sertl.c File Reference

#include "ntrtlp.h"
#include <stdio.h>
#include "seopaque.h"
#include "sertlp.h"
#include <..\dll\ldrp.h>

Go to the source code of this file.

Defines
#define	CREATOR_SID_SIZE   12
#define	max(a, b)   (((a) > (b)) ? (a) : (b))
#define	SE_VALID_CONTROL_BITS
#define	ProbeAndReadUlongUM(Address)   (*(volatile ULONG *)(Address))
#define	MAX_CHILD_SID_GROUP_SIZE   3
#define	EFFECTIVE_ACE   INHERIT_ONLY_ACE
#define	AceFlagsInAce(_Ace)
Enumerations
enum	ACE_TYPE_TO_COPY { CopyInheritedAces, CopyNonInheritedAces, CopyAllAces }
Functions
ULONG	RtlLengthUsedSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor)
NTSYSAPI BOOLEAN NTAPI	RtlEqualLuid (PLUID Luid1, PLUID Luid2)
NTSTATUS	RtlpConvertAclToAutoInherit (IN PACL ParentAcl OPTIONAL, IN PACL ChildAcl, IN GUID *ObjectType OPTIONAL, IN BOOLEAN IsDirectoryObject, IN PSID OwnerSid, IN PSID GroupSid, IN PGENERIC_MAPPING GenericMapping, OUT PACL *NewAcl, OUT PULONG NewGenericControl)
BOOLEAN	RtlpCopyEffectiveAce (IN PACE_HEADER OldAce, IN BOOLEAN AutoInherit, IN BOOLEAN WillGenerateInheritAce, IN PSID ClientOwnerSid, IN PSID ClientGroupSid, IN PSID ServerOwnerSid OPTIONAL, IN PSID ServerGroupSid OPTIONAL, IN PGENERIC_MAPPING GenericMapping, IN GUID *NewObjectType OPTIONAL, IN OUT PVOID *AcePosition, OUT PULONG NewAceLength, OUT PACL NewAcl, OUT PBOOLEAN ObjectAceInherited OPTIONAL, OUT PBOOLEAN EffectiveAceMapped, OUT PBOOLEAN AclOverflowed)
NTSTATUS	RtlpCopyAces (IN PACL Acl, IN PGENERIC_MAPPING GenericMapping, IN ACE_TYPE_TO_COPY AceTypeToCopy, IN UCHAR AceFlagsToReset, IN BOOLEAN MapSids, IN PSID ClientOwnerSid, IN PSID ClientGroupSid, IN PSID ServerOwnerSid OPTIONAL, IN PSID ServerGroupSid OPTIONAL, OUT PULONG NewAclSizeParam, OUT PACL NewAcl)
NTSTATUS	RtlpGenerateInheritedAce (IN PACE_HEADER OldAce, IN BOOLEAN IsDirectoryObject, IN BOOLEAN AutoInherit, IN PSID ClientOwnerSid, IN PSID ClientGroupSid, IN PSID ServerOwnerSid OPTIONAL, IN PSID ServerGroupSid OPTIONAL, IN PGENERIC_MAPPING GenericMapping, IN GUID *NewObjectType OPTIONAL, OUT PULONG NewAceLength, OUT PACL NewAcl, OUT PULONG NewAceExtraLength, OUT PBOOLEAN ObjectAceInherited)
NTSTATUS	RtlpGenerateInheritAcl (IN PACL Acl, IN BOOLEAN IsDirectoryObject, IN BOOLEAN AutoInherit, IN PSID ClientOwnerSid, IN PSID ClientGroupSid, IN PSID ServerOwnerSid OPTIONAL, IN PSID ServerGroupSid OPTIONAL, IN PGENERIC_MAPPING GenericMapping, IN GUID *NewObjectType OPTIONAL, OUT PULONG NewAclSizeParam, OUT PACL NewAcl, OUT PBOOLEAN ObjectAceInherited)
NTSTATUS	RtlpInheritAcl2 (IN PACL DirectoryAcl, IN PACL ChildAcl, IN ULONG ChildGenericControl, IN BOOLEAN IsDirectoryObject, IN BOOLEAN AutoInherit, IN BOOLEAN DefaultDescriptorForObject, IN PSID OwnerSid, IN PSID GroupSid, IN PSID ServerOwnerSid OPTIONAL, IN PSID ServerGroupSid OPTIONAL, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN IsSacl, IN GUID *NewObjectType OPTIONAL, IN PULONG AclBufferSize, IN OUT PUCHAR AclBuffer, OUT PBOOLEAN NewAclExplicitlyAssigned, OUT PULONG NewGenericControl)
NTSTATUS	RtlpComputeMergedAcl (IN PACL CurrentAcl, IN ULONG CurrentGenericControl, IN PACL ModificationAcl, IN ULONG ModificationGenericControl, IN PSID ClientOwnerSid, IN PSID ClientGroupSid, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN IsSacl, OUT PACL *NewAcl, OUT PULONG NewGenericControl)
NTSTATUS	RtlpComputeMergedAcl2 (IN PACL CurrentAcl, IN ULONG CurrentGenericControl, IN PACL ModificationAcl, IN ULONG ModificationGenericControl, IN PSID ClientOwnerSid, IN PSID ClientGroupSid, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN IsSacl, IN PULONG AclBufferSize, IN OUT PUCHAR AclBuffer, OUT PULONG NewGenericControl)
BOOLEAN	RtlpCompareAces (IN PKNOWN_ACE InheritedAce, IN PKNOWN_ACE ChildAce, IN PSID OwnerSid, IN PSID GroupSid)
BOOLEAN	RtlpCompareKnownObjectAces (IN PKNOWN_OBJECT_ACE InheritedAce, IN PKNOWN_OBJECT_ACE ChildAce, IN PSID OwnerSid OPTIONAL, IN PSID GroupSid OPTIONAL)
BOOLEAN	RtlpCompareKnownAces (IN PKNOWN_ACE InheritedAce, IN PKNOWN_ACE ChildAce, IN PSID OwnerSid OPTIONAL, IN PSID GroupSid OPTIONAL)
BOOLEAN	RtlpIsDuplicateAce (IN PACL Acl, IN PKNOWN_ACE NewAce, IN GUID *ObjectType OPTIONAL)
NTSTATUS	RtlpCreateServerAcl (IN PACL Acl, IN BOOLEAN AclUntrusted, IN PSID ServerSid, OUT PACL *ServerAcl, OUT BOOLEAN *ServerAclAllocated)
NTSTATUS	RtlpGetDefaultsSubjectContext (HANDLE ClientToken, OUT PTOKEN_OWNER *OwnerInfo, OUT PTOKEN_PRIMARY_GROUP *GroupInfo, OUT PTOKEN_DEFAULT_DACL *DefaultDaclInfo, OUT PTOKEN_OWNER *ServerOwner, OUT PTOKEN_PRIMARY_GROUP *ServerGroup)
BOOLEAN	RtlpValidateSDOffsetAndSize (IN ULONG Offset, IN ULONG Length, IN ULONG MinLength, OUT PULONG MaxLength)
BOOLEAN	RtlValidRelativeSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptorInput, IN ULONG SecurityDescriptorLength, IN SECURITY_INFORMATION RequiredInformation)
VOID	RtlRunEncodeUnicodeString (PUCHAR Seed OPTIONAL, PUNICODE_STRING String)
VOID	RtlRunDecodeUnicodeString (UCHAR Seed, PUNICODE_STRING String)
VOID	RtlEraseUnicodeString (PUNICODE_STRING String)
NTSTATUS	RtlAdjustPrivilege (ULONG Privilege, BOOLEAN Enable, BOOLEAN Client, PBOOLEAN WasEnabled)
BOOLEAN	RtlValidSid (IN PSID Sid)
BOOLEAN	RtlEqualSid (IN PSID Sid1, IN PSID Sid2)
BOOLEAN	RtlEqualPrefixSid (IN PSID Sid1, IN PSID Sid2)
ULONG	RtlLengthRequiredSid (IN ULONG SubAuthorityCount)
NTSTATUS	RtlAllocateAndInitializeSid (IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, IN UCHAR SubAuthorityCount, IN ULONG SubAuthority0, IN ULONG SubAuthority1, IN ULONG SubAuthority2, IN ULONG SubAuthority3, IN ULONG SubAuthority4, IN ULONG SubAuthority5, IN ULONG SubAuthority6, IN ULONG SubAuthority7, OUT PSID *Sid)
NTSTATUS	RtlInitializeSid (IN PSID Sid, IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, IN UCHAR SubAuthorityCount)
PVOID	RtlFreeSid (IN PSID Sid)
PSID_IDENTIFIER_AUTHORITY	RtlIdentifierAuthoritySid (IN PSID Sid)
PULONG	RtlSubAuthoritySid (IN PSID Sid, IN ULONG SubAuthority)
PUCHAR	RtlSubAuthorityCountSid (IN PSID Sid)
ULONG	RtlLengthSid (IN PSID Sid)
NTSTATUS	RtlCopySid (IN ULONG DestinationSidLength, OUT PSID DestinationSid, IN PSID SourceSid)
NTSTATUS	RtlCopySidAndAttributesArray (IN ULONG ArrayLength, IN PSID_AND_ATTRIBUTES Source, IN ULONG TargetSidBufferSize, OUT PSID_AND_ATTRIBUTES TargetArrayElement, OUT PSID TargetSid, OUT PSID *NextTargetSid, OUT PULONG RemainingTargetSidBufferSize)
NTSTATUS	RtlLengthSidAsUnicodeString (PSID Sid, PULONG StringLength)
NTSTATUS	RtlConvertSidToUnicodeString (PUNICODE_STRING UnicodeString, PSID Sid, BOOLEAN AllocateDestinationString)
BOOLEAN	RtlEqualLuid (IN PLUID Luid1, IN PLUID Luid2)
VOID	RtlCopyLuid (OUT PLUID DestinationLuid, IN PLUID SourceLuid)
VOID	RtlCopyLuidAndAttributesArray (IN ULONG ArrayLength, IN PLUID_AND_ATTRIBUTES Source, OUT PLUID_AND_ATTRIBUTES Target)
NTSTATUS	RtlCreateSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN ULONG Revision)
NTSTATUS	RtlCreateSecurityDescriptorRelative (IN PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor, IN ULONG Revision)
BOOLEAN	RtlValidSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor)
ULONG	RtlLengthSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor)
NTSTATUS	RtlSetAttributesSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN SECURITY_DESCRIPTOR_CONTROL Control, OUT PULONG Revision)
NTSTATUS	RtlGetControlSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PSECURITY_DESCRIPTOR_CONTROL Control, OUT PULONG Revision)
NTSTATUS	RtlSetControlSecurityDescriptor (IN PSECURITY_DESCRIPTOR pSecurityDescriptor, IN SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest, IN SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet)
NTSTATUS	RtlSetDaclSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN BOOLEAN DaclPresent, IN PACL Dacl OPTIONAL, IN BOOLEAN DaclDefaulted OPTIONAL)
NTSTATUS	RtlGetDaclSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PBOOLEAN DaclPresent, OUT PACL *Dacl, OUT PBOOLEAN DaclDefaulted)
NTSTATUS	RtlSetSaclSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN BOOLEAN SaclPresent, IN PACL Sacl OPTIONAL, IN BOOLEAN SaclDefaulted OPTIONAL)
NTSTATUS	RtlGetSaclSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PBOOLEAN SaclPresent, OUT PACL *Sacl, OUT PBOOLEAN SaclDefaulted)
NTSTATUS	RtlSetOwnerSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSID Owner OPTIONAL, IN BOOLEAN OwnerDefaulted OPTIONAL)
NTSTATUS	RtlGetOwnerSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PSID *Owner, OUT PBOOLEAN OwnerDefaulted)
NTSTATUS	RtlSetGroupSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSID Group OPTIONAL, IN BOOLEAN GroupDefaulted OPTIONAL)
NTSTATUS	RtlGetGroupSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PSID *Group, OUT PBOOLEAN GroupDefaulted)
BOOLEAN	RtlAreAllAccessesGranted (IN ACCESS_MASK GrantedAccess, IN ACCESS_MASK DesiredAccess)
BOOLEAN	RtlAreAnyAccessesGranted (IN ACCESS_MASK GrantedAccess, IN ACCESS_MASK DesiredAccess)
VOID	RtlMapGenericMask (IN OUT PACCESS_MASK AccessMask, IN PGENERIC_MAPPING GenericMapping)
NTSTATUS	RtlImpersonateSelf (IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
BOOLEAN	RtlpValidOwnerSubjectContext (IN HANDLE Token, IN PSID Owner, IN BOOLEAN ServerObject, OUT PNTSTATUS ReturnStatus)
VOID	RtlpApplyAclToObject (IN PACL Acl, IN PGENERIC_MAPPING GenericMapping)
NTSTATUS	RtlpInheritAcl (IN PACL DirectoryAcl, IN PACL ChildAcl, IN ULONG ChildGenericControl, IN BOOLEAN IsDirectoryObject, IN BOOLEAN AutoInherit, IN BOOLEAN DefaultDescriptorForObject, IN PSID OwnerSid, IN PSID GroupSid, IN PSID ServerOwnerSid OPTIONAL, IN PSID ServerGroupSid OPTIONAL, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN IsSacl, IN GUID *NewObjectType OPTIONAL, OUT PACL *NewAcl, OUT PBOOLEAN NewAclExplicitlyAssigned, OUT PULONG NewGenericControl)
NTSTATUS	RtlpConvertToAutoInheritSecurityObject (IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL, IN PSECURITY_DESCRIPTOR CurrentSecurityDescriptor, OUT PSECURITY_DESCRIPTOR *NewSecurityDescriptor, IN GUID *ObjectType OPTIONAL, IN BOOLEAN IsDirectoryObject, IN PGENERIC_MAPPING GenericMapping)
NTSTATUS	RtlpNewSecurityObject (IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL, IN PSECURITY_DESCRIPTOR CreatorDescriptor OPTIONAL, OUT PSECURITY_DESCRIPTOR *NewDescriptor, IN GUID *ObjectType OPTIONAL, IN BOOLEAN IsDirectoryObject, IN ULONG AutoInheritFlags, IN HANDLE Token OPTIONAL, IN PGENERIC_MAPPING GenericMapping)
NTSTATUS	RtlpSetSecurityObject (IN PVOID Object OPTIONAL, IN SECURITY_INFORMATION SecurityInformation, IN PSECURITY_DESCRIPTOR ModificationDescriptor, IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, IN ULONG AutoInheritFlags, IN ULONG PoolType, IN PGENERIC_MAPPING GenericMapping, IN HANDLE Token OPTIONAL)
BOOLEAN	RtlGetSecurityDescriptorRMControl (IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PUCHAR RMControl)
VOID	RtlSetSecurityDescriptorRMControl (IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN PUCHAR RMControl OPTIONAL)
Variables
UCHAR	RtlBaseAceType []
UCHAR	RtlIsSystemAceType []
BOOLEAN	RtlpVerboseConvert = FALSE

---

Define Documentation

#define AceFlagsInAce (  _Ace   )

Value: (((PACE_HEADER)(_Ace))->AceFlags & (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE) | \ (((PACE_HEADER)(_Ace))->AceFlags & INHERIT_ONLY_ACE) ^ INHERIT_ONLY_ACE ) Definition at line 6966 of file sertl.c. Referenced by RtlpCompareKnownAces(), RtlpCompareKnownObjectAces(), and RtlpConvertAclToAutoInherit().

#define CREATOR_SID_SIZE   12

Definition at line 330 of file sertl.c. Referenced by RtlpCompareKnownAces(), RtlpCompareKnownObjectAces(), RtlpConvertAclToAutoInherit(), RtlpCopyEffectiveAce(), and RtlpGenerateInheritedAce().

#define EFFECTIVE_ACE   INHERIT_ONLY_ACE

Definition at line 6965 of file sertl.c. Referenced by RtlpCompareKnownAces(), RtlpCompareKnownObjectAces(), and RtlpConvertAclToAutoInherit().

#define max (  a, b   )     (((a) > (b)) ? (a) : (b))

Definition at line 332 of file sertl.c. Referenced by _CreateEmptyCursorObject(), _MapWindowPoints(), ArbGetNextAllocationRange(), CalcSBStuff2(), CheckPlacementBounds(), ComboBoxWndProcWorker(), CommandListPopup(), ComputeSecPerCluster(), ConvertToFullScreen(), Create_LH_ProfileSet(), CreateRedirectionBitmap(), CreateScreenBuffer(), DrawCommandListPopup(), DrawStateW(), ECCalcChangeSelection(), ECFindXORblks(), ECImeComposition(), ECSetPasswordChar(), ECTabTheTextOut(), FdGetMinimumSizeMB(), GetDeskWallpaperName(), GetWallpaperCenterRect(), GetWindowLimits(), HorizontalScroll(), InitCreateUserSubsystem(), IntersectRect(), InvertPixels(), IopCreateArcNames(), IopMakeGloballyUniqueId(), IopStartNetworkForRemoteBoot(), KeConnectInterrupt(), KeDisconnectInterrupt(), KeSetTimeIncrement(), KiIpiGenericCall(), LastFullVisible(), LBCalcItemRowsAndColumns(), LBPage(), ListBoxWndProcWorker(), MLBuildchLines(), MLCalcXOffset(), MLDeleteText(), MLDrawText(), MLEditWndProc(), MLIchToLine(), MLInsertText(), MLMouseToIch(), MLScroll(), MLSetCaretPosition(), ParkIcon(), PositionConsoleWindow(), ProcessDeviceChanges(), RtlpComputeMergedAcl2(), RtlpConvertAclToAutoInherit(), RtlpGenerateInheritAcl(), RtlpGenerateInheritedAce(), RtlpInheritAcl2(), RW_RegisterControls(), SelectInputContext(), SetIconMetrics(), SetMinMetrics(), SLCalcXOffsetSpecial(), SLChar(), SLDrawLine(), SLSetCaretPosition(), SmoothScrollWindowEx(), SoftModalMessageBox(), StreamScrollRegion(), UnionRect(), UpdateUserScreen(), VerticalScroll(), WowGetDefWindowProcBits(), WWSB_ConsolePolyTextOut(), WWSB_WriteRegionToScreen(), WWSB_WriteToScreen(), xxxAdjustSize(), xxxAlterHilite(), xxxAnimateCaption(), xxxArrangeIconicWindows(), xxxBNDrawText(), xxxCBCalcControlRects(), xxxCBSetEditItemHeight(), xxxCBShowListBoxWindow(), xxxDrawMenuBarTemp(), xxxDrawMenuItem(), xxxDrawState(), xxxInitSendValidateMinMaxInfo(), xxxInsureVisible(), xxxLBBinarySearchString(), xxxLBSelRange(), xxxLBSize(), xxxMNCompute(), xxxMNItemSize(), xxxMNPositionHierarchy(), xxxMouseEventDirect(), xxxMS_TrackMove(), xxxNextAniIconStep(), xxxRealDrawMenuItem(), xxxSetLBScrollParms(), xxxSetNCFonts(), xxxSetStaticImage(), xxxSetWindowNCMetrics(), xxxSystemParametersInfo(), xxxTrackMouse(), and zzzClipCursor().

#define MAX_CHILD_SID_GROUP_SIZE   3

Definition at line 6964 of file sertl.c.

#define ProbeAndReadUlongUM (  Address   )     (*(volatile ULONG *)(Address))

Referenced by RtlValidSid().

#define SE_VALID_CONTROL_BITS

Value: ( SE_DACL_UNTRUSTED | \ SE_SERVER_SECURITY | \ SE_DACL_AUTO_INHERIT_REQ | \ SE_SACL_AUTO_INHERIT_REQ | \ SE_DACL_AUTO_INHERITED | \ SE_SACL_AUTO_INHERITED | \ SE_DACL_PROTECTED | \ SE_SACL_PROTECTED ) Definition at line 370 of file sertl.c. Referenced by RtlSetAttributesSecurityDescriptor(), and RtlSetControlSecurityDescriptor().

---

Enumeration Type Documentation

enum ACE_TYPE_TO_COPY

Enumeration values: CopyInheritedAces  CopyNonInheritedAces  CopyAllAces  Definition at line 89 of file sertl.c. Referenced by RtlpInheritAcl2(). { CopyInheritedAces, CopyNonInheritedAces, CopyAllAces } ACE_TYPE_TO_COPY;

---

Function Documentation

NTSTATUS RtlAdjustPrivilege (  ULONG  Privilege, BOOLEAN  Enable, BOOLEAN  Client, PBOOLEAN  WasEnabled )

Definition at line 639 of file sertl.c. References ANYSIZE_ARRAY, ASSERT, Buffer1, Buffer2, FALSE, NT_SUCCESS, NtAdjustPrivilegesToken(), NtClose(), NtOpenProcessToken(), NtOpenThreadToken(), NTSTATUS(), RTL_PAGED_CODE, Status, Token, and TRUE. Referenced by main(). : This procedure enables or disables a privilege process-wide. Arguments: Privilege - The lower 32-bits of the privilege ID to be enabled or disabled. The upper 32-bits is assumed to be zero. Enable - A boolean indicating whether the privilege is to be enabled or disabled. TRUE indicates the privilege is to be enabled. FALSE indicates the privilege is to be disabled. Client - A boolean indicating whether the privilege should be adjusted in a client token or the process's own token. TRUE indicates the client's token should be used (and an error returned if there is no client token). FALSE indicates the process's token should be used. WasEnabled - points to a boolean to receive an indication of whether the privilege was previously enabled or disabled. TRUE indicates the privilege was previously enabled. FALSE indicates the privilege was previoulsy disabled. This value is useful for returning the privilege to its original state after using it. Return Value: STATUS_SUCCESS - The privilege has been sucessfully enabled or disabled. STATUS_PRIVILEGE_NOT_HELD - The privilege is not held by the specified context. Other status values as may be returned by: NtOpenProcessToken() NtAdjustPrivilegesToken() --*/ { NTSTATUS Status, TmpStatus; HANDLE Token; LUID LuidPrivilege; PTOKEN_PRIVILEGES NewPrivileges, OldPrivileges; ULONG Length; UCHAR Buffer1[sizeof(TOKEN_PRIVILEGES)+ ((1-ANYSIZE_ARRAY)*sizeof(LUID_AND_ATTRIBUTES))], Buffer2[sizeof(TOKEN_PRIVILEGES)+ ((1-ANYSIZE_ARRAY)*sizeof(LUID_AND_ATTRIBUTES))]; RTL_PAGED_CODE(); NewPrivileges = (PTOKEN_PRIVILEGES)Buffer1; OldPrivileges = (PTOKEN_PRIVILEGES)Buffer2; // // Open the appropriate token... // if (Client == TRUE) { Status = NtOpenThreadToken( NtCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &Token ); } else { Status = NtOpenProcessToken( NtCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &Token ); } if (!NT_SUCCESS(Status)) { return(Status); } // // Initialize the privilege adjustment structure // LuidPrivilege = RtlConvertUlongToLuid(Privilege); NewPrivileges->PrivilegeCount = 1; NewPrivileges->Privileges[0].Luid = LuidPrivilege; NewPrivileges->Privileges[0].Attributes = Enable ? SE_PRIVILEGE_ENABLED : 0; // // Adjust the privilege // Status = NtAdjustPrivilegesToken( Token, // TokenHandle FALSE, // DisableAllPrivileges NewPrivileges, // NewPrivileges sizeof(Buffer1), // BufferLength OldPrivileges, // PreviousState (OPTIONAL) &Length // ReturnLength ); TmpStatus = NtClose(Token); ASSERT(NT_SUCCESS(TmpStatus)); // // Map the success code NOT_ALL_ASSIGNED to an appropriate error // since we're only trying to adjust the one privilege. // if (Status == STATUS_NOT_ALL_ASSIGNED) { Status = STATUS_PRIVILEGE_NOT_HELD; } if (NT_SUCCESS(Status)) { // // If there are no privileges in the previous state, there were // no changes made. The previous state of the privilege // is whatever we tried to change it to. // if (OldPrivileges->PrivilegeCount == 0) { (*WasEnabled) = Enable; } else { (*WasEnabled) = (OldPrivileges->Privileges[0].Attributes & SE_PRIVILEGE_ENABLED) ? TRUE : FALSE; } } return(Status); }

NTSTATUS RtlAllocateAndInitializeSid (  IN PSID_IDENTIFIER_AUTHORITY  IdentifierAuthority, IN UCHAR  SubAuthorityCount, IN ULONG  SubAuthority0, IN ULONG  SubAuthority1, IN ULONG  SubAuthority2, IN ULONG  SubAuthority3, IN ULONG  SubAuthority4, IN ULONG  SubAuthority5, IN ULONG  SubAuthority6, IN ULONG  SubAuthority7, OUT PSID *  Sid )

Definition at line 1062 of file sertl.c. References NULL, RTL_PAGED_CODE, RtlAllocateHeap, and RtlLengthRequiredSid(). Referenced by CreateBSMEventSD(), and CsrpConnectToServer(). 01078 : 01079 01080 This function allocates and initializes a sid with the specified 01081 number of sub-authorities (up to 8). A sid allocated with this 01082 routine must be freed using RtlFreeSid(). 01083 01084 THIS ROUTINE IS CURRENTLY NOT CALLABLE FROM KERNEL MODE. 01085 01086 Arguments: 01087 01088 IdentifierAuthority - Pointer to the Identifier Authority value to 01089 set in the SID. 01090 01091 SubAuthorityCount - The number of sub-authorities to place in the SID. 01092 This also identifies how many of the SubAuthorityN parameters 01093 have meaningful values. This must contain a value from 0 through 01094 8. 01095 01096 SubAuthority0-7 - Provides the corresponding sub-authority value to 01097 place in the SID. For example, a SubAuthorityCount value of 3 01098 indicates that SubAuthority0, SubAuthority1, and SubAuthority0 01099 have meaningful values and the rest are to be ignored. 01100 01101 Sid - Receives a pointer to the SID data structure to initialize. 01102 01103 Return Value: 01104 01105 STATUS_SUCCESS - The SID has been allocated and initialized. 01106 01107 STATUS_NO_MEMORY - The attempt to allocate memory for the SID 01108 failed. 01109 01110 STATUS_INVALID_SID - The number of sub-authorities specified did 01111 not fall in the valid range for this api (0 through 8). 01112 01113 01114 --*/ 01115 { 01116 PISID ISid; 01117 01118 RTL_PAGED_CODE(); 01119 01120 if ( SubAuthorityCount > 8 ) { 01121 return( STATUS_INVALID_SID ); 01122 } 01123 01124 ISid = RtlAllocateHeap( RtlProcessHeap(), 0, 01125 RtlLengthRequiredSid(SubAuthorityCount) 01126 ); 01127 if (ISid == NULL) { 01128 return(STATUS_NO_MEMORY); 01129 } 01130 01131 ISid->SubAuthorityCount = (UCHAR)SubAuthorityCount; 01132 ISid->Revision = 1; 01133 ISid->IdentifierAuthority = *IdentifierAuthority; 01134 01135 switch (SubAuthorityCount) { 01136 01137 case 8: 01138 ISid->SubAuthority[7] = SubAuthority7; 01139 case 7: 01140 ISid->SubAuthority[6] = SubAuthority6; 01141 case 6: 01142 ISid->SubAuthority[5] = SubAuthority5; 01143 case 5: 01144 ISid->SubAuthority[4] = SubAuthority4; 01145 case 4: 01146 ISid->SubAuthority[3] = SubAuthority3; 01147 case 3: 01148 ISid->SubAuthority[2] = SubAuthority2; 01149 case 2: 01150 ISid->SubAuthority[1] = SubAuthority1; 01151 case 1: 01152 ISid->SubAuthority[0] = SubAuthority0; 01153 case 0: 01154 ; 01155 } 01156 01157 (*Sid) = ISid; 01158 return( STATUS_SUCCESS ); 01159 01160 } #endif // NTOS_KERNEL_RUNTIME

BOOLEAN RtlAreAllAccessesGranted (  IN ACCESS_MASK  GrantedAccess, IN ACCESS_MASK  DesiredAccess )

Definition at line 3309 of file sertl.c. References RTL_PAGED_CODE. Referenced by _BlockInput(), CheckGrantedAccess(), CheckWinstaWriteAttributesAccess(), InitiateShutdown(), xxxInternalKeyEventDirect(), xxxSetProcessWindowStation(), and zzzSetWindowsHookEx(). : This routine is used to check a desired access mask against a granted access mask. It is used by the Object Management component when dereferencing a handle. Arguments: GrantedAccess - Specifies the granted access mask. DesiredAccess - Specifies the desired access mask. Return Value: BOOLEAN - TRUE if the GrantedAccess mask has all the bits set that the DesiredAccess mask has set. That is, TRUE is returned if all of the desired accesses have been granted. --*/ { RTL_PAGED_CODE(); return ((BOOLEAN)((~(GrantedAccess) & (DesiredAccess)) == 0)); }

BOOLEAN RtlAreAnyAccessesGranted (  IN ACCESS_MASK  GrantedAccess, IN ACCESS_MASK  DesiredAccess )

Definition at line 3344 of file sertl.c. References RTL_PAGED_CODE. Referenced by NtUserGetAsyncKeyState(). : This routine is used to test whether any of a set of desired accesses are granted by a granted access mask. It is used by components other than the the Object Management component for checking access mask subsets. Arguments: GrantedAccess - Specifies the granted access mask. DesiredAccess - Specifies the desired access mask. Return Value: BOOLEAN - TRUE if the GrantedAccess mask contains any of the bits specified in the DesiredAccess mask. That is, if any of the desired accesses have been granted, TRUE is returned. --*/ { RTL_PAGED_CODE(); return ((BOOLEAN)(((GrantedAccess) & (DesiredAccess)) != 0)); }

NTSTATUS RtlConvertSidToUnicodeString (  PUNICODE_STRING  UnicodeString, PSID  Sid, BOOLEAN  AllocateDestinationString )

Definition at line 1611 of file sertl.c. References L, NT_SUCCESS, NTSTATUS(), Offset, RTL_PAGED_CODE, RtlCopyUnicodeString(), RtlCreateUnicodeString(), RtlIntegerToUnicode(), RtlLargeIntegerToUnicode(), RtlValidSid(), Status, TRUE, and USHORT. Referenced by RtlFormatCurrentUserKeyPath(). : This function generates a printable unicode string representation of a SID. The resulting string will take one of two forms. If the IdentifierAuthority value is not greater than 2^32, then the SID will be in the form: S-1-281736-12-72-9-110 ^ ^^ ^^ ^ ^^^ | | | | | +-----+--+-+--+---- Decimal Otherwise it will take the form: S-1-0x173495281736-12-72-9-110 ^^^^^^^^^^^^^^ ^^ ^^ ^ ^^^ Hexidecimal | | | | +--+-+--+---- Decimal Arguments: UnicodeString - Returns a unicode string that is equivalent to the SID. The maximum length field is only set if AllocateDestinationString is TRUE. Sid - Supplies the SID that is to be converted to unicode. AllocateDestinationString - Supplies a flag that controls whether or not this API allocates the buffer space for the destination string. If it does, then the buffer must be deallocated using RtlFreeUnicodeString (note that only storage for DestinationString->Buffer is allocated by this API). Return Value: SUCCESS - The conversion was successful STATUS_INVALID_SID - The sid provided does not have a valid structure, or has too many sub-authorities (more than SID_MAX_SUB_AUTHORITIES). STATUS_NO_MEMORY - There was not sufficient memory to allocate the target string. This is returned only if AllocateDestinationString is specified as TRUE. STATUS_BUFFER_OVERFLOW - This is returned only if AllocateDestinationString is specified as FALSE. --*/ { NTSTATUS Status; WCHAR UniBuffer[ 256 ]; PWSTR Offset ; UNICODE_STRING LocalString ; UCHAR i; ULONG Tmp; LARGE_INTEGER Auth ; PISID iSid = (PISID)Sid; // pointer to opaque structure RTL_PAGED_CODE(); if (RtlValidSid( Sid ) != TRUE) { return(STATUS_INVALID_SID); } if ( iSid->Revision != SID_REVISION ) { return STATUS_INVALID_SID ; } wcscpy( UniBuffer, L"S-1-" ); Offset = &UniBuffer[ 4 ]; if ( (iSid->IdentifierAuthority.Value[0] != 0) || (iSid->IdentifierAuthority.Value[1] != 0) ){ // // Ugly hex dump. // Auth.HighPart = (LONG) (iSid->IdentifierAuthority.Value[ 0 ] << 8) + (LONG) iSid->IdentifierAuthority.Value[ 1 ] ; Auth.LowPart = (ULONG)iSid->IdentifierAuthority.Value[5] + (ULONG)(iSid->IdentifierAuthority.Value[4] << 8) + (ULONG)(iSid->IdentifierAuthority.Value[3] << 16) + (ULONG)(iSid->IdentifierAuthority.Value[2] << 24); Status = RtlLargeIntegerToUnicode( &Auth, 16, 256 - (LONG) (Offset - UniBuffer), Offset ); } else { Tmp = (ULONG)iSid->IdentifierAuthority.Value[5] + (ULONG)(iSid->IdentifierAuthority.Value[4] << 8) + (ULONG)(iSid->IdentifierAuthority.Value[3] << 16) + (ULONG)(iSid->IdentifierAuthority.Value[2] << 24); Status = RtlIntegerToUnicode( Tmp, 10, 256 - (LONG) (Offset - UniBuffer), Offset ); } if ( !NT_SUCCESS( Status ) ) { return Status ; } for (i=0;i<iSid->SubAuthorityCount ;i++ ) { while ( *Offset && ( Offset < &UniBuffer[ 255 ] ) ) { Offset++ ; } *Offset++ = L'-' ; Status = RtlIntegerToUnicode( iSid->SubAuthority[ i ], 10, 256 - (LONG) (Offset - UniBuffer), Offset ); if ( !NT_SUCCESS( Status ) ) { return Status ; } } if ( AllocateDestinationString ) { if ( RtlCreateUnicodeString( UnicodeString, UniBuffer ) ) { Status = STATUS_SUCCESS ; } else { Status = STATUS_NO_MEMORY ; } } else { while ( *Offset && ( Offset < &UniBuffer[ 255 ] ) ) { Offset++ ; } Tmp = (ULONG) (Offset - UniBuffer) * sizeof( WCHAR ); if ( Tmp < UnicodeString->MaximumLength ) { LocalString.Length = (USHORT) Tmp ; LocalString.MaximumLength = LocalString.Length + sizeof( WCHAR ); LocalString.Buffer = UniBuffer ; RtlCopyUnicodeString( UnicodeString, &LocalString ); Status = STATUS_SUCCESS ; } else { Status = STATUS_BUFFER_OVERFLOW ; } } return(Status); }

VOID RtlCopyLuid (  OUT PLUID  DestinationLuid, IN PLUID  SourceLuid )

Definition at line 1863 of file sertl.c. References RTL_PAGED_CODE. Referenced by NtCreateToken(). 01870 : 01871 01872 This routine copies the value of the source LUID to the 01873 destination LUID. 01874 01875 Arguments: 01876 01877 DestinationLuid - Receives a copy of the source Luid value. 01878 01879 SourceLuid - Supplies the Luid value to be copied. This LUID is 01880 assumed to be structurally valid. 01881 01882 Return Value: 01883 01884 None. 01885 01886 --*/ 01887 01888 { 01889 RTL_PAGED_CODE(); 01890 01891 (*DestinationLuid) = (*SourceLuid); 01892 return; 01893 }

VOID RtlCopyLuidAndAttributesArray (  IN ULONG  ArrayLength, IN PLUID_AND_ATTRIBUTES  Source, OUT PLUID_AND_ATTRIBUTES  Target )

Definition at line 1896 of file sertl.c. References Index, and RTL_PAGED_CODE. Referenced by NtQueryInformationToken(), SepFilterToken(), and SeQueryInformationToken(). 01904 : 01905 01906 This routine copies the value of the source LUID_AND_ATTRIBUTES array 01907 to the target. 01908 01909 Arguments: 01910 01911 ArrayLength - Number of elements in the source array to copy. 01912 01913 Source - The source array. 01914 01915 Target - Indicates where the array elements are to be copied to. 01916 01917 01918 Return Value: 01919 01920 None. 01921 01922 01923 --*/ 01924 01925 { 01926 01927 ULONG Index = 0; 01928 01929 RTL_PAGED_CODE(); 01930 01931 while (Index < ArrayLength) { 01932 01933 Target[Index] = Source[Index]; 01934 01935 Index += 1; 01936 01937 } //end_while 01938 01939 01940 return; 01941 01942 }

NTSTATUS RtlCopySid (  IN ULONG  DestinationSidLength, OUT PSID  DestinationSid, IN PSID  SourceSid )

Definition at line 1380 of file sertl.c. References RTL_PAGED_CODE, and SeLengthSid. Referenced by AllocAce(), CreateDAclToken(), GenerateDescriptor(), GetSiteSidFromToken(), NtCloseObjectAuditAlarm(), NtDeleteObjectAuditAlarm(), NtQueryInformationToken(), RtlAddCompoundAce(), RtlCopySidAndAttributesArray(), RtlpAddKnownAce(), RtlpAddKnownObjectAce(), RtlpInitializeAllowedAce(), RtlpInitializeAuditAce(), RtlpInitializeDeniedAce(), RtlpNewSecurityObject(), SepAdjustGroups(), SepCreateToken(), SeQueryInformationToken(), TestSeAclRtl(), TestSeSid(), TSeVariableInitialization(), and xxxCreateWindowStation(). : This routine copies the value of the source SID to the destination SID. Arguments: DestinationSidLength - Indicates the length, in bytes, of the destination SID buffer. DestinationSid - Pointer to a buffer to receive a copy of the source Sid value. SourceSid - Supplies the Sid value to be copied. Return Value: STATUS_SUCCESS - Indicates the SID was successfully copied. STATUS_BUFFER_TOO_SMALL - Indicates the target buffer wasn't large enough to receive a copy of the SID. --*/ { ULONG SidLength = SeLengthSid(SourceSid); RTL_PAGED_CODE(); if (SidLength > DestinationSidLength) { return STATUS_BUFFER_TOO_SMALL; } // // Buffer is large enough // RtlMoveMemory( DestinationSid, SourceSid, SidLength ); return STATUS_SUCCESS; }

NTSTATUS RtlCopySidAndAttributesArray (  IN ULONG  ArrayLength, IN PSID_AND_ATTRIBUTES  Source, IN ULONG  TargetSidBufferSize, OUT PSID_AND_ATTRIBUTES  TargetArrayElement, OUT PSID  TargetSid, OUT PSID *  NextTargetSid, OUT PULONG  RemainingTargetSidBufferSize )

