Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

ob.h File Reference

Go to the source code of this file.

Classes

struct  _OBJECT_HANDLE_INFORMATION
struct  _OBJECT_DUMP_CONTROL
struct  _OBJECT_TYPE_INITIALIZER
struct  _OBJECT_TYPE
struct  _OBJECT_DIRECTORY
struct  _OBJECT_DIRECTORY_ENTRY
struct  _OBJECT_SYMBOLIC_LINK
struct  _DEVICE_MAP
struct  _OBJECT_HANDLE_COUNT_ENTRY
struct  _OBJECT_HANDLE_COUNT_DATABASE
struct  _OBJECT_CREATE_INFORMATION
struct  _OBJECT_HEADER
struct  _OBJECT_HEADER_QUOTA_INFO
struct  _OBJECT_HEADER_HANDLE_INFO
struct  _OBJECT_HEADER_NAME_INFO
struct  _OBJECT_HEADER_CREATOR_INFO

Defines

#define NUMBER_HASH_BUCKETS   37
#define OB_FLAG_NEW_OBJECT   0x01
#define OB_FLAG_KERNEL_OBJECT   0x02
#define OB_FLAG_CREATOR_INFO   0x04
#define OB_FLAG_EXCLUSIVE_OBJECT   0x08
#define OB_FLAG_PERMANENT_OBJECT   0x10
#define OB_FLAG_DEFAULT_SECURITY_QUOTA   0x20
#define OB_FLAG_SINGLE_HANDLE_ENTRY   0x40
#define OBJECT_TO_OBJECT_HEADER(o)   CONTAINING_RECORD( (o), OBJECT_HEADER, Body )
#define OBJECT_HEADER_TO_EXCLUSIVE_PROCESS(oh)
#define OBJECT_HEADER_TO_QUOTA_INFO(oh)
#define OBJECT_HEADER_TO_HANDLE_INFO(oh)
#define OBJECT_HEADER_TO_NAME_INFO(oh)
#define OBJECT_HEADER_TO_CREATOR_INFO(oh)
#define ObDereferenceObject(a)   ObfDereferenceObject(a)
#define ObReferenceObject(Object)

Typedefs

typedef _OBJECT_HANDLE_INFORMATION OBJECT_HANDLE_INFORMATION
typedef _OBJECT_HANDLE_INFORMATION * POBJECT_HANDLE_INFORMATION
typedef _OBJECT_DUMP_CONTROL OB_DUMP_CONTROL
typedef _OBJECT_DUMP_CONTROL * POB_DUMP_CONTROL
typedef VOID(* OB_DUMP_METHOD )(IN PVOID Object, IN POB_DUMP_CONTROL Control OPTIONAL)
typedef enum _OB_OPEN_REASON OB_OPEN_REASON
typedef VOID(* OB_OPEN_METHOD )(IN OB_OPEN_REASON OpenReason, IN PEPROCESS Process OPTIONAL, IN PVOID Object, IN ACCESS_MASK GrantedAccess, IN ULONG HandleCount)
typedef BOOLEAN(* OB_OKAYTOCLOSE_METHOD )(IN PEPROCESS Process OPTIONAL, IN PVOID Object, IN HANDLE Handle)
typedef VOID(* OB_CLOSE_METHOD )(IN PEPROCESS Process OPTIONAL, IN PVOID Object, IN ACCESS_MASK GrantedAccess, IN ULONG ProcessHandleCount, IN ULONG SystemHandleCount)
typedef VOID(* OB_DELETE_METHOD )(IN PVOID Object)
typedef NTSTATUS(* OB_PARSE_METHOD )(IN PVOID ParseObject, IN PVOID ObjectType, IN OUT PACCESS_STATE AccessState, IN KPROCESSOR_MODE AccessMode, IN ULONG Attributes, IN OUT PUNICODE_STRING CompleteName, IN OUT PUNICODE_STRING RemainingName, IN OUT PVOID Context OPTIONAL, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL, OUT PVOID *Object)
typedef NTSTATUS(* OB_SECURITY_METHOD )(IN PVOID Object, IN SECURITY_OPERATION_CODE OperationCode, IN PSECURITY_INFORMATION SecurityInformation, IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PULONG CapturedLength, IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, IN POOL_TYPE PoolType, IN PGENERIC_MAPPING GenericMapping)
typedef NTSTATUS(* OB_QUERYNAME_METHOD )(IN PVOID Object, IN BOOLEAN HasObjectName, OUT POBJECT_NAME_INFORMATION ObjectNameInfo, IN ULONG Length, OUT PULONG ReturnLength)
typedef _OBJECT_TYPE_INITIALIZER OBJECT_TYPE_INITIALIZER
typedef _OBJECT_TYPE_INITIALIZER * POBJECT_TYPE_INITIALIZER
typedef _OBJECT_TYPE OBJECT_TYPE
typedef _OBJECT_TYPE * POBJECT_TYPE
typedef _OBJECT_DIRECTORY OBJECT_DIRECTORY
typedef _OBJECT_DIRECTORY * POBJECT_DIRECTORY
typedef _OBJECT_DIRECTORY_ENTRY OBJECT_DIRECTORY_ENTRY
typedef _OBJECT_DIRECTORY_ENTRY * POBJECT_DIRECTORY_ENTRY
typedef _OBJECT_SYMBOLIC_LINK OBJECT_SYMBOLIC_LINK
typedef _OBJECT_SYMBOLIC_LINK * POBJECT_SYMBOLIC_LINK
typedef _DEVICE_MAP DEVICE_MAP
typedef _DEVICE_MAP * PDEVICE_MAP
typedef _OBJECT_HANDLE_COUNT_ENTRY OBJECT_HANDLE_COUNT_ENTRY
typedef _OBJECT_HANDLE_COUNT_ENTRY * POBJECT_HANDLE_COUNT_ENTRY
typedef _OBJECT_HANDLE_COUNT_DATABASE OBJECT_HANDLE_COUNT_DATABASE
typedef _OBJECT_HANDLE_COUNT_DATABASE * POBJECT_HANDLE_COUNT_DATABASE
typedef _OBJECT_CREATE_INFORMATION OBJECT_CREATE_INFORMATION
typedef _OBJECT_CREATE_INFORMATION * POBJECT_CREATE_INFORMATION
typedef _OBJECT_HEADER OBJECT_HEADER
typedef _OBJECT_HEADER * POBJECT_HEADER
typedef _OBJECT_HEADER_QUOTA_INFO OBJECT_HEADER_QUOTA_INFO
typedef _OBJECT_HEADER_QUOTA_INFO * POBJECT_HEADER_QUOTA_INFO
typedef _OBJECT_HEADER_HANDLE_INFO OBJECT_HEADER_HANDLE_INFO
typedef _OBJECT_HEADER_HANDLE_INFO * POBJECT_HEADER_HANDLE_INFO
typedef _OBJECT_HEADER_NAME_INFO OBJECT_HEADER_NAME_INFO
typedef _OBJECT_HEADER_NAME_INFO * POBJECT_HEADER_NAME_INFO
typedef _OBJECT_HEADER_CREATOR_INFO OBJECT_HEADER_CREATOR_INFO
typedef _OBJECT_HEADER_CREATOR_INFO * POBJECT_HEADER_CREATOR_INFO

Enumerations

enum  _OB_OPEN_REASON {
  ObCreateHandle, ObOpenHandle, ObDuplicateHandle, ObInheritHandle,
  ObMaxOpenReason
}

Functions

BOOLEAN ObInitSystem (VOID)
NTSTATUS ObInitProcess (PEPROCESS ParentProcess OPTIONAL, PEPROCESS NewProcess)
VOID ObInitProcess2 (PEPROCESS NewProcess)
VOID ObKillProcess (BOOLEAN AcquireLock, PEPROCESS Process)
NTKERNELAPI NTSTATUS ObCreateObjectType (IN PUNICODE_STRING TypeName, IN POBJECT_TYPE_INITIALIZER ObjectTypeInitializer, IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL, OUT POBJECT_TYPE *ObjectType)
VOID FASTCALL ObFreeObjectCreateInfoBuffer (IN POBJECT_CREATE_INFORMATION ObjectCreateInfo)
NTKERNELAPI VOID ObDeleteCapturedInsertInfo (IN PVOID Object)
NTKERNELAPI NTSTATUS ObCreateObject (IN KPROCESSOR_MODE ProbeMode, IN POBJECT_TYPE ObjectType, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE OwnershipMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectBodySize, IN ULONG PagedPoolCharge, IN ULONG NonPagedPoolCharge, OUT PVOID *Object)
NTKERNELAPI NTSTATUS ObInsertObject (IN PVOID Object, IN PACCESS_STATE PassedAccessState OPTIONAL, IN ACCESS_MASK DesiredAccess OPTIONAL, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
NTKERNELAPI NTSTATUS ObReferenceObjectByHandle (IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType OPTIONAL, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
NTKERNELAPI NTSTATUS ObOpenObjectByName (IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PACCESS_STATE PassedAccessState OPTIONAL, IN ACCESS_MASK DesiredAccess OPTIONAL, IN OUT PVOID ParseContext OPTIONAL, OUT PHANDLE Handle)
NTKERNELAPI NTSTATUS ObOpenObjectByPointer (IN PVOID Object, IN ULONG HandleAttributes, IN PACCESS_STATE PassedAccessState OPTIONAL, IN ACCESS_MASK DesiredAccess OPTIONAL, IN POBJECT_TYPE ObjectType OPTIONAL, IN KPROCESSOR_MODE AccessMode, OUT PHANDLE Handle)
NTSTATUS ObReferenceObjectByName (IN PUNICODE_STRING ObjectName, IN ULONG Attributes, IN PACCESS_STATE PassedAccessState OPTIONAL, IN ACCESS_MASK DesiredAccess OPTIONAL, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, OUT PVOID *Object)
NTKERNELAPI VOID ObMakeTemporaryObject (IN PVOID Object)
NTKERNELAPI BOOLEAN ObFindHandleForObject (IN PEPROCESS Process, IN PVOID Object, IN POBJECT_TYPE ObjectType OPTIONAL, IN POBJECT_HANDLE_INFORMATION MatchCriteria OPTIONAL, OUT PHANDLE Handle)
NTKERNELAPI NTSTATUS ObReferenceObjectByPointer (IN PVOID Object, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode)
NTKERNELAPI VOID FASTCALL ObfDereferenceObject (IN PVOID Object)
NTSTATUS ObWaitForSingleObject (IN HANDLE Handle, IN BOOLEAN Alertable, IN PLARGE_INTEGER Timeout OPTIONAL)
NTKERNELAPI NTSTATUS ObQueryNameString (IN PVOID Object, OUT POBJECT_NAME_INFORMATION ObjectNameInfo, IN ULONG Length, OUT PULONG ReturnLength)
NTKERNELAPI ULONG ObGetObjectPointerCount (IN PVOID Object)
NTSTATUS ObQueryTypeName (IN PVOID Object, PUNICODE_STRING ObjectTypeName, IN ULONG Length, OUT PULONG ReturnLength)
NTSTATUS ObQueryTypeInfo (IN POBJECT_TYPE ObjectType, OUT POBJECT_TYPE_INFORMATION ObjectTypeInfo, IN ULONG Length, OUT PULONG ReturnLength)
NTSTATUS ObDumpObjectByHandle (IN HANDLE Handle, IN POB_DUMP_CONTROL Control OPTIONAL)
NTSTATUS ObDumpObjectByPointer (IN PVOID Object, IN POB_DUMP_CONTROL Control OPTIONAL)
NTSTATUS ObSetDeviceMap (IN PEPROCESS TargetProcess, IN HANDLE DirectoryHandle)
NTSTATUS ObQueryDeviceMapInformation (IN PEPROCESS TargetProcess, OUT PPROCESS_DEVICEMAP_INFORMATION DeviceMapInformation)
VOID ObInheritDeviceMap (IN PEPROCESS NewProcess, IN PEPROCESS ParentProcess)
VOID ObDereferenceDeviceMap (IN PEPROCESS Process)
NTSTATUS ObGetObjectSecurity (IN PVOID Object, OUT PSECURITY_DESCRIPTOR *SecurityDescriptor, OUT PBOOLEAN MemoryAllocated)
VOID ObReleaseObjectSecurity (IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN BOOLEAN MemoryAllocated)
NTSTATUS ObAssignObjectSecurityDescriptor (IN PVOID Object, IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL, IN POOL_TYPE PoolType)
NTSTATUS ObValidateSecurityQuota (IN PVOID Object, IN ULONG NewSize)
NTKERNELAPI BOOLEAN ObCheckCreateObjectAccess (IN PVOID DirectoryObject, IN ACCESS_MASK CreateAccess, IN PACCESS_STATE AccessState OPTIONAL, IN PUNICODE_STRING ComponentName, IN BOOLEAN TypeMutexLocked, IN KPROCESSOR_MODE PreviousMode, OUT PNTSTATUS AccessStatus)
NTKERNELAPI BOOLEAN ObCheckObjectAccess (IN PVOID Object, IN PACCESS_STATE AccessState, IN BOOLEAN TypeMutexLocked, IN KPROCESSOR_MODE AccessMode, OUT PNTSTATUS AccessStatus)
NTKERNELAPI NTSTATUS ObAssignSecurity (IN PACCESS_STATE AccessState, IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL, IN PVOID Object, IN POBJECT_TYPE ObjectType)
NTSTATUS ObQueryObjectAuditingByHandle (IN HANDLE Handle, OUT PBOOLEAN GenerateOnClose)
NTSTATUS ObSetSecurityObjectByPointer (IN PVOID Object, IN SECURITY_INFORMATION SecurityInformation, IN PSECURITY_DESCRIPTOR SecurityDescriptor)

Variables

PDEVICE_MAP ObSystemDeviceMap

Define Documentation

#define NUMBER_HASH_BUCKETS   37
 

Definition at line 206 of file ob.h.

Referenced by NtQueryDirectoryObject(), and ObpLookupDirectoryEntry().

#define OB_FLAG_CREATOR_INFO   0x04
 

Definition at line 349 of file ob.h.

Referenced by ObpAllocateObject().

#define OB_FLAG_DEFAULT_SECURITY_QUOTA   0x20
 

Definition at line 352 of file ob.h.

Referenced by ObpChargeQuotaForObject(), ObpFreeObject(), and ObValidateSecurityQuota().

#define OB_FLAG_EXCLUSIVE_OBJECT   0x08
 

Definition at line 350 of file ob.h.

Referenced by NtQueryObject(), ObpAllocateObject(), ObpDecrementHandleCount(), ObpIncrementHandleCount(), and ObpIncrementUnnamedHandleCount().

#define OB_FLAG_KERNEL_OBJECT   0x02
 

Definition at line 348 of file ob.h.

Referenced by ObCreateObjectType(), ObInsertObject(), ObpAllocateObject(), and ObpSetHandleAttributes().

#define OB_FLAG_NEW_OBJECT   0x01
 

Definition at line 347 of file ob.h.

Referenced by ObDeleteCapturedInsertInfo(), ObInsertObject(), ObOpenObjectByName(), ObpAllocateObject(), ObpChargeQuotaForObject(), and ObpFreeObject().

#define OB_FLAG_PERMANENT_OBJECT   0x10
 

Definition at line 351 of file ob.h.

Referenced by NtQueryObject(), ObCreateObject(), ObCreateObjectType(), ObMakeTemporaryObject(), ObpAllocateObject(), and ObpDeleteNameCheck().

#define OB_FLAG_SINGLE_HANDLE_ENTRY   0x40
 

Definition at line 353 of file ob.h.

Referenced by ObpAllocateObject(), ObpDecrementHandleCount(), ObpFreeObject(), ObpIncrementHandleDataBase(), and ObpInsertHandleCount().

#define ObDereferenceObject (  a   )     ObfDereferenceObject(a)
 

Definition at line 494 of file ob.h.

Referenced by _GetUserObjectInformation(), _SetUserObjectInformation(), BuildQueryDirectoryIrp(), CcDeleteSharedCacheMap(), CcPerformReadAhead(), CheckAllowForeground(), CmGetSystemDriverList(), CmNotifyRunDown(), CmpCloneControlSet(), CmpDelayedDerefKeys(), CmpDoCreateChild(), CmpDoOpen(), CmpFileRead(), CmpFileWrite(), CmpFreePostBlock(), CmpLinkHiveToMaster(), CmpOpenHiveFiles(), CmpPostApc(), CmpPostApcRunDown(), CmpPostNotify(), CmpSaveBootControlSet(), DestroyProcessInfo(), DeviceClassCDROMNotify(), ExFreePool(), ExFreePoolWithTag(), ExpCreateWorkerThread(), ExpProfileDelete(), ExpTimerApcRoutine(), ExRegisterCallback(), ExReturnPoolQuota(), ExTimerRundown(), ExUnregisterCallback(), FreeWindowStation(), FsRtlAcknowledgeOplockBreak(), FsRtlCancelExclusiveIrp(), FsRtlNotifyVolumeEvent(), FsRtlOpBatchBreakClosePending(), FsRtlOplockBreakToII(), FsRtlOplockBreakToNone(), FsRtlOplockCleanup(), FsRtlPrivateCheckWaitingLocks(), FsRtlPrivateLock(), FsRtlRemoveAndCompleteIrp(), FsRtlUninitializeOplock(), GetDeviceChangeInfo(), GetProcessLuid(), HalpEnableAutomaticDriveLetterAssignment(), HalpIsOldStyleFloppy(), HalpNextMountLetter(), HalpQueryDriveLayout(), HalpQueryPartitionType(), HalpSetMountLetter(), InitiateWin32kCleanup(), IoAttachDevice(), IoCreateDriver(), IoCreateFile(), IoCreateNotificationEvent(), IoCreateSynchronizationEvent(), IoDeleteController(), IoDeleteDriver(), IoFreeDumpStack(), IoGetBootDiskInformation(), IoGetDmaAdapter(), IopAddDevicesToBootDriverWorker(), IopAllocateIrpCleanup(), IopBusCheck(), IopCallDriverAddDevice(), IopCallDriverAddDeviceQueryRoutine(), IopCheckUnloadDriver(), IopCompleteDumpInitialization(), IopCompleteRequest(), IopCompleteUnloadOrDelete(), IopConfigureCrashDump(), IopCreateArcNames(), IopDeleteDevice(), IopDeleteFile(), IopDeleteLegacyKey(), IopDeleteLockedDeviceNode(), IopDereferenceNotify(), IopDestroyDeviceNode(), IopDeviceActionWorker(), IopDriverLoadingFailed(), IopDropIrp(), IopEnumerateDevice(), IopErrorLogThread(), IopExceptionCleanup(), IopFreePoDeviceNotifyListHead(), IopFreeRelationList(), IopGetDriverDeviceListWorker(), IopGetDumpStack(), IopGetLegacyVetoListDrivers(), IopGetRootDevices(), IopGetSetSecurityObject(), IopInitializeBootDrivers(), IopInitializeBuiltinDriver(), IopInitializeSystemDrivers(), IopInvalidateDeviceStateWorker(), IopInvalidateRelationsInList(), IopInvalidateVolumesForDevice(), IopIsAnyDeviceInstanceEnabled(), IopIsDeviceInstanceEnabled(), IopLoadDriver(), IopLockDeviceRemovalRelations(), IopMarkBootPartition(), IopMountVolume(), IopNotifyTargetDeviceChange(), IopOpenLinkOrRenameTarget(), IopOrphanNotification(), IopParseDevice(), IopProcessNewDeviceNode(), IopProcessRelation(), IopProcessSetInterfaceState(), IopProcessWorkItem(), IopQueryXxxInformation(), IopRebalance(), IopRemoveIndirectRelationsFromList(), IopRemoveRelationFromList(), IopReportTargetDeviceChangeAsyncWorker(), IopRequestDeviceEjectWorker(), IopSendMessageToTrackService(), IopSetDeviceSecurityDescriptors(), IopSetEaOrQuotaInformationFile(), IopStartDriverDevices(), IopTrackLink(), IopUnlockDeviceRemovalRelations(), IopXxxControlFile(), IoRegisterPlugPlayNotification(), IoReportDetectedDevice(), IoSetInformation(), IoUnregisterFsRegistrationChange(), IovpAssertNewRequest(), IovpAssertNonLegacyDevice(), IovpCallDriver1(), IovpCallDriver2(), IovpDeleteDevice(), IovpExamineDevObjForwarding(), IovpStopObRefMonitoring(), IovpThrowBogusSynchronousIrp(), IovpThrowChaffAtStartedPdoStack(), IoWriteErrorLogEntry(), IsRestricted(), KdUpdateTimeSlipEvent(), LockObjectAssignment(), LpcExitThread(), LpcpCopyRequestData(), LpcpCreatePort(), LpcpDeletePort(), LpcpDestroyPortQueue(), LpcpFreeToPortZone(), LpcRequestWaitReplyPort(), MiLoadImageSection(), MiLoadSystemImage(), MiSegmentDelete(), MiSuperSectionDelete(), MmCreateSection(), MmGetFileNameForSection(), MmSetBankedSection(), MmUnloadSystemImage(), NtAcceptConnectPort(), NtAdjustGroupsToken(), NtAdjustPrivilegesToken(), NtAlertResumeThread(), NtAlertThread(), NtAllocateUserPhysicalPages(), NtAllocateVirtualMemory(), NtAssignProcessToJobObject(), NtCancelIoFile(), NtCancelTimer(), NtClearEvent(), NtClose(), NtCompleteConnectPort(), NtCreateJobObject(), NtCreateKey(), NtCreatePagingFile(), NtCreateProfile(), NtCreateSuperSection(), NtCreateSymbolicLinkObject(), NtDeleteKey(), NtDeleteValueKey(), NtDuplicateObject(), NtDuplicateToken(), NtEnumerateKey(), NtEnumerateValueKey(), NtExtendSection(), NtFilterToken(), NtFlushBuffersFile(), NtFlushInstructionCache(), NtFlushKey(), NtFlushVirtualMemory(), NtFreeUserPhysicalPages(), NtFreeVirtualMemory(), NtGetContextThread(), NtImpersonateAnonymousToken(), NtImpersonateClientOfPort(), NtImpersonateThread(), NtListenChannel(), NtLockFile(), NtLockVirtualMemory(), NtMakeTemporaryObject(), NtMapViewOfSection(), NtMapViewOfSuperSection(), NtNotifyChangeDirectoryFile(), NtNotifyChangeMultipleKeys(), NtOpenChannel(), NtOpenKey(), NtOpenObjectAuditAlarm(), NtOpenProcess(), NtOpenProcessToken(), NtOpenThread(), NtOpenThreadToken(), NtPrivilegeCheck(), NtPrivilegedServiceAuditAlarm(), NtPrivilegeObjectAuditAlarm(), NtProtectVirtualMemory(), NtPulseEvent(), NtQueryDirectoryObject(), NtQueryEaFile(), NtQueryEvent(), NtQueryInformationFile(), NtQueryInformationJobObject(), NtQueryInformationPort(), NtQueryInformationProcess(), NtQueryInformationThread(), NtQueryInformationToken(), NtQueryIoCompletion(), NtQueryKey(), NtQueryMultipleValueKey(), NtQueryMutant(), NtQueryObject(), NtQueryOpenSubKeys(), NtQueryQuotaInformationFile(), NtQuerySection(), NtQuerySecurityObject(), NtQuerySemaphore(), NtQuerySymbolicLinkObject(), NtQueryTimer(), NtQueryValueKey(), NtQueryVirtualMemory(), NtQueryVolumeInformationFile(), NtQueueApcThread(), NtReadFile(), NtReadFileScatter(), NtReadVirtualMemory(), NtRegisterThreadTerminatePort(), NtReleaseMutant(), NtReleaseSemaphore(), NtRemoveIoCompletion(), NtReplaceKey(), NtReplyPort(), NtReplyWaitReceivePort(), NtReplyWaitReceivePortEx(), NtReplyWaitReplyPort(), NtReplyWaitSendChannel(), NtRequestPort(), NtRequestWaitReplyPort(), NtResetEvent(), NtRestoreKey(), NtResumeThread(), NtSaveKey(), NtSaveMergedKeys(), NtSecureConnectPort(), NtSendWaitReplyChannel(), NtSetContextThread(), NtSetEaFile(), NtSetEvent(), NtSetHighEventPair(), NtSetHighWaitLowEventPair(), NtSetInformationFile(), NtSetInformationJobObject(), NtSetInformationKey(), NtSetInformationProcess(), NtSetInformationThread(), NtSetInformationToken(), NtSetIoCompletion(), NtSetLowEventPair(), NtSetLowWaitHighEventPair(), NtSetSecurityObject(), NtSetTimer(), NtSetValueKey(), NtSetVolumeInformationFile(), NtSignalAndWaitForSingleObject(), NtStartProfile(), NtStopProfile(), NtSuspendThread(), NtTerminateJobObject(), NtTerminateProcess(), NtTerminateThread(), NtUnloadDriver(), NtUnloadKey(), NtUnlockFile(), NtUnlockVirtualMemory(), NtUnmapViewOfSection(), NtUserBuildHwndList(), NtUserBuildNameList(), NtUserCloseWindowStation(), NtUserGetGuiResources(), NtUserLockWindowStation(), NtUserProcessConnect(), NtUserSetThreadDesktop(), NtUserSetWindowStationUser(), NtUserSwitchDesktop(), NtUserUnlockWindowStation(), NtUserUserHandleGrantAccess(), NtWaitForMultipleObjects(), NtWaitForSingleObject(), NtWaitHighEventPair(), NtWaitLowEventPair(), NtWriteFile(), NtWriteFileGather(), NtWriteVirtualMemory(), ObDereferenceDeviceMap(), ObInsertObject(), ObOpenObjectByName(), ObOpenObjectByPointer(), ObpDeleteNameCheck(), ObpDeleteSymbolicLinkName(), ObpDestroyTypeArray(), ObpLookupObjectName(), ObpProcessDosDeviceSymbolicLink(), ObSetDeviceMap(), obtest(), ObWaitForSingleObject(), OpenCacheKeyEx(), OpenDeviceReparseIndex(), PsAssignImpersonationToken(), PsEnforceExecutionTimeLimits(), PsOpenTokenOfProcess(), PsOpenTokenOfThread(), PspAssignPrimaryToken(), PspCreateProcess(), PspCreateThread(), PspDeleteThreadSecurity(), PspExitProcess(), PspExitThread(), PspJobClose(), PspJobDelete(), PspProcessDelete(), PspQueryPooledQuotaLimits(), PspQueryQuotaLimits(), PspQueryWorkingSetWatch(), PspReaper(), PspSetPrimaryToken(), PspSetQuotaLimits(), PspTerminateAllProcessesInJob(), PspTerminateProcess(), PspTerminateThreadByPointer(), PspThreadDelete(), PsRestoreImpersonation(), PsRevertToSelf(), RawInputThread(), ReferenceWindowStation(), RegisterForDeviceChangeNotifications(), SeAccessCheckByType(), SeDeassignPrimaryToken(), SeIsChildToken(), SeMakeAnonymousLogonToken(), SeMakeSystemToken(), SepAccessCheckAndAuditAlarm(), SepCreateToken(), SepFilterToken(), SepOpenTokenOfThread(), SmbTraceToClient(), UdfCreateInternalStream(), UdfDeleteInternalStream(), UdfDeleteVcb(), UdfInvalidateVolumes(), UdfMountVolume(), UdfVerifyVolume(), UnlockObjectAssignment(), UserDeleteW32Thread(), UserDereferenceObject(), ValidateHdesk(), ValidateHwinsta(), VdmpDelayIntDpcRoutine(), VdmpDelayInterrupt(), VdmpIsThreadTerminating(), VdmpQueueInterrupt(), VdmpQueueIntNormalRoutine(), VdmQueryDirectoryFile(), Win32KDriverUnload(), Win32kNtUserCleanup(), xxxCloseDesktop(), xxxConsoleControl(), xxxCreateDesktop(), xxxCreateDesktop2(), xxxCreateThreadInfo(), xxxCreateWindowStation(), xxxDesktopThread(), xxxGetThreadDesktop(), xxxInitTerminal(), xxxOpenDesktop(), xxxResolveDesktop(), xxxRestoreCsrssThreadDesktop(), xxxSetCsrssThreadDesktop(), xxxSetInformationThread(), xxxSetProcessWindowStation(), and zzzSetDesktop().

