurityObject(
                   ScManagerSd,                // ParentSD
                   AceData,
                   SC_SERVICE_OBJECT_ACES,
                   LocalSystemSid,
                   LocalSystemSid,
                   FALSE,                       // IsDirectoryObject
                   FALSE,                       // UseImpersonationToken
                   &ScServiceObjectMapping,
                   ServiceSd
                   );

#undef SC_SERVICE_OBJECT_ACES

    return RtlNtStatusToDosError(ntstatus);
}


DWORD
ScGrantAccess(
    IN OUT LPSC_HANDLE_STRUCT ContextHandle,
    IN     ACCESS_MASK DesiredAccess
    )
/*++

Routine Description:

    This function is called when a new service is created.  It validates
    the access desired by the caller for the new service handle and
    computes the granted access to be stored in the context handle
    structure.  Since this is object creation, all requested accesses,
    except for ACCESS_SYSTEM_SECURITY, are granted automatically.

Arguments:

    DesiredAccess - Supplies the client requested desired access.

    ContextHandle - On return, the granted access is written back to this
        location if this call succeeds.

Return Value:

    Returns values from calls to the following, mapped to Win32 error codes:
        ScPrivilegeCheckAndAudit

--*/
{
    NTSTATUS    Status = STATUS_SUCCESS;
    ACCESS_MASK AccessToGrant = DesiredAccess;

    //
    // If MAXIMUM_ALLOWED is requested, add GENERIC_ALL
    //

    if (AccessToGrant & MAXIMUM_ALLOWED) {

        AccessToGrant &= ~MAXIMUM_ALLOWED;
        AccessToGrant |= GENERIC_ALL;
    }

    //
    // If ACCESS_SYSTEM_SECURITY is requested, check that we have
    // SE_SECURITY_PRIVILEGE.
    //

    if (AccessToGrant & ACCESS_SYSTEM_SECURITY) {

        Status = ScPrivilegeCheckAndAudit(
                    SE_SECURITY_PRIVILEGE,  // check for this privilege
                    ContextHandle,          // client's handle to the object
                                            //  (used for auditing only)
                    DesiredAccess           // (used for auditing only)
                    );
    }

    if (NT_SUCCESS(Status)) {

        //
        // Map the generic bits to specific and standard bits.
        //

        RtlMapGenericMask(
            &AccessToGrant,
            &ScServiceObjectMapping
            );

        //
        // Return the computed access mask.
        //

        ContextHandle->AccessGranted = AccessToGrant;
    }

    return(RtlNtStatusToDosError(Status));
}


NTSTATUS
ScPrivilegeCheckAndAudit(
    IN ULONG PrivilegeId,
    IN PVOID ObjectHandle,
    IN ACCESS_MASK DesiredAccess
    )
/*++

Routine Description:

    This function is only called from ScGrantAccess.  It checks if the given
    well known privilege is enabled for an impersonated client.  It also
    generates an audit for the attempt to use the privilege.

Arguments:

    PrivilegeId -  Specifies the well known Privilege Id

    ObjectHandle - Client's handle to the object (used for auditing)

    DesiredAccess - Access that the client requested to the object (used
                    for auditing)

Return Value:

    NTSTATUS - Standard Nt Result Code

        STATUS_SUCCESS - The call completed successfully and the client
            is either trusted or has the necessary privilege enabled.

