Ros-diffs June 2018

ros-diffs@reactos.org

26 participants
174 discussions

15/15: [NTOS:SE] Overhaul the token management code.
by Hermès Bélusca-Maïto 27 Jun '18

27 Jun '18

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=4d494caf614b03d8ecec0… commit 4d494caf614b03d8ecec09deaf53c5fe96f01e73 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Tue Jun 26 22:50:53 2018 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Wed Jun 27 23:40:18 2018 +0200 [NTOS:SE] Overhaul the token management code. - Overhaul SepCreateToken() and SepDuplicateToken() so that they implement the "variable information area" of the token, where immutable lists of user & groups and privileges reside, and the "dynamic information area" (allocated separately in paged pool), where mutable data such as the token's default DACL is stored. Perform the necessary adaptations in SepDeleteToken() and in NtSetInformationToken(). - Actually dereference the token's logon session, when needed, in the 'TokenSessionReference' case in NtSetInformationToken(). - Overhaul SepFindPrimaryGroupAndDefaultOwner() so that it returns the indices of candidate primary group and default owner within the token's user & groups array. This allows for fixing the 'TokenOwner' and 'TokenPrimaryGroup' cases of NtSetInformationToken(), since the owner or primary group being set *MUST* already exist in the token's user & groups array (as a by-product, memory corruptions that existed before due to the broken way of setting these properties disappear too). - Lock tokens every time operations are performed on them (NOTE: we still use a global token lock!). - Touch the ModifiedId LUID member of tokens everytime a write operation (property change, etc...) is made on them. - Fix some group attributes in the SYSTEM process token, SepCreateSystemProcessToken(). - Make the SeCreateTokenPrivilege mandatory when calling NtCreateToken(). - Update the token pool tags. - Explicitly use the Ex*ResourceLite() versions of the locking functions in the token locking macros. --- ntoskrnl/include/internal/se.h | 12 +- ntoskrnl/include/internal/tag.h | 4 +- ntoskrnl/se/token.c | 908 ++++++++++++++++++++++++++++------------ sdk/include/ndk/sefuncs.h | 1 + 4 files changed, 643 insertions(+), 282 deletions(-) diff --git a/ntoskrnl/include/internal/se.h b/ntoskrnl/include/internal/se.h index e2861aad8c..993c6ceb11 100644 --- a/ntoskrnl/include/internal/se.h +++ b/ntoskrnl/include/internal/se.h @@ -200,17 +200,17 @@ extern PSECURITY_DESCRIPTOR SeUnrestrictedSd; #define SepAcquireTokenLockExclusive(Token) \ { \ KeEnterCriticalRegion(); \ - ExAcquireResourceExclusive(((PTOKEN)Token)->TokenLock, TRUE); \ + ExAcquireResourceExclusiveLite(((PTOKEN)Token)->TokenLock, TRUE); \ } #define SepAcquireTokenLockShared(Token) \ { \ KeEnterCriticalRegion(); \ - ExAcquireResourceShared(((PTOKEN)Token)->TokenLock, TRUE); \ + ExAcquireResourceSharedLite(((PTOKEN)Token)->TokenLock, TRUE); \ } #define SepReleaseTokenLock(Token) \ { \ - ExReleaseResource(((PTOKEN)Token)->TokenLock); \ + ExReleaseResourceLite(((PTOKEN)Token)->TokenLock); \ KeLeaveCriticalRegion(); \ } @@ -345,9 +345,9 @@ SeAuditProcessCreate(IN PEPROCESS Process); NTSTATUS NTAPI SeExchangePrimaryToken( - struct _EPROCESS* Process, - PACCESS_TOKEN NewToken, - PACCESS_TOKEN* OldTokenP + _In_ PEPROCESS Process, + _In_ PACCESS_TOKEN NewAccessToken, + _Out_ PACCESS_TOKEN* OldAccessToken ); VOID diff --git a/ntoskrnl/include/internal/tag.h b/ntoskrnl/include/internal/tag.h index eec80135f2..cca581f15c 100644 --- a/ntoskrnl/include/internal/tag.h +++ b/ntoskrnl/include/internal/tag.h @@ -177,9 +177,7 @@ #define TAG_QOS 'sQeS' #define TAG_LUID 'uLeS' #define TAG_PRIVILEGE_SET 'rPeS' -#define TAG_TOKEN_USERS 'uKOT' -#define TAG_TOKEN_PRIVILAGES 'pKOT' -#define TAG_TOKEN_ACL 'kDOT' +#define TAG_TOKEN_DYNAMIC 'dTeS' /* LPC Tags */ #define TAG_LPC_MESSAGE 'McpL' diff --git a/ntoskrnl/se/token.c b/ntoskrnl/se/token.c index 9523fbf8aa..0b20030b8d 100644 --- a/ntoskrnl/se/token.c +++ b/ntoskrnl/se/token.c @@ -32,7 +32,7 @@ typedef struct _TOKEN_AUDIT_POLICY_INFORMATION /* GLOBALS ********************************************************************/ POBJECT_TYPE SeTokenObjectType = NULL; -ERESOURCE SepTokenLock; +ERESOURCE SepTokenLock; // FIXME: Global lock! TOKEN_SOURCE SeSystemTokenSource = {"*SYSTEM*", {0}}; LUID SeSystemAuthenticationId = SYSTEM_LUID; @@ -97,6 +97,10 @@ SepCompareTokens(IN PTOKEN FirstToken, ASSERT(FirstToken != SecondToken); + /* Lock the tokens */ + SepAcquireTokenLockShared(FirstToken); + SepAcquireTokenLockShared(SecondToken); + /* FIXME: Check if every SID that is present in either token is also present in the other one */ Restricted = SeTokenIsRestricted(FirstToken); @@ -112,6 +116,10 @@ SepCompareTokens(IN PTOKEN FirstToken, IsEqual = TRUE; } + /* Unlock the tokens */ + SepReleaseTokenLock(SecondToken); + SepReleaseTokenLock(FirstToken); + *Equal = IsEqual; return STATUS_SUCCESS; } @@ -223,16 +231,19 @@ SepCopyProxyData(PVOID* Dest, NTSTATUS NTAPI -SeExchangePrimaryToken(PEPROCESS Process, - PACCESS_TOKEN NewTokenP, - PACCESS_TOKEN* OldTokenP) +SeExchangePrimaryToken( + _In_ PEPROCESS Process, + _In_ PACCESS_TOKEN NewAccessToken, + _Out_ PACCESS_TOKEN* OldAccessToken) { PTOKEN OldToken; - PTOKEN NewToken = (PTOKEN)NewTokenP; + PTOKEN NewToken = (PTOKEN)NewAccessToken; PAGED_CODE(); - if (NewToken->TokenType != TokenPrimary) return STATUS_BAD_TOKEN_TYPE; + if (NewToken->TokenType != TokenPrimary) + return STATUS_BAD_TOKEN_TYPE; + if (NewToken->TokenInUse) { BOOLEAN IsEqual; @@ -243,43 +254,57 @@ SeExchangePrimaryToken(PEPROCESS Process, if (OldToken == NewToken) { /* So it's a nop. */ - *OldTokenP = OldToken; + *OldAccessToken = OldToken; return STATUS_SUCCESS; } Status = SepCompareTokens(OldToken, NewToken, &IsEqual); if (!NT_SUCCESS(Status)) { - *OldTokenP = NULL; PsDereferencePrimaryToken(OldToken); + *OldAccessToken = NULL; return Status; } if (!IsEqual) { - *OldTokenP = NULL; PsDereferencePrimaryToken(OldToken); + *OldAccessToken = NULL; return STATUS_TOKEN_ALREADY_IN_USE; } /* Silently return STATUS_SUCCESS but do not set the new token, * as it's already in use elsewhere. */ - *OldTokenP = OldToken; + *OldAccessToken = OldToken; return STATUS_SUCCESS; } + /* Lock the new token */ + SepAcquireTokenLockExclusive(NewToken); + /* Mark new token in use */ NewToken->TokenInUse = TRUE; - /* Reference the New Token */ + // TODO: Set a correct SessionId for NewToken + + /* Unlock the new token */ + SepReleaseTokenLock(NewToken); + + /* Reference the new token */ ObReferenceObject(NewToken); /* Replace the old with the new */ OldToken = ObFastReplaceObject(&Process->Token, NewToken); - /* Mark the Old Token as free */ + /* Lock the old token */ + SepAcquireTokenLockExclusive(OldToken); + + /* Mark the old token as free */ OldToken->TokenInUse = FALSE; - *OldTokenP = (PACCESS_TOKEN)OldToken; + /* Unlock the old token */ + SepReleaseTokenLock(OldToken); + + *OldAccessToken = (PACCESS_TOKEN)OldToken; return STATUS_SUCCESS; } @@ -316,44 +341,95 @@ RtlLengthSidAndAttributes(ULONG Count, } -NTSTATUS -NTAPI -SepFindPrimaryGroupAndDefaultOwner(PTOKEN Token, - PSID PrimaryGroup, - PSID DefaultOwner) +static NTSTATUS +SepFindPrimaryGroupAndDefaultOwner( + _In_ PTOKEN Token, + _In_ PSID PrimaryGroup, + _In_opt_ PSID DefaultOwner, + _Out_opt_ PULONG PrimaryGroupIndex, + _Out_opt_ PULONG DefaultOwnerIndex) { ULONG i; - Token->PrimaryGroup = NULL; + /* We should return at least a search result */ + if (!PrimaryGroupIndex && !DefaultOwnerIndex) + return STATUS_INVALID_PARAMETER; + + if (PrimaryGroupIndex) + { + /* Initialize with an invalid index */ + // Token->PrimaryGroup = NULL; + *PrimaryGroupIndex = Token->UserAndGroupCount; + } - if (DefaultOwner) + if (DefaultOwnerIndex) { - Token->DefaultOwnerIndex = Token->UserAndGroupCount; + if (DefaultOwner) + { + /* An owner is specified: check whether this is actually the user */ + if (RtlEqualSid(Token->UserAndGroups[0].Sid, DefaultOwner)) + { + /* + * It's the user (first element in array): set it + * as the owner and stop the search for it. + */ + *DefaultOwnerIndex = 0; + DefaultOwnerIndex = NULL; + } + else + { + /* An owner is specified: initialize with an invalid index */ + *DefaultOwnerIndex = Token->UserAndGroupCount; + } + } + else + { + /* + * No owner specified: set the user (first element in array) + * as the owner and stop the search for it. + */ + *DefaultOwnerIndex = 0; + DefaultOwnerIndex = NULL; + } } - /* Validate and set the primary group and user pointers */ + /* Validate and set the primary group and default owner indices */ for (i = 0; i < Token->UserAndGroupCount; i++) { - if (DefaultOwner && - RtlEqualSid(Token->UserAndGroups[i].Sid, DefaultOwner)) + /* Stop the search if we have found what we searched for */ + if (!PrimaryGroupIndex && !DefaultOwnerIndex) + break; + + if (DefaultOwnerIndex && DefaultOwner && + RtlEqualSid(Token->UserAndGroups[i].Sid, DefaultOwner) && + (Token->UserAndGroups[i].Attributes & SE_GROUP_OWNER)) { - Token->DefaultOwnerIndex = i; + /* Owner is found, stop the search for it */ + *DefaultOwnerIndex = i; + DefaultOwnerIndex = NULL; } - if (RtlEqualSid(Token->UserAndGroups[i].Sid, PrimaryGroup)) + if (PrimaryGroupIndex && + RtlEqualSid(Token->UserAndGroups[i].Sid, PrimaryGroup)) { - Token->PrimaryGroup = Token->UserAndGroups[i].Sid; + /* Primary group is found, stop the search for it */ + // Token->PrimaryGroup = Token->UserAndGroups[i].Sid; + *PrimaryGroupIndex = i; + PrimaryGroupIndex = NULL; } } - if (Token->DefaultOwnerIndex == Token->UserAndGroupCount) + if (DefaultOwnerIndex) { - return STATUS_INVALID_OWNER; + if (*DefaultOwnerIndex == Token->UserAndGroupCount) + return STATUS_INVALID_OWNER; } - if (Token->PrimaryGroup == NULL) + if (PrimaryGroupIndex) { - return STATUS_INVALID_PRIMARY_GROUP; + if (*PrimaryGroupIndex == Token->UserAndGroupCount) + // if (Token->PrimaryGroup == NULL) + return STATUS_INVALID_PRIMARY_GROUP; } return STATUS_SUCCESS; @@ -371,20 +447,24 @@ SepDuplicateToken( _In_ KPROCESSOR_MODE PreviousMode, _Out_ PTOKEN* NewAccessToken) { - ULONG uLength; - ULONG i; - PVOID EndMem; - PTOKEN AccessToken; NTSTATUS Status; + PTOKEN AccessToken; + PVOID EndMem; + ULONG VariableLength; + ULONG TotalSize; PAGED_CODE(); + /* Compute how much size we need to allocate for the token */ + VariableLength = Token->VariableLength; + TotalSize = FIELD_OFFSET(TOKEN, VariablePart) + VariableLength; + Status = ObCreateObject(PreviousMode, SeTokenObjectType, ObjectAttributes, PreviousMode, NULL, - sizeof(TOKEN), + TotalSize, 0, 0, (PVOID*)&AccessToken); @@ -394,103 +474,193 @@ SepDuplicateToken( return Status; } - /* Zero out the buffer */ - RtlZeroMemory(AccessToken, sizeof(TOKEN)); + /* Zero out the buffer and initialize the token */ + RtlZeroMemory(AccessToken, TotalSize); ExAllocateLocallyUniqueId(&AccessToken->TokenId); - AccessToken->TokenLock = &SepTokenLock; + AccessToken->TokenType = TokenType; + AccessToken->ImpersonationLevel = Level; - /* Copy and reference the logon session */ - RtlCopyLuid(&AccessToken->AuthenticationId, &Token->AuthenticationId); - SepRmReferenceLogonSession(&AccessToken->AuthenticationId); + AccessToken->TokenLock = &SepTokenLock; // FIXME: Global lock! - AccessToken->TokenType = TokenType; - AccessToken->ImpersonationLevel = Level; - RtlCopyLuid(&AccessToken->ModifiedId, &Token->ModifiedId); + /* Copy the immutable fields */ + RtlCopyLuid(&AccessToken->TokenSource.SourceIdentifier, + &Token->TokenSource.SourceIdentifier); + RtlCopyMemory(AccessToken->TokenSource.SourceName, + Token->TokenSource.SourceName, + sizeof(Token->TokenSource.SourceName)); - AccessToken->TokenSource.SourceIdentifier.LowPart = Token->TokenSource.SourceIdentifier.LowPart; - AccessToken->TokenSource.SourceIdentifier.HighPart = Token->TokenSource.SourceIdentifier.HighPart; - memcpy(AccessToken->TokenSource.SourceName, - Token->TokenSource.SourceName, - sizeof(Token->TokenSource.SourceName)); - AccessToken->ExpirationTime.QuadPart = Token->ExpirationTime.QuadPart; - AccessToken->UserAndGroupCount = Token->UserAndGroupCount; - AccessToken->DefaultOwnerIndex = Token->DefaultOwnerIndex; + AccessToken->AuthenticationId = Token->AuthenticationId; + AccessToken->ParentTokenId = Token->ParentTokenId; + AccessToken->ExpirationTime = Token->ExpirationTime; + AccessToken->OriginatingLogonSession = Token->OriginatingLogonSession; - uLength = sizeof(SID_AND_ATTRIBUTES) * AccessToken->UserAndGroupCount; - for (i = 0; i < Token->UserAndGroupCount; i++) - uLength += RtlLengthSid(Token->UserAndGroups[i].Sid); - AccessToken->UserAndGroups = ExAllocatePoolWithTag(PagedPool, - uLength, - TAG_TOKEN_USERS); - if (AccessToken->UserAndGroups == NULL) + /* Lock the source token and copy the mutable fields */ + SepAcquireTokenLockExclusive(Token); + + AccessToken->SessionId = Token->SessionId; + RtlCopyLuid(&AccessToken->ModifiedId, &Token->ModifiedId); + + AccessToken->TokenFlags = Token->TokenFlags & ~TOKEN_SESSION_NOT_REFERENCED; + + /* Copy and reference the logon session */ + // RtlCopyLuid(&AccessToken->AuthenticationId, &Token->AuthenticationId); + Status = SepRmReferenceLogonSession(&AccessToken->AuthenticationId); + if (!NT_SUCCESS(Status)) { - Status = STATUS_INSUFFICIENT_RESOURCES; - goto done; + /* No logon session could be found, bail out */ + DPRINT1("SepRmReferenceLogonSession() failed (Status 0x%lx)\n", Status); + /* Set the flag for proper cleanup by the delete procedure */ + AccessToken->TokenFlags |= TOKEN_SESSION_NOT_REFERENCED; + goto Quit; } - EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount]; + /* Assign the data that reside in the TOKEN's variable information area */ + AccessToken->VariableLength = VariableLength; + EndMem = (PVOID)&AccessToken->VariablePart; - Status = RtlCopySidAndAttributesArray(AccessToken->UserAndGroupCount, - Token->UserAndGroups, - uLength, - AccessToken->UserAndGroups, - EndMem, - &EndMem, - &uLength); - if (!NT_SUCCESS(Status)) - goto done; + /* Copy the privileges */ + AccessToken->PrivilegeCount = 0; + AccessToken->Privileges = NULL; + if (Token->Privileges && (Token->PrivilegeCount > 0)) + { + ULONG PrivilegesLength = Token->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES); + PrivilegesLength = ALIGN_UP_BY(PrivilegesLength, sizeof(PVOID)); + + ASSERT(VariableLength >= PrivilegesLength); + + AccessToken->PrivilegeCount = Token->PrivilegeCount; + AccessToken->Privileges = EndMem; + EndMem = (PVOID)((ULONG_PTR)EndMem + PrivilegesLength); + VariableLength -= PrivilegesLength; + + RtlCopyMemory(AccessToken->Privileges, + Token->Privileges, + AccessToken->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES)); + } + + /* Copy the user and groups */ + AccessToken->UserAndGroupCount = 0; + AccessToken->UserAndGroups = NULL; + if (Token->UserAndGroups && (Token->UserAndGroupCount > 0)) + { + AccessToken->UserAndGroupCount = Token->UserAndGroupCount; + AccessToken->UserAndGroups = EndMem; + EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount]; + VariableLength -= ((ULONG_PTR)EndMem - (ULONG_PTR)AccessToken->UserAndGroups); + + Status = RtlCopySidAndAttributesArray(AccessToken->UserAndGroupCount, + Token->UserAndGroups, + VariableLength, + AccessToken->UserAndGroups, + EndMem, + &EndMem, + &VariableLength); + if (!NT_SUCCESS(Status)) + { + DPRINT1("RtlCopySidAndAttributesArray(UserAndGroups) failed (Status 0x%lx)\n", Status); + goto Quit; + } + } + +#if 1 + { + ULONG PrimaryGroupIndex; + /* Find the token primary group */ Status = SepFindPrimaryGroupAndDefaultOwner(AccessToken, Token->PrimaryGroup, - 0); + NULL, + &PrimaryGroupIndex, + NULL); if (!NT_SUCCESS(Status)) - goto done; - - AccessToken->PrivilegeCount = Token->PrivilegeCount; - - uLength = AccessToken->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES); - AccessToken->Privileges = ExAllocatePoolWithTag(PagedPool, - uLength, - TAG_TOKEN_PRIVILAGES); - if (AccessToken->Privileges == NULL) { - Status = STATUS_INSUFFICIENT_RESOURCES; - goto done; + DPRINT1("SepFindPrimaryGroupAndDefaultOwner failed (Status 0x%lx)\n", Status); + goto Quit; + } + AccessToken->PrimaryGroup = AccessToken->UserAndGroups[PrimaryGroupIndex].Sid; } +#else + AccessToken->PrimaryGroup = (PVOID)((ULONG_PTR)AccessToken + (ULONG_PTR)Token->PrimaryGroup - (ULONG_PTR)Token->UserAndGroups); +#endif + AccessToken->DefaultOwnerIndex = Token->DefaultOwnerIndex; - for (i = 0; i < AccessToken->PrivilegeCount; i++) - { - RtlCopyLuid(&AccessToken->Privileges[i].Luid, - &Token->Privileges[i].Luid); - AccessToken->Privileges[i].Attributes = - Token->Privileges[i].Attributes; + /* Copy the restricted SIDs */ + AccessToken->RestrictedSidCount = 0; + AccessToken->RestrictedSids = NULL; + if (Token->RestrictedSids && (Token->RestrictedSidCount > 0)) + { + AccessToken->RestrictedSidCount = Token->RestrictedSidCount; + AccessToken->RestrictedSids = EndMem; + EndMem = &AccessToken->RestrictedSids[AccessToken->RestrictedSidCount]; + VariableLength -= ((ULONG_PTR)EndMem - (ULONG_PTR)AccessToken->RestrictedSids); + + Status = RtlCopySidAndAttributesArray(AccessToken->RestrictedSidCount, + Token->RestrictedSids, + VariableLength, + AccessToken->RestrictedSids, + EndMem, + &EndMem, + &VariableLength); + if (!NT_SUCCESS(Status)) + { + DPRINT1("RtlCopySidAndAttributesArray(RestrictedSids) failed (Status 0x%lx)\n", Status); + goto Quit; + } } - if (Token->DefaultDacl) + + // + // FIXME: Implement the "EffectiveOnly" option, that removes all + // the disabled parts (privileges and groups) of the token. + // + + + // + // NOTE: So far our dynamic area only contains + // the default dacl, so this makes the following + // code pretty simple. The day where it stores + // other data, the code will require adaptations. + // + + /* Now allocate the TOKEN's dynamic information area and set the data */ + AccessToken->DynamicAvailable = 0; // Unused memory in the dynamic area. + AccessToken->DynamicPart = NULL; + if (Token->DynamicPart && Token->DefaultDacl) { - AccessToken->DefaultDacl = ExAllocatePoolWithTag(PagedPool, + AccessToken->DynamicPart = ExAllocatePoolWithTag(PagedPool, Token->DefaultDacl->AclSize, - TAG_TOKEN_ACL); - if (AccessToken->DefaultDacl == NULL) + TAG_TOKEN_DYNAMIC); + if (AccessToken->DynamicPart == NULL) { Status = STATUS_INSUFFICIENT_RESOURCES; - goto done; + goto Quit; } + EndMem = (PVOID)AccessToken->DynamicPart; - memcpy(AccessToken->DefaultDacl, - Token->DefaultDacl, - Token->DefaultDacl->AclSize); + AccessToken->DefaultDacl = EndMem; + + RtlCopyMemory(AccessToken->DefaultDacl, + Token->DefaultDacl, + Token->DefaultDacl->AclSize); } + /* Unlock the source token */ + SepReleaseTokenLock(Token); + + /* Return the token */ *NewAccessToken = AccessToken; + Status = STATUS_SUCCESS; -done: +Quit: if (!NT_SUCCESS(Status)) { - /* Dereference the token, the delete procedure will clean up */ + /* Unlock the source token */ + SepReleaseTokenLock(Token); + + /* Dereference the token, the delete procedure will clean it up */ ObDereferenceObject(AccessToken); } @@ -609,16 +779,12 @@ SepDeleteToken(PVOID ObjectBody) DPRINT("SepDeleteToken()\n"); /* Dereference the logon session */ - SepRmDereferenceLogonSession(&AccessToken->AuthenticationId); - - if (AccessToken->UserAndGroups) - ExFreePoolWithTag(AccessToken->UserAndGroups, TAG_TOKEN_USERS); - - if (AccessToken->Privileges) - ExFreePoolWithTag(AccessToken->Privileges, TAG_TOKEN_PRIVILAGES); + if ((AccessToken->TokenFlags & TOKEN_SESSION_NOT_REFERENCED) == 0) + SepRmDereferenceLogonSession(&AccessToken->AuthenticationId); - if (AccessToken->DefaultDacl) - ExFreePoolWithTag(AccessToken->DefaultDacl, TAG_TOKEN_ACL); + /* Delete the dynamic information area */ + if (AccessToken->DynamicPart) + ExFreePoolWithTag(AccessToken->DynamicPart, TAG_TOKEN_DYNAMIC); } @@ -630,7 +796,7 @@ SepInitializeTokenImplementation(VOID) UNICODE_STRING Name; OBJECT_TYPE_INITIALIZER ObjectTypeInitializer; - ExInitializeResource(&SepTokenLock); + ExInitializeResource(&SepTokenLock); // FIXME: Global lock! DPRINT("Creating Token Object Type\n"); @@ -692,14 +858,18 @@ SepCreateToken( _In_ PTOKEN_SOURCE TokenSource, _In_ BOOLEAN SystemToken) { + NTSTATUS Status; PTOKEN AccessToken; + ULONG TokenFlags = 0; + ULONG PrimaryGroupIndex, DefaultOwnerIndex; LUID TokenId; LUID ModifiedId; PVOID EndMem; - ULONG uLength; + ULONG PrivilegesLength; + ULONG UserGroupsLength; + ULONG VariableLength; + ULONG TotalSize; ULONG i; - NTSTATUS Status; - ULONG TokenFlags = 0; PAGED_CODE(); @@ -721,15 +891,37 @@ SepCreateToken( } } + /* Allocate unique IDs for the token */ ExAllocateLocallyUniqueId(&TokenId); ExAllocateLocallyUniqueId(&ModifiedId); + /* Compute how much size we need to allocate for the token */ + + /* Privileges size */ + PrivilegesLength = PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES); + PrivilegesLength = ALIGN_UP_BY(PrivilegesLength, sizeof(PVOID)); + + /* User and groups size */ + UserGroupsLength = (1 + GroupCount) * sizeof(SID_AND_ATTRIBUTES); + UserGroupsLength += RtlLengthSid(User->Sid); + for (i = 0; i < GroupCount; i++) + { + UserGroupsLength += RtlLengthSid(Groups[i].Sid); + } + UserGroupsLength = ALIGN_UP_BY(UserGroupsLength, sizeof(PVOID)); + + /* Add the additional groups array length */ + UserGroupsLength += ALIGN_UP_BY(GroupsLength, sizeof(PVOID)); + + VariableLength = PrivilegesLength + UserGroupsLength; + TotalSize = FIELD_OFFSET(TOKEN, VariablePart) + VariableLength; + Status = ObCreateObject(PreviousMode, SeTokenObjectType, ObjectAttributes, PreviousMode, NULL, - sizeof(TOKEN), + TotalSize, 0, 0, (PVOID*)&AccessToken); @@ -739,141 +931,144 @@ SepCreateToken( return Status; } - /* Zero out the buffer */ - RtlZeroMemory(AccessToken, sizeof(TOKEN)); + /* Zero out the buffer and initialize the token */ + RtlZeroMemory(AccessToken, TotalSize); - AccessToken->TokenLock = &SepTokenLock; + RtlCopyLuid(&AccessToken->TokenId, &TokenId); + + AccessToken->TokenType = TokenType; + AccessToken->ImpersonationLevel = ImpersonationLevel; + + AccessToken->TokenLock = &SepTokenLock; // FIXME: Global lock! RtlCopyLuid(&AccessToken->TokenSource.SourceIdentifier, &TokenSource->SourceIdentifier); - memcpy(AccessToken->TokenSource.SourceName, - TokenSource->SourceName, - sizeof(TokenSource->SourceName)); + RtlCopyMemory(AccessToken->TokenSource.SourceName, + TokenSource->SourceName, + sizeof(TokenSource->SourceName)); - /* Copy and reference the logon session */ - RtlCopyLuid(&AccessToken->AuthenticationId, AuthenticationId); - SepRmReferenceLogonSession(&AccessToken->AuthenticationId); - - RtlCopyLuid(&AccessToken->TokenId, &TokenId); AccessToken->ExpirationTime = *ExpirationTime; RtlCopyLuid(&AccessToken->ModifiedId, &ModifiedId); - AccessToken->UserAndGroupCount = GroupCount + 1; - AccessToken->PrivilegeCount = PrivilegeCount; + AccessToken->TokenFlags = TokenFlags & ~TOKEN_SESSION_NOT_REFERENCED; - AccessToken->TokenFlags = TokenFlags; - AccessToken->TokenType = TokenType; - AccessToken->ImpersonationLevel = ImpersonationLevel; - - /* - * Normally we would just point these members into the variable information - * area; however, our ObCreateObject() call can't allocate a variable information - * area, so we allocate them seperately and provide a destroy function. - */ + /* Copy and reference the logon session */ + RtlCopyLuid(&AccessToken->AuthenticationId, AuthenticationId); + Status = SepRmReferenceLogonSession(&AccessToken->AuthenticationId); + if (!NT_SUCCESS(Status)) + { + /* No logon session could be found, bail out */ + DPRINT1("SepRmReferenceLogonSession() failed (Status 0x%lx)\n", Status); + /* Set the flag for proper cleanup by the delete procedure */ + AccessToken->TokenFlags |= TOKEN_SESSION_NOT_REFERENCED; + goto Quit; + } - uLength = sizeof(SID_AND_ATTRIBUTES) * AccessToken->UserAndGroupCount; - uLength += RtlLengthSid(User->Sid); - for (i = 0; i < GroupCount; i++) - uLength += RtlLengthSid(Groups[i].Sid); + /* Assign the data that reside in the TOKEN's variable information area */ + AccessToken->VariableLength = VariableLength; + EndMem = (PVOID)&AccessToken->VariablePart; - // FIXME: should use the object itself - AccessToken->UserAndGroups = ExAllocatePoolWithTag(PagedPool, - uLength, - TAG_TOKEN_USERS); - if (AccessToken->UserAndGroups == NULL) + /* Copy the privileges */ + AccessToken->PrivilegeCount = PrivilegeCount; + AccessToken->Privileges = NULL; + if (PrivilegeCount > 0) { - Status = STATUS_INSUFFICIENT_RESOURCES; - goto done; + AccessToken->Privileges = EndMem; + EndMem = (PVOID)((ULONG_PTR)EndMem + PrivilegesLength); + VariableLength -= PrivilegesLength; + + if (PreviousMode != KernelMode) + { + _SEH2_TRY + { + RtlCopyMemory(AccessToken->Privileges, + Privileges, + PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES)); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + Status = _SEH2_GetExceptionCode(); + } + _SEH2_END; + } + else + { + RtlCopyMemory(AccessToken->Privileges, + Privileges, + PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES)); + } + + if (!NT_SUCCESS(Status)) + goto Quit; } + /* Update the privilege flags */ + SepUpdatePrivilegeFlagsToken(AccessToken); + + /* Copy the user and groups */ + AccessToken->UserAndGroupCount = 1 + GroupCount; + AccessToken->UserAndGroups = EndMem; EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount]; + VariableLength -= ((ULONG_PTR)EndMem - (ULONG_PTR)AccessToken->UserAndGroups); Status = RtlCopySidAndAttributesArray(1, User, - uLength, - AccessToken->UserAndGroups, + VariableLength, + &AccessToken->UserAndGroups[0], EndMem, &EndMem, - &uLength); + &VariableLength); if (!NT_SUCCESS(Status)) - goto done; + goto Quit; Status = RtlCopySidAndAttributesArray(GroupCount, Groups, - uLength, + VariableLength, &AccessToken->UserAndGroups[1], EndMem, &EndMem, - &uLength); + &VariableLength); if (!NT_SUCCESS(Status)) - goto done; + goto Quit; + /* Find the token primary group and default owner */ Status = SepFindPrimaryGroupAndDefaultOwner(AccessToken, PrimaryGroup, - Owner); + Owner, + &PrimaryGroupIndex, + &DefaultOwnerIndex); if (!NT_SUCCESS(Status)) - goto done; - - // FIXME: should use the object itself - uLength = PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES); - if (uLength == 0) uLength = sizeof(PVOID); - AccessToken->Privileges = ExAllocatePoolWithTag(PagedPool, - uLength, - TAG_TOKEN_PRIVILAGES); - if (AccessToken->Privileges == NULL) - { - Status = STATUS_INSUFFICIENT_RESOURCES; - goto done; - } - - if (PreviousMode != KernelMode) - { - _SEH2_TRY - { - RtlCopyMemory(AccessToken->Privileges, - Privileges, - PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES)); - } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) - { - Status = _SEH2_GetExceptionCode(); - } - _SEH2_END; - } - else { - RtlCopyMemory(AccessToken->Privileges, - Privileges, - PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES)); + DPRINT1("SepFindPrimaryGroupAndDefaultOwner failed (Status 0x%lx)\n", Status); + goto Quit; } - if (!NT_SUCCESS(Status)) - goto done; - - /* Update privilege flags */ - SepUpdatePrivilegeFlagsToken(AccessToken); + AccessToken->PrimaryGroup = AccessToken->UserAndGroups[PrimaryGroupIndex].Sid; + AccessToken->DefaultOwnerIndex = DefaultOwnerIndex; + /* Now allocate the TOKEN's dynamic information area and set the data */ + AccessToken->DynamicAvailable = 0; // Unused memory in the dynamic area. + AccessToken->DynamicPart = NULL; if (DefaultDacl != NULL) { - // FIXME: should use the object itself - AccessToken->DefaultDacl = ExAllocatePoolWithTag(PagedPool, + AccessToken->DynamicPart = ExAllocatePoolWithTag(PagedPool, DefaultDacl->AclSize, - TAG_TOKEN_ACL); - if (AccessToken->DefaultDacl == NULL) + TAG_TOKEN_DYNAMIC); + if (AccessToken->DynamicPart == NULL) { Status = STATUS_INSUFFICIENT_RESOURCES; - goto done; + goto Quit; } + EndMem = (PVOID)AccessToken->DynamicPart; + + AccessToken->DefaultDacl = EndMem; RtlCopyMemory(AccessToken->DefaultDacl, DefaultDacl, DefaultDacl->AclSize); } - else - { - AccessToken->DefaultDacl = NULL; - } + /* Insert the token only if it's not the system token, otherwise return it directly */ if (!SystemToken) { Status = ObInsertObject(AccessToken, @@ -893,10 +1088,10 @@ SepCreateToken( *TokenHandle = (HANDLE)AccessToken; } -done: +Quit: if (!NT_SUCCESS(Status)) { - /* Dereference the token, the delete procedure will clean up */ + /* Dereference the token, the delete procedure will clean it up */ ObDereferenceObject(AccessToken); } @@ -927,23 +1122,23 @@ SepCreateSystemProcessToken(VOID) GroupAttributes = SE_GROUP_ENABLED | SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT; OwnerAttributes = SE_GROUP_ENABLED | SE_GROUP_OWNER | SE_GROUP_ENABLED_BY_DEFAULT; - /* User is system */ + /* User is Local System */ UserSid.Sid = SeLocalSystemSid; UserSid.Attributes = 0; - /* Primary group is local system */ + /* Primary group is Local System */ PrimaryGroup = SeLocalSystemSid; - /* Owner is admins */ + /* Owner is Administrators */ Owner = SeAliasAdminsSid; - /* Groups are admins, world, and authenticated users */ + /* Groups are Administrators, World, and Authenticated Users */ Groups[0].Sid = SeAliasAdminsSid; Groups[0].Attributes = OwnerAttributes; Groups[1].Sid = SeWorldSid; Groups[1].Attributes = GroupAttributes; - Groups[2].Sid = SeAuthenticatedUserSid; - Groups[2].Attributes = OwnerAttributes; + Groups[2].Sid = SeAuthenticatedUsersSid; + Groups[2].Attributes = GroupAttributes; GroupsLength = sizeof(SID_AND_ATTRIBUTES) + SeLengthSid(Groups[0].Sid) + SeLengthSid(Groups[1].Sid) + @@ -1023,7 +1218,7 @@ SepCreateSystemProcessToken(VOID) 0, &ObjectAttributes, TokenPrimary, - 0, + SecurityAnonymous, &SeSystemAuthenticationId, &Expiration, &UserSid, @@ -1090,6 +1285,8 @@ SeQueryInformationToken(IN PACCESS_TOKEN AccessToken, return STATUS_INVALID_INFO_CLASS; } + // TODO: Lock the token + switch (TokenInformationClass) { case TokenUser: @@ -1471,10 +1668,7 @@ SeQueryInformationToken(IN PACCESS_TOKEN AccessToken, case TokenSessionId: { DPRINT("SeQueryInformationToken(TokenSessionId)\n"); - Status = SeQuerySessionIdToken(Token, (PULONG)TokenInformation); - - // Status = STATUS_SUCCESS; break; } @@ -1495,7 +1689,16 @@ NTAPI SeQuerySessionIdToken(IN PACCESS_TOKEN Token, IN PULONG pSessionId) { + PAGED_CODE(); + + /* Lock the token */ + SepAcquireTokenLockShared(Token); + *pSessionId = ((PTOKEN)Token)->SessionId; + + /* Unlock the token */ + SepReleaseTokenLock(Token); + return STATUS_SUCCESS; } @@ -1587,12 +1790,17 @@ SeTokenIsWriteRestricted(IN PACCESS_TOKEN Token) /* * @implemented */ -NTSTATUS NTAPI -NtQueryInformationToken(IN HANDLE TokenHandle, - IN TOKEN_INFORMATION_CLASS TokenInformationClass, - OUT PVOID TokenInformation, - IN ULONG TokenInformationLength, - OUT PULONG ReturnLength) +_Must_inspect_result_ +__kernel_entry +NTSTATUS +NTAPI +NtQueryInformationToken( + _In_ HANDLE TokenHandle, + _In_ TOKEN_INFORMATION_CLASS TokenInformationClass, + _Out_writes_bytes_to_opt_(TokenInformationLength, *ReturnLength) + PVOID TokenInformation, + _In_ ULONG TokenInformationLength, + _Out_ PULONG ReturnLength) { NTSTATUS Status; KPROCESSOR_MODE PreviousMode; @@ -1631,6 +1839,9 @@ NtQueryInformationToken(IN HANDLE TokenHandle, NULL); if (NT_SUCCESS(Status)) { + /* Lock the token */ + SepAcquireTokenLockShared(Token); + switch (TokenInformationClass) { case TokenUser: @@ -2140,6 +2351,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle, break; } + /* Unlock and dereference the token */ + SepReleaseTokenLock(Token); ObDereferenceObject(Token); } @@ -2152,16 +2365,20 @@ NtQueryInformationToken(IN HANDLE TokenHandle, * Unimplemented: * TokenOrigin, TokenDefaultDacl */ -NTSTATUS NTAPI -NtSetInformationToken(IN HANDLE TokenHandle, - IN TOKEN_INFORMATION_CLASS TokenInformationClass, - IN PVOID TokenInformation, - IN ULONG TokenInformationLength) +_Must_inspect_result_ +__kernel_entry +NTSTATUS +NTAPI +NtSetInformationToken( + _In_ HANDLE TokenHandle, + _In_ TOKEN_INFORMATION_CLASS TokenInformationClass, + _In_reads_bytes_(TokenInformationLength) PVOID TokenInformation, + _In_ ULONG TokenInformationLength) { + NTSTATUS Status; PTOKEN Token; KPROCESSOR_MODE PreviousMode; ULONG NeededAccess = TOKEN_ADJUST_DEFAULT; - NTSTATUS Status; PAGED_CODE(); @@ -2201,6 +2418,7 @@ NtSetInformationToken(IN HANDLE TokenHandle, { PTOKEN_OWNER to = (PTOKEN_OWNER)TokenInformation; PSID InputSid = NULL, CapturedSid; + ULONG DefaultOwnerIndex; _SEH2_TRY { @@ -2220,9 +2438,25 @@ NtSetInformationToken(IN HANDLE TokenHandle, &CapturedSid); if (NT_SUCCESS(Status)) { - RtlCopySid(RtlLengthSid(CapturedSid), - Token->UserAndGroups[Token->DefaultOwnerIndex].Sid, - CapturedSid); + /* Lock the token */ + SepAcquireTokenLockExclusive(Token); + + /* Find the owner amongst the existing token user and groups */ + Status = SepFindPrimaryGroupAndDefaultOwner(Token, + NULL, + CapturedSid, + NULL, + &DefaultOwnerIndex); + if (NT_SUCCESS(Status)) + { + /* Found it */ + Token->DefaultOwnerIndex = DefaultOwnerIndex; + ExAllocateLocallyUniqueId(&Token->ModifiedId); + } + + /* Unlock the token */ + SepReleaseTokenLock(Token); + SepReleaseSid(CapturedSid, PreviousMode, FALSE); @@ -2241,6 +2475,7 @@ NtSetInformationToken(IN HANDLE TokenHandle, { PTOKEN_PRIMARY_GROUP tpg = (PTOKEN_PRIMARY_GROUP)TokenInformation; PSID InputSid = NULL, CapturedSid; + ULONG PrimaryGroupIndex; _SEH2_TRY { @@ -2260,9 +2495,25 @@ NtSetInformationToken(IN HANDLE TokenHandle, &CapturedSid); if (NT_SUCCESS(Status)) { - RtlCopySid(RtlLengthSid(CapturedSid), - Token->PrimaryGroup, - CapturedSid); + /* Lock the token */ + SepAcquireTokenLockExclusive(Token); + + /* Find the primary group amongst the existing token user and groups */ + Status = SepFindPrimaryGroupAndDefaultOwner(Token, + CapturedSid, + NULL, + &PrimaryGroupIndex, + NULL); + if (NT_SUCCESS(Status)) + { + /* Found it */ + Token->PrimaryGroup = Token->UserAndGroups[PrimaryGroupIndex].Sid; + ExAllocateLocallyUniqueId(&Token->ModifiedId); + } + + /* Unlock the token */ + SepReleaseTokenLock(Token); + SepReleaseSid(CapturedSid, PreviousMode, FALSE); @@ -2305,36 +2556,87 @@ NtSetInformationToken(IN HANDLE TokenHandle, &CapturedAcl); if (NT_SUCCESS(Status)) { - /* Free the previous dacl if present */ - if(Token->DefaultDacl != NULL) + ULONG DynamicLength; + + /* Lock the token */ + SepAcquireTokenLockExclusive(Token); + + // + // NOTE: So far our dynamic area only contains + // the default dacl, so this makes the following + // code pretty simple. The day where it stores + // other data, the code will require adaptations. + // + + DynamicLength = Token->DynamicAvailable; + // Add here any other data length present in the dynamic area... + if (Token->DefaultDacl) + DynamicLength += Token->DefaultDacl->AclSize; + + /* Reallocate the dynamic area if it is too small */ + Status = STATUS_SUCCESS; + if ((DynamicLength < CapturedAcl->AclSize) || + (Token->DynamicPart == NULL)) { - ExFreePoolWithTag(Token->DefaultDacl, TAG_TOKEN_ACL); - } + PVOID NewDynamicPart; - Token->DefaultDacl = ExAllocatePoolWithTag(PagedPool, + NewDynamicPart = ExAllocatePoolWithTag(PagedPool, CapturedAcl->AclSize, - TAG_TOKEN_ACL); - if (!Token->DefaultDacl) - { - ExFreePoolWithTag(CapturedAcl, TAG_ACL); - Status = STATUS_NO_MEMORY; + TAG_TOKEN_DYNAMIC); + if (NewDynamicPart == NULL) + { + Status = STATUS_INSUFFICIENT_RESOURCES; + } + else + { + if (Token->DynamicPart != NULL) + { + // RtlCopyMemory(NewDynamicPart, Token->DynamicPart, DynamicLength); + ExFreePoolWithTag(Token->DynamicPart, TAG_TOKEN_DYNAMIC); + } + Token->DynamicPart = NewDynamicPart; + Token->DynamicAvailable = 0; + } } else + { + Token->DynamicAvailable = DynamicLength - CapturedAcl->AclSize; + } + + if (NT_SUCCESS(Status)) { /* Set the new dacl */ - RtlCopyMemory(Token->DefaultDacl, CapturedAcl, CapturedAcl->AclSize); - ExFreePoolWithTag(CapturedAcl, TAG_ACL); + Token->DefaultDacl = (PVOID)Token->DynamicPart; + RtlCopyMemory(Token->DefaultDacl, + CapturedAcl, + CapturedAcl->AclSize); + + ExAllocateLocallyUniqueId(&Token->ModifiedId); } + + /* Unlock the token */ + SepReleaseTokenLock(Token); + + ExFreePoolWithTag(CapturedAcl, TAG_ACL); } } else { - /* Clear and free the default dacl if present */ + /* Lock the token */ + SepAcquireTokenLockExclusive(Token); + + /* Clear the default dacl if present */ if (Token->DefaultDacl != NULL) { - ExFreePoolWithTag(Token->DefaultDacl, TAG_TOKEN_ACL); + Token->DynamicAvailable += Token->DefaultDacl->AclSize; + RtlZeroMemory(Token->DefaultDacl, Token->DefaultDacl->AclSize); Token->DefaultDacl = NULL; + + ExAllocateLocallyUniqueId(&Token->ModifiedId); } + + /* Unlock the token */ + SepReleaseTokenLock(Token); } } else @@ -2360,14 +2662,22 @@ NtSetInformationToken(IN HANDLE TokenHandle, } _SEH2_END; - if (!SeSinglePrivilegeCheck(SeTcbPrivilege, - PreviousMode)) + /* Check for TCB privilege */ + if (!SeSinglePrivilegeCheck(SeTcbPrivilege, PreviousMode)) { Status = STATUS_PRIVILEGE_NOT_HELD; break; } + /* Lock the token */ + SepAcquireTokenLockExclusive(Token); + Token->SessionId = SessionId; + ExAllocateLocallyUniqueId(&Token->ModifiedId); + + /* Unlock the token */ + SepReleaseTokenLock(Token); + break; } @@ -2387,6 +2697,7 @@ NtSetInformationToken(IN HANDLE TokenHandle, } _SEH2_END; + /* Check for TCB privilege */ if (!SeSinglePrivilegeCheck(SeTcbPrivilege, PreviousMode)) { Status = STATUS_PRIVILEGE_NOT_HELD; @@ -2396,11 +2707,30 @@ NtSetInformationToken(IN HANDLE TokenHandle, /* Check if it is 0 */ if (SessionReference == 0) { + ULONG OldTokenFlags; + + /* Lock the token */ + SepAcquireTokenLockExclusive(Token); + /* Atomically set the flag in the token */ - RtlInterlockedSetBits(&Token->TokenFlags, - TOKEN_SESSION_NOT_REFERENCED); + OldTokenFlags = RtlInterlockedSetBits(&Token->TokenFlags, + TOKEN_SESSION_NOT_REFERENCED); + /* + * If the flag was already set, do not dereference again + * the logon session. Use SessionReference as an indicator + * to know whether to really dereference the session. + */ + if (OldTokenFlags == Token->TokenFlags) + SessionReference = ULONG_MAX; + + /* Unlock the token */ + SepReleaseTokenLock(Token); } + /* Dereference the logon session if needed */ + if (SessionReference == 0) + SepRmDereferenceLogonSession(&Token->AuthenticationId); + break; } @@ -2469,8 +2799,8 @@ NtSetInformationToken(IN HANDLE TokenHandle, } _SEH2_END; - if (!SeSinglePrivilegeCheck(SeTcbPrivilege, - PreviousMode)) + /* Check for TCB privilege */ + if (!SeSinglePrivilegeCheck(SeTcbPrivilege, PreviousMode)) { Status = STATUS_PRIVILEGE_NOT_HELD; break; @@ -2481,6 +2811,7 @@ NtSetInformationToken(IN HANDLE TokenHandle, /* Set the new audit policy */ Token->AuditPolicy = AuditPolicy; + ExAllocateLocallyUniqueId(&Token->ModifiedId); /* Unlock the token */ SepReleaseTokenLock(Token); @@ -2515,12 +2846,13 @@ NtSetInformationToken(IN HANDLE TokenHandle, SepAcquireTokenLockExclusive(Token); /* Check if there is no token origin set yet */ - if ((Token->OriginatingLogonSession.LowPart == 0) && - (Token->OriginatingLogonSession.HighPart == 0)) + if (RtlIsZeroLuid(&Token->OriginatingLogonSession)) { /* Set the token origin */ Token->OriginatingLogonSession = TokenOrigin.OriginatingLogonSession; + + ExAllocateLocallyUniqueId(&Token->ModifiedId); } /* Unlock the token */ @@ -2560,13 +2892,17 @@ Cleanup: * NOTE for readers: http://hex.pp.ua/nt/NtDuplicateToken.php is therefore * wrong in that regard, while MSDN documentation is correct. */ -NTSTATUS NTAPI -NtDuplicateToken(IN HANDLE ExistingTokenHandle, - IN ACCESS_MASK DesiredAccess, - IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, - IN BOOLEAN EffectiveOnly, - IN TOKEN_TYPE TokenType, - OUT PHANDLE NewTokenHandle) +_Must_inspect_result_ +__kernel_entry +NTSTATUS +NTAPI +NtDuplicateToken( + _In_ HANDLE ExistingTokenHandle, + _In_ ACCESS_MASK DesiredAccess, + _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_ BOOLEAN EffectiveOnly, + _In_ TOKEN_TYPE TokenType, + _Out_ PHANDLE NewTokenHandle) { KPROCESSOR_MODE PreviousMode; HANDLE hToken; @@ -2581,7 +2917,9 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle, if (TokenType != TokenImpersonation && TokenType != TokenPrimary) + { return STATUS_INVALID_PARAMETER; + } PreviousMode = KeGetPreviousMode(); @@ -2619,6 +2957,7 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle, &HandleInformation); if (!NT_SUCCESS(Status)) { + DPRINT1("Failed to reference token (Status 0x%lx)\n", Status); SepReleaseSecurityQualityOfService(CapturedSecurityQualityOfService, PreviousMode, FALSE); @@ -2712,7 +3051,7 @@ NtAdjustGroupsToken(IN HANDLE TokenHandle, static -ULONG +NTSTATUS SepAdjustPrivileges( _Inout_ PTOKEN Token, _In_ BOOLEAN DisableAllPrivileges, @@ -2720,13 +3059,15 @@ SepAdjustPrivileges( _In_ ULONG NewStateCount, _Out_opt_ PTOKEN_PRIVILEGES PreviousState, _In_ BOOLEAN ApplyChanges, - _Out_ PULONG ChangedPrivileges) + _Out_ PULONG ChangedPrivileges, + _Out_ PBOOLEAN ChangesMade) { ULONG i, j, PrivilegeCount, ChangeCount, NewAttributes; /* Count the found privileges and those that need to be changed */ PrivilegeCount = 0; ChangeCount = 0; + *ChangesMade = FALSE; /* Loop all privileges in the token */ for (i = 0; i < Token->PrivilegeCount; i++) @@ -2791,16 +3132,17 @@ SepAdjustPrivileges( /* Remove the privilege */ SepRemovePrivilegeToken(Token, i); - /* Fix the running index */ - i--; + *ChangesMade = TRUE; - /* Continue with next */ + /* Fix the running index and continue with next one */ + i--; continue; } /* Set the new attributes and update flags */ Token->Privileges[i].Attributes = NewAttributes; SepUpdateSinglePrivilegeFlagToken(Token, i); + *ChangesMade = TRUE; } /* Increment the change count */ @@ -2841,15 +3183,17 @@ NtAdjustPrivilegesToken( PTOKEN_PRIVILEGES PreviousState, _When_(PreviousState!=NULL, _Out_) PULONG ReturnLength) { - PLUID_AND_ATTRIBUTES CapturedPrivileges = NULL; + NTSTATUS Status; KPROCESSOR_MODE PreviousMode; + PTOKEN Token; + PLUID_AND_ATTRIBUTES CapturedPrivileges = NULL; ULONG CapturedCount = 0; ULONG CapturedLength = 0; ULONG NewStateSize = 0; ULONG ChangeCount; ULONG RequiredLength; - PTOKEN Token; - NTSTATUS Status; + BOOLEAN ChangesMade = FALSE; + PAGED_CODE(); DPRINT("NtAdjustPrivilegesToken() called\n"); @@ -2936,15 +3280,17 @@ NtAdjustPrivilegesToken( /* Release the captured privileges */ if (CapturedPrivileges != NULL) + { SeReleaseLuidAndAttributesArray(CapturedPrivileges, PreviousMode, TRUE); + } return Status; } /* Lock the token */ - ExEnterCriticalRegionAndAcquireResourceExclusive(Token->TokenLock); + SepAcquireTokenLockExclusive(Token); /* Count the privileges that need to be changed, do not apply them yet */ Status = SepAdjustPrivileges(Token, @@ -2953,7 +3299,8 @@ NtAdjustPrivilegesToken( CapturedCount, NULL, FALSE, - &ChangeCount); + &ChangeCount, + &ChangesMade); /* Check if the caller asked for the previous state */ if (PreviousState != NULL) @@ -2992,31 +3339,40 @@ NtAdjustPrivilegesToken( CapturedCount, PreviousState, TRUE, - &ChangeCount); + &ChangeCount, + &ChangesMade); } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { /* Do cleanup and return the exception code */ Status = _SEH2_GetExceptionCode(); + ChangesMade = TRUE; // Force write. _SEH2_YIELD(goto Cleanup); } _SEH2_END; Cleanup: + /* Touch the token if we made changes */ + if (ChangesMade) + ExAllocateLocallyUniqueId(&Token->ModifiedId); + /* Unlock and dereference the token */ - ExReleaseResourceAndLeaveCriticalRegion(Token->TokenLock); + SepReleaseTokenLock(Token); ObDereferenceObject(Token); /* Release the captured privileges */ if (CapturedPrivileges != NULL) + { SeReleaseLuidAndAttributesArray(CapturedPrivileges, PreviousMode, TRUE); + } DPRINT ("NtAdjustPrivilegesToken() done\n"); return Status; } +__kernel_entry NTSTATUS NTAPI NtCreateToken( @@ -3153,6 +3509,12 @@ NtCreateToken( return STATUS_BAD_TOKEN_TYPE; } + /* Check for token creation privilege */ + if (!SeSinglePrivilegeCheck(SeCreateTokenPrivilege, PreviousMode)) + { + return STATUS_PRIVILEGE_NOT_HELD; + } + /* Capture the user SID and attributes */ Status = SeCaptureSidAndAttributesArray(&TokenUser->User, 1, @@ -3524,8 +3886,8 @@ NtCompareTokens(IN HANDLE FirstTokenHandle, IsEqual = TRUE; } - ObDereferenceObject(FirstToken); ObDereferenceObject(SecondToken); + ObDereferenceObject(FirstToken); if (NT_SUCCESS(Status)) { diff --git a/sdk/include/ndk/sefuncs.h b/sdk/include/ndk/sefuncs.h index f62dc5f3fc..96164320ac 100644 --- a/sdk/include/ndk/sefuncs.h +++ b/sdk/include/ndk/sefuncs.h @@ -201,6 +201,7 @@ NtCompareTokens( _In_ HANDLE SecondTokenHandle, _Out_ PBOOLEAN Equal); +__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI

1 0

14/15: [NDK] Update NtCreateToken() prototype annotations.
by Hermès Bélusca-Maïto 27 Jun '18

27 Jun '18

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=a3376cd50d4503413ce8d… commit a3376cd50d4503413ce8dcdc23b8bc8645cd78c9 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Tue Jun 26 22:49:34 2018 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Wed Jun 27 23:40:17 2018 +0200 [NDK] Update NtCreateToken() prototype annotations. --- sdk/include/ndk/sefuncs.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sdk/include/ndk/sefuncs.h b/sdk/include/ndk/sefuncs.h index e0e18e1460..f62dc5f3fc 100644 --- a/sdk/include/ndk/sefuncs.h +++ b/sdk/include/ndk/sefuncs.h @@ -207,16 +207,16 @@ NTAPI NtCreateToken( _Out_ PHANDLE TokenHandle, _In_ ACCESS_MASK DesiredAccess, - _In_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ TOKEN_TYPE TokenType, _In_ PLUID AuthenticationId, _In_ PLARGE_INTEGER ExpirationTime, _In_ PTOKEN_USER TokenUser, _In_ PTOKEN_GROUPS TokenGroups, _In_ PTOKEN_PRIVILEGES TokenPrivileges, - _In_ PTOKEN_OWNER TokenOwner, + _In_opt_ PTOKEN_OWNER TokenOwner, _In_ PTOKEN_PRIMARY_GROUP TokenPrimaryGroup, - _In_ PTOKEN_DEFAULT_DACL TokenDefaultDacl, + _In_opt_ PTOKEN_DEFAULT_DACL TokenDefaultDacl, _In_ PTOKEN_SOURCE TokenSource );

1 0

13/15: [LSASRV] Enable SE_CREATE_TOKEN_PRIVILEGE in LSASS since one of our purposes is to create access tokens -- NtCreateToken() requires this privilege.
by Hermès Bélusca-Maïto 27 Jun '18

27 Jun '18

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=a9eda8f492137e7d8d9ac… commit a9eda8f492137e7d8d9ac5089956689b28d8f332 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Tue Jun 26 22:30:09 2018 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Wed Jun 27 23:40:16 2018 +0200 [LSASRV] Enable SE_CREATE_TOKEN_PRIVILEGE in LSASS since one of our purposes is to create access tokens -- NtCreateToken() requires this privilege. --- dll/win32/lsasrv/lsasrv.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dll/win32/lsasrv/lsasrv.c b/dll/win32/lsasrv/lsasrv.c index e2a28bd600..206c10ec06 100644 --- a/dll/win32/lsasrv/lsasrv.c +++ b/dll/win32/lsasrv/lsasrv.c @@ -272,6 +272,7 @@ NTSTATUS WINAPI LsapInitLsa(VOID) { NTSTATUS Status; + BOOLEAN PrivilegeEnabled; TRACE("LsapInitLsa() called\n"); @@ -300,6 +301,13 @@ LsapInitLsa(VOID) return Status; } + /* Enable the token creation privilege for the rest of our lifetime */ + Status = RtlAdjustPrivilege(SE_CREATE_TOKEN_PRIVILEGE, TRUE, FALSE, &PrivilegeEnabled); + if (!NT_SUCCESS(Status)) + { + ERR("RtlAdjustPrivilege(SE_CREATE_TOKEN_PRIVILEGE) failed, ignoring (Status 0x%08lx)\n", Status); + } + /* Start the authentication LPC port thread */ Status = StartAuthenticationPort(); if (!NT_SUCCESS(Status))

1 0

12/15: [LSASRV] Move the LSA_RPC_SERVER_ACTIVE event creation to a better place, in LsarStartRpcServer().
by Hermès Bélusca-Maïto 27 Jun '18

27 Jun '18

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=c901c3d37fd929d768e53… commit c901c3d37fd929d768e5378bb35e05921a5cddd3 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Tue Jun 26 22:19:40 2018 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Wed Jun 27 23:40:16 2018 +0200 [LSASRV] Move the LSA_RPC_SERVER_ACTIVE event creation to a better place, in LsarStartRpcServer(). --- dll/win32/lsasrv/lookup.c | 1 - dll/win32/lsasrv/lsarpc.c | 42 ++++++++++++++++++++++++++++++++++++++---- dll/win32/lsasrv/lsasrv.c | 36 +++++------------------------------- dll/win32/lsasrv/lsasrv.h | 2 +- 4 files changed, 44 insertions(+), 37 deletions(-) diff --git a/dll/win32/lsasrv/lookup.c b/dll/win32/lsasrv/lookup.c index b0805ebc0f..79cbffca57 100644 --- a/dll/win32/lsasrv/lookup.c +++ b/dll/win32/lsasrv/lookup.c @@ -182,7 +182,6 @@ LsapInitSids(VOID) hInstance = GetModuleHandleW(L"lsasrv.dll"); /* NT Authority */ - LsapLoadString(hInstance, IDS_NT_AUTHORITY, szAccountName, ARRAYSIZE(szAccountName)); LsapLoadString(hInstance, IDS_NT_AUTHORITY, szDomainName, ARRAYSIZE(szDomainName)); LsapCreateSid(&NtAuthority, diff --git a/dll/win32/lsasrv/lsarpc.c b/dll/win32/lsasrv/lsarpc.c index 4b9ef392c2..5f314e8c2b 100644 --- a/dll/win32/lsasrv/lsarpc.c +++ b/dll/win32/lsasrv/lsarpc.c @@ -36,10 +36,12 @@ LsapSecretMapping = {SECRET_READ, /* FUNCTIONS ***************************************************************/ -VOID +NTSTATUS LsarStartRpcServer(VOID) { RPC_STATUS Status; + DWORD dwError; + HANDLE hEvent; RtlInitializeCriticalSection(&PolicyHandleTableLock); @@ -52,7 +54,7 @@ LsarStartRpcServer(VOID) if (Status != RPC_S_OK) { WARN("RpcServerUseProtseqEpW() failed (Status %lx)\n", Status); - return; + return I_RpcMapWin32Status(Status); } Status = RpcServerRegisterIf(lsarpc_v0_0_s_ifspec, @@ -61,7 +63,7 @@ LsarStartRpcServer(VOID) if (Status != RPC_S_OK) { WARN("RpcServerRegisterIf() failed (Status %lx)\n", Status); - return; + return I_RpcMapWin32Status(Status); } DsSetupInit(); @@ -70,10 +72,42 @@ LsarStartRpcServer(VOID) if (Status != RPC_S_OK) { WARN("RpcServerListen() failed (Status %lx)\n", Status); - return; + return I_RpcMapWin32Status(Status); } + /* Notify the service manager */ + TRACE("Creating notification event!\n"); + hEvent = CreateEventW(NULL, + TRUE, + FALSE, + L"LSA_RPC_SERVER_ACTIVE"); + if (hEvent == NULL) + { + dwError = GetLastError(); + TRACE("Failed to create or open the notification event (Error %lu)\n", dwError); +#if 0 + if (dwError == ERROR_ALREADY_EXISTS) + { + hEvent = OpenEventW(GENERIC_WRITE, + FALSE, + L"LSA_RPC_SERVER_ACTIVE"); + if (hEvent == NULL) + { + ERR("Could not open the notification event (Error %lu)\n", GetLastError()); + return STATUS_UNSUCCESSFUL; + } + } +#endif + return STATUS_UNSUCCESSFUL; + } + + TRACE("Set notification event!\n"); + SetEvent(hEvent); + + /* NOTE: Do not close the event handle, as it must remain alive! */ + TRACE("LsarStartRpcServer() done\n"); + return STATUS_SUCCESS; } diff --git a/dll/win32/lsasrv/lsasrv.c b/dll/win32/lsasrv/lsasrv.c index 12fac372d8..e2a28bd600 100644 --- a/dll/win32/lsasrv/lsasrv.c +++ b/dll/win32/lsasrv/lsasrv.c @@ -271,8 +271,6 @@ LsaIFree_LSAPR_TRANSLATED_SIDS( NTSTATUS WINAPI LsapInitLsa(VOID) { - HANDLE hEvent; - DWORD dwError; NTSTATUS Status; TRACE("LsapInitLsa() called\n"); @@ -302,7 +300,7 @@ LsapInitLsa(VOID) return Status; } - /* Start the authentication port thread */ + /* Start the authentication LPC port thread */ Status = StartAuthenticationPort(); if (!NT_SUCCESS(Status)) { @@ -311,37 +309,13 @@ LsapInitLsa(VOID) } /* Start the RPC server */ - LsarStartRpcServer(); - - TRACE("Creating notification event!\n"); - /* Notify the service manager */ - hEvent = CreateEventW(NULL, - TRUE, - FALSE, - L"LSA_RPC_SERVER_ACTIVE"); - if (hEvent == NULL) + Status = LsarStartRpcServer(); + if (!NT_SUCCESS(Status)) { - dwError = GetLastError(); - TRACE("Failed to create the notification event (Error %lu)\n", dwError); - - if (dwError == ERROR_ALREADY_EXISTS) - { - hEvent = OpenEventW(GENERIC_WRITE, - FALSE, - L"LSA_RPC_SERVER_ACTIVE"); - if (hEvent == NULL) - { - ERR("Could not open the notification event (Error %lu)\n", GetLastError()); - return STATUS_UNSUCCESSFUL; - } - } + ERR("LsarStartRpcServer() failed (Status 0x%08lx)\n", Status); + return Status; } - TRACE("Set notification event!\n"); - SetEvent(hEvent); - - /* NOTE: Do not close the event handle!!!! */ - return STATUS_SUCCESS; } diff --git a/dll/win32/lsasrv/lsasrv.h b/dll/win32/lsasrv/lsasrv.h index 4bc0673c71..8a772aba21 100644 --- a/dll/win32/lsasrv/lsasrv.h +++ b/dll/win32/lsasrv/lsasrv.h @@ -206,7 +206,7 @@ LsapLookupSids(PLSAPR_SID_ENUM_BUFFER SidEnumBuffer, DWORD ClientRevision); /* lsarpc.c */ -VOID +NTSTATUS LsarStartRpcServer(VOID); /* policy.c */

1 0

11/15: [LSASRV] Add the SE_GROUP_OWNER attributes to the token owner.
by Hermès Bélusca-Maïto 27 Jun '18

27 Jun '18

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=0208a4d196805fd610a51… commit 0208a4d196805fd610a511b4ff71af405ca38297 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Tue Jun 26 22:14:03 2018 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Wed Jun 27 23:40:16 2018 +0200 [LSASRV] Add the SE_GROUP_OWNER attributes to the token owner. --- dll/win32/lsasrv/authpackage.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/dll/win32/lsasrv/authpackage.c b/dll/win32/lsasrv/authpackage.c index 0e9ab0b701..22e668c600 100644 --- a/dll/win32/lsasrv/authpackage.c +++ b/dll/win32/lsasrv/authpackage.c @@ -1137,7 +1137,7 @@ LsapSetTokenOwner( IN LSA_TOKEN_INFORMATION_TYPE TokenInformationType) { PLSA_TOKEN_INFORMATION_V1 TokenInfo1; - PSID OwnerSid = NULL; + PSID_AND_ATTRIBUTES OwnerSid = NULL; ULONG i, Length; if (TokenInformationType == LsaTokenInformationV1) @@ -1147,24 +1147,25 @@ LsapSetTokenOwner( if (TokenInfo1->Owner.Owner != NULL) return STATUS_SUCCESS; - OwnerSid = TokenInfo1->User.User.Sid; + OwnerSid = &TokenInfo1->User.User; for (i = 0; i < TokenInfo1->Groups->GroupCount; i++) { if (EqualSid(TokenInfo1->Groups->Groups[i].Sid, LsapAdministratorsSid)) { - OwnerSid = LsapAdministratorsSid; + OwnerSid = &TokenInfo1->Groups->Groups[i]; break; } } - Length = RtlLengthSid(OwnerSid); + Length = RtlLengthSid(OwnerSid->Sid); TokenInfo1->Owner.Owner = DispatchTable.AllocateLsaHeap(Length); if (TokenInfo1->Owner.Owner == NULL) return STATUS_INSUFFICIENT_RESOURCES; RtlCopyMemory(TokenInfo1->Owner.Owner, - OwnerSid, + OwnerSid->Sid, Length); + OwnerSid->Attributes |= SE_GROUP_OWNER; } return STATUS_SUCCESS;

1 0

10/15: [NTOS:SE] Add a documentation note about SeTokenIsWriteRestricted() and SeTokenIsAdmin(), and update the one for NtDuplicateToken(). [XDK] Move TOKEN_HAS_ADMIN_GROUP where appropriate.
by Hermès Bélusca-Maïto 27 Jun '18

27 Jun '18

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=9594022ce141965e672ce… commit 9594022ce141965e672ce975bf4d71a5f0e46730 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Mon Jun 25 18:49:07 2018 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Wed Jun 27 23:40:15 2018 +0200 [NTOS:SE] Add a documentation note about SeTokenIsWriteRestricted() and SeTokenIsAdmin(), and update the one for NtDuplicateToken(). [XDK] Move TOKEN_HAS_ADMIN_GROUP where appropriate. --- ntoskrnl/se/token.c | 12 +++++++++--- sdk/include/xdk/ntifs.template.h | 2 -- sdk/include/xdk/setypes.h | 1 + 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/ntoskrnl/se/token.c b/ntoskrnl/se/token.c index 75ab43d21e..9523fbf8aa 100644 --- a/ntoskrnl/se/token.c +++ b/ntoskrnl/se/token.c @@ -1549,7 +1549,9 @@ SeTokenIsAdmin(IN PACCESS_TOKEN Token) { PAGED_CODE(); - return (((PTOKEN)Token)->TokenFlags & TOKEN_WRITE_RESTRICTED) != 0; + // NOTE: Win7+ instead really checks the list of groups in the token + // (since TOKEN_HAS_ADMIN_GROUP == TOKEN_WRITE_RESTRICTED ...) + return (((PTOKEN)Token)->TokenFlags & TOKEN_HAS_ADMIN_GROUP) != 0; } /* @@ -1566,6 +1568,8 @@ SeTokenIsRestricted(IN PACCESS_TOKEN Token) /* * @implemented + * @note First introduced in NT 5.1 SP2 x86 (5.1.2600.2622), absent in NT 5.2, + * then finally re-introduced in Vista+. */ BOOLEAN NTAPI @@ -1573,7 +1577,9 @@ SeTokenIsWriteRestricted(IN PACCESS_TOKEN Token) { PAGED_CODE(); - return (((PTOKEN)Token)->TokenFlags & TOKEN_HAS_RESTORE_PRIVILEGE) != 0; + // NOTE: NT 5.1 SP2 x86 checks the SE_BACKUP_PRIVILEGES_CHECKED flag + // while Vista+ checks the TOKEN_WRITE_RESTRICTED flag as one expects. + return (((PTOKEN)Token)->TokenFlags & SE_BACKUP_PRIVILEGES_CHECKED) != 0; } /* SYSTEM CALLS ***************************************************************/ @@ -2552,7 +2558,7 @@ Cleanup: * is correct either. -Gunnar * This is true. EffectiveOnly overrides SQOS.EffectiveOnly. - IAI * NOTE for readers: http://hex.pp.ua/nt/NtDuplicateToken.php is therefore - * wrong in that regard. + * wrong in that regard, while MSDN documentation is correct. */ NTSTATUS NTAPI NtDuplicateToken(IN HANDLE ExistingTokenHandle, diff --git a/sdk/include/xdk/ntifs.template.h b/sdk/include/xdk/ntifs.template.h index 642193fe36..7ad62ca88d 100644 --- a/sdk/include/xdk/ntifs.template.h +++ b/sdk/include/xdk/ntifs.template.h @@ -1360,8 +1360,6 @@ typedef struct _QUERY_PATH_RESPONSE { /* end winnt.h */ -#define TOKEN_HAS_ADMIN_GROUP 0x08 - #if (VER_PRODUCTBUILD >= 1381) #define FSCTL_GET_HFS_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS) #endif /* (VER_PRODUCTBUILD >= 1381) */ diff --git a/sdk/include/xdk/setypes.h b/sdk/include/xdk/setypes.h index 5dbf75edf0..699e71bd7d 100644 --- a/sdk/include/xdk/setypes.h +++ b/sdk/include/xdk/setypes.h @@ -1125,6 +1125,7 @@ typedef struct _TOKEN_ACCESS_INFORMATION { #define TOKEN_HAS_BACKUP_PRIVILEGE 0x0002 #define TOKEN_HAS_RESTORE_PRIVILEGE 0x0004 #define TOKEN_WRITE_RESTRICTED 0x0008 +#define TOKEN_HAS_ADMIN_GROUP TOKEN_WRITE_RESTRICTED #define TOKEN_IS_RESTRICTED 0x0010 #define TOKEN_SESSION_NOT_REFERENCED 0x0020 #define TOKEN_SANDBOX_INERT 0x0040

1 0

09/15: [NTOS:SE] Minor style changes.
by Hermès Bélusca-Maïto 27 Jun '18

27 Jun '18

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=f61694cfbb6ba189cf474… commit f61694cfbb6ba189cf47485e7888a8968d811c88 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Mon Jun 25 16:03:40 2018 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Wed Jun 27 23:40:15 2018 +0200 [NTOS:SE] Minor style changes. - Use TRUE/FALSE instead of 1/0 for booleans. - Use NULL instead of 0 for null pointers. - Print 0x prefix for hex values in DPRINTs. - Use new annotations for SepCreateToken() and SepDuplicateToken(). --- ntoskrnl/include/internal/se.h | 14 +++--- ntoskrnl/se/token.c | 103 ++++++++++++++++++++--------------------- 2 files changed, 58 insertions(+), 59 deletions(-) diff --git a/ntoskrnl/include/internal/se.h b/ntoskrnl/include/internal/se.h index 040d23c174..e2861aad8c 100644 --- a/ntoskrnl/include/internal/se.h +++ b/ntoskrnl/include/internal/se.h @@ -412,13 +412,13 @@ SeCheckPrivilegedObject( NTSTATUS NTAPI SepDuplicateToken( - PTOKEN Token, - POBJECT_ATTRIBUTES ObjectAttributes, - BOOLEAN EffectiveOnly, - TOKEN_TYPE TokenType, - SECURITY_IMPERSONATION_LEVEL Level, - KPROCESSOR_MODE PreviousMode, - PTOKEN* NewAccessToken + _In_ PTOKEN Token, + _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_ BOOLEAN EffectiveOnly, + _In_ TOKEN_TYPE TokenType, + _In_ SECURITY_IMPERSONATION_LEVEL Level, + _In_ KPROCESSOR_MODE PreviousMode, + _Out_ PTOKEN* NewAccessToken ); NTSTATUS diff --git a/ntoskrnl/se/token.c b/ntoskrnl/se/token.c index b9c4e6f1f4..75ab43d21e 100644 --- a/ntoskrnl/se/token.c +++ b/ntoskrnl/se/token.c @@ -47,7 +47,7 @@ static GENERIC_MAPPING SepTokenMapping = { static const INFORMATION_CLASS_INFO SeTokenInformationClass[] = { - /* Class 0 not used, blame M$! */ + /* Class 0 not used, blame MS! */ ICI_SQ_SAME( 0, 0, 0), /* TokenUser */ @@ -268,7 +268,7 @@ SeExchangePrimaryToken(PEPROCESS Process, } /* Mark new token in use */ - NewToken->TokenInUse = 1; + NewToken->TokenInUse = TRUE; /* Reference the New Token */ ObReferenceObject(NewToken); @@ -277,7 +277,7 @@ SeExchangePrimaryToken(PEPROCESS Process, OldToken = ObFastReplaceObject(&Process->Token, NewToken); /* Mark the Old Token as free */ - OldToken->TokenInUse = 0; + OldToken->TokenInUse = FALSE; *OldTokenP = (PACCESS_TOKEN)OldToken; return STATUS_SUCCESS; @@ -293,7 +293,7 @@ SeDeassignPrimaryToken(PEPROCESS Process) OldToken = ObFastReplaceObject(&Process->Token, NULL); /* Mark the Old Token as free */ - OldToken->TokenInUse = 0; + OldToken->TokenInUse = FALSE; /* Dereference the Token */ ObDereferenceObject(OldToken); @@ -324,7 +324,7 @@ SepFindPrimaryGroupAndDefaultOwner(PTOKEN Token, { ULONG i; - Token->PrimaryGroup = 0; + Token->PrimaryGroup = NULL; if (DefaultOwner) { @@ -351,7 +351,7 @@ SepFindPrimaryGroupAndDefaultOwner(PTOKEN Token, return STATUS_INVALID_OWNER; } - if (Token->PrimaryGroup == 0) + if (Token->PrimaryGroup == NULL) { return STATUS_INVALID_PRIMARY_GROUP; } @@ -362,13 +362,14 @@ SepFindPrimaryGroupAndDefaultOwner(PTOKEN Token, NTSTATUS NTAPI -SepDuplicateToken(PTOKEN Token, - POBJECT_ATTRIBUTES ObjectAttributes, - BOOLEAN EffectiveOnly, - TOKEN_TYPE TokenType, - SECURITY_IMPERSONATION_LEVEL Level, - KPROCESSOR_MODE PreviousMode, - PTOKEN* NewAccessToken) +SepDuplicateToken( + _In_ PTOKEN Token, + _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_ BOOLEAN EffectiveOnly, + _In_ TOKEN_TYPE TokenType, + _In_ SECURITY_IMPERSONATION_LEVEL Level, + _In_ KPROCESSOR_MODE PreviousMode, + _Out_ PTOKEN* NewAccessToken) { ULONG uLength; ULONG i; @@ -389,7 +390,7 @@ SepDuplicateToken(PTOKEN Token, (PVOID*)&AccessToken); if (!NT_SUCCESS(Status)) { - DPRINT1("ObCreateObject() failed (Status %lx)\n", Status); + DPRINT1("ObCreateObject() failed (Status 0x%lx)\n", Status); return Status; } @@ -587,6 +588,7 @@ SeCopyClientToken(IN PACCESS_TOKEN Token, 0, NULL, NULL); + Status = SepDuplicateToken(Token, &ObjectAttributes, FALSE, @@ -667,28 +669,28 @@ SeAssignPrimaryToken(IN PEPROCESS Process, ObInitializeFastReference(&Process->Token, Token); } - NTSTATUS NTAPI -SepCreateToken(OUT PHANDLE TokenHandle, - IN KPROCESSOR_MODE PreviousMode, - IN ACCESS_MASK DesiredAccess, - IN POBJECT_ATTRIBUTES ObjectAttributes, - IN TOKEN_TYPE TokenType, - IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, - IN PLUID AuthenticationId, - IN PLARGE_INTEGER ExpirationTime, - IN PSID_AND_ATTRIBUTES User, - IN ULONG GroupCount, - IN PSID_AND_ATTRIBUTES Groups, - IN ULONG GroupLength, - IN ULONG PrivilegeCount, - IN PLUID_AND_ATTRIBUTES Privileges, - IN PSID Owner, - IN PSID PrimaryGroup, - IN PACL DefaultDacl, - IN PTOKEN_SOURCE TokenSource, - IN BOOLEAN SystemToken) +SepCreateToken( + _Out_ PHANDLE TokenHandle, + _In_ KPROCESSOR_MODE PreviousMode, + _In_ ACCESS_MASK DesiredAccess, + _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_ TOKEN_TYPE TokenType, + _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, + _In_ PLUID AuthenticationId, + _In_ PLARGE_INTEGER ExpirationTime, + _In_ PSID_AND_ATTRIBUTES User, + _In_ ULONG GroupCount, + _In_ PSID_AND_ATTRIBUTES Groups, + _In_ ULONG GroupsLength, + _In_ ULONG PrivilegeCount, + _In_ PLUID_AND_ATTRIBUTES Privileges, + _In_opt_ PSID Owner, + _In_ PSID PrimaryGroup, + _In_opt_ PACL DefaultDacl, + _In_ PTOKEN_SOURCE TokenSource, + _In_ BOOLEAN SystemToken) { PTOKEN AccessToken; LUID TokenId; @@ -733,7 +735,7 @@ SepCreateToken(OUT PHANDLE TokenHandle, (PVOID*)&AccessToken); if (!NT_SUCCESS(Status)) { - DPRINT1("ObCreateObject() failed (Status %lx)\n", Status); + DPRINT1("ObCreateObject() failed (Status 0x%lx)\n", Status); return Status; } @@ -874,7 +876,7 @@ SepCreateToken(OUT PHANDLE TokenHandle, if (!SystemToken) { - Status = ObInsertObject((PVOID)AccessToken, + Status = ObInsertObject(AccessToken, NULL, DesiredAccess, 0, @@ -882,7 +884,7 @@ SepCreateToken(OUT PHANDLE TokenHandle, TokenHandle); if (!NT_SUCCESS(Status)) { - DPRINT1("ObInsertObject() failed (Status %lx)\n", Status); + DPRINT1("ObInsertObject() failed (Status 0x%lx)\n", Status); } } else @@ -910,7 +912,7 @@ SepCreateSystemProcessToken(VOID) SID_AND_ATTRIBUTES Groups[32]; LARGE_INTEGER Expiration; SID_AND_ATTRIBUTES UserSid; - ULONG GroupLength; + ULONG GroupsLength; PSID PrimaryGroup; OBJECT_ATTRIBUTES ObjectAttributes; PSID Owner; @@ -942,11 +944,11 @@ SepCreateSystemProcessToken(VOID) Groups[1].Attributes = GroupAttributes; Groups[2].Sid = SeAuthenticatedUserSid; Groups[2].Attributes = OwnerAttributes; - GroupLength = sizeof(SID_AND_ATTRIBUTES) + - SeLengthSid(Groups[0].Sid) + - SeLengthSid(Groups[1].Sid) + - SeLengthSid(Groups[2].Sid); - ASSERT(GroupLength <= sizeof(Groups)); + GroupsLength = sizeof(SID_AND_ATTRIBUTES) + + SeLengthSid(Groups[0].Sid) + + SeLengthSid(Groups[1].Sid) + + SeLengthSid(Groups[2].Sid); + ASSERT(GroupsLength <= sizeof(Groups)); /* Setup the privileges */ i = 0; @@ -1027,7 +1029,7 @@ SepCreateSystemProcessToken(VOID) &UserSid, 3, Groups, - GroupLength, + GroupsLength, 20, Privileges, Owner, @@ -2144,7 +2146,6 @@ NtQueryInformationToken(IN HANDLE TokenHandle, * Unimplemented: * TokenOrigin, TokenDefaultDacl */ - NTSTATUS NTAPI NtSetInformationToken(IN HANDLE TokenHandle, IN TOKEN_INFORMATION_CLASS TokenInformationClass, @@ -2395,10 +2396,8 @@ NtSetInformationToken(IN HANDLE TokenHandle, } break; - } - case TokenAuditPolicy: { PTOKEN_AUDIT_POLICY_INFORMATION PolicyInformation = @@ -2665,7 +2664,7 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle, if (NT_SUCCESS(Status)) { - Status = ObInsertObject((PVOID)NewToken, + Status = ObInsertObject(NewToken, NULL, (DesiredAccess ? DesiredAccess : HandleInformation.GrantedAccess), 0, @@ -2853,7 +2852,7 @@ NtAdjustPrivilegesToken( if (DisableAllPrivileges == FALSE && NewState == NULL) return STATUS_INVALID_PARAMETER; - PreviousMode = KeGetPreviousMode (); + PreviousMode = KeGetPreviousMode(); if (PreviousMode != KernelMode) { _SEH2_TRY @@ -2927,7 +2926,7 @@ NtAdjustPrivilegesToken( NULL); if (!NT_SUCCESS(Status)) { - DPRINT1("Failed to reference token (Status %lx)\n", Status); + DPRINT1("Failed to reference token (Status 0x%lx)\n", Status); /* Release the captured privileges */ if (CapturedPrivileges != NULL) @@ -3455,8 +3454,6 @@ NtOpenThreadToken(IN HANDLE ThreadHandle, TokenHandle); } - - /* * @unimplemented */ @@ -3517,7 +3514,9 @@ NtCompareTokens(IN HANDLE FirstTokenHandle, &IsEqual); } else + { IsEqual = TRUE; + } ObDereferenceObject(FirstToken); ObDereferenceObject(SecondToken);

