tokenadj.c

Go to the documentation of this file.

/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

    tokenadj.c

Abstract:

   This module implements the services that perform individual adjustments
   on token objects.

Author:

    Jim Kelly (JimK) 15-June-1990

Environment:

    Kernel mode only.

Revision History:

--*/

#include "sep.h"
#include "sertlp.h"
#include "tokenp.h"

#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE,NtAdjustPrivilegesToken)
#pragma alloc_text(PAGE,NtAdjustGroupsToken)
#pragma alloc_text(PAGE,SepAdjustPrivileges)
#pragma alloc_text(PAGE,SepAdjustGroups)
#endif


//                                                                    //
//           Token Object Routines & Methods                          //
//                                                                    //


NTSTATUS
NtAdjustPrivilegesToken (
    IN HANDLE TokenHandle,
    IN BOOLEAN DisableAllPrivileges,
    IN PTOKEN_PRIVILEGES NewState OPTIONAL,
    IN ULONG BufferLength OPTIONAL,
    OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL,
    OUT PULONG ReturnLength
    )


/*++


Routine Description:

    This routine is used to disable or enable privileges in the
    specified token.  The absence of some of the privileges listed to
    be changed won't effect the successful modification of the
    privileges that are in the token.  The previous enabled/disabled
    state of changed privileges may optionally be capture (for
    resetting later).

    TOKEN_ADJUST_PRIVILEGES access is required to enable or disable
    privileges in a token.


Arguments:

    TokenHandle - Provides a handle to the token to operate on.

    DisableAllPrivileges - This boolean parameter may be
        used to disable all privileges assigned to the token.  If
        this parameter is specified as TRUE, then the NewState parameter is
        ignored.

    NewState - This (optional) parameter points to a TOKEN_PRIVILEGES
        data structure containing the privileges whose states are to
        be adjusted (disabled or enabled).  Only the Enabled flag of
        the attributes associated with each privilege is used.  It
        provides the new value that is to be assigned to the
        privilege in the token.

    BufferLength - This optional parameter indicates the length (in
        bytes) of the PreviousState buffer.  This value must be
        provided if the PreviousState parameter is provided.

    PreviousState - This (optional) parameter points to a buffer to
        receive the state of any privileges actually changed by this
        request.  This information is formated as a TOKEN_PRIVILEGES
        data structure which may be passed as the NewState parameter
        in a subsequent call to this routine to restore the original
        state of those privilges.  TOKEN_QUERY access is needed to
        use this parameter.

        If this buffer does not contain enough space to receive the
        complete list of modified privileges, then no privilege
        states are changed and STATUS_BUFFER_TOO_SMALL is returned.
        In this case, the ReturnLength OUT parameter will
        contain the actual number of bytes needed to hold the
        information.

    ReturnLength - Indicates the actual number of bytes needed to
        contain the previous privilege state information.
        This parameter is ignored if the PreviousState argument is not
        passed.

Return Value:

    STATUS_SUCCESS - The service successfully completed the requested
        operation.

    STATUS_NOT_ALL_ASSIGNED - This NT_SUCCESS severity return status
        indicates that not all the specified privileges are currently
        assigned to the caller.  All specified privileges that are
        currently assigned have been successfully adjusted.

    STATUS_BUFFER_TOO_SMALL - Indicates the optional buffer provided
        to receive the previous states of changed privileges wasn't
        large enough to receive that information.  No changes to
        privilege states has been made.  The number of bytes needed
        to hold the state change information is returned via the
        ReturnLength parameter.

    STATUS_INVALID_PARAMETER - Indicates neither the DisableAllPrivileges
        parameter was specified as true, nor was an explicit NewState
        provided.

--*/

{
    KPROCESSOR_MODE PreviousMode;
    NTSTATUS Status;

    PTOKEN Token;

    ACCESS_MASK DesiredAccess;

    ULONG CapturedPrivilegeCount;
    PLUID_AND_ATTRIBUTES CapturedPrivileges = NULL;
    ULONG CapturedPrivilegesLength;

    ULONG LocalReturnLength;
    ULONG ChangeCount;
    BOOLEAN ChangesMade;

    ULONG ParameterLength;

    PAGED_CODE();

    //
    //  The semantics of the PreviousState parameter leads to a two-pass
    //  approach to adjusting privileges.  The first pass simply checks
    //  to see which privileges will change and counts them.  This allows
    //  the amount of space needed to be calculated and returned.  If
    //  the caller's PreviousState return buffer is not large enough, then
    //  an error is returned without making any modifications.  Otherwise,
    //  a second pass is made to actually make the changes.
    //
    //

    if (!DisableAllPrivileges && !ARGUMENT_PRESENT(NewState)) {
        return STATUS_INVALID_PARAMETER;
    }

    //
    // Get previous processor mode and probe parameters if necessary.
    //

    PreviousMode = KeGetPreviousMode();
    if (PreviousMode != KernelMode) {
        try {