Definition at line 1436 of file sertl.c. References Index, LongAlign, RTL_PAGED_CODE, RtlCopySid(), and SeLengthSid. Referenced by NtQueryInformationJobObject(), NtQueryInformationToken(), SepCreateToken(), SepFilterToken(), SeQueryInformationToken(), and TestSeSid(). : This routine copies the value of the source SID_AND_ATTRIBUTES array to the target. The actual SID values are placed according to a separate parameter. This allows multiple arrays to be merged using this service to copy each. Arguments: ArrayLength - Number of elements in the source array to copy. Source - Pointer to the source array. TargetSidBufferSize - Indicates the length, in bytes, of the buffer to receive the actual SID values. If this value is less than the actual amount needed, then STATUS_BUFFER_TOO_SMALL is returned. TargetArrayElement - Indicates where the array elements are to be copied to (but not the SID values themselves). TargetSid - Indicates where the target SID values s are to be copied. This is assumed to be ULONG aligned. Each SID value will be copied into this buffer. Each SID will be ULONG aligned. NextTargetSid - On completion, will be set to point to the ULONG aligned address following the last SID copied. RemainingTargetSidBufferSize - On completion, receives an indicatation of how much of the SID buffer is still unused. Return Value: STATUS_SUCCESS - The call completed successfully. STATUS_BUFFER_TOO_SMALL - Indicates the buffer to receive the SID values wasn't large enough. --*/ { ULONG Index = 0; PSID NextSid = TargetSid; ULONG NextSidLength; ULONG AlignedSidLength; ULONG RemainingLength = TargetSidBufferSize; RTL_PAGED_CODE(); while (Index < ArrayLength) { NextSidLength = SeLengthSid( Source[Index].Sid ); AlignedSidLength = PtrToUlong(LongAlign(NextSidLength)); if (NextSidLength > RemainingLength) { return STATUS_BUFFER_TOO_SMALL; } RemainingLength -= AlignedSidLength; TargetArrayElement[Index].Sid = NextSid; TargetArrayElement[Index].Attributes = Source[Index].Attributes; RtlCopySid( NextSidLength, NextSid, Source[Index].Sid ); NextSid = (PSID)((PCHAR)NextSid + AlignedSidLength); Index += 1; } //end_while (*NextTargetSid) = NextSid; (*RemainingTargetSidBufferSize) = RemainingLength; return STATUS_SUCCESS; }

NTSTATUS RtlCreateSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN ULONG  Revision )

Definition at line 1945 of file sertl.c. References RTL_PAGED_CODE. Referenced by CmpHiveRootSecurityDescriptor(), CreateBSMEventSD(), CreateDAclToken(), CreateSecurityDescriptor(), GenerateDescriptor(), InternalCreateCallbackThread(), IoCreateUnprotectedSymbolicLink(), IopApplySystemPartitionProt(), IopCreateDefaultDeviceSecurityDescriptor(), IopInitializePlugPlayServices(), IopOpenDeviceParametersSubkey(), NtOpenThreadToken(), ObInitSystem(), ObpGetDosDevicesProtection(), RtlCreateAndSetSD(), RtlpNewSecurityObject(), RtlQuerySecurityObject(), SeMakeAnonymousLogonToken(), SeMakeSystemToken(), SepInitializationPhase1(), SepInitSystemDacls(), SeRmInitPhase1(), SmbTraceStart(), TestSeAccess(), TestSeNamedCreate(), TestSeSecurityDescriptor(), and TestTokenInitialize(). : This procedure initializes a new "absolute format" security descriptor. After the procedure call the security descriptor is initialized with no system ACL, no discretionary ACL, no owner, no primary group and all control flags set to false (null). Arguments: SecurityDescriptor - Supplies the security descriptor to initialize. Revision - Provides the revision level to assign to the security descriptor. This should be one (1) for this release. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision level provided is not supported by this routine. --*/ { RTL_PAGED_CODE(); // // Check the requested revision // if (Revision == SECURITY_DESCRIPTOR_REVISION) { // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = SecurityDescriptor; RtlZeroMemory( ISecurityDescriptor, sizeof(SECURITY_DESCRIPTOR)); ISecurityDescriptor->Revision = SECURITY_DESCRIPTOR_REVISION; return STATUS_SUCCESS; } return STATUS_UNKNOWN_REVISION; }

NTSTATUS RtlCreateSecurityDescriptorRelative (  IN PISECURITY_DESCRIPTOR_RELATIVE  SecurityDescriptor, IN ULONG  Revision )

Definition at line 2004 of file sertl.c. References RTL_PAGED_CODE. Referenced by RtlpConvertToAutoInheritSecurityObject(), RtlpNewSecurityObject(), RtlpSetSecurityObject(), SeAssignWorldSecurityDescriptor(), and SeQuerySecurityDescriptorInfo(). : This procedure initializes a new "relative format" security descriptor. After the procedure call the security descriptor is initialized with no system ACL, no discretionary ACL, no owner, no primary group and all control flags set to false (null). Arguments: SecurityDescriptor - Supplies the security descriptor to initialize. Revision - Provides the revision level to assign to the security descriptor. This should be one (1) for this release. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision level provided is not supported by this routine. Note: Warning, this code assume the caller allocated a relative security descriptor rather than a relative one. Absolute is larger on systems with 64-bit pointers. --*/ { RTL_PAGED_CODE(); // // Check the requested revision // if (Revision == SECURITY_DESCRIPTOR_REVISION) { // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // RtlZeroMemory( SecurityDescriptor, sizeof(SECURITY_DESCRIPTOR_RELATIVE)); SecurityDescriptor->Revision = SECURITY_DESCRIPTOR_REVISION; return STATUS_SUCCESS; } return STATUS_UNKNOWN_REVISION; }

BOOLEAN RtlEqualLuid (  IN PLUID  Luid1, IN PLUID  Luid2 )

Definition at line 1824 of file sertl.c. References RTL_PAGED_CODE. Referenced by _UserTestForWinStaAccess(), CheckAllowForeground(), EndShutdown(), InitiateShutdown(), InitPreviousUserString(), NotifyLogon(), NtUserPostThreadMessage(), OpenDesktopCompletion(), RtlNewInstanceSecurityObject(), SeIsChildToken(), SeIsChildTokenByPointer(), SeMarkLogonSessionForTerminationNotification(), SepAdjustPrivileges(), SepCreateLogonSessionTrack(), SepCreateToken(), SepDeleteLogonSessionTrack(), SepDeReferenceLogonSession(), SepFilterPrivilegeAudits(), SepPrivilegeCheck(), SepReferenceLogonSession(), SepRemoveDisabledGroupsAndPrivileges(), SetWindowStationUser(), TestForInteractiveUser(), TestpCompareDuplicateToken(), TestTokenOpenPrimary(), TestTokenQuery(), xxxCallHook2(), xxxCreateDesktop2(), xxxProcessNotifyWinEvent(), xxxUpdatePerUserAccessPackSettings(), and zzzSetWindowsHookEx(). : This procedure test two LUID values for equality. This routine is here for backwards compatibility only. New code should use the macro. Arguments: Luid1, Luid2 - Supply pointers to the two LUID values to compare. Return Value: BOOLEAN - TRUE if the value of Luid1 is equal to Luid2, and FALSE otherwise. --*/ { LUID UNALIGNED * TempLuid1; LUID UNALIGNED * TempLuid2; RTL_PAGED_CODE(); return((Luid1->HighPart == Luid2->HighPart) && (Luid1->LowPart == Luid2->LowPart)); }

NTSYSAPI BOOLEAN NTAPI RtlEqualLuid (  PLUID  Luid1, PLUID  Luid2 )

BOOLEAN RtlEqualPrefixSid (  IN PSID  Sid1, IN PSID  Sid2 )

Definition at line 924 of file sertl.c. References FALSE, Index, RTL_PAGED_CODE, and TRUE. Referenced by RtlpCompareKnownAces(), RtlpCompareKnownObjectAces(), and RtlpCopyEffectiveAce(). : This procedure tests two SID prefix values for equality. An SID prefix is the entire SID except for the last sub-authority value. Arguments: Sid1, Sid2 - Supply pointers to the two SID values to compare. The SID structures are assumed to be valid. Return Value: BOOLEAN - TRUE if the prefix value of Sid1 is equal to Sid2, and FALSE otherwise. --*/ { LONG Index; // // Typecast to the opaque SID structures. // SID *ISid1 = Sid1; SID *ISid2 = Sid2; RTL_PAGED_CODE(); // // Make sure they are the same revision // if (ISid1->Revision == ISid2->Revision ) { // // Compare IdentifierAuthority values // if ( (ISid1->IdentifierAuthority.Value[0] == ISid2->IdentifierAuthority.Value[0]) && (ISid1->IdentifierAuthority.Value[1]== ISid2->IdentifierAuthority.Value[1]) && (ISid1->IdentifierAuthority.Value[2] == ISid2->IdentifierAuthority.Value[2]) && (ISid1->IdentifierAuthority.Value[3] == ISid2->IdentifierAuthority.Value[3]) && (ISid1->IdentifierAuthority.Value[4] == ISid2->IdentifierAuthority.Value[4]) && (ISid1->IdentifierAuthority.Value[5] == ISid2->IdentifierAuthority.Value[5]) ) { // // Compare SubAuthorityCount values // if (ISid1->SubAuthorityCount == ISid2->SubAuthorityCount) { if (ISid1->SubAuthorityCount == 0) { return TRUE; } Index = 0; while (Index < (ISid1->SubAuthorityCount - 1)) { if ((ISid1->SubAuthority[Index]) != (ISid2->SubAuthority[Index])) { // // Found some SubAuthority values that weren't equal. // return FALSE; } Index += 1; } // // All SubAuthority values are equal. // return TRUE; } } } // // Either the Revision, SubAuthorityCount, or IdentifierAuthority values // weren't equal. // return FALSE; }

BOOLEAN RtlEqualSid (  IN PSID  Sid1, IN PSID  Sid2 )

Definition at line 871 of file sertl.c. References FALSE, RTL_PAGED_CODE, RtlSubAuthorityCountSid(), and SeLengthSid. Referenced by IopCreateDefaultDeviceSecurityDescriptor(), IopOpenDeviceParametersSubkey(), NtSecureConnectPort(), NtSetInformationToken(), RtlpCompareKnownAces(), RtlpCompareKnownObjectAces(), RtlpValidOwnerSubjectContext(), SeFastTraverseCheck(), SepAdjustGroups(), SepAdtPrivilegeObjectAuditAlarm(), SepCreateToken(), SepIdAssignableAsGroup(), SepMakeTokenEffectiveOnly(), SepRemoveDisabledGroupsAndPrivileges(), SePrivilegedServiceAuditAlarm(), SepSidInSidAndAttributes(), SepSidInToken(), SepSidInTokenEx(), SepSidTranslation(), SepValidOwnerSubjectContext(), SidTranslation(), TestpCompareDuplicateToken(), TestSeAclRtl(), TestSeSid(), TestTokenQuery(), and TestTokenSet(). : This procedure tests two SID values for equality. Arguments: Sid1, Sid2 - Supply pointers to the two SID values to compare. The SID structures are assumed to be valid. Return Value: BOOLEAN - TRUE if the value of Sid1 is equal to Sid2, and FALSE otherwise. --*/ { ULONG SidLength; RTL_PAGED_CODE(); // // Make sure they are the same revision // if ( ((SID *)Sid1)->Revision == ((SID *)Sid2)->Revision ) { // // Check the SubAuthorityCount first, because it's fast and // can help us exit faster. // if ( *RtlSubAuthorityCountSid( Sid1 ) == *RtlSubAuthorityCountSid( Sid2 )) { SidLength = SeLengthSid( Sid1 ); return( (BOOLEAN)RtlEqualMemory( Sid1, Sid2, SidLength) ); } } return( FALSE ); }

VOID RtlEraseUnicodeString (  PUNICODE_STRING  String  )

Definition at line 596 of file sertl.c. References NULL, RTL_PAGED_CODE, and String. : This function scrubs the passed string by over-writing all characters in the string. The entire string (i.e., MaximumLength) is erased, not just the current length. Argumen ts: String - The string to be erased. Return Value: None - Nothing can really go wrong unless the caller passes bogus parameters. In this case, the caller can catch the access violation. --*/ { RTL_PAGED_CODE(); if ((String->Buffer == NULL) || (String->MaximumLength == 0)) { return; } RtlZeroMemory( (PVOID)String->Buffer, (ULONG)String->MaximumLength ); String->Length = 0; return; }

PVOID RtlFreeSid (  IN PSID  Sid  )

Definition at line 1218 of file sertl.c. References NULL, RTL_PAGED_CODE, and RtlFreeHeap. Referenced by CreateBSMEventSD(), CsrpConnectToServer(), and InitializeRestrictedStuff(). 01224 : 01225 01226 This function is used to free a SID previously allocated using 01227 RtlAllocateAndInitializeSid(). 01228 01229 THIS ROUTINE IS CURRENTLY NOT CALLABLE FROM KERNEL MODE. 01230 01231 Arguments: 01232 01233 Sid - Pointer to the SID to free. 01234 01235 Return Value: 01236 01237 None. 01238 01239 01240 --*/ 01241 { 01242 RTL_PAGED_CODE(); 01243 01244 if (RtlFreeHeap( RtlProcessHeap(), 0, Sid )) 01245 return NULL; 01246 else 01247 return Sid; 01248 } #endif // NTOS_KERNEL_RUNTIME

NTSTATUS RtlGetControlSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, OUT PSECURITY_DESCRIPTOR_CONTROL  Control, OUT PULONG  Revision )

Definition at line 2415 of file sertl.c. References RTL_PAGED_CODE. Referenced by TestSeSecurityDescriptor(). : This procedure retrieves the control information from a security descriptor. Arguments: SecurityDescriptor - Supplies the security descriptor. Control - Receives the control information. Revision - Receives the revision of the security descriptor. This value will always be returned, even if an error is returned by this routine. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision of the security descriptor is not known to the routine. It may be a newer revision than the routine knows about. --*/ { RTL_PAGED_CODE(); // // Always return the revision value - even if this isn't a valid // security descriptor // *Revision = ((SECURITY_DESCRIPTOR *)SecurityDescriptor)->Revision; if ( ((SECURITY_DESCRIPTOR *)SecurityDescriptor)->Revision != SECURITY_DESCRIPTOR_REVISION ) { return STATUS_UNKNOWN_REVISION; } *Control = ((SECURITY_DESCRIPTOR *)SecurityDescriptor)->Control; return STATUS_SUCCESS; }

NTSTATUS RtlGetDaclSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, OUT PBOOLEAN  DaclPresent, OUT PACL *  Dacl, OUT PBOOLEAN  DaclDefaulted )

Definition at line 2665 of file sertl.c. References Dacl, and RTL_PAGED_CODE. Referenced by DumpSecurity(), IopChangeDeviceObjectFromRegistryProperties(), IopOpenDeviceParametersSubkey(), IopSetSecurityObjectFromRegistry(), ObpFreeDosDevicesProtection(), ObpHashSecurityDescriptor(), and TestSeSecurityDescriptor(). : This procedure retrieves the discretionary ACL information of a security descriptor. Arguments: SecurityDescriptor - Supplies the security descriptor. DaclPresent - If TRUE, indicates that the security descriptor does contain a discretionary ACL. In this case, the remaining OUT parameters will receive valid values. Otherwise, the security descriptor does not contain a discretionary ACL and the remaining OUT parameters will not receive valid values. Dacl - This value is returned only if the value returned for the DaclPresent flag is TRUE. In this case, the Dacl parameter receives the address of the security descriptor's discretionary ACL. If this value is returned as null, then the security descriptor has a null discretionary ACL. DaclDefaulted - This value is returned only if the value returned for the DaclPresent flag is TRUE. In this case, the DaclDefaulted parameter receives the value of the security descriptor's DaclDefaulted control flag. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision of the security descriptor is not known to the routine. It may be a newer revision than the routine knows about. --*/ { // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = SecurityDescriptor; RTL_PAGED_CODE(); // // Check the revision // if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return STATUS_UNKNOWN_REVISION; } // // Assign the DaclPresent flag value // *DaclPresent = RtlpAreControlBitsSet( ISecurityDescriptor, SE_DACL_PRESENT ); if (*DaclPresent) { // // Assign the ACL address. // *Dacl = RtlpDaclAddrSecurityDescriptor(ISecurityDescriptor); // // Assign DaclDefaulted flag. // *DaclDefaulted = RtlpAreControlBitsSet( ISecurityDescriptor, SE_DACL_DEFAULTED ); } return STATUS_SUCCESS; }

NTSTATUS RtlGetGroupSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, OUT PSID *  Group, OUT PBOOLEAN  GroupDefaulted )

Definition at line 3232 of file sertl.c. References Group, and RTL_PAGED_CODE. Referenced by IopChangeDeviceObjectFromRegistryProperties(), IopSetSecurityObjectFromRegistry(), ObpHashSecurityDescriptor(), and TestSeSecurityDescriptor(). : This procedure retrieves the primary group information of a security descriptor. Arguments: SecurityDescriptor - Supplies the security descriptor. Group - Receives a pointer to the primary group SID. If the security descriptor does not currently contain a primary group, then this value will be returned as null. In this case, the remaining OUT parameters are not given valid return values. Otherwise, this parameter points to an SID and the remaining OUT parameters are provided valid return values. GroupDefaulted - This value is returned only if the value returned for the Group parameter is not null. In this case, the GroupDefaulted parameter receives the value of the security descriptor's GroupDefaulted control flag. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision of the security descriptor is not known to the routine. It may be a newer revision than the routine knows about. --*/ { // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = (SECURITY_DESCRIPTOR *)SecurityDescriptor; RTL_PAGED_CODE(); // // Check the revision // if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return STATUS_UNKNOWN_REVISION; } // // Return the Group field value. // *Group = RtlpGroupAddrSecurityDescriptor(ISecurityDescriptor); // // Return the GroupDefaulted flag value. // *GroupDefaulted = RtlpAreControlBitsSet( ISecurityDescriptor, SE_GROUP_DEFAULTED ); return STATUS_SUCCESS; }

NTSTATUS RtlGetOwnerSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, OUT PSID *  Owner, OUT PBOOLEAN  OwnerDefaulted )

Definition at line 3059 of file sertl.c. References Owner, and RTL_PAGED_CODE. Referenced by IopChangeDeviceObjectFromRegistryProperties(), IopSetSecurityObjectFromRegistry(), ObpHashSecurityDescriptor(), and TestSeSecurityDescriptor(). : This procedure retrieves the owner information of a security descriptor. Arguments: SecurityDescriptor - Supplies the security descriptor. Owner - Receives a pointer to the owner SID. If the security descriptor does not currently contain an owner, then this value will be returned as null. In this case, the remaining OUT parameters are not given valid return values. Otherwise, this parameter points to an SID and the remaining OUT parameters are provided valid return values. OwnerDefaulted - This value is returned only if the value returned for the Owner parameter is not null. In this case, the OwnerDefaulted parameter receives the value of the security descriptor's OwnerDefaulted control flag. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision of the security descriptor is not known to the routine. It may be a newer revision than the routine knows about. --*/ { // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = SecurityDescriptor; RTL_PAGED_CODE(); // // Check the revision // if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return STATUS_UNKNOWN_REVISION; } // // Return the Owner field value. // *Owner = RtlpOwnerAddrSecurityDescriptor(ISecurityDescriptor); // // Return the OwnerDefaulted flag value. // *OwnerDefaulted = RtlpAreControlBitsSet( ISecurityDescriptor, SE_OWNER_DEFAULTED ); return STATUS_SUCCESS; }

NTSTATUS RtlGetSaclSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, OUT PBOOLEAN  SaclPresent, OUT PACL *  Sacl, OUT PBOOLEAN  SaclDefaulted )

Definition at line 2871 of file sertl.c. References RTL_PAGED_CODE. Referenced by IopChangeDeviceObjectFromRegistryProperties(), IopSetSecurityObjectFromRegistry(), ObpHashSecurityDescriptor(), and TestSeSecurityDescriptor(). : This procedure retrieves the system ACL information of a security descriptor. Arguments: SecurityDescriptor - Supplies the security descriptor. SaclPresent - If TRUE, indicates that the security descriptor does contain a system ACL. In this case, the remaining OUT parameters will receive valid values. Otherwise, the security descriptor does not contain a system ACL and the remaining OUT parameters will not receive valid values. Sacl - This value is returned only if the value returned for the SaclPresent flag is TRUE. In this case, the Sacl parameter receives the address of the security descriptor's system ACL. If this value is returned as null, then the security descriptor has a null system ACL. SaclDefaulted - This value is returned only if the value returned for the SaclPresent flag is TRUE. In this case, the SaclDefaulted parameter receives the value of the security descriptor's SaclDefaulted control flag. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision of the security descriptor is not known to the routine. It may be a newer revision than the routine knows about. --*/ { // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = SecurityDescriptor; RTL_PAGED_CODE(); // // Check the revision // if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return STATUS_UNKNOWN_REVISION; } // // Assign the SaclPresent flag value // *SaclPresent = RtlpAreControlBitsSet( ISecurityDescriptor, SE_SACL_PRESENT ); if (*SaclPresent) { // // Assign the ACL address. // *Sacl = RtlpSaclAddrSecurityDescriptor(ISecurityDescriptor); // // Assign SaclDefaulted flag. // *SaclDefaulted = RtlpAreControlBitsSet( ISecurityDescriptor, SE_SACL_DEFAULTED ); } return STATUS_SUCCESS; }

BOOLEAN RtlGetSecurityDescriptorRMControl (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, OUT PUCHAR  RMControl )

Definition at line 11323 of file sertl.c. References FALSE, and TRUE. : This procedure returns the RM Control flags from a SecurityDescriptor if SE_RM_CONTROL_VALID flags is present in the control field. Arguments: SecurityDescriptor - Pointer to the SECURITY_DESCRIPTOR structure RMControl - Returns the flags in the SecurityDescriptor if SE_RM_CONTROL_VALID is set in the control bits of the SecurityDescriptor. Return Value: BOOLEAN - TRUE if SE_RM_CONTROL_VALID is set in the Control bits of the SecurityDescriptor. Note: Parameter validation has already been done in Advapi. --*/ { PISECURITY_DESCRIPTOR ISecurityDescriptor = (PISECURITY_DESCRIPTOR) SecurityDescriptor; if (!(ISecurityDescriptor->Control & SE_RM_CONTROL_VALID)) { *RMControl = 0; return FALSE; } *RMControl = ISecurityDescriptor->Sbz1; return TRUE; }

PSID_IDENTIFIER_AUTHORITY RtlIdentifierAuthoritySid (  IN PSID  Sid  )

Definition at line 1253 of file sertl.c. References RTL_PAGED_CODE. Referenced by DisplayAccountSid(). 01258 : 01259 01260 This function returns the address of an SID's IdentifierAuthority field. 01261 01262 Arguments: 01263 01264 Sid - Pointer to the SID data structure. 01265 01266 Return Value: 01267 01268 01269 --*/ 01270 { 01271 PISID ISid; 01272 01273 RTL_PAGED_CODE(); 01274 01275 // 01276 // Typecast to the opaque SID 01277 // 01278 01279 ISid = (PISID)Sid; 01280 01281 return &(ISid->IdentifierAuthority); 01282 01283 }

NTSTATUS RtlImpersonateSelf (  IN SECURITY_IMPERSONATION_LEVEL  ImpersonationLevel  )

Definition at line 3446 of file sertl.c. References FALSE, NT_SUCCESS, NtClose(), NtDuplicateToken(), NtOpenProcessToken(), NtSetInformationThread(), NTSTATUS(), NULL, ObjectAttributes, RTL_PAGED_CODE, and Status. : This routine may be used to obtain an Impersonation token representing your own process's context. This may be useful for enabling a privilege for a single thread rather than for the entire process; or changing the default DACL for a single thread. The token is assigned to the callers thread. Arguments: ImpersonationLevel - The level to make the impersonation token. Return Value: STATUS_SUCCESS - The thread is now impersonating the calling process. Other - Status values returned by: NtOpenProcessToken() NtDuplicateToken() NtSetInformationThread() --*/ { NTSTATUS Status, IgnoreStatus; HANDLE Token1, Token2; OBJECT_ATTRIBUTES ObjectAttributes; SECURITY_QUALITY_OF_SERVICE Qos; RTL_PAGED_CODE(); InitializeObjectAttributes(&ObjectAttributes, NULL, 0, 0, NULL); Qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE); Qos.ImpersonationLevel = ImpersonationLevel; Qos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING; Qos.EffectiveOnly = FALSE; ObjectAttributes.SecurityQualityOfService = &Qos; Status = NtOpenProcessToken( NtCurrentProcess(), TOKEN_DUPLICATE, &Token1 ); if (NT_SUCCESS(Status)) { Status = NtDuplicateToken( Token1, TOKEN_IMPERSONATE, &ObjectAttributes, FALSE, //EffectiveOnly TokenImpersonation, &Token2 ); if (NT_SUCCESS(Status)) { Status = NtSetInformationThread( NtCurrentThread(), ThreadImpersonationToken, &Token2, sizeof(HANDLE) ); IgnoreStatus = NtClose( Token2 ); } IgnoreStatus = NtClose( Token1 ); } return(Status); }

NTSTATUS RtlInitializeSid (  IN PSID  Sid, IN PSID_IDENTIFIER_AUTHORITY  IdentifierAuthority, IN UCHAR  SubAuthorityCount )

Definition at line 1166 of file sertl.c. References RTL_PAGED_CODE. Referenced by CmpHiveRootSecurityDescriptor(), GenerateDescriptor(), InitVars(), RtlDefaultNpAcl(), RtlpCompareKnownAces(), RtlpCompareKnownObjectAces(), RtlpConvertAclToAutoInherit(), RtlpCopyEffectiveAce(), SepVariableInitialization(), TestSeAclRtl(), TestTokenSet(), and TSeVariableInitialization(). : This function initializes an SID data structure. It does not, however, set the sub-authority values. This must be done separately. Arguments: Sid - Pointer to the SID data structure to initialize. IdentifierAuthority - Pointer to the Identifier Authority value to set in the SID. SubAuthorityCount - The number of sub-authorities that will be placed in the SID (a separate action). Return Value: --*/ { PISID ISid; RTL_PAGED_CODE(); // // Typecast to the opaque SID // ISid = (PISID)Sid; if ( SubAuthorityCount > SID_MAX_SUB_AUTHORITIES ) { return( STATUS_INVALID_PARAMETER ); } ISid->SubAuthorityCount = (UCHAR)SubAuthorityCount; ISid->Revision = 1; ISid->IdentifierAuthority = *IdentifierAuthority; return( STATUS_SUCCESS ); }

ULONG RtlLengthRequiredSid (  IN ULONG  SubAuthorityCount  )

Definition at line 1030 of file sertl.c. References L, and RTL_PAGED_CODE. Referenced by CmpHiveRootSecurityDescriptor(), GenerateDescriptor(), InitVars(), NtQueryQuotaInformationFile(), RtlAllocateAndInitializeSid(), RtlDefaultNpAcl(), RtlpCompareKnownAces(), RtlpCompareKnownObjectAces(), RtlpConvertAclToAutoInherit(), RtlpCopyEffectiveAce(), RtlpGenerateInheritedAce(), RtlpSetSecurityObject(), SeCaptureSecurityDescriptor(), SeCaptureSid(), SeCaptureSidAndAttributesArray(), SepCreateToken(), SepVariableInitialization(), TestSeAclRtl(), TestSeSid(), TestTokenSet(), and TSeVariableInitialization(). : This routine returns the length, in bytes, required to store an SID with the specified number of Sub-Authorities. Arguments: SubAuthorityCount - The number of sub-authorities to be stored in the SID. Return Value: ULONG - The length, in bytes, required to store the SID. --*/ { RTL_PAGED_CODE(); return (8L + (4 * SubAuthorityCount)); }

ULONG RtlLengthSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor  )

Definition at line 2165 of file sertl.c. References NULL, RTL_PAGED_CODE, and SeLengthSid. Referenced by CmpAssignSecurityDescriptor(), CmpFindMatchingDescriptorCell(), CmpSetSecurityDescriptorInfo(), EhpAttachSecurity(), NtQueryObject(), ObpCompareSecurityDescriptors(), ObpCreateCacheEntry(), and TestSeSecurityDescriptor(). : This routine returns the length, in bytes, necessary to capture a structurally valid SECURITY_DESCRIPTOR. The length includes the length of all associated data structures (like SIDs and ACLs). The length also takes into account the alignment requirements of each component. The minimum length of a security descriptor (one which has no associated SIDs or ACLs) is SECURITY_DESCRIPTOR_MIN_LENGTH. Arguments: SecurityDescriptor - Points to the SECURITY_DESCRIPTOR whose length is to be returned. The SECURITY_DESCRIPTOR's structure is assumed to be valid. Return Value: ULONG - The length, in bytes, of the SECURITY_DESCRIPTOR. --*/ { ULONG sum; PVOID Temp; // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = (SECURITY_DESCRIPTOR *)SecurityDescriptor; RTL_PAGED_CODE(); // // The length is the sum of the following: // // SECURITY_DESCRIPTOR_MIN_LENGTH (or sizeof(SECURITY_DESCRIPTOR)) // length of Owner SID (if present) // length of Group SID (if present) // length of Discretionary ACL (if present and non-null) // length of System ACL (if present and non-null) // sum = ISecurityDescriptor->Control & SE_SELF_RELATIVE ? sizeof(SECURITY_DESCRIPTOR_RELATIVE) : sizeof(SECURITY_DESCRIPTOR); // // Add in length of Owner SID // Temp = RtlpOwnerAddrSecurityDescriptor(ISecurityDescriptor); if (Temp != NULL) { sum += LongAlignSize(SeLengthSid(Temp)); } // // Add in length of Group SID // Temp = RtlpGroupAddrSecurityDescriptor(ISecurityDescriptor); if (Temp != NULL) { sum += LongAlignSize(SeLengthSid(Temp)); } // // Add in used length of Discretionary ACL // Temp = RtlpDaclAddrSecurityDescriptor(ISecurityDescriptor); if ( Temp != NULL ) { sum += LongAlignSize(((PACL) Temp)->AclSize ); } // // Add in used length of System Acl // Temp = RtlpSaclAddrSecurityDescriptor(ISecurityDescriptor); if ( Temp != NULL ) { sum += LongAlignSize(((PACL) Temp)->AclSize ); } return sum; }

ULONG RtlLengthSid (  IN PSID  Sid  )

Definition at line 1350 of file sertl.c. References RTL_PAGED_CODE, and SeLengthSid. Referenced by _GetUserObjectInformation(), AllocAce(), CreateBSMEventSD(), GetSiteSidFromToken(), IoCheckQuotaBufferValidity(), IopCheckGetQuotaBufferValidity(), IopInitializePlugPlayServices(), IopOpenDeviceParametersSubkey(), ObpGetDosDevicesProtection(), ObpHashSecurityDescriptor(), RtlCreateAndSetSD(), RtlDefaultNpAcl(), RtlpInitializeAllowedAce(), RtlpInitializeAuditAce(), RtlpInitializeDeniedAce(), SeCaptureSidAndAttributesArray(), and xxxCreateWindowStation(). : This routine returns the length, in bytes, of a structurally valid SID. Arguments: Sid - Points to the SID whose length is to be returned. The SID's structure is assumed to be valid. Return Value: ULONG - The length, in bytes, of the SID. --*/ { RTL_PAGED_CODE(); return SeLengthSid(Sid); }

NTSTATUS RtlLengthSidAsUnicodeString (  PSID  Sid, PULONG  StringLength )

Definition at line 1532 of file sertl.c. References RTL_PAGED_CODE, RtlValidSid(), StringLength(), and TRUE. Referenced by RtlFormatCurrentUserKeyPath(). : This function returns the maximum length of the string needed to represent the SID supplied. The actual string may be shorter, but this is intended to be a quick calculation. Arguments: Sid - Supplies the SID that is to be converted to unicode. StringLength - Receives the max length required in bytes. Return Value: SUCCESS - The conversion was successful STATUS_INVALID_SID - The sid provided does not have a valid structure, or has too many sub-authorities (more than SID_MAX_SUB_AUTHORITIES). --*/ { ULONG i ; PISID iSid = (PISID)Sid; // pointer to opaque structure RTL_PAGED_CODE(); if ( RtlValidSid( Sid ) != TRUE) { return(STATUS_INVALID_SID); } // // if the SID's IA value has 5 or 6 significant bytes, the // representation will be in hex, with a 0x preceding. Otherwise // it will be in decimal, with at most 10 characters. // if ( (iSid->IdentifierAuthority.Value[0] != 0) || (iSid->IdentifierAuthority.Value[1] != 0) ) { i = 14 ; // 0x665544332211 } else { i = 10 ; // 4294967295 is the max ulong, at 10 chars } i += 4 ; // room for the S-1- // // for each sub authority, it is a max of 10 chars (for a ulong), // plus the - separator // i += 11 * iSid->SubAuthorityCount ; *StringLength = i * sizeof( WCHAR ); return STATUS_SUCCESS ; }

ULONG RtlLengthUsedSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor  )

Definition at line 2265 of file sertl.c. References NULL, RTL_PAGED_CODE, RtlQueryInformationAcl(), and SeLengthSid. : This routine returns the length, in bytes, in use in a structurally valid SECURITY_DESCRIPTOR. This is the number of bytes necessary to capture the security descriptor, which may be less the the current actual length of the security descriptor (RtlLengthSecurityDescriptor() is used to retrieve the actual length). Notice that the used length and actual length may differ if either the SACL or DACL include padding bytes. The length includes the length of all associated data structures (like SIDs and ACLs). The length also takes into account the alignment requirements of each component. The minimum length of a security descriptor (one which has no associated SIDs or ACLs) is SECURITY_DESCRIPTOR_MIN_LENGTH. Arguments: SecurityDescriptor - Points to the SECURITY_DESCRIPTOR whose used length is to be returned. The SECURITY_DESCRIPTOR's structure is assumed to be valid. Return Value: ULONG - Number of bytes of the SECURITY_DESCRIPTOR that are in use. --*/ { ULONG sum; ACL_SIZE_INFORMATION AclSize; PVOID Temp; // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = (SECURITY_DESCRIPTOR *)SecurityDescriptor; RTL_PAGED_CODE(); // // The length is the sum of the following: // // SECURITY_DESCRIPTOR_MIN_LENGTH (or sizeof(SECURITY_DESCRIPTOR)) // length of Owner SID (if present) // length of Group SID (if present) // length of Discretionary ACL (if present and non-null) // length of System ACL (if present and non-null) // sum = ISecurityDescriptor->Control & SE_SELF_RELATIVE ? sizeof(SECURITY_DESCRIPTOR_RELATIVE) : sizeof(SECURITY_DESCRIPTOR); // // Add in length of Owner SID // Temp = RtlpOwnerAddrSecurityDescriptor(ISecurityDescriptor); if (Temp != NULL) { sum += LongAlignSize(SeLengthSid(Temp)); } // // Add in length of Group SID // Temp = RtlpGroupAddrSecurityDescriptor(ISecurityDescriptor); if (Temp != NULL) { sum += LongAlignSize(SeLengthSid(Temp)); } // // Add in used length of Discretionary ACL // Temp = RtlpDaclAddrSecurityDescriptor(ISecurityDescriptor); if ( Temp != NULL ) { RtlQueryInformationAcl( Temp, (PVOID)&AclSize, sizeof(AclSize), AclSizeInformation ); sum += LongAlignSize(AclSize.AclBytesInUse); } // // Add in used length of System Acl // Temp = RtlpSaclAddrSecurityDescriptor(ISecurityDescriptor); if ( Temp != NULL ) { RtlQueryInformationAcl( Temp, (PVOID)&AclSize, sizeof(AclSize), AclSizeInformation ); sum += LongAlignSize(AclSize.AclBytesInUse); } return sum; }

VOID RtlMapGenericMask (  IN OUT PACCESS_MASK  AccessMask, IN PGENERIC_MAPPING  GenericMapping )

Definition at line 3381 of file sertl.c. References RTL_PAGED_CODE. Referenced by IoCheckDesiredAccess(), IopParseDevice(), NtDuplicateObject(), ObpIncrementHandleCount(), ObpIncrementUnnamedHandleCount(), RtlNewSecurityGrantedAccess(), RtlpConvertAclToAutoInherit(), SeCreateAccessState(), SeOpenObjectAuditAlarm(), SeOpenObjectForDeleteAuditAlarm(), and xxxCreateDesktop2(). : This routine maps all generic accesses in the provided access mask to specific and standard accesses according to the provided GenericMapping. Arguments: AccessMask - Points to the access mask to be mapped. GenericMapping - The mapping of generic to specific and standard access types. Return Value: None. --*/ { RTL_PAGED_CODE(); // // // // Make sure the pointer is properly aligned // // // // ASSERT( ((ULONG)AccessMask >> 2) << 2 == (ULONG)AccessMask ); if (*AccessMask & GENERIC_READ) { *AccessMask |= GenericMapping->GenericRead; } if (*AccessMask & GENERIC_WRITE) { *AccessMask |= GenericMapping->GenericWrite; } if (*AccessMask & GENERIC_EXECUTE) { *AccessMask |= GenericMapping->GenericExecute; } if (*AccessMask & GENERIC_ALL) { *AccessMask |= GenericMapping->GenericAll; } // // Now clear the generic flags // *AccessMask &= ~(GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL); return; }

VOID RtlpApplyAclToObject (  IN PACL  Acl, IN PGENERIC_MAPPING  GenericMapping )

Definition at line 3812 of file sertl.c. References FirstAce, NextAce, NULL, and RTL_PAGED_CODE. Referenced by RtlpNewSecurityObject(), and RtlpSetSecurityObject(). : This is a private routine that maps Access Masks of an ACL so that they are applicable to the object type the ACL is being applied to. Only known DSA ACEs are mapped. Unknown ACE types are ignored. Only access types in the GenericAll mapping for the target object type will be non-zero upon return. Arguments: Acl - Supplies the acl being applied. GenericMapping - Specifies the generic mapping to use. Return Value: None. --*/ { ULONG i; PACE_HEADER Ace; RTL_PAGED_CODE(); // // First check if the acl is null // if (Acl == NULL) { return; } // // Now walk the ACL, mapping each ACE as we go. // for (i = 0, Ace = FirstAce(Acl); i < Acl->AceCount; i += 1, Ace = NextAce(Ace)) { if (IsMSAceType( Ace )) { RtlApplyAceToObject( Ace, GenericMapping ); } } return; }

BOOLEAN RtlpCompareAces (  IN PKNOWN_ACE  InheritedAce, IN PKNOWN_ACE  ChildAce, IN PSID  OwnerSid, IN PSID  GroupSid )

Definition at line 6972 of file sertl.c. References FALSE, RtlpCompareKnownAces(), and RtlpCompareKnownObjectAces(). Referenced by RtlpConvertAclToAutoInherit(), and RtlpIsDuplicateAce(). : Compare two aces to see if they are "substantially" the same. Arguments: InheritedAce - Computed ACE as inherited from DirectoryAcl. ChildAce - The current acl on the object. This ACL must be a revision 2 ACL. ObjectType - GUID of the object type being created. If the object being created has no GUID associated with it, then this argument is specified as NULL. OwnerSid - Specifies the owner Sid to use. If not specified, the owner sid is not treated as special. GroupSid - Specifies the group SID to use. If not specified, the group sid is not treated as special. Return Value: TRUE - The ACEs are substantially the same. FALSE - The ACEs are not substantially the same. --*/ { BOOLEAN AcesCompare = FALSE; if (IsObjectAceType(InheritedAce) && IsObjectAceType(ChildAce)) { AcesCompare = RtlpCompareKnownObjectAces( (PKNOWN_OBJECT_ACE)InheritedAce, (PKNOWN_OBJECT_ACE)ChildAce, OwnerSid, GroupSid ); } else { if (!IsObjectAceType(InheritedAce) && !IsObjectAceType(ChildAce)) { AcesCompare = RtlpCompareKnownAces( InheritedAce, ChildAce, OwnerSid, GroupSid ); } } return( AcesCompare ); }

BOOLEAN RtlpCompareKnownAces (  IN PKNOWN_ACE  InheritedAce, IN PKNOWN_ACE  ChildAce, IN PSID OwnerSid  OPTIONAL, IN PSID GroupSid  OPTIONAL )