        STATUS_PRIVILEGE_NOT_HELD - The client does not have the necessary
            privilege.
--*/
{
    NTSTATUS Status, SecondaryStatus;
    HANDLE ClientToken = NULL;

    //
    // Impersonate the client.
    //

    Status = I_RpcMapWin32Status(RpcImpersonateClient( NULL ));

    if (NT_SUCCESS(Status)) {

        //
        // Open the current thread's impersonation token (if any).
        //

        Status = NtOpenThreadToken(
                     NtCurrentThread(),
                     TOKEN_QUERY,
                     TRUE,
                     &ClientToken
                     );

        if (NT_SUCCESS(Status)) {

            PRIVILEGE_SET Privilege;
            BOOLEAN PrivilegeHeld = FALSE;
            UNICODE_STRING Subsystem;

            //
            // OK, we have a token open.  Now check for the specified privilege.
            // On return, PrivilegeHeld indicates whether the client has the
            // privilege, and whether we will allow the operation to succeed.
            //

            Privilege.PrivilegeCount = 1;
            Privilege.Control = PRIVILEGE_SET_ALL_NECESSARY;
            Privilege.Privilege[0].Luid = RtlConvertLongToLuid(PrivilegeId);
            Privilege.Privilege[0].Attributes = 0;

            Status = NtPrivilegeCheck(
                         ClientToken,
                         &Privilege,
                         &PrivilegeHeld
                         );

            SC_ASSERT(NT_SUCCESS(Status));

            //
            // Audit the attempt to use the privilege.
            //

            RtlInitUnicodeString(&Subsystem, SC_MANAGER_AUDIT_NAME);

            Status = NtPrivilegeObjectAuditAlarm(
                            &Subsystem,     // Subsystem name
                            PrivilegeHeld ? ObjectHandle : NULL,
                                            // Object handle, to display in
                                            //  the audit log
                            ClientToken,    // Client's token
                            DesiredAccess,  // Access desired by client
                            &Privilege,     // Privileges attempted to use
                            PrivilegeHeld   // Whether access was granted
                            );

            SC_ASSERT(NT_SUCCESS(Status));

            if ( !PrivilegeHeld ) {

                Status = STATUS_PRIVILEGE_NOT_HELD;
            }


            //
            // Close the client token.
            //

            SecondaryStatus = NtClose( ClientToken );
            ASSERT(NT_SUCCESS(SecondaryStatus));
        }

        //
        // Stop impersonating the client.
        //

        SecondaryStatus = I_RpcMapWin32Status(RpcRevertToSelf());
    }

    return Status;
}


DWORD
ScAccessValidate(
    IN OUT LPSC_HANDLE_STRUCT ContextHandle,
    IN     ACCESS_MASK DesiredAccess
    )
/*++

Routine Description:

    This function is called due to an open request.  It validates the
    desired access based on the object type specified in the context
    handle structure.  If the requested access is granted, it is
    written into the context handle structure.

Arguments:

    ContextHandle - Supplies a pointer to the context handle structure
        which contains information about the object.  On return, the
        granted access is written back to this structure if this
        call succeeds.

    DesiredAccess - Supplies the client requested desired access.


Return Value:

    ERROR_GEN_FAILURE - Object type is unrecognizable.  An internal
        error has occured.

    Returns values from calls to:
        ScAccessCheckAndAudit

Notes:

    The supplied ContextHandle must be verified to be valid (i.e., non-NULL)
    BEFORE calling this routine.

--*/
{

    ACCESS_MASK RequestedAccess = DesiredAccess;


    if (ContextHandle->Signature == SC_SIGNATURE) {

        //
        // Map the generic bits to specific and standard bits.
        //
        RtlMapGenericMask(&RequestedAccess, &ScManagerObjectMapping);

        //
        // Check to see if requested access is granted to client
        //
        return ScAccessCheckAndAudit(
                   (LPWSTR) SC_MANAGER_AUDIT_NAME,
                   (LPWSTR) SC_MANAGER_OBJECT_TYPE_NAME,
                   ContextHandle->Type.ScManagerObject.DatabaseName,
                   ContextHandle,
                   ScManagerSd,
                   RequestedAccess,
                   &ScManagerObjectMapping
                   );
    }
    else if (ContextHandle->Signature == SERVICE_SIGNATURE) {

        //
        // Special-case the status access check instead of adding the right
        // for the service to set its own status to the service's default SD
        // because of the following reasons:
        //
        //     1.  This check is tighter -- since an SC_HANDLE can be used
        //         remotely, this prevents SetServiceStatus from now being
        //         called remotely because the LUIDs won't match.
        //
        //     2.  Modifying the SD would require lots of extra work for SDs
        //         that are stored in the registry -- the SCM would have to
        //         detect that there's no SERVICE_SET_STATUS access ACL on
        //         the SD and add it (also in calls to SetServiceObjectSecurity).
        //
        // Note that if the user specifies extraneous access bits (i.e.,
        // SERVICE_SET_STATUS & <other bits>), it will be rejected by the
        // ScAccessCheckAndAudit call below.
        //
        if (DesiredAccess == SERVICE_SET_STATUS) {

            DWORD  dwError = ScStatusAccessCheck(ContextHandle->Type.ScServiceObject.ServiceRecord);

            if (dwError == NO_ERROR) {
                ContextHandle->AccessGranted = SERVICE_SET_STATUS;
            }

            return dwError;
        }

        //
        // Map the generic bits to specific and standard bits.
        //
        RtlMapGenericMask(&RequestedAccess, &ScServiceObjectMapping);

        //
        // Check to see if requested access is granted to client
        //
        return ScAccessCheckAndAudit(
                   (LPWSTR) SC_MANAGER_AUDIT_NAME,
                   (LPWSTR) SC_SERVICE_OBJECT_TYPE_NAME,
                   ContextHandle->Type.ScServiceObject.ServiceRecord->ServiceName,
                   ContextHandle,
                   ContextHandle->Type.ScServiceObject.ServiceRecord->ServiceSd,
                   RequestedAccess,
                   &ScServiceObjectMapping
                   );
    }
    else {

        //
        // Unknown object type.  This should not happen!
        //
        SC_LOG(ERROR, "ScAccessValidate: Unknown object type, signature=0x%08lx\n",
               ContextHandle->Signature);
        ASSERT(FALSE);
        return ERROR_GEN_FAILURE;
    }
}


DWORD
ScAccessCheckAndAudit(
    IN     LPWSTR SubsystemName,
    IN     LPWSTR ObjectTypeName,
    IN     LPWSTR ObjectName,
    IN OUT LPSC_HANDLE_STRUCT ContextHandle,
    IN     PSECURITY_DESCRIPTOR SecurityDescriptor,
    IN     ACCESS_MASK DesiredAccess,
    IN     PGENERIC_MAPPING GenericMapping
    )
/*++

Routine Description:

    This function impersonates the caller so that it can perform access
    validation using NtAccessCheckAndAuditAlarm; and reverts back to
    itself before returning.

Arguments:

    SubsystemName - Supplies a name string identifying the subsystem
        calling this routine.

    ObjectTypeName - Supplies the name of the type of the object being
        accessed.

    ObjectName - Supplies the name of the object being accessed.

    ContextHandle - Supplies the context handle to the object.  On return, if
        this call succeeds, the granted access is written to the AccessGranted
        field of this structure, and the SC_HANDLE_GENERATE_ON_CLOSE bit of the
        Flags field indicates whether NtCloseAuditAlarm must be called when
        this handle is closed.

    SecurityDescriptor - A pointer to the Security Descriptor against which
        acccess is to be checked.

    DesiredAccess - Supplies desired acccess mask.  This mask must have been
        previously mapped to contain no generic accesses.

    GenericMapping - Supplies a pointer to the generic mapping associated
        with this object type.

Return Value:

    NT status mapped to Win32 errors.

