/////////////////////////////////////////////////////////////////////////////
//
// Copyright (c) 1998-2000 Microsoft Corporation
//
// Module Name:
// ClusPage.cpp
//
// Abstract:
// CClusterSecurityPage class implementation. This class will encapsulate
// the cluster security extension page.
//
// Author:
// Galen Barbee (galenb) February 11, 1998
//
// Revision History:
//
// Notes:
//
/////////////////////////////////////////////////////////////////////////////
#include "stdafx.h"
#include "resource.h"
#include "ClusPage.h"
#include "AclUtils.h"
#include <clusudef.h>
static GENERIC_MAPPING ShareMap =
{
CLUSAPI_READ_ACCESS,
CLUSAPI_CHANGE_ACCESS,
CLUSAPI_NO_ACCESS,
CLUSAPI_ALL_ACCESS
};
static SI_ACCESS siClusterAccesses[] =
{
{ &GUID_NULL, CLUSAPI_ALL_ACCESS, MAKEINTRESOURCE(IDS_ACLEDIT_PERM_GEN_ALL), SI_ACCESS_GENERAL | SI_ACCESS_SPECIFIC /*| OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE*/ }
};
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityInformation::CClusterSecurityInformation
//
// Routine Description:
// Default contructor
//
// Arguments:
// none
//
// Return Value:
// none
//
//--
/////////////////////////////////////////////////////////////////////////////
CClusterSecurityInformation::CClusterSecurityInformation( void )
: m_pcsp( NULL )
{
m_pShareMap = &ShareMap;
m_psiAccess = (SI_ACCESS *) &siClusterAccesses;
m_nAccessElems = ARRAYSIZE( siClusterAccesses );
m_nDefAccess = 0;
m_dwFlags = SI_EDIT_PERMS
| SI_NO_ACL_PROTECT
//| SI_UGOP_PROVIDED
//| SI_NO_UGOP_ACCOUNT_GROUPS
//| SI_NO_UGOP_USERS
//| SI_NO_UGOP_LOCAL_GROUPS
//| SI_NO_UGOP_WELLKNOWN
//| SI_NO_UGOP_BUILTIN
;
} //*** CClusterSecurityInformation::CClusterSecurityInformation()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityInformation::GetSecurity
//
// Routine Description:
// Give our security descriptor to the ISecurityInfomation UI
// so it can be displayed and edited.
//
// Arguments:
// RequestedInformation [IN]
// ppSecurityDescriptor [IN OUT]
// fDefault [IN]
//
// Return Value:
// E_FAIL for error and S_OK for success.
//
//--
/////////////////////////////////////////////////////////////////////////////
STDMETHODIMP CClusterSecurityInformation::GetSecurity(
IN SECURITY_INFORMATION RequestedInformation,
IN OUT PSECURITY_DESCRIPTOR *ppSecurityDescriptor,
IN BOOL fDefault
)
{
AFX_MANAGE_STATE( ::AfxGetStaticModuleState() );
HRESULT hr = E_FAIL;
try
{
if ( ppSecurityDescriptor != NULL )
{
PSECURITY_DESCRIPTOR pSD = NULL;
pSD = ClRtlCopySecurityDescriptor( Pcsp()->Psec() );
if ( pSD != NULL )
{
//hr = HrFixupSD( pSD );
//if ( SUCCEEDED( hr ) )
//{
*ppSecurityDescriptor = pSD;
//}
hr = S_OK;
} // if: no errors copying the security descriptor
else
{
hr = GetLastError();
TRACE( _T("CClusterSecurityInformation::GetSecurity() - Error %08.8x copying the security descriptor.\n"), hr );
hr = HRESULT_FROM_WIN32( hr );
} // else: error copying the security descriptor
}
else
{
hr = S_OK;
} // else: no security descriptor pointer
}
catch ( ... )
{
TRACE( _T("CClusterSecurityInformation::GetSecurity() - Unknown error occurred.\n") );
}
return hr;
} //*** CClusterSecurityInformation::GetSecurity()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityInformation::SetSecurity
//
// Routine Description:
// ISecurityInformation is giving back the edited security descriptor.
//
// Arguments:
// SecurityInformation [IN]
// pSecurityDescriptor [IN OUT]
//
// Return Value:
// E_FAIL for error and S_OK for success.