Definition at line 7033 of file sertl.c. References AceFlagsInAce, ASSERT, CREATOR_SID_SIZE, CreatorSid, EFFECTIVE_ACE, FALSE, NTSTATUS(), NULL, RTL_PAGED_CODE, RtlBaseAceType, RtlEqualPrefixSid(), RtlEqualSid(), RtlInitializeSid(), RtlIsSystemAceType, RtlLengthRequiredSid(), RtlpVerboseConvert, Status, and TRUE. Referenced by RtlpCompareAces(). : Compare two aces to see if they are "substantially" the same. Arguments: InheritedAce - Computed ACE as inherited from DirectoryAcl. ChildAce - The current acl on the object. This ACL must be a revision 2 ACL. OwnerSid - Specifies the owner Sid to use. If not specified, the owner sid is not treated as special. GroupSid - Specifies the group SID to use. If not specified, the group sid is not treated as special. Return Value: TRUE - The ACEs are substantially the same. FALSE - The ACEs are not substantially the same. --*/ { NTSTATUS Status; ACE_HEADER volatile *InheritedAceHdr = &InheritedAce->Header; RTL_PAGED_CODE(); ASSERT(!IsObjectAceType(InheritedAce)); ASSERT(!IsObjectAceType(ChildAce)); // // If the Ace types are different, // we don't match. // if ( RtlBaseAceType[ChildAce->Header.AceType] != RtlBaseAceType[InheritedAceHdr->AceType] ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("AceType mismatch")); } #endif // DBG return FALSE; } // // If this is a system ACE, // ensure the SUCCESS/FAILURE flags match. // if ( RtlIsSystemAceType[ChildAce->Header.AceType] ) { if ( (ChildAce->Header.AceFlags & (SUCCESSFUL_ACCESS_ACE_FLAG|FAILED_ACCESS_ACE_FLAG)) != (InheritedAceHdr->AceFlags & (SUCCESSFUL_ACCESS_ACE_FLAG|FAILED_ACCESS_ACE_FLAG)) ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("System ace success/fail mismatch")); } #endif // DBG return FALSE; } } // // If the SID of the inherited ACE doesn't match, // we don't match. // if ( !RtlEqualSid( (PSID)&ChildAce->SidStart, (PSID)&InheritedAce->SidStart )) { // // The inheritance algorithm only does SID mapping when building the effective // ace. So, we only check for a mapped SID if the child ACE is an effective ACE. // if ( AceFlagsInAce(ChildAce) != EFFECTIVE_ACE ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch")); } #endif // DBG return FALSE; } // // In the case of CreatorOwner and CreatorGroup, the SIDs don't have to // exactly match. When the InheritedAce was generated, care was taken // to NOT map these sids. The SID may (or may not) have been mapped in // the ChildAce. We want to compare equal in both cases. // // If the InheritedAce contains a CreatorOwner/Group SID, // do the another comparison of the SID in the child ACE with the // real owner/group from the child security descriptor. // if ( OwnerSid != NULL || GroupSid != NULL ) { SID_IDENTIFIER_AUTHORITY CreatorSidAuthority = SECURITY_CREATOR_SID_AUTHORITY; ULONG CreatorSid[CREATOR_SID_SIZE]; // // Allocate and initialize the universal SIDs we're going to need // to look for inheritable ACEs. // ASSERT(RtlLengthRequiredSid( 1 ) == CREATOR_SID_SIZE); RtlInitializeSid( (PSID)CreatorSid, &CreatorSidAuthority, 1 ); *(RtlpSubAuthoritySid( (PSID)CreatorSid, 0 )) = SECURITY_CREATOR_OWNER_RID; if (RtlEqualPrefixSid ( (PSID)&InheritedAce->SidStart, CreatorSid )) { ULONG Rid; Rid = *RtlpSubAuthoritySid( (PSID)&InheritedAce->SidStart, 0 ); switch (Rid) { case SECURITY_CREATOR_OWNER_RID: if ( OwnerSid == NULL || !RtlEqualSid( (PSID)&ChildAce->SidStart, OwnerSid )) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch (Creator Owner)")); } #endif // DBG return FALSE; } break; case SECURITY_CREATOR_GROUP_RID: if ( GroupSid == NULL || !RtlEqualSid( (PSID)&ChildAce->SidStart, GroupSid )) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch (Creator Group)")); } #endif // DBG return FALSE; } break; default: #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch (Creator)")); } #endif // DBG return FALSE; } } else { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch")); } #endif // DBG return FALSE; } } else { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch")); } #endif // DBG return FALSE; } } return TRUE; }

BOOLEAN RtlpCompareKnownObjectAces (  IN PKNOWN_OBJECT_ACE  InheritedAce, IN PKNOWN_OBJECT_ACE  ChildAce, IN PSID OwnerSid  OPTIONAL, IN PSID GroupSid  OPTIONAL )

Definition at line 7209 of file sertl.c. References AceFlagsInAce, ASSERT, CREATOR_SID_SIZE, CreatorSid, EFFECTIVE_ACE, FALSE, NTSTATUS(), NULL, RTL_PAGED_CODE, RtlBaseAceType, RtlEqualPrefixSid(), RtlEqualSid(), RtlInitializeSid(), RtlIsSystemAceType, RtlLengthRequiredSid(), RtlpVerboseConvert, Status, and TRUE. Referenced by RtlpCompareAces(). : Compare two aces to see if they are "substantially" the same. Arguments: InheritedAce - Computed ACE as inherited from DirectoryAcl. ChildAce - The current acl on the object. This ACL must be a revision 2 ACL. ObjectType - GUID of the object type being created. If the object being created has no GUID associated with it, then this argument is specified as NULL. OwnerSid - Specifies the owner Sid to use. If not specified, the owner sid is not treated as special. GroupSid - Specifies the group SID to use. If not specified, the group sid is not treated as special. Return Value: TRUE - The ACEs are substantially the same. FALSE - The ACEs are not substantially the same. --*/ { NTSTATUS Status; BOOLEAN DoingObjectAces; GUID *ChildObjectGuid; GUID *InhObjectGuid; GUID *ChildInheritedObjectGuid; GUID *InhInheritedObjectGuid; ACE_HEADER volatile *InheritedAceHdr = &InheritedAce->Header; RTL_PAGED_CODE(); ASSERT(IsObjectAceType(InheritedAce)); ASSERT(IsObjectAceType(ChildAce)); // // If the Ace types are different, // we don't match. // if ( RtlBaseAceType[ChildAce->Header.AceType] != RtlBaseAceType[InheritedAceHdr->AceType] ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("AceType mismatch")); } #endif // DBG return FALSE; } // // If this is a system ACE, // ensure the SUCCESS/FAILURE flags match. // if ( RtlIsSystemAceType[ChildAce->Header.AceType] ) { if ( (ChildAce->Header.AceFlags & (SUCCESSFUL_ACCESS_ACE_FLAG|FAILED_ACCESS_ACE_FLAG)) != (InheritedAceHdr->AceFlags & (SUCCESSFUL_ACCESS_ACE_FLAG|FAILED_ACCESS_ACE_FLAG)) ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("System ace success/fail mismatch")); } #endif // DBG return FALSE; } } // // Get the GUIDs from the Object Aces // ChildObjectGuid = RtlObjectAceObjectType(ChildAce); ChildInheritedObjectGuid = RtlObjectAceInheritedObjectType(ChildAce); InhObjectGuid = RtlObjectAceObjectType(InheritedAce); InhInheritedObjectGuid = RtlObjectAceInheritedObjectType(InheritedAce); // // If the InheritedObjectGuid is present in either ACE, // they must be equal. // if ( ChildInheritedObjectGuid != NULL || InhInheritedObjectGuid != NULL ) { if ( ChildInheritedObjectGuid == NULL || InhInheritedObjectGuid == NULL || !RtlpIsEqualGuid( ChildInheritedObjectGuid, InhInheritedObjectGuid )) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("InheritedObject GUID mismatch")); } #endif // DBG return FALSE; } } // // If the ObjectGUID is present in either ACE, // they must be equal. // // Any missing object GUID defaults to the passed in object GUID. // if ( (ChildObjectGuid != NULL) && (InhObjectGuid != NULL) ) { if (!RtlpIsEqualGuid( ChildObjectGuid, InhObjectGuid )) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Object GUID mismatch")); } #endif // DBG return( FALSE ); } } else { // // One or both is NULL, if it's only one, they don't match. // if ( !((ChildObjectGuid == NULL) && (InhObjectGuid == NULL)) ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Object GUID mismatch")); } #endif // DBG return( FALSE ); } } // // If the SID of the inherited ACE doesn't match, // we don't match. // if ( !RtlEqualSid( RtlObjectAceSid(ChildAce), RtlObjectAceSid(InheritedAce))) { // // The inheritance algorithm only does SID mapping when building the effective // ace. So, we only check for a mapped SID if the child ACE is an effective ACE. // if ( AceFlagsInAce(ChildAce) != EFFECTIVE_ACE ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch")); } #endif // DBG return FALSE; } // // In the case of CreatorOwner and CreatorGroup, the SIDs don't have to // exactly match. When the InheritedAce was generated, care was taken // to NOT map these sids. The SID may (or may not) have been mapped in // the ChildAce. We want to compare equal in both cases. // // If the InheritedAce contains a CreatorOwner/Group SID, // do the another comparison of the SID in the child ACE with the // real owner/group from the child security descriptor. // if ( OwnerSid != NULL || GroupSid != NULL ) { SID_IDENTIFIER_AUTHORITY CreatorSidAuthority = SECURITY_CREATOR_SID_AUTHORITY; ULONG CreatorSid[CREATOR_SID_SIZE]; // // Allocate and initialize the universal SIDs we're going to need // to look for inheritable ACEs. // ASSERT(RtlLengthRequiredSid( 1 ) == CREATOR_SID_SIZE); RtlInitializeSid( (PSID)CreatorSid, &CreatorSidAuthority, 1 ); *(RtlpSubAuthoritySid( (PSID)CreatorSid, 0 )) = SECURITY_CREATOR_OWNER_RID; if (RtlEqualPrefixSid ( RtlObjectAceSid(InheritedAce), CreatorSid )) { ULONG Rid; Rid = *RtlpSubAuthoritySid( RtlObjectAceSid(InheritedAce), 0 ); switch (Rid) { case SECURITY_CREATOR_OWNER_RID: if ( OwnerSid == NULL || !RtlEqualSid( RtlObjectAceSid(ChildAce), OwnerSid )) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch (Creator Owner)")); } #endif // DBG return FALSE; } break; case SECURITY_CREATOR_GROUP_RID: if ( GroupSid == NULL || !RtlEqualSid( RtlObjectAceSid(ChildAce), GroupSid )) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch (Creator Group)")); } #endif // DBG return FALSE; } break; default: #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch (Creator)")); } #endif // DBG return FALSE; } } else { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch")); } #endif // DBG return FALSE; } } else { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("SID mismatch")); } #endif // DBG return FALSE; } } return TRUE; }

NTSTATUS RtlpComputeMergedAcl (  IN PACL  CurrentAcl, IN ULONG  CurrentGenericControl, IN PACL  ModificationAcl, IN ULONG  ModificationGenericControl, IN PSID  ClientOwnerSid, IN PSID  ClientGroupSid, IN PGENERIC_MAPPING  GenericMapping, IN BOOLEAN  IsSacl, OUT PACL *  NewAcl, OUT PULONG  NewGenericControl )

Definition at line 6266 of file sertl.c. References ExAllocatePoolWithTag, ExFreePool(), HeapHandle, NT_SUCCESS, NTSTATUS(), NULL, PagedPool, RTL_PAGED_CODE, RtlAllocateHeap, RtlFreeHeap, RtlpComputeMergedAcl2(), and Status. Referenced by RtlpSetSecurityObject(). : This routine builds the actual ACL that should be set on an object. The built ACL is a composite of the previous ACL on an object and the newly set ACL on the object. The New ACL is built as follows: If SEP_ACL_PROTECTED is set in neither CurrentAcl nor ModificationAcl, the NewAcl is constructed from the inherited ACEs from the CurrentAcl and the non-inherited ACEs from the ModificationAcl. (That is, it is impossible to edit an inherited ACE by changing the ACL on an object.) If SEP_ACL_PROTECTED is set on ModificationAcl, CurrentAcl is ignored. NewAcl is built as a copy of ModificationAcl with any INHERITED_ACE bits turned off. If SEP_ACL_PROTECTED is set on CurrentAcl and not ModificationAcl, the CurrentAcl is ignored. NewAcl is built as a copy of ModificationDescriptor. It is the callers responsibility to ensure that the correct ACEs have the INHERITED_ACE bit turned on. Arguments: CurrentAcl - The current ACL on the object. CurrentGenericControl - Specifies the control flags from the SecurityDescriptor describing the CurrentAcl. ModificationAcl - The ACL being applied to the object. ModificationGenericControl - Specifies the control flags from the SecurityDescriptor describing the CurrentAcl. ClientOwnerSid - Specifies the owner Sid to use ClientGroupSid - Specifies the new Group Sid to use GenericMapping - The mapping of generic to specific and standard access types. IsSacl - True if this is the SACL. False if this is the DACL. NewAcl - Receives a pointer to the new resultant acl. NewGenericControl - Specifies the control flags for the newly generated ACL. Only the Protected and AutoInherited bits are returned. Return Value: STATUS_SUCCESS - An ACL was successfully generated. STATUS_UNKNOWN_REVISION - Indicates the source ACL is a revision that is unknown to this routine. --*/ { NTSTATUS Status; ULONG AclBufferSize; ULONG i; #ifndef NTOS_KERNEL_RUNTIME PVOID HeapHandle; #endif // NTOS_KERNEL_RUNTIME RTL_PAGED_CODE(); // // Get the handle to the current process heap // #ifndef NTOS_KERNEL_RUNTIME HeapHandle = RtlProcessHeap(); #endif // NTOS_KERNEL_RUNTIME // // Implement a two pass strategy. // // First try to create the ACL in a fixed length buffer. // If that is too small, // then use the buffer size determined on the first pass // AclBufferSize = 1024; for ( i=0; i<2 ; i++ ) { // // Allocate heap for the new ACL. // #ifdef NTOS_KERNEL_RUNTIME (*NewAcl) = ExAllocatePoolWithTag( PagedPool, AclBufferSize, 'cAeS' ); #else // NTOS_KERNEL_RUNTIME (*NewAcl) = RtlAllocateHeap( HeapHandle, 0, AclBufferSize ); #endif // NTOS_KERNEL_RUNTIME if ((*NewAcl) == NULL ) { return( STATUS_NO_MEMORY ); } // // Merge the ACLs // Status = RtlpComputeMergedAcl2 ( CurrentAcl, CurrentGenericControl, ModificationAcl, ModificationGenericControl, ClientOwnerSid, ClientGroupSid, GenericMapping, IsSacl, &AclBufferSize, (PUCHAR) *NewAcl, NewGenericControl ); if ( NT_SUCCESS(Status) ) { // // If a NULL ACL should be used, // tell the caller. // if ( AclBufferSize == 0 ) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( *NewAcl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, *NewAcl ); #endif // NTOS_KERNEL_RUNTIME *NewAcl = NULL; } break; } else { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( *NewAcl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, *NewAcl ); #endif // NTOS_KERNEL_RUNTIME *NewAcl = NULL; if ( Status != STATUS_BUFFER_TOO_SMALL ) { break; } } } return Status; }

NTSTATUS RtlpComputeMergedAcl2 (  IN PACL  CurrentAcl, IN ULONG  CurrentGenericControl, IN PACL  ModificationAcl, IN ULONG  ModificationGenericControl, IN PSID  ClientOwnerSid, IN PSID  ClientGroupSid, IN PGENERIC_MAPPING  GenericMapping, IN BOOLEAN  IsSacl, IN PULONG  AclBufferSize, IN OUT PUCHAR  AclBuffer, OUT PULONG  NewGenericControl )

Definition at line 5893 of file sertl.c. References CopyAllAces, CopyInheritedAces, CopyNonInheritedAces, FALSE, max, NT_SUCCESS, NTSTATUS(), NULL, RTL_PAGED_CODE, RtlCreateAcl(), RtlpCopyAces(), Status, TRUE, and USHORT. Referenced by RtlpComputeMergedAcl(). : This routine implements the 'set' semantics for auto inheritance. This routine builds the actual ACL that should be set on an object. The built ACL is a composite of the previous ACL on an object and the newly set ACL on the object. The New ACL is built as follows: If SEP_ACL_PROTECTED is set in neither CurrentAcl nor ModificationAcl, the NewAcl is constructed from the inherited ACEs from the CurrentAcl and the non-inherited ACEs from the ModificationAcl. (That is, it is impossible to edit an inherited ACE by changing the ACL on an object.) If SEP_ACL_PROTECTED is set on ModificationAcl, CurrentAcl is ignored. NewAcl is built as a copy of ModificationAcl with any INHERITED_ACE bits turned off. If SEP_ACL_PROTECTED is set on CurrentAcl and not ModificationAcl, the CurrentAcl is ignored. NewAcl is built as a copy of ModificationDescriptor. It is the callers responsibility to ensure that the correct ACEs have the INHERITED_ACE bit turned on. Arguments: CurrentAcl - The current ACL on the object. CurrentGenericControl - Specifies the control flags from the SecurityDescriptor describing the CurrentAcl. ModificationAcl - The ACL being applied to the object. ModificationGenericControl - Specifies the control flags from the SecurityDescriptor describing the CurrentAcl. ClientOwnerSid - Specifies the owner Sid to use ClientGroupSid - Specifies the new Group Sid to use GenericMapping - The mapping of generic to specific and standard access types. IsSacl - True if this is the SACL. False if this is the DACL. AclBufferSize - On input, specifies the size of AclBuffer. On output, on success, returns the used size of AclBuffer. On output, if the buffer is too small, returns the required size of AclBuffer. AclBuffer - Receives a pointer to the new (inherited) acl. NewGenericControl - Specifies the control flags for the newly generated ACL. Only the Protected and AutoInherited bits are returned. Return Value: STATUS_SUCCESS - An ACL was successfully generated. STATUS_UNKNOWN_REVISION - Indicates the source ACL is a revision that is unknown to this routine. --*/ { NTSTATUS Status; ULONG ModificationNewAclSize = 0; ULONG CurrentNewAclSize = 0; ULONG AclRevision; BOOLEAN AclOverflowed = FALSE; BOOLEAN NullAclOk = TRUE; RTL_PAGED_CODE(); // // Assume the ACL revision. // AclRevision = ACL_REVISION; RtlCreateAcl( (PACL)AclBuffer, *AclBufferSize, AclRevision ); // // This routine is only called for the AutoInheritance case. // *NewGenericControl = SEP_ACL_AUTO_INHERITED; // // If the new ACL is protected, // simply use the new ACL with the INHERITED_ACE bits turned off. // if ( (ModificationGenericControl & SEP_ACL_PROTECTED) != 0 ) { // // Set the Control bits for the resultant descriptor. // *NewGenericControl |= SEP_ACL_PROTECTED; // // Only copy the ACL if it is actually present // if ( ModificationAcl != NULL ) { AclRevision = max( AclRevision, ModificationAcl->AclRevision ); // // Copy all ACES, turn off the inherited bit, and generic map them. // Status = RtlpCopyAces( ModificationAcl, GenericMapping, CopyAllAces, INHERITED_ACE, // Turn off all INHERITED_ACE flags TRUE, // Map sids as needed ClientOwnerSid, ClientGroupSid, ClientOwnerSid, // Not technically correct. s.b. server sid ClientGroupSid, // Not technically correct. s.b. server sid &ModificationNewAclSize, (PACL)AclBuffer ); if ( Status == STATUS_BUFFER_TOO_SMALL ) { AclOverflowed = TRUE; Status = STATUS_SUCCESS; } if ( !NT_SUCCESS(Status) ) { return Status; } // // If the caller specified an ACL with no ACES, // make sure we generate an ACL with no ACES. // NullAclOk = FALSE; } // // If the old ACL is protected but the new one isn't, // simply use the new ACL as is. // // Rely on the caller to get the INHERITED_ACE bits right. // } else if ( (CurrentGenericControl & SEP_ACL_PROTECTED) != 0 ) { // // Only do the copy if the new ACL is specified. // if ( ModificationAcl != NULL ) { AclRevision = max( AclRevision, ModificationAcl->AclRevision ); // // Copy all ACES, and generic map them. // Status = RtlpCopyAces( ModificationAcl, GenericMapping, CopyAllAces, 0, TRUE, // Map sids as needed ClientOwnerSid, ClientGroupSid, ClientOwnerSid, // Not technically correct. s.b. server sid ClientGroupSid, // Not technically correct. s.b. server sid &ModificationNewAclSize, (PACL)AclBuffer ); if ( Status == STATUS_BUFFER_TOO_SMALL ) { AclOverflowed = TRUE; Status = STATUS_SUCCESS; } if ( !NT_SUCCESS(Status) ) { return Status; } // // If the caller specified an ACL with no ACES, // make sure we generate an ACL with no ACES. // NullAclOk = FALSE; // // Since the ACL isn't protected, // don't allow NULL ACL semantics. // (those semantics are ambiguous for auto inheritance) // } else if ( !IsSacl ) { return STATUS_INVALID_ACL; } // // If neither are protected, // use the non-inherited ACEs from the new ACL, and // preserve the inherited ACEs from the old ACL. // } else { // // NULL ACLs are always OK for a SACL. // NULL ACLs are never OK for a non-protected DACL. // NullAclOk = IsSacl; // // Only do the copy if the new ACL is specified. // if ( ModificationAcl != NULL ) { AclRevision = max( AclRevision, ModificationAcl->AclRevision ); // // Copy the non-inherited ACES, and generic map them. // Status = RtlpCopyAces( ModificationAcl, GenericMapping, CopyNonInheritedAces, 0, TRUE, // Map sids as needed ClientOwnerSid, ClientGroupSid, ClientOwnerSid, // Not technically correct. s.b. server sid ClientGroupSid, // Not technically correct. s.b. server sid &ModificationNewAclSize, (PACL)AclBuffer ); if ( Status == STATUS_BUFFER_TOO_SMALL ) { AclOverflowed = TRUE; Status = STATUS_SUCCESS; } if ( !NT_SUCCESS(Status) ) { return Status; } // // If the caller specified an ACL with no ACES, // make sure we generate an ACL with no ACES. // // If inherited aces were deleted, leave the flag alone allowing // a NULL SACL to be generated. // if ( ModificationAcl->AceCount == 0 ) { NullAclOk = FALSE; } // // Since the ACL isn't protected, // don't allow NULL ACL semantics. // (those semantics are ambiguous for auto inheritance) // } else if ( !IsSacl ) { return STATUS_INVALID_ACL; } // // Only do the copy if the old ACL is specified. // if ( CurrentAcl != NULL ) { AclRevision = max( AclRevision, CurrentAcl->AclRevision ); // // Copy the inherited ACES, and generic map them. // // Don't bother mapping the sids in these ACEs. They got mapped // during inheritance. // Status = RtlpCopyAces( CurrentAcl, GenericMapping, CopyInheritedAces, 0, FALSE, // Don't map the sids, NULL, NULL, NULL, NULL, &CurrentNewAclSize, (PACL)AclBuffer ); if ( Status == STATUS_BUFFER_TOO_SMALL ) { AclOverflowed = TRUE; Status = STATUS_SUCCESS; } if ( !NT_SUCCESS(Status) ) { return Status; } } } // // If this routine didn't build the ACL, // tell the caller to use an explict NULL ACL // if ( ModificationNewAclSize + CurrentNewAclSize == 0) { // // If the Acl was explictly assigned, // generate a NULL ACL based on the path taken above. // if ( NullAclOk ) { *AclBufferSize = 0; return STATUS_SUCCESS; } } // // And make sure we don't exceed the length limitations of an ACL (WORD) // if ( ModificationNewAclSize + CurrentNewAclSize + sizeof(ACL) > 0xFFFF) { return(STATUS_BAD_INHERITANCE_ACL); } (*AclBufferSize) = ModificationNewAclSize + CurrentNewAclSize + sizeof(ACL); if ( AclOverflowed ) { return STATUS_BUFFER_TOO_SMALL; } // // Patch the real ACL size and revision into the ACL // ((PACL)AclBuffer)->AclSize = (USHORT) *AclBufferSize; ((PACL)AclBuffer)->AclRevision = (UCHAR) AclRevision; return STATUS_SUCCESS; }

NTSTATUS RtlpConvertAclToAutoInherit (  IN PACL ParentAcl  OPTIONAL, IN PACL  ChildAcl, IN GUID *ObjectType  OPTIONAL, IN BOOLEAN  IsDirectoryObject, IN PSID  OwnerSid, IN PSID  GroupSid, IN PGENERIC_MAPPING  GenericMapping, OUT PACL *  NewAcl, OUT PULONG  NewGenericControl )

Definition at line 7461 of file sertl.c. References AceFlagsInAce, ASSERT, CREATOR_SID_SIZE, CreatorOwnerSid, EFFECTIVE_ACE, ExAllocatePoolWithTag, ExFreePool(), FALSE, FirstAce, _KNOWN_ACE::Header, HeapHandle, MAKE_TAG, _KNOWN_ACE::Mask, max, NextAce, NT_SUCCESS, NTSTATUS(), NULL, PagedPool, RTL_PAGED_CODE, RtlAllocateHeap, RtlBaseAceType, RtlCreateAcl(), RtlFreeHeap, RtlInitializeSid(), RtlLengthRequiredSid(), RtlMapGenericMask(), RtlpCompareAces(), RtlpInheritAcl(), RtlpVerboseConvert, RtlValidAcl(), SE_TAG, Status, and TRUE. Referenced by RtlpConvertToAutoInheritSecurityObject(). : This is a private routine that produces an auto inherited acl from a ChildAcl that is not marked as auto inherited. The passed in InheritedAcl is computed as the pure inherited ACL of Parent ACL of the object. See comments for RtlConvertToAutoInheritSecurityObject. Arguments: ParentAcl - Supplies the ACL of the parent object. ChildAcl - Supplies the acl associated with the object. This is the current acl on the object. ObjectType - GUID of the object type being created. If the object being created has no GUID associated with it, then this argument is specified as NULL. IsDirectoryObject - Specifies if the object is a directory object. A value of TRUE indicates the object is a container of other objects. OwnerSid - Specifies the owner Sid to use. GroupSid - Specifies the group SID to use. GenericMapping - Specifies the generic mapping to use. NewAcl - Receives a pointer to the new (auto inherited) acl. The ACL must be deallocated using the pool (kernel mode) or heap (user mode) deallocator. NewGenericControl - Specifies the control flags for the newly generated ACL. SEP_ACL_PRESENT: Specifies that the ACL is explictly supplied by the caller. ?? Ever set? SEP_ACL_DEFAULTED: Specifies that the ACL was supplied by some defaulting mechanism. ?? Ever set SEP_ACL_AUTO_INHERITED: Set if the ACL was generated using the Automatic Inheritance algorithm. SEP_ACL_PROTECTED: Specifies that the ACL is protected and was not inherited from the parent ACL. Return Value: STATUS_SUCCESS - An inheritable ACL was successfully generated. STATUS_UNKNOWN_REVISION - Indicates the source ACL is a revision that is unknown to this routine. STATUS_INVALID_ACL - The structure of one of the ACLs in invalid. --*/ { NTSTATUS Status; PACL InheritedAcl = NULL; PACL RealInheritedAcl = NULL; BOOLEAN AclExplicitlyAssigned; ULONG GenericControl; PKNOWN_ACE ChildAce = NULL; PKNOWN_ACE InheritedAce; LONG ChildAceIndex; LONG InheritedAceIndex; BOOLEAN InheritedAllowFound; BOOLEAN InheritedDenyFound; BOOLEAN AcesCompare; ACCESS_MASK InheritedContainerInheritMask; ACCESS_MASK InheritedObjectInheritMask; ACCESS_MASK InheritedEffectiveMask; ACCESS_MASK OriginalInheritedContainerInheritMask; ACCESS_MASK OriginalInheritedObjectInheritMask; ACCESS_MASK OriginalInheritedEffectiveMask; ULONG InheritedAceFlags; ULONG MatchedFlags; ULONG NonInheritedAclSize; PACE_HEADER AceHeader; PUCHAR Where; // ULONG i; // // This routine maintains an array of the structure below (one element per ACE in // the ChildAcl). // // The ACE is broken down into its component parts. The access mask is triplicated. // That is, if the ACE is a ContainerInherit ACE, the access mask is remembered as // being a "ContainerInheritMask". The same is true if the ACE is an ObjectInherit ACE // on an effective ACE. This is done since each of the resultant 96 bits are // individually matched against corresponding bits in the computed inherited ACE. // // Each of the above mentioned masks are maintained in two forms. The first is never // changed and represents the bits as the originally appeared in the child ACL. // This second is modified as the corresponding bits are matched in the inherited ACL. // When the algorithm is completed, bits that haven't been matched represent ACEs // that weren't inherited from the parent. // typedef struct { ACCESS_MASK OriginalContainerInheritMask; ACCESS_MASK OriginalObjectInheritMask; ACCESS_MASK OriginalEffectiveMask; ACCESS_MASK ContainerInheritMask; ACCESS_MASK ObjectInheritMask; ACCESS_MASK EffectiveMask; } ACE_INFO, *PACE_INFO; PACE_INFO ChildAceInfo = NULL; ULONG CreatorOwnerSid[CREATOR_SID_SIZE]; ULONG CreatorGroupSid[CREATOR_SID_SIZE]; SID_IDENTIFIER_AUTHORITY CreatorSidAuthority = SECURITY_CREATOR_SID_AUTHORITY; #ifndef NTOS_KERNEL_RUNTIME PVOID HeapHandle; #endif // NTOS_KERNEL_RUNTIME RTL_PAGED_CODE(); // // Get the handle to the current process heap // #ifndef NTOS_KERNEL_RUNTIME HeapHandle = RtlProcessHeap(); #endif // NTOS_KERNEL_RUNTIME // // Allocate and initialize the universal SIDs we're going to need // to look for inheritable ACEs. // ASSERT(RtlLengthRequiredSid( 1 ) == CREATOR_SID_SIZE); RtlInitializeSid( (PSID)CreatorOwnerSid, &CreatorSidAuthority, 1 ); *(RtlpSubAuthoritySid( (PSID)CreatorOwnerSid, 0 )) = SECURITY_CREATOR_OWNER_RID; RtlInitializeSid( (PSID)CreatorGroupSid, &CreatorSidAuthority, 1 ); *(RtlpSubAuthoritySid( (PSID)CreatorGroupSid, 0 )) = SECURITY_CREATOR_GROUP_RID; // // Ensure the passed in ACLs are valid. // *NewGenericControl = SEP_ACL_AUTO_INHERITED; *NewAcl = NULL; if ( ParentAcl != NULL && !RtlValidAcl( ParentAcl ) ) { Status = STATUS_INVALID_ACL; goto Cleanup; } if (!RtlValidAcl( ChildAcl ) ) { Status = STATUS_INVALID_ACL; goto Cleanup; } // // Compute what the inherited ACL "should" look like. // // The inherited ACL is computed to NOT SID-map Creator Owner and Creator Group. // This allows use to later recognize the constant SIDs and special case them // rather than mistakenly confuse them with the mapped SID. // Status = RtlpInheritAcl ( ParentAcl, NULL, // No explicit child ACL 0, // No Child Generic Control IsDirectoryObject, TRUE, // AutoInherit the DACL FALSE, // Not default descriptor for object CreatorOwnerSid, // Subsitute a constant SID CreatorGroupSid, // Subsitute a constant SID CreatorOwnerSid, // Server Owner (Technically incorrect, but OK since we don't support compound ACEs) CreatorGroupSid, // Server Group GenericMapping, TRUE, // Is a SACL ObjectType, &InheritedAcl, &AclExplicitlyAssigned, &GenericControl ); if ( Status == STATUS_NO_INHERITANCE ) { *NewGenericControl |= SEP_ACL_PROTECTED; #if DBG if ( RtlpVerboseConvert ) { KdPrint(("NO_INHERITANCE of the parent ACL\n" )); } #endif // DBG Status = STATUS_SUCCESS; goto Cleanup; } if ( !NT_SUCCESS(Status) ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Can't build inherited ACL %lX\n", Status )); } #endif // DBG goto Cleanup; } // // Allocate a work buffer describing the ChildAcl // #ifdef NTOS_KERNEL_RUNTIME ChildAceInfo = ExAllocatePoolWithTag( PagedPool, ChildAcl->AceCount * sizeof(ACE_INFO), 'cAeS' ); #else // NTOS_KERNEL_RUNTIME ChildAceInfo = RtlAllocateHeap( HeapHandle, MAKE_TAG(SE_TAG), ChildAcl->AceCount * sizeof(ACE_INFO) ); #endif // NTOS_KERNEL_RUNTIME if (ChildAceInfo == NULL ) { Status = STATUS_NO_MEMORY; goto Cleanup; } for (ChildAceIndex = 0, ChildAce = FirstAce(ChildAcl); ChildAceIndex < ChildAcl->AceCount; ChildAceIndex += 1, ChildAce = NextAce(ChildAce)) { ACCESS_MASK LocalMask; ULONG ChildAceFlags; if ( !IsV4AceType(ChildAce) || IsCompoundAceType(ChildAce)) { *NewGenericControl |= SEP_ACL_PROTECTED; #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Inherited Ace type (%ld) not known\n", ChildAce->Header.AceType )); } #endif // DBG Status = STATUS_SUCCESS; goto Cleanup; } // // Compute the generic mapped mask for use in all comparisons. The // generic mapping will be undone if needed later. // // All V4 aces have an access mask in the same location. // LocalMask = ((PKNOWN_ACE)(ChildAce))->Mask; RtlApplyGenericMask( ChildAce, &LocalMask, GenericMapping); // // Break the ACE into its component parts. // ChildAceFlags = AceFlagsInAce( ChildAce ); if ( ChildAceFlags & CONTAINER_INHERIT_ACE ) { ChildAceInfo[ChildAceIndex].OriginalContainerInheritMask = LocalMask; ChildAceInfo[ChildAceIndex].ContainerInheritMask = LocalMask; } else { ChildAceInfo[ChildAceIndex].OriginalContainerInheritMask = 0; ChildAceInfo[ChildAceIndex].ContainerInheritMask = 0; } if ( ChildAceFlags & OBJECT_INHERIT_ACE ) { ChildAceInfo[ChildAceIndex].OriginalObjectInheritMask = LocalMask; ChildAceInfo[ChildAceIndex].ObjectInheritMask = LocalMask; } else { ChildAceInfo[ChildAceIndex].OriginalObjectInheritMask = 0; ChildAceInfo[ChildAceIndex].ObjectInheritMask = 0; } if ( ChildAceFlags & EFFECTIVE_ACE ) { ChildAceInfo[ChildAceIndex].OriginalEffectiveMask = LocalMask; ChildAceInfo[ChildAceIndex].EffectiveMask = LocalMask; } else { ChildAceInfo[ChildAceIndex].OriginalEffectiveMask = 0; ChildAceInfo[ChildAceIndex].EffectiveMask = 0; } } // // Walk through the computed inherited ACL one ACE at a time. // for (InheritedAceIndex = 0, InheritedAce = FirstAce(InheritedAcl); InheritedAceIndex < InheritedAcl->AceCount; InheritedAceIndex += 1, InheritedAce = NextAce(InheritedAce)) { ACCESS_MASK LocalMask; // // If the ACE isn't a valid version 4 ACE, // this isn't an ACL we're interested in handling. // if ( !IsV4AceType(InheritedAce) || IsCompoundAceType(InheritedAce)) { *NewGenericControl |= SEP_ACL_PROTECTED; #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Inherited Ace type (%ld) not known\n", InheritedAce->Header.AceType )); } #endif // DBG Status = STATUS_SUCCESS; goto Cleanup; } // // Compute the generic mapped mask for use in all comparisons. The // generic mapping will be undone if needed later. // // All V4 aces have an access mask in the same location. // LocalMask = ((PKNOWN_ACE)(InheritedAce))->Mask; RtlApplyGenericMask( InheritedAce, &LocalMask, GenericMapping); if ( LocalMask == 0 ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Worthless INH ACE: %ld 0x%8.8lx\n", InheritedAceIndex, LocalMask )); } #endif // DBG continue; } // // This ACE is some combination of an effective ACE, a container // inherit ACE and an object inherit ACE. Process each of those // attributes separately since they might be represented separately // in the ChildAcl. // InheritedAceFlags = AceFlagsInAce( InheritedAce ); if ( InheritedAceFlags == 0 ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Worthless INH ACE: %ld 0x%lx\n", InheritedAceIndex, InheritedAceFlags )); } #endif // DBG continue; } if ( InheritedAceFlags & CONTAINER_INHERIT_ACE ) { OriginalInheritedContainerInheritMask = InheritedContainerInheritMask = LocalMask; } else { OriginalInheritedContainerInheritMask = InheritedContainerInheritMask = 0; } if ( InheritedAceFlags & OBJECT_INHERIT_ACE ) { OriginalInheritedObjectInheritMask = InheritedObjectInheritMask = LocalMask; } else { OriginalInheritedObjectInheritMask = InheritedObjectInheritMask = 0; } if ( InheritedAceFlags & EFFECTIVE_ACE ) { OriginalInheritedEffectiveMask = InheritedEffectiveMask = LocalMask; } else { OriginalInheritedEffectiveMask = InheritedEffectiveMask = 0; } #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Doing INH ACE: %ld %8.8lX %8.8lX %8.8lX\n", InheritedAceIndex, InheritedEffectiveMask, InheritedContainerInheritMask, InheritedObjectInheritMask )); } #endif // DBG // // Loop through the entire child ACL comparing each inherited ACE with // each child ACE. Don't stop simply because we've matched once. // Multiple ACEs in the one ACL may have been condensed into a single ACE // in the other ACL in any combination (by any of our friendly ACL editors). // In all cases, it is better to compute a resultant auto inherited ACL // than it is to compute a protected ACL. // for (ChildAceIndex = 0, ChildAce = FirstAce(ChildAcl); ChildAceIndex < ChildAcl->AceCount; ChildAceIndex += 1, ChildAce = NextAce(ChildAce)) { // // Ensure the ACE represents the same principal and object, // #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Compare Child Ace: %ld ", ChildAceIndex )); } #endif // DBG if ( !RtlpCompareAces( InheritedAce, ChildAce, OwnerSid, GroupSid ) ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("\n" )); } #endif // DBG continue; } #if DBG if ( RtlpVerboseConvert ) { KdPrint(("\n" )); } #endif // DBG // // Match as many access bits in the INH ACE as possible. // // Don't pay any attention to whether the bits have been previously matched // in the CHILD ACE. To do so, would imply that there is a one-to-one // correspondance between bits in the INH ACL and Child ACL. Unfortunately, // ACL editors feel free to compress out duplicate bits in both // the CHILD ACL and PARENT ACL as they see fit. // InheritedEffectiveMask &= ~ChildAceInfo[ChildAceIndex].OriginalEffectiveMask; InheritedContainerInheritMask &= ~ChildAceInfo[ChildAceIndex].OriginalContainerInheritMask; InheritedObjectInheritMask &= ~ChildAceInfo[ChildAceIndex].OriginalObjectInheritMask; #if DBG if ( RtlpVerboseConvert ) { KdPrint(("New INH MASKs %ld %8.8lX %8.8lX %8.8lX\n", InheritedAceIndex, InheritedEffectiveMask, InheritedContainerInheritMask, InheritedObjectInheritMask )); } #endif // DBG // // Match as many access bits in the child ACE as possible. // // Same reasoning as above. // ChildAceInfo[ChildAceIndex].EffectiveMask &= ~OriginalInheritedEffectiveMask; ChildAceInfo[ChildAceIndex].ContainerInheritMask &= ~OriginalInheritedContainerInheritMask; ChildAceInfo[ChildAceIndex].ObjectInheritMask &= ~OriginalInheritedObjectInheritMask; #if DBG if ( RtlpVerboseConvert ) { KdPrint(("New Child MASKs %ld %8.8lX %8.8lX %8.8lX\n", ChildAceIndex, ChildAceInfo[ChildAceIndex].EffectiveMask, ChildAceInfo[ChildAceIndex].ContainerInheritMask, ChildAceInfo[ChildAceIndex].ObjectInheritMask )); } #endif // DBG } // // If we couldn't process this inherited ACE, // then the child ACL wasn't inherited. // if ( (InheritedEffectiveMask | InheritedContainerInheritMask | InheritedObjectInheritMask) != 0 ) { *NewGenericControl |= SEP_ACL_PROTECTED; #if DBG if ( RtlpVerboseConvert ) { KdPrint(("INH ACE not completely matched: %ld %8.8lX %8.8lX %8.8lX\n", InheritedAceIndex, InheritedEffectiveMask, InheritedContainerInheritMask, InheritedObjectInheritMask )); } #endif // DBG Status = STATUS_SUCCESS; goto Cleanup; } } // // ASSERT: All of the inherited ACEs have been processed. // // // Loop through the Child ACL ensuring we can build a valid auto inherited ACL // InheritedAllowFound = FALSE; InheritedDenyFound = FALSE; NonInheritedAclSize = 0; for (ChildAceIndex = 0, ChildAce = FirstAce(ChildAcl); ChildAceIndex < ChildAcl->AceCount; ChildAceIndex += 1, ChildAce = NextAce(ChildAce)) { ACCESS_MASK ResultantMask; // // Any Child ACE access bits not eliminated above required than an // explicit non-inherited ACE by built. That ACE will have an // access mask that is the combined access mask of the unmatched bit // in the effective, container inherit, and object inherit categories. // Even though, the combined mask may include access bits not absolutely // required (since they were already inherited), this strategy prevents // us from having to build multiple ACEs (one for each category) for this // single ACE. // ResultantMask = ChildAceInfo[ChildAceIndex].EffectiveMask | ChildAceInfo[ChildAceIndex].ContainerInheritMask | ChildAceInfo[ChildAceIndex].ObjectInheritMask; // // Handle an inherited ACE // if ( ResultantMask == 0 ) { // // Keep track of whether inherited "allow" and "deny" ACEs are found. // if ( RtlBaseAceType[ChildAce->Header.AceType] == ACCESS_ALLOWED_ACE_TYPE ) { InheritedAllowFound = TRUE; } if ( RtlBaseAceType[ChildAce->Header.AceType] == ACCESS_DENIED_ACE_TYPE ) { InheritedDenyFound = TRUE; } // // Handle a non-inherited ACE // } else { // // Keep a running tab of the size of the non-inherited ACEs. // NonInheritedAclSize += ChildAce->Header.AceSize; // // Since non-inherited ACEs will be moved to the front of the ACL, // we have to be careful that we don't move a deny ACE in front of a // previously found inherited allow ACE (and vice-versa). To do so would // change the semantics of the ACL. // if ( RtlBaseAceType[ChildAce->Header.AceType] == ACCESS_ALLOWED_ACE_TYPE && InheritedDenyFound ) { *NewGenericControl |= SEP_ACL_PROTECTED; #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Previous deny found Child ACE: %ld\n", ChildAceIndex )); } #endif // DBG Status = STATUS_SUCCESS; goto Cleanup; } if ( RtlBaseAceType[ChildAce->Header.AceType] == ACCESS_DENIED_ACE_TYPE && InheritedAllowFound ) { *NewGenericControl |= SEP_ACL_PROTECTED; #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Previous allow found Child ACE: %ld\n", ChildAceIndex )); } #endif // DBG Status = STATUS_SUCCESS; goto Cleanup; } } } // // The resultant ACL is composed of the non-inherited ACEs followed by // the inherited ACE. The inherited ACEs are built by running the // inheritance algorithm over the Parent ACL. // // The Inherited ACL computed below is almost identical to InhertedAcl. // However, InheritedAcl didn't properly substitute the correct owner and // group SID. // Status = RtlpInheritAcl ( ParentAcl, NULL, // No explicit child ACL 0, // No Child Generic Control IsDirectoryObject, TRUE, // AutoInherit the DACL FALSE, // Not default descriptor for object OwnerSid, // Subsitute a constant SID GroupSid, // Subsitute a constant SID OwnerSid, // Server Owner (Technically incorrect, but OK since we don't support compound ACEs) GroupSid, // Server Group GenericMapping, TRUE, // Is a SACL ObjectType, &RealInheritedAcl, &AclExplicitlyAssigned, &GenericControl ); if ( !NT_SUCCESS(Status) ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Can't build real inherited ACL %lX\n", Status )); } #endif // DBG goto Cleanup; } // // Allocate a buffer for the inherited ACL // #ifdef NTOS_KERNEL_RUNTIME *NewAcl = ExAllocatePoolWithTag( PagedPool, RealInheritedAcl->AclSize + NonInheritedAclSize, 'cAeS' ); #else // NTOS_KERNEL_RUNTIME *NewAcl = RtlAllocateHeap( HeapHandle, MAKE_TAG(SE_TAG), RealInheritedAcl->AclSize + NonInheritedAclSize ); #endif // NTOS_KERNEL_RUNTIME if ( *NewAcl == NULL ) { Status = STATUS_NO_MEMORY; goto Cleanup; } // // All non-inherited ACEs are copied first. // The inherited ACES are grabbed from real inherited ACL. // // Build an ACL Header. // Status = RtlCreateAcl( *NewAcl, RealInheritedAcl->AclSize + NonInheritedAclSize, max( RealInheritedAcl->AclRevision, ChildAcl->AclRevision ) ); if ( !NT_SUCCESS(Status) ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Can't create final ACL %lX\n", Status )); } #endif // DBG // // The only reason for failure would be if the combined ACL is too large. // So just create a protected ACL (better than a failure). // *NewGenericControl |= SEP_ACL_PROTECTED; Status = STATUS_SUCCESS; goto Cleanup; } // // Copy the non-inherited ACES. // Where = ((PUCHAR)(*NewAcl)) + sizeof(ACL); for (ChildAceIndex = 0, ChildAce = FirstAce(ChildAcl); ChildAceIndex < ChildAcl->AceCount; ChildAceIndex += 1, ChildAce = NextAce(ChildAce)) { ACCESS_MASK ResultantMask; // // Copy the non-inherited ACE from the Child only if there's a non-zero access mask. // ResultantMask = ChildAceInfo[ChildAceIndex].EffectiveMask | ChildAceInfo[ChildAceIndex].ContainerInheritMask | ChildAceInfo[ChildAceIndex].ObjectInheritMask; if ( ResultantMask != 0 ) { PKNOWN_ACE NewAce; ULONG GenericBitToTry; // // Use the original ChildAce as the template. // RtlCopyMemory( Where, ChildAce, ChildAce->Header.AceSize ); NewAce = (PKNOWN_ACE)Where; NewAce->Header.AceFlags &= ~INHERITED_ACE; // Clear stray bits Where += ChildAce->Header.AceSize; (*NewAcl)->AceCount ++; // // The AccessMask on the ACE are those access bits that didn't get matched // by inherited ACEs. // NewAce->Mask = ChildAce->Mask & ResultantMask; ResultantMask &= ~ChildAce->Mask; #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Original non-inherited: %ld %8.8lX %8.8lX\n", ChildAceIndex, NewAce->Mask, ResultantMask )); } #endif // DBG // // Map any remaining bits back to generic access bits. // Doing so might expand the ResultantMask to beyond what was computed above. // Doing so will never expand the computed ACE to beyond what the original // ChildAce granted. // ASSERT( GENERIC_WRITE == (GENERIC_READ >> 1)); ASSERT( GENERIC_EXECUTE == (GENERIC_WRITE >> 1)); ASSERT( GENERIC_ALL == (GENERIC_EXECUTE >> 1)); GenericBitToTry = GENERIC_READ; while ( ResultantMask && GenericBitToTry >= GENERIC_ALL ) { // // Only map generic bits that are in the ChildAce. // if ( GenericBitToTry & ChildAce->Mask ) { ACCESS_MASK GenericMask; // // Compute the real access mask corresponding to the Generic bit. // GenericMask = GenericBitToTry; RtlMapGenericMask( &GenericMask, GenericMapping ); // // If the current generic bit matches any of the bits remaining, // set the generic bit in the current ACE. // if ( (ResultantMask & GenericMask) != 0 ) { NewAce->Mask |= GenericBitToTry; ResultantMask &= ~GenericMask; } #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Generic non-inherited: %ld %8.8lX %8.8lX\n", ChildAceIndex, NewAce->Mask, ResultantMask )); } #endif // DBG } // // Try the next Generic bit. // GenericBitToTry >>= 1; } // // This is really an internal error, but press on regardless. // ASSERT(ResultantMask == 0 ); NewAce->Mask |= ResultantMask; #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Final non-inherited: %ld %8.8lX %8.8lX\n", ChildAceIndex, NewAce->Mask, ResultantMask )); } #endif // DBG } } // // Copy the inherited ACES. // Simply copy computed Inherited ACL. // RtlCopyMemory( Where, FirstAce(RealInheritedAcl), RealInheritedAcl->AclSize - (ULONG)(((PUCHAR)FirstAce(RealInheritedAcl)) - (PUCHAR)RealInheritedAcl)); Where += RealInheritedAcl->AclSize - (ULONG)(((PUCHAR)FirstAce(RealInheritedAcl)) - (PUCHAR)RealInheritedAcl); (*NewAcl)->AceCount += RealInheritedAcl->AceCount; ASSERT( (*NewAcl)->AclSize == Where - (PUCHAR)(*NewAcl) ); Status = STATUS_SUCCESS; Cleanup: // // If successful, // build the resultant autoinherited ACL. // if ( NT_SUCCESS(Status) ) { // // If the Child ACL is protected, // just build it as a copy of the original ACL // if ( *NewGenericControl & SEP_ACL_PROTECTED ) { // // If we've already allocated a new ACL (and couldn't finish it for some reason), // free it. if ( *NewAcl != NULL) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( *NewAcl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, *NewAcl ); #endif // NTOS_KERNEL_RUNTIME *NewAcl = NULL; } // // Allocate a buffer for the protected ACL. // #ifdef NTOS_KERNEL_RUNTIME *NewAcl = ExAllocatePoolWithTag( PagedPool, ChildAcl->AclSize, 'cAeS' ); #else // NTOS_KERNEL_RUNTIME *NewAcl = RtlAllocateHeap( HeapHandle, MAKE_TAG(SE_TAG), ChildAcl->AclSize ); #endif // NTOS_KERNEL_RUNTIME if ( *NewAcl == NULL ) { Status = STATUS_NO_MEMORY; } else { RtlCopyMemory( *NewAcl, ChildAcl, ChildAcl->AclSize ); } } } if ( ChildAceInfo != NULL) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( ChildAceInfo ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, ChildAceInfo ); #endif // NTOS_KERNEL_RUNTIME } if ( InheritedAcl != NULL) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( InheritedAcl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, InheritedAcl ); #endif // NTOS_KERNEL_RUNTIME } if ( RealInheritedAcl != NULL) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( RealInheritedAcl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, RealInheritedAcl ); #endif // NTOS_KERNEL_RUNTIME } return Status; }