#define OBJECT_HEADER_TO_CREATOR_INFO (  oh   ) 
 

Value:

((POBJECT_HEADER_CREATOR_INFO) \
    (((oh)->Flags & OB_FLAG_CREATOR_INFO) == 0 ? NULL : ((PCHAR)(oh) - sizeof(OBJECT_HEADER_CREATOR_INFO))))

Definition at line 371 of file ob.h.

Referenced by ObCreateObjectType(), ObpDecrementHandleCount(), ObpFreeObject(), ObpIncrementHandleCount(), ObpIncrementUnnamedHandleCount(), and ObpRemoveObjectRoutine().

#define OBJECT_HEADER_TO_EXCLUSIVE_PROCESS (  oh   ) 
 

Value:

((oh->Flags & OB_FLAG_EXCLUSIVE_OBJECT) == 0 ? \
    NULL : (((POBJECT_HEADER_QUOTA_INFO)((PCHAR)(oh) - (oh)->QuotaInfoOffset))->ExclusiveProcess))

Definition at line 358 of file ob.h.

Referenced by ObpIncrementHandleCount(), and ObpIncrementUnnamedHandleCount().

#define OBJECT_HEADER_TO_HANDLE_INFO (  oh   ) 
 

Value:

((POBJECT_HEADER_HANDLE_INFO) \
    ((oh)->HandleInfoOffset == 0 ? NULL : ((PCHAR)(oh) - (oh)->HandleInfoOffset)))

Definition at line 365 of file ob.h.

Referenced by ObpDecrementHandleCount(), ObpFreeObject(), ObpIncrementHandleDataBase(), and ObpInsertHandleCount().

#define OBJECT_HEADER_TO_NAME_INFO (  oh   ) 
 

Value:

((POBJECT_HEADER_NAME_INFO) \
    ((oh)->NameInfoOffset == 0 ? NULL : ((PCHAR)(oh) - (oh)->NameInfoOffset)))

Definition at line 368 of file ob.h.

Referenced by _BuildNameList(), IovpStartObRefMonitoring(), IovpStopObRefMonitoring(), NtQueryDirectoryObject(), NtQueryObject(), ObEnumerateObjectsByType(), ObfDereferenceObject(), ObInitSystem(), ObInsertObject(), ObpCreateSymbolicLinkName(), ObpDeleteNameCheck(), ObpFreeObject(), ObpInsertDirectoryEntry(), ObpLookupDirectoryEntry(), ObpLookupObjectName(), ObpProcessDosDeviceSymbolicLink(), ObpRemoveObjectRoutine(), ObQueryNameString(), and xxxCreateWindowStation().

#define OBJECT_HEADER_TO_QUOTA_INFO (  oh   ) 
 

Value:

((POBJECT_HEADER_QUOTA_INFO) \
    ((oh)->QuotaInfoOffset == 0 ? NULL : ((PCHAR)(oh) - (oh)->QuotaInfoOffset)))

Definition at line 362 of file ob.h.

Referenced by NtQueryObject(), ObGetObjectInformation(), ObpChargeQuotaForObject(), ObpDecrementHandleCount(), ObpFreeObject(), ObpIncrementHandleCount(), ObpIncrementUnnamedHandleCount(), and ObValidateSecurityQuota().

#define OBJECT_TO_OBJECT_HEADER (  o   )     CONTAINING_RECORD( (o), OBJECT_HEADER, Body )
 

Definition at line 355 of file ob.h.

Referenced by _BuildNameList(), _GetUserObjectInformation(), _LockWindowStation(), _SetUserObjectInformation(), DestroyWindowStation(), DumpConvInfo(), FreeDesktop(), FreeWindowStation(), IoCreateStreamFileObjectLite(), IovpStartObRefMonitoring(), IovpStopObRefMonitoring(), LockObjectAssignment(), MapDesktop(), NtDuplicateObject(), NtQueryDirectoryObject(), NtQueryObject(), NtQuerySecurityObject(), NtSignalAndWaitForSingleObject(), NtWaitForSingleObject(), ObAssignObjectSecurityDescriptor(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObDeleteCapturedInsertInfo(), ObfDereferenceObject(), ObFindHandleForObject(), ObfReferenceObject(), ObGetObjectPointerCount(), ObGetObjectSecurity(), ObInsertObject(), ObMakeTemporaryObject(), ObOpenObjectByName(), ObOpenObjectByPointer(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), ObpCreateHandle(), ObpCreateSymbolicLinkName(), ObpCreateUnnamedHandle(), ObpDeleteNameCheck(), ObpFreeObject(), ObpIncrementHandleCount(), ObpIncrementUnnamedHandleCount(), ObpInsertDirectoryEntry(), ObpLookupDirectoryEntry(), ObpLookupObjectName(), ObpProcessDosDeviceSymbolicLink(), ObpReferenceSecurityDescriptor(), ObpRemoveObjectRoutine(), ObQueryNameString(), ObQueryTypeName(), ObReferenceObjectByHandle(), ObReferenceObjectByPointer(), ObSetSecurityDescriptorInfo(), ObSetSecurityObjectByPointer(), ObValidateSecurityQuota(), ObWaitForSingleObject(), OkayToCloseDesktop(), OkayToCloseWindowStation(), ParseDesktop(), ParseWindowStation(), UnlockObjectAssignment(), UnmapDesktop(), xxxCreateDesktop2(), and xxxCreateWindowStation().

#define ObReferenceObject (  Object   ) 
 

Value:

{                                \
    POBJECT_HEADER ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object); \
    InterlockedIncrement(&ObjectHeader->PointerCount);             \
}

Definition at line 514 of file ob.h.

Referenced by CcInitializeCacheMap(), CcScheduleReadAhead(), ExAllocatePoolWithQuota(), ExAllocatePoolWithQuotaTag(), ExRegisterCallback(), ExTimerRundown(), FsRtlPrivateCheckWaitingLocks(), FsRtlPrivateLock(), FsRtlRequestExclusiveOplock(), FsRtlRequestOplockII(), InitiateWin32kCleanup(), IoBuildPoDeviceNotifyList(), IoCreateDevice(), IoGetAttachedDeviceReference(), IopAddRelationToList(), IopAllocateErrorLogEntry(), IopBusCheck(), IopCloseFile(), IopDeleteLockedDeviceNode(), IopDeviceActionWorker(), IopDeviceObjectFromDeviceInstance(), IopEnumerateDevice(), IopGetDeviceAttachmentBaseRef(), IopGetDevicePDO(), IopGetFileName(), IopGetSetObjectId(), IopGetSetSecurityObject(), IopGetVolumeId(), IopInitializeBootDrivers(), IopInitializeDeviceInstanceKey(), IopLoadBootFilterDriver(), IopLockDeviceRemovalRelations(), IopMarkBootPartition(), IopMountVolume(), IopNotifyTargetDeviceChange(), IopParseDevice(), IopPnPDispatch(), IopProcessRelation(), IopQueryXxxInformation(), IopQueueDeviceWorkItem(), IopRequestDeviceAction(), IopSetDeviceSecurityDescriptors(), IopSetRemoteLink(), IopTestForReconfiguration(), IoQueueWorkItem(), IoRegisterFsRegistrationChange(), IoReportDetectedDevice(), IoReportTargetDeviceChangeAsynchronous(), IoSetInformation(), IovpGetDeviceAttachedTo(), IovpGetLowestDevice(), IovpStartObRefMonitoring(), LockObjectAssignment(), LpcpCreatePort(), LpcRequestWaitReplyPort(), MiCheckPageFilePath(), MiLoadImageSection(), MmCreateSection(), NtAcceptConnectPort(), NtAssignProcessToJobObject(), NtImpersonateClientOfPort(), NtOpenThreadToken(), NtQueryInformationJobObject(), NtQueryVirtualMemory(), NtReplyPort(), NtReplyWaitReceivePort(), NtReplyWaitReceivePortEx(), NtReplyWaitReplyPort(), NtReplyWaitSendChannel(), NtRequestPort(), NtRequestWaitReplyPort(), NtSecureConnectPort(), NtSendWaitReplyChannel(), ObCreateObjectType(), ObpCreateTypeArray(), ObpDeleteSymbolicLinkName(), ObpLookupObjectName(), ObpProcessDosDeviceSymbolicLink(), ParseDesktop(), ParseWindowStation(), PsEnforceExecutionTimeLimits(), PsImpersonateClient(), PsLookupProcessByProcessId(), PsLookupProcessThreadByCid(), PsLookupThreadByThreadId(), PsOpenTokenOfJobObject(), PspApplyJobLimitsToProcessSet(), PspCreateProcess(), PspCreateThread(), PspTerminateAllProcessesInJob(), PsReferenceEffectiveToken(), PsReferenceImpersonationToken(), PsReferencePrimaryToken(), SeAssignPrimaryToken(), SeCreateClientSecurityFromSubjectContext(), SeExchangePrimaryToken(), SepRmCommandServerThreadInit(), UdfInitializeVcb(), UdfMountVolume(), UdfVerifyVolume(), VdmpDelayInterrupt(), xxxCreateWindowStation(), and xxxInitTerminal().

Typedef Documentation

typedef struct _DEVICE_MAP DEVICE_MAP
 

typedef VOID(* OB_CLOSE_METHOD)(IN PEPROCESS Process OPTIONAL, IN PVOID Object, IN ACCESS_MASK GrantedAccess, IN ULONG ProcessHandleCount, IN ULONG SystemHandleCount)
 

Definition at line 95 of file ob.h.

typedef VOID(* OB_DELETE_METHOD)(IN PVOID Object)
 

Definition at line 103 of file ob.h.

typedef struct _OBJECT_DUMP_CONTROL OB_DUMP_CONTROL
 

typedef VOID(* OB_DUMP_METHOD)(IN PVOID Object, IN POB_DUMP_CONTROL Control OPTIONAL)
 

Definition at line 67 of file ob.h.

typedef BOOLEAN(* OB_OKAYTOCLOSE_METHOD)(IN PEPROCESS Process OPTIONAL, IN PVOID Object, IN HANDLE Handle)
 

Definition at line 89 of file ob.h.

typedef VOID(* OB_OPEN_METHOD)(IN OB_OPEN_REASON OpenReason, IN PEPROCESS Process OPTIONAL, IN PVOID Object, IN ACCESS_MASK GrantedAccess, IN ULONG HandleCount)
 

Definition at line 81 of file ob.h.

typedef enum _OB_OPEN_REASON OB_OPEN_REASON
 

Referenced by MapDesktop(), ObInsertObject(), and ObOpenObjectByName().

typedef NTSTATUS(* OB_PARSE_METHOD)(IN PVOID ParseObject, IN PVOID ObjectType, IN OUT PACCESS_STATE AccessState, IN KPROCESSOR_MODE AccessMode, IN ULONG Attributes, IN OUT PUNICODE_STRING CompleteName, IN OUT PUNICODE_STRING RemainingName, IN OUT PVOID Context OPTIONAL, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL, OUT PVOID *Object)
 

Definition at line 107 of file ob.h.

Referenced by IopCreateObjectTypes(), and ObpLookupObjectName().

typedef NTSTATUS(* OB_QUERYNAME_METHOD)(IN PVOID Object, IN BOOLEAN HasObjectName, OUT POBJECT_NAME_INFORMATION ObjectNameInfo, IN ULONG Length, OUT PULONG ReturnLength)
 

Definition at line 131 of file ob.h.

Referenced by IopCreateObjectTypes().

typedef NTSTATUS(* OB_SECURITY_METHOD)(IN PVOID Object, IN SECURITY_OPERATION_CODE OperationCode, IN PSECURITY_INFORMATION SecurityInformation, IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PULONG CapturedLength, IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, IN POOL_TYPE PoolType, IN PGENERIC_MAPPING GenericMapping)
 

Definition at line 120 of file ob.h.

Referenced by IopCreateObjectTypes().

typedef struct _OBJECT_CREATE_INFORMATION OBJECT_CREATE_INFORMATION
 

typedef struct _OBJECT_DIRECTORY OBJECT_DIRECTORY
 

typedef struct _OBJECT_DIRECTORY_ENTRY OBJECT_DIRECTORY_ENTRY
 

typedef struct _OBJECT_HANDLE_COUNT_DATABASE OBJECT_HANDLE_COUNT_DATABASE
 

typedef struct _OBJECT_HANDLE_COUNT_ENTRY OBJECT_HANDLE_COUNT_ENTRY
 

typedef struct _OBJECT_HANDLE_INFORMATION OBJECT_HANDLE_INFORMATION
 

Referenced by zzzSetDesktop().

typedef struct _OBJECT_HEADER OBJECT_HEADER
 

typedef struct _OBJECT_HEADER_CREATOR_INFO OBJECT_HEADER_CREATOR_INFO
 

typedef struct _OBJECT_HEADER_HANDLE_INFO OBJECT_HEADER_HANDLE_INFO
 

typedef struct _OBJECT_HEADER_NAME_INFO OBJECT_HEADER_NAME_INFO
 

typedef struct _OBJECT_HEADER_QUOTA_INFO OBJECT_HEADER_QUOTA_INFO
 

typedef struct _OBJECT_SYMBOLIC_LINK OBJECT_SYMBOLIC_LINK
 

typedef struct _OBJECT_TYPE OBJECT_TYPE
 

Referenced by ObCreateObjectType().

typedef struct _OBJECT_TYPE_INITIALIZER OBJECT_TYPE_INITIALIZER
 

Referenced by ExpInitializeCallbacks().

typedef struct _DEVICE_MAP * PDEVICE_MAP
 

typedef struct _OBJECT_DUMP_CONTROL * POB_DUMP_CONTROL
 

typedef struct _OBJECT_CREATE_INFORMATION * POBJECT_CREATE_INFORMATION
 

typedef struct _OBJECT_DIRECTORY * POBJECT_DIRECTORY
 

typedef struct _OBJECT_DIRECTORY_ENTRY * POBJECT_DIRECTORY_ENTRY
 

typedef struct _OBJECT_HANDLE_COUNT_DATABASE * POBJECT_HANDLE_COUNT_DATABASE
 

typedef struct _OBJECT_HANDLE_COUNT_ENTRY * POBJECT_HANDLE_COUNT_ENTRY
 

typedef struct _OBJECT_HANDLE_INFORMATION * POBJECT_HANDLE_INFORMATION
 

Referenced by xxxUserFindHandleForObject().

typedef struct _OBJECT_HEADER * POBJECT_HEADER
 

typedef struct _OBJECT_HEADER_CREATOR_INFO * POBJECT_HEADER_CREATOR_INFO
 

typedef struct _OBJECT_HEADER_HANDLE_INFO * POBJECT_HEADER_HANDLE_INFO
 

typedef struct _OBJECT_HEADER_NAME_INFO * POBJECT_HEADER_NAME_INFO
 

typedef struct _OBJECT_HEADER_QUOTA_INFO * POBJECT_HEADER_QUOTA_INFO
 

typedef struct _OBJECT_SYMBOLIC_LINK * POBJECT_SYMBOLIC_LINK
 

typedef struct _OBJECT_TYPE * POBJECT_TYPE
 

typedef struct _OBJECT_TYPE_INITIALIZER * POBJECT_TYPE_INITIALIZER
 

Enumeration Type Documentation

enum _OB_OPEN_REASON
 

Enumeration values:
ObCreateHandle 
ObOpenHandle 
ObDuplicateHandle 
ObInheritHandle 
ObMaxOpenReason 

Definition at line 72 of file ob.h.

Function Documentation

NTSTATUS ObAssignObjectSecurityDescriptor (  IN PVOID  Object,
IN PSECURITY_DESCRIPTOR SecurityDescriptor  OPTIONAL,
IN POOL_TYPE  PoolType
) 
 

Definition at line 1183 of file obse.c.

References NT_SUCCESS, NTSTATUS(), NULL, OBJECT_TO_OBJECT_HEADER, ObpLogSecurityDescriptor(), PAGED_CODE, and Status.

Referenced by CmpSecurityMethod(), SeDefaultObjectMethod(), SeMakeAnonymousLogonToken(), and SeMakeSystemToken(). 

01191                    :
01192 
01193     Takes a pointer to an object and sets the SecurityDescriptor field
01194     in the object's header.
01195 
01196 Arguments:
01197 
01198     Object - Supplies a pointer to the object
01199 
01200     SecurityDescriptor - Supplies a pointer to the security descriptor
01201         to be assigned to the object.  This pointer may be null if there
01202         is no security on the object.
01203 
01204     PoolType - Supplies the type of pool memory used to allocate the
01205         security descriptor.  This field is currently ignored.
01206 
01207 Return Value:
01208 
01209     An appropriate NTSTATUS value.
01210 
01211 --*/
01212 
01213 {
01214     NTSTATUS Status;
01215     PSECURITY_DESCRIPTOR OutputSecurityDescriptor;
01216 
01217     PAGED_CODE();
01218 
01219     //
01220     //  If the security descriptor isn't supplied then we set the
01221     //  object header's security descriptor to null and return
01222     //  to our caller
01223     //
01224 
01225     if (!ARGUMENT_PRESENT(SecurityDescriptor)) {
01226 
01227         OBJECT_TO_OBJECT_HEADER( Object )->SecurityDescriptor = NULL;
01228 
01229         return( STATUS_SUCCESS );
01230     }
01231 
01232     //
01233     //  Log the new security descriptor into our security database and
01234     //  get back the real security descriptor to use
01235     //
01236 
01237     Status = ObpLogSecurityDescriptor( SecurityDescriptor, &OutputSecurityDescriptor );
01238 
01239     //
01240     //  If we've been successful so far then set the object's
01241     //  security descriptor to the newly allocated one.
01242     //
01243 
01244     if (NT_SUCCESS(Status)) {
01245 
01246         OBJECT_TO_OBJECT_HEADER( Object )->SecurityDescriptor = OutputSecurityDescriptor;
01247     }
01248 
01249     //
01250     //  And return to our caller
01251     //
01252 
01253     return( Status );
01254 }

NTKERNELAPI NTSTATUS ObAssignSecurity (  IN PACCESS_STATE  AccessState,
IN PSECURITY_DESCRIPTOR ParentDescriptor  OPTIONAL,
IN PVOID  Object,
IN POBJECT_TYPE  ObjectType
) 
 

Definition at line 1574 of file obse.c.

References AssignSecurityDescriptor, NT_SUCCESS, NTSTATUS(), NULL, ObpBeginTypeSpecificCallOut, ObpDirectoryObjectType, ObpEndTypeSpecificCallOut, PAGED_CODE, PagedPool, SeAssignSecurity(), SeDeassignSecurity(), and Status.

Referenced by ObInsertObject(), and xxxCreateDesktop2(). 

01583                    :
01584 
01585     This routine will assign a security descriptor to a newly created object.
01586     It assumes that the AccessState parameter contains a captured security
01587     descriptor.
01588 
01589 Arguments:
01590 
01591      AccessState - The AccessState containing the security information
01592         for this object creation.
01593 
01594      ParentDescriptor - The security descriptor from the parent object, if
01595         available.
01596 
01597      Object - A pointer to the object being created.
01598 
01599      ObjectType - Supplies the type of object being created.
01600 
01601 Return Value:
01602 
01603     STATUS_SUCCESS - indicates the operation was successful.
01604 
01605     STATUS_INVALID_OWNER - The owner SID provided as the owner of the
01606         target security descriptor is not one the caller is authorized
01607         to assign as the owner of an object.
01608 
01609     STATUS_PRIVILEGE_NOT_HELD - The caller does not have the privilege
01610         necessary to explicitly assign the specified system ACL.
01611         SeSecurityPrivilege privilege is needed to explicitly assign
01612         system ACLs to objects.
01613 
01614 --*/
01615 
01616 {
01617     PSECURITY_DESCRIPTOR NewDescriptor = NULL;
01618     NTSTATUS Status;
01619     KIRQL SaveIrql;
01620 
01621     PAGED_CODE();
01622 
01623     //
01624     //  SeAssignSecurity will construct the final version
01625     //  of the security  descriptor
01626     //
01627 
01628     Status = SeAssignSecurity( ParentDescriptor,
01629                                AccessState->SecurityDescriptor,
01630                                &NewDescriptor,
01631                                (BOOLEAN)(ObjectType == ObpDirectoryObjectType),
01632                                &AccessState->SubjectSecurityContext,
01633                                &ObjectType->TypeInfo.GenericMapping,
01634                                PagedPool );
01635 
01636     if (!NT_SUCCESS( Status )) {
01637 
01638         return( Status );
01639     }
01640 
01641     ObpBeginTypeSpecificCallOut( SaveIrql );
01642 
01643     //
01644     //  Now invoke the security method callback to finish
01645     //  the assignment.
01646     //
01647 
01648     Status = (*ObjectType->TypeInfo.SecurityProcedure)( Object,
01649                                                         AssignSecurityDescriptor,
01650                                                         NULL,
01651                                                         NewDescriptor,
01652                                                         NULL,
01653                                                         NULL,
01654                                                         PagedPool,
01655                                                         &ObjectType->TypeInfo.GenericMapping );
01656 
01657     ObpEndTypeSpecificCallOut( SaveIrql, "Security", ObjectType, Object );
01658 
01659     if (!NT_SUCCESS( Status )) {
01660 
01661         //
01662         // The attempt to assign the security descriptor to the object
01663         // failed.  Free the space used by the new security descriptor.
01664         //
01665 
01666         SeDeassignSecurity( &NewDescriptor );
01667     }
01668 
01669     //
01670     //  And return to our caller
01671     //
01672 
01673     return( Status );
01674 }

NTKERNELAPI BOOLEAN ObCheckCreateObjectAccess (  IN PVOID  DirectoryObject,
IN ACCESS_MASK  CreateAccess,
IN PACCESS_STATE AccessState  OPTIONAL,
IN PUNICODE_STRING  ComponentName,
IN BOOLEAN  TypeMutexLocked,
IN KPROCESSOR_MODE  PreviousMode,
OUT PNTSTATUS  AccessStatus
) 
 

Definition at line 983 of file obse.c.

References FALSE, _OBJECT_TYPE_INITIALIZER::GenericMapping, NT_SUCCESS, NTSTATUS(), NULL, ObGetObjectSecurity(), OBJECT_TO_OBJECT_HEADER, ObpEnterObjectTypeMutex, ObpLeaveObjectTypeMutex, ObReleaseObjectSecurity(), PAGED_CODE, SeAccessCheck(), SeAppendPrivileges(), SeCreateObjectAuditAlarm(), SeFreePrivileges(), SeLockSubjectContext(), SeUnlockSubjectContext(), Status, TRUE, _OBJECT_HEADER::Type, and _OBJECT_TYPE::TypeInfo.

Referenced by ObpLookupObjectName(), and xxxCreateDesktop2(). 

