se.h File Reference

Go to the source code of this file.

Classes
struct	_SECURITY_SUBJECT_CONTEXT
struct	_INITIAL_PRIVILEGE_SET
struct	_ACCESS_STATE
struct	_AUX_ACCESS_DATA
struct	_SE_AUDITING_STATE
struct	_SE_PROCESS_AUDIT_INFO
struct	_SE_EXPORTS
Defines
#define	SE_DEFAULT_SECURITY_QUOTA   2048
#define	TOKEN_HAS_TRAVERSE_PRIVILEGE   0x01
#define	TOKEN_HAS_BACKUP_PRIVILEGE   0x02
#define	TOKEN_HAS_RESTORE_PRIVILEGE   0x04
#define	TOKEN_HAS_ADMIN_GROUP   0x08
#define	TOKEN_IS_RESTRICTED   0x10
#define	SE_BACKUP_PRIVILEGES_CHECKED   0x00000010
#define	INITIAL_PRIVILEGE_COUNT   3
#define	SeComputeDeniedAccesses(GrantedAccess, DesiredAccess)   ((~(GrantedAccess)) & (DesiredAccess) )
#define	SeComputeGrantedAccesses(GrantedAccess, DesiredAccess)   ((GrantedAccess) & (DesiredAccess) )
#define	SeLengthSid(Sid)   (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
#define	SeSameToken(TC1, TC2)
#define	SeDeleteClientSecurity(C)
	*++
#define	SeStopImpersonatingClient()   PsRevertToSelf()
	*++
#define	SeAssertMappedCanonicalAccess(AccessMask)
#define	SeComputeSecurityQuota(Size)
#define	SeQuerySubjectContextToken(SubjectContext)
#define	SeTokenObjectType()   (PVOID)SepTokenObjectType
#define	SeEnableAccessToExports()
Typedefs
typedef enum _SECURITY_OPERATION_CODE	SECURITY_OPERATION_CODE
typedef enum _SECURITY_OPERATION_CODE *	PSECURITY_OPERATION_CODE
typedef _SECURITY_SUBJECT_CONTEXT	SECURITY_SUBJECT_CONTEXT
typedef _SECURITY_SUBJECT_CONTEXT *	PSECURITY_SUBJECT_CONTEXT
typedef _INITIAL_PRIVILEGE_SET	INITIAL_PRIVILEGE_SET
typedef _INITIAL_PRIVILEGE_SET *	PINITIAL_PRIVILEGE_SET
typedef _ACCESS_STATE	ACCESS_STATE
typedef _ACCESS_STATE *	PACCESS_STATE
typedef _AUX_ACCESS_DATA	AUX_ACCESS_DATA
typedef _AUX_ACCESS_DATA *	PAUX_ACCESS_DATA
typedef _SE_AUDITING_STATE	SE_AUDITING_STATE
typedef _SE_AUDITING_STATE *	PSE_AUDITING_STATE
typedef _SE_PROCESS_AUDIT_INFO	SE_PROCESS_AUDIT_INFO
typedef _SE_PROCESS_AUDIT_INFO *	PSE_PROCESS_AUDIT_INFO
typedef _SE_EXPORTS	SE_EXPORTS
typedef _SE_EXPORTS *	PSE_EXPORTS
typedef NTSTATUS(*	PSE_LOGON_SESSION_TERMINATED_ROUTINE )(IN PLUID LogonId)
Enumerations
enum	_SECURITY_OPERATION_CODE { SetSecurityDescriptor, QuerySecurityDescriptor, DeleteSecurityDescriptor, AssignSecurityDescriptor }
Functions
BOOLEAN	SeInitSystem (VOID)
VOID	SeSetSecurityAccessMask (IN SECURITY_INFORMATION SecurityInformation, OUT PACCESS_MASK DesiredAccess)
VOID	SeQuerySecurityAccessMask (IN SECURITY_INFORMATION SecurityInformation, OUT PACCESS_MASK DesiredAccess)
NTSTATUS	SeDefaultObjectMethod (IN PVOID Object, IN SECURITY_OPERATION_CODE OperationCode, IN PSECURITY_INFORMATION SecurityInformation, IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PULONG Length, IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, IN POOL_TYPE PoolType, IN PGENERIC_MAPPING GenericMapping)
NTKERNELAPI NTSTATUS	SeCaptureSecurityDescriptor (IN PSECURITY_DESCRIPTOR InputSecurityDescriptor, IN KPROCESSOR_MODE RequestorMode, IN POOL_TYPE PoolType, IN BOOLEAN ForceCapture, OUT PSECURITY_DESCRIPTOR *OutputSecurityDescriptor)
NTKERNELAPI VOID	SeReleaseSecurityDescriptor (IN PSECURITY_DESCRIPTOR CapturedSecurityDescriptor, IN KPROCESSOR_MODE RequestorMode, IN BOOLEAN ForceCapture)
NTKERNELAPI VOID	SeCaptureSubjectContext (OUT PSECURITY_SUBJECT_CONTEXT SubjectContext)
NTKERNELAPI VOID	SeLockSubjectContext (IN PSECURITY_SUBJECT_CONTEXT SubjectContext)
NTKERNELAPI VOID	SeUnlockSubjectContext (IN PSECURITY_SUBJECT_CONTEXT SubjectContext)
NTKERNELAPI VOID	SeReleaseSubjectContext (IN PSECURITY_SUBJECT_CONTEXT SubjectContext)
NTSTATUS	SeCaptureSecurityQos (IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE RequestorMode, IN PBOOLEAN SecurityQosPresent, IN PSECURITY_ADVANCED_QUALITY_OF_SERVICE CapturedSecurityQos)
VOID	SeFreeCapturedSecurityQos (IN PVOID SecurityQos)
NTSTATUS	SeCaptureSid (IN PSID InputSid, IN KPROCESSOR_MODE RequestorMode, IN PVOID CaptureBuffer OPTIONAL, IN ULONG CaptureBufferLength, IN POOL_TYPE PoolType, IN BOOLEAN ForceCapture, OUT PSID *CapturedSid)
VOID	SeReleaseSid (IN PSID CapturedSid, IN KPROCESSOR_MODE RequestorMode, IN BOOLEAN ForceCapture)
NTSTATUS	SeCaptureAcl (IN PACL InputAcl, IN KPROCESSOR_MODE RequestorMode, IN PVOID CaptureBuffer OPTIONAL, IN ULONG CaptureBufferLength, IN POOL_TYPE PoolType, IN BOOLEAN ForceCapture, OUT PACL *CapturedAcl, OUT PULONG AlignedAclSize)
VOID	SeReleaseAcl (IN PACL CapturedAcl, IN KPROCESSOR_MODE RequestorMode, IN BOOLEAN ForceCapture)
NTSTATUS	SeCaptureLuidAndAttributesArray (IN PLUID_AND_ATTRIBUTES InputArray, IN ULONG ArrayCount, IN KPROCESSOR_MODE RequestorMode, IN PVOID CaptureBuffer OPTIONAL, IN ULONG CaptureBufferLength, IN POOL_TYPE PoolType, IN BOOLEAN ForceCapture, OUT PLUID_AND_ATTRIBUTES *CapturedArray, OUT PULONG AlignedArraySize)
VOID	SeReleaseLuidAndAttributesArray (IN PLUID_AND_ATTRIBUTES CapturedArray, IN KPROCESSOR_MODE RequestorMode, IN BOOLEAN ForceCapture)
NTSTATUS	SeCaptureSidAndAttributesArray (IN PSID_AND_ATTRIBUTES InputArray, IN ULONG ArrayCount, IN KPROCESSOR_MODE RequestorMode, IN PVOID CaptureBuffer OPTIONAL, IN ULONG CaptureBufferLength, IN POOL_TYPE PoolType, IN BOOLEAN ForceCapture, OUT PSID_AND_ATTRIBUTES *CapturedArray, OUT PULONG AlignedArraySize)
VOID	SeReleaseSidAndAttributesArray (IN PSID_AND_ATTRIBUTES CapturedArray, IN KPROCESSOR_MODE RequestorMode, IN BOOLEAN ForceCapture)
NTKERNELAPI NTSTATUS	SeAssignSecurity (IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL, IN PSECURITY_DESCRIPTOR ExplicitDescriptor, OUT PSECURITY_DESCRIPTOR *NewDescriptor, IN BOOLEAN IsDirectoryObject, IN PSECURITY_SUBJECT_CONTEXT SubjectContext, IN PGENERIC_MAPPING GenericMapping, IN POOL_TYPE PoolType)
NTKERNELAPI NTSTATUS	SeAssignSecurityEx (IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL, IN PSECURITY_DESCRIPTOR ExplicitDescriptor OPTIONAL, OUT PSECURITY_DESCRIPTOR *NewDescriptor, IN GUID *ObjectType OPTIONAL, IN BOOLEAN IsDirectoryObject, IN ULONG AutoInheritFlags, IN PSECURITY_SUBJECT_CONTEXT SubjectContext, IN PGENERIC_MAPPING GenericMapping, IN POOL_TYPE PoolType)
NTKERNELAPI NTSTATUS	SeDeassignSecurity (IN OUT PSECURITY_DESCRIPTOR *SecurityDescriptor)
NTKERNELAPI BOOLEAN	SeAccessCheck (IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN BOOLEAN SubjectContextLocked, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK PreviouslyGrantedAccess, OUT PPRIVILEGE_SET *Privileges OPTIONAL, IN PGENERIC_MAPPING GenericMapping, IN KPROCESSOR_MODE AccessMode, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus)
BOOLEAN	SeProxyAccessCheck (IN PUNICODE_STRING Volume, IN PUNICODE_STRING RelativePath, IN BOOLEAN ContainerObject, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN BOOLEAN SubjectContextLocked, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK PreviouslyGrantedAccess, OUT PPRIVILEGE_SET *Privileges OPTIONAL, IN PGENERIC_MAPPING GenericMapping, IN KPROCESSOR_MODE AccessMode, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus)
NTKERNELAPI BOOLEAN	SePrivilegeCheck (IN OUT PPRIVILEGE_SET RequiredPrivileges, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN KPROCESSOR_MODE AccessMode)
NTKERNELAPI VOID	SeFreePrivileges (IN PPRIVILEGE_SET Privileges)
NTSTATUS	SePrivilegePolicyCheck (IN OUT PACCESS_MASK RemainingDesiredAccess, IN OUT PACCESS_MASK PreviouslyGrantedAccess, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL, IN PACCESS_TOKEN Token OPTIONAL, OUT PPRIVILEGE_SET *PrivilegeSet, IN KPROCESSOR_MODE PreviousMode)
VOID	SeGenerateMessage (IN PSTRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PACCESS_TOKEN Token, IN ACCESS_MASK DesiredAccess, IN BOOLEAN AccessGranted, IN HANDLE AuditPort, IN HANDLE AlarmPort, IN KPROCESSOR_MODE AccessMode)
NTKERNELAPI VOID	SeOpenObjectAuditAlarm (IN PUNICODE_STRING ObjectTypeName, IN PVOID Object OPTIONAL, IN PUNICODE_STRING AbsoluteObjectName OPTIONAL, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PACCESS_STATE AccessState, IN BOOLEAN ObjectCreated, IN BOOLEAN AccessGranted, IN KPROCESSOR_MODE AccessMode, OUT PBOOLEAN GenerateOnClose)
NTKERNELAPI VOID	SeOpenObjectForDeleteAuditAlarm (IN PUNICODE_STRING ObjectTypeName, IN PVOID Object OPTIONAL, IN PUNICODE_STRING AbsoluteObjectName OPTIONAL, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PACCESS_STATE AccessState, IN BOOLEAN ObjectCreated, IN BOOLEAN AccessGranted, IN KPROCESSOR_MODE AccessMode, OUT PBOOLEAN GenerateOnClose)
VOID	SeDeleteObjectAuditAlarm (IN PVOID Object, IN HANDLE Handle)
VOID	SeCloseObjectAuditAlarm (IN PVOID Object, IN HANDLE Handle, IN BOOLEAN GenerateOnClose)
VOID	SeTraverseAuditAlarm (IN PLUID OperationID, IN PVOID DirectoryObject, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN BOOLEAN SubjectContextLocked, IN ACCESS_MASK TraverseAccess, IN PPRIVILEGE_SET Privileges OPTIONAL, IN BOOLEAN AccessGranted, IN KPROCESSOR_MODE AccessMode)
VOID	SeCreateInstanceAuditAlarm (IN PLUID OperationID OPTIONAL, IN PVOID Object, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET Privileges OPTIONAL, IN BOOLEAN AccessGranted, IN KPROCESSOR_MODE AccessMode)
VOID	SeCreateObjectAuditAlarm (IN PLUID OperationID OPTIONAL, IN PVOID Object, IN PUNICODE_STRING ComponentName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET Privileges OPTIONAL, IN BOOLEAN AccessGranted, OUT PBOOLEAN AuditPerformed, IN KPROCESSOR_MODE AccessMode)
VOID	SeObjectReferenceAuditAlarm (IN PLUID OperationID OPTIONAL, IN PVOID Object, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET Privileges OPTIONAL, IN BOOLEAN AccessGranted, IN KPROCESSOR_MODE AccessMode)
NTKERNELAPI VOID	SePrivilegeObjectAuditAlarm (IN HANDLE Handle, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET Privileges, IN BOOLEAN AccessGranted, IN KPROCESSOR_MODE AccessMode)
BOOLEAN	SeCheckPrivilegedObject (LUID PrivilegeValue, HANDLE ObjectHandle, ACCESS_MASK DesiredAccess, KPROCESSOR_MODE PreviousMode)
NTKERNELAPI BOOLEAN	SeValidSecurityDescriptor (IN ULONG Length, IN PSECURITY_DESCRIPTOR SecurityDescriptor)
VOID	SeAuditHandleCreation (IN PACCESS_STATE AccessState, IN HANDLE Handle)
PACCESS_TOKEN	SeMakeSystemToken ()
PACCESS_TOKEN	SeMakeAnonymousLogonToken ()
VOID	SeGetTokenControlInformation (IN PACCESS_TOKEN Token, OUT PTOKEN_CONTROL TokenControl)
NTKERNELAPI TOKEN_TYPE	SeTokenType (IN PACCESS_TOKEN Token)
SECURITY_IMPERSONATION_LEVEL	SeTokenImpersonationLevel (IN PACCESS_TOKEN Token)
NTKERNELAPI BOOLEAN	SeTokenIsAdmin (IN PACCESS_TOKEN Token)
NTKERNELAPI BOOLEAN	SeTokenIsRestricted (IN PACCESS_TOKEN Token)
NTSTATUS	SeSubProcessToken (IN PEPROCESS ParentProcess, OUT PACCESS_TOKEN *ChildToken)
VOID	SeAssignPrimaryToken (IN PEPROCESS Process, IN PACCESS_TOKEN Token)
VOID	SeDeassignPrimaryToken (IN PEPROCESS Process)
NTSTATUS	SeExchangePrimaryToken (IN PEPROCESS Process, IN PACCESS_TOKEN NewAccessToken, OUT PACCESS_TOKEN *OldAccessToken)
NTSTATUS	SeCopyClientToken (IN PACCESS_TOKEN ClientToken, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, IN KPROCESSOR_MODE RequestorMode, OUT PACCESS_TOKEN *DuplicateToken)
NTSTATUS	SeFilterToken (IN PACCESS_TOKEN ExistingToken, IN ULONG Flags, IN PTOKEN_GROUPS SidsToDisable OPTIONAL, IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL, IN PTOKEN_GROUPS RestrictedSids OPTIONAL, OUT PACCESS_TOKEN *FilteredToken)
NTKERNELAPI NTSTATUS	SeQueryAuthenticationIdToken (IN PACCESS_TOKEN Token, OUT PLUID AuthenticationId)
NTKERNELAPI NTSTATUS	SeQuerySessionIdToken (IN PACCESS_TOKEN, IN PULONG pSessionId)
NTKERNELAPI NTSTATUS	SeSetSessionIdToken (IN PACCESS_TOKEN, IN ULONG SessionId)
NTKERNELAPI NTSTATUS	SeCreateClientSecurity (IN PETHREAD ClientThread, IN PSECURITY_QUALITY_OF_SERVICE ClientSecurityQos, IN BOOLEAN RemoteSession, OUT PSECURITY_CLIENT_CONTEXT ClientContext)
NTKERNELAPI VOID	SeImpersonateClient (IN PSECURITY_CLIENT_CONTEXT ClientContext, IN PETHREAD ServerThread OPTIONAL)
NTKERNELAPI NTSTATUS	SeImpersonateClientEx (IN PSECURITY_CLIENT_CONTEXT ClientContext, IN PETHREAD ServerThread OPTIONAL)
NTKERNELAPI NTSTATUS	SeCreateClientSecurityFromSubjectContext (IN PSECURITY_SUBJECT_CONTEXT SubjectContext, IN PSECURITY_QUALITY_OF_SERVICE ClientSecurityQos, IN BOOLEAN ServerIsRemote, OUT PSECURITY_CLIENT_CONTEXT ClientContext)
NTKERNELAPI NTSTATUS	SeCreateAccessState (IN PACCESS_STATE AccessState, IN PAUX_ACCESS_DATA AuxData, IN ACCESS_MASK DesiredAccess, IN PGENERIC_MAPPING GenericMapping)
NTKERNELAPI VOID	SeDeleteAccessState (IN PACCESS_STATE AccessState)
NTSTATUS	SeUpdateClientSecurity (IN PETHREAD ClientThread, IN OUT PSECURITY_CLIENT_CONTEXT ClientContext, OUT PBOOLEAN ChangesMade, OUT PBOOLEAN NewToken)
BOOLEAN	SeRmInitPhase1 ()
NTKERNELAPI NTSTATUS	SeQuerySecurityDescriptorInfo (IN PSECURITY_INFORMATION SecurityInformation, OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PULONG Length, IN PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor)
NTKERNELAPI NTSTATUS	SeSetSecurityDescriptorInfo (IN PVOID Object OPTIONAL, IN PSECURITY_INFORMATION SecurityInformation, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, IN POOL_TYPE PoolType, IN PGENERIC_MAPPING GenericMapping)
NTKERNELAPI NTSTATUS	SeSetSecurityDescriptorInfoEx (IN PVOID Object OPTIONAL, IN PSECURITY_INFORMATION SecurityInformation, IN PSECURITY_DESCRIPTOR ModificationDescriptor, IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, IN ULONG AutoInheritFlags, IN POOL_TYPE PoolType, IN PGENERIC_MAPPING GenericMapping)
NTKERNELAPI NTSTATUS	SeAppendPrivileges (PACCESS_STATE AccessState, PPRIVILEGE_SET Privileges)
NTSTATUS	SeComputeQuotaInformationSize (IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PULONG Size)
VOID	SePrivilegedServiceAuditAlarm (IN PUNICODE_STRING ServiceName, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN PPRIVILEGE_SET Privileges, IN BOOLEAN AccessGranted)
NTKERNELAPI BOOLEAN	SeSinglePrivilegeCheck (LUID PrivilegeValue, KPROCESSOR_MODE PreviousMode)
BOOLEAN	SeCheckAuditPrivilege (IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN KPROCESSOR_MODE PreviousMode)
NTSTATUS	SeAssignWorldSecurityDescriptor (IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PULONG Length, IN PSECURITY_INFORMATION SecurityInformation)
BOOLEAN	SeFastTraverseCheck (PSECURITY_DESCRIPTOR SecurityDescriptor, ACCESS_MASK TraverseAccess, KPROCESSOR_MODE AccessMode)
NTKERNELAPI BOOLEAN	SeAuditingFileEvents (IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor)
NTKERNELAPI BOOLEAN	SeAuditingFileOrGlobalEvents (IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext)
VOID	SeAuditProcessCreation (PEPROCESS Process, PEPROCESS Parent, PUNICODE_STRING ImageFileName)
VOID	SeAuditProcessExit (PEPROCESS Process)
VOID	SeAuditHandleDuplication (PVOID SourceHandle, PVOID NewHandle, PEPROCESS SourceProcess, PEPROCESS TargetProcess)
VOID	SeSetAccessStateGenericMapping (PACCESS_STATE AccessState, PGENERIC_MAPPING GenericMapping)
NTKERNELAPI NTSTATUS	SeRegisterLogonSessionTerminatedRoutine (IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine)
NTKERNELAPI NTSTATUS	SeUnregisterLogonSessionTerminatedRoutine (IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine)
NTKERNELAPI NTSTATUS	SeMarkLogonSessionForTerminationNotification (IN PLUID LogonId)
NTKERNELAPI NTSTATUS	SeQueryInformationToken (IN PACCESS_TOKEN Token, IN TOKEN_INFORMATION_CLASS TokenInformationClass, OUT PVOID *TokenInformation)
NTSTATUS	SeIsChildToken (IN HANDLE Token, OUT PBOOLEAN IsChild)
NTSTATUS	SeIsChildTokenByPointer (IN PACCESS_TOKEN Token, OUT PBOOLEAN IsChild)
NTSTATUS	SeFastFilterToken (IN PACCESS_TOKEN ExistingToken, IN KPROCESSOR_MODE RequestorMode, IN ULONG Flags, IN ULONG GroupCount, IN PSID_AND_ATTRIBUTES GroupsToDisable OPTIONAL, IN ULONG PrivilegeCount, IN PLUID_AND_ATTRIBUTES PrivilegesToDelete OPTIONAL, IN ULONG SidCount, IN PSID_AND_ATTRIBUTES RestrictedSids OPTIONAL, IN ULONG SidLength, OUT PACCESS_TOKEN *FilteredToken)
Variables
_OBJECT_TYPE *	SepTokenObjectType
NTKERNELAPI PSE_EXPORTS	SeExports
LUID	SeSystemAuthenticationId
LUID	SeAnonymousAuthenticationId
TOKEN_SOURCE	SeSystemTokenSource
PSID	SeNullSid
PSID	SeWorldSid
PSID	SeLocalSid
PSID	SeCreatorOwnerSid
PSID	SeCreatorGroupSid
PSID	SeCreatorOwnerServerSid
PSID	SeCreatorGroupServerSid
PSID	SePrincipalSelfSid
PSID	SeNtAuthoritySid
PSID	SeDialupSid
PSID	SeNetworkSid
PSID	SeBatchSid
PSID	SeInteractiveSid
PSID	SeLocalSystemSid
PSID	SeAuthenticatedUsersSid
PSID	SeAliasAdminsSid
PSID	SeRestrictedSid
PSID	SeAnonymousLogonSid
PSID	SeAliasUsersSid
PSID	SeAliasGuestsSid
PSID	SeAliasPowerUsersSid
PSID	SeAliasAccountOpsSid
PSID	SeAliasSystemOpsSid
PSID	SeAliasPrintOpsSid
PSID	SeAliasBackupOpsSid
PACCESS_TOKEN	SeAnonymousLogonToken
PSECURITY_DESCRIPTOR	SePublicDefaultSd
PSECURITY_DESCRIPTOR	SePublicDefaultUnrestrictedSd
PSECURITY_DESCRIPTOR	SePublicOpenSd
PSECURITY_DESCRIPTOR	SePublicOpenUnrestrictedSd
PSECURITY_DESCRIPTOR	SeSystemDefaultSd
PSECURITY_DESCRIPTOR	SeUnrestrictedSd
PACL	SePublicDefaultDacl
PACL	SePublicDefaultUnrestrictedDacl
PACL	SePublicOpenDacl
PACL	SePublicOpenUnrestrictedDacl
PACL	SeSystemDefaultDacl
PACL	SeUnrestrictedDacl
LUID	SeCreateTokenPrivilege
LUID	SeAssignPrimaryTokenPrivilege
LUID	SeLockMemoryPrivilege
LUID	SeIncreaseQuotaPrivilege
LUID	SeUnsolicitedInputPrivilege
LUID	SeTcbPrivilege
LUID	SeSecurityPrivilege
LUID	SeTakeOwnershipPrivilege
LUID	SeLoadDriverPrivilege
LUID	SeCreatePagefilePrivilege
LUID	SeIncreaseBasePriorityPrivilege
LUID	SeSystemProfilePrivilege
LUID	SeSystemtimePrivilege
LUID	SeProfileSingleProcessPrivilege
LUID	SeCreatePermanentPrivilege
LUID	SeBackupPrivilege
LUID	SeRestorePrivilege
LUID	SeShutdownPrivilege
LUID	SeDebugPrivilege
LUID	SeAuditPrivilege
LUID	SeSystemEnvironmentPrivilege
LUID	SeChangeNotifyPrivilege
LUID	SeRemoteShutdownPrivilege
LUID	SeUndockPrivilege
LUID	SeSyncAgentPrivilege
LUID	SeEnableDelegationPrivilege
SE_AUDITING_STATE	SeAuditingState []
BOOLEAN	SeDetailedAuditing
UNICODE_STRING	SeSubsystemName

---

Define Documentation

#define INITIAL_PRIVILEGE_COUNT   3

Definition at line 147 of file se.h. Referenced by SeAppendPrivileges().

#define SE_BACKUP_PRIVILEGES_CHECKED   0x00000010

Definition at line 85 of file se.h. Referenced by IopCheckBackupRestorePrivilege(), and IopParseDevice().

#define SE_DEFAULT_SECURITY_QUOTA   2048

Definition at line 62 of file se.h. Referenced by ObpAllocateObject(), ObpChargeQuotaForObject(), ObpFreeObject(), and ObValidateSecurityQuota().

#define SeAssertMappedCanonicalAccess (  AccessMask   )

Value: ASSERT(!( ( AccessMask ) & \ ( GENERIC_READ | \ GENERIC_WRITE | \ GENERIC_EXECUTE | \ GENERIC_ALL )) \ ) Definition at line 650 of file se.h. Referenced by SeAccessCheck(), and SepAccessCheck().

#define SeComputeDeniedAccesses (  GrantedAccess, DesiredAccess   )     ((~(GrantedAccess)) & (DesiredAccess) )

Definition at line 480 of file se.h. Referenced by IoCheckDesiredAccess(), IoCheckFunctionAccess(), NtSignalAndWaitForSingleObject(), NtWaitForMultipleObjects(), and ObReferenceObjectByHandle().

#define SeComputeGrantedAccesses (  GrantedAccess, DesiredAccess   )     ((GrantedAccess) & (DesiredAccess) )

Definition at line 515 of file se.h. Referenced by IoCheckFunctionAccess(), IopXxxControlFile(), NtFlushBuffersFile(), NtLockFile(), NtUnlockFile(), NtWriteFile(), and NtWriteFileGather().

#define SeComputeSecurityQuota (  Size   )

Value: ( \ ((( Size ) * 2 ) > SE_DEFAULT_SECURITY_QUOTA) ? \ (( Size ) * 2 ) : SE_DEFAULT_SECURITY_QUOTA \ ) Definition at line 676 of file se.h. Referenced by ObpCaptureObjectCreateInformation().

#define SeDeleteClientSecurity (  C   )

Value: { \ if (SeTokenType((C)->ClientToken) == TokenPrimary) { \ PsDereferencePrimaryToken( (C)->ClientToken ); \ } else { \ PsDereferenceImpersonationToken( (C)->ClientToken ); \ } \ } *++ Definition at line 612 of file se.h. Referenced by CmLoadKey(), FreeDdeConv(), LpcpFreePortClientSecurity(), MESSAGECALL(), and NtImpersonateThread().

#define SeEnableAccessToExports (   )

Definition at line 1589 of file se.h. Referenced by InitSecurity().

#define SeLengthSid (  Sid   )     (8 + (4 * ((SID *)Sid)->SubAuthorityCount))

Definition at line 540 of file se.h. Referenced by CmpHiveRootSecurityDescriptor(), CreateDAclToken(), GenerateDescriptor(), IopApplySystemPartitionProt(), NtCloseObjectAuditAlarm(), NtDeleteObjectAuditAlarm(), NtQueryInformationToken(), NtSetInformationToken(), ObInitSystem(), RtlAddCompoundAce(), RtlCopySid(), RtlCopySidAndAttributesArray(), RtlEqualSid(), RtlLengthSecurityDescriptor(), RtlLengthSid(), RtlLengthUsedSecurityDescriptor(), RtlpAddKnownAce(), RtlpAddKnownObjectAce(), RtlpConvertToAutoInheritSecurityObject(), RtlpCopyEffectiveAce(), RtlpCreateServerAcl(), RtlpNewSecurityObject(), RtlpQuerySecurityDescriptor(), RtlpSetSecurityObject(), RtlQuerySecurityObject(), RtlSelfRelativeToAbsoluteSD(), RtlValidAcl(), RtlValidRelativeSecurityDescriptor(), SeAssignWorldSecurityDescriptor(), SeComputeQuotaInformationSize(), SeMakeAnonymousLogonToken(), SeMakeSystemToken(), SepAdjustGroups(), SepAppendDefaultDacl(), SepAppendPrimaryGroup(), SepCreateImpersonationTokenDacl(), SepFreeDefaultDacl(), SepFreePrimaryGroup(), SepInitSystemDacls(), SeQueryInformationToken(), SeQuerySecurityDescriptorInfo(), SeRmInitPhase1(), SeValidSecurityDescriptor(), TestSeSid(), and TestTokenSet().

#define SeQuerySubjectContextToken (  SubjectContext   )

Value: ( ARGUMENT_PRESENT( ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken) ? \ ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \ ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken ) Definition at line 732 of file se.h. Referenced by NtSetUuidSeed(), and SeCreateClientSecurityFromSubjectContext().

#define SeSameToken (  TC1, TC2   )

Value: ( \ ((TC1)->TokenId.HighPart == (TC2)->TokenId.HighPart) && \ ((TC1)->TokenId.LowPart == (TC2)->TokenId.LowPart) && \ (RtlEqualLuid(&(TC1)->AuthenticationId,&(TC2)->AuthenticationId)) \ ) Definition at line 577 of file se.h.

#define SeStopImpersonatingClient (   )     PsRevertToSelf()

*++ Definition at line 647 of file se.h.

#define SeTokenObjectType (   )     (PVOID)SepTokenObjectType

Definition at line 1213 of file se.h. Referenced by NtSetInformationJobObject(), PsAssignImpersonationToken(), PspAssignPrimaryToken(), and PspSetPrimaryToken().

#define TOKEN_HAS_ADMIN_GROUP   0x08

Definition at line 75 of file se.h. Referenced by SepCreateToken(), SepMakeTokenEffectiveOnly(), SepRemoveDisabledGroupsAndPrivileges(), and SeTokenIsAdmin().

#define TOKEN_HAS_BACKUP_PRIVILEGE   0x02

Definition at line 73 of file se.h. Referenced by IopCheckBackupRestorePrivilege().

#define TOKEN_HAS_RESTORE_PRIVILEGE   0x04

Definition at line 74 of file se.h. Referenced by IopCheckBackupRestorePrivilege().

#define TOKEN_HAS_TRAVERSE_PRIVILEGE   0x01

Definition at line 72 of file se.h. Referenced by IopParseDevice(), ObpLookupObjectName(), SeCreateAccessState(), SepAdjustPrivileges(), SepCreateToken(), and SepRemoveDisabledGroupsAndPrivileges().

#define TOKEN_IS_RESTRICTED   0x10

Definition at line 76 of file se.h. Referenced by IopParseDevice(), ObpCheckTraverseAccess(), SepFilterToken(), SepTokenIsOwner(), and SeTokenIsRestricted().

---

Typedef Documentation

typedef struct _ACCESS_STATE ACCESS_STATE

Referenced by SeCreateAccessState().

typedef struct _AUX_ACCESS_DATA AUX_ACCESS_DATA

Referenced by NtDuplicateObject().

typedef struct _INITIAL_PRIVILEGE_SET INITIAL_PRIVILEGE_SET

typedef struct _ACCESS_STATE * PACCESS_STATE

typedef struct _AUX_ACCESS_DATA * PAUX_ACCESS_DATA

Referenced by ObpCreateHandle().

typedef struct _INITIAL_PRIVILEGE_SET * PINITIAL_PRIVILEGE_SET

typedef struct _SE_AUDITING_STATE * PSE_AUDITING_STATE

typedef struct _SE_EXPORTS * PSE_EXPORTS

typedef NTSTATUS(* PSE_LOGON_SESSION_TERMINATED_ROUTINE)(IN PLUID LogonId)

Definition at line 434 of file se.h. Referenced by SeRegisterLogonSessionTerminatedRoutine().

typedef struct _SE_PROCESS_AUDIT_INFO * PSE_PROCESS_AUDIT_INFO

Referenced by ObAuditInheritedHandleProcedure().

typedef enum _SECURITY_OPERATION_CODE * PSECURITY_OPERATION_CODE

typedef struct _SECURITY_SUBJECT_CONTEXT * PSECURITY_SUBJECT_CONTEXT

Referenced by SeAccessCheck().

typedef struct _SE_AUDITING_STATE SE_AUDITING_STATE

typedef struct _SE_EXPORTS SE_EXPORTS

typedef struct _SE_PROCESS_AUDIT_INFO SE_PROCESS_AUDIT_INFO

Referenced by ObInitProcess().

typedef enum _SECURITY_OPERATION_CODE SECURITY_OPERATION_CODE

typedef struct _SECURITY_SUBJECT_CONTEXT SECURITY_SUBJECT_CONTEXT

Referenced by SeAccessCheckByType(), and SeSinglePrivilegeCheck().