NTSTATUS RtlpConvertToAutoInheritSecurityObject (  IN PSECURITY_DESCRIPTOR ParentDescriptor  OPTIONAL, IN PSECURITY_DESCRIPTOR  CurrentSecurityDescriptor, OUT PSECURITY_DESCRIPTOR *  NewSecurityDescriptor, IN GUID *ObjectType  OPTIONAL, IN BOOLEAN  IsDirectoryObject, IN PGENERIC_MAPPING  GenericMapping )

Definition at line 6520 of file sertl.c. References ExAllocatePoolWithTag, ExFreePool(), FALSE, HeapHandle, MAKE_TAG, NT_SUCCESS, NTSTATUS(), NULL, PagedPool, PrimaryToken, RTL_PAGED_CODE, RtlAllocateHeap, RtlCreateSecurityDescriptorRelative(), RtlFreeHeap, RtlpConvertAclToAutoInherit(), RtlValidSecurityDescriptor(), SE_TAG, SeLengthSid, Status, and TRUE. Referenced by RtlConvertToAutoInheritSecurityObject(). : This routine a converts a security descriptor whose ACLs are not marked as AutoInherit to a security descriptor whose ACLs are marked as AutoInherit. See comments for RtlConvertToAutoInheritSecurityObject. Arguments: ParentDescriptor - Supplies the Security Descriptor for the parent directory under which a object exists. If there is no parent directory, then this argument is specified as NULL. CurrentSecurityDescriptor - Supplies a pointer to the objects security descriptor that is going to be altered by this procedure. NewSecurityDescriptor Points to a pointer that is to be made to point to the newly allocated self-relative security descriptor. When no longer needed, this descriptor must be freed using DestroyPrivateObjectSecurity(). ObjectType - GUID of the object type being created. If the object being created has no GUID associated with it, then this argument is specified as NULL. IsDirectoryObject - Specifies if the object is a directory object. A value of TRUE indicates the object is a container of other objects. GenericMapping - Supplies a pointer to a generic mapping array denoting the mapping between each generic right to specific rights. Return Value: STATUS_SUCCESS - The operation was successful. See comments for RtlConvertToAutoInheritSecurityObject. --*/ { NTSTATUS Status; PISECURITY_DESCRIPTOR CurrentDescriptor; PACL CurrentSacl; PACL CurrentDacl; PSID NewOwner; PSID NewGroup; PACL NewSacl = NULL; ULONG NewSaclControl = 0; BOOLEAN NewSaclAllocated = FALSE; PACL NewDacl = NULL; ULONG NewDaclControl = 0; BOOLEAN NewDaclAllocated = FALSE; PACL TemplateInheritedDacl = NULL; ULONG GenericControl; ULONG AllocationSize; ULONG NewOwnerSize; ULONG NewGroupSize; ULONG NewSaclSize; ULONG NewDaclSize; PCHAR Field; PCHAR Base; PISECURITY_DESCRIPTOR_RELATIVE INewDescriptor = NULL; ULONG ReturnLength; NTSTATUS PassedStatus; HANDLE PrimaryToken; #ifndef NTOS_KERNEL_RUNTIME PVOID HeapHandle; #endif // NTOS_KERNEL_RUNTIME RTL_PAGED_CODE(); // // Get the handle to the current process heap // #ifndef NTOS_KERNEL_RUNTIME HeapHandle = RtlProcessHeap(); #endif // NTOS_KERNEL_RUNTIME // // CurrentDescriptor = CurrentSecurityDescriptor; // // Validate the incoming security descriptor. // if (!RtlValidSecurityDescriptor ( CurrentDescriptor )) { Status = STATUS_INVALID_SECURITY_DESCR; goto Cleanup; } NewOwner = RtlpOwnerAddrSecurityDescriptor( CurrentDescriptor ); if ( NewOwner == NULL ) { Status = STATUS_INVALID_SECURITY_DESCR; goto Cleanup; } NewGroup = RtlpGroupAddrSecurityDescriptor( CurrentDescriptor ); // // Handle the SACL. // // // If the SACL isn't present, // special case it. // CurrentSacl = RtlpSaclAddrSecurityDescriptor( CurrentDescriptor ); if ( CurrentSacl == NULL ) { PACL ParentSacl; // Preserve the Acl Present bit and protected bit from the existing descriptor. NewSaclControl |= CurrentDescriptor->Control & (SE_SACL_PROTECTED|SE_SACL_PRESENT); // Always set the autoinherited bit. NewSaclControl |= SE_SACL_AUTO_INHERITED; // // If the Parent also has a NULL SACL, // just consider this SACL as inherited. // otherwise, this SACL is protected. // ParentSacl = ARGUMENT_PRESENT(ParentDescriptor) ? RtlpSaclAddrSecurityDescriptor( ((SECURITY_DESCRIPTOR *)ParentDescriptor)) : NULL; if ( ParentSacl != NULL) { NewSaclControl |= SE_SACL_PROTECTED; } // // If the SACL is already converted, // or if this object is at the root of the tree, // simply leave it alone. // // Don't force the Protect bit on at the root of the tree since it is semantically // a no-op and gets in the way if the object is ever moved. // } else if ( RtlpAreControlBitsSet( CurrentDescriptor, SE_SACL_AUTO_INHERITED) || RtlpAreControlBitsSet( CurrentDescriptor, SE_SACL_PROTECTED ) || !ARGUMENT_PRESENT(ParentDescriptor) ) { // Preserve the Acl Present bit and protected bit from the existing descriptor. NewSaclControl |= CurrentDescriptor->Control & (SE_SACL_PROTECTED|SE_SACL_PRESENT); // Always set the autoinherited bit. NewSaclControl |= SE_SACL_AUTO_INHERITED; NewSacl = CurrentSacl; // // If the SACL is present, // compute a new SACL with appropriate ACEs marked as inherited. // } else { Status = RtlpConvertAclToAutoInherit ( ARGUMENT_PRESENT(ParentDescriptor) ? RtlpSaclAddrSecurityDescriptor( ((SECURITY_DESCRIPTOR *)ParentDescriptor)) : NULL, RtlpSaclAddrSecurityDescriptor(CurrentDescriptor), ObjectType, IsDirectoryObject, RtlpOwnerAddrSecurityDescriptor(CurrentDescriptor), RtlpGroupAddrSecurityDescriptor(CurrentDescriptor), GenericMapping, &NewSacl, &GenericControl ); if ( !NT_SUCCESS(Status) ) { goto Cleanup; } NewSaclAllocated = TRUE; NewSaclControl |= SE_SACL_PRESENT | SeControlGenericToSacl( GenericControl ); } // // Handle the DACL. // // // If the DACL isn't present, // special case it. // CurrentDacl = RtlpDaclAddrSecurityDescriptor( CurrentDescriptor ); if ( CurrentDacl == NULL ) { // Preserve the Dacl Present bit from the existing descriptor. NewDaclControl |= CurrentDescriptor->Control & SE_DACL_PRESENT; // Always set the autoinherited bit. // Force it protected. NewDaclControl |= SE_DACL_AUTO_INHERITED | SE_DACL_PROTECTED; // // If the DACL is already converted, // or if this object is at the root of the tree, // simply leave it alone. // // Don't force the Protect bit on at the root of the tree since it is semantically // a no-op and gets in the way if the object is ever moved. // } else if ( RtlpAreControlBitsSet( CurrentDescriptor, SE_DACL_AUTO_INHERITED) || RtlpAreControlBitsSet( CurrentDescriptor, SE_DACL_PROTECTED ) || !ARGUMENT_PRESENT(ParentDescriptor) ) { // Preserve the Acl Present bit and protected bit from the existing descriptor. NewDaclControl |= CurrentDescriptor->Control & (SE_DACL_PROTECTED|SE_DACL_PRESENT); // Always set the autoinherited bit. NewDaclControl |= SE_DACL_AUTO_INHERITED; NewDacl = CurrentDacl; // // If the DACL is present, // compute a new DACL with appropriate ACEs marked as inherited. // } else { Status = RtlpConvertAclToAutoInherit ( ARGUMENT_PRESENT(ParentDescriptor) ? RtlpDaclAddrSecurityDescriptor( ((SECURITY_DESCRIPTOR *)ParentDescriptor)) : NULL, RtlpDaclAddrSecurityDescriptor(CurrentDescriptor), ObjectType, IsDirectoryObject, RtlpOwnerAddrSecurityDescriptor(CurrentDescriptor), RtlpGroupAddrSecurityDescriptor(CurrentDescriptor), GenericMapping, &NewDacl, &GenericControl ); if ( !NT_SUCCESS(Status) ) { goto Cleanup; } NewDaclAllocated = TRUE; NewDaclControl |= SE_DACL_PRESENT | SeControlGenericToDacl( GenericControl ); } // // Build the resultant security descriptor // // Also map the ACEs for application to the target object // type, if they haven't already been mapped. // NewOwnerSize = LongAlignSize(SeLengthSid(NewOwner)); if ( NewGroup != NULL ) { NewGroupSize = LongAlignSize(SeLengthSid(NewGroup)); } else { NewGroupSize = 0; } if (NewSacl != NULL) { NewSaclSize = LongAlignSize(NewSacl->AclSize); } else { NewSaclSize = 0; } if (NewDacl != NULL) { NewDaclSize = LongAlignSize(NewDacl->AclSize); } else { NewDaclSize = 0; } AllocationSize = LongAlignSize(sizeof(SECURITY_DESCRIPTOR_RELATIVE)) + NewOwnerSize + NewGroupSize + NewSaclSize + NewDaclSize; // // Allocate and initialize the security descriptor as // self-relative form. // #ifdef NTOS_KERNEL_RUNTIME INewDescriptor = ExAllocatePoolWithTag( PagedPool, AllocationSize, 'dSeS' ); #else // NTOS_KERNEL_RUNTIME INewDescriptor = RtlAllocateHeap( HeapHandle, MAKE_TAG(SE_TAG), AllocationSize ); #endif // NTOS_KERNEL_RUNTIME if ( INewDescriptor == NULL ) { Status = STATUS_NO_MEMORY; goto Cleanup; } // // Initialize the security descriptor as self-relative form. // RtlCreateSecurityDescriptorRelative( INewDescriptor, SECURITY_DESCRIPTOR_REVISION ); RtlpSetControlBits( INewDescriptor, SE_SELF_RELATIVE ); Base = (PCHAR)(INewDescriptor); Field = Base + sizeof(SECURITY_DESCRIPTOR_RELATIVE); // // Copy the Sacl // RtlpSetControlBits( INewDescriptor, NewSaclControl ); if (NewSacl != NULL ) { RtlCopyMemory( Field, NewSacl, NewSacl->AclSize ); INewDescriptor->Sacl = RtlPointerToOffset(Base,Field); Field += NewSaclSize; } else { INewDescriptor->Sacl = 0; } // // Copy the Dacl // RtlpSetControlBits( INewDescriptor, NewDaclControl ); if (NewDacl != NULL ) { RtlCopyMemory( Field, NewDacl, NewDacl->AclSize ); INewDescriptor->Dacl = RtlPointerToOffset(Base,Field); Field += NewDaclSize; } else { INewDescriptor->Dacl = 0; } // // Assign the owner // RtlCopyMemory( Field, NewOwner, SeLengthSid(NewOwner) ); INewDescriptor->Owner = RtlPointerToOffset(Base,Field); Field += NewOwnerSize; if ( NewGroup != NULL ) { RtlCopyMemory( Field, NewGroup, SeLengthSid(NewGroup) ); INewDescriptor->Group = RtlPointerToOffset(Base,Field); } Status = STATUS_SUCCESS; // // Cleanup any locally used resources. // Cleanup: if (NewDaclAllocated) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( NewDacl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, NewDacl ); #endif // NTOS_KERNEL_RUNTIME } if (NewSaclAllocated) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( NewSacl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, NewSacl ); #endif // NTOS_KERNEL_RUNTIME } *NewSecurityDescriptor = (PSECURITY_DESCRIPTOR) INewDescriptor; return Status; }

NTSTATUS RtlpCopyAces (  IN PACL  Acl, IN PGENERIC_MAPPING  GenericMapping, IN ACE_TYPE_TO_COPY  AceTypeToCopy, IN UCHAR  AceFlagsToReset, IN BOOLEAN  MapSids, IN PSID  ClientOwnerSid, IN PSID  ClientGroupSid, IN PSID ServerOwnerSid  OPTIONAL, IN PSID ServerGroupSid  OPTIONAL, OUT PULONG  NewAclSizeParam, OUT PACL  NewAcl )

Definition at line 4371 of file sertl.c. References CopyAllAces, CopyInheritedAces, CopyNonInheritedAces, FALSE, FirstAce, NextAce, NTSTATUS(), NULL, RTL_PAGED_CODE, RtlFirstFreeAce(), RtlpCopyEffectiveAce(), Status, and TRUE. Referenced by RtlpComputeMergedAcl2(), and RtlpInheritAcl2(). : Copy ACEs from of an ACL and perform generic mapping. Only ACEs specified by 'AceFilter' are copied. Arguments: Acl - Supplies the ACL to copy from. GenericMapping - Specifies the generic mapping to use. AceTypeToCopy - Describes which aces to copy. AceFlagsToReset - Bit mask of ACE flags to reset (if set) on each ACE. MapSids - TRUE if the SID in the ACE is to be mapped to the corresponding actual SID. ClientOwnerSid - Specifies the owner Sid to use ClientGroupSid - Specifies the new Group Sid to use ServerOwnerSid - Optionally specifies the Server Sid to use in compound ACEs. ServerGroupSid - Optionally specifies the Server group Sid to use in compound ACEs. NewAclSizeParam - Receives the cumulatiave length of the copies ACEs NewAcl - Provides a pointer to the ACL to copy to. This ACL must already be initialized. Return Value: STATUS_SUCCESS - An inheritable ACL has been generated. STATUS_BUFFER_TOO_SMALL - The ACL specified by NewAcl is too small for the copied ACEs. The required size is returned in NewAceLength. --*/ { NTSTATUS Status; ULONG i; PACE_HEADER OldAce; ULONG NewAclSize, NewAceSize; BOOLEAN AclOverflowed = FALSE; BOOLEAN CopyAce; PVOID AcePosition; RTL_PAGED_CODE(); // // Validate the ACL. // if ( !ValidAclRevision(NewAcl) ) { return STATUS_UNKNOWN_REVISION; } // // Find where the first ACE goes. // if (!RtlFirstFreeAce( NewAcl, &AcePosition )) { return STATUS_BAD_INHERITANCE_ACL; } // // Walk through the original ACL copying ACEs. // NewAclSize = 0; for (i = 0, OldAce = FirstAce(Acl); i < Acl->AceCount; i += 1, OldAce = NextAce(OldAce)) { // // If the ACE wasn't inherited, // copy it. // switch (AceTypeToCopy) { case CopyInheritedAces: CopyAce = AceInherited(OldAce); break; case CopyNonInheritedAces: CopyAce = !AceInherited(OldAce); break; case CopyAllAces: CopyAce = TRUE; break; default: CopyAce = FALSE; break; } if ( CopyAce ) { // // If SIDs are to be mapped, // do so (and potentially create up to two ACEs). // if ( MapSids ) { PVOID TempAcePosition; ULONG EffectiveAceSize = 0; BOOLEAN EffectiveAceMapped; BOOLEAN GenerateInheritAce; // // Remember where the next ACE will be copied. // TempAcePosition = AcePosition; NewAceSize = 0; GenerateInheritAce = (((PACE_HEADER)OldAce)->AceFlags & (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE)) != 0; // // If the orginal ACE is an effective ACE, // create an effective ACE. // if ( !(((PACE_HEADER)OldAce)->AceFlags & INHERIT_ONLY_ACE)) { BOOLEAN LocalAclOverflowed; // // Copy the effective ACE into the ACL. // if ( !RtlpCopyEffectiveAce ( OldAce, FALSE, // Don't set the auto inherit bit GenerateInheritAce, ClientOwnerSid, ClientGroupSid, ServerOwnerSid, ServerGroupSid, GenericMapping, NULL, // Always copy object ACES &TempAcePosition, &EffectiveAceSize, NewAcl, NULL, // Always copy object ACES &EffectiveAceMapped, &LocalAclOverflowed ) ) { return STATUS_BAD_INHERITANCE_ACL; } if (LocalAclOverflowed) { AclOverflowed = TRUE; } NewAceSize += EffectiveAceSize; // // Reset any undesirable AceFlags. // if ( !AclOverflowed ) { ((PACE_HEADER)AcePosition)->AceFlags &= ~AceFlagsToReset; } } // // If the original ACE is inheritable, // create an inheritable ACE. // // ASSERT: AcePosition points to where the effective ACE was copied // ASSERT: TempAcePosition points to where the inheritable ACE should be copied // if ( GenerateInheritAce ) { // // If a effective ACE was created, // and it wasn't mapped, // avoid generating another ACE and simply merge the inheritance bits into // the effective ACE. // if ( EffectiveAceSize != 0 && !EffectiveAceMapped ) { // // Copy the inherit bits from the original ACE. // if ( !AclOverflowed ) { ((PACE_HEADER)AcePosition)->AceFlags |= ((PACE_HEADER)OldAce)->AceFlags & (VALID_INHERIT_FLAGS); ((PACE_HEADER)AcePosition)->AceFlags &= ~AceFlagsToReset; } // // Otherwise, generate an explicit inheritance ACE. // // But only if the access mask isn't zero. // } else if ( !IsMSAceType(OldAce) || ((PKNOWN_ACE)(OldAce))->Mask != 0 ) { // // Account for the new ACE being added to the ACL. // NewAceSize += (ULONG)(((PACE_HEADER)OldAce)->AceSize); if (NewAceSize > 0xFFFF) { return STATUS_BAD_INHERITANCE_ACL; } // // If the ACE doesn't fit, // just note the fact and don't copy the ACE. // if ( ((PACE_HEADER)OldAce)->AceSize > NewAcl->AclSize - ((PUCHAR)TempAcePosition - (PUCHAR)NewAcl) ) { AclOverflowed = TRUE; } else { // // copy it as is, but make sure the InheritOnly bit is set. // if ( !AclOverflowed ) { RtlCopyMemory( TempAcePosition, OldAce, ((PACE_HEADER)OldAce)->AceSize ); ((PACE_HEADER)TempAcePosition)->AceFlags |= INHERIT_ONLY_ACE; ((PACE_HEADER)TempAcePosition)->AceFlags &= ~AceFlagsToReset; NewAcl->AceCount += 1; } } } } } else { NewAceSize = (ULONG)OldAce->AceSize; // // If the ACE doesn't fit, // just note the fact and don't copy the ACE. // if ( AcePosition == NULL || NewAceSize > (ULONG)NewAcl->AclSize - ((PUCHAR)AcePosition - (PUCHAR)NewAcl) ) { AclOverflowed = TRUE; } else if ( !AclOverflowed ) { // // Copy the ACE. // RtlCopyMemory( AcePosition, OldAce, NewAceSize ); // // Map the generic bits. // // Is it really right to map the generic bits on an ACE // that's both effective and inheritable. Shouldn't this // be split into two ACEs in that case? Or just skip the mapping? // if (IsMSAceType( AcePosition )) { RtlApplyAceToObject( (PACE_HEADER)AcePosition, GenericMapping ); } // // Reset any undesirable AceFlags. // ((PACE_HEADER)AcePosition)->AceFlags &= ~AceFlagsToReset; // // Account for the new ACE. // NewAcl->AceCount += 1; } } // // Move the Ace Position to where the next ACE goes. // if ( !AclOverflowed ) { AcePosition = ((PUCHAR)AcePosition) + NewAceSize; } else { // On overflow, ensure no other ACEs are actually output to the buffer AcePosition = ((PUCHAR)NewAcl) + NewAcl->AclSize; } NewAclSize += NewAceSize; } } // // We have the length of the new ACE, but we've calculated // it with a ULONG. It must fit into a USHORT. See if it // does. // if (NewAclSize > 0xFFFF) { return STATUS_BAD_INHERITANCE_ACL; } (*NewAclSizeParam) = NewAclSize; return AclOverflowed ? STATUS_BUFFER_TOO_SMALL : STATUS_SUCCESS; }

BOOLEAN RtlpCopyEffectiveAce (  IN PACE_HEADER  OldAce, IN BOOLEAN  AutoInherit, IN BOOLEAN  WillGenerateInheritAce, IN PSID  ClientOwnerSid, IN PSID  ClientGroupSid, IN PSID ServerOwnerSid  OPTIONAL, IN PSID ServerGroupSid  OPTIONAL, IN PGENERIC_MAPPING  GenericMapping, IN GUID *NewObjectType  OPTIONAL, IN OUT PVOID *  AcePosition, OUT PULONG  NewAceLength, OUT PACL  NewAcl, OUT PBOOLEAN ObjectAceInherited  OPTIONAL, OUT PBOOLEAN  EffectiveAceMapped, OUT PBOOLEAN  AclOverflowed )

Definition at line 3880 of file sertl.c. References ASSERT, CREATOR_SID_SIZE, CreatorSid, FALSE, KNOWN_ACE, NULL, RTL_PAGED_CODE, RtlBaseAceType, RtlEqualPrefixSid(), RtlInitializeSid(), RtlLengthRequiredSid(), SeLengthSid, TRUE, and USHORT. Referenced by RtlpCopyAces(), and RtlpGenerateInheritedAce(). : This routine copy a specified ACE into an ACL as an effective ACE. The resultant ACE has all the inheritance bits turned of. The resultant ACE has the SID mapped from a generic SID to a specific SID (e.g., From "creator owner" to the passed in owner sid). Arguments: OldAce - Supplies the ace being inherited AutoInherit - Specifies if the inheritance is an "automatic inheritance". As such, the inherited ACEs will be marked as such. WillGenerateInheritAce - Specifies if the caller intends to generate an inheritable ACE the corresponds to OldAce. If TRUE, this routine will try to not map the effective ACE (increasing the likelyhood that EffectiveAceMapped will return FALSE), ClientOwnerSid - Specifies the owner Sid to use ClientGroupSid - Specifies the new Group Sid to use ServerSid - Optionally specifies the Server Sid to use in compound ACEs. ClientSid - Optionally specifies the Client Sid to use in compound ACEs. GenericMapping - Specifies the generic mapping to use NewObjectType - Type of object being inherited to. If not specified, the object has no object type. AcePosition - On entry and exit, specifies location of the next available ACE position in NewAcl. A NULL ACE position means there is no room at all in NewAcl. NewAceLength - Returns the length (in bytes) needed in NewAcl to copy the specified ACE. This might be zero to indicate that the ACE need not be copied at all. NewAcl - Provides a pointer to the ACL into which the ACE is to be inherited. ObjectAceInherited - Returns true if one or more object ACEs were inherited based on NewObjectType If NULL, NewObjectType is ignored and the object ACE is always inherited EffectiveAceMapped - Return TRUE if the SID, guid, or access mask of Old Ace was modifed when copying the ACE. AclOverflowed - Returns TRUE if NewAcl wasn't long enough to contain NewAceLength. Return Value: TRUE - No problem was detected. FALSE - Indicates something went wrong preventing the ACE from being compied. This generally represents a bugcheck situation when returned from this call. --*/ { ULONG LengthRequired; ACCESS_MASK LocalMask; PSID LocalServerOwner; PSID LocalServerGroup; ULONG CreatorSid[CREATOR_SID_SIZE]; SID_IDENTIFIER_AUTHORITY CreatorSidAuthority = SECURITY_CREATOR_SID_AUTHORITY; RTL_PAGED_CODE(); // // Allocate and initialize the universal SIDs we're going to need // to look for inheritable ACEs. // ASSERT(RtlLengthRequiredSid( 1 ) == CREATOR_SID_SIZE); RtlInitializeSid( (PSID)CreatorSid, &CreatorSidAuthority, 1 ); *(RtlpSubAuthoritySid( (PSID)CreatorSid, 0 )) = SECURITY_CREATOR_OWNER_RID; LocalServerOwner = ARGUMENT_PRESENT(ServerOwnerSid) ? ServerOwnerSid : ClientOwnerSid; LocalServerGroup = ARGUMENT_PRESENT(ServerGroupSid) ? ServerGroupSid : ClientGroupSid; // // Initialization // *EffectiveAceMapped = FALSE; if ( ARGUMENT_PRESENT(ObjectAceInherited)) { *ObjectAceInherited = FALSE; } *AclOverflowed = FALSE; LengthRequired = (ULONG)OldAce->AceSize; // // Process all MS ACE types specially // if ( IsMSAceType(OldAce) ) { ULONG Rid; PSID SidToCopy = NULL; ULONG AceHeaderToCopyLength; PACE_HEADER AceHeaderToCopy = OldAce; PSID ServerSidToCopy = NULL; UCHAR DummyAce[sizeof(KNOWN_OBJECT_ACE)+sizeof(GUID)]; // // Grab the Sid pointer and access mask as a function of the ACE type // if (IsKnownAceType( OldAce ) ) { SidToCopy = &((PKNOWN_ACE)OldAce)->SidStart; AceHeaderToCopyLength = FIELD_OFFSET(KNOWN_ACE, SidStart); } else if (IsCompoundAceType(OldAce)) { SidToCopy = RtlCompoundAceClientSid( OldAce ); AceHeaderToCopyLength = FIELD_OFFSET(KNOWN_COMPOUND_ACE, SidStart); ASSERT( FIELD_OFFSET(KNOWN_COMPOUND_ACE, Mask) == FIELD_OFFSET(KNOWN_ACE, Mask) ); // // Compound ACEs have two SIDs (Map one now). // ServerSidToCopy = RtlCompoundAceServerSid( OldAce ); if (RtlEqualPrefixSid ( ServerSidToCopy, CreatorSid )) { Rid = *RtlpSubAuthoritySid( ServerSidToCopy, 0 ); switch (Rid) { case SECURITY_CREATOR_OWNER_RID: ServerSidToCopy = ClientOwnerSid; LengthRequired = LengthRequired - CREATOR_SID_SIZE + SeLengthSid(ClientOwnerSid); *EffectiveAceMapped = TRUE; break; case SECURITY_CREATOR_GROUP_RID: if ( ClientGroupSid != NULL ) { ServerSidToCopy = ClientGroupSid; LengthRequired = LengthRequired - CREATOR_SID_SIZE + SeLengthSid(ClientGroupSid); *EffectiveAceMapped = TRUE; } break; case SECURITY_CREATOR_OWNER_SERVER_RID: ServerSidToCopy = LocalServerOwner; LengthRequired = LengthRequired - CREATOR_SID_SIZE + SeLengthSid(LocalServerOwner); *EffectiveAceMapped = TRUE; break; case SECURITY_CREATOR_GROUP_SERVER_RID: ServerSidToCopy = LocalServerGroup; LengthRequired = LengthRequired - CREATOR_SID_SIZE + SeLengthSid(LocalServerGroup); *EffectiveAceMapped = TRUE; break; } // // If we don't know what this SID is, just copy the original. // if ( !*EffectiveAceMapped ) { AceHeaderToCopyLength += SeLengthSid( ServerSidToCopy ); ServerSidToCopy = NULL; } } else { // // We don't know what this SID is, just copy the original. // AceHeaderToCopyLength += SeLengthSid( ServerSidToCopy ); ServerSidToCopy = NULL; } // // Handle Object ACEs // } else { GUID *InheritedObjectType; SidToCopy = RtlObjectAceSid( OldAce ); AceHeaderToCopyLength = (ULONG) ((PUCHAR)SidToCopy - (PUCHAR)OldAce); ASSERT( FIELD_OFFSET(KNOWN_OBJECT_ACE, Mask) == FIELD_OFFSET(KNOWN_ACE, Mask) ); // // Handle ACEs that are only inherited for a specific object type, // InheritedObjectType = RtlObjectAceInheritedObjectType( OldAce ); if ( ARGUMENT_PRESENT(ObjectAceInherited) && InheritedObjectType != NULL ) { // // If the object type doesn't match the inherited object type, // don't inherit the ACE. // if ( NewObjectType == NULL || !RtlEqualMemory( InheritedObjectType, NewObjectType, sizeof(GUID) ) ) { LengthRequired = 0; // // If the object type matches the inherited object type, // Inherit an ACE with no inherited object type. // } else { // // Tell the caller we inherited an object type specific ACE. // *ObjectAceInherited = TRUE; // // If the caller is not going to generate an inheritable ACE, // deleting the inherited object type GUID for the effective ACE. // // Otherwise, leave it so the caller can merge the two ACEs. // if ( !WillGenerateInheritAce ) { *EffectiveAceMapped = TRUE; // // If an object type GUID is present, // simply delete the inherited object type GUID. // if ( RtlObjectAceObjectTypePresent( OldAce )) { LengthRequired -= sizeof(GUID); AceHeaderToCopyLength -= sizeof(GUID); RtlCopyMemory( DummyAce, OldAce, AceHeaderToCopyLength ); AceHeaderToCopy = (PACE_HEADER)DummyAce; ((PKNOWN_OBJECT_ACE)AceHeaderToCopy)->Flags &= ~ACE_INHERITED_OBJECT_TYPE_PRESENT; // // If an object type GUID is not present, // convert the ACE to non-object type specific. // } else { AceHeaderToCopyLength = AceHeaderToCopyLength - sizeof(GUID) + sizeof(KNOWN_ACE) - sizeof(KNOWN_OBJECT_ACE); LengthRequired = LengthRequired - sizeof(GUID) + sizeof(KNOWN_ACE) - sizeof(KNOWN_OBJECT_ACE); RtlCopyMemory( DummyAce, OldAce, AceHeaderToCopyLength ); AceHeaderToCopy = (PACE_HEADER)DummyAce; AceHeaderToCopy->AceType = RtlBaseAceType[ OldAce->AceType ]; } } } } } // // Only proceed if we've not already determined to drop the ACE. // if ( LengthRequired != 0 ) { // // If after mapping the access mask, the access mask // is empty, then drop the ACE. // // This is incompatible with NT 4.0 which simply mapped and left // undefined access bits set. LocalMask = ((PKNOWN_ACE)(OldAce))->Mask; RtlApplyGenericMask( OldAce, &LocalMask, GenericMapping); if ( LocalMask != ((PKNOWN_ACE)(OldAce))->Mask ) { *EffectiveAceMapped = TRUE; } // // Mask off any bits that aren't meaningful // LocalMask &= ( STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL | ACCESS_SYSTEM_SECURITY ); if (LocalMask == 0) { LengthRequired = 0; } else { // // See if the SID in the ACE is one of the various CREATOR_* SIDs by // comparing identifier authorities. // if (RtlEqualPrefixSid ( SidToCopy, CreatorSid )) { Rid = *RtlpSubAuthoritySid( SidToCopy, 0 ); switch (Rid) { case SECURITY_CREATOR_OWNER_RID: SidToCopy = ClientOwnerSid; LengthRequired = LengthRequired - CREATOR_SID_SIZE + SeLengthSid(ClientOwnerSid); *EffectiveAceMapped = TRUE; break; case SECURITY_CREATOR_GROUP_RID: if ( ClientGroupSid != NULL ) { SidToCopy = ClientGroupSid; LengthRequired = LengthRequired - CREATOR_SID_SIZE + SeLengthSid(ClientGroupSid); *EffectiveAceMapped = TRUE; } break; case SECURITY_CREATOR_OWNER_SERVER_RID: SidToCopy = LocalServerOwner; LengthRequired = LengthRequired - CREATOR_SID_SIZE + SeLengthSid(LocalServerOwner); *EffectiveAceMapped = TRUE; break; case SECURITY_CREATOR_GROUP_SERVER_RID: SidToCopy = LocalServerGroup; LengthRequired = LengthRequired - CREATOR_SID_SIZE + SeLengthSid(LocalServerGroup); *EffectiveAceMapped = TRUE; break; default : // // We don't know what this SID is, just copy the original. // break; } } // // If the ACE doesn't fit, // just note the fact and don't copy the ACE. // if ( *AcePosition == NULL || LengthRequired > (ULONG)NewAcl->AclSize - ((PUCHAR)(*AcePosition) - (PUCHAR)NewAcl) ) { *AclOverflowed = TRUE; } else { PUCHAR Target; // // Copy individual parts of the ACE separately. // Target = (PUCHAR)*AcePosition; RtlCopyMemory( Target, AceHeaderToCopy, AceHeaderToCopyLength ); Target += AceHeaderToCopyLength; // // Now copy the correct server SID // if ( ServerSidToCopy != NULL ) { RtlCopyMemory( Target, ServerSidToCopy, SeLengthSid(ServerSidToCopy) ); Target += SeLengthSid(ServerSidToCopy); } // // Now copy the correct SID // RtlCopyMemory( Target, SidToCopy, SeLengthSid(SidToCopy) ); Target += SeLengthSid(SidToCopy); // // Set the size of the ACE accordingly // if ( LengthRequired < (ULONG)(Target - (PUCHAR)*AcePosition) ) { return FALSE; } LengthRequired = (ULONG)(Target - (PUCHAR)*AcePosition); ((PKNOWN_ACE)*AcePosition)->Header.AceSize = (USHORT)LengthRequired; // // Put the mapped access mask in the new ACE // ((PKNOWN_ACE)*AcePosition)->Mask = LocalMask; } } } } else { // // If the ACE doesn't fit, // just note the fact and don't copy the ACE. // if ( LengthRequired > (ULONG)NewAcl->AclSize - ((PUCHAR)*AcePosition - (PUCHAR)NewAcl) ) { *AclOverflowed = TRUE; } else { // // Not a known ACE type, copy ACE as is // RtlCopyMemory( *AcePosition, OldAce, LengthRequired ); } } // // If the ACE was actually kept, clear all the inherit flags // and update the ACE count of the ACL. // if ( !*AclOverflowed && LengthRequired != 0 ) { ((PACE_HEADER)*AcePosition)->AceFlags &= ~VALID_INHERIT_FLAGS; if ( AutoInherit ) { ((PACE_HEADER)*AcePosition)->AceFlags |= INHERITED_ACE; } NewAcl->AceCount += 1; } // // We have the length of the new ACE, but we've calculated // it with a ULONG. It must fit into a USHORT. See if it // does. // if (LengthRequired > 0xFFFF) { return FALSE; } // // Move the Ace Position to where the next ACE goes. // if ( !*AclOverflowed ) { *AcePosition = ((PUCHAR)*AcePosition) + LengthRequired; } // // Now return to our caller // (*NewAceLength) = LengthRequired; return TRUE; }