--*/
{

    NTSTATUS NtStatus;
    RPC_STATUS RpcStatus;

    UNICODE_STRING Subsystem;
    UNICODE_STRING ObjectType;
    UNICODE_STRING Object;

    BOOLEAN GenerateOnClose;
    NTSTATUS AccessStatus;



    RtlInitUnicodeString(&Subsystem, SubsystemName);
    RtlInitUnicodeString(&ObjectType, ObjectTypeName);
    RtlInitUnicodeString(&Object, ObjectName);

    if ((RpcStatus = RpcImpersonateClient(NULL)) != RPC_S_OK)
    {
        SC_LOG1(ERROR, "ScAccessCheckAndAudit: Failed to impersonate client " FORMAT_RPC_STATUS "\n",
                RpcStatus);

        ScLogEvent(
            NEVENT_CALL_TO_FUNCTION_FAILED,
            SC_RPC_IMPERSONATE,
            RpcStatus
            );

        return RpcStatus;
    }

    NtStatus = NtAccessCheckAndAuditAlarm(
                   &Subsystem,
                   (PVOID) ContextHandle,
                   &ObjectType,
                   &Object,
                   SecurityDescriptor,
                   DesiredAccess,
                   GenericMapping,
                   FALSE,
                   &ContextHandle->AccessGranted,   // return access granted
                   &AccessStatus,
                   &GenerateOnClose
                   );

    if ((RpcStatus = RpcRevertToSelf()) != RPC_S_OK)
    {
        SC_LOG(ERROR, "ScAccessCheckAndAudit: Fail to revert to self %08lx\n",
               RpcStatus);

        ScLogEvent(
            NEVENT_CALL_TO_FUNCTION_FAILED,
            SC_RPC_REVERT,
            RpcStatus
            );

        ASSERT(FALSE);
        return RpcStatus;
    }

    if (! NT_SUCCESS(NtStatus)) {
        if (NtStatus != STATUS_ACCESS_DENIED) {
            SC_LOG1(
                ERROR,
                "ScAccessCheckAndAudit: Error calling NtAccessCheckAndAuditAlarm " FORMAT_NTSTATUS "\n",
                NtStatus
                );
        }
        return ERROR_ACCESS_DENIED;
    }

    if (GenerateOnClose)
    {
        ContextHandle->Flags |= SC_HANDLE_GENERATE_ON_CLOSE;
    }

    if (AccessStatus != STATUS_SUCCESS) {
        SC_LOG(SECURITY, "ScAccessCheckAndAudit: Access status is %08lx\n",
               AccessStatus);
        return ERROR_ACCESS_DENIED;
    }

    SC_LOG(SECURITY, "ScAccessCheckAndAudit: Object name %ws\n", ObjectName);
    SC_LOG(SECURITY, "                       Granted access %08lx\n",
           ContextHandle->AccessGranted);

    return NO_ERROR;
}


DWORD
ScStatusAccessCheck(
    IN     LPSERVICE_RECORD   lpServiceRecord    OPTIONAL
    )
{
    RPC_STATUS          RpcStatus;
    DWORD               dwStatus;

    HANDLE              hThreadToken   = NULL;

    SC_ASSERT(lpServiceRecord == NULL || ScServiceRecordLock.Have());

    //
    // If OpenService is called for SERVICE_SET_STATUS access on a
    // service that's not running, the ImageRecord will be NULL
    //
    if (lpServiceRecord != NULL && lpServiceRecord->ImageRecord == NULL)
    {
        return ERROR_SERVICE_NOT_ACTIVE;
    }

    RpcStatus = RpcImpersonateClient(NULL);

    if (RpcStatus != RPC_S_OK)
    {
        SC_LOG1(ERROR,
                "ScStatusAccessCheck: Failed to impersonate client " FORMAT_RPC_STATUS "\n",
                RpcStatus);

        ScLogEvent(
            NEVENT_CALL_TO_FUNCTION_FAILED,
            SC_RPC_IMPERSONATE,
            RpcStatus
            );

        return RpcStatus;
    }

    if (!OpenThreadToken(GetCurrentThread(),
                         TOKEN_QUERY,
                         TRUE,               // Open as self
                         &hThreadToken))
    {
        dwStatus = GetLastError();

