Ros-diffs

ros-diffs@reactos.org

81390 discussions

[reactos] 01/02: Add a small descriptive comment for the reason why the chosen files are specified in a .gitattributes file.
by Hermès Bélusca-Maïto 08 Oct '17

08 Oct '17

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=0436a4c73b22d9cce3905… commit 0436a4c73b22d9cce390504c5225ceaae8731854 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Sun Oct 8 15:46:02 2017 +0200 Add a small descriptive comment for the reason why the chosen files are specified in a .gitattributes file. --- boot/bootdata/.gitattributes | 2 +- hal/halx86/legacy/bus/.gitattributes | 1 + subsystems/mvdm/config/.gitattributes | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/boot/bootdata/.gitattributes b/boot/bootdata/.gitattributes index 6b7a8fc6dc..38f873f93f 100644 --- a/boot/bootdata/.gitattributes +++ b/boot/bootdata/.gitattributes @@ -1,2 +1,2 @@ -# This one will be distributed in the ISO. +# The README file is distributed in the ISO. readme.txt text eol=crlf diff --git a/hal/halx86/legacy/bus/.gitattributes b/hal/halx86/legacy/bus/.gitattributes index d58638ba9b..0ddf4ebe1b 100644 --- a/hal/halx86/legacy/bus/.gitattributes +++ b/hal/halx86/legacy/bus/.gitattributes @@ -1,2 +1,3 @@ +# The HAL expects these files to be in CR-LF. pci_classes.ids text eol=crlf pci_vendors.ids text eol=crlf diff --git a/subsystems/mvdm/config/.gitattributes b/subsystems/mvdm/config/.gitattributes index f95b66d5ee..2eaecf386d 100644 --- a/subsystems/mvdm/config/.gitattributes +++ b/subsystems/mvdm/config/.gitattributes @@ -1,2 +1,3 @@ +# These files are distributed with ReactOS. AUTOEXEC.NT text eol=crlf CONFIG.NT text eol=crlf

1 0

[reactos] 01/01: [AMSTREAM] We don't need to define WIDL_C_INLINE_WRAPPERS here anymore.
by Amine Khaldi 08 Oct '17

08 Oct '17

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=e7054d7688e14c4a85f72… commit e7054d7688e14c4a85f72cac70959a101d5f976c Author: Amine Khaldi <amine.khaldi(a)reactos.org> AuthorDate: Sun Oct 8 14:32:50 2017 +0100 [AMSTREAM] We don't need to define WIDL_C_INLINE_WRAPPERS here anymore. --- dll/directx/wine/amstream/CMakeLists.txt | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/dll/directx/wine/amstream/CMakeLists.txt b/dll/directx/wine/amstream/CMakeLists.txt index 695b778ffc..b6e6b869aa 100644 --- a/dll/directx/wine/amstream/CMakeLists.txt +++ b/dll/directx/wine/amstream/CMakeLists.txt @@ -1,7 +1,5 @@ -add_definitions( - -D__WINESRC__ - -DWIDL_C_INLINE_WRAPPERS) +add_definitions(-D__WINESRC__) include_directories(${REACTOS_SOURCE_DIR}/sdk/include/reactos/wine) spec2def(amstream.dll amstream.spec)

1 0

[reactos] 01/01: [MSCOREE] Fix build.
by Amine Khaldi 08 Oct '17

08 Oct '17

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=e38cdd2f62c26bf0610af… commit e38cdd2f62c26bf0610afa6c41a93561cda07bc3 Author: Amine Khaldi <amine.khaldi(a)reactos.org> AuthorDate: Sun Oct 8 14:28:58 2017 +0100 [MSCOREE] Fix build. --- dll/win32/mscoree/cordebug.c | 8 ++++---- dll/win32/mscoree/corruntimehost.c | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dll/win32/mscoree/cordebug.c b/dll/win32/mscoree/cordebug.c index d1601fcae7..0a06a94178 100644 --- a/dll/win32/mscoree/cordebug.c +++ b/dll/win32/mscoree/cordebug.c @@ -67,7 +67,7 @@ static HRESULT WINAPI cordebugprocess_QueryInterface(ICorDebugProcess *iface, return E_NOINTERFACE; } - ICorDebug_AddRef(iface); + ICorDebugProcess_AddRef(iface); return S_OK; } @@ -413,7 +413,7 @@ static HRESULT CorDebugProcess_Create(CorDebug *cordebug, IUnknown** ppUnk, LPPR if(This->cordebug) ICorDebug_AddRef(&This->cordebug->ICorDebug_iface); - *ppUnk = (IUnknown*)This; + *ppUnk = (IUnknown*)&This->ICorDebugProcess_iface; return S_OK; } @@ -437,7 +437,7 @@ static HRESULT WINAPI process_enum_QueryInterface(ICorDebugProcessEnum *iface, R return E_NOINTERFACE; } - ICorDebug_AddRef(iface); + ICorDebugProcessEnum_AddRef(iface); return S_OK; } @@ -759,7 +759,7 @@ HRESULT CorDebug_Create(ICLRRuntimeHost *runtimehost, IUnknown** ppUnk) if(This->runtimehost) ICLRRuntimeHost_AddRef(This->runtimehost); - *ppUnk = (IUnknown*)This; + *ppUnk = (IUnknown*)&This->ICorDebug_iface; return S_OK; } diff --git a/dll/win32/mscoree/corruntimehost.c b/dll/win32/mscoree/corruntimehost.c index 847d6fa821..2c8f2cbfd3 100644 --- a/dll/win32/mscoree/corruntimehost.c +++ b/dll/win32/mscoree/corruntimehost.c @@ -919,7 +919,7 @@ static void CDECL ReallyFixupVTable(struct dll_fixup *fixup) } if (info != NULL) - ICLRRuntimeHost_Release(info); + ICLRRuntimeInfo_Release(info); HeapFree(GetProcessHeap(), 0, filenameA);

1 0

[reactos] 01/01: [PSDK] Update unknwn.idl. CORE-13762
by Amine Khaldi 08 Oct '17

08 Oct '17

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=6cdefd33e1f79327f9807… commit 6cdefd33e1f79327f98070835b132ee581d77122 Author: Amine Khaldi <amine.khaldi(a)reactos.org> AuthorDate: Sun Oct 8 14:04:24 2017 +0100 [PSDK] Update unknwn.idl. CORE-13762 --- sdk/include/psdk/unknwn.idl | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/sdk/include/psdk/unknwn.idl b/sdk/include/psdk/unknwn.idl index 9071973fbe..7856a7f504 100644 --- a/sdk/include/psdk/unknwn.idl +++ b/sdk/include/psdk/unknwn.idl @@ -20,7 +20,14 @@ import "wtypes.idl"; #endif -/* Interfaces */ +cpp_quote("#ifdef __WINESRC__") +cpp_quote("#define WIDL_C_INLINE_WRAPPERS") +cpp_quote("#endif") + +cpp_quote("#ifdef WIDL_C_INLINE_WRAPPERS") +cpp_quote("#define SAVE_WIDL_C_INLINE_WRAPPERS") +cpp_quote("#undef WIDL_C_INLINE_WRAPPERS") +cpp_quote("#endif") [ local, @@ -39,6 +46,20 @@ interface IUnknown ULONG Release(); } +cpp_quote("HRESULT STDMETHODCALLTYPE IUnknown_QueryInterface_Proxy(IUnknown* This, REFIID riid, void **ppvObject);") +cpp_quote("void __RPC_STUB IUnknown_QueryInterface_Stub(IRpcStubBuffer* This, IRpcChannelBuffer* pRpcChannelBuffer,") +cpp_quote(" PRPC_MESSAGE pRpcMessage, DWORD* pdwStubPhase);") +cpp_quote("ULONG STDMETHODCALLTYPE IUnknown_AddRef_Proxy(IUnknown* This);") +cpp_quote("void __RPC_STUB IUnknown_AddRef_Stub(IRpcStubBuffer* This, IRpcChannelBuffer* pRpcChannelBuffer,") +cpp_quote(" PRPC_MESSAGE pRpcMessage, DWORD* pdwStubPhase);") +cpp_quote("ULONG STDMETHODCALLTYPE IUnknown_Release_Proxy(IUnknown* This);") +cpp_quote("void __RPC_STUB IUnknown_Release_Stub(IRpcStubBuffer* This, IRpcChannelBuffer* pRpcChannelBuffer,") +cpp_quote(" PRPC_MESSAGE pRpcMessage, DWORD* pdwStubPhase);") + +cpp_quote("#ifdef SAVE_WIDL_C_INLINE_WRAPPERS") +cpp_quote("#define WIDL_C_INLINE_WRAPPERS") +cpp_quote("#endif") + [ object, uuid(00000001-0000-0000-C000-000000000046),

1 0

[reactos] 01/01: [NTOSKRNL] Add back parentheses that got removed in r75605
by Timo Kreuzer 08 Oct '17

08 Oct '17

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=24856b8de6abc6abb569d… commit 24856b8de6abc6abb569d9cd3158e7eeac70fdb4 Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Sun Oct 8 14:13:47 2017 +0200 [NTOSKRNL] Add back parentheses that got removed in r75605 --- ntoskrnl/include/internal/mm.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ntoskrnl/include/internal/mm.h b/ntoskrnl/include/internal/mm.h index ade96213ed..694c51f1f0 100644 --- a/ntoskrnl/include/internal/mm.h +++ b/ntoskrnl/include/internal/mm.h @@ -200,8 +200,8 @@ typedef struct _ROS_SECTION_OBJECT }; } ROS_SECTION_OBJECT, *PROS_SECTION_OBJECT; -#define MA_GetStartingAddress(_MemoryArea) (_MemoryArea->VadNode.StartingVpn << PAGE_SHIFT) -#define MA_GetEndingAddress(_MemoryArea) ((_MemoryArea->VadNode.EndingVpn + 1) << PAGE_SHIFT) +#define MA_GetStartingAddress(_MemoryArea) ((_MemoryArea)->VadNode.StartingVpn << PAGE_SHIFT) +#define MA_GetEndingAddress(_MemoryArea) (((_MemoryArea)->VadNode.EndingVpn + 1) << PAGE_SHIFT) typedef struct _MEMORY_AREA {

1 0

[reactos] 01/01: [WIDL] Sync with Wine Staging 2.16. CORE-13762
by Amine Khaldi 08 Oct '17

08 Oct '17

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=891d81e058237344de3fe… commit 891d81e058237344de3fe4e183f6b1933d1f2bbc Author: Amine Khaldi <amine.khaldi(a)reactos.org> AuthorDate: Sun Oct 8 10:52:42 2017 +0100 [WIDL] Sync with Wine Staging 2.16. CORE-13762 b42a155 widl: Handle C++ aggregate returns in a MSVC compatible way. 084fa63 widl: Only generate Proxy Stubs when functions have the call_as attribute. fbdf119 widl: Try to find imported typelib using .tlb extension if it wasn't specified. --- media/doc/README.WINE | 2 +- sdk/tools/widl/header.c | 53 ++++++++++++++++++++++++++++++++++++++++++++++-- sdk/tools/widl/typelib.c | 36 ++++++++++++++++++++++++-------- 3 files changed, 80 insertions(+), 11 deletions(-) diff --git a/media/doc/README.WINE b/media/doc/README.WINE index 1a7c651da6..8dcdd23aa5 100644 --- a/media/doc/README.WINE +++ b/media/doc/README.WINE @@ -16,7 +16,7 @@ wine-patches(a)winehq.com and ros-dev(a)reactos.org The following build tools are shared with Wine. reactos/sdk/tools/unicode # Synced to WineStaging-2.9 -reactos/sdk/tools/widl # Synced to WineStaging-2.9 +reactos/sdk/tools/widl # Synced to WineStaging-2.16 reactos/sdk/tools/wpp # Synced to WineStaging-2.9 The following libraries are shared with Wine. diff --git a/sdk/tools/widl/header.c b/sdk/tools/widl/header.c index a5dadbaf68..27bca0ed0d 100644 --- a/sdk/tools/widl/header.c +++ b/sdk/tools/widl/header.c @@ -1043,13 +1043,62 @@ static void write_cpp_method_def(FILE *header, const type_t *iface) const var_t *func = stmt->u.var; if (!is_callas(func->attrs)) { const char *callconv = get_attrp(func->type->attrs, ATTR_CALLCONV); + const var_list_t *args = type_get_function_args(func->type); + const var_t *arg; + if (!callconv) callconv = "STDMETHODCALLTYPE"; + + if (is_aggregate_return(func)) { + fprintf(header, "#ifdef WIDL_EXPLICIT_AGGREGATE_RETURNS\n"); + + indent(header, 0); + fprintf(header, "virtual "); + write_type_decl_left(header, type_function_get_rettype(func->type)); + fprintf(header, "* %s %s(\n", callconv, get_name(func)); + ++indentation; + indent(header, 0); + write_type_decl_left(header, type_function_get_rettype(func->type)); + fprintf(header, " *__ret"); + --indentation; + if (args) { + fprintf(header, ",\n"); + write_args(header, args, iface->name, 2, TRUE); + } + fprintf(header, ") = 0;\n"); + + indent(header, 0); + write_type_decl_left(header, type_function_get_rettype(func->type)); + fprintf(header, " %s %s(\n", callconv, get_name(func)); + write_args(header, args, iface->name, 2, TRUE); + fprintf(header, ")\n"); + indent(header, 0); + fprintf(header, "{\n"); + ++indentation; + indent(header, 0); + write_type_decl_left(header, type_function_get_rettype(func->type)); + fprintf(header, " __ret;\n"); + indent(header, 0); + fprintf(header, "return *%s(&__ret", get_name(func)); + if (args) + LIST_FOR_EACH_ENTRY(arg, args, const var_t, entry) + fprintf(header, ", %s", arg->name); + fprintf(header, ");\n"); + --indentation; + indent(header, 0); + fprintf(header, "}\n"); + + fprintf(header, "#else\n"); + } + indent(header, 0); fprintf(header, "virtual "); write_type_decl_left(header, type_function_get_rettype(func->type)); fprintf(header, " %s %s(\n", callconv, get_name(func)); - write_args(header, type_get_function_args(func->type), iface->name, 2, TRUE); + write_args(header, args, iface->name, 2, TRUE); fprintf(header, ") = 0;\n"); + + if (is_aggregate_return(func)) + fprintf(header, "#endif\n"); fprintf(header, "\n"); } } @@ -1181,7 +1230,7 @@ static void write_method_proto(FILE *header, const type_t *iface) { const var_t *func = stmt->u.var; - if (!is_local(func->attrs)) { + if (is_callas(func->attrs)) { const char *callconv = get_attrp(func->type->attrs, ATTR_CALLCONV); if (!callconv) callconv = "STDMETHODCALLTYPE"; /* proxy prototype */ diff --git a/sdk/tools/widl/typelib.c b/sdk/tools/widl/typelib.c index f8f92e2062..ba71de71ab 100644 --- a/sdk/tools/widl/typelib.c +++ b/sdk/tools/widl/typelib.c @@ -327,22 +327,42 @@ static void read_msft_importlib(importlib_t *importlib, int fd) free(typeinfo_offs); } +static int open_typelib(const char *name) +{ + char *file_name; + int fd; + + file_name = wpp_find_include(name, NULL); + if(!file_name) + return open(name, O_RDONLY | O_BINARY ); + + fd = open(file_name, O_RDONLY | O_BINARY ); + free(file_name); + return fd; +} + static void read_importlib(importlib_t *importlib) { int fd; INT magic; - char *file_name; - file_name = wpp_find_include(importlib->name, NULL); - if(file_name) { - fd = open(file_name, O_RDONLY | O_BINARY ); - free(file_name); - }else { - fd = open(importlib->name, O_RDONLY | O_BINARY ); + fd = open_typelib(importlib->name); + + /* widl extension: if importlib name has no .tlb extension, try using .tlb */ + if(fd < 0) { + const char *p = strrchr(importlib->name, '.'); + size_t len = p ? p - importlib->name : strlen(importlib->name); + if(strcmp(importlib->name + len, ".tlb")) { + char *tlb_name = xmalloc(len + 5); + memcpy(tlb_name, importlib->name, len); + strcpy(tlb_name + len, ".tlb"); + fd = open_typelib(tlb_name); + free(tlb_name); + } } if(fd < 0) - error("Could not open importlib %s.\n", importlib->name); + error("Could not find importlib %s.\n", importlib->name); tlb_read(fd, &magic, sizeof(magic));