NTSTATUS RtlpCreateServerAcl (  IN PACL  Acl, IN BOOLEAN  AclUntrusted, IN PSID  ServerSid, OUT PACL *  ServerAcl, OUT BOOLEAN *  ServerAclAllocated )

Definition at line 8588 of file sertl.c. References ASSERT, ExAllocatePoolWithTag, FALSE, FirstAce, KNOWN_ACE, MAKE_TAG, NextAce, NT_SUCCESS, NTSTATUS(), NULL, PagedPool, RTL_PAGED_CODE, RtlAllocateHeap, RtlCreateAcl(), SE_TAG, SeLengthSid, Status, TRUE, and USHORT. Referenced by RtlpNewSecurityObject(), and RtlpSetSecurityObject(). : This routine takes an ACL and converts it into a server ACL. Currently, that means converting all of the GRANT ACEs into Compount Grants, and if necessary sanitizing any Compound Grants that are encountered. Arguments: Return Value: --*/ { USHORT RequiredSize = sizeof(ACL); USHORT AceSizeAdjustment; USHORT ServerSidSize; PACE_HEADER Ace; ULONG i; PVOID Target; PVOID AcePosition; PSID UntrustedSid; PSID ClientSid; NTSTATUS Status; RTL_PAGED_CODE(); if (Acl == NULL) { *ServerAclAllocated = FALSE; *ServerAcl = NULL; return( STATUS_SUCCESS ); } AceSizeAdjustment = sizeof( KNOWN_COMPOUND_ACE ) - sizeof( KNOWN_ACE ); ASSERT( sizeof( KNOWN_COMPOUND_ACE ) >= sizeof( KNOWN_ACE ) ); ServerSidSize = (USHORT)SeLengthSid( ServerSid ); // // Do this in two passes. First, determine how big the final // result is going to be, and then allocate the space and make // the changes. // for (i = 0, Ace = FirstAce(Acl); i < Acl->AceCount; i += 1, Ace = NextAce(Ace)) { // // If it's an ACCESS_ALLOWED_ACE_TYPE, we'll need to add in the // size of the Server SID. // if (Ace->AceType == ACCESS_ALLOWED_ACE_TYPE) { // // Simply add the size of the new Server SID plus whatever // adjustment needs to be made to increase the size of the ACE. // RequiredSize += ( ServerSidSize + AceSizeAdjustment ); } else { if (AclUntrusted && Ace->AceType == ACCESS_ALLOWED_COMPOUND_ACE_TYPE ) { // // Since the Acl is untrusted, we don't care what is in the // server SID, we're going to replace it. // UntrustedSid = RtlCompoundAceServerSid( Ace ); if ((USHORT)SeLengthSid(UntrustedSid) > ServerSidSize) { RequiredSize += ((USHORT)SeLengthSid(UntrustedSid) - ServerSidSize); } else { RequiredSize += (ServerSidSize - (USHORT)SeLengthSid(UntrustedSid)); } } } RequiredSize += Ace->AceSize; } #ifdef NTOS_KERNEL_RUNTIME (*ServerAcl) = (PACL)ExAllocatePoolWithTag( PagedPool, RequiredSize, 'cAeS' ); #else // NTOS_KERNEL_RUNTIME (*ServerAcl) = (PACL)RtlAllocateHeap( RtlProcessHeap(), MAKE_TAG( SE_TAG ), RequiredSize ); #endif // NTOS_KERNEL_RUNTIME if ((*ServerAcl) == NULL) { return STATUS_INSUFFICIENT_RESOURCES; } // // Mark as allocated so caller knows to free it. // *ServerAclAllocated = TRUE; Status = RtlCreateAcl( (*ServerAcl), RequiredSize, ACL_REVISION3 ); ASSERT( NT_SUCCESS( Status )); for (i = 0, Ace = FirstAce(Acl), Target=FirstAce( *ServerAcl ); i < Acl->AceCount; i += 1, Ace = NextAce(Ace)) { // // If it's an ACCESS_ALLOWED_ACE_TYPE, convert to a Server ACE. // if (Ace->AceType == ACCESS_ALLOWED_ACE_TYPE || (AclUntrusted && Ace->AceType == ACCESS_ALLOWED_COMPOUND_ACE_TYPE )) { AcePosition = Target; if (Ace->AceType == ACCESS_ALLOWED_ACE_TYPE) { ClientSid = &((PKNOWN_ACE)Ace)->SidStart; } else { ClientSid = RtlCompoundAceClientSid( Ace ); } // // Copy up to the access mask. // RtlCopyMemory( Target, Ace, FIELD_OFFSET(KNOWN_ACE, SidStart) ); // // Now copy the correct Server SID // Target = ((PCHAR)Target + (UCHAR)(FIELD_OFFSET(KNOWN_COMPOUND_ACE, SidStart))); RtlCopyMemory( Target, ServerSid, SeLengthSid(ServerSid) ); Target = ((PCHAR)Target + (UCHAR)SeLengthSid(ServerSid)); // // Now copy in the correct client SID. We can copy this right out of // the original ACE. // RtlCopyMemory( Target, ClientSid, SeLengthSid(ClientSid) ); Target = ((PCHAR)Target + SeLengthSid(ClientSid)); // // Set the size of the ACE accordingly // ((PKNOWN_COMPOUND_ACE)AcePosition)->Header.AceSize = (USHORT)FIELD_OFFSET(KNOWN_COMPOUND_ACE, SidStart) + (USHORT)SeLengthSid(ServerSid) + (USHORT)SeLengthSid(ClientSid); // // Set the type // ((PKNOWN_COMPOUND_ACE)AcePosition)->Header.AceType = ACCESS_ALLOWED_COMPOUND_ACE_TYPE; ((PKNOWN_COMPOUND_ACE)AcePosition)->CompoundAceType = COMPOUND_ACE_IMPERSONATION; } else { // // Just copy the ACE as is. // RtlCopyMemory( Target, Ace, Ace->AceSize ); Target = ((PCHAR)Target + Ace->AceSize); } } (*ServerAcl)->AceCount = Acl->AceCount; return( STATUS_SUCCESS ); }

NTSTATUS RtlpGenerateInheritAcl (  IN PACL  Acl, IN BOOLEAN  IsDirectoryObject, IN BOOLEAN  AutoInherit, IN PSID  ClientOwnerSid, IN PSID  ClientGroupSid, IN PSID ServerOwnerSid  OPTIONAL, IN PSID ServerGroupSid  OPTIONAL, IN PGENERIC_MAPPING  GenericMapping, IN GUID *NewObjectType  OPTIONAL, OUT PULONG  NewAclSizeParam, OUT PACL  NewAcl, OUT PBOOLEAN  ObjectAceInherited )

Definition at line 5722 of file sertl.c. References FALSE, FirstAce, max, NextAce, NT_SUCCESS, NTSTATUS(), RTL_PAGED_CODE, RtlpGenerateInheritedAce(), Status, and TRUE. Referenced by RtlpInheritAcl2(). : This is a private routine that produces an inheritable ACL. The buffer to contain the inherted ACL is passed in. If the buffer is too small, the corect size is computed and STATUS_BUFFER_TOO_SMALL is returned. Arguments: Acl - Supplies the acl being inherited. IsDirectoryObject - Specifies if the new acl is for a directory. AutoInherit - Specifies if the inheritance is an "automatic inheritance". As such, the inherited ACEs will be marked as such. OwnerSid - Specifies the owner Sid to use. GroupSid - Specifies the group SID to use. GenericMapping - Specifies the generic mapping to use. NewObjectType - Type of object being inherited to. If not specified, the object has no object type. NewAclSizeParam - Receives the length of the inherited ACL. NewAcl - Provides a pointer to the buffer to receive the new (inherited) acl. This ACL must already be initialized. ObjectAceInherited - Returns true if one or more object ACEs were inherited based on NewObjectType Return Value: STATUS_SUCCESS - An inheritable ACL has been generated. STATUS_BAD_INHERITANCE_ACL - Indicates the acl built was not a valid ACL. This can becaused by a number of things. One of the more probable causes is the replacement of a CreatorId with an SID that didn't fit into the ACE or ACL. STATUS_BUFFER_TOO_SMALL - The ACL specified by NewAcl is too small for the inheritance ACEs. The required size is returned in NewAceLength. --*/ { NTSTATUS Status; ULONG i; PACE_HEADER OldAce; ULONG NewAclSize, NewAceSize; ULONG NewAclExtraSize, NewAceExtraSize; BOOLEAN AclOverflowed = FALSE; BOOLEAN LocalObjectAceInherited; RTL_PAGED_CODE(); // // Walk through the original ACL generating any necessary // inheritable ACEs. // NewAclSize = 0; NewAclExtraSize = 0; *ObjectAceInherited = FALSE; for (i = 0, OldAce = FirstAce(Acl); i < Acl->AceCount; i += 1, OldAce = NextAce(OldAce)) { // // RtlpGenerateInheritedAce() will generate the ACE(s) necessary // to inherit a single ACE. This may be 0, 1, or more ACEs. // Status = RtlpGenerateInheritedAce( OldAce, IsDirectoryObject, AutoInherit, ClientOwnerSid, ClientGroupSid, ServerOwnerSid, ServerGroupSid, GenericMapping, NewObjectType, &NewAceSize, NewAcl, &NewAceExtraSize, &LocalObjectAceInherited ); if ( Status == STATUS_BUFFER_TOO_SMALL ) { AclOverflowed = TRUE; Status = STATUS_SUCCESS; } if ( !NT_SUCCESS(Status) ) { return Status; } if ( LocalObjectAceInherited ) { *ObjectAceInherited = TRUE; } // // Make room in the ACL for the new ACE // NewAclSize += NewAceSize; // // If a previous ACE needed 'extra' space, // reduce that requirement by the size of this ACE. // // The previous ACE can use this ACE's space temporarily // if ( NewAceSize > NewAclExtraSize ) { NewAclExtraSize = 0 ; } else { NewAclExtraSize -= NewAceSize; } // // The 'extra' space needed is the larger of that needed by any // previous ACE and that need by this ACE // NewAclExtraSize = max( NewAclExtraSize, NewAceExtraSize ); } // // We only need to include the "ExtraSize" if we've overflowed. // In those cases, the caller will allocate the size we requested and // try again. Otherwise, the caller won't call back so we don't care // if it knows about the extra size. // if ( AclOverflowed ) { (*NewAclSizeParam) = NewAclSize + NewAclExtraSize; return STATUS_BUFFER_TOO_SMALL; } else { (*NewAclSizeParam) = NewAclSize; return STATUS_SUCCESS; } }

NTSTATUS RtlpGenerateInheritedAce (  IN PACE_HEADER  OldAce, IN BOOLEAN  IsDirectoryObject, IN BOOLEAN  AutoInherit, IN PSID  ClientOwnerSid, IN PSID  ClientGroupSid, IN PSID ServerOwnerSid  OPTIONAL, IN PSID ServerGroupSid  OPTIONAL, IN PGENERIC_MAPPING  GenericMapping, IN GUID *NewObjectType  OPTIONAL, OUT PULONG  NewAceLength, OUT PACL  NewAcl, OUT PULONG  NewAceExtraLength, OUT PBOOLEAN  ObjectAceInherited )

Definition at line 5381 of file sertl.c. References ASSERT, CREATOR_SID_SIZE, FALSE, max, NULL, RTL_PAGED_CODE, RtlFirstFreeAce(), RtlLengthRequiredSid(), RtlpCopyEffectiveAce(), RtlpIsDuplicateAce(), and TRUE. Referenced by RtlpGenerateInheritAcl(). : This is a private routine that checks if the input ace is inheritable and produces 0, 1, or 2 inherited aces in the given buffer. Arguments: OldAce - Supplies the ace being inherited IsDirectoryObject - Specifies if the new ACE is for a directory AutoInherit - Specifies if the inheritance is an "automatic inheritance". As such, the inherited ACEs will be marked as such. ClientOwnerSid - Specifies the owner Sid to use ClientGroupSid - Specifies the new Group Sid to use ServerSid - Optionally specifies the Server Sid to use in compound ACEs. ClientSid - Optionally specifies the Client Sid to use in compound ACEs. GenericMapping - Specifies the generic mapping to use NewObjectType - Type of object being inherited to. If not specified, the object has no object type. NewAceLength - Receives the length (number of bytes) needed to allow for the inheritance of the specified ACE. This might be zero. NewAcl - Provides a pointer to the ACL into which the ACE is to be inherited. NewAceExtraLength - Receives a length (number of bytes) temporarily used in the ACL for the inheritance ACE. This might be zero ObjectAceInherited - Returns true if one or more object ACEs were inherited based on NewObjectType Return Value: STATUS_SUCCESS - The ACE was inherited successfully. STATUS_BAD_INHERITANCE_ACL - Indicates something went wrong preventing the ACE from being inherited. This generally represents a bugcheck situation when returned from this call. STATUS_BUFFER_TOO_SMALL - The ACL specified by NewAcl is too small for the inheritance ACEs. The required size is returned in NewAceLength. --*/ { // // // !!!!!!!!! This is tricky !!!!!!!!!! // // // // The inheritence flags AND the sid of the ACE determine whether // // we need 0, 1, or 2 ACEs. // // // // BE CAREFUL WHEN CHANGING THIS CODE. READ THE DSA ACL ARCHITECTURE // // SECTION COVERING INHERITENCE BEFORE ASSUMING YOU KNOW WHAT THE HELL // // YOU ARE DOING!!!! // // // // The general gist of the algorithm is: // // // // if ( (container && ContainerInherit) || // // (!container && ObjectInherit) ) { // // GenerateEffectiveAce; // // } // // // // // // if (Container && Propagate) { // // Propogate copy of ACE and set InheritOnly; // // } // // // // // // A slightly more accurate description of this algorithm is: // // // // IO === InheritOnly flag // // CI === ContainerInherit flag // // OI === ObjectInherit flag // // NPI === NoPropagateInherit flag // // // // if ( (container && CI) || // // (!container && OI) ) { // // Copy Header of ACE; // // Clear IO, NPI, CI, OI; // // // // if (KnownAceType) { // // if (SID is a creator ID) { // // Copy appropriate creator SID; // // } else { // // Copy SID of original; // // } // // // // Copy AccessMask of original; // // MapGenericAccesses; // // if (AccessMask == 0) { // // discard new ACE; // // } // // // // } else { // // Copy body of ACE; // // } // // // // } // // // // if (!NPI) { // // Copy ACE as is; // // Set IO; // // } // // // // // // // ULONG LengthRequired = 0; ULONG ExtraLengthRequired = 0; PVOID AcePosition; PVOID EffectiveAcePosition; ULONG EffectiveAceSize = 0; BOOLEAN EffectiveAceMapped; BOOLEAN AclOverflowed = FALSE; BOOLEAN GenerateInheritAce; RTL_PAGED_CODE(); // // This is gross and ugly, but it's better than allocating // virtual memory to hold the ClientSid, because that can // fail, and propogating the error back is a tremendous pain // ASSERT(RtlLengthRequiredSid( 1 ) == CREATOR_SID_SIZE); *ObjectAceInherited = FALSE; GenerateInheritAce = IsDirectoryObject && Propagate(OldAce); // // Allocate and initialize the universal SIDs we're going to need // to look for inheritable ACEs. // if (!RtlFirstFreeAce( NewAcl, &AcePosition ) ) { return STATUS_BAD_INHERITANCE_ACL; } // // check to see if we will have a effective ACE (one mapped to // the target object type). // if ( (IsDirectoryObject && ContainerInherit(OldAce)) || (!IsDirectoryObject && ObjectInherit(OldAce)) ) { // // Remember where the effective ACE will be copied to. // EffectiveAcePosition = AcePosition; // // Copy the effective ACE into the ACL. // if ( !RtlpCopyEffectiveAce ( OldAce, AutoInherit, GenerateInheritAce, ClientOwnerSid, ClientGroupSid, ServerOwnerSid, ServerGroupSid, GenericMapping, NewObjectType, &AcePosition, &EffectiveAceSize, NewAcl, ObjectAceInherited, &EffectiveAceMapped, &AclOverflowed ) ) { return STATUS_BAD_INHERITANCE_ACL; } // // If the effective ACE is a duplicate of existing inherited ACEs, // Don't really generate it. // if ( !AclOverflowed && EffectiveAceSize > 0 && EffectiveAcePosition != NULL && RtlpIsDuplicateAce( NewAcl, EffectiveAcePosition, NewObjectType ) ) { // // Truncate the ACE we just added. // NewAcl->AceCount--; AcePosition = EffectiveAcePosition; ExtraLengthRequired = max( ExtraLengthRequired, EffectiveAceSize ); EffectiveAceSize = 0; } LengthRequired += EffectiveAceSize; } // // If we are inheriting onto a container, then we may need to // propagate the inheritance as well. // if ( GenerateInheritAce ) { // // If a effective ACE was created, // and it wasn't mapped, // avoid generating another ACE and simply merge the inheritance bits into // the effective ACE. // if ( EffectiveAceSize != 0 && !EffectiveAceMapped ) { // // Copy the inherit bits from the original ACE. // if ( !AclOverflowed ) { ((PACE_HEADER)EffectiveAcePosition)->AceFlags |= ((PACE_HEADER)OldAce)->AceFlags & (CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE); if ( AutoInherit ) { ((PACE_HEADER)EffectiveAcePosition)->AceFlags |= INHERITED_ACE; } } // // Otherwise, generate an explicit inheritance ACE. // // But only if the access mask isn't zero. // } else if ( !IsMSAceType(OldAce) || ((PKNOWN_ACE)(OldAce))->Mask != 0 ) { // // Account for the new ACE being added to the ACL. // LengthRequired += (ULONG)(((PACE_HEADER)OldAce)->AceSize); if (LengthRequired > 0xFFFF) { return STATUS_BAD_INHERITANCE_ACL; } // // If the ACE doesn't fit, // just note the fact and don't copy the ACE. // if ( ((PACE_HEADER)OldAce)->AceSize > NewAcl->AclSize - ((PUCHAR)AcePosition - (PUCHAR)NewAcl) ) { AclOverflowed = TRUE; } else if (!AclOverflowed){ // // copy it as is, but make sure the InheritOnly bit is set. // RtlCopyMemory( AcePosition, OldAce, ((PACE_HEADER)OldAce)->AceSize ); ((PACE_HEADER)AcePosition)->AceFlags |= INHERIT_ONLY_ACE; NewAcl->AceCount += 1; if ( AutoInherit ) { ((PACE_HEADER)AcePosition)->AceFlags |= INHERITED_ACE; // // If the inheritance ACE is a duplicate of existing inherited ACEs, // Don't really generate it. // if ( RtlpIsDuplicateAce( NewAcl, AcePosition, NewObjectType ) ) { // // Truncate the ACE we just added. // NewAcl->AceCount--; ExtraLengthRequired = max( ExtraLengthRequired, ((PACE_HEADER)OldAce)->AceSize ); LengthRequired -= (ULONG)(((PACE_HEADER)OldAce)->AceSize); } } } } } // // Now return to our caller // (*NewAceLength) = LengthRequired; (*NewAceExtraLength) = ExtraLengthRequired; return AclOverflowed ? STATUS_BUFFER_TOO_SMALL : STATUS_SUCCESS; }

NTSTATUS RtlpGetDefaultsSubjectContext (  HANDLE  ClientToken, OUT PTOKEN_OWNER *  OwnerInfo, OUT PTOKEN_PRIMARY_GROUP *  GroupInfo, OUT PTOKEN_DEFAULT_DACL *  DefaultDaclInfo, OUT PTOKEN_OWNER *  ServerOwner, OUT PTOKEN_PRIMARY_GROUP *  ServerGroup )

Definition at line 8795 of file sertl.c. References ClientToken, FALSE, HeapHandle, MAKE_TAG, NT_SUCCESS, NtClose(), NtOpenProcessToken(), NtQueryInformationToken(), NTSTATUS(), NULL, PrimaryToken, RtlAllocateHeap, RtlFreeHeap, SE_TAG, Status, and TRUE. Referenced by RtlpNewSecurityObject(). { HANDLE PrimaryToken; PVOID HeapHandle; NTSTATUS Status; ULONG ServerGroupInfoSize; ULONG ServerOwnerInfoSize; ULONG TokenDaclInfoSize; ULONG TokenGroupInfoSize; ULONG TokenOwnerInfoSize; BOOLEAN ClosePrimaryToken = FALSE; *OwnerInfo = NULL; *GroupInfo = NULL; *DefaultDaclInfo = NULL; *ServerOwner = NULL; *ServerGroup = NULL; HeapHandle = RtlProcessHeap(); // // If the caller doesn't know the client token, // simply don't return any information. // if ( ClientToken != NULL ) { // // Obtain the default owner from the client. // Status = NtQueryInformationToken( ClientToken, // Handle TokenOwner, // TokenInformationClass NULL, // TokenInformation 0, // TokenInformationLength &TokenOwnerInfoSize // ReturnLength ); if ( STATUS_BUFFER_TOO_SMALL != Status ) { goto Cleanup; } *OwnerInfo = RtlAllocateHeap( HeapHandle, MAKE_TAG( SE_TAG ), TokenOwnerInfoSize ); if ( *OwnerInfo == NULL ) { Status = STATUS_NO_MEMORY; goto Cleanup; } Status = NtQueryInformationToken( ClientToken, // Handle TokenOwner, // TokenInformationClass *OwnerInfo, // TokenInformation TokenOwnerInfoSize, // TokenInformationLength &TokenOwnerInfoSize // ReturnLength ); if (!NT_SUCCESS( Status )) { goto Cleanup; } // // Obtain the default group from the client token. // Status = NtQueryInformationToken( ClientToken, // Handle TokenPrimaryGroup, // TokenInformationClass *GroupInfo, // TokenInformation 0, // TokenInformationLength &TokenGroupInfoSize // ReturnLength ); if ( STATUS_BUFFER_TOO_SMALL != Status ) { goto Cleanup; } *GroupInfo = RtlAllocateHeap( HeapHandle, MAKE_TAG( SE_TAG ), TokenGroupInfoSize ); if ( *GroupInfo == NULL ) { Status = STATUS_NO_MEMORY; goto Cleanup; } Status = NtQueryInformationToken( ClientToken, // Handle TokenPrimaryGroup, // TokenInformationClass *GroupInfo, // TokenInformation TokenGroupInfoSize, // TokenInformationLength &TokenGroupInfoSize // ReturnLength ); if (!NT_SUCCESS( Status )) { goto Cleanup; } Status = NtQueryInformationToken( ClientToken, // Handle TokenDefaultDacl, // TokenInformationClass *DefaultDaclInfo, // TokenInformation 0, // TokenInformationLength &TokenDaclInfoSize // ReturnLength ); if ( STATUS_BUFFER_TOO_SMALL != Status ) { goto Cleanup; } *DefaultDaclInfo = RtlAllocateHeap( HeapHandle, MAKE_TAG( SE_TAG ), TokenDaclInfoSize ); if ( *DefaultDaclInfo == NULL ) { Status = STATUS_NO_MEMORY; goto Cleanup; } Status = NtQueryInformationToken( ClientToken, // Handle TokenDefaultDacl, // TokenInformationClass *DefaultDaclInfo, // TokenInformation TokenDaclInfoSize, // TokenInformationLength &TokenDaclInfoSize // ReturnLength ); if (!NT_SUCCESS( Status )) { goto Cleanup; } } // // Now open the primary token to determine how to substitute for // ServerOwner and ServerGroup. // Status = NtOpenProcessToken( NtCurrentProcess(), TOKEN_QUERY, &PrimaryToken ); if (!NT_SUCCESS( Status )) { ClosePrimaryToken = FALSE; goto Cleanup; } else { ClosePrimaryToken = TRUE; } Status = NtQueryInformationToken( PrimaryToken, // Handle TokenOwner, // TokenInformationClass NULL, // TokenInformation 0, // TokenInformationLength &ServerOwnerInfoSize // ReturnLength ); if ( STATUS_BUFFER_TOO_SMALL != Status ) { goto Cleanup; } *ServerOwner = RtlAllocateHeap( HeapHandle, MAKE_TAG( SE_TAG ), ServerOwnerInfoSize ); if ( *ServerOwner == NULL ) { Status = STATUS_NO_MEMORY; goto Cleanup; } Status = NtQueryInformationToken( PrimaryToken, // Handle TokenOwner, // TokenInformationClass *ServerOwner, // TokenInformation ServerOwnerInfoSize, // TokenInformationLength &ServerOwnerInfoSize // ReturnLength ); if (!NT_SUCCESS( Status )) { goto Cleanup; } // // Find the server group. // Status = NtQueryInformationToken( PrimaryToken, // Handle TokenPrimaryGroup, // TokenInformationClass *ServerGroup, // TokenInformation 0, // TokenInformationLength &ServerGroupInfoSize // ReturnLength ); if ( STATUS_BUFFER_TOO_SMALL != Status ) { goto Cleanup; } *ServerGroup = RtlAllocateHeap( HeapHandle, MAKE_TAG( SE_TAG ), ServerGroupInfoSize ); if ( *ServerGroup == NULL ) { goto Cleanup; } Status = NtQueryInformationToken( PrimaryToken, // Handle TokenPrimaryGroup, // TokenInformationClass *ServerGroup, // TokenInformation ServerGroupInfoSize, // TokenInformationLength &ServerGroupInfoSize // ReturnLength ); if (!NT_SUCCESS( Status )) { goto Cleanup; } NtClose( PrimaryToken ); return( STATUS_SUCCESS ); Cleanup: if (*OwnerInfo != NULL) { RtlFreeHeap( HeapHandle, 0, (PVOID)*OwnerInfo ); *OwnerInfo = NULL; } if (*GroupInfo != NULL) { RtlFreeHeap( HeapHandle, 0, (PVOID)*GroupInfo ); *GroupInfo = NULL; } if (*DefaultDaclInfo != NULL) { RtlFreeHeap( HeapHandle, 0, (PVOID)*DefaultDaclInfo ); *DefaultDaclInfo = NULL; } if (*ServerOwner != NULL) { RtlFreeHeap( HeapHandle, 0, (PVOID)*ServerOwner ); *ServerOwner = NULL; } if (*ServerGroup != NULL) { RtlFreeHeap( HeapHandle, 0, (PVOID)*ServerGroup ); *ServerGroup = NULL; } if (ClosePrimaryToken == TRUE) { NtClose( PrimaryToken ); } return( Status ); }

NTSTATUS RtlpInheritAcl (  IN PACL  DirectoryAcl, IN PACL  ChildAcl, IN ULONG  ChildGenericControl, IN BOOLEAN  IsDirectoryObject, IN BOOLEAN  AutoInherit, IN BOOLEAN  DefaultDescriptorForObject, IN PSID  OwnerSid, IN PSID  GroupSid, IN PSID ServerOwnerSid  OPTIONAL, IN PSID ServerGroupSid  OPTIONAL, IN PGENERIC_MAPPING  GenericMapping, IN BOOLEAN  IsSacl, IN GUID *NewObjectType  OPTIONAL, OUT PACL *  NewAcl, OUT PBOOLEAN  NewAclExplicitlyAssigned, OUT PULONG  NewGenericControl )

Definition at line 5153 of file sertl.c. References ExAllocatePoolWithTag, ExFreePool(), HeapHandle, MAKE_TAG, NT_SUCCESS, NTSTATUS(), NULL, PagedPool, RTL_PAGED_CODE, RtlAllocateHeap, RtlFreeHeap, RtlpInheritAcl2(), SE_TAG, and Status. Referenced by RtlpConvertAclToAutoInherit(), RtlpNewSecurityObject(), and SepInheritAcl(). : This is a private routine that produces an inherited acl from a parent acl according to the rules of inheritance Arguments: DirectoryAcl - Supplies the acl being inherited. ChildAcl - Supplies the acl associated with the object. This is either the current acl on the object or the acl being assigned to the object. ChildGenericControl - Specifies the control flags from the SecurityDescriptor describing the ChildAcl: SEP_ACL_PRESENT: Specifies that the child ACL is explictly supplied by the caller. SEP_ACL_DEFAULTED: Specifies that the child ACL was supplied by some defaulting mechanism. SEP_ACL_PROTECTED: Specifies that the child ACL is protected and should not inherit any ACE from the DirectoryACL IsDirectoryObject - Specifies if the new acl is for a directory. AutoInherit - Specifies if the inheritance is an "automatic inheritance". As such, the non-inherited ACEs from the ChildAcl will be preserved and the inherited ACEs from the DirectoryAcl will be marked as such. DefaultDescriptorForObject - If set, the CreatorDescriptor is the default descriptor for ObjectType. As such, the CreatorDescriptor will be ignored if any ObjectType specific ACEs are inherited from the parent. If not such ACEs are inherited, the CreatorDescriptor is handled as though this flag were not specified. OwnerSid - Specifies the owner Sid to use. GroupSid - Specifies the group SID to use. GenericMapping - Specifies the generic mapping to use. IsSacl - True if this is the SACL. False if this is the DACL. NewObjectType - Type of object being inherited to. If not specified, the object has no object type. NewAcl - Receives a pointer to the new (inherited) acl. NewAclExplicitlyAssigned - Returns true to indicate that some portion of "NewAcl" was derived from an the explicit ChildAcl NewGenericControl - Specifies the control flags for the newly generated ACL. SEP_ACL_AUTO_INHERITED: Set if the ACL was generated using the Automatic Inheritance algorithm. SEP_ACL_PROTECTED: Specifies that the ACL is protected and was not inherited from the parent ACL. Return Value: STATUS_SUCCESS - An inheritable ACL was successfully generated. STATUS_NO_INHERITANCE - An inheritable ACL was not successfully generated. This is a warning completion status. STATUS_BAD_INHERITANCE_ACL - Indicates the acl built was not a valid ACL. This can becaused by a number of things. One of the more probable causes is the replacement of a CreatorId with an SID that didn't fit into the ACE or ACL. STATUS_UNKNOWN_REVISION - Indicates the source ACL is a revision that is unknown to this routine. --*/ { // // // The logic in the ACL inheritance code must mirror the code for // // inheritance in the executive (in seassign.c). Do not make changes // // here without also making changes in that module. // // // NTSTATUS Status; ULONG AclBufferSize; ULONG i; #ifndef NTOS_KERNEL_RUNTIME PVOID HeapHandle; #endif // NTOS_KERNEL_RUNTIME RTL_PAGED_CODE(); // // Get the handle to the current process heap // #ifndef NTOS_KERNEL_RUNTIME HeapHandle = RtlProcessHeap(); #endif // NTOS_KERNEL_RUNTIME // // Implement a two pass strategy. // // First try to create the ACL in a fixed length buffer. // If that is too small, // then use the buffer size determined on the first pass // AclBufferSize = 1024; // Typical maximum size of an ACL for ( i=0; i<2 ; i++ ) { // // Allocate heap for the new ACL. // #ifdef NTOS_KERNEL_RUNTIME (*NewAcl) = ExAllocatePoolWithTag( PagedPool, AclBufferSize, 'cAeS' ); #else // NTOS_KERNEL_RUNTIME (*NewAcl) = RtlAllocateHeap( HeapHandle, MAKE_TAG(SE_TAG), AclBufferSize ); #endif // NTOS_KERNEL_RUNTIME if ((*NewAcl) == NULL ) { return( STATUS_NO_MEMORY ); } // // Actually build the inherited ACL. // Status = RtlpInheritAcl2 ( DirectoryAcl, ChildAcl, ChildGenericControl, IsDirectoryObject, AutoInherit, DefaultDescriptorForObject, OwnerSid, GroupSid, ServerOwnerSid, ServerGroupSid, GenericMapping, IsSacl, NewObjectType, &AclBufferSize, (PUCHAR) *NewAcl, NewAclExplicitlyAssigned, NewGenericControl ); if ( NT_SUCCESS(Status) ) { // // If a NULL ACL should be used, // tell the caller. // if ( AclBufferSize == 0 ) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( *NewAcl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, *NewAcl ); #endif // NTOS_KERNEL_RUNTIME *NewAcl = NULL; } break; } else { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( *NewAcl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, *NewAcl ); #endif // NTOS_KERNEL_RUNTIME *NewAcl = NULL; if ( Status != STATUS_BUFFER_TOO_SMALL ) { break; } } } return Status; }

NTSTATUS RtlpInheritAcl2 (  IN PACL  DirectoryAcl, IN PACL  ChildAcl, IN ULONG  ChildGenericControl, IN BOOLEAN  IsDirectoryObject, IN BOOLEAN  AutoInherit, IN BOOLEAN  DefaultDescriptorForObject, IN PSID  OwnerSid, IN PSID  GroupSid, IN PSID ServerOwnerSid  OPTIONAL, IN PSID ServerGroupSid  OPTIONAL, IN PGENERIC_MAPPING  GenericMapping, IN BOOLEAN  IsSacl, IN GUID *NewObjectType  OPTIONAL, IN PULONG  AclBufferSize, IN OUT PUCHAR  AclBuffer, OUT PBOOLEAN  NewAclExplicitlyAssigned, OUT PULONG  NewGenericControl )

Definition at line 4716 of file sertl.c. References ACE_TYPE_TO_COPY, CopyAllAces, CopyNonInheritedAces, FALSE, FirstAce, max, NT_SUCCESS, NTSTATUS(), NULL, RTL_PAGED_CODE, RtlCreateAcl(), RtlFirstFreeAce(), RtlpCopyAces(), RtlpGenerateInheritAcl(), Status, TRUE, and USHORT. Referenced by RtlpInheritAcl(). : This is a private routine that produces an inherited acl from a parent acl according to the rules of inheritance Arguments: DirectoryAcl - Supplies the acl being inherited. ChildAcl - Supplies the acl associated with the object. This is either the current acl on the object or the acl being assigned to the object. ChildGenericControl - Specifies the control flags from the SecurityDescriptor describing the ChildAcl: SEP_ACL_PRESENT: Specifies that the child ACL is explictly supplied by the caller. SEP_ACL_DEFAULTED: Specifies that the child ACL was supplied by some defaulting mechanism. SEP_ACL_PROTECTED: Specifies that the child ACL is protected and should not inherit any ACE from the DirectoryACL IsDirectoryObject - Specifies if the new acl is for a directory. AutoInherit - Specifies if the inheritance is an "automatic inheritance". As such, the non-inherited ACEs from the ChildAcl will be preserved and the inherited ACEs from the DirectoryAcl will be marked as such. DefaultDescriptorForObject - If set, the CreatorDescriptor is the default descriptor for ObjectType. As such, the CreatorDescriptor will be ignored if any ObjectType specific ACEs are inherited from the parent. If not such ACEs are inherited, the CreatorDescriptor is handled as though this flag were not specified. OwnerSid - Specifies the owner Sid to use. GroupSid - Specifies the group SID to use. GenericMapping - Specifies the generic mapping to use. IsSacl - True if this is the SACL. False if this is the DACL. NewObjectType - Type of object being inherited to. If not specified, the object has no object type. AclBufferSize - On input, specifies the size of AclBuffer. On output, on success, returns the used size of AclBuffer. On output, if the buffer is too small, returns the required size of AclBuffer. AclBuffer - Receives a pointer to the new (inherited) acl. NewAclExplicitlyAssigned - Returns true to indicate that some portion of "NewAcl" was derived from an the explicit ChildAcl NewGenericControl - Specifies the control flags for the newly generated ACL. SEP_ACL_AUTO_INHERITED: Set if the ACL was generated using the Automatic Inheritance algorithm. SEP_ACL_PROTECTED: Specifies that the ACL is protected and was not inherited from the parent ACL. Return Value: STATUS_SUCCESS - An inheritable ACL was successfully generated. STATUS_NO_INHERITANCE - An inheritable ACL was not successfully generated. This is a warning completion status. The caller should use the default ACL. STATUS_BAD_INHERITANCE_ACL - Indicates the acl built was not a valid ACL. This can becaused by a number of things. One of the more probable causes is the replacement of a CreatorId with an SID that didn't fit into the ACE or ACL. STATUS_UNKNOWN_REVISION - Indicates the source ACL is a revision that is unknown to this routine. STATUS_BUFFER_TOO_SMALL - The ACL specified by NewAcl is too small for the inheritance ACEs. The required size is returned in AclBufferSize. --*/ { NTSTATUS Status; ULONG ChildNewAclSize = 0; ULONG UsedChildNewAclSize = 0; ULONG DirectoryNewAclSize = 0; ULONG AclRevision; USHORT ChildAceCount; PVOID ChildAcePosition; PVOID DirectoryAcePosition; BOOLEAN AclOverflowed = FALSE; BOOLEAN AclProtected = FALSE; BOOLEAN NullAclOk = TRUE; BOOLEAN ObjectAceInherited; RTL_PAGED_CODE(); // // Assume the ACL revision. // AclRevision = ACL_REVISION; RtlCreateAcl( (PACL)AclBuffer, *AclBufferSize, AclRevision ); *NewAclExplicitlyAssigned = FALSE; *NewGenericControl = AutoInherit ? SEP_ACL_AUTO_INHERITED : 0; // // If the a current child ACL is not defaulted, // the non-inherited ACEs from the current child ACL are to be preserved. // if ( (ChildGenericControl & SEP_ACL_DEFAULTED) == 0 ) { // // The resultant ACL should be protected if the input ACL is // protected. // if ( ChildGenericControl & SEP_ACL_PROTECTED ) { AclProtected = TRUE; *NewGenericControl |= SEP_ACL_PROTECTED; } // // Only copy ACEs if the child ACL is actually present. // if ( (ChildGenericControl & (SEP_ACL_PRESENT|SEP_ACL_PROTECTED)) != 0 ) { if ( ChildAcl != NULL ) { ACE_TYPE_TO_COPY AceTypeToCopy; UCHAR AceFlagsToReset; BOOLEAN MapSids; AclRevision = max( AclRevision, ChildAcl->AclRevision ); // // Since we're explicitly using the ACL specified by the caller, // we never want to return a NULL ACL. // Rather, if we have an ACL with no ACEs, // we'll return exactly that. For a DACL, that results // in a DACL that grants no access rather than a DACL // that grants all access. // NullAclOk = FALSE; // // If the caller doesn't understand auto inheritance, // simply preserve the specified ACL 100% intact. // if ( !AutoInherit ) { AceTypeToCopy = CopyAllAces; AceFlagsToReset = 0; // Don't turn off any ACE Flags MapSids = FALSE; // For backward compatibility // // If the child is protected, // keep all of the ACEs turning off the INHERITED ACE flags. // } else if ( ChildGenericControl & SEP_ACL_PROTECTED ) { AceTypeToCopy = CopyAllAces; AceFlagsToReset = INHERITED_ACE; // Turn off all INHERITED_ACE flags MapSids = TRUE; // // If the child is not protected, // just copy the non-inherited ACEs. // // (The inherited ACEs will be recomputed from the parent.) // } else { AceTypeToCopy = CopyNonInheritedAces; AceFlagsToReset = 0; // Don't turn off any ACE Flags MapSids = TRUE; } // // Copy the requested ACEs. // Status = RtlpCopyAces( ChildAcl, GenericMapping, AceTypeToCopy, AceFlagsToReset, MapSids, OwnerSid, GroupSid, ServerOwnerSid, ServerGroupSid, &ChildNewAclSize, (PACL)AclBuffer ); UsedChildNewAclSize = ChildNewAclSize; if ( Status == STATUS_BUFFER_TOO_SMALL ) { AclOverflowed = TRUE; Status = STATUS_SUCCESS; } if ( !NT_SUCCESS(Status) ) { return Status; } // // If this ACL might be ignored later, // remember the current state of the ACL. // if ( DefaultDescriptorForObject && ChildNewAclSize != 0 ) { ChildAceCount = ((PACL)AclBuffer)->AceCount; if (!RtlFirstFreeAce( (PACL)AclBuffer, &ChildAcePosition ) ) { return STATUS_BAD_INHERITANCE_ACL; } } // // If the ACL isn't protected, // don't allow NULL ACL semantics. // (those semantics are ambiguous for auto inheritance) // } else if ( AutoInherit && !IsSacl && (ChildGenericControl & (SEP_ACL_PRESENT|SEP_ACL_PROTECTED)) == SEP_ACL_PRESENT ) { return STATUS_INVALID_ACL; } *NewAclExplicitlyAssigned = TRUE; } } // // Inherit ACEs from the Directory ACL in any of the following cases: // If !AutoInheriting, // Inherit if there is no explicit child ACL (ignoring a defaulted child). // If AutoInheriting, // observe the protected flag. // if ( (!AutoInherit && (ChildGenericControl & SEP_ACL_PRESENT) == 0 || (ChildGenericControl & SEP_ACL_DEFAULTED) != 0) || (AutoInherit && !AclProtected) ) { // // If there is no directory ACL, // don't inherit from it. // if ( DirectoryAcl != NULL ) { // // If the DirectoryAcl is used, // the revision of the Directory ACL is picked up. // if ( !ValidAclRevision(DirectoryAcl) ) { return STATUS_UNKNOWN_REVISION; } AclRevision = max( AclRevision, DirectoryAcl->AclRevision ); // // Inherit the Parent's ACL. // Status = RtlpGenerateInheritAcl( DirectoryAcl, IsDirectoryObject, AutoInherit, OwnerSid, GroupSid, ServerOwnerSid, ServerGroupSid, GenericMapping, NewObjectType, &DirectoryNewAclSize, (PACL)AclBuffer, &ObjectAceInherited ); if ( Status == STATUS_BUFFER_TOO_SMALL ) { AclOverflowed = TRUE; Status = STATUS_SUCCESS; } if ( !NT_SUCCESS(Status) ) { return Status; } // // If the default descriptor for the object should be ditched, // because object specific ACEs were inherited from the directory, // ditch them now. // if ( DefaultDescriptorForObject && ChildNewAclSize != 0 && ObjectAceInherited && !AclOverflowed ) { // // Compute the last used byte of the combined ACL // if (!RtlFirstFreeAce( (PACL)AclBuffer, &DirectoryAcePosition ) ) { return STATUS_BAD_INHERITANCE_ACL; } if ( DirectoryAcePosition == NULL ) { DirectoryAcePosition = AclBuffer + ((PACL)AclBuffer)->AclSize; } // // Move all the inherited ACEs to the front of the ACL. // RtlMoveMemory( FirstAce( AclBuffer ), ChildAcePosition, (ULONG)(((PUCHAR)DirectoryAcePosition) - (PUCHAR)ChildAcePosition) ); // // Adjust the ACE count to remove the deleted ACEs // ((PACL)AclBuffer)->AceCount -= ChildAceCount; // // Save the number of bytes of the Child ACL that were // actually used. // UsedChildNewAclSize = 0; } } } // // If this routine didn't build the ACL, // tell the caller. // if ( DirectoryNewAclSize + UsedChildNewAclSize == 0) { // // If the ACL was not explicitly assigned, // tell the caller to default the ACL. // if ( !(*NewAclExplicitlyAssigned) ) { *AclBufferSize = 0; return STATUS_NO_INHERITANCE; // // If the Acl was explictly assigned, // generate a NULL ACL based on the path taken above. // } else if ( NullAclOk ) { *AclBufferSize = 0; return STATUS_SUCCESS; } // DbgBreakPoint(); } // // And make sure we don't exceed the length limitations of an ACL (WORD) // if ( DirectoryNewAclSize + UsedChildNewAclSize + sizeof(ACL) > 0xFFFF) { return(STATUS_BAD_INHERITANCE_ACL); } // BUGBUG: The caller has to allocate a buffer large enough for // ChildNewAclSize rather than UsedChildNewAclSize. Due to the nature of // my algorithm above. (*AclBufferSize) = DirectoryNewAclSize + ChildNewAclSize + sizeof(ACL); if ( AclOverflowed ) { return STATUS_BUFFER_TOO_SMALL; } // // Patch the real ACL size and revision into the ACL // ((PACL)AclBuffer)->AclSize = (USHORT) (DirectoryNewAclSize + UsedChildNewAclSize + sizeof(ACL)); ((PACL)AclBuffer)->AclRevision = (UCHAR) AclRevision; return STATUS_SUCCESS; }

BOOLEAN RtlpIsDuplicateAce (  IN PACL  Acl, IN PKNOWN_ACE  NewAce, IN GUID *ObjectType  OPTIONAL )

Definition at line 8362 of file sertl.c. References FALSE, FirstAce, NextAce, NTSTATUS(), NULL, RTL_PAGED_CODE, RtlpCompareAces(), RtlpVerboseConvert, Status, and TRUE. Referenced by RtlpGenerateInheritedAce(). : This routine determine if an ACE is a duplicate of an ACE already in an ACL. If so, the NewAce can be removed from the end of the ACL. This routine currently only detects duplicate version 4 ACEs. If the ACE isn't version 4, the ACE will be declared to be a non-duplicate. This routine only detects duplicate INHERTED ACEs. Arguments: Acl - Existing ACL NewAce - Ace to determine if it is already in Acl. NewAce is expected to be the last ACE in "Acl". ObjectType - GUID of the object type represented by Acl. If the object has no GUID associated with it, then this argument is specified as NULL. Return Value: TRUE - NewAce is a duplicate of another ACE on the Acl FALSE - NewAce is NOT a duplicate of another ACE on the Acl --*/ { NTSTATUS Status; BOOLEAN RetVal = FALSE; LONG AceIndex; ACCESS_MASK NewAceContainerInheritMask; ACCESS_MASK NewAceObjectInheritMask; ACCESS_MASK NewAceEffectiveMask; ACCESS_MASK LocalMask; PKNOWN_ACE AceFromAcl; RTL_PAGED_CODE(); // // Ensure the passed in ACE is one this routine understands // if ( !IsV4AceType(NewAce) || IsCompoundAceType(NewAce)) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("New Ace type (%ld) not known\n", NewAce->Header.AceType )); } #endif // DBG RetVal = FALSE; goto Cleanup; } // // This routine only works for ACEs marked as INHERITED. // if ( (NewAce->Header.AceFlags & INHERITED_ACE ) == 0 ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("New Ace type isn't inherited\n" )); } #endif // DBG RetVal = FALSE; goto Cleanup; } // // Break the new ACE into its component parts. // // All V4 aces have an access mask in the same location. // LocalMask = ((PKNOWN_ACE)(NewAce))->Mask; if ( NewAce->Header.AceFlags & CONTAINER_INHERIT_ACE ) { NewAceContainerInheritMask = LocalMask; } else { NewAceContainerInheritMask = 0; } if ( NewAce->Header.AceFlags & OBJECT_INHERIT_ACE ) { NewAceObjectInheritMask = LocalMask; } else { NewAceObjectInheritMask = 0; } if ( (NewAce->Header.AceFlags & INHERIT_ONLY_ACE) == 0 ) { NewAceEffectiveMask = LocalMask; } else { NewAceEffectiveMask = 0; } #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Starting MASKs: %8.8lX %8.8lX %8.8lX", NewAceEffectiveMask, NewAceContainerInheritMask, NewAceObjectInheritMask )); } #endif // DBG // // Walk through the ACL one ACE at a time. // for (AceIndex = 0, AceFromAcl = FirstAce(Acl); AceIndex < Acl->AceCount-1; // NewAce is the last ACE AceIndex += 1, AceFromAcl = NextAce(AceFromAcl)) { // // If the ACE isn't a valid version 4 ACE, // this isn't an ACE we're interested in handling. // if ( !IsV4AceType(AceFromAcl) || IsCompoundAceType(AceFromAcl)) { continue; } // // This routine only works for ACEs marked as INHERITED. // if ( (AceFromAcl->Header.AceFlags & INHERITED_ACE ) == 0 ) { continue; } // // Compare the Ace from the ACL with the New ACE // // Don't stop simply because we've matched once. // Multiple ACEs in the one ACL may have been condensed into a single ACE // in the other ACL in any combination (by any of our friendly ACL editors). // #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Compare Ace: %ld ", AceIndex )); } #endif // DBG if ( RtlpCompareAces( AceFromAcl, NewAce, NULL, NULL ) ) { // // Match the bits from the current ACE with bits from the New ACE. // // All V4 aces have an access mask in the same location. // LocalMask = ((PKNOWN_ACE)(AceFromAcl))->Mask; if ( AceFromAcl->Header.AceFlags & CONTAINER_INHERIT_ACE ) { NewAceContainerInheritMask &= ~LocalMask; } if ( AceFromAcl->Header.AceFlags & OBJECT_INHERIT_ACE ) { NewAceObjectInheritMask &= ~LocalMask; } if ( (AceFromAcl->Header.AceFlags & INHERIT_ONLY_ACE) == 0 ) { NewAceEffectiveMask &= ~LocalMask; } #if DBG if ( RtlpVerboseConvert ) { KdPrint(("Remaining MASKs: %8.8lX %8.8lX %8.8lX", NewAceEffectiveMask, NewAceContainerInheritMask, NewAceObjectInheritMask )); } #endif // DBG // // If all bits have been matched in the New Ace, // then this is a duplicate ACE. // if ( (NewAceEffectiveMask | NewAceContainerInheritMask | NewAceObjectInheritMask) == 0 ) { #if DBG if ( RtlpVerboseConvert ) { KdPrint(("\n")); } #endif // DBG RetVal = TRUE; goto Cleanup; } } #if DBG if ( RtlpVerboseConvert ) { KdPrint(("\n")); } #endif // DBG } // // All of the ACEs of the ACL have been processed. // // We haven't matched all of the bits in the New Ace so this is not a duplicate ACE. // RetVal = FALSE; Cleanup: return RetVal; }

NTSTATUS RtlpNewSecurityObject (  IN PSECURITY_DESCRIPTOR ParentDescriptor  OPTIONAL, IN PSECURITY_DESCRIPTOR CreatorDescriptor  OPTIONAL, OUT PSECURITY_DESCRIPTOR *  NewDescriptor, IN GUID *ObjectType  OPTIONAL, IN BOOLEAN  IsDirectoryObject, IN ULONG  AutoInheritFlags, IN HANDLE Token  OPTIONAL, IN PGENERIC_MAPPING  GenericMapping )

Definition at line 9057 of file sertl.c. References ExAllocatePoolWithTag, ExFreePool(), FALSE, HeapHandle, KernelMode, KPROCESSOR_MODE, MAKE_TAG, NT_SUCCESS, NtPrivilegeCheck(), NtQueryInformationToken(), NTSTATUS(), NULL, PagedPool, RtlAllocateHeap, RtlCopySid(), RtlCreateSecurityDescriptor(), RtlCreateSecurityDescriptorRelative(), RtlFreeHeap, RtlpApplyAclToObject(), RtlpCreateServerAcl(), RtlpGetDefaultsSubjectContext(), RtlpInheritAcl(), RtlpValidOwnerSubjectContext(), RtlValidSid(), SE_TAG, SeLengthSid, SeLockSubjectContext(), SepGetDefaultsSubjectContext(), SePrivilegeCheck(), SePrivilegedServiceAuditAlarm(), SepValidOwnerSubjectContext(), SeSecurityPrivilege, SeUnlockSubjectContext(), Status, Token, TRUE, and UserMode. Referenced by RtlNewSecurityObject(), RtlNewSecurityObjectEx(), SeAssignSecurity(), and SeAssignSecurityEx(). : The procedure is used to allocate and initialize a self-relative Security Descriptor for a new protected server's object. It is called when a new protected server object is being created. The generated security descriptor will be in self-relative form. This procedure, called only from user mode, is used to establish a security descriptor for a new protected server's object. Memory is allocated to hold each of the security descriptor's components (using NtAllocateVirtualMemory()). The final security descriptor generated by this procedure is produced according to the rules stated in ??? System and Discretionary ACL Assignment --------------------------------------- The assignment of system and discretionary ACLs is governed by the logic illustrated in the following table: | Explicit | Explicit | | (non-default) | Default | No | Acl | Acl | Acl | Specified | Specified | Specified -------------+----------------+---------------+-------------- | | | Inheritable | Assign | Assign | Assign Acl From | Specified | Inherited | Inherited Parent | Acl(1)(2) | Acl | Acl | | | -------------+----------------+---------------+-------------- No | | | Inheritable | Assign | Assign | Assign Acl From | Specified | Default | No Acl Parent | Acl(1) | Acl | | | | -------------+----------------+---------------+-------------- (1) Any ACEs with the INHERITED_ACE bit set are NOT copied to the assigned security descriptor. (2) If the AutoInheritFlags is flagged to automatically inherit ACEs from parent (SEF_DACL_AUTO_INHERIT or SEF_SACL_AUTO_INHERIT), inherited ACEs from the parent will be appended after explicit ACEs from the CreatorDescriptor. Note that an explicitly specified ACL, whether a default ACL or not, may be empty or null. If the caller is explicitly assigning a system acl, default or non-default, the caller must either be a kernel mode client or must be appropriately privileged. Owner and Group Assignment -------------------------- The assignment of the new object's owner and group is governed by the following logic: 1) If the passed security descriptor includes an owner, it is assigned as the new object's owner. Otherwise, the caller's token is looked in for the owner. Within the token, if there is a default owner, it is assigned. Otherwise, the caller's user ID is assigned. 2) If the passed security descriptor includes a group, it is assigned as the new object's group. Otherwise, the caller's token is looked in for the group. Within the token, if there is a default group, it is assigned. Otherwise, the caller's primary group ID is assigned. Arguments: ParentDescriptor - Supplies the Security Descriptor for the parent directory under which a new object is being created. If there is no parent directory, then this argument is specified as NULL. CreatorDescriptor - (Optionally) Points to a security descriptor presented by the creator of the object. If the creator of the object did not explicitly pass security information for the new object, then a null pointer should be passed. NewDescriptor - Points to a pointer that is to be made to point to the newly allocated self-relative security descriptor. ObjectType - GUID of the object type being created. If the object being created has no GUID associated with it, then this argument is specified as NULL. IsDirectoryObject - Specifies if the new object is going to be a directory object. A value of TRUE indicates the object is a container of other objects. AutoInheritFlags - Controls automatic inheritance of ACES from the Parent Descriptor. Valid values are a bits mask of the logical OR of one or more of the following bits: SEF_DACL_AUTO_INHERIT - If set, inherit ACEs from the DACL ParentDescriptor are inherited to NewDescriptor in addition to any explicit ACEs specified by the CreatorDescriptor. SEF_SACL_AUTO_INHERIT - If set, inherit ACEs from the SACL ParentDescriptor are inherited to NewDescriptor in addition to any explicit ACEs specified by the CreatorDescriptor. SEF_DEFAULT_DESCRIPTOR_FOR_OBJECT - If set, the CreatorDescriptor is the default descriptor for ObjectType. As such, the CreatorDescriptor will be ignored if any ObjectType specific ACEs are inherited from the parent. If no such ACEs are inherited, the CreatorDescriptor is handled as though this flag were not specified. SEF_AVOID_PRIVILEGE_CHECK - If set, no privilege checking is done by this routine. This flag is useful while implementing automatic inheritance to avoid checking privileges on each child updated. SEF_AVOID_OWNER_CHECK - If set, no owner checking is done by this routine. SEF_DEFAULT_OWNER_FROM_PARENT - If set, the owner of NewDescriptor will default to the owner from ParentDescriptor. If not set, the owner of NewDescriptor will default to the user specified in Token. In either case, the owner of NewDescriptor is set to the owner from the CreatorDescriptor if that field is specified. SEF_DEFAULT_GROUP_FROM_PARENT - If set, the group of NewDescriptor will default to the group from ParentDescriptor. If not set, the group of NewDescriptor will default to the group specified in Token. In either case, the group of NewDescriptor is set to the group from the CreatorDescriptor if that field is specified. Token - Supplies the token for the client on whose behalf the object is being created. If it is an impersonation token, then it must be at SecurityIdentification level or higher. If it is not an impersonation token, the operation proceeds normally. A client token is used to retrieve default security information for the new object, such as default owner, primary group, and discretionary access control. The token must be open for TOKEN_QUERY access. For calls from the kernel, Supplies the security context of the subject creating the object. This is used to retrieve default security information for the new object, such as default owner, primary group, and discretionary access control. If not specified, the Owner and Primary group must be specified in the CreatorDescriptor. GenericMapping - Supplies a pointer to a generic mapping array denoting the mapping between each generic right to specific rights. Return Value: STATUS_SUCCESS - The operation was successful. STATUS_INVALID_OWNER - The owner SID provided as the owner of the target security descriptor is not one the subject is authorized to assign as the owner of an object. STATUS_NO_CLIENT_TOKEN - Indicates a client token was not explicitly provided and the caller is not currently impersonating a client. STATUS_PRIVILEGE_NOT_HELD - The caller does not have the privilege necessary to explicitly assign the specified system ACL. SeSecurityPrivilege privilege is needed to explicitly assign system ACLs to objects. --*/ { SECURITY_DESCRIPTOR *CapturedDescriptor; SECURITY_DESCRIPTOR InCaseOneNotPassed; BOOLEAN SecurityDescriptorPassed; NTSTATUS Status; PACL NewSacl = NULL; BOOLEAN NewSaclInherited = FALSE; PACL NewDacl = NULL; PACL ServerDacl = NULL; BOOLEAN NewDaclInherited = FALSE; PSID NewOwner = NULL; PSID NewGroup = NULL; BOOLEAN SaclExplicitlyAssigned = FALSE; BOOLEAN OwnerExplicitlyAssigned = FALSE; BOOLEAN DaclExplicitlyAssigned = FALSE; BOOLEAN ServerDaclAllocated = FALSE; BOOLEAN ServerObject; BOOLEAN DaclUntrusted; BOOLEAN HasPrivilege; PRIVILEGE_SET PrivilegeSet; PSID SubjectContextOwner = NULL; PSID SubjectContextGroup = NULL; PSID ServerOwner = NULL; PSID ServerGroup = NULL; PACL SubjectContextDacl = NULL; ULONG AllocationSize; ULONG NewOwnerSize; ULONG NewGroupSize; ULONG NewSaclSize; ULONG NewDaclSize; PCHAR Field; PCHAR Base; PISECURITY_DESCRIPTOR_RELATIVE INewDescriptor = NULL; NTSTATUS PassedStatus; KPROCESSOR_MODE RequestorMode; ULONG GenericControl; ULONG NewControlBits = SE_SELF_RELATIVE; #ifndef NTOS_KERNEL_RUNTIME PTOKEN_OWNER TokenOwnerInfo = NULL; PTOKEN_PRIMARY_GROUP TokenPrimaryGroupInfo = NULL; PTOKEN_DEFAULT_DACL TokenDefaultDaclInfo = NULL; PTOKEN_OWNER ServerOwnerInfo = NULL; PTOKEN_PRIMARY_GROUP ServerGroupInfo = NULL; PVOID HeapHandle; #else // // For kernel mode callers, the Token parameter is really // a pointer to a subject context structure. // PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext; PVOID SubjectContextInfo = NULL; SubjectSecurityContext = (PSECURITY_SUBJECT_CONTEXT)Token; #endif // NTOS_KERNEL_RUNTIME #ifdef NTOS_KERNEL_RUNTIME // // Get the previous mode of the caller // RequestorMode = KeGetPreviousMode(); #else // NTOS_KERNEL_RUNTIME RequestorMode = UserMode; // // Get the handle to the current process heap // HeapHandle = RtlProcessHeap(); // // Ensure the token is an impersonation token. // if ( Token != NULL ) { TOKEN_STATISTICS ThreadTokenStatistics; ULONG ReturnLength; Status = NtQueryInformationToken( Token, // Handle TokenStatistics, // TokenInformationClass &ThreadTokenStatistics, // TokenInformation sizeof(TOKEN_STATISTICS), // TokenInformationLength &ReturnLength // ReturnLength ); if (!NT_SUCCESS( Status )) { return( Status ); } // // If it is an impersonation token, then make sure it is at a // high enough level. // if (ThreadTokenStatistics.TokenType == TokenImpersonation) { if (ThreadTokenStatistics.ImpersonationLevel < SecurityIdentification ) { return( STATUS_BAD_IMPERSONATION_LEVEL ); } } } #endif // NTOS_KERNEL_RUNTIME // // The desired end result is to build a self-relative security descriptor. // This means that a single block of memory will be allocated and all // security information copied into it. To minimize work along the way, // it is desirable to reference (rather than copy) each field as we // determine its source. This can not be done with inherited ACLs, however, // since they must be built from another ACL. So, explicitly assigned // and defaulted SIDs and ACLs are just referenced until they are copied // into the self-relative descriptor. Inherited ACLs are built in a // temporary buffer which must be deallocated after being copied to the // self-relative descriptor. // // // If a security descriptor has been passed, capture it, otherwise // cobble up a fake one to simplify the code that follows. // if (ARGUMENT_PRESENT(CreatorDescriptor)) { CapturedDescriptor = CreatorDescriptor; SecurityDescriptorPassed = TRUE; } else { // // No descriptor passed, make a fake one // SecurityDescriptorPassed = FALSE; RtlCreateSecurityDescriptor(&InCaseOneNotPassed, SECURITY_DESCRIPTOR_REVISION); CapturedDescriptor = &InCaseOneNotPassed; } if ( CapturedDescriptor->Control & SE_SERVER_SECURITY ) { ServerObject = TRUE; } else { ServerObject = FALSE; } if ( CapturedDescriptor->Control & SE_DACL_UNTRUSTED ) { DaclUntrusted = TRUE; } else { DaclUntrusted = FALSE; } // // Get the required information from the token. // // // Grab pointers to the default owner, primary group, and // discretionary ACL. // if ( Token != NULL || ServerObject ) { #ifdef NTOS_KERNEL_RUNTIME PSID TmpSubjectContextOwner = NULL; PSID TmpSubjectContextGroup = NULL; PSID TmpServerOwner = NULL; PSID TmpServerGroup = NULL; PACL TmpSubjectContextDacl = NULL; SIZE_T SubjectContextInfoSize = 0; // // Lock the subject context for read access so that the pointers // we copy out of it don't disappear on us at random // SeLockSubjectContext( SubjectSecurityContext ); SepGetDefaultsSubjectContext( SubjectSecurityContext, &TmpSubjectContextOwner, &TmpSubjectContextGroup, &TmpServerOwner, &TmpServerGroup, &TmpSubjectContextDacl ); // // We can't keep the subject context locked, because // we may have to do a privilege check later, which calls // PsLockProcessSecurityFields, which can cause a deadlock // with PsImpersonateClient, which takes them in the reverse // order. // // Since we're giving up our read lock on the token, we // need to copy all the stuff that we just got back. Since // it's not going to change, we can save some cycles and copy // it all into a single chunck of memory. // SubjectContextInfoSize = SeLengthSid( TmpSubjectContextOwner ) + SeLengthSid( TmpServerOwner ) + (TmpSubjectContextGroup != NULL ? SeLengthSid( TmpSubjectContextGroup ) : 0) + (TmpServerGroup != NULL ? SeLengthSid( TmpServerGroup ) : 0) + (TmpSubjectContextDacl != NULL ? TmpSubjectContextDacl->AclSize : 0); SubjectContextInfo = ExAllocatePoolWithTag( PagedPool, SubjectContextInfoSize, 'dSeS'); if (SubjectContextInfo) { // // Copy in the data // Base = SubjectContextInfo; // // There will always be an owner. // SubjectContextOwner = (PSID)Base; RtlCopySid( SeLengthSid( TmpSubjectContextOwner), Base, TmpSubjectContextOwner ); Base += SeLengthSid( TmpSubjectContextOwner); // // Groups may be NULL // if (TmpSubjectContextGroup != NULL) { SubjectContextGroup = (PSID)Base; RtlCopySid( SeLengthSid( TmpSubjectContextGroup), Base, TmpSubjectContextGroup ); Base += SeLengthSid( TmpSubjectContextGroup ); } else { SubjectContextGroup = NULL; } ServerOwner = (PSID)Base; RtlCopySid( SeLengthSid( TmpServerOwner ), Base, TmpServerOwner ); Base += SeLengthSid( TmpServerOwner ); // // Groups may be NULL // if (TmpServerGroup != NULL) { ServerGroup = (PSID)Base; RtlCopySid( SeLengthSid( TmpServerGroup ), Base, TmpServerGroup ); Base += SeLengthSid( TmpServerGroup ); } else { ServerGroup = NULL; } if (TmpSubjectContextDacl != NULL) { SubjectContextDacl = (PACL)Base; RtlCopyMemory( Base, TmpSubjectContextDacl, TmpSubjectContextDacl->AclSize ); // Base += TmpSubjectContextDacl->AclSize; } else { SubjectContextDacl = NULL; } } else { SeUnlockSubjectContext( SubjectSecurityContext ); return( STATUS_INSUFFICIENT_RESOURCES ); } SeUnlockSubjectContext( SubjectSecurityContext ); #else // NTOS_KERNEL_RUNTIME Status = RtlpGetDefaultsSubjectContext( Token, &TokenOwnerInfo, &TokenPrimaryGroupInfo, &TokenDefaultDaclInfo, &ServerOwnerInfo, &ServerGroupInfo ); if (!NT_SUCCESS( Status )) { return( Status ); } SubjectContextOwner = TokenOwnerInfo->Owner; SubjectContextGroup = TokenPrimaryGroupInfo->PrimaryGroup; SubjectContextDacl = TokenDefaultDaclInfo->DefaultDacl; ServerOwner = ServerOwnerInfo->Owner; ServerGroup = ServerGroupInfo->PrimaryGroup; #endif // NTOS_KERNEL_RUNTIME } // // Establish an owner SID // NewOwner = RtlpOwnerAddrSecurityDescriptor(CapturedDescriptor); if ((NewOwner) != NULL) { // // Use the specified owner // OwnerExplicitlyAssigned = TRUE; } else { // // If the caller said to default the owner from the parent descriptor, // grab it now. // if ( AutoInheritFlags & SEF_DEFAULT_OWNER_FROM_PARENT) { if ( !ARGUMENT_PRESENT(ParentDescriptor) ) { Status = STATUS_INVALID_OWNER; goto Cleanup; } NewOwner = RtlpOwnerAddrSecurityDescriptor((SECURITY_DESCRIPTOR *)ParentDescriptor); OwnerExplicitlyAssigned = TRUE; if ( NewOwner == NULL ) { Status = STATUS_INVALID_OWNER; goto Cleanup; } } else { // // Pick up the default from the subject's security context. // // This does NOT constitute explicit assignment of owner // and does not have to be checked as an ID that can be // assigned as owner. This is because a default can not // be established in a token unless the user of the token // can assign it as an owner. // // // If we've been asked to create a ServerObject, we need to // make sure to pick up the new owner from the Primary token, // not the client token. If we're not impersonating, they will // end up being the same. // NewOwner = ServerObject ? ServerOwner : SubjectContextOwner; // // Ensure an owner is now defined. // if ( NewOwner == NULL ) { Status = STATUS_NO_TOKEN; goto Cleanup; } } } // // Establish a Group SID // NewGroup = RtlpGroupAddrSecurityDescriptor(CapturedDescriptor); if (NewGroup == NULL) { // // If the caller said to default the group from the parent descriptor, // grab it now. // if ( AutoInheritFlags & SEF_DEFAULT_GROUP_FROM_PARENT) { if ( !ARGUMENT_PRESENT(ParentDescriptor) ) { Status = STATUS_INVALID_PRIMARY_GROUP; goto Cleanup; } NewGroup = RtlpGroupAddrSecurityDescriptor((SECURITY_DESCRIPTOR *)ParentDescriptor); } else { // // Pick up the primary group from the subject's security context // // If we're creating a Server object, use the group from the server // context. // NewGroup = ServerObject ? ServerGroup : SubjectContextGroup; } } if (NewGroup != NULL) { if (!RtlValidSid( NewGroup )) { Status = STATUS_INVALID_PRIMARY_GROUP; goto Cleanup; } } else { Status = STATUS_INVALID_PRIMARY_GROUP; goto Cleanup; } // // Establish System Acl // Status = RtlpInheritAcl ( ARGUMENT_PRESENT(ParentDescriptor) ? RtlpSaclAddrSecurityDescriptor( ((SECURITY_DESCRIPTOR *)ParentDescriptor)) : NULL, RtlpSaclAddrSecurityDescriptor(CapturedDescriptor), SeControlSaclToGeneric( CapturedDescriptor->Control ), IsDirectoryObject, (BOOLEAN)((AutoInheritFlags & SEF_SACL_AUTO_INHERIT) != 0), (BOOLEAN)((AutoInheritFlags & SEF_DEFAULT_DESCRIPTOR_FOR_OBJECT) != 0), NewOwner, NewGroup, ServerOwner, ServerGroup, GenericMapping, TRUE, // Is a SACL ObjectType, &NewSacl, &SaclExplicitlyAssigned, &GenericControl ); if ( NT_SUCCESS(Status) ) { NewSaclInherited = TRUE; NewControlBits |= SE_SACL_PRESENT | SeControlGenericToSacl( GenericControl ); } else if ( Status == STATUS_NO_INHERITANCE ) { // // Always set the auto inherit bit if the caller requested it. // if ( AutoInheritFlags & SEF_SACL_AUTO_INHERIT) { NewControlBits |= SE_SACL_AUTO_INHERITED; } // // No inheritable ACL - check for a defaulted one. // if ( RtlpAreControlBitsSet( CapturedDescriptor, SE_SACL_PRESENT | SE_SACL_DEFAULTED ) ) { // // Reference the default ACL // NewSacl = RtlpSaclAddrSecurityDescriptor(CapturedDescriptor); NewControlBits |= SE_SACL_PRESENT; NewControlBits |= (CapturedDescriptor->Control & SE_SACL_PROTECTED); // // This counts as an explicit assignment. // SaclExplicitlyAssigned = TRUE; } } else { // // Some unusual error occured // goto Cleanup; } // // Establish Discretionary Acl // Status = RtlpInheritAcl ( ARGUMENT_PRESENT(ParentDescriptor) ? RtlpDaclAddrSecurityDescriptor( ((SECURITY_DESCRIPTOR *)ParentDescriptor)) : NULL, RtlpDaclAddrSecurityDescriptor(CapturedDescriptor), SeControlDaclToGeneric( CapturedDescriptor->Control ), IsDirectoryObject, (BOOLEAN)((AutoInheritFlags & SEF_DACL_AUTO_INHERIT) != 0), (BOOLEAN)((AutoInheritFlags & SEF_DEFAULT_DESCRIPTOR_FOR_OBJECT) != 0), NewOwner, NewGroup, ServerOwner, ServerGroup, GenericMapping, FALSE, // Is a DACL ObjectType, &NewDacl, &DaclExplicitlyAssigned, &GenericControl ); if ( NT_SUCCESS(Status) ) { NewDaclInherited = TRUE; NewControlBits |= SE_DACL_PRESENT | SeControlGenericToDacl( GenericControl ); } else if ( Status == STATUS_NO_INHERITANCE ) { // // Always set the auto inherit bit if the caller requested it. // if ( AutoInheritFlags & SEF_DACL_AUTO_INHERIT) { NewControlBits |= SE_DACL_AUTO_INHERITED; } // // No inheritable ACL - check for a defaulted one. // if ( RtlpAreControlBitsSet( CapturedDescriptor, SE_DACL_PRESENT | SE_DACL_DEFAULTED ) ) { // // Reference the default ACL // NewDacl = RtlpDaclAddrSecurityDescriptor(CapturedDescriptor); NewControlBits |= SE_DACL_PRESENT; NewControlBits |= (CapturedDescriptor->Control & SE_DACL_PROTECTED); // // This counts as an explicit assignment. // DaclExplicitlyAssigned = TRUE; // // Default to the DACL on the token. // } else if (ARGUMENT_PRESENT(SubjectContextDacl)) { NewDacl = SubjectContextDacl; NewControlBits |= SE_DACL_PRESENT; } } else { // // Some unusual error occured // goto Cleanup; } // // If auto inheriting and the computed child DACL is NULL, // mark it as protected. // // NULL DACLs are problematic when ACEs are actually inherited from the // parent DACL. It is better to mark them as protected NOW (even if we don't // end up inheriting any ACEs) to avoid confusion later. // if ( (AutoInheritFlags & SEF_DACL_AUTO_INHERIT) != 0 && NewDacl == NULL ) { NewControlBits |= SE_DACL_PROTECTED; } // // Now make sure that the caller has the right to assign // everything in the descriptor. The requestor is subjected // to privilege and restriction tests for some assignments. // if (RequestorMode == UserMode) { // // Anybody can assign any Discretionary ACL or group that they want to. // // // See if the system ACL was explicitly specified // if ( SaclExplicitlyAssigned && (AutoInheritFlags & SEF_AVOID_PRIVILEGE_CHECK) == 0 ) { // // Require a Token if we're to do the privilege check. // if ( Token == NULL ) { Status = STATUS_NO_TOKEN; goto Cleanup; } #ifdef NTOS_KERNEL_RUNTIME // // Check for appropriate Privileges // Audit/Alarm messages need to be generated due to the attempt // to perform a privileged operation. // // // Note: be sure to do the privilege check against // the passed subject context! // PrivilegeSet.PrivilegeCount = 1; PrivilegeSet.Control = PRIVILEGE_SET_ALL_NECESSARY; PrivilegeSet.Privilege[0].Luid = SeSecurityPrivilege; PrivilegeSet.Privilege[0].Attributes = 0; HasPrivilege = SePrivilegeCheck( &PrivilegeSet, SubjectSecurityContext, RequestorMode ); if ( RequestorMode != KernelMode ) { SePrivilegedServiceAuditAlarm ( NULL, // BUGWARNING need service name SubjectSecurityContext, &PrivilegeSet, HasPrivilege ); } #else // NTOS_KERNEL_RUNTIME // // Check for appropriate Privileges // // Audit/Alarm messages need to be generated due to the attempt // to perform a privileged operation. // PrivilegeSet.PrivilegeCount = 1; PrivilegeSet.Control = PRIVILEGE_SET_ALL_NECESSARY; PrivilegeSet.Privilege[0].Luid = RtlConvertLongToLuid(SE_SECURITY_PRIVILEGE); PrivilegeSet.Privilege[0].Attributes = 0; Status = NtPrivilegeCheck( Token, &PrivilegeSet, &HasPrivilege ); if (!NT_SUCCESS( Status )) { goto Cleanup; } #endif // NTOS_KERNEL_RUNTIME if ( !HasPrivilege ) { Status = STATUS_PRIVILEGE_NOT_HELD; goto Cleanup; } } // // See if the owner field is one the requestor can assign // if (OwnerExplicitlyAssigned && (AutoInheritFlags & SEF_AVOID_OWNER_CHECK) == 0 ) { #ifdef NTOS_KERNEL_RUNTIME if (!SepValidOwnerSubjectContext( SubjectSecurityContext, NewOwner, ServerObject) ) { Status = STATUS_INVALID_OWNER; goto Cleanup; } #else // NTOS_KERNEL_RUNTIME // // Require a Token if we're to do the privilege check. // if ( Token == NULL ) { Status = STATUS_NO_TOKEN; goto Cleanup; } if (!RtlpValidOwnerSubjectContext( Token, NewOwner, ServerObject, &PassedStatus) ) { Status = PassedStatus; goto Cleanup; } #endif // NTOS_KERNEL_RUNTIME } // // If the DACL was explictly assigned and this is a server object, // convert the DACL to be a server DACL // if (DaclExplicitlyAssigned && ServerObject) { Status = RtlpCreateServerAcl( NewDacl, DaclUntrusted, ServerOwner, &ServerDacl, &ServerDaclAllocated ); if (!NT_SUCCESS( Status )) { goto Cleanup; } NewDacl = ServerDacl; } } // // Everything is assignable by the requestor. // Calculate the memory needed to house all the information in // a self-relative security descriptor. // // Also map the ACEs for application to the target object // type, if they haven't already been mapped. // NewOwnerSize = LongAlignSize(SeLengthSid(NewOwner)); if (NewGroup != NULL) { NewGroupSize = LongAlignSize(SeLengthSid(NewGroup)); } if ((NewControlBits & SE_SACL_PRESENT) && (NewSacl != NULL)) { NewSaclSize = LongAlignSize(NewSacl->AclSize); } else { NewSaclSize = 0; } if ( (NewControlBits & SE_DACL_PRESENT) && (NewDacl != NULL)) { NewDaclSize = LongAlignSize(NewDacl->AclSize); } else { NewDaclSize = 0; } AllocationSize = LongAlignSize(sizeof(SECURITY_DESCRIPTOR_RELATIVE)) + NewOwnerSize + NewGroupSize + NewSaclSize + NewDaclSize; // // Allocate and initialize the security descriptor as // self-relative form. // #ifdef NTOS_KERNEL_RUNTIME INewDescriptor = (PSECURITY_DESCRIPTOR)ExAllocatePoolWithTag( PagedPool, AllocationSize, 'dSeS'); #else // NTOS_KERNEL_RUNTIME INewDescriptor = RtlAllocateHeap( HeapHandle, MAKE_TAG( SE_TAG ), AllocationSize ); #endif // NTOS_KERNEL_RUNTIME if ( INewDescriptor == NULL ) { #ifdef NTOS_KERNEL_RUNTIME Status = STATUS_INSUFFICIENT_RESOURCES; #else // NTOS_KERNEL_RUNTIME Status = STATUS_NO_MEMORY; #endif // NTOS_KERNEL_RUNTIME goto Cleanup; } RtlCreateSecurityDescriptorRelative( INewDescriptor, SECURITY_DESCRIPTOR_REVISION ); RtlpSetControlBits( INewDescriptor, NewControlBits ); Base = (PCHAR)(INewDescriptor); Field = Base + sizeof(SECURITY_DESCRIPTOR_RELATIVE); // // Map and Copy in the Sacl // if (NewControlBits & SE_SACL_PRESENT) { if (NewSacl != NULL) { RtlCopyMemory( Field, NewSacl, NewSacl->AclSize ); if (!NewSaclInherited) { RtlpApplyAclToObject( (PACL)Field, GenericMapping ); } INewDescriptor->Sacl = RtlPointerToOffset(Base,Field); Field += NewSaclSize; } else { INewDescriptor->Sacl = 0; } } // // Map and Copy in the Dacl // if (NewControlBits & SE_DACL_PRESENT) { if (NewDacl != NULL) { RtlCopyMemory( Field, NewDacl, NewDacl->AclSize ); if (!NewDaclInherited) { RtlpApplyAclToObject( (PACL)Field, GenericMapping ); } INewDescriptor->Dacl = RtlPointerToOffset(Base,Field); Field += NewDaclSize; } else { INewDescriptor->Dacl = 0; } } // // Assign the owner // RtlCopyMemory( Field, NewOwner, SeLengthSid(NewOwner) ); INewDescriptor->Owner = RtlPointerToOffset(Base,Field); Field += NewOwnerSize; if (NewGroup != NULL) { RtlCopyMemory( Field, NewGroup, SeLengthSid(NewGroup) ); INewDescriptor->Group = RtlPointerToOffset(Base,Field); } Status = STATUS_SUCCESS; Cleanup: // // If we allocated memory for a Server DACL, free it now. // if (ServerDaclAllocated) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( ServerDacl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap(RtlProcessHeap(), 0, ServerDacl ); #endif // NTOS_KERNEL_RUNTIME } // // Either an error was encountered or the assignment has completed // successfully. In either case, we have to clean up any memory. // #ifdef NTOS_KERNEL_RUNTIME // if ( SubjectSecurityContext != NULL ) { // SeUnlockSubjectContext( SubjectSecurityContext ); // } if (SubjectContextInfo != NULL) { ExFreePool( SubjectContextInfo ); } #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, (PVOID)TokenOwnerInfo ); RtlFreeHeap( HeapHandle, 0, (PVOID)TokenPrimaryGroupInfo ); RtlFreeHeap( HeapHandle, 0, (PVOID)TokenDefaultDaclInfo ); RtlFreeHeap( HeapHandle, 0, (PVOID)ServerOwnerInfo ); RtlFreeHeap( HeapHandle, 0, (PVOID)ServerGroupInfo ); #endif // NTOS_KERNEL_RUNTIME if (NewSaclInherited && NewSacl != NULL ) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( NewSacl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, (PVOID)NewSacl ); #endif // NTOS_KERNEL_RUNTIME } if (NewDaclInherited && NewDacl != NULL ) { #ifdef NTOS_KERNEL_RUNTIME ExFreePool( NewDacl ); #else // NTOS_KERNEL_RUNTIME RtlFreeHeap( HeapHandle, 0, (PVOID)NewDacl ); #endif // NTOS_KERNEL_RUNTIME } *NewDescriptor = (PSECURITY_DESCRIPTOR) INewDescriptor; return Status; }

NTSTATUS RtlpSetSecurityObject (  IN PVOID Object  OPTIONAL, IN SECURITY_INFORMATION  SecurityInformation, IN PSECURITY_DESCRIPTOR  ModificationDescriptor, IN OUT PSECURITY_DESCRIPTOR *  ObjectsSecurityDescriptor, IN ULONG  AutoInheritFlags, IN ULONG  PoolType, IN PGENERIC_MAPPING  GenericMapping, IN HANDLE Token  OPTIONAL )

Definition at line 10195 of file sertl.c. References ASSERT, ExAllocatePoolWithTag, ExFreePool(), FALSE, HeapHandle, MAKE_TAG, NT_SUCCESS, NtClose(), NtOpenProcessToken(), NtQueryInformationToken(), NTSTATUS(), NULL, ObValidateSecurityQuota(), PrimaryToken, RTL_PAGED_CODE, RtlAllocateHeap, RtlCreateSecurityDescriptorRelative(), RtlFreeHeap, RtlLengthRequiredSid(), RtlpApplyAclToObject(), RtlpComputeMergedAcl(), RtlpCreateServerAcl(), RtlpValidOwnerSubjectContext(), RtlValidSid(), SE_TAG, SeCaptureSubjectContext(), SeLengthSid, SepGetDefaultsSubjectContext(), SepValidOwnerSubjectContext(), SeReleaseSubjectContext(), Status, Token, and TRUE. Referenced by RtlSetSecurityObject(), RtlSetSecurityObjectEx(), SeSetSecurityDescriptorInfo(), and SeSetSecurityDescriptorInfoEx(). 10209 : 10210 10211 Modify an object's existing self-relative form security descriptor. 10212 10213 This procedure, called only from user mode, is used to update a 10214 security descriptor on an existing protected server's object. It 10215 applies changes requested by a new security descriptor to the existing 10216 security descriptor. If necessary, this routine will allocate 10217 additional memory to produce a larger security descriptor. All access 10218 checking is expected to be done before calling this routine. This 10219 includes checking for WRITE_OWNER, WRITE_DAC, and privilege to assign a 10220 system ACL as appropriate. 10221 10222 The caller of this routine must not be impersonating a client. 10223 10224 - - WARNING - - 10225 10226 This service is for use by protected subsystems that project their own 10227 type of object. This service is explicitly not for use by the 10228 executive for executive objects and must not be called from kernel 10229 mode. 10230 10231 Arguments: 10232 10233 Object - Optionally supplies the object whose security is 10234 being adjusted. This is used to update security quota 10235 information. 10236 10237 SecurityInformation - Indicates which security information is 10238 to be applied to the object. The value(s) to be assigned are 10239 passed in the ModificationDescriptor parameter. 10240 10241 ModificationDescriptor - Supplies the input security descriptor to be 10242 applied to the object. The caller of this routine is expected 10243 to probe and capture the passed security descriptor before calling 10244 and release it after calling. 10245 10246 ObjectsSecurityDescriptor - Supplies the address of a pointer to 10247 the objects security descriptor that is going to be altered by 10248 this procedure. This security descriptor must be in self- 10249 relative form or an error will be returned. 10250 10251 AutoInheritFlags - Controls automatic inheritance of ACES. 10252 Valid values are a bits mask of the logical OR of 10253 one or more of the following bits: 10254 10255 SEF_DACL_AUTO_INHERIT - If set, inherited ACEs from the 10256 DACL in the ObjectsSecurityDescriptor are preserved and inherited ACEs from 10257 the ModificationDescriptor are ignored. Inherited ACEs are not supposed 10258 to be modified; so preserving them across this call is appropriate. 10259 If a protected server does not itself implement auto inheritance, it should 10260 not set this bit. The caller of the protected server may implement 10261 auto inheritance and my indeed be modifying inherited ACEs. 10262 10263 SEF_SACL_AUTO_INHERIT - If set, inherited ACEs from the 10264 SACL in the ObjectsSecurityDescriptor are preserved and inherited ACEs from 10265 the ModificationDescriptor are ignored. Inherited ACEs are not supposed 10266 to be modified; so preserving them across this call is appropriate. 10267 If a protected server does not itself implement auto inheritance, it should 10268 not set this bit. The caller of the protected server may implement 10269 auto inheritance and my indeed be modifying inherited ACEs. 10270 10271 SEF_AVOID_PRIVILEGE_CHECK - If set, the Token in not used to ensure the 10272 Owner passed in ModificationDescriptor is valid. 10273 10274 PoolType - Specifies the type of pool to allocate for the objects 10275 security descriptor. 10276 10277 GenericMapping - This argument provides the mapping of generic to 10278 specific/standard access types for the object being accessed. 10279 This mapping structure is expected to be safe to access 10280 (i.e., captured if necessary) prior to be passed to this routine. 10281 10282 Token - (optionally) Supplies the token for the client on whose 10283 behalf the security is being modified. This parameter is only 10284 required to ensure that the client has provided a legitimate 10285 value for a new owner SID. The token must be open for 10286 TOKEN_QUERY access. 10287 10288 Return Value: 10289 10290 STATUS_SUCCESS - The operation was successful. 10291 10292 STATUS_INVALID_OWNER - The owner SID provided as the new owner of the 10293 target security descriptor is not one the caller is authorized to 10294 assign as the owner of an object, or the client did not pass 10295 a token at all. 10296 10297 STATUS_NO_CLIENT_TOKEN - Indicates a client token was not explicitly 10298 provided and the caller is not currently impersonating a client. 10299 10300 STATUS_BAD_DESCRIPTOR_FORMAT - Indicates the provided object's security 10301 descriptor was not in self-relative format. 10302 10303 --*/ 10304 10305 { 10306 BOOLEAN NewGroupPresent = FALSE; 10307 BOOLEAN NewOwnerPresent = FALSE; 10308 10309 BOOLEAN ServerAclAllocated = FALSE; 10310 BOOLEAN LocalDaclAllocated = FALSE; 10311 BOOLEAN LocalSaclAllocated = FALSE; 10312 BOOLEAN ServerObject; 10313 BOOLEAN DaclUntrusted; 10314 10315 PCHAR Field; 10316 PCHAR Base; 10317 10318 PISECURITY_DESCRIPTOR_RELATIVE NewDescriptor = NULL; 10319 10320 NTSTATUS Status; 10321 10322 TOKEN_STATISTICS ThreadTokenStatistics; 10323 10324 ULONG ReturnLength; 10325 10326 PSID NewGroup; 10327 PSID NewOwner; 10328 10329 PACL NewDacl; 10330 PACL LocalDacl; 10331 PACL NewSacl; 10332 PACL LocalSacl; 10333 10334 ULONG NewDaclSize; 10335 ULONG NewSaclSize; 10336 ULONG NewOwnerSize; 10337 ULONG NewGroupSize; 10338 ULONG AllocationSize; 10339 ULONG ServerOwnerInfoSize; 10340 10341 HANDLE PrimaryToken; 10342 ULONG GenericControl; 10343 ULONG NewControlBits = SE_SELF_RELATIVE; 10344 10345 PACL ServerDacl; 10346 10347 SECURITY_SUBJECT_CONTEXT SubjectContext; 10348 10349 10350 // 10351 // Typecast to internal representation of security descriptor. 10352 // Note that the internal one is not a pointer to a pointer. 10353 // It is just a pointer to a security descriptor. 10354 // 10355 PISECURITY_DESCRIPTOR IModificationDescriptor = 10356 (PISECURITY_DESCRIPTOR)ModificationDescriptor; 10357 10358 PISECURITY_DESCRIPTOR *IObjectsSecurityDescriptor = 10359 (PISECURITY_DESCRIPTOR *)(ObjectsSecurityDescriptor); 10360 10361 #ifndef NTOS_KERNEL_RUNTIME 10362 PVOID HeapHandle; 10363 #endif // NTOS_KERNEL_RUNTIME 10364 10365 RTL_PAGED_CODE(); 10366 10367 // 10368 // Get the handle to the current process heap 10369 // 10370 10371 #ifndef NTOS_KERNEL_RUNTIME 10372 HeapHandle = RtlProcessHeap(); 10373 #endif // NTOS_KERNEL_RUNTIME 10374 10375 // 10376 // Validate that the provided SD is in self-relative form 10377 // 10378 10379 if ( !RtlpAreControlBitsSet(*IObjectsSecurityDescriptor, SE_SELF_RELATIVE) ) { 10380 Status = STATUS_BAD_DESCRIPTOR_FORMAT; 10381 goto Cleanup; 10382 } 10383 10384 // 10385 // Check to see if we need to edit the passed acl 10386 // either because we're creating a server object, or because 10387 // we were passed an untrusted ACL. 10388 // 10389 10390 if (ARGUMENT_PRESENT(ModificationDescriptor)) { 10391 10392 if ( RtlpAreControlBitsSet(IModificationDescriptor, SE_SERVER_SECURITY)) { 10393 ServerObject = TRUE; 10394 } else { 10395 ServerObject = FALSE; 10396 } 10397 10398 if ( RtlpAreControlBitsSet(IModificationDescriptor, SE_DACL_UNTRUSTED)) { 10399 DaclUntrusted = TRUE; 10400 } else { 10401 DaclUntrusted = FALSE; 10402 } 10403 10404 } else { 10405 10406 ServerObject = FALSE; 10407 DaclUntrusted = FALSE; 10408 10409 } 10410 10411 10412 // 10413 // For each item specified in the SecurityInformation, extract it 10414 // and get it to the point where it can be copied into a new 10415 // descriptor. 10416 // 10417 10418 // 10419 // if he's setting the owner field, make sure he's 10420 // allowed to set that value as an owner. 10421 // 10422 10423 if (SecurityInformation & OWNER_SECURITY_INFORMATION) { 10424 10425 NewOwner = RtlpOwnerAddrSecurityDescriptor( IModificationDescriptor ); 10426 NewOwnerPresent = TRUE; 10427 10428 if ((AutoInheritFlags & SEF_AVOID_PRIVILEGE_CHECK) == 0 ) { 10429 10430 #ifdef NTOS_KERNEL_RUNTIME 10431 10432 SeCaptureSubjectContext( &SubjectContext ); 10433 10434 if (!SepValidOwnerSubjectContext( &SubjectContext, NewOwner, ServerObject ) ) { 10435 10436 SeReleaseSubjectContext( &SubjectContext ); 10437 return( STATUS_INVALID_OWNER ); 10438 10439 } else { 10440 10441 SeReleaseSubjectContext( &SubjectContext ); 10442 } 10443 #else // NTOS_KERNEL_RUNTIME 10444 10445 if ( ARGUMENT_PRESENT( Token )) { 10446 10447 Status = NtQueryInformationToken( 10448 Token, // Handle 10449 TokenStatistics, // TokenInformationClass 10450 &ThreadTokenStatistics, // TokenInformation 10451 sizeof(TOKEN_STATISTICS), // TokenInformationLength 10452 &ReturnLength // ReturnLength 10453 ); 10454 10455 if (!NT_SUCCESS( Status )) { 10456 goto Cleanup; 10457 } 10458 10459 // 10460 // If it is an impersonation token, then make sure it is at a 10461 // high enough level. 10462 // 10463 10464 if (ThreadTokenStatistics.TokenType == TokenImpersonation) { 10465 10466 if (ThreadTokenStatistics.ImpersonationLevel < SecurityIdentification ) { 10467 Status = STATUS_BAD_IMPERSONATION_LEVEL; 10468 goto Cleanup; 10469 } 10470 } 10471 10472 } else { 10473 10474 Status = STATUS_INVALID_OWNER; 10475 goto Cleanup; 10476 } 10477 10478 if (!RtlpValidOwnerSubjectContext( 10479 Token, 10480 NewOwner, 10481 ServerObject, 10482 &Status) ) { 10483 10484 Status = STATUS_INVALID_OWNER; 10485 goto Cleanup; 10486 } 10487 #endif // NTOS_KERNEL_RUNTIME 10488 } 10489 10490 } else { 10491 10492 NewOwner = RtlpOwnerAddrSecurityDescriptor ( *IObjectsSecurityDescriptor ); 10493 if (NewOwner == NULL) { 10494 Status = STATUS_INVALID_OWNER; 10495 goto Cleanup; 10496 } 10497 10498 } 10499 ASSERT( NewOwner != NULL ); 10500 if (!RtlValidSid( NewOwner )) { 10501 Status = STATUS_INVALID_OWNER; 10502 goto Cleanup; 10503 } 10504 10505 10506 if (SecurityInformation & GROUP_SECURITY_INFORMATION) { 10507 10508 NewGroup = RtlpGroupAddrSecurityDescriptor(IModificationDescriptor); 10509 NewGroupPresent = TRUE; 10510 10511 } else { 10512 10513 NewGroup = RtlpGroupAddrSecurityDescriptor( *IObjectsSecurityDescriptor ); 10514 } 10515 10516 if (NewGroup != NULL) { 10517 if (!RtlValidSid( NewGroup )) { 10518 Status = STATUS_INVALID_PRIMARY_GROUP; 10519 goto Cleanup; 10520 } 10521 } else { 10522 Status = STATUS_INVALID_PRIMARY_GROUP; 10523 goto Cleanup; 10524 } 10525 10526 10527 if (SecurityInformation & DACL_SECURITY_INFORMATION) { 10528 10529 // 10530 // If AutoInherit is requested, 10531 // build a merged ACL. 10532 // 10533 10534 if ( AutoInheritFlags & SEF_DACL_AUTO_INHERIT ) { 10535 Status = RtlpComputeMergedAcl( 10536 RtlpDaclAddrSecurityDescriptor( *IObjectsSecurityDescriptor ), 10537 SeControlDaclToGeneric( (*IObjectsSecurityDescriptor)->Control ), 10538 RtlpDaclAddrSecurityDescriptor( IModificationDescriptor ), 10539 SeControlDaclToGeneric( IModificationDescriptor->Control ), 10540 NewOwner, 10541 NewGroup, 10542 GenericMapping, 10543 FALSE, // Not a SACL 10544 &LocalDacl, 10545 &GenericControl ); 10546 10547 if ( !NT_SUCCESS(Status)) { 10548 goto Cleanup; 10549 } 10550 10551 LocalDaclAllocated = TRUE; 10552 NewDacl = LocalDacl; 10553 NewControlBits |= SE_DACL_PRESENT; 10554 NewControlBits |= SeControlGenericToDacl( GenericControl ); 10555 10556 // 10557 // If AutoInherit isn't requested, 10558 // just grab a copy of the input DACL. 10559 // 10560 10561 } else { 10562 NewDacl = RtlpDaclAddrSecurityDescriptor( IModificationDescriptor ); 10563 NewControlBits |= SE_DACL_PRESENT; 10564 NewControlBits |= IModificationDescriptor->Control & SE_DACL_PROTECTED; 10565 10566 // 10567 // If the original caller claims he understands auto inheritance, 10568 // preserve the AutoInherited flag. 10569 // 10570 10571 if ( RtlpAreControlBitsSet(IModificationDescriptor, SE_DACL_AUTO_INHERIT_REQ|SE_DACL_AUTO_INHERITED) ) { 10572 NewControlBits |= SE_DACL_AUTO_INHERITED; 10573 } 10574 } 10575 10576 if (ServerObject) { 10577 10578 #ifdef NTOS_KERNEL_RUNTIME 10579 10580 PSID SubjectContextOwner; 10581 PSID SubjectContextGroup; 10582 PSID SubjectContextServerOwner; 10583 PSID SubjectContextServerGroup; 10584 PACL SubjectContextDacl; 10585 10586 SeCaptureSubjectContext( &SubjectContext ); 10587 10588 SepGetDefaultsSubjectContext( 10589 &SubjectContext, 10590 &SubjectContextOwner, 10591 &SubjectContextGroup, 10592 &SubjectContextServerOwner, 10593 &SubjectContextServerGroup, 10594 &SubjectContextDacl 10595 ); 10596 10597 Status = RtlpCreateServerAcl( 10598 NewDacl, 10599 DaclUntrusted, 10600 SubjectContextServerOwner, 10601 &ServerDacl, 10602 &ServerAclAllocated 10603 ); 10604 10605 SeReleaseSubjectContext( &SubjectContext ); 10606 #else // NTOS_KERNEL_RUNTIME 10607 PTOKEN_OWNER ServerSid; 10608 10609 // 10610 // Obtain the default Server SID to substitute in the 10611 // ACL if necessary. 10612 // 10613 10614 ServerOwnerInfoSize = RtlLengthRequiredSid( SID_MAX_SUB_AUTHORITIES ); 10615 10616 ServerSid = RtlAllocateHeap( HeapHandle, MAKE_TAG( SE_TAG ), ServerOwnerInfoSize ); 10617 10618 if (ServerSid == NULL) { 10619 Status = STATUS_NO_MEMORY; 10620 goto Cleanup; 10621 } 10622 10623 Status = NtOpenProcessToken( 10624 NtCurrentProcess(), 10625 TOKEN_QUERY, 10626 &PrimaryToken 10627 ); 10628 10629 if (!NT_SUCCESS( Status )) { 10630 RtlFreeHeap( HeapHandle, 0, ServerSid ); 10631 goto Cleanup; 10632 } 10633 10634 Status = NtQueryInformationToken( 10635 PrimaryToken, // Handle 10636 TokenOwner, // TokenInformationClass 10637 ServerSid, // TokenInformation 10638 ServerOwnerInfoSize, // TokenInformationLength 10639 &ServerOwnerInfoSize // ReturnLength 10640 ); 10641 10642 NtClose( PrimaryToken ); 10643 10644 if (!NT_SUCCESS( Status )) { 10645 RtlFreeHeap( HeapHandle, 0, ServerSid ); 10646 goto Cleanup; 10647 } 10648 10649 Status = RtlpCreateServerAcl( 10650 NewDacl, 10651 DaclUntrusted, 10652 ServerSid->Owner, 10653 &ServerDacl, 10654 &ServerAclAllocated 10655 ); 10656 10657 RtlFreeHeap( HeapHandle, 0, ServerSid ); 10658 #endif // NTOS_KERNEL_RUNTIME 10659 10660 if (!NT_SUCCESS( Status )) { 10661 goto Cleanup; 10662 } 10663 10664 NewDacl = ServerDacl; 10665 10666 } 10667 10668 } else { 10669 10670 NewDacl = RtlpDaclAddrSecurityDescriptor( *IObjectsSecurityDescriptor ); 10671 } 10672 10673 10674 10675 if (SecurityInformation & SACL_SECURITY_INFORMATION) { 10676 10677 10678 // 10679 // If AutoInherit is requested, 10680 // build a merged ACL. 10681 // 10682 10683 if ( AutoInheritFlags & SEF_SACL_AUTO_INHERIT ) { 10684 Status = RtlpComputeMergedAcl( 10685 RtlpSaclAddrSecurityDescriptor( *IObjectsSecurityDescriptor ), 10686 SeControlSaclToGeneric( (*IObjectsSecurityDescriptor)->Control ), 10687 RtlpSaclAddrSecurityDescriptor( IModificationDescriptor ), 10688 SeControlSaclToGeneric( IModificationDescriptor->Control ), 10689 NewOwner, 10690 NewGroup, 10691 GenericMapping, 10692 TRUE, // Is a SACL 10693 &LocalSacl, 10694 &GenericControl ); 10695 10696 if ( !NT_SUCCESS(Status)) { 10697 goto Cleanup; 10698 } 10699 LocalSaclAllocated = TRUE; 10700 NewSacl = LocalSacl; 10701 NewControlBits |= SE_SACL_PRESENT; 10702 NewControlBits |= SeControlGenericToSacl( GenericControl ); 10703 } else { 10704 NewSacl = RtlpSaclAddrSecurityDescriptor( IModificationDescriptor ); 10705 NewControlBits |= SE_SACL_PRESENT; 10706 NewControlBits |= IModificationDescriptor->Control & SE_SACL_PROTECTED; 10707 10708 // 10709 // If the original caller claims he understands auto inheritance, 10710 // preserve the AutoInherited flag. 10711 // 10712 10713 if ( RtlpAreControlBitsSet(IModificationDescriptor, SE_SACL_AUTO_INHERIT_REQ|SE_SACL_AUTO_INHERITED) ) { 10714 NewControlBits |= SE_SACL_AUTO_INHERITED; 10715 } 10716 } 10717 10718 } else { 10719 10720 NewSacl = RtlpSaclAddrSecurityDescriptor( *IObjectsSecurityDescriptor ); 10721 } 10722 10723 10724 // 10725 // Everything is assignable by the requestor. 10726 // Calculate the memory needed to house all the information in 10727 // a self-relative security descriptor. 10728 // 10729 // Also map the ACEs for application to the target object 10730 // type, if they haven't already been mapped. 10731 // 10732 10733 NewOwnerSize = LongAlignSize(SeLengthSid(NewOwner)); 10734 10735 if (NewGroup != NULL) { 10736 NewGroupSize = LongAlignSize(SeLengthSid(NewGroup)); 10737 } else { 10738 NewGroupSize = 0; 10739 } 10740 10741 if (NewSacl != NULL) { 10742 NewSaclSize = LongAlignSize(NewSacl->AclSize); 10743 } else { 10744 NewSaclSize = 0; 10745 } 10746 10747 if (NewDacl !=NULL) { 10748 NewDaclSize = LongAlignSize(NewDacl->AclSize); 10749 } else { 10750 NewDaclSize = 0; 10751 } 10752 10753 AllocationSize = LongAlignSize(sizeof(SECURITY_DESCRIPTOR_RELATIVE)) + 10754 NewOwnerSize + 10755 NewGroupSize + 10756 NewSaclSize + 10757 NewDaclSize; 10758 10759 // 10760 // Allocate and initialize the security descriptor as 10761 // self-relative form. 10762 // 10763 10764 #ifdef NTOS_KERNEL_RUNTIME 10765 NewDescriptor = ExAllocatePoolWithTag(PoolType, AllocationSize, 'dSeS'); 10766 #else // NTOS_KERNEL_RUNTIME 10767 NewDescriptor = RtlAllocateHeap( HeapHandle, MAKE_TAG( SE_TAG ), AllocationSize ); 10768 #endif // NTOS_KERNEL_RUNTIME 10769 10770 if ( NewDescriptor == NULL ) { 10771 Status = STATUS_NO_MEMORY; 10772 goto Cleanup; 10773 } 10774 10775 Status = RtlCreateSecurityDescriptorRelative( 10776 NewDescriptor, 10777 SECURITY_DESCRIPTOR_REVISION 10778 ); 10779 10780 ASSERT( NT_SUCCESS( Status ) ); 10781 10782 #ifdef NTOS_KERNEL_RUNTIME 10783 // 10784 // We must check to make sure that the Group and Dacl size 10785 // do not exceed the quota preallocated for this object's 10786 // security when it was created. 10787 // 10788 // Update SeComputeSecurityQuota if this changes. 10789 // 10790 10791 10792 if (ARGUMENT_PRESENT( Object )) { 10793 10794 Status = ObValidateSecurityQuota( 10795 Object, 10796 NewGroupSize + NewDaclSize 10797 ); 10798 10799 if (!NT_SUCCESS( Status )) { 10800 10801 // 10802 // The new information is too big. 10803 // 10804 10805 ExFreePool( NewDescriptor ); 10806 goto Cleanup; 10807 } 10808 10809 } 10810 #endif // NTOS_KERNEL_RUNTIME 10811 10812 10813 Base = (PCHAR)NewDescriptor; 10814 Field = Base + sizeof(SECURITY_DESCRIPTOR_RELATIVE); 10815 10816 // 10817 // Map and Copy in the Sacl 10818 // 10819 10820 10821 // if new item { 10822 // PRESENT=TRUE 10823 // DEFAULTED=FALSE 10824 // if (NULL) { 10825 // set new pointer to NULL 10826 // } else { 10827 // copy into new SD 10828 // } 10829 // } else { 10830 // copy PRESENT bit 10831 // copy DEFAULTED bit 10832 // if (NULL) { 10833 // set new pointer to NULL 10834 // } else { 10835 // copy old one into new SD 10836 // } 10837 // } 10838 10839 RtlpSetControlBits( NewDescriptor, NewControlBits ); 10840 10841 10842 if (IModificationDescriptor->Control & SE_RM_CONTROL_VALID) { 10843 NewDescriptor->Sbz1 = IModificationDescriptor->Sbz1; 10844 NewDescriptor->Control |= SE_RM_CONTROL_VALID; 10845 } 10846 10847 if (NewSacl == NULL) { 10848 NewDescriptor->Sacl = 0; 10849 10850 } else { 10851 RtlCopyMemory( Field, NewSacl, NewSacl->AclSize ); 10852 RtlpApplyAclToObject( (PACL)Field, GenericMapping ); 10853 NewDescriptor->Sacl = RtlPointerToOffset(Base,Field); 10854 Field += NewSaclSize; 10855 } 10856 10857 10858 10859 10860 if ( (NewControlBits & SE_SACL_PRESENT) == 0 ) { 10861 10862 // 10863 // Propagate the SE_SACL_DEFAULTED and SE_SACL_PRESENT 10864 // bits from the old security descriptor into the new 10865 // one. 10866 // 10867 10868 RtlpPropagateControlBits( 10869 NewDescriptor, 10870 *IObjectsSecurityDescriptor, 10871 SE_SACL_DEFAULTED | SE_SACL_PRESENT | SE_SACL_PROTECTED 10872 ); 10873 10874 } 10875 10876 10877 10878 // 10879 // Fill in Dacl field in new SD 10880 // 10881 10882 if (NewDacl == NULL) { 10883 NewDescriptor->Dacl = 0; 10884 10885 } else { 10886 RtlCopyMemory( Field, NewDacl, NewDacl->AclSize ); 10887 RtlpApplyAclToObject( (PACL)Field, GenericMapping ); 10888 NewDescriptor->Dacl = RtlPointerToOffset(Base,Field); 10889 Field += NewDaclSize; 10890 } 10891 10892 10893 if ( (NewControlBits & SE_DACL_PRESENT) == 0 ) { 10894 10895 // 10896 // Propagate the SE_DACL_DEFAULTED and SE_DACL_PRESENT 10897 // bits from the old security descriptor into the new 10898 // one. 10899 // 10900 10901 RtlpPropagateControlBits( 10902 NewDescriptor, 10903 *IObjectsSecurityDescriptor, 10904 SE_DACL_DEFAULTED | SE_DACL_PRESENT | SE_DACL_PROTECTED 10905 ); 10906 10907 } 10908 10909 // if new item { 10910 // PRESENT=TRUE 10911 // DEFAULTED=FALSE 10912 // if (NULL) { 10913 // set new pointer to NULL 10914 // } else { 10915 // copy into new SD 10916 // } 10917 // } else { 10918 // copy PRESENT bit 10919 // copy DEFAULTED bit 10920 // if (NULL) { 10921 // set new pointer to NULL 10922 // } else { 10923 // copy old one into new SD 10924 // } 10925 // } 10926 10927 10928 // 10929 // Fill in Owner field in new SD 10930 // 10931 10932 RtlCopyMemory( Field, NewOwner, SeLengthSid(NewOwner) ); 10933 NewDescriptor->Owner = RtlPointerToOffset(Base,Field); 10934 Field += NewOwnerSize; 10935 10936 if (!NewOwnerPresent) { 10937 10938 // 10939 // Propagate the SE_OWNER_DEFAULTED bit from the old SD. 10940 // If a new owner is being assigned, we want to leave 10941 // SE_OWNER_DEFAULTED off, which means leave it alone. 10942 // 10943 10944 RtlpPropagateControlBits( 10945 NewDescriptor, 10946 *IObjectsSecurityDescriptor, 10947 SE_OWNER_DEFAULTED 10948 ); 10949 10950 } else { 10951 ASSERT( !RtlpAreControlBitsSet( NewDescriptor, SE_OWNER_DEFAULTED ) ); 10952 } 10953 10954 10955 // 10956 // Fill in Group field in new SD 10957 // 10958 10959 if ( NewGroup != NULL) { 10960 RtlCopyMemory( Field, NewGroup, SeLengthSid(NewGroup) ); 10961 NewDescriptor->Group = RtlPointerToOffset(Base,Field); 10962 } 10963 10964 if (!NewGroupPresent) { 10965 10966 // 10967 // Propagate the SE_GROUP_DEFAULTED bit from the old SD 10968 // If a new owner is being assigned, we want to leave 10969 // SE_GROUP_DEFAULTED off, which means leave it alone. 10970 // 10971 10972 RtlpPropagateControlBits( 10973 NewDescriptor, 10974 *IObjectsSecurityDescriptor, 10975 SE_GROUP_DEFAULTED 10976 ); 10977 } else { 10978 ASSERT( !RtlpAreControlBitsSet( NewDescriptor, SE_GROUP_DEFAULTED ) ); 10979 10980 } 10981 10982 // 10983 // Free old descriptor 10984 // 10985 10986 // Kernel version doesn't free the old descriptor 10987 #ifndef NTOS_KERNEL_RUNTIME 10988 RtlFreeHeap( HeapHandle, 0, (PVOID) *IObjectsSecurityDescriptor ); 10989 #endif // NTOS_KERNEL_RUNTIME 10990 10991 *ObjectsSecurityDescriptor = (PSECURITY_DESCRIPTOR)NewDescriptor; 10992 Status = STATUS_SUCCESS; 10993 10994 Cleanup: 10995 if ( LocalDaclAllocated ) { 10996 #ifdef NTOS_KERNEL_RUNTIME 10997 ExFreePool( LocalDacl ); 10998 #else // NTOS_KERNEL_RUNTIME 10999 RtlFreeHeap( HeapHandle, 0, LocalDacl ); 11000 #endif // NTOS_KERNEL_RUNTIME 11001 } 11002 if ( LocalSaclAllocated ) { 11003 #ifdef NTOS_KERNEL_RUNTIME 11004 ExFreePool( LocalSacl ); 11005 #else // NTOS_KERNEL_RUNTIME 11006 RtlFreeHeap( HeapHandle, 0, LocalSacl ); 11007 #endif // NTOS_KERNEL_RUNTIME 11008 } 11009 if (ServerAclAllocated) { 11010 #ifdef NTOS_KERNEL_RUNTIME 11011 ExFreePool( ServerDacl ); 11012 #else // NTOS_KERNEL_RUNTIME 11013 RtlFreeHeap( HeapHandle, 0, ServerDacl ); 11014 #endif // NTOS_KERNEL_RUNTIME 11015 } 11016 11017 return( Status ); 11018 }

BOOLEAN RtlpValidateSDOffsetAndSize (  IN ULONG  Offset, IN ULONG  Length, IN ULONG  MinLength, OUT PULONG  MaxLength )

Definition at line 11020 of file sertl.c. References FALSE, Offset, and TRUE. Referenced by RtlValidRelativeSecurityDescriptor(). : This procedure validates offsets within a SecurityDescriptor. It checks that the structure can have the minimum length, not overlap with the fixed header and returns the maximum size of the item and longword alignment. Arguments: Offset - Offset from start of SD of structure to validate Length - Total size of SD MinLength - Minimum size this structure can be MaxLength - Retuns the maximum length this item can be given by the enclosing structure. Return Value: BOOLEAN - TRUE if the item is valid --*/ { ULONG Left; *MaxLength = 0; // // Don't allow overlap with header just in case caller modifies control bits etc // if (Offset < sizeof (SECURITY_DESCRIPTOR_RELATIVE)) { return FALSE; } // // Don't allow offsets beyond the end of the buffer // if (Offset >= Length) { return FALSE; } // // Calculate maximim size of segment and check its limits // Left = Length - Offset; if (Left < MinLength) { return FALSE; } // // Reject unaligned offsets // if (Offset & (sizeof (ULONG) - 1)) { return FALSE; } *MaxLength = Left; return TRUE; }