//
//--
/////////////////////////////////////////////////////////////////////////////
STDMETHODIMP CClusterSecurityInformation::SetSecurity(
IN SECURITY_INFORMATION SecurityInformation,
IN PSECURITY_DESCRIPTOR pSecurityDescriptor
)
{
AFX_MANAGE_STATE( ::AfxGetStaticModuleState() );
HRESULT hr = E_FAIL;
PSID pSystemSid = NULL;
PSID pAdminSid = NULL;
PSID pServiceSid = NULL;
try
{
SID_IDENTIFIER_AUTHORITY siaNtAuthority = SECURITY_NT_AUTHORITY;
hr = CSecurityInformation::SetSecurity( SecurityInformation, pSecurityDescriptor );
if ( hr == S_OK )
{
if ( AllocateAndInitializeSid(
&siaNtAuthority,
1,
SECURITY_LOCAL_SYSTEM_RID,
0, 0, 0, 0, 0, 0, 0,
&pSystemSid
) )
{
CString strMsg;
if ( BSidInSD( pSecurityDescriptor, pSystemSid ) )
{
//
// allocate and init the Administrators group sid
//
if ( AllocateAndInitializeSid(
&siaNtAuthority,
2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_ADMINS,
0, 0, 0, 0, 0, 0,
&pAdminSid
) )
{
if ( BSidInSD( pSecurityDescriptor, pAdminSid ) )
{
//
// allocate and init the Service sid
//
if ( AllocateAndInitializeSid(
&siaNtAuthority,
1,
SECURITY_SERVICE_RID,
0, 0, 0, 0, 0, 0, 0,
&pServiceSid
) )
{
if ( BSidInSD( pSecurityDescriptor, pServiceSid ) )
{
hr = Pcsp()->HrSetSecurityDescriptor( pSecurityDescriptor );
} // if: service SID in the SD
else
{
strMsg.LoadString( IDS_SERVICE_ACCOUNT_NOT_SPECIFIED );
AfxMessageBox( strMsg, MB_OK | MB_ICONSTOP );
hr = S_FALSE; // if there are missing required accounts then return S_FALSE to keep AclUi alive.
} // else
} // if: allocate and init service SID
} // if: admin SID in the SD
else
{
strMsg.LoadString( IDS_ADMIN_ACCOUNT_NOT_SPECIFIED );
AfxMessageBox( strMsg, MB_OK | MB_ICONSTOP );
hr = S_FALSE; // if there are missing required accounts then return S_FALSE to keep AclUi alive.
} // else
} // if: allocate and init admin SID
} // if: system SID in the SD
else
{
strMsg.LoadString( IDS_SYS_ACCOUNT_NOT_SPECIFIED );
AfxMessageBox( strMsg, MB_OK | MB_ICONSTOP );
hr = S_FALSE; // if there are missing required accounts then return S_FALSE to keep AclUi alive.
} // else
} // if: allocate and init system SID
} // if: CSecurityInformation::SetSecurity() worked
}
catch( ... )
{
;
}
if ( pSystemSid != NULL )
{
FreeSid( pSystemSid );
}
if ( pAdminSid != NULL )
{
FreeSid( pAdminSid );
}
return hr;
} //*** CClusterSecurityInformation::SetSecurity()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityInformation::HrInit
//
// Routine Description:
// Initialize method.
//
// Arguments:
// pcsp [IN] back pointer to parent property page wrapper
// strServer [IN] cluster name
//
// Return Value:
// S_OK for success. E_FAIL for failure.
//
//--
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityInformation::HrInit(
IN CClusterSecurityPage * pcsp,
IN CString const & strServer,
IN CString const & strNode
)
{
ASSERT( pcsp != NULL );
ASSERT( strServer.GetLength() > 0 );
AFX_MANAGE_STATE( ::AfxGetStaticModuleState() );
m_pcsp = pcsp;
m_strServer = strServer;
m_strNode = strNode;
m_nLocalSIDErrorMessageID = IDS_LOCAL_ACCOUNTS_SPECIFIED_CLUS;
return S_OK;
} //*** CClusterSecurityInformation::HrInit()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityInformation::BSidInSD
//
// Routine Description:
// Determines if there is an ACEs for the passed in SID in the
// Security Descriptor (pSD) after the ACL editor has been called
//
// Arguments:
// pSD [IN] - Security Descriptor to be checked.
// pSid [IN] - SID to look for
//
// Return Value:
// TRUE if an ACE for the SID was found, False otherwise.
