Ros-diffs

ros-diffs@reactos.org

81390 discussions

[reactos] 02/02: [NTOSKRNL] Implement ObSetDirectoryDeviceMap
by Pierre Schweitzer 01 Jun '19

01 Jun '19

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=de17b3603726bd3fdf668… commit de17b3603726bd3fdf668b344f47dbf15425ca0f Author: Pierre Schweitzer <pierre(a)reactos.org> AuthorDate: Sat Jun 1 21:22:30 2019 +0200 Commit: Pierre Schweitzer <pierre(a)reactos.org> CommitDate: Sat Jun 1 21:22:30 2019 +0200 [NTOSKRNL] Implement ObSetDirectoryDeviceMap --- ntoskrnl/ob/devicemap.c | 93 +++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 91 insertions(+), 2 deletions(-) diff --git a/ntoskrnl/ob/devicemap.c b/ntoskrnl/ob/devicemap.c index 5dfe1994dd8..5d583e9388b 100644 --- a/ntoskrnl/ob/devicemap.c +++ b/ntoskrnl/ob/devicemap.c @@ -149,8 +149,97 @@ NTAPI ObSetDirectoryDeviceMap(OUT PDEVICE_MAP * DeviceMap, IN HANDLE DirectoryHandle) { - UNIMPLEMENTED; - return STATUS_NOT_IMPLEMENTED; + POBJECT_DIRECTORY DirectoryObject = NULL; + PDEVICE_MAP LocalMap = NULL, NewDeviceMap = NULL; + NTSTATUS Status; + POBJECT_HEADER ObjectHeader; + POBJECT_HEADER_NAME_INFO HeaderNameInfo; + + Status = ObReferenceObjectByHandle(DirectoryHandle, + DIRECTORY_TRAVERSE, + ObpDirectoryObjectType, + KernelMode, + (PVOID*)&DirectoryObject, + NULL); + if (!NT_SUCCESS(Status)) + { + DPRINT("ObReferenceObjectByHandle() failed (Status 0x%08lx)\n", Status); + return Status; + } + + /* Allocate and initialize a new device map */ + LocalMap = ExAllocatePoolWithTag(PagedPool, + sizeof(*LocalMap), + 'mDbO'); + if (LocalMap == NULL) + { + ObDereferenceObject(DirectoryObject); + return STATUS_INSUFFICIENT_RESOURCES; + } + + /* Initialize the device map */ + RtlZeroMemory(LocalMap, sizeof(*LocalMap)); + LocalMap->ReferenceCount = 1; + LocalMap->DosDevicesDirectory = DirectoryObject; + + /* Acquire the device map lock */ + KeAcquireGuardedMutex(&ObpDeviceMapLock); + + /* Attach the device map to the directory object */ + if (DirectoryObject->DeviceMap == NULL) + { + DirectoryObject->DeviceMap = LocalMap; + } + else + { + NewDeviceMap = LocalMap; + + /* There's already a device map, + so reuse it */ + LocalMap = DirectoryObject->DeviceMap; + ++LocalMap->ReferenceCount; + } + + /* If current object isn't system one, save system one in current + * device map */ + if (DirectoryObject != ObSystemDeviceMap->DosDevicesDirectory) + { + /* We also need to make the object permanant */ + LocalMap->GlobalDosDevicesDirectory = ObSystemDeviceMap->DosDevicesDirectory; + } + + /* Release the device map lock */ + KeReleaseGuardedMutex(&ObpDeviceMapLock); + + if (DeviceMap != NULL) + { + *DeviceMap = LocalMap; + } + + /* Caller expects us to make the object permanant, so do it! */ + ObjectHeader = OBJECT_TO_OBJECT_HEADER(DirectoryObject); + HeaderNameInfo = ObpReferenceNameInfo(ObjectHeader); + + ObpEnterObjectTypeMutex(ObjectHeader->Type); + if (HeaderNameInfo != NULL && HeaderNameInfo->Directory != NULL) + { + ObjectHeader->Flags |= OB_FLAG_PERMANENT; + } + ObpLeaveObjectTypeMutex(ObjectHeader->Type); + + if (HeaderNameInfo != NULL) + { + ObpDereferenceNameInfo(HeaderNameInfo); + } + + /* Release useless device map if required */ + if (NewDeviceMap != NULL) + { + ObfDereferenceObject(DirectoryObject); + ExFreePoolWithTag(NewDeviceMap, 'mDbO'); + } + + return Status; }

1 0

[reactos] 01/02: [NTOSKRNL] Implement SeGetLogonIdDeviceMap
by Pierre Schweitzer 01 Jun '19

