https://git.reactos.org/?p=reactos.git;a=commitdiff;h=9c6037182c86165a35e8d…
commit 9c6037182c86165a35e8dbc07fac2d9a9892a258
Author: Pierre Schweitzer <pierre(a)reactos.org>
AuthorDate: Sat Oct 27 11:48:52 2018 +0200
Commit: Pierre Schweitzer <pierre(a)reactos.org>
CommitDate: Sat Oct 27 12:01:38 2018 +0200
[NTOSKRNL] Add support for unsecure object names
---
ntoskrnl/ob/obname.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/ntoskrnl/ob/obname.c b/ntoskrnl/ob/obname.c
index 5177cc1224..a9d05c8137 100644
--- a/ntoskrnl/ob/obname.c
+++ b/ntoskrnl/ob/obname.c
@@ -814,11 +814,27 @@ ParseFromRoot:
/* Get the object header */
ObjectHeader = OBJECT_TO_OBJECT_HEADER(InsertObject);
- /* FIXME: Check if this is a Section Object or Sym Link */
- /* FIXME: If it is, then check if this isn't session 0 */
- /* FIXME: If it isn't, check for SeCreateGlobalPrivilege */
- /* FIXME: If privilege isn't there, check for unsecure name */
- /* FIXME: If it isn't a known unsecure name, then fail */
+ /*
+ * Deny object creation if:
+ * That's a section object or a symbolic link
+ * Which isn't in the same section that root directory
+ * That doesn't have the SeCreateGlobalPrivilege
+ * And that is not a known unsecure name
+ */
+ if (RootDirectory->SessionId != -1)
+ {
+ if (ObjectHeader->Type == MmSectionObjectType ||
+ ObjectHeader->Type == ObpSymbolicLinkObjectType)
+ {
+ if (RootDirectory->SessionId != PsGetCurrentProcessSessionId() &&
+ !SeSinglePrivilegeCheck(SeCreateGlobalPrivilege, AccessCheckMode) &&
+ !ObpIsUnsecureName(&ComponentName, BooleanFlagOn(Attributes, OBJ_CASE_INSENSITIVE)))
+ {
+ Status = STATUS_ACCESS_DENIED;
+ break;
+ }
+ }
+ }
/* Create Object Name */
NewName = ExAllocatePoolWithTag(PagedPool,