//
/////////////////////////////////////////////////////////////////////////////
BOOL CClusterSecurityInformation::BSidInSD(
IN PSECURITY_DESCRIPTOR pSD,
IN PSID pSid
)
{
BOOL bSIdInACL = FALSE;
try
{
PACL pDACL = NULL;
BOOL bHasDACL = FALSE;
BOOL bDaclDefaulted = FALSE;
if ( ::GetSecurityDescriptorDacl( pSD, &bHasDACL, &pDACL, &bDaclDefaulted ) )
{
if ( bHasDACL && ( pDACL != NULL ) && ::IsValidAcl( pDACL ) )
{
ACL_SIZE_INFORMATION asiAclSize;
ACCESS_ALLOWED_ACE * paaAllowedAce;
if ( ::GetAclInformation( pDACL, (LPVOID) &asiAclSize, sizeof( asiAclSize ), AclSizeInformation ) )
{
//
// Search the ACL for the SID
//
for ( DWORD dwCount = 0; dwCount < asiAclSize.AceCount; dwCount++ )
{
if ( ::GetAce( pDACL, dwCount, (LPVOID *) &paaAllowedAce ) )
{
if ( paaAllowedAce->Header.AceType == ACCESS_ALLOWED_ACE_TYPE )
{
if ( EqualSid( &paaAllowedAce->SidStart, pSid ) )
{
bSIdInACL = TRUE;
break;
} // if: EqualSid
} // if: is this an access allowed ace?
} // if: can we get the ace from the DACL?
} // for
} // if: get ACL information
} // if: is the ACL valid
} // if: get the ACL from the SD
}
catch ( ... )
{
TRACE( _T("CClusterSecurityInformation::BSidInSD() - Unknown error occurred.\n") );
}
return bSIdInACL;
} //*** CClusterSecurityInformation::BSidInSD()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityInformation::HrFixupSD
//
// Routine Description:
// Performs any fixups to the SD that may be requrired.
//
// Arguments:
// pSD [IN] - Security Descriptor to be checked.
//
// Return Value:
// S_OK, or other Win32 error
//
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityInformation::HrFixupSD(
IN PSECURITY_DESCRIPTOR pSD
)
{
HRESULT hr = S_OK;
PSID pSystemSid = NULL;
PSID pAdminSid = NULL;
try
{
SID_IDENTIFIER_AUTHORITY siaNtAuthority = SECURITY_NT_AUTHORITY;
if ( AllocateAndInitializeSid( &siaNtAuthority,
1,
SECURITY_LOCAL_SYSTEM_RID,
0, 0, 0, 0, 0, 0, 0,
&pSystemSid ) )
{
if ( ! BSidInSD( pSD, pSystemSid ) )
{
HrAddSidToSD( &pSD, pSystemSid );
} // if: system SID found in SD
} // if: allocate system SID
//
// allocate and init the Administrators group sid
//
if ( AllocateAndInitializeSid(
&siaNtAuthority,
2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_ADMINS,
0, 0, 0, 0, 0, 0,
&pAdminSid
) ) {
if ( ! BSidInSD( pSD, pAdminSid ) )
{
HrAddSidToSD( &pSD, pAdminSid );
} // if: admin SID found in SD
} // if: allocate admin SID
}
catch ( ... )
{
TRACE( _T("CClusterSecurityInformation::HrFixupSD() - Unknown error occurred.\n") );
}
if ( pSystemSid != NULL )
{
FreeSid( pSystemSid );
}
if ( pAdminSid != NULL )
{
FreeSid( pAdminSid );
}
return hr;
} //*** CClusterSecurityInformation::HrFixupSD()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityInformation::HrAddSidToSD
//
// Routine Description:
// Adds the passed in SID to the DACL of the passed in SD
//
// Arguments:
// ppSD [IN, OUT] - Security Descriptor to be added to
// PSid [IN] - SID to add
//
// Return Value:
// S_OK, or other Win32 error
//
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityInformation::HrAddSidToSD(
IN OUT PSECURITY_DESCRIPTOR * ppSD,
IN PSID pSid
)
{
HRESULT hr = S_OK;
DWORD sc;
SECURITY_DESCRIPTOR sd;
DWORD dwSDLen = sizeof( SECURITY_DESCRIPTOR );
PACL pDacl = NULL;
DWORD dwDaclLen = 0;
PACL pSacl = NULL;
DWORD dwSaclLen = 0;
PSID pOwnerSid = NULL;
DWORD dwOwnerSidLen = 0;
PSID pGroupSid = NULL;
DWORD dwGroupSidLen = NULL;
PSECURITY_DESCRIPTOR pNewSD = NULL;
DWORD dwNewSDLen = 0;
try
{
BOOL bRet = FALSE;
bRet = ::MakeAbsoluteSD( *ppSD, // address of self relative SD
&sd, // address of absolute SD
&dwSDLen, // address of size of absolute SD
NULL, // address of discretionary ACL
&dwDaclLen, // address of size of discretionary ACL
NULL, // address of system ACL
&dwSaclLen, // address of size of system ACL
NULL, // address of owner SID
&dwOwnerSidLen, // address of size of owner SID
NULL, // address of primary-group SID
&dwGroupSidLen // address of size of group SID
);
if ( ! bRet )
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
if ( hr != ERROR_INSUFFICIENT_BUFFER ) // Duh, we're trying to find out how big the buffer should be?