01 Jun '19

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=7c618faa326bde0337ca7… commit 7c618faa326bde0337ca74f50b02215576e8a397 Author: Pierre Schweitzer <pierre(a)reactos.org> AuthorDate: Sat Jun 1 21:05:14 2019 +0200 Commit: Pierre Schweitzer <pierre(a)reactos.org> CommitDate: Sat Jun 1 21:09:20 2019 +0200 [NTOSKRNL] Implement SeGetLogonIdDeviceMap --- ntoskrnl/include/internal/ob.h | 9 ++- ntoskrnl/ob/devicemap.c | 10 +++ ntoskrnl/se/srm.c | 145 ++++++++++++++++++++++++++++++++++++++++- 3 files changed, 161 insertions(+), 3 deletions(-) diff --git a/ntoskrnl/include/internal/ob.h b/ntoskrnl/include/internal/ob.h index 23f54cefefd..266c4dd668c 100644 --- a/ntoskrnl/include/internal/ob.h +++ b/ntoskrnl/include/internal/ob.h @@ -402,7 +402,14 @@ NTSTATUS NTAPI ObSetDeviceMap( IN PEPROCESS Process, - IN HANDLE DirectoryHandle); + IN HANDLE DirectoryHandle +); + +NTSTATUS +NTAPI +ObSetDirectoryDeviceMap(OUT PDEVICE_MAP * DeviceMap, + IN HANDLE DirectoryHandle +); VOID NTAPI diff --git a/ntoskrnl/ob/devicemap.c b/ntoskrnl/ob/devicemap.c index 8a471446919..5dfe1994dd8 100644 --- a/ntoskrnl/ob/devicemap.c +++ b/ntoskrnl/ob/devicemap.c @@ -144,6 +144,16 @@ ObSetDeviceMap(IN PEPROCESS Process, } +NTSTATUS +NTAPI +ObSetDirectoryDeviceMap(OUT PDEVICE_MAP * DeviceMap, + IN HANDLE DirectoryHandle) +{ + UNIMPLEMENTED; + return STATUS_NOT_IMPLEMENTED; +} + + NTSTATUS NTAPI ObpSetCurrentProcessDeviceMap(VOID) diff --git a/ntoskrnl/se/srm.c b/ntoskrnl/se/srm.c index 7d1526623c6..f0cc7341093 100644 --- a/ntoskrnl/se/srm.c +++ b/ntoskrnl/se/srm.c @@ -5,6 +5,7 @@ * PURPOSE: Security Reference Monitor Server * * PROGRAMMERS: Timo Kreuzer (timo.kreuzer(a)reactos.org) + * Pierre Schweitzer (pierre(a)reactos.org) */ /* INCLUDES *******************************************************************/ @@ -701,8 +702,148 @@ SeGetLogonIdDeviceMap( OUT PDEVICE_MAP * DeviceMap ) { - UNIMPLEMENTED; - return STATUS_NOT_IMPLEMENTED; + NTSTATUS Status; + WCHAR Buffer[63]; + PDEVICE_MAP LocalMap; + HANDLE DirectoryHandle, LinkHandle; + OBJECT_ATTRIBUTES ObjectAttributes; + PSEP_LOGON_SESSION_REFERENCES CurrentSession; + UNICODE_STRING DirectoryName, LinkName, TargetName; + + PAGED_CODE(); + + if (LogonId == NULL || + DeviceMap == NULL) + { + return STATUS_INVALID_PARAMETER; + } + + /* Acquire the database lock */ + KeAcquireGuardedMutex(&SepRmDbLock); + + /* Loop all existing sessions */ + for (CurrentSession = SepLogonSessions; + CurrentSession != NULL; + CurrentSession = CurrentSession->Next) + { + /* Check if the LUID matches the provided one */ + if (RtlEqualLuid(&CurrentSession->LogonId, LogonId)) + { + break; + } + } + + /* No session found, fail */ + if (CurrentSession == NULL) + { + /* Release the database lock */ + KeReleaseGuardedMutex(&SepRmDbLock); + + return STATUS_NO_SUCH_LOGON_SESSION; + } + + /* The found session has a device map, return it! */ + if (CurrentSession->pDeviceMap != NULL) + { + *DeviceMap = CurrentSession->pDeviceMap; + + /* Release the database lock */ + KeReleaseGuardedMutex(&SepRmDbLock); + + return STATUS_SUCCESS; + } + + /* At that point, we'll setup a new device map for the session */ + LocalMap = NULL; + + /* Reference the session so that it doesn't go away */ + CurrentSession->ReferenceCount += 1; + + /* Release the database lock */ + KeReleaseGuardedMutex(&SepRmDbLock); + + /* Create our object directory given the LUID */ + _snwprintf(Buffer, + sizeof(Buffer) / sizeof(WCHAR), + L"\\Sessions\\0\\DosDevices\\%08x-%08x", + LogonId->HighPart, + LogonId->LowPart); + RtlInitUnicodeString(&DirectoryName, Buffer); + + InitializeObjectAttributes(&ObjectAttributes, + &DirectoryName, + OBJ_KERNEL_HANDLE | OBJ_OPENIF | OBJ_CASE_INSENSITIVE, + NULL, + NULL); + Status = ZwCreateDirectoryObject(&DirectoryHandle, + DIRECTORY_ALL_ACCESS, + &ObjectAttributes); + if (NT_SUCCESS(Status)) + { + /* Create the associated device map */ + Status = ObSetDirectoryDeviceMap(&LocalMap, DirectoryHandle); + if (NT_SUCCESS(Status)) + { + /* Make Global point to \Global?? in the directory */ + RtlInitUnicodeString(&LinkName, L"Global"); + RtlInitUnicodeString(&TargetName, L"\\Global??"); + + InitializeObjectAttributes(&ObjectAttributes, + &LinkName, + OBJ_KERNEL_HANDLE | OBJ_OPENIF | OBJ_CASE_INSENSITIVE | OBJ_PERMANENT, + DirectoryHandle, + NULL); + Status = ZwCreateSymbolicLinkObject(&LinkHandle, + SYMBOLIC_LINK_ALL_ACCESS, + &ObjectAttributes, + &TargetName); + if (!NT_SUCCESS(Status)) + { + ObfDereferenceDeviceMap(LocalMap); + } + else + { + ZwClose(LinkHandle); + } + } + + ZwClose(DirectoryHandle); + } + + /* Acquire the database lock */ + KeAcquireGuardedMutex(&SepRmDbLock); + + /* If we succeed... */ + if (NT_SUCCESS(Status)) + { + /* The session now has a device map? We raced with someone else */ + if (CurrentSession->pDeviceMap != NULL) + { + /* Give up on our new device map */ + ObfDereferenceDeviceMap(LocalMap); + } + /* Otherwise use our newly allocated device map */ + else + { + CurrentSession->pDeviceMap = LocalMap; + } + + /* Return the device map */ + *DeviceMap = CurrentSession->pDeviceMap; + } + /* Zero output */ + else + { + *DeviceMap = NULL; + } + + /* Release the database lock */ + KeReleaseGuardedMutex(&SepRmDbLock); + + /* We're done with the session */ + SepRmDereferenceLogonSession(&CurrentSession->LogonId); + + return Status; } /*