1 0

[reactos] 02/02: [ADVAPI32_WINETEST] Sync with Wine Staging 2.16. CORE-13762
by Amine Khaldi 08 Oct '17

08 Oct '17

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=561bed7b55ea36aecbfcd… commit 561bed7b55ea36aecbfcda4da919bc5a77d43636 Author: Amine Khaldi <amine.khaldi(a)reactos.org> AuthorDate: Sun Oct 8 11:06:20 2017 +0100 [ADVAPI32_WINETEST] Sync with Wine Staging 2.16. CORE-13762 --- modules/rostests/winetests/advapi32/CMakeLists.txt | 2 +- modules/rostests/winetests/advapi32/eventlog.c | 4 - modules/rostests/winetests/advapi32/registry.c | 199 ++- modules/rostests/winetests/advapi32/security.c | 1322 ++++++++++++++------ 4 files changed, 1103 insertions(+), 424 deletions(-) diff --git a/modules/rostests/winetests/advapi32/CMakeLists.txt b/modules/rostests/winetests/advapi32/CMakeLists.txt index d6958f4c63..5005dd5adf 100644 --- a/modules/rostests/winetests/advapi32/CMakeLists.txt +++ b/modules/rostests/winetests/advapi32/CMakeLists.txt @@ -22,5 +22,5 @@ if(NOT MSVC) endif() set_module_type(advapi32_winetest win32cui) -add_importlibs(advapi32_winetest advapi32 ole32 msvcrt kernel32 ntdll) +add_importlibs(advapi32_winetest advapi32 ole32 user32 msvcrt kernel32 ntdll) add_rostests_file(TARGET advapi32_winetest) diff --git a/modules/rostests/winetests/advapi32/eventlog.c b/modules/rostests/winetests/advapi32/eventlog.c index be9b4673ae..8c78dcf73f 100644 --- a/modules/rostests/winetests/advapi32/eventlog.c +++ b/modules/rostests/winetests/advapi32/eventlog.c @@ -1209,11 +1209,7 @@ static void test_start_trace(void) ret = StartTraceA(&handle, sessionname, properties); todo_wine ok(ret == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", ret); -#ifndef __REACTOS__ - properties->Wnode.Guid = (GUID){0}; -#else memset(&properties->Wnode.Guid, 0, sizeof(properties->Wnode.Guid)); -#endif properties->LogFileNameOffset = 0; ret = StartTraceA(&handle, sessionname, properties); diff --git a/modules/rostests/winetests/advapi32/registry.c b/modules/rostests/winetests/advapi32/registry.c index 8af1ebf938..053113a293 100644 --- a/modules/rostests/winetests/advapi32/registry.c +++ b/modules/rostests/winetests/advapi32/registry.c @@ -3523,40 +3523,76 @@ static void test_RegNotifyChangeKeyValue(void) CloseHandle(event); } +static const char *dbgstr_longlong(ULONGLONG ll) +{ + static char buf[16][64]; + static int idx; + + idx &= 0x0f; + + if (sizeof(ll) > sizeof(unsigned long) && ll >> 32) + sprintf(buf[idx], "0x%lx%08lx", (unsigned long)(ll >> 32), (unsigned long)ll); + else + sprintf(buf[idx], "0x%08lx", (unsigned long)ll); + + return buf[idx++]; +} + +#define cmp_li(a, b, c) cmp_li_real(a, b, c, __LINE__) +static void cmp_li_real(LARGE_INTEGER *l1, LARGE_INTEGER *l2, LONGLONG slack, int line) +{ + LONGLONG diff = l2->QuadPart - l1->QuadPart; + if (diff < 0) diff = -diff; + ok_(__FILE__, line)(diff <= slack, "values don't match: %s/%s\n", + dbgstr_longlong(l1->QuadPart), dbgstr_longlong(l2->QuadPart)); +} + static void test_RegQueryValueExPerformanceData(void) { - DWORD cbData, len; + static const WCHAR globalW[] = { 'G','l','o','b','a','l',0 }; + static const WCHAR dummyW[5] = { 'd','u','m','m','y' }; + static const char * const names[] = { NULL, "", "Global", "2" "invalid counter name" }; + DWORD cbData, len, i, type; BYTE *value; DWORD dwret; LONG limit = 6; PERF_DATA_BLOCK *pdb; + HKEY hkey; + BYTE buf[256 + sizeof(PERF_DATA_BLOCK)]; /* Test with data == NULL */ dwret = RegQueryValueExA( HKEY_PERFORMANCE_DATA, "Global", NULL, NULL, NULL, &cbData ); - todo_wine ok( dwret == ERROR_MORE_DATA, "expected ERROR_MORE_DATA, got %d\n", dwret ); + ok( dwret == ERROR_MORE_DATA, "expected ERROR_MORE_DATA, got %d\n", dwret ); + + dwret = RegQueryValueExW( HKEY_PERFORMANCE_DATA, globalW, NULL, NULL, NULL, &cbData ); + ok( dwret == ERROR_MORE_DATA, "expected ERROR_MORE_DATA, got %d\n", dwret ); /* Test ERROR_MORE_DATA, start with small buffer */ len = 10; value = HeapAlloc(GetProcessHeap(), 0, len); cbData = len; - dwret = RegQueryValueExA( HKEY_PERFORMANCE_DATA, "Global", NULL, NULL, value, &cbData ); - todo_wine ok( dwret == ERROR_MORE_DATA, "expected ERROR_MORE_DATA, got %d\n", dwret ); + type = 0xdeadbeef; + dwret = RegQueryValueExA( HKEY_PERFORMANCE_DATA, "Global", NULL, &type, value, &cbData ); + ok( dwret == ERROR_MORE_DATA, "expected ERROR_MORE_DATA, got %d\n", dwret ); + ok(type == REG_BINARY, "got %u\n", type); while( dwret == ERROR_MORE_DATA && limit) { len = len * 10; value = HeapReAlloc( GetProcessHeap(), 0, value, len ); cbData = len; - dwret = RegQueryValueExA( HKEY_PERFORMANCE_DATA, "Global", NULL, NULL, value, &cbData ); + type = 0xdeadbeef; + dwret = RegQueryValueExA( HKEY_PERFORMANCE_DATA, "Global", NULL, &type, value, &cbData ); limit--; } ok(limit > 0, "too many times ERROR_MORE_DATA returned\n"); - todo_wine ok(dwret == ERROR_SUCCESS, "expected ERROR_SUCCESS, got %d\n", dwret); + ok(dwret == ERROR_SUCCESS, "expected ERROR_SUCCESS, got %d\n", dwret); + ok(type == REG_BINARY, "got %u\n", type); /* Check returned data */ if (dwret == ERROR_SUCCESS) { - todo_wine ok(len >= sizeof(PERF_DATA_BLOCK), "got size %d\n", len); + ok(len >= sizeof(PERF_DATA_BLOCK), "got size %d\n", len); if (len >= sizeof(PERF_DATA_BLOCK)) { pdb = (PERF_DATA_BLOCK*) value; ok(pdb->Signature[0] == 'P', "expected Signature[0] = 'P', got 0x%x\n", pdb->Signature[0]); @@ -3568,8 +3604,155 @@ static void test_RegQueryValueExPerformanceData(void) } HeapFree(GetProcessHeap(), 0, value); -} + for (i = 0; i < sizeof(names)/sizeof(names[0]); i++) + { + cbData = 0xdeadbeef; + dwret = RegQueryValueExA(HKEY_PERFORMANCE_DATA, names[i], NULL, NULL, NULL, &cbData); + ok(dwret == ERROR_MORE_DATA, "%u/%s: got %u\n", i, names[i], dwret); + ok(cbData == 0, "got %u\n", cbData); + + cbData = 0; + dwret = RegQueryValueExA(HKEY_PERFORMANCE_DATA, names[i], NULL, NULL, NULL, &cbData); + ok(dwret == ERROR_MORE_DATA, "%u/%s: got %u\n", i, names[i], dwret); + ok(cbData == 0, "got %u\n", cbData); + + cbData = 0xdeadbeef; + dwret = RegQueryValueExA(HKEY_PERFORMANCE_TEXT, names[i], NULL, NULL, NULL, &cbData); +todo_wine + ok(dwret == ERROR_MORE_DATA, "%u/%s: got %u\n", i, names[i], dwret); + ok(cbData == 0, "got %u\n", cbData); + + cbData = 0; + dwret = RegQueryValueExA(HKEY_PERFORMANCE_TEXT, names[i], NULL, NULL, NULL, &cbData); +todo_wine + ok(dwret == ERROR_MORE_DATA, "%u/%s: got %u\n", i, names[i], dwret); + ok(cbData == 0, "got %u\n", cbData); + + cbData = 0xdeadbeef; + dwret = RegQueryValueExA(HKEY_PERFORMANCE_NLSTEXT, names[i], NULL, NULL, NULL, &cbData); +todo_wine + ok(dwret == ERROR_MORE_DATA, "%u/%s: got %u\n", i, names[i], dwret); + ok(cbData == 0, "got %u\n", cbData); + + cbData = 0; + dwret = RegQueryValueExA(HKEY_PERFORMANCE_NLSTEXT, names[i], NULL, NULL, NULL, &cbData); +todo_wine + ok(dwret == ERROR_MORE_DATA, "%u/%s: got %u\n", i, names[i], dwret); + ok(cbData == 0, "got %u\n", cbData); + } + + memset(buf, 0x77, sizeof(buf)); + type = 0xdeadbeef; + cbData = sizeof(buf); + dwret = RegQueryValueExA(HKEY_PERFORMANCE_DATA, "invalid counter name", NULL, &type, buf, &cbData); + ok(dwret == ERROR_SUCCESS, "got %u\n", dwret); + ok(type == REG_BINARY, "got %u\n", type); + if (dwret == ERROR_SUCCESS) + { + SYSTEMTIME st; + WCHAR sysname[MAX_COMPUTERNAME_LENGTH + 1]; + DWORD sysname_len; + LARGE_INTEGER counter, freq, ftime; + + GetSystemTime(&st); + GetSystemTimeAsFileTime((FILETIME *)&ftime); + QueryPerformanceCounter(&counter); + QueryPerformanceFrequency(&freq); + + sysname_len = MAX_COMPUTERNAME_LENGTH + 1; + GetComputerNameW(sysname, &sysname_len); + + pdb = (PERF_DATA_BLOCK *)buf; + ok(pdb->Signature[0] == 'P', "got '%c'\n", pdb->Signature[0]); + ok(pdb->Signature[1] == 'E', "got '%c'\n", pdb->Signature[1]); + ok(pdb->Signature[2] == 'R', "got '%c'\n", pdb->Signature[2]); + ok(pdb->Signature[3] == 'F', "got '%c'\n", pdb->Signature[3]); + + ok(pdb->LittleEndian == 1, "got %u\n", pdb->LittleEndian); + ok(pdb->Version == 1, "got %u\n", pdb->Version); + ok(pdb->Revision == 1, "got %u\n", pdb->Revision); + len = (sizeof(*pdb) + pdb->SystemNameLength + 7) & ~7; + ok(pdb->TotalByteLength == len, "got %u vs %u\n", pdb->TotalByteLength, len); + ok(pdb->HeaderLength == pdb->TotalByteLength, "got %u\n", pdb->HeaderLength); + ok(pdb->NumObjectTypes == 0, "got %u\n", pdb->NumObjectTypes); +todo_wine + ok(pdb->DefaultObject != 0, "got %u\n", pdb->DefaultObject); + ok(pdb->SystemTime.wYear == st.wYear, "got %u\n", pdb->SystemTime.wYear); + ok(pdb->SystemTime.wMonth == st.wMonth, "got %u\n", pdb->SystemTime.wMonth); + ok(pdb->SystemTime.wDayOfWeek == st.wDayOfWeek, "got %u\n", pdb->SystemTime.wDayOfWeek); + ok(pdb->SystemTime.wDay == st.wDay, "got %u\n", pdb->SystemTime.wDay); + if (U(pdb->PerfTime).LowPart != 0x77777777) /* TestBot is broken */ + cmp_li(&pdb->PerfTime, &counter, freq.QuadPart); + if (U(pdb->PerfFreq).LowPart != 0x77777777) /* TestBot is broken */ + cmp_li(&pdb->PerfFreq, &freq, 0); + cmp_li(&pdb->PerfTime100nSec, &ftime, 200000); /* TestBot needs huge slack value */ + ok(pdb->SystemNameLength == (sysname_len + 1) * sizeof(WCHAR), "expected %u, got %u\n", + (sysname_len + 1) * sizeof(WCHAR), pdb->SystemNameLength); + ok(pdb->SystemNameOffset == sizeof(*pdb), "got %u\n", pdb->SystemNameOffset); + ok(!lstrcmpW(sysname, (LPCWSTR)(pdb + 1)), "%s != %s\n", + wine_dbgstr_w(sysname), wine_dbgstr_w((LPCWSTR)(pdb + 1))); + + len = pdb->TotalByteLength - (sizeof(*pdb) + pdb->SystemNameLength); + if (len) + { + BYTE remainder[8], *p; + + memset(remainder, 0x77, sizeof(remainder)); + p = buf + sizeof(*pdb) + pdb->SystemNameLength; + ok(!memcmp(p, remainder, len), "remainder: %02x,%02x...\n", p[0], p[1]); + } + } + + dwret = RegOpenKeyA(HKEY_PERFORMANCE_DATA, NULL, &hkey); +todo_wine + ok(dwret == ERROR_INVALID_HANDLE, "got %u\n", dwret); + + dwret = RegOpenKeyA(HKEY_PERFORMANCE_DATA, "Global", &hkey); +todo_wine + ok(dwret == ERROR_INVALID_HANDLE, "got %u\n", dwret); + + dwret = RegOpenKeyExA(HKEY_PERFORMANCE_DATA, "Global", 0, KEY_READ, &hkey); +todo_wine + ok(dwret == ERROR_INVALID_HANDLE, "got %u\n", dwret); + + dwret = RegQueryValueA(HKEY_PERFORMANCE_DATA, "Global", NULL, (LONG *)&cbData); +todo_wine + ok(dwret == ERROR_INVALID_HANDLE, "got %u\n", dwret); + + dwret = RegSetValueA(HKEY_PERFORMANCE_DATA, "Global", REG_SZ, "dummy", 4); +todo_wine + ok(dwret == ERROR_INVALID_HANDLE, "got %u\n", dwret); + + dwret = RegSetValueExA(HKEY_PERFORMANCE_DATA, "Global", 0, REG_SZ, (const BYTE *)"dummy", 40); +todo_wine + ok(dwret == ERROR_INVALID_HANDLE, "got %u\n", dwret); + + cbData = sizeof(buf); + dwret = RegEnumKeyA(HKEY_PERFORMANCE_DATA, 0, (LPSTR)buf, cbData); +todo_wine + ok(dwret == ERROR_INVALID_HANDLE, "got %u\n", dwret); + + cbData = sizeof(buf); + dwret = RegEnumValueA(HKEY_PERFORMANCE_DATA, 0, (LPSTR)buf, &cbData, NULL, NULL, NULL, NULL); +todo_wine + ok(dwret == ERROR_MORE_DATA, "got %u\n", dwret); +todo_wine + ok(cbData == sizeof(buf), "got %u\n", cbData); + + dwret = RegEnumValueA(HKEY_PERFORMANCE_DATA, 0, NULL, &cbData, NULL, NULL, NULL, NULL); + ok(dwret == ERROR_INVALID_PARAMETER, "got %u\n", dwret); + + if (pRegSetKeyValueW) + { + dwret = pRegSetKeyValueW(HKEY_PERFORMANCE_DATA, NULL, globalW, REG_SZ, dummyW, sizeof(dummyW)); +todo_wine + ok(dwret == ERROR_INVALID_HANDLE, "got %u\n", dwret); + } + + dwret = RegCloseKey(HKEY_PERFORMANCE_DATA); + ok(dwret == ERROR_SUCCESS, "got %u\n", dwret); +} START_TEST(registry) { diff --git a/modules/rostests/winetests/advapi32/security.c b/modules/rostests/winetests/advapi32/security.c index d03796964b..7ca17b71e8 100644 --- a/modules/rostests/winetests/advapi32/security.c +++ b/modules/rostests/winetests/advapi32/security.c @@ -89,7 +89,6 @@ static VOID (WINAPI *pBuildTrusteeWithObjectsAndSidA)( PTRUSTEEA pTrustee, PSID pSid ); static LPSTR (WINAPI *pGetTrusteeNameA)( PTRUSTEEA pTrustee ); static BOOL (WINAPI *pMakeSelfRelativeSD)( PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR, LPDWORD ); -static BOOL (WINAPI *pConvertSidToStringSidA)( PSID pSid, LPSTR *str ); static BOOL (WINAPI *pConvertStringSidToSidA)( LPCSTR str, PSID pSid ); static BOOL (WINAPI *pCheckTokenMembership)(HANDLE, PSID, PBOOL); static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorA)(LPCSTR, DWORD, @@ -157,9 +156,8 @@ static const char* debugstr_sid(PSID sid) DWORD le = GetLastError(); char* res = debugsid_str[debugsid_index]; debugsid_index = (debugsid_index + 1) % SID_SLOTS; - if (!pConvertSidToStringSidA) - strcpy(res, "missing ConvertSidToStringSidA"); - else if (!pConvertSidToStringSidA(sid, &sidstr)) + + if (!ConvertSidToStringSidA(sid, &sidstr)) sprintf(res, "ConvertSidToStringSidA failed le=%u", GetLastError()); else if (strlen(sidstr) > sizeof(*debugsid_str) - 1) { @@ -218,14 +216,13 @@ static void init(void) pGetSecurityInfo = (void *)GetProcAddress(hmod, "GetSecurityInfo"); pSetSecurityInfo = (void *)GetProcAddress(hmod, "SetSecurityInfo"); pCreateRestrictedToken = (void *)GetProcAddress(hmod, "CreateRestrictedToken"); - pConvertSidToStringSidA = (void *)GetProcAddress(hmod, "ConvertSidToStringSidA"); pConvertStringSidToSidA = (void *)GetProcAddress(hmod, "ConvertStringSidToSidA"); pGetAclInformation = (void *)GetProcAddress(hmod, "GetAclInformation"); pGetAce = (void *)GetProcAddress(hmod, "GetAce"); pGetWindowsAccountDomainSid = (void *)GetProcAddress(hmod, "GetWindowsAccountDomainSid"); pGetSidIdentifierAuthority = (void *)GetProcAddress(hmod, "GetSidIdentifierAuthority"); - pGetExplicitEntriesFromAclW = (void *)GetProcAddress(hmod, "GetExplicitEntriesFromAclW"); pDuplicateTokenEx = (void *)GetProcAddress(hmod, "DuplicateTokenEx"); + pGetExplicitEntriesFromAclW = (void *)GetProcAddress(hmod, "GetExplicitEntriesFromAclW"); myARGC = winetest_get_mainargs( &myARGV ); } @@ -363,7 +360,7 @@ static void test_sid(void) BOOL r; LPSTR str; - if( !pConvertSidToStringSidA || !pConvertStringSidToSidA ) + if( !pConvertStringSidToSidA ) { win_skip("ConvertSidToStringSidA or ConvertStringSidToSidA not