            //
            // Make sure we can see all of the new state
            //

            if (!DisableAllPrivileges) {

                ProbeForRead(
                    NewState,
                    sizeof(TOKEN_PRIVILEGES),
                    sizeof(ULONG)
                    );

                CapturedPrivilegeCount = NewState->PrivilegeCount;
                ParameterLength = (ULONG)sizeof(TOKEN_PRIVILEGES) +
                                  ( (CapturedPrivilegeCount - ANYSIZE_ARRAY) *
                                  (ULONG)sizeof(LUID_AND_ATTRIBUTES)  );

                ProbeForRead(
                    NewState,
                    ParameterLength,
                    sizeof(ULONG)
                    );

            }


            //
            // Check the PreviousState buffer for writeability
            //

            if (ARGUMENT_PRESENT(PreviousState)) {

                ProbeForWrite(
                    PreviousState,
                    BufferLength,
                    sizeof(ULONG)
                    );

                ProbeForWriteUlong(ReturnLength);
            }


        } except(EXCEPTION_EXECUTE_HANDLER) {
            return GetExceptionCode();
        }

    } else {

        if (!DisableAllPrivileges) {

            CapturedPrivilegeCount = NewState->PrivilegeCount;
        }
    }



    //
    // Capture NewState if passed.
    //

    if (!DisableAllPrivileges) {

        try {


            Status = SeCaptureLuidAndAttributesArray(
                         (NewState->Privileges),
                         CapturedPrivilegeCount,
                         PreviousMode,
                         NULL, 0,
                         PagedPool,
                         TRUE,
                         &CapturedPrivileges,
                         &CapturedPrivilegesLength
                         );

        } except(EXCEPTION_EXECUTE_HANDLER) {

            return GetExceptionCode();

        }

        if (!NT_SUCCESS(Status)) {

            return Status;

        }

    }


    //
    // Reference the token object and validate the caller's right
    // to adjust the privileges.
    //

    if (ARGUMENT_PRESENT(PreviousState)) {
        DesiredAccess = (TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY);
    } else {
        DesiredAccess = TOKEN_ADJUST_PRIVILEGES;
    }

    Status = ObReferenceObjectByHandle(
             TokenHandle,             // Handle
             DesiredAccess,           // DesiredAccess
             SepTokenObjectType,      // ObjectType
             PreviousMode,            // AccessMode
             (PVOID *)&Token,         // Object
             NULL                     // GrantedAccess
             );

    if ( !NT_SUCCESS(Status) ) {

        if (CapturedPrivileges != NULL) {
            SeReleaseLuidAndAttributesArray(
                CapturedPrivileges,
                PreviousMode,
                TRUE
                );
        }

        return Status;
    }

    //
    //  Gain exclusive access to the token.
    //

    SepAcquireTokenWriteLock( Token );

    //
    // First pass through the privileges list - just count the changes
    //


    Status = SepAdjustPrivileges(
                Token,
                FALSE,                // Don't make changes this pass
                DisableAllPrivileges,
                CapturedPrivilegeCount,
                CapturedPrivileges,
                PreviousState,
                &LocalReturnLength,
                &ChangeCount,
                &ChangesMade
                );

    if (ARGUMENT_PRESENT(PreviousState)) {

        try {

            (*ReturnLength) = LocalReturnLength;

        } except(EXCEPTION_EXECUTE_HANDLER) {

            SepReleaseTokenWriteLock( Token, FALSE );
            ObDereferenceObject( Token );

            if (CapturedPrivileges != NULL) {
                SeReleaseLuidAndAttributesArray(
                    CapturedPrivileges,
                    PreviousMode,
                    TRUE
                    );
            }

            return GetExceptionCode();
        }

    }


    //
    // Make sure there is enough room to return any  requested
    // information.
    //

    if (ARGUMENT_PRESENT(PreviousState)) {
        if (LocalReturnLength > BufferLength) {

            SepReleaseTokenWriteLock( Token, FALSE );
            ObDereferenceObject( Token );

            if (CapturedPrivileges != NULL) {
                SeReleaseLuidAndAttributesArray(
                    CapturedPrivileges,
                    PreviousMode,
                    TRUE
                    );
            }

            return STATUS_BUFFER_TOO_SMALL;
        }
    }

    //
    // Second pass through the privileges list - Make the changes.
    //
    // Note that the internal routine attempts to write the previous
    // state directly to the caller's buffer - and so may get an exception.
    //

    try {

        Status = SepAdjustPrivileges(
                    Token,
                    TRUE,                 // Make the changes this pass
                    DisableAllPrivileges,
                    CapturedPrivilegeCount,
                    CapturedPrivileges,
                    PreviousState,
                    &LocalReturnLength,
                    &ChangeCount,
                    &ChangesMade
                    );


        if (ARGUMENT_PRESENT(PreviousState)) {

            PreviousState->PrivilegeCount = ChangeCount;
        }

    } except(EXCEPTION_EXECUTE_HANDLER) {

        SepReleaseTokenWriteLock( Token, TRUE );
        ObDereferenceObject( Token );
        if (CapturedPrivileges != NULL) {
            SeReleaseLuidAndAttributesArray(
                CapturedPrivileges,
                PreviousMode,
                TRUE
                );
        }
        return GetExceptionCode();

    }


    SepReleaseTokenWriteLock( Token, ChangesMade );
    ObDereferenceObject( Token );
    if (CapturedPrivileges != NULL) {
        SeReleaseLuidAndAttributesArray(
            CapturedPrivileges,
            PreviousMode,
            TRUE
            );
    }

    return Status;

}


NTSTATUS
NtAdjustGroupsToken (
    IN HANDLE TokenHandle,
    IN BOOLEAN ResetToDefault,
    IN PTOKEN_GROUPS NewState OPTIONAL,
    IN ULONG BufferLength OPTIONAL,
    OUT PTOKEN_GROUPS PreviousState OPTIONAL,
    OUT PULONG ReturnLength
    )

/*++


Routine Description:

    This routine is used to disable or enable groups in the specified
    token.  The absence of some of the groups listed to be changed
    won't effect the successful modification of the groups that are in
    the token.  The previous enabled/disabled state of changed groups
    may optionally be capture (for resetting later).

    TOKEN_ADJUST_GROUPS access is required to enable or disable groups
    in a token

    Note that mandatory groups can not be disabled.  An attempt
    disable any mandatory groups will cause the call to fail, leaving
    the state of all groups unchanged.


Arguments:

    TokenHandle - Provides a handle to the token to operate on.

    ResetToDefault - The parameter indicates whether all the groups
        in the token are to be reset to their default enabled/disabled
        state.

    NewState - This parameter points to a TOKEN_GROUPS data structure
        containing the groups whose states are to be adjusted
        (disabled or enabled).  Only the Enabled flag of the
        attributes associated with each group is used.  It provides
        the new value that is to be assigned to the group in the
        token.  If the ResetToDefault argument is specified as TRUE,
        then this argument is ignored.  Otherwise, it must be passed.

    BufferLength - This optional parameter indicates the length (in
        bytes) of the PreviousState buffer.  This value must be
        provided if the PreviousState parameter is provided.

    PreviousState - This (optional) parameter points to a buffer to
        receive the state of any groups actually changed by this
        request.  This information is formated as a TOKEN_GROUPS data
        structure which may be passed as the NewState parameter in a
        subsequent call to NtAdjustGroups to restore the original state
        of those groups.  TOKEN_QUERY access is needed to use this
        parameter.

        If this buffer does not contain enough space to receive the
        complete list of modified groups, then no group states are
        changed and STATUS_BUFFER_TOO_SMALL is returned.  In this
        case, the ReturnLength return parameter will contain the
        actual number of bytes needed to hold the information.

    ReturnLength - Indicates the actual number of bytes needed to
        contain the previous group state information.
        This parameter is ignored if the PreviousState argument is not
        passed.


Return Value:

    STATUS_SUCCESS - The service successfully completed the requested
        operation.

    STATUS_NOT_ALL_ASSIGNED - This NT_SUCCESS severity return status
        indicates that not all the specified groups are currently
        assigned to the caller.  All specified groups that are
        currently assigned have been successfully adjusted.

    STATUS_CANT_DISABLE_MANDATORY - Indicates an attempt was made to
        disable a mandatory group.  The states of all groups remains
        unchanged.

    STATUS_BUFFER_TOO_SMALL - Indicates the optional buffer provided
        to receive the previous states of changed group wasn't large
        enough to receive that information.  No changes to group
        states has been made.  The number of bytes needed to hold the
        state change information is returned via the ReturnLength
        parameter.

    STATUS_INVALID_PARAMETER - Indicates neither the ResetToDefault
        parameter was specified as true, nor was an explicit NewState
        provided.

--*/
{

    KPROCESSOR_MODE PreviousMode;
    NTSTATUS Status;

    PTOKEN Token;

    ACCESS_MASK DesiredAccess;

    ULONG CapturedGroupCount;
    PSID_AND_ATTRIBUTES CapturedGroups = NULL;
    ULONG CapturedGroupsLength;

    ULONG LocalReturnLength;
    ULONG ChangeCount;
    BOOLEAN ChangesMade;
    PSID SidBuffer;

    PAGED_CODE();

    //
    //  The semantics of the PreviousState parameter and the
    //  STATUS_CANT_DISABLE_MANDATORY completion status leads to a two-pass
    //  approach to adjusting groups.  The first pass simply checks
    //  to see which groups will change and counts them.  This allows
    //  the amount of space needed to be calculated and returned.  If
    //  the caller's PreviousState return buffer is not large enough, or
    //  one of the specified groups is a mandatory group, then an error
    //  is returned without making any modifications.  Otherwise, a second
    //  pass is made to actually make the changes.
    //

    if (!ResetToDefault && !ARGUMENT_PRESENT(NewState)) {
        return STATUS_INVALID_PARAMETER;
    }