00995                    :
00996 
00997     This routine checks to see if we are allowed to create an object in the
00998     given directory, and performs auditing as appropriate.
00999 
01000 Arguments:
01001 
01002     DirectoryObject - The directory object being examined.
01003 
01004     CreateAccess - The access mask corresponding to create access for
01005         this directory type.
01006 
01007     AccessState - Checks for traverse access will typically be incidental
01008         to some other access attempt.  Information on the current state of
01009         that access attempt is required so that the constituent access
01010         attempts may be associated with each other in the audit log.
01011 
01012     ComponentName - Pointer to a Unicode string containing the name of
01013         the object being created.
01014 
01015     TypeMutexLocked - Indicates whether the type mutex for this object's
01016         type is locked.  The type mutex is used to protect the object's
01017         security descriptor from being modified while it is being accessed.
01018 
01019     PreviousMode - The previous processor mode.
01020 
01021     AccessStatus - Pointer to a variable to return the status code of the
01022         access attempt.  In the case of failure this status code must be
01023         propagated back to the user.
01024 
01025 Return Value:
01026 
01027     BOOLEAN - TRUE if access is allowed and FALSE otherwise.  AccessStatus
01028     contains the status code to be passed back to the caller.  It is not
01029     correct to simply pass back STATUS_ACCESS_DENIED, since this will have
01030     to change with the advent of mandatory access control.
01031 
01032 --*/
01033 
01034 {
01035     BOOLEAN AccessAllowed;
01036     ACCESS_MASK GrantedAccess = 0;
01037     PSECURITY_DESCRIPTOR SecurityDescriptor;
01038     BOOLEAN MemoryAllocated;
01039     NTSTATUS Status;
01040     POBJECT_HEADER ObjectHeader;
01041     POBJECT_TYPE ObjectType;
01042     PPRIVILEGE_SET Privileges = NULL;
01043     BOOLEAN AuditPerformed = FALSE;
01044 
01045     PAGED_CODE();
01046 
01047     //
01048     //  Map the object body to its object header and corresponding
01049     //  object type
01050     //
01051 
01052     ObjectHeader = OBJECT_TO_OBJECT_HEADER( DirectoryObject );
01053     ObjectType = ObjectHeader->Type;
01054 
01055     //
01056     //  If the caller didn't lock the object type down then
01057     //  we'll do it now
01058     //
01059 
01060     if (!TypeMutexLocked) {
01061 
01062         ObpEnterObjectTypeMutex( ObjectType );
01063     }
01064 
01065     //
01066     //  Obtain the object's security descriptor and make it was
01067     //  successful
01068     //
01069 
01070     Status = ObGetObjectSecurity( DirectoryObject,
01071                                   &SecurityDescriptor,
01072                                   &MemoryAllocated );
01073 
01074     if (!NT_SUCCESS( Status )) {
01075 
01076         if (!TypeMutexLocked) {
01077 
01078             ObpLeaveObjectTypeMutex( ObjectType );
01079         }
01080 
01081         *AccessStatus = Status;
01082 
01083         return( FALSE );
01084     }
01085 
01086     //
01087     //  lock the caller's tokens until after auditing has been
01088     //  performed.
01089     //
01090 
01091     SeLockSubjectContext( &AccessState->SubjectSecurityContext );
01092 
01093     //
01094     //  if we have a security descriptor then do an access
01095     //  check to see if access is allowed and set in the
01096     //  privileges if necessary
01097     //
01098 
01099     if (SecurityDescriptor != NULL) {
01100 
01101         AccessAllowed = SeAccessCheck( SecurityDescriptor,
01102                                        &AccessState->SubjectSecurityContext,
01103                                        TRUE,            // Tokens are locked
01104                                        CreateAccess,
01105                                        0,
01106                                        &Privileges,
01107                                        &ObjectType->TypeInfo.GenericMapping,
01108                                        PreviousMode,
01109                                        &GrantedAccess,
01110                                        AccessStatus );
01111 
01112         if (Privileges != NULL) {
01113 
01114             Status = SeAppendPrivileges( AccessState,
01115                                          Privileges );
01116 
01117             SeFreePrivileges( Privileges );
01118         }
01119 
01120         //
01121         //  This is wrong, but leave for reference.
01122         //
01123         //  if (AccessAllowed) {
01124         //
01125         //      AccessState->PreviouslyGrantedAccess |= GrantedAccess;
01126         //      AccessState->RemainingDesiredAccess &= ~GrantedAccess;
01127         //  }
01128         //
01129 
01130 #if 0
01131         SeCreateObjectAuditAlarm( &AccessState->OperationID,
01132                                   DirectoryObject,
01133                                   ComponentName,
01134                                   SecurityDescriptor,
01135                                   &AccessState->SubjectSecurityContext,
01136                                   CreateAccess,
01137                                   AccessState->PrivilegesUsed,
01138                                   AccessAllowed,
01139                                   &AuditPerformed,
01140                                   PreviousMode );
01141 
01142         if ( AuditPerformed ) {
01143 
01144             AccessState->AuditHandleCreation = TRUE;
01145         }
01146 #endif
01147 
01148     } else {
01149 
01150         //
01151         //  At this point there is not a security descriptor
01152         //  so we'll assume access is allowed
01153         //
01154 
01155         AccessAllowed = TRUE;
01156     }
01157 
01158     //
01159     //  Free the caller's token and if the caller didn't have the
01160     //  object type locked we need to free it.
01161     //
01162 
01163     SeUnlockSubjectContext( &AccessState->SubjectSecurityContext );
01164 
01165     if (!TypeMutexLocked) {
01166 
01167         ObpLeaveObjectTypeMutex( ObjectType );
01168     }
01169 
01170     //
01171     //  Finally free the security descriptor
01172     //  and return to our caller
01173     //
01174 
01175     ObReleaseObjectSecurity( SecurityDescriptor,
01176                              MemoryAllocated );
01177 
01178     return( AccessAllowed );
01179 }

NTKERNELAPI BOOLEAN ObCheckObjectAccess (  IN PVOID  Object,
IN PACCESS_STATE  AccessState,
IN BOOLEAN  TypeMutexLocked,
IN KPROCESSOR_MODE  AccessMode,
OUT PNTSTATUS  AccessStatus
) 
 

NTKERNELAPI NTSTATUS ObCreateObject (  IN KPROCESSOR_MODE  ProbeMode,
IN POBJECT_TYPE  ObjectType,
IN POBJECT_ATTRIBUTES ObjectAttributes  OPTIONAL,
IN KPROCESSOR_MODE  OwnershipMode,
IN OUT PVOID ParseContext  OPTIONAL,
IN ULONG  ObjectBodySize,
IN ULONG  PagedPoolCharge,
IN ULONG  NonPagedPoolCharge,
OUT PVOID *  Object
) 
 

Definition at line 55 of file obcreate.c.

References _OBJECT_CREATE_INFORMATION::Attributes, _OBJECT_HEADER::Body, FALSE, _OBJECT_HEADER::Flags, _OBJECT_CREATE_INFORMATION::NonPagedPoolCharge, NT_SUCCESS, NTSTATUS(), NULL, OB_FLAG_PERMANENT_OBJECT, ObjectAttributes, ObpAllocateObject(), ObpAllocateObjectCreateInfoBuffer, ObpCaptureObjectCreateInformation(), ObpFreeObject(), ObpFreeObjectCreateInfoBuffer, ObpFreeObjectNameBuffer(), ObpReleaseObjectCreateInformation, PAGED_CODE, _OBJECT_CREATE_INFORMATION::PagedPoolCharge, SeCreatePermanentPrivilege, SeSinglePrivilegeCheck(), and Status.

Referenced by CmpCreateRegistryRoot(), CmpDoCreateChild(), CmpDoOpen(), ExCreateCallback(), IoCreateController(), IoCreateDevice(), IoCreateDriver(), IoCreateStreamFileObject(), IoCreateStreamFileObjectLite(), IopInitializeAttributesAndCreateObject(), IopLoadDriver(), IopParseDevice(), LpcpCreatePort(), MiSectionInitialization(), MmCreateSection(), NtAcceptConnectPort(), NtCreateChannel(), NtCreateDirectoryObject(), NtCreateEvent(), NtCreateEventPair(), NtCreateIoCompletion(), NtCreateJobObject(), NtCreateMutant(), NtCreateProfile(), NtCreateSemaphore(), NtCreateSuperSection(), NtCreateSymbolicLinkObject(), NtCreateTimer(), NtOpenChannel(), NtSecureConnectPort(), obtest(), PspCreateProcess(), PspCreateThread(), SepCreateToken(), SepDuplicateToken(), SepFilterToken(), xxxCreateDesktop2(), and xxxCreateWindowStation(). 

00069                    :
00070 
00071     This functions allocates space for an NT Object from either
00072     Paged or NonPaged pool. It captures the optional name and
00073     SECURITY_DESCRIPTOR parameters for later use when the object is
00074     inserted into an object table.  No quota is charged at this time.
00075     That occurs when the object is inserted into an object table.
00076 
00077 Arguments:
00078 
00079     ProbeMode - The processor mode to consider when doing a probe
00080         of the input parameters
00081 
00082     ObjectType - A pointer of the type returned by ObCreateObjectType
00083         that gives the type of object being created.
00084 
00085     ObjectAttributes - Optionally supplies the attributes of the object
00086         being created (such as its name)
00087 
00088     OwnershipMode - The processor mode of who is going to own the object
00089 
00090     ParseContext - Ignored
00091 
00092     ObjectBodySize - Number of bytes to allocate for the object body.  The
00093         object body immediately follows the object header in memory and are
00094         part of a single allocation.
00095 
00096     PagedPoolCharge - Supplies the amount of paged pool to charge for the
00097         object.  If zero is specified then the default charge for the object
00098         type is used.
00099 
00100     NonPagedPoolCharge - Supplies the amount of nonpaged pool to charge for
00101         the object.  If zero is specified then the default charge for the
00102         object type is used.
00103 
00104     Object - Receives a pointer to the newly created object
00105 
00106 Return Value:
00107 
00108     Following errors can occur:
00109 
00110         - invalid object type
00111         - insufficient memory
00112 
00113 --*/
00114 
00115 {
00116     UNICODE_STRING CapturedObjectName;
00117     POBJECT_CREATE_INFORMATION ObjectCreateInfo;
00118     POBJECT_HEADER ObjectHeader;
00119     NTSTATUS Status;
00120 
00121     PAGED_CODE();
00122 
00123     //
00124     //  Allocate a buffer to capture the object creation information.
00125     //
00126 
00127     ObjectCreateInfo = ObpAllocateObjectCreateInfoBuffer();
00128 
00129     if (ObjectCreateInfo == NULL) {
00130 
00131         Status = STATUS_INSUFFICIENT_RESOURCES;
00132 
00133     } else {
00134 
00135         //
00136         //  Capture the object attributes, quality of service, and object
00137         //  name, if specified. Otherwise, initialize the captured object
00138         //  name, the security quality of service, and the create attributes
00139         //  to default values.
00140         //
00141 
00142         Status = ObpCaptureObjectCreateInformation( ObjectType,
00143                                                     ProbeMode,
00144                                                     ObjectAttributes,
00145                                                     &CapturedObjectName,
00146                                                     ObjectCreateInfo,
00147                                                     FALSE );
00148 
00149         if (NT_SUCCESS(Status)) {
00150 
00151             //
00152             //  If the creation attributes are invalid, then return an error
00153             //  status.
00154             //
00155 
00156             if (ObjectType->TypeInfo.InvalidAttributes & ObjectCreateInfo->Attributes) {
00157 
00158                 Status = STATUS_INVALID_PARAMETER;
00159 
00160             } else {
00161 
00162                 //
00163                 //  Set the paged and nonpaged pool quota charges for the
00164                 //  object allocation.
00165                 //
00166 
00167                 if (PagedPoolCharge == 0) {
00168 
00169                     PagedPoolCharge = ObjectType->TypeInfo.DefaultPagedPoolCharge;
00170                 }
00171 
00172                 if (NonPagedPoolCharge == 0) {
00173 
00174                     NonPagedPoolCharge = ObjectType->TypeInfo.DefaultNonPagedPoolCharge;
00175                 }
00176 
00177                 ObjectCreateInfo->PagedPoolCharge = PagedPoolCharge;
00178                 ObjectCreateInfo->NonPagedPoolCharge = NonPagedPoolCharge;
00179 
00180                 //
00181                 //  Allocate and initialize the object.
00182                 //
00183 
00184                 Status = ObpAllocateObject( ObjectCreateInfo,
00185                                             OwnershipMode,
00186                                             ObjectType,
00187                                             &CapturedObjectName,
00188                                             ObjectBodySize,
00189                                             &ObjectHeader );
00190 
00191                 if (NT_SUCCESS(Status)) {
00192 
00193                     //
00194                     //  If a permanent object is being created, then check if
00195                     //  the caller has the appropriate privilege.
00196                     //
00197 
00198                     *Object = &ObjectHeader->Body;
00199 
00200                     if (ObjectHeader->Flags & OB_FLAG_PERMANENT_OBJECT) {
00201 
00202                         if (!SeSinglePrivilegeCheck( SeCreatePermanentPrivilege,
00203                                                      ProbeMode)) {
00204 
00205                             ObpFreeObject(*Object);
00206 
00207                             Status = STATUS_PRIVILEGE_NOT_HELD;
00208                         }
00209                     }
00210 
00211                     //
00212                     //  Here is the only successful path out of this module but
00213                     //  this path can also return privilege not held.
00214                     //
00215 
00216                     return Status;
00217                 }
00218             }
00219 
00220             //
00221             //  An error path, free the create information.
00222             //
00223 
00224             ObpReleaseObjectCreateInformation(ObjectCreateInfo);
00225 
00226             if (CapturedObjectName.Buffer != NULL) {
00227 
00228                 ObpFreeObjectNameBuffer(&CapturedObjectName);
00229             }
00230         }
00231 
00232         //
00233         //  An error path, free object creation information buffer.
00234         //
00235 
00236         ObpFreeObjectCreateInfoBuffer(ObjectCreateInfo);
00237     }
00238 
00239     //
00240     //  An error path
00241     //
00242 
00243     return Status;
00244 }

NTKERNELAPI NTSTATUS ObCreateObjectType (  IN PUNICODE_STRING  TypeName,
IN POBJECT_TYPE_INITIALIZER  ObjectTypeInitializer,
IN PSECURITY_DESCRIPTOR SecurityDescriptor  OPTIONAL,
OUT POBJECT_TYPE *  ObjectType
) 
 

Definition at line 69 of file obtype.c.

References _OBJECT_HEADER::Body, _OBJECT_TYPE_INITIALIZER::DefaultNonPagedPoolCharge, _OBJECT_TYPE::DefaultObject, _OBJECT_TYPE_INITIALIZER::DefaultPagedPoolCharge, Event(), ExAllocatePoolWithTag, ExFreePool(), ExInitializeResourceLite(), _OBJECT_HEADER::Flags, _OBJECT_TYPE::Index, KernelMode, L, _OBJECT_TYPE_INITIALIZER::MaintainTypeList, _OBJECT_TYPE::Mutex, _OBJECT_TYPE::Name, NonPagedPool, NT_SUCCESS, NtGlobalFlag, NTSTATUS(), NULL, OB_FLAG_KERNEL_OBJECT, OB_FLAG_PERMANENT_OBJECT, OBJECT_HEADER_TO_CREATOR_INFO, OBJECT_TYPE, OBP_MAX_DEFINED_OBJECT_TYPES, ObpAllocateObject(), ObpDefaultObject, ObpEnterObjectTypeMutex, ObpEnterRootDirectoryMutex, ObpInsertDirectoryEntry(), ObpLeaveObjectTypeMutex, ObpLeaveRootDirectoryMutex, ObpLookupDirectoryEntry(), ObpObjectTypes, ObpTypeDirectoryObject, ObpTypeObjectType, ObpValidateIrql, ObReferenceObject, PagedPool, POOL_TYPE, _OBJECT_TYPE_INITIALIZER::PoolType, RtlCopyUnicodeString(), RtlUnicodeStringToAnsiString(), _OBJECT_TYPE_INITIALIZER::SecurityProcedure, SeDefaultObjectMethod(), Status, _OBJECT_TYPE::TotalNumberOfObjects, TRUE, _OBJECT_HEADER::Type, _OBJECT_TYPE::TypeInfo, _OBJECT_TYPE::TypeList, _OBJECT_HEADER_CREATOR_INFO::TypeList, _OBJECT_TYPE_INITIALIZER::UseDefaultObject, and _OBJECT_TYPE_INITIALIZER::ValidAccessMask.

Referenced by CmpCreateObjectTypes(), ExpEventInitialization(), ExpEventPairInitialization(), ExpInitializeCallbacks(), ExpMutantInitialization(), ExpProfileInitialization(), ExpSemaphoreInitialization(), ExpTimerInitialization(), ExpWin32Initialization(), IopCreateObjectTypes(), LpcInitSystem(), MiSectionInitialization(), MiSuperSectionInitialization(), ObInitSystem(), obtest(), PspInitPhase0(), and SepTokenInitialization(). 

00078                    :
00079 
00080     This routine creates a new object type.
00081 
00082 Arguments:
00083 
00084     TypeName - Supplies the name of the new object type
00085 
00086     ObjectTypeInitializer - Supplies a object initialization
00087         structure.  This structure denotes the default object
00088         behavior including callbacks.
00089 
00090     SecurityDescriptor - Currently ignored
00091 
00092     ObjectType - Receives a pointer to the newly created object
00093         type.
00094 
00095 Return Value:
00096 
00097     An appropriate NTSTATUS value.
00098 
00099 --*/
00100 
00101 {
00102     POOL_TYPE PoolType;
00103     POBJECT_HEADER_CREATOR_INFO CreatorInfo;
00104     POBJECT_HEADER NewObjectTypeHeader;
00105     POBJECT_TYPE NewObjectType;
00106     ULONG i;
00107     UNICODE_STRING ObjectName;
00108     PWCH s;
00109     NTSTATUS Status;
00110     ULONG StandardHeaderCharge;
00111 
00112     ObpValidateIrql( "ObCreateObjectType" );
00113 
00114     //
00115     //  Return an error if invalid type attributes or no type name specified.
00116     //  No type name is okay if the type directory object does not exist
00117     //  yet (see init.c).
00118     //
00119 
00120     PoolType = ObjectTypeInitializer->PoolType;
00121 
00122     if ((!TypeName)
00123 
00124             ||
00125 
00126         (!TypeName->Length)
00127 
00128             ||
00129 
00130         (TypeName->Length % sizeof( WCHAR ))
00131 
00132             ||
00133 
00134         (ObjectTypeInitializer == NULL)
00135 
00136             ||
00137 
00138         (ObjectTypeInitializer->InvalidAttributes & ~OBJ_VALID_ATTRIBUTES)
00139 
00140             ||
00141 
00142         (ObjectTypeInitializer->Length != sizeof( *ObjectTypeInitializer ))
00143 
00144             ||
00145 
00146         (ObjectTypeInitializer->MaintainHandleCount &&
00147             (ObjectTypeInitializer->OpenProcedure == NULL &&
00148              ObjectTypeInitializer->CloseProcedure == NULL ))
00149 
00150             ||
00151 
00152         ((!ObjectTypeInitializer->UseDefaultObject) &&
00153             (PoolType != NonPagedPool))) {
00154 
00155         return( STATUS_INVALID_PARAMETER );
00156     }
00157 
00158     //
00159     //  Make sure that the type name does not contain an
00160     //  path name separator
00161     //
00162 
00163     s = TypeName->Buffer;
00164     i = TypeName->Length / sizeof( WCHAR );
00165 
00166     while (i--) {
00167 
00168         if (*s++ == OBJ_NAME_PATH_SEPARATOR) {
00169 
00170             return( STATUS_OBJECT_NAME_INVALID );
00171         }
00172     }
00173 
00174     //
00175     //  See if TypeName string already exists in the \ObjectTypes directory
00176     //  Return an error if it does.  Otherwise add the name to the directory.
00177     //  Note that there may not necessarily be a type directory.
00178     //
00179 
00180     if (ObpTypeDirectoryObject) {
00181 
00182         ObpEnterRootDirectoryMutex();
00183 
00184         if (ObpLookupDirectoryEntry( ObpTypeDirectoryObject,
00185                                      TypeName,
00186                                      OBJ_CASE_INSENSITIVE )) {
00187 
00188             ObpLeaveRootDirectoryMutex();
00189 
00190             return( STATUS_OBJECT_NAME_COLLISION );
00191         }
00192     }
00193 
00194     //
00195     //  Allocate a buffer for the type name and then
00196     //  copy over the name
00197     //
00198 
00199     ObjectName.Buffer = ExAllocatePoolWithTag( PagedPool,
00200                                                (ULONG)TypeName->MaximumLength,
00201                                                'mNbO' );
00202 
00203     if (ObjectName.Buffer == NULL) {
00204 
00205         if (ObpTypeDirectoryObject)
00206 
00207             ObpLeaveRootDirectoryMutex();
00208 
00209         return STATUS_INSUFFICIENT_RESOURCES;
00210     }
00211 
00212     ObjectName.MaximumLength = TypeName->MaximumLength;
00213 
00214     RtlCopyUnicodeString( &ObjectName, TypeName );
00215 
00216     //
00217     //  Allocate memory for the object
00218     //
00219 
00220     Status = ObpAllocateObject( NULL,
00221                                 KernelMode,
00222                                 ObpTypeObjectType,
00223                                 &ObjectName,
00224                                 sizeof( OBJECT_TYPE ),
00225                                 &NewObjectTypeHeader );
00226 
00227     if (!NT_SUCCESS( Status )) {
00228 
00229         if (ObpTypeDirectoryObject)
00230 
00231             ObpLeaveRootDirectoryMutex();
00232 
00233         ExFreePool(ObjectName.Buffer);
00234 
00235         return( Status );
00236     }
00237 
00238     //
00239     //  Initialize the create attributes, object ownership. parse context,
00240     //  and object body pointer.
00241     //
00242     //  N.B. This is required since these fields are not initialized.
00243     //
00244 
00245     NewObjectTypeHeader->Flags |= OB_FLAG_KERNEL_OBJECT |
00246                                   OB_FLAG_PERMANENT_OBJECT;
00247 
00248     NewObjectType = (POBJECT_TYPE)&NewObjectTypeHeader->Body;
00249     NewObjectType->Name = ObjectName;
00250 
00251     //
00252     //  The following call zeros out the number of handles and objects
00253     //  field plus high water marks
00254     //
00255 
00256     RtlZeroMemory( &NewObjectType->TotalNumberOfObjects,
00257                    FIELD_OFFSET( OBJECT_TYPE, TypeInfo ) -
00258                    FIELD_OFFSET( OBJECT_TYPE, TotalNumberOfObjects ));
00259 
00260     //
00261     //  If there is not a type object type yet then this must be
00262     //  that type (i.e., type object type must be the first object type
00263     //  ever created.  Consequently we'll need to setup some self
00264     //  referencing pointers.
00265     //
00266 
00267     if (!ObpTypeObjectType) {
00268 
00269         ObpTypeObjectType = NewObjectType;
00270         NewObjectTypeHeader->Type = ObpTypeObjectType;
00271         NewObjectType->TotalNumberOfObjects = 1;
00272 
00273 #ifdef POOL_TAGGING
00274 
00275         NewObjectType->Key = 'TjbO';
00276 
00277     } else {
00278 
00279         //
00280         //  Otherwise this is not the type object type so we'll
00281         //  try and generate a tag for the new object type provided
00282         //  pool tagging is turned on.
00283         //
00284 
00285         ANSI_STRING AnsiName;
00286 
00287         if (NT_SUCCESS( RtlUnicodeStringToAnsiString( &AnsiName, TypeName, TRUE ) )) {
00288 
00289             for (i=3; i>=AnsiName.Length; i--) {
00290 
00291                 AnsiName.Buffer[ i ] = ' ';
00292 
00293             }
00294 
00295             NewObjectType->Key = *(PULONG)AnsiName.Buffer;
00296             ExFreePool( AnsiName.Buffer );
00297 
00298         } else {
00299 
00300             NewObjectType->Key = *(PULONG)TypeName->Buffer;
00301         }
00302 
00303 #endif //POOL_TAGGING
00304 
00305     }
00306 
00307     //
00308     //  Continue initializing the new object type fields
00309     //
00310 
00311     NewObjectType->TypeInfo = *ObjectTypeInitializer;
00312     NewObjectType->TypeInfo.PoolType = PoolType;
00313 
00314     if (NtGlobalFlag & FLG_MAINTAIN_OBJECT_TYPELIST) {
00315 
00316         NewObjectType->TypeInfo.MaintainTypeList = TRUE;
00317     }
00318 
00319     //
00320     //  Whack quotas passed in so that headers are properly charged
00321     //
00322     //  Quota for object name is charged independently
00323     //
00324 
00325     StandardHeaderCharge = sizeof( OBJECT_HEADER ) +
00326                            sizeof( OBJECT_HEADER_NAME_INFO ) +
00327                            (ObjectTypeInitializer->MaintainHandleCount ?
00328                                 sizeof( OBJECT_HEADER_HANDLE_INFO )
00329                               : 0 );
00330 
00331     if ( PoolType == NonPagedPool ) {
00332 
00333         NewObjectType->TypeInfo.DefaultNonPagedPoolCharge += StandardHeaderCharge;
00334 
00335     } else {
00336 
00337         NewObjectType->TypeInfo.DefaultPagedPoolCharge += StandardHeaderCharge;
00338     }
00339 
00340     //
00341     //  If there is not an object type specific security procedure then set
00342     //  the default one supplied by Se.
00343     //
00344 
00345     if (ObjectTypeInitializer->SecurityProcedure == NULL) {
00346 
00347         NewObjectType->TypeInfo.SecurityProcedure = SeDefaultObjectMethod;
00348     }
00349 
00350     //
00351     //  Initialize the object type lock and its list of objects created
00352     //  of this type
00353     //
00354 
00355     ExInitializeResourceLite( &NewObjectType->Mutex );
00356 
00357     InitializeListHead( &NewObjectType->TypeList );
00358 
00359     //
00360     //  If we are to use the default object (meaning that we'll have our
00361     //  private event as our default object) then the type must allow
00362     //  synchronize and we'll set the default object
00363     //
00364 
00365     if (NewObjectType->TypeInfo.UseDefaultObject) {
00366 
00367         NewObjectType->TypeInfo.ValidAccessMask |= SYNCHRONIZE;
00368         NewObjectType->DefaultObject = &ObpDefaultObject;
00369 
00370     //
00371     //  Otherwise if this is the type file object then we'll put
00372     //  in the offset to the event of a file object.
00373     //
00374     //  **** What a hack
00375     //
00376 
00377     } else if (ObjectName.Length == 8 && !wcscmp( ObjectName.Buffer, L"File" )) {
00378 
00379         NewObjectType->DefaultObject = ULongToPtr( FIELD_OFFSET( FILE_OBJECT, Event ) );
00380 
00381 
00382     //
00383     // If this is a waitable port, set the offset to the event in the
00384     // waitableport object.  Another hack
00385     //
00386 
00387     } else if ( ObjectName.Length == 24 && !wcscmp( ObjectName.Buffer, L"WaitablePort")) {
00388 
00389         NewObjectType->DefaultObject = ULongToPtr( FIELD_OFFSET( LPCP_PORT_OBJECT, WaitEvent ) );
00390 
00391     //
00392     //  Otherwise indicate that there isn't a default object to wait
00393     //  on
00394     //
00395 
00396     } else {
00397 
00398         NewObjectType->DefaultObject = NULL;
00399     }
00400 
00401     //
00402     //  Lock down the type object type and if there is a creator info
00403     //  record then insert this object on that list
00404     //
00405 
00406     ObpEnterObjectTypeMutex( ObpTypeObjectType );
00407 
00408     CreatorInfo = OBJECT_HEADER_TO_CREATOR_INFO( NewObjectTypeHeader );
00409 
00410     if (CreatorInfo != NULL) {
00411 
00412         InsertTailList( &ObpTypeObjectType->TypeList, &CreatorInfo->TypeList );
00413     }
00414 
00415     //
00416     //  Store a pointer to this new object type in the
00417     //  global object types array.  We'll use the index from
00418     //  the type object type number of objects count
00419     //
00420 
00421     NewObjectType->Index = ObpTypeObjectType->TotalNumberOfObjects;
00422 
00423     if (NewObjectType->Index < OBP_MAX_DEFINED_OBJECT_TYPES) {
00424 
00425         ObpObjectTypes[ NewObjectType->Index - 1 ] = NewObjectType;
00426     }
00427 
00428     //
00429     //  Unlock the type object type lock
00430     //
00431 
00432     ObpLeaveObjectTypeMutex( ObpTypeObjectType );
00433 
00434     //
00435     //  Lastly if there is not a directory object type yet then the following
00436     //  code will actually drop through and set the output object type
00437     //  and return success.
00438     //
00439     //  Otherwise, there is a directory object type and we try to insert the
00440     //  new type into the directory.  If this succeeds then we'll reference
00441     //  the directory type object, unlock the root directory, set the
00442     //  output type and return success
00443     //
00444 
00445     if (!ObpTypeDirectoryObject ||
00446         ObpInsertDirectoryEntry( ObpTypeDirectoryObject, NewObjectType )) {
00447 
00448         if (ObpTypeDirectoryObject) {
00449 
00450             ObReferenceObject( ObpTypeDirectoryObject );
00451         }
00452 
00453         if (ObpTypeDirectoryObject) {
00454 
00455             ObpLeaveRootDirectoryMutex();
00456         }
00457 
00458         *ObjectType = NewObjectType;
00459 
00460         return( STATUS_SUCCESS );
00461 
00462     } else {
00463 
00464         //
00465         //  Otherwise there is a directory object type and
00466         //  the insertion failed.  So release the root directory
00467         //  and return failure to our caller.
00468         //
00469 
00470         ObpLeaveRootDirectoryMutex();
00471 
00472         return( STATUS_INSUFFICIENT_RESOURCES );
00473     }
00474 }

NTKERNELAPI VOID ObDeleteCapturedInsertInfo (  IN PVOID  Object  ) 
 

Definition at line 713 of file obcreate.c.