1 0

[reactos] 07/07: [NTOSKRNL] Implement ObpSetCurrentProcessDeviceMap
by Pierre Schweitzer 01 Jun '19

01 Jun '19

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=4bf7d54910acb38fdc33d… commit 4bf7d54910acb38fdc33de8177c33d7967ece69e Author: Pierre Schweitzer <pierre(a)reactos.org> AuthorDate: Sat Jun 1 18:58:36 2019 +0200 Commit: Pierre Schweitzer <pierre(a)reactos.org> CommitDate: Sat Jun 1 18:58:36 2019 +0200 [NTOSKRNL] Implement ObpSetCurrentProcessDeviceMap --- ntoskrnl/ob/devicemap.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 71 insertions(+), 1 deletion(-) diff --git a/ntoskrnl/ob/devicemap.c b/ntoskrnl/ob/devicemap.c index 12abcb90595..8a471446919 100644 --- a/ntoskrnl/ob/devicemap.c +++ b/ntoskrnl/ob/devicemap.c @@ -5,6 +5,7 @@ * PURPOSE: Device map implementation * PROGRAMMERS: Eric Kohl (eric.kohl(a)reactos.org) * Alex Ionescu (alex.ionescu(a)reactos.org) + * Pierre Schweitzer (pierre(a)reactos.org) */ /* INCLUDES ***************************************************************/ @@ -147,7 +148,76 @@ NTSTATUS NTAPI ObpSetCurrentProcessDeviceMap(VOID) { - return STATUS_NOT_IMPLEMENTED; + PTOKEN Token; + LUID LogonId; + NTSTATUS Status; + PEPROCESS CurrentProcess; + LUID SystemLuid = SYSTEM_LUID; + PDEVICE_MAP DeviceMap, OldDeviceMap; + + /* Get our impersonation token */ + CurrentProcess = PsGetCurrentProcess(); + Token = PsReferencePrimaryToken(CurrentProcess); + if (Token == NULL) + { + return STATUS_NO_TOKEN; + } + + /* Query the Logon ID */ + Status = SeQueryAuthenticationIdToken(Token, &LogonId); + if (!NT_SUCCESS(Status)) + { + goto done; + } + + /* If that's system, then use system device map */ + if (RtlEqualLuid(&LogonId, &SystemLuid)) + { + DeviceMap = ObSystemDeviceMap; + } + /* Otherwise ask Se for the device map */ + else + { + Status = SeGetLogonIdDeviceMap(&LogonId, &DeviceMap); + if (!NT_SUCCESS(Status)) + { + /* Normalize failure status */ + Status = STATUS_OBJECT_PATH_INVALID; + goto done; + } + } + + /* Fail if no device map */ + if (DeviceMap == NULL) + { + Status = STATUS_OBJECT_PATH_INVALID; + goto done; + } + + /* Acquire the device map lock */ + KeAcquireGuardedMutex(&ObpDeviceMapLock); + + /* Save old device map attached to the process */ + OldDeviceMap = CurrentProcess->DeviceMap; + + /* Set new device map & reference it */ + ++DeviceMap->ReferenceCount; + CurrentProcess->DeviceMap = DeviceMap; + + /* Release the device map lock */ + KeReleaseGuardedMutex(&ObpDeviceMapLock); + + /* If we had a device map, dereference it */ + if (OldDeviceMap != NULL) + { + ObfDereferenceDeviceMap(OldDeviceMap); + } + +done: + /* We're done with the token! */ + ObDereferenceObject(Token); + + return Status; }

1 0

[reactos] 06/07: [NTOSKRNL] Implement ObpReferenceDeviceMap()
by Pierre Schweitzer 01 Jun '19