        SC_LOG1(ERROR,
                "ScStatusAccessCheck: OpenThreadToken FAILED %d\n",
                dwStatus);
    }
    else
    {
        TOKEN_STATISTICS  TokenStats;

        if (!GetTokenInformation(hThreadToken,
                                 TokenStatistics,        // Information wanted
                                 &TokenStats,
                                 sizeof(TokenStats),     // Buffer size
                                 &dwStatus))             // Size required
        {
            dwStatus = GetLastError();

            SC_LOG1(ERROR,
                    "ScCreateImageRecord: GetTokenInformation FAILED %d\n",
                    dwStatus);
        }
        else
        {
            LUID  SystemLuid = SYSTEM_LUID;

            if (RtlEqualLuid(&TokenStats.AuthenticationId,
                             lpServiceRecord ? &lpServiceRecord->ImageRecord->AccountLuid :
                                               &SystemLuid))
            {
                dwStatus = NO_ERROR;
            }
            else
            {
                dwStatus = ERROR_ACCESS_DENIED;
            }
        }

        CloseHandle(hThreadToken);
    }

    RpcStatus = RpcRevertToSelf();

    if (RpcStatus != RPC_S_OK)
    {
        SC_LOG(ERROR,
               "ScStatusAccessCheck: Fail to revert to self %08lx\n",
               RpcStatus);

        ScLogEvent(
            NEVENT_CALL_TO_FUNCTION_FAILED,
            SC_RPC_REVERT,
            RpcStatus
            );

        ASSERT(FALSE);
        return RpcStatus;
    }

    return dwStatus;
}    


DWORD
ScGetPrivilege(
    IN  DWORD       numPrivileges,
    IN  PULONG      pulPrivileges
    )
/*++

Routine Description:

    This function alters the privilege level for the current thread.

    It does this by duplicating the token for the current thread, and then
    applying the new privileges to that new token, then the current thread
    impersonates with that new token.

    Privileges can be relinquished by calling ScReleasePrivilege().

Arguments:

    numPrivileges - This is a count of the number of privileges in the
        array of privileges.

    pulPrivileges - This is a pointer to the array of privileges that are
        desired.  This is an array of ULONGs.

Return Value:

    NO_ERROR - If the operation was completely successful.

    Otherwise, it returns mapped return codes from the various NT
    functions that are called.

--*/
{
    DWORD                       status;
    NTSTATUS                    ntStatus;
    HANDLE                      ourToken;
    HANDLE                      newToken;
    OBJECT_ATTRIBUTES           Obja;
    SECURITY_QUALITY_OF_SERVICE SecurityQofS;
    ULONG                       returnLen;
    PTOKEN_PRIVILEGES           pTokenPrivilege = NULL;
    DWORD                       i;

    //
    // Initialize the Privileges Structure
    //
    pTokenPrivilege = (PTOKEN_PRIVILEGES) LocalAlloc(
                                              LMEM_FIXED,
                                              sizeof(TOKEN_PRIVILEGES) +
                                                  (sizeof(LUID_AND_ATTRIBUTES) *
                                                   numPrivileges)
                                              );

    if (pTokenPrivilege == NULL) {
        status = GetLastError();
        SC_LOG(ERROR,"ScGetPrivilege:LocalAlloc Failed %d\n", status);
        return(status);
    }

    pTokenPrivilege->PrivilegeCount  = numPrivileges;

    for (i = 0; i < numPrivileges; i++) {
        pTokenPrivilege->Privileges[i].Luid = RtlConvertLongToLuid(
                                                pulPrivileges[i]);
        pTokenPrivilege->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED;

    }

    //
    // Initialize Object Attribute Structure.
    //
    InitializeObjectAttributes(&Obja,NULL,0L,NULL,NULL);

    //
    // Initialize Security Quality Of Service Structure
    //
    SecurityQofS.Length              = sizeof(SECURITY_QUALITY_OF_SERVICE);
    SecurityQofS.ImpersonationLevel  = SecurityImpersonation;
    SecurityQofS.ContextTrackingMode = FALSE;     // Snapshot client context
    SecurityQofS.EffectiveOnly       = FALSE;

    Obja.SecurityQualityOfService = &SecurityQofS;

    //
    // Open our own Token
    //
    ntStatus = NtOpenProcessToken(
                NtCurrentProcess(),
                TOKEN_DUPLICATE,
                &ourToken);

    if (!NT_SUCCESS(ntStatus)) {

        SC_LOG(ERROR, "ScGetPrivilege: NtOpenThreadToken Failed "
            "FORMAT_NTSTATUS" "\n", ntStatus);

        LocalFree(pTokenPrivilege);
        return(RtlNtStatusToDosError(ntStatus));
    }

    //
    // Duplicate that Token
    //
    ntStatus = NtDuplicateToken(
                ourToken,
                TOKEN_IMPERSONATE | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
                &Obja,
                FALSE,                  // Duplicate the entire token
                TokenImpersonation,     // TokenType
                &newToken);             // Duplicate token

    if (!NT_SUCCESS(ntStatus)) {
        SC_LOG(ERROR, "ScGetPrivilege: NtDuplicateToken Failed "
            "FORMAT_NTSTATUS" "\n", ntStatus);

        LocalFree(pTokenPrivilege);
        NtClose(ourToken);
        return(RtlNtStatusToDosError(ntStatus));
    }

    //
    // Add new privileges
    //

    ntStatus = NtAdjustPrivilegesToken(
                newToken,                   // TokenHandle
                FALSE,                      // DisableAllPrivileges
                pTokenPrivilege,            // NewState
                0,                          // Size of previous state buffer
                NULL,                       // No info on previous state
                &returnLen);                // numBytes required for buffer.

    if (!NT_SUCCESS(ntStatus)) {

        SC_LOG(ERROR, "ScGetPrivilege: NtAdjustPrivilegesToken Failed "
            "FORMAT_NTSTATUS" "\n", ntStatus);

        LocalFree(pTokenPrivilege);
        NtClose(ourToken);
        NtClose(newToken);
        return(RtlNtStatusToDosError(ntStatus));
    }

    //
    // Begin impersonating with the new token
    //
    ntStatus = NtSetInformationThread(
                NtCurrentThread(),
                ThreadImpersonationToken,
                (PVOID)&newToken,
                (ULONG)sizeof(HANDLE));

    if (!NT_SUCCESS(ntStatus)) {

        SC_LOG(ERROR, "ScGetPrivilege: NtAdjustPrivilegesToken Failed "
            "FORMAT_NTSTATUS" "\n", ntStatus);

        LocalFree(pTokenPrivilege);
        NtClose(ourToken);
        NtClose(newToken);
        return(RtlNtStatusToDosError(ntStatus));
    }

    LocalFree(pTokenPrivilege);
    NtClose(ourToken);
    NtClose(newToken);

    return(NO_ERROR);
}


DWORD
ScReleasePrivilege(
    VOID
    )
/*++

Routine Description:

    This function relinquishes privileges obtained by calling ScGetPrivilege().

Arguments:

    none

Return Value:

    NO_ERROR - If the operation was completely successful.

    Otherwise, it returns mapped return codes from the various NT
    functions that are called.


--*/
{
    NTSTATUS    ntStatus;
    HANDLE      NewToken;


    //
    // Revert To Self.
    //
    NewToken = NULL;

    ntStatus = NtSetInformationThread(
                NtCurrentThread(),
                ThreadImpersonationToken,
                (PVOID)&NewToken,
                (ULONG)sizeof(HANDLE));

    if ( !NT_SUCCESS(ntStatus) ) {
        return(RtlNtStatusToDosError(ntStatus));
    }

    return(NO_ERROR);
}


DWORD
ScGetClientSid(
    OUT PTOKEN_USER *UserInfo
    )

/*++

Routine Description:

    This function looks up the SID of the API caller by impersonating
    the caller.