    //
    // Get previous processor mode and probe parameters if necessary.
    //

    PreviousMode = KeGetPreviousMode();
    if (PreviousMode != KernelMode) {
        try {

            if (!ResetToDefault) {
                ProbeForRead(
                    NewState,
                    sizeof(TOKEN_GROUPS),
                    sizeof(ULONG)
                    );
            }

            if (ARGUMENT_PRESENT(PreviousState)) {

                ProbeForWrite(
                    PreviousState,
                    BufferLength,
                    sizeof(ULONG)
                    );

                //
                // This parameter is only used if PreviousState
                // is present
                //

                ProbeForWriteUlong(ReturnLength);

            }


        } except(EXCEPTION_EXECUTE_HANDLER) {
            return GetExceptionCode();
        }
    }

    //
    // Capture NewState.
    //

    if (!ResetToDefault) {

        try {

            CapturedGroupCount = NewState->GroupCount;
            Status = SeCaptureSidAndAttributesArray(
                         &(NewState->Groups[0]),
                         CapturedGroupCount,
                         PreviousMode,
                         NULL, 0,
                         PagedPool,
                         TRUE,
                         &CapturedGroups,
                         &CapturedGroupsLength
                         );

            if (!NT_SUCCESS(Status)) {

                return Status;

            }

        } except(EXCEPTION_EXECUTE_HANDLER) {

            return GetExceptionCode();

        } // endtry
    } // endif !ResetToDefault


    //
    // Reference the token object and validate the caller's right
    // to adjust the groups.
    //

    if (ARGUMENT_PRESENT(PreviousState)) {
        DesiredAccess = (TOKEN_ADJUST_GROUPS | TOKEN_QUERY);
    } else {
        DesiredAccess = TOKEN_ADJUST_GROUPS;
    }

    Status = ObReferenceObjectByHandle(
             TokenHandle,             // Handle
             DesiredAccess,           // DesiredAccess
             SepTokenObjectType,      // ObjectType
             PreviousMode,            // AccessMode
             (PVOID *)&Token,         // Object
             NULL                     // GrantedAccess
             );

    if ( !NT_SUCCESS(Status) ) {

        if (ARGUMENT_PRESENT(CapturedGroups)) {
            SeReleaseSidAndAttributesArray( CapturedGroups, PreviousMode, TRUE );
        }

        return Status;
    }

    //
    //  Gain exclusive access to the token.
    //

    SepAcquireTokenWriteLock( Token );

    //
    // First pass through the groups list.
    //
    // This pass is always necessary for groups to make sure the caller
    // isn't trying to do anything illegal to mandatory groups.
    //

    Status = SepAdjustGroups(
                 Token,
                 FALSE,                // Don't make changes this pass
                 ResetToDefault,
                 CapturedGroupCount,
                 CapturedGroups,
                 PreviousState,
                 NULL,                // Not returning SIDs this call
                 &LocalReturnLength,
                 &ChangeCount,
                 &ChangesMade
                 );

    if (ARGUMENT_PRESENT(PreviousState)) {

        try {

            (*ReturnLength) = LocalReturnLength;

        } except(EXCEPTION_EXECUTE_HANDLER) {

            SepReleaseTokenWriteLock( Token, FALSE );
            ObDereferenceObject( Token );

            if (ARGUMENT_PRESENT(CapturedGroups)) {
                SeReleaseSidAndAttributesArray(
                    CapturedGroups,
                    PreviousMode,
                    TRUE
                    );
            }

            return GetExceptionCode();
        }
    }

    //
    // Make sure we didn't encounter an error
    //

    if (!NT_SUCCESS(Status)) {

        SepReleaseTokenWriteLock( Token, FALSE );
        ObDereferenceObject( Token );

        if (ARGUMENT_PRESENT(CapturedGroups)) {
            SeReleaseSidAndAttributesArray(
                CapturedGroups,
                PreviousMode,
                TRUE
                );
        }

        return Status;

    }

    //
    // Make sure there is enough room to return requested information.
    // Also go on to calculate where the SID values go.
    //

    if (ARGUMENT_PRESENT(PreviousState)) {
        if (LocalReturnLength > BufferLength) {

            SepReleaseTokenWriteLock( Token, FALSE );
            ObDereferenceObject( Token );

            if (ARGUMENT_PRESENT(CapturedGroups)) {
                SeReleaseSidAndAttributesArray(
                    CapturedGroups,
                    PreviousMode,
                    TRUE
                    );
            }


            return STATUS_BUFFER_TOO_SMALL;
        }

        //
        // Calculate where the SIDs can be placed in the PreviousState
        // buffer.
        //

        SidBuffer = (PSID)(LongAlignPtr(
                            (PCHAR)PreviousState + (ULONG)sizeof(TOKEN_GROUPS) +
                            (ChangeCount * (ULONG)sizeof(SID_AND_ATTRIBUTES)) -
                            (ANYSIZE_ARRAY * (ULONG)sizeof(SID_AND_ATTRIBUTES))
                            ) );

    }

    //
    // Second pass through the groups list.
    //

    try {

        Status = SepAdjustGroups(
                     Token,
                     TRUE,                 // Make changes in this pass
                     ResetToDefault,
                     CapturedGroupCount,
                     CapturedGroups,
                     PreviousState,
                     SidBuffer,
                     &LocalReturnLength,
                     &ChangeCount,
                     &ChangesMade
                     );

        if (ARGUMENT_PRESENT(PreviousState)) {

            PreviousState->GroupCount = ChangeCount;
        }

    } except(EXCEPTION_EXECUTE_HANDLER) {

        //SepFreeToken( Token, TRUE );
        SepReleaseTokenWriteLock( Token, TRUE );
        ObDereferenceObject( Token );
        if (ARGUMENT_PRESENT(CapturedGroups)) {
            SeReleaseSidAndAttributesArray( CapturedGroups, PreviousMode, TRUE );
        }
        return GetExceptionCode();

    }

    //SepFreeToken( Token, ChangesMade );
    SepReleaseTokenWriteLock( Token, ChangesMade );
    ObDereferenceObject( Token );

    if (ARGUMENT_PRESENT(CapturedGroups)) {
        SeReleaseSidAndAttributesArray( CapturedGroups, PreviousMode, TRUE );
    }

    return Status;

}

NTSTATUS
SepAdjustPrivileges(
    IN PTOKEN Token,
    IN BOOLEAN MakeChanges,
    IN BOOLEAN DisableAllPrivileges,
    IN ULONG PrivilegeCount OPTIONAL,
    IN PLUID_AND_ATTRIBUTES NewState OPTIONAL,
    OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL,
    OUT PULONG ReturnLength,
    OUT PULONG ChangeCount,
    OUT PBOOLEAN ChangesMade
    )

/*++


Routine Description:

    This routine is used to walk the privileges array in a token as a
    result of a request to adjust privileges.

    If the MakeChanges parameter is FALSE, this routine simply determines
    what changes are needed and how much space is necessary to save the
    current state of changed privileges.

    If the MakeChanges parameter is TRUE, this routine will not only
    calculate the space necessary to save the current state, but will
    actually make the changes.

    This routine makes the following assumptions:

      1) The token is locked for exclusive access.

      2) The PrivilegeCount and NewState parameters (if passed) are captured
         and accesses to them will not result in access violations.

      4) Any access violations encountered may leave the request
         partially completed.  It is the calling routine's responsibility
         to catch exceptions.

      5) The calling routine is responsible for inrementing the token's
         ModifiedId field.

Arguments:

    Token - Pointer to the token to act upon.

    MakeChanges - A boolean value indicating whether the changes should
        actually be made, or just evaluated.  A value of TRUE indicates
        the changes should be made.

    DisableAllPrivilegs - A boolean value indicating whether all privileges
        are to be disabled, or only select, specified privileges.  A value
        of TRUE indicates all privileges are to be disabled.

    PrivilegeCount - This parameter is required only if the NewState parameter
        is used.  In that case, this parameter indicates how many entries are
        in the NewState parameter.

    NewState - This parameter is ignored if the DisableAllPrivileges
        argument is TRUE.  If the DisableAllPrivileges argument is FALSE,
        then this parameter must be provided and specifies the new state
        to set privileges to (enabled or disabled).

    PreviousState - This (optional) parameter points to a buffer to
        receive the state of any privileges actually changed by this
        request.  This information is formated as a TOKEN_PRIVILEGES data
        structure which may be passed as the NewState parameter in a
        subsequent call to NtAdjustPrivileges to restore the original state
        of those privileges.  It is the caller's responsibility to make
        sure this buffer is large enough to receive all the state
        information.

    ReturnLength - Points to a buffer to receive the number of bytes needed
        to retrieve the previous state information of changed privileges.
        This parameter is ignored if the PreviousState argument is not
        passed.

    ChangeCount - Points to a ULONG to receive the number of privileges
        which were adjusted (or would be adjusted, if changes are made).

    ChangesMade - Points to a boolean flag which is to receive an indication
        as to whether any changes were made as a result of this call.  This
        is expected to be used to decide whether or not to increment the
        token's ModifiedId field.

Return Value:

    STATUS_SUCCESS - Call completed sccessfully.

    STATUS_NOT_ALL_ASSIGNED - Indicates not all the specified adjustments
        have been made (or could be made, if update wasn't requested).