01 Jun '19

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=57c608680672fcab9461a… commit 57c608680672fcab9461a0a88ac5ea283a6d312f Author: Pierre Schweitzer <pierre(a)reactos.org> AuthorDate: Sat Jun 1 18:43:38 2019 +0200 Commit: Pierre Schweitzer <pierre(a)reactos.org> CommitDate: Sat Jun 1 18:43:38 2019 +0200 [NTOSKRNL] Implement ObpReferenceDeviceMap() --- ntoskrnl/ob/devicemap.c | 134 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 132 insertions(+), 2 deletions(-) diff --git a/ntoskrnl/ob/devicemap.c b/ntoskrnl/ob/devicemap.c index 4dcaff1c832..12abcb90595 100644 --- a/ntoskrnl/ob/devicemap.c +++ b/ntoskrnl/ob/devicemap.c @@ -143,12 +143,142 @@ ObSetDeviceMap(IN PEPROCESS Process, } +NTSTATUS +NTAPI +ObpSetCurrentProcessDeviceMap(VOID) +{ + return STATUS_NOT_IMPLEMENTED; +} + + PDEVICE_MAP NTAPI ObpReferenceDeviceMap(VOID) { - UNIMPLEMENTED; - return NULL; + LUID LogonId; + NTSTATUS Status; + PTOKEN Token = NULL; + PDEVICE_MAP DeviceMap; + PETHREAD CurrentThread; + BOOLEAN LookingForSystem; + LUID SystemLuid = SYSTEM_LUID; + BOOLEAN CopyOnOpen, EffectiveOnly; + SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; + + LookingForSystem = FALSE; + + /* If LUID mapping is enable, try to get appropriate device map */ + if (ObpLUIDDeviceMapsEnabled != 0) + { + /* In case of impersonation, we've got a bit of work to do */ + CurrentThread = PsGetCurrentThread(); + if (CurrentThread->ActiveImpersonationInfo) + { + /* Get impersonation token */ + Token = PsReferenceImpersonationToken(CurrentThread, + &CopyOnOpen, + &EffectiveOnly, + &ImpersonationLevel); + /* Get logon LUID */ + if (Token != NULL) + { + Status = SeQueryAuthenticationIdToken(Token, &LogonId); + } + else + { + /* Force failure */ + Status = STATUS_NO_TOKEN; + } + + /* If we got logon LUID */ + if (NT_SUCCESS(Status)) + { + /* + * Check it's not system, system is easy to handle, + * we just need to return ObSystemDeviceMap + */ + if (!RtlEqualLuid(&LogonId, &SystemLuid)) + { + /* Ask Se for the device map */ + Status = SeGetLogonIdDeviceMap(&LogonId, &DeviceMap); + if (NT_SUCCESS(Status)) + { + /* Acquire the device map lock */ + KeAcquireGuardedMutex(&ObpDeviceMapLock); + + /* Reference the device map if any */ + if (DeviceMap != NULL) + { + ++DeviceMap->ReferenceCount; + } + + /* Release the device map lock */ + KeReleaseGuardedMutex(&ObpDeviceMapLock); + + /* If we got the device map, we're done! */ + if (DeviceMap != NULL) + { + ObDereferenceObject(Token); + + return DeviceMap; + } + } + } + else + { + LookingForSystem = TRUE; + } + } + } + + /* + * Fall back case of the LUID mapping, make sure there's a + * a device map attached to the current process + */ + if (PsGetCurrentProcess()->DeviceMap == NULL && + !NT_SUCCESS(ObpSetCurrentProcessDeviceMap())) + { + /* We may have failed after we got impersonation token */ + if (Token != NULL) + { + ObDereferenceObject(Token); + } + + return NULL; + } + } + + /* Acquire the device map lock */ + KeAcquireGuardedMutex(&ObpDeviceMapLock); + + /* If we're looking for system map, use it */ + if (LookingForSystem) + { + DeviceMap = ObSystemDeviceMap; + } + /* Otherwise, use current process device map */ + else + { + DeviceMap = PsGetCurrentProcess()->DeviceMap; + } + + /* If we got one, reference it */ + if (DeviceMap != NULL) + { + ++DeviceMap->ReferenceCount; + } + + /* Release the device map lock */ + KeReleaseGuardedMutex(&ObpDeviceMapLock); + + /* We may have impersonation token (if we failed in impersonation branch) */ + if (Token != NULL) + { + ObDereferenceObject(Token); + } + + /* Return the potentially found device map */ + return DeviceMap; }

1 0

[reactos] 05/07: [NTOSKRNL] Stub SeGetLogonIdDeviceMap
by Pierre Schweitzer 01 Jun '19

01 Jun '19

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=59806f7eb0a589d4eb0c7… commit 59806f7eb0a589d4eb0c73ab9e0cb3b3a9b9729e Author: Pierre Schweitzer <pierre(a)reactos.org> AuthorDate: Sat Jun 1 18:37:47 2019 +0200 Commit: Pierre Schweitzer <pierre(a)reactos.org> CommitDate: Sat Jun 1 18:37:47 2019 +0200 [NTOSKRNL] Stub SeGetLogonIdDeviceMap --- ntoskrnl/include/internal/se.h | 6 ++++++ ntoskrnl/se/srm.c | 14 ++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/ntoskrnl/include/internal/se.h b/ntoskrnl/include/internal/se.h index aec259cdb7c..722d2d9a2aa 100644 --- a/ntoskrnl/include/internal/se.h +++ b/ntoskrnl/include/internal/se.h @@ -604,6 +604,12 @@ NTSTATUS SepRmDereferenceLogonSession( PLUID LogonLuid); +NTSTATUS +NTAPI +SeGetLogonIdDeviceMap( + IN PLUID LogonId, + OUT PDEVICE_MAP * DeviceMap); + #endif /* EOF */ diff --git a/ntoskrnl/se/srm.c b/ntoskrnl/se/srm.c index 66761d874bf..7d1526623c6 100644 --- a/ntoskrnl/se/srm.c +++ b/ntoskrnl/se/srm.c @@ -691,6 +691,20 @@ SepRmCommandServerThread( /* PUBLIC FUNCTIONS ***********************************************************/ +/* + * @unimplemented + */ +NTSTATUS +NTAPI +SeGetLogonIdDeviceMap( + IN PLUID LogonId, + OUT PDEVICE_MAP * DeviceMap + ) +{ + UNIMPLEMENTED; + return STATUS_NOT_IMPLEMENTED; +} + /* * @unimplemented */

1 0

[reactos] 04/07: [NTOSKRNL] Simplify NtQueryInformationProcess:ProcessDeviceMap implementation
by Pierre Schweitzer 01 Jun '19