References _OBJECT_HEADER::Flags, NULL, OB_FLAG_NEW_OBJECT, OBJECT_TO_OBJECT_HEADER, _OBJECT_HEADER::ObjectCreateInfo, ObpFreeObjectCreateInformation, and PAGED_CODE.

Referenced by CcInitializeCacheMap(), SepCreateClientSecurity(), and SepCreateToken(). 

00719                    :
00720 
00721     This function frees the creation information that could be pointed at
00722     by the object header.
00723 
00724 Arguments:
00725 
00726     Object - Supplies the object being modified
00727 
00728 Return Value:
00729 
00730     None.
00731 
00732 --*/
00733 
00734 {
00735     POBJECT_HEADER ObjectHeader;
00736 
00737     PAGED_CODE();
00738 
00739     //
00740     //  Get the address of the object header and free the object create
00741     //  information object if the object is being created.
00742     //
00743 
00744     ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
00745 
00746     if (ObjectHeader->Flags & OB_FLAG_NEW_OBJECT) {
00747 
00748         if (ObjectHeader->ObjectCreateInfo != NULL) {
00749 
00750             ObpFreeObjectCreateInformation(ObjectHeader->ObjectCreateInfo);
00751 
00752             ObjectHeader->ObjectCreateInfo = NULL;
00753         }
00754     }
00755 
00756     return;
00757 }

VOID ObDereferenceDeviceMap (  IN PEPROCESS  Process  ) 
 

Definition at line 416 of file obdevmap.c.

References _OBJECT_DIRECTORY::DeviceMap, _DEVICE_MAP::DosDevicesDirectory, ExFreePool(), NULL, ObDereferenceObject, ObpDeviceMapLock, and _DEVICE_MAP::ReferenceCount.

Referenced by ObSetDeviceMap(), and PspProcessDelete(). 

00422                    :
00423 
00424     This function is called at process tear down time to decrement the
00425     reference count on a device map.  When the reference count goes to
00426     zero, it means no more processes are using this, so it can be freed
00427     and the reference on the associated object directory can be released.
00428 
00429 Arguments:
00430 
00431     Process - Process being destroyed.
00432 
00433 Return Value:
00434 
00435     None.
00436 
00437 --*/
00438 
00439 {
00440     PDEVICE_MAP DeviceMap;
00441     KIRQL OldIrql;
00442 
00443     //
00444     //  Grab the device map and then we only have work to do
00445     //  it there is one
00446     //
00447 
00448     DeviceMap = Process->DeviceMap;
00449 
00450     if (DeviceMap != NULL) {
00451 
00452         //
00453         //  To dereference the device map we need to null out the
00454         //  processes device map pointer, and decrement its ref count
00455         //  If the ref count goes to zero we can free up the memory
00456         //  and dereference the dos device directory object
00457         //
00458 
00459         ExAcquireSpinLock( &ObpDeviceMapLock, &OldIrql );
00460 
00461         Process->DeviceMap = NULL;
00462         DeviceMap->ReferenceCount--;
00463 
00464         if (DeviceMap->ReferenceCount == 0) {
00465 
00466             DeviceMap->DosDevicesDirectory->DeviceMap = NULL;
00467 
00468             ExReleaseSpinLock( &ObpDeviceMapLock, OldIrql );
00469 
00470             ObDereferenceObject( DeviceMap->DosDevicesDirectory );
00471 
00472             ExFreePool( DeviceMap );
00473 
00474         } else {
00475 
00476             ExReleaseSpinLock( &ObpDeviceMapLock, OldIrql );
00477         }
00478     }
00479 
00480     //
00481     //  And return to our caller
00482     //
00483 
00484     return;
00485 }

NTSTATUS ObDumpObjectByHandle (  IN HANDLE  Handle,
IN POB_DUMP_CONTROL Control  OPTIONAL
) 
 

NTSTATUS ObDumpObjectByPointer (  IN PVOID  Object,
IN POB_DUMP_CONTROL Control  OPTIONAL
) 
 

NTKERNELAPI VOID FASTCALL ObfDereferenceObject (  IN PVOID  Object  ) 
 

Definition at line 1124 of file obref.c.

References APC_LEVEL, ASSERT, CriticalWorkQueue, ExInitializeWorkItem, ExQueueWorkItem(), FALSE, _LPCP_PORT_OBJECT::Flags, _OBJECT_HEADER::HandleCount, LpcpAcquireLpcpLock, LpcPortObjectType, LpcpReleaseLpcpLock, LpcWaitablePortObjectType, NonPagedPool, NULL, OBJECT_HEADER_TO_NAME_INFO, OBJECT_TO_OBJECT_HEADER, ObpDecrPointerCountWithResult, ObpLock, ObpProcessRemoveObjectQueue(), ObpRemoveObjectQueue, ObpRemoveObjectRoutine(), ObpRemoveObjectWorkItem, ObpRemoveQueueActive, PASSIVE_LEVEL, _OBJECT_TYPE_INITIALIZER::PoolType, PORT_DELETED, _OBJECT_HEADER::SEntry, TRUE, _OBJECT_HEADER::Type, and _OBJECT_TYPE::TypeInfo.

Referenced by ObDereferenceObject(). 

01130                    :
01131 
01132     This routine decrments the refernce count of the specified object and
01133     does whatever cleanup there is if the count goes to zero.
01134 
01135 Arguments:
01136 
01137     Object - Supplies a pointer to the body of the object being dereferenced
01138 
01139 Return Value:
01140 
01141     None.
01142 
01143 --*/
01144 
01145 {
01146     POBJECT_HEADER ObjectHeader;
01147     POBJECT_TYPE ObjectType;
01148     KIRQL OldIrql;
01149     BOOLEAN StartWorkerThread;
01150 
01151     PLPCP_PORT_OBJECT Port = NULL;
01152 
01153 #if DBG
01154 
01155     POBJECT_HEADER_NAME_INFO NameInfo;
01156 
01157 #endif
01158 
01159     //
01160     //  Translate a pointer to the object body to a pointer to the object
01161     //  header.
01162     //
01163 
01164     ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
01165 
01166 #if DBG
01167 
01168     NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectHeader );
01169 
01170     if (NameInfo) {
01171 
01172        InterlockedDecrement(&NameInfo->DbgDereferenceCount) ;
01173     }
01174 
01175 #endif
01176 
01177 
01178     //
01179     //  Decrement the point count and if the result is now then
01180     //  there is extra work to do
01181     //
01182 
01183     ObjectType = ObjectHeader->Type;
01184 
01185     if ( (ObjectType == LpcPortObjectType) ||
01186          (ObjectType == LpcWaitablePortObjectType) ) {
01187 
01188         Port = Object;
01189         LpcpAcquireLpcpLock();
01190     }
01191 
01192     if (ObpDecrPointerCountWithResult( ObjectHeader )) {
01193 
01194         //
01195         //  Find out the level we're at and the object type
01196         //
01197 
01198         OldIrql = KeGetCurrentIrql();
01199 
01200         ASSERT(ObjectHeader->HandleCount == 0);
01201 
01202 
01203         if (Port != NULL) {
01204 
01205             Port->Flags |= PORT_DELETED;
01206             Port = NULL;
01207 
01208             LpcpReleaseLpcpLock();
01209         }
01210 
01211 
01212         //
01213         //  If we're at the passive level then go ahead and delete the
01214         //  object now.  Or if we're at APC level and object say's we're
01215         //  allocated out of paged pool then also go ahead and delete
01216         //  the object right now.
01217         //
01218 
01219         if ((OldIrql == PASSIVE_LEVEL) ||
01220             ((OldIrql == APC_LEVEL) &&
01221              ((ObjectType != NULL) && (ObjectType->TypeInfo.PoolType != NonPagedPool)))) {
01222 
01223 
01224                 ObpRemoveObjectRoutine( Object );
01225 
01226                 return;    
01227 
01228         } else {
01229 
01230             //
01231             //  Objects can't be deleted from an IRQL above APC_LEVEL.
01232             //  Nonpaged objects can't be deleted from APC_LEVEL.
01233             //  So queue the delete operation.
01234             //
01235 
01236             ASSERT((ObjectHeader->Type == NULL) || (ObjectHeader->Type->TypeInfo.PoolType == NonPagedPool));
01237 
01238             //
01239             //  Lock the work queue, enqueue the new work item, and if the
01240             //  work queue is not active then make it active, indicate that
01241             //  we need to start the worker thread, and unlock the work
01242             //  queue.
01243             //
01244 
01245             ExAcquireSpinLock( &ObpLock, &OldIrql );
01246 
01247             PushEntryList((PSINGLE_LIST_ENTRY)&ObpRemoveObjectQueue, (PSINGLE_LIST_ENTRY)&ObjectHeader->SEntry );
01248 
01249             if (!ObpRemoveQueueActive) {
01250 
01251                 ObpRemoveQueueActive = TRUE;
01252                 StartWorkerThread = TRUE;
01253 
01254             } else {
01255 
01256                 StartWorkerThread = FALSE;
01257             }
01258 
01259 #if 0
01260             if (StartWorkerThread) {
01261 
01262                 KdPrint(( "OB: %08x Starting ObpProcessRemoveObjectQueue thread.\n", Object ));
01263 
01264             } else {
01265 
01266                 KdPrint(( "OB: %08x Queued to ObpProcessRemoveObjectQueue thread.\n", Object ));
01267             }
01268 
01269 #endif  // 1
01270 
01271             ExReleaseSpinLock( &ObpLock, OldIrql );
01272 
01273             //
01274             //  If we have to start the worker thread then go ahead
01275             //  and enqueue the work item
01276             //
01277 
01278             if (StartWorkerThread) {
01279 
01280                 ExInitializeWorkItem( &ObpRemoveObjectWorkItem,
01281                                       ObpProcessRemoveObjectQueue,
01282                                       NULL );
01283 
01284                 ExQueueWorkItem( &ObpRemoveObjectWorkItem, CriticalWorkQueue );
01285             }
01286         }
01287     }
01288 
01289     if ( Port != NULL ) {
01290 
01291         LpcpReleaseLpcpLock();
01292     }
01293 
01294     return;
01295 }

NTKERNELAPI BOOLEAN ObFindHandleForObject (  IN PEPROCESS  Process,
IN PVOID  Object,
IN POBJECT_TYPE ObjectType  OPTIONAL,
IN POBJECT_HANDLE_INFORMATION MatchCriteria  OPTIONAL,
OUT PHANDLE  Handle
) 
 

VOID FASTCALL ObFreeObjectCreateInfoBuffer (  IN POBJECT_CREATE_INFORMATION  ObjectCreateInfo  ) 
 

Definition at line 1279 of file obcreate.c.

References ObpFreeObjectCreateInfoBuffer.

Referenced by IoCreateStreamFileObjectLite(). 

01285                    :
01286 
01287     This function frees a create information buffer.  Called from IO component
01288 
01289     N.B. This function is nonpageable.
01290 
01291 Arguments:
01292 
01293     ObjectCreateInfo - Supplies a pointer to a create information buffer.
01294 
01295 Return Value:
01296 
01297     None.
01298 
01299 --*/
01300 
01301 {
01302     ObpFreeObjectCreateInfoBuffer( ObjectCreateInfo );
01303 
01304     return;
01305 }
}

NTKERNELAPI ULONG ObGetObjectPointerCount (  IN PVOID  Object  ) 
 

Definition at line 58 of file obref.c.

References OBJECT_TO_OBJECT_HEADER, and PAGED_CODE.

Referenced by PsEnforceExecutionTimeLimits(), PspApplyJobLimitsToProcessSet(), and PspTerminateAllProcessesInJob(). 

00064                    :
00065 
00066     This routine returns the current pointer count for a specified object.
00067 
00068 Arguments:
00069 
00070     Object - Pointer to the object whose pointer count is to be returned.
00071 
00072 Return Value:
00073 
00074     The current pointer count for the specified object is returned.
00075 
00076 Note:
00077 
00078     This function cannot be made a macro, since fields in the thread object
00079     move from release to release, so this must remain a full function.
00080 
00081 --*/
00082 
00083 {
00084     PAGED_CODE();
00085 
00086     //
00087     //  Simply return the current pointer count for the object.
00088     //
00089 
00090     return OBJECT_TO_OBJECT_HEADER( Object )->PointerCount;
00091 }

NTSTATUS ObGetObjectSecurity (  IN PVOID  Object,
OUT PSECURITY_DESCRIPTOR *  SecurityDescriptor,
OUT PBOOLEAN  MemoryAllocated
) 
 

Definition at line 1258 of file obse.c.

References ExAllocatePoolWithTag, ExFreePool(), FALSE, _OBJECT_TYPE_INITIALIZER::GenericMapping, NT_SUCCESS, NTSTATUS(), NULL, OBJECT_TO_OBJECT_HEADER, ObpBeginTypeSpecificCallOut, ObpCentralizedSecurity, ObpEndTypeSpecificCallOut, ObpReferenceSecurityDescriptor(), PAGED_CODE, PagedPool, _OBJECT_TYPE_INITIALIZER::PoolType, QuerySecurityDescriptor, _OBJECT_HEADER::SecurityDescriptor, _OBJECT_TYPE_INITIALIZER::SecurityProcedure, Status, TRUE, _OBJECT_HEADER::Type, and _OBJECT_TYPE::TypeInfo.

Referenced by ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObInsertObject(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), ObpProcessDosDeviceSymbolicLink(), PspCreateProcess(), PspCreateThread(), and PspSetPrimaryToken(). 

01266                    :
01267 
01268     Given an object, this routine will find its security descriptor.
01269     It will do this by calling the object's security method.
01270 
01271     It is possible for an object not to have a security descriptor
01272     at all.  Unnamed objects such as events that can only be referenced
01273     by a handle are an example of an object that does not have a
01274     security descriptor.
01275 
01276 Arguments:
01277 
01278     Object - Supplies the object body being queried.
01279 
01280     SecurityDescriptor - Returns a pointer to the object's security
01281         descriptor.
01282 
01283     MemoryAllocated - indicates whether we had to allocate pool
01284         memory to hold the security descriptor or not.  This should
01285         be passed back into ObReleaseObjectSecurity.
01286 
01287 Return Value:
01288 
01289     STATUS_SUCCESS - The operation was successful.  Note that the
01290         operation may be successful and still return a NULL security
01291         descriptor.
01292 
01293     STATUS_INSUFFICIENT_RESOURCES - Insufficient memory was available
01294         to satisfy the request.
01295 
01296 --*/
01297 
01298 {
01299     SECURITY_INFORMATION SecurityInformation;
01300     ULONG Length = 0;
01301     NTSTATUS Status;
01302     POBJECT_TYPE ObjectType;
01303     POBJECT_HEADER ObjectHeader;
01304     KIRQL SaveIrql;
01305 
01306     PAGED_CODE();
01307 
01308     //
01309     //  Map the object body to its object header and corresponding
01310     //  object type
01311     //
01312 
01313     ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
01314     ObjectType = ObjectHeader->Type;
01315 
01316     //
01317     //  If the object is one that uses the default object method,
01318     //  its security descriptor is contained in ob's security
01319     //  descriptor cache.
01320     //
01321     //  Reference it so that it doesn't go away out from under us.
01322     //
01323 
01324     if (ObpCentralizedSecurity(ObjectType))  {
01325 
01326         *SecurityDescriptor = ObpReferenceSecurityDescriptor( Object );
01327 
01328         *MemoryAllocated = FALSE;
01329 
01330         return( STATUS_SUCCESS );
01331     }
01332 
01333     //
01334     //  Request a complete security descriptor
01335     //
01336 
01337     SecurityInformation = OWNER_SECURITY_INFORMATION |
01338                           GROUP_SECURITY_INFORMATION |
01339                           DACL_SECURITY_INFORMATION  |
01340                           SACL_SECURITY_INFORMATION;
01341 
01342     //
01343     //  Call the security method with Length = 0 to find out
01344     //  how much memory we need to store the final result.
01345     //
01346     //  Note that the ObjectsSecurityDescriptor parameter is NULL,
01347     //  because we expect whoever is on the other end of this call
01348     //  to find the security descriptor for us.  We pass in a pool
01349     //  type to keep the compiler happy, it will not be used for a
01350     //  query operation.
01351     //
01352 
01353 
01354     ObpBeginTypeSpecificCallOut( SaveIrql );
01355 
01356     Status = (*ObjectType->TypeInfo.SecurityProcedure)( Object,
01357                                                         QuerySecurityDescriptor,
01358                                                         &SecurityInformation,
01359                                                         *SecurityDescriptor,
01360                                                         &Length,
01361                                                         &ObjectHeader->SecurityDescriptor,         // not used
01362                                                         ObjectType->TypeInfo.PoolType,
01363                                                         &ObjectType->TypeInfo.GenericMapping );
01364 
01365     ObpEndTypeSpecificCallOut( SaveIrql, "Security", ObjectType, Object );
01366 
01367     if (Status != STATUS_BUFFER_TOO_SMALL) {
01368 
01369         return( Status );
01370     }
01371 
01372     //
01373     //  Now that we know how large the security descriptor is we
01374     //  can allocate space for it
01375     //
01376 
01377     *SecurityDescriptor = ExAllocatePoolWithTag( PagedPool, Length, 'qSbO' );
01378 
01379     if (*SecurityDescriptor == NULL) {
01380 
01381         return( STATUS_INSUFFICIENT_RESOURCES );
01382     }
01383 
01384     *MemoryAllocated = TRUE;
01385 
01386     //
01387     //  The security method will return an absolute format
01388     //  security descriptor that just happens to be in a self
01389     //  contained buffer (not to be confused with a self-relative
01390     //  security descriptor).
01391     //
01392 
01393     ObpBeginTypeSpecificCallOut( SaveIrql );
01394 
01395     Status = (*ObjectType->TypeInfo.SecurityProcedure)( Object,
01396                                                         QuerySecurityDescriptor,
01397                                                         &SecurityInformation,
01398                                                         *SecurityDescriptor,
01399                                                         &Length,
01400                                                         &ObjectHeader->SecurityDescriptor,
01401                                                         ObjectType->TypeInfo.PoolType,
01402                                                         &ObjectType->TypeInfo.GenericMapping );
01403 
01404     ObpEndTypeSpecificCallOut( SaveIrql, "Security", ObjectType, Object );
01405 
01406     if (!NT_SUCCESS( Status )) {
01407 
01408         ExFreePool( *SecurityDescriptor );
01409 
01410         *MemoryAllocated = FALSE;
01411     }
01412 
01413     return( Status );
01414 }

VOID ObInheritDeviceMap (  IN PEPROCESS  NewProcess,
IN PEPROCESS  ParentProcess
) 
 

Definition at line 343 of file obdevmap.c.

References NULL, ObpDeviceMapLock, ObSystemDeviceMap, and _DEVICE_MAP::ReferenceCount.

Referenced by PspCreateProcess(). 

00350                    :
00351 
00352     This function is called at process initialization time to inherit the
00353     device map for a process.  If no parent process, then inherits from
00354     the system device map.
00355 
00356 Arguments:
00357 
00358     NewProcess - Supplies the process being initialized that needs a new
00359         dos device map
00360 
00361     ParentProcess - - Optionally specifies the parent process whose device
00362         map we inherit.  This process if specified must have a device map
00363 
00364 Return Value:
00365 
00366     None.
00367 
00368 --*/
00369 
00370 {
00371     PDEVICE_MAP DeviceMap;
00372     KIRQL OldIrql;
00373 
00374     //
00375     //  If we are called with a parent process then grab its device map
00376     //  otherwise grab the system wide device map and check that is does
00377     //  exist
00378     //
00379 
00380     if (ParentProcess) {
00381 
00382         DeviceMap = ParentProcess->DeviceMap;
00383 
00384     } else {
00385 
00386         //
00387         //  Note: WindowStation guys may want a callout here to get the
00388         //  device map to use for this case.
00389         //
00390 
00391         DeviceMap = ObSystemDeviceMap;
00392 
00393         if (DeviceMap == NULL) {
00394 
00395             return;
00396         }
00397     }
00398 
00399     //
00400     //  With the device map bumps its reference count and add it to the
00401     //  new process
00402     //
00403 
00404     ExAcquireSpinLock( &ObpDeviceMapLock, &OldIrql );
00405 
00406     DeviceMap->ReferenceCount++;
00407     NewProcess->DeviceMap = DeviceMap;
00408 
00409     ExReleaseSpinLock( &ObpDeviceMapLock, OldIrql );
00410 
00411     return;
00412 }

NTSTATUS ObInitProcess (  PEPROCESS ParentProcess  OPTIONAL,
PEPROCESS  NewProcess
) 
 

Definition at line 815 of file obinit.c.

References ExCreateHandleTable(), ExDupHandleTable(), Executive, ExEnumHandleTable(), FALSE, KeEnterCriticalRegion, KeLeaveCriticalRegion, KeReleaseMutant(), KernelMode, KeWaitForSingleObject(), MaxPoolType, NULL, ObAuditInheritedHandleProcedure(), ObDupHandleProcedure(), _EPROCESS::ObjectTable, ObpInitKillMutant, _SE_PROCESS_AUDIT_INFO::Parent, _SE_PROCESS_AUDIT_INFO::Process, SE_PROCESS_AUDIT_INFO, and SeDetailedAuditing.

Referenced by PspCreateProcess(). 

00822                    :
00823 
00824     This function initializes a process object table.  If the ParentProcess
00825     is specified, then all object handles with the OBJ_INHERIT attribute are
00826     copied from the parent object table to the new process' object table.
00827     The HandleCount field of each object copied is incremented by one.  Both
00828     object table mutexes remained locked for the duration of the copy
00829     operation.
00830 
00831 Arguments:
00832 
00833     ParentProcess - optional pointer to a process object that is the
00834         parent process to inherit object handles from.
00835 
00836     NewProcess - pointer to the process object being initialized.
00837 
00838 Return Value:
00839 
00840     Status code.
00841 
00842     The following errors can occur:
00843 
00844     - insufficient memory
00845 
00846 --*/
00847 
00848 {
00849     PHANDLE_TABLE OldObjectTable;
00850     PHANDLE_TABLE NewObjectTable;
00851     ULONG PoolCharges[ MaxPoolType ];
00852     SE_PROCESS_AUDIT_INFO ProcessAuditInfo;
00853 
00854     RtlZeroMemory( PoolCharges, sizeof( PoolCharges ) );
00855 
00856     //
00857     //  If we have a parent process then we need to lock it down
00858     //  check that it is not going away and then make a copy
00859     //  of its handle table.  If there isn't a parent then
00860     //  we'll start with an empty handle table.
00861     //
00862 
00863     if (ARGUMENT_PRESENT( ParentProcess )) {
00864 
00865         KeEnterCriticalRegion();
00866         KeWaitForSingleObject( &ObpInitKillMutant,
00867                                Executive,
00868                                KernelMode,
00869                                FALSE,
00870                                NULL );
00871 
00872         OldObjectTable = ParentProcess->ObjectTable;
00873 
00874         if ( !OldObjectTable ) {
00875 
00876             KeReleaseMutant( &ObpInitKillMutant, 0, FALSE, FALSE );
00877             KeLeaveCriticalRegion();
00878 
00879             return STATUS_PROCESS_IS_TERMINATING;
00880         }
00881 
00882         NewObjectTable = ExDupHandleTable( NewProcess,
00883                                            OldObjectTable,
00884                                            ObDupHandleProcedure );
00885 
00886     } else {
00887 
00888         OldObjectTable = NULL;
00889         NewObjectTable = ExCreateHandleTable( NewProcess );
00890     }
00891 
00892     //
00893     //  Check that we really have a new handle table otherwise
00894     //  we must be out of resources
00895     //
00896 
00897     if (NewObjectTable) {
00898 
00899         //
00900         //  Set the new processes object table and if we are
00901         //  auditing then enumerate the new table calling
00902         //  the audit procedure
00903         //
00904 
00905         NewProcess->ObjectTable = NewObjectTable;
00906 
00907         if ( SeDetailedAuditing ) {
00908 
00909             ProcessAuditInfo.Process = NewProcess;
00910             ProcessAuditInfo.Parent  = ParentProcess;
00911 
00912             ExEnumHandleTable( NewObjectTable,
00913                                ObAuditInheritedHandleProcedure,
00914                                (PVOID)&ProcessAuditInfo,
00915                                (PHANDLE)NULL );
00916         }
00917 
00918         //
00919         //  Free the old table if it exists and then
00920         //  return our caller
00921         //
00922 
00923         if ( OldObjectTable ) {
00924 
00925             KeReleaseMutant( &ObpInitKillMutant, 0, FALSE, FALSE );
00926             KeLeaveCriticalRegion();
00927         }
00928 
00929         return( STATUS_SUCCESS );
00930 
00931     } else {
00932 
00933         //
00934         //  We're out of resources to null out the new object table field,
00935         //  unlock the old object table, and tell our caller that this
00936         //  didn't work
00937         //
00938 
00939         NewProcess->ObjectTable = NULL;
00940 
00941         if ( OldObjectTable ) {
00942 
00943             KeReleaseMutant( &ObpInitKillMutant, 0, FALSE, FALSE );
00944             KeLeaveCriticalRegion();
00945         }
00946 
00947         return( STATUS_INSUFFICIENT_RESOURCES );
00948     }
00949 }

VOID ObInitProcess2 (  PEPROCESS  NewProcess  ) 
 

Definition at line 953 of file obinit.c.

References ExSetHandleTableOrder, _EPROCESS::ObjectTable, and _EPROCESS::SubSystemVersion.

Referenced by PspCreateProcess(). 

00959                    :
00960 
00961     This function is called after an image file has been mapped into the address
00962     space of a newly created process.  Allows the object manager to set LIFO/FIFO
00963     ordering for handle allocation based on the SubSystemVersion number in the
00964     image.
00965 
00966 Arguments:
00967 
00968     NewProcess - pointer to the process object being initialized.
00969 
00970 Return Value:
00971 
00972     None.
00973 
00974 --*/
00975 
00976 {
00977     //
00978     //  Set LIFO ordering of handles for images <= SubSystemVersion 3.50
00979     //
00980 
00981     if (NewProcess->ObjectTable) {
00982 
00983         ExSetHandleTableOrder( NewProcess->ObjectTable, (BOOLEAN)(NewProcess->SubSystemVersion <= 0x332) );
00984     }
00985 
00986     return;
00987 }

BOOLEAN ObInitSystem (  VOID   ) 
 

Definition at line 117 of file obinit.c.

References ASSERT, _OBJECT_HEADER::Body, _OBJECT_HEADER_NAME_INFO::Directory, ExAllocatePoolWithTag, ExCreateHandleTable(), ExInitializeNPagedLookasideList(), ExInitializeResourceLite(), FALSE, Index, InitializationPhase, KeGetCurrentPrcb, KeInitializeEvent, KeInitializeMutant(), KeInitializeSpinLock(), KeNumberProcessors, KernelMode, KiProcessorBlock, _NPAGED_LOOKASIDE_LIST::L, L, LookasideCreateInfoList, LookasideNameBufferList, MM_SYSTEMSIZE, MmIsThisAnNtAsSystem(), MmLargeSystem, MmQuerySystemSize(), _OBJECT_HEADER_NAME_INFO::Name, NonPagedPool, NPAGED_LOOKASIDE_LIST, NT_SUCCESS, NtClose(), NtCreateDirectoryObject(), NTSTATUS(), NULL, ObCreateObjectType(), OBJECT_HEADER_TO_NAME_INFO, OBJECT_NAME_BUFFER_SIZE, ObjectAttributes, ObpAuditBaseDirectories, ObpAuditBaseObjects, ObpCreateDosDevicesDirectory(), ObpCreateInfoLookasideList, ObpDefaultObject, ObpDeleteSymbolicLink(), ObpDeviceMapLock, ObpDirectoryMapping, ObpDirectoryObjectType, ObpEnterRootDirectoryMutex, ObpInitKillMutant, ObpInitSecurityDescriptorCache(), ObpInsertDirectoryEntry(), ObpKernelHandleTable, ObpLeaveRootDirectoryMutex, ObpLock, ObpLookupDirectoryEntry(), ObpNameBufferLookasideList, ObpParseSymbolicLink(), ObpRemoveObjectQueue, ObpRootDirectoryMutex, ObpRootDirectoryObject, ObpSymbolicLinkMapping, ObpSymbolicLinkObjectType, ObpTypeDirectoryObject, ObpTypeMapping, ObpTypeObjectType, ObReferenceObjectByHandle(), PAGE_SIZE, PagedPool, _EPROCESS_QUOTA_BLOCK::PagefileLimit, PsGetCurrentProcess, PsGetCurrentThread, PspDefaultQuotaBlock, _EPROCESS_QUOTA_BLOCK::QuotaLock, _EPROCESS_QUOTA_BLOCK::QuotaPoolLimit, _EPROCESS_QUOTA_BLOCK::ReferenceCount, RtlAddAuditAccessAce(), RtlCreateAcl(), RtlCreateSecurityDescriptor(), RtlGetAce(), RtlInitUnicodeString(), RtlSetDaclSecurityDescriptor(), RtlSetSaclSecurityDescriptor(), SeLengthSid, SePublicDefaultUnrestrictedDacl, SePublicDefaultUnrestrictedSd, SeWorldSid, Status, TRUE, _OBJECT_TYPE::TypeList, and USHORT. 

00123                    :
00124 
00125     This function performs the system initialization for the object
00126     manager.  The object manager data structures are self describing
00127     with the exception of the root directory, the type object type and
00128     the directory object type.  The initialization code then constructs
00129     these objects by hand to get the ball rolling.
00130 
00131 Arguments:
00132 
00133     None.
00134 
00135 Return Value:
00136 
00137     TRUE if successful and FALSE if an error occurred.
00138 
00139     The following errors can occur:
00140 
00141     - insufficient memory
00142 
00143 --*/
00144 
00145 {
00146     USHORT CreateInfoMaxDepth;
00147     USHORT NameBufferMaxDepth;
00148     ULONG RegionSegmentSize;
00149     OBJECT_TYPE_INITIALIZER ObjectTypeInitializer;
00150     UNICODE_STRING TypeTypeName;
00151     UNICODE_STRING SymbolicLinkTypeName;
00152     UNICODE_STRING DosDevicesDirectoryName;
00153     UNICODE_STRING DirectoryTypeName;
00154     UNICODE_STRING RootDirectoryName;
00155     UNICODE_STRING TypeDirectoryName;
00156     NTSTATUS Status;
00157     OBJECT_ATTRIBUTES ObjectAttributes;
00158     HANDLE RootDirectoryHandle;
00159     HANDLE TypeDirectoryHandle;
00160     PLIST_ENTRY Next, Head;
00161     POBJECT_HEADER ObjectTypeHeader;
00162     POBJECT_HEADER_CREATOR_INFO CreatorInfo;
00163     POBJECT_HEADER_NAME_INFO NameInfo;
00164     MM_SYSTEMSIZE SystemSize;
00165     SECURITY_DESCRIPTOR AuditSd;
00166     PSECURITY_DESCRIPTOR EffectiveSd;
00167     PACL    AuditAllAcl;
00168     UCHAR   AuditAllBuffer[250];  // Ample room for the ACL
00169     ULONG   AuditAllLength;
00170     PACE_HEADER Ace;
00171     PNPAGED_LOOKASIDE_LIST Lookaside;
00172     ULONG Index;
00173     PKPRCB Prcb;
00174 
00175     //
00176     //  Determine the the size of the object creation and the name buffer
00177     //  lookaside lists.
00178     //
00179 
00180     SystemSize = MmQuerySystemSize();
00181 
00182     if (SystemSize == MmLargeSystem) {
00183 
00184         if (MmIsThisAnNtAsSystem()) {
00185 
00186             CreateInfoMaxDepth = 64;
00187             NameBufferMaxDepth = 32;
00188 
00189         } else {
00190 
00191             CreateInfoMaxDepth = 32;
00192             NameBufferMaxDepth = 16;
00193         }
00194 
00195     } else {
00196 
00197         CreateInfoMaxDepth = 3;
00198         NameBufferMaxDepth = 3;
00199     }
00200 
00201     //
00202     //  PHASE 0 Initialization
00203     //
00204 
00205     if (InitializationPhase == 0) {
00206 
00207         //
00208         //  Initialize the object creation lookaside list.
00209         //
00210 
00211         ExInitializeNPagedLookasideList( &ObpCreateInfoLookasideList,
00212                                          NULL,
00213                                          NULL,
00214                                          0,
00215                                          sizeof(OBJECT_CREATE_INFORMATION),
00216                                          'iCbO',
00217                                          CreateInfoMaxDepth );
00218 
00219         //
00220         //  Initialize the name buffer lookaside list.
00221         //
00222 
00223         ExInitializeNPagedLookasideList( &ObpNameBufferLookasideList,
00224                                          NULL,
00225                                          NULL,
00226                                          0,
00227                                          OBJECT_NAME_BUFFER_SIZE,
00228                                          'mNbO',
00229                                          NameBufferMaxDepth );
00230 
00231         //
00232         //  Initialize the system create info and name buffer lookaside lists
00233         //  for the current processor.
00234         //
00235         // N.B. Temporarily during the initialization of the system both
00236         //      lookaside list pointers in the processor block point to
00237         //      the same lookaside list structure. Later in initialization
00238         //      another lookaside list structure is allocated and filled
00239         //      for the per processor list.
00240         //
00241 
00242         Prcb = KeGetCurrentPrcb();
00243         Prcb->PPLookasideList[LookasideCreateInfoList].L = &ObpCreateInfoLookasideList;
00244         Prcb->PPLookasideList[LookasideCreateInfoList].P = &ObpCreateInfoLookasideList;
00245         Prcb->PPLookasideList[LookasideNameBufferList].L = &ObpNameBufferLookasideList;
00246         Prcb->PPLookasideList[LookasideNameBufferList].P = &ObpNameBufferLookasideList;
00247 
00248         //
00249         //  Initialize the object removal queue listhead.
00250         //
00251 
00252         ObpRemoveObjectQueue = NULL;
00253 
00254         //
00255         //  Initialize security descriptor cache
00256         //
00257 
00258         ObpInitSecurityDescriptorCache();
00259 
00260         KeInitializeMutant( &ObpInitKillMutant, FALSE );
00261         KeInitializeEvent( &ObpDefaultObject, NotificationEvent, TRUE );
00262         KeInitializeSpinLock( &ObpLock );
00263         PsGetCurrentProcess()->GrantedAccess = PROCESS_ALL_ACCESS;
00264         PsGetCurrentThread()->GrantedAccess = THREAD_ALL_ACCESS;
00265 
00266         KeInitializeSpinLock( &ObpDeviceMapLock );
00267 
00268         //
00269         //  Initialize the quota block and have the eprocess structure
00270         //  point to it.
00271         //
00272 
00273         KeInitializeSpinLock(&PspDefaultQuotaBlock.QuotaLock);
00274         PspDefaultQuotaBlock.ReferenceCount = 1;
00275         PspDefaultQuotaBlock.QuotaPoolLimit[PagedPool] = (ULONG)-1;
00276         PspDefaultQuotaBlock.QuotaPoolLimit[NonPagedPool] = (ULONG)-1;
00277         PspDefaultQuotaBlock.PagefileLimit = (ULONG)-1;
00278 
00279         PsGetCurrentProcess()->QuotaBlock = &PspDefaultQuotaBlock;
00280 
00281         //
00282         //  Initialize the handle table for the system process and also the global
00283         //  kernel handle table
00284         //
00285 
00286         PsGetCurrentProcess()->ObjectTable = ExCreateHandleTable( NULL );
00287         ObpKernelHandleTable = ExCreateHandleTable( NULL );
00288 
00289         //
00290         //  Create an object type for the "Type" object.  This is the start of
00291         //  of the object types and goes in the ObpTypeDirectoryObject.
00292         //
00293 
00294         RtlZeroMemory( &ObjectTypeInitializer, sizeof( ObjectTypeInitializer ) );
00295         ObjectTypeInitializer.Length = sizeof( ObjectTypeInitializer );
00296         ObjectTypeInitializer.InvalidAttributes = OBJ_OPENLINK;
00297         ObjectTypeInitializer.PoolType = NonPagedPool;
00298 
00299         RtlInitUnicodeString( &TypeTypeName, L"Type" );
00300         ObjectTypeInitializer.ValidAccessMask = OBJECT_TYPE_ALL_ACCESS;
00301         ObjectTypeInitializer.GenericMapping = ObpTypeMapping;
00302         ObjectTypeInitializer.DefaultNonPagedPoolCharge = sizeof( OBJECT_TYPE );
00303         ObjectTypeInitializer.MaintainTypeList = TRUE;
00304         ObjectTypeInitializer.UseDefaultObject = TRUE;
00305         ObCreateObjectType( &TypeTypeName,
00306                             &ObjectTypeInitializer,
00307                             (PSECURITY_DESCRIPTOR)NULL,
00308                             &ObpTypeObjectType );
00309 
00310         //
00311         //  Create the object type for the "Directory" object.
00312         //
00313 
00314         RtlInitUnicodeString( &DirectoryTypeName, L"Directory" );
00315         ObjectTypeInitializer.DefaultNonPagedPoolCharge = sizeof( OBJECT_DIRECTORY );
00316         ObjectTypeInitializer.ValidAccessMask = DIRECTORY_ALL_ACCESS;
00317         ObjectTypeInitializer.GenericMapping = ObpDirectoryMapping;
00318         ObjectTypeInitializer.UseDefaultObject = FALSE;
00319         ObjectTypeInitializer.MaintainTypeList = FALSE;
00320         ObCreateObjectType( &DirectoryTypeName,
00321                             &ObjectTypeInitializer,
00322                             (PSECURITY_DESCRIPTOR)NULL,
00323                             &ObpDirectoryObjectType );
00324 
00325         //
00326         //  Create the object type for the "SymbolicLink" object.
00327         //
00328 
00329         RtlInitUnicodeString( &SymbolicLinkTypeName, L"SymbolicLink" );
00330         ObjectTypeInitializer.DefaultNonPagedPoolCharge = sizeof( OBJECT_SYMBOLIC_LINK );
00331         ObjectTypeInitializer.ValidAccessMask = SYMBOLIC_LINK_ALL_ACCESS;
00332         ObjectTypeInitializer.GenericMapping = ObpSymbolicLinkMapping;
00333         ObjectTypeInitializer.DeleteProcedure = ObpDeleteSymbolicLink;
00334         ObjectTypeInitializer.ParseProcedure = ObpParseSymbolicLink;
00335         ObCreateObjectType( &SymbolicLinkTypeName,
00336                             &ObjectTypeInitializer,
00337                             (PSECURITY_DESCRIPTOR)NULL,
00338                             &ObpSymbolicLinkObjectType );
00339 
00340         //
00341         //  Initialize the resource that protects the object name space directory structure
00342         //
00343 
00344         ExInitializeResourceLite( &ObpRootDirectoryMutex );
00345 
00346 #if i386 && !FPO
00347 
00348         //
00349         //  Initialize the cached granted access structure.  These variables are used
00350         //  in place of the access mask in the object table entry.
00351         //
00352 
00353         ObpCurCachedGrantedAccessIndex = 0;
00354         ObpMaxCachedGrantedAccessIndex = PAGE_SIZE / sizeof( ACCESS_MASK );
00355         ObpCachedGrantedAccesses = ExAllocatePoolWithTag( NonPagedPool, PAGE_SIZE, 'gAbO' );
00356 
00357 #endif // i386 && !FPO
00358 
00359     } // End of Phase 0 Initialization
00360 
00361 
00362     //
00363     //  PHASE 1 Initialization
00364     //
00365 
00366     if (InitializationPhase == 1) {
00367 
00368         //
00369         //  Initialize the per processor nonpaged lookaside lists and descriptors.
00370         //
00371 
00372         for (Index = 0; Index < (ULONG)KeNumberProcessors; Index += 1) {
00373             Prcb = KiProcessorBlock[Index];
00374 
00375             //
00376             //  Initialize the create information per processor lookaside pointers.
00377             //
00378 
00379             Prcb->PPLookasideList[LookasideCreateInfoList].L = &ObpCreateInfoLookasideList;
00380             Lookaside = (PNPAGED_LOOKASIDE_LIST)ExAllocatePoolWithTag( NonPagedPool,
00381                                                                        sizeof(NPAGED_LOOKASIDE_LIST),
00382                                                                        'ICbO');
00383 
00384             if (Lookaside != NULL) {
00385                 ExInitializeNPagedLookasideList( Lookaside,
00386                                                  NULL,
00387                                                  NULL,
00388                                                  0,
00389                                                  sizeof(OBJECT_CREATE_INFORMATION),
00390                                                  'ICbO',
00391                                                  CreateInfoMaxDepth );
00392 
00393             } else {
00394                 Lookaside = &ObpCreateInfoLookasideList;
00395             }
00396 
00397             Prcb->PPLookasideList[LookasideCreateInfoList].P = Lookaside;
00398 
00399             //
00400             //  Initialize the name buffer per processor lookaside pointers.
00401             //
00402 
00403             Prcb->PPLookasideList[LookasideNameBufferList].L = &ObpNameBufferLookasideList;
00404             Lookaside = (PNPAGED_LOOKASIDE_LIST)ExAllocatePoolWithTag( NonPagedPool,
00405                                                                        sizeof(NPAGED_LOOKASIDE_LIST),
00406                                                                        'MNbO');
00407 
00408             if (Lookaside != NULL) {
00409                 ExInitializeNPagedLookasideList( Lookaside,
00410                                                  NULL,
00411                                                  NULL,
00412                                                  0,
00413                                                  OBJECT_NAME_BUFFER_SIZE,
00414                                                  'MNbO',
00415                                                  NameBufferMaxDepth);
00416 
00417             } else {
00418                 Lookaside = &ObpNameBufferLookasideList;
00419             }
00420 
00421             Prcb->PPLookasideList[LookasideNameBufferList].P = Lookaside;
00422         }
00423 
00424         EffectiveSd = SePublicDefaultUnrestrictedSd;
00425 
00426         //
00427         //  This code is only executed if base auditing is turned on.
00428         //
00429 
00430         if ((ObpAuditBaseDirectories != 0) || (ObpAuditBaseObjects != 0)) {
00431 
00432             //
00433             //  build an SACL to audit
00434             //
00435 
00436             AuditAllAcl = (PACL)AuditAllBuffer;
00437             AuditAllLength = (ULONG)sizeof(ACL) +
00438                                ((ULONG)sizeof(SYSTEM_AUDIT_ACE)) +
00439                                SeLengthSid(SeWorldSid);
00440 
00441             ASSERT( sizeof(AuditAllBuffer)   >   AuditAllLength );
00442 
00443             Status = RtlCreateAcl( AuditAllAcl, AuditAllLength, ACL_REVISION2);
00444 
00445             ASSERT( NT_SUCCESS(Status) );
00446 
00447             Status = RtlAddAuditAccessAce ( AuditAllAcl,
00448                                             ACL_REVISION2,
00449                                             GENERIC_ALL,
00450                                             SeWorldSid,
00451                                             TRUE,  TRUE ); //Audit success and failure
00452             ASSERT( NT_SUCCESS(Status) );
00453 
00454             Status = RtlGetAce( AuditAllAcl, 0,  (PVOID)&Ace );
00455 
00456             ASSERT( NT_SUCCESS(Status) );
00457 
00458             if (ObpAuditBaseDirectories != 0) {
00459 
00460                 Ace->AceFlags |= (CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE);
00461             }
00462 
00463             if (ObpAuditBaseObjects != 0) {
00464 
00465                 Ace->AceFlags |= (OBJECT_INHERIT_ACE    |
00466                                   CONTAINER_INHERIT_ACE |
00467                                   INHERIT_ONLY_ACE);
00468             }
00469 
00470             //
00471             //  Now create a security descriptor that looks just like
00472             //  the public default, but has auditing in it as well.
00473             //
00474 
00475             EffectiveSd = (PSECURITY_DESCRIPTOR)&AuditSd;
00476             Status = RtlCreateSecurityDescriptor( EffectiveSd,
00477                                                   SECURITY_DESCRIPTOR_REVISION1 );
00478 
00479             ASSERT( NT_SUCCESS(Status) );
00480 
00481             Status = RtlSetDaclSecurityDescriptor( EffectiveSd,
00482                                                    TRUE,        // DaclPresent
00483                                                    SePublicDefaultUnrestrictedDacl,
00484                                                    FALSE );     // DaclDefaulted
00485 
00486             ASSERT( NT_SUCCESS(Status) );
00487 
00488             Status = RtlSetSaclSecurityDescriptor( EffectiveSd,
00489                                                    TRUE,        // DaclPresent
00490                                                    AuditAllAcl,
00491                                                    FALSE );     // DaclDefaulted
00492 
00493             ASSERT( NT_SUCCESS(Status) );
00494         }
00495 
00496         //
00497         //  We only need to use the EffectiveSd on the root.  The SACL
00498         //  will be inherited by all other objects.
00499         //
00500 
00501         //
00502         //  Create an directory object for the root directory
00503         //
00504 
00505         RtlInitUnicodeString( &RootDirectoryName, L"\\" );
00506 
00507         InitializeObjectAttributes( &ObjectAttributes,
00508                                     &RootDirectoryName,
00509                                     OBJ_CASE_INSENSITIVE |
00510                                     OBJ_PERMANENT,
00511                                     NULL,
00512                                     EffectiveSd );
00513 
00514         Status = NtCreateDirectoryObject( &RootDirectoryHandle,
00515                                           DIRECTORY_ALL_ACCESS,
00516                                           &ObjectAttributes );
00517 
00518         if (!NT_SUCCESS( Status )) {
00519 
00520             return( FALSE );
00521         }
00522 
00523         Status = ObReferenceObjectByHandle( RootDirectoryHandle,
00524                                             0,
00525                                             ObpDirectoryObjectType,
00526                                             KernelMode,
00527                                             (PVOID *)&ObpRootDirectoryObject,
00528                                             NULL );
00529 
00530         if (!NT_SUCCESS( Status )) {
00531 
00532             return( FALSE );
00533         }
00534 
00535         Status = NtClose( RootDirectoryHandle );
00536 
00537         if (!NT_SUCCESS( Status )) {
00538 
00539             return( FALSE );
00540         }
00541 
00542         //
00543         //  Create an directory object for the directory of object types
00544         //
00545 
00546         RtlInitUnicodeString( &TypeDirectoryName, L"\\ObjectTypes" );
00547 
00548         InitializeObjectAttributes( &ObjectAttributes,
00549                                     &TypeDirectoryName,
00550                                     OBJ_CASE_INSENSITIVE |
00551                                     OBJ_PERMANENT,
00552                                     NULL,
00553                                     NULL );
00554 
00555         Status = NtCreateDirectoryObject( &TypeDirectoryHandle,
00556                                           DIRECTORY_ALL_ACCESS,
00557                                           &ObjectAttributes );
00558 
00559         if (!NT_SUCCESS( Status )) {
00560 
00561             return( FALSE );
00562         }
00563 
00564         Status = ObReferenceObjectByHandle( TypeDirectoryHandle,
00565                                             0,
00566                                             ObpDirectoryObjectType,
00567                                             KernelMode,
00568                                             (PVOID *)&ObpTypeDirectoryObject,
00569                                             NULL );
00570 
00571         if (!NT_SUCCESS( Status )) {
00572 
00573             return( FALSE );
00574         }
00575 
00576         Status = NtClose( TypeDirectoryHandle );
00577 
00578         if (!NT_SUCCESS( Status )) {
00579 
00580             return( FALSE );
00581         }
00582 
00583         //
00584         //  Lock the object directory name space
00585         //
00586 
00587         ObpEnterRootDirectoryMutex();
00588 
00589         //
00590         //  For every object type that has already been created we will
00591         //  insert it in the type directory.  We do this looking down the
00592         //  linked list of type objects and for every one that has a name
00593         //  and isn't already in a directory we'll look the name up and
00594         //  then put it in the directory.  Be sure to skip the first
00595         //  entry in the type object types lists.
00596         //
00597 
00598         Head = &ObpTypeObjectType->TypeList;
00599         Next = Head->Flink;
00600 
00601         while (Next != Head) {
00602 
00603             //
00604             //  Right after the creator info is the object header.  Get\
00605             //  the object header and then see if there is a name
00606             //
00607 
00608             CreatorInfo = CONTAINING_RECORD( Next,
00609                                              OBJECT_HEADER_CREATOR_INFO,
00610                                              TypeList );
00611 
00612             ObjectTypeHeader = (POBJECT_HEADER)(CreatorInfo+1);
00613 
00614             NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectTypeHeader );
00615 
00616             //
00617             //  Check if we have a name and we're not in a directory
00618             //
00619 
00620 
00621             if ((NameInfo != NULL) && (NameInfo->Directory == NULL)) {
00622 
00623                 if (!ObpLookupDirectoryEntry( ObpTypeDirectoryObject,
00624                                               &NameInfo->Name,
00625                                               OBJ_CASE_INSENSITIVE )) {
00626 
00627                     ObpInsertDirectoryEntry( ObpTypeDirectoryObject,
00628                                              &ObjectTypeHeader->Body );
00629                 }
00630             }
00631 
00632             Next = Next->Flink;
00633         }
00634 
00635         //
00636         //  Unlock the object directory name space
00637         //
00638 
00639         ObpLeaveRootDirectoryMutex();
00640 
00641         //
00642         //  Create \DosDevices object directory for drive letters and Win32 device names
00643         //
00644 
00645         Status = ObpCreateDosDevicesDirectory();
00646 
00647         if (!NT_SUCCESS( Status )) {
00648 
00649             return FALSE;
00650         }
00651     }
00652 
00653     return TRUE;
00654 }

NTKERNELAPI NTSTATUS ObInsertObject (  IN PVOID  Object,
IN PACCESS_STATE PassedAccessState  OPTIONAL,
IN ACCESS_MASK DesiredAccess  OPTIONAL,
IN ULONG  ObjectPointerBias,
OUT PVOID *NewObject  OPTIONAL,
OUT PHANDLE  Handle
) 
 

VOID ObKillProcess (  BOOLEAN  AcquireLock,
PEPROCESS  Process
) 
 

Definition at line 1022 of file obinit.c.

References ExDestroyHandleTable(), Executive, FALSE, IoSetThreadHardErrorMode(), KeEnterCriticalRegion, KeLeaveCriticalRegion, KeReleaseMutant(), KernelMode, KeWaitForSingleObject(), NULL, ObDestroyHandleProcedure(), _EPROCESS::ObjectTable, ObpInitKillMutant, ObpValidateIrql, and PAGED_CODE.

Referenced by PspCreateProcess(), PspExitProcess(), and PspExitThread(). 

01028                    :
01029 
01030     This function is called whenever a process is destroyed.  It loops over
01031     the process' object table and closes all the handles.
01032 
01033 Arguments:
01034 
01035     AcquireLock - TRUE if there are other pointers to this process and therefore
01036         this operation needs to be synchronized.  False if this is being called
01037         from the Process delete routine and therefore this is the only pointer
01038         to the process.
01039 
01040     Process - Pointer to the process that is being destroyed.
01041 
01042 Return Value:
01043 
01044     None.
01045 
01046 --*/
01047 
01048 {
01049     PVOID ObjectTable;
01050     BOOLEAN PreviousIOHardError;
01051 
01052     PAGED_CODE();
01053 
01054     ObpValidateIrql( "ObKillProcess" );
01055 
01056     //
01057     //  Check if we need to get the lock
01058     //
01059 
01060     if (AcquireLock) {
01061 
01062         KeEnterCriticalRegion();
01063 
01064         KeWaitForSingleObject( &ObpInitKillMutant,
01065                                Executive,
01066                                KernelMode,
01067                                FALSE,
01068                                NULL );
01069     }
01070 
01071     //
01072     //  If the process does NOT have an object table, return
01073     //
01074 
01075     ObjectTable = Process->ObjectTable;
01076 
01077     if (ObjectTable != NULL) {
01078         
01079         PreviousIOHardError = IoSetThreadHardErrorMode(FALSE); 
01080         
01081         //
01082         //  For each valid entry in the object table, close the handle
01083         //  that points to that entry.
01084         //
01085 
01086         ExDestroyHandleTable( ObjectTable, ObDestroyHandleProcedure );
01087 
01088         Process->ObjectTable = NULL;
01089         
01090         IoSetThreadHardErrorMode( PreviousIOHardError ); 
01091     }
01092 
01093     //
01094     //  Release the lock
01095     //
01096 
01097     if (AcquireLock) {
01098 
01099         KeReleaseMutant( &ObpInitKillMutant, 0, FALSE, FALSE );
01100 
01101         KeLeaveCriticalRegion();
01102     }
01103 
01104     //
01105     //  And return to our caller
01106     //
01107 
01108     return;
01109 }

NTKERNELAPI VOID ObMakeTemporaryObject (  IN PVOID  Object  ) 
 

Definition at line 484 of file obclose.c.

References FALSE, _OBJECT_HEADER::Flags, OB_FLAG_PERMANENT_OBJECT, OBJECT_TO_OBJECT_HEADER, ObpDeleteNameCheck(), and PAGED_CODE.

Referenced by IoCreateDriver(), IoDeleteDevice(), IopCompleteUnloadOrDelete(), IopInitializeBootDrivers(), IopInitializeBuiltinDriver(), IopLoadDriver(), NtMakeTemporaryObject(), and NtUnloadDriver(). 

00490                    :
00491 
00492     This routine removes the name of the object from its parent
00493     directory.  The object is only removed if it has a non zero
00494     handle count and a name.  Otherwise the object is simply
00495     made non permanent
00496 
00497 Arguments:
00498 
00499     Object - Supplies the object being modified
00500 
00501 Return Value:
00502 
00503     None.
00504 
00505 --*/
00506 
00507 {
00508     POBJECT_HEADER ObjectHeader;
00509 
00510     PAGED_CODE();
00511 
00512     ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
00513     ObjectHeader->Flags &= ~OB_FLAG_PERMANENT_OBJECT;
00514 
00515     ObpDeleteNameCheck( Object, FALSE );
00516 
00517     return;
00518 }

NTKERNELAPI NTSTATUS ObOpenObjectByName (  IN POBJECT_ATTRIBUTES  ObjectAttributes,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode,
IN OUT PACCESS_STATE PassedAccessState  OPTIONAL,
IN ACCESS_MASK DesiredAccess  OPTIONAL,
IN OUT PVOID ParseContext  OPTIONAL,
OUT PHANDLE  Handle
) 
 

NTKERNELAPI NTSTATUS ObOpenObjectByPointer (  IN PVOID  Object,
IN ULONG  HandleAttributes,
IN PACCESS_STATE PassedAccessState  OPTIONAL,
IN ACCESS_MASK DesiredAccess  OPTIONAL,
IN POBJECT_TYPE ObjectType  OPTIONAL,
IN KPROCESSOR_MODE  AccessMode,
OUT PHANDLE  Handle
) 
 

Definition at line 367 of file obref.c.

References FALSE, _OBJECT_TYPE_INITIALIZER::GenericMapping, Handle, _OBJECT_TYPE_INITIALIZER::InvalidAttributes, NT_SUCCESS, NTSTATUS(), NULL, ObDereferenceObject, OBJECT_TO_OBJECT_HEADER, ObOpenHandle, ObpCreateHandle(), ObpValidateIrql, ObReferenceObjectByPointer(), PAGED_CODE, SeCreateAccessState(), SeDeleteAccessState(), Status, _OBJECT_HEADER::Type, and _OBJECT_TYPE::TypeInfo.

Referenced by CreateSystemThread(), IopInvalidateVolumesForDevice(), NtCreatePagingFile(), NtOpenProcess(), NtOpenProcessToken(), NtOpenThread(), NtOpenThreadToken(), NtUserOpenInputDesktop(), obtest(), UserBeep(), xxxCreateDisconnectDesktop(), xxxCreateWindowStation(), xxxResolveDesktop(), xxxSetCsrssThreadDesktop(), and xxxSwitchDesktop(). 

00379                    :
00380 
00381     This routine opens an object referenced by a pointer.
00382 
00383 Arguments:
00384 
00385     Object - A pointer to the object being opened.
00386 
00387     HandleAttributes - The desired attributes for the handle, such
00388         as OBJ_INHERIT, OBJ_PERMANENT, OBJ_EXCLUSIVE, OBJ_CASE_INSENSITIVE,
00389         OBJ_OPENIF, and OBJ_OPENLINK
00390 
00391     PassedAccessState - Supplies an optional pointer to the current access
00392         status describing already granted access types, the privileges used
00393         to get them, and any access types yet to be granted.
00394 
00395     DesiredAcess - Supplies the desired access to the object.
00396 
00397     ObjectType - Supplies the type of the object being opened
00398 
00399     AccessMode - Supplies the processor mode of the access.
00400 
00401     Handle - Supplies a pointer to a variable that receives the handle value.
00402 
00403 Return Value:
00404 
00405     An appropriate NTSTATUS value
00406 
00407 --*/
00408 
00409 {
00410     NTSTATUS Status;
00411     HANDLE NewHandle;
00412     POBJECT_HEADER ObjectHeader;
00413     ACCESS_STATE LocalAccessState;
00414     PACCESS_STATE AccessState = NULL;
00415     AUX_ACCESS_DATA AuxData;
00416 
00417     PAGED_CODE();
00418 
00419     ObpValidateIrql( "ObOpenObjectByPointer" );
00420 
00421     //
00422     //  First increment the pointer count for the object.  This routine
00423     //  also checks the object types
00424     //
00425 
00426     Status = ObReferenceObjectByPointer( Object,
00427                                          0,
00428                                          ObjectType,
00429                                          AccessMode );
00430 
00431     if (NT_SUCCESS( Status )) {
00432 
00433         //
00434         //  Get the object header for the input object body
00435         //
00436 
00437         ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
00438 
00439         //
00440         //  If the caller did not pass in an access state then
00441         //  we will create a new one based on the desired access
00442         //  and the object types generic mapping
00443         //
00444 
00445         if (!ARGUMENT_PRESENT( PassedAccessState )) {
00446 
00447             Status = SeCreateAccessState( &LocalAccessState,
00448                                           &AuxData,
00449                                           DesiredAccess,
00450                                           &ObjectHeader->Type->TypeInfo.GenericMapping );
00451 
00452             if (!NT_SUCCESS( Status )) {
00453 
00454                 ObDereferenceObject( Object );
00455 
00456                 return(Status);
00457             }
00458 
00459             AccessState = &LocalAccessState;
00460 
00461         //
00462         //  Otherwise the caller did specify an access state so
00463         //  we use the one passed in.
00464         //
00465 
00466         } else {
00467 
00468             AccessState = PassedAccessState;
00469         }
00470 
00471         //
00472         //  Make sure the caller is asking for handle attributes that are
00473         //  valid for the given object type
00474         //
00475 
00476         if (ObjectHeader->Type->TypeInfo.InvalidAttributes & HandleAttributes) {
00477 
00478             if (AccessState == &LocalAccessState) {
00479 
00480                 SeDeleteAccessState( AccessState );
00481             }
00482 
00483             ObDereferenceObject( Object );
00484 
00485             return( STATUS_INVALID_PARAMETER );
00486         }
00487 
00488         //
00489         //  We've referenced the object and have an access state to give
00490         //  the new handle so now create a new handle for the object.
00491         //
00492 
00493         Status = ObpCreateHandle( ObOpenHandle,
00494                                   Object,
00495                                   ObjectType,
00496                                   AccessState,
00497                                   0,
00498                                   HandleAttributes,
00499                                   FALSE,
00500                                   AccessMode,
00501                                   (PVOID *)NULL,
00502                                   &NewHandle );
00503 
00504         if (!NT_SUCCESS( Status )) {
00505 
00506             ObDereferenceObject( Object );
00507         }
00508     }
00509 
00510     //
00511     //  If we successfully opened by object and created a new handle
00512     //  then set the output variable correctly
00513     //
00514 
00515     if (NT_SUCCESS( Status )) {
00516 
00517         *Handle = NewHandle;
00518 
00519     } else {
00520 
00521         *Handle = NULL;
00522     }
00523 
00524     //
00525     //  Check if we used our own access state and now need to cleanup
00526     //
00527 
00528     if (AccessState == &LocalAccessState) {
00529 
00530         SeDeleteAccessState( AccessState );
00531     }
00532 
00533     //
00534     //  And return to our caller
00535     //
00536 
00537     return( Status );
00538 }

NTSTATUS ObQueryDeviceMapInformation (  IN PEPROCESS  TargetProcess,
OUT PPROCESS_DEVICEMAP_INFORMATION  DeviceMapInformation
) 
 

Definition at line 236 of file obdevmap.c.

References _DEVICE_MAP::DriveMap, EXCEPTION_EXECUTE_HANDLER, NTSTATUS(), NULL, ObpDeviceMapLock, ObSystemDeviceMap, and Status.

Referenced by NtQueryInformationProcess(). 

00243                    :
00244 
00245     This function queries information from the device map associated with the
00246     specified process.  The returned information contains a bit map indicating
00247     which drive letters are defined in the associated object directory, along
00248     with an array of drive types that give the type of each drive letter.
00249 
00250 Arguments:
00251 
00252     TargetProcess - Specifies the target process to retreive the device map
00253         from.  If not specified then we return the global default device map
00254 
00255     DeviceMapInformation - Specifies the location where to store the results.
00256 
00257 Return Value:
00258 
00259     Returns one of the following status codes:
00260 
00261         STATUS_SUCCESS - normal, successful completion.
00262 
00263         STATUS_END_OF_FILE - The specified process was not associated with
00264             a device map.
00265 
00266         STATUS_ACCESS_VIOLATION - The DeviceMapInformation buffer pointer
00267             value specified an invalid address.
00268 
00269 --*/
00270 
00271 {
00272     NTSTATUS Status;
00273     PDEVICE_MAP DeviceMap;
00274     KIRQL OldIrql;
00275     PROCESS_DEVICEMAP_INFORMATION LocalMapInformation;
00276 
00277     //
00278     //  Check if the caller gave us a target process and if not then use
00279     //  the globally defined one
00280     //
00281 
00282     if (ARGUMENT_PRESENT( TargetProcess )) {
00283 
00284         DeviceMap = TargetProcess->DeviceMap;
00285 
00286     } else {
00287 
00288         DeviceMap = ObSystemDeviceMap;
00289     }
00290 
00291     //
00292     //  If we do not have a device map then we'll return an error otherwise
00293     //  we simply copy over the device map structure (bitmap and drive type
00294     //  array) into the output buffer
00295     //
00296 
00297     if (DeviceMap == NULL) {
00298 
00299         Status = STATUS_END_OF_FILE;
00300 
00301     } else {
00302 
00303         Status = STATUS_SUCCESS;
00304 
00305         //
00306         //  First, while using a spinlock to protect the device map from
00307         //  going away we will make local copy of the information.
00308         //
00309 
00310         ExAcquireSpinLock( &ObpDeviceMapLock, &OldIrql );
00311 
00312         RtlMoveMemory( &LocalMapInformation.Query,
00313                        &DeviceMap->DriveMap,
00314                        sizeof( DeviceMapInformation->Query ));
00315 
00316         ExReleaseSpinLock( &ObpDeviceMapLock, OldIrql );
00317 
00318         //
00319         //  Now we can copy the information to the caller buffer using
00320         //  a try-except to guard against the output buffer changing.
00321         //  Note that the caller must have already probed the buffer
00322         //  for write.
00323         //
00324 
00325         try {
00326 
00327             RtlMoveMemory( &DeviceMapInformation->Query,
00328                            &LocalMapInformation.Query,
00329                            sizeof( DeviceMapInformation->Query ));
00330 
00331         } except( EXCEPTION_EXECUTE_HANDLER ) {
00332 
00333             Status = GetExceptionCode();
00334         }
00335 
00336     }
00337 
00338     return Status;
00339 }

NTKERNELAPI NTSTATUS ObQueryNameString (  IN PVOID  Object,
OUT POBJECT_NAME_INFORMATION  ObjectNameInfo,
IN ULONG  Length,
OUT PULONG  ReturnLength
) 
 

Definition at line 713 of file obquery.c.

References _OBJECT_HEADER_NAME_INFO::Directory, EXCEPTION_EXECUTE_HANDLER, _OBJECT_HEADER_NAME_INFO::Name, NTSTATUS(), NULL, OBJECT_HEADER_TO_NAME_INFO, OBJECT_TO_OBJECT_HEADER, OBP_MISSING_NAME_LITERAL, OBP_MISSING_NAME_LITERAL_SIZE, ObpBeginTypeSpecificCallOut, ObpEndTypeSpecificCallOut, ObpEnterRootDirectoryMutex, ObpLeaveRootDirectoryMutex, ObpRootDirectoryObject, PAGED_CODE, _OBJECT_TYPE_INITIALIZER::QueryNameProcedure, Status, String, _OBJECT_HEADER::Type, _OBJECT_TYPE::TypeInfo, and USHORT.

Referenced by CcWriteBehind(), IoGetDeviceProperty(), IopBuildCmResourceList(), IopCaptureObjectName(), IopErrorLogThread(), IopQueryName(), IopRaiseHardError(), MmGetFileNameForSection(), NtQueryObject(), NtQueryVirtualMemory(), ObGetObjectInformation(), and SepQueryNameString(). 

00722                    :
00723 
00724     This routine processes a query of an object's name information
00725 
00726 Arguments:
00727 
00728     Object - Supplies the object being queried
00729 
00730     ObjectNameInfo - Supplies the buffer to store the name string
00731         information
00732 
00733     Length - Specifies the length, in bytes, of the original object
00734         name info buffer.
00735 
00736     ReturnLength - Contains the number of bytes already used up
00737         in the object name info. On return this receives an updated
00738         byte count.
00739 
00740         (Length minus ReturnLength) is really now many bytes are left
00741         in the output buffer.  The buffer supplied to this call may
00742         actually be offset within the original users buffer
00743 
00744 Return Value:
00745 
00746     An appropriate status value
00747 
00748 --*/
00749 
00750 {
00751     NTSTATUS Status;
00752     POBJECT_HEADER ObjectHeader;
00753     POBJECT_HEADER_NAME_INFO NameInfo;
00754     POBJECT_HEADER ObjectDirectoryHeader;
00755     POBJECT_DIRECTORY ObjectDirectory;
00756     ULONG NameInfoSize;
00757     PUNICODE_STRING String;
00758     PWCH StringBuffer;
00759     ULONG NameSize;
00760 
00761     PAGED_CODE();
00762 
00763     //
00764     //  Get the object header and name info record if it exists
00765     //
00766 
00767     ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
00768     NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectHeader );
00769 
00770     //
00771     //  If the object type has a query name callback routine then
00772     //  that is how we get the name
00773     //
00774 
00775     if (ObjectHeader->Type->TypeInfo.QueryNameProcedure != NULL) {
00776 
00777         try {
00778 
00779             KIRQL SaveIrql;
00780 
00781             ObpBeginTypeSpecificCallOut( SaveIrql );
00782             ObpEndTypeSpecificCallOut( SaveIrql, "Query", ObjectHeader->Type, Object );
00783 
00784             Status = (*ObjectHeader->Type->TypeInfo.QueryNameProcedure)( Object,
00785                                                                          (BOOLEAN)((NameInfo != NULL) && (NameInfo->Name.Length != 0)),
00786                                                                          ObjectNameInfo,
00787                                                                          Length,
00788                                                                          ReturnLength );
00789 
00790         } except( EXCEPTION_EXECUTE_HANDLER ) {
00791 
00792             Status = GetExceptionCode();
00793         }
00794 
00795         return( Status );
00796     }
00797 
00798     //
00799     //  Otherwise, the object type does not specify a query name
00800     //  procedure so we get to do the work.  The first thing
00801     //  to check is if the object doesn't even have a name.  If
00802     //  object doesn't have a name then we'll return an empty name
00803     //  info structure.
00804     //
00805 
00806     if ((NameInfo == NULL) || (NameInfo->Name.Buffer == NULL)) {
00807 
00808         //
00809         //  Compute the length of our return buffer, set the output
00810         //  if necessary and make sure the supplied buffer is large
00811         //  enough
00812         //
00813 
00814         NameInfoSize = sizeof( OBJECT_NAME_INFORMATION );
00815 
00816         try {
00817 
00818             *ReturnLength = NameInfoSize;
00819 
00820         } except( EXCEPTION_EXECUTE_HANDLER ) {
00821 
00822             return( GetExceptionCode() );
00823         }
00824 
00825         if (Length < NameInfoSize) {
00826 
00827             return( STATUS_INFO_LENGTH_MISMATCH );
00828         }
00829 
00830         //
00831         //  Initialize the output buffer to be an empty string
00832         //  and then return to our caller
00833         //
00834 
00835         try {
00836 
00837             ObjectNameInfo->Name.Length = 0;
00838             ObjectNameInfo->Name.MaximumLength = 0;
00839             ObjectNameInfo->Name.Buffer = NULL;
00840 
00841         } except( EXCEPTION_EXECUTE_HANDLER ) {
00842 
00843             //
00844             //  Fall through, since we cannot undo what we have done.
00845             //
00846             //  **** This should probably get the exception code and return
00847             //  that value
00848             //
00849         }
00850 
00851         return( STATUS_SUCCESS );
00852     }
00853 
00854     //
00855     //  First lock the directory mutex to stop before we chase stuff down
00856     //
00857 
00858     ObpEnterRootDirectoryMutex();
00859 
00860     try {
00861 
00862         //
00863         //  The object does have a name but now see if this is
00864         //  just the root directory object in which case the name size
00865         //  is only the "\" character
00866         //
00867 
00868         if (Object == ObpRootDirectoryObject) {
00869 
00870             NameSize = sizeof( OBJ_NAME_PATH_SEPARATOR );
00871 
00872         } else {
00873 
00874             //
00875             //  The named object is not the root so for every directory
00876             //  working out way up we'll add its size to the name keeping
00877             //  track of "\" characters inbetween each component.  We first
00878             //  start with the object name itself and then move on to
00879             //  the directories
00880             //
00881 
00882             ObjectDirectory = NameInfo->Directory;
00883             NameSize = sizeof( OBJ_NAME_PATH_SEPARATOR ) + NameInfo->Name.Length;
00884 
00885             //
00886             //  While we are not at the root we'll keep moving up
00887             //
00888 
00889             while ((ObjectDirectory != ObpRootDirectoryObject) && (ObjectDirectory)) {
00890 
00891                 //
00892                 //  Get the name information for this directory
00893                 //
00894 
00895                 ObjectDirectoryHeader = OBJECT_TO_OBJECT_HEADER( ObjectDirectory );
00896                 NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectDirectoryHeader );
00897 
00898                 if ((NameInfo != NULL) && (NameInfo->Directory != NULL)) {
00899 
00900                     //
00901                     //  This directory has a name so add it to the accomulated
00902                     //  size and move up the tree
00903                     //
00904 
00905                     NameSize += sizeof( OBJ_NAME_PATH_SEPARATOR ) + NameInfo->Name.Length;
00906                     ObjectDirectory = NameInfo->Directory;
00907 
00908                 } else {
00909 
00910                     //
00911                     //  This directory does not have a name so we'll give it
00912                     //  the "..." name and stop the loop
00913                     //
00914 
00915                     NameSize += sizeof( OBJ_NAME_PATH_SEPARATOR ) + OBP_MISSING_NAME_LITERAL_SIZE;
00916                     break;
00917                 }
00918             }
00919         }
00920 
00921         //
00922         //  At this point NameSize is the number of bytes we need to store the
00923         //  name of the object from the root down.  The total buffer size we are
00924         //  going to need will include this size, plus object name information
00925         //  structure, plus an ending null character
00926         //
00927 
00928         NameInfoSize = NameSize + sizeof( OBJECT_NAME_INFORMATION ) + sizeof( UNICODE_NULL );
00929 
00930         //
00931         //  Set the output size and make sure the supplied buffer is large enough
00932         //  to hold the information
00933         //
00934 
00935         try {
00936 
00937             *ReturnLength = NameInfoSize;
00938 
00939         } except( EXCEPTION_EXECUTE_HANDLER ) {
00940 
00941             Status = GetExceptionCode();
00942             leave;
00943         }
00944 
00945         if (Length < NameInfoSize) {
00946 
00947             Status = STATUS_INFO_LENGTH_MISMATCH;
00948             leave;
00949         }
00950 
00951         //
00952         //  **** the following IF isn't necessary because name info size is
00953         //  already guaranteed to be nonzero from about 23 lines above
00954         //
00955 
00956         if (NameInfoSize != 0) {
00957 
00958             //
00959             //  Set the String buffer to point to the byte right after the
00960             //  last byte in the output string.  This following logic actually
00961             //  fills in the buffer backwards working from the name back to the
00962             //  root
00963             //
00964 
00965             StringBuffer = (PWCH)ObjectNameInfo;
00966             StringBuffer = (PWCH)((PCH)StringBuffer + NameInfoSize);
00967 
00968             NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectHeader );
00969 
00970             try {
00971 
00972                 //
00973                 //  Terminate the string with a null and backup one unicode
00974                 //  character
00975                 //
00976 
00977                 *--StringBuffer = UNICODE_NULL;
00978 
00979                 //
00980                 //  If the object in question is not the root directory
00981                 //  then we are going to put its name in the string buffer
00982                 //  When we finally reach the root directory we'll append on
00983                 //  the final "\"
00984                 //
00985 
00986                 if (Object != ObpRootDirectoryObject) {
00987 
00988                     //
00989                     //  Add in the objects name
00990                     //
00991 
00992                     String = &NameInfo->Name;
00993                     StringBuffer = (PWCH)((PCH)StringBuffer - String->Length);
00994                     RtlMoveMemory( StringBuffer, String->Buffer, String->Length );
00995 
00996                     //
00997                     //  While we are not at the root directory we'll keep
00998                     //  moving up
00999                     //
01000 
01001                     ObjectDirectory = NameInfo->Directory;
01002 
01003                     while ((ObjectDirectory != ObpRootDirectoryObject) && (ObjectDirectory)) {
01004 
01005                         //
01006                         //  Get the name information for this directory
01007                         //
01008 
01009                         ObjectDirectoryHeader = OBJECT_TO_OBJECT_HEADER( ObjectDirectory );
01010                         NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectDirectoryHeader );
01011 
01012                         //
01013                         //  Tack on the "\" between the last name we added and
01014                         //  this new name
01015                         //
01016 
01017                         *--StringBuffer = OBJ_NAME_PATH_SEPARATOR;
01018 
01019                         //
01020                         //  Preappend the directory name, if it has one, and
01021                         //  move up to the next directory.
01022                         //
01023 
01024                         if ((NameInfo != NULL) && (NameInfo->Directory != NULL)) {
01025 
01026                             String = &NameInfo->Name;
01027                             StringBuffer = (PWCH)((PCH)StringBuffer - String->Length);
01028                             RtlMoveMemory( StringBuffer, String->Buffer, String->Length );
01029                             ObjectDirectory = NameInfo->Directory;
01030 
01031                         } else {
01032 
01033                             //
01034                             //  The directory is nameless so use the "..." for
01035                             //  its name and break out of the loop
01036                             //
01037 
01038                             StringBuffer = (PWCH)((PCH)StringBuffer - OBP_MISSING_NAME_LITERAL_SIZE);
01039                             RtlMoveMemory( StringBuffer,
01040                                            OBP_MISSING_NAME_LITERAL,
01041                                            OBP_MISSING_NAME_LITERAL_SIZE );
01042                             break;
01043                         }
01044                     }
01045                 }
01046 
01047                 //
01048                 //  Tack on the "\" for the root directory and then set the
01049                 //  output unicode string variable to have the right size
01050                 //  and point to the right spot.
01051                 //
01052 
01053                 *--StringBuffer = OBJ_NAME_PATH_SEPARATOR;
01054 
01055                 ObjectNameInfo->Name.Length = (USHORT)NameSize;
01056                 ObjectNameInfo->Name.MaximumLength = (USHORT)(NameSize+sizeof( UNICODE_NULL ));
01057                 ObjectNameInfo->Name.Buffer = StringBuffer;
01058 
01059             } except( EXCEPTION_EXECUTE_HANDLER ) {
01060 
01061                 //
01062                 // Fall through, since we cannot undo what we have done.
01063                 //
01064                 //  **** This should probably get the exception code and return
01065                 //  that value
01066                 //
01067             }
01068         }
01069 
01070         Status = STATUS_SUCCESS;
01071 
01072     } finally {
01073 
01074         ObpLeaveRootDirectoryMutex();
01075     }
01076 
01077     return Status;
01078 }

NTSTATUS ObQueryObjectAuditingByHandle (  IN HANDLE  Handle,
OUT PBOOLEAN  GenerateOnClose
) 
 

Definition at line 1319 of file obquery.c.

References ExMapHandleToPointer(), ExUnlockHandleTableEntry(), FALSE, Handle, KeEnterCriticalRegion, KeLeaveCriticalRegion, NTSTATUS(), NULL, _HANDLE_TABLE_ENTRY::ObAttributes, OBJ_AUDIT_OBJECT_CLOSE, ObpGetObjectTable, ObpValidateIrql, PAGED_CODE, Status, and TRUE. 

01326                    :
01327 
01328     This routine tells the caller if the indicated handle will
01329     generate an audit if it is closed
01330 
01331 Arguments:
01332 
01333     Handle - Supplies the handle being queried
01334 
01335     GenerateOnClose - Receives TRUE if the handle will generate
01336         an audit if closed and FALSE otherwise
01337 
01338 Return Value:
01339 
01340     An appropriate status value
01341 
01342 --*/
01343 
01344 {
01345     PHANDLE_TABLE ObjectTable;
01346     PHANDLE_TABLE_ENTRY ObjectTableEntry;
01347     PVOID Object;
01348     ULONG CapturedGrantedAccess;
01349     ULONG CapturedAttributes;
01350     NTSTATUS Status;
01351 
01352     PAGED_CODE();
01353 
01354     //
01355     //  Protect ourselves from being interrupted while we hold a handle table
01356     //  entry lock
01357     //
01358 
01359     KeEnterCriticalRegion();
01360 
01361     try {
01362 
01363         ObpValidateIrql( "ObQueryObjectAuditingByHandle" );
01364 
01365 
01366         //
01367         //  For the current process we'll grab its object table and
01368         //  then get the object table entry
01369         //
01370 
01371         ObjectTable = ObpGetObjectTable();
01372 
01373         ObjectTableEntry = ExMapHandleToPointer( ObjectTable,
01374                                                   Handle );
01375 
01376         //
01377         //  If we were given a valid handle we'll look at the attributes
01378         //  stored in the object table entry to decide if we generate
01379         //  an audit on close
01380         //
01381 
01382         if (ObjectTableEntry != NULL) {
01383 
01384             CapturedAttributes = ObjectTableEntry->ObAttributes;
01385 
01386             if (CapturedAttributes & OBJ_AUDIT_OBJECT_CLOSE) {
01387 
01388                 *GenerateOnClose = TRUE;
01389 
01390             } else {
01391 
01392                 *GenerateOnClose = FALSE;
01393             }
01394 
01395             ExUnlockHandleTableEntry( ObjectTable, ObjectTableEntry );
01396 
01397             Status = STATUS_SUCCESS;
01398 
01399         } else {
01400 
01401             Status = STATUS_INVALID_HANDLE;
01402         }
01403 
01404     } finally {
01405 
01406         KeLeaveCriticalRegion();
01407     }
01408 
01409     return Status;
01410 }

NTSTATUS ObQueryTypeInfo (  IN POBJECT_TYPE  ObjectType,
OUT POBJECT_TYPE_INFORMATION  ObjectTypeInfo,
IN ULONG  Length,
OUT PULONG  ReturnLength
) 
 

Definition at line 1216 of file obquery.c.

References ALIGN_UP, EXCEPTION_EXECUTE_HANDLER, NTSTATUS(), and Status.

Referenced by NtQueryObject(). 

01225                    :
01226 
01227     This routine processes the query for object type information
01228 
01229 Arguments:
01230 
01231     Object - Supplies a pointer to the object type being queried
01232 
01233     ObjectTypeInfo - Supplies the buffer to store the type information
01234 
01235     Length - Specifies the length, in bytes, of the object type
01236         information buffer
01237 
01238     ReturnLength - Contains the number of bytes already used up
01239         in the object type information buffer. On return this receives
01240         an updated byte count
01241 
01242         (Length minus ReturnLength) is really now many bytes are left
01243         in the output buffer.  The buffer supplied to this call may
01244         actually be offset within the original users buffer
01245 
01246 Return Value:
01247 
01248     An appropriate status value
01249 
01250 --*/
01251 
01252 {
01253     NTSTATUS Status;
01254 
01255     try {
01256 
01257         //
01258         //  The total number of bytes needed for this query includes the
01259         //  object type information structure plus the name of the type
01260         //  rounded up to a ulong boundary
01261         //
01262 
01263         *ReturnLength += sizeof( *ObjectTypeInfo ) + ALIGN_UP( ObjectType->Name.MaximumLength, ULONG );
01264 
01265         //
01266         //  Make sure the buffer is large enough for this information and
01267         //  then fill in the record
01268         //
01269 
01270         if (Length < *ReturnLength) {
01271 
01272             Status = STATUS_INFO_LENGTH_MISMATCH;
01273 
01274         } else {
01275 
01276             ObjectTypeInfo->TotalNumberOfObjects = ObjectType->TotalNumberOfObjects;
01277             ObjectTypeInfo->TotalNumberOfHandles = ObjectType->TotalNumberOfHandles;
01278             ObjectTypeInfo->HighWaterNumberOfObjects = ObjectType->HighWaterNumberOfObjects;
01279             ObjectTypeInfo->HighWaterNumberOfHandles = ObjectType->HighWaterNumberOfHandles;
01280             ObjectTypeInfo->InvalidAttributes = ObjectType->TypeInfo.InvalidAttributes;
01281             ObjectTypeInfo->GenericMapping = ObjectType->TypeInfo.GenericMapping;
01282             ObjectTypeInfo->ValidAccessMask = ObjectType->TypeInfo.ValidAccessMask;
01283             ObjectTypeInfo->SecurityRequired = ObjectType->TypeInfo.SecurityRequired;
01284             ObjectTypeInfo->MaintainHandleCount = ObjectType->TypeInfo.MaintainHandleCount;
01285             ObjectTypeInfo->PoolType = ObjectType->TypeInfo.PoolType;
01286             ObjectTypeInfo->DefaultPagedPoolCharge = ObjectType->TypeInfo.DefaultPagedPoolCharge;
01287             ObjectTypeInfo->DefaultNonPagedPoolCharge = ObjectType->TypeInfo.DefaultNonPagedPoolCharge;
01288 
01289             //
01290             //  The type name goes right after this structure.  We cannot use
01291             //  rtl routine like RtlCopyUnicodeString that might use the local
01292             //  memory to keep state, because this is the user buffer and it
01293             //  could be changing by user
01294             //
01295 
01296             ObjectTypeInfo->TypeName.Buffer = (PWSTR)(ObjectTypeInfo+1);
01297             ObjectTypeInfo->TypeName.Length = ObjectType->Name.Length;
01298             ObjectTypeInfo->TypeName.MaximumLength = ObjectType->Name.MaximumLength;
01299 
01300             RtlMoveMemory( (PWSTR)(ObjectTypeInfo+1),
01301                            ObjectType->Name.Buffer,
01302                            ObjectType->Name.Length );
01303 
01304             ((PWSTR)(ObjectTypeInfo+1))[ ObjectType->Name.Length/sizeof(WCHAR) ] = UNICODE_NULL;
01305 
01306             Status = STATUS_SUCCESS;
01307         }
01308 
01309     } except( EXCEPTION_EXECUTE_HANDLER ) {
01310 
01311         Status = GetExceptionCode();
01312     }
01313 
01314     return Status;
01315 }

NTSTATUS ObQueryTypeName (  IN PVOID  Object,
PUNICODE_STRING  ObjectTypeName,
IN ULONG  Length,
OUT PULONG  ReturnLength
) 
 

Definition at line 1082 of file obquery.c.

References EXCEPTION_EXECUTE_HANDLER, _OBJECT_TYPE::Name, OBJECT_TO_OBJECT_HEADER, PAGED_CODE, String, _OBJECT_HEADER::Type, and USHORT.

Referenced by ObGetObjectInformation(), and SepQueryTypeString(). 

01091                    :
01092 
01093     This routine processes a query of an object's type name
01094 
01095 Arguments:
01096 
01097     Object - Supplies the object being queried
01098 
01099     ObjectTypeName - Supplies the buffer to store the type name
01100         string information
01101 
01102     Length - Specifies the length, in bytes, of the object type
01103         name buffer
01104 
01105     ReturnLength - Contains the number of bytes already used up
01106         in the object type name buffer. On return this receives
01107         an updated byte count
01108 
01109         (Length minus ReturnLength) is really now many bytes are left
01110         in the output buffer.  The buffer supplied to this call may
01111         actually be offset within the original users buffer
01112 
01113 Return Value:
01114 
01115     An appropriate status value
01116 
01117 --*/
01118 
01119 {
01120     POBJECT_TYPE ObjectType;
01121     POBJECT_HEADER ObjectHeader;
01122     ULONG TypeNameSize;
01123     PUNICODE_STRING String;
01124     PWCH StringBuffer;
01125     ULONG NameSize;
01126 
01127     PAGED_CODE();
01128 
01129     //
01130     //  From the object get its object type and from that get the size of
01131     //  the object type name.  The total size for we need for the output
01132     //  buffer must fit the name, a terminating null, and a preceding
01133     //  unicode string structure
01134     //
01135 
01136     ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
01137     ObjectType = ObjectHeader->Type;
01138 
01139     NameSize = ObjectType->Name.Length;
01140     TypeNameSize = NameSize + sizeof( UNICODE_NULL ) + sizeof( UNICODE_STRING );
01141 
01142     //
01143     //  Update the number of bytes we need and make sure the output buffer is
01144     //  large enough
01145     //
01146     //  **** to be consistent with all our callers and other routines in
01147     //  this module this should probably be a "+=" and not just "="
01148     //
01149 
01150     try {
01151 
01152         *ReturnLength = TypeNameSize;
01153 
01154     } except( EXCEPTION_EXECUTE_HANDLER ) {
01155 
01156         return( GetExceptionCode() );
01157     }
01158 
01159     if (Length < TypeNameSize) {
01160 
01161         return( STATUS_INFO_LENGTH_MISMATCH );
01162     }
01163 
01164     //
01165     //  **** this IF is probably not needed because of the earlier computation
01166     //  of type name size
01167     //
01168 
01169     if (TypeNameSize != 0) {
01170 
01171         //
01172         //  Set string buffer to point to the one byte beyond the
01173         //  buffer that we're going to fill in
01174         //
01175 
01176         StringBuffer = (PWCH)ObjectTypeName;
01177         StringBuffer = (PWCH)((PCH)StringBuffer + TypeNameSize);
01178 
01179         String = &ObjectType->Name;
01180 
01181         try {
01182 
01183             //
01184             //  Tack on the terminating null character and copy over
01185             //  the type name
01186             //
01187 
01188             *--StringBuffer = UNICODE_NULL;
01189 
01190             StringBuffer = (PWCH)((PCH)StringBuffer - String->Length);
01191 
01192             RtlMoveMemory( StringBuffer, String->Buffer, String->Length );
01193 
01194             //
01195             //  Now set the preceding unicode string to have the right
01196             //  lengths and to point to this buffer
01197             //
01198 
01199             ObjectTypeName->Length = (USHORT)NameSize;
01200             ObjectTypeName->MaximumLength = (USHORT)(NameSize+sizeof( UNICODE_NULL ));
01201             ObjectTypeName->Buffer = StringBuffer;
01202 
01203         } except( EXCEPTION_EXECUTE_HANDLER ) {
01204 
01205             //
01206             // Fall through, since we cannot undo what we have done.
01207             //
01208         }
01209     }
01210 
01211     return( STATUS_SUCCESS );
01212 }

NTKERNELAPI NTSTATUS ObReferenceObjectByHandle (  IN HANDLE  Handle,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE ObjectType  OPTIONAL,
IN KPROCESSOR_MODE  AccessMode,
OUT PVOID *  Object,
OUT POBJECT_HANDLE_INFORMATION HandleInformation  OPTIONAL
) 
 

Definition at line 542 of file obref.c.

References ASSERT, _OBJECT_HEADER::Body, DecodeKernelHandle, ExMapHandleToPointer(), ExUnlockHandleTableEntry(), FALSE, _EPROCESS::GrantedAccess, _ETHREAD::GrantedAccess, _HANDLE_TABLE_ENTRY::GrantedAccess, _HANDLE_TABLE_ENTRY::GrantedAccessIndex, Handle, IsKernelHandle, KeDetachProcess(), KeEnterCriticalRegion, KeLeaveCriticalRegion, KernelMode, NtGlobalFlag, NTSTATUS(), NULL, _HANDLE_TABLE_ENTRY::ObAttributes, OBJ_HANDLE_ATTRIBUTES, _HANDLE_TABLE_ENTRY::Object, OBJECT_TO_OBJECT_HEADER, ObpGetObjectTable, ObpIncrPointerCount, ObpKernelHandleTable, ObpValidateIrql, PsGetCurrentProcess, PsGetCurrentThread, PsProcessType, PsThreadType, SeComputeDeniedAccesses, Status, TRUE, and _OBJECT_HEADER::Type.

Referenced by _GetUserObjectInformation(), _SetUserObjectInformation(), BuildQueryDirectoryIrp(), CmGetSystemDriverList(), CmpCloneControlSet(), CmpCloneHwProfile(), CmpCreateEvent(), CmpCreateRegistryRoot(), CmpLinkHiveToMaster(), CmpSaveBootControlSet(), ExCreateCallback(), ExpCreateWorkerThread(), InitializeMediaChange(), InitializePowerRequestList(), IoAttachDevice(), IoCreateDriver(), IoCreateNotificationEvent(), IoCreateSynchronizationEvent(), IoGetDeviceObjectPointer(), IoInitSystem(), IopCompleteDumpInitialization(), IopConfigureCrashDump(), IopConnectLinkTrackingPort(), IopGetDumpStack(), IopInitializeBuiltinDriver(), IopLoadDriver(), IopMarkBootPartition(), IopOpenLinkOrRenameTarget(), IopReferenceDriverObjectByName(), IopSetEaOrQuotaInformationFile(), IopTrackLink(), IopXxxControlFile(), MiLoadSystemImage(), MmCreateSection(), MmGetFileNameForSection(), MmSetBankedSection(), NtAcceptConnectPort(), NtAdjustGroupsToken(), NtAdjustPrivilegesToken(), NtAlertResumeThread(), NtAlertThread(), NtAllocateUserPhysicalPages(), NtAllocateVirtualMemory(), NtAssignProcessToJobObject(), NtCancelIoFile(), NtCancelTimer(), NtClearEvent(), NtCreateKey(), NtCreatePagingFile(), NtCreateProfile(), NtCreateSuperSection(), NtDeleteKey(), NtDeleteValueKey(), NtDuplicateObject(), NtDuplicateToken(), NtEnumerateKey(), NtEnumerateValueKey(), NtExtendSection(), NtFilterToken(), NtFlushBuffersFile(), NtFlushInstructionCache(), NtFlushKey(), NtFlushVirtualMemory(), NtFreeUserPhysicalPages(), NtFreeVirtualMemory(), NtGetContextThread(), NtImpersonateAnonymousToken(), NtImpersonateThread(), NtListenChannel(), NtLockFile(), NtLockVirtualMemory(), NtMakeTemporaryObject(), NtMapViewOfSection(), NtMapViewOfSuperSection(), NtNotifyChangeDirectoryFile(), NtNotifyChangeMultipleKeys(), NtOpenKey(), NtOpenObjectAuditAlarm(), NtOpenThreadToken(), NtPrivilegeCheck(), NtPrivilegedServiceAuditAlarm(), NtPrivilegeObjectAuditAlarm(), NtProtectVirtualMemory(), NtPulseEvent(), NtQueryDirectoryObject(), NtQueryEaFile(), NtQueryEvent(), NtQueryInformationFile(), NtQueryInformationJobObject(), NtQueryInformationPort(), NtQueryInformationProcess(), NtQueryInformationThread(), NtQueryInformationToken(), NtQueryIoCompletion(), NtQueryKey(), NtQueryMultipleValueKey(), NtQueryMutant(), NtQueryObject(), NtQueryOpenSubKeys(), NtQueryQuotaInformationFile(), NtQuerySection(), NtQuerySecurityObject(), NtQuerySemaphore(), NtQuerySymbolicLinkObject(), NtQueryTimer(), NtQueryValueKey(), NtQueryVirtualMemory(), NtQueryVolumeInformationFile(), NtQueueApcThread(), NtReadFile(), NtReadFileScatter(), NtReadVirtualMemory(), NtRegisterThreadTerminatePort(), NtReleaseMutant(), NtReleaseSemaphore(), NtRemoveIoCompletion(), NtReplaceKey(), NtReplyWaitReceivePort(), NtReplyWaitReceivePortEx(), NtResetEvent(), NtRestoreKey(), NtResumeThread(), NtSaveKey(), NtSaveMergedKeys(), NtSecureConnectPort(), NtSendWaitReplyChannel(), NtSetContextThread(), NtSetDefaultHardErrorPort(), NtSetEaFile(), NtSetEvent(), NtSetHighEventPair(), NtSetHighWaitLowEventPair(), NtSetInformationFile(), NtSetInformationJobObject(), NtSetInformationKey(), NtSetInformationProcess(), NtSetInformationThread(), NtSetInformationToken(), NtSetIoCompletion(), NtSetLowEventPair(), NtSetLowWaitHighEventPair(), NtSetSecurityObject(), NtSetSystemInformation(), NtSetTimer(), NtSetValueKey(), NtSetVolumeInformationFile(), NtSignalAndWaitForSingleObject(), NtStartProfile(), NtStopProfile(), NtSuspendThread(), NtTerminateJobObject(), NtTerminateProcess(), NtTerminateThread(), NtUnloadDriver(), NtUnloadKey(), NtUnlockFile(), NtUnlockVirtualMemory(), NtUnmapViewOfSection(), NtUserGetGuiResources(), NtUserProcessConnect(), NtUserUserHandleGrantAccess(), NtWaitForSingleObject(), NtWaitHighEventPair(), NtWaitLowEventPair(), NtWriteFile(), NtWriteFileGather(), NtWriteVirtualMemory(), ObInitSystem(), ObpLookupObjectName(), ObSetDeviceMap(), obtest(), ObWaitForSingleObject(), OpenCacheKeyEx(), PsAssignImpersonationToken(), PsLocateSystemDll(), PsOpenTokenOfJobObject(), PsOpenTokenOfProcess(), PsOpenTokenOfThread(), PspAssignPrimaryToken(), PspCreateProcess(), PspCreateThread(), PspInitPhase0(), PspQueryPooledQuotaLimits(), PspQueryQuotaLimits(), PspQueryWorkingSetWatch(), PspSetPrimaryToken(), PspSetQuotaLimits(), RawInputThread(), ReferenceWindowStation(), RegisterForDeviceChangeNotifications(), RemoteConnect(), SeAccessCheckByType(), SeFilterToken(), SeIsChildToken(), SepAccessCheckAndAuditAlarm(), SepOpenTokenOfThread(), SetInformationProcess(), SmbTraceToClient(), UdfInvalidateVolumes(), ValidateHdesk(), ValidateHwinsta(), VdmpDelayInterrupt(), VdmpQueueInterrupt(), VdmpQueueIntNormalRoutine(), VdmQueryDirectoryFile(), WaitOnPseudoEvent(), xxxCloseDesktop(), xxxConsoleControl(), xxxCreateDesktop(), xxxCreateDisconnectDesktop(), xxxCreateThreadInfo(), xxxCreateWindowStation(), xxxGetThreadDesktop(), xxxHardErrorControl(), xxxInitTerminal(), xxxOpenDesktop(), xxxQueryInformationThread(), xxxRegisterUserHungAppHandlers(), xxxResolveDesktop(), xxxSetInformationThread(), xxxSetProcessWindowStation(), and zzzSetDesktop(). 

00553                    :
00554 
00555     Given a handle to an object this routine returns a pointer
00556     to the body of the object with proper ref counts
00557 
00558 Arguments:
00559 
00560     Handle - Supplies a handle to the object being referenced.  It can
00561         also be the result of NtCurrentProcess or NtCurrentThread
00562 
00563     DesiredAccess - Supplies the access being requested by the caller
00564 
00565     ObjectType - Optionally supplies the type of the object we
00566         are expecting
00567 
00568     AccessMode - Supplies the processor mode of the access
00569 
00570     Object - Receives a pointer to the object body if the operation
00571         is successful
00572 
00573     HandleInformation - Optionally receives information regarding the
00574         input handle.
00575 
00576 Return Value:
00577 
00578     An appropriate NTSTATUS value
00579 
00580 --*/
00581 
00582 {
00583     ACCESS_MASK GrantedAccess;
00584     PHANDLE_TABLE HandleTable;
00585     POBJECT_HEADER ObjectHeader;
00586     PHANDLE_TABLE_ENTRY ObjectTableEntry;
00587     PEPROCESS Process;
00588     NTSTATUS Status;
00589     PETHREAD Thread;
00590     BOOLEAN AttachedToProcess = FALSE;
00591 
00592     ObpValidateIrql("ObReferenceObjectByHandle");
00593 
00594     //
00595     //  Protect ourselves from being interrupted while we hold a handle table
00596     //  entry lock
00597     //
00598 
00599     KeEnterCriticalRegion();
00600 
00601     try {
00602 
00603         //
00604         //  If the handle is equal to the current process handle and the object
00605         //  type is NULL or type process, then attempt to translate a handle to
00606         //  the current process. Otherwise, check if the handle is the current
00607         //  thread handle.
00608         //
00609 
00610         if (Handle == NtCurrentProcess()) {
00611 
00612             if ((ObjectType == PsProcessType) || (ObjectType == NULL)) {
00613 
00614                 Process = PsGetCurrentProcess();
00615                 GrantedAccess = Process->GrantedAccess;
00616 
00617                 if ((SeComputeDeniedAccesses(GrantedAccess, DesiredAccess) == 0) ||
00618                     (AccessMode == KernelMode)) {
00619 
00620                     ObjectHeader = OBJECT_TO_OBJECT_HEADER(Process);
00621 
00622                     if (ARGUMENT_PRESENT(HandleInformation)) {
00623 
00624                         HandleInformation->GrantedAccess = GrantedAccess;
00625                         HandleInformation->HandleAttributes = 0;
00626                     }
00627 
00628                     ObpIncrPointerCount(ObjectHeader);
00629                     *Object = Process;
00630 
00631                     ASSERT( *Object != NULL );
00632 
00633                     Status = STATUS_SUCCESS;
00634                     leave;
00635 
00636                 } else {
00637 
00638                     Status = STATUS_ACCESS_DENIED;
00639                 }
00640 
00641             } else {
00642 
00643                 Status = STATUS_OBJECT_TYPE_MISMATCH;
00644             }
00645 
00646         //
00647         //  If the handle is equal to the current thread handle and the object
00648         //  type is NULL or type thread, then attempt to translate a handle to
00649         //  the current thread. Otherwise, the we'll try and translate the
00650         //  handle
00651         //
00652 
00653         } else if (Handle == NtCurrentThread()) {
00654 
00655             if ((ObjectType == PsThreadType) || (ObjectType == NULL)) {
00656 
00657                 Thread = PsGetCurrentThread();
00658                 GrantedAccess = Thread->GrantedAccess;
00659 
00660                 if ((SeComputeDeniedAccesses(GrantedAccess, DesiredAccess) == 0) ||
00661                     (AccessMode == KernelMode)) {
00662 
00663                     ObjectHeader = OBJECT_TO_OBJECT_HEADER(Thread);
00664 
00665                     if (ARGUMENT_PRESENT(HandleInformation)) {
00666 
00667                         HandleInformation->GrantedAccess = GrantedAccess;
00668                         HandleInformation->HandleAttributes = 0;
00669                     }
00670 
00671                     ObpIncrPointerCount(ObjectHeader);
00672                     *Object = Thread;
00673 
00674                     ASSERT( *Object != NULL );
00675 
00676                     Status = STATUS_SUCCESS;
00677                     leave;
00678 
00679                 } else {
00680 
00681                     Status = STATUS_ACCESS_DENIED;
00682                 }
00683 
00684             } else {
00685 
00686                 Status = STATUS_OBJECT_TYPE_MISMATCH;
00687             }
00688 
00689         //
00690         //  Otherwise the handle is not a built in value.  It must be an index
00691         //  into a handle table.
00692         //
00693 
00694         } else {
00695 
00696     #if DBG
00697             //
00698             //  On checked builds, check that if the Kernel handle bit is set,
00699             //  then we're coming from Kernel mode. We should probably fail the
00700             //  call if bit set && !Kmode
00701             //
00702             //  We know we're NOT a builtin handle at this point
00703             //
00704 
00705             ASSERT((Handle < 0) ? (AccessMode == KernelMode) : TRUE);
00706     #endif
00707 
00708             //
00709             //  First get a pointer to either the processes handle table or the
00710             //  global kernel handle table.  If it is the kernel handle then we
00711             //  need to clear the handle bit and attach to the system process
00712             //
00713 
00714             if (IsKernelHandle( Handle, AccessMode )) {
00715 
00716                 //
00717                 //  Make the handle look like a regular handle
00718                 //
00719 
00720                 Handle = DecodeKernelHandle( Handle );
00721 
00722                 //
00723                 //  The global kernel handle table
00724                 //
00725 
00726                 HandleTable = ObpKernelHandleTable;
00727 
00728             } else {
00729 
00730                 HandleTable = ObpGetObjectTable();
00731             }
00732 
00733             ASSERT(HandleTable != NULL);
00734 
00735             //
00736             //  Translate the specified handle to an object table index.
00737             //
00738 
00739             ObjectTableEntry = ExMapHandleToPointer( HandleTable, Handle );
00740 
00741             //
00742             //  Make sure the object table entry really does exist
00743             //
00744 
00745             if (ObjectTableEntry != NULL) {
00746 
00747                 ObjectHeader = (POBJECT_HEADER)(((ULONG_PTR)(ObjectTableEntry->Object)) & ~OBJ_HANDLE_ATTRIBUTES);
00748 
00749                 if ((ObjectHeader->Type == ObjectType) || (ObjectType == NULL)) {
00750 
00751     #if i386 && !FPO
00752                     if (NtGlobalFlag & FLG_KERNEL_STACK_TRACE_DB) {
00753 
00754                         if ((AccessMode != KernelMode) || ARGUMENT_PRESENT(HandleInformation)) {
00755 
00756                             GrantedAccess = ObpTranslateGrantedAccessIndex( ObjectTableEntry->GrantedAccessIndex );
00757                         }
00758 
00759                     } else {
00760 
00761                         GrantedAccess = ObjectTableEntry->GrantedAccess;
00762                     }
00763     #else
00764                     GrantedAccess = ObjectTableEntry->GrantedAccess;
00765 
00766     #endif // i386 && !FPO
00767 
00768                     if ((SeComputeDeniedAccesses(GrantedAccess, DesiredAccess) == 0) ||
00769                         (AccessMode == KernelMode)) {
00770 
00771                         //
00772                         //  Access to the object is allowed. Return the handle
00773                         //  information is requested, increment the object
00774                         //  pointer count, unlock the handle table and return
00775                         //  a success status.
00776                         //
00777                         //  Note that this is the only successful return path
00778                         //  out of this routine if the user did not specify
00779                         //  the current process or current thread in the input
00780                         //  handle.
00781                         //
00782 
00783                         if (ARGUMENT_PRESENT(HandleInformation)) {
00784 
00785                             HandleInformation->GrantedAccess = GrantedAccess;
00786                             HandleInformation->HandleAttributes = ObjectTableEntry->ObAttributes & OBJ_HANDLE_ATTRIBUTES;
00787                         }
00788 
00789                         ObpIncrPointerCount(ObjectHeader);
00790                         *Object = &ObjectHeader->Body;
00791 
00792                         ASSERT( *Object != NULL );
00793 
00794                         ExUnlockHandleTableEntry( HandleTable, ObjectTableEntry );
00795 
00796                         Status = STATUS_SUCCESS;
00797                         leave;
00798 
00799                     } else {
00800 
00801                         Status = STATUS_ACCESS_DENIED;
00802                     }
00803 
00804                 } else {
00805 
00806                     Status = STATUS_OBJECT_TYPE_MISMATCH;
00807                 }
00808 
00809                 ExUnlockHandleTableEntry( HandleTable, ObjectTableEntry );
00810 
00811             } else {
00812 
00813                 Status = STATUS_INVALID_HANDLE;
00814             }
00815         }
00816 
00817         //
00818         //  If we are attached to the system process then return
00819         //  back to our caller
00820         //
00821 
00822         if (AttachedToProcess) {
00823 
00824             KeDetachProcess();
00825         }
00826 
00827         //
00828         //  No handle translation is possible. Set the object address to NULL
00829         //  and return an error status.
00830         //
00831 
00832         *Object = NULL;
00833 
00834     } finally {
00835 
00836         KeLeaveCriticalRegion();
00837     }
00838 
00839     return Status;
00840 }

NTSTATUS ObReferenceObjectByName (  IN PUNICODE_STRING  ObjectName,
IN ULONG  Attributes,
IN PACCESS_STATE PassedAccessState  OPTIONAL,
IN ACCESS_MASK DesiredAccess  OPTIONAL,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode,
IN OUT PVOID ParseContext  OPTIONAL,
OUT PVOID *  Object
) 
 

NTKERNELAPI NTSTATUS ObReferenceObjectByPointer (  IN PVOID  Object,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode
) 
 

Definition at line 1022 of file obref.c.

References KernelMode, OBJECT_TO_OBJECT_HEADER, ObpIncrPointerCount, ObpSymbolicLinkObjectType, and _OBJECT_HEADER::Type.

Referenced by IoRegisterPlugPlayNotification(), NtImpersonateAnonymousToken(), ObOpenObjectByPointer(), ObpLookupObjectName(), ObpParseSymbolicLink(), obtest(), ParseAProc(), RawInputThread(), VdmpDelayInterrupt(), xxxDesktopThread(), and xxxSetCsrssThreadDesktop(). 

01031                    :
01032 
01033     This routine adds another reference count to an object denoted by
01034     a pointer to the object body
01035 
01036 Arguments:
01037 
01038     Object - Supplies a pointer to the object being referenced
01039 
01040     DesiredAccess - Specifies the desired access for the reference
01041 
01042     ObjectType - Specifies the object type according to the caller
01043 
01044     AccessMode - Supplies the processor mode of the access
01045 
01046 Return Value:
01047 
01048     STATUS_SUCCESS if successful and STATUS_OBJECT_TYPE_MISMATCH otherwise
01049 
01050 --*/
01051 
01052 {
01053     POBJECT_HEADER ObjectHeader;
01054 
01055     //
01056     //  Translate the pointer to the object body to a pointer to the
01057     //  object header
01058     //
01059 
01060     ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
01061 
01062     //
01063     //  If the specified object type does not match and either the caller is
01064     //  not kernel mode or it is not a symbolic link object then it is an
01065     //  error
01066     //
01067 
01068     if ((ObjectHeader->Type != ObjectType) && (AccessMode != KernelMode ||
01069                                                ObjectType == ObpSymbolicLinkObjectType)) {
01070 
01071         return( STATUS_OBJECT_TYPE_MISMATCH );
01072     }
01073 
01074     //
01075     //  Otherwise increment the pointer count and return success to
01076     //  our caller
01077     //
01078 
01079     ObpIncrPointerCount( ObjectHeader );
01080 
01081     return( STATUS_SUCCESS );
01082 }

VOID ObReleaseObjectSecurity (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor,
IN BOOLEAN  MemoryAllocated
) 
 

Definition at line 1418 of file obse.c.

References ExFreePool(), NULL, ObpDereferenceSecurityDescriptor(), and PAGED_CODE.

Referenced by ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObInsertObject(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), ObpProcessDosDeviceSymbolicLink(), PspCreateProcess(), PspCreateThread(), and PspSetPrimaryToken(). 

01425                    :
01426 
01427     This function will free up any memory associated with a queried
01428     security descriptor.  This undoes the function ObGetObjectSecurity
01429 
01430 Arguments:
01431 
01432     SecurityDescriptor - Supplies a pointer to the security descriptor
01433         to be freed.
01434 
01435     MemoryAllocated - Supplies whether or not we should free the
01436         memory pointed to by SecurityDescriptor.
01437 
01438 Return Value:
01439 
01440     None.
01441 
01442 --*/
01443 
01444 {
01445     PAGED_CODE();
01446 
01447     //
01448     //  Check if there is a security descriptor to actually free
01449     //
01450 
01451     if ( SecurityDescriptor != NULL ) {
01452 
01453         //
01454         //  If ObGetObjectSecurity allocated memory then we
01455         //  need to free it. Otherwise what the earlier routine did
01456         //  was reference the object to keep the security descriptor
01457         //  to keep it from going away
01458         //
01459 
01460         if (MemoryAllocated) {
01461 
01462             ExFreePool( SecurityDescriptor );
01463 
01464         } else {
01465 
01466             ObpDereferenceSecurityDescriptor( SecurityDescriptor );
01467         }
01468     }
01469 }

NTSTATUS ObSetDeviceMap (  IN PEPROCESS  TargetProcess,
IN HANDLE  DirectoryHandle
) 
 

Definition at line 30 of file obdevmap.c.

References _OBJECT_DIRECTORY::DeviceMap, _EPROCESS::DeviceMap, DirectoryHandle, ExAllocatePoolWithTag, Handle, NonPagedPool, NT_SUCCESS, NTSTATUS(), NULL, ObDereferenceDeviceMap(), ObDereferenceObject, ObpDeviceMapLock, ObpDirectoryObjectType, ObReferenceObjectByHandle(), ObSystemDeviceMap, PAGED_CODE, PsGetCurrentProcess, _DEVICE_MAP::ReferenceCount, and Status.

Referenced by NtSetInformationProcess(), and ObpCreateDosDevicesDirectory(). 

00037                    :
00038 
00039     This function sets the device map for the specified process, using
00040     the specified object directory.  A device map is a structure
00041     associated with an object directory and a process.  When the object
00042     manager sees a references to a name beginning with \??\ or just \??,
00043     then it follows the device map object in the calling process's
00044     EPROCESS structure to get to the object directory to use for that
00045     reference.  This allows multiple virtual \??  object directories on
00046     a per process basis.  The WindowStation logic will use this
00047     functionality to allocate devices unique to each WindowStation.
00048 
00049 Arguments:
00050 
00051     TargetProcess - Specifies the target process to associate the device map
00052         with.  If null then the current process is used and the directory
00053         becomes the system default dos device map.
00054 
00055     DirectoryHandle - Specifies the object directory to associate with the
00056         device map.
00057 
00058 
00059 Return Value:
00060 
00061     Returns one of the following status codes:
00062 
00063         STATUS_SUCCESS - normal, successful completion.
00064 
00065         STATUS_SHARING_VIOLATION - The specified object directory is already
00066             associated with a device map.
00067 
00068         STATUS_INSUFFICIENT_RESOURCES - Unable to allocate pool for the device
00069             map data structure;
00070 
00071         STATUS_ACCESS_DENIED - Caller did not have DIRECTORY_TRAVERSE access
00072             to the specified object directory.
00073 
00074 --*/
00075 
00076 {
00077     NTSTATUS Status;
00078     POBJECT_DIRECTORY DosDevicesDirectory;
00079     PDEVICE_MAP DeviceMap;
00080     PVOID Object;
00081     HANDLE Handle;
00082     KIRQL OldIrql;
00083 
00084     PAGED_CODE();
00085 
00086     //
00087     //  Reference the object directory handle and see if it is already
00088     //  associated with a device map structure.  If so, fail this call.
00089     //
00090 
00091     Status = ObReferenceObjectByHandle( DirectoryHandle,
00092                                         DIRECTORY_TRAVERSE,
00093                                         ObpDirectoryObjectType,
00094                                         KeGetPreviousMode(),
00095                                         &DosDevicesDirectory,
00096                                         NULL );
00097 
00098     if (!NT_SUCCESS( Status )) {
00099 
00100         return( Status );
00101     }
00102 
00103     //
00104     //  Capture the device map
00105     //
00106     
00107     ExAcquireSpinLock( &ObpDeviceMapLock, &OldIrql );
00108     
00109     DeviceMap = DosDevicesDirectory->DeviceMap;
00110     
00111     //
00112     //  Check if the directory already has a dos device map
00113     //
00114     
00115     if (DeviceMap != NULL) {
00116         
00117         //
00118         //  Test if the DeviceMap is about to delete and has the
00119         //  ReferenceCount 0
00120         //
00121     
00122         if (DeviceMap->ReferenceCount != 0) {
00123         
00124             //
00125             //  We have a dos device map, so setup the target process to be either
00126             //  what the caller specified or the current process
00127             //
00128 
00129             PEPROCESS Target = TargetProcess;
00130 
00131             if (Target == NULL) {
00132 
00133                 Target = PsGetCurrentProcess();
00134             }
00135 
00136             //
00137             //  If the current process already has the exact same dos device map
00138             //  then everything is already done and nothing left for us to do.
00139             //
00140 
00141             if (Target->DeviceMap == DeviceMap) {
00142 
00143                 ExReleaseSpinLock( &ObpDeviceMapLock, OldIrql );
00144                 
00145                 ObDereferenceObject( DosDevicesDirectory );
00146 
00147                 return Status;
00148             }
00149 
00150             //
00151             //  Add a new reference before releasing the spinlock
00152             //  to make sure nobody will release the devicemap while
00153             //  we try to attach to the process.
00154             //
00155             
00156             DeviceMap->ReferenceCount++;
00157 
00158             ExReleaseSpinLock( &ObpDeviceMapLock, OldIrql );
00159         
00160             //
00161             //  We can dereference the target processes device map because it
00162             //  no longer will have it's old dos device map.
00163             //
00164 
00165             ObDereferenceDeviceMap ( Target );
00166 
00167             //
00168             //  Now setup the new device map that we were feed in.  We lock it
00169             //  bump its ref count, make the targe process point to it, unlock it,
00170             //  and return to our caller
00171             //
00172 
00173             ExAcquireSpinLock( &ObpDeviceMapLock, &OldIrql );
00174 
00175             Target->DeviceMap = DeviceMap;
00176 
00177             ExReleaseSpinLock( &ObpDeviceMapLock, OldIrql );
00178 
00179             ObDereferenceObject( DosDevicesDirectory );
00180 
00181             return Status;
00182         }
00183     }
00184 
00185     ExReleaseSpinLock( &ObpDeviceMapLock, OldIrql );
00186     
00187     //
00188     //  The input directory does not have a dos device map. so we'll
00189     //  allocate and initialize a new device map structure.
00190     //
00191 
00192     DeviceMap = ExAllocatePoolWithTag( NonPagedPool, sizeof( *DeviceMap ), 'mDbO' );
00193 
00194     if (DeviceMap == NULL) {
00195 
00196         ObDereferenceObject( DosDevicesDirectory );
00197         Status = STATUS_INSUFFICIENT_RESOURCES;
00198 
00199     } else {
00200 
00201         RtlZeroMemory( DeviceMap, sizeof( *DeviceMap ) );
00202 
00203         DeviceMap->ReferenceCount = 1;
00204         DeviceMap->DosDevicesDirectory = DosDevicesDirectory;
00205 
00206         DosDevicesDirectory->DeviceMap = DeviceMap;
00207 
00208         //
00209         //  If the caller specified a target process then remove the
00210         //  processes device map if in use and replace it with the new
00211         //  one, otherwise set this new device map to the system wide one
00212         //  and put it into the current process
00213         //
00214 
00215         if (TargetProcess != NULL) {
00216 
00217             ObDereferenceDeviceMap ( TargetProcess );
00218 
00219             TargetProcess->DeviceMap = DeviceMap;
00220 
00221         } else {
00222 
00223             ObSystemDeviceMap = DeviceMap;
00224 
00225             ObDereferenceDeviceMap ( PsGetCurrentProcess() );
00226 
00227             PsGetCurrentProcess()->DeviceMap = DeviceMap;
00228         }
00229     }
00230 
00231     return( Status );
00232 }

NTSTATUS ObSetSecurityObjectByPointer (  IN PVOID  Object,
IN SECURITY_INFORMATION  SecurityInformation,
IN PSECURITY_DESCRIPTOR  SecurityDescriptor
) 
 

Definition at line 174 of file obse.c.

References ASSERT, _OBJECT_TYPE_INITIALIZER::GenericMapping, NTSTATUS(), NULL, OBJECT_TO_OBJECT_HEADER, PAGED_CODE, _OBJECT_TYPE_INITIALIZER::PoolType, _OBJECT_HEADER::SecurityDescriptor, _OBJECT_TYPE_INITIALIZER::SecurityProcedure, SetSecurityDescriptor, Status, _OBJECT_HEADER::Type, and _OBJECT_TYPE::TypeInfo.

Referenced by IopChangeDeviceObjectFromRegistryProperties(), IopSetSecurityObjectFromRegistry(), and NtSetSecurityObject(). 

00182                    :
00183 
00184     This routine is used to invoke an object's security routine.  It
00185     is used to set the object's security state.
00186 
00187     This routine is accessible only to the kernel and assumes that all
00188     necessary validation of parameters has been done by the caller.
00189 
00190 Arguments:
00191 
00192     Object - Supplies the pointer for the object being modified
00193 
00194     SecurityInformation - Indicates the type of information we are
00195         interested in setting. e.g., owner, group, dacl, or sacl.
00196 
00197     SecurityDescriptor - Supplies the security descriptor for the
00198         object being modified.
00199 
00200 Return Value:
00201 
00202     An appropriate NTSTATUS value
00203 
00204 --*/
00205 
00206 {
00207     NTSTATUS Status;
00208     POBJECT_HEADER ObjectHeader;
00209     POBJECT_TYPE ObjectType;
00210 
00211     PAGED_CODE();
00212 
00213 //    DbgPrint("ObSetSecurityObjectByPointer called for object %#08lx with info "
00214 //             "%x and descriptor %#08lx\n",
00215 //             Object, SecurityInformation, SecurityDescriptor);
00216 
00217     //
00218     //  Map the object body to an object header and the corresponding
00219     //  object type
00220     //
00221 
00222     ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
00223     ObjectType = ObjectHeader->Type;
00224 
00225     //
00226     //  Make sure the passed security descriptor is really there.
00227     //
00228 
00229     ASSERT(ARGUMENT_PRESENT( SecurityDescriptor ));
00230 
00231     //
00232     //  Now invoke the security procedure call back to set the security
00233     //  descriptor for the object
00234     //
00235 
00236     Status = (ObjectType->TypeInfo.SecurityProcedure)
00237                 ( Object,
00238                   SetSecurityDescriptor,
00239                   &SecurityInformation,
00240                   SecurityDescriptor,
00241                   NULL,
00242                   &ObjectHeader->SecurityDescriptor,
00243                   ObjectType->TypeInfo.PoolType,
00244                   &ObjectType->TypeInfo.GenericMapping );
00245 
00246 
00247 //    DbgPrint("ObSetSecurityObjectByPointer: object security routine returned "
00248 //             "%#08lx\n", Status);
00249 
00250     return( Status );
00251 }

NTSTATUS ObValidateSecurityQuota (  IN PVOID  Object,
IN ULONG  NewSize
) 
 

Definition at line 1473 of file obse.c.

References _OBJECT_HEADER::Flags, NULL, OB_FLAG_DEFAULT_SECURITY_QUOTA, OBJECT_HEADER_TO_QUOTA_INFO, OBJECT_TO_OBJECT_HEADER, PAGED_CODE, SE_DEFAULT_SECURITY_QUOTA, and _OBJECT_HEADER_QUOTA_INFO::SecurityDescriptorCharge.

Referenced by RtlpSetSecurityObject(). 

01480                    :
01481 
01482     This routine will check to see if the new security information
01483     is larger than is allowed by the object's pre-allocated quota.
01484 
01485 Arguments:
01486 
01487     Object - Supplies a pointer to the object whose information is to be
01488         modified.
01489 
01490     NewSize - Supplies the size of the proposed new security
01491         information.
01492 
01493 Return Value:
01494 
01495     STATUS_SUCCESS - New size is within alloted quota.
01496 
01497     STATUS_QUOTA_EXCEEDED - The desired adjustment would have exceeded
01498         the permitted security quota for this object.
01499 
01500 --*/
01501 
01502 {
01503     POBJECT_HEADER ObjectHeader;
01504     POBJECT_HEADER_QUOTA_INFO QuotaInfo;
01505 
01506     PAGED_CODE();
01507 
01508     //
01509     //  Map the object body to its object header and corresponding
01510     //  quota information block
01511     //
01512 
01513     ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
01514     QuotaInfo = OBJECT_HEADER_TO_QUOTA_INFO( ObjectHeader );
01515 
01516     //
01517     //  If there isn't any quota info and the new size is greater
01518     //  then the default security quota then if the object uses
01519     //  the default value then we've exceeded quota otherwise
01520     //  let the caller get the quota
01521     //
01522 
01523     if ((QuotaInfo == NULL) && (NewSize > SE_DEFAULT_SECURITY_QUOTA)) {
01524 
01525         if (!(ObjectHeader->Flags & OB_FLAG_DEFAULT_SECURITY_QUOTA)) {
01526 
01527             //
01528             //  Should really charge quota here.
01529             //
01530 
01531             return( STATUS_SUCCESS );
01532         }
01533 
01534         return( STATUS_QUOTA_EXCEEDED );
01535 
01536     //
01537     //  If the quota is not null and the new size is greater than the
01538     //  allowed quota charge then if the charge is zero we grant the
01539     //  request otherwise we've exceeded quota.
01540     //
01541     //  **** this logic seems wierd
01542     //
01543 
01544     } else if ((QuotaInfo != NULL) && (NewSize > QuotaInfo->SecurityDescriptorCharge)) {
01545 
01546         if (QuotaInfo->SecurityDescriptorCharge == 0) {
01547 
01548             //
01549             //  Should really charge quota here.
01550             //
01551 
01552             //  QuotaInfo->SecurityDescriptorCharge = SeComputeSecurityQuota( NewSize );
01553 
01554             return( STATUS_SUCCESS );
01555         }
01556 
01557         return( STATUS_QUOTA_EXCEEDED );
01558 
01559     //
01560     //  Otherwise we have two cases.  (1) there isn't any quota info but
01561     //  the size is within limits or (2) there is a quota info block and
01562     //  the size is within the specified security descriptor charge so
01563     //  return success to our caller
01564     //
01565 
01566     } else {
01567 
01568         return( STATUS_SUCCESS );
01569     }
01570 }

NTSTATUS ObWaitForSingleObject (  IN HANDLE  Handle,
IN BOOLEAN  Alertable,
IN PLARGE_INTEGER Timeout  OPTIONAL
) 
 

Definition at line 837 of file obwait.c.

References _OBJECT_TYPE::DefaultObject, EXCEPTION_EXECUTE_HANDLER, FALSE, Handle, KernelMode, KeWaitForSingleObject(), NT_SUCCESS, NTSTATUS(), NULL, ObDereferenceObject, OBJECT_TO_OBJECT_HEADER, ObReferenceObjectByHandle(), PAGED_CODE, Status, _OBJECT_HEADER::Type, and UserRequest. 

00845                    :
00846 
00847     Please refer to NtWaitForSingleObject
00848 
00849 Arguments:
00850 
00851     Handle  - Supplies the handle for the wait object.
00852 
00853     Alertable - Supplies a boolean value that specifies whether the wait
00854         is alertable.
00855 
00856     Timeout - Supplies an pointer to an absolute or relative time over
00857         which the wait is to occur.
00858 
00859 Return Value:
00860 
00861     The wait completion status. A value of STATUS_TIMEOUT is returned if a
00862     timeout occurred.  A value of STATUS_SUCCESS is returned if the specified
00863     object satisfied the wait.  A value of STATUS_ALERTED is returned if the
00864     wait was aborted to deliver an alert to the current thread. A value of
00865     STATUS_USER_APC is returned if the wait was aborted to deliver a user
00866     APC to the current thread.
00867 
00868 --*/
00869 
00870 {
00871     POBJECT_HEADER ObjectHeader;
00872     PVOID Object;
00873     NTSTATUS Status;
00874     PVOID WaitObject;
00875 
00876     PAGED_CODE();
00877 
00878     //
00879     //  Get a referenced pointer to the specified object with synchronize
00880     //  access.
00881     //
00882 
00883     Status = ObReferenceObjectByHandle( Handle,
00884                                         SYNCHRONIZE,
00885                                         (POBJECT_TYPE)NULL,
00886                                         KernelMode,
00887                                         &Object,
00888                                         NULL );
00889 
00890     //
00891     //  If access is granted, then check to determine if the specified object
00892     //  can be waited on.
00893     //
00894 
00895     if (NT_SUCCESS( Status ) != FALSE) {
00896 
00897         ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
00898 
00899         if ((LONG_PTR)ObjectHeader->Type->DefaultObject < 0) {
00900 
00901             WaitObject = (PVOID)ObjectHeader->Type->DefaultObject;
00902 
00903         } else {
00904 
00905             WaitObject = (PVOID)((PCHAR)Object + (ULONG_PTR)ObjectHeader->Type->DefaultObject);
00906         }
00907 
00908         //
00909         //  Protect the wait call just in case KeWait decides
00910         //  to raise For example, a mutant level is exceeded
00911         //
00912 
00913         try {
00914 
00915             Status = KeWaitForSingleObject( WaitObject,
00916                                             UserRequest,
00917                                             KernelMode,
00918                                             Alertable,
00919                                             Timeout );
00920 
00921         } except(EXCEPTION_EXECUTE_HANDLER) {
00922 
00923             Status = GetExceptionCode();
00924         }
00925 
00926         ObDereferenceObject(Object);
00927     }
00928 
00929     return Status;
00930 }
}

Variable Documentation

PDEVICE_MAP ObSystemDeviceMap
 

Definition at line 249 of file ob.h.

Referenced by ObInheritDeviceMap(), ObQueryDeviceMapInformation(), and ObSetDeviceMap().

Generated on Sat May 15 19:44:57 2004 for test by doxygen 1.3.7