--*/
{
    NTSTATUS CompletionStatus = STATUS_SUCCESS;

    ULONG OldIndex;
    ULONG NewIndex;
    BOOLEAN Found;
    ULONG MatchCount = 0;

    LUID_AND_ATTRIBUTES CurrentPrivilege;

    PAGED_CODE();

    //
    //  Walk through the privileges array to determine which need to be
    //  adjusted.
    //

    OldIndex = 0;
    (*ChangeCount) = 0;

    while (OldIndex < Token->PrivilegeCount) {

        CurrentPrivilege = (Token->Privileges)[OldIndex];

        if (DisableAllPrivileges) {

            if (SepTokenPrivilegeAttributes(Token,OldIndex) &
               SE_PRIVILEGE_ENABLED ) {

                //
                // Change, if necessary (saving previous state if
                // appropriate).
                //

                if (MakeChanges) {

                    if (ARGUMENT_PRESENT(PreviousState)) {

                        PreviousState->Privileges[(*ChangeCount)] =
                            CurrentPrivilege;
                    }

                    SepTokenPrivilegeAttributes(Token,OldIndex) &=
                        ~SE_PRIVILEGE_ENABLED;



                } //endif make changes

                //
                // increment the number of changes
                //

                (*ChangeCount) += 1;

            } // endif privilege enabled

        } else {

            //
            //  Selective adjustments - this is a little trickier
            //  Compare the current privilege to each of those in
            //  the NewState array.  If a match is found, then adjust
            //  the current privilege appropriately.
            //

            NewIndex = 0;
            Found = FALSE;

            while ( (NewIndex < PrivilegeCount) && !Found)  {

                //
                // Look for a comparison
                //

                if (RtlEqualLuid(&CurrentPrivilege.Luid,&NewState[NewIndex].Luid)) {

                    Found = TRUE;
                    MatchCount += 1;

                    if ( (SepArrayPrivilegeAttributes( NewState, NewIndex ) &
                          SE_PRIVILEGE_ENABLED)
                        !=
                         (SepTokenPrivilegeAttributes(Token,OldIndex) &
                          SE_PRIVILEGE_ENABLED)  ) {

                        //
                        // Change, if necessary (saving previous state if
                        // appropriate).
                        //

                        if (MakeChanges) {

                            if (ARGUMENT_PRESENT(PreviousState)) {

                                PreviousState->Privileges[(*ChangeCount)] =
                                    CurrentPrivilege;
                            }

                            SepTokenPrivilegeAttributes(Token,OldIndex) &=
                                ~(SepTokenPrivilegeAttributes(Token,OldIndex)
                                  & SE_PRIVILEGE_ENABLED);
                            SepTokenPrivilegeAttributes(Token,OldIndex) |=
                                 (SepArrayPrivilegeAttributes(NewState,NewIndex)
                                  & SE_PRIVILEGE_ENABLED);

                            //
                            // if this is SeChangeNotifyPrivilege, then
                            // change its corresponding bit in TokenFlags
                            //

                            if (RtlEqualLuid(&CurrentPrivilege.Luid,
                                              &SeChangeNotifyPrivilege)) {
                                Token->TokenFlags ^= TOKEN_HAS_TRAVERSE_PRIVILEGE;
                            }



                        } //endif make changes

                        //
                        // increment the number of changes
                        //

                        (*ChangeCount) += 1;


                    } // endif change needed

                } // endif found

                NewIndex += 1;

            } // endwhile searching NewState

        } // endelse

        OldIndex += 1;

    } // endwhile privileges in token

    //
    // If we disabled all privileges, then clear the TokenFlags flag
    // corresponding to the SeChangeNotifyPrivilege privilege.
    //


    if (DisableAllPrivileges) {
        Token->TokenFlags &= ~TOKEN_HAS_TRAVERSE_PRIVILEGE;
    }

    //
    // Set completion status appropriately if some not assigned
    //

    if (!DisableAllPrivileges) {

        if (MatchCount < PrivilegeCount) {
            CompletionStatus = STATUS_NOT_ALL_ASSIGNED;
        }
    }

    //
    //  Indicate whether changes were made
    //

    if ((*ChangeCount) > 0  &&  MakeChanges) {
        (*ChangesMade) = TRUE;
    } else {
        (*ChangesMade) = FALSE;
    }

    //
    // Calculate the space needed to return previous state information
    //

    if (ARGUMENT_PRESENT(PreviousState)) {

        (*ReturnLength) = (ULONG)sizeof(TOKEN_PRIVILEGES) +
                          ((*ChangeCount) *  (ULONG)sizeof(LUID_AND_ATTRIBUTES)) -
                          (ANYSIZE_ARRAY * (ULONG)sizeof(LUID_AND_ATTRIBUTES));
    }

   return CompletionStatus;
}

NTSTATUS
SepAdjustGroups(
    IN PTOKEN Token,
    IN BOOLEAN MakeChanges,
    IN BOOLEAN ResetToDefault,
    IN ULONG GroupCount,
    IN PSID_AND_ATTRIBUTES NewState OPTIONAL,
    OUT PTOKEN_GROUPS PreviousState OPTIONAL,
    OUT PSID SidBuffer OPTIONAL,
    OUT PULONG ReturnLength,
    OUT PULONG ChangeCount,
    OUT PBOOLEAN ChangesMade
    )

/*++


Routine Description:

    This routine is used to walk the groups array in a token as a
    result of a request to adjust groups.

    If the MakeChanges parameter is FALSE, this routine simply determines
    what changes are needed and how much space is necessary to save the
    current state of changed groups.

    If the MakeChanges parameter is TRUE, this routine will not only
    calculate the space necessary to save the current state, but will
    actually make the changes.

    This routine makes the following assumptions:

      1) The token is locked for exclusive access.

      2) The NewState parameter is captured and accesses
         to it will not result in access violations.

      4) Any access violations encountered may leave the request
         partially completed.  It is the calling routine's responsibility
         to catch exceptions.

      5) The calling routine is responsible for inrementing the token's
         ModifiedId field.

Arguments:

    Token - Pointer to the token to act upon.

    MakeChanges - A boolean value indicating whether the changes should
        actually be made, or just evaluated.  A value of TRUE indicates
        the changes should be made.

    ResetToDefault - Indicates that the groups are to be reset to their
        default enabled/disabled state.

    GroupCount - This parameter is required only if the NewState parameter
        is used.  In that case, this parameter indicates how many entries are
        in the NewState parameter.

    NewState - This parameter points to a SID_AND_ATTRIBUTES array
        containing the groups whose states are to be adjusted
        (disabled or enabled).  Only the Enabled flag of the
        attributes associated with each group is used.  It provides
        the new value that is to be assigned to the group in the
        token.  If the ResetToDefault argument is specified as TRUE,
        then this argument is ignored.  Otherwise, it must be passed.

    PreviousState - This (optional) parameter points to a buffer to
        receive the state of any groups actually changed by this
        request.  This information is formated as a TOKEN_GROUPS data
        structure which may be passed as the NewState parameter in a
        subsequent call to NtAdjustGroups to restore the original state
        of those groups.  It is the caller's responsibility to make
        sure this buffer is large enough to receive all the state
        information.

    SidBuffer - Pointer to buffer to receive the SID values corresponding
        to the groups returned in the PreviousState argument.

    ReturnLength - Points to a buffer to receive the number of bytes needed
        to retrieve the previous state information of changed privileges.
        This parameter is ignored if the PreviousState argument is not
        passed.

    ChangeCount - Points to a ULONG to receive the number of groups
        which were adjusted (or would be adjusted, if changes are made).

    ChangesMade - Points to a boolean flag which is to receive an indication
        as to whether any changes were made as a result of this call.  This
        is expected to be used to decide whether or not to increment the
        token's ModifiedId field.

Return Value:

    STATUS_SUCCESS - Call completed sccessfully.

    STATUS_NOT_ALL_ASSIGNED - Indicates not all the specified adjustments
        have been made (or could be made, if update wasn't requested).

    STATUS_CANT_DISABLE_MANDATORY - Not all adjustments were made (or could
        be made, if update not requested) because an attempt was made to
        disable a mandatory group.  The state of the groups is left
        in an underterministic state if update was requested.


--*/
{

    NTSTATUS CompletionStatus = STATUS_SUCCESS;

    ULONG OldIndex;
    ULONG NewIndex;
    ULONG SidLength;
    ULONG LocalReturnLength = 0;
    PSID NextSid;
    BOOLEAN Found;
    ULONG MatchCount = 0;
    BOOLEAN EnableGroup;
    BOOLEAN DisableGroup;
    ULONG TokenGroupAttributes;

    SID_AND_ATTRIBUTES CurrentGroup;

    PAGED_CODE();

    //
    // NextSid is used to copy group SID values if asked for previous state.
    //

    NextSid = SidBuffer;


    //
    //  Walk through the groups array to determine which need to be
    //  adjusted.
    //

    OldIndex = 1;             // Don't evaluate the 0th entry (user ID)
    (*ChangeCount) = 0;

    while (OldIndex < Token->UserAndGroupCount) {

        CurrentGroup = Token->UserAndGroups[OldIndex];

        if (ResetToDefault) {

            TokenGroupAttributes = SepTokenGroupAttributes(Token,OldIndex);

            //
            // If the group is enabled by default and currently disabled,
            // then we must enable it.
            //

            EnableGroup = (BOOLEAN)( (TokenGroupAttributes & SE_GROUP_ENABLED_BY_DEFAULT)
                && !(TokenGroupAttributes & SE_GROUP_ENABLED));

            //
            // If the group is disabled by default and currently enabled,
            // then we must disable it.
            //

            DisableGroup = (BOOLEAN)( !(TokenGroupAttributes & SE_GROUP_ENABLED_BY_DEFAULT)
                && (TokenGroupAttributes & SE_GROUP_ENABLED));

            //
            // Blow up if it's a mandatory group that is not both
            // enabled by default and enabled (SepCreateToken should
            // make sure that this never happens).
            //

            ASSERT(!(TokenGroupAttributes & SE_GROUP_MANDATORY)
                   || (TokenGroupAttributes & (SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED)
                       == (SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED)));

            if ( EnableGroup || DisableGroup ) {

                SidLength = SeLengthSid( CurrentGroup.Sid );
                SidLength = (ULONG)LongAlignSize(SidLength);
                LocalReturnLength += SidLength;

                //
                // Change, if necessary (saving previous state if
                // appropriate).
                //

                if (MakeChanges) {

                    if (ARGUMENT_PRESENT(PreviousState)) {

                        (*(PreviousState)).Groups[(*ChangeCount)].Attributes =
                            CurrentGroup.Attributes;

                        (*(PreviousState)).Groups[(*ChangeCount)].Sid =
                            NextSid;

                        RtlCopySid( SidLength, NextSid, CurrentGroup.Sid );
                        NextSid = (PSID)((ULONG_PTR)NextSid + SidLength);
                    }

                    if (EnableGroup) {
                        SepTokenGroupAttributes(Token,OldIndex) |= SE_GROUP_ENABLED;
                    } else {
                        SepTokenGroupAttributes(Token,OldIndex) &= ~SE_GROUP_ENABLED;
                    }



                } //endif make changes

                //
                // increment the number of changes
                //

                (*ChangeCount) += 1;

            } // endif group enabled

        } else {

            //
            //  Selective adjustments - this is a little trickier
            //  Compare the current group to each of those in
            //  the NewState array.  If a match is found, then adjust
            //  the current group appropriately.
            //

            NewIndex = 0;
            Found = FALSE;

            while ( (NewIndex < GroupCount) && !Found)  {

                //
                // Look for a comparison
                //

                if (RtlEqualSid(
                        CurrentGroup.Sid,
                        NewState[NewIndex].Sid
                        ) ) {

                    Found = TRUE;
                    MatchCount += 1;


                    //
                    // See if it needs to be changed
                    //

                    if ( (SepArrayGroupAttributes( NewState, NewIndex ) &
                            SE_GROUP_ENABLED ) !=
                         (SepTokenGroupAttributes(Token,OldIndex) &
                            SE_GROUP_ENABLED ) ) {

                        //
                        // Make sure group is not mandatory
                        //

                        if (SepTokenGroupAttributes(Token,OldIndex) &
                              SE_GROUP_MANDATORY ) {
                            return STATUS_CANT_DISABLE_MANDATORY;
                        }

                        //
                        // Make sure group is not deny-only
                        //


                        if (SepTokenGroupAttributes(Token,OldIndex) &
                              SE_GROUP_USE_FOR_DENY_ONLY ) {
                            return STATUS_CANT_ENABLE_DENY_ONLY;
                        }

                        SidLength = SeLengthSid( CurrentGroup.Sid );
                        SidLength = (ULONG)LongAlignSize(SidLength);
                        LocalReturnLength += SidLength;

                        //
                        // Change, if necessary (saving previous state if
                        // appropriate).
                        //

                        if (MakeChanges) {

                            if (ARGUMENT_PRESENT(PreviousState)) {

                                PreviousState->Groups[(*ChangeCount)].Attributes =
                                    CurrentGroup.Attributes;

                                PreviousState->Groups[(*ChangeCount)].Sid =
                                    NextSid;

                                RtlCopySid( SidLength, NextSid, CurrentGroup.Sid );

                                NextSid = (PSID)((ULONG_PTR)NextSid + SidLength);
                            }

                            SepTokenGroupAttributes(Token,OldIndex) &=
                                ~(SepTokenGroupAttributes(Token,OldIndex)
                                  & SE_GROUP_ENABLED);
                            SepTokenGroupAttributes(Token,OldIndex) |=
                                 (SepArrayGroupAttributes(NewState,NewIndex)
                                  & SE_GROUP_ENABLED);



                        } //endif make changes

                        //
                        // increment the number of changes
                        //

                        (*ChangeCount) += 1;


                    } // endif change needed

                } // endif found

                NewIndex += 1;

            } // endwhile searching NewState

        } // endelse

        OldIndex += 1;

    } // endwhile more groups in token

    //
    // Set completion status appropriately if some not assigned
    //

    if (!ResetToDefault) {

        if (MatchCount < GroupCount) {
            CompletionStatus = STATUS_NOT_ALL_ASSIGNED;
        }
    }

    //
    //  Indicate whether changes were made
    //

    if ((*ChangeCount) > 0  &&  MakeChanges) {
        (*ChangesMade) = TRUE;
    } else {
        (*ChangesMade) = FALSE;
    }

    //
    // Calculate the space needed to return previous state information
    // (The SID lengths have already been added up in LocalReturnLength).
    //

    if (ARGUMENT_PRESENT(PreviousState)) {

        (*ReturnLength) = LocalReturnLength +
                          (ULONG)sizeof(TOKEN_GROUPS) +
                          ((*ChangeCount) *  (ULONG)sizeof(SID_AND_ATTRIBUTES)) -
                          (ANYSIZE_ARRAY * (ULONG)sizeof(SID_AND_ATTRIBUTES));
    }

   return CompletionStatus;
}

---