seinit.c File Reference

#include <nt.h>
#include "sep.h"
#include "tokenp.h"
#include "adt.h"
#include <string.h>

Go to the source code of this file.

Defines
#define	SEP_INITIAL_KEY_COUNT   15
#define	SEP_INITIAL_LEVEL_COUNT   6L
Functions
BOOLEAN	SeInitSystem (VOID)
BOOLEAN	SepInitializationPhase0 (VOID)
BOOLEAN	SepInitializationPhase1 (VOID)

---

Define Documentation

#define SEP_INITIAL_KEY_COUNT   15

Definition at line 31 of file seinit.c.

#define SEP_INITIAL_LEVEL_COUNT   6L

Definition at line 32 of file seinit.c.

---

Function Documentation

BOOLEAN SeInitSystem (  VOID   )

Definition at line 41 of file seinit.c. References InitializationPhase, KeBugCheck(), PAGED_CODE, SepInitializationPhase0(), and SepInitializationPhase1(). 00045 : 00046 00047 Perform security related system initialization functions. 00048 00049 Arguments: 00050 00051 None. 00052 00053 Return Value: 00054 00055 TRUE - Initialization succeeded. 00056 00057 FALSE - Initialization failed. 00058 00059 --*/ 00060 00061 { 00062 PAGED_CODE(); 00063 00064 switch ( InitializationPhase ) { 00065 00066 case 0 : 00067 return SepInitializationPhase0(); 00068 case 1 : 00069 return SepInitializationPhase1(); 00070 default: 00071 KeBugCheck(UNEXPECTED_INITIALIZATION_CALL); 00072 } 00073 return 0; // Bash compiler warning 00074 }

BOOLEAN SepInitializationPhase0 (  VOID   )

Definition at line 78 of file seinit.c. References ExLuidInitialization(), FALSE, NULL, PAGED_CODE, PsGetCurrentProcess, PsGetCurrentThread, SeMakeSystemToken(), SepInitializeWorkList(), SepRmInitPhase0(), SepTokenInitialization(), and SepVariableInitialization(). Referenced by SeInitSystem(). 00082 : 00083 00084 Perform phase 0 security initialization. 00085 00086 This includes: 00087 00088 - Initialize LUID allocation 00089 - Initialize security global variables 00090 - initialize the token object. 00091 - Initialize the necessary security components of the boot thread/process 00092 00093 00094 Arguments: 00095 00096 None. 00097 00098 Return Value: 00099 00100 TRUE - Initialization was successful. 00101 00102 FALSE - Initialization Failed. 00103 00104 --*/ 00105 00106 { 00107 00108 PAGED_CODE(); 00109 00110 // 00111 // LUID allocation services are needed by security prior to phase 0 00112 // Executive initialization. So, LUID initialization is performed 00113 // here 00114 // 00115 00116 if (ExLuidInitialization() == FALSE) { 00117 KdPrint(("Security: Locally Unique ID initialization failed.\n")); 00118 return FALSE; 00119 } 00120 00121 // 00122 // Initialize security global variables 00123 // 00124 00125 if (!SepVariableInitialization()) { 00126 KdPrint(("Security: Global variable initialization failed.\n")); 00127 return FALSE; 00128 } 00129 00130 // 00131 // Perform Phase 0 Reference Monitor Initialization. 00132 // 00133 00134 if (!SepRmInitPhase0()) { 00135 KdPrint(("Security: Ref Mon state initialization failed.\n")); 00136 return FALSE; 00137 } 00138 00139 // 00140 // Initialize the token object type. 00141 // 00142 00143 if (!SepTokenInitialization()) { 00144 KdPrint(("Security: Token object initialization failed.\n")); 00145 return FALSE; 00146 } 00147 00148 // // 00149 // // Initialize auditing structures 00150 // // 00151 // 00152 // if (!SepAdtInitializePhase0()) { 00153 // KdPrint(("Security: Auditing initialization failed.\n")); 00154 // return FALSE; 00155 // } 00156 // 00157 // 00158 // Initialize SpinLock and list for the LSA worker thread 00159 // 00160 00161 // 00162 // Initialize the work queue spinlock, list head, and semaphore 00163 // for each of the work queues. 00164 // 00165 00166 if (!SepInitializeWorkList()) { 00167 KdPrint(("Security: Unable to initialize work queue\n")); 00168 return FALSE; 00169 } 00170 00171 // 00172 // Initialize the security fields of the boot thread. 00173 // 00174 00175 PsGetCurrentProcess()->Token = SeMakeSystemToken(); 00176 PsGetCurrentThread()->ImpersonationInfo = NULL; 00177 PsGetCurrentThread()->ActiveImpersonationInfo = FALSE; 00178 00179 return ( PsGetCurrentProcess()->Token != NULL ); 00180 }

BOOLEAN SepInitializationPhase1 (  VOID   )

Definition at line 184 of file seinit.c. References ASSERT, ASSERTMSG, Dacl, ExAllocatePool, ExFreePool(), FALSE, Name, NonPagedPool, NT_SUCCESS, NtClose(), NtCreateDirectoryObject(), NtCreateEvent(), NTSTATUS(), NULL, ObjectAttributes, PAGED_CODE, RtlAddAccessAllowedAce(), RtlAnsiStringToUnicodeString(), RtlCreateAcl(), RtlCreateSecurityDescriptor(), RtlFreeUnicodeString(), RtlInitString(), RtlSetDaclSecurityDescriptor(), SeAliasAdminsSid, SeAnonymousLogonToken, SeLocalSystemSid, SeMakeAnonymousLogonToken(), SepAdtInitializePhase1(), SepDevelopmentTest(), SePublicDefaultSd, SeWorldSid, Status, and TRUE. Referenced by SeInitSystem(). 00188 : 00189 00190 Perform phase 1 security initialization. 00191 00192 This includes: 00193 00194 - Create an object directory for security related objects. 00195 (\Security). 00196 00197 - Create an event to be signalled after the LSA has initialized. 00198 (\Security\LSA_Initialized) 00199 00200 00201 00202 00203 Arguments: 00204 00205 None. 00206 00207 Return Value: 00208 00209 TRUE - Initialization was successful. 00210 00211 FALSE - Initialization Failed. 00212 00213 --*/ 00214 00215 { 00216 00217 NTSTATUS Status; 00218 STRING Name; 00219 UNICODE_STRING UnicodeName; 00220 OBJECT_ATTRIBUTES ObjectAttributes; 00221 HANDLE SecurityRoot, TemporaryHandle; 00222 PSECURITY_DESCRIPTOR SD ; 00223 UCHAR SDBuffer[ SECURITY_DESCRIPTOR_MIN_LENGTH ]; 00224 PACL Dacl ; 00225 00226 PAGED_CODE(); 00227 00228 SeAnonymousLogonToken = SeMakeAnonymousLogonToken(); 00229 ASSERT(SeAnonymousLogonToken != NULL); 00230 00231 // 00232 // Create the security object directory. 00233 // 00234 00235 RtlInitString( &Name, "\\Security" ); 00236 Status = RtlAnsiStringToUnicodeString( 00237 &UnicodeName, 00238 &Name, 00239 TRUE ); ASSERT( NT_SUCCESS(Status) ); 00240 00241 // 00242 // Build up the security descriptor 00243 // 00244 00245 SD = (PSECURITY_DESCRIPTOR) SDBuffer ; 00246 00247 RtlCreateSecurityDescriptor( SD, 00248 SECURITY_DESCRIPTOR_REVISION ); 00249 00250 Dacl = ExAllocatePool( 00251 NonPagedPool, 00252 256 ); 00253 00254 if ( !Dacl ) 00255 { 00256 return FALSE ; 00257 } 00258 00259 RtlCreateAcl( Dacl, 256, ACL_REVISION ); 00260 00261 RtlAddAccessAllowedAce( Dacl, 00262 ACL_REVISION, 00263 DIRECTORY_ALL_ACCESS, 00264 SeLocalSystemSid ); 00265 00266 RtlAddAccessAllowedAce( Dacl, 00267 ACL_REVISION, 00268 DIRECTORY_QUERY | DIRECTORY_TRAVERSE | 00269 READ_CONTROL, 00270 SeAliasAdminsSid ); 00271 00272 RtlAddAccessAllowedAce( Dacl, 00273 ACL_REVISION, 00274 DIRECTORY_TRAVERSE, 00275 SeWorldSid ); 00276 00277 RtlSetDaclSecurityDescriptor( 00278 SD, 00279 TRUE, 00280 Dacl, 00281 FALSE ); 00282 00283 InitializeObjectAttributes( 00284 &ObjectAttributes, 00285 &UnicodeName, 00286 (OBJ_PERMANENT | OBJ_CASE_INSENSITIVE), 00287 NULL, 00288 SD 00289 ); 00290 00291 Status = NtCreateDirectoryObject( 00292 &SecurityRoot, 00293 DIRECTORY_ALL_ACCESS, 00294 &ObjectAttributes 00295 ); 00296 RtlFreeUnicodeString( &UnicodeName ); 00297 ASSERTMSG("Security root object directory creation failed.",NT_SUCCESS(Status)); 00298 00299 ExFreePool( Dacl ); 00300 00301 // 00302 // Create an event in the security directory 00303 // 00304 00305 RtlInitString( &Name, "LSA_AUTHENTICATION_INITIALIZED" ); 00306 Status = RtlAnsiStringToUnicodeString( 00307 &UnicodeName, 00308 &Name, 00309 TRUE ); ASSERT( NT_SUCCESS(Status) ); 00310 InitializeObjectAttributes( 00311 &ObjectAttributes, 00312 &UnicodeName, 00313 (OBJ_PERMANENT | OBJ_CASE_INSENSITIVE), 00314 SecurityRoot, 00315 SePublicDefaultSd 00316 ); 00317 00318 Status = NtCreateEvent( 00319 &TemporaryHandle, 00320 GENERIC_WRITE, 00321 &ObjectAttributes, 00322 NotificationEvent, 00323 FALSE 00324 ); 00325 RtlFreeUnicodeString( &UnicodeName ); 00326 ASSERTMSG("LSA Initialization Event Creation Failed.",NT_SUCCESS(Status)); 00327 00328 Status = NtClose( SecurityRoot ); 00329 ASSERTMSG("Security object directory handle closure Failed.",NT_SUCCESS(Status)); 00330 Status = NtClose( TemporaryHandle ); 00331 ASSERTMSG("LSA Initialization Event handle closure Failed.",NT_SUCCESS(Status)); 00332 00333 // 00334 // Initialize auditing structures 00335 // 00336 00337 if (!SepAdtInitializePhase1()) { 00338 KdPrint(("Security: Auditing initialization failed.\n")); 00339 return FALSE; 00340 } 00341 00342 00343 #ifndef SETEST 00344 00345 return TRUE; 00346 00347 #else 00348 00349 return SepDevelopmentTest(); 00350 00351 #endif //SETEST 00352 00353 } }

---