---

Enumeration Type Documentation

enum _SECURITY_OPERATION_CODE

Enumeration values: SetSecurityDescriptor  QuerySecurityDescriptor  DeleteSecurityDescriptor  AssignSecurityDescriptor  Definition at line 43 of file se.h. { SetSecurityDescriptor, QuerySecurityDescriptor, DeleteSecurityDescriptor, AssignSecurityDescriptor } SECURITY_OPERATION_CODE, *PSECURITY_OPERATION_CODE;

---

Function Documentation

NTKERNELAPI BOOLEAN SeAccessCheck (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext, IN BOOLEAN  SubjectContextLocked, IN ACCESS_MASK  DesiredAccess, IN ACCESS_MASK  PreviouslyGrantedAccess, OUT PPRIVILEGE_SET *Privileges  OPTIONAL, IN PGENERIC_MAPPING  GenericMapping, IN KPROCESSOR_MODE  AccessMode, OUT PACCESS_MASK  GrantedAccess, OUT PNTSTATUS  AccessStatus )

Definition at line 3323 of file accessck.c. References DbgPrint, EffectiveToken, FALSE, KernelMode, NULL, PAGED_CODE, PSECURITY_SUBJECT_CONTEXT, SeAssertMappedCanonicalAccess, SeLockSubjectContext(), SepAccessCheck(), SepDumpSecurityDescriptor(), SepDumpTokenInfo(), SepTokenIsOwner(), SeUnlockSubjectContext(), and TRUE. Referenced by CmpCheckCreateAccess(), CmpCheckNotifyAccess(), IopParseDevice(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), PspCreateProcess(), PspCreateThread(), PspSetPrimaryToken(), SeProxyAccessCheck(), and TestAccessCheck(). : See module abstract This routine MAY perform tests for the following privileges: SeTakeOwnershipPrivilege SeSecurityPrivilege depending upon the accesses being requested. This routine may also check to see if the subject is the owner of the object (to grant WRITE_DAC access). Arguments: SecurityDescriptor - Supplies the security descriptor protecting the object being accessed SubjectSecurityContext - A pointer to the subject's captured security context SubjectContextLocked - Supplies a flag indiciating whether or not the user's subject context is locked, so that it does not have to be locked again. DesiredAccess - Supplies the access mask that the user is attempting to acquire PreviouslyGrantedAccess - Supplies any accesses that the user has already been granted, for example, as a result of holding a privilege. Privileges - Supplies a pointer in which will be returned a privilege set indicating any privileges that were used as part of the access validation. GenericMapping - Supplies the generic mapping associated with this object type. AccessMode - Supplies the access mode to be used in the check GrantedAccess - Pointer to a returned access mask indicatating the granted access AccessStatus - Status value that may be returned indicating the reason why access was denied. Routines should avoid hardcoding a return value of STATUS_ACCESS_DENIED so that a different value can be returned when mandatory access control is implemented. Return Value: BOOLEAN - TRUE if access is allowed and FALSE otherwise --*/ { BOOLEAN Success; PAGED_CODE(); if (AccessMode == KernelMode) { if (DesiredAccess & MAXIMUM_ALLOWED) { // // Give him: // GenericAll // Anything else he asked for // *GrantedAccess = GenericMapping->GenericAll; *GrantedAccess |= (DesiredAccess & ~MAXIMUM_ALLOWED); *GrantedAccess |= PreviouslyGrantedAccess; } else { *GrantedAccess = DesiredAccess | PreviouslyGrantedAccess; } *AccessStatus = STATUS_SUCCESS; return(TRUE); } // // If the object doesn't have a security descriptor (and it's supposed // to), return access denied. // if ( SecurityDescriptor == NULL) { *AccessStatus = STATUS_ACCESS_DENIED; return( FALSE ); } // // If we're impersonating a client, we have to be at impersonation level // of SecurityImpersonation or above. // if ( (SubjectSecurityContext->ClientToken != NULL) && (SubjectSecurityContext->ImpersonationLevel < SecurityImpersonation) ) { *AccessStatus = STATUS_BAD_IMPERSONATION_LEVEL; return( FALSE ); } if ( DesiredAccess == 0 ) { if ( PreviouslyGrantedAccess == 0 ) { *AccessStatus = STATUS_ACCESS_DENIED; return( FALSE ); } *GrantedAccess = PreviouslyGrantedAccess; *AccessStatus = STATUS_SUCCESS; *Privileges = NULL; return( TRUE ); } SeAssertMappedCanonicalAccess( DesiredAccess ); // // If the caller did not lock the subject context for us, // lock it here to keep lower level routines from having // to lock it. // if ( !SubjectContextLocked ) { SeLockSubjectContext( SubjectSecurityContext ); } // // If the user in the token is the owner of the object, we // must automatically grant ReadControl and WriteDac access // if desired. If the DesiredAccess mask is empty after // these bits are turned off, we don't have to do any more // access checking (ref section 4, DSA ACL Arch) // if ( DesiredAccess & (WRITE_DAC | READ_CONTROL | MAXIMUM_ALLOWED) ) { if ( SepTokenIsOwner( EffectiveToken( SubjectSecurityContext ), SecurityDescriptor, TRUE ) ) { if ( DesiredAccess & MAXIMUM_ALLOWED ) { PreviouslyGrantedAccess |= (WRITE_DAC | READ_CONTROL); } else { PreviouslyGrantedAccess |= (DesiredAccess & (WRITE_DAC | READ_CONTROL)); } DesiredAccess &= ~(WRITE_DAC | READ_CONTROL); } } if (DesiredAccess == 0) { if ( !SubjectContextLocked ) { SeUnlockSubjectContext( SubjectSecurityContext ); } *GrantedAccess = PreviouslyGrantedAccess; *AccessStatus = STATUS_SUCCESS; return( TRUE ); } else { SepAccessCheck( SecurityDescriptor, NULL, // No PrincipalSelfSid SubjectSecurityContext->PrimaryToken, SubjectSecurityContext->ClientToken, DesiredAccess, NULL, // No object type list 0, // No object type list GenericMapping, PreviouslyGrantedAccess, AccessMode, GrantedAccess, Privileges, AccessStatus, FALSE, // Don't return a list &Success, NULL ); #if DBG if (!Success && SepShowAccessFail) { DbgPrint("SE: Access check failed, DesiredAccess = 0x%x\n", DesiredAccess); SepDumpSD = TRUE; SepDumpSecurityDescriptor( SecurityDescriptor, "Input to SeAccessCheck\n" ); SepDumpSD = FALSE; SepDumpToken = TRUE; SepDumpTokenInfo( EffectiveToken( SubjectSecurityContext ) ); SepDumpToken = FALSE; } #endif // // If we locked it in this routine, unlock it before we // leave. // if ( !SubjectContextLocked ) { SeUnlockSubjectContext( SubjectSecurityContext ); } return( Success ); } }

NTKERNELAPI NTSTATUS SeAppendPrivileges (  PACCESS_STATE  AccessState, PPRIVILEGE_SET  Privileges )

Definition at line 434 of file seastate.c. References _ACCESS_STATE::AuxData, ExAllocatePoolWithTag, ExFreePool(), INITIAL_PRIVILEGE_COUNT, NULL, PAGED_CODE, PagedPool, _ACCESS_STATE::PrivilegesAllocated, _AUX_ACCESS_DATA::PrivilegesUsed, SepConcatenatePrivileges(), SepPrivilegeSetSize, and TRUE. Referenced by IopCheckBackupRestorePrivilege(), IopParseDevice(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObpCheckTraverseAccess(), and ObpIncrementHandleCount(). : This routine takes a privilege set and adds it to the privilege set imbedded in an ACCESS_STATE structure. An AccessState may contain up to three imbedded privileges. To add more, this routine will allocate a block of memory, copy the current privileges into it, and append the new privilege to that block. A bit is set in the AccessState indicating that the pointer to the privilge set in the structure points to pool memory and must be deallocated. Arguments: AccessState - The AccessState structure representing the current access attempt. Privileges - A pointer to a privilege set to be added. Return Value: STATUS_INSUFFICIENT_RESOURCES - an attempt to allocate pool memory failed. --*/ { ULONG NewPrivilegeSetSize; PPRIVILEGE_SET NewPrivilegeSet; PAUX_ACCESS_DATA AuxData; PAGED_CODE(); AuxData = (PAUX_ACCESS_DATA)AccessState->AuxData; if (Privileges->PrivilegeCount + AuxData->PrivilegesUsed->PrivilegeCount > INITIAL_PRIVILEGE_COUNT) { // // Compute the total size of the two privilege sets // NewPrivilegeSetSize = SepPrivilegeSetSize( Privileges ) + SepPrivilegeSetSize( AuxData->PrivilegesUsed ); NewPrivilegeSet = ExAllocatePoolWithTag( PagedPool, NewPrivilegeSetSize, 'rPeS' ); if (NewPrivilegeSet == NULL) { return( STATUS_INSUFFICIENT_RESOURCES ); } RtlCopyMemory( NewPrivilegeSet, AuxData->PrivilegesUsed, SepPrivilegeSetSize( AuxData->PrivilegesUsed ) ); // // Note that this will adjust the privilege count in the // structure for us. // SepConcatenatePrivileges( NewPrivilegeSet, NewPrivilegeSetSize, Privileges ); if (AccessState->PrivilegesAllocated) { ExFreePool( AuxData->PrivilegesUsed ); } AuxData->PrivilegesUsed = NewPrivilegeSet; // // Mark that we've allocated memory for the privilege set, // so we know to free it when we're cleaning up. // AccessState->PrivilegesAllocated = TRUE; } else { // // Note that this will adjust the privilege count in the // structure for us. // SepConcatenatePrivileges( AuxData->PrivilegesUsed, sizeof(INITIAL_PRIVILEGE_SET), Privileges ); } return( STATUS_SUCCESS ); }

VOID SeAssignPrimaryToken (  IN PEPROCESS  Process, IN PACCESS_TOKEN  Token )

Definition at line 241 of file token.c. References ASSERT, NTSTATUS(), NULL, ObReferenceObject, PAGED_CODE, PTOKEN, SeDeassignPrimaryToken(), Status, Token, and TRUE. Referenced by PspInitializeProcessSecurity(). : This function establishes a primary token for a process. Arguments: Token - Points to the new primary token. Return Value: None. --*/ { NTSTATUS Status; PTOKEN NewToken = (PTOKEN)Token; PAGED_CODE(); ASSERT(NewToken->TokenType == TokenPrimary); ASSERT( !NewToken->TokenInUse ); // // Dereference the old token if there is one. // // Processes typically already have a token that must be // dereferenced. There are two cases where this may not // be the situation. First, during phase 0 system initialization, // the initial system process starts out without a token. Second, // if an error occurs during process creation, we may be cleaning // up a process that hasn't yet had a primary token assigned. // if (Process->Token != NULL) { SeDeassignPrimaryToken( Process ); } Process->Token=Token; NewToken->TokenInUse = TRUE; ObReferenceObject(NewToken); return; }

NTKERNELAPI NTSTATUS SeAssignSecurity (  IN PSECURITY_DESCRIPTOR ParentDescriptor  OPTIONAL, IN PSECURITY_DESCRIPTOR  ExplicitDescriptor, OUT PSECURITY_DESCRIPTOR *  NewDescriptor, IN BOOLEAN  IsDirectoryObject, IN PSECURITY_SUBJECT_CONTEXT  SubjectContext, IN PGENERIC_MAPPING  GenericMapping, IN POOL_TYPE  PoolType )

Definition at line 89 of file seassign.c. References NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, PagedPool, RtlpNewSecurityObject(), SepDumpSecurityDescriptor(), and Status. Referenced by CmpDoCreateChild(), ObAssignSecurity(), TestAssignSecurity(), and xxxCreateWindowStation(). : This routine assumes privilege checking HAS NOT yet been performed and so will be performed by this routine. This procedure is used to build a security descriptor for a new object given the security descriptor of its parent directory and any originally requested security for the object. The final security descriptor returned to the caller may contain a mix of information, some explicitly provided other from the new object's parent. See RtlpNewSecurityObject for a descriptor of how the NewDescriptor is built. Arguments: ParentDescriptor - Optionally supplies the security descriptor of the parent directory under which this new object is being created. ExplicitDescriptor - Supplies the address of a pointer to the security descriptor as specified by the user that is to be applied to the new object. NewDescriptor - Returns the actual security descriptor for the new object that has been modified according to above rules. IsDirectoryObject - Specifies if the new object is itself a directory object. A value of TRUE indicates the object is a container of other objects. SubjectContext - Supplies the security context of the subject creating the object. This is used to retrieve default security information for the new object, such as default owner, primary group, and discretionary access control. GenericMapping - Supplies a pointer to an array of access mask values denoting the mapping between each generic right to non-generic rights. PoolType - Specifies the pool type to use to when allocating a new security descriptor. Return Value: STATUS_SUCCESS - indicates the operation was successful. STATUS_INVALID_OWNER - The owner SID provided as the owner of the target security descriptor is not one the caller is authorized to assign as the owner of an object. STATUS_PRIVILEGE_NOT_HELD - The caller does not have the privilege necessary to explicitly assign the specified system ACL. SeSecurityPrivilege privilege is needed to explicitly assign system ACLs to objects. --*/ { NTSTATUS Status; ULONG AutoInherit = 0; PAGED_CODE(); #if DBG if ( ARGUMENT_PRESENT( ExplicitDescriptor) ) { SepDumpSecurityDescriptor( ExplicitDescriptor, "\nSeAssignSecurity: Input security descriptor = \n" ); } if (ARGUMENT_PRESENT( ParentDescriptor )) { SepDumpSecurityDescriptor( ParentDescriptor, "\nSeAssignSecurity: Parent security descriptor = \n" ); } #endif // DBG // // If the Parent SD was created via AutoInheritance, // and this object is being created with no explicit descriptor, // then we can safely create this object as AutoInherit. // if ( ParentDescriptor != NULL ) { if ( (ExplicitDescriptor == NULL || (((PISECURITY_DESCRIPTOR)ExplicitDescriptor)->Control & SE_DACL_PRESENT) == 0 ) && (((PISECURITY_DESCRIPTOR)ParentDescriptor)->Control & SE_DACL_AUTO_INHERITED) != 0 ) { AutoInherit |= SEF_DACL_AUTO_INHERIT; } if ( (ExplicitDescriptor == NULL || (((PISECURITY_DESCRIPTOR)ExplicitDescriptor)->Control & SE_SACL_PRESENT) == 0 ) && (((PISECURITY_DESCRIPTOR)ParentDescriptor)->Control & SE_SACL_AUTO_INHERITED) != 0 ) { AutoInherit |= SEF_SACL_AUTO_INHERIT; } } Status = RtlpNewSecurityObject ( ParentDescriptor OPTIONAL, ExplicitDescriptor OPTIONAL, NewDescriptor, NULL, // No object type IsDirectoryObject, AutoInherit, (HANDLE) SubjectContext, GenericMapping ); #if DBG if ( NT_SUCCESS(Status)) { SepDumpSecurityDescriptor( *NewDescriptor, "SeAssignSecurity: Final security descriptor = \n" ); } #endif return Status; // RtlpNewSecurityObject always uses PagedPool. UNREFERENCED_PARAMETER( PagedPool ); }

NTKERNELAPI NTSTATUS SeAssignSecurityEx (  IN PSECURITY_DESCRIPTOR ParentDescriptor  OPTIONAL, IN PSECURITY_DESCRIPTOR ExplicitDescriptor  OPTIONAL, OUT PSECURITY_DESCRIPTOR *  NewDescriptor, IN GUID *ObjectType  OPTIONAL, IN BOOLEAN  IsDirectoryObject, IN ULONG  AutoInheritFlags, IN PSECURITY_SUBJECT_CONTEXT  SubjectContext, IN PGENERIC_MAPPING  GenericMapping, IN POOL_TYPE  PoolType )

Definition at line 228 of file seassign.c. References NT_SUCCESS, NTSTATUS(), PAGED_CODE, PagedPool, RtlpNewSecurityObject(), SepDumpSecurityDescriptor(), and Status. : This routine assumes privilege checking HAS NOT yet been performed and so will be performed by this routine. This procedure is used to build a security descriptor for a new object given the security descriptor of its parent directory and any originally requested security for the object. The final security descriptor returned to the caller may contain a mix of information, some explicitly provided other from the new object's parent. See RtlpNewSecurityObject for a descriptor of how the NewDescriptor is built. Arguments: ParentDescriptor - Optionally supplies the security descriptor of the parent directory under which this new object is being created. ExplicitDescriptor - Supplies the address of a pointer to the security descriptor as specified by the user that is to be applied to the new object. NewDescriptor - Returns the actual security descriptor for the new object that has been modified according to above rules. ObjectType - GUID of the object type being created. If the object being created has no GUID associated with it, then this argument is specified as NULL. IsDirectoryObject - Specifies if the new object is itself a directory object. A value of TRUE indicates the object is a container of other objects. AutoInheritFlags - Controls automatic inheritance of ACES from the Parent Descriptor. Valid values are a bits mask of the logical OR of one or more of the following bits: SEF_DACL_AUTO_INHERIT - If set, inherit ACEs from the DACL ParentDescriptor are inherited to NewDescriptor in addition to any explicit ACEs specified by the CreatorDescriptor. SEF_SACL_AUTO_INHERIT - If set, inherit ACEs from the SACL ParentDescriptor are inherited to NewDescriptor in addition to any explicit ACEs specified by the CreatorDescriptor. SEF_DEFAULT_DESCRIPTOR_FOR_OBJECT - If set, the CreatorDescriptor is the default descriptor for ObjectType. As such, the CreatorDescriptor will be ignored if any ObjectType specific ACEs are inherited from the parent. If no such ACEs are inherited, the CreatorDescriptor is handled as though this flag were not specified. SEF_AVOID_PRIVILEGE_CHECK - If set, no privilege checking is done by this routine. This flag is useful while implementing automatic inheritance to avoid checking privileges on each child updated. SubjectContext - Supplies the security context of the subject creating the object. This is used to retrieve default security information for the new object, such as default owner, primary group, and discretionary access control. GenericMapping - Supplies a pointer to an array of access mask values denoting the mapping between each generic right to non-generic rights. PoolType - Specifies the pool type to use to when allocating a new security descriptor. Return Value: STATUS_SUCCESS - indicates the operation was successful. STATUS_INVALID_OWNER - The owner SID provided as the owner of the target security descriptor is not one the caller is authorized to assign as the owner of an object. STATUS_PRIVILEGE_NOT_HELD - The caller does not have the privilege necessary to explicitly assign the specified system ACL. SeSecurityPrivilege privilege is needed to explicitly assign system ACLs to objects. --*/ { NTSTATUS Status; PAGED_CODE(); #if DBG if ( ARGUMENT_PRESENT( ExplicitDescriptor) ) { SepDumpSecurityDescriptor( ExplicitDescriptor, "\nSeAssignSecurityEx: Input security descriptor = \n" ); } if (ARGUMENT_PRESENT( ParentDescriptor )) { SepDumpSecurityDescriptor( ParentDescriptor, "\nSeAssignSecurityEx: Parent security descriptor = \n" ); } #endif // DBG Status = RtlpNewSecurityObject ( ParentDescriptor OPTIONAL, ExplicitDescriptor OPTIONAL, NewDescriptor, ObjectType, IsDirectoryObject, AutoInheritFlags, (HANDLE) SubjectContext, GenericMapping ); #if DBG if ( NT_SUCCESS(Status)) { SepDumpSecurityDescriptor( *NewDescriptor, "SeAssignSecurityEx: Final security descriptor = \n" ); } #endif return Status; // RtlpNewSecurityObject always uses PagedPool. UNREFERENCED_PARAMETER( PagedPool ); }

NTSTATUS SeAssignWorldSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN OUT PULONG  Length, IN PSECURITY_INFORMATION  SecurityInformation )

Definition at line 529 of file seassign.c. References NT_SUCCESS, NTSTATUS(), PAGED_CODE, RtlCreateSecurityDescriptorRelative(), SeLengthSid, SeWorldSid, and Status. Referenced by IopGetSetSecurityObject(). : This routine is called by the I/O system to properly initialize a security descriptor for a FAT file. It will take a pointer to a buffer containing an emptry security descriptor, and create in the buffer a self-relative security descriptor with Owner = WorldSid, Group = WorldSid. Thus, a FAT file is accessable to all. Arguments: SecurityDescriptor - Supplies a pointer to a buffer in which will be created a self-relative security descriptor as described above. Length - The length in bytes of the buffer. If the length is too small, it will contain the minimum size required upon exit. Return Value: STATUS_BUFFER_TOO_SMALL - The buffer was not big enough to contain the requested information. --*/ { PCHAR Field; PCHAR Base; ULONG WorldSidLength; PISECURITY_DESCRIPTOR_RELATIVE ISecurityDescriptor; ULONG MinSize; NTSTATUS Status; PAGED_CODE(); if ( !ARGUMENT_PRESENT( SecurityInformation )) { return( STATUS_ACCESS_DENIED ); } WorldSidLength = SeLengthSid( SeWorldSid ); MinSize = sizeof( SECURITY_DESCRIPTOR_RELATIVE ) + 2 * WorldSidLength; if ( *Length < MinSize ) { *Length = MinSize; return( STATUS_BUFFER_TOO_SMALL ); } *Length = MinSize; ISecurityDescriptor = (SECURITY_DESCRIPTOR_RELATIVE *)SecurityDescriptor; Status = RtlCreateSecurityDescriptorRelative( ISecurityDescriptor, SECURITY_DESCRIPTOR_REVISION ); if (!NT_SUCCESS( Status )) { return( Status ); } Base = (PCHAR)(ISecurityDescriptor); Field = Base + sizeof(SECURITY_DESCRIPTOR_RELATIVE); if ( *SecurityInformation & OWNER_SECURITY_INFORMATION ) { RtlCopyMemory( Field, SeWorldSid, WorldSidLength ); ISecurityDescriptor->Owner = RtlPointerToOffset(Base,Field); Field += WorldSidLength; } if ( *SecurityInformation & GROUP_SECURITY_INFORMATION ) { RtlCopyMemory( Field, SeWorldSid, WorldSidLength ); ISecurityDescriptor->Group = RtlPointerToOffset(Base,Field); } if ( *SecurityInformation & DACL_SECURITY_INFORMATION ) { RtlpSetControlBits( ISecurityDescriptor, SE_DACL_PRESENT ); } if ( *SecurityInformation & SACL_SECURITY_INFORMATION ) { RtlpSetControlBits( ISecurityDescriptor, SE_SACL_PRESENT ); } RtlpSetControlBits( ISecurityDescriptor, SE_SELF_RELATIVE ); return( STATUS_SUCCESS ); }

VOID SeAuditHandleCreation (  IN PACCESS_STATE  AccessState, IN HANDLE  Handle )

Definition at line 3736 of file seaudit.c. References FALSE, Handle, NULL, PAGED_CODE, _AUX_ACCESS_DATA::PrivilegesUsed, PsGetCurrentProcessId(), PTOKEN, SepAdtOpenObjectAuditAlarm(), SepAdtPrivilegeObjectAuditAlarm(), SeSubsystemName, and TRUE. Referenced by NtDuplicateObject(), and ObpCreateHandle(). : This function audits the creation of a handle. It will examine the AuditHandleCreation field in the passed AccessState, which will indicate whether auditing was performed when the object was found or created. This routine is necessary because object name decoding and handle allocation occur in widely separate places, preventing us from auditing everything at once. Arguments: AccessState - Supplies a pointer to the AccessState structure representing this access attempt. Handle - The newly allocated handle value. Return Value: None. --*/ { BOOLEAN AuditPerformed = FALSE; PAUX_ACCESS_DATA AuxData; PAGED_CODE(); AuxData = (PAUX_ACCESS_DATA)AccessState->AuxData; if ( AccessState->GenerateAudit ) { if ( AccessState->AuditPrivileges ) { AuditPerformed = SepAdtPrivilegeObjectAuditAlarm ( &SeSubsystemName, Handle, (PTOKEN)AccessState->SubjectSecurityContext.ClientToken, (PTOKEN)AccessState->SubjectSecurityContext.PrimaryToken, &AccessState->SubjectSecurityContext.ProcessAuditId, AccessState->PreviouslyGrantedAccess, AuxData->PrivilegesUsed, TRUE ); } else { AuditPerformed = SepAdtOpenObjectAuditAlarm ( &SeSubsystemName, &Handle, &AccessState->ObjectTypeName, NULL, &AccessState->ObjectName, AccessState->SubjectSecurityContext.ClientToken, AccessState->SubjectSecurityContext.PrimaryToken, AccessState->OriginalDesiredAccess, AccessState->PreviouslyGrantedAccess, &AccessState->OperationID, AuxData->PrivilegesUsed, FALSE, TRUE, TRUE, FALSE, PsGetCurrentProcessId(), AuditCategoryObjectAccess, NULL, 0, NULL ); } } // // If we generated an 'open' audit, make sure we generate a close // AccessState->GenerateOnClose = AuditPerformed; return; }

VOID SeAuditHandleDuplication (  PVOID  SourceHandle, PVOID  NewHandle, PEPROCESS  SourceProcess, PEPROCESS  TargetProcess )

Definition at line 2573 of file sepaudit.c. References ASSERT, EffectiveToken, PAGED_CODE, PsProcessAuditId, SeCaptureSubjectContext(), SepAdtLogAuditRecord(), SepSetParmTypeSid, SepSetParmTypeString, SepSetParmTypeUlong, SepTokenUserSid, SeReleaseSubjectContext(), and SeSubsystemName. Referenced by NtDuplicateObject(), and ObAuditInheritedHandleProcedure(). : This routine generates a handle duplication audit. It is up to the caller to determine if this routine should be called or not. Arguments: SourceHandle - Original handle NewHandle - New handle SourceProcess - Process containing SourceHandle TargetProcess - Process containing NewHandle Return Value: None. --*/ { SE_ADT_PARAMETER_ARRAY AuditParameters; SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; PSID UserSid; PAGED_CODE(); SeCaptureSubjectContext( &SubjectSecurityContext ); UserSid = SepTokenUserSid( EffectiveToken( &SubjectSecurityContext )); RtlZeroMemory ( (PVOID) &AuditParameters, sizeof( AuditParameters ) ); ASSERT( SeAdtParmTypeNone == 0 ); AuditParameters.CategoryId = SE_CATEGID_DETAILED_TRACKING; AuditParameters.AuditId = SE_AUDITID_DUPLICATE_HANDLE; AuditParameters.ParameterCount = 0; AuditParameters.Type = EVENTLOG_AUDIT_SUCCESS; SepSetParmTypeSid( AuditParameters, AuditParameters.ParameterCount, UserSid ); AuditParameters.ParameterCount++; SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, &SeSubsystemName ); AuditParameters.ParameterCount++; SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)SourceHandle) ); AuditParameters.ParameterCount++; SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)PsProcessAuditId( SourceProcess ))); AuditParameters.ParameterCount++; SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)NewHandle) ); AuditParameters.ParameterCount++; SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)PsProcessAuditId( TargetProcess ))); AuditParameters.ParameterCount++; SepAdtLogAuditRecord( &AuditParameters ); SeReleaseSubjectContext( &SubjectSecurityContext ); }

NTKERNELAPI BOOLEAN SeAuditingFileEvents (  IN BOOLEAN  AccessGranted, IN PSECURITY_DESCRIPTOR  SecurityDescriptor )

Definition at line 4693 of file seaudit.c. References PAGED_CODE, and SepAdtAuditThisEvent. : This routine is to be called by a file system to quickly determine if we are auditing file open events. This allows the file system to avoid the often considerable setup involved in generating an audit. Arguments: AccessGranted - Supplies whether the access attempt was successful or a failure. Return Value: Boolean - TRUE if events of type AccessGranted are being audited, FALSE otherwise. --*/ { PAGED_CODE(); UNREFERENCED_PARAMETER( SecurityDescriptor ); return( SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted ) ); }

NTKERNELAPI BOOLEAN SeAuditingFileOrGlobalEvents (  IN BOOLEAN  AccessGranted, IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext )

Definition at line 4648 of file seaudit.c. References EffectiveToken, FALSE, NULL, PAGED_CODE, PTOKEN, SepAdtAuditThisEvent, and TRUE. : This routine is to be called by a file system to quickly determine if we are auditing file open events. This allows the file system to avoid the often considerable setup involved in generating an audit. Arguments: AccessGranted - Supplies whether the access attempt was successful or a failure. Return Value: Boolean - TRUE if events of type AccessGranted are being audited, FALSE otherwise. --*/ { PISECURITY_DESCRIPTOR ISecurityDescriptor = (PISECURITY_DESCRIPTOR) SecurityDescriptor; PAGED_CODE(); if ( ((PTOKEN)EffectiveToken( SubjectSecurityContext ))->AuditData != NULL) { return( TRUE ); } if ( RtlpSaclAddrSecurityDescriptor( ISecurityDescriptor ) == NULL ) { return( FALSE ); } return( SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted ) ); }

VOID SeAuditProcessCreation (  PEPROCESS  Process, PEPROCESS  Parent, PUNICODE_STRING  ImageFileName )

Definition at line 2466 of file sepaudit.c. References ASSERT, NTSTATUS(), NULL, PAGED_CODE, _SECURITY_SUBJECT_CONTEXT::PrimaryToken, SeCaptureSubjectContext(), SepAdtLogAuditRecord(), SepSetParmTypeLogonId, SepSetParmTypeSid, SepSetParmTypeString, SepSetParmTypeUlong, SepTokenAuthenticationId, SepTokenUserSid, SeReleaseSubjectContext(), SeSubsystemName, and Status. Referenced by PspCreateProcess(). : Audits the creation of a process. It is the caller's responsibility to determine if process auditing is in progress. Arguments: Process - Points to the new process object. Parent - Points to the creator (parent) process object. ImageFileName - the name of the image Return Value: None. --*/ { ANSI_STRING Ansi; LUID UserAuthenticationId; NTSTATUS Status; PSID UserSid; SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; SE_ADT_PARAMETER_ARRAY AuditParameters; PAGED_CODE(); if ( ImageFileName == NULL ) { return ; } // // NtCreateProcess with no section will cause this to be NULL // fork() for posix will do this, or someone calling NtCreateProcess // directly. // if ( ImageFileName->Buffer == NULL ) { return; } SeCaptureSubjectContext( &SubjectSecurityContext ); RtlZeroMemory ( (PVOID) &AuditParameters, sizeof( AuditParameters ) ); ASSERT( SeAdtParmTypeNone == 0 ); AuditParameters.CategoryId = SE_CATEGID_DETAILED_TRACKING; AuditParameters.AuditId = SE_AUDITID_PROCESS_CREATED; AuditParameters.ParameterCount = 0; AuditParameters.Type = EVENTLOG_AUDIT_SUCCESS; // // Use the primary token here, because that's what's going to show up // when the created process exits. // UserSid = SepTokenUserSid( SubjectSecurityContext.PrimaryToken ); UserAuthenticationId = SepTokenAuthenticationId( SubjectSecurityContext.PrimaryToken ); // // Fill in the AuditParameters structure. // SepSetParmTypeSid( AuditParameters, AuditParameters.ParameterCount, UserSid ); AuditParameters.ParameterCount++; SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, &SeSubsystemName ); AuditParameters.ParameterCount++; SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)Process) ); AuditParameters.ParameterCount++; SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, ImageFileName ); AuditParameters.ParameterCount++; SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)Parent) ); AuditParameters.ParameterCount++; SepSetParmTypeLogonId( AuditParameters, AuditParameters.ParameterCount, UserAuthenticationId ); AuditParameters.ParameterCount++; SepAdtLogAuditRecord( &AuditParameters ); SeReleaseSubjectContext( &SubjectSecurityContext ); return; }

VOID SeAuditProcessExit (  PEPROCESS  Process  )

Definition at line 2653 of file sepaudit.c. References ASSERT, PAGED_CODE, PsProcessAuditId, PTOKEN, SepAdtLogAuditRecord(), SepSetParmTypeLogonId, SepSetParmTypeSid, SepSetParmTypeString, SepSetParmTypeUlong, SepTokenAuthenticationId, SepTokenUserSid, SeSubsystemName, Token, and _EPROCESS::Token. Referenced by PspProcessDelete(). : Audits the exit of a process. The caller is responsible for determining if this should be called. Arguments: Process - Pointer to the process object that is exiting. Return Value: None. --*/ { PTOKEN Token; SE_ADT_PARAMETER_ARRAY AuditParameters; PSID UserSid; LUID LogonId; PAGED_CODE(); Token = (PTOKEN)Process->Token; UserSid = SepTokenUserSid( Token ); LogonId = SepTokenAuthenticationId( Token ); RtlZeroMemory ( (PVOID) &AuditParameters, sizeof( AuditParameters ) ); ASSERT( SeAdtParmTypeNone == 0 ); AuditParameters.CategoryId = SE_CATEGID_DETAILED_TRACKING; AuditParameters.AuditId = SE_AUDITID_PROCESS_EXIT; AuditParameters.ParameterCount = 0; AuditParameters.Type = EVENTLOG_AUDIT_SUCCESS; SepSetParmTypeSid( AuditParameters, AuditParameters.ParameterCount, UserSid ); AuditParameters.ParameterCount++; SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, &SeSubsystemName ); AuditParameters.ParameterCount++; SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)PsProcessAuditId( Process ))); AuditParameters.ParameterCount++; SepSetParmTypeLogonId( AuditParameters, AuditParameters.ParameterCount, LogonId ); AuditParameters.ParameterCount++; SepAdtLogAuditRecord( &AuditParameters ); }

NTSTATUS SeCaptureAcl (  IN PACL  InputAcl, IN KPROCESSOR_MODE  RequestorMode, IN PVOID CaptureBuffer  OPTIONAL, IN ULONG  CaptureBufferLength, IN POOL_TYPE  PoolType, IN BOOLEAN  ForceCapture, OUT PACL *  CapturedAcl, OUT PULONG  AlignedAclSize )

Definition at line 1370 of file se/capture.c. References ExAllocatePoolWithTag, EXCEPTION_EXECUTE_HANDLER, ExFreePool(), FALSE, KernelMode, NULL, PAGED_CODE, ProbeAndReadUshort, ProbeForRead, and SepCheckAcl(). Referenced by NtCreateToken(), and NtSetInformationToken(). 01383 : 01384 01385 This routine probes and captures a copy of the specified ACL. 01386 The ACL is either captured into a provided buffer, or pool 01387 allocated to receive the ACL. 01388 01389 Any ACL captured will have its structure validated. 01390 01391 01392 if the requestor mode is not kernel mode then 01393 01394 probe and capture the input ACL 01395 01396 if the requstor mode is kernel mode then 01397 01398 if force capture is true then 01399 01400 do not probe the input ACL, but do capture it 01401 01402 else 01403 01404 return address of original, but don't copy 01405 01406 Arguments: 01407 01408 InputAcl - Supplies the ACL to capture. This parameter is assumed 01409 to have been provided by the mode specified in RequestorMode. 01410 01411 RequestorMode - Specifies the caller's access mode. 01412 01413 CaptureBuffer - Specifies a buffer into which the ACL is to be 01414 captured. If this parameter is not provided, pool will be allocated 01415 to hold the captured data. 01416 01417 CaptureBufferLength - Indicates the length, in bytes, of the capture 01418 buffer. 01419 01420 PoolType - Specifies which pool type to allocate to capture the 01421 ACL into. This parameter is ignored if CaptureBuffer is provided. 01422 01423 ForceCapture - Specifies whether the ACL should be captured even if 01424 requestor mode is kernel. 01425 01426 CapturedAcl - Supplies the address of a pointer to an ACL. 01427 The pointer will be set to point to the captured (or uncaptured) ACL. 01428 01429 AlignedAclSize - Supplies the address of a ULONG to receive the length 01430 of the ACL rounded up to the next longword boundary. 01431 01432 Return Value: 01433 01434 STATUS_SUCCESS indicates the capture was successful. 01435 01436 STATUS_BUFFER_TOO_SMALL - indicates the buffer provided to capture the ACL 01437 into wasn't large enough to hold the ACL. 01438 01439 Any access violations encountered will be returned. 01440 01441 --*/ 01442 01443 { 01444 01445 ULONG AclSize; 01446 01447 PAGED_CODE(); 01448 01449 // 01450 // check if the requestors mode is kernel mode and we are not 01451 // to force a capture. 01452 // 01453 01454 if ((RequestorMode == KernelMode) && (ForceCapture == FALSE)) { 01455 01456 // 01457 // We don't need to do any work and can simply 01458 // return a pointer to the input ACL 01459 // 01460 01461 (*CapturedAcl) = InputAcl; 01462 01463 return STATUS_SUCCESS; 01464 } 01465 01466 01467 // 01468 // Get the length needed to hold the ACL 01469 // 01470 01471 if (RequestorMode != KernelMode) { 01472 01473 try { 01474 01475 AclSize = ProbeAndReadUshort( &(InputAcl->AclSize) ); 01476 01477 ProbeForRead( InputAcl, 01478 AclSize, 01479 sizeof(ULONG) ); 01480 01481 } except(EXCEPTION_EXECUTE_HANDLER) { 01482 return GetExceptionCode(); 01483 } 01484 01485 } else { 01486 01487 AclSize = InputAcl->AclSize; 01488 01489 } 01490 01491 // 01492 // If the passed pointer is non-null, it has better at least 01493 // point to a well formed ACL 01494 // 01495 01496 if (AclSize < sizeof(ACL)) { 01497 return( STATUS_INVALID_ACL ); 01498 } 01499 01500 (*AlignedAclSize) = (ULONG)LongAlignSize( AclSize ); 01501 01502 01503 // 01504 // If a buffer was provided, compare lengths. 01505 // Otherwise, allocate a buffer. 01506 // 01507 01508 if (ARGUMENT_PRESENT(CaptureBuffer)) { 01509 01510 if (AclSize > CaptureBufferLength) { 01511 return STATUS_BUFFER_TOO_SMALL; 01512 } else { 01513 01514 (*CapturedAcl) = CaptureBuffer; 01515 } 01516 01517 } else { 01518 01519 (*CapturedAcl) = (PACL)ExAllocatePoolWithTag(PoolType, AclSize, 'cAeS'); 01520 01521 if ( *CapturedAcl == NULL ) { 01522 return( STATUS_INSUFFICIENT_RESOURCES ); 01523 } 01524 01525 } 01526 01527 // 01528 // Now copy the ACL and validate it 01529 // 01530 01531 try { 01532 01533 RtlMoveMemory( (*CapturedAcl), InputAcl, AclSize ); 01534 01535 } except(EXCEPTION_EXECUTE_HANDLER) { 01536 if (!ARGUMENT_PRESENT(CaptureBuffer)) { 01537 ExFreePool( (*CapturedAcl) ); 01538 } 01539 01540 *CapturedAcl = NULL; 01541 return GetExceptionCode(); 01542 } 01543 01544 if ( (!SepCheckAcl( (*CapturedAcl), AclSize )) ) { 01545 01546 if (!ARGUMENT_PRESENT(CaptureBuffer)) { 01547 ExFreePool( (*CapturedAcl) ); 01548 } 01549 01550 *CapturedAcl = NULL; 01551 return STATUS_INVALID_ACL; 01552 } 01553 01554 return STATUS_SUCCESS; 01555 01556 }

NTSTATUS SeCaptureLuidAndAttributesArray (  IN PLUID_AND_ATTRIBUTES  InputArray, IN ULONG  ArrayCount, IN KPROCESSOR_MODE  RequestorMode, IN PVOID CaptureBuffer  OPTIONAL, IN ULONG  CaptureBufferLength, IN POOL_TYPE  PoolType, IN BOOLEAN  ForceCapture, OUT PLUID_AND_ATTRIBUTES *  CapturedArray, OUT PULONG  AlignedArraySize )

Definition at line 1608 of file se/capture.c. References ExAllocatePoolWithTag, EXCEPTION_EXECUTE_HANDLER, ExFreePool(), FALSE, InputArray, KernelMode, NULL, PAGED_CODE, ProbeForRead, and SEP_MAX_PRIVILEGE_COUNT. Referenced by NtAdjustPrivilegesToken(), NtCreateToken(), NtFilterToken(), NtPrivilegeCheck(), and PspCaptureTokenFilter(). 01622 : 01623 01624 This routine probes and captures a copy of the specified 01625 LUID_AND_ATTRIBUTES array. 01626 01627 The array is either captured into a provided buffer, or pool 01628 allocated to receive the array. 01629 01630 01631 if the requestor mode is not kernel mode then 01632 01633 probe and capture the input array 01634 01635 if the requstor mode is kernel mode then 01636 01637 if force capture is true then 01638 01639 do not probe the input array, but do capture it 01640 01641 else 01642 01643 return address of original, but don't copy 01644 01645 Arguments: 01646 01647 InputArray - Supplies the array to capture. This parameter is assumed 01648 to have been provided by the mode specified in RequestorMode. 01649 01650 ArrayCount - Indicates the number of elements in the array to capture. 01651 01652 RequestorMode - Specifies the caller's access mode. 01653 01654 CaptureBuffer - Specifies a buffer into which the array is to be 01655 captured. If this parameter is not provided, pool will be allocated 01656 to hold the captured data. 01657 01658 CaptureBufferLength - Indicates the length, in bytes, of the capture 01659 buffer. 01660 01661 PoolType - Specifies which pool type to allocate to capture the 01662 array into. This parameter is ignored if CaptureBuffer is provided. 01663 01664 ForceCapture - Specifies whether the array should be captured even if 01665 requestor mode is kernel. 01666 01667 CapturedArray - Supplies the address of a pointer to an array. 01668 The pointer will be set to point to the captured (or uncaptured) array. 01669 01670 AlignedArraySize - Supplies the address of a ULONG to receive the length 01671 of the array rounded up to the next longword boundary. 01672 01673 Return Value: 01674 01675 STATUS_SUCCESS indicates the capture was successful. 01676 01677 STATUS_BUFFER_TOO_SMALL - indicates the buffer provided to capture the array 01678 into wasn't large enough to hold the array. 01679 01680 Any access violations encountered will be returned. 01681 01682 --*/ 01683 01684 { 01685 01686 ULONG ArraySize; 01687 01688 PAGED_CODE(); 01689 01690 // 01691 // Make sure the array isn't empty 01692 // 01693 01694 if (ArrayCount == 0) { 01695 (*CapturedArray) = NULL; 01696 (*AlignedArraySize) = 0; 01697 return STATUS_SUCCESS; 01698 } 01699 01700 // 01701 // If there are too many LUIDs, return failure 01702 // 01703 01704 if (ArrayCount > SEP_MAX_PRIVILEGE_COUNT) { 01705 return(STATUS_INVALID_PARAMETER); 01706 } 01707 01708 // 01709 // check if the requestors mode is kernel mode and we are not 01710 // to force a capture. 01711 // 01712 01713 if ((RequestorMode == KernelMode) && (ForceCapture == FALSE)) { 01714 01715 // 01716 // We don't need to do any work and can simply 01717 // return a pointer to the input array 01718 // 01719 01720 (*CapturedArray) = InputArray; 01721 01722 return STATUS_SUCCESS; 01723 } 01724 01725 01726 // 01727 // Get the length needed to hold the array 01728 // 01729 01730 ArraySize = ArrayCount * (ULONG)sizeof(LUID_AND_ATTRIBUTES); 01731 (*AlignedArraySize) = (ULONG)LongAlignSize( ArraySize ); 01732 01733 if (RequestorMode != KernelMode) { 01734 01735 try { 01736 01737 01738 ProbeForRead( InputArray, 01739 ArraySize, 01740 sizeof(ULONG) ); 01741 01742 } except(EXCEPTION_EXECUTE_HANDLER) { 01743 return GetExceptionCode(); 01744 } 01745 01746 } 01747 01748 01749 01750 // 01751 // If a buffer was provided, compare lengths. 01752 // Otherwise, allocate a buffer. 01753 // 01754 01755 if (ARGUMENT_PRESENT(CaptureBuffer)) { 01756 01757 if (ArraySize > CaptureBufferLength) { 01758 return STATUS_BUFFER_TOO_SMALL; 01759 } else { 01760 01761 (*CapturedArray) = CaptureBuffer; 01762 } 01763 01764 } else { 01765 01766 (*CapturedArray) = 01767 (PLUID_AND_ATTRIBUTES)ExAllocatePoolWithTag(PoolType, ArraySize, 'uLeS'); 01768 01769 if ( *CapturedArray == NULL ) { 01770 return( STATUS_INSUFFICIENT_RESOURCES ); 01771 } 01772 01773 } 01774 01775 // 01776 // Now copy the array 01777 // 01778 01779 try { 01780 01781 RtlMoveMemory( (*CapturedArray), InputArray, ArraySize ); 01782 01783 } except(EXCEPTION_EXECUTE_HANDLER) { 01784 if (!ARGUMENT_PRESENT(CaptureBuffer)) { 01785 ExFreePool( (*CapturedArray) ); 01786 } 01787 01788 return GetExceptionCode(); 01789 } 01790 01791 return STATUS_SUCCESS; 01792 01793 }