1 0

08/15: [NTOS:SE] In SepCreateClientSecurity(), fix the impersonation level value passed to the SeCopyClientToken() call.
by Hermès Bélusca-Maïto 27 Jun '18

27 Jun '18

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=986bf4c407954cb95fa42… commit 986bf4c407954cb95fa4260347e347cf9c4ad19b Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Mon Jun 25 15:32:06 2018 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Wed Jun 27 23:40:14 2018 +0200 [NTOS:SE] In SepCreateClientSecurity(), fix the impersonation level value passed to the SeCopyClientToken() call. Caught while debugging, in the case the ImpersonationLevel value was uninitialized, due to the fact it was left untouched on purpose by PsReferenceEffectiveToken(). --- ntoskrnl/se/access.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ntoskrnl/se/access.c b/ntoskrnl/se/access.c index 4d24839592..a4f5cb0ee6 100644 --- a/ntoskrnl/se/access.c +++ b/ntoskrnl/se/access.c @@ -225,8 +225,8 @@ SepCreateClientSecurity(IN PACCESS_TOKEN Token, /* Do not use direct access and make a copy */ ClientContext->DirectlyAccessClientToken = FALSE; Status = SeCopyClientToken(Token, - ImpersonationLevel, - 0, + ClientSecurityQos->ImpersonationLevel, + KernelMode, &NewToken); if (!NT_SUCCESS(Status)) return Status;

1 0

07/15: [FORMATTING] No code change; typo fix.
by Hermès Bélusca-Maïto 27 Jun '18

27 Jun '18

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=0ef734dba4d2a9d4fc8d3… commit 0ef734dba4d2a9d4fc8d3ece62a96cca3e49127c Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Mon Jun 25 15:31:15 2018 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Wed Jun 27 23:40:14 2018 +0200 [FORMATTING] No code change; typo fix. --- ntoskrnl/se/access.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/ntoskrnl/se/access.c b/ntoskrnl/se/access.c index cc87da8160..4d24839592 100644 --- a/ntoskrnl/se/access.c +++ b/ntoskrnl/se/access.c @@ -162,7 +162,7 @@ SeGetTokenControlInformation(IN PACCESS_TOKEN _Token, /* Lock the token */ SepAcquireTokenLockShared(Token); - /* Capture the modified it */ + /* Capture the modified ID */ TokenControl->ModifiedId = Token->ModifiedId; /* Unlock it */ @@ -215,8 +215,8 @@ SepCreateClientSecurity(IN PACCESS_TOKEN Token, } /* Pick either the thread setting or the QOS setting */ - ClientContext->DirectAccessEffectiveOnly = ((ThreadEffectiveOnly) || - (ClientSecurityQos->EffectiveOnly)) ? TRUE : FALSE; + ClientContext->DirectAccessEffectiveOnly = + ((ThreadEffectiveOnly) || (ClientSecurityQos->EffectiveOnly)) ? TRUE : FALSE; } /* Is this static tracking */ @@ -224,8 +224,12 @@ SepCreateClientSecurity(IN PACCESS_TOKEN Token, { /* Do not use direct access and make a copy */ ClientContext->DirectlyAccessClientToken = FALSE; - Status = SeCopyClientToken(Token, ImpersonationLevel, 0, &NewToken); - if (!NT_SUCCESS(Status)) return Status; + Status = SeCopyClientToken(Token, + ImpersonationLevel, + 0, + &NewToken); + if (!NT_SUCCESS(Status)) + return Status; } else {

1 0

06/15: [NTOS:SE] Finish SepCreateImpersonationTokenDacl() implementation.
by Hermès Bélusca-Maïto 27 Jun '18

27 Jun '18

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=5b2dda91348d200fde43e… commit 5b2dda91348d200fde43ee09d796174efa982d78 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Mon Jun 25 15:24:44 2018 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Wed Jun 27 23:40:14 2018 +0200 [NTOS:SE] Finish SepCreateImpersonationTokenDacl() implementation. - Re-enable a commented-out block; - Return the allocated Dacl. - Use the correct pool tag when freeing the allocated Dacl. --- ntoskrnl/include/internal/se.h | 6 +++--- ntoskrnl/se/acl.c | 29 ++++++++++++++++------------- ntoskrnl/se/token.c | 6 +++--- 3 files changed, 22 insertions(+), 19 deletions(-) diff --git a/ntoskrnl/include/internal/se.h b/ntoskrnl/include/internal/se.h index 125055fe11..040d23c174 100644 --- a/ntoskrnl/include/internal/se.h +++ b/ntoskrnl/include/internal/se.h @@ -317,9 +317,9 @@ SeIsTokenChild( NTSTATUS NTAPI SepCreateImpersonationTokenDacl( - PTOKEN Token, - PTOKEN PrimaryToken, - PACL *Dacl + _In_ PTOKEN Token, + _In_ PTOKEN PrimaryToken, + _Out_ PACL* Dacl ); VOID diff --git a/ntoskrnl/se/acl.c b/ntoskrnl/se/acl.c index 392f2a9ea6..3829684794 100644 --- a/ntoskrnl/se/acl.c +++ b/ntoskrnl/se/acl.c @@ -224,22 +224,26 @@ SepInitDACLs(VOID) return TRUE; } -NTSTATUS NTAPI -SepCreateImpersonationTokenDacl(PTOKEN Token, - PTOKEN PrimaryToken, - PACL *Dacl) +NTSTATUS +NTAPI +SepCreateImpersonationTokenDacl( + _In_ PTOKEN Token, + _In_ PTOKEN PrimaryToken, + _Out_ PACL* Dacl) { ULONG AclLength; - PVOID TokenDacl; + PACL TokenDacl; PAGED_CODE(); + *Dacl = NULL; + AclLength = sizeof(ACL) + - (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) + - (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)) + - (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + - (sizeof(ACE) + RtlLengthSid(Token->UserAndGroups->Sid)) + - (sizeof(ACE) + RtlLengthSid(PrimaryToken->UserAndGroups->Sid)); + (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) + + (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) + + (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)) + + (sizeof(ACE) + RtlLengthSid(Token->UserAndGroups->Sid)) + + (sizeof(ACE) + RtlLengthSid(PrimaryToken->UserAndGroups->Sid)); TokenDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL); if (TokenDacl == NULL) @@ -257,14 +261,13 @@ SepCreateImpersonationTokenDacl(PTOKEN Token, RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL, SeLocalSystemSid); - /* FIXME */ -#if 0 if (Token->RestrictedSids != NULL || PrimaryToken->RestrictedSids != NULL) { RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL, SeRestrictedCodeSid); } -#endif + + *Dacl = TokenDacl; return STATUS_SUCCESS; } diff --git a/ntoskrnl/se/token.c b/ntoskrnl/se/token.c index 46ab29b0f7..b9c4e6f1f4 100644 --- a/ntoskrnl/se/token.c +++ b/ntoskrnl/se/token.c @@ -3325,7 +3325,8 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, /* * At first open the thread token for information access and verify - * that the token associated with thread is valid. */ + * that the token associated with thread is valid. + */ Status = ObReferenceObjectByHandle(ThreadHandle, THREAD_QUERY_INFORMATION, PsThreadType, PreviousMode, (PVOID*)&Thread, @@ -3386,7 +3387,6 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, InitializeObjectAttributes(&ObjectAttributes, NULL, HandleAttributes, NULL, Dacl ? &SecurityDescriptor : NULL); - Status = SepDuplicateToken(Token, &ObjectAttributes, EffectiveOnly, TokenImpersonation, ImpersonationLevel, KernelMode, &NewToken); @@ -3406,7 +3406,7 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle, PreviousMode, &hToken); } - if (Dacl) ExFreePoolWithTag(Dacl, TAG_TOKEN_ACL); + if (Dacl) ExFreePoolWithTag(Dacl, TAG_ACL); if (RestoreImpersonation) {

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs June 2018