https://git.reactos.org/?p=reactos.git;a=commitdiff;h=07227562c0731d847fe73…
commit 07227562c0731d847fe73569fdcab180e567e7e1
Author: George Bișoc <george.bisoc(a)reactos.org>
AuthorDate: Sun May 8 00:51:54 2022 +0200
Commit: George Bișoc <george.bisoc(a)reactos.org>
CommitDate: Sun May 8 20:16:18 2022 +0200
[WINLOGON] Let Winlogon assign security to desktop when a user logs in now
---
base/system/winlogon/security.c | 9 ---------
1 file changed, 9 deletions(-)
diff --git a/base/system/winlogon/security.c b/base/system/winlogon/security.c
index 4045496abb2..d2a845ffbd6 100644
--- a/base/system/winlogon/security.c
+++ b/base/system/winlogon/security.c
@@ -1446,21 +1446,12 @@ AllowAccessOnSession(
goto Quit;
}
-/*
- * FIXME: Desktop security management is broken. The application desktop gets created
- * with CreateDesktopW() API call with an initial and defined security descriptor for it yet
- * when we are giving access to the logged in user, SetUserObjectSecurity() API call fails to set
- * new security because the desktop in question has no prior security descriptor (when it's
- * been assigned even before!!!). This chunk of code must be enabled when this gets fixed.
- */
-#if 0
/* Allow application desktop access to this user within this session */
if (!AllowDesktopAccessToUser(Session->ApplicationDesktop, LogonSid))
{
ERR("AllowAccessOnSession(): Failed to allow application desktop access to the logon user!\n");
goto Quit;
}
-#endif
/* Get the length of this logon SID */
SidLength = GetLengthSid(LogonSid);
https://git.reactos.org/?p=reactos.git;a=commitdiff;h=aa815e1cfa66f65e1964b…
commit aa815e1cfa66f65e1964bbb4cce917c04d56f631
Author: George Bișoc <george.bisoc(a)reactos.org>
AuthorDate: Sun May 8 00:39:44 2022 +0200
Commit: George Bișoc <george.bisoc(a)reactos.org>
CommitDate: Sun May 8 20:16:15 2022 +0200
[WIN32K:NTUSER] Assign a security descriptor when parsing the desktop object
The problem ReactOS currently faces is this -- whenever the desktop is being parsed we aren't assigning a security descriptor to it. As a matter of fact when Winlogon tries to assign new security information to the application desktop when a user logs in, Winlogon fails because no prior descriptor has been created for it even though we already do this when initializing security buffers in Winlogon.
With that said, we must assign a descriptor when parsing the desktop as well. This fixes a hack in Winlogon where security assigning of application desktop during a log in is disabled (which we can now enable such code path back).
---
win32ss/user/ntuser/desktop.c | 8 +++++
win32ss/user/ntuser/security.c | 66 ++++++++++++++++++++++++++++++++++++++++++
win32ss/user/ntuser/security.h | 7 +++++
3 files changed, 81 insertions(+)
diff --git a/win32ss/user/ntuser/desktop.c b/win32ss/user/ntuser/desktop.c
index fb8d6ed96cd..fcb3a8aa009 100644
--- a/win32ss/user/ntuser/desktop.c
+++ b/win32ss/user/ntuser/desktop.c
@@ -128,6 +128,14 @@ IntDesktopObjectParse(IN PVOID ParseObject,
(PVOID*)&Desktop);
if (!NT_SUCCESS(Status)) return Status;
+ /* Assign security to the desktop we have created */
+ Status = IntAssignDesktopSecurityOnParse(WinStaObject, Desktop, AccessState);
+ if (!NT_SUCCESS(Status))
+ {
+ ObDereferenceObject(Desktop);
+ return Status;
+ }
+
/* Initialize the desktop */
Status = UserInitializeDesktop(Desktop, RemainingName, WinStaObject);
if (!NT_SUCCESS(Status))
diff --git a/win32ss/user/ntuser/security.c b/win32ss/user/ntuser/security.c
index 0286a76f5e3..276d01bfe16 100644
--- a/win32ss/user/ntuser/security.c
+++ b/win32ss/user/ntuser/security.c
@@ -235,6 +235,72 @@ IntQueryUserSecurityIdentification(
return STATUS_SUCCESS;
}
+/**
+ * @brief
+ * Assigns a security descriptor to the desktop
+ * object during a desktop object parse procedure.
+ *
+ * @param[in] WinSta
+ * A pointer to a window station object, of which
+ * such object contains its own security descriptor
+ * that will be captured.
+ *
+ * @param[in] Desktop
+ * A pointer to a desktop object that is created
+ * during a parse procedure.
+ *
+ * @param[in] AccessState
+ * A pointer to an access state structure that
+ * describes the progress state of an access in
+ * action.
+ *
+ * @return
+ * Returns STATUS_SUCCESS if the function has successfully
+ * assigned new security descriptor to the desktop object.
+ * A NTSTATUS failure code is returned otherwise.
+ */
+NTSTATUS
+NTAPI
+IntAssignDesktopSecurityOnParse(
+ _In_ PWINSTATION_OBJECT WinSta,
+ _In_ PDESKTOP Desktop,
+ _In_ PACCESS_STATE AccessState)
+{
+ NTSTATUS Status;
+ PSECURITY_DESCRIPTOR CapturedDescriptor;
+ BOOLEAN MemoryAllocated;
+
+ /*
+ * Capture the security descriptor from
+ * the window station. The window station
+ * in question has a descriptor that is
+ * inheritable and contains desktop access
+ * rights as well.
+ */
+ Status = ObGetObjectSecurity(WinSta,
+ &CapturedDescriptor,
+ &MemoryAllocated);
+ if (!NT_SUCCESS(Status))
+ {
+ ERR("IntAssignDesktopSecurityOnParse(): Failed to capture the security descriptor from window station (Status 0x%08lx)\n", Status);
+ return Status;
+ }
+
+ /* Assign new security to the desktop */
+ Status = ObAssignSecurity(AccessState,
+ CapturedDescriptor,
+ Desktop,
+ ExDesktopObjectType);
+ if (!NT_SUCCESS(Status))
+ {
+ ERR("IntAssignDesktopSecurityOnParse(): Failed to assign security information to the desktop object (Status 0x%08lx)\n", Status);
+ }
+
+ /* Release the descriptor that we have captured */
+ ObReleaseObjectSecurity(CapturedDescriptor, MemoryAllocated);
+ return Status;
+}
+
/**
* @brief
* Creates a security descriptor for the service.
diff --git a/win32ss/user/ntuser/security.h b/win32ss/user/ntuser/security.h
index f719beccc8a..1bbf185ac30 100644
--- a/win32ss/user/ntuser/security.h
+++ b/win32ss/user/ntuser/security.h
@@ -84,6 +84,13 @@ NTSTATUS
IntQueryUserSecurityIdentification(
_Out_ PTOKEN_USER *User);
+NTSTATUS
+NTAPI
+IntAssignDesktopSecurityOnParse(
+ _In_ PWINSTATION_OBJECT WinSta,
+ _In_ PDESKTOP Desktop,
+ _In_ PACCESS_STATE AccessState);
+
NTSTATUS
NTAPI
IntCreateServiceSecurity(
https://git.reactos.org/?p=reactos.git;a=commitdiff;h=9f8fbe14f5e48a0ff3910…
commit 9f8fbe14f5e48a0ff391078866bbfddcfe16d222
Author: George Bișoc <george.bisoc(a)reactos.org>
AuthorDate: Sun May 8 19:16:34 2022 +0200
Commit: George Bișoc <george.bisoc(a)reactos.org>
CommitDate: Sun May 8 19:16:34 2022 +0200
[NTOS:OB] Specify the query security descriptor tag when freeing the allocation
We are allocating blocks of pool memory for a security descriptor with its own specific tag, TAG_SEC_QUERY, so just use it when freeing when releasing the descriptor as well (aka freeing the said pool).
---
ntoskrnl/ob/obsecure.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ntoskrnl/ob/obsecure.c b/ntoskrnl/ob/obsecure.c
index 135b7b2f5e1..649ba4ea283 100644
--- a/ntoskrnl/ob/obsecure.c
+++ b/ntoskrnl/ob/obsecure.c
@@ -718,7 +718,7 @@ ObReleaseObjectSecurity(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
if (MemoryAllocated)
{
/* Free it */
- ExFreePool(SecurityDescriptor);
+ ExFreePoolWithTag(SecurityDescriptor, TAG_SEC_QUERY);
}
else
{