Arguments:

    UserInfo - Receives a pointer to a buffer allocated by this routine
        which contains the TOKEN_USER information of the caller.

Return Value:

    Returns the NT error mapped to Win32

--*/
{
    DWORD status;
    NTSTATUS ntstatus;
    RPC_STATUS rpcstatus;
    HANDLE CurrentThreadToken = NULL;
    DWORD UserInfoSize;


    *UserInfo = NULL;

    if ((rpcstatus = RpcImpersonateClient(NULL)) != RPC_S_OK)
    {
        SC_LOG1(
            ERROR,
            "ScGetUserSid: Failed to impersonate client " FORMAT_RPC_STATUS "\n",
            rpcstatus
            );

        ScLogEvent(
            NEVENT_CALL_TO_FUNCTION_FAILED,
            SC_RPC_IMPERSONATE,
            rpcstatus
            );

        return ((DWORD) rpcstatus);
    }

    ntstatus = NtOpenThreadToken(
                   NtCurrentThread(),
                   TOKEN_QUERY,
                   TRUE,              // Use service controller's security
                                      // context to open thread token
                   &CurrentThreadToken
                   );

    status = RtlNtStatusToDosError(ntstatus);

    if (! NT_SUCCESS(ntstatus)) {
        SC_LOG1(ERROR, "ScGetUserSid: NtOpenThreadToken failed "
                FORMAT_NTSTATUS "\n", ntstatus);
        goto Cleanup;
    }

    //
    // Call NtQueryInformationToken the first time with 0 input size to
    // get size of returned information.
    //
    ntstatus = NtQueryInformationToken(
                   CurrentThreadToken,
                   TokenUser,         // User information class
                   (PVOID) *UserInfo, // Output
                   0,
                   &UserInfoSize
                   );

    if (ntstatus != STATUS_BUFFER_TOO_SMALL) {
        SC_LOG1(ERROR, "ScGetUserSid: NtQueryInformationToken failed "
                FORMAT_NTSTATUS ".  Expected BUFFER_TOO_SMALL.\n", ntstatus);
        status = RtlNtStatusToDosError(ntstatus);
        goto Cleanup;
    }

    //
    // Allocate buffer of returned size
    //
    *UserInfo = (PTOKEN_USER)LocalAlloc(
                    LMEM_ZEROINIT,
                    (UINT) UserInfoSize
                    );

    if (*UserInfo == NULL) {
        SC_LOG1(ERROR, "ScGetUserSid: LocalAlloc failed " FORMAT_DWORD
                "\n", GetLastError());
        status = ERROR_NOT_ENOUGH_MEMORY;
        goto Cleanup;
    }

    //
    // Call NtQueryInformationToken again with the correct buffer size.
    //
    ntstatus = NtQueryInformationToken(
                   CurrentThreadToken,
                   TokenUser,         // User information class
                   (PVOID) *UserInfo, // Output
                   UserInfoSize,
                   &UserInfoSize
                   );

    status = RtlNtStatusToDosError(ntstatus);

    if (! NT_SUCCESS(ntstatus)) {
        SC_LOG1(ERROR, "ScGetUserSid: NtQueryInformationToken failed "
                FORMAT_NTSTATUS "\n", ntstatus);

        LocalFree(*UserInfo);
        *UserInfo = NULL;
    }

Cleanup:

    if (CurrentThreadToken != NULL)
    {
        NtClose(CurrentThreadToken);
    }

    if ((rpcstatus = RpcRevertToSelf()) != RPC_S_OK)
    {
        SC_LOG1(
           ERROR,
           "ScGetUserSid: Failed to revert to self " FORMAT_RPC_STATUS "\n",
           rpcstatus
           );

        ScLogEvent(
            NEVENT_CALL_TO_FUNCTION_FAILED,
            SC_RPC_REVERT,
            rpcstatus
            );

        SC_ASSERT(FALSE);
        return ((DWORD) rpcstatus);
    }

    return status;
}