NTKERNELAPI NTSTATUS SeCaptureSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  InputSecurityDescriptor, IN KPROCESSOR_MODE  RequestorMode, IN POOL_TYPE  PoolType, IN BOOLEAN  ForceCapture, OUT PSECURITY_DESCRIPTOR *  OutputSecurityDescriptor )

Definition at line 53 of file se/capture.c. References ExAllocatePoolWithTag, EXCEPTION_EXECUTE_HANDLER, ExFreePool(), ExRaiseDatatypeMisalignment(), FALSE, KernelMode, NULL, PAGED_CODE, ProbeAndReadUchar, ProbeAndReadUshort, ProbeForRead, RtlLengthRequiredSid(), RtlValidSid(), SepCheckAcl(), Size, and USHORT. Referenced by IopGetRegistrySecurityWithFallback(), IopSetSecurityObjectFromRegistry(), NtLoadKey2(), NtOpenObjectAuditAlarm(), NtSetSecurityObject(), NtUserCreateWindowStation(), ObpCaptureObjectCreateInformation(), SeAccessCheckByType(), SepAccessCheckAndAuditAlarm(), and TestCaptureSecurityDescriptor(). 00063 : 00064 00065 This routine probes and captures a copy of the security descriptor based 00066 upon the following tests. 00067 00068 if the requestor mode is not kernel mode then 00069 00070 probe and capture the input descriptor 00071 (the captured descriptor is self-relative) 00072 00073 if the requstor mode is kernel mode then 00074 00075 if force capture is true then 00076 00077 do not probe the input descriptor, but do capture it. 00078 (the captured descriptor is self-relative) 00079 00080 else 00081 00082 do nothing 00083 (the input descriptor is expected to be self-relative) 00084 00085 Arguments: 00086 00087 InputSecurityDescriptor - Supplies the security descriptor to capture. 00088 This parameter is assumed to have been provided by the mode specified 00089 in RequestorMode. 00090 00091 RequestorMode - Specifies the caller's access mode. 00092 00093 PoolType - Specifies which pool type to allocate the captured 00094 descriptor from 00095 00096 ForceCapture - Specifies whether the input descriptor should always be 00097 captured 00098 00099 OutputSecurityDescriptor - Supplies the address of a pointer to the 00100 output security descriptor. The captured descriptor will be 00101 self-relative format. 00102 00103 Return Value: 00104 00105 STATUS_SUCCESS if the operation is successful. 00106 00107 STATUS_INVALID_SID - An SID within the security descriptor is not 00108 a valid SID. 00109 00110 STATUS_INVALID_ACL - An ACL within the security descriptor is not 00111 a valid ACL. 00112 00113 STATUS_UNKNOWN_REVISION - The revision level of the security descriptor 00114 is not one known to this revision of the capture routine. 00115 --*/ 00116 00117 { 00118 SECURITY_DESCRIPTOR Captured; 00119 SECURITY_DESCRIPTOR_RELATIVE *PIOutputSecurityDescriptor; 00120 PCHAR DescriptorOffset; 00121 00122 ULONG SaclSize; 00123 ULONG NewSaclSize; 00124 00125 ULONG DaclSize; 00126 ULONG NewDaclSize; 00127 00128 ULONG OwnerSubAuthorityCount; 00129 ULONG OwnerSize; 00130 ULONG NewOwnerSize; 00131 00132 ULONG GroupSubAuthorityCount; 00133 ULONG GroupSize; 00134 ULONG NewGroupSize; 00135 00136 ULONG Size; 00137 00138 PAGED_CODE(); 00139 00140 // 00141 // if the security descriptor is null then there is really nothing to 00142 // capture 00143 // 00144 00145 if (InputSecurityDescriptor == NULL) { 00146 00147 (*OutputSecurityDescriptor) = NULL; 00148 00149 return STATUS_SUCCESS; 00150 00151 } 00152 00153 // 00154 // check if the requestors mode is kernel mode and we are not 00155 // to force a capture 00156 // 00157 00158 if ((RequestorMode == KernelMode) && (ForceCapture == FALSE)) { 00159 00160 // 00161 // Yes it is so we don't need to do any work and can simply 00162 // return a pointer to the input descriptor 00163 // 00164 00165 (*OutputSecurityDescriptor) = InputSecurityDescriptor; 00166 00167 return STATUS_SUCCESS; 00168 00169 } 00170 00171 00172 // 00173 // We need to probe and capture the descriptor. 00174 // To do this we need to probe the main security descriptor record 00175 // first. 00176 // 00177 00178 if (RequestorMode != KernelMode) { 00179 00180 // 00181 // Capture of UserMode SecurityDescriptor. 00182 // 00183 00184 try { 00185 00186 // 00187 // Probe the main record of the input SecurityDescriptor 00188 // 00189 00190 ProbeForRead( InputSecurityDescriptor, 00191 sizeof(SECURITY_DESCRIPTOR_RELATIVE), 00192 sizeof(ULONG) ); 00193 00194 // 00195 // Capture the SecurityDescriptor main record. 00196 // 00197 00198 RtlCopyMemory( (&Captured), 00199 InputSecurityDescriptor, 00200 sizeof(SECURITY_DESCRIPTOR_RELATIVE) ); 00201 00202 // 00203 // Verify the alignment is correct for absolute case. This is 00204 // only needed when pointer are 64 bits. 00205 // 00206 00207 if (!(Captured.Control & SE_SELF_RELATIVE)) { 00208 00209 if ((ULONG_PTR) InputSecurityDescriptor & (sizeof(ULONG_PTR) - 1)) { 00210 ExRaiseDatatypeMisalignment(); 00211 } 00212 } 00213 00214 00215 } except(EXCEPTION_EXECUTE_HANDLER) { 00216 return GetExceptionCode(); 00217 } 00218 00219 } else { 00220 00221 // 00222 // Force capture of kernel mode SecurityDescriptor. 00223 // 00224 // Capture the SecurityDescriptor main record. 00225 // It doesn't need probing because requestor mode is kernel. 00226 // 00227 00228 RtlCopyMemory( (&Captured), 00229 InputSecurityDescriptor, 00230 sizeof(SECURITY_DESCRIPTOR_RELATIVE) ); 00231 00232 } 00233 00234 // 00235 // Make sure it is a revision we recognize 00236 // 00237 00238 if (Captured.Revision != SECURITY_DESCRIPTOR_REVISION) { 00239 return STATUS_UNKNOWN_REVISION; 00240 } 00241 00242 00243 // 00244 // In case the input security descriptor is self-relative, change the 00245 // captured main record to appear as an absolute form so we can use 00246 // common code for both cases below. 00247 // 00248 // Note that the fields of Captured are left pointing to user 00249 // space addresses. Treat them carefully. 00250 // 00251 00252 try { 00253 00254 Captured.Owner = RtlpOwnerAddrSecurityDescriptor( 00255 (SECURITY_DESCRIPTOR *)InputSecurityDescriptor 00256 ); 00257 Captured.Group = RtlpGroupAddrSecurityDescriptor( 00258 (SECURITY_DESCRIPTOR *)InputSecurityDescriptor 00259 ); 00260 Captured.Sacl = RtlpSaclAddrSecurityDescriptor ( 00261 (SECURITY_DESCRIPTOR *)InputSecurityDescriptor 00262 ); 00263 Captured.Dacl = RtlpDaclAddrSecurityDescriptor ( 00264 (SECURITY_DESCRIPTOR *)InputSecurityDescriptor 00265 ); 00266 Captured.Control &= ~SE_SELF_RELATIVE; 00267 00268 } except(EXCEPTION_EXECUTE_HANDLER) { 00269 return GetExceptionCode(); 00270 } 00271 00272 00273 00274 // 00275 // Indicate the size we are going to need to allocate for the captured 00276 // acls 00277 // 00278 00279 SaclSize = 0; 00280 DaclSize = 0; 00281 00282 NewSaclSize = 0; 00283 NewDaclSize = 0; 00284 NewGroupSize = 0; 00285 NewOwnerSize = 0; 00286 00287 // 00288 // Probe (if necessary) and capture each of the components of a 00289 // SECURITY_DESCRIPTOR. 00290 // 00291 00292 // 00293 // System ACL first 00294 // 00295 00296 if ((Captured.Control & SE_SACL_PRESENT) && 00297 (Captured.Sacl != NULL) ) { 00298 00299 if (RequestorMode != KernelMode) { 00300 00301 try { 00302 SaclSize = ProbeAndReadUshort( &(Captured.Sacl->AclSize) ); 00303 ProbeForRead( Captured.Sacl, 00304 SaclSize, 00305 sizeof(ULONG) ); 00306 } except(EXCEPTION_EXECUTE_HANDLER) { 00307 return GetExceptionCode(); 00308 } 00309 00310 } else { 00311 00312 SaclSize = Captured.Sacl->AclSize; 00313 00314 } 00315 00316 NewSaclSize = (ULONG)LongAlignSize( SaclSize ); 00317 00318 } else { 00319 // 00320 // Force the SACL to null if the bit is off 00321 // 00322 Captured.Sacl = NULL; 00323 } 00324 00325 // 00326 // Discretionary ACL 00327 // 00328 00329 if ((Captured.Control & SE_DACL_PRESENT) && 00330 (Captured.Dacl != NULL) ) { 00331 00332 if (RequestorMode != KernelMode) { 00333 00334 try { 00335 DaclSize = ProbeAndReadUshort( &(Captured.Dacl->AclSize) ); 00336 ProbeForRead( Captured.Dacl, 00337 DaclSize, 00338 sizeof(ULONG) ); 00339 } except(EXCEPTION_EXECUTE_HANDLER) { 00340 return GetExceptionCode(); 00341 } 00342 00343 } else { 00344 00345 DaclSize = Captured.Dacl->AclSize; 00346 00347 } 00348 00349 NewDaclSize = (ULONG)LongAlignSize( DaclSize ); 00350 00351 } else { 00352 // 00353 // Force the DACL to null if it is not present 00354 // 00355 Captured.Dacl = NULL; 00356 } 00357 00358 // 00359 // Owner SID 00360 // 00361 00362 if (Captured.Owner != NULL) { 00363 00364 if (RequestorMode != KernelMode) { 00365 00366 try { 00367 OwnerSubAuthorityCount = 00368 ProbeAndReadUchar( &(((SID *)(Captured.Owner))->SubAuthorityCount) ); 00369 OwnerSize = RtlLengthRequiredSid( OwnerSubAuthorityCount ); 00370 ProbeForRead( Captured.Owner, 00371 OwnerSize, 00372 sizeof(ULONG) ); 00373 } except(EXCEPTION_EXECUTE_HANDLER) { 00374 return GetExceptionCode(); 00375 } 00376 00377 } else { 00378 00379 OwnerSubAuthorityCount = ((SID *)(Captured.Owner))->SubAuthorityCount; 00380 OwnerSize = RtlLengthRequiredSid( OwnerSubAuthorityCount ); 00381 00382 } 00383 00384 NewOwnerSize = (ULONG)LongAlignSize( OwnerSize ); 00385 00386 } 00387 00388 // 00389 // Group SID 00390 // 00391 00392 if (Captured.Group != NULL) { 00393 00394 if (RequestorMode != KernelMode) { 00395 00396 try { 00397 GroupSubAuthorityCount = 00398 ProbeAndReadUchar( &(((SID *)(Captured.Group))->SubAuthorityCount) ); 00399 GroupSize = RtlLengthRequiredSid( GroupSubAuthorityCount ); 00400 ProbeForRead( Captured.Group, 00401 GroupSize, 00402 sizeof(ULONG) ); 00403 } except(EXCEPTION_EXECUTE_HANDLER) { 00404 return GetExceptionCode(); 00405 } 00406 00407 } else { 00408 00409 GroupSubAuthorityCount = ((SID *)(Captured.Group))->SubAuthorityCount; 00410 GroupSize = RtlLengthRequiredSid( GroupSubAuthorityCount ); 00411 00412 } 00413 00414 NewGroupSize = (ULONG)LongAlignSize( GroupSize ); 00415 00416 } 00417 00418 00419 00420 // 00421 // Now allocate enough pool to hold the descriptor 00422 // 00423 00424 Size = sizeof(SECURITY_DESCRIPTOR_RELATIVE) + 00425 NewSaclSize + 00426 NewDaclSize + 00427 NewOwnerSize + 00428 NewGroupSize; 00429 00430 (PIOutputSecurityDescriptor) = (SECURITY_DESCRIPTOR_RELATIVE *)ExAllocatePoolWithTag( PoolType, 00431 Size, 00432 'cSeS' ); 00433 00434 if ( PIOutputSecurityDescriptor == NULL ) { 00435 return( STATUS_INSUFFICIENT_RESOURCES ); 00436 } 00437 00438 (*OutputSecurityDescriptor) = (PSECURITY_DESCRIPTOR)PIOutputSecurityDescriptor; 00439 DescriptorOffset = (PCHAR)(PIOutputSecurityDescriptor); 00440 00441 00442 // 00443 // Copy the main security descriptor record over 00444 // 00445 00446 RtlCopyMemory( DescriptorOffset, 00447 &Captured, 00448 sizeof(SECURITY_DESCRIPTOR_RELATIVE) ); 00449 DescriptorOffset += sizeof(SECURITY_DESCRIPTOR_RELATIVE); 00450 00451 // 00452 // Indicate the output descriptor is self-relative 00453 // 00454 00455 PIOutputSecurityDescriptor->Control |= SE_SELF_RELATIVE; 00456 00457 // 00458 // If there is a System Acl, copy it over and set 00459 // the output descriptor's offset to point to the newly captured copy. 00460 // 00461 00462 if ((Captured.Control & SE_SACL_PRESENT) && (Captured.Sacl != NULL)) { 00463 00464 00465 try { 00466 RtlCopyMemory( DescriptorOffset, 00467 Captured.Sacl, 00468 SaclSize ); 00469 00470 00471 } except(EXCEPTION_EXECUTE_HANDLER) { 00472 ExFreePool( PIOutputSecurityDescriptor ); 00473 return GetExceptionCode(); 00474 } 00475 00476 if ((RequestorMode != KernelMode) && 00477 (!SepCheckAcl( (PACL) DescriptorOffset, SaclSize )) ) { 00478 00479 ExFreePool( PIOutputSecurityDescriptor ); 00480 return STATUS_INVALID_ACL; 00481 } 00482 00483 // 00484 // Change pointer to offset 00485 // 00486 00487 PIOutputSecurityDescriptor->Sacl = 00488 RtlPointerToOffset( PIOutputSecurityDescriptor, 00489 DescriptorOffset, 00490 ); 00491 00492 ((PACL) DescriptorOffset)->AclSize = (USHORT) NewSaclSize; 00493 DescriptorOffset += NewSaclSize; 00494 } else { 00495 PIOutputSecurityDescriptor->Sacl = 0; 00496 } 00497 00498 // 00499 // If there is a Discretionary Acl, copy it over and set 00500 // the output descriptor's offset to point to the newly captured copy. 00501 // 00502 00503 if ((Captured.Control & SE_DACL_PRESENT) && (Captured.Dacl != NULL)) { 00504 00505 00506 try { 00507 RtlCopyMemory( DescriptorOffset, 00508 Captured.Dacl, 00509 DaclSize ); 00510 } except(EXCEPTION_EXECUTE_HANDLER) { 00511 ExFreePool( PIOutputSecurityDescriptor ); 00512 return GetExceptionCode(); 00513 } 00514 00515 if ((RequestorMode != KernelMode) && 00516 (!SepCheckAcl( (PACL) DescriptorOffset, DaclSize )) ) { 00517 00518 ExFreePool( PIOutputSecurityDescriptor ); 00519 return STATUS_INVALID_ACL; 00520 } 00521 00522 // 00523 // Change pointer to offset 00524 // 00525 00526 PIOutputSecurityDescriptor->Dacl = 00527 RtlPointerToOffset( 00528 PIOutputSecurityDescriptor, 00529 DescriptorOffset 00530 ); 00531 00532 ((PACL) DescriptorOffset)->AclSize = (USHORT) NewDaclSize; 00533 DescriptorOffset += NewDaclSize; 00534 } else { 00535 PIOutputSecurityDescriptor->Dacl = 0; 00536 } 00537 00538 // 00539 // If there is an Owner SID, copy it over and set 00540 // the output descriptor's offset to point to the newly captured copy. 00541 // 00542 00543 if (Captured.Owner != NULL) { 00544 00545 00546 try { 00547 RtlCopyMemory( DescriptorOffset, 00548 Captured.Owner, 00549 OwnerSize ); 00550 ((SID *) (DescriptorOffset))->SubAuthorityCount = (UCHAR) OwnerSubAuthorityCount; 00551 00552 } except(EXCEPTION_EXECUTE_HANDLER) { 00553 ExFreePool( PIOutputSecurityDescriptor ); 00554 return GetExceptionCode(); 00555 } 00556 00557 if ((RequestorMode != KernelMode) && 00558 (!RtlValidSid( (PSID) DescriptorOffset )) ) { 00559 00560 ExFreePool( PIOutputSecurityDescriptor ); 00561 return STATUS_INVALID_SID; 00562 } 00563 00564 // 00565 // Change pointer to offset 00566 // 00567 00568 PIOutputSecurityDescriptor->Owner = 00569 RtlPointerToOffset( 00570 PIOutputSecurityDescriptor, 00571 DescriptorOffset 00572 ); 00573 00574 DescriptorOffset += NewOwnerSize; 00575 00576 } else { 00577 PIOutputSecurityDescriptor->Owner = 0; 00578 } 00579 00580 // 00581 // If there is a group SID, copy it over and set 00582 // the output descriptor's offset to point to the newly captured copy. 00583 // 00584 00585 if (Captured.Group != NULL) { 00586 00587 00588 try { 00589 RtlCopyMemory( DescriptorOffset, 00590 Captured.Group, 00591 GroupSize ); 00592 00593 ((SID *) DescriptorOffset)->SubAuthorityCount = (UCHAR) GroupSubAuthorityCount; 00594 } except(EXCEPTION_EXECUTE_HANDLER) { 00595 ExFreePool( PIOutputSecurityDescriptor ); 00596 return GetExceptionCode(); 00597 } 00598 00599 if ((RequestorMode != KernelMode) && 00600 (!RtlValidSid( (PSID) DescriptorOffset )) ) { 00601 00602 ExFreePool( PIOutputSecurityDescriptor ); 00603 return STATUS_INVALID_SID; 00604 } 00605 00606 // 00607 // Change pointer to offset 00608 // 00609 00610 PIOutputSecurityDescriptor->Group = 00611 RtlPointerToOffset( 00612 PIOutputSecurityDescriptor, 00613 DescriptorOffset 00614 ); 00615 00616 DescriptorOffset += NewGroupSize; 00617 } else { 00618 PIOutputSecurityDescriptor->Group = 0; 00619 } 00620 00621 // 00622 // And return to our caller 00623 // 00624 00625 return STATUS_SUCCESS; 00626 00627 }

NTSTATUS SeCaptureSecurityQos (  IN POBJECT_ATTRIBUTES ObjectAttributes  OPTIONAL, IN KPROCESSOR_MODE  RequestorMode, IN PBOOLEAN  SecurityQosPresent, IN PSECURITY_ADVANCED_QUALITY_OF_SERVICE  CapturedSecurityQos )

NTSTATUS SeCaptureSid (  IN PSID  InputSid, IN KPROCESSOR_MODE  RequestorMode, IN PVOID CaptureBuffer  OPTIONAL, IN ULONG  CaptureBufferLength, IN POOL_TYPE  PoolType, IN BOOLEAN  ForceCapture, OUT PSID *  CapturedSid )

Definition at line 1141 of file se/capture.c. References ExAllocatePoolWithTag, EXCEPTION_EXECUTE_HANDLER, ExFreePool(), FALSE, KernelMode, NULL, PAGED_CODE, ProbeAndReadUchar, ProbeForRead, RtlLengthRequiredSid(), and RtlValidSid(). Referenced by NtCreateToken(), NtSecureConnectPort(), NtSetInformationToken(), SeAccessCheckByType(), and SepAccessCheckAndAuditAlarm(). 01152 : 01153 01154 This routine probes and captures a copy of the specified SID. 01155 The SID is either captured into a provided buffer, or pool 01156 allocated to receive the SID. 01157 01158 01159 if the requestor mode is not kernel mode then 01160 01161 probe and capture the input SID 01162 01163 if the requstor mode is kernel mode then 01164 01165 if force capture is true then 01166 01167 do not probe the input SID, but do capture it 01168 01169 else 01170 01171 return address of original, but don't copy 01172 01173 Arguments: 01174 01175 InputSid - Supplies the SID to capture. This parameter is assumed 01176 to have been provided by the mode specified in RequestorMode. 01177 01178 RequestorMode - Specifies the caller's access mode. 01179 01180 CaptureBuffer - Specifies a buffer into which the SID is to be 01181 captured. If this parameter is not provided, pool will be allocated 01182 to hold the captured data. 01183 01184 CaptureBufferLength - Indicates the length, in bytes, of the capture 01185 buffer. 01186 01187 PoolType - Specifies which pool type to allocate to capture the 01188 SID into. This parameter is ignored if CaptureBuffer is provided. 01189 01190 ForceCapture - Specifies whether the SID should be captured even if 01191 requestor mode is kernel. 01192 01193 CapturedSid - Supplies the address of a pointer to an SID. 01194 The pointer will be set to point to the captured (or uncaptured) SID. 01195 01196 AlignedSidSize - Supplies the address of a ULONG to receive the length 01197 of the SID rounded up to the next longword boundary. 01198 01199 Return Value: 01200 01201 STATUS_SUCCESS indicates the capture was successful. 01202 01203 STATUS_BUFFER_TOO_SMALL - indicates the buffer provided to capture the SID 01204 into wasn't large enough to hold the SID. 01205 01206 Any access violations encountered will be returned. 01207 01208 --*/ 01209 01210 { 01211 01212 01213 01214 ULONG GetSidSubAuthorityCount; 01215 ULONG SidSize; 01216 01217 PAGED_CODE(); 01218 01219 // 01220 // check if the requestors mode is kernel mode and we are not 01221 // to force a capture. 01222 // 01223 01224 if ((RequestorMode == KernelMode) && (ForceCapture == FALSE)) { 01225 01226 // 01227 // We don't need to do any work and can simply 01228 // return a pointer to the input SID 01229 // 01230 01231 (*CapturedSid) = InputSid; 01232 01233 return STATUS_SUCCESS; 01234 } 01235 01236 01237 // 01238 // Get the length needed to hold the SID 01239 // 01240 01241 if (RequestorMode != KernelMode) { 01242 01243 try { 01244 GetSidSubAuthorityCount = 01245 ProbeAndReadUchar( &(((SID *)(InputSid))->SubAuthorityCount) ); 01246 SidSize = RtlLengthRequiredSid( GetSidSubAuthorityCount ); 01247 ProbeForRead( InputSid, 01248 SidSize, 01249 sizeof(ULONG) ); 01250 } except(EXCEPTION_EXECUTE_HANDLER) { 01251 return GetExceptionCode(); 01252 } 01253 01254 } else { 01255 01256 GetSidSubAuthorityCount = ((SID *)(InputSid))->SubAuthorityCount; 01257 SidSize = RtlLengthRequiredSid( GetSidSubAuthorityCount ); 01258 01259 } 01260 01261 01262 // 01263 // If a buffer was provided, compare lengths. 01264 // Otherwise, allocate a buffer. 01265 // 01266 01267 if (ARGUMENT_PRESENT(CaptureBuffer)) { 01268 01269 if (SidSize > CaptureBufferLength) { 01270 return STATUS_BUFFER_TOO_SMALL; 01271 } else { 01272 01273 (*CapturedSid) = CaptureBuffer; 01274 } 01275 01276 } else { 01277 01278 (*CapturedSid) = (PSID)ExAllocatePoolWithTag(PoolType, SidSize, 'iSeS'); 01279 01280 if ( *CapturedSid == NULL ) { 01281 return( STATUS_INSUFFICIENT_RESOURCES ); 01282 } 01283 01284 } 01285 01286 // 01287 // Now copy the SID and validate it 01288 // 01289 01290 try { 01291 01292 RtlMoveMemory( (*CapturedSid), InputSid, SidSize ); 01293 ((SID *)(*CapturedSid))->SubAuthorityCount = (UCHAR) GetSidSubAuthorityCount; 01294 01295 } except(EXCEPTION_EXECUTE_HANDLER) { 01296 if (!ARGUMENT_PRESENT(CaptureBuffer)) { 01297 ExFreePool( (*CapturedSid) ); 01298 *CapturedSid = NULL; 01299 } 01300 01301 return GetExceptionCode(); 01302 } 01303 01304 if ((!RtlValidSid( (*CapturedSid) )) ) { 01305 01306 if (!ARGUMENT_PRESENT(CaptureBuffer)) { 01307 ExFreePool( (*CapturedSid) ); 01308 *CapturedSid = NULL; 01309 } 01310 01311 return STATUS_INVALID_SID; 01312 } 01313 01314 return STATUS_SUCCESS; 01315 01316 }

NTSTATUS SeCaptureSidAndAttributesArray (  IN PSID_AND_ATTRIBUTES  InputArray, IN ULONG  ArrayCount, IN KPROCESSOR_MODE  RequestorMode, IN PVOID CaptureBuffer  OPTIONAL, IN ULONG  CaptureBufferLength, IN POOL_TYPE  PoolType, IN BOOLEAN  ForceCapture, OUT PSID_AND_ATTRIBUTES *  CapturedArray, OUT PULONG  AlignedArraySize )

Definition at line 1850 of file se/capture.c. References ExAllocatePoolWithTag, EXCEPTION_EXECUTE_HANDLER, ExFreePool(), FALSE, InputArray, KernelMode, NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, ProbeAndReadUchar, ProbeForRead, RtlLengthRequiredSid(), RtlLengthSid(), RtlValidSid(), and SEP_MAX_GROUP_COUNT. Referenced by NtAdjustGroupsToken(), NtCreateToken(), NtFilterToken(), and PspCaptureTokenFilter(). 01864 : 01865 01866 This routine probes and captures a copy of the specified 01867 SID_AND_ATTRIBUTES array, along with the SID values pointed 01868 to. 01869 01870 The array is either captured into a provided buffer, or pool 01871 allocated to receive the array. 01872 01873 The format of the captured information is an array of SID_AND_ATTRIBUTES 01874 data structures followed by the SID values. THIS MAY NOT BE THE CASE 01875 FOR KERNEL MODE UNLESS A FORCE CAPTURE IS SPECIFIED. 01876 01877 01878 if the requestor mode is not kernel mode then 01879 01880 probe and capture the input array 01881 01882 if the requstor mode is kernel mode then 01883 01884 if force capture is true then 01885 01886 do not probe the input array, but do capture it 01887 01888 else 01889 01890 return address of original, but don't copy 01891 01892 Arguments: 01893 01894 InputArray - Supplies the array to capture. This parameter is assumed 01895 to have been provided by the mode specified in RequestorMode. 01896 01897 ArrayCount - Indicates the number of elements in the array to capture. 01898 01899 RequestorMode - Specifies the caller's access mode. 01900 01901 CaptureBuffer - Specifies a buffer into which the array is to be 01902 captured. If this parameter is not provided, pool will be allocated 01903 to hold the captured data. 01904 01905 CaptureBufferLength - Indicates the length, in bytes, of the capture 01906 buffer. 01907 01908 PoolType - Specifies which pool type to allocate to capture the 01909 array into. This parameter is ignored if CaptureBuffer is provided. 01910 01911 ForceCapture - Specifies whether the array should be captured even if 01912 requestor mode is kernel. 01913 01914 CapturedArray - Supplies the address of a pointer to an array. 01915 The pointer will be set to point to the captured (or uncaptured) array. 01916 01917 AlignedArraySize - Supplies the address of a ULONG to receive the length 01918 of the array rounded up to the next longword boundary. 01919 01920 Return Value: 01921 01922 STATUS_SUCCESS indicates the capture was successful. 01923 01924 STATUS_BUFFER_TOO_SMALL - indicates the buffer provided to capture the array 01925 into wasn't large enough to hold the array. 01926 01927 Any access violations encountered will be returned. 01928 01929 --*/ 01930 01931 { 01932 01933 typedef struct _TEMP_ARRAY_ELEMENT { 01934 PISID Sid; 01935 ULONG SidLength; 01936 } TEMP_ARRAY_ELEMENT; 01937 01938 01939 TEMP_ARRAY_ELEMENT *TempArray; 01940 01941 NTSTATUS CompletionStatus = STATUS_SUCCESS; 01942 01943 ULONG ArraySize; 01944 ULONG AlignedLengthRequired; 01945 01946 ULONG NextIndex; 01947 01948 PSID_AND_ATTRIBUTES NextElement; 01949 PVOID NextBufferLocation; 01950 01951 ULONG GetSidSubAuthorityCount; 01952 ULONG SidSize; 01953 ULONG AlignedSidSize; 01954 01955 PAGED_CODE(); 01956 01957 // 01958 // Make sure the array isn't empty 01959 // 01960 01961 if (ArrayCount == 0) { 01962 (*CapturedArray) = NULL; 01963 (*AlignedArraySize) = 0; 01964 return STATUS_SUCCESS; 01965 } 01966 01967 // 01968 // Check there aren't too many SIDs 01969 // 01970 01971 if (ArrayCount > SEP_MAX_GROUP_COUNT) { 01972 return(STATUS_INVALID_PARAMETER); 01973 } 01974 // 01975 // check if the requestor's mode is kernel mode and we are not 01976 // to force a capture. 01977 // 01978 01979 if ((RequestorMode == KernelMode) && (ForceCapture == FALSE)) { 01980 01981 // 01982 // We don't need to do any work and can simply 01983 // return a pointer to the input array 01984 // 01985 01986 (*CapturedArray) = InputArray; 01987 01988 return STATUS_SUCCESS; 01989 } 01990 01991 01992 // 01993 // ---------- For RequestorMode == UserMode ---------------------- 01994 // 01995 // the algorithm for capturing an SID_AND_ATTRIBUTES array is somewhat 01996 // convoluted to avoid problems that could occur if the data is 01997 // being changed while being captured. 01998 // 01999 // The algorithm uses two loops. 02000 // 02001 // Allocate a temporary buffer to house the fixed length data. 02002 // 02003 // 1st loop: 02004 // For each SID: 02005 // Capture the Pointers to the SID and the length of the SID. 02006 // 02007 // Allocate a buffer large enough to hold all of the data. 02008 // 02009 // 2nd loop: 02010 // For each SID: 02011 // Capture the Attributes. 02012 // Capture the SID. 02013 // Set the pointer to the SID. 02014 // 02015 // Deallocate temporary buffer. 02016 // 02017 // ------------ For RequestorMode == KernelMode -------------------- 02018 // 02019 // There is no need to capture the length and address of the SIDs 02020 // in the first loop (since the kernel can be trusted not to change 02021 // them while they are being copied.) So for kernel mode, the first 02022 // loop just adds up the length needed. Kernel mode, thus, avoids 02023 // having to allocate a temporary buffer. 02024 // 02025 02026 // 02027 // Get the length needed to hold the array elements. 02028 // 02029 02030 ArraySize = ArrayCount * (ULONG)sizeof(SID_AND_ATTRIBUTES); 02031 AlignedLengthRequired = (ULONG)LongAlignSize( ArraySize ); 02032 02033 if (RequestorMode != KernelMode) { 02034 02035 // 02036 // Allocate a temporary array to capture the array elements into 02037 // 02038 02039 TempArray = 02040 (TEMP_ARRAY_ELEMENT *)ExAllocatePoolWithTag(PoolType, AlignedLengthRequired, 'aTeS'); 02041 02042 if ( TempArray == NULL ) { 02043 return( STATUS_INSUFFICIENT_RESOURCES ); 02044 } 02045 02046 02047 try { 02048 02049 // 02050 // Make sure we can read each SID_AND_ATTRIBUTE 02051 // 02052 02053 ProbeForRead( InputArray, 02054 ArraySize, 02055 sizeof(ULONG) ); 02056 02057 // 02058 // Probe and capture the length and address of each SID 02059 // 02060 02061 NextIndex = 0; 02062 while (NextIndex < ArrayCount) { 02063 PSID TempSid; 02064 02065 TempSid = InputArray[NextIndex].Sid; 02066 GetSidSubAuthorityCount = 02067 ProbeAndReadUchar( &((PISID)TempSid)->SubAuthorityCount); 02068 02069 if (GetSidSubAuthorityCount > SID_MAX_SUB_AUTHORITIES) { 02070 CompletionStatus = STATUS_INVALID_SID; 02071 break; 02072 } 02073 02074 TempArray[NextIndex].Sid = ((PISID)(TempSid)); 02075 TempArray[NextIndex].SidLength = 02076 RtlLengthRequiredSid( GetSidSubAuthorityCount ); 02077 02078 ProbeForRead( TempArray[NextIndex].Sid, 02079 TempArray[NextIndex].SidLength, 02080 sizeof(ULONG) ); 02081 02082 AlignedLengthRequired += 02083 (ULONG)LongAlignSize( TempArray[NextIndex].SidLength ); 02084 02085 NextIndex += 1; 02086 02087 } //end while 02088 02089 } except(EXCEPTION_EXECUTE_HANDLER) { 02090 02091 ExFreePool( TempArray ); 02092 return GetExceptionCode(); 02093 } 02094 02095 if (!NT_SUCCESS(CompletionStatus)) { 02096 ExFreePool( TempArray ); 02097 return(CompletionStatus); 02098 } 02099 02100 } else { 02101 02102 // 02103 // No need to capture anything. 02104 // But, we do need to add up the lengths of the SIDs 02105 // so we can allocate a buffer (or check the size of one provided). 02106 // 02107 02108 NextIndex = 0; 02109 02110 while (NextIndex < ArrayCount) { 02111 02112 GetSidSubAuthorityCount = 02113 ((PISID)(InputArray[NextIndex].Sid))->SubAuthorityCount; 02114 02115 AlignedLengthRequired += 02116 (ULONG)LongAlignSize(RtlLengthRequiredSid(GetSidSubAuthorityCount)); 02117 02118 NextIndex += 1; 02119 02120 } //end while 02121 02122 } 02123 02124 02125 // 02126 // Now we know how much memory we need. 02127 // Return this value in the output parameter. 02128 // 02129 02130 (*AlignedArraySize) = AlignedLengthRequired; 02131 02132 // 02133 // If a buffer was provided, make sure it is long enough. 02134 // Otherwise, allocate a buffer. 02135 // 02136 02137 if (ARGUMENT_PRESENT(CaptureBuffer)) { 02138 02139 if (AlignedLengthRequired > CaptureBufferLength) { 02140 02141 if (RequestorMode != KernelMode) { 02142 ExFreePool( TempArray ); 02143 } 02144 02145 return STATUS_BUFFER_TOO_SMALL; 02146 02147 } else { 02148 02149 (*CapturedArray) = CaptureBuffer; 02150 } 02151 02152 } else { 02153 02154 (*CapturedArray) = 02155 (PSID_AND_ATTRIBUTES)ExAllocatePoolWithTag(PoolType, AlignedLengthRequired, 'aSeS'); 02156 02157 if ( *CapturedArray == NULL ) { 02158 if (RequestorMode != KernelMode) { 02159 ExFreePool( TempArray ); 02160 } 02161 return( STATUS_INSUFFICIENT_RESOURCES ); 02162 } 02163 } 02164 02165 02166 // 02167 // Now copy everything. 02168 // This is done by copying all the SID_AND_ATTRIBUTES and then 02169 // copying each individual SID. 02170 // 02171 // All SIDs have already been probed for READ access. We just 02172 // need to copy them. 02173 // 02174 // 02175 02176 if (RequestorMode != KernelMode) { 02177 try { 02178 02179 // 02180 // Copy the SID_AND_ATTRIBUTES array elements 02181 // This really only sets the attributes, since we 02182 // over-write the SID pointer field later on. 02183 // 02184 02185 NextBufferLocation = (*CapturedArray); 02186 RtlMoveMemory( NextBufferLocation, InputArray, ArraySize ); 02187 NextBufferLocation = (PVOID)((ULONG_PTR)NextBufferLocation + 02188 (ULONG)LongAlignSize(ArraySize) ); 02189 02190 // 02191 // Now go through and copy each referenced SID. 02192 // Validate each SID as it is copied. 02193 // 02194 02195 NextIndex = 0; 02196 NextElement = (*CapturedArray); 02197 while ( (NextIndex < ArrayCount) && 02198 (CompletionStatus == STATUS_SUCCESS) ) { 02199 02200 02201 RtlMoveMemory( NextBufferLocation, 02202 TempArray[NextIndex].Sid, 02203 TempArray[NextIndex].SidLength ); 02204 02205 02206 NextElement[NextIndex].Sid = (PSID)NextBufferLocation; 02207 NextBufferLocation = 02208 (PVOID)((ULONG_PTR)NextBufferLocation + 02209 (ULONG)LongAlignSize(TempArray[NextIndex].SidLength)); 02210 02211 // 02212 // Verify the sid is valid and its length didn't change 02213 // 02214 02215 if (!RtlValidSid(NextElement[NextIndex].Sid) ) { 02216 CompletionStatus = STATUS_INVALID_SID; 02217 } else if (RtlLengthSid(NextElement[NextIndex].Sid) != TempArray[NextIndex].SidLength) { 02218 CompletionStatus = STATUS_INVALID_SID; 02219 } 02220 02221 02222 NextIndex += 1; 02223 02224 } //end while 02225 02226 02227 } except(EXCEPTION_EXECUTE_HANDLER) { 02228 02229 if (!ARGUMENT_PRESENT(CaptureBuffer)) { 02230 ExFreePool( (*CapturedArray) ); 02231 } 02232 02233 ExFreePool( TempArray ); 02234 02235 return GetExceptionCode(); 02236 } 02237 } else { 02238 02239 // 02240 // Requestor mode is kernel mode - 02241 // don't need protection, probing, and validating 02242 // 02243 02244 // 02245 // Copy the SID_AND_ATTRIBUTES array elements 02246 // This really only sets the attributes, since we 02247 // over-write the SID pointer field later on. 02248 // 02249 02250 NextBufferLocation = (*CapturedArray); 02251 RtlMoveMemory( NextBufferLocation, InputArray, ArraySize ); 02252 NextBufferLocation = (PVOID)( (ULONG_PTR)NextBufferLocation + 02253 (ULONG)LongAlignSize(ArraySize)); 02254 02255 // 02256 // Now go through and copy each referenced SID 02257 // 02258 02259 NextIndex = 0; 02260 NextElement = (*CapturedArray); 02261 while (NextIndex < ArrayCount) { 02262 02263 GetSidSubAuthorityCount = 02264 ((PISID)(NextElement[NextIndex].Sid))->SubAuthorityCount; 02265 02266 RtlMoveMemory( 02267 NextBufferLocation, 02268 NextElement[NextIndex].Sid, 02269 RtlLengthRequiredSid(GetSidSubAuthorityCount) ); 02270 SidSize = RtlLengthRequiredSid( GetSidSubAuthorityCount ); 02271 AlignedSidSize = (ULONG)LongAlignSize(SidSize); 02272 02273 NextElement[NextIndex].Sid = (PSID)NextBufferLocation; 02274 02275 NextIndex += 1; 02276 NextBufferLocation = (PVOID)((ULONG_PTR)NextBufferLocation + 02277 AlignedSidSize); 02278 02279 } //end while 02280 02281 } 02282 02283 if (RequestorMode != KernelMode) { 02284 ExFreePool( TempArray ); 02285 } 02286 02287 if (!ARGUMENT_PRESENT(CaptureBuffer) && !NT_SUCCESS(CompletionStatus)) { 02288 ExFreePool( (*CapturedArray) ); 02289 *CapturedArray = NULL ; 02290 } 02291 02292 return CompletionStatus; 02293 }