{
goto fnExit;
}
}
//
// increase the DACL length to hold one more ace and its sid.
//
dwDaclLen += ( sizeof( ACCESS_ALLOWED_ACE ) + GetLengthSid( pSid ) +1024 );
pDacl = (PACL) ::LocalAlloc( LMEM_ZEROINIT, dwDaclLen );
if ( pDacl == NULL )
{
hr = E_OUTOFMEMORY;
goto fnExit;
}
InitializeAcl( pDacl, dwDaclLen, ACL_REVISION );
if ( dwSaclLen > 0 )
{
pSacl = (PACL) ::LocalAlloc( LMEM_ZEROINIT, dwSaclLen );
if ( pSacl == NULL )
{
hr = E_OUTOFMEMORY;
goto fnExit;
}
}
if ( dwOwnerSidLen > 0 )
{
pOwnerSid = (PSID) ::LocalAlloc( LMEM_ZEROINIT, dwOwnerSidLen );
if ( pOwnerSid == NULL )
{
hr = E_OUTOFMEMORY;
goto fnExit;
}
}
if ( dwGroupSidLen > 0 )
{
pGroupSid = (PSID) ::LocalAlloc( LMEM_ZEROINIT, dwGroupSidLen );
if ( pGroupSid == NULL )
{
hr = E_OUTOFMEMORY;
goto fnExit;
}
}
bRet = ::MakeAbsoluteSD( *ppSD, // address of self relative SD
&sd, // address of absolute SD
&dwSDLen, // address of size of absolute SD
pDacl, // address of discretionary ACL
&dwDaclLen, // address of size of discretionary ACL
pSacl, // address of system ACL
&dwSaclLen, // address of size of system ACL
pOwnerSid, // address of owner SID
&dwOwnerSidLen, // address of size of owner SID
pGroupSid, // address of primary-group SID
&dwGroupSidLen // address of size of group SID
);
if ( !bRet )
{
goto fnExit;
}
//
// Add the ACE for the SID to the DACL
//
// if ( !AddAccessAllowedAceEx( pDacl,
// ACL_REVISION,
// CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE,
// CLUSAPI_ALL_ACCESS,
// pSid ) )
if ( ! AddAccessAllowedAce(
pDacl,
ACL_REVISION,
CLUSAPI_ALL_ACCESS,
pSid
) )
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
goto fnExit;
}
if ( ! ::SetSecurityDescriptorDacl( &sd, TRUE, pDacl, FALSE ) )
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
goto fnExit;
}
if ( ! ::SetSecurityDescriptorOwner( &sd, pOwnerSid, FALSE ) )
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
goto fnExit;
}
if ( ! ::SetSecurityDescriptorGroup( &sd, pGroupSid, FALSE ) )
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
goto fnExit;
}
if ( ! ::SetSecurityDescriptorSacl( &sd, TRUE, pSacl, FALSE ) )
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
goto fnExit;
}
dwNewSDLen = 0 ;
if ( ! ::MakeSelfRelativeSD( &sd, NULL, &dwNewSDLen ) )
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
if ( hr != HRESULT_FROM_WIN32( ERROR_INSUFFICIENT_BUFFER ) ) // Duh, we're trying to find out how big the buffer should be?