available\n"); return; @@ -407,7 +404,7 @@ static void test_sid(void) r = AllocateAndInitializeSid( &refs[i].auth, 1,1,0,0,0,0,0,0,0, &psid ); ok( r, "failed to allocate sid\n" ); - r = pConvertSidToStringSidA( psid, &str ); + r = ConvertSidToStringSidA( psid, &str ); ok( r, "failed to convert sid\n" ); if (r) { @@ -475,7 +472,7 @@ static void test_sid(void) *GetSidSubAuthority(psid, n) = 0; } - r = pConvertSidToStringSidA(psid, &sid_string); + r = ConvertSidToStringSidA(psid, &sid_string); ok(r, "%s: ConvertSidToStringSid error %u\n", strsid_table[i].str, GetLastError()); if (winetest_debug > 1) trace("%s => %s\n", strsid_table[i].str, sid_string); @@ -484,7 +481,7 @@ static void test_sid(void) r = pCreateWellKnownSid(strsid_table[i].sid_type, domain_sid, buf, &size); ok(r, "%u: CreateWellKnownSid(%u) error %u\n", i, strsid_table[i].sid_type, GetLastError()); - r = pConvertSidToStringSidA(buf, &well_known_sid_string); + r = ConvertSidToStringSidA(buf, &well_known_sid_string); ok(r, "%u: ConvertSidToStringSi(%u) error %u\n", i, strsid_table[i].sid_type, GetLastError()); if (winetest_debug > 1) trace("%u => %s\n", strsid_table[i].sid_type, well_known_sid_string); @@ -1821,12 +1818,6 @@ static void test_token_attr(void) CloseHandle(Token); } - if(!pConvertSidToStringSidA) - { - win_skip("ConvertSidToStringSidA is not available\n"); - return; - } - SetLastError(0xdeadbeef); ret = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &Token); ok(ret, "OpenProcessToken failed with error %d\n", GetLastError()); @@ -1877,7 +1868,7 @@ static void test_token_attr(void) ret = LookupAccountSidA(NULL, Groups->Groups[i].Sid, Name, &NameLength, Domain, &DomainLength, &SidNameUse); if (ret) { - pConvertSidToStringSidA(Groups->Groups[i].Sid, &SidString); + ConvertSidToStringSidA(Groups->Groups[i].Sid, &SidString); trace("%s, %s\\%s use: %d attr: 0x%08x\n", SidString, Domain, Name, SidNameUse, Groups->Groups[i].Attributes); LocalFree(SidString); } @@ -1894,7 +1885,7 @@ static void test_token_attr(void) ok(ret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError()); - pConvertSidToStringSidA(User->User.Sid, &SidString); + ConvertSidToStringSidA(User->User.Sid, &SidString); trace("TokenUser: %s attr: 0x%08x\n", SidString, User->User.Attributes); LocalFree(SidString); HeapFree(GetProcessHeap(), 0, User); @@ -2009,7 +2000,7 @@ typedef union _MAX_SID static void test_sid_str(PSID * sid) { char *str_sid; - BOOL ret = pConvertSidToStringSidA(sid, &str_sid); + BOOL ret = ConvertSidToStringSidA(sid, &str_sid); ok(ret, "ConvertSidToStringSidA() failed: %d\n", GetLastError()); if (ret) { @@ -2126,7 +2117,7 @@ static void test_CreateWellKnownSid(void) ok(pCreateWellKnownSid(i, value->without_domain ? NULL : domainsid, sid_buffer, &cb), "Couldn't create well known sid %u\n", i); expect_eq(GetSidLengthRequired(*GetSidSubAuthorityCount(sid_buffer)), cb, DWORD, "%d"); ok(IsValidSid(sid_buffer), "The sid is not valid\n"); - ok(pConvertSidToStringSidA(sid_buffer, &str), "Couldn't convert SID to string\n"); + ok(ConvertSidToStringSidA(sid_buffer, &str), "Couldn't convert SID to string\n"); ok(strcmp(str, value->sid_string) == 0, "%d: SID mismatch - expected %s, got %s\n", i, value->sid_string, str); LocalFree(str); @@ -2349,7 +2340,7 @@ static void test_LookupAccountSid(void) } HeapFree(GetProcessHeap(), 0, ptiUser); - if (pCreateWellKnownSid && pConvertSidToStringSidA) + if (pCreateWellKnownSid) { trace("Well Known SIDs:\n"); for (i = 0; i <= 84; i++) @@ -2357,7 +2348,7 @@ static void test_LookupAccountSid(void) size = SECURITY_MAX_SID_SIZE; if (pCreateWellKnownSid(i, NULL, &max_sid.sid, &size)) { - if (pConvertSidToStringSidA(&max_sid.sid, &str_sidA)) + if (ConvertSidToStringSidA(&max_sid.sid, &str_sidA)) { acc_sizeA = MAX_PATH; dom_sizeA = MAX_PATH; @@ -3770,7 +3761,6 @@ static void test_CreateDirectoryA(void) ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error); bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation); ok(bret, "GetAclInformation failed\n"); - todo_wine ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n", acl_size.AceCount); LocalFree(pSD); @@ -3905,6 +3895,7 @@ static void test_CreateDirectoryA(void) ok(error == ERROR_SUCCESS, "GetNamedSecurityInfo failed with error %d\n", error); bret = pGetAclInformation(pDacl, &acl_size, sizeof(acl_size), AclSizeInformation); ok(bret, "GetAclInformation failed\n"); + todo_wine ok(acl_size.AceCount == 0, "GetAclInformation returned unexpected entry count (%d != 0).\n", acl_size.AceCount); LocalFree(pSD); @@ -4281,7 +4272,7 @@ static void test_GetNamedSecurityInfoA(void) if (bret) admins_ace_id = i; } ok(users_ace_id != -1 || broken(users_ace_id == -1) /* win2k */, - "Bultin Users ACE not found.\n"); + "Builtin Users ACE not found.\n"); if (users_ace_id != -1) { bret = pGetAce(pDacl, users_ace_id, (VOID **)&ace); @@ -4298,7 +4289,7 @@ static void test_GetNamedSecurityInfoA(void) "Builtin Users ACE has unexpected mask (0x%x != 0x%x)\n", ace->Mask, GENERIC_READ); } - ok(admins_ace_id != -1, "Bultin Admins ACE not found.\n"); + ok(admins_ace_id != -1, "Builtin Admins ACE not found.\n"); if (admins_ace_id != -1) { bret = pGetAce(pDacl, admins_ace_id, (VOID **)&ace); @@ -5309,10 +5300,13 @@ static void test_GetUserNameW(void) static void test_CreateRestrictedToken(void) { + TOKEN_PRIMARY_GROUP *primary_group, *primary_group2; HANDLE process_token, token, r_token; PTOKEN_GROUPS token_groups, groups2; SID_AND_ATTRIBUTES sattr; SECURITY_IMPERSONATION_LEVEL level; + TOKEN_PRIVILEGES *privs; + PRIVILEGE_SET privset; TOKEN_TYPE type; BOOL is_member; DWORD size; @@ -5328,7 +5322,7 @@ static void test_CreateRestrictedToken(void) ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token); ok(ret, "got error %d\n", GetLastError()); - ret = DuplicateTokenEx(process_token, TOKEN_DUPLICATE|TOKEN_ADJUST_GROUPS|TOKEN_QUERY, + ret = DuplicateTokenEx(process_token, TOKEN_DUPLICATE|TOKEN_ADJUST_GROUPS|TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, NULL, SecurityImpersonation, TokenImpersonation, &token); ok(ret, "got error %d\n", GetLastError()); @@ -5359,11 +5353,21 @@ static void test_CreateRestrictedToken(void) ok(ret, "got error %d\n", GetLastError()); ok(is_member, "not a member\n"); - /* disable a SID in new token */ + privset.PrivilegeCount = 1; + privset.Control = PRIVILEGE_SET_ALL_NECESSARY; + ret = LookupPrivilegeValueA(NULL, "SeChangeNotifyPrivilege", &privset.Privilege[0].Luid); + ok(ret, "got error %d\n", GetLastError()); + + is_member = FALSE; + ret = PrivilegeCheck(token, &privset, &is_member); + ok(ret, "got error %d\n", GetLastError()); + ok(is_member, "Expected SeChangeNotifyPrivilege to be enabled\n"); + + /* disable a SID and a privilege in new token */ sattr.Sid = token_groups->Groups[i].Sid; sattr.Attributes = 0; r_token = NULL; - ret = pCreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token); + ret = pCreateRestrictedToken(token, 0, 1, &sattr, 1, &privset.Privilege[0], 0, NULL, &r_token); ok(ret, "got error %d\n", GetLastError()); if (ret) @@ -5372,7 +5376,7 @@ static void test_CreateRestrictedToken(void) is_member = TRUE; ret = pCheckTokenMembership(r_token, token_groups->Groups[i].Sid, &is_member); ok(ret, "got error %d\n", GetLastError()); - todo_wine ok(!is_member, "not a member\n"); + ok(!is_member, "not a member\n"); ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", @@ -5387,9 +5391,9 @@ static void test_CreateRestrictedToken(void) break; } - todo_wine ok(groups2->Groups[j].Attributes & SE_GROUP_USE_FOR_DENY_ONLY, + ok(groups2->Groups[j].Attributes & SE_GROUP_USE_FOR_DENY_ONLY, "got wrong attributes\n"); - todo_wine ok((groups2->Groups[j].Attributes & SE_GROUP_ENABLED) == 0, + ok((groups2->Groups[j].Attributes & SE_GROUP_ENABLED) == 0, "got wrong attributes\n"); HeapFree(GetProcessHeap(), 0, groups2); @@ -5403,10 +5407,73 @@ static void test_CreateRestrictedToken(void) ret = GetTokenInformation(r_token, TokenImpersonationLevel, &level, size, &size); ok(ret, "got error %d\n", GetLastError()); ok(level == SecurityImpersonation, "got level %u\n", type); + + is_member = TRUE; + ret = PrivilegeCheck(r_token, &privset, &is_member); + ok(ret, "got error %d\n", GetLastError()); + ok(!is_member, "Expected SeChangeNotifyPrivilege not to be enabled\n"); + + ret = GetTokenInformation(r_token, TokenPrivileges, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", + ret, GetLastError()); + privs = HeapAlloc(GetProcessHeap(), 0, size); + ret = GetTokenInformation(r_token, TokenPrivileges, privs, size, &size); + ok(ret, "got error %d\n", GetLastError()); + + is_member = FALSE; + for (j = 0; j < privs->PrivilegeCount; j++) + { + if (RtlEqualLuid(&privs->Privileges[j].Luid, &privset.Privilege[0].Luid)) + { + is_member = TRUE; + break; + } + } + + ok(!is_member, "Expected not to find privilege\n"); + HeapFree(GetProcessHeap(), 0, privs); } HeapFree(GetProcessHeap(), 0, token_groups); CloseHandle(r_token); + + ret = GetTokenInformation(token, TokenPrimaryGroup, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", + ret, GetLastError()); + primary_group = HeapAlloc(GetProcessHeap(), 0, size); + ret = GetTokenInformation(token, TokenPrimaryGroup, primary_group, size, &size); + ok(ret, "got error %d\n", GetLastError()); + + /* disable primary group */ + sattr.Sid = primary_group->PrimaryGroup; + sattr.Attributes = 0; + r_token = NULL; + ret = pCreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token); + ok(ret, "got error %d\n", GetLastError()); + + if (ret) + { + is_member = TRUE; + ret = pCheckTokenMembership(r_token, primary_group->PrimaryGroup, &is_member); + ok(ret, "got error %d\n", GetLastError()); + ok(!is_member, "not a member\n"); + + ret = GetTokenInformation(r_token, TokenPrimaryGroup, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n", + ret, GetLastError()); + primary_group2 = HeapAlloc(GetProcessHeap(), 0, size); + ret = GetTokenInformation(r_token, TokenPrimaryGroup, primary_group2, size, &size); + ok(ret, "got error %d\n", GetLastError()); + + ok(EqualSid(primary_group2->PrimaryGroup, primary_group->PrimaryGroup), + "Expected same primary group\n"); + + HeapFree(GetProcessHeap(), 0, primary_group2); + } + + HeapFree(GetProcessHeap(), 0, primary_group); + CloseHandle(r_token); + CloseHandle(token); CloseHandle(process_token); } @@ -6189,7 +6256,8 @@ static void test_process_access(void) case GENERIC_WRITE: ok(access == map[i].mapped || access == (map[i].mapped | PROCESS_TERMINATE) /* before Vista */ || - access == (map[i].mapped | PROCESS_SET_LIMITED_INFORMATION) /* win8 */, + access == (map[i].mapped | PROCESS_SET_LIMITED_INFORMATION) /* win8 */ || + access == (map[i].mapped | PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_SET_LIMITED_INFORMATION) /* Win10 Anniversary Update */, "%d: expected %#x, got %#x\n", i, map[i].mapped, access); break; case GENERIC_EXECUTE: @@ -6411,7 +6479,7 @@ static void test_default_dacl_owner_sid(void) static void test_AdjustTokenPrivileges(void) { - TOKEN_PRIVILEGES tp, prev; + TOKEN_PRIVILEGES tp; HANDLE token; DWORD len; LUID luid; @@ -6439,7 +6507,8 @@ static void test_AdjustTokenPrivileges(void) tp.PrivilegeCount = 1; tp.Privileges[0].Luid = luid; tp.Privileges[0].Attributes = 0; - AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), &prev, NULL); + ret = AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL); + ok(ret, "got %d\n", ret); CloseHandle(token); } @@ -6495,18 +6564,19 @@ static void test_AddMandatoryAce(void) {SECURITY_MANDATORY_LOW_RID}}; static SID medium_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, {SECURITY_MANDATORY_MEDIUM_RID}}; - static SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, - {SECURITY_MANDATORY_HIGH_RID}}; - SYSTEM_MANDATORY_LABEL_ACE *ace; + static SID_IDENTIFIER_AUTHORITY sia_world = {SECURITY_WORLD_SID_AUTHORITY}; char buffer_sd[SECURITY_DESCRIPTOR_MIN_LENGTH]; SECURITY_DESCRIPTOR *sd2, *sd = (SECURITY_DESCRIPTOR *)&buffer_sd; - SECURITY_ATTRIBUTES sa; - char buffer_acl[256]; - ACL *pAcl = (ACL *)&buffer_acl; - ACL *sAcl; BOOL defaulted, present, ret, found, found2; - HANDLE handle; + ACL_SIZE_INFORMATION acl_size_info; + SYSTEM_MANDATORY_LABEL_ACE *ace; + char buffer_acl[256]; + ACL *acl = (ACL *)&buffer_acl; + SECURITY_ATTRIBUTES sa; DWORD index, size; + HANDLE handle; + SID *everyone; + ACL *sacl; if (!pAddMandatoryAce) { @@ -6515,50 +6585,48 @@ static void test_AddMandatoryAce(void) } ret = InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION); - ok(ret, "InitializeSecurityDescriptor failed with %u\n", GetLastError()); + ok(ret, "InitializeSecurityDescriptor failed with error %u\n", GetLastError()); - sa.nLength = sizeof(SECURITY_ATTRIBUTES); + sa.nLength = sizeof(sa); sa.lpSecurityDescriptor = sd; - sa.bInheritHandle = FALSE; + sa.bInheritHandle = FALSE; handle = CreateEventA(&sa, TRUE, TRUE, "test_event"); ok(handle != NULL, "CreateEventA failed with error %u\n", GetLastError()); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); sd2 = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, sd2, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - sAcl = (void *)0xdeadbeef; + sacl = (void *)0xdeadbeef; present = TRUE; - defaulted = TRUE; - ret = GetSecurityDescriptorSacl(sd2, &present, &sAcl, &defaulted); - ok(ret, "GetSecurityDescriptorSacl failed with %u\n", GetLastError()); - ok(!present, "sAcl is present\n"); - ok(sAcl == (void *)0xdeadbeef, "sAcl is set\n"); - todo_wine ok(!defaulted, "sAcl defaulted\n"); + ret = GetSecurityDescriptorSacl(sd2, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(!present, "SACL is present\n"); + ok(sacl == (void *)0xdeadbeef, "SACL is set\n"); HeapFree(GetProcessHeap(), 0, sd2); CloseHandle(handle); - ret = InitializeAcl(pAcl, 256, ACL_REVISION); + ret = InitializeAcl(acl, 256, ACL_REVISION); ok(ret, "InitializeAcl failed with %u\n", GetLastError()); SetLastError(0xdeadbeef); - ret = pAddMandatoryAce(pAcl, ACL_REVISION, 0, 0x1234, &low_level); + ret = pAddMandatoryAce(acl, ACL_REVISION, 