BOOLEAN RtlpValidOwnerSubjectContext (  IN HANDLE  Token, IN PSID  Owner, IN BOOLEAN  ServerObject, OUT PNTSTATUS  ReturnStatus )

Definition at line 3544 of file sertl.c. References FALSE, HeapHandle, Index, NT_SUCCESS, NtClose(), NtOpenProcessToken(), NtPrivilegeCheck(), NtQueryInformationToken(), NTSTATUS(), NULL, Owner, RTL_PAGED_CODE, RtlAllocateHeap, RtlEqualSid(), RtlFreeHeap, Status, Token, and TRUE. Referenced by RtlpNewSecurityObject(), and RtlpSetSecurityObject(). 03552 : 03553 03554 This routine checks to see whether the provided SID is one the subject 03555 is authorized to assign as the owner of objects. 03556 03557 Arguments: 03558 03559 Token - Points to the subject's effective token 03560 03561 Owner - Points to the SID to be checked. 03562 03563 ServerObject - Boolean indicating whether or not this is a server 03564 object, meaning it is protected by a primary-client combination. 03565 03566 ReturnStatus - Status to be passed back to the caller on failure. 03567 03568 Return Value: 03569 03570 FALSE on failure. 03571 03572 --*/ 03573 03574 { 03575 NTSTATUS Status; 03576 03577 ULONG Index; 03578 BOOLEAN Found; 03579 ULONG ReturnLength; 03580 PTOKEN_GROUPS GroupIds = NULL; 03581 PTOKEN_USER UserId = NULL; 03582 PVOID HeapHandle; 03583 HANDLE TokenToUse; 03584 03585 BOOLEAN HasPrivilege; 03586 PRIVILEGE_SET PrivilegeSet; 03587 03588 RTL_PAGED_CODE(); 03589 03590 // 03591 // Get the handle to the current process heap 03592 // 03593 03594 if ( Owner == NULL ) { 03595 *ReturnStatus = STATUS_INVALID_OWNER; 03596 return(FALSE); 03597 } 03598 03599 // 03600 // If it's not a server object, check the owner against the contents of the 03601 // client token. If it is a server object, the owner must be valid in the 03602 // primary token. 03603 // 03604 03605 if (!ServerObject) { 03606 03607 TokenToUse = Token; 03608 03609 } else { 03610 03611 *ReturnStatus = NtOpenProcessToken( 03612 NtCurrentProcess(), 03613 TOKEN_QUERY, 03614 &TokenToUse 03615 ); 03616 03617 if (!NT_SUCCESS( *ReturnStatus )) { 03618 return( FALSE ); 03619 } 03620 } 03621 03622 HeapHandle = RtlProcessHeap(); 03623 03624 // 03625 // Get the User from the Token 03626 // 03627 03628 *ReturnStatus = NtQueryInformationToken( 03629 TokenToUse, 03630 TokenUser, 03631 UserId, 03632 0, 03633 &ReturnLength 03634 ); 03635 03636 if (!NT_SUCCESS( *ReturnStatus ) && (STATUS_BUFFER_TOO_SMALL != *ReturnStatus)) { 03637 if (ServerObject) { 03638 NtClose( TokenToUse ); 03639 } 03640 return( FALSE ); 03641 03642 } 03643 03644 UserId = RtlAllocateHeap( HeapHandle, 0, ReturnLength ); 03645 03646 if (UserId == NULL) { 03647 03648 *ReturnStatus = STATUS_NO_MEMORY; 03649 if (ServerObject) { 03650 NtClose( TokenToUse ); 03651 } 03652 03653 return( FALSE ); 03654 } 03655 03656 *ReturnStatus = NtQueryInformationToken( 03657 TokenToUse, 03658 TokenUser, 03659 UserId, 03660 ReturnLength, 03661 &ReturnLength 03662 ); 03663 03664 if (!NT_SUCCESS( *ReturnStatus )) { 03665 RtlFreeHeap( HeapHandle, 0, (PVOID)UserId ); 03666 if (ServerObject) { 03667 NtClose( TokenToUse ); 03668 } 03669 return( FALSE ); 03670 } 03671 03672 if ( RtlEqualSid( Owner, UserId->User.Sid ) ) { 03673 03674 RtlFreeHeap( HeapHandle, 0, (PVOID)UserId ); 03675 if (ServerObject) { 03676 NtClose( TokenToUse ); 03677 } 03678 return( TRUE ); 03679 } 03680 03681 RtlFreeHeap( HeapHandle, 0, (PVOID)UserId ); 03682 03683 // 03684 // Get the groups from the Token 03685 // 03686 03687 *ReturnStatus = NtQueryInformationToken( 03688 TokenToUse, 03689 TokenGroups, 03690 GroupIds, 03691 0, 03692 &ReturnLength 03693 ); 03694 03695 if (!NT_SUCCESS( *ReturnStatus ) && (STATUS_BUFFER_TOO_SMALL != *ReturnStatus)) { 03696 03697 if (ServerObject) { 03698 NtClose( TokenToUse ); 03699 } 03700 return( FALSE ); 03701 } 03702 03703 GroupIds = RtlAllocateHeap( HeapHandle, 0, ReturnLength ); 03704 03705 if (GroupIds == NULL) { 03706 03707 *ReturnStatus = STATUS_NO_MEMORY; 03708 if (ServerObject) { 03709 NtClose( TokenToUse ); 03710 } 03711 return( FALSE ); 03712 } 03713 03714 *ReturnStatus = NtQueryInformationToken( 03715 TokenToUse, 03716 TokenGroups, 03717 GroupIds, 03718 ReturnLength, 03719 &ReturnLength 03720 ); 03721 03722 if (ServerObject) { 03723 NtClose( TokenToUse ); 03724 } 03725 03726 if (!NT_SUCCESS( *ReturnStatus )) { 03727 RtlFreeHeap( HeapHandle, 0, GroupIds ); 03728 return( FALSE ); 03729 } 03730 03731 // 03732 // Walk through the list of group IDs looking for a match to 03733 // the specified SID. If one is found, make sure it may be 03734 // assigned as an owner. 03735 // 03736 // This code is similar to that performed to set the default 03737 // owner of a token (NtSetInformationToken). 03738 // 03739 03740 Index = 0; 03741 while (Index < GroupIds->GroupCount) { 03742 03743 Found = RtlEqualSid( 03744 Owner, 03745 GroupIds->Groups[Index].Sid 03746 ); 03747 03748 if ( Found ) { 03749 03750 if ( RtlpIdAssignableAsOwner(GroupIds->Groups[Index])) { 03751 03752 RtlFreeHeap( HeapHandle, 0, GroupIds ); 03753 return TRUE; 03754 03755 } else { 03756 03757 break; 03758 03759 } //endif assignable 03760 03761 } //endif Found 03762 03763 Index++; 03764 03765 } //endwhile 03766 03767 RtlFreeHeap( HeapHandle, 0, GroupIds ); 03768 03769 // 03770 // If we are going to fail this call, check for Restore privilege, 03771 // and succeed if he has it. 03772 // 03773 03774 // 03775 // Check for appropriate Privileges 03776 // 03777 // Audit/Alarm messages need to be generated due to the attempt 03778 // to perform a privileged operation. 03779 // 03780 03781 PrivilegeSet.PrivilegeCount = 1; 03782 PrivilegeSet.Control = PRIVILEGE_SET_ALL_NECESSARY; 03783 PrivilegeSet.Privilege[0].Luid = RtlConvertLongToLuid(SE_RESTORE_PRIVILEGE); 03784 PrivilegeSet.Privilege[0].Attributes = 0; 03785 03786 Status = NtPrivilegeCheck( 03787 Token, 03788 &PrivilegeSet, 03789 &HasPrivilege 03790 ); 03791 03792 if (!NT_SUCCESS( Status )) { 03793 HasPrivilege = FALSE; 03794 } 03795 03796 if ( HasPrivilege ) { 03797 return TRUE; 03798 } else { 03799 *ReturnStatus = STATUS_INVALID_OWNER; 03800 return FALSE; 03801 } 03802 } #endif // NTOS_KERNEL_RUNTIME

VOID RtlRunDecodeUnicodeString (  UCHAR  Seed, PUNICODE_STRING  String )

Definition at line 520 of file sertl.c. References RTL_PAGED_CODE, Seed, and String. Referenced by ECLock(). : This function performs the inverse of the function performed by RtlRunEncodeUnicodeString(). Please see RtlRunEncodeUnicodeString() for details. Arguments: Seed - The seed value to use in RtlRunEncodeUnicodeString(). String - The string to reveal. Return Value: None - Nothing can really go wrong unless the caller passes bogus parameters. In this case, the caller can catch the access violation. --*/ { ULONG i; PSTRING S; RTL_PAGED_CODE(); // // Typecast so we can work on bytes rather than WCHARs // S = (PSTRING)((PVOID)String); // // Transform the end of the string // for (i=S->Length; i>1; i--) { // // a simple running XOR with the previous byte and the // seed value. // S->Buffer[i-1] ^= (S->Buffer[i-2]^Seed); } // // Finally, transform the initial byte // if (S->Length >= 1) { S->Buffer[0] ^= (Seed | 0X43); } return; }

VOID RtlRunEncodeUnicodeString (  PUCHAR Seed  OPTIONAL, PUNICODE_STRING  String )

Definition at line 388 of file sertl.c. References ASSERT, NT_SUCCESS, NTSTATUS(), RTL_PAGED_CODE, Status, String, and Time. Referenced by ECUnlock(). : This function performs a trivial XOR run-encoding of a string. The purpose of this run-encoding is to change the character values to appear somewhat random and typically not printable. This is useful for transforming passwords that you don't want to be easily distinguishable by visually scanning a paging file or memory dump. Arguments: Seed - Points to a seed value to use in the encoding. If the pointed to value is zero, then this routine will assign a value. String - The string to encode. This string may be decode by passing it and the seed value to RtlRunDecodeUnicodeString(). Return Value: None - Nothing can really go wrong unless the caller passes bogus parameters. In this case, the caller can catch the access violation. --*/ { LARGE_INTEGER Time; PUCHAR LocalSeed; NTSTATUS Status; ULONG i; PSTRING S; RTL_PAGED_CODE(); // // Typecast so we can work on bytes rather than WCHARs // S = (PSTRING)((PVOID)String); // // If a seed wasn't passed, use the 2nd byte of current time. // This byte seems to be sufficiently random (by observation). // if ((*Seed) == 0) { Status = NtQuerySystemTime ( &Time ); ASSERT(NT_SUCCESS(Status)); LocalSeed = (PUCHAR)((PVOID)&Time); i = 1; (*Seed) = LocalSeed[ i ]; // // Occasionally, this byte could be zero. That would cause the // string to become un-decodable, since 0 is the magic value that // causes us to re-gen the seed. This loop makes sure that we // never end up with a zero byte (unless time is zero, as well). // while ( ((*Seed) == 0) && ( i < sizeof( Time ) ) ) { (*Seed) |= LocalSeed[ i++ ] ; } if ( (*Seed) == 0 ) { (*Seed) = 1; } } // // Transform the initial byte. // The funny constant just keeps the first byte from propagating // into the second byte in the next step. Without a funny constant // this would happen for many languages (which typically have every // other byte zero. // // if (S->Length >= 1) { S->Buffer[0] ^= ((*Seed) | 0X43); } // // Now transform the rest of the string // for (i=1; i<S->Length; i++) { // // There are export issues that cause us to want to // keep this algorithm simple. Please don't change it // without checking with JimK first. Thanks. // // // In order to be compatible with zero terminated unicode strings, // this algorithm is designed to not produce a wide character of // zero as long a the seed is not zero. // // // Simple running XOR with the previous byte and the // seed value. // S->Buffer[i] ^= (S->Buffer[i-1]^(*Seed)); } return; }

NTSTATUS RtlSetAttributesSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN SECURITY_DESCRIPTOR_CONTROL  Control, OUT PULONG  Revision )

Definition at line 2386 of file sertl.c. References RTL_PAGED_CODE, RtlSetControlSecurityDescriptor(), and SE_VALID_CONTROL_BITS. { RTL_PAGED_CODE(); // // Always return the revision value - even if this isn't a valid // security descriptor // *Revision = ((SECURITY_DESCRIPTOR *)SecurityDescriptor)->Revision; if ( ((SECURITY_DESCRIPTOR *)SecurityDescriptor)->Revision != SECURITY_DESCRIPTOR_REVISION ) { return STATUS_UNKNOWN_REVISION; } // BUGBUG: This is a worthless API. There is no way to turn any of the bits off. // Use the newer RtlSetControlSecurityDescriptor. Control &= SE_VALID_CONTROL_BITS; return RtlSetControlSecurityDescriptor ( SecurityDescriptor, Control, Control ); }

NTSTATUS RtlSetControlSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  pSecurityDescriptor, IN SECURITY_DESCRIPTOR_CONTROL  ControlBitsOfInterest, IN SECURITY_DESCRIPTOR_CONTROL  ControlBitsToSet )

Definition at line 2472 of file sertl.c. References SE_VALID_CONTROL_BITS. Referenced by RtlSetAttributesSecurityDescriptor(). : This procedure sets the control information in a security descriptor. For instance, SetSecurityDescriptorControl( &SecDesc, SE_DACL_PROTECTED, SE_DACL_PROTECTED ); marks the DACL on the security descriptor as protected. And SetSecurityDescriptorControl( &SecDesc, SE_DACL_PROTECTED, 0 ); marks the DACL as not protected. Arguments: pSecurityDescriptor - Supplies the security descriptor. ControlBitsOfInterest - A mask of the control bits being changed, set, or reset by this call. The mask is the logical OR of one or more of the following flags: SE_DACL_UNTRUSTED SE_SERVER_SECURITY SE_DACL_AUTO_INHERIT_REQ SE_SACL_AUTO_INHERIT_REQ SE_DACL_AUTO_INHERITED SE_SACL_AUTO_INHERITED SE_DACL_PROTECTED SE_SACL_PROTECTED ControlBitsToSet - A mask indicating what the bits specified by ControlBitsOfInterest should be set to. Return Value: Returns TRUE for success, FALSE for failure. Extended error status is available using GetLastError. --*/ { // // Ensure the caller passed valid bits. // if ( (ControlBitsOfInterest & ~SE_VALID_CONTROL_BITS) != 0 || (ControlBitsToSet & ~ControlBitsOfInterest) != 0 ) { return STATUS_INVALID_PARAMETER; } ((SECURITY_DESCRIPTOR *)pSecurityDescriptor)->Control &= ~ControlBitsOfInterest; ((SECURITY_DESCRIPTOR *)pSecurityDescriptor)->Control |= ControlBitsToSet; return STATUS_SUCCESS; }

NTSTATUS RtlSetDaclSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN BOOLEAN  DaclPresent, IN PACL Dacl  OPTIONAL, IN BOOLEAN DaclDefaulted  OPTIONAL )

Definition at line 2543 of file sertl.c. References Dacl, NULL, RTL_PAGED_CODE, and TRUE. Referenced by CmpHiveRootSecurityDescriptor(), CreateBSMEventSD(), CreateDAclToken(), CreateSecurityDescriptor(), GenerateDescriptor(), InternalCreateCallbackThread(), IoCreateUnprotectedSymbolicLink(), IopApplySystemPartitionProt(), IopCreateDefaultDeviceSecurityDescriptor(), IopInitializePlugPlayServices(), IopOpenDeviceParametersSubkey(), NtOpenThreadToken(), ObInitSystem(), ObpGetDosDevicesProtection(), RtlCreateAndSetSD(), SeMakeAnonymousLogonToken(), SeMakeSystemToken(), SepInitializationPhase1(), SepInitSystemDacls(), SmbTraceStart(), TestSeNamedCreate(), TestSeSecurityDescriptor(), and TestTokenInitialize(). : This procedure sets the discretionary ACL information of an absolute format security descriptor. If there is already a discretionary ACL present in the security descriptor, it is superseded. Arguments: SecurityDescriptor - Supplies the security descriptor to be which the discretionary ACL is to be added. DaclPresent - If FALSE, indicates the DaclPresent flag in the security descriptor should be set to FALSE. In this case, the remaining optional parameters are ignored. Otherwise, the DaclPresent control flag in the security descriptor is set to TRUE and the remaining optional parameters are not ignored. Dacl - Supplies the discretionary ACL for the security descriptor. If this optional parameter is not passed, then a null ACL is assigned to the security descriptor. A null discretionary ACL unconditionally grants access. The ACL is referenced by, not copied into, by the security descriptor. DaclDefaulted - When set, indicates the discretionary ACL was picked up from some default mechanism (rather than explicitly specified by a user). This value is set in the DaclDefaulted control flag in the security descriptor. If this optional parameter is not passed, then the DaclDefaulted flag will be cleared. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision of the security descriptor is not known to the routine. It may be a newer revision than the routine knows about. STATUS_INVALID_SECURITY_DESCR - Indicates the security descriptor is not an absolute format security descriptor. --*/ { // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = SecurityDescriptor; RTL_PAGED_CODE(); // // Check the revision // if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return STATUS_UNKNOWN_REVISION; } // // Make sure the descriptor is absolute format // if (ISecurityDescriptor->Control & SE_SELF_RELATIVE) { return STATUS_INVALID_SECURITY_DESCR; } // // Assign the DaclPresent flag value passed // if (DaclPresent) { ISecurityDescriptor->Control |= SE_DACL_PRESENT; // // Assign the ACL address if passed, otherwise set to null. // ISecurityDescriptor->Dacl = NULL; if (ARGUMENT_PRESENT(Dacl)) { ISecurityDescriptor->Dacl = Dacl; } // // Assign DaclDefaulted flag if passed, otherwise clear it. // ISecurityDescriptor->Control &= ~SE_DACL_DEFAULTED; if (DaclDefaulted == TRUE) { ISecurityDescriptor->Control |= SE_DACL_DEFAULTED; } } else { ISecurityDescriptor->Control &= ~SE_DACL_PRESENT; } return STATUS_SUCCESS; }

NTSTATUS RtlSetGroupSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PSID Group  OPTIONAL, IN BOOLEAN GroupDefaulted  OPTIONAL )

Definition at line 3135 of file sertl.c. References Group, NULL, and RTL_PAGED_CODE. Referenced by CreateDAclToken(), CreateSecurityDescriptor(), RtlCreateAndSetSD(), SeMakeAnonymousLogonToken(), SeMakeSystemToken(), and TestSeSecurityDescriptor(). : This procedure sets the primary group information of an absolute security descriptor. If there is already an primary group present in the security descriptor, it is superseded. Arguments: SecurityDescriptor - Supplies the security descriptor in which the primary group is to be set. If the security descriptor already includes a primary group, it will be superseded by the new group. Group - Supplies the primary group SID for the security descriptor. If this optional parameter is not passed, then the primary group is cleared (indicating the security descriptor has no primary group). The SID is referenced by, not copied into, the security descriptor. GroupDefaulted - When set, indicates the owner was picked up from some default mechanism (rather than explicitly specified by a user). This value is set in the OwnerDefaulted control flag in the security descriptor. If this optional parameter is not passed, then the SaclDefaulted flag will be cleared. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision of the security descriptor is not known to the routine. It may be a newer revision than the routine knows about. STATUS_INVALID_SECURITY_DESCR - Indicates the security descriptor is not an absolute format security descriptor. --*/ { // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = SecurityDescriptor; RTL_PAGED_CODE(); // // Check the revision // if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return STATUS_UNKNOWN_REVISION; } // // Make sure the descriptor is absolute format // if (ISecurityDescriptor->Control & SE_SELF_RELATIVE) { return STATUS_INVALID_SECURITY_DESCR; } // // Assign the Group field if passed, otherwise clear it. // ISecurityDescriptor->Group = NULL; if (ARGUMENT_PRESENT(Group)) { ISecurityDescriptor->Group = Group; } // // Assign the GroupDefaulted flag if passed, otherwise clear it. // ISecurityDescriptor->Control &= ~SE_GROUP_DEFAULTED; if (ARGUMENT_PRESENT(GroupDefaulted)) { ISecurityDescriptor->Control |= SE_GROUP_DEFAULTED; } return STATUS_SUCCESS; }

NTSTATUS RtlSetOwnerSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PSID Owner  OPTIONAL, IN BOOLEAN OwnerDefaulted  OPTIONAL )

Definition at line 2963 of file sertl.c. References NULL, Owner, RTL_PAGED_CODE, and TRUE. Referenced by CreateDAclToken(), CreateSecurityDescriptor(), RtlCreateAndSetSD(), SeMakeAnonymousLogonToken(), SeMakeSystemToken(), and TestSeSecurityDescriptor(). : This procedure sets the owner information of an absolute security descriptor. If there is already an owner present in the security descriptor, it is superseded. Arguments: SecurityDescriptor - Supplies the security descriptor in which the owner is to be set. If the security descriptor already includes an owner, it will be superseded by the new owner. Owner - Supplies the owner SID for the security descriptor. If this optional parameter is not passed, then the owner is cleared (indicating the security descriptor has no owner). The SID is referenced by, not copied into, the security descriptor. OwnerDefaulted - When set, indicates the owner was picked up from some default mechanism (rather than explicitly specified by a user). This value is set in the OwnerDefaulted control flag in the security descriptor. If this optional parameter is not passed, then the SaclDefaulted flag will be cleared. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision of the security descriptor is not known to the routine. It may be a newer revision than the routine knows about. STATUS_INVALID_SECURITY_DESCR - Indicates the security descriptor is not an absolute format security descriptor. --*/ { // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = SecurityDescriptor; RTL_PAGED_CODE(); // // Check the revision // if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return STATUS_UNKNOWN_REVISION; } // // Make sure the descriptor is absolute format // if (ISecurityDescriptor->Control & SE_SELF_RELATIVE) { return STATUS_INVALID_SECURITY_DESCR; } // // Assign the Owner field if passed, otherwise clear it. // ISecurityDescriptor->Owner = NULL; if (ARGUMENT_PRESENT(Owner)) { ISecurityDescriptor->Owner = Owner; } // // Assign the OwnerDefaulted flag if passed, otherwise clear it. // ISecurityDescriptor->Control &= ~SE_OWNER_DEFAULTED; if (OwnerDefaulted == TRUE) { ISecurityDescriptor->Control |= SE_OWNER_DEFAULTED; } return STATUS_SUCCESS; }

NTSTATUS RtlSetSaclSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN BOOLEAN  SaclPresent, IN PACL Sacl  OPTIONAL, IN BOOLEAN SaclDefaulted  OPTIONAL )

Definition at line 2756 of file sertl.c. References NULL, and RTL_PAGED_CODE. Referenced by CreateDAclToken(), CreateSecurityDescriptor(), ObInitSystem(), RtlCreateAndSetSD(), and TestSeSecurityDescriptor(). : This procedure sets the system ACL information of an absolute security descriptor. If there is already a system ACL present in the security descriptor, it is superseded. Arguments: SecurityDescriptor - Supplies the security descriptor to be which the system ACL is to be added. SaclPresent - If FALSE, indicates the SaclPresent flag in the security descriptor should be set to FALSE. In this case, the remaining optional parameters are ignored. Otherwise, the SaclPresent control flag in the security descriptor is set to TRUE and the remaining optional parameters are not ignored. Sacl - Supplies the system ACL for the security descriptor. If this optional parameter is not passed, then a null ACL is assigned to the security descriptor. The ACL is referenced by, not copied into, by the security descriptor. SaclDefaulted - When set, indicates the system ACL was picked up from some default mechanism (rather than explicitly specified by a user). This value is set in the SaclDefaulted control flag in the security descriptor. If this optional parameter is not passed, then the SaclDefaulted flag will be cleared. Return Value: STATUS_SUCCESS - Indicates the call completed successfully. STATUS_UNKNOWN_REVISION - Indicates the revision of the security descriptor is not known to the routine. It may be a newer revision than the routine knows about. STATUS_INVALID_SECURITY_DESCR - Indicates the security descriptor is not an absolute format security descriptor. --*/ { // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = SecurityDescriptor; RTL_PAGED_CODE(); // // Check the revision // if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return STATUS_UNKNOWN_REVISION; } // // Make sure the descriptor is absolute format // if (ISecurityDescriptor->Control & SE_SELF_RELATIVE) { return STATUS_INVALID_SECURITY_DESCR; } // // Assign the SaclPresent flag value passed // if (SaclPresent) { ISecurityDescriptor->Control |= SE_SACL_PRESENT; // // Assign the ACL address if passed, otherwise set to null. // ISecurityDescriptor->Sacl = NULL; if (ARGUMENT_PRESENT(Sacl)) { ISecurityDescriptor->Sacl = Sacl; } // // Assign SaclDefaulted flag if passed, otherwise clear it. // ISecurityDescriptor->Control &= ~ SE_SACL_DEFAULTED; if (ARGUMENT_PRESENT(SaclDefaulted)) { ISecurityDescriptor->Control |= SE_SACL_DEFAULTED; } } else { ISecurityDescriptor->Control &= ~SE_SACL_PRESENT; } return STATUS_SUCCESS; }

VOID RtlSetSecurityDescriptorRMControl (  IN OUT PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PUCHAR RMControl  OPTIONAL )

Definition at line 11370 of file sertl.c. 11377 : 11378 11379 This procedure sets the RM Control flag in the control field of 11380 SecurityDescriptor and sets Sbz1 to the the byte to which RMContol points. 11381 If RMControl is NULL then the bits are cleared. 11382 11383 Arguments: 11384 11385 SecurityDescriptor - Pointer to the SECURITY_DESCRIPTOR structure 11386 RMControl - Pointer to the flags to set. If NULL then the bits 11387 are cleared. 11388 11389 Note: 11390 Parameter validation has already been done in Advapi. 11391 11392 11393 --*/ 11394 11395 { 11396 PISECURITY_DESCRIPTOR ISecurityDescriptor = (PISECURITY_DESCRIPTOR) SecurityDescriptor; 11397 11398 if (ARGUMENT_PRESENT(RMControl)) { 11399 ISecurityDescriptor->Control |= SE_RM_CONTROL_VALID; 11400 ISecurityDescriptor->Sbz1 = *RMControl; 11401 } else { 11402 ISecurityDescriptor->Control &= ~SE_RM_CONTROL_VALID; 11403 ISecurityDescriptor->Sbz1 = 0; 11404 } 11405 } }

PUCHAR RtlSubAuthorityCountSid (  IN PSID  Sid  )

Definition at line 1316 of file sertl.c. References RTL_PAGED_CODE. Referenced by DisplayAccountSid(), GetMangledSiteSid(), RtlEqualSid(), TestSeAclRtl(), and TSeVariableInitialization(). 01321 : 01322 01323 This function returns the address of the sub-authority count field of 01324 an SID. 01325 01326 Arguments: 01327 01328 Sid - Pointer to the SID data structure. 01329 01330 Return Value: 01331 01332 01333 --*/ 01334 { 01335 PISID ISid; 01336 01337 RTL_PAGED_CODE(); 01338 01339 // 01340 // Typecast to the opaque SID 01341 // 01342 01343 ISid = (PISID)Sid; 01344 01345 return &(ISid->SubAuthorityCount); 01346 01347 }

PULONG RtlSubAuthoritySid (  IN PSID  Sid, IN ULONG  SubAuthority )

Definition at line 1286 of file sertl.c. References RTL_PAGED_CODE. Referenced by CmpHiveRootSecurityDescriptor(), DisplayAccountSid(), GenerateDescriptor(), GetMangledSiteSid(), InitVars(), RtlDefaultNpAcl(), SepVariableInitialization(), TestSeAclRtl(), and TSeVariableInitialization(). 01292 : 01293 01294 This function returns the address of a sub-authority array element of 01295 an SID. 01296 01297 Arguments: 01298 01299 Sid - Pointer to the SID data structure. 01300 01301 SubAuthority - An index indicating which sub-authority is being specified. 01302 This value is not compared against the number of sub-authorities in the 01303 SID for validity. 01304 01305 Return Value: 01306 01307 01308 --*/ 01309 { 01310 RTL_PAGED_CODE(); 01311 01312 return RtlpSubAuthoritySid( Sid, SubAuthority ); 01313 }

BOOLEAN RtlValidRelativeSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptorInput, IN ULONG  SecurityDescriptorLength, IN SECURITY_INFORMATION  RequiredInformation )

Definition at line 11089 of file sertl.c. References Dacl, FALSE, RtlpValidateSDOffsetAndSize(), RtlValidAcl(), SeLengthSid, and TRUE. : This procedure validates a SecurityDescriptor's structure contained within a flat buffer. This involves validating the revision levels of each component of the security descriptor. Arguments: SecurityDescriptor - Pointer to the SECURITY_DESCRIPTOR structure to validate. SecurityDescriptorLength - Size of flat buffer containing the security descriptor. RequiredInformation - Which SD components must be present to be valid. OWNER_SECURITY_INFORMATION etc as a bit mask. OWNER_SECURITY_INFORMATION - There must be a valid owner SID GROUP_SECURITY_INFORMATION - There must be a valid group SID DACL_SECURITY_INFORMATION - Ignored SACL_SECURITY_INFORMATION - Ignored Return Value: BOOLEAN - TRUE if the structure of SecurityDescriptor is valid. --*/ { PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor; PISID OwnerSid; PISID GroupSid; PACE_HEADER Ace; PACL Dacl; PACL Sacl; ULONG MaxOwnerSidLength; ULONG MaxGroupSidLength; ULONG MaxDaclLength; ULONG MaxSaclLength; if (SecurityDescriptorLength < sizeof(SECURITY_DESCRIPTOR_RELATIVE)) { return FALSE; } // // Check the revision information. // if (((PISECURITY_DESCRIPTOR) SecurityDescriptorInput)->Revision != SECURITY_DESCRIPTOR_REVISION) { return FALSE; } // // Make sure the passed SecurityDescriptor is in self-relative form // if (!(((PISECURITY_DESCRIPTOR) SecurityDescriptorInput)->Control & SE_SELF_RELATIVE)) { return FALSE; } SecurityDescriptor = (PISECURITY_DESCRIPTOR_RELATIVE) SecurityDescriptorInput; // // Validate the owner if it's there and see if its allowed to be missing // if (SecurityDescriptor->Owner == 0) { if (RequiredInformation & OWNER_SECURITY_INFORMATION) { return FALSE; } } else { if (!RtlpValidateSDOffsetAndSize (SecurityDescriptor->Owner, SecurityDescriptorLength, sizeof (SID), &MaxOwnerSidLength)) { return FALSE; } // // It is safe to reference the owner's SubAuthorityCount, compute the // expected length of the SID // OwnerSid = (PSID)RtlOffsetToPointer (SecurityDescriptor, SecurityDescriptor->Owner); if (OwnerSid->Revision != SID_REVISION) { return FALSE; } if (OwnerSid->SubAuthorityCount > SID_MAX_SUB_AUTHORITIES) { return FALSE; } if (MaxOwnerSidLength < (ULONG) SeLengthSid (OwnerSid)) { return FALSE; } } // // The owner appears to be a structurally valid SID that lies within // the bounds of the security descriptor. Do the same for the Group // if there is one. // // // Validate the group if it's there and see if its allowed to be missing // if (SecurityDescriptor->Group == 0) { if (RequiredInformation & GROUP_SECURITY_INFORMATION) { return FALSE; } } else { if (!RtlpValidateSDOffsetAndSize (SecurityDescriptor->Group, SecurityDescriptorLength, sizeof (SID), &MaxGroupSidLength)) { return FALSE; } // // It is safe to reference the group's SubAuthorityCount, compute the // expected length of the SID // GroupSid = (PSID)RtlOffsetToPointer (SecurityDescriptor, SecurityDescriptor->Group); if (GroupSid->Revision != SID_REVISION) { return FALSE; } if (GroupSid->SubAuthorityCount > SID_MAX_SUB_AUTHORITIES) { return FALSE; } if (MaxGroupSidLength < (ULONG) SeLengthSid (GroupSid)) { return FALSE; } } // // Validate the DACL if it's there and check if its allowed to be missing. // if (!RtlpAreControlBitsSet (SecurityDescriptor, SE_DACL_PRESENT)) { // // Some code does this kind of thing: // // InitializeSecurityDescriptor (&sd, SECURITY_DESCRIPTOR_REVISION); // RegSetKeySecurity(hKey, DACL_SECURITY_INFORMATION, &sd) ) // // With the current system this works the same as passing in a NULL DACL but it looks // almost by accident // // if (RequiredInformation & DACL_SECURITY_INFORMATION) { // return FALSE; // } } else if (SecurityDescriptor->Dacl) { if (!RtlpValidateSDOffsetAndSize (SecurityDescriptor->Dacl, SecurityDescriptorLength, sizeof (ACL), &MaxDaclLength)) { return FALSE; } Dacl = (PACL) RtlOffsetToPointer (SecurityDescriptor, SecurityDescriptor->Dacl); // // Make sure the DACL length fits within the bounds of the security descriptor. // if (MaxDaclLength < Dacl->AclSize) { return FALSE; } // // Make sure the ACL is structurally valid. // if (!RtlValidAcl (Dacl)) { return FALSE; } } // // Validate the SACL if it's there and check if its allowed to be missing. // if (!RtlpAreControlBitsSet (SecurityDescriptor, SE_SACL_PRESENT)) { // if (RequiredInformation & SACL_SECURITY_INFORMATION) { // return FALSE; // } } else if (SecurityDescriptor->Sacl) { if (!RtlpValidateSDOffsetAndSize (SecurityDescriptor->Sacl, SecurityDescriptorLength, sizeof (ACL), &MaxSaclLength)) { return FALSE; } Sacl = (PACL) RtlOffsetToPointer (SecurityDescriptor, SecurityDescriptor->Sacl); // // Make sure the SACL length fits within the bounds of the security descriptor. // if (MaxSaclLength < Sacl->AclSize) { return FALSE; } // // Make sure the ACL is structurally valid. // if (!RtlValidAcl (Sacl)) { return FALSE; } } return TRUE; }

BOOLEAN RtlValidSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor  )

Definition at line 2066 of file sertl.c. References Dacl, EXCEPTION_EXECUTE_HANDLER, FALSE, Group, NULL, Owner, RTL_PAGED_CODE, RtlValidAcl(), RtlValidSid(), and TRUE. Referenced by IopInitializePlugPlayServices(), IopOpenDeviceParametersSubkey(), ObpReferenceSecurityDescriptor(), RtlpConvertToAutoInheritSecurityObject(), and TestSeSecurityDescriptor(). : This procedure validates a SecurityDescriptor's structure. This involves validating the revision levels of each component of the security descriptor. Arguments: SecurityDescriptor - Pointer to the SECURITY_DESCRIPTOR structure to validate. Return Value: BOOLEAN - TRUE if the structure of SecurityDescriptor is valid. --*/ { PSID Owner; PSID Group; PACL Dacl; PACL Sacl; // // Typecast to the opaque SECURITY_DESCRIPTOR structure. // SECURITY_DESCRIPTOR *ISecurityDescriptor = SecurityDescriptor; RTL_PAGED_CODE(); try { // // known revision ? // if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return FALSE; } // // Validate each element contained in the security descriptor // Owner = RtlpOwnerAddrSecurityDescriptor( ISecurityDescriptor ); if (Owner != NULL) { if (!RtlValidSid( Owner )) { return FALSE; } } Group = RtlpGroupAddrSecurityDescriptor( ISecurityDescriptor ); if (Group != NULL) { if (!RtlValidSid( Group )) { return FALSE; } } Dacl = RtlpDaclAddrSecurityDescriptor( ISecurityDescriptor ); if (Dacl != NULL ) { if (!RtlValidAcl( Dacl )) { return FALSE; } } Sacl = RtlpSaclAddrSecurityDescriptor( ISecurityDescriptor ); if ( Sacl != NULL ) { if (!RtlValidAcl( Sacl )) { return FALSE; } } } except(EXCEPTION_EXECUTE_HANDLER) { return FALSE; } // // All components are valid // return TRUE; }

BOOLEAN RtlValidSid (  IN PSID  Sid  )

Definition at line 810 of file sertl.c. References EXCEPTION_EXECUTE_HANDLER, FALSE, NULL, ProbeAndReadUlongUM, RTL_PAGED_CODE, and TRUE. Referenced by CmpHiveRootSecurityDescriptor(), GenerateDescriptor(), IoCheckQuotaBufferValidity(), IopCheckGetQuotaBufferValidity(), NtQueryQuotaInformationFile(), RtlAddCompoundAce(), RtlConvertSidToUnicodeString(), RtlLengthSidAsUnicodeString(), RtlpAddKnownAce(), RtlpAddKnownObjectAce(), RtlpNewSecurityObject(), RtlpSetSecurityObject(), RtlValidSecurityDescriptor(), SeCaptureSecurityDescriptor(), SeCaptureSid(), SeCaptureSidAndAttributesArray(), and TestSeSid(). : This procedure validates an SID's structure. Arguments: Sid - Pointer to the SID structure to validate. Return Value: BOOLEAN - TRUE if the structure of Sid is valid. --*/ { PISID Isid = (PISID) Sid; RTL_PAGED_CODE(); // // Make sure revision is SID_REVISION and sub authority count is not // greater than maximum number of allowed sub-authorities. // try { if ( Isid != NULL && (Isid->Revision & 0x0f) == SID_REVISION) { if (Isid->SubAuthorityCount <= SID_MAX_SUB_AUTHORITIES) { // // Verify the memory actually contains the last subauthority // #ifndef NTOS_KERNEL_RUNTIME #define ProbeAndReadUlongUM(Address) \ (*(volatile ULONG *)(Address)) if (Isid->SubAuthorityCount > 0) { ProbeAndReadUlongUM( &Isid->SubAuthority[Isid->SubAuthorityCount-1] ); } #endif // !NTOS_KERNEL_RUNTIME return TRUE; } } } except(EXCEPTION_EXECUTE_HANDLER) { return FALSE; } return FALSE; }

---

Variable Documentation

UCHAR RtlBaseAceType[]

Initial value: { ACCESS_ALLOWED_ACE_TYPE, ACCESS_DENIED_ACE_TYPE, SYSTEM_AUDIT_ACE_TYPE, SYSTEM_ALARM_ACE_TYPE, ACCESS_ALLOWED_ACE_TYPE, ACCESS_ALLOWED_ACE_TYPE, ACCESS_DENIED_ACE_TYPE, SYSTEM_AUDIT_ACE_TYPE, SYSTEM_ALARM_ACE_TYPE } Definition at line 340 of file sertl.c. Referenced by RtlpCompareKnownAces(), RtlpCompareKnownObjectAces(), RtlpConvertAclToAutoInherit(), and RtlpCopyEffectiveAce().

UCHAR RtlIsSystemAceType[]

Initial value: { FALSE, FALSE, TRUE, TRUE, FALSE, FALSE, FALSE, TRUE, TRUE } Definition at line 356 of file sertl.c. Referenced by RtlpCompareKnownAces(), and RtlpCompareKnownObjectAces().

BOOLEAN RtlpVerboseConvert = FALSE

Definition at line 368 of file sertl.c. Referenced by RtlpCompareKnownAces(), RtlpCompareKnownObjectAces(), RtlpConvertAclToAutoInherit(), and RtlpIsDuplicateAce().

---