{
goto fnExit;
}
}
pNewSD = ::LocalAlloc( LPTR, dwNewSDLen );
if ( pNewSD != NULL )
{
if ( ! ::MakeSelfRelativeSD( &sd, pNewSD, &dwNewSDLen ) )
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
goto fnExit;
}
::LocalFree( *ppSD );
*ppSD = pNewSD;
hr = ERROR_SUCCESS;
} else
{
hr = ERROR_NOT_ENOUGH_MEMORY;
}
}
catch ( ... )
{
TRACE( _T("CClusterSecurityInformation::HrAddSidToSD() - Unknown error occurred.\n") );
}
fnExit:
if ( pSacl != NULL )
{
::LocalFree( pSacl );
}
if ( pOwnerSid != NULL )
{
::LocalFree( pOwnerSid );
}
if ( pGroupSid != NULL )
{
::LocalFree( pGroupSid );
}
return hr;
} //*** CClusterSecurityInformation::HrAddSidToSD()
//*************************************************************************//
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::CClusterSecurityPage
//
// Routine Description:
// Default contructor.
//
// Arguments:
// none
//
// Return Value:
// none
//
//--
/////////////////////////////////////////////////////////////////////////////
CClusterSecurityPage::CClusterSecurityPage( void )
: m_psec( NULL )
, m_psecPrev( NULL )
, m_hpage( 0 )
, m_hkey( 0 )
, m_psecinfo( NULL )
, m_pOwner( NULL )
, m_pGroup( NULL )
, m_fOwnerDef( FALSE )
, m_fGroupDef( FALSE )
{
AFX_MANAGE_STATE( ::AfxGetStaticModuleState() );
m_bSecDescModified = FALSE;
} //*** CClusterSecurityPage::CClusterSecurityPage()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::~CClusterSecurityPage
//
// Routine Description:
// Destructor
//
// Arguments:
// none
//
// Return Value:
// none
//
//--
/////////////////////////////////////////////////////////////////////////////
CClusterSecurityPage::~CClusterSecurityPage( void )
{
AFX_MANAGE_STATE( ::AfxGetStaticModuleState() );
::LocalFree( m_psec );
m_psec = NULL;
::LocalFree( m_psecPrev );
m_psecPrev = NULL;
::LocalFree( m_pOwner );
m_pOwner = NULL;
::LocalFree( m_pGroup );
m_pGroup = NULL;
m_psecinfo->Release();
} //*** CClusterSecurityPage::~CClusterSecurityPage()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::HrInit
//
// Routine Description:
// Initialize method.
//
// Arguments:
// peo [IN] back pointer to parent extension object.
//
// Return Value:
// S_OK Page was initialized successfully.
// hr Error initializing the page.
//
//--
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityPage::HrInit( IN CExtObject * peo )
{
ASSERT( peo != NULL );
AFX_MANAGE_STATE( ::AfxGetStaticModuleState() );
HRESULT _hr = S_OK;
DWORD _sc;
if ( peo != NULL )
{
m_peo = peo;
_hr = CComObject< CClusterSecurityInformation >::CreateInstance( &m_psecinfo );
if ( SUCCEEDED( _hr ) )
{
m_psecinfo->AddRef();
m_hkey = GetClusterKey( Hcluster(), KEY_ALL_ACCESS );
if ( m_hkey != NULL )
{
_hr = HrGetSecurityDescriptor();
if ( SUCCEEDED( _hr ) )
{
CString strServer;
CString strNode;
strServer.Format( _T( "\\\\%s" ), StrClusterName() );
// Get the node on which the Cluster Name resource is online.
if ( BGetClusterNetworkNameNode( strNode ) )
{
_hr = m_psecinfo->HrInit( this, strServer, strNode );
if ( SUCCEEDED( _hr ) )
{
m_hpage = CreateClusterSecurityPage( m_psecinfo );
if ( m_hpage == NULL )
{
_sc = ::GetLastError();
_hr = HRESULT_FROM_WIN32( _sc );
} // if: error creating the page
} // if: initialized security info successfully
} // if: retrieved cluster network name node successfully
else
{
} // else: error getting cluster network name node
} // if: error getting SD
} // if: retrieved cluster key
else
{
_sc = ::GetLastError();
_hr = HRESULT_FROM_WIN32( _sc );
TRACE( _T( "CClusterSecurityPage::ScInit() - Failed to get the cluster key, 0x%08lx.\n" ), _sc );
} // else: error getting cluster key
} // if: created security info object successfully
else
{
TRACE( _T( "CClusterSecurityPage::ScInit() - Failed to create CClusterSecurityInformation object, %0x%08lx.\n" ), _hr );
}
} // if: extension object is available
return _hr;
} //*** CClusterSecurityPage::HrInit()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::HrGetSecurityDescriptor
//
// Routine Description:
// Get the security descriptor from the cluster database or create a
// default one if it doesn't exist.
//
// Arguments:
// none
//
// Return Value:
//
//
//--
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityPage::HrGetSecurityDescriptor( void )
{
AFX_MANAGE_STATE( ::AfxGetStaticModuleState() );
HRESULT hr = S_OK;
PSECURITY_DESCRIPTOR psec = NULL;
hr = HrGetSDFromClusterDB( &psec ); //uses localalloc
if ( FAILED( hr ) || ( psec == NULL ) )
{
DWORD sc;
DWORD dwLen = 0;
TRACE( _T( "Security Descriptor is NULL. Build default SD" ) );
sc = ::ClRtlBuildDefaultClusterSD( NULL, &psec, &dwLen ); //uses localalloc
hr = HRESULT_FROM_WIN32( sc );
if ( sc != ERROR_SUCCESS )
{
TRACE( _T( "ClRtlBuildDefaultClusterSD failed, 0x%08x" ), sc );
} // if: error building the default SD
hr = HRESULT_FROM_WIN32( sc );
} // if: error getting SD from cluster database
if ( SUCCEEDED( hr ) )
{
delete m_psec;
m_psec = ClRtlCopySecurityDescriptor( psec );
hr = GetLastError(); // Get the last error
::LocalFree( psec );
psec = NULL;
if ( m_psec == NULL )
{
hr = HRESULT_FROM_WIN32( hr ); // Convert to HRESULT
goto Cleanup;
} // if: error copying the security descriptor
hr = HrGetSDOwner( m_psec );
if ( SUCCEEDED( hr ) )
{
hr = HrGetSDGroup( m_psec );
if ( SUCCEEDED( hr ) )
{
m_psecPrev = ClRtlCopySecurityDescriptor( m_psec );
if ( m_psecPrev == NULL )
{
hr = GetLastError(); // Get the last error
hr = HRESULT_FROM_WIN32( hr ); // Convert to HRESULT
goto Cleanup;
} // if: error copying the security descriptor
} // if: got SD group successfully
} // if: got SD owner successfully
} // if: retrieved or built SD successfully
#ifdef _DEBUG
if ( m_psec != NULL )
{
ASSERT( IsValidSecurityDescriptor( m_psec ) );
}
#endif
Cleanup:
return hr;
} //*** CClusterSecurityPage::HrGetSecurityDescriptor()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::HrSetSecurityDescriptor
//
// Routine Description:
// Save the new security descriptor to the cluster database.
//
// Arguments:
// psec [IN] the new security descriptor
//
// Return Value:
// hr
//
//--
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityPage::HrSetSecurityDescriptor(
IN PSECURITY_DESCRIPTOR psec
)
{
ASSERT( psec != NULL );
AFX_MANAGE_STATE( ::AfxGetStaticModuleState() );
HRESULT hr = S_OK;
try
{
if ( psec != NULL )
{
CWaitCursor wc;
ASSERT( IsValidSecurityDescriptor( psec ) );
if ( IsValidSecurityDescriptor( psec ) )
{
hr = HrSetSDOwner( psec );
if ( SUCCEEDED( hr ) )
{
hr = HrSetSDGroup( psec );
if ( SUCCEEDED( hr ) )
{
LocalFree( m_psecPrev );
m_psecPrev = NULL;
if ( m_psec == NULL )
{
m_psecPrev = NULL;
} // if: no previous value
else
{
m_psecPrev = ClRtlCopySecurityDescriptor( m_psec );
if ( m_psecPrev == NULL )
{
hr = GetLastError(); // Get the last error
TRACE( _T( "CClusterSecurityPage::HrSetSecurityDescriptor() - Error %08.8x copying the previous SD.\n" ), hr );
hr = HRESULT_FROM_WIN32( hr ); // Convert to HRESULT
goto Cleanup;
} // if: error copying the security descriptor
} // else: previous value exists
LocalFree( m_psec );
m_psec = NULL;
m_psec = ClRtlCopySecurityDescriptor( psec );
if ( m_psec == NULL )
{
hr = GetLastError(); // Get the last error
TRACE( _T( "CClusterSecurityPage::HrSetSecurityDescriptor() - Error %08.8x copying the new SD.\n" ), hr );
hr = HRESULT_FROM_WIN32( hr ); // Convert to HRESULT
goto Cleanup;
} // if: error copying the security descriptor
SetPermissions( m_psec );
} // if: SD group set successfully
} // if: SD owner set successfully
} // if: security descriptor is valid
else
{
hr = HRESULT_FROM_WIN32( ERROR_INVALID_SECURITY_DESCR );
TRACE( _T( "CClusterSecurityPage::HrSetSecurityDescriptor() - Invalid security descriptor.\n" ) );
} // else: invalid security descriptor
} // if: security descriptor specified
else
{
hr = HRESULT_FROM_WIN32( ERROR_INVALID_SECURITY_DESCR );
} // else: no security descriptor specified
} // try
catch ( ... )
{
hr = E_FAIL;
TRACE( _T( "CClusterSecurityPage::HrSetSecurityDescriptor() - Unknown error occurred.\n" ) );
}
Cleanup:
return hr;
} //*** CClusterSecurityPage::HrSetSecurityDescriptor()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::SetPermissions
//
// Routine Description:
// Set the permissions for accessing the cluster.
//
// Arguments:
// psec [IN] Security descriptor.
//
// Return Value:
// None.
//
// Exceptions Thrown:
// Any exceptions thrown by CClusterItem::WriteValue().
//--
/////////////////////////////////////////////////////////////////////////////
void CClusterSecurityPage::SetPermissions(
IN const PSECURITY_DESCRIPTOR psec
)
{
ASSERT( psec != NULL );
ASSERT( IsValidSecurityDescriptor( psec ) );
DWORD cbNew;
DWORD cbOld;
LPBYTE psecPrev; // buffer for use by ScWriteValue. Prev SD is saved elsewhere now.
// Get the length of the two security descriptors.
if ( m_psecPrev == NULL )
{
cbOld = 0;
}
else
{
cbOld = ::GetSecurityDescriptorLength( m_psecPrev );
}
if ( psec == NULL )
{
cbNew = 0;
}
else
{
cbNew = ::GetSecurityDescriptorLength( psec );
}
// Allocate a new buffer for the previous data pointer.
try
{
psecPrev = new BYTE [cbOld];
if ( psecPrev == NULL )
{
return;
} // if: error allocating previous data buffer
}
catch ( CMemoryException * )
{
return;
} // catch: CMemoryException
::CopyMemory( psecPrev, m_psecPrev, cbOld );
ScWriteValue( CLUSREG_NAME_CLUS_SD, (LPBYTE) psec, cbNew, (LPBYTE *) &psecPrev, cbOld, m_hkey );
PSECURITY_DESCRIPTOR psd = ClRtlConvertClusterSDToNT4Format( psec );
ScWriteValue( CLUSREG_NAME_CLUS_SECURITY, (LPBYTE) psd, cbNew, (LPBYTE *) &psecPrev, cbOld, m_hkey );
::LocalFree( psd );
delete [] psecPrev;
} //*** CClusterSecurityPage::SetPermissions()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::HrGetSDOwner
//
// Routine Description:
// Get the owner sid and save it.
//
// Arguments:
// psec [IN] Security descriptor.
//
// Return Value:
// hr
//
//--
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityPage::HrGetSDOwner(
IN const PSECURITY_DESCRIPTOR psec
)
{
HRESULT hr = S_OK;
DWORD sc;
PSID pOwner = NULL;
if ( ::GetSecurityDescriptorOwner( psec, &pOwner, &m_fOwnerDef ) != 0 )
{
// The security descriptor does not have an owner.
if ( pOwner == NULL )
{
::LocalFree( m_pOwner );
m_pOwner = NULL;
}
else
{
DWORD dwLen = ::GetLengthSid( pOwner );
// copy the sid since AclUi will free the SD...
hr = ::GetLastError();
if ( SUCCEEDED( hr ) )
{
::LocalFree( m_pOwner );
m_pOwner = ::LocalAlloc( LMEM_ZEROINIT, dwLen );
if ( m_pOwner != NULL )
{
if ( ::CopySid( dwLen, m_pOwner, pOwner ) )
{
hr = S_OK;
}
else
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
}
}
else
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
}
}
}
}
else
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
}
return( hr );
} //*** CClusterSecurityPage::HrGetSDOwner()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::HrGetSDGroup
//
// Routine Description:
// Get the group sid and save it.
//
// Arguments:
// psec [IN] Security descriptor.
//
// Return Value:
// None.
//
//--
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityPage::HrGetSDGroup(
IN const PSECURITY_DESCRIPTOR psec
)
{
HRESULT hr = S_OK;
DWORD sc;
PSID pGroup = NULL;
if ( ::GetSecurityDescriptorOwner( psec, &pGroup, &m_fOwnerDef ) != 0 )
{
// This SID does not contain group information.
if ( pGroup == NULL )
{
::LocalFree( m_pGroup );
m_pGroup = NULL;
}
else
{
DWORD dwLen = ::GetLengthSid( pGroup );
// copy the sid since AclUi will free the SD...
hr = ::GetLastError();
if ( SUCCEEDED( hr ) )
{
::LocalFree( m_pGroup );
m_pGroup = ::LocalAlloc( LMEM_ZEROINIT, dwLen );
if ( m_pGroup != NULL )
{
if ( ::CopySid( dwLen, m_pGroup, pGroup ) )
{
hr = S_OK;
}
else
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
}
}
else
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
}
}
}
}
else
{
sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
}
return( hr );
} //*** CClusterSecurityPage::HrGetSDGroup()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::HrSetSDOwner
//
// Routine Description:
// Set the owner sid.
//
// Arguments:
// psec [IN] Security descriptor.
//
// Return Value:
// None.
//
//--
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityPage::HrSetSDOwner(
IN PSECURITY_DESCRIPTOR psec
)
{
HRESULT hr = S_OK;
if ( !::SetSecurityDescriptorOwner( psec, m_pOwner, m_fOwnerDef ) )
{
DWORD sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
}
return( hr );
} //*** CClusterSecurityPage::HrSetSDOwner()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::HrSetSDGroup
//
// Routine Description:
// Set the group sid.
//
// Arguments:
// psec [IN] Security descriptor.
//
// Return Value:
// None.
//
//--
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityPage::HrSetSDGroup(
IN PSECURITY_DESCRIPTOR psec
)
{
HRESULT hr = S_OK;
if ( !::SetSecurityDescriptorGroup( psec, m_pGroup, m_fGroupDef ) )
{
DWORD sc = ::GetLastError();
hr = HRESULT_FROM_WIN32( sc );
}
return( hr );
} //*** CClusterSecurityPage::HrSetSDGroup()
/////////////////////////////////////////////////////////////////////////////
//++
//
// CClusterSecurityPage::HrGetSDFromClusterDB
//
// Routine Description:
// Retrieve the SD from the cluster database.
//
// Arguments:
// ppsec [OUT] Pointer to security descriptor.
//
// Return Value:
// S_OK for success
// Any error returned by ScReadValue
//
//--
/////////////////////////////////////////////////////////////////////////////
HRESULT CClusterSecurityPage::HrGetSDFromClusterDB(
OUT PSECURITY_DESCRIPTOR * ppsec
)
{
AFX_MANAGE_STATE( ::AfxGetStaticModuleState() );
ASSERT( ppsec != NULL );
HRESULT hr = E_FAIL;
PSECURITY_DESCRIPTOR psd = NULL;
if ( ppsec != NULL )
{
DWORD sc;
// Read the security descriptor.
sc = ScReadValue( CLUSREG_NAME_CLUS_SD, (LPBYTE *) &psd, m_hkey ); //alloc using new
hr = HRESULT_FROM_WIN32( sc );
if ( FAILED( hr ) || ( psd == NULL ) )
{ // try getting the NT4 SD...
sc = ScReadValue( CLUSREG_NAME_CLUS_SECURITY, (LPBYTE *) &psd, m_hkey ); //alloc using new
hr = HRESULT_FROM_WIN32( sc );
if ( SUCCEEDED( hr ) )
{
*ppsec = ::ClRtlConvertClusterSDToNT5Format( psd );
}
}
else
{
*ppsec = ClRtlCopySecurityDescriptor( psd );
if ( *ppsec == NULL )
{
hr = GetLastError(); // Get the last error
hr = HRESULT_FROM_WIN32( hr ); // Convert to HRESULT
} // if: error copying the security descriptor
}
delete [] psd;
if ( *ppsec != NULL )
{
::ClRtlExamineSD( *ppsec, "[ClusPage]" );
} // if: security descriptor is available to be examined
}
return hr;
} //*** CClusterSecurityPage::HrGetSDFromClusterDB