01 Jun '19

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=445e895932438ef6e1790… commit 445e895932438ef6e1790beda439221645aeccad Author: Pierre Schweitzer <pierre(a)reactos.org> AuthorDate: Sat Jun 1 17:39:29 2019 +0200 Commit: Pierre Schweitzer <pierre(a)reactos.org> CommitDate: Sat Jun 1 17:40:23 2019 +0200 [NTOSKRNL] Simplify NtQueryInformationProcess:ProcessDeviceMap implementation --- ntoskrnl/ps/query.c | 24 +++++++----------------- 1 file changed, 7 insertions(+), 17 deletions(-) diff --git a/ntoskrnl/ps/query.c b/ntoskrnl/ps/query.c index 29c8171a474..5391ae18d64 100644 --- a/ntoskrnl/ps/query.c +++ b/ntoskrnl/ps/query.c @@ -78,11 +78,11 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle, PVM_COUNTERS VmCounters = (PVM_COUNTERS)ProcessInformation; PIO_COUNTERS IoCounters = (PIO_COUNTERS)ProcessInformation; PQUOTA_LIMITS QuotaLimits = (PQUOTA_LIMITS)ProcessInformation; - PROCESS_DEVICEMAP_INFORMATION_EX DeviceMap; PUNICODE_STRING ImageName; ULONG Cookie, ExecuteOptions = 0; ULONG_PTR Wow64 = 0; PROCESS_VALUES ProcessValues; + ULONG Flags; PAGED_CODE(); /* Check for user-mode caller */ @@ -577,7 +577,7 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle, { PPROCESS_DEVICEMAP_INFORMATION_EX DeviceMapEx = ProcessInformation; - DeviceMap.Flags = DeviceMapEx->Flags; + Flags = DeviceMapEx->Flags; } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { @@ -592,7 +592,7 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle, } /* Only one flag is supported and it needs LUID mappings */ - if ((DeviceMap.Flags & ~PROCESS_LUID_DOSDEVICES_ONLY) != 0 || + if ((Flags & ~PROCESS_LUID_DOSDEVICES_ONLY) != 0 || !ObIsLUIDDeviceMapsEnabled()) { Status = STATUS_INVALID_PARAMETER; @@ -608,7 +608,7 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle, } /* No flags for standard call */ - DeviceMap.Flags = 0; + Flags = 0; } /* Set the return length */ @@ -624,19 +624,9 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle, if (!NT_SUCCESS(Status)) break; /* Query the device map information */ - ObQueryDeviceMapInformation(Process, (PPROCESS_DEVICEMAP_INFORMATION)&DeviceMap, DeviceMap.Flags); - - /* Enter SEH for writing back data */ - _SEH2_TRY - { - RtlCopyMemory(ProcessInformation, &DeviceMap, sizeof(PROCESS_DEVICEMAP_INFORMATION)); - } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) - { - /* Get the exception code */ - Status = _SEH2_GetExceptionCode(); - } - _SEH2_END; + Status = ObQueryDeviceMapInformation(Process, + ProcessInformation, + Flags); /* Dereference the process */ ObDereferenceObject(Process);

1 0

[reactos] 03/07: [NTOSKRNL] Add support for LUID mappings in ObQueryDeviceMapInformation
by Pierre Schweitzer 01 Jun '19

01 Jun '19

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=46b90ccb9695279e90afe… commit 46b90ccb9695279e90afeea89eb0cf8b79f3f4d8 Author: Pierre Schweitzer <pierre(a)reactos.org> AuthorDate: Sat Jun 1 17:28:11 2019 +0200 Commit: Pierre Schweitzer <pierre(a)reactos.org> CommitDate: Sat Jun 1 17:40:18 2019 +0200 [NTOSKRNL] Add support for LUID mappings in ObQueryDeviceMapInformation --- ntoskrnl/include/internal/ob.h | 2 +- ntoskrnl/ob/devicemap.c | 122 ++++++++++++++++++++++++++++++++++++++--- 2 files changed, 114 insertions(+), 10 deletions(-) diff --git a/ntoskrnl/include/internal/ob.h b/ntoskrnl/include/internal/ob.h index 910858ac5de..23f54cefefd 100644 --- a/ntoskrnl/include/internal/ob.h +++ b/ntoskrnl/include/internal/ob.h @@ -292,7 +292,7 @@ ObpSetHandleAttributes( IN ULONG_PTR Context ); -VOID +NTSTATUS NTAPI ObQueryDeviceMapInformation( IN PEPROCESS Process, diff --git a/ntoskrnl/ob/devicemap.c b/ntoskrnl/ob/devicemap.c index d1b7368bb8c..4dcaff1c832 100644 --- a/ntoskrnl/ob/devicemap.c +++ b/ntoskrnl/ob/devicemap.c @@ -143,6 +143,15 @@ ObSetDeviceMap(IN PEPROCESS Process, } +PDEVICE_MAP +NTAPI +ObpReferenceDeviceMap(VOID) +{ + UNIMPLEMENTED; + return NULL; +} + + VOID NTAPI ObDereferenceDeviceMap(IN PEPROCESS Process) @@ -226,30 +235,125 @@ ObInheritDeviceMap(IN PEPROCESS Parent, } -VOID +NTSTATUS NTAPI ObQueryDeviceMapInformation(IN PEPROCESS Process, IN PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, IN ULONG Flags) { - PDEVICE_MAP DeviceMap; + PDEVICE_MAP DeviceMap = NULL, GlobalDeviceMap; + BOOLEAN Dereference; + PROCESS_DEVICEMAP_INFORMATION MapInfo; + ULONG BitMask, i; + BOOLEAN ReturnAny; + NTSTATUS Status; + + /* Validate flags */ + if (Flags & ~PROCESS_LUID_DOSDEVICES_ONLY) + { + return STATUS_INVALID_PARAMETER; + } + + Dereference = FALSE; + /* Do we want to return anything? */ + ReturnAny = ~Flags & PROCESS_LUID_DOSDEVICES_ONLY; + + /* If LUID mappings are enabled... */ + if (ObpLUIDDeviceMapsEnabled != 0) + { + /* Check for process parameter validness */ + if (Process != NULL && Process != PsGetCurrentProcess()) + { + return STATUS_INVALID_PARAMETER; + } + + /* And get the device map */ + DeviceMap = ObpReferenceDeviceMap(); + } /* Acquire the device map lock */ KeAcquireGuardedMutex(&ObpDeviceMapLock); - /* Get the process device map or the system device map */ - DeviceMap = (Process != NULL) ? Process->DeviceMap : ObSystemDeviceMap; + /* + * If we had a device map, if because of LUID mappings, + * we'll have to dereference it afterwards + */ if (DeviceMap != NULL) { - /* Make a copy */ - DeviceMapInfo->Query.DriveMap = DeviceMap->DriveMap; - RtlCopyMemory(DeviceMapInfo->Query.DriveType, - DeviceMap->DriveType, - sizeof(DeviceMap->DriveType)); + Dereference = TRUE; + } + else + { + /* Get the process device map or the system device map */ + DeviceMap = (Process != NULL) ? Process->DeviceMap : ObSystemDeviceMap; + } + + /* Fail if no device map */ + if (DeviceMap == NULL) + { + KeReleaseGuardedMutex(&ObpDeviceMapLock); + return STATUS_END_OF_FILE; + } + + /* At that point, assume success */ + Status = STATUS_SUCCESS; + + /* Try to get the global device map if any */ + GlobalDeviceMap = DeviceMap; + if (DeviceMap->GlobalDosDevicesDirectory != NULL) + { + if (DeviceMap->GlobalDosDevicesDirectory->DeviceMap != NULL) + { + GlobalDeviceMap = DeviceMap->GlobalDosDevicesDirectory->DeviceMap; + } + } + + /* Now, setup our device map info, especially drive types */ + MapInfo.Query.DriveMap = DeviceMap->DriveMap; + /* Browse every device */ + for (i = 0, BitMask = 1; i < 32; ++i, BitMask *= 2) + { + /* Set the type given current device map */ + MapInfo.Query.DriveType[i] = DeviceMap->DriveType[i]; + + /* + * If device is not existing and we're asked to return + * more than just LUID mapped, get the entry + * from global device map if not remote + */ + if (!(MapInfo.Query.DriveMap & BitMask) && ReturnAny) + { + if (ObpLUIDDeviceMapsEnabled != 0 || + (GlobalDeviceMap->DriveType[i] != DOSDEVICE_DRIVE_REMOTE && + GlobalDeviceMap->DriveType[i] != DOSDEVICE_DRIVE_CALCULATE)) + { + MapInfo.Query.DriveType[i] = GlobalDeviceMap->DriveType[i]; + MapInfo.Query.DriveMap |= BitMask & GlobalDeviceMap->DriveMap; + } + } } /* Release the device map lock */ KeReleaseGuardedMutex(&ObpDeviceMapLock); + + /* Dereference LUID device map */ + if (Dereference) + { + ObfDereferenceDeviceMap(DeviceMap); + } + + /* Copy back data */ + _SEH2_TRY + { + RtlCopyMemory(DeviceMapInfo, &MapInfo, sizeof(PROCESS_DEVICEMAP_INFORMATION)); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + Status = _SEH2_GetExceptionCode(); + } + _SEH2_END; + + return Status; }