NTKERNELAPI VOID SeCaptureSubjectContext (  OUT PSECURITY_SUBJECT_CONTEXT  SubjectContext  )

Definition at line 46 of file subject.c. References PAGED_CODE, PsGetCurrentProcess, PsGetCurrentThread, PsProcessAuditId, PsReferenceImpersonationToken(), and PsReferencePrimaryToken(). Referenced by CmpNotifyChangeKey(), IsPrivileged(), NtCloseObjectAuditAlarm(), NtDeleteObjectAuditAlarm(), NtOpenObjectAuditAlarm(), NtPrivilegedServiceAuditAlarm(), NtPrivilegeObjectAuditAlarm(), NtSetUuidSeed(), RtlpSetSecurityObject(), SeAccessCheckByType(), SeAuditHandleDuplication(), SeAuditProcessCreation(), SeCheckPrivilegedObject(), SeCloseObjectAuditAlarm(), SeCreateAccessState(), SeDeleteObjectAuditAlarm(), SepAccessCheckAndAuditAlarm(), SeSinglePrivilegeCheck(), and xxxCreateWindowStation(). : This routine takes a snapshot of the calling thread's security context (locking tokens as necessary to do so). This function is intended to support the object manager and other components that utilize the reference monitor's access validation, privilege test, and audit generation services. A subject's security context should be captured before initiating access validation and should be released after audit messages are generated. This is necessary to provide a consistent security context to all those services. After calling access validation, privilege test, and audit generation services, the captured context should be released as soon as possible using the SeReleaseSubjectContext() service. Arguments: SubjectContext - Points to a SECURITY_SUBJECT_CONTEXT data structure to be filled in with a snapshot of the calling thread's security profile. Return Value: none. --*/ { PEPROCESS CurrentProcess; //PVOID Objects[2]; BOOLEAN IgnoreCopyOnOpen; BOOLEAN IgnoreEffectiveOnly; PAGED_CODE(); CurrentProcess = PsGetCurrentProcess(); SubjectContext->ProcessAuditId = PsProcessAuditId( CurrentProcess ); // // Get pointers to primary and impersonation tokens // SubjectContext->ClientToken = PsReferenceImpersonationToken( PsGetCurrentThread(), &IgnoreCopyOnOpen, &IgnoreEffectiveOnly, &(SubjectContext->ImpersonationLevel) ); SubjectContext->PrimaryToken = PsReferencePrimaryToken(CurrentProcess); return; }

BOOLEAN SeCheckAuditPrivilege (  IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext, IN KPROCESSOR_MODE  PreviousMode )

Definition at line 199 of file seaudit.c. References KernelMode, NULL, PAGED_CODE, SeAuditPrivilege, SepPrivilegeCheck(), and SePrivilegedServiceAuditAlarm(). Referenced by NtCloseObjectAuditAlarm(), NtDeleteObjectAuditAlarm(), NtOpenObjectAuditAlarm(), NtPrivilegedServiceAuditAlarm(), NtPrivilegeObjectAuditAlarm(), and SepAccessCheckAndAuditAlarm(). : This routine specifically searches the primary token (rather than the effective token) of the calling process for SeAuditPrivilege. In order to do this it must call the underlying worker SepPrivilegeCheck directly, to ensure that the correct token is searched Arguments: SubjectSecurityContext - The subject being examined. PreviousMode - The previous processor mode. Return Value: Returns TRUE if the subject has SeAuditPrivilege, FALSE otherwise. --*/ { PRIVILEGE_SET RequiredPrivileges; BOOLEAN AccessGranted; PAGED_CODE(); RequiredPrivileges.PrivilegeCount = 1; RequiredPrivileges.Control = PRIVILEGE_SET_ALL_NECESSARY; RequiredPrivileges.Privilege[0].Luid = SeAuditPrivilege; RequiredPrivileges.Privilege[0].Attributes = 0; AccessGranted = SepPrivilegeCheck( SubjectSecurityContext->PrimaryToken, // token RequiredPrivileges.Privilege, // privilege set RequiredPrivileges.PrivilegeCount, // privilege count PRIVILEGE_SET_ALL_NECESSARY, // privilege control PreviousMode // previous mode ); if ( PreviousMode != KernelMode ) { SePrivilegedServiceAuditAlarm ( NULL, // BUGWARNING need service name SubjectSecurityContext, &RequiredPrivileges, AccessGranted ); } return( AccessGranted ); }

BOOLEAN SeCheckPrivilegedObject (  LUID  PrivilegeValue, HANDLE  ObjectHandle, ACCESS_MASK  DesiredAccess, KPROCESSOR_MODE  PreviousMode )

Definition at line 504 of file privileg.c. References KernelMode, PAGED_CODE, SeCaptureSubjectContext(), SePrivilegeCheck(), SePrivilegeObjectAuditAlarm(), and SeReleaseSubjectContext(). Referenced by NtSetInformationJobObject(), NtSetInformationProcess(), NtSetInformationThread(), and PspSetPrimaryToken(). 00513 : 00514 00515 This function will check for the passed privilege value in the 00516 current context, and generate audits as appropriate. 00517 00518 Arguments: 00519 00520 PrivilegeValue - The value of the privilege being checked. 00521 00522 Object - Specifies a pointer to the object being accessed. 00523 00524 ObjectHandle - Specifies the object handle being used. 00525 00526 DesiredAccess - The desired access mask, if any 00527 00528 PreviousMode - The previous processor mode 00529 00530 00531 Return Value: 00532 00533 TRUE - The current subject has the desired privilege. 00534 00535 FALSE - The current subject does not have the desired privilege. 00536 --*/ 00537 00538 { 00539 BOOLEAN AccessGranted; 00540 PRIVILEGE_SET RequiredPrivileges; 00541 SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; 00542 00543 PAGED_CODE(); 00544 00545 // 00546 // Make sure the caller has the privilege to make this 00547 // call. 00548 // 00549 00550 RequiredPrivileges.PrivilegeCount = 1; 00551 RequiredPrivileges.Control = PRIVILEGE_SET_ALL_NECESSARY; 00552 RequiredPrivileges.Privilege[0].Luid = PrivilegeValue; 00553 RequiredPrivileges.Privilege[0].Attributes = 0; 00554 00555 SeCaptureSubjectContext( &SubjectSecurityContext ); 00556 00557 AccessGranted = SePrivilegeCheck( 00558 &RequiredPrivileges, 00559 &SubjectSecurityContext, 00560 PreviousMode 00561 ); 00562 00563 if ( PreviousMode != KernelMode ) { 00564 00565 SePrivilegeObjectAuditAlarm( 00566 ObjectHandle, 00567 &SubjectSecurityContext, 00568 DesiredAccess, 00569 &RequiredPrivileges, 00570 AccessGranted, 00571 PreviousMode 00572 ); 00573 00574 } 00575 00576 00577 SeReleaseSubjectContext( &SubjectSecurityContext ); 00578 00579 return( AccessGranted ); 00580 00581 } }

VOID SeCloseObjectAuditAlarm (  IN PVOID  Object, IN HANDLE  Handle, IN BOOLEAN  GenerateOnClose )

Definition at line 3826 of file seaudit.c. References EffectiveToken, Handle, NTSTATUS(), PAGED_CODE, SeCaptureSubjectContext(), SepAdtCloseObjectAuditAlarm(), SepTokenAuthenticationId, SepTokenUserSid, SeReleaseSubjectContext(), SeSubsystemName, and Status. Referenced by NtClose(). : This routine is used to generate audit and alarm messages when a handle to an object is deleted. This routine may result in several messages being generated and sent to Port objects. This may result in a significant latency before returning. Design of routines that must call this routine must take this potential latency into account. This may have an impact on the approach taken for data structure mutex locking, for example. Arguments: Object - Address of the object being accessed. This value will not be used as a pointer (referenced). It is necessary only to enter into log messages. Handle - Supplies the handle value assigned to the open. GenerateOnClose - Is a boolean value returned from a corresponding SeOpenObjectAuditAlarm() call when the object handle was created. Return Value: None. --*/ { SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; PSID UserSid; NTSTATUS Status; PAGED_CODE(); if (GenerateOnClose) { SeCaptureSubjectContext ( &SubjectSecurityContext ); UserSid = SepTokenUserSid( EffectiveToken (&SubjectSecurityContext)); SepAdtCloseObjectAuditAlarm ( &SeSubsystemName, (PVOID)Handle, Object, UserSid, SepTokenAuthenticationId( EffectiveToken (&SubjectSecurityContext)) ); SeReleaseSubjectContext ( &SubjectSecurityContext ); } return; }

NTSTATUS SeComputeQuotaInformationSize (  IN PSECURITY_DESCRIPTOR  SecurityDescriptor, OUT PULONG  Size )

Definition at line 2350 of file se/capture.c. References Dacl, Group, NULL, PAGED_CODE, SeLengthSid, and Size. Referenced by ObpCaptureObjectCreateInformation(). : This routine computes the size of the Group and DACL for the passed security descriptor. This quantity will later be used in calculating the amount of quota to charge for this object. Arguments: SecurityDescriptor - Supplies a pointer to the security descriptor to be examined. Size - Returns the size in bytes of the sum of the Group and Dacl fields of the security descriptor. Return Value: STATUS_SUCCESS - The operation was successful. STATUS_INVALID_REVISION - The passed security descriptor was of an unknown revision. --*/ { PISECURITY_DESCRIPTOR ISecurityDescriptor; PSID Group; PACL Dacl; PAGED_CODE(); ISecurityDescriptor = (PISECURITY_DESCRIPTOR)SecurityDescriptor; *Size = 0; if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return( STATUS_UNKNOWN_REVISION ); } Group = RtlpGroupAddrSecurityDescriptor( ISecurityDescriptor ); Dacl = RtlpDaclAddrSecurityDescriptor( ISecurityDescriptor ); if (Group != NULL) { *Size += (ULONG)LongAlignSize(SeLengthSid( Group )); } if (Dacl != NULL) { *Size += (ULONG)LongAlignSize(Dacl->AclSize); } return( STATUS_SUCCESS ); }

NTSTATUS SeCopyClientToken (  IN PACCESS_TOKEN  ClientToken, IN SECURITY_IMPERSONATION_LEVEL  ImpersonationLevel, IN KPROCESSOR_MODE  RequestorMode, OUT PACCESS_TOKEN *  DuplicateToken )

Definition at line 1227 of file tokendup.c. References ClientToken, FALSE, NTSTATUS(), NULL, ObjectAttributes, PAGED_CODE, PTOKEN, SepDuplicateToken(), and Status. Referenced by SepCreateClientSecurity(). : This routine copies a client's token as part of establishing a client context for impersonation. The result will be an impersonation token. No handles to the new token are established. The token will be an exact duplicate of the source token. It is the caller's responsibility to ensure an effective only copy of the token is produced when the token is opened, if necessary. Arguments: ClientToken - Points to the token to be duplicated. This may be either a primary or impersonation token. ImpersonationLevel - The impersonation level to be assigned to the new token. RequestorMode - Mode to be assigned as the owner mode of the new token. DuplicateToken - Receives a pointer to the duplicate token. The token has not yet been inserted into any object table. No exceptions are expected when tring to set this OUT value. Return Value: STATUS_SUCCESS - The service successfully completed the requested operation. --*/ { NTSTATUS Status; OBJECT_ATTRIBUTES ObjectAttributes; PTOKEN NewToken; PAGED_CODE(); InitializeObjectAttributes( &ObjectAttributes, NULL, 0, NULL, NULL ); Status = SepDuplicateToken( (PTOKEN)ClientToken, // ExistingToken &ObjectAttributes, // ObjectAttributes FALSE, // EffectiveOnly TokenImpersonation, // TokenType (target) ImpersonationLevel, // ImpersonationLevel RequestorMode, // RequestorMode &NewToken // DuplicateToken ); (*DuplicateToken) = (PACCESS_TOKEN)NewToken; return Status; }

NTKERNELAPI NTSTATUS SeCreateAccessState (  IN PACCESS_STATE  AccessState, IN PAUX_ACCESS_DATA  AuxData, IN ACCESS_MASK  DesiredAccess, IN PGENERIC_MAPPING  GenericMapping )

Definition at line 180 of file seastate.c. References ACCESS_STATE, ASSERT, EffectiveToken, ExAllocateLocallyUniqueId, FALSE, GENERIC_ACCESS, NULL, PAGED_CODE, PTOKEN, RtlMapGenericMask(), SeCaptureSubjectContext(), and TOKEN_HAS_TRAVERSE_PRIVILEGE. Referenced by AccessCheckObject(), NtDuplicateObject(), NtOpenProcess(), NtOpenThread(), ObInsertObject(), ObOpenObjectByName(), ObOpenObjectByPointer(), ObReferenceObjectByName(), and SepCreateToken(). : This routine initializes an ACCESS_STATE structure. This consists of: - zeroing the entire structure - mapping generic access types in the passed DesiredAccess and putting it into the structure - "capturing" the Subject Context, which must be held for the duration of the access attempt (at least until auditing is performed). - Allocating an Operation ID, which is an LUID that will be used to associate different parts of the access attempt in the audit log. Arguments: AccessState - a pointer to the structure to be initialized. AuxData - Supplies a buffer big enough for an AuxData structure so we don't have to allocate one. DesiredAccess - Access mask containing the desired access GenericMapping - Optionally supplies a pointer to a generic mapping that may be used to map any generic access requests that may have been passed in the DesiredAccess parameter. Note that if this parameter is not supplied, it must be filled in at some later point. The IO system does this in IopParseDevice. Return Value: Error if the attempt to allocate an LUID fails. Note that this error may be safely ignored if it is known that all security checks will be performed with PreviousMode == KernelMode. Know what you're doing if you choose to ignore this. --*/ { ACCESS_MASK MappedAccessMask; PSECURITY_DESCRIPTOR InputSecurityDescriptor = NULL; PAGED_CODE(); // // Don't modify what he passed in // MappedAccessMask = DesiredAccess; // // Map generic access to object specific access iff generic access types // are specified and a generic access mapping table is provided. // if ( ((DesiredAccess & GENERIC_ACCESS) != 0) && ARGUMENT_PRESENT(GenericMapping) ) { RtlMapGenericMask( &MappedAccessMask, GenericMapping ); } RtlZeroMemory(AccessState, sizeof(ACCESS_STATE)); // // Assume RtlZeroMemory has initialized these fields properly // ASSERT( AccessState->SecurityDescriptor == NULL ); ASSERT( AccessState->PrivilegesAllocated == FALSE ); AccessState->AuxData = AuxData; SeCaptureSubjectContext(&AccessState->SubjectSecurityContext); if (((PTOKEN)EffectiveToken( &AccessState->SubjectSecurityContext ))->TokenFlags & TOKEN_HAS_TRAVERSE_PRIVILEGE ) { AccessState->Flags = TOKEN_HAS_TRAVERSE_PRIVILEGE; } AccessState->RemainingDesiredAccess = MappedAccessMask; AccessState->OriginalDesiredAccess = MappedAccessMask; AuxData->PrivilegesUsed = (PPRIVILEGE_SET)((ULONG_PTR)AccessState + (FIELD_OFFSET(ACCESS_STATE, Privileges))); ExAllocateLocallyUniqueId(&AccessState->OperationID); if (ARGUMENT_PRESENT(GenericMapping)) { AuxData->GenericMapping = *GenericMapping; } return( STATUS_SUCCESS ); }

NTKERNELAPI NTSTATUS SeCreateClientSecurity (  IN PETHREAD  ClientThread, IN PSECURITY_QUALITY_OF_SERVICE  ClientSecurityQos, IN BOOLEAN  RemoteSession, OUT PSECURITY_CLIENT_CONTEXT  ClientContext )

Definition at line 209 of file seclient.c. References ClientThread(), NTSTATUS(), PAGED_CODE, PsReferenceEffectiveToken(), SepCreateClientSecurity(), Status, and Token. Referenced by CmLoadKey(), MESSAGECALL(), NtImpersonateThread(), and NtSecureConnectPort(). : This service initializes a context block to represent a client's security context. This may simply result in a reference to the client's token, or may cause the client's token to be duplicated, depending upon the security quality of service information specified. NOTE The code in this routine is optimized for DYNAMIC context tracking. This is only mode in which direct access to a caller's token is allowed, and the mode expected to be used most often. STATIC context tracking always requires the caller's token to be copied. Arguments: ClientThread - Points to the client's thread. This is used to locate the client's security context (token). ClientSecurityQos - Points to the security quality of service parameters specified by the client for this communication session. ServerIsRemote - Provides an indication as to whether the session this context block is being used for is an inter-system session or intra-system session. This is reconciled with the impersonation level of the client thread's token (in case the client has a client of his own that didn't specify delegation). ClientContext - Points to the client security context block to be initialized. Return Value: STATUS_SUCCESS - The service completed successfully. STATUS_BAD_IMPERSONATION_LEVEL - The client is currently impersonating either an Anonymous or Identification level token, which can not be passed on for use by another server. This status may also be returned if the security context block is for an inter-system communication session and the client thread is impersonating a client of its own using other than delegation impersonation level. --*/ { NTSTATUS Status = STATUS_SUCCESS; PACCESS_TOKEN Token; TOKEN_TYPE TokenType; BOOLEAN ThreadEffectiveOnly; SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; PACCESS_TOKEN DuplicateToken; PAGED_CODE(); // // Gain access to the client thread's effective token // Token = PsReferenceEffectiveToken( ClientThread, &TokenType, &ThreadEffectiveOnly, &ImpersonationLevel ); Status = SepCreateClientSecurity( Token, ClientSecurityQos, ServerIsRemote, TokenType, ThreadEffectiveOnly, ImpersonationLevel, ClientContext ); return Status ; }

NTKERNELAPI NTSTATUS SeCreateClientSecurityFromSubjectContext (  IN PSECURITY_SUBJECT_CONTEXT  SubjectContext, IN PSECURITY_QUALITY_OF_SERVICE  ClientSecurityQos, IN BOOLEAN  ServerIsRemote, OUT PSECURITY_CLIENT_CONTEXT  ClientContext )

Definition at line 712 of file seclient.c. References FALSE, NTSTATUS(), ObReferenceObject, PAGED_CODE, SepCreateClientSecurity(), SeQuerySubjectContextToken, Status, and Token. : This service initializes a context block to represent a client's security context. This may simply result in a reference to the client's token, or may cause the client's token to be duplicated, depending upon the security quality of service information specified. NOTE The code in this routine is optimized for DYNAMIC context tracking. This is only mode in which direct access to a caller's token is allowed, and the mode expected to be used most often. STATIC context tracking always requires the caller's token to be copied. Arguments: SubjectContext - Points to the SubjectContext that should serve as the basis for this client context. ClientSecurityQos - Points to the security quality of service parameters specified by the client for this communication session. ServerIsRemote - Provides an indication as to whether the session this context block is being used for is an inter-system session or intra-system session. This is reconciled with the impersonation level of the client thread's token (in case the client has a client of his own that didn't specify delegation). ClientContext - Points to the client security context block to be initialized. Return Value: STATUS_SUCCESS - The service completed successfully. STATUS_BAD_IMPERSONATION_LEVEL - The client is currently impersonating either an Anonymous or Identification level token, which can not be passed on for use by another server. This status may also be returned if the security context block is for an inter-system communication session and the client thread is impersonating a client of its own using other than delegation impersonation level. --*/ { NTSTATUS Status = STATUS_SUCCESS; PACCESS_TOKEN Token; TOKEN_TYPE Type; BOOLEAN ThreadEffectiveOnly; SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; PACCESS_TOKEN DuplicateToken; PAGED_CODE(); Token = SeQuerySubjectContextToken( SubjectContext ); ObReferenceObject( Token ); if ( SubjectContext->ClientToken ) { Type = TokenImpersonation ; } else { Type = TokenPrimary ; } Status = SepCreateClientSecurity( Token, ClientSecurityQos, ServerIsRemote, Type, FALSE, SubjectContext->ImpersonationLevel, ClientContext ); return Status ; }

VOID SeCreateInstanceAuditAlarm (  IN PLUID OperationID  OPTIONAL, IN PVOID  Object, IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext, IN ACCESS_MASK  DesiredAccess, IN PPRIVILEGE_SET Privileges  OPTIONAL, IN BOOLEAN  AccessGranted, IN KPROCESSOR_MODE  AccessMode )

VOID SeCreateObjectAuditAlarm (  IN PLUID OperationID  OPTIONAL, IN PVOID  Object, IN PUNICODE_STRING  ComponentName, IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext, IN ACCESS_MASK  DesiredAccess, IN PPRIVILEGE_SET Privileges  OPTIONAL, IN BOOLEAN  AccessGranted, OUT PBOOLEAN  AuditPerformed, IN KPROCESSOR_MODE  AccessMode )

Definition at line 3538 of file seaudit.c. References DirectoryName, EffectiveToken, ExFreePool(), FALSE, KernelMode, NULL, PAGED_CODE, SepAdtAuditThisEvent, SepAdtCreateObjectAuditAlarm(), SepExamineSacl(), SepQueryNameString(), SepTokenAuthenticationId, SepTokenUserSid, and TRUE. Referenced by CmpCheckCreateAccess(), and ObCheckCreateObjectAccess(). : Audits the creation of an object in a directory. Arguments: OperationID - Optionally supplies the LUID representing the operation id for this operation. DirectoryObject - Provides a pointer to the directory object being examined. ComponentName - Provides a pointer to a Unicode string containing the relative name of the object being created. SecurityDescriptor - The security descriptor for the passed direcctory. SubjectSecurityContext - The current subject context. DesiredAccess - The desired access to the directory. Privileges - Returns any privileges that were used for the access attempt. AccessGranted - Returns whether or not the access was successful. AuditPerformed - Returns whether or not auditing was performed. AccessMode - The previous mode. Return Value: return-value - Description of conditions needed to return value. - or - None. --*/ { PAGED_CODE(); #if 0 BOOLEAN GenerateAudit = FALSE; BOOLEAN GenerateAlarm = FALSE; PUNICODE_STRING DirectoryName; POBJECT_NAME_INFORMATION ObjectNameInformation = NULL; UNREFERENCED_PARAMETER( DirectoryObject ); UNREFERENCED_PARAMETER( Privileges ); if (AccessMode == KernelMode) { return; } if ( SecurityDescriptor != NULL ) { if ( SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted )) { SepExamineSacl( RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ), EffectiveToken( SubjectSecurityContext ), DesiredAccess, AccessGranted, &GenerateAudit, &GenerateAlarm ); if ( GenerateAudit || GenerateAlarm ) { // // Call ob for the name of the directory. // ObjectNameInformation = SepQueryNameString( DirectoryObject ); if ( ObjectNameInformation != NULL ) { DirectoryName = &ObjectNameInformation->Name; } SepAdtCreateObjectAuditAlarm( OperationID, DirectoryName, ComponentName, SepTokenUserSid(EffectiveToken( SubjectSecurityContext )), SepTokenAuthenticationId( EffectiveToken( SubjectSecurityContext )), DesiredAccess, AccessGranted, GenerateAudit, GenerateAlarm ); *AuditPerformed = TRUE; if ( DirectoryName != NULL ) { ExFreePool( DirectoryName ); } } } } #endif return; }

VOID SeDeassignPrimaryToken (  IN PEPROCESS  Process  )

Definition at line 302 of file token.c. References ASSERT, FALSE, ObDereferenceObject, PAGED_CODE, and PTOKEN. Referenced by PspDeleteProcessSecurity(), and SeAssignPrimaryToken(). : This function causes a process reference to a token to be dropped. Arguments: Process - Points to the process whose primary token is no longer needed. This is probably only the case at process deletion or when a primary token is being replaced. Return Value: None. --*/ { PTOKEN OldToken = (PTOKEN)(Process->Token); PAGED_CODE(); ASSERT(OldToken->TokenType == TokenPrimary); ASSERT(OldToken->TokenInUse); OldToken->TokenInUse = FALSE; ObDereferenceObject( OldToken ); return; }

NTKERNELAPI NTSTATUS SeDeassignSecurity (  IN OUT PSECURITY_DESCRIPTOR *  SecurityDescriptor  )

Definition at line 373 of file seassign.c. References ExFreePool(), NULL, and PAGED_CODE. Referenced by CmpDoCreateChild(), ObAssignSecurity(), and xxxCreateWindowStation(). : This routine deallocates the memory associated with a security descriptor that was assigned using SeAssignSecurity. Arguments: SecurityDescriptor - Supplies the address of a pointer to the security descriptor being deleted. Return Value: STATUS_SUCCESS - The deallocation was successful. --*/ { PAGED_CODE(); if ((*SecurityDescriptor) != NULL) { ExFreePool( (*SecurityDescriptor) ); } // // And zero out the pointer to it for safety sake // (*SecurityDescriptor) = NULL; return( STATUS_SUCCESS ); }

NTSTATUS SeDefaultObjectMethod (  IN PVOID  Object, IN SECURITY_OPERATION_CODE  OperationCode, IN PSECURITY_INFORMATION  SecurityInformation, IN OUT PSECURITY_DESCRIPTOR  SecurityDescriptor, IN OUT PULONG  Length, IN OUT PSECURITY_DESCRIPTOR *  ObjectsSecurityDescriptor, IN POOL_TYPE  PoolType, IN PGENERIC_MAPPING  GenericMapping )

Definition at line 195 of file semethod.c. References ASSERT, AssignSecurityDescriptor, DeleteSecurityDescriptor, KeBugCheck(), NonPagedPool, NULL, ObAssignObjectSecurityDescriptor(), ObQuerySecurityDescriptorInfo(), ObSetSecurityDescriptorInfo(), PAGED_CODE, PagedPool, QuerySecurityDescriptor, SepDefaultDeleteMethod(), and SetSecurityDescriptor. Referenced by NtDuplicateObject(), ObCreateObjectType(), and TestDefaultObjectMethod(). : This is the default security method for objects. It is responsible for either retrieving, setting, and deleting the security descriptor of an object. It is not used to assign the original security descriptor to an object (use SeAssignSecurity for that purpose). IT IS ASSUMED THAT THE OBJECT MANAGER HAS ALREADY DONE THE ACCESS VALIDATIONS NECESSARY TO ALLOW THE REQUESTED OPERATIONS TO BE PERFORMED. Arguments: Object - Supplies a pointer to the object being used. OperationCode - Indicates if the operation is for setting, querying, or deleting the object's security descriptor. SecurityInformation - Indicates which security information is being queried or set. This argument is ignored for the delete operation. SecurityDescriptor - The meaning of this parameter depends on the OperationCode: QuerySecurityDescriptor - For the query operation this supplies the buffer to copy the descriptor into. The security descriptor is assumed to have been probed up to the size passed in in Length. Since it still points into user space, it must always be accessed in a try clause in case it should suddenly disappear. SetSecurityDescriptor - For a set operation this supplies the security descriptor to copy into the object. The security descriptor must be captured before this routine is called. DeleteSecurityDescriptor - It is ignored when deleting a security descriptor. AssignSecurityDescriptor - For assign operations this is the security descriptor that will be assigned to the object. It is assumed to be in kernel space, and is therefore not probed or captured. CapturedLength - For the query operation this specifies the length, in bytes, of the security descriptor buffer, and upon return contains the number of bytes needed to store the descriptor. If the length needed is greater than the length supplied the operation will fail. It is ignored in the set and delete operation. This parameter is assumed to be captured and probed as appropriate. ObjectsSecurityDescriptor - For the Set operation this supplies the address of a pointer to the object's current security descriptor. This routine will either modify the security descriptor in place or allocate a new security descriptor and use this variable to indicate its new location. For the query operation it simply supplies the security descriptor being queried. The caller is responsible for freeing the old security descriptor. PoolType - For the set operation this specifies the pool type to use if a new security descriptor needs to be allocated. It is ignored in the query and delete operation. the mapping of generic to specific/standard access types for the object being accessed. This mapping structure is expected to be safe to access (i.e., captured if necessary) prior to be passed to this routine. Return Value: NTSTATUS - STATUS_SUCCESS if the operation is successful and an appropriate error status otherwise. --*/ { PAGED_CODE(); // // If the object's security descriptor is null, then object is not // one that has security information associated with it. Return // an error. // // // Make sure the common parts of our input are proper // ASSERT( (OperationCode == SetSecurityDescriptor) || (OperationCode == QuerySecurityDescriptor) || (OperationCode == AssignSecurityDescriptor) || (OperationCode == DeleteSecurityDescriptor) ); // // This routine simply cases off of the operation code to decide // which support routine to call // switch (OperationCode) { case SetSecurityDescriptor: ASSERT( (PoolType == PagedPool) || (PoolType == NonPagedPool) ); return ObSetSecurityDescriptorInfo( Object, SecurityInformation, SecurityDescriptor, ObjectsSecurityDescriptor, PoolType, GenericMapping ); case QuerySecurityDescriptor: // // check the rest of our input and call the default query security // method // ASSERT( CapturedLength != NULL ); return ObQuerySecurityDescriptorInfo( SecurityInformation, SecurityDescriptor, CapturedLength, ObjectsSecurityDescriptor ); case DeleteSecurityDescriptor: // // call the default delete security method // return SepDefaultDeleteMethod( ObjectsSecurityDescriptor ); case AssignSecurityDescriptor: ObAssignObjectSecurityDescriptor( Object, SecurityDescriptor, PoolType ); return( STATUS_SUCCESS ); default: // // Bugcheck on any other operation code, We won't get here if // the earlier asserts are still checked. // KeBugCheck( SECURITY_SYSTEM ); return( STATUS_INVALID_PARAMETER ); } }

NTKERNELAPI VOID SeDeleteAccessState (  IN PACCESS_STATE  AccessState  )

VOID SeDeleteObjectAuditAlarm (  IN PVOID  Object, IN HANDLE  Handle )

Definition at line 3892 of file seaudit.c. References EffectiveToken, Handle, NTSTATUS(), PAGED_CODE, SeCaptureSubjectContext(), SepAdtDeleteObjectAuditAlarm(), SepTokenAuthenticationId, SepTokenUserSid, SeReleaseSubjectContext(), SeSubsystemName, and Status. Referenced by NtDeleteKey(), and NtMakeTemporaryObject(). : This routine is used to generate audit and alarm messages when an object is marked for deletion. This routine may result in several messages being generated and sent to Port objects. This may result in a significant latency before returning. Design of routines that must call this routine must take this potential latency into account. This may have an impact on the approach taken for data structure mutex locking, for example. Arguments: Object - Address of the object being accessed. This value will not be used as a pointer (referenced). It is necessary only to enter into log messages. Handle - Supplies the handle value assigned to the open. Return Value: None. --*/ { SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; PSID UserSid; NTSTATUS Status; PAGED_CODE(); SeCaptureSubjectContext ( &SubjectSecurityContext ); UserSid = SepTokenUserSid( EffectiveToken (&SubjectSecurityContext)); SepAdtDeleteObjectAuditAlarm ( &SeSubsystemName, (PVOID)Handle, Object, UserSid, SepTokenAuthenticationId( EffectiveToken (&SubjectSecurityContext)) ); SeReleaseSubjectContext ( &SubjectSecurityContext ); return; }

NTSTATUS SeExchangePrimaryToken (  IN PEPROCESS  Process, IN PACCESS_TOKEN  NewAccessToken, OUT PACCESS_TOKEN *  OldAccessToken )

Definition at line 346 of file token.c. References ASSERT, FALSE, NTSTATUS(), ObReferenceObject, PAGED_CODE, PTOKEN, Status, and TRUE. Referenced by PspAssignPrimaryToken(). : This function is used to perform the portions of changing a primary token that reference the internals of token structures. The new token is checked to make sure it is not already in use. The !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!! WARNING WARNING WARNING !!!!!!!! !!!!!!!! !!!!!!!! !!!!!!!! THIS ROUTINE MUST BE CALLED WITH THE GOBAL !!!!!!!! !!!!!!!! PROCESS SECURITY FIELDS LOCK HELD !!!!!!!! !!!!!!!! !!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Arguments: Process - Points to the process whose primary token is being exchanged. NewAccessToken - Points to the process's new primary token. OldAccessToken - Receives a pointer to the process's current token. The caller is responsible for dereferencing this token when it is no longer needed. This can't be done while the process security locks are held. Return Value: STATUS_SUCCESS - Everything has been updated. STATUS_TOKEN_ALREADY_IN_USE - A primary token can only be used by a single process. That is, each process must have its own primary token. The token passed to be assigned as the primary token is already in use as a primary token. STATUS_BAD_TOKEN_TYPE - The new token is not a primary token. --*/ { NTSTATUS Status; PTOKEN OldToken = (PTOKEN)(Process->Token); PTOKEN NewToken = (PTOKEN)NewAccessToken; PAGED_CODE(); // // We need to access the security fields of both tokens. // Access to these fields is guarded by the global Process Security // fields lock. // ASSERT(OldToken->TokenType == TokenPrimary); ASSERT(OldToken->TokenInUse); // // Make sure the new token is a primary token... // if ( NewToken->TokenType != TokenPrimary ) { return(STATUS_BAD_TOKEN_TYPE); } // // and that it is not already in use... // if (NewToken->TokenInUse) { return(STATUS_TOKEN_ALREADY_IN_USE); } // // Ensure SessionId consistent for hydra // NewToken->SessionId = OldToken->SessionId ; // // Switch the tokens // Process->Token=NewAccessToken; NewToken->TokenInUse = TRUE; ObReferenceObject(NewToken); // // Mark the token as "NOT USED" // OldToken->TokenInUse = FALSE; // // Return the pointer to the old token. The caller // is responsible for dereferencing it if they don't need it. // (*OldAccessToken) = OldToken; return (STATUS_SUCCESS); }

NTSTATUS SeFastFilterToken (  IN PACCESS_TOKEN  ExistingToken, IN KPROCESSOR_MODE  RequestorMode, IN ULONG  Flags, IN ULONG  GroupCount, IN PSID_AND_ATTRIBUTES GroupsToDisable  OPTIONAL, IN ULONG  PrivilegeCount, IN PLUID_AND_ATTRIBUTES PrivilegesToDelete  OPTIONAL, IN ULONG  SidCount, IN PSID_AND_ATTRIBUTES RestrictedSids  OPTIONAL, IN ULONG  SidLength, OUT PACCESS_TOKEN *  FilteredToken )

Definition at line 1859 of file tokendup.c. References PTOKEN, and SepFilterToken(). Referenced by PsAssignImpersonationToken(), and PsImpersonateClient(). : This is a fast wrapper for the Ps code to filter a token inline of an impersonate. This routine acquires a read lock on the token being filtered. Arguments: ExistingToken - Points to the token to be duplicated. GroupCount - Count of groups to disable GroupsToDisable - Contains a list of sids and attributes. All sids with the USE_FOR_DENY_ONLY attribute that also exist in the token will cause the new token to have that sid set with the USE_FOR_DENY_ONLY attribute. PrivilegeCount - Count of privileges to delete PrivilegesToDelete - Privileges in this list that are present in the existing token will not exist in the final token. This is similar to duplicating a token effective only with these privileges set to disabled. SidCount - Count of restricted sids to add. RestrictedSids - Contains a list of SIDs and attributes that will be stored in the RestrictedSids field of the new token. These SIDs are used after a normal access check to futher restrict access. The attributes of these groups are always SE_GROUP_MANDATORY | SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT. If there already exist RestrictedSids in the original token, these sids will be appended. SidLength - Length of added restricted sids. FilteredToken - Receives a pointer to the duplicate token. The token has not yet been inserted into any object table. No exceptions are expected when tring to set this OUT value. Return Value: STATUS_SUCCESS - The service successfully completed the requested operation. --*/ { return SepFilterToken( (PTOKEN) ExistingToken, RequestorMode, Flags, GroupCount, GroupsToDisable, PrivilegeCount, PrivilegesToDelete, SidCount, RestrictedSids, SidLength, (PTOKEN *) FilteredToken ); }

BOOLEAN SeFastTraverseCheck (  PSECURITY_DESCRIPTOR  SecurityDescriptor, ACCESS_MASK  TraverseAccess, KPROCESSOR_MODE  AccessMode )

Definition at line 3871 of file accessck.c. References Dacl, FALSE, FirstAce, KernelMode, NextAce, NULL, PAGED_CODE, RtlEqualSid(), SeWorldSid, and TRUE. Referenced by IopParseDevice(), ObpCheckTraverseAccess(), ObpProcessDosDeviceSymbolicLink(), and ObSetSecurityDescriptorInfo(). 03878 : 03879 03880 This routine will examine the DACL of the passed Security Descriptor 03881 to see if WORLD has Traverse access. If so, no further access checking 03882 is necessary. 03883 03884 Note that the SubjectContext for the client process does not have 03885 to be locked to make this call, since it does not examine any data 03886 structures in the Token. 03887 03888 Arguments: 03889 03890 SecurityDescriptor - The Security Descriptor protecting the container 03891 object being traversed. 03892 03893 TraverseAccess - Access mask describing Traverse access for this 03894 object type. 03895 03896 AccessMode - Supplies the access mode to be used in the check 03897 03898 03899 Return Value: 03900 03901 TRUE - WORLD has Traverse access to this container. FALSE 03902 otherwise. 03903 03904 --*/ 03905 03906 { 03907 PACL Dacl; 03908 ULONG i; 03909 PVOID Ace; 03910 ULONG AceCount; 03911 03912 PAGED_CODE(); 03913 03914 if ( AccessMode == KernelMode ) { 03915 return( TRUE ); 03916 } 03917 03918 if (SecurityDescriptor == NULL) { 03919 return( FALSE ); 03920 } 03921 03922 // 03923 // See if there is a valid DACL in the passed Security Descriptor. 03924 // No DACL, no security, all is granted. 03925 // 03926 03927 Dacl = RtlpDaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ); 03928 03929 // 03930 // If the SE_DACL_PRESENT bit is not set, the object has no 03931 // security, so all accesses are granted. 03932 // 03933 // Also grant all access if the Dacl is NULL. 03934 // 03935 03936 if ( !RtlpAreControlBitsSet( 03937 (PISECURITY_DESCRIPTOR)SecurityDescriptor, SE_DACL_PRESENT 03938 ) 03939 || (Dacl == NULL)) { 03940 03941 return(TRUE); 03942 } 03943 03944 // 03945 // There is security on this object. If the DACL is empty, 03946 // deny all access immediately 03947 // 03948 03949 if ((AceCount = Dacl->AceCount) == 0) { 03950 03951 return( FALSE ); 03952 } 03953 03954 // 03955 // There's stuff in the DACL, walk down the list and see 03956 // if WORLD has been granted TraverseAccess 03957 // 03958 03959 for ( i = 0, Ace = FirstAce( Dacl ) ; 03960 i < AceCount ; 03961 i++, Ace = NextAce( Ace ) 03962 ) { 03963 03964 if ( !(((PACE_HEADER)Ace)->AceFlags & INHERIT_ONLY_ACE)) { 03965 03966 if ( (((PACE_HEADER)Ace)->AceType == ACCESS_ALLOWED_ACE_TYPE) ) { 03967 03968 if ( (TraverseAccess & ((PACCESS_ALLOWED_ACE)Ace)->Mask) ) { 03969 03970 if ( RtlEqualSid( SeWorldSid, &((PACCESS_ALLOWED_ACE)Ace)->SidStart ) ) { 03971 03972 return( TRUE ); 03973 } 03974 } 03975 03976 } else { 03977 03978 if ( (((PACE_HEADER)Ace)->AceType == ACCESS_DENIED_ACE_TYPE) ) { 03979 03980 if ( (TraverseAccess & ((PACCESS_DENIED_ACE)Ace)->Mask) ) { 03981 03982 if ( RtlEqualSid( SeWorldSid, &((PACCESS_DENIED_ACE)Ace)->SidStart ) ) { 03983 03984 return( FALSE ); 03985 } 03986 } 03987 } 03988 } 03989 } 03990 } 03991 03992 return( FALSE ); 03993 } }

NTSTATUS SeFilterToken (  IN PACCESS_TOKEN  ExistingToken, IN ULONG  Flags, IN PTOKEN_GROUPS SidsToDisable  OPTIONAL, IN PTOKEN_PRIVILEGES PrivilegesToDelete  OPTIONAL, IN PTOKEN_GROUPS RestrictedSids  OPTIONAL, OUT PACCESS_TOKEN *  FilteredToken )

Definition at line 1634 of file tokendup.c. References DbgPrint, Index, KernelMode, KPROCESSOR_MODE, NT_SUCCESS, NtClose(), NTSTATUS(), NULL, ObInsertObject(), ObReferenceObjectByHandle(), PAGED_CODE, PTOKEN, SepAcquireTokenReadLock, SepFilterToken(), SepReleaseTokenReadLock, SepTokenObjectType, Status, Token, and VOID(). : Create a new token that is a subset of an existing token. Arguments: ExistingToken - Is a token already open for TOKEN_DUPLICATE access. Flags - Flags indicating additional filtering. The flags may be: DISABLE_ALL_GROUPS - disable all groups in token DELETE_ALL_PRIVILEGES - Disable all privileges SidsToDisable - Contains a list of sids and attributes. All sids with the USE_FOR_DENY_ONLY attribute that also exist in the token will cause the new token to have that sid set with the USE_FOR_DENY_ONLY attribte. PrivilegesToDelete - Privileges in this list that are present in the existing token will not exist in the final token. This is similar to duplicating a token effective only with these privileges set to disabled. RestrictedSids - Contains a list of SIDs and attributes that will be stored in the RestrictedSids field of the new token. These SIDs are used after a normal access check to futher restrict access. The attributes of these groups are always SE_GROUP_MANDATORY | SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT. If there already exist RestrictedSids in the original token, these sids will be appended. NewToken - Receives a pointer to the newly created token. Return Value: STATUS_SUCCESS - Indicates the operation was successful. STATUS_INVALID_PARAMETER - Indicates one or more of the parameter values was invalid. This value is returned if the target token is not an impersonation token. --*/ { PTOKEN Token; PTOKEN FilteredToken = NULL; KPROCESSOR_MODE PreviousMode; NTSTATUS Status = STATUS_SUCCESS; ULONG Index; ULONG CapturedSidCount = 0; PSID_AND_ATTRIBUTES CapturedSids = NULL; ULONG CapturedSidsLength = 0; ULONG CapturedGroupCount = 0; PSID_AND_ATTRIBUTES CapturedGroups = NULL; ULONG CapturedGroupsLength = 0; ULONG CapturedPrivilegeCount = 0; PLUID_AND_ATTRIBUTES CapturedPrivileges = NULL; ULONG CapturedPrivilegesLength = 0; HANDLE LocalHandle; OBJECT_HANDLE_INFORMATION HandleInformation; ACCESS_MASK EffectiveDesiredAccess; PAGED_CODE(); PreviousMode = KeGetPreviousMode(); // // Probe parameters // *NewToken = NULL; // // Capture Sids to remove // if (ARGUMENT_PRESENT(SidsToDisable)) { CapturedGroupCount = SidsToDisable->GroupCount; CapturedGroups = SidsToDisable->Groups; } // // Capture PrivilegesToDelete // if (ARGUMENT_PRESENT(PrivilegesToDelete)) { CapturedPrivilegeCount = PrivilegesToDelete->PrivilegeCount; CapturedPrivileges = PrivilegesToDelete->Privileges; } // // Capture Restricted Sids // if (ARGUMENT_PRESENT(RestrictedSids)) { CapturedSidCount = RestrictedSids->GroupCount; CapturedSids = RestrictedSids->Groups; // // Check that the attribtes are all zero for the restricted sids // for (Index = 0; Index < CapturedSidCount ; Index++ ) { if (CapturedSids[Index].Attributes != 0) { return(STATUS_INVALID_PARAMETER); } } } // // Check the handle's access to the existing token and get // a pointer to that token. Pick up the default desired // access mask from the handle while we're at it. // Token = (PTOKEN) ExistingToken; #ifdef TOKEN_DEBUG // // Debug SepAcquireTokenReadLock( Token ); DbgPrint("\n"); DbgPrint("\n"); DbgPrint("Token being filtered: \n"); SepDumpToken( Token ); SepReleaseTokenReadLock( Token ); // Debug // #endif //TOKEN_DEBUG // // Filter the existing token // Status = SepFilterToken( Token, KernelMode, Flags, CapturedGroupCount, CapturedGroups, CapturedPrivilegeCount, CapturedPrivileges, CapturedSidCount, CapturedSids, CapturedSidsLength, &FilteredToken ); if (NT_SUCCESS(Status)) { // // Insert the new token // Status = ObInsertObject( FilteredToken, NULL, 0, 0, (PVOID *)NULL, &LocalHandle ); if (!NT_SUCCESS( Status )) { #ifdef TOKEN_DEBUG DbgPrint( "SE: ObInsertObject failed (%x) for token at %x\n", Status, NewToken ); #endif } else { Status = ObReferenceObjectByHandle( LocalHandle, TOKEN_IMPERSONATE, SepTokenObjectType, KernelMode, (PVOID * ) NewToken, NULL // granted acess ); (VOID) NtClose(LocalHandle); } } else if (NewToken != NULL) { #ifdef TOKEN_DEBUG DbgPrint( "SE: SepFilterToken failed (%x) but allocated token at %x\n", Status, NewToken ); #endif } return Status; }

VOID SeFreeCapturedSecurityQos (  IN PVOID  SecurityQos  )

Definition at line 910 of file se/capture.c. References ExFreePool(), NULL, PAGED_CODE, SecurityQos, and SepFreeProxyData(). Referenced by NtCreateToken(), and NtDuplicateToken(). : This routine frees the data associated with a captured SecurityQos structure. It does not free the body of the structure, just whatever its internal fields point to. Arguments: SecurityQos - Points to a captured security QOS structure. Return Value: None. --*/ { PSECURITY_ADVANCED_QUALITY_OF_SERVICE IAdvancedSecurityQos; PAGED_CODE(); IAdvancedSecurityQos = (PSECURITY_ADVANCED_QUALITY_OF_SERVICE)SecurityQos; if (IAdvancedSecurityQos->Length == sizeof( SECURITY_ADVANCED_QUALITY_OF_SERVICE )) { if (IAdvancedSecurityQos->AuditData != NULL) { ExFreePool( IAdvancedSecurityQos->AuditData ); } SepFreeProxyData( IAdvancedSecurityQos->ProxyData ); } return; }

NTKERNELAPI VOID SeFreePrivileges (  IN PPRIVILEGE_SET  Privileges  )

Definition at line 3294 of file accessck.c. References ExFreePool(), and PAGED_CODE. Referenced by IopParseDevice(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObpCheckTraverseAccess(), and SeAccessCheckByType(). : This routine frees a privilege set returned by SeAccessCheck. Arguments: Privileges - Supplies a pointer to the privilege set to be freed. Return Value: None. --*/ { PAGED_CODE(); ExFreePool( Privileges ); }

VOID SeGenerateMessage (  IN PSTRING  ObjectName, IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PACCESS_TOKEN  Token, IN ACCESS_MASK  DesiredAccess, IN BOOLEAN  AccessGranted, IN HANDLE  AuditPort, IN HANDLE  AlarmPort, IN KPROCESSOR_MODE  AccessMode )

VOID SeGetTokenControlInformation (  IN PACCESS_TOKEN  Token, OUT PTOKEN_CONTROL  TokenControl )

Definition at line 475 of file token.c. References PAGED_CODE, PTOKEN, SepAcquireTokenReadLock, SepReleaseTokenReadLock, and Token. Referenced by SepCreateClientSecurity(). 00482 : 00483 00484 This routine is provided for communication session layers, or 00485 any other executive component that needs to keep track of 00486 whether a caller's security context has changed between calls. 00487 Communication session layers will need to check this, for some 00488 security quality of service modes, to determine whether or not 00489 a server's security context needs to be updated to reflect 00490 changes in the client's security context. 00491 00492 This routine will also be useful to communications subsystems 00493 that need to retrieve client' authentication information from 00494 the local security authority in order to perform a remote 00495 authentication. 00496 00497 00498 Parameters: 00499 00500 Token - Points to the token whose information is to be retrieved. 00501 00502 TokenControl - Points to the buffer to receive the token control 00503 information. 00504 00505 Return Value: 00506 00507 None. 00508 00509 --*/ 00510 00511 { 00512 PAGED_CODE(); 00513 00514 // 00515 // acquire exclusive access to the token 00516 // 00517 00518 SepAcquireTokenReadLock( (PTOKEN)Token ); 00519 00520 // 00521 // Grab the data and run 00522 // 00523 00524 TokenControl->TokenId = ((TOKEN *)Token)->TokenId; 00525 TokenControl->AuthenticationId = ((TOKEN *)Token)->AuthenticationId; 00526 TokenControl->ModifiedId = ((TOKEN *)Token)->ModifiedId; 00527 TokenControl->TokenSource = ((TOKEN *)Token)->TokenSource; 00528 00529 SepReleaseTokenReadLock( (PTOKEN)Token ); 00530 00531 return; 00532 00533 }

NTKERNELAPI VOID SeImpersonateClient (  IN PSECURITY_CLIENT_CONTEXT  ClientContext, IN PETHREAD ServerThread  OPTIONAL )

Definition at line 593 of file seclient.c. References DbgPrint, PAGED_CODE, SeImpersonateClientEx(), ServerThread(), and VOID(). : This service is used to cause the calling thread to impersonate a client. The client security context in ClientContext is assumed to be up to date. Arguments: ClientContext - Points to client security context block. ServerThread - (Optional) Specifies the thread which is to be made to impersonate the client. If not specified, the calling thread is used. Return Value: None. --*/ { PAGED_CODE(); #if DBG DbgPrint("SE: Obsolete call: SeImpersonateClient\n"); #endif (VOID) SeImpersonateClientEx( ClientContext, ServerThread ); }

NTKERNELAPI NTSTATUS SeImpersonateClientEx (  IN PSECURITY_CLIENT_CONTEXT  ClientContext, IN PETHREAD ServerThread  OPTIONAL )

Definition at line 636 of file seclient.c. References NTSTATUS(), PAGED_CODE, PsGetCurrentThread, PsImpersonateClient(), ServerThread(), Status, and TRUE. Referenced by _ImpersonateDdeClientWindow(), CmpWorker(), NtImpersonateClientOfPort(), NtImpersonateThread(), and SeImpersonateClient(). : This service is used to cause the calling thread to impersonate a client. The client security context in ClientContext is assumed to be up to date. Arguments: ClientContext - Points to client security context block. ServerThread - (Optional) Specifies the thread which is to be made to impersonate the client. If not specified, the calling thread is used. Return Value: None. --*/ { BOOLEAN EffectiveValueToUse; PETHREAD Thread; NTSTATUS Status ; PAGED_CODE(); if (ClientContext->DirectlyAccessClientToken) { EffectiveValueToUse = ClientContext->DirectAccessEffectiveOnly; } else { EffectiveValueToUse = ClientContext->SecurityQos.EffectiveOnly; } // // if a ServerThread wasn't specified, then default to the current // thread. // if (!ARGUMENT_PRESENT(ServerThread)) { Thread = PsGetCurrentThread(); } else { Thread = ServerThread; } // // Assign the context to the calling thread // Status = PsImpersonateClient( Thread, ClientContext->ClientToken, TRUE, EffectiveValueToUse, ClientContext->SecurityQos.ImpersonationLevel ); return Status ; }

BOOLEAN SeInitSystem (  VOID   )

Definition at line 41 of file seinit.c. References InitializationPhase, KeBugCheck(), PAGED_CODE, SepInitializationPhase0(), and SepInitializationPhase1(). 00045 : 00046 00047 Perform security related system initialization functions. 00048 00049 Arguments: 00050 00051 None. 00052 00053 Return Value: 00054 00055 TRUE - Initialization succeeded. 00056 00057 FALSE - Initialization failed. 00058 00059 --*/ 00060 00061 { 00062 PAGED_CODE(); 00063 00064 switch ( InitializationPhase ) { 00065 00066 case 0 : 00067 return SepInitializationPhase0(); 00068 case 1 : 00069 return SepInitializationPhase1(); 00070 default: 00071 KeBugCheck(UNEXPECTED_INITIALIZATION_CALL); 00072 } 00073 return 0; // Bash compiler warning 00074 }

NTSTATUS SeIsChildToken (  IN HANDLE  Token, OUT PBOOLEAN  IsChild )

Definition at line 2867 of file token.c. References FALSE, IsChild(), NT_SUCCESS, NTSTATUS(), NULL, ObDereferenceObject, ObReferenceObjectByHandle(), PsDereferencePrimaryToken, PsGetCurrentProcess, PsReferencePrimaryToken(), PTOKEN, RtlEqualLuid(), SepAcquireTokenReadLock, SepReleaseTokenReadLock, SepTokenObjectType, Status, Token, and TRUE. : This routine returns TRUE if the supplied token is a child of the caller's process token. This is done by comparing the ParentTokenId field of the supplied token to the TokenId field of the token from the current subject context. Arguments: Token - Token to check for childhood IsChild - Contains results of comparison. TRUE - The supplied token is a child of the caller's token FALSE- The supplied token is not a child of the caller's token Returns: Status codes from any NT services called. --*/ { PTOKEN CallerToken; PTOKEN SuppliedToken; LUID CallerTokenId; LUID SuppliedParentTokenId; NTSTATUS Status = STATUS_SUCCESS; *IsChild = FALSE; // // Capture the caller's token and get the token id // CallerToken = (PTOKEN) PsReferencePrimaryToken(PsGetCurrentProcess()); SepAcquireTokenReadLock( CallerToken ); CallerTokenId = CallerToken->TokenId; SepReleaseTokenReadLock( CallerToken ); PsDereferencePrimaryToken(CallerToken); // // Reference the supplied token and get the parent token id. // Status = ObReferenceObjectByHandle( Token, // Handle 0, // DesiredAccess SepTokenObjectType, // ObjectType KeGetPreviousMode(), // AccessMode (PVOID *)&SuppliedToken, // Object NULL // GrantedAccess ); if (NT_SUCCESS(Status)) { SepAcquireTokenReadLock( SuppliedToken ); SuppliedParentTokenId = SuppliedToken->ParentTokenId; SepReleaseTokenReadLock( SuppliedToken ); ObDereferenceObject(SuppliedToken); // // Check to see if the supplied token's parent ID is the ID // of the caller. // if (RtlEqualLuid( &SuppliedParentTokenId, &CallerTokenId )) { *IsChild = TRUE; } } return(Status); }

NTSTATUS SeIsChildTokenByPointer (  IN PACCESS_TOKEN  Token, OUT PBOOLEAN  IsChild )

Definition at line 2960 of file token.c. References FALSE, IsChild(), NTSTATUS(), PsDereferencePrimaryToken, PsGetCurrentProcess, PsReferencePrimaryToken(), PTOKEN, RtlEqualLuid(), SepAcquireTokenReadLock, SepReleaseTokenReadLock, Status, Token, and TRUE. Referenced by NtSetInformationJobObject(), and PspSetPrimaryToken(). : This routine returns TRUE if the supplied token is a child of the caller's token. This is done by comparing the ParentTokenId field of the supplied token to the TokenId field of the token from the current subject context. Arguments: Token - Token to check for childhood IsChild - Contains results of comparison. TRUE - The supplied token is a child of the caller's token FALSE- The supplied token is not a child of the caller's token Returns: Status codes from any NT services called. --*/ { SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; PTOKEN CallerToken; PTOKEN SuppliedToken; LUID CallerTokenId; LUID SuppliedParentTokenId; NTSTATUS Status = STATUS_SUCCESS; *IsChild = FALSE; // // Capture the caller's token and get the token id // CallerToken = (PTOKEN) PsReferencePrimaryToken(PsGetCurrentProcess()); SepAcquireTokenReadLock( CallerToken ); CallerTokenId = CallerToken->TokenId; SepReleaseTokenReadLock( CallerToken ); PsDereferencePrimaryToken(CallerToken); SuppliedToken = (PTOKEN) Token ; SepAcquireTokenReadLock( SuppliedToken ); SuppliedParentTokenId = SuppliedToken->ParentTokenId; SepReleaseTokenReadLock( SuppliedToken ); // // Check to see if the supplied token's parent ID is the ID // of the caller. // if (RtlEqualLuid( &SuppliedParentTokenId, &CallerTokenId )) { *IsChild = TRUE; } return(Status); }

NTKERNELAPI VOID SeLockSubjectContext (  IN PSECURITY_SUBJECT_CONTEXT  SubjectContext  )

Definition at line 115 of file subject.c. References PAGED_CODE, PTOKEN, and SepAcquireTokenReadLock. Referenced by CmpCheckCreateAccess(), CmpCheckNotifyAccess(), IopParseDevice(), IsPrivileged(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), RtlpNewSecurityObject(), SeAccessCheck(), SepAccessCheckAndAuditAlarm(), SeQueryAuthenticationIdSubjectContext(), SeTraverseAuditAlarm(), and xxxCreateWindowStation(). : Acquires READ LOCKS on the primary and impersonation tokens in the passed SubjectContext. This call must be undone by a call to SeUnlockSubjectContext(). No one outside of the SE component should need to acquire a write lock to a token. Therefore there is no public interface to do this. Arguments: SubjectContext - Points to a SECURITY_SUBJECT_CONTEXT data structure which points to a primary token and an optional impersonation token. Return Value: None --*/ { PAGED_CODE(); SepAcquireTokenReadLock((PTOKEN)(SubjectContext->PrimaryToken)); if (ARGUMENT_PRESENT(SubjectContext->ClientToken)) { SepAcquireTokenReadLock((PTOKEN)(SubjectContext->ClientToken)); } return; }

PACCESS_TOKEN SeMakeAnonymousLogonToken (   )

Referenced by SepInitializationPhase1().

PACCESS_TOKEN SeMakeSystemToken (   )

Definition at line 536 of file token.c. References ASSERT, Buffer, DbgPrint, ExAllocatePoolWithTag, ExFreePool(), FALSE, KernelMode, NoExpiration, NormalGroupAttributes, NT_SUCCESS, NTSTATUS(), NULL, ObAssignObjectSecurityDescriptor(), ObDereferenceObject, Owner, OwnerGroupAttributes, PAGED_CODE, PagedPool, RtlAbsoluteToSelfRelativeSD(), RtlAddAccessAllowedAce(), RtlCreateAcl(), RtlCreateSecurityDescriptor(), RtlSetDaclSecurityDescriptor(), RtlSetGroupSecurityDescriptor(), RtlSetOwnerSecurityDescriptor(), RtlTimeFieldsToTime(), SeAliasAdminsSid, SeAssignPrimaryTokenPrivilege, SeAuditPrivilege, SeAuthenticatedUsersSid, SeBackupPrivilege, SeChangeNotifyPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeCreateTokenPrivilege, SeDebugPrivilege, SeIncreaseBasePriorityPrivilege, SeIncreaseQuotaPrivilege, SeLengthSid, SeLoadDriverPrivilege, SeLocalSystemSid, SeLockMemoryPrivilege, SepCreateToken(), SeProfileSingleProcessPrivilege, SeRestorePrivilege, SeSecurityPrivilege, SeShutdownPrivilege, SeSystemAuthenticationId, SeSystemDefaultDacl, SeSystemEnvironmentPrivilege, SeSystemtimePrivilege, SeSystemTokenSource, SeTakeOwnershipPrivilege, SeTcbPrivilege, SeUndockPrivilege, SeWorldSid, Status, TimeFields, Token, and TRUE. Referenced by SepInitializationPhase0(), and TestMakeSystemToken(). : This routine is provided for use by executive components DURING SYSTEM INITIALIZATION ONLY. It creates a token for use by system components. A system token has the following characteristics: - It has LOCAL_SYSTEM as its user ID - It has the following groups with the corresponding attributes: ADMINS_ALIAS EnabledByDefault | Enabled | Owner WORLD EnabledByDefault | Enabled | Mandatory ADMINISTRATORS (alias) Owner (disabled) AUTHENTICATED_USER EnabledByDefault | Enabled | Mandatory - It has LOCAL_SYSTEM as its primary group. - It has the privileges shown in comments below. - It has protection that provides TOKEN_ALL_ACCESS to the LOCAL_SYSTEM ID. - It has a default ACL that grants GENERIC_ALL access to LOCAL_SYSTEM and GENERIC_EXECUTE to WORLD. Parameters: None. Return Value: Pointer to a system token. --*/ { NTSTATUS Status; PVOID Token; SID_AND_ATTRIBUTES UserId; TOKEN_PRIMARY_GROUP PrimaryGroup; PSID_AND_ATTRIBUTES GroupIds; ULONG GroupIdsLength; LUID_AND_ATTRIBUTES Privileges[30]; PACL TokenAcl; PSID Owner; ULONG NormalGroupAttributes; ULONG OwnerGroupAttributes; ULONG Length; OBJECT_ATTRIBUTES TokenObjectAttributes; PSECURITY_DESCRIPTOR TokenSecurityDescriptor; ULONG BufferLength; PVOID Buffer; ULONG_PTR GroupIdsBuffer[128 * sizeof(ULONG) / sizeof(ULONG_PTR)]; TIME_FIELDS TimeFields; LARGE_INTEGER NoExpiration; PAGED_CODE(); // // Make sure only one system token gets created. // #if DBG ASSERT( !SystemTokenCreated ); SystemTokenCreated = TRUE; #endif //DBG // // Set up expiration times // TimeFields.Year = 3000; TimeFields.Month = 1; TimeFields.Day = 1; TimeFields.Hour = 1; TimeFields.Minute = 1; TimeFields.Second = 1; TimeFields.Milliseconds = 1; TimeFields.Weekday = 1; RtlTimeFieldsToTime( &TimeFields, &NoExpiration ); // // // // The amount of memory used in the following is gross overkill, but // // it is freed up immediately after creating the token. // // // // GroupIds = (PSID_AND_ATTRIBUTES)ExAllocatePool( NonPagedPool, 512 ); GroupIds = (PSID_AND_ATTRIBUTES)GroupIdsBuffer; // // Set up the attributes to be assigned to groups // NormalGroupAttributes = (SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED ); OwnerGroupAttributes = (SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED | SE_GROUP_OWNER ); // // Set up the user ID // UserId.Sid = SeLocalSystemSid; UserId.Attributes = 0; // // Set up the groups // GroupIds->Sid = SeAliasAdminsSid; (GroupIds+1)->Sid = SeWorldSid; (GroupIds+2)->Sid = SeAuthenticatedUsersSid; GroupIds->Attributes = OwnerGroupAttributes; (GroupIds+1)->Attributes = NormalGroupAttributes; (GroupIds+2)->Attributes = NormalGroupAttributes; GroupIdsLength = (ULONG)LongAlignSize(SeLengthSid(GroupIds->Sid)) + (ULONG)LongAlignSize(SeLengthSid((GroupIds+1)->Sid)) + (ULONG)LongAlignSize(SeLengthSid((GroupIds+2)->Sid)) + sizeof(SID_AND_ATTRIBUTES); ASSERT( GroupIdsLength <= 128 * sizeof(ULONG) ); // // Privileges // // // The privileges in the system token are as follows: // // Privilege Name Attributes // -------------- ---------- // // SeTcbPrivilege enabled/enabled by default // SeCreateTokenPrivilege DISabled/NOT enabled by default // SeTakeOwnershipPrivilege DISabled/NOT enabled by default // SeCreatePagefilePrivilege enabled/enabled by default // SeLockMemoryPrivilege enabled/enabled by default // SeAssignPrimaryTokenPrivilege DISabled/NOT enabled by default // SeIncreaseQuotaPrivilege DISabled/NOT enabled by default // SeIncreaseBasePriorityPrivilege enabled/enabled by default // SeCreatePermanentPrivilege enabled/enabled by default // SeDebugPrivilege enabled/enabled by default // SeAuditPrivilege enabled/enabled by default // SeSecurityPrivilege DISabled/NOT enabled by default // SeSystemEnvironmentPrivilege DISabled/NOT enabled by default // SeChangeNotifyPrivilege enabled/enabled by default // SeBackupPrivilege DISabled/NOT enabled by default // SeRestorePrivilege DISabled/NOT enabled by default // SeShutdownPrivilege DISabled/NOT enabled by default // SeLoadDriverPrivilege DISabled/NOT enabled by default // SeProfileSingleProcessPrivilege enabled/enabled by default // SeSystemtimePrivilege DISabled/NOT enabled by default // SeUndockPrivilege DISabled/NOT enabled by default // // The following privileges are not present, and should never be present in // the local system token: // // SeRemoteShutdownPrivilege no one can come in as local system // SeSyncAgentPrivilege only users specified by the admin can // be sync agents // SeEnableDelegationPrivilege only users specified by the admin can // enable delegation on accounts. // Privileges[0].Luid = SeTcbPrivilege; Privileges[0].Attributes = (SE_PRIVILEGE_ENABLED_BY_DEFAULT | // Enabled by default SE_PRIVILEGE_ENABLED); // Enabled Privileges[1].Luid = SeCreateTokenPrivilege; Privileges[1].Attributes = 0; // Only the LSA should enable this. Privileges[2].Luid = SeTakeOwnershipPrivilege; Privileges[2].Attributes = 0; Privileges[3].Luid = SeCreatePagefilePrivilege; Privileges[3].Attributes = (SE_PRIVILEGE_ENABLED_BY_DEFAULT | // Enabled by default SE_PRIVILEGE_ENABLED); // Enabled Privileges[4].Luid = SeLockMemoryPrivilege; Privileges[4].Attributes = (SE_PRIVILEGE_ENABLED_BY_DEFAULT | // Enabled by default SE_PRIVILEGE_ENABLED); // Enabled Privileges[5].Luid = SeAssignPrimaryTokenPrivilege; Privileges[5].Attributes = 0; // disabled, not enabled by default Privileges[6].Luid = SeIncreaseQuotaPrivilege; Privileges[6].Attributes = 0; // disabled, not enabled by default Privileges[7].Luid = SeIncreaseBasePriorityPrivilege; Privileges[7].Attributes = (SE_PRIVILEGE_ENABLED_BY_DEFAULT | // Enabled by default SE_PRIVILEGE_ENABLED); // Enabled Privileges[8].Luid = SeCreatePermanentPrivilege; Privileges[8].Attributes = (SE_PRIVILEGE_ENABLED_BY_DEFAULT | // Enabled by default SE_PRIVILEGE_ENABLED); // Enabled Privileges[9].Luid = SeDebugPrivilege; Privileges[9].Attributes = (SE_PRIVILEGE_ENABLED_BY_DEFAULT | // Enabled by default SE_PRIVILEGE_ENABLED); // Enabled Privileges[10].Luid = SeAuditPrivilege; Privileges[10].Attributes = (SE_PRIVILEGE_ENABLED_BY_DEFAULT | // Enabled by default SE_PRIVILEGE_ENABLED); // Enabled Privileges[11].Luid = SeSecurityPrivilege; Privileges[11].Attributes = 0; // disabled, not enabled by default Privileges[12].Luid = SeSystemEnvironmentPrivilege; Privileges[12].Attributes = 0; // disabled, not enabled by default Privileges[13].Luid = SeChangeNotifyPrivilege; Privileges[13].Attributes = (SE_PRIVILEGE_ENABLED_BY_DEFAULT | // Enabled by default SE_PRIVILEGE_ENABLED); // Enabled Privileges[14].Luid = SeBackupPrivilege; Privileges[14].Attributes = 0; // disabled, not enabled by default Privileges[15].Luid = SeRestorePrivilege; Privileges[15].Attributes = 0; // disabled, not enabled by default Privileges[16].Luid = SeShutdownPrivilege; Privileges[16].Attributes = 0; // disabled, not enabled by default Privileges[17].Luid = SeLoadDriverPrivilege; Privileges[17].Attributes = 0; // disabled, not enabled by default Privileges[18].Luid = SeProfileSingleProcessPrivilege; Privileges[18].Attributes = (SE_PRIVILEGE_ENABLED_BY_DEFAULT | // Enabled by default SE_PRIVILEGE_ENABLED); // Enabled Privileges[19].Luid = SeSystemtimePrivilege; Privileges[19].Attributes = 0; // disabled, not enabled by default Privileges[20].Luid = SeUndockPrivilege ; Privileges[20].Attributes = 0 ; // disabled, not enabled by default //BEFORE ADDING ANOTHER PRIVILEGE ^^ HERE ^^ CHECK THE ARRAY BOUND //ALSO INCREMENT THE PRIVILEGE COUNT IN THE SepCreateToken() call // // Establish the primary group and default owner // PrimaryGroup.PrimaryGroup = SeLocalSystemSid; // Primary group Owner = SeAliasAdminsSid; // Default owner // // Set up an ACL to protect token as well ... // give system full reign of terror. This includes user-mode components // running as part of the system. // Length = (ULONG)sizeof(ACL) + ((ULONG)sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG)) + SeLengthSid( SeLocalSystemSid ) ; TokenAcl = (PACL)ExAllocatePoolWithTag(PagedPool, Length, 'cAeS'); if ( TokenAcl == NULL ) { return NULL ; } Status = RtlCreateAcl( TokenAcl, Length, ACL_REVISION2); ASSERT( NT_SUCCESS(Status) ); Status = RtlAddAccessAllowedAce ( TokenAcl, ACL_REVISION2, TOKEN_ALL_ACCESS, SeLocalSystemSid ); ASSERT( NT_SUCCESS(Status) ); TokenSecurityDescriptor = (PSECURITY_DESCRIPTOR)ExAllocatePoolWithTag( PagedPool, sizeof(SECURITY_DESCRIPTOR), 'dSeS' ); if ( TokenSecurityDescriptor == NULL ) { ExFreePool( TokenAcl ); return NULL ; } Status = RtlCreateSecurityDescriptor( TokenSecurityDescriptor, SECURITY_DESCRIPTOR_REVISION ); ASSERT( NT_SUCCESS(Status) ); Status = RtlSetDaclSecurityDescriptor ( TokenSecurityDescriptor, TRUE, TokenAcl, FALSE ); ASSERT( NT_SUCCESS(Status) ); Status = RtlSetOwnerSecurityDescriptor ( TokenSecurityDescriptor, SeAliasAdminsSid, FALSE // Owner defaulted ); ASSERT( NT_SUCCESS(Status) ); Status = RtlSetGroupSecurityDescriptor ( TokenSecurityDescriptor, SeAliasAdminsSid, FALSE // Group defaulted ); ASSERT( NT_SUCCESS(Status) ); // // Create the system token // #ifdef TOKEN_DEBUG // // Debug DbgPrint("\n Creating system token...\n"); // Debug // #endif //TOKEN_DEBUG InitializeObjectAttributes( &TokenObjectAttributes, NULL, 0, NULL, TokenSecurityDescriptor ); ASSERT(SeSystemDefaultDacl != NULL); Status = SepCreateToken( (PHANDLE)&Token, KernelMode, 0, // No handle created for system token &TokenObjectAttributes, TokenPrimary, (SECURITY_IMPERSONATION_LEVEL)0, &SeSystemAuthenticationId, &NoExpiration, &UserId, 3, // GroupCount GroupIds, GroupIdsLength, 21, // privileges Privileges, sizeof(Privileges), Owner, PrimaryGroup.PrimaryGroup, SeSystemDefaultDacl, &SeSystemTokenSource, TRUE, // System token NULL, NULL ); ASSERT(NT_SUCCESS(Status)); // // Assign the security descriptor here, since we don't do it // in SepCreateToken for the System Token. // BufferLength = Length + sizeof(SECURITY_DESCRIPTOR_RELATIVE) + 2 * SeLengthSid(SeAliasAdminsSid); Buffer = (PSECURITY_DESCRIPTOR)ExAllocatePoolWithTag( PagedPool, BufferLength, 'dSeS' ); if ( Buffer ) { Status = RtlAbsoluteToSelfRelativeSD( TokenSecurityDescriptor, Buffer, &BufferLength ); ASSERT(NT_SUCCESS(Status)); Status = ObAssignObjectSecurityDescriptor( Token, Buffer, PagedPool ); ASSERT(NT_SUCCESS(Status)); } else { ObDereferenceObject( Token ); Token = NULL ; } // // We can free the old one now. // ExFreePool( TokenAcl ); ExFreePool( TokenSecurityDescriptor ); return (PACCESS_TOKEN)Token; }

NTKERNELAPI NTSTATUS SeMarkLogonSessionForTerminationNotification (  IN PLUID  LogonId  )

Definition at line 979 of file rmlogon.c. References _SEP_LOGON_SESSION_REFERENCES::Flags, _SEP_LOGON_SESSION_REFERENCES::LogonId, _SEP_LOGON_SESSION_REFERENCES::Next, NULL, PAGED_CODE, RtlEqualLuid(), SEP_TERMINATION_NOTIFY, SepLogonSessionIndex, SepLogonSessions, SepRmAcquireDbWriteLock, and SepRmReleaseDbWriteLock. : File systems that have registered for logon-termination notification can mark logon sessions they are interested in for callback by calling this routine. Arguments: LogonId - The logon id for which the file system should be notified when the logon session is terminated. Returns: Nothing. --*/ { ULONG SessionArrayIndex; PSEP_LOGON_SESSION_REFERENCES Previous, Current; PAGED_CODE(); SessionArrayIndex = SepLogonSessionIndex( LogonId ); // // Protect modification of reference monitor database // SepRmAcquireDbWriteLock(); // // Now walk the list for our logon session array hash index. // Previous = (PSEP_LOGON_SESSION_REFERENCES) ((PVOID)&SepLogonSessions[ SessionArrayIndex ]); Current = Previous->Next; while (Current != NULL) { // // If we found it, decrement the reference count and return // if (RtlEqualLuid( LogonId, &Current->LogonId) ) { Current->Flags |= SEP_TERMINATION_NOTIFY; break; } Previous = Current; Current = Current->Next; } SepRmReleaseDbWriteLock(); return( (Current != NULL) ? STATUS_SUCCESS : STATUS_NOT_FOUND ); }

VOID SeObjectReferenceAuditAlarm (  IN PLUID OperationID  OPTIONAL, IN PVOID  Object, IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext, IN ACCESS_MASK  DesiredAccess, IN PPRIVILEGE_SET Privileges  OPTIONAL, IN BOOLEAN  AccessGranted, IN KPROCESSOR_MODE  AccessMode )

Definition at line 3660 of file seaudit.c. References EffectiveToken, FALSE, KernelMode, NULL, PAGED_CODE, SepAdtAuditThisEvent, SepAdtObjectReferenceAuditAlarm(), and SepExamineSacl(). Referenced by ObpCheckObjectReference(). : description-of-function. Arguments: argument-name - Supplies | Returns description of argument. . . Return Value: return-value - Description of conditions needed to return value. - or - None. --*/ { BOOLEAN GenerateAudit = FALSE; BOOLEAN GenerateAlarm = FALSE; PAGED_CODE(); if (AccessMode == KernelMode) { return; } if ( SecurityDescriptor != NULL ) { if ( SepAdtAuditThisEvent( AuditCategoryDetailedTracking, &AccessGranted )) { SepExamineSacl( RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ), EffectiveToken( SubjectSecurityContext ), DesiredAccess, AccessGranted, &GenerateAudit, &GenerateAlarm ); if ( GenerateAudit || GenerateAlarm ) { SepAdtObjectReferenceAuditAlarm( OperationID, Object, SubjectSecurityContext, DesiredAccess, Privileges, AccessGranted, GenerateAudit, GenerateAlarm ); } } } return; }

NTKERNELAPI VOID SeOpenObjectAuditAlarm (  IN PUNICODE_STRING  ObjectTypeName, IN PVOID Object  OPTIONAL, IN PUNICODE_STRING AbsoluteObjectName  OPTIONAL, IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PACCESS_STATE  AccessState, IN BOOLEAN  ObjectCreated, IN BOOLEAN  AccessGranted, IN KPROCESSOR_MODE  AccessMode, OUT PBOOLEAN  GenerateOnClose )

Definition at line 2765 of file seaudit.c. References EffectiveToken, ExAllocatePool, ExFreePool(), FALSE, _AUX_ACCESS_DATA::GenericMapping, KernelMode, NULL, PAGED_CODE, PagedPool, _AUX_ACCESS_DATA::PrivilegesUsed, PTOKEN, RtlCopyUnicodeString(), RtlMapGenericMask(), SepAdtAuditThisEvent, SepAdtOpenObjectAuditAlarm(), SepExamineSacl(), SepFilterPrivilegeAudits(), SepQueryNameString(), SepQueryTypeString(), SeSubsystemName, Token, and TRUE. Referenced by IopParseDevice(), and ObCheckObjectAccess(). : SeOpenObjectAuditAlarm is used by the object manager that open objects to generate any necessary audit or alarm messages. The open may be to existing objects or for newly created objects. No messages will be generated for Kernel mode accesses. This routine is used to generate audit and alarm messages when an attempt is made to open an object. This routine may result in several messages being generated and sent to Port objects. This may result in a significant latency before returning. Design of routines that must call this routine must take this potential latency into account. This may have an impact on the approach taken for data structure mutex locking, for example. Arguments: ObjectTypeName - Supplies the name of the type of object being accessed. This must be the same name provided to the ObCreateObjectType service when the object type was created. Object - Address of the object accessed. This value will not be used as a pointer (referenced). It is necessary only to enter into log messages. If the open was not successful, then this argument is ignored. Otherwise, it must be provided. AbsoluteObjectName - Supplies the name of the object being accessed. If the object doesn't have a name, then this field is left null. Otherwise, it must be provided. SecurityDescriptor - A pointer to the security descriptor of the object being accessed. AccessState - A pointer to an access state structure containing the subject context, the remaining desired access types, the granted access types, and optionally a privilege set to indicate which privileges were used to permit the access. ObjectCreated - A boolean flag indicating whether the access resulted in a new object being created. A value of TRUE indicates an object was created, FALSE indicates an existing object was opened. AccessGranted - Indicates if the access was granted or denied based on the access check or privilege check. AccessMode - Indicates the access mode used for the access check. One of UserMode or KernelMode. Messages will not be generated by kernel mode accesses. GenerateOnClose - Points to a boolean that is set by the audit generation routine and must be passed to SeCloseObjectAuditAlarm() when the object handle is closed. Return value: None. --*/ { BOOLEAN GenerateAudit = FALSE; BOOLEAN GenerateAlarm = FALSE; ACCESS_MASK RequestedAccess; POBJECT_NAME_INFORMATION ObjectNameInfo = NULL; PUNICODE_STRING ObjectTypeNameInfo = NULL; PUNICODE_STRING ObjectName = NULL; PUNICODE_STRING LocalObjectTypeName = NULL; PLUID PrimaryAuthenticationId = NULL; PLUID ClientAuthenticationId = NULL; BOOLEAN AuditPrivileges = FALSE; BOOLEAN AuditPerformed; PTOKEN Token; ACCESS_MASK MappedGrantMask = (ACCESS_MASK)0; ACCESS_MASK MappedDenyMask = (ACCESS_MASK)0; PAUX_ACCESS_DATA AuxData; PAGED_CODE(); if ( AccessMode == KernelMode ) { return; } AuxData = (PAUX_ACCESS_DATA)AccessState->AuxData; Token = EffectiveToken( &AccessState->SubjectSecurityContext ); if (ARGUMENT_PRESENT(Token->AuditData)) { MappedGrantMask = Token->AuditData->GrantMask; RtlMapGenericMask( &MappedGrantMask, &AuxData->GenericMapping ); MappedDenyMask = Token->AuditData->DenyMask; RtlMapGenericMask( &MappedDenyMask, &AuxData->GenericMapping ); } if (SecurityDescriptor != NULL) { RequestedAccess = AccessState->RemainingDesiredAccess | AccessState->PreviouslyGrantedAccess; if ( SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted )) { if ( RequestedAccess & (AccessGranted ? MappedGrantMask : MappedDenyMask)) { GenerateAudit = TRUE; } else { SepExamineSacl( RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ), Token, RequestedAccess, AccessGranted, &GenerateAudit, &GenerateAlarm ); } // // Only generate an audit on close of we're auditing from SACL // settings. // if (GenerateAudit) { *GenerateOnClose = TRUE; } } } // // If we don't generate an audit via the SACL, see if we need to generate // one for privilege use. // // Note that we only audit privileges successfully used to open objects, // so we don't care about a failed privilege use here. Therefore, only // do this test of access has been granted. // if (!GenerateAudit && (AccessGranted == TRUE)) { if ( SepAdtAuditThisEvent( AuditCategoryPrivilegeUse, &AccessGranted )) { if ((AuxData->PrivilegesUsed != NULL) && (AuxData->PrivilegesUsed->PrivilegeCount > 0) ) { // // Make sure these are actually privileges that we want to audit // if (SepFilterPrivilegeAudits( AuxData->PrivilegesUsed )) { GenerateAudit = TRUE; // // When we finally try to generate this audit, this flag // will tell us that we need to audit the fact that we // used a privilege, as opposed to audit due to the SACL. // AccessState->AuditPrivileges = TRUE; } } } } // // Set up either to generate an audit (if the access check has failed), or save // the stuff that we're going to audit later into the AccessState structure. // if (GenerateAudit || GenerateAlarm) { AccessState->GenerateAudit = TRUE; // // Figure out what we've been passed, and obtain as much // missing information as possible. // if ( !ARGUMENT_PRESENT( AbsoluteObjectName )) { if ( ARGUMENT_PRESENT( Object )) { ObjectNameInfo = SepQueryNameString( Object ); if ( ObjectNameInfo != NULL ) { ObjectName = &ObjectNameInfo->Name; } } } else { ObjectName = AbsoluteObjectName; } if ( !ARGUMENT_PRESENT( ObjectTypeName )) { if ( ARGUMENT_PRESENT( Object )) { ObjectTypeNameInfo = SepQueryTypeString( Object ); if ( ObjectTypeNameInfo != NULL ) { LocalObjectTypeName = ObjectTypeNameInfo; } } } else { LocalObjectTypeName = ObjectTypeName; } // // If the access attempt failed, do the audit here. If it succeeded, // we'll do the audit later, when the handle is allocated. // // if (!AccessGranted) { AuditPerformed = SepAdtOpenObjectAuditAlarm ( &SeSubsystemName, NULL, LocalObjectTypeName, NULL, ObjectName, AccessState->SubjectSecurityContext.ClientToken, AccessState->SubjectSecurityContext.PrimaryToken, AccessState->OriginalDesiredAccess, AccessState->PreviouslyGrantedAccess, &AccessState->OperationID, AuxData->PrivilegesUsed, FALSE, FALSE, TRUE, FALSE, AccessState->SubjectSecurityContext.ProcessAuditId, AuditCategoryObjectAccess, NULL, 0, NULL ); } else { // // Copy all the stuff we're going to need into the // AccessState and return. // if ( ObjectName != NULL ) { if ( AccessState->ObjectName.Buffer != NULL ) { ExFreePool( AccessState->ObjectName.Buffer ); AccessState->ObjectName.Length = 0; AccessState->ObjectName.MaximumLength = 0; } AccessState->ObjectName.Buffer = ExAllocatePool( PagedPool,ObjectName->MaximumLength ); if (AccessState->ObjectName.Buffer != NULL) { AccessState->ObjectName.MaximumLength = ObjectName->MaximumLength; RtlCopyUnicodeString( &AccessState->ObjectName, ObjectName ); } } if ( LocalObjectTypeName != NULL ) { if ( AccessState->ObjectTypeName.Buffer != NULL ) { ExFreePool( AccessState->ObjectTypeName.Buffer ); AccessState->ObjectTypeName.Length = 0; AccessState->ObjectTypeName.MaximumLength = 0; } AccessState->ObjectTypeName.Buffer = ExAllocatePool( PagedPool, LocalObjectTypeName->MaximumLength ); if (AccessState->ObjectTypeName.Buffer != NULL) { AccessState->ObjectTypeName.MaximumLength = LocalObjectTypeName->MaximumLength; RtlCopyUnicodeString( &AccessState->ObjectTypeName, LocalObjectTypeName ); } } } if ( ObjectNameInfo != NULL ) { ExFreePool( ObjectNameInfo ); } if ( ObjectTypeNameInfo != NULL ) { ExFreePool( ObjectTypeNameInfo ); } } return; }

NTKERNELAPI VOID SeOpenObjectForDeleteAuditAlarm (  IN PUNICODE_STRING  ObjectTypeName, IN PVOID Object  OPTIONAL, IN PUNICODE_STRING AbsoluteObjectName  OPTIONAL, IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PACCESS_STATE  AccessState, IN BOOLEAN  ObjectCreated, IN BOOLEAN  AccessGranted, IN KPROCESSOR_MODE  AccessMode, OUT PBOOLEAN  GenerateOnClose )

Definition at line 3085 of file seaudit.c. References EffectiveToken, ExAllocatePool, ExFreePool(), FALSE, _AUX_ACCESS_DATA::GenericMapping, KernelMode, NULL, PAGED_CODE, PagedPool, _AUX_ACCESS_DATA::PrivilegesUsed, PTOKEN, RtlCopyUnicodeString(), RtlMapGenericMask(), SepAdtAuditThisEvent, SepAdtOpenObjectAuditAlarm(), SepAdtOpenObjectForDeleteAuditAlarm(), SepExamineSacl(), SepFilterPrivilegeAudits(), SepQueryNameString(), SepQueryTypeString(), SeSubsystemName, Token, and TRUE. : SeOpenObjectForDeleteAuditAlarm is used by the object manager that open objects to generate any necessary audit or alarm messages. The open may be to existing objects or for newly created objects. No messages will be generated for Kernel mode accesses. This routine is used to generate audit and alarm messages when an attempt is made to open an object with the intent to delete it. Specifically, this is used by file systems when the flag FILE_DELETE_ON_CLOSE is specified. This routine may result in several messages being generated and sent to Port objects. This may result in a significant latency before returning. Design of routines that must call this routine must take this potential latency into account. This may have an impact on the approach taken for data structure mutex locking, for example. Arguments: ObjectTypeName - Supplies the name of the type of object being accessed. This must be the same name provided to the ObCreateObjectType service when the object type was created. Object - Address of the object accessed. This value will not be used as a pointer (referenced). It is necessary only to enter into log messages. If the open was not successful, then this argument is ignored. Otherwise, it must be provided. AbsoluteObjectName - Supplies the name of the object being accessed. If the object doesn't have a name, then this field is left null. Otherwise, it must be provided. SecurityDescriptor - A pointer to the security descriptor of the object being accessed. AccessState - A pointer to an access state structure containing the subject context, the remaining desired access types, the granted access types, and optionally a privilege set to indicate which privileges were used to permit the access. ObjectCreated - A boolean flag indicating whether the access resulted in a new object being created. A value of TRUE indicates an object was created, FALSE indicates an existing object was opened. AccessGranted - Indicates if the access was granted or denied based on the access check or privilege check. AccessMode - Indicates the access mode used for the access check. One of UserMode or KernelMode. Messages will not be generated by kernel mode accesses. GenerateOnClose - Points to a boolean that is set by the audit generation routine and must be passed to SeCloseObjectAuditAlarm() when the object handle is closed. Return value: None. --*/ { BOOLEAN GenerateAudit = FALSE; BOOLEAN GenerateAlarm = FALSE; ACCESS_MASK RequestedAccess; POBJECT_NAME_INFORMATION ObjectNameInfo = NULL; PUNICODE_STRING ObjectTypeNameInfo = NULL; PUNICODE_STRING ObjectName = NULL; PUNICODE_STRING LocalObjectTypeName = NULL; PLUID PrimaryAuthenticationId = NULL; PLUID ClientAuthenticationId = NULL; BOOLEAN AuditPrivileges = FALSE; BOOLEAN AuditPerformed; PTOKEN Token; ACCESS_MASK MappedGrantMask = (ACCESS_MASK)0; ACCESS_MASK MappedDenyMask = (ACCESS_MASK)0; PAUX_ACCESS_DATA AuxData; PAGED_CODE(); if ( AccessMode == KernelMode ) { return; } AuxData = (PAUX_ACCESS_DATA)AccessState->AuxData; Token = EffectiveToken( &AccessState->SubjectSecurityContext ); if (ARGUMENT_PRESENT(Token->AuditData)) { MappedGrantMask = Token->AuditData->GrantMask; RtlMapGenericMask( &MappedGrantMask, &AuxData->GenericMapping ); MappedDenyMask = Token->AuditData->DenyMask; RtlMapGenericMask( &MappedDenyMask, &AuxData->GenericMapping ); } if (SecurityDescriptor != NULL) { RequestedAccess = AccessState->RemainingDesiredAccess | AccessState->PreviouslyGrantedAccess; if ( SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted )) { if ( RequestedAccess & (AccessGranted ? MappedGrantMask : MappedDenyMask)) { GenerateAudit = TRUE; } else { SepExamineSacl( RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ), Token, RequestedAccess, AccessGranted, &GenerateAudit, &GenerateAlarm ); } // // Only generate an audit on close of we're auditing from SACL // settings. // if (GenerateAudit) { *GenerateOnClose = TRUE; } } } // // If we don't generate an audit via the SACL, see if we need to generate // one for privilege use. // // Note that we only audit privileges successfully used to open objects, // so we don't care about a failed privilege use here. Therefore, only // do this test of access has been granted. // if (!GenerateAudit && (AccessGranted == TRUE)) { if ( SepAdtAuditThisEvent( AuditCategoryPrivilegeUse, &AccessGranted )) { if ((AuxData->PrivilegesUsed != NULL) && (AuxData->PrivilegesUsed->PrivilegeCount > 0) ) { // // Make sure these are actually privileges that we want to audit // if (SepFilterPrivilegeAudits( AuxData->PrivilegesUsed )) { GenerateAudit = TRUE; // // When we finally try to generate this audit, this flag // will tell us that we need to audit the fact that we // used a privilege, as opposed to audit due to the SACL. // AccessState->AuditPrivileges = TRUE; } } } } // // Set up either to generate an audit (if the access check has failed), or save // the stuff that we're going to audit later into the AccessState structure. // if (GenerateAudit || GenerateAlarm) { AccessState->GenerateAudit = TRUE; // // Figure out what we've been passed, and obtain as much // missing information as possible. // if ( !ARGUMENT_PRESENT( AbsoluteObjectName )) { if ( ARGUMENT_PRESENT( Object )) { ObjectNameInfo = SepQueryNameString( Object ); if ( ObjectNameInfo != NULL ) { ObjectName = &ObjectNameInfo->Name; } } } else { ObjectName = AbsoluteObjectName; } if ( !ARGUMENT_PRESENT( ObjectTypeName )) { if ( ARGUMENT_PRESENT( Object )) { ObjectTypeNameInfo = SepQueryTypeString( Object ); if ( ObjectTypeNameInfo != NULL ) { LocalObjectTypeName = ObjectTypeNameInfo; } } } else { LocalObjectTypeName = ObjectTypeName; } // // If the access attempt failed, do the audit here. If it succeeded, // we'll do the audit later, when the handle is allocated. // // if (!AccessGranted) { AuditPerformed = SepAdtOpenObjectAuditAlarm ( &SeSubsystemName, NULL, LocalObjectTypeName, NULL, ObjectName, AccessState->SubjectSecurityContext.ClientToken, AccessState->SubjectSecurityContext.PrimaryToken, AccessState->OriginalDesiredAccess, AccessState->PreviouslyGrantedAccess, &AccessState->OperationID, AuxData->PrivilegesUsed, FALSE, FALSE, TRUE, FALSE, AccessState->SubjectSecurityContext.ProcessAuditId, AuditCategoryObjectAccess, NULL, 0, NULL ); } else { // // Generate the delete audit first // SepAdtOpenObjectForDeleteAuditAlarm ( &SeSubsystemName, NULL, LocalObjectTypeName, NULL, ObjectName, AccessState->SubjectSecurityContext.ClientToken, AccessState->SubjectSecurityContext.PrimaryToken, AccessState->OriginalDesiredAccess, AccessState->PreviouslyGrantedAccess, &AccessState->OperationID, AuxData->PrivilegesUsed, FALSE, TRUE, TRUE, FALSE, AccessState->SubjectSecurityContext.ProcessAuditId ); // // Copy all the stuff we're going to need into the // AccessState and return. // if ( ObjectName != NULL ) { if ( AccessState->ObjectName.Buffer != NULL ) { ExFreePool( AccessState->ObjectName.Buffer ); AccessState->ObjectName.Length = 0; AccessState->ObjectName.MaximumLength = 0; } AccessState->ObjectName.Buffer = ExAllocatePool( PagedPool,ObjectName->MaximumLength ); if (AccessState->ObjectName.Buffer != NULL) { AccessState->ObjectName.MaximumLength = ObjectName->MaximumLength; RtlCopyUnicodeString( &AccessState->ObjectName, ObjectName ); } } if ( LocalObjectTypeName != NULL ) { if ( AccessState->ObjectTypeName.Buffer != NULL ) { ExFreePool( AccessState->ObjectTypeName.Buffer ); AccessState->ObjectTypeName.Length = 0; AccessState->ObjectTypeName.MaximumLength = 0; } AccessState->ObjectTypeName.Buffer = ExAllocatePool( PagedPool, LocalObjectTypeName->MaximumLength ); if (AccessState->ObjectTypeName.Buffer != NULL) { AccessState->ObjectTypeName.MaximumLength = LocalObjectTypeName->MaximumLength; RtlCopyUnicodeString( &AccessState->ObjectTypeName, LocalObjectTypeName ); } } } if ( ObjectNameInfo != NULL ) { ExFreePool( ObjectNameInfo ); } if ( ObjectTypeNameInfo != NULL ) { ExFreePool( ObjectTypeNameInfo ); } } return; }

NTKERNELAPI BOOLEAN SePrivilegeCheck (  IN OUT PPRIVILEGE_SET  RequiredPrivileges, IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext, IN KPROCESSOR_MODE  AccessMode )

Definition at line 158 of file privileg.c. References EffectiveToken, FALSE, NULL, PAGED_CODE, SepPrivilegeCheck(), and Status. Referenced by IopCheckBackupRestorePrivilege(), IsPrivileged(), ObpIncrementHandleCount(), RtlpNewSecurityObject(), SeCheckPrivilegedObject(), and SeSinglePrivilegeCheck(). : This routine checks to see if the token contains the specified privileges. Arguments: RequiredPrivileges - Points to a set of privileges. The subject's security context is to be checked to see which of the specified privileges are present. The results will be indicated in the attributes associated with each privilege. Note that flags in this parameter indicate whether all the privileges listed are needed, or any of the privileges. SubjectSecurityContext - A pointer to the subject's captured security context. AccessMode - Indicates the access mode to use for access check. One of UserMode or KernelMode. If the mode is kernel, then all privileges will be marked as being possessed by the subject, and successful completion status is returned. Return Value: BOOLEAN - TRUE if all specified privileges are held by the subject, otherwise FALSE. --*/ { BOOLEAN Status; PAGED_CODE(); // // If we're impersonating a client, we have to be at impersonation level // of SecurityImpersonation or above. // if ( (SubjectSecurityContext->ClientToken != NULL) && (SubjectSecurityContext->ImpersonationLevel < SecurityImpersonation) ) { return(FALSE); } // // SepPrivilegeCheck locks the passed token for read access // Status = SepPrivilegeCheck( EffectiveToken( SubjectSecurityContext ), RequiredPrivileges->Privilege, RequiredPrivileges->PrivilegeCount, RequiredPrivileges->Control, AccessMode ); return(Status); }

VOID SePrivilegedServiceAuditAlarm (  IN PUNICODE_STRING  ServiceName, IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext, IN PPRIVILEGE_SET  Privileges, IN BOOLEAN  AccessGranted )

Definition at line 989 of file seaudit.c. References EffectiveToken, PAGED_CODE, PTOKEN, RtlEqualSid(), SeLocalSystemSid, SepAdtAuditThisEvent, SepAdtPrivilegedServiceAuditAlarm(), SepFilterPrivilegeAudits(), SepTokenUserSid, SeSubsystemName, and Token. Referenced by ObpIncrementHandleCount(), RtlpNewSecurityObject(), SeCheckAuditPrivilege(), and SeSinglePrivilegeCheck(). : This routine is to be called whenever a privileged system service is attempted. It should be called immediately after the privilege check regardless of whether or not the test succeeds. Arguments: ServiceName - Supplies the name of the privileged system service. SubjectSecurityContext - The subject security context representing the caller of the system service. Privileges - Supplies a privilge set containing the privilege(s) required for the access. AccessGranted - Supplies the results of the privilege test. Return Value: None. --*/ { PTOKEN Token; PAGED_CODE(); if ( SepAdtAuditThisEvent( AuditCategoryPrivilegeUse, &AccessGranted ) && SepFilterPrivilegeAudits( Privileges )) { Token = (PTOKEN)EffectiveToken( SubjectSecurityContext ); if ( RtlEqualSid( SeLocalSystemSid, SepTokenUserSid( Token ))) { return; } SepAdtPrivilegedServiceAuditAlarm ( &SeSubsystemName, ServiceName, SubjectSecurityContext->ClientToken, SubjectSecurityContext->PrimaryToken, Privileges, AccessGranted ); } return; }

NTKERNELAPI VOID SePrivilegeObjectAuditAlarm (  IN HANDLE  Handle, IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext, IN ACCESS_MASK  DesiredAccess, IN PPRIVILEGE_SET  Privileges, IN BOOLEAN  AccessGranted, IN KPROCESSOR_MODE  AccessMode )

Definition at line 650 of file seaudit.c. References Handle, KernelMode, PAGED_CODE, SepAdtPrivilegeObjectAuditAlarm(), and SeSubsystemName. Referenced by IsPrivileged(), ObpCreateHandle(), and SeCheckPrivilegedObject(). : This routine is used by object methods that perform privileged operations to generate audit and alarm messages related to the use of privileges, or attempts to use privileges. Arguments: Object - Address of the object accessed. This value will not be used as a pointer (referenced). It is necessary only to enter into log messages. Handle - Provides the handle value assigned for the open. SecurityDescriptor - A pointer to the security descriptor of the object being accessed. SubjectSecurityContext - A pointer to the captured security context of the subject attempting to open the object. DesiredAccess - The desired access mask. This mask must have been previously mapped to contain no generic accesses. Privileges - Points to a set of privileges required for the access attempt. Those privileges that were held by the subject are marked using the UsedForAccess flag of the PRIVILEGE_ATTRIBUTES associated with each privilege. AccessGranted - Indicates whether the access was granted or denied. A value of TRUE indicates the access was allowed. A value of FALSE indicates the access was denied. AccessMode - Indicates the access mode used for the access check. Messages will not be generated by kernel mode accesses. Return Value: None. --*/ { BOOLEAN AuditPerformed; PAGED_CODE(); if (AccessMode != KernelMode) { AuditPerformed = SepAdtPrivilegeObjectAuditAlarm ( &SeSubsystemName, Handle, SubjectSecurityContext->ClientToken, SubjectSecurityContext->PrimaryToken, SubjectSecurityContext->ProcessAuditId, DesiredAccess, Privileges, AccessGranted ); } }

NTSTATUS SePrivilegePolicyCheck (  IN OUT PACCESS_MASK  RemainingDesiredAccess, IN OUT PACCESS_MASK  PreviouslyGrantedAccess, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext  OPTIONAL, IN PACCESS_TOKEN Token  OPTIONAL, OUT PPRIVILEGE_SET *  PrivilegeSet, IN KPROCESSOR_MODE  PreviousMode )

BOOLEAN SeProxyAccessCheck (  IN PUNICODE_STRING  Volume, IN PUNICODE_STRING  RelativePath, IN BOOLEAN  ContainerObject, IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext, IN BOOLEAN  SubjectContextLocked, IN ACCESS_MASK  DesiredAccess, IN ACCESS_MASK  PreviouslyGrantedAccess, OUT PPRIVILEGE_SET *Privileges  OPTIONAL, IN PGENERIC_MAPPING  GenericMapping, IN KPROCESSOR_MODE  AccessMode, OUT PACCESS_MASK  GrantedAccess, OUT PNTSTATUS  AccessStatus )

Definition at line 3564 of file accessck.c. References SeAccessCheck(). : Arguments: Volume - Supplies the volume information of the file being opened. RelativePath - The volume-relative path of the file being opened. The full path of the file is the RelativePath appended to the Volume string. ContainerObject - Indicates if the access is to a container object (TRUE), or a leaf object (FALSE). SecurityDescriptor - Supplies the security descriptor protecting the object being accessed SubjectSecurityContext - A pointer to the subject's captured security context SubjectContextLocked - Supplies a flag indiciating whether or not the user's subject context is locked, so that it does not have to be locked again. DesiredAccess - Supplies the access mask that the user is attempting to acquire PreviouslyGrantedAccess - Supplies any accesses that the user has already been granted, for example, as a result of holding a privilege. Privileges - Supplies a pointer in which will be returned a privilege set indicating any privileges that were used as part of the access validation. GenericMapping - Supplies the generic mapping associated with this object type. AccessMode - Supplies the access mode to be used in the check GrantedAccess - Pointer to a returned access mask indicatating the granted access AccessStatus - Status value that may be returned indicating the reason why access was denied. Routines should avoid hardcoding a return value of STATUS_ACCESS_DENIED so that a different value can be returned when mandatory access control is implemented. Return Value: BOOLEAN - TRUE if access is allowed and FALSE otherwise --*/ { return SeAccessCheck ( SecurityDescriptor, SubjectSecurityContext, SubjectContextLocked, DesiredAccess, PreviouslyGrantedAccess, Privileges, GenericMapping, AccessMode, GrantedAccess, AccessStatus ); }

NTKERNELAPI NTSTATUS SeQueryAuthenticationIdToken (  IN PACCESS_TOKEN  Token, OUT PLUID  AuthenticationId )

Definition at line 1152 of file tokenqry.c. References PAGED_CODE, PTOKEN, SepAcquireTokenReadLock, SepReleaseTokenReadLock, and Token. Referenced by CheckAllowForeground(), GetProcessLuid(), NtSetUuidSeed(), and SeQueryAuthenticationIdSubjectContext(). : Retrieve authentication ID out of the token. Arguments: Token - Referenced pointer to a token. AutenticationId - Receives the token's authentication ID. Return Value: STATUS_SUCCESS - Indicates the operation was successful. This is the only expected status. --*/ { PAGED_CODE(); SepAcquireTokenReadLock( ((PTOKEN)Token) ); (*AuthenticationId) = ((PTOKEN)Token)->AuthenticationId; SepReleaseTokenReadLock( ((PTOKEN)Token) ); return(STATUS_SUCCESS); }

NTKERNELAPI NTSTATUS SeQueryInformationToken (  IN PACCESS_TOKEN  Token, IN TOKEN_INFORMATION_CLASS  TokenInformationClass, OUT PVOID *  TokenInformation )

Definition at line 1189 of file tokenqry.c. References ANYSIZE_ARRAY, ASSERT, ExAllocatePool, Index, NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, PagedPool, PTOKEN, RtlCopyLuidAndAttributesArray(), RtlCopySid(), RtlCopySidAndAttributesArray(), SeLengthSid, SepAcquireTokenReadLock, SepReleaseTokenReadLock, SeQuerySessionIdToken(), Status, and Token. Referenced by NtSecureConnectPort(). : Retrieve information about a specified token. Arguments: TokenHandle - Provides a handle to the token to operate on. TokenInformationClass - The token information class about which to retrieve information. TokenInformation - Receives a pointer to the requested information. The actual structures returned are dependent upon the information class requested, as defined in the TokenInformationClass parameter description. TokenInformation Format By Information Class: TokenUser => TOKEN_USER data structure. TOKEN_QUERY access is needed to retrieve this information about a token. TokenGroups => TOKEN_GROUPS data structure. TOKEN_QUERY access is needed to retrieve this information about a token. TokenPrivileges => TOKEN_PRIVILEGES data structure. TOKEN_QUERY access is needed to retrieve this information about a token. TokenOwner => TOKEN_OWNER data structure. TOKEN_QUERY access is needed to retrieve this information about a token. TokenPrimaryGroup => TOKEN_PRIMARY_GROUP data structure. TOKEN_QUERY access is needed to retrieve this information about a token. TokenDefaultDacl => TOKEN_DEFAULT_DACL data structure. TOKEN_QUERY access is needed to retrieve this information about a token. TokenSource => TOKEN_SOURCE data structure. TOKEN_QUERY_SOURCE access is needed to retrieve this information about a token. TokenType => TOKEN_TYPE data structure. TOKEN_QUERY access is needed to retrieve this information about a token. TokenStatistics => TOKEN_STATISTICS data structure. TOKEN_QUERY access is needed to retrieve this information about a token. Return Value: STATUS_SUCCESS - Indicates the operation was successful. --*/ { NTSTATUS Status; ULONG RequiredLength; ULONG Index; PSID PSid; PACL PAcl; PVOID Ignore; PTOKEN Token = (PTOKEN)AccessToken; PAGED_CODE(); // // Case on information class. // switch ( TokenInformationClass ) { case TokenUser: { PTOKEN_USER LocalUser; // // Gain exclusive access to the token. // SepAcquireTokenReadLock( Token ); // // Return the length required now in case not enough buffer // was provided by the caller and we have to return an error. // RequiredLength = SeLengthSid( Token->UserAndGroups[0].Sid) + (ULONG)sizeof( TOKEN_USER ); LocalUser = ExAllocatePool( PagedPool, RequiredLength ); if (LocalUser == NULL) { SepReleaseTokenReadLock( Token ); return( STATUS_INSUFFICIENT_RESOURCES ); } // // Return the user SID // // Put SID immediately following TOKEN_USER data structure // PSid = (PSID)( (ULONG_PTR)LocalUser + (ULONG)sizeof(TOKEN_USER) ); RtlCopySidAndAttributesArray( 1, Token->UserAndGroups, RequiredLength, &(LocalUser->User), PSid, ((PSID *)&Ignore), ((PULONG)&Ignore) ); SepReleaseTokenReadLock( Token ); *TokenInformation = LocalUser; return STATUS_SUCCESS; }  case TokenGroups: { PTOKEN_GROUPS LocalGroups; // // Gain exclusive access to the token. // SepAcquireTokenReadLock( Token ); // // Figure out how much space is needed to return the group SIDs. // That's the size of TOKEN_GROUPS (without any array entries) // plus the size of an SID_AND_ATTRIBUTES times the number of groups. // The number of groups is Token->UserAndGroups-1 (since the count // includes the user ID). Then the lengths of each individual group // must be added. // RequiredLength = (ULONG)sizeof(TOKEN_GROUPS) + ((Token->UserAndGroupCount - ANYSIZE_ARRAY - 1) * ((ULONG)sizeof(SID_AND_ATTRIBUTES)) ); Index = 1; while (Index < Token->UserAndGroupCount) { RequiredLength += SeLengthSid( Token->UserAndGroups[Index].Sid ); Index += 1; } // endwhile LocalGroups = ExAllocatePool( PagedPool, RequiredLength ); if (LocalGroups == NULL) { SepReleaseTokenReadLock( Token ); return( STATUS_INSUFFICIENT_RESOURCES ); } // // Now copy the groups. // LocalGroups->GroupCount = Token->UserAndGroupCount - 1; PSid = (PSID)( (ULONG_PTR)LocalGroups + (ULONG)sizeof(TOKEN_GROUPS) + ( (Token->UserAndGroupCount - ANYSIZE_ARRAY - 1) * (ULONG)sizeof(SID_AND_ATTRIBUTES) ) ); RtlCopySidAndAttributesArray( (ULONG)(Token->UserAndGroupCount - 1), &(Token->UserAndGroups[1]), RequiredLength, LocalGroups->Groups, PSid, ((PSID *)&Ignore), ((PULONG)&Ignore) ); SepReleaseTokenReadLock( Token ); *TokenInformation = LocalGroups; return STATUS_SUCCESS; }  case TokenPrivileges: { PTOKEN_PRIVILEGES LocalPrivileges; // // Gain exclusive access to the token to prevent changes // from occuring to the privileges. // SepAcquireTokenReadLock( Token ); // // Return the length required now in case not enough buffer // was provided by the caller and we have to return an error. // RequiredLength = (ULONG)sizeof(TOKEN_PRIVILEGES) + ((Token->PrivilegeCount - ANYSIZE_ARRAY) * ((ULONG)sizeof(LUID_AND_ATTRIBUTES)) ); LocalPrivileges = ExAllocatePool( PagedPool, RequiredLength ); if (LocalPrivileges == NULL) { SepReleaseTokenReadLock( Token ); return( STATUS_INSUFFICIENT_RESOURCES ); } // // Return the token privileges. // LocalPrivileges->PrivilegeCount = Token->PrivilegeCount; RtlCopyLuidAndAttributesArray( Token->PrivilegeCount, Token->Privileges, LocalPrivileges->Privileges ); SepReleaseTokenReadLock( Token ); *TokenInformation = LocalPrivileges; return STATUS_SUCCESS; }  case TokenOwner: { PTOKEN_OWNER LocalOwner; // // Gain exclusive access to the token to prevent changes // from occuring to the owner. // SepAcquireTokenReadLock( Token ); // // Return the length required now in case not enough buffer // was provided by the caller and we have to return an error. // PSid = Token->UserAndGroups[Token->DefaultOwnerIndex].Sid; RequiredLength = (ULONG)sizeof(TOKEN_OWNER) + SeLengthSid( PSid ); LocalOwner = ExAllocatePool( PagedPool, RequiredLength ); if (LocalOwner == NULL) { SepReleaseTokenReadLock( Token ); return( STATUS_INSUFFICIENT_RESOURCES ); } // // Return the owner SID // PSid = (PSID)((ULONG_PTR)LocalOwner + (ULONG)sizeof(TOKEN_OWNER)); LocalOwner->Owner = PSid; Status = RtlCopySid( (RequiredLength - (ULONG)sizeof(TOKEN_OWNER)), PSid, Token->UserAndGroups[Token->DefaultOwnerIndex].Sid ); ASSERT( NT_SUCCESS(Status) ); SepReleaseTokenReadLock( Token ); *TokenInformation = LocalOwner; return STATUS_SUCCESS; }  case TokenPrimaryGroup: { PTOKEN_PRIMARY_GROUP LocalPrimaryGroup; // // Gain exclusive access to the token to prevent changes // from occuring to the owner. // SepAcquireTokenReadLock( Token ); // // Return the length required now in case not enough buffer // was provided by the caller and we have to return an error. // RequiredLength = (ULONG)sizeof(TOKEN_PRIMARY_GROUP) + SeLengthSid( Token->PrimaryGroup ); LocalPrimaryGroup = ExAllocatePool( PagedPool, RequiredLength ); if (LocalPrimaryGroup == NULL) { SepReleaseTokenReadLock( Token ); return( STATUS_INSUFFICIENT_RESOURCES ); } // // Return the primary group SID // PSid = (PSID)((ULONG_PTR)LocalPrimaryGroup + (ULONG)sizeof(TOKEN_PRIMARY_GROUP)); LocalPrimaryGroup->PrimaryGroup = PSid; Status = RtlCopySid( (RequiredLength - (ULONG)sizeof(TOKEN_PRIMARY_GROUP)), PSid, Token->PrimaryGroup ); ASSERT( NT_SUCCESS(Status) ); SepReleaseTokenReadLock( Token ); *TokenInformation = LocalPrimaryGroup; return STATUS_SUCCESS; }  case TokenDefaultDacl: { PTOKEN_DEFAULT_DACL LocalDefaultDacl; // // Gain exclusive access to the token to prevent changes // from occuring to the owner. // SepAcquireTokenReadLock( Token ); // // Return the length required now in case not enough buffer // was provided by the caller and we have to return an error. // RequiredLength = (ULONG)sizeof(TOKEN_DEFAULT_DACL); if (ARGUMENT_PRESENT(Token->DefaultDacl)) { RequiredLength += Token->DefaultDacl->AclSize; } LocalDefaultDacl = ExAllocatePool( PagedPool, RequiredLength ); if (LocalDefaultDacl == NULL) { SepReleaseTokenReadLock( Token ); return( STATUS_INSUFFICIENT_RESOURCES ); } // // Return the default Dacl // PAcl = (PACL)((ULONG_PTR)LocalDefaultDacl + (ULONG)sizeof(TOKEN_DEFAULT_DACL)); if (ARGUMENT_PRESENT(Token->DefaultDacl)) { LocalDefaultDacl->DefaultDacl = PAcl; RtlCopyMemory( (PVOID)PAcl, (PVOID)Token->DefaultDacl, Token->DefaultDacl->AclSize ); } else { LocalDefaultDacl->DefaultDacl = NULL; } SepReleaseTokenReadLock( Token ); *TokenInformation = LocalDefaultDacl; return STATUS_SUCCESS; }  case TokenSource: { PTOKEN_SOURCE LocalSource; // // The type of a token can not be changed, so // exclusive access to the token is not necessary. // // // Return the length required now in case not enough buffer // was provided by the caller and we have to return an error. // RequiredLength = (ULONG) sizeof(TOKEN_SOURCE); LocalSource = ExAllocatePool( PagedPool, RequiredLength ); if (LocalSource == NULL) { return( STATUS_INSUFFICIENT_RESOURCES ); } // // Return the token source // (*LocalSource) = Token->TokenSource; *TokenInformation = LocalSource; return STATUS_SUCCESS; }  case TokenType: { PTOKEN_TYPE LocalType; // // The type of a token can not be changed, so // exclusive access to the token is not necessary. // // // Return the length required now in case not enough buffer // was provided by the caller and we have to return an error. // RequiredLength = (ULONG) sizeof(TOKEN_TYPE); LocalType = ExAllocatePool( PagedPool, RequiredLength ); if (LocalType == NULL) { return( STATUS_INSUFFICIENT_RESOURCES ); } // // Return the token type // (*LocalType) = Token->TokenType; *TokenInformation = LocalType; return STATUS_SUCCESS; }  case TokenImpersonationLevel: { PSECURITY_IMPERSONATION_LEVEL LocalImpersonationLevel; // // The impersonation level of a token can not be changed, so // exclusive access to the token is not necessary. // // // Make sure the token is an appropriate type to be retrieving // the impersonation level from. // if (Token->TokenType != TokenImpersonation) { return STATUS_INVALID_INFO_CLASS; } // // Return the length required now in case not enough buffer // was provided by the caller and we have to return an error. // RequiredLength = (ULONG) sizeof(SECURITY_IMPERSONATION_LEVEL); LocalImpersonationLevel = ExAllocatePool( PagedPool, RequiredLength ); if (LocalImpersonationLevel == NULL) { return( STATUS_INSUFFICIENT_RESOURCES ); } // // Return the impersonation level // (*LocalImpersonationLevel) = Token->ImpersonationLevel; *TokenInformation = LocalImpersonationLevel; return STATUS_SUCCESS; }  case TokenStatistics: { PTOKEN_STATISTICS LocalStatistics; // // Gain exclusive access to the token. // SepAcquireTokenReadLock( Token ); // // Return the length required now in case not enough buffer // was provided by the caller and we have to return an error. // RequiredLength = (ULONG)sizeof( TOKEN_STATISTICS ); LocalStatistics = ExAllocatePool( PagedPool, RequiredLength ); if (LocalStatistics == NULL) { SepReleaseTokenReadLock( Token ); return( STATUS_INSUFFICIENT_RESOURCES ); } // // Return the statistics // LocalStatistics->TokenId = Token->TokenId; LocalStatistics->AuthenticationId = Token->AuthenticationId; LocalStatistics->ExpirationTime = Token->ExpirationTime; LocalStatistics->TokenType = Token->TokenType; LocalStatistics->ImpersonationLevel = Token->ImpersonationLevel; LocalStatistics->DynamicCharged = Token->DynamicCharged; LocalStatistics->DynamicAvailable = Token->DynamicAvailable; LocalStatistics->GroupCount = Token->UserAndGroupCount-1; LocalStatistics->PrivilegeCount = Token->PrivilegeCount; LocalStatistics->ModifiedId = Token->ModifiedId; SepReleaseTokenReadLock( Token ); *TokenInformation = LocalStatistics; return STATUS_SUCCESS; } case TokenSessionId: /* * Get SessionId for the token */ SeQuerySessionIdToken( (PACCESS_TOKEN)Token, (PULONG)TokenInformation ); return( STATUS_SUCCESS ); default: return STATUS_INVALID_INFO_CLASS; } }

VOID SeQuerySecurityAccessMask (  IN SECURITY_INFORMATION  SecurityInformation, OUT PACCESS_MASK  DesiredAccess )

Definition at line 138 of file semethod.c. References PAGED_CODE. Referenced by IoCheckFunctionAccess(), and NtQuerySecurityObject(). : This routine builds an access mask representing the accesses necessary to query the object security information specified in the SecurityInformation parameter. While it is not difficult to determine this information, the use of a single routine to generate it will ensure minimal impact when the security information associated with an object is extended in the future (to include mandatory access control information). Arguments: SecurityInformation - Identifies the object's security information to be queried. DesiredAccess - Points to an access mask to be set to represent the accesses necessary to query the information specified in the SecurityInformation parameter. Return Value: None. --*/ { PAGED_CODE(); // // Figure out accesses needed to perform the indicated operation(s). // (*DesiredAccess) = 0; if ((SecurityInformation & OWNER_SECURITY_INFORMATION) || (SecurityInformation & GROUP_SECURITY_INFORMATION) || (SecurityInformation & DACL_SECURITY_INFORMATION)) { (*DesiredAccess) |= READ_CONTROL; } if ((SecurityInformation & SACL_SECURITY_INFORMATION)) { (*DesiredAccess) |= ACCESS_SYSTEM_SECURITY; } return; }

NTKERNELAPI NTSTATUS SeQuerySecurityDescriptorInfo (  IN PSECURITY_INFORMATION  SecurityInformation, OUT PSECURITY_DESCRIPTOR  SecurityDescriptor, IN OUT PULONG  Length, IN PSECURITY_DESCRIPTOR *  ObjectsSecurityDescriptor )

Definition at line 559 of file semethod.c. References EXCEPTION_EXECUTE_HANDLER, LongAlignPtr, NULL, PAGED_CODE, RtlCreateSecurityDescriptorRelative(), SeLengthSid, and Size. Referenced by CmpQuerySecurityDescriptorInfo(), IopGetSetSecurityObject(), and ObQuerySecurityDescriptorInfo(). : This routine will extract the desired information from the passed security descriptor and return the information in the passed buffer as a security descriptor in self-relative format. Arguments: SecurityInformation - Specifies what information is being queried. SecurityDescriptor - Supplies the buffer to output the requested information into. This buffer has been probed only to the size indicated by the Length parameter. Since it still points into user space, it must always be accessed in a try clause. Length - Supplies the address of a variable containing the length of the security descriptor buffer. Upon return this variable will contain the length needed to store the requested information. ObjectsSecurityDescriptor - Supplies the address of a pointer to the objects security descriptor. The passed security descriptor must be in self-relative format. Return Value: NTSTATUS - STATUS_SUCCESS if successful and an appropriate error value otherwise --*/ { ULONG BufferLength; ULONG Size; ULONG OwnerLength; ULONG GroupLength; ULONG DaclLength; ULONG SaclLength; PUCHAR NextFree; SECURITY_DESCRIPTOR IObjectSecurity; // // Note that IObjectSecurity is not a pointer to a pointer // like ObjectsSecurityDescriptor is. // SECURITY_DESCRIPTOR_RELATIVE *ISecurityDescriptor = SecurityDescriptor; PAGED_CODE(); // // We will be accessing user memory throughout this routine, // therefore do everything in a try-except clause. // try { BufferLength = *Length; // // Check if the object's descriptor is null, and if it is then // we only need to return a blank security descriptor record // if (*ObjectsSecurityDescriptor == NULL) { *Length = sizeof(SECURITY_DESCRIPTOR_RELATIVE); // // Now make sure it's large enough for the security descriptor // record // if (BufferLength < sizeof(SECURITY_DESCRIPTOR_RELATIVE)) { return STATUS_BUFFER_TOO_SMALL; } // // It's large enough to make a blank security descriptor record // // Note that this parameter has been probed for write by the // object manager, however, we still have to be careful when // writing to it. // // // We do not have to probe this here, because the object // manager has probed it for length=BufferLength, which we // know at this point is at least as large as a security // descriptor. // RtlCreateSecurityDescriptorRelative( SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION ); // // Mark it as self-relative // RtlpSetControlBits( ISecurityDescriptor, SE_SELF_RELATIVE ); // // And return to our caller // return STATUS_SUCCESS; } // // Create an absolute format SD on the stack pointing into // user space to simplify the following code // RtlCopyMemory( (&IObjectSecurity), *ObjectsSecurityDescriptor, sizeof(SECURITY_DESCRIPTOR_RELATIVE) ); IObjectSecurity.Owner = RtlpOwnerAddrSecurityDescriptor( (SECURITY_DESCRIPTOR *) *ObjectsSecurityDescriptor ); IObjectSecurity.Group = RtlpGroupAddrSecurityDescriptor( (SECURITY_DESCRIPTOR *) *ObjectsSecurityDescriptor ); IObjectSecurity.Dacl = RtlpDaclAddrSecurityDescriptor( (SECURITY_DESCRIPTOR *) *ObjectsSecurityDescriptor ); IObjectSecurity.Sacl = RtlpSaclAddrSecurityDescriptor( (SECURITY_DESCRIPTOR *) *ObjectsSecurityDescriptor ); IObjectSecurity.Control &= ~SE_SELF_RELATIVE; // // This is not a blank descriptor so we need to determine the size // needed to store the requested information. It is the size of the // descriptor record plus the size of each requested component. // Size = sizeof(SECURITY_DESCRIPTOR_RELATIVE); if ( (((*SecurityInformation) & OWNER_SECURITY_INFORMATION)) && (IObjectSecurity.Owner != NULL) ) { OwnerLength = SeLengthSid( IObjectSecurity.Owner ); Size += (ULONG)LongAlignSize(OwnerLength); } if ( (((*SecurityInformation) & GROUP_SECURITY_INFORMATION)) && (IObjectSecurity.Group != NULL) ) { GroupLength = SeLengthSid( IObjectSecurity.Group ); Size += (ULONG)LongAlignSize(GroupLength); } if ( (((*SecurityInformation) & DACL_SECURITY_INFORMATION)) && (IObjectSecurity.Control & SE_DACL_PRESENT) && (IObjectSecurity.Dacl != NULL) ) { DaclLength = (ULONG)LongAlignSize((IObjectSecurity.Dacl)->AclSize); Size += DaclLength; } if ( (((*SecurityInformation) & SACL_SECURITY_INFORMATION)) && (IObjectSecurity.Control & SE_SACL_PRESENT) && (IObjectSecurity.Sacl != NULL) ) { SaclLength = (ULONG)LongAlignSize((IObjectSecurity.Sacl)->AclSize); Size += SaclLength; } // // Tell the caller how much space this will require // (whether we actually fit or not) // *Length = Size; // // Now make sure the size is less than or equal to the length // we were passed // if (Size > BufferLength) { return STATUS_BUFFER_TOO_SMALL; } // // The length is fine. // // Fill in the length and flags part of the security descriptor. // The real addresses of each acl will be filled in later when we // copy the ACLs over. // // Note that we only set a flag in the descriptor if the information // was requested, which is a simple copy of the requested information // input variable // // The output buffer has already been probed to the passed size, // so we can just write to it. // RtlCreateSecurityDescriptorRelative( SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION ); // // Mark the returned Security Descriptor as being in // self-relative format // RtlpSetControlBits( ISecurityDescriptor, SE_SELF_RELATIVE ); // // NextFree is used to point to the next free spot in the // returned security descriptor. // NextFree = LongAlignPtr((PUCHAR)SecurityDescriptor + sizeof(SECURITY_DESCRIPTOR_RELATIVE)); // // Copy the Owner SID if necessary and update the NextFree pointer, // keeping it longword aligned. // if ( ((*SecurityInformation) & OWNER_SECURITY_INFORMATION) && ((IObjectSecurity.Owner) != NULL) ) { RtlMoveMemory( NextFree, IObjectSecurity.Owner, OwnerLength ); ISecurityDescriptor->Owner = (ULONG)((PUCHAR)NextFree - (PUCHAR)SecurityDescriptor); RtlpPropagateControlBits( ISecurityDescriptor, &IObjectSecurity, SE_OWNER_DEFAULTED ); NextFree += (ULONG)LongAlignSize(OwnerLength); } // // Copy the Group SID if necessary and update the NextFree pointer, // keeping it longword aligned. // if ( ((*SecurityInformation) & GROUP_SECURITY_INFORMATION) && (IObjectSecurity.Group != NULL) ) { RtlMoveMemory( NextFree, IObjectSecurity.Group, GroupLength ); ISecurityDescriptor->Group = (ULONG)((PUCHAR)NextFree - (PUCHAR)SecurityDescriptor); RtlpPropagateControlBits( ISecurityDescriptor, &IObjectSecurity, SE_GROUP_DEFAULTED ); NextFree += (ULONG)LongAlignSize(GroupLength); } // // Set discretionary acl information if requested. // If not set in object's security, // then everything is already set properly. // if ( (*SecurityInformation) & DACL_SECURITY_INFORMATION) { RtlpPropagateControlBits( ISecurityDescriptor, &IObjectSecurity, SE_DACL_PRESENT | SE_DACL_DEFAULTED | SE_DACL_PROTECTED | SE_DACL_AUTO_INHERITED ); // // Copy the acl if non-null and update the NextFree pointer, // keeping it longword aligned. // if ( (IObjectSecurity.Control & SE_DACL_PRESENT) != 0 && IObjectSecurity.Dacl != NULL) { RtlMoveMemory( NextFree, IObjectSecurity.Dacl, (IObjectSecurity.Dacl)->AclSize ); ISecurityDescriptor->Dacl = (ULONG)((PUCHAR)NextFree - (PUCHAR)SecurityDescriptor); NextFree += DaclLength; } } // // Set system acl information if requested. // If not set in object's security, // then everything is already set properly. // if ( (*SecurityInformation) & SACL_SECURITY_INFORMATION) { RtlpPropagateControlBits( ISecurityDescriptor, &IObjectSecurity, SE_SACL_PRESENT | SE_SACL_DEFAULTED | SE_SACL_PROTECTED | SE_SACL_AUTO_INHERITED ); // // Copy the acl if non-null and update the NextFree pointer, // keeping it longword aligned. // if ( (IObjectSecurity.Control & SE_SACL_PRESENT) != 0 && IObjectSecurity.Sacl != NULL) { RtlMoveMemory( NextFree, IObjectSecurity.Sacl, (IObjectSecurity.Sacl)->AclSize ); ISecurityDescriptor->Sacl = (ULONG)((PUCHAR)NextFree - (PUCHAR)SecurityDescriptor); } } } except(EXCEPTION_EXECUTE_HANDLER) { return(GetExceptionCode()); } return STATUS_SUCCESS; }

NTKERNELAPI NTSTATUS SeQuerySessionIdToken (  IN  PACCESS_TOKEN, IN PULONG  pSessionId )

NTKERNELAPI NTSTATUS SeRegisterLogonSessionTerminatedRoutine (  IN PSE_LOGON_SESSION_TERMINATED_ROUTINE  CallbackRoutine  )

Definition at line 849 of file rmlogon.c. References _SEP_LOGON_SESSION_TERMINATED_NOTIFICATION::CallbackRoutine, ExAllocatePoolWithTag, _SEP_LOGON_SESSION_TERMINATED_NOTIFICATION::Next, NULL, PAGED_CODE, PagedPool, PSE_LOGON_SESSION_TERMINATED_ROUTINE, PSEP_LOGON_SESSION_TERMINATED_NOTIFICATION, SeFileSystemNotifyRoutinesHead, SepRmAcquireDbWriteLock, and SepRmReleaseDbWriteLock. : This routine is called by file systems that are interested in being notified when a logon session is being deleted. Arguments: CallbackRoutine - Address of routine to call back when a logon session is being deleted. Return Value: STATUS_SUCCESS - Successfully registered routine STATUS_INVALID_PARAMETER - CallbackRoutine is NULL STATUS_INSUFFICIENT_RESOURCE - Unable to allocate list entry. --*/ { PSEP_LOGON_SESSION_TERMINATED_NOTIFICATION NewCallback; PAGED_CODE(); if (CallbackRoutine == NULL) { return( STATUS_INVALID_PARAMETER ); } NewCallback = ExAllocatePoolWithTag( PagedPool, sizeof(SEP_LOGON_SESSION_TERMINATED_NOTIFICATION), 'SFeS'); if (NewCallback == NULL) { return( STATUS_INSUFFICIENT_RESOURCES ); } SepRmAcquireDbWriteLock(); NewCallback->Next = SeFileSystemNotifyRoutinesHead.Next; NewCallback->CallbackRoutine = CallbackRoutine; SeFileSystemNotifyRoutinesHead.Next = NewCallback; SepRmReleaseDbWriteLock(); return( STATUS_SUCCESS ); }

VOID SeReleaseAcl (  IN PACL  CapturedAcl, IN KPROCESSOR_MODE  RequestorMode, IN BOOLEAN  ForceCapture )

Definition at line 1560 of file se/capture.c. References ExFreePool(), KernelMode, PAGED_CODE, TRUE, and UserMode. Referenced by NtCreateToken(), and NtSetInformationToken(). 01568 : 01569 01570 This routine releases a previously captured ACL. 01571 01572 This routine should NOT be called if the ACL was captured into a 01573 provided CaptureBuffer (see SeCaptureAcl). 01574 01575 Arguments: 01576 01577 CapturedAcl - Supplies the ACL to release. 01578 01579 RequestorMode - The processor mode specified when the ACL was captured. 01580 01581 ForceCapture - The ForceCapture value specified when the ACL was 01582 captured. 01583 01584 Return Value: 01585 01586 None. 01587 01588 --*/ 01589 01590 { 01591 // 01592 // We only have something to deallocate if the requestor was user 01593 // mode or kernel mode requesting ForceCapture. 01594 // 01595 01596 PAGED_CODE(); 01597 01598 if ( ((RequestorMode == KernelMode) && (ForceCapture == TRUE)) || 01599 (RequestorMode == UserMode ) ) { 01600 01601 ExFreePool(CapturedAcl); 01602 01603 } 01604 01605 }

VOID SeReleaseLuidAndAttributesArray (  IN PLUID_AND_ATTRIBUTES  CapturedArray, IN KPROCESSOR_MODE  RequestorMode, IN BOOLEAN  ForceCapture )

Definition at line 1797 of file se/capture.c. References ExFreePool(), KernelMode, NULL, PAGED_CODE, TRUE, and UserMode. Referenced by NtAdjustPrivilegesToken(), NtCreateToken(), NtFilterToken(), and NtPrivilegeCheck(). 01805 : 01806 01807 This routine releases a previously captured array of LUID_AND_ATTRIBUTES. 01808 01809 This routine should NOT be called if the array was captured into a 01810 provided CaptureBuffer (see SeCaptureLuidAndAttributesArray). 01811 01812 Arguments: 01813 01814 CapturedArray - Supplies the array to release. 01815 01816 RequestorMode - The processor mode specified when the array was captured. 01817 01818 ForceCapture - The ForceCapture value specified when the array was 01819 captured. 01820 01821 Return Value: 01822 01823 None. 01824 01825 --*/ 01826 01827 { 01828 // 01829 // We only have something to deallocate if the requestor was user 01830 // mode or kernel mode requesting ForceCapture. 01831 // 01832 01833 PAGED_CODE(); 01834 01835 if ( ((RequestorMode == KernelMode) && (ForceCapture == TRUE)) || 01836 (RequestorMode == UserMode )) { 01837 // 01838 // the capture routine returns success with a null pointer for zero elements. 01839 // 01840 if (CapturedArray != NULL) 01841 ExFreePool(CapturedArray); 01842 01843 } 01844 01845 return; 01846 01847 }

NTKERNELAPI VOID SeReleaseSecurityDescriptor (  IN PSECURITY_DESCRIPTOR  CapturedSecurityDescriptor, IN KPROCESSOR_MODE  RequestorMode, IN BOOLEAN  ForceCapture )

Definition at line 631 of file se/capture.c. References ExFreePool(), KernelMode, PAGED_CODE, TRUE, and UserMode. Referenced by IopSetSecurityObjectFromRegistry(), NtOpenObjectAuditAlarm(), NtSetSecurityObject(), NtUserCreateWindowStation(), ObInsertObject(), SeAccessCheckByType(), and SepAccessCheckAndAuditAlarm(). : This routine releases a previously captured security descriptor. Only Arguments: CapturedSecurityDescriptor - Supplies the security descriptor to release. RequestorMode - The processor mode specified when the descriptor was captured. ForceCapture - The ForceCapture value specified when the descriptor was captured. Return Value: None. --*/ { // // We only have something to deallocate if the requestor was user // mode or kernel mode requesting ForceCapture. // PAGED_CODE(); if ( ((RequestorMode == KernelMode) && (ForceCapture == TRUE)) || (RequestorMode == UserMode ) ) { if ( CapturedSecurityDescriptor ) { ExFreePool(CapturedSecurityDescriptor); } } return; }

VOID SeReleaseSid (  IN PSID  CapturedSid, IN KPROCESSOR_MODE  RequestorMode, IN BOOLEAN  ForceCapture )

Definition at line 1320 of file se/capture.c. References ExFreePool(), KernelMode, PAGED_CODE, TRUE, and UserMode. Referenced by NtCreateToken(), NtSecureConnectPort(), NtSetInformationToken(), SeAccessCheckByType(), and SepAccessCheckAndAuditAlarm(). 01328 : 01329 01330 This routine releases a previously captured SID. 01331 01332 This routine should NOT be called if the SID was captured into a 01333 provided CaptureBuffer (see SeCaptureSid). 01334 01335 Arguments: 01336 01337 CapturedSid - Supplies the SID to release. 01338 01339 RequestorMode - The processor mode specified when the SID was captured. 01340 01341 ForceCapture - The ForceCapture value specified when the SID was 01342 captured. 01343 01344 Return Value: 01345 01346 None. 01347 01348 --*/ 01349 01350 { 01351 // 01352 // We only have something to deallocate if the requestor was user 01353 // mode or kernel mode requesting ForceCapture. 01354 // 01355 01356 PAGED_CODE(); 01357 01358 if ( ((RequestorMode == KernelMode) && (ForceCapture == TRUE)) || 01359 (RequestorMode == UserMode ) ) { 01360 01361 ExFreePool(CapturedSid); 01362 01363 } 01364 01365 return; 01366 01367 }

VOID SeReleaseSidAndAttributesArray (  IN PSID_AND_ATTRIBUTES  CapturedArray, IN KPROCESSOR_MODE  RequestorMode, IN BOOLEAN  ForceCapture )

Definition at line 2297 of file se/capture.c. References ExFreePool(), KernelMode, PAGED_CODE, TRUE, and UserMode. Referenced by NtAdjustGroupsToken(), NtCreateToken(), and NtFilterToken(). : This routine releases a previously captured array of SID_AND_ATTRIBUTES. This routine should NOT be called if the array was captured into a provided CaptureBuffer (see SeCaptureSidAndAttributesArray). Arguments: CapturedArray - Supplies the array to release. RequestorMode - The processor mode specified when the array was captured. ForceCapture - The ForceCapture value specified when the array was captured. Return Value: None. --*/ { // // We only have something to deallocate if the requestor was user // mode or kernel mode requesting ForceCapture. // PAGED_CODE(); if ( ((RequestorMode == KernelMode) && (ForceCapture == TRUE)) || (RequestorMode == UserMode ) ) { ExFreePool(CapturedArray); } return; }

NTKERNELAPI VOID SeReleaseSubjectContext (  IN PSECURITY_SUBJECT_CONTEXT  SubjectContext  )

Definition at line 196 of file subject.c. References NULL, PAGED_CODE, PsDereferenceImpersonationToken, and PsDereferencePrimaryToken. Referenced by CmpFlushNotify(), FsRtlCancelNotify(), FsRtlNotifyCleanup(), FsRtlNotifyFullChangeDirectory(), IsPrivileged(), NtCloseObjectAuditAlarm(), NtDeleteObjectAuditAlarm(), NtOpenObjectAuditAlarm(), NtPrivilegedServiceAuditAlarm(), NtPrivilegeObjectAuditAlarm(), NtSetUuidSeed(), RtlpSetSecurityObject(), SeAccessCheckByType(), SeAuditHandleDuplication(), SeAuditProcessCreation(), SeCheckPrivilegedObject(), SeCloseObjectAuditAlarm(), SeDeleteAccessState(), SeDeleteObjectAuditAlarm(), SepAccessCheckAndAuditAlarm(), SeSinglePrivilegeCheck(), and xxxCreateWindowStation(). 00203 : 00204 00205 This routine releases a subject security context previously captured by 00206 SeCaptureSubjectContext(). 00207 00208 Arguments: 00209 00210 SubjectContext - Points to a SECURITY_SUBJECT_CONTEXT data structure 00211 containing a subject's previously captured security context. 00212 00213 Return Value: 00214 00215 none. 00216 00217 --*/ 00218 00219 { 00220 PAGED_CODE(); 00221 00222 PsDereferencePrimaryToken( SubjectContext->PrimaryToken ); 00223 SubjectContext->PrimaryToken = NULL; 00224 00225 00226 PsDereferenceImpersonationToken( SubjectContext->ClientToken ); 00227 SubjectContext->ClientToken = NULL; 00228 00229 return; 00230 00231 }

BOOLEAN SeRmInitPhase1 (   )

Definition at line 60 of file rmmain.c. References ASSERT, ExAllocatePoolWithTag, ExFreePool(), FALSE, _SEP_RM_STATE::LsaInitEventHandle, NT_SUCCESS, NTSTATUS(), NULL, ObjectAttributes, PAGED_CODE, PagedPool, PsCreateSystemThread(), _SEP_RM_STATE::RmCommandPortHandle, RtlAddAccessAllowedAce(), RtlAnsiStringToUnicodeString(), RtlCreateAcl(), RtlCreateSecurityDescriptor(), RtlFreeUnicodeString(), RtlInitString(), SeLengthSid, SeLocalSystemSid, SEP_RM_CONNECT_INFO, SepAdtInitializeAuditingOptions(), SepAdtInitializeCrashOnFail(), SepAdtInitializePrivilegeAuditing(), SepRmCommandServerThread(), SepRmState, _SEP_RM_STATE::SepRmThreadHandle, Status, and TRUE. : This function is called by Phase 1 System Initialization to initialize the Security Reference Monitor. Note that initialization of the Reference Monitor Global State has already been performed in Phase 0 initialization to allow access validation routines to operate without having to check that Reference Monitor Initialization is complete. The steps listed below are performed in this routine. The remainder of Reference Monitor initialization requires the LSA subsystem to have run, so that initialization is performed in a separate thread (the RM Command Server Thread, see below), so that the present thread can create the Session Manager which execs the LSA. o Create the Reference Monitor Command LPC port. The LSA subsystem sends commands (e.g. turn on auditing) which change the Reference Monitor Global State. o Create an Event for use in synchronizing with the LSA subsystem. The LSA will signal the event when the portion of LSA initialization upon with the Reference Monitor depends is complete. The Reference Monitor uses another LPC port, called the LSA Command Port to send commands to the LSA, so the RM must know that this port has been created before trying to connect to it. o Create the Reference Monitor Command Server Thread. This thread is a permanent thread of the System Init process that fields the Reference Monitor State Change commands described above. Arguments: None. Return Value: BOOLEAN - TRUE if Rm Initialization (Phase 1) succeeded, else FALSE --*/ { NTSTATUS Status; STRING RmCommandPortName; UNICODE_STRING UnicodeRmCommandPortName; OBJECT_ATTRIBUTES ObjectAttributes; STRING LsaInitEventName; UNICODE_STRING UnicodeLsaInitEventName; OBJECT_ATTRIBUTES LsaInitEventObjectAttributes; SECURITY_DESCRIPTOR LsaInitEventSecurityDescriptor; ULONG AclSize; PAGED_CODE(); // // Create an LPC port called the Reference Monitor Command Port. // This will be used by the LSA to send commands to the Reference // Monitor to update its state data. // RtlInitString( &RmCommandPortName, "\\SeRmCommandPort" ); Status = RtlAnsiStringToUnicodeString( &UnicodeRmCommandPortName, &RmCommandPortName, TRUE ); ASSERT( NT_SUCCESS(Status) ); InitializeObjectAttributes( &ObjectAttributes, &UnicodeRmCommandPortName, 0, NULL, NULL ); Status = ZwCreatePort( &SepRmState.RmCommandPortHandle, &ObjectAttributes, sizeof(SEP_RM_CONNECT_INFO), sizeof(RM_COMMAND_MESSAGE), sizeof(RM_COMMAND_MESSAGE) * 32 ); RtlFreeUnicodeString( &UnicodeRmCommandPortName ); if( !NT_SUCCESS(Status) ) { KdPrint(("Security: Rm Create Command Port failed 0x%lx\n", Status)); return FALSE; } // // Prepare to create an event for synchronizing with the LSA. // First, build the Security Descriptor for the Init Event Object // Status = RtlCreateSecurityDescriptor( &LsaInitEventSecurityDescriptor, SECURITY_DESCRIPTOR_REVISION ); if (!NT_SUCCESS(Status)) { KdPrint(("Security: Creating Lsa Init Event Desc failed 0x%lx\n", Status)); return FALSE; } // // Allocate a temporary buffer from the paged pool. It is a fatal // system error if the allocation fails since security cannot be // enabled. // AclSize = sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE) + SeLengthSid(SeLocalSystemSid); LsaInitEventSecurityDescriptor.Dacl = ExAllocatePoolWithTag(PagedPool, AclSize, 'cAeS'); if (LsaInitEventSecurityDescriptor.Dacl == NULL) { KdPrint(("Security LSA: Insufficient resources to initialize\n")); return FALSE; } // // Now create the Discretionary ACL within the Security Descriptor // Status = RtlCreateAcl( LsaInitEventSecurityDescriptor.Dacl, AclSize, ACL_REVISION2 ); if (!NT_SUCCESS(Status)) { KdPrint(("Security: Creating Lsa Init Event Dacl failed 0x%lx\n", Status)); return FALSE; } // // Now add an ACE giving GENERIC_ALL access to the User ID // Status = RtlAddAccessAllowedAce( LsaInitEventSecurityDescriptor.Dacl, ACL_REVISION2, GENERIC_ALL, SeLocalSystemSid ); if (!NT_SUCCESS(Status)) { KdPrint(("Security: Adding Lsa Init Event ACE failed 0x%lx\n", Status)); return FALSE; } // // Set up the Object Attributes for the Lsa Initialization Event // RtlInitString( &LsaInitEventName, "\\SeLsaInitEvent" ); Status = RtlAnsiStringToUnicodeString( &UnicodeLsaInitEventName, &LsaInitEventName, TRUE ); ASSERT( NT_SUCCESS(Status) ); InitializeObjectAttributes( &LsaInitEventObjectAttributes, &UnicodeLsaInitEventName, 0, NULL, &LsaInitEventSecurityDescriptor ); // // Create an event for use in synchronizing with the LSA. The LSA will // signal this event when LSA initialization has reached the point // where the LSA's Reference Monitor Server Port has been created. // Status = ZwCreateEvent( &(SepRmState.LsaInitEventHandle), EVENT_MODIFY_STATE, &LsaInitEventObjectAttributes, NotificationEvent, FALSE); RtlFreeUnicodeString( &UnicodeLsaInitEventName ); if (!NT_SUCCESS(Status)) { KdPrint(("Security: LSA init event creation failed.0x%xl\n", Status)); return FALSE; } // // Deallocate the pool memory used for the Init Event DACL // ExFreePool( LsaInitEventSecurityDescriptor.Dacl ); // // Create a permanent thread of the Sysinit Process, called the // Reference Monitor Server Thread. This thread is dedicated to // receiving Reference Monitor commands and dispatching them. // Status = PsCreateSystemThread( &SepRmState.SepRmThreadHandle, THREAD_GET_CONTEXT | THREAD_SET_CONTEXT | THREAD_SET_INFORMATION, NULL, NULL, NULL, SepRmCommandServerThread, NULL ); if (!NT_SUCCESS(Status)) { KdPrint(("Security: Rm Server Thread creation failed 0x%lx\n", Status)); return FALSE; } // // Initialize data from the registry. This must go here because all other // Se initialization takes place before the registry is initialized. // SepAdtInitializeCrashOnFail(); SepAdtInitializePrivilegeAuditing(); SepAdtInitializeAuditingOptions(); // // Reference Monitor initialization is successful if we get to here. // ZwClose( SepRmState.SepRmThreadHandle ); SepRmState.SepRmThreadHandle = NULL; return TRUE; }

VOID SeSetAccessStateGenericMapping (  PACCESS_STATE  AccessState, PGENERIC_MAPPING  GenericMapping )

Definition at line 396 of file seastate.c. References _ACCESS_STATE::AuxData, _AUX_ACCESS_DATA::GenericMapping, and PAGED_CODE. Referenced by IopParseDevice(). : This routine sets the GenericMapping field in an AccessState structure. It must be called before access validation is performed if the GenericMapping is not passed in when the AccessState structure is created. Arguments: AccessState - a pointer to the ACCESS_STATE structure to be modified. GenericMapping - a pointer to the GenericMapping to be copied into the AccessState. Return Value: --*/ { PAUX_ACCESS_DATA AuxData; PAGED_CODE(); AuxData = (PAUX_ACCESS_DATA)AccessState->AuxData; AuxData->GenericMapping = *GenericMapping; return; }

VOID SeSetSecurityAccessMask (  IN SECURITY_INFORMATION  SecurityInformation, OUT PACCESS_MASK  DesiredAccess )

Definition at line 78 of file semethod.c. References PAGED_CODE. Referenced by IoCheckFunctionAccess(), and NtSetSecurityObject(). : This routine builds an access mask representing the accesses necessary to set the object security information specified in the SecurityInformation parameter. While it is not difficult to determine this information, the use of a single routine to generate it will ensure minimal impact when the security information associated with an object is extended in the future (to include mandatory access control information). Arguments: SecurityInformation - Identifies the object's security information to be modified. DesiredAccess - Points to an access mask to be set to represent the accesses necessary to modify the information specified in the SecurityInformation parameter. Return Value: None. --*/ { PAGED_CODE(); // // Figure out accesses needed to perform the indicated operation(s). // (*DesiredAccess) = 0; if ((SecurityInformation & OWNER_SECURITY_INFORMATION) || (SecurityInformation & GROUP_SECURITY_INFORMATION) ) { (*DesiredAccess) |= WRITE_OWNER; } if (SecurityInformation & DACL_SECURITY_INFORMATION) { (*DesiredAccess) |= WRITE_DAC; } if (SecurityInformation & SACL_SECURITY_INFORMATION) { (*DesiredAccess) |= ACCESS_SYSTEM_SECURITY; } return; }

NTKERNELAPI NTSTATUS SeSetSecurityDescriptorInfo (  IN PVOID Object  OPTIONAL, IN PSECURITY_INFORMATION  SecurityInformation, IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN OUT PSECURITY_DESCRIPTOR *  ObjectsSecurityDescriptor, IN POOL_TYPE  PoolType, IN PGENERIC_MAPPING  GenericMapping )

Definition at line 365 of file semethod.c. References NULL, and RtlpSetSecurityObject(). Referenced by CmpSetSecurityDescriptorInfo(), IopSetDeviceSecurityDescriptors(), and ObSetSecurityDescriptorInfo(). : This routine will set an object's security descriptor. The input security descriptor must be previously captured. Arguments: Object - Optionally supplies the object whose security is being adjusted. This is used to update security quota information. SecurityInformation - Indicates which security information is to be applied to the object. The value(s) to be assigned are passed in the SecurityDescriptor parameter. ModificationDescriptor - Supplies the input security descriptor to be applied to the object. The caller of this routine is expected to probe and capture the passed security descriptor before calling and release it after calling. ObjectsSecurityDescriptor - Supplies the address of a pointer to the objects security descriptor that is going to be altered by this procedure. This structure must be deallocated by the caller. PoolType - Specifies the type of pool to allocate for the objects security descriptor. GenericMapping - This argument provides the mapping of generic to specific/standard access types for the object being accessed. This mapping structure is expected to be safe to access (i.e., captured if necessary) prior to be passed to this routine. Return Value: NTSTATUS - STATUS_SUCCESS if successful and an appropriate error value otherwise. --*/ { // // Make sure the object already has a security descriptor. // Objects that 'may' have security descriptors 'must' have security // descriptors. If this one doesn't already have one, then we can't // assign one to it. // if ((*ObjectsSecurityDescriptor) == NULL) { return(STATUS_NO_SECURITY_ON_OBJECT); } // // Pass this call to the common Rtlp routine. // return RtlpSetSecurityObject ( Object, *SecurityInformation, ModificationDescriptor, ObjectsSecurityDescriptor, 0, // No Auto Inheritance PoolType, GenericMapping, NULL ); // No Token }

NTKERNELAPI NTSTATUS SeSetSecurityDescriptorInfoEx (  IN PVOID Object  OPTIONAL, IN PSECURITY_INFORMATION  SecurityInformation, IN PSECURITY_DESCRIPTOR  ModificationDescriptor, IN OUT PSECURITY_DESCRIPTOR *  ObjectsSecurityDescriptor, IN ULONG  AutoInheritFlags, IN POOL_TYPE  PoolType, IN PGENERIC_MAPPING  GenericMapping )

Definition at line 452 of file semethod.c. References NULL, and RtlpSetSecurityObject(). : This routine will set an object's security descriptor. The input security descriptor must be previously captured. Arguments: Object - Optionally supplies the object whose security is being adjusted. This is used to update security quota information. SecurityInformation - Indicates which security information is to be applied to the object. The value(s) to be assigned are passed in the SecurityDescriptor parameter. ModificationDescriptor - Supplies the input security descriptor to be applied to the object. The caller of this routine is expected to probe and capture the passed security descriptor before calling and release it after calling. ObjectsSecurityDescriptor - Supplies the address of a pointer to the objects security descriptor that is going to be altered by this procedure. This structure must be deallocated by the caller. AutoInheritFlags - Controls automatic inheritance of ACES. Valid values are a bits mask of the logical OR of one or more of the following bits: SEF_DACL_AUTO_INHERIT - If set, inherited ACEs from the DACL in the ObjectsSecurityDescriptor are preserved and inherited ACEs from the ModificationDescriptor are ignored. Inherited ACEs are not supposed to be modified; so preserving them across this call is appropriate. If a protected server does not itself implement auto inheritance, it should not set this bit. The caller of the protected server may implement auto inheritance and my indeed be modifying inherited ACEs. SEF_SACL_AUTO_INHERIT - If set, inherited ACEs from the SACL in the ObjectsSecurityDescriptor are preserved and inherited ACEs from the ModificationDescriptor are ignored. Inherited ACEs are not supposed to be modified; so preserving them across this call is appropriate. If a protected server does not itself implement auto inheritance, it should not set this bit. The caller of the protected server may implement auto inheritance and my indeed be modifying inherited ACEs. PoolType - Specifies the type of pool to allocate for the objects security descriptor. GenericMapping - This argument provides the mapping of generic to specific/standard access types for the object being accessed. This mapping structure is expected to be safe to access (i.e., captured if necessary) prior to be passed to this routine. Return Value: NTSTATUS - STATUS_SUCCESS if successful and an appropriate error value otherwise. --*/ { // // Make sure the object already has a security descriptor. // Objects that 'may' have security descriptors 'must' have security // descriptors. If this one doesn't already have one, then we can't // assign one to it. // if ((*ObjectsSecurityDescriptor) == NULL) { return(STATUS_NO_SECURITY_ON_OBJECT); } // // Pass this call to the common Rtlp routine. // return RtlpSetSecurityObject ( Object, *SecurityInformation, ModificationDescriptor, ObjectsSecurityDescriptor, AutoInheritFlags, PoolType, GenericMapping, NULL ); // No Token }

NTKERNELAPI NTSTATUS SeSetSessionIdToken (  IN  PACCESS_TOKEN, IN ULONG  SessionId )

NTKERNELAPI BOOLEAN SeSinglePrivilegeCheck (  LUID  PrivilegeValue, KPROCESSOR_MODE  PreviousMode )

Definition at line 436 of file privileg.c. References KernelMode, NULL, PAGED_CODE, SeCaptureSubjectContext(), SECURITY_SUBJECT_CONTEXT, SePrivilegeCheck(), SePrivilegedServiceAuditAlarm(), and SeReleaseSubjectContext(). Referenced by CmpDoOpen(), CmpRefreshHive(), ExpRaiseHardError(), NtAllocateUserPhysicalPages(), NtCreatePagingFile(), NtCreateProfile(), NtLoadDriver(), NtLoadKey2(), NtLockVirtualMemory(), NtOpenProcess(), NtOpenThread(), NtQuerySystemEnvironmentValue(), NtQuerySystemInformation(), NtReplaceKey(), NtRestoreKey(), NtSaveKey(), NtSaveMergedKeys(), NtSetDefaultHardErrorPort(), NtSetInformationProcess(), NtSetInformationToken(), NtSetSystemEnvironmentValue(), NtSetSystemInformation(), NtSystemDebugControl(), NtUnloadDriver(), NtUnloadKey(), NtUnlockVirtualMemory(), ObCreateObject(), PspSetQuotaLimits(), SepCreateToken(), SepValidOwnerSubjectContext(), and UdfInvalidateVolumes(). : This function will check for the passed privilege value in the current context. Arguments: PrivilegeValue - The value of the privilege being checked. Return Value: TRUE - The current subject has the desired privilege. FALSE - The current subject does not have the desired privilege. --*/ { BOOLEAN AccessGranted; PRIVILEGE_SET RequiredPrivileges; SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; PAGED_CODE(); // // Make sure the caller has the privilege to make this // call. // RequiredPrivileges.PrivilegeCount = 1; RequiredPrivileges.Control = PRIVILEGE_SET_ALL_NECESSARY; RequiredPrivileges.Privilege[0].Luid = PrivilegeValue; RequiredPrivileges.Privilege[0].Attributes = 0; SeCaptureSubjectContext( &SubjectSecurityContext ); AccessGranted = SePrivilegeCheck( &RequiredPrivileges, &SubjectSecurityContext, PreviousMode ); if ( PreviousMode != KernelMode ) { SePrivilegedServiceAuditAlarm ( NULL, // BUGWARNING need service name &SubjectSecurityContext, &RequiredPrivileges, AccessGranted ); } SeReleaseSubjectContext( &SubjectSecurityContext ); return( AccessGranted ); }

NTSTATUS SeSubProcessToken (  IN PEPROCESS  ParentProcess, OUT PACCESS_TOKEN *  ChildToken )

Definition at line 1327 of file token.c. References DbgPrint, FALSE, KernelMode, KPROCESSOR_MODE, NT_SUCCESS, NTSTATUS(), NULL, ObInsertObject(), PAGED_CODE, PrimaryTokenAttributes, PsDereferencePrimaryToken, PsReferencePrimaryToken(), PTOKEN, SepDuplicateToken(), Status, and TRUE. Referenced by PspInitializeProcessSecurity(). : This routine makes a token for a sub-process that is a duplicate of the parent process's token. Parameters: ParentProcess - Pointer to the parent process object. This is used to locate the parent process's primary token, and for logging purposes. ChildToken - Receives a pointer to the child process's token. Return Value: STATUS_SUCCESS - Indicates the sub-process's token has been created successfully. Other status values may be returned from memory allocation or object creation services used and typically indicate insufficient resources or quota on the requestor's part. --*/ { // // NOTE: THIS ROUTINE CAN BE MADE MUCH MORE EFFICIENT. // IT IS DONE IN A BRUTE FORCE FASHION FOR THE LARGE_INTEGER // BEING TO GET THINGS UP AND RUNNING. // // THE PERFORMANCE OF THIS ROUTINE DIRECTLY IMPACTS // THE PERFORMANCE OF SUB-PROCESS CREATION. // KPROCESSOR_MODE PreviousMode; PTOKEN ParentToken; PTOKEN NewToken; HANDLE NewTokenHandle; OBJECT_ATTRIBUTES PrimaryTokenAttributes; PTOKEN InsertedToken; NTSTATUS Status; NTSTATUS IgnoreStatus; PAGED_CODE(); PreviousMode = KeGetPreviousMode(); InitializeObjectAttributes( &PrimaryTokenAttributes, NULL, 0, NULL, NULL ); #ifdef TOKEN_DEBUG DbgPrint("\nCreating sub-process token...\n"); DbgPrint("Parent token address = 0x%lx\n", ParentProcess->Token); #endif //TOKEN_DEBUG ParentToken = (PTOKEN)PsReferencePrimaryToken( ParentProcess ); Status = SepDuplicateToken( ParentToken, // ExistingToken &PrimaryTokenAttributes, // ObjectAttributes FALSE, // EffectiveOnly TokenPrimary, // TokenType (SECURITY_IMPERSONATION_LEVEL)0, // ImpersonationLevel KernelMode, // RequestorMode &NewToken // NewToken ); PsDereferencePrimaryToken( (PACCESS_TOKEN)ParentToken ); if (NT_SUCCESS(Status)) { // // Insert the new token object, up its ref count, and then // delete the new handle. // Status = ObInsertObject( NewToken, NULL, 0, 1, // ObjectPointerBias (PVOID *)&InsertedToken, &NewTokenHandle ); if (NT_SUCCESS(Status)) { *ChildToken = InsertedToken; InsertedToken->TokenInUse = TRUE; IgnoreStatus = ZwClose( NewTokenHandle ); // // At this point, either the token has a reference // outstanding (and no handles), or the reference // failed. If the reference failed, the status will // be returned indicating why. // } else { // // ObInsertObject dereferences the passed object if it // fails, so we don't have to do any cleanup on NewToken // here. // } } return Status; }

SECURITY_IMPERSONATION_LEVEL SeTokenImpersonationLevel (  IN PACCESS_TOKEN  Token  )

Definition at line 211 of file token.c. References PAGED_CODE, PTOKEN, and Token. Referenced by PsAssignImpersonationToken(). : This function returns the impersonation level of a token. The token is assumed to be a TokenImpersonation type token. Arguments: Token - Points to the token whose impersonation level is to be returned. Return Value: The token's impersonation level. --*/ { PAGED_CODE(); return ((PTOKEN)Token)->ImpersonationLevel; }

NTKERNELAPI BOOLEAN SeTokenIsAdmin (  IN PACCESS_TOKEN  Token  )

Definition at line 150 of file token.c. References PAGED_CODE, PTOKEN, Token, and TOKEN_HAS_ADMIN_GROUP. Referenced by NtAssignProcessToJobObject(), NtSetInformationJobObject(), PsAssignImpersonationToken(), and PsImpersonateClient(). : Returns if the token is a member of the local admin group. Arguments: Token - Points to the token. Return Value: TRUE - Token contains the local admin group FALSE - no admin. --*/ { PAGED_CODE(); return ((((PTOKEN)Token)->TokenFlags & TOKEN_HAS_ADMIN_GROUP) != 0 ); }

NTKERNELAPI BOOLEAN SeTokenIsRestricted (  IN PACCESS_TOKEN  Token  )

Definition at line 181 of file token.c. References PAGED_CODE, PTOKEN, Token, and TOKEN_IS_RESTRICTED. Referenced by IsRestricted(), PsAssignImpersonationToken(), PsImpersonateClient(), and SepAccessCheck(). : Returns if the token is a restricted token. Arguments: Token - Points to the token. Return Value: TRUE - Token contains restricted sids FALSE - no admin. --*/ { PAGED_CODE(); return ((((PTOKEN)Token)->TokenFlags & TOKEN_IS_RESTRICTED) != 0 ); }

NTKERNELAPI TOKEN_TYPE SeTokenType (  IN PACCESS_TOKEN  Token  )

Definition at line 118 of file token.c. References PAGED_CODE, PTOKEN, and Token. Referenced by PsAssignImpersonationToken(). : This function returns the type of an instance of a token (TokenPrimary, or TokenImpersonation). Arguments: Token - Points to the token whose type is to be returned. Return Value: The token's type. --*/ { PAGED_CODE(); return (((PTOKEN)Token)->TokenType); }

VOID SeTraverseAuditAlarm (  IN PLUID  OperationID, IN PVOID  DirectoryObject, IN PSECURITY_DESCRIPTOR  SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT  SubjectSecurityContext, IN BOOLEAN  SubjectContextLocked, IN ACCESS_MASK  TraverseAccess, IN PPRIVILEGE_SET Privileges  OPTIONAL, IN BOOLEAN  AccessGranted, IN KPROCESSOR_MODE  AccessMode )

Definition at line 3429 of file seaudit.c. References _SE_AUDITING_STATE::AuditOnFailure, _SE_AUDITING_STATE::AuditOnSuccess, EffectiveToken, FALSE, KernelMode, NULL, PAGED_CODE, SeAuditingState, SeLockSubjectContext(), SepAdtTraverseAuditAlarm(), SepExamineSacl(), SepTokenAuthenticationId, SepTokenUserSid, and SeUnlockSubjectContext(). Referenced by IopParseDevice(). : This routine is called to audit directory traverse operations specifically. It should be called by parse procedures as they traverse directories as part of their operation. Arguments: OperationID - LUID identifying the operation in progress DirectoryObject - Pointer to the directory being traversed. SecurityDescriptor - The security descriptor (if any) attached to the directory being traversed. SubjectSecurityContext - Security context of the client. SubjectContextLocked - Supplies whether the SubjectContext is locked for shared access. TraverseAccess - Mask to indicate the traverse access for this object type. Privileges - Optional parameter to indicate any privilges that the subject may have used to gain access to the object. AccessGranted - Indicates if the access was granted or denied based on the access check or privilege check. AccessMode - Indicates the access mode used for the access check. One of UserMode or KernelMode. Messages will not be generated by kernel mode accesses. Return value: None. --*/ { PAGED_CODE(); #if 0 BOOLEAN GenerateAudit = FALSE; BOOLEAN GenerateAlarm = FALSE; if (AccessMode == KernelMode) { return; } if ((SeAuditingState[AuditEventTraverse].AuditOnSuccess && AccessGranted) || SeAuditingState[AuditEventTraverse].AuditOnFailure && !AccessGranted) { if ( SecurityDescriptor != NULL ) { if ( !SubjectContextLocked ) { SeLockSubjectContext( SubjectSecurityContext ); } SepExamineSacl( RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ), EffectiveToken( SubjectSecurityContext ), TraverseAccess, AccessGranted, &GenerateAudit, &GenerateAlarm ); if (GenerateAudit || GenerateAlarm) { SepAdtTraverseAuditAlarm( OperationID, DirectoryObject, SepTokenUserSid(EffectiveToken( SubjectSecurityContext )), SepTokenAuthenticationId(EffectiveToken( SubjectSecurityContext )), TraverseAccess, Privileges, AccessGranted, GenerateAudit, GenerateAlarm ); } if ( !SubjectContextLocked ) { SeUnlockSubjectContext( SubjectSecurityContext ); } } } #endif return; }

NTKERNELAPI VOID SeUnlockSubjectContext (  IN PSECURITY_SUBJECT_CONTEXT  SubjectContext  )

Definition at line 159 of file subject.c. References PAGED_CODE, PTOKEN, and SepReleaseTokenReadLock. Referenced by CmpCheckCreateAccess(), CmpCheckNotifyAccess(), IopParseDevice(), IsPrivileged(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), RtlpNewSecurityObject(), SeAccessCheck(), SepAccessCheckAndAuditAlarm(), SeQueryAuthenticationIdSubjectContext(), SeTraverseAuditAlarm(), and xxxCreateWindowStation(). : Releases the read locks on the token(s) in the passed SubjectContext. Arguments: SubjectContext - Points to a SECURITY_SUBJECT_CONTEXT data structure which points to a primary token and an optional impersonation token. Return Value: None --*/ { PAGED_CODE(); SepReleaseTokenReadLock((PTOKEN)(SubjectContext->PrimaryToken)); if (ARGUMENT_PRESENT(SubjectContext->ClientToken)) { SepReleaseTokenReadLock((PTOKEN)(SubjectContext->ClientToken)); } }

NTKERNELAPI NTSTATUS SeUnregisterLogonSessionTerminatedRoutine (  IN PSE_LOGON_SESSION_TERMINATED_ROUTINE  CallbackRoutine  )

Definition at line 908 of file rmlogon.c. References ExFreePool(), _SEP_LOGON_SESSION_TERMINATED_NOTIFICATION::Next, NTSTATUS(), NULL, PAGED_CODE, SeFileSystemNotifyRoutinesHead, SepRmAcquireDbWriteLock, SepRmReleaseDbWriteLock, and Status. : This is the dual of SeRegisterLogonSessionTerminatedRoutine. A File System *MUST* call this before it is unloaded. Arguments: CallbackRoutine - Address of routine that was originally passed in to SeRegisterLogonSessionTerminatedRoutine. Return Value: STATUS_SUCCESS - Successfully removed callback routine STATUS_INVALID_PARAMETER - CallbackRoutine is NULL STATUS_NOT_FOUND - Didn't find and entry for CallbackRoutine --*/ { NTSTATUS Status; PSEP_LOGON_SESSION_TERMINATED_NOTIFICATION PreviousEntry; PSEP_LOGON_SESSION_TERMINATED_NOTIFICATION NotifyEntry; PAGED_CODE(); if (CallbackRoutine == NULL) { return( STATUS_INVALID_PARAMETER ); } SepRmAcquireDbWriteLock(); for (PreviousEntry = &SeFileSystemNotifyRoutinesHead, NotifyEntry = SeFileSystemNotifyRoutinesHead.Next; NotifyEntry != NULL; PreviousEntry = NotifyEntry, NotifyEntry = NotifyEntry->Next) { if (NotifyEntry->CallbackRoutine == CallbackRoutine) break; } if (NotifyEntry != NULL) { PreviousEntry->Next = NotifyEntry->Next; ExFreePool( NotifyEntry ); Status = STATUS_SUCCESS; } else { Status = STATUS_NOT_FOUND; } SepRmReleaseDbWriteLock(); return( Status ); }

NTSTATUS SeUpdateClientSecurity (  IN PETHREAD  ClientThread, IN OUT PSECURITY_CLIENT_CONTEXT  ClientContext, OUT PBOOLEAN  ChangesMade, OUT PBOOLEAN  NewToken )

NTKERNELAPI BOOLEAN SeValidSecurityDescriptor (  IN ULONG  Length, IN PSECURITY_DESCRIPTOR  SecurityDescriptor )

Definition at line 2414 of file se/capture.c. References Dacl, FALSE, LongAligned, RtlValidAcl(), SeLengthSid, and TRUE. Referenced by CmpValidateHiveSecurityDescriptors(). : Validates a security descriptor for structural correctness. The idea is to make sure that the security descriptor may be passed to other kernel callers, without fear that they're going to choke while manipulating it. This routine does not enforce policy (e.g., ACL/ACE revision information). It is entirely possible for a security descriptor to be approved by this routine, only to be later found to be invalid by some later routine. This routine is designed to be used by callers who have a security descriptor in kernel memory. Callers wishing to validate a security descriptor passed from user mode should call RtlValidSecurityDescriptor. Arguments: Length - Length in bytes of passed Security Descriptor. SecurityDescriptor - Points to the Security Descriptor (in kernel memory) to be validatated. Return Value: TRUE - The passed security descriptor is correctly structured FALSE - The passed security descriptor is badly formed --*/ { PISECURITY_DESCRIPTOR_RELATIVE ISecurityDescriptor = (PISECURITY_DESCRIPTOR_RELATIVE)SecurityDescriptor; PISID OwnerSid; PISID GroupSid; PACE_HEADER Ace; PISID Sid; PISID Sid2; PACL Dacl; PACL Sacl; ULONG i; if (Length < sizeof(SECURITY_DESCRIPTOR_RELATIVE)) { return(FALSE); } // // Check the revision information. // if (ISecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION) { return(FALSE); } // // Make sure the passed SecurityDescriptor is in self-relative form // if (!(ISecurityDescriptor->Control & SE_SELF_RELATIVE)) { return(FALSE); } // // Check the owner. A valid SecurityDescriptor must have an owner. // It must also be long aligned. // if ((ISecurityDescriptor->Owner == 0) || (!LongAligned((PVOID)(ULONG_PTR)(ULONG)ISecurityDescriptor->Owner)) || (ISecurityDescriptor->Owner > Length) || (Length - ISecurityDescriptor->Owner < sizeof(SID))) { return(FALSE); } // // It is safe to reference the owner's SubAuthorityCount, compute the // expected length of the SID // OwnerSid = (PSID)RtlOffsetToPointer( ISecurityDescriptor, ISecurityDescriptor->Owner ); if (OwnerSid->Revision != SID_REVISION) { return(FALSE); } if (OwnerSid->SubAuthorityCount > SID_MAX_SUB_AUTHORITIES) { return(FALSE); } if (Length - ISecurityDescriptor->Owner < (ULONG) SeLengthSid(OwnerSid)) { return(FALSE); } // // The owner appears to be a structurally valid SID that lies within // the bounds of the security descriptor. Do the same for the Group // if there is one. // if (ISecurityDescriptor->Group != 0) { // // Check alignment // if (!LongAligned( (PVOID)(ULONG_PTR)(ULONG)ISecurityDescriptor->Group)) { return(FALSE); } if (ISecurityDescriptor->Group > Length) { return(FALSE); } if (Length - ISecurityDescriptor->Group < sizeof (SID)) { return(FALSE); } // // It is safe to reference the Group's SubAuthorityCount, compute the // expected length of the SID // GroupSid = (PSID)RtlOffsetToPointer( ISecurityDescriptor, ISecurityDescriptor->Group ); if (GroupSid->Revision != SID_REVISION) { return(FALSE); } if (GroupSid->SubAuthorityCount > SID_MAX_SUB_AUTHORITIES) { return(FALSE); } if (Length - ISecurityDescriptor->Group < (ULONG) SeLengthSid(GroupSid)) { return(FALSE); } } // // Validate the DACL. A structurally valid SecurityDescriptor may not necessarily // have a DACL. // if (ISecurityDescriptor->Dacl != 0) { // // Check alignment // if (!LongAligned( (PVOID)(ULONG_PTR)(ULONG)ISecurityDescriptor->Dacl)) { return(FALSE); } // // Make sure the DACL structure is within the bounds of the security descriptor. // if ((ISecurityDescriptor->Dacl > Length) || (Length - ISecurityDescriptor->Dacl < sizeof(ACL))) { return(FALSE); } Dacl = (PACL) RtlOffsetToPointer( ISecurityDescriptor, ISecurityDescriptor->Dacl ); // // Make sure the DACL length fits within the bounds of the security descriptor. // if (Length - ISecurityDescriptor->Dacl < Dacl->AclSize) { return(FALSE); } // // Make sure the ACL is structurally valid. // if (!RtlValidAcl( Dacl )) { return(FALSE); } } // // Validate the SACL. A structurally valid SecurityDescriptor may not // have a SACL. // if (ISecurityDescriptor->Sacl != 0) { // // Check alignment // if (!LongAligned( (PVOID)(ULONG_PTR)(ULONG)ISecurityDescriptor->Sacl)) { return(FALSE); } // // Make sure the SACL structure is within the bounds of the security descriptor. // if ((ISecurityDescriptor->Sacl > Length) || (Length - ISecurityDescriptor->Sacl < sizeof(ACL))) { return(FALSE); } // // Make sure the Sacl structure is within the bounds of the security descriptor. // Sacl = (PACL)RtlOffsetToPointer( ISecurityDescriptor, ISecurityDescriptor->Sacl ); if (Length - ISecurityDescriptor->Sacl < Sacl->AclSize) { return(FALSE); } // // Make sure the ACL is structurally valid. // if (!RtlValidAcl( Sacl )) { return(FALSE); } } return(TRUE); }

---

Variable Documentation

PSID SeAliasAccountOpsSid

Definition at line 1636 of file se.h. Referenced by SepVariableInitialization().

PSID SeAliasAdminsSid

Definition at line 1630 of file se.h. Referenced by IopApplySystemPartitionProt(), IopCreateDefaultDeviceSecurityDescriptor(), IopOpenDeviceParametersSubkey(), ObpGetDosDevicesProtection(), SeMakeAnonymousLogonToken(), SeMakeSystemToken(), SepCreateImpersonationTokenDacl(), SepCreateToken(), SepInitializationPhase1(), SepInitSystemDacls(), SepMakeTokenEffectiveOnly(), SepRemoveDisabledGroupsAndPrivileges(), and SepVariableInitialization().

PSID SeAliasBackupOpsSid

Definition at line 1639 of file se.h. Referenced by SepVariableInitialization().

PSID SeAliasGuestsSid

Definition at line 1634 of file se.h. Referenced by SepVariableInitialization().

PSID SeAliasPowerUsersSid

Definition at line 1635 of file se.h. Referenced by SepVariableInitialization().

PSID SeAliasPrintOpsSid

Definition at line 1638 of file se.h. Referenced by SepVariableInitialization().

PSID SeAliasSystemOpsSid

Definition at line 1637 of file se.h. Referenced by SepVariableInitialization().

PSID SeAliasUsersSid

Definition at line 1633 of file se.h. Referenced by SepVariableInitialization().

LUID SeAnonymousAuthenticationId

Definition at line 1600 of file se.h. Referenced by SeMakeAnonymousLogonToken(), and SepRmDbInitialization().

PSID SeAnonymousLogonSid

Definition at line 1632 of file se.h. Referenced by SeMakeAnonymousLogonToken(), and SepVariableInitialization().

PACCESS_TOKEN SeAnonymousLogonToken

Definition at line 1645 of file se.h. Referenced by NtImpersonateAnonymousToken(), and SepInitializationPhase1().

LUID SeAssignPrimaryTokenPrivilege

Definition at line 1671 of file se.h. Referenced by NtSetInformationJobObject(), PspSetPrimaryToken(), SeMakeSystemToken(), and SepVariableInitialization().

SE_AUDITING_STATE SeAuditingState[]

Definition at line 1702 of file se.h. Referenced by SepRmSetAuditEventWrkr(), and SeTraverseAuditAlarm().

LUID SeAuditPrivilege

Definition at line 1689 of file se.h. Referenced by SeCheckAuditPrivilege(), SeMakeSystemToken(), and SepVariableInitialization().

PSID SeAuthenticatedUsersSid

Definition at line 1629 of file se.h. Referenced by SeMakeSystemToken(), and SepVariableInitialization().

LUID SeBackupPrivilege

Definition at line 1685 of file se.h. Referenced by CmpDoOpen(), IopCheckBackupRestorePrivilege(), NtSaveKey(), NtSaveMergedKeys(), SeMakeSystemToken(), and SepVariableInitialization().

PSID SeBatchSid

Definition at line 1626 of file se.h. Referenced by SepSidTranslation(), and SepVariableInitialization().

LUID SeChangeNotifyPrivilege

Definition at line 1691 of file se.h. Referenced by SeMakeSystemToken(), SepAdjustPrivileges(), SepCreateToken(), SepRemoveDisabledGroupsAndPrivileges(), and SepVariableInitialization().

LUID SeCreatePagefilePrivilege

Definition at line 1679 of file se.h. Referenced by NtCreatePagingFile(), NtQuerySystemInformation(), NtSetSystemInformation(), SeMakeSystemToken(), and SepVariableInitialization().

LUID SeCreatePermanentPrivilege

Definition at line 1684 of file se.h. Referenced by ObCreateObject(), SeMakeSystemToken(), and SepVariableInitialization().

LUID SeCreateTokenPrivilege

Definition at line 1670 of file se.h. Referenced by SeMakeSystemToken(), SepCreateToken(), and SepVariableInitialization().

PSID SeCreatorGroupServerSid

Definition at line 1614 of file se.h. Referenced by SepSidTranslation(), and SepVariableInitialization().

PSID SeCreatorGroupSid

Definition at line 1612 of file se.h. Referenced by SepSidTranslation(), and SepVariableInitialization().

PSID SeCreatorOwnerServerSid

Definition at line 1613 of file se.h. Referenced by SepSidTranslation(), and SepVariableInitialization().

PSID SeCreatorOwnerSid

Definition at line 1611 of file se.h. Referenced by ObpGetDosDevicesProtection(), SepSidTranslation(), and SepVariableInitialization().

LUID SeDebugPrivilege

Definition at line 1688 of file se.h. Referenced by NtOpenProcess(), NtOpenThread(), NtSetSystemInformation(), NtSystemDebugControl(), SeMakeSystemToken(), and SepVariableInitialization().

BOOLEAN SeDetailedAuditing

Definition at line 1709 of file se.h. Referenced by NtDuplicateObject(), ObInitProcess(), PspCreateProcess(), PspProcessDelete(), and SepRmSetAuditEventWrkr().

PSID SeDialupSid

Definition at line 1624 of file se.h. Referenced by SepVariableInitialization().

LUID SeEnableDelegationPrivilege

Definition at line 1695 of file se.h. Referenced by SepVariableInitialization().

NTKERNELAPI PSE_EXPORTS SeExports

Definition at line 1590 of file se.h. Referenced by InitSecurity(), SepVariableInitialization(), SmbTraceStart(), xxxConnectService(), and xxxCreateWindowStation().

LUID SeIncreaseBasePriorityPrivilege

Definition at line 1680 of file se.h. Referenced by NtSetInformationJobObject(), NtSetInformationProcess(), NtSetInformationThread(), SeMakeSystemToken(), and SepVariableInitialization().

LUID SeIncreaseQuotaPrivilege

Definition at line 1673 of file se.h. Referenced by NtSetSystemInformation(), PspSetQuotaLimits(), SeMakeSystemToken(), and SepVariableInitialization().

PSID SeInteractiveSid

Definition at line 1627 of file se.h. Referenced by SepSidTranslation(), and SepVariableInitialization().

LUID SeLoadDriverPrivilege

Definition at line 1678 of file se.h. Referenced by NtLoadDriver(), NtSetSystemInformation(), NtUnloadDriver(), SeMakeSystemToken(), and SepVariableInitialization().

PSID SeLocalSid

Definition at line 1610 of file se.h. Referenced by SepSidTranslation(), and SepVariableInitialization().

PSID SeLocalSystemSid

Definition at line 1628 of file se.h. Referenced by IopApplySystemPartitionProt(), IopInitializePlugPlayServices(), ObpGetDosDevicesProtection(), SeMakeSystemToken(), SepAdtGenerateDiscardAudit(), SepAdtPrivilegeObjectAuditAlarm(), SepCreateImpersonationTokenDacl(), SepInitializationPhase1(), SepInitSystemDacls(), SePrivilegedServiceAuditAlarm(), SepSidTranslation(), SepVariableInitialization(), and SeRmInitPhase1().

LUID SeLockMemoryPrivilege

Definition at line 1672 of file se.h. Referenced by NtAllocateUserPhysicalPages(), NtLockVirtualMemory(), NtUnlockVirtualMemory(), SeMakeSystemToken(), and SepVariableInitialization().

PSID SeNetworkSid

Definition at line 1625 of file se.h. Referenced by SepSidTranslation(), and SepVariableInitialization().

PSID SeNtAuthoritySid

Definition at line 1622 of file se.h. Referenced by SepVariableInitialization().

PSID SeNullSid

Definition at line 1608 of file se.h. Referenced by SepVariableInitialization().

PSID SePrincipalSelfSid

Definition at line 1615 of file se.h. Referenced by SepSidInSidAndAttributes(), SepSidInToken(), SepSidInTokenEx(), and SepVariableInitialization().

LUID SeProfileSingleProcessPrivilege

Definition at line 1683 of file se.h. Referenced by SeMakeSystemToken(), and SepVariableInitialization().

struct _OBJECT_TYPE* SepTokenObjectType

Definition at line 1212 of file se.h. Referenced by NtAdjustGroupsToken(), NtAdjustPrivilegesToken(), NtDuplicateToken(), NtFilterToken(), NtImpersonateAnonymousToken(), NtOpenObjectAuditAlarm(), NtOpenProcessToken(), NtOpenThreadToken(), NtPrivilegeCheck(), NtPrivilegedServiceAuditAlarm(), NtPrivilegeObjectAuditAlarm(), NtQueryInformationToken(), NtSetInformationToken(), SeAccessCheckByType(), SeFilterToken(), SeIsChildToken(), SepAccessCheckAndAuditAlarm(), SepCreateToken(), SepDuplicateToken(), SepFilterToken(), and SepTokenInitialization().

PACL SePublicDefaultDacl

Definition at line 1658 of file se.h. Referenced by SepInitSystemDacls().

PSECURITY_DESCRIPTOR SePublicDefaultSd

Definition at line 1651 of file se.h. Referenced by ExpInitializeCallbacks(), SepInitializationPhase1(), and SepInitSystemDacls().

PACL SePublicDefaultUnrestrictedDacl

Definition at line 1659 of file se.h. Referenced by IopCreateDefaultDeviceSecurityDescriptor(), ObInitSystem(), and SepInitSystemDacls().

PSECURITY_DESCRIPTOR SePublicDefaultUnrestrictedSd

Definition at line 1652 of file se.h. Referenced by IoCreateSymbolicLink(), ObInitSystem(), and SepInitSystemDacls().

PACL SePublicOpenDacl

Definition at line 1660 of file se.h. Referenced by SepInitSystemDacls().

PSECURITY_DESCRIPTOR SePublicOpenSd

Definition at line 1653 of file se.h. Referenced by SepInitSystemDacls().

PACL SePublicOpenUnrestrictedDacl

Definition at line 1661 of file se.h. Referenced by IopCreateDefaultDeviceSecurityDescriptor(), and SepInitSystemDacls().

PSECURITY_DESCRIPTOR SePublicOpenUnrestrictedSd

Definition at line 1654 of file se.h. Referenced by SepInitSystemDacls().

LUID SeRemoteShutdownPrivilege

Definition at line 1692 of file se.h. Referenced by SepVariableInitialization().

LUID SeRestorePrivilege

Definition at line 1686 of file se.h. Referenced by CmpDoOpen(), IopCheckBackupRestorePrivilege(), NtLoadKey2(), NtReplaceKey(), NtRestoreKey(), NtUnloadKey(), SeMakeSystemToken(), SepValidOwnerSubjectContext(), and SepVariableInitialization().

PSID SeRestrictedSid

Definition at line 1631 of file se.h. Referenced by SepCreateImpersonationTokenDacl(), SepInitSystemDacls(), and SepVariableInitialization().

LUID SeSecurityPrivilege

Definition at line 1676 of file se.h. Referenced by ObpIncrementHandleCount(), RtlpNewSecurityObject(), SeMakeSystemToken(), SepAccessCheck(), SepInitializePrivilegeSets(), SePrivilegePolicyCheck(), and SepVariableInitialization().

LUID SeShutdownPrivilege

Definition at line 1687 of file se.h. Referenced by ExpRaiseHardError(), SeMakeSystemToken(), and SepVariableInitialization().

UNICODE_STRING SeSubsystemName

Definition at line 1711 of file se.h. Referenced by SeAuditHandleCreation(), SeAuditHandleDuplication(), SeAuditProcessCreation(), SeAuditProcessExit(), SeCloseObjectAuditAlarm(), SeDeleteObjectAuditAlarm(), SeOpenObjectAuditAlarm(), SeOpenObjectForDeleteAuditAlarm(), SepAdtGenerateDiscardAudit(), SepAdtInitializePhase1(), SepAdtObjectReferenceAuditAlarm(), SepAdtPrivilegedServiceAuditAlarm(), SePrivilegedServiceAuditAlarm(), and SePrivilegeObjectAuditAlarm().

LUID SeSyncAgentPrivilege

Definition at line 1694 of file se.h. Referenced by SepVariableInitialization().

LUID SeSystemAuthenticationId

Definition at line 1599 of file se.h. Referenced by SeMakeSystemToken(), and SepRmDbInitialization().

PACL SeSystemDefaultDacl

Definition at line 1662 of file se.h. Referenced by SeMakeSystemToken(), and SepInitSystemDacls().

PSECURITY_DESCRIPTOR SeSystemDefaultSd

Definition at line 1655 of file se.h. Referenced by SepInitSystemDacls().

LUID SeSystemEnvironmentPrivilege

Definition at line 1690 of file se.h. Referenced by NtQuerySystemEnvironmentValue(), NtSetSystemEnvironmentValue(), SeMakeSystemToken(), and SepVariableInitialization().

LUID SeSystemProfilePrivilege

Definition at line 1681 of file se.h. Referenced by NtCreateProfile(), and SepVariableInitialization().

LUID SeSystemtimePrivilege

Definition at line 1682 of file se.h. Referenced by NtSetSystemInformation(), SeMakeSystemToken(), and SepVariableInitialization().

TOKEN_SOURCE SeSystemTokenSource

Definition at line 1602 of file se.h. Referenced by SeMakeAnonymousLogonToken(), and SeMakeSystemToken().

LUID SeTakeOwnershipPrivilege

Definition at line 1677 of file se.h. Referenced by SeMakeSystemToken(), SepAccessCheck(), SepInitializePrivilegeSets(), SePrivilegePolicyCheck(), and SepVariableInitialization().

LUID SeTcbPrivilege

Definition at line 1675 of file se.h. Referenced by CmpRefreshHive(), NtSetDefaultHardErrorPort(), NtSetInformationProcess(), NtSetInformationToken(), SeMakeSystemToken(), SepSinglePrivilegeCheck(), and SepVariableInitialization().

LUID SeUndockPrivilege

Definition at line 1693 of file se.h. Referenced by SeMakeSystemToken(), and SepVariableInitialization().

PACL SeUnrestrictedDacl

Definition at line 1663 of file se.h. Referenced by SepInitSystemDacls().

PSECURITY_DESCRIPTOR SeUnrestrictedSd

Definition at line 1656 of file se.h. Referenced by SepInitSystemDacls().

LUID SeUnsolicitedInputPrivilege

Definition at line 1674 of file se.h. Referenced by SepVariableInitialization().

PSID SeWorldSid

Definition at line 1609 of file se.h. Referenced by IopCreateDefaultDeviceSecurityDescriptor(), IopInitializePlugPlayServices(), ObInitSystem(), ObpGetDosDevicesProtection(), SeAssignWorldSecurityDescriptor(), SeFastTraverseCheck(), SeMakeAnonymousLogonToken(), SeMakeSystemToken(), SepInitializationPhase1(), SepInitSystemDacls(), SepSidTranslation(), and SepVariableInitialization().

---