0, 0x1234, &low_level); ok(!ret, "AddMandatoryAce succeeded\n"); ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER got %u\n", GetLastError()); - ret = pAddMandatoryAce(pAcl, ACL_REVISION, 0, SYSTEM_MANDATORY_LABEL_NO_WRITE_UP, &low_level); + ret = pAddMandatoryAce(acl, ACL_REVISION, 0, SYSTEM_MANDATORY_LABEL_NO_WRITE_UP, &low_level); ok(ret, "AddMandatoryAce failed with %u\n", GetLastError()); index = 0; found = FALSE; - while (pGetAce( pAcl, index++, (void **)&ace )) + while (pGetAce(acl, index++, (void **)&ace)) { if (ace->Header.AceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue; ok(ace->Header.AceFlags == 0, "Expected flags 0, got %x\n", ace->Header.AceFlags); @@ -6569,192 +6637,184 @@ static void test_AddMandatoryAce(void) } ok(found, "Could not find mandatory label ace\n"); - ret = SetSecurityDescriptorSacl(sd, TRUE, pAcl, FALSE); - ok(ret, "SetSecurityDescriptorSacl failed with %u\n", GetLastError()); + ret = SetSecurityDescriptorSacl(sd, TRUE, acl, FALSE); + ok(ret, "SetSecurityDescriptorSacl failed with error %u\n", GetLastError()); handle = CreateEventA(&sa, TRUE, TRUE, "test_event"); ok(handle != NULL, "CreateEventA failed with error %u\n", GetLastError()); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); sd2 = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, sd2, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - sAcl = (void *)0xdeadbeef; + sacl = (void *)0xdeadbeef; present = FALSE; defaulted = TRUE; - ret = GetSecurityDescriptorSacl(sd2, &present, &sAcl, &defaulted); - ok(ret, "GetSecurityDescriptorSacl failed with %u\n", GetLastError()); - ok(present, "sAcl not present\n"); - ok(sAcl != (void *)0xdeadbeef, "sAcl not set\n"); - ok(!defaulted, "sAcl defaulted\n"); - - index = 0; - found = FALSE; - while (pGetAce( sAcl, index++, (void **)&ace )) - { - if (ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) - { - found = TRUE; - ok(ace->Header.AceFlags == 0, "Expected 0 as flags, got %x\n", ace->Header.AceFlags); - ok(ace->Mask == SYSTEM_MANDATORY_LABEL_NO_WRITE_UP, - "Expected SYSTEM_MANDATORY_LABEL_NO_WRITE_UP as flag, got %x\n", ace->Mask); - ok(EqualSid(&ace->SidStart, &low_level), "Expected low integrity level\n"); - } - } - ok(found, "Could not find mandatory label\n"); + ret = GetSecurityDescriptorSacl(sd2, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "SACL not present\n"); + ok(sacl != (void *)0xdeadbeef, "SACL not set\n"); + ok(!defaulted, "SACL defaulted\n"); + ret = pGetAclInformation(sacl, &acl_size_info, sizeof(acl_size_info), AclSizeInformation); + ok(ret, "GetAclInformation failed with error %u\n", GetLastError()); + ok(acl_size_info.AceCount == 1, "SACL contains an unexpected ACE count %u\n", acl_size_info.AceCount); + + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok (ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(!ace->Header.AceFlags, "Unexpected ACE flags %#x\n", ace->Header.AceFlags); + ok(ace->Mask == SYSTEM_MANDATORY_LABEL_NO_WRITE_UP, "Unexpected ACE mask %#x\n", ace->Mask); + ok(EqualSid(&ace->SidStart, &low_level), "Expected low integrity level\n"); HeapFree(GetProcessHeap(), 0, sd2); - ret = pAddMandatoryAce(pAcl, ACL_REVISION, 0, SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP, &medium_level); - ok(ret, "AddMandatoryAce failed with %u\n", GetLastError()); + ret = pAddMandatoryAce(acl, ACL_REVISION, 0, SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP, &medium_level); + ok(ret, "AddMandatoryAce failed with error %u\n", GetLastError()); ret = SetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, sd); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "SetKernelObjectSecurity failed with error %u\n", GetLastError()); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); sd2 = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, sd2, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - sAcl = (void *)0xdeadbeef; + sacl = (void *)0xdeadbeef; present = FALSE; defaulted = TRUE; - ret = GetSecurityDescriptorSacl(sd2, &present, &sAcl, &defaulted); - ok(ret, "GetSecurityDescriptorSacl failed with %u\n", GetLastError()); - ok(present, "sAcl not present\n"); - ok(sAcl != (void *)0xdeadbeef, "sAcl not set\n"); - ok(sAcl->AceCount == 2, "Expected 2 ACEs, got %d\n", sAcl->AceCount); - ok(!defaulted, "sAcl defaulted\n"); + ret = GetSecurityDescriptorSacl(sd2, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "SACL not present\n"); + ok(sacl != (void *)0xdeadbeef, "SACL not set\n"); + ok(sacl->AceCount == 2, "Expected 2 ACEs, got %d\n", sacl->AceCount); + ok(!defaulted, "SACL defaulted\n"); index = 0; found = found2 = FALSE; - while (pGetAce( sAcl, index++, (void **)&ace )) + while (pGetAce(sacl, index++, (void **)&ace)) { if (ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE) { if (EqualSid(&ace->SidStart, &low_level)) { found = TRUE; - ok(ace->Header.AceFlags == 0, "Expected 0 as flags, got %x\n", ace->Header.AceFlags); + ok(!ace->Header.AceFlags, "Expected 0 as flags, got %#x\n", ace->Header.AceFlags); ok(ace->Mask == SYSTEM_MANDATORY_LABEL_NO_WRITE_UP, - "Expected SYSTEM_MANDATORY_LABEL_NO_WRITE_UP as flag, got %x\n", ace->Mask); + "Expected SYSTEM_MANDATORY_LABEL_NO_WRITE_UP as mask, got %#x\n", ace->Mask); } if (EqualSid(&ace->SidStart, &medium_level)) { found2 = TRUE; - ok(ace->Header.AceFlags == 0, "Expected 0 as flags, got %x\n", ace->Header.AceFlags); + ok(!ace->Header.AceFlags, "Expected 0 as flags, got %#x\n", ace->Header.AceFlags); ok(ace->Mask == SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP, - "Expected SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP as flag, got %x\n", ace->Mask); + "Expected SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP as mask, got %#x\n", ace->Mask); } } } ok(found, "Could not find low mandatory label\n"); ok(found2, "Could not find medium mandatory label\n"); - HeapFree( GetProcessHeap(), 0, sd2); + HeapFree(GetProcessHeap(), 0, sd2); ret = SetSecurityDescriptorSacl(sd, FALSE, NULL, FALSE); - ok(ret, "SetSecurityDescriptorSacl failed with %u\n", GetLastError()); + ok(ret, "SetSecurityDescriptorSacl failed with error %u\n", GetLastError()); ret = SetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, sd); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "SetKernelObjectSecurity failed with error %u\n", GetLastError()); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); sd2 = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, sd2, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - sAcl = (void *)0xdeadbeef; + sacl = (void *)0xdeadbeef; present = FALSE; defaulted = TRUE; - ret = GetSecurityDescriptorSacl(sd2, &present, &sAcl, &defaulted); - ok(ret, "GetSecurityDescriptorSacl failed with %u\n", GetLastError()); - ok(present, "sAcl not present\n"); - ok(sAcl != (void *)0xdeadbeef, "sAcl not set\n"); - ok(sAcl->AceCount == 0, "Expected 0 ACEs, got %d\n", sAcl->AceCount); - ok(!defaulted, "sAcl defaulted\n"); + ret = GetSecurityDescriptorSacl(sd2, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "SACL not present\n"); + ok(sacl && sacl != (void *)0xdeadbeef, "SACL not set\n"); + ok(!defaulted, "SACL defaulted\n"); + ok(!sacl->AceCount, "SACL contains an unexpected ACE count %u\n", sacl->AceCount); HeapFree(GetProcessHeap(), 0, sd2); - ret = InitializeAcl(pAcl, 256, ACL_REVISION); - ok(ret, "InitializeAcl failed with %u\n", GetLastError()); + ret = InitializeAcl(acl, 256, ACL_REVISION); + ok(ret, "InitializeAcl failed with error %u\n", GetLastError()); - ret = pAddMandatoryAce(pAcl, ACL_REVISION3, 0, SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP, &medium_level); - ok(ret, "AddMandatoryAce failed with %u\n", GetLastError()); + ret = pAddMandatoryAce(acl, ACL_REVISION3, 0, SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP, &medium_level); + ok(ret, "AddMandatoryAce failed with error %u\n", GetLastError()); - ret = SetSecurityDescriptorSacl(sd, TRUE, pAcl, FALSE); - ok(ret, "SetSecurityDescriptorSacl failed with %u\n", GetLastError()); + ret = SetSecurityDescriptorSacl(sd, TRUE, acl, FALSE); + ok(ret, "SetSecurityDescriptorSacl failed with error %u\n", GetLastError()); ret = SetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, sd); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "SetKernelObjectSecurity failed with error %u\n", GetLastError()); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); sd2 = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, sd2, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - sAcl = (void *)0xdeadbeef; + sacl = (void *)0xdeadbeef; present = FALSE; defaulted = TRUE; - ret = GetSecurityDescriptorSacl(sd2, &present, &sAcl, &defaulted); - ok(ret, "GetSecurityDescriptorSacl failed with %u\n", GetLastError()); - ok(present, "sAcl not present\n"); - ok(sAcl != (void *)0xdeadbeef, "sAcl not set\n"); - ok(sAcl->AclRevision == ACL_REVISION3, "Expected revision 3, got %d\n", sAcl->AclRevision); - ok(!defaulted, "sAcl defaulted\n"); + ret = GetSecurityDescriptorSacl(sd2, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "SACL not present\n"); + ok(sacl != (void *)0xdeadbeef, "SACL not set\n"); + ok(sacl->AclRevision == ACL_REVISION3, "Expected revision 3, got %d\n", sacl->AclRevision); + ok(!defaulted, "SACL defaulted\n"); HeapFree(GetProcessHeap(), 0, sd2); - CloseHandle(handle); - ret = OpenProcessToken(GetCurrentProcess(), READ_CONTROL, &handle); - ok(ret, "got %d with %d (expected TRUE)\n", ret, GetLastError()); + ret = InitializeAcl(acl, 256, ACL_REVISION); + ok(ret, "InitializeAcl failed with error %u\n", GetLastError()); + + ret = AllocateAndInitializeSid(&sia_world, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, (void **)&everyone); + ok(ret, "AllocateAndInitializeSid failed with error %u\n", GetLastError()); + + ret = AddAccessAllowedAce(acl, ACL_REVISION, KEY_READ, everyone); + ok(ret, "AddAccessAllowedAce failed with error %u\n", GetLastError()); + + ret = SetSecurityDescriptorSacl(sd, TRUE, acl, FALSE); + ok(ret, "SetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + + ret = SetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, sd); + ok(ret, "SetKernelObjectSecurity failed with error %u\n", GetLastError()); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); sd2 = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(handle, LABEL_SECURITY_INFORMATION, sd2, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - sAcl = (void *)0xdeadbeef; + sacl = (void *)0xdeadbeef; present = FALSE; defaulted = TRUE; - ret = GetSecurityDescriptorSacl(sd2, &present, &sAcl, &defaulted); - ok(ret, "GetSecurityDescriptorSacl failed with %u\n", GetLastError()); - ok(present, "sAcl not present\n"); - ok(sAcl != (void *)0xdeadbeef, "sAcl not set\n"); - ok(sAcl->AceCount == 1, "Expected 1 ACEs, got %d\n", sAcl->AceCount); - ok(!defaulted, "sAcl defaulted\n"); - - index = 0; - found = FALSE; - while (pGetAce( sAcl, index++, (void **)&ace )) - { - if (ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE && - (EqualSid(&ace->SidStart, &medium_level) || EqualSid(&ace->SidStart, &high_level))) - { - found = TRUE; - ok(ace->Header.AceFlags == 0, "Expected 0 as flags, got %x\n", ace->Header.AceFlags); - ok(ace->Mask == SYSTEM_MANDATORY_LABEL_NO_WRITE_UP, - "Expected SYSTEM_MANDATORY_LABEL_NO_WRITE_UP as flag, got %x\n", ace->Mask); - } - } - ok(found, "Could not find medium/high mandatory label\n"); - + ret = GetSecurityDescriptorSacl(sd2, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "SACL not present\n"); + ok(sacl && sacl != (void *)0xdeadbeef, "SACL not set\n"); + ok(!defaulted, "SACL defaulted\n"); + ok(!sacl->AceCount, "SACL contains an unexpected ACE count %u\n", sacl->AceCount); + + FreeSid(everyone); HeapFree(GetProcessHeap(), 0, sd2); CloseHandle(handle); } @@ -7054,164 +7114,113 @@ static void test_maximum_allowed(void) CloseHandle(handle); } -static void test_GetExplicitEntriesFromAclW(void) +static void test_token_label(void) { - static const WCHAR wszCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'}; - SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY }; - SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY }; - PSID everyone_sid = NULL, users_sid = NULL; - EXPLICIT_ACCESSW access; - EXPLICIT_ACCESSW *access2; - PACL new_acl, old_acl = NULL; - ULONG count; - DWORD res; - - if (!pGetExplicitEntriesFromAclW) - { - win_skip("GetExplicitEntriesFromAclW is not available\n"); - return; - } - - if (!pSetEntriesInAclW) - { - win_skip("SetEntriesInAclW is not available\n"); - return; - } - - old_acl = HeapAlloc(GetProcessHeap(), 0, 256); - res = InitializeAcl(old_acl, 256, ACL_REVISION); - if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED) - { - win_skip("ACLs not implemented - skipping tests\n"); - HeapFree(GetProcessHeap(), 0, old_acl); - return; - } - ok(res, "InitializeAcl failed with error %d\n", GetLastError()); - - res = AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &everyone_sid); - ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError()); + static SID medium_sid = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, + {SECURITY_MANDATORY_MEDIUM_RID}}; + static SID high_sid = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, + {SECURITY_MANDATORY_HIGH_RID}}; + SECURITY_DESCRIPTOR_CONTROL control; + SYSTEM_MANDATORY_LABEL_ACE *ace; + BOOL ret, present, defaulted; + SECURITY_DESCRIPTOR *sd; + ACL *sacl = NULL, *dacl; + DWORD size, revision; + HANDLE token; + char *str; + SID *sid; - res = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID, - DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &users_sid); - ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError()); + ret = OpenProcessToken(GetCurrentProcess(), READ_CONTROL | WRITE_OWNER, &token); + ok(ret, "OpenProcessToken failed with error %u\n", GetLastError()); - res = AddAccessAllowedAce(old_acl, ACL_REVISION, KEY_READ, users_sid); - ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError()); + ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); - access2 = NULL; - res = pGetExplicitEntriesFromAclW(old_acl, &count, &access2); - ok(res == ERROR_SUCCESS, "GetExplicitEntriesFromAclW failed with error %d\n", GetLastError()); - ok(count == 1, "Expected count == 1, got %d\n", count); - ok(access2[0].grfAccessMode == GRANT_ACCESS, "Expected GRANT_ACCESS, got %d\n", access2[0].grfAccessMode); - ok(access2[0].grfAccessPermissions == KEY_READ, "Expected KEY_READ, got %d\n", access2[0].grfAccessPermissions); - ok(access2[0].Trustee.TrusteeForm == TRUSTEE_IS_SID, "Expected SID trustee, got %d\n", access2[0].Trustee.TrusteeForm); - ok(access2[0].grfInheritance == NO_INHERITANCE, "Expected NO_INHERITANCE, got %x\n", access2[0].grfInheritance); - ok(EqualSid(access2[0].Trustee.ptstrName, users_sid), "Expected equal SIDs\n"); - LocalFree(access2); + sd = HeapAlloc(GetProcessHeap(), 0, size); + ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - access.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; - access.Trustee.pMultipleTrustee = NULL; + ret = GetSecurityDescriptorControl(sd, &control, &revision); + ok(ret, "GetSecurityDescriptorControl failed with error %u\n", GetLastError()); + todo_wine ok(control == (SE_SELF_RELATIVE | SE_SACL_AUTO_INHERITED | SE_SACL_PRESENT) || + broken(control == SE_SELF_RELATIVE) /* WinXP, Win2003 */, + "Unexpected security descriptor control %#x\n", control); + ok(revision == 1, "Unexpected security descriptor revision %u\n", revision); - access.grfAccessPermissions = KEY_WRITE; - access.grfAccessMode = GRANT_ACCESS; - access.grfInheritance = NO_INHERITANCE; - access.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP; - access.Trustee.TrusteeForm = TRUSTEE_IS_SID; - access.Trustee.ptstrName = everyone_sid; - res = pSetEntriesInAclW(1, &access, old_acl, &new_acl); - ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res); - ok(new_acl != NULL, "returned acl was NULL\n"); + sid = (void *)0xdeadbeef; + defaulted = TRUE; + ret = GetSecurityDescriptorOwner(sd, (void **)&sid, &defaulted); + ok(ret, "GetSecurityDescriptorOwner failed with error %u\n", GetLastError()); + ok(!sid, "Owner present\n"); + ok(!defaulted, "Owner defaulted\n"); - access2 = NULL; - res = pGetExplicitEntriesFromAclW(new_acl, &count, &access2); - ok(res == ERROR_SUCCESS, "GetExplicitEntriesFromAclW failed with error %d\n", GetLastError()); - ok(count == 2, "Expected count == 2, got %d\n", count); - ok(access2[0].grfAccessMode == GRANT_ACCESS, "Expected GRANT_ACCESS, got %d\n", access2[0].grfAccessMode); - ok(access2[0].grfAccessPermissions == KEY_WRITE, "Expected KEY_WRITE, got %d\n", access2[0].grfAccessPermissions); - ok(access2[0].Trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, - "Expected TRUSTEE_IS_UNKNOWN trustee type, got %d\n", access2[0].Trustee.TrusteeType); - ok(access2[0].Trustee.TrusteeForm == TRUSTEE_IS_SID, "Expected SID trustee, got %d\n", access2[0].Trustee.TrusteeForm); - ok(access2[0].grfInheritance == NO_INHERITANCE, "Expected NO_INHERITANCE, got %x\n", access2[0].grfInheritance); - ok(EqualSid(access2[0].Trustee.ptstrName, everyone_sid), "Expected equal SIDs\n"); - LocalFree(access2); - LocalFree(new_acl); + sid = (void *)0xdeadbeef; + defaulted = TRUE; + ret = GetSecurityDescriptorGroup(sd, (void **)&sid, &defaulted); + ok(ret, "GetSecurityDescriptorGroup failed with error %u\n", GetLastError()); + ok(!sid, "Group present\n"); + ok(!defaulted, "Group defaulted\n"); - access.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN; - res = pSetEntriesInAclW(1, &access, old_acl, &new_acl); - ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res); - ok(new_acl != NULL, "returned acl was NULL\n"); + ret = GetSecurityDescriptorSacl(sd, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present || broken(!present) /* WinXP, Win2003 */, "No SACL in the security descriptor\n"); + ok(sacl || broken(!sacl) /* WinXP, Win2003 */, "NULL SACL in the security descriptor\n"); - access2 = NULL; - res = pGetExplicitEntriesFromAclW(new_acl, &count, &access2); - ok(res == ERROR_SUCCESS, "GetExplicitEntriesFromAclW failed with error %d\n", GetLastError()); - ok(count == 2, "Expected count == 2, got %d\n", count); - ok(access2[0].grfAccessMode == GRANT_ACCESS, "Expected GRANT_ACCESS, got %d\n", access2[0].grfAccessMode); - ok(access2[0].grfAccessPermissions == KEY_WRITE, "Expected KEY_WRITE, got %d\n", access2[0].grfAccessPermissions); - ok(access2[0].Trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, - "Expected TRUSTEE_IS_UNKNOWN trustee type, got %d\n", access2[0].Trustee.TrusteeType); - ok(access2[0].Trustee.TrusteeForm == TRUSTEE_IS_SID, "Expected SID trustee, got %d\n", access2[0].Trustee.TrusteeForm); - ok(access2[0].grfInheritance == NO_INHERITANCE, "Expected NO_INHERITANCE, got %x\n", access2[0].grfInheritance); - ok(EqualSid(access2[0].Trustee.ptstrName, everyone_sid), "Expected equal SIDs\n"); - LocalFree(access2); - LocalFree(new_acl); + if (present) + { + ok(!defaulted, "SACL defaulted\n"); + ok(sacl->AceCount == 1, "SACL contains an unexpected ACE count %u\n", sacl->AceCount); - access.Trustee.TrusteeForm = TRUSTEE_IS_NAME; - access.Trustee.ptstrName = (LPWSTR)wszCurrentUser; - res = pSetEntriesInAclW(1, &access, old_acl, &new_acl); - ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res); - ok(new_acl != NULL, "returned acl was NULL\n"); + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); - access2 = NULL; - res = pGetExplicitEntriesFromAclW(new_acl, &count, &access2); - ok(res == ERROR_SUCCESS, "GetExplicitEntriesFromAclW failed with error %d\n", GetLastError()); - ok(count == 2, "Expected count == 2, got %d\n", count); - ok(access2[0].grfAccessMode == GRANT_ACCESS, "Expected GRANT_ACCESS, got %d\n", access2[0].grfAccessMode); - ok(access2[0].grfAccessPermissions == KEY_WRITE, "Expected KEY_WRITE, got %d\n", access2[0].grfAccessPermissions); - ok(access2[0].Trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, - "Expected TRUSTEE_IS_UNKNOWN trustee type, got %d\n", access2[0].Trustee.TrusteeType); - ok(access2[0].Trustee.TrusteeForm == TRUSTEE_IS_SID, "Expected SID trustee, got %d\n", access2[0].Trustee.TrusteeForm); - ok(access2[0].grfInheritance == NO_INHERITANCE, "Expected NO_INHERITANCE, got %x\n", access2[0].grfInheritance); - LocalFree(access2); - LocalFree(new_acl); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(!ace->Header.AceFlags, "Unexpected ACE flags %#x\n", ace->Header.AceFlags); + ok(ace->Header.AceSize, "Unexpected ACE size %u\n", ace->Header.AceSize); + ok(ace->Mask == SYSTEM_MANDATORY_LABEL_NO_WRITE_UP, "Unexpected ACE mask %#x\n", ace->Mask); - access.grfAccessMode = REVOKE_ACCESS; - access.Trustee.TrusteeForm = TRUSTEE_IS_SID; - access.Trustee.ptstrName = users_sid; - res = pSetEntriesInAclW(1, &access, old_acl, &new_acl); - ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res); - ok(new_acl != NULL, "returned acl was NULL\n"); + sid = (SID *)&ace->SidStart; + ConvertSidToStringSidA(sid, &str); + ok(EqualSid(sid, &medium_sid) || EqualSid(sid, &high_sid), "Got unexpected SID %s\n", str); + LocalFree(str); + } - access2 = (void *)0xdeadbeef; - res = pGetExplicitEntriesFromAclW(new_acl, &count, &access2); - ok(res == ERROR_SUCCESS, "GetExplicitEntriesFromAclW failed with error %d\n", GetLastError()); - ok(count == 0, "Expected count == 0, got %d\n", count); - ok(access2 == NULL, "access2 was not NULL\n"); - LocalFree(new_acl); + ret = GetSecurityDescriptorDacl(sd, &present, &dacl, &defaulted); + ok(ret, "GetSecurityDescriptorDacl failed with error %u\n", GetLastError()); + todo_wine ok(!present, "DACL present\n"); - FreeSid(users_sid); - FreeSid(everyone_sid); - HeapFree(GetProcessHeap(), 0, old_acl); + HeapFree(GetProcessHeap(), 0, sd); + CloseHandle(token); } static void test_token_security_descriptor(void) { static SID low_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, - {SECURITY_MANDATORY_LOW_RID}}; - ACCESS_ALLOWED_ACE *ace; + {SECURITY_MANDATORY_LOW_RID}}; + static SID medium_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, + {SECURITY_MANDATORY_MEDIUM_RID}}; + static SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, + {SECURITY_MANDATORY_HIGH_RID}}; char buffer_sd[SECURITY_DESCRIPTOR_MIN_LENGTH]; - SECURITY_DESCRIPTOR *sd = (SECURITY_DESCRIPTOR *)&buffer_sd, *sd2; + SECURITY_DESCRIPTOR *sd = (SECURITY_DESCRIPTOR *)&buffer_sd, *sd2, *sd3; char buffer_acl[256], buffer[MAX_PATH]; - ACL *pAcl = (ACL *)&buffer_acl, *pAcl2, *pAclChild; + ACL *acl = (ACL *)&buffer_acl, *acl2, *acl_child, *sacl; BOOL defaulted, present, ret, found; - HANDLE token, token2, token3; + HANDLE token, token2, token3, token4, token5, token6; EXPLICIT_ACCESSW exp_access; + TOKEN_MANDATORY_LABEL *tml; + BYTE buffer_integrity[64]; PROCESS_INFORMATION info; - SECURITY_ATTRIBUTES sa; DWORD size, index, retd; + ACCESS_ALLOWED_ACE *ace; + SECURITY_ATTRIBUTES sa; STARTUPINFOA startup; PSID psid; - if (!pDuplicateTokenEx || !pConvertStringSidToSidA || !pAddAccessAllowedAceEx || !pGetAce || !pSetEntriesInAclW) + if (!pDuplicateTokenEx || !pConvertStringSidToSidA || !pAddAccessAllowedAceEx || !pGetAce + || !pSetEntriesInAclW) { win_skip("Some functions not available\n"); return; @@ -7222,131 +7231,109 @@ static void test_token_security_descriptor(void) ok(ret, "OpenProcessToken failed with error %u\n", GetLastError()); ret = InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION); - ok(ret, "InitializeSecurityDescriptor failed with %u\n", GetLastError()); + ok(ret, "InitializeSecurityDescriptor failed with error %u\n", GetLastError()); - ret = InitializeAcl(pAcl, 256, ACL_REVISION); - ok(ret, "InitializeAcl failed with %u\n", GetLastError()); + ret = InitializeAcl(acl, 256, ACL_REVISION); + ok(ret, "InitializeAcl failed with error %u\n", GetLastError()); ret = pConvertStringSidToSidA("S-1-5-6", &psid); - ok(ret, "ConvertStringSidToSidA failed with %u\n", GetLastError()); + ok(ret, "ConvertStringSidToSidA failed with error %u\n", GetLastError()); - ret = pAddAccessAllowedAceEx(pAcl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, GENERIC_ALL, psid); - ok(ret, "AddAccessAllowedAceEx failed with %u\n", GetLastError()); + ret = pAddAccessAllowedAceEx(acl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, GENERIC_ALL, psid); + ok(ret, "AddAccessAllowedAceEx failed with error %u\n", GetLastError()); - ret = SetSecurityDescriptorDacl(sd, TRUE, pAcl, FALSE); - ok(ret, "SetSecurityDescriptorDacl failed with %u\n", GetLastError()); + ret = SetSecurityDescriptorDacl(sd, TRUE, acl, FALSE); + ok(ret, "SetSecurityDescriptorDacl failed with error %u\n", GetLastError()); - sa.nLength = sizeof(SECURITY_ATTRIBUTES); + sa.nLength = sizeof(SECURITY_ATTRIBUTES); sa.lpSecurityDescriptor = sd; - sa.bInheritHandle = FALSE; + sa.bInheritHandle = FALSE; ret = pDuplicateTokenEx(token, MAXIMUM_ALLOWED, &sa, SecurityImpersonation, TokenImpersonation, &token2); - ok(ret, "DuplicateTokenEx failed with %u\n", GetLastError()); + ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError()); ret = GetKernelObjectSecurity(token2, DACL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); sd2 = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(token2, DACL_SECURITY_INFORMATION, sd2, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - pAcl2 = (void *)0xdeadbeef; + acl2 = (void *)0xdeadbeef; present = FALSE; defaulted = TRUE; - ret = GetSecurityDescriptorDacl(sd2, &present, &pAcl2, &defaulted); - ok(ret, "GetSecurityDescriptorDacl failed with %u\n", GetLastError()); - ok(present, "pAcl2 not present\n"); - ok(pAcl2 != (void *)0xdeadbeef, "pAcl2 not set\n"); - ok(pAcl2->AceCount == 1, "Expected 1 ACEs, got %d\n", pAcl2->AceCount); - ok(!defaulted, "pAcl2 defaulted\n"); + ret = GetSecurityDescriptorDacl(sd2, &present, &acl2, &defaulted); + ok(ret, "GetSecurityDescriptorDacl failed with error %u\n", GetLastError()); + ok(present, "acl2 not present\n"); + ok(acl2 != (void *)0xdeadbeef, "acl2 not set\n"); + ok(acl2->AceCount == 1, "Expected 1 ACE, got %d\n", acl2->AceCount); + ok(!defaulted, "acl2 defaulted\n"); + + ret = pGetAce(acl2, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE, "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(EqualSid(&ace->SidStart, psid), "Expected access allowed ACE\n"); + ok(ace->Header.AceFlags == NO_PROPAGATE_INHERIT_ACE, + "Expected NO_PROPAGATE_INHERIT_ACE as flags, got %x\n", ace->Header.AceFlags); - index = 0; - found = FALSE; - while (pGetAce( pAcl2, index++, (void **)&ace )) - { - if (ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE && EqualSid(&ace->SidStart, psid)) - { - found = TRUE; - ok(ace->Header.AceFlags == NO_PROPAGATE_INHERIT_ACE, - "Expected NO_PROPAGATE_INHERIT_ACE as flags, got %x\n", ace->Header.AceFlags); - } - } - ok(found, "Could not find access allowed ace\n"); - - HeapFree( GetProcessHeap(), 0, sd2); + HeapFree(GetProcessHeap(), 0, sd2); /* Duplicate token without security attributes. - * Tokens do not inherit the security descriptor when calling DuplicateToken, - * see https://blogs.msdn.microsoft.com/oldnewthing/20160512-00/?p=93447 - */ + * Tokens do not inherit the security descriptor in DuplicateToken. */ ret = pDuplicateTokenEx(token2, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, TokenImpersonation, &token3); - ok(ret, "DuplicateTokenEx failed with %u\n", GetLastError()); + ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError()); ret = GetKernelObjectSecurity(token3, DACL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); sd2 = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(token3, DACL_SECURITY_INFORMATION, sd2, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - pAcl2 = (void *)0xdeadbeef; + acl2 = (void *)0xdeadbeef; present = FALSE; defaulted = TRUE; - ret = GetSecurityDescriptorDacl(sd2, &present, &pAcl2, &defaulted); - ok(ret, "GetSecurityDescriptorDacl failed with %u\n", GetLastError()); - todo_wine - ok(present, "pAcl2 not present\n"); - ok(pAcl2 != (void *)0xdeadbeef, "pAcl2 not set\n"); - ok(!defaulted, "pAcl2 defaulted\n"); + ret = GetSecurityDescriptorDacl(sd2, &present, &acl2, &defaulted); + ok(ret, "GetSecurityDescriptorDacl failed with error %u\n", GetLastError()); + ok(present, "DACL not present\n"); - if (pAcl2) + if (present) { + ok(acl2 != (void *)0xdeadbeef, "DACL not set\n"); + ok(!defaulted, "DACL defaulted\n"); + index = 0; found = FALSE; - while (pGetAce( pAcl2, index++, (void **)&ace )) + while (pGetAce(acl2, index++, (void **)&ace)) { if (ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE && EqualSid(&ace->SidStart, psid)) found = TRUE; } - ok(!found, "Access allowed ace got inherited!\n"); + ok(!found, "Access allowed ACE was inherited\n"); } HeapFree(GetProcessHeap(), 0, sd2); - /* When creating a child process, the process does only inherit the - * Token of the parent, but not the DACL of the token. - */ + /* When creating a child process, the process does inherit the token of + * the parent but not the DACL of the token */ ret = GetKernelObjectSecurity(token, DACL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); sd2 = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(token, DACL_SECURITY_INFORMATION, sd2, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - pAcl2 = (void *)0xdeadbeef; + acl2 = (void *)0xdeadbeef; present = FALSE; defaulted = TRUE; - ret = GetSecurityDescriptorDacl(sd2, &present, &pAcl2, &defaulted); - ok(ret, "GetSecurityDescriptorDacl failed with %u\n", GetLastError()); - ok(present, "pAcl2 not present\n"); - ok(pAcl2 != (void *)0xdeadbeef, "pAcl2 not set\n"); - ok(!defaulted, "pAcl2 defaulted\n"); - - /* check that the ace we add for testing does not already exist! */ - if (pAcl2) - { - index = 0; - found = FALSE; - while (pGetAce( pAcl2, index++, (void **)&ace )) - { - if (ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE && EqualSid(&ace->SidStart, psid)) - found = TRUE; - } - ok(!found, "Test ace does already exist!\n"); - } + ret = GetSecurityDescriptorDacl(sd2, &present, &acl2, &defaulted); + ok(ret, "GetSecurityDescriptorDacl failed with error %u\n", GetLastError()); + ok(present, "DACL not present\n"); + ok(acl2 != (void *)0xdeadbeef, "DACL not set\n"); + ok(!defaulted, "DACL defaulted\n"); exp_access.grfAccessPermissions = GENERIC_ALL; exp_access.grfAccessMode = GRANT_ACCESS; @@ -7357,42 +7344,305 @@ static void test_token_security_descriptor(void) exp_access.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP; exp_access.Trustee.ptstrName = (void*)psid; - retd = pSetEntriesInAclW(1, &exp_access, pAcl2, &pAclChild); + retd = pSetEntriesInAclW(1, &exp_access, acl2, &acl_child); ok(retd == ERROR_SUCCESS, "Expected ERROR_SUCCESS, got %u\n", retd); memset(sd, 0, sizeof(buffer_sd)); ret = InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION); - ok(ret, "InitializeSecurityDescriptor failed with %u\n", GetLastError()); + ok(ret, "InitializeSecurityDescriptor failed with error %u\n", GetLastError()); - ret = SetSecurityDescriptorDacl(sd, TRUE, pAclChild, FALSE); - ok(ret, "SetSecurityDescriptorDacl failed with %u\n", GetLastError()); + ret = SetSecurityDescriptorDacl(sd, TRUE, acl_child, FALSE); + ok(ret, "SetSecurityDescriptorDacl failed with error %u\n", GetLastError()); ret = SetKernelObjectSecurity(token, DACL_SECURITY_INFORMATION, sd); - ok(ret, "SetKernelObjectSecurity failed with %u\n", GetLastError()); + ok(ret, "SetKernelObjectSecurity failed with error %u\n", GetLastError()); /* The security label is also not inherited */ if (pAddMandatoryAce) { - ret = InitializeAcl(pAcl, 256, ACL_REVISION); - ok(ret, "InitializeAcl failed with %u\n", GetLastError()); + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level), + "Expected medium or high integrity level\n"); + + if (EqualSid(tml->Label.Sid, &high_level)) + { + DWORD process_id; + HANDLE process; + HWND shell; + + /* This test tries to get a medium token and then impersonates this token. The + * idea is to check whether the sd label of a newly created token depends on the + * current active token or the integrity level of the newly created token. */ + + /* Steal process token of the explorer.exe process */ + shell = GetShellWindow(); + todo_wine ok(shell != NULL, "Failed to get shell window\n"); + if (!shell) shell = GetDesktopWindow(); /* FIXME: Workaround for Wine */ + ok(GetWindowThreadProcessId(shell, &process_id), + "Failed to get process id of shell window: %u\n", GetLastError()); + process = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, process_id); + ok(process != NULL, "Failed to open process: %u\n", GetLastError()); + ok(OpenProcessToken(process, TOKEN_ALL_ACCESS, &token4), + "Failed to open process token: %u\n", GetLastError()); + CloseHandle(process); + + /* Check TokenIntegrityLevel and LABEL_SECURITY_INFORMATION of explorer.exe token */ + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token4, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &medium_level), "Expected medium integrity level\n"); + + size = 0; + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); + + sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, sd3, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + sacl = NULL; + ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "No SACL in the security descriptor\n"); + ok(sacl != NULL, "NULL SACL in the security descriptor\n"); + + if (sacl) + { + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(EqualSid(&ace->SidStart, &medium_level), + "Expected medium integrity level\n"); + } + + HeapFree(GetProcessHeap(), 0, sd3); + + /* Start child process with the explorer.exe token */ + memset(&startup, 0, sizeof(startup)); + startup.cb = sizeof(startup); + startup.dwFlags = STARTF_USESHOWWINDOW; + startup.wShowWindow = SW_SHOWNORMAL; + + sprintf(buffer, "%s tests/security.c test_token_sd_medium", myARGV[0]); + ret = CreateProcessAsUserA(token4, NULL, buffer, NULL, NULL, FALSE, 0, NULL, NULL, &startup, &info); + ok(ret || GetLastError() == ERROR_PRIVILEGE_NOT_HELD, + "CreateProcess failed with error %u\n", GetLastError()); + if (ret) + { + winetest_wait_child_process(info.hProcess); + CloseHandle(info.hProcess); + CloseHandle(info.hThread); + } + else + win_skip("Skipping test for creating process with medium level token\n"); + + ret = DuplicateTokenEx(token4, 0, NULL, SecurityImpersonation, TokenImpersonation, &token5); + ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError()); + ret = SetThreadToken(NULL, token5); + ok(ret, "SetThreadToken failed with error %u\n", GetLastError()); + CloseHandle(token4); + + /* Restrict current process token while impersonating a medium integrity token */ + ret = CreateRestrictedToken(token, 0, 0, NULL, 0, NULL, 0, NULL, &token6); + ok(ret, "CreateRestrictedToken failed with error %u\n", GetLastError()); + + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token6, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &high_level), "Expected high integrity level\n"); + + size = 0; + ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); + + sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); + ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, sd3, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + sacl = NULL; + ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "No SACL in the security descriptor\n"); + ok(sacl != NULL, "NULL SACL in the security descriptor\n"); + + if (sacl) + { + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(EqualSid(&ace->SidStart, &medium_level), + "Expected medium integrity level\n"); + } + + HeapFree(GetProcessHeap(), 0, sd3); + RevertToSelf(); + CloseHandle(token5); + + /* Start child process with the restricted token */ + sprintf(buffer, "%s tests/security.c test_token_sd_restricted", myARGV[0]); + ret = CreateProcessAsUserA(token6, NULL, buffer, NULL, NULL, FALSE, 0, NULL, NULL, &startup, &info); + ok(ret, "CreateProcess failed with error %u\n", GetLastError()); + winetest_wait_child_process(info.hProcess); + CloseHandle(info.hProcess); + CloseHandle(info.hThread); + CloseHandle(token6); + + /* DuplicateTokenEx should assign security label even when SA points to empty SD */ + memset(sd, 0, sizeof(buffer_sd)); + ret = InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION); + ok(ret, "InitializeSecurityDescriptor failed with error %u\n", GetLastError()); + + sa.nLength = sizeof(SECURITY_ATTRIBUTES); + sa.lpSecurityDescriptor = sd; + sa.bInheritHandle = FALSE; + + ret = DuplicateTokenEx(token, 0, &sa, 0, TokenPrimary, &token6); + ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError()); + + size = 0; + ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); + + sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); + ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, sd3, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + sacl = NULL; + ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "No SACL in the security descriptor\n"); + ok(sacl != NULL, "NULL SACL in the security descriptor\n"); + + if (sacl) + { + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(EqualSid(&ace->SidStart, &high_level), + "Expected high integrity level\n"); + } + + HeapFree(GetProcessHeap(), 0, sd3); + CloseHandle(token6); + } + else + skip("Skipping test, running without admin rights\n"); + + ret = InitializeAcl(acl, 256, ACL_REVISION); + ok(ret, "InitializeAcl failed with error %u\n", GetLastError()); - ret = pAddMandatoryAce(pAcl, ACL_REVISION, 0, SYSTEM_MANDATORY_LABEL_NO_WRITE_UP, &low_level); - ok(ret, "AddMandatoryAce failed with %u\n", GetLastError()); + ret = pAddMandatoryAce(acl, ACL_REVISION, 0, SYSTEM_MANDATORY_LABEL_NO_WRITE_UP, &low_level); + ok(ret, "AddMandatoryAce failed with error %u\n", GetLastError()); memset(sd, 0, sizeof(buffer_sd)); ret = InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION); - ok(ret, "InitializeSecurityDescriptor failed with %u\n", GetLastError()); + ok(ret, "InitializeSecurityDescriptor failed with error %u\n", GetLastError()); - ret = SetSecurityDescriptorSacl(sd, TRUE, pAcl, FALSE); - ok(ret, "SetSecurityDescriptorSacl failed with %u\n", GetLastError()); + ret = SetSecurityDescriptorSacl(sd, TRUE, acl, FALSE); + ok(ret, "SetSecurityDescriptorSacl failed with error %u\n", GetLastError()); ret = SetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd); - ok(ret, "SetKernelObjectSecurity failed with %u\n", GetLastError()); + ok(ret, "SetKernelObjectSecurity failed with error %u\n", GetLastError()); + + /* changing the label of the security descriptor does not change the integrity level of the token itself */ + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level), + "Expected medium or high integrity level\n"); + + /* restricting / duplicating a token resets the mandatory sd label */ + ret = CreateRestrictedToken(token, 0, 0, NULL, 0, NULL, 0, NULL, &token4); + ok(ret, "CreateRestrictedToken failed with error %u\n", GetLastError()); + + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token4, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level), + "Expected medium or high integrity level\n"); + + size = 0; + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); + + sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, sd3, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "No SACL in the security descriptor\n"); + ok(sacl != NULL, "NULL SACL in the security descriptor\n"); + + if (sacl) + { + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(EqualSid(&ace->SidStart, &medium_level) || EqualSid(&ace->SidStart, &high_level), + "Low integrity level should not have been inherited\n"); + } + + HeapFree(GetProcessHeap(), 0, sd3); + CloseHandle(token4); + + ret = DuplicateTokenEx(token, 0, NULL, 0, TokenPrimary, &token4); + ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError()); + + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token4, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL*) buffer_integrity; + ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level), + "Expected medium or high integrity level\n"); + + size = 0; + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); + + sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, sd3, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + sacl = NULL; + ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "No SACL in the security descriptor\n"); + ok(sacl != NULL, "NULL SACL in the security descriptor\n"); + + if (sacl) + { + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(EqualSid(&ace->SidStart, &medium_level) || EqualSid(&ace->SidStart, &high_level), + "Low integrity level should not have been inherited\n"); + } + + HeapFree(GetProcessHeap(), 0, sd3); + CloseHandle(token4); } else win_skip("SYSTEM_MANDATORY_LABEL not supported\n"); - /* start child process with our modified token */ + /* Start child process with our modified token */ memset(&startup, 0, sizeof(startup)); startup.cb = sizeof(startup); startup.dwFlags = STARTF_USESHOWWINDOW; @@ -7405,7 +7655,7 @@ static void test_token_security_descriptor(void) CloseHandle(info.hProcess); CloseHandle(info.hThread); - LocalFree(pAclChild); + LocalFree(acl_child); LocalFree(psid); CloseHandle(token3); @@ -7416,48 +7666,46 @@ static void test_token_security_descriptor(void) static void test_child_token_sd(void) { static SID low_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, - {SECURITY_MANDATORY_LOW_RID}}; + {SECURITY_MANDATORY_LOW_RID}}; SYSTEM_MANDATORY_LABEL_ACE *ace_label; - BOOL ret, present, defaulted, found; - ACCESS_ALLOWED_ACE *ace_acc; + BOOL ret, present, defaulted; + ACCESS_ALLOWED_ACE *acc_ace; SECURITY_DESCRIPTOR *sd; - DWORD size, index; + DWORD size, i; HANDLE token; - ACL *pAcl; PSID psid; + ACL *acl; ret = pConvertStringSidToSidA("S-1-5-6", &psid); - ok(ret, "ConvertStringSidToSidA failed with %u\n", GetLastError()); + ok(ret, "ConvertStringSidToSidA failed with error %u\n", GetLastError()); ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &token); ok(ret, "OpenProcessToken failed with error %u\n", GetLastError()); ret = GetKernelObjectSecurity(token, DACL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); sd = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(token, DACL_SECURITY_INFORMATION, sd, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - pAcl = NULL; + acl = NULL; present = FALSE; defaulted = TRUE; - ret = GetSecurityDescriptorDacl(sd, &present, &pAcl, &defaulted); - ok(ret, "GetSecurityDescriptorSacl failed with %u\n", GetLastError()); + ret = GetSecurityDescriptorDacl(sd, &present, &acl, &defaulted); + ok(ret, "GetSecurityDescriptorDacl failed with error %u\n", GetLastError()); + ok(present, "DACL not present\n"); + ok(acl && acl != (void *)0xdeadbeef, "Got invalid DACL\n"); + ok(!defaulted, "DACL defaulted\n"); - index = 0; - found = FALSE; - if (present && pAcl) + ok(acl->AceCount, "Expected at least one ACE\n"); + for (i = 0; i < acl->AceCount; i++) { - ok(pAcl->AceCount > 0, "Expected at least one ACE\n"); - while (pGetAce( pAcl, index++, (void **)&ace_acc )) - { - if (ace_acc->Header.AceType == ACCESS_ALLOWED_ACE_TYPE && EqualSid(&ace_acc->SidStart, psid)) - found = TRUE; - } + ok(pGetAce(acl, i, (void **)&acc_ace), "GetAce failed with error %u\n", GetLastError()); + ok(acc_ace->Header.AceType != ACCESS_ALLOWED_ACE_TYPE || !EqualSid(&acc_ace->SidStart, psid), + "ACE inherited from the parent\n"); } - ok(!found, "The ACE should not haven been inherited from the parent\n"); LocalFree(psid); HeapFree(GetProcessHeap(), 0, sd); @@ -7470,33 +7718,280 @@ static void test_child_token_sd(void) ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, NULL, 0, &size); ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, - "GetKernelObjectSecurity failed with %u\n", GetLastError()); + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); sd = HeapAlloc(GetProcessHeap(), 0, size); ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd, size, &size); - ok(ret, "GetKernelObjectSecurity failed %u\n", GetLastError()); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); - pAcl = NULL; + acl = NULL; present = FALSE; defaulted = TRUE; - ret = GetSecurityDescriptorSacl(sd, &present, &pAcl, &defaulted); - ok(ret, "GetSecurityDescriptorSacl failed with %u\n", GetLastError()); + ret = GetSecurityDescriptorSacl(sd, &present, &acl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "SACL not present\n"); + ok(acl && acl != (void *)0xdeadbeef, "Got invalid SACL\n"); + ok(!defaulted, "SACL defaulted\n"); + ok(acl->AceCount == 1, "Expected exactly one ACE\n"); + ret = pGetAce(acl, 0, (void **)&ace_label); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace_label->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace_label->Header.AceType); + ok(!EqualSid(&ace_label->SidStart, &low_level), + "Low integrity level should not have been inherited\n"); - index = 0; - found = FALSE; - if (present && pAcl) + HeapFree(GetProcessHeap(), 0, sd); +} + +static void test_child_token_sd_restricted(void) +{ + static SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, + {SECURITY_MANDATORY_HIGH_RID}}; + SYSTEM_MANDATORY_LABEL_ACE *ace_label; + BOOL ret, present, defaulted; + TOKEN_MANDATORY_LABEL *tml; + BYTE buffer_integrity[64]; + SECURITY_DESCRIPTOR *sd; + HANDLE token; + DWORD size; + ACL *acl; + + if (!pAddMandatoryAce) { - while (pGetAce( pAcl, index++, (void **)&ace_label )) - { - if (ace_label->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE && EqualSid(&ace_label->SidStart, &low_level)) - found = TRUE; - } + win_skip("SYSTEM_MANDATORY_LABEL not supported\n"); + return; } - ok(!found, "Low integrity level should not have been inherited\n"); + + ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &token); + ok(ret, "OpenProcessToken failed with error %u\n", GetLastError()); + + ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); + + sd = HeapAlloc(GetProcessHeap(), 0, size); + ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + acl = NULL; + present = FALSE; + defaulted = TRUE; + ret = GetSecurityDescriptorSacl(sd, &present, &acl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "SACL not present\n"); + ok(acl && acl != (void *)0xdeadbeef, "Got invalid SACL\n"); + ok(!defaulted, "SACL defaulted\n"); + ok(acl->AceCount == 1, "Expected exactly one ACE\n"); + ret = pGetAce(acl, 0, (void **)&ace_label); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace_label->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace_label->Header.AceType); + ok(EqualSid(&ace_label->SidStart, &high_level), + "Expected high integrity level\n"); + + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &high_level), "Expected high integrity level\n"); HeapFree(GetProcessHeap(), 0, sd); } +static void test_child_token_sd_medium(void) +{ + static SID medium_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, + {SECURITY_MANDATORY_MEDIUM_RID}}; + SYSTEM_MANDATORY_LABEL_ACE *ace_label; + BOOL ret, present, defaulted; + TOKEN_MANDATORY_LABEL *tml; + BYTE buffer_integrity[64]; + SECURITY_DESCRIPTOR *sd; + HANDLE token; + DWORD size; + ACL *acl; + + if (!pAddMandatoryAce) + { + win_skip("SYSTEM_MANDATORY_LABEL not supported\n"); + return; + } + + ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &token); + ok(ret, "OpenProcessToken failed with error %u\n", GetLastError()); + + ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); + + sd = HeapAlloc(GetProcessHeap(), 0, size); + ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + acl = NULL; + present = FALSE; + defaulted = TRUE; + ret = GetSecurityDescriptorSacl(sd, &present, &acl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "SACL not present\n"); + ok(acl && acl != (void *)0xdeadbeef, "Got invalid SACL\n"); + ok(!defaulted, "SACL defaulted\n"); + ok(acl->AceCount == 1, "Expected exactly one ACE\n"); + ret = pGetAce(acl, 0, (void **)&ace_label); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace_label->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace_label->Header.AceType); + ok(EqualSid(&ace_label->SidStart, &medium_level), + "Expected medium integrity level\n"); + + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &medium_level), "Expected medium integrity level\n"); + + HeapFree(GetProcessHeap(), 0, sd); +} + +static void test_GetExplicitEntriesFromAclW(void) +{ + static const WCHAR wszCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'}; + SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY }; + SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY }; + PSID everyone_sid = NULL, users_sid = NULL; + EXPLICIT_ACCESSW access; + EXPLICIT_ACCESSW *access2; + PACL new_acl, old_acl = NULL; + ULONG count; + DWORD res; + + if (!pGetExplicitEntriesFromAclW) + { + win_skip("GetExplicitEntriesFromAclW is not available\n"); + return; + } + + if (!pSetEntriesInAclW) + { + win_skip("SetEntriesInAclW is not available\n"); + return; + } + + old_acl = HeapAlloc(GetProcessHeap(), 0, 256); + res = InitializeAcl(old_acl, 256, ACL_REVISION); + if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED) + { + win_skip("ACLs not implemented - skipping tests\n"); + HeapFree(GetProcessHeap(), 0, old_acl); + return; + } + ok(res, "InitializeAcl failed with error %d\n", GetLastError()); + + res = AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &everyone_sid); + ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError()); + + res = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID, + DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &users_sid); + ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError()); + + res = AddAccessAllowedAce(old_acl, ACL_REVISION, KEY_READ, users_sid); + ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError()); + + access2 = NULL; + res = pGetExplicitEntriesFromAclW(old_acl, &count, &access2); + ok(res == ERROR_SUCCESS, "GetExplicitEntriesFromAclW failed with error %d\n", GetLastError()); + ok(count == 1, "Expected count == 1, got %d\n", count); + ok(access2[0].grfAccessMode == GRANT_ACCESS, "Expected GRANT_ACCESS, got %d\n", access2[0].grfAccessMode); + ok(access2[0].grfAccessPermissions == KEY_READ, "Expected KEY_READ, got %d\n", access2[0].grfAccessPermissions); + ok(access2[0].Trustee.TrusteeForm == TRUSTEE_IS_SID, "Expected SID trustee, got %d\n", access2[0].Trustee.TrusteeForm); + ok(access2[0].grfInheritance == NO_INHERITANCE, "Expected NO_INHERITANCE, got %x\n", access2[0].grfInheritance); + ok(EqualSid(access2[0].Trustee.ptstrName, users_sid), "Expected equal SIDs\n"); + LocalFree(access2); + + access.Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; + access.Trustee.pMultipleTrustee = NULL; + + access.grfAccessPermissions = KEY_WRITE; + access.grfAccessMode = GRANT_ACCESS; + access.grfInheritance = NO_INHERITANCE; + access.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP; + access.Trustee.TrusteeForm = TRUSTEE_IS_SID; + access.Trustee.ptstrName = everyone_sid; + res = pSetEntriesInAclW(1, &access, old_acl, &new_acl); + ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res); + ok(new_acl != NULL, "returned acl was NULL\n"); + + access2 = NULL; + res = pGetExplicitEntriesFromAclW(new_acl, &count, &access2); + ok(res == ERROR_SUCCESS, "GetExplicitEntriesFromAclW failed with error %d\n", GetLastError()); + ok(count == 2, "Expected count == 2, got %d\n", count); + ok(access2[0].grfAccessMode == GRANT_ACCESS, "Expected GRANT_ACCESS, got %d\n", access2[0].grfAccessMode); + ok(access2[0].grfAccessPermissions == KEY_WRITE, "Expected KEY_WRITE, got %d\n", access2[0].grfAccessPermissions); + ok(access2[0].Trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, + "Expected TRUSTEE_IS_UNKNOWN trustee type, got %d\n", access2[0].Trustee.TrusteeType); + ok(access2[0].Trustee.TrusteeForm == TRUSTEE_IS_SID, "Expected SID trustee, got %d\n", access2[0].Trustee.TrusteeForm); + ok(access2[0].grfInheritance == NO_INHERITANCE, "Expected NO_INHERITANCE, got %x\n", access2[0].grfInheritance); + ok(EqualSid(access2[0].Trustee.ptstrName, everyone_sid), "Expected equal SIDs\n"); + LocalFree(access2); + LocalFree(new_acl); + + access.Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN; + res = pSetEntriesInAclW(1, &access, old_acl, &new_acl); + ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res); + ok(new_acl != NULL, "returned acl was NULL\n"); + + access2 = NULL; + res = pGetExplicitEntriesFromAclW(new_acl, &count, &access2); + ok(res == ERROR_SUCCESS, "GetExplicitEntriesFromAclW failed with error %d\n", GetLastError()); + ok(count == 2, "Expected count == 2, got %d\n", count); + ok(access2[0].grfAccessMode == GRANT_ACCESS, "Expected GRANT_ACCESS, got %d\n", access2[0].grfAccessMode); + ok(access2[0].grfAccessPermissions == KEY_WRITE, "Expected KEY_WRITE, got %d\n", access2[0].grfAccessPermissions); + ok(access2[0].Trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, + "Expected TRUSTEE_IS_UNKNOWN trustee type, got %d\n", access2[0].Trustee.TrusteeType); + ok(access2[0].Trustee.TrusteeForm == TRUSTEE_IS_SID, "Expected SID trustee, got %d\n", access2[0].Trustee.TrusteeForm); + ok(access2[0].grfInheritance == NO_INHERITANCE, "Expected NO_INHERITANCE, got %x\n", access2[0].grfInheritance); + ok(EqualSid(access2[0].Trustee.ptstrName, everyone_sid), "Expected equal SIDs\n"); + LocalFree(access2); + LocalFree(new_acl); + + access.Trustee.TrusteeForm = TRUSTEE_IS_NAME; + access.Trustee.ptstrName = (LPWSTR)wszCurrentUser; + res = pSetEntriesInAclW(1, &access, old_acl, &new_acl); + ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res); + ok(new_acl != NULL, "returned acl was NULL\n"); + + access2 = NULL; + res = pGetExplicitEntriesFromAclW(new_acl, &count, &access2); + ok(res == ERROR_SUCCESS, "GetExplicitEntriesFromAclW failed with error %d\n", GetLastError()); + ok(count == 2, "Expected count == 2, got %d\n", count); + ok(access2[0].grfAccessMode == GRANT_ACCESS, "Expected GRANT_ACCESS, got %d\n", access2[0].grfAccessMode); + ok(access2[0].grfAccessPermissions == KEY_WRITE, "Expected KEY_WRITE, got %d\n", access2[0].grfAccessPermissions); + ok(access2[0].Trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, + "Expected TRUSTEE_IS_UNKNOWN trustee type, got %d\n", access2[0].Trustee.TrusteeType); + ok(access2[0].Trustee.TrusteeForm == TRUSTEE_IS_SID, "Expected SID trustee, got %d\n", access2[0].Trustee.TrusteeForm); + ok(access2[0].grfInheritance == NO_INHERITANCE, "Expected NO_INHERITANCE, got %x\n", access2[0].grfInheritance); + LocalFree(access2); + LocalFree(new_acl); + + access.grfAccessMode = REVOKE_ACCESS; + access.Trustee.TrusteeForm = TRUSTEE_IS_SID; + access.Trustee.ptstrName = users_sid; + res = pSetEntriesInAclW(1, &access, old_acl, &new_acl); + ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res); + ok(new_acl != NULL, "returned acl was NULL\n"); + + access2 = (void *)0xdeadbeef; + res = pGetExplicitEntriesFromAclW(new_acl, &count, &access2); + ok(res == ERROR_SUCCESS, "GetExplicitEntriesFromAclW failed with error %d\n", GetLastError()); + ok(count == 0, "Expected count == 0, got %d\n", count); + ok(access2 == NULL, "access2 was not NULL\n"); + LocalFree(new_acl); + + FreeSid(users_sid); + FreeSid(everyone_sid); + HeapFree(GetProcessHeap(), 0, old_acl); +} + static void test_BuildSecurityDescriptorW(void) { SECURITY_DESCRIPTOR old_sd, *new_sd, *rel_sd; @@ -7544,6 +8039,10 @@ START_TEST(security) { if (!strcmp(myARGV[2], "test_token_sd")) test_child_token_sd(); + else if (!strcmp(myARGV[2], "test_token_sd_restricted")) + test_child_token_sd_restricted(); + else if (!strcmp(myARGV[2], "test_token_sd_medium")) + test_child_token_sd_medium(); else test_process_security_child(); return; @@ -7587,9 +8086,10 @@ START_TEST(security) test_GetSidIdentifierAuthority(); test_pseudo_tokens(); test_maximum_allowed(); + test_token_label(); test_GetExplicitEntriesFromAclW(); test_BuildSecurityDescriptorW(); - /* must be the last test, modifies process token */ + /* Must be the last test, modifies process token */ test_token_security_descriptor(); }

1 0

[reactos] 01/02: [PSDK] Add missing CreateRestrictedToken() declaration. CORE-13762
by Amine Khaldi 08 Oct '17

08 Oct '17

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=babc61c5ee09a24161745… commit babc61c5ee09a24161745808842c2e0b5349cd7f Author: Amine Khaldi <amine.khaldi(a)reactos.org> AuthorDate: Sun Oct 8 11:05:53 2017 +0100 [PSDK] Add missing CreateRestrictedToken() declaration. CORE-13762 --- sdk/include/psdk/winbase.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/sdk/include/psdk/winbase.h b/sdk/include/psdk/winbase.h index 19462021c9..09812fc128 100644 --- a/sdk/include/psdk/winbase.h +++ b/sdk/include/psdk/winbase.h @@ -1689,6 +1689,20 @@ CreateProcessAsUserA( BOOL WINAPI CreateProcessAsUserW(HANDLE,LPCWSTR,LPWSTR,LPSECURITY_ATTRIBUTES,LPSECURITY_ATTRIBUTES,BOOL,DWORD,PVOID,LPCWSTR,LPSTARTUPINFOW,LPPROCESS_INFORMATION); HANDLE WINAPI CreateRemoteThread(HANDLE,LPSECURITY_ATTRIBUTES,DWORD,LPTHREAD_START_ROUTINE,LPVOID,DWORD,LPDWORD); + +BOOL +WINAPI +CreateRestrictedToken( + _In_ HANDLE ExistingTokenHandle, + _In_ DWORD Flags, + _In_ DWORD DisableSidCount, + _In_reads_opt_(DisableSidCount) PSID_AND_ATTRIBUTES SidsToDisable, + _In_ DWORD DeletePrivilegeCount, + _In_reads_opt_(DeletePrivilegeCount) PLUID_AND_ATTRIBUTES PrivilegesToDelete, + _In_ DWORD RestrictedSidCount, + _In_reads_opt_(RestrictedSidCount) PSID_AND_ATTRIBUTES SidsToRestrict, + _Outptr_ PHANDLE NewTokenHandle); + _Ret_maybenull_ HANDLE WINAPI CreateSemaphoreA(_In_opt_ LPSECURITY_ATTRIBUTES, _In_ LONG, _In_ LONG, _In_opt_ LPCSTR); _Ret_maybenull_ HANDLE WINAPI CreateSemaphoreW(_In_opt_ LPSECURITY_ATTRIBUTES, _In_ LONG, _In_ LONG, _In_opt_ LPCWSTR); #if (_WIN32_WINNT >= 0x0600)

1 0

[reactos] 01/01: [TRAVIS-CI] Initial version of the Travis-CI script.
by Amine Khaldi 08 Oct '17

08 Oct '17

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=d77464b3d695c65f13e01… commit d77464b3d695c65f13e0196d46dc1081bdf273b5 Author: Amine Khaldi <amine.khaldi(a)reactos.org> AuthorDate: Sun Oct 8 13:38:07 2017 +0100 [TRAVIS-CI] Initial version of the Travis-CI script. --- .travis.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.travis.yml b/.travis.yml new file mode 100644 index 0000000000..643416724e --- /dev/null +++ b/.travis.yml @@ -0,0 +1,10 @@ +language: bash + +git: + depth: 1 + +before_script: +- wget https://svn.reactos.org/amine/RosBEBinFull.tar.gz -O RosBE.tar.gz +- tar -xzf RosBE.tar.gz +- echo 'mkdir ../Build && cd ../Build && $TRAVIS_BUILD_DIR/configure.sh -DENABLE_ROSTESTS=1 && cd reactos && ninja && ninja bootcd' > tmp_file +- ./RosBEBinFull/RosBE.sh < tmp_file \ No newline at end of file

1 0

[reactos] 01/01: [MSDMO] Fix build.
by Amine Khaldi 08 Oct '17

08 Oct '17

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=57cda5aa7d072db5b522a… commit 57cda5aa7d072db5b522a6fad4d9d03ecaf8b608 Author: Amine Khaldi <amine.khaldi(a)reactos.org> AuthorDate: Sun Oct 8 12:28:23 2017 +0100 [MSDMO] Fix build. --- dll/directx/wine/msdmo/precomp.h | 1 + 1 file changed, 1 insertion(+) diff --git a/dll/directx/wine/msdmo/precomp.h b/dll/directx/wine/msdmo/precomp.h index d952772c24..ceb8d707d8 100644 --- a/dll/directx/wine/msdmo/precomp.h +++ b/dll/directx/wine/msdmo/precomp.h @@ -11,6 +11,7 @@ #include <windef.h> #include <winbase.h> +#include <wingdi.h> #include <objbase.h> #include <wine/debug.h>

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs