rmp.h File Reference

#include <nt.h>
#include <ntlsa.h>
#include "sep.h"

Go to the source code of this file.

Classes
struct	_SEP_RM_STATE
struct	_SEP_RM_CONNECT_INFO
struct	_SEP_LOGON_SESSION_REFERENCES
struct	_SEP_LOGON_SESSION_TERMINATED_NOTIFICATION
Defines
#define	SEP_LOGON_TRACK_INDEX_MASK   (0x0000000FL)
#define	SEP_LOGON_TRACK_ARRAY_SIZE   (0x00000010L)
#define	SepRmAcquireDbReadLock()
#define	SepRmAcquireDbWriteLock()
#define	SepRmReleaseDbReadLock()
#define	SepRmReleaseDbWriteLock()
#define	SEP_RM_LSA_SHARED_MEMORY_SIZE   ((ULONG) PAGE_SIZE)
#define	SEP_RM_COMMAND_MAX   4
#define	SEP_TERMINATION_NOTIFY   0x1
Typedefs
typedef _SEP_RM_STATE	SEP_RM_STATE
typedef _SEP_RM_STATE *	PSEP_RM_STATE
typedef _SEP_RM_CONNECT_INFO	SEP_RM_CONNECT_INFO
typedef SEP_RM_CONNECT_INFO *	PSEP_RM_CONNECT_INFO
typedef VOID(*	SEP_RM_COMMAND_WORKER )(PRM_COMMAND_MESSAGE, PRM_REPLY_MESSAGE)
typedef _SEP_LOGON_SESSION_REFERENCES	SEP_LOGON_SESSION_REFERENCES
typedef _SEP_LOGON_SESSION_REFERENCES *	PSEP_LOGON_SESSION_REFERENCES
typedef _SEP_LOGON_SESSION_TERMINATED_NOTIFICATION	SEP_LOGON_SESSION_TERMINATED_NOTIFICATION
typedef _SEP_LOGON_SESSION_TERMINATED_NOTIFICATION *	PSEP_LOGON_SESSION_TERMINATED_NOTIFICATION
Functions
BOOLEAN	SepRmDbInitialization (VOID)
VOID	SepRmCommandServerThread (IN PVOID StartContext)
BOOLEAN	SepRmCommandServerThreadInit ()
VOID	SepRmComponentTestCommandWrkr (IN PRM_COMMAND_MESSAGE CommandMessage, OUT PRM_REPLY_MESSAGE ReplyMessage)
VOID	SepRmSetAuditEventWrkr (IN PRM_COMMAND_MESSAGE CommandMessage, OUT PRM_REPLY_MESSAGE ReplyMessage)
VOID	SepRmSendCommandToLsaWrkr (IN PRM_COMMAND_MESSAGE CommandMessage, OUT PRM_REPLY_MESSAGE ReplyMessage)
VOID	SepRmCreateLogonSessionWrkr (IN PRM_COMMAND_MESSAGE CommandMessage, OUT PRM_REPLY_MESSAGE ReplyMessage)
VOID	SepRmDeleteLogonSessionWrkr (IN PRM_COMMAND_MESSAGE CommandMessage, OUT PRM_REPLY_MESSAGE ReplyMessage)
NTSTATUS	SepCreateLogonSessionTrack (IN PLUID LogonId)
NTSTATUS	SepDeleteLogonSessionTrack (IN PLUID LogonId)
Variables
SEP_LOGON_SESSION_TERMINATED_NOTIFICATION	SeFileSystemNotifyRoutinesHead
PEPROCESS	SepRmLsaCallProcess
SEP_RM_STATE	SepRmState
ERESOURCE	SepRmDbLock
PSEP_LOGON_SESSION_REFERENCES *	SepLogonSessions

---

Define Documentation

#define SEP_LOGON_TRACK_ARRAY_SIZE   (0x00000010L)

Definition at line 41 of file rmp.h. Referenced by SepRmDbInitialization().

#define SEP_LOGON_TRACK_INDEX_MASK   (0x0000000FL)

Definition at line 40 of file rmp.h.

#define SEP_RM_COMMAND_MAX   4

Definition at line 116 of file rmp.h.

#define SEP_RM_LSA_SHARED_MEMORY_SIZE   ((ULONG) PAGE_SIZE)

Definition at line 76 of file rmp.h. Referenced by SepRmCallLsa().

#define SEP_TERMINATION_NOTIFY   0x1

Definition at line 134 of file rmp.h. Referenced by SeMarkLogonSessionForTerminationNotification(), and SepDeReferenceLogonSession().

#define SepRmAcquireDbReadLock (   )

Value: KeEnterCriticalRegion(); \ ExAcquireResourceShared(&SepRmDbLock, TRUE) Definition at line 57 of file rmp.h. Referenced by SepNotifyFileSystems().

#define SepRmAcquireDbWriteLock (   )

Value: KeEnterCriticalRegion(); \ ExAcquireResourceExclusive(&SepRmDbLock, TRUE) Definition at line 60 of file rmp.h. Referenced by SeMarkLogonSessionForTerminationNotification(), SepAdtSetAuditLogInformation(), SepCreateLogonSessionTrack(), SepDeleteLogonSessionTrack(), SepDeReferenceLogonSession(), SepReferenceLogonSession(), SeRegisterLogonSessionTerminatedRoutine(), and SeUnregisterLogonSessionTerminatedRoutine().

#define SepRmReleaseDbReadLock (   )

Value: ExReleaseResource(&SepRmDbLock); \ KeLeaveCriticalRegion() Definition at line 63 of file rmp.h. Referenced by SepNotifyFileSystems().

#define SepRmReleaseDbWriteLock (   )

Value: ExReleaseResource(&SepRmDbLock); \ KeLeaveCriticalRegion() Definition at line 66 of file rmp.h. Referenced by SeMarkLogonSessionForTerminationNotification(), SepAdtSetAuditLogInformation(), SepCreateLogonSessionTrack(), SepDeleteLogonSessionTrack(), SepDeReferenceLogonSession(), SepReferenceLogonSession(), SeRegisterLogonSessionTerminatedRoutine(), and SeUnregisterLogonSessionTerminatedRoutine().

---

Typedef Documentation

typedef struct _SEP_LOGON_SESSION_REFERENCES * PSEP_LOGON_SESSION_REFERENCES

Referenced by SepReferenceLogonSession().

typedef struct _SEP_LOGON_SESSION_TERMINATED_NOTIFICATION * PSEP_LOGON_SESSION_TERMINATED_NOTIFICATION

Referenced by SeRegisterLogonSessionTerminatedRoutine().

typedef struct SEP_RM_CONNECT_INFO* PSEP_RM_CONNECT_INFO

Definition at line 109 of file rmp.h.

typedef struct _SEP_RM_STATE * PSEP_RM_STATE

typedef struct _SEP_LOGON_SESSION_REFERENCES SEP_LOGON_SESSION_REFERENCES

Referenced by SepCreateLogonSessionTrack().

typedef struct _SEP_LOGON_SESSION_TERMINATED_NOTIFICATION SEP_LOGON_SESSION_TERMINATED_NOTIFICATION

typedef VOID(* SEP_RM_COMMAND_WORKER)(PRM_COMMAND_MESSAGE, PRM_REPLY_MESSAGE)

Definition at line 118 of file rmp.h.

typedef struct _SEP_RM_CONNECT_INFO SEP_RM_CONNECT_INFO

Referenced by SeRmInitPhase1().

typedef struct _SEP_RM_STATE SEP_RM_STATE

---

Function Documentation

NTSTATUS SepCreateLogonSessionTrack (  IN PLUID  LogonId  )

Definition at line 541 of file rmlogon.c. References ExAllocatePoolWithTag, ExFreePool(), _SEP_LOGON_SESSION_REFERENCES::LogonId, _SEP_LOGON_SESSION_REFERENCES::Next, NULL, PAGED_CODE, PagedPool, _SEP_LOGON_SESSION_REFERENCES::ReferenceCount, RtlEqualLuid(), SEP_LOGON_SESSION_REFERENCES, SepLogonSessionIndex, SepLogonSessions, SepRmAcquireDbWriteLock, and SepRmReleaseDbWriteLock. Referenced by SepRmCreateLogonSessionWrkr(), and SepRmDbInitialization(). : This routine creates a new logon session tracking record. This should only be called as a dispatch routine for a LSA->RM call (and once during system initialization). If the specified logon session already exists, then an error is returned. Arguments: LogonId - Pointer to the logon session ID for which a new logon track is to be created. Return Value: STATUS_SUCCESS - The logon session track was created successfully. STATUS_LOGON_SESSION_EXISTS - The logon session already exists. A new one has not been created. --*/ { ULONG SessionArrayIndex; PSEP_LOGON_SESSION_REFERENCES Previous, Current; PSEP_LOGON_SESSION_REFERENCES LogonSessionTrack; PAGED_CODE(); // // Make sure we can allocate a new logon session track record // LogonSessionTrack = (PSEP_LOGON_SESSION_REFERENCES) ExAllocatePoolWithTag( PagedPool, sizeof(SEP_LOGON_SESSION_REFERENCES), 'sLeS' ); if (LogonSessionTrack == NULL) { return STATUS_INSUFFICIENT_RESOURCES; } LogonSessionTrack->LogonId = (*LogonId); LogonSessionTrack->ReferenceCount = 0; SessionArrayIndex = SepLogonSessionIndex( LogonId ); // // Protect modification of reference monitor database // SepRmAcquireDbWriteLock(); // // Now walk the list for our logon session array hash index // looking for a duplicate logon session ID. // Previous = (PSEP_LOGON_SESSION_REFERENCES) ((PVOID)&SepLogonSessions[ SessionArrayIndex ]); Current = Previous->Next; while (Current != NULL) { if (RtlEqualLuid( LogonId, &Current->LogonId) ) { // // One already exists. Hmmm. // SepRmReleaseDbWriteLock(); ExFreePool(LogonSessionTrack); return STATUS_LOGON_SESSION_EXISTS; } Previous = Current; Current = Current->Next; } // // Reached the end of the list without finding a duplicate. // Add the new one. // LogonSessionTrack->Next = SepLogonSessions[ SessionArrayIndex ]; SepLogonSessions[ SessionArrayIndex ] = LogonSessionTrack; SepRmReleaseDbWriteLock(); return STATUS_SUCCESS; }

NTSTATUS SepDeleteLogonSessionTrack (  IN PLUID  LogonId  )

Definition at line 655 of file rmlogon.c. References ExFreePool(), _SEP_LOGON_SESSION_REFERENCES::LogonId, _SEP_LOGON_SESSION_REFERENCES::Next, NULL, PAGED_CODE, _SEP_LOGON_SESSION_REFERENCES::ReferenceCount, RtlEqualLuid(), SepLogonSessionIndex, SepLogonSessions, SepRmAcquireDbWriteLock, and SepRmReleaseDbWriteLock. Referenced by SepRmDeleteLogonSessionWrkr(). : This routine creates a new logon session tracking record. This should only be called as a dispatch routine for a LSA->RM call (and once during system initialization). If the specified logon session already exists, then an error is returned. Arguments: LogonId - Pointer to the logon session ID whose logon track is to be deleted. Return Value: STATUS_SUCCESS - The logon session track was deleted successfully. STATUS_BAD_LOGON_SESSION_STATE - The logon session has a non-zero reference count and can not be deleted. STATUS_NO_SUCH_LOGON_SESSION - The specified logon session does not exist. --*/ { ULONG SessionArrayIndex; PSEP_LOGON_SESSION_REFERENCES Previous, Current; PAGED_CODE(); SessionArrayIndex = SepLogonSessionIndex( LogonId ); // // Protect modification of reference monitor database // SepRmAcquireDbWriteLock(); // // Now walk the list for our logon session array hash index. // Previous = (PSEP_LOGON_SESSION_REFERENCES) ((PVOID)&SepLogonSessions[ SessionArrayIndex ]); Current = Previous->Next; while (Current != NULL) { // // If we found it, make sure reference count is zero // if (RtlEqualLuid( LogonId, &Current->LogonId) ) { if (Current->ReferenceCount == 0) { // // Pull it from the list // Previous->Next = Current->Next; // // No longer need to protect our pointer to this // record. // SepRmReleaseDbWriteLock(); // // Deallocate the logon session track record. // ExFreePool( (PVOID)Current ); return STATUS_SUCCESS; } // // reference count was not zero. This is not considered // a healthy situation. Return an error and let someone // else declare the bug check. // SepRmReleaseDbWriteLock(); return STATUS_BAD_LOGON_SESSION_STATE; } Previous = Current; Current = Current->Next; } SepRmReleaseDbWriteLock(); // // Someone asked us to delete a logon session that isn't // in the database. // return STATUS_NO_SUCH_LOGON_SESSION; }

VOID SepRmCommandServerThread (  IN PVOID  StartContext  )

Definition at line 309 of file rmmain.c. References NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, ReplyMessage(), _SEP_RM_STATE::RmCommandPortHandle, SepRmCommandDispatch, SepRmCommandServerThreadInit(), SepRmState, and Status. Referenced by SeRmInitPhase1(). : This function is executed indefinitely by a dedicated permanent thread of the Sysinit Process, called the Reference Monitor Server Thread. This thread updates Reference Monitor Global State Data by dispatching commands sent from the LSA through the the Reference Monitor LPC Command Port. The following steps are repeated indefinitely: o Initialize RM Command receive and reply buffer headers o Perform remaining Reference Monitor initialization involving LSA o Wait for RM command sent from LSA, send reply to previous command (if any) o Validate command o Dispatch to command worker routine to execute command. Arguments: None. Return Value: None. --*/ { NTSTATUS Status; PRM_REPLY_MESSAGE Reply; RM_COMMAND_MESSAGE CommandMessage; RM_REPLY_MESSAGE ReplyMessage; PAGED_CODE(); // // Perform the rest of the Reference Monitor initialization, involving // synchronization with the LSA or dependency on the LSA having run. // if (!SepRmCommandServerThreadInit()) { KdPrint(("Security: Terminating Rm Command Server Thread\n")); return; } // // Initialize LPC port message header type and length fields for the // received command message. // CommandMessage.MessageHeader.u2.ZeroInit = 0; CommandMessage.MessageHeader.u1.s1.TotalLength = (CSHORT) sizeof(RM_COMMAND_MESSAGE); CommandMessage.MessageHeader.u1.s1.DataLength = CommandMessage.MessageHeader.u1.s1.TotalLength - (CSHORT) sizeof(PORT_MESSAGE); // // Initialize the LPC port message header type and data sizes for // for the reply message. // ReplyMessage.MessageHeader.u2.ZeroInit = 0; ReplyMessage.MessageHeader.u1.s1.TotalLength = (CSHORT) sizeof(RM_COMMAND_MESSAGE); ReplyMessage.MessageHeader.u1.s1.DataLength = ReplyMessage.MessageHeader.u1.s1.TotalLength - (CSHORT) sizeof(PORT_MESSAGE); // // First time through, there is no reply. // Reply = NULL; // // Now loop indefinitely, processing incoming Rm commands from the LSA. // for(;;) { // // Wait for Command, send reply to previous command (if any) // Status = ZwReplyWaitReceivePort( SepRmState.RmCommandPortHandle, NULL, (PPORT_MESSAGE) Reply, (PPORT_MESSAGE) &CommandMessage ); if (!NT_SUCCESS(Status)) { // // malicious user apps can try to connect to this port. We will // fail later, but if their thread vanishes, we'll get a failure // here. Ignore it: // if ( Status == STATUS_UNSUCCESSFUL ) { // // skip it: // Reply = NULL ; continue; } KdPrint(("Security: RM message receive from Lsa failed %lx\n", Status)); } // // Now dispatch to a routine to handle the command. Allow // command errors to occur without bringing system down just now. // if ( CommandMessage.MessageHeader.u2.s2.Type == LPC_REQUEST ) { (*(SepRmCommandDispatch[CommandMessage.CommandNumber])) (&CommandMessage, &ReplyMessage); // // Initialize the client thread info and message id for the // reply message. First time through, the reply message structure // is not used. // ReplyMessage.MessageHeader.ClientId = CommandMessage.MessageHeader.ClientId; ReplyMessage.MessageHeader.MessageId = CommandMessage.MessageHeader.MessageId; Reply = &ReplyMessage; } else { Reply = NULL; } } // end_for // // Make compiler ferme la bouche // StartContext; }

BOOLEAN SepRmCommandServerThreadInit (   )

Referenced by SepRmCommandServerThread().

VOID SepRmComponentTestCommandWrkr (  IN PRM_COMMAND_MESSAGE  CommandMessage, OUT PRM_REPLY_MESSAGE  ReplyMessage )

Definition at line 758 of file rmmain.c. References ASSERT, PAGED_CODE, and ReplyMessage(). : BUGWARNING - Remove this command when other RM commands are implemented. Until then, this command is the only way a CT can verify that an RM command with parameters is sent correctly. This function processes the Component Test RM command. This is a temporary command that can be used to verify that the link from RM to LSA is working. This command verifies that the link is working by receiving a ULONG parameter and verifying that it has the expected value. Arguments: CommandMessage - Pointer to structure containing RM command message information consisting of an LPC PORT_MESSAGE structure followed by the command number (RmComponentTestCommand). This command currently has one parameter, a fixed ulong value. ReplyMessage - Pointer to structure containing LSA reply message information consisting of an LPC PORT_MESSAGE structure followed by the command ReturnedStatus field in which a status code from the command will be returned. Return Value: VOID --*/ { PAGED_CODE(); ReplyMessage->ReturnedStatus = STATUS_SUCCESS; // // Strict check that command is correct. // ASSERT( CommandMessage->CommandNumber == RmComponentTestCommand ); KdPrint(("Security: RM Component Test Command Received\n")); // // Verify that the parameter value passed is as expected. // if (*((ULONG *) CommandMessage->CommandParams) != RM_CT_COMMAND_PARAM_VALUE ) { ReplyMessage->ReturnedStatus = STATUS_INVALID_PARAMETER; } return; }

VOID SepRmCreateLogonSessionWrkr (  IN PRM_COMMAND_MESSAGE  CommandMessage, OUT PRM_REPLY_MESSAGE  ReplyMessage )

Definition at line 122 of file rmlogon.c. References ASSERT, NTSTATUS(), PAGED_CODE, ReplyMessage(), SepCreateLogonSessionTrack(), and Status. : This function is the dispatch routine for the LSA --> RM "CreateLogonSession" call. The arguments passed to this routine are defined by the type SEP_RM_COMMAND_WORKER. Arguments: CommandMessage - Points to structure containing RM command message information consisting of an LPC PORT_MESSAGE structure followed by the command number (RmComponentTestCommand) and a command-specific body. The command-specific body of this parameter is a LUID of the logon session to be created. ReplyMessage - Pointer to structure containing LSA reply message information consisting of an LPC PORT_MESSAGE structure followed by the command ReturnedStatus field in which a status code from the command will be returned. Return Value: VOID --*/ { NTSTATUS Status; LUID LogonId; PAGED_CODE(); // // Check that command is expected type // ASSERT( CommandMessage->CommandNumber == RmCreateLogonSession ); // // Typecast the command parameter to what we expect. // LogonId = *((LUID UNALIGNED *) CommandMessage->CommandParams); // // Try to create the logon session tracking record // Status = SepCreateLogonSessionTrack( &LogonId ); // // Set the reply status // ReplyMessage->ReturnedStatus = Status; return; }

BOOLEAN SepRmDbInitialization (  VOID   )

Definition at line 95 of file rmvars.c. References ASSERT, _SEP_RM_STATE::AuditingEnabled, ExAllocatePoolWithTag, ExInitializeResource, FALSE, NT_SUCCESS, NTSTATUS(), NULL, _SEP_RM_STATE::OperationalMode, PagedPool, SeAnonymousAuthenticationId, SEP_LOGON_TRACK_ARRAY_SIZE, SepCreateLogonSessionTrack(), SepLogonSessions, SepRmDbLock, SepRmState, SeSystemAuthenticationId, Status, and TRUE. Referenced by SepRmInitPhase0(). 00100 : 00101 00102 This function initializes the reference monitor in-memory database. 00103 00104 Arguments: 00105 00106 None. 00107 00108 Return Value: 00109 00110 TRUE if database successfully initialized. 00111 FALSE if not successfully initialized. 00112 00113 --*/ 00114 { 00115 NTSTATUS Status; 00116 ULONG i; 00117 00118 00119 // 00120 // Create the reference monitor database lock 00121 // 00122 // Use SepRmAcquireDbReadLock() 00123 // SepRmAcquireDbWriteLock() 00124 // SepRmReleaseDbReadLock() 00125 // SepRmReleaseDbWriteLock() 00126 // 00127 // to gain access to the reference monitor database. 00128 // 00129 00130 ExInitializeResource(&SepRmDbLock); 00131 00132 // 00133 // Initialize the Logon Session tracking array. 00134 // 00135 00136 SepLogonSessions = ExAllocatePoolWithTag( PagedPool, 00137 sizeof( PSEP_LOGON_SESSION_REFERENCES ) * SEP_LOGON_TRACK_ARRAY_SIZE, 00138 'SLeS' 00139 ); 00140 00141 if (SepLogonSessions == NULL) { 00142 return( FALSE ); 00143 } 00144 00145 for (i=0;i<SEP_LOGON_TRACK_ARRAY_SIZE;i++) { 00146 00147 SepLogonSessions[ i ] = NULL; 00148 } 00149 00150 // 00151 // Now add in a record representing the system logon session. 00152 // 00153 00154 Status = SepCreateLogonSessionTrack( &SeSystemAuthenticationId ); 00155 ASSERT( NT_SUCCESS(Status) ); 00156 if ( !NT_SUCCESS(Status)) { 00157 return FALSE; 00158 } 00159 00160 // 00161 // Add one for the null session logon session 00162 // 00163 00164 Status = SepCreateLogonSessionTrack( &SeAnonymousAuthenticationId ); 00165 ASSERT( NT_SUCCESS(Status) ); 00166 if ( !NT_SUCCESS(Status)) { 00167 return FALSE; 00168 } 00169 00170 00171 00172 00173 // 00174 // The correct RM state will be set when the local security policy 00175 // information is retrieved (by the LSA) and subsequently passed to 00176 // the reference monitor later on in initialization. For now, initialize 00177 // the state to something that will work for the remainder of 00178 // system initialization. 00179 // 00180 00181 SepRmState.AuditingEnabled = 0; // auditing state disabled. 00182 SepRmState.OperationalMode = LSA_MODE_PASSWORD_PROTECTED; 00183 00184 00185 00186 return TRUE; 00187 00188 00189 } }

VOID SepRmDeleteLogonSessionWrkr (  IN PRM_COMMAND_MESSAGE  CommandMessage, OUT PRM_REPLY_MESSAGE  ReplyMessage )

Definition at line 200 of file rmlogon.c. References ASSERT, NTSTATUS(), PAGED_CODE, ReplyMessage(), SepDeleteLogonSessionTrack(), and Status. : This function is the dispatch routine for the LSA --> RM "DeleteLogonSession" call. The arguments passed to this routine are defined by the type SEP_RM_COMMAND_WORKER. Arguments: CommandMessage - Points to structure containing RM command message information consisting of an LPC PORT_MESSAGE structure followed by the command number (RmComponentTestCommand) and a command-specific body. The command-specific body of this parameter is a LUID of the logon session to be created. ReplyMessage - Pointer to structure containing LSA reply message information consisting of an LPC PORT_MESSAGE structure followed by the command ReturnedStatus field in which a status code from the command will be returned. Return Value: VOID --*/ { NTSTATUS Status; LUID LogonId; PAGED_CODE(); // // Check that command is expected type // ASSERT( CommandMessage->CommandNumber == RmDeleteLogonSession ); // // Typecast the command parameter to what we expect. // LogonId = *((LUID UNALIGNED *) CommandMessage->CommandParams); // // Try to create the logon session tracking record // Status = SepDeleteLogonSessionTrack( &LogonId ); // // Set the reply status // ReplyMessage->ReturnedStatus = Status; return; }

VOID SepRmSendCommandToLsaWrkr (  IN PRM_COMMAND_MESSAGE  CommandMessage, OUT PRM_REPLY_MESSAGE  ReplyMessage )

Definition at line 824 of file rmmain.c. References ASSERT, NULL, PAGED_CODE, and ReplyMessage(). : This function carries out the special Rm Send Command To Lsa Command. This command is used only by the ctlsarm component test which checks that LSA to RM and RM to LSA communication via LPC is working. Arguments: CommandMessage - Pointer to structure containing RM command message information consisting of an LPC PORT_MESSAGE structure followed by the command number (RmDisableAuditCommand), followed by the command parameters. The parameters of this special command consists of the Command Number of an LSA command and its parameters (if any). ReplyMessage - Pointer to structure containing RM reply message information consisting of an LPC PORT_MESSAGE structure followed by the command ReturnedStatus field in which a status code from the command will be returned. Return Value: VOID --*/ { // // Obtain a pointer to the LSA command's params, and the size of the // params in bytes. If there are no params, set the pointer to NULL. // PVOID LsaCommandParams = ((RM_SEND_COMMAND_TO_LSA_PARAMS *) (CommandMessage->CommandParams))->LsaCommandParams; ULONG LsaCommandParamsLength = ((RM_SEND_COMMAND_TO_LSA_PARAMS *) (CommandMessage->CommandParams))->LsaCommandParamsLength; PAGED_CODE(); if (LsaCommandParamsLength == 0) { LsaCommandParams = NULL; } // // Strict check that command is correct one for this worker. // ASSERT( CommandMessage->CommandNumber == RmSendCommandToLsaCommand ); KdPrint(("Security: RM Send Command back to LSA Command Received\n")); ReplyMessage->ReturnedStatus = STATUS_SUCCESS; // Status = SepRmCallLsa( // ((RM_SEND_COMMAND_TO_LSA_PARAMS *) // (CommandMessage->CommandParams))->LsaCommandNumber, // LsaCommandParams, // LsaCommandParamsLength, // NULL, // 0, // NULL, // NULL // ); return; }

VOID SepRmSetAuditEventWrkr (  IN PRM_COMMAND_MESSAGE  CommandMessage, OUT PRM_REPLY_MESSAGE  ReplyMessage )

Definition at line 51 of file rmaudit.c. References ASSERT, _SE_AUDITING_STATE::AuditOnFailure, _SE_AUDITING_STATE::AuditOnSuccess, FALSE, PAGED_CODE, ReplyMessage(), SeAuditingState, SeDetailedAuditing, SepAdtAuditingEnabled, SepAdtInitializeBounds(), and TRUE. : This function carries out the Reference Monitor Set Audit Event Command. This command enables or disables auditing and optionally sets the auditing events. Arguments: CommandMessage - Pointer to structure containing RM command message information consisting of an LPC PORT_MESSAGE structure followed by the command number (RmSetAuditStateCommand) and a single command parameter in structure form. ReplyMessage - Pointer to structure containing RM reply message information consisting of an LPC PORT_MESSAGE structure followed by the command ReturnedStatus field in which a status code from the command will be returned. Return Value: VOID --*/ { PPOLICY_AUDIT_EVENT_OPTIONS EventAuditingOptions; POLICY_AUDIT_EVENT_TYPE EventType; PAGED_CODE(); SepAdtInitializeBounds(); ReplyMessage->ReturnedStatus = STATUS_SUCCESS; // // Strict check that command is correct one for this worker. // ASSERT( CommandMessage->CommandNumber == RmAuditSetCommand ); // // Extract the AuditingMode flag and put it in the right place. // SepAdtAuditingEnabled = (((PLSARM_POLICY_AUDIT_EVENTS_INFO) CommandMessage->CommandParams)-> AuditingMode); // // For each element in the passed array, process changes to audit // nothing, and then success or failure flags. // EventAuditingOptions = ((PLSARM_POLICY_AUDIT_EVENTS_INFO) CommandMessage->CommandParams)-> EventAuditingOptions; for ( EventType=AuditEventMinType; EventType <= AuditEventMaxType; EventType++ ) { SeAuditingState[EventType].AuditOnSuccess = FALSE; SeAuditingState[EventType].AuditOnFailure = FALSE; if ( EventAuditingOptions[EventType] & POLICY_AUDIT_EVENT_SUCCESS ) { SeAuditingState[EventType].AuditOnSuccess = TRUE; } if ( EventAuditingOptions[EventType] & POLICY_AUDIT_EVENT_FAILURE ) { SeAuditingState[EventType].AuditOnFailure = TRUE; } } // // Set the flag to indicate that we're auditing detailed events. // This is merely a timesaver so we can skip auditing setup in // time critical places like process creation. // // // Despite what the UI may imply, we never audit failures for detailed events, since // none of them can fail for security related reasons, and we're not interested in // auditing out of memory errors and stuff like that. So just set this flag when // they want to see successes and ignore the failure case. // // We may have to revisit this someday. // if ( SeAuditingState[AuditCategoryDetailedTracking].AuditOnSuccess && SepAdtAuditingEnabled ) { SeDetailedAuditing = TRUE; } else { SeDetailedAuditing = FALSE; } return; }

---

Variable Documentation

SEP_LOGON_SESSION_TERMINATED_NOTIFICATION SeFileSystemNotifyRoutinesHead

Definition at line 151 of file rmp.h. Referenced by SepNotifyFileSystems(), SeRegisterLogonSessionTerminatedRoutine(), and SeUnregisterLogonSessionTerminatedRoutine().

PSEP_LOGON_SESSION_REFERENCES* SepLogonSessions

Definition at line 229 of file rmp.h. Referenced by SeMarkLogonSessionForTerminationNotification(), SepCreateLogonSessionTrack(), SepDeleteLogonSessionTrack(), SepDeReferenceLogonSession(), SepReferenceLogonSession(), and SepRmDbInitialization().

ERESOURCE SepRmDbLock

Definition at line 228 of file rmp.h. Referenced by SepRmDbInitialization().

PEPROCESS SepRmLsaCallProcess

Definition at line 226 of file rmp.h. Referenced by SepRmCallLsa(), and SepRmCommandServerThreadInit().

SEP_RM_STATE SepRmState

Definition at line 227 of file rmp.h. Referenced by SepRmCallLsa(), SepRmCommandServerThread(), SepRmCommandServerThreadInit(), SepRmDbInitialization(), and SeRmInitPhase1().

---