1 0

[reactos] 02/07: [NTOSKRNL] Implement support for PROCESS_DEVICEMAP_INFORMATION_EX in NtQueryInformationProcess
by Pierre Schweitzer 01 Jun '19

01 Jun '19

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=1074a9aaff0b8d0378213… commit 1074a9aaff0b8d03782132cbe08f035afa85de9b Author: Pierre Schweitzer <pierre(a)reactos.org> AuthorDate: Sat Jun 1 15:18:52 2019 +0200 Commit: Pierre Schweitzer <pierre(a)reactos.org> CommitDate: Sat Jun 1 15:18:52 2019 +0200 [NTOSKRNL] Implement support for PROCESS_DEVICEMAP_INFORMATION_EX in NtQueryInformationProcess --- ntoskrnl/include/internal/ob.h | 3 ++- ntoskrnl/ob/devicemap.c | 3 ++- ntoskrnl/ps/query.c | 53 ++++++++++++++++++++++++++++++++++-------- 3 files changed, 47 insertions(+), 12 deletions(-) diff --git a/ntoskrnl/include/internal/ob.h b/ntoskrnl/include/internal/ob.h index 132b47f5a6b..910858ac5de 100644 --- a/ntoskrnl/include/internal/ob.h +++ b/ntoskrnl/include/internal/ob.h @@ -296,7 +296,8 @@ VOID NTAPI ObQueryDeviceMapInformation( IN PEPROCESS Process, - OUT PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo + OUT PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, + IN ULONG Flags ); // diff --git a/ntoskrnl/ob/devicemap.c b/ntoskrnl/ob/devicemap.c index a4cd5afbfae..d1b7368bb8c 100644 --- a/ntoskrnl/ob/devicemap.c +++ b/ntoskrnl/ob/devicemap.c @@ -229,7 +229,8 @@ ObInheritDeviceMap(IN PEPROCESS Parent, VOID NTAPI ObQueryDeviceMapInformation(IN PEPROCESS Process, - IN PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo) + IN PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, + IN ULONG Flags) { PDEVICE_MAP DeviceMap; diff --git a/ntoskrnl/ps/query.c b/ntoskrnl/ps/query.c index 12036fb01a1..29c8171a474 100644 --- a/ntoskrnl/ps/query.c +++ b/ntoskrnl/ps/query.c @@ -78,7 +78,7 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle, PVM_COUNTERS VmCounters = (PVM_COUNTERS)ProcessInformation; PIO_COUNTERS IoCounters = (PIO_COUNTERS)ProcessInformation; PQUOTA_LIMITS QuotaLimits = (PQUOTA_LIMITS)ProcessInformation; - PROCESS_DEVICEMAP_INFORMATION DeviceMap; + PROCESS_DEVICEMAP_INFORMATION_EX DeviceMap; PUNICODE_STRING ImageName; ULONG Cookie, ExecuteOptions = 0; ULONG_PTR Wow64 = 0; @@ -564,22 +564,55 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle, /* DOS Device Map */ case ProcessDeviceMap: - if (ProcessInformationLength != RTL_FIELD_SIZE(PROCESS_DEVICEMAP_INFORMATION, Query)) + if (ProcessInformationLength < sizeof(PROCESS_DEVICEMAP_INFORMATION)) { - if (ProcessInformationLength == sizeof(PROCESS_DEVICEMAP_INFORMATION_EX)) + Status = STATUS_INFO_LENGTH_MISMATCH; + break; + } + + if (ProcessInformationLength == sizeof(PROCESS_DEVICEMAP_INFORMATION_EX)) + { + /* Protect read in SEH */ + _SEH2_TRY { - DPRINT1("PROCESS_DEVICEMAP_INFORMATION_EX not supported!\n"); - Status = STATUS_NOT_IMPLEMENTED; + PPROCESS_DEVICEMAP_INFORMATION_EX DeviceMapEx = ProcessInformation; + + DeviceMap.Flags = DeviceMapEx->Flags; } - else + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + /* Get the exception code */ + Status = _SEH2_GetExceptionCode(); + } + _SEH2_END; + + if (!NT_SUCCESS(Status)) + { + break; + } + + /* Only one flag is supported and it needs LUID mappings */ + if ((DeviceMap.Flags & ~PROCESS_LUID_DOSDEVICES_ONLY) != 0 || + !ObIsLUIDDeviceMapsEnabled()) + { + Status = STATUS_INVALID_PARAMETER; + break; + } + } + else + { + if (ProcessInformationLength != sizeof(PROCESS_DEVICEMAP_INFORMATION)) { Status = STATUS_INFO_LENGTH_MISMATCH; + break; } - break; + + /* No flags for standard call */ + DeviceMap.Flags = 0; } /* Set the return length */ - Length = sizeof(PROCESS_DEVICEMAP_INFORMATION); + Length = ProcessInformationLength; /* Reference the process */ Status = ObReferenceObjectByHandle(ProcessHandle, @@ -591,12 +624,12 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle, if (!NT_SUCCESS(Status)) break; /* Query the device map information */ - ObQueryDeviceMapInformation(Process, &DeviceMap); + ObQueryDeviceMapInformation(Process, (PPROCESS_DEVICEMAP_INFORMATION)&DeviceMap, DeviceMap.Flags); /* Enter SEH for writing back data */ _SEH2_TRY { - *(PPROCESS_DEVICEMAP_INFORMATION)ProcessInformation = DeviceMap; + RtlCopyMemory(ProcessInformation, &DeviceMap, sizeof(PROCESS_DEVICEMAP_INFORMATION)); } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {

1 0

[reactos] 01/07: [NTOSKRNL] Implement ObIsLUIDDeviceMapsEnabled and call it in NtQueryInformationProcess
by Pierre Schweitzer 01 Jun '19

01 Jun '19

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=b16a07fa6913184abe2d2… commit b16a07fa6913184abe2d2bee321f8f7aef919808 Author: Pierre Schweitzer <pierre(a)reactos.org> AuthorDate: Sat Jun 1 14:56:28 2019 +0200 Commit: Pierre Schweitzer <pierre(a)reactos.org> CommitDate: Sat Jun 1 14:56:28 2019 +0200 [NTOSKRNL] Implement ObIsLUIDDeviceMapsEnabled and call it in NtQueryInformationProcess --- ntoskrnl/include/internal/ob.h | 7 +++++++ ntoskrnl/ob/devicemap.c | 11 +++++++++++ ntoskrnl/ob/obdir.c | 3 +-- ntoskrnl/ob/obname.c | 3 --- ntoskrnl/ps/query.c | 4 ++-- 5 files changed, 21 insertions(+), 7 deletions(-) diff --git a/ntoskrnl/include/internal/ob.h b/ntoskrnl/include/internal/ob.h index ddbfeb42d92..132b47f5a6b 100644 --- a/ntoskrnl/include/internal/ob.h +++ b/ntoskrnl/include/internal/ob.h @@ -429,6 +429,12 @@ ObpCreateDosDevicesDirectory( VOID ); +ULONG +NTAPI +ObIsLUIDDeviceMapsEnabled( + VOID +); + // // Security descriptor cache functions // @@ -621,6 +627,7 @@ extern ULONG ObpUnsecureGlobalNamesLength; extern ULONG ObpObjectSecurityMode; extern ULONG ObpProtectionMode; extern ULONG ObpLUIDDeviceMapsDisabled; +extern ULONG ObpLUIDDeviceMapsEnabled; // // Inlined Functions diff --git a/ntoskrnl/ob/devicemap.c b/ntoskrnl/ob/devicemap.c index dd501f134f8..a4cd5afbfae 100644 --- a/ntoskrnl/ob/devicemap.c +++ b/ntoskrnl/ob/devicemap.c @@ -13,6 +13,9 @@ #define NDEBUG #include <debug.h> +ULONG ObpLUIDDeviceMapsDisabled; +ULONG ObpLUIDDeviceMapsEnabled; + /* PRIVATE FUNCTIONS ******************************************************/ NTSTATUS @@ -249,6 +252,14 @@ ObQueryDeviceMapInformation(IN PEPROCESS Process, } +ULONG +NTAPI +ObIsLUIDDeviceMapsEnabled(VOID) +{ + return ObpLUIDDeviceMapsEnabled; +} + + #if 0 NTSTATUS NTAPI diff --git a/ntoskrnl/ob/obdir.c b/ntoskrnl/ob/obdir.c index 3c62411fed5..f8e3a36a06a 100644 --- a/ntoskrnl/ob/obdir.c +++ b/ntoskrnl/ob/obdir.c @@ -17,7 +17,6 @@ #define NDEBUG #include <debug.h> -BOOLEAN ObpLUIDDeviceMapsEnabled; POBJECT_TYPE ObpDirectoryObjectType = NULL; /* PRIVATE FUNCTIONS ******************************************************/ @@ -141,7 +140,7 @@ ObpLookupEntryDirectory(IN POBJECT_DIRECTORY Directory, PAGED_CODE(); /* Check if we should search the shadow directory */ - if (!ObpLUIDDeviceMapsEnabled) SearchShadow = FALSE; + if (ObpLUIDDeviceMapsEnabled == 0) SearchShadow = FALSE; /* Fail if we don't have a directory or name */ if (!(Directory) || !(Name)) goto Quickie; diff --git a/ntoskrnl/ob/obname.c b/ntoskrnl/ob/obname.c index f05a06805d0..5700d43d5ca 100644 --- a/ntoskrnl/ob/obname.c +++ b/ntoskrnl/ob/obname.c @@ -32,9 +32,6 @@ UNICODE_STRING ObpDosDevicesShortName = WCHAR ObpUnsecureGlobalNamesBuffer[128] = {0}; ULONG ObpUnsecureGlobalNamesLength = sizeof(ObpUnsecureGlobalNamesBuffer); -ULONG ObpLUIDDeviceMapsDisabled; -ULONG ObpLUIDDeviceMapsEnabled; - /* PRIVATE FUNCTIONS *********************************************************/ INIT_FUNCTION diff --git a/ntoskrnl/ps/query.c b/ntoskrnl/ps/query.c index 1f605be3349..12036fb01a1 100644 --- a/ntoskrnl/ps/query.c +++ b/ntoskrnl/ps/query.c @@ -911,8 +911,8 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle, /* Protect write in SEH */ _SEH2_TRY { - /* Return FALSE -- we don't support this */ - *(PULONG)ProcessInformation = FALSE; + /* Query Ob */ + *(PULONG)ProcessInformation = ObIsLUIDDeviceMapsEnabled(); } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {

1 0

[reactos] 01/01: [NTOSKRNL] Disable LUID mapping until it's properly implemented
by Pierre Schweitzer 01 Jun '19

01 Jun '19

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=7898b2eaa365b72cfb001… commit 7898b2eaa365b72cfb00186b165cff13d2990b40 Author: Pierre Schweitzer <pierre(a)reactos.org> AuthorDate: Sat Jun 1 14:40:24 2019 +0200 Commit: Pierre Schweitzer <pierre(a)reactos.org> CommitDate: Sat Jun 1 14:40:54 2019 +0200 [NTOSKRNL] Disable LUID mapping until it's properly implemented --- boot/bootdata/hivesys.inf | 1 + ntoskrnl/config/cmdata.c | 2 +- ntoskrnl/include/internal/ob.h | 1 + ntoskrnl/ob/obname.c | 10 ++++++++++ 4 files changed, 13 insertions(+), 1 deletion(-) diff --git a/boot/bootdata/hivesys.inf b/boot/bootdata/hivesys.inf index 0f2fc9369eb..d1e1f7d4d59 100644 --- a/boot/bootdata/hivesys.inf +++ b/boot/bootdata/hivesys.inf @@ -1445,6 +1445,7 @@ HKLM,"SYSTEM\CurrentControlSet\Control\Session Manager","ObjectDirectories",0x00 "\Windows", \ "\RPC Control" HKLM,"SYSTEM\CurrentControlSet\Control\Session Manager","ProtectionMode", 0x00010003, 0x00000001 +HKLM,"SYSTEM\CurrentControlSet\Control\Session Manager","LUIDDeviceMapsDisabled", 0x00010003, 0x00000001 ; DOS devices HKLM,"SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices","AUX",0x00000002,"\DosDevices\COM1" diff --git a/ntoskrnl/config/cmdata.c b/ntoskrnl/config/cmdata.c index 816dfd28c91..7a2c6af6c55 100644 --- a/ntoskrnl/config/cmdata.c +++ b/ntoskrnl/config/cmdata.c @@ -157,7 +157,7 @@ INIT_SECTION CM_SYSTEM_CONTROL_VECTOR CmControlVector[] = { L"Session Manager", L"LUIDDeviceMapsDisabled", - &DummyData, + &ObpLUIDDeviceMapsDisabled, NULL, NULL }, diff --git a/ntoskrnl/include/internal/ob.h b/ntoskrnl/include/internal/ob.h index b2d7037d9dc..ddbfeb42d92 100644 --- a/ntoskrnl/include/internal/ob.h +++ b/ntoskrnl/include/internal/ob.h @@ -620,6 +620,7 @@ extern WCHAR ObpUnsecureGlobalNamesBuffer[128]; extern ULONG ObpUnsecureGlobalNamesLength; extern ULONG ObpObjectSecurityMode; extern ULONG ObpProtectionMode; +extern ULONG ObpLUIDDeviceMapsDisabled; // // Inlined Functions diff --git a/ntoskrnl/ob/obname.c b/ntoskrnl/ob/obname.c index d76ed10a919..f05a06805d0 100644 --- a/ntoskrnl/ob/obname.c +++ b/ntoskrnl/ob/obname.c @@ -32,6 +32,9 @@ UNICODE_STRING ObpDosDevicesShortName = WCHAR ObpUnsecureGlobalNamesBuffer[128] = {0}; ULONG ObpUnsecureGlobalNamesLength = sizeof(ObpUnsecureGlobalNamesBuffer); +ULONG ObpLUIDDeviceMapsDisabled; +ULONG ObpLUIDDeviceMapsEnabled; + /* PRIVATE FUNCTIONS *********************************************************/ INIT_FUNCTION @@ -182,6 +185,13 @@ ObpCreateDosDevicesDirectory(VOID) SECURITY_DESCRIPTOR DosDevicesSD; NTSTATUS Status; + /* + * Enable LUID mappings only if not explicitely disabled + * and if protection mode is set + */ + if (ObpProtectionMode == 0 || ObpLUIDDeviceMapsDisabled != 0) + ObpLUIDDeviceMapsEnabled = 0; + /* Create a custom security descriptor for the global DosDevices directory */ Status = ObpGetDosDevicesProtection(&DosDevicesSD); if (!NT_SUCCESS(Status))

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs