Ros-diffs

ros-diffs@reactos.org

81390 discussions

[reactos] 09/10: [NTDLL_APITEST] Write tests for NtAccessCheckByType

by George Bișoc

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=fd2e4437a8c9cc1aba7d5… commit fd2e4437a8c9cc1aba7d526d2a6103ce4fe2520d Author: George Bișoc <george.bisoc(a)reactos.org> AuthorDate: Wed Jun 21 17:57:23 2023 +0200 Commit: unknown <george.bisoc(a)reactos.org> CommitDate: Tue Aug 22 17:54:19 2023 +0200 [NTDLL_APITEST] Write tests for NtAccessCheckByType --- modules/rostests/apitests/ntdll/CMakeLists.txt | 1 + .../rostests/apitests/ntdll/NtAccessCheckByType.c | 1383 ++++++++++++++++++++ modules/rostests/apitests/ntdll/testlist.c | 2 + 3 files changed, 1386 insertions(+) diff --git a/modules/rostests/apitests/ntdll/CMakeLists.txt b/modules/rostests/apitests/ntdll/CMakeLists.txt index 380b76ab310..4cad9ae218e 100644 --- a/modules/rostests/apitests/ntdll/CMakeLists.txt +++ b/modules/rostests/apitests/ntdll/CMakeLists.txt @@ -10,6 +10,7 @@ list(APPEND SOURCE load_notifications.c locale.c NtAcceptConnectPort.c + NtAccessCheckByType.c NtAdjustGroupsToken.c NtAdjustPrivilegesToken.c NtAllocateVirtualMemory.c diff --git a/modules/rostests/apitests/ntdll/NtAccessCheckByType.c b/modules/rostests/apitests/ntdll/NtAccessCheckByType.c new file mode 100644 index 00000000000..bbd072dd9f4 --- /dev/null +++ b/modules/rostests/apitests/ntdll/NtAccessCheckByType.c @@ -0,0 +1,1383 @@ +/* + * PROJECT: ReactOS API tests + * LICENSE: GPL-2.0-or-later (https://spdx.org/licenses/GPL-2.0-or-later) + * PURPOSE: Tests for the NtAccessCheckByType API + * COPYRIGHT: Copyright 2023 George Bișoc <george.bisoc(a)reactos.org> + */ + +#include "precomp.h" + +static GENERIC_MAPPING RegMapping = {KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS}; +static GUID ObjectType = {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}}; +static GUID ChildObjectType = {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}}; +static SID_IDENTIFIER_AUTHORITY WorldAuthority = {SECURITY_WORLD_SID_AUTHORITY}; +static SID_IDENTIFIER_AUTHORITY NtAuthority = {SECURITY_NT_AUTHORITY}; + +static +HANDLE +GetTokenProcess( + _In_ BOOLEAN WantImpersonateLevel, + _In_ BOOLEAN WantImpersonateType) +{ + NTSTATUS Status; + HANDLE Token; + HANDLE DuplicatedToken; + OBJECT_ATTRIBUTES ObjectAttributes; + SECURITY_QUALITY_OF_SERVICE Sqos; + + Status = NtOpenProcessToken(NtCurrentProcess(), + TOKEN_QUERY | TOKEN_DUPLICATE, + &Token); + if (!NT_SUCCESS(Status)) + { + trace("Failed to get current process token (Status 0x%08lx)\n", Status); + return NULL; + } + + Sqos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE); + Sqos.ImpersonationLevel = WantImpersonateLevel ? SecurityImpersonation : SecurityAnonymous; + Sqos.ContextTrackingMode = 0; + Sqos.EffectiveOnly = FALSE; + + InitializeObjectAttributes(&ObjectAttributes, + NULL, + 0, + NULL, + NULL); + ObjectAttributes.SecurityQualityOfService = &Sqos; + + Status = NtDuplicateToken(Token, + TOKEN_QUERY | TOKEN_DUPLICATE, + &ObjectAttributes, + FALSE, + WantImpersonateType ? TokenImpersonation : TokenPrimary, + &DuplicatedToken); + if (!NT_SUCCESS(Status)) + { + trace("Failed to duplicate token (Status 0x%08lx)\n", Status); + NtClose(Token); + return NULL; + } + + return DuplicatedToken; +} + +static +VOID +ParamsValidationTests(VOID) +{ + NTSTATUS Status; + NTSTATUS AccessStatus; + ACCESS_MASK GrantedAccess; + PPRIVILEGE_SET PrivilegeSet = NULL; + ULONG PrivilegeSetLength; + HANDLE Token = NULL; + SECURITY_DESCRIPTOR Sd; + OBJECT_TYPE_LIST ObjTypeList[2]; + + /* Everything is NULL */ + Status = NtAccessCheckByType(NULL, + NULL, + NULL, + 0, + NULL, + 0, + NULL, + NULL, + 0, + NULL, + NULL); + ok_hex(Status, STATUS_ACCESS_VIOLATION); + + /* Allocate a buffer for privileges set */ + PrivilegeSetLength = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]); + PrivilegeSet = RtlAllocateHeap(RtlGetProcessHeap(), 0, PrivilegeSetLength); + if (PrivilegeSet == NULL) + { + skip("Failed to allocate PrivilegeSet, skipping tests\n"); + goto Quit; + } + + /* No token given */ + Status = NtAccessCheckByType(NULL, + NULL, + NULL, + MAXIMUM_ALLOWED, + NULL, + 0, + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_INVALID_HANDLE); + + /* Get a token now */ + Token = GetTokenProcess(FALSE, FALSE); + if (Token == NULL) + { + skip("Failed to get token, skipping tests\n"); + goto Quit; + } + + /* Token given but it's not an impersonation one */ + Status = NtAccessCheckByType(NULL, + NULL, + Token, + MAXIMUM_ALLOWED, + NULL, + 0, + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_NO_IMPERSONATION_TOKEN); + + /* Get a token but this time with an invalid impersonation level */ + NtClose(Token); + Token = GetTokenProcess(FALSE, TRUE); + if (Token == NULL) + { + skip("Failed to get token, skipping tests\n"); + goto Quit; + } + + /* Token given but it doesn't have the right impersonation level */ + Status = NtAccessCheckByType(NULL, + NULL, + Token, + MAXIMUM_ALLOWED, + NULL, + 0, + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_BAD_IMPERSONATION_LEVEL); + + /* A generic access right is given */ + Status = NtAccessCheckByType(NULL, + NULL, + Token, + GENERIC_WRITE, + NULL, + 0, + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_GENERIC_NOT_MAPPED); + + /* Close the token, get a valid one that we want */ + NtClose(Token); + Token = GetTokenProcess(TRUE, TRUE); + if (Token == NULL) + { + skip("Failed to get token, skipping tests\n"); + goto Quit; + } + + /* No security descriptor is given */ + Status = NtAccessCheckByType(NULL, + NULL, + Token, + MAXIMUM_ALLOWED, + NULL, + 0, + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_INVALID_SECURITY_DESCR); + + /* The function expects a privilege set */ + Status = NtAccessCheckByType(NULL, + NULL, + Token, + MAXIMUM_ALLOWED, + NULL, + 0, + &RegMapping, + NULL, + 0, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_ACCESS_VIOLATION); + + /* Create a security descriptor */ + Status = RtlCreateSecurityDescriptor(&Sd, SECURITY_DESCRIPTOR_REVISION); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create a security descriptor, skipping tests\n"); + goto Quit; + } + + /* This descriptor will have no group, owner and DACL */ + RtlSetGroupSecurityDescriptor(&Sd, NULL, FALSE); + RtlSetOwnerSecurityDescriptor(&Sd, NULL, FALSE); + RtlSetDaclSecurityDescriptor(&Sd, FALSE, NULL, FALSE); + + /* Give the invalid descriptor */ + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + MAXIMUM_ALLOWED, + NULL, + 0, + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_INVALID_SECURITY_DESCR); + + /* Give a bogus principal SID */ + Status = NtAccessCheckByType(&Sd, + (PSID)1, + Token, + MAXIMUM_ALLOWED, + NULL, + 0, + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + + /* + * On newer versions of Windows such as 10 the principal SID is validated + * after the security descriptor so it will always trigger an invalid + * descriptor case. On Windows Server 2003 the principal SID is captured + * before the security descriptor. ReactOS currently follows the Windows + * 10's behavior. + */ + ok(Status == STATUS_ACCESS_VIOLATION || Status == STATUS_INVALID_SECURITY_DESCR, + "STATUS_ACCESS_VIOLATION or STATUS_INVALID_SECURITY_DESCR expected, got 0x%lx\n", Status); + + /* The first object element is not the root */ + ObjTypeList[0].Level = ACCESS_PROPERTY_SET_GUID; + ObjTypeList[0].Sbz = 0; + ObjTypeList[0].ObjectType = &ObjectType; + + /* Give a bogus list */ + Status = NtAccessCheckByType(&Sd, + (PSID)1, + Token, + MAXIMUM_ALLOWED, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_INVALID_PARAMETER); + + /* This list has two roots */ + ObjTypeList[0].Level = ACCESS_OBJECT_GUID; + ObjTypeList[0].Sbz = 0; + ObjTypeList[0].ObjectType = &ObjectType; + + ObjTypeList[1].Level = ACCESS_OBJECT_GUID; + ObjTypeList[1].Sbz = 0; + ObjTypeList[1].ObjectType = &ChildObjectType; + + /* Give a bogus list */ + Status = NtAccessCheckByType(&Sd, + (PSID)1, + Token, + MAXIMUM_ALLOWED, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_INVALID_PARAMETER); + + /* This list has an object whose level is invalid */ + ObjTypeList[0].Level = 0xa; + ObjTypeList[0].Sbz = 0; + ObjTypeList[0].ObjectType = &ObjectType; + + /* Give a bogus list */ + Status = NtAccessCheckByType(&Sd, + (PSID)1, + Token, + MAXIMUM_ALLOWED, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_INVALID_PARAMETER); + + /* This list doesn't have consistent object levels */ + ObjTypeList[0].Level = ACCESS_OBJECT_GUID; + ObjTypeList[0].Sbz = 0; + ObjTypeList[0].ObjectType = &ObjectType; + + ObjTypeList[1].Level = ACCESS_PROPERTY_GUID; + ObjTypeList[1].Sbz = 0; + ObjTypeList[1].ObjectType = &ChildObjectType; + + /* Give a bogus list */ + Status = NtAccessCheckByType(&Sd, + (PSID)1, + Token, + MAXIMUM_ALLOWED, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_INVALID_PARAMETER); + +Quit: + if (Token) + { + NtClose(Token); + } + + if (PrivilegeSet) + { + RtlFreeHeap(RtlGetProcessHeap(), 0, PrivilegeSet); + } +} + +static +VOID +AccessGrantedNoDaclTests(VOID) +{ + NTSTATUS Status; + NTSTATUS AccessStatus; + ACCESS_MASK GrantedAccess; + PPRIVILEGE_SET PrivilegeSet = NULL; + ULONG PrivilegeSetLength; + HANDLE Token = NULL; + SECURITY_DESCRIPTOR Sd; + OBJECT_TYPE_LIST ObjTypeList[2]; + PSID AdminSid = NULL, UsersSid = NULL; + + /* Allocate all the stuff we need */ + PrivilegeSetLength = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]); + PrivilegeSet = RtlAllocateHeap(RtlGetProcessHeap(), 0, PrivilegeSetLength); + if (PrivilegeSet == NULL) + { + skip("Failed to allocate PrivilegeSet, skipping tests\n"); + return; + } + + Status = RtlAllocateAndInitializeSid(&NtAuthority, + 2, + SECURITY_BUILTIN_DOMAIN_RID, + DOMAIN_ALIAS_RID_ADMINS, + 0, + 0, + 0, + 0, + 0, + 0, + &AdminSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create Admins SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAllocateAndInitializeSid(&NtAuthority, + 2, + SECURITY_BUILTIN_DOMAIN_RID, + DOMAIN_ALIAS_RID_USERS, + 0, + 0, + 0, + 0, + 0, + 0, + &UsersSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create User SID, skipping tests\n"); + goto Quit; + } + + Token = GetTokenProcess(TRUE, TRUE); + if (Token == NULL) + { + skip("Failed to get token, skipping tests\n"); + goto Quit; + } + + Status = RtlCreateSecurityDescriptor(&Sd, SECURITY_DESCRIPTOR_REVISION); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create a security descriptor, skipping tests\n"); + goto Quit; + } + + /* Setup the descriptor with no DACL */ + RtlSetGroupSecurityDescriptor(&Sd, UsersSid, FALSE); + RtlSetOwnerSecurityDescriptor(&Sd, AdminSid, FALSE); + RtlSetDaclSecurityDescriptor(&Sd, FALSE, NULL, FALSE); + + /* Setup the object type list */ + ObjTypeList[0].Level = ACCESS_OBJECT_GUID; + ObjTypeList[0].Sbz = 0; + ObjTypeList[0].ObjectType = &ObjectType; + + ObjTypeList[1].Level = ACCESS_PROPERTY_SET_GUID; + ObjTypeList[1].Sbz = 0; + ObjTypeList[1].ObjectType = &ChildObjectType; + + /* + * Evaluate the access -- a SD with no DACL is always a granted + * access as no ACL is enforced to protect the object. + */ + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_READ, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_READ, "Expected KEY_READ as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + ok(PrivilegeSet != NULL, "PrivilegeSet is NULL when it mustn't be!\n"); + ok(PrivilegeSetLength != 0, "PrivilegeSetLength mustn't be 0!\n"); + + /* Evaluate access for MAXIMUM_ALLOWED as well */ + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + MAXIMUM_ALLOWED, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_ALL_ACCESS, "Expected KEY_ALL_ACCESS as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + ok(PrivilegeSet != NULL, "PrivilegeSet is NULL when it mustn't be!\n"); + ok(PrivilegeSetLength != 0, "PrivilegeSetLength mustn't be 0!\n"); + + /* + * Evaluate access but with no object type list. + * NtAccessCheckByType will be treated as a normal NtAccessCheck. + */ + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_READ, + NULL, + 0, + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_READ, "Expected KEY_READ as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + ok(PrivilegeSet != NULL, "PrivilegeSet is NULL when it mustn't be!\n"); + ok(PrivilegeSetLength != 0, "PrivilegeSetLength mustn't be 0!\n"); + +Quit: + if (Token) + { + NtClose(Token); + } + + if (UsersSid) + { + RtlFreeSid(UsersSid); + } + + if (AdminSid) + { + RtlFreeSid(AdminSid); + } + + if (PrivilegeSet) + { + RtlFreeHeap(RtlGetProcessHeap(), 0, PrivilegeSet); + } +} + +static +VOID +AccessGrantedTests(VOID) +{ + NTSTATUS Status; + NTSTATUS AccessStatus; + ACCESS_MASK GrantedAccess; + PPRIVILEGE_SET PrivilegeSet = NULL; + ULONG PrivilegeSetLength; + HANDLE Token = NULL; + PACL Dacl = NULL; + ULONG DaclSize; + SECURITY_DESCRIPTOR Sd; + OBJECT_TYPE_LIST ObjTypeList[2]; + PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL; + + /* Allocate all the stuff we need */ + PrivilegeSetLength = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]); + PrivilegeSet = RtlAllocateHeap(RtlGetProcessHeap(), 0, PrivilegeSetLength); + if (PrivilegeSet == NULL) + { + skip("Failed to allocate PrivilegeSet, skipping tests\n"); + return; + } + + Status = RtlAllocateAndInitializeSid(&WorldAuthority, + 1, + SECURITY_WORLD_RID, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + &EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create Everyone SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAllocateAndInitializeSid(&NtAuthority, + 2, + SECURITY_BUILTIN_DOMAIN_RID, + DOMAIN_ALIAS_RID_ADMINS, + 0, + 0, + 0, + 0, + 0, + 0, + &AdminSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create Admins SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAllocateAndInitializeSid(&NtAuthority, + 2, + SECURITY_BUILTIN_DOMAIN_RID, + DOMAIN_ALIAS_RID_USERS, + 0, + 0, + 0, + 0, + 0, + 0, + &UsersSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create User SID, skipping tests\n"); + goto Quit; + } + + Token = GetTokenProcess(TRUE, TRUE); + if (Token == NULL) + { + skip("Failed to get token, skipping tests\n"); + goto Quit; + } + + Status = RtlCreateSecurityDescriptor(&Sd, SECURITY_DESCRIPTOR_REVISION); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create a security descriptor, skipping tests\n"); + goto Quit; + } + + DaclSize = sizeof(ACL) + + sizeof(ACCESS_ALLOWED_OBJECT_ACE) + RtlLengthSid(EveryoneSid) + + sizeof(ACCESS_ALLOWED_OBJECT_ACE) + RtlLengthSid(AdminSid); + Dacl = RtlAllocateHeap(RtlGetProcessHeap(), + HEAP_ZERO_MEMORY, + DaclSize); + if (Dacl == NULL) + { + skip("Failed to allocate memory for DACL, skipping tests\n"); + goto Quit; + } + + /* + * Create an ordinary ACL with an old revision. Object types are supported + * starting with Revision 4, so adding ACEs to it will fail. + */ + Status = RtlCreateAcl(Dacl, + DaclSize, + ACL_REVISION); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create DACL, skipping tests\n"); + goto Quit; + } + + Status = RtlAddAccessAllowedObjectAce(Dacl, + ACL_REVISION, + 0, + KEY_READ, + &ObjectType, + NULL, + EveryoneSid); + ok_hex(Status, STATUS_REVISION_MISMATCH); + + /* Free the ACL and create a proper one with correct revision */ + RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl); + Dacl = RtlAllocateHeap(RtlGetProcessHeap(), + HEAP_ZERO_MEMORY, + DaclSize); + if (Dacl == NULL) + { + skip("Failed to allocate memory for DACL, skipping tests\n"); + goto Quit; + } + + Status = RtlCreateAcl(Dacl, + DaclSize, + ACL_REVISION4); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create DACL, skipping tests\n"); + goto Quit; + } + + /* Setup ACEs -- READ for everyone and READ/WRITE for admins */ + Status = RtlAddAccessAllowedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_READ, + &ObjectType, + NULL, + EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add allowed object ACE for Everyone SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAddAccessAllowedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_READ | KEY_WRITE, + &ObjectType, + NULL, + AdminSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add allowed object ACE for Admins SID, skipping tests\n"); + goto Quit; + } + + /* Setup the descriptor */ + RtlSetGroupSecurityDescriptor(&Sd, UsersSid, FALSE); + RtlSetOwnerSecurityDescriptor(&Sd, AdminSid, FALSE); + RtlSetDaclSecurityDescriptor(&Sd, TRUE, Dacl, FALSE); + + /* Setup the object type list */ + ObjTypeList[0].Level = ACCESS_OBJECT_GUID; + ObjTypeList[0].Sbz = 0; + ObjTypeList[0].ObjectType = &ObjectType; + + ObjTypeList[1].Level = ACCESS_PROPERTY_SET_GUID; + ObjTypeList[1].Sbz = 0; + ObjTypeList[1].ObjectType = &ChildObjectType; + + /* Evaluate access -- KEY_READ has to be granted */ + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_READ, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_READ, "Expected KEY_READ as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + ok(PrivilegeSet != NULL, "PrivilegeSet is NULL when it mustn't be!\n"); + ok(PrivilegeSetLength != 0, "PrivilegeSetLength mustn't be 0!\n"); + + /* Admins should be granted WRITE access */ + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_WRITE, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_WRITE, "Expected KEY_WRITE as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + ok(PrivilegeSet != NULL, "PrivilegeSet is NULL when it mustn't be!\n"); + ok(PrivilegeSetLength != 0, "PrivilegeSetLength mustn't be 0!\n"); + +Quit: + if (Dacl) + { + RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl); + } + + if (Token) + { + NtClose(Token); + } + + if (UsersSid) + { + RtlFreeSid(UsersSid); + } + + if (AdminSid) + { + RtlFreeSid(AdminSid); + } + + if (EveryoneSid) + { + RtlFreeSid(EveryoneSid); + } + + if (PrivilegeSet) + { + RtlFreeHeap(RtlGetProcessHeap(), 0, PrivilegeSet); + } +} + +static +VOID +AccessGrantedMultipleObjectsTests(VOID) +{ + NTSTATUS Status; + NTSTATUS AccessStatus; + ACCESS_MASK GrantedAccess; + PPRIVILEGE_SET PrivilegeSet = NULL; + ULONG PrivilegeSetLength; + HANDLE Token = NULL; + PACL Dacl = NULL; + ULONG DaclSize; + SECURITY_DESCRIPTOR Sd; + OBJECT_TYPE_LIST ObjTypeList[6]; + PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL; + GUID ChildObjectType2 = {0x34578901, 0x3456, 0x7896, {0x3, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0x00}}; + GUID ChildObjectType3 = {0x45678901, 0x4567, 0x1122, {0x4, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x01}}; + GUID ChildObjectType4 = {0x56788901, 0x1111, 0x2222, {0x5, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x02}}; + GUID ChildObjectType5 = {0x67901234, 0x2222, 0x3333, {0x4, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x03}}; + + /* Allocate all the stuff we need */ + PrivilegeSetLength = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]); + PrivilegeSet = RtlAllocateHeap(RtlGetProcessHeap(), 0, PrivilegeSetLength); + if (PrivilegeSet == NULL) + { + skip("Failed to allocate PrivilegeSet, skipping tests\n"); + return; + } + + Status = RtlAllocateAndInitializeSid(&WorldAuthority, + 1, + SECURITY_WORLD_RID, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + &EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create Everyone SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAllocateAndInitializeSid(&NtAuthority, + 2, + SECURITY_BUILTIN_DOMAIN_RID, + DOMAIN_ALIAS_RID_ADMINS, + 0, + 0, + 0, + 0, + 0, + 0, + &AdminSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create Admins SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAllocateAndInitializeSid(&NtAuthority, + 2, + SECURITY_BUILTIN_DOMAIN_RID, + DOMAIN_ALIAS_RID_USERS, + 0, + 0, + 0, + 0, + 0, + 0, + &UsersSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create User SID, skipping tests\n"); + goto Quit; + } + + Token = GetTokenProcess(TRUE, TRUE); + if (Token == NULL) + { + skip("Failed to get token, skipping tests\n"); + goto Quit; + } + + Status = RtlCreateSecurityDescriptor(&Sd, SECURITY_DESCRIPTOR_REVISION); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create a security descriptor, skipping tests\n"); + goto Quit; + } + + DaclSize = sizeof(ACL) + + sizeof(ACCESS_ALLOWED_OBJECT_ACE) + RtlLengthSid(AdminSid) + + sizeof(ACCESS_ALLOWED_OBJECT_ACE) + RtlLengthSid(EveryoneSid) + + sizeof(ACCESS_ALLOWED_OBJECT_ACE) + RtlLengthSid(EveryoneSid) + + sizeof(ACCESS_ALLOWED_OBJECT_ACE) + RtlLengthSid(EveryoneSid) + + sizeof(ACCESS_ALLOWED_OBJECT_ACE) + RtlLengthSid(EveryoneSid) + + sizeof(ACCESS_ALLOWED_OBJECT_ACE) + RtlLengthSid(EveryoneSid); + Dacl = RtlAllocateHeap(RtlGetProcessHeap(), + HEAP_ZERO_MEMORY, + DaclSize); + if (Dacl == NULL) + { + skip("Failed to allocate memory for DACL, skipping tests\n"); + goto Quit; + } + + Status = RtlCreateAcl(Dacl, + DaclSize, + ACL_REVISION4); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create DACL, skipping tests\n"); + goto Quit; + } + + /* Setup some rights for these objects, admins are granted everything */ + Status = RtlAddAccessAllowedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_ALL_ACCESS, + &ObjectType, + NULL, + AdminSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add allowed object ACE for Admins SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAddAccessAllowedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_READ, + &ChildObjectType, + NULL, + EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add allowed object ACE for Everyone SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAddAccessAllowedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_WRITE, + &ChildObjectType2, + NULL, + EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add allowed object ACE for Everyone SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAddAccessAllowedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_EXECUTE, + &ChildObjectType3, + NULL, + EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add allowed object ACE for Everyone SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAddAccessAllowedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_SET_VALUE, + &ChildObjectType4, + NULL, + EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add allowed object ACE for Everyone SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAddAccessAllowedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_QUERY_VALUE, + &ChildObjectType5, + NULL, + EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add allowed object ACE for Everyone SID, skipping tests\n"); + goto Quit; + } + + /* Setup the descriptor */ + RtlSetGroupSecurityDescriptor(&Sd, UsersSid, FALSE); + RtlSetOwnerSecurityDescriptor(&Sd, AdminSid, FALSE); + RtlSetDaclSecurityDescriptor(&Sd, TRUE, Dacl, FALSE); + + /* Setup the object type list */ + ObjTypeList[0].Level = ACCESS_OBJECT_GUID; + ObjTypeList[0].Sbz = 0; + ObjTypeList[0].ObjectType = &ObjectType; + + ObjTypeList[1].Level = ACCESS_PROPERTY_SET_GUID; + ObjTypeList[1].Sbz = 0; + ObjTypeList[1].ObjectType = &ChildObjectType; + + ObjTypeList[2].Level = ACCESS_PROPERTY_GUID; + ObjTypeList[2].Sbz = 0; + ObjTypeList[2].ObjectType = &ChildObjectType2; + + ObjTypeList[3].Level = ACCESS_PROPERTY_GUID; + ObjTypeList[3].Sbz = 0; + ObjTypeList[3].ObjectType = &ChildObjectType3; + + ObjTypeList[4].Level = ACCESS_PROPERTY_SET_GUID; + ObjTypeList[4].Sbz = 0; + ObjTypeList[4].ObjectType = &ChildObjectType4; + + ObjTypeList[5].Level = ACCESS_PROPERTY_GUID; + ObjTypeList[5].Sbz = 0; + ObjTypeList[5].ObjectType = &ChildObjectType5; + + /* Evaluate access for each object case */ + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + MAXIMUM_ALLOWED, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_ALL_ACCESS, "Expected KEY_ALL_ACCESS as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_READ, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_READ, "Expected KEY_READ as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_WRITE, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_WRITE, "Expected KEY_WRITE as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_EXECUTE, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_EXECUTE, "Expected KEY_EXECUTE as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_SET_VALUE, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_SET_VALUE, "Expected KEY_SET_VALUE as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_QUERY_VALUE, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_QUERY_VALUE, "Expected KEY_QUERY_VALUE as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + +Quit: + if (Dacl) + { + RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl); + } + + if (Token) + { + NtClose(Token); + } + + if (UsersSid) + { + RtlFreeSid(UsersSid); + } + + if (AdminSid) + { + RtlFreeSid(AdminSid); + } + + if (EveryoneSid) + { + RtlFreeSid(EveryoneSid); + } + + if (PrivilegeSet) + { + RtlFreeHeap(RtlGetProcessHeap(), 0, PrivilegeSet); + } +} + +static +VOID +DenyAccessTests(VOID) +{ + NTSTATUS Status; + NTSTATUS AccessStatus; + ACCESS_MASK GrantedAccess; + PPRIVILEGE_SET PrivilegeSet = NULL; + ULONG PrivilegeSetLength; + HANDLE Token = NULL; + PACL Dacl = NULL; + ULONG DaclSize; + SECURITY_DESCRIPTOR Sd; + OBJECT_TYPE_LIST ObjTypeList[2]; + PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL; + + /* Allocate all the stuff we need */ + PrivilegeSetLength = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]); + PrivilegeSet = RtlAllocateHeap(RtlGetProcessHeap(), 0, PrivilegeSetLength); + if (PrivilegeSet == NULL) + { + skip("Failed to allocate PrivilegeSet, skipping tests\n"); + return; + } + + Status = RtlAllocateAndInitializeSid(&WorldAuthority, + 1, + SECURITY_WORLD_RID, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + &EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create Everyone SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAllocateAndInitializeSid(&NtAuthority, + 2, + SECURITY_BUILTIN_DOMAIN_RID, + DOMAIN_ALIAS_RID_ADMINS, + 0, + 0, + 0, + 0, + 0, + 0, + &AdminSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create Admins SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAllocateAndInitializeSid(&NtAuthority, + 2, + SECURITY_BUILTIN_DOMAIN_RID, + DOMAIN_ALIAS_RID_USERS, + 0, + 0, + 0, + 0, + 0, + 0, + &UsersSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create User SID, skipping tests\n"); + goto Quit; + } + + Token = GetTokenProcess(TRUE, TRUE); + if (Token == NULL) + { + skip("Failed to get token, skipping tests\n"); + goto Quit; + } + + Status = RtlCreateSecurityDescriptor(&Sd, SECURITY_DESCRIPTOR_REVISION); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create a security descriptor, skipping tests\n"); + goto Quit; + } + + DaclSize = sizeof(ACL) + + sizeof(ACCESS_DENIED_OBJECT_ACE) + RtlLengthSid(AdminSid) + + sizeof(ACCESS_DENIED_OBJECT_ACE) + RtlLengthSid(EveryoneSid) + + sizeof(ACCESS_ALLOWED_OBJECT_ACE) + RtlLengthSid(EveryoneSid); + Dacl = RtlAllocateHeap(RtlGetProcessHeap(), + HEAP_ZERO_MEMORY, + DaclSize); + if (Dacl == NULL) + { + skip("Failed to allocate memory for DACL, skipping tests\n"); + goto Quit; + } + + Status = RtlCreateAcl(Dacl, + DaclSize, + ACL_REVISION4); + if (!NT_SUCCESS(Status)) + { + skip("Failed to create DACL, skipping tests\n"); + goto Quit; + } + + /* + * Admins can't query values from keys and everyone else is denied writing to + * keys to child sub-object but can enumerate subkeys from the object itself. + */ + Status = RtlAddAccessDeniedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_QUERY_VALUE, + &ObjectType, + NULL, + AdminSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add deny object ACE for Admins SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAddAccessDeniedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_WRITE, + &ChildObjectType, + NULL, + EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add deny object ACE for Everyone SID, skipping tests\n"); + goto Quit; + } + + Status = RtlAddAccessAllowedObjectAce(Dacl, + ACL_REVISION4, + 0, + KEY_ENUMERATE_SUB_KEYS, + &ObjectType, + NULL, + EveryoneSid); + if (!NT_SUCCESS(Status)) + { + skip("Failed to add allowed object ACE for Everyone SID, skipping tests\n"); + goto Quit; + } + + /* Setup the descriptor */ + RtlSetGroupSecurityDescriptor(&Sd, UsersSid, FALSE); + RtlSetOwnerSecurityDescriptor(&Sd, AdminSid, FALSE); + RtlSetDaclSecurityDescriptor(&Sd, TRUE, Dacl, FALSE); + + /* Setup the object type list */ + ObjTypeList[0].Level = ACCESS_OBJECT_GUID; + ObjTypeList[0].Sbz = 0; + ObjTypeList[0].ObjectType = &ObjectType; + + ObjTypeList[1].Level = ACCESS_PROPERTY_SET_GUID; + ObjTypeList[1].Sbz = 0; + ObjTypeList[1].ObjectType = &ChildObjectType; + + /* Evaluate access -- they should be denied */ + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_QUERY_VALUE, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == 0, "Expected no access rights but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_ACCESS_DENIED, "Expected access denied as status but got 0x%08lx\n", AccessStatus); + + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_WRITE, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == 0, "Expected no access rights but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_ACCESS_DENIED, "Expected access denied as status but got 0x%08lx\n", AccessStatus); + + /* Everyone else should be granted only enumerate subkey access */ + Status = NtAccessCheckByType(&Sd, + NULL, + Token, + KEY_ENUMERATE_SUB_KEYS, + ObjTypeList, + RTL_NUMBER_OF(ObjTypeList), + &RegMapping, + PrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus); + ok_hex(Status, STATUS_SUCCESS); + ok(GrantedAccess == KEY_ENUMERATE_SUB_KEYS, "Expected KEY_ENUMERATE_SUB_KEYS as granted right but got 0x%08lx\n", GrantedAccess); + ok(AccessStatus == STATUS_SUCCESS, "Expected a success status but got 0x%08lx\n", AccessStatus); + +Quit: + if (Dacl) + { + RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl); + } + + if (Token) + { + NtClose(Token); + } + + if (UsersSid) + { + RtlFreeSid(UsersSid); + } + + if (AdminSid) + { + RtlFreeSid(AdminSid); + } + + if (EveryoneSid) + { + RtlFreeSid(EveryoneSid); + } + + if (PrivilegeSet) + { + RtlFreeHeap(RtlGetProcessHeap(), 0, PrivilegeSet); + } +} + +START_TEST(NtAccessCheckByType) +{ + ParamsValidationTests(); + AccessGrantedNoDaclTests(); + AccessGrantedTests(); + AccessGrantedMultipleObjectsTests(); + DenyAccessTests(); +} diff --git a/modules/rostests/apitests/ntdll/testlist.c b/modules/rostests/apitests/ntdll/testlist.c index 03857e1852a..321b8cddf4b 100644 --- a/modules/rostests/apitests/ntdll/testlist.c +++ b/modules/rostests/apitests/ntdll/testlist.c @@ -6,6 +6,7 @@ extern void func_LdrEnumResources(void); extern void func_load_notifications(void); extern void func_NtAcceptConnectPort(void); +extern void func_NtAccessCheckByType(void); extern void func_NtAdjustGroupsToken(void); extern void func_NtAdjustPrivilegesToken(void); extern void func_NtAllocateVirtualMemory(void); @@ -99,6 +100,7 @@ const struct test winetest_testlist[] = { "LdrEnumResources", func_LdrEnumResources }, { "load_notifications", func_load_notifications }, { "NtAcceptConnectPort", func_NtAcceptConnectPort }, + { "NtAccessCheckByType", func_NtAccessCheckByType }, { "NtAdjustGroupsToken", func_NtAdjustGroupsToken }, { "NtAdjustPrivilegesToken", func_NtAdjustPrivilegesToken }, { "NtAllocateVirtualMemory", func_NtAllocateVirtualMemory },

1 year, 10 months

[reactos] 08/10: [SDK:RTL] Fix the ACE revision check in RtlpAddKnownObjectAce

by George Bișoc

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=cad780e17caddbe7660d9… commit cad780e17caddbe7660d95755be5c145c4ada98b Author: George Bișoc <george.bisoc(a)reactos.org> AuthorDate: Wed Jul 5 20:31:23 2023 +0200 Commit: unknown <george.bisoc(a)reactos.org> CommitDate: Tue Aug 22 17:54:18 2023 +0200 [SDK:RTL] Fix the ACE revision check in RtlpAddKnownObjectAce Object ACEs are supported starting from Revision 4, the current code checks if the revision is above Revision 4. An Object ACE has to be strictly set on that revision, whereas Object ACLs can be of any revision starting from ACL_REVISION4. --- sdk/lib/rtl/acl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk/lib/rtl/acl.c b/sdk/lib/rtl/acl.c index afe41d0bcdb..efe7d331a57 100644 --- a/sdk/lib/rtl/acl.c +++ b/sdk/lib/rtl/acl.c @@ -173,7 +173,7 @@ RtlpAddKnownObjectAce(IN PACL Acl, if (!RtlValidSid(Sid)) return STATUS_INVALID_SID; /* Check the validity of the revision */ - if ((Acl->AclRevision > ACL_REVISION4) || (Revision > ACL_REVISION4)) + if ((Acl->AclRevision > ACL_REVISION4) || (Revision != ACL_REVISION4)) { return STATUS_REVISION_MISMATCH; }

1 year, 10 months

[reactos] 07/10: [SDK:RTL] Implement object type ACE validation checks

by George Bișoc

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=c175c4f47df477846efda… commit c175c4f47df477846efda556476fba45f405b4d1 Author: George Bișoc <george.bisoc(a)reactos.org> AuthorDate: Wed Jun 21 17:56:12 2023 +0200 Commit: unknown <george.bisoc(a)reactos.org> CommitDate: Tue Aug 22 17:54:18 2023 +0200 [SDK:RTL] Implement object type ACE validation checks Write the necessary ACL validation code for ACEs whose types are ACCESS_ALLOWED_OBJECT_ACE_TYPE or ACCESS_DENIED_OBJECT_ACE_TYPE. This ensures each created object type ACL has valid ACE contents. --- sdk/lib/rtl/acl.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/sdk/lib/rtl/acl.c b/sdk/lib/rtl/acl.c index e7fa8e3c7cf..afe41d0bcdb 100644 --- a/sdk/lib/rtl/acl.c +++ b/sdk/lib/rtl/acl.c @@ -839,6 +839,9 @@ RtlValidAcl(IN PACL Acl) PACE_HEADER Ace; PISID Sid; ULONG i; + USHORT RequiredObjectAceSize; + PULONG Flags; + ULONG GuidSize; PAGED_CODE_RTL(); _SEH2_TRY @@ -929,6 +932,68 @@ RtlValidAcl(IN PACL Acl) _SEH2_YIELD(return FALSE); } } + else if (Ace->AceType == ACCESS_ALLOWED_OBJECT_ACE_TYPE || + Ace->AceType == ACCESS_DENIED_OBJECT_ACE_TYPE) + { + /* Object ACEs are supported starting with Revision 4 */ + if (Acl->AclRevision < ACL_REVISION4) + { + DPRINT1("Invalid ACL revision for Object ACE: %u\n", Acl->AclRevision); + _SEH2_YIELD(return FALSE); + } + + /* Validate the length of this ACE */ + if (ROUND_DOWN(Ace->AceSize, sizeof(ULONG)) != Ace->AceSize) + { + DPRINT1("Misaligned Object ACE size: %lx\n", Ace->AceSize); + _SEH2_YIELD(return FALSE); + } + + /* The ACE size should at least have enough space for the known object ACE header */ + if (Ace->AceSize < sizeof(KNOWN_OBJECT_ACE)) + { + DPRINT1("Too small Object ACE size to hold KNOWN_OBJECT_ACE header: %lx\n", Ace->AceSize); + _SEH2_YIELD(return FALSE); + } + + /* This ACL may have multiple Object ACEs so reset the size counter */ + GuidSize = 0; + + /* If we have GUIDs include them */ + Flags = (PULONG)&((PKNOWN_OBJECT_ACE)Ace)->Flags; + if (*Flags & ACE_OBJECT_TYPE_PRESENT) + { + GuidSize += sizeof(GUID); + } + + if (*Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT) + { + GuidSize += sizeof(GUID); + } + + /* Check if the SID revision is valid */ + Sid = (PISID)((ULONG_PTR)&((PKNOWN_OBJECT_ACE)Ace)->SidStart + GuidSize); + if (Sid->Revision != SID_REVISION) + { + DPRINT1("Object ACE SID has invalid revision: %u\n", Sid->Revision); + _SEH2_YIELD(return FALSE); + } + + /* Check if the SID is out of bounds */ + if (Sid->SubAuthorityCount > SID_MAX_SUB_AUTHORITIES) + { + DPRINT1("Object ACE SID's sub-authority count is out of bounds: %u\n", Sid->SubAuthorityCount); + _SEH2_YIELD(return FALSE); + } + + /* The ACE size should at least have enough space for the known object ACE header, GUIDs and the SID */ + RequiredObjectAceSize = (sizeof(KNOWN_OBJECT_ACE) - sizeof(ULONG)) + GuidSize + RtlLengthSid(Sid); + if (Ace->AceSize < RequiredObjectAceSize) + { + DPRINT1("Too small Object ACE size: AceSize %u RequiredSize %u\n", Ace->AceSize, RequiredObjectAceSize); + _SEH2_YIELD(return FALSE); + } + } else if (Ace->AceType == ACCESS_ALLOWED_COMPOUND_ACE_TYPE) { DPRINT1("Unsupported ACE in ReactOS, assuming valid\n");

1 year, 10 months

[reactos] 06/10: [NTOS:SE] Cast the ACE to known ACE type variants on SepGetSidFromAce

by George Bișoc

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=8289de6ef784e19920f60… commit 8289de6ef784e19920f6011ecfcd0533647ab1c1 Author: George Bișoc <george.bisoc(a)reactos.org> AuthorDate: Sun Jul 16 20:45:13 2023 +0200 Commit: unknown <george.bisoc(a)reactos.org> CommitDate: Tue Aug 22 17:54:18 2023 +0200 [NTOS:SE] Cast the ACE to known ACE type variants on SepGetSidFromAce ACCESS_DENIED_ACE_TYPE, ACCESS_ALLOWED_ACE_TYPE, SYSTEM_AUDIT_ACE_TYPE and SYSTEM_ALARM_ACE_TYPE belong to the same commonly internal ACE type, aka KNOWN_ACE, as each of these ACEs have the same structure field offsets. The only difference are ACCESS_DENIED_OBJECT_ACE_TYPE and ACCESS_ALLOWED_OBJECT_ACE_TYPE as they have their own internal ACE type variant, the KNOWN_OBJECT_ACE structure. The general guideline is that public ACE structure variants have to be used elsehwere such as in UM whilst the kernel has to use the internal known ACE type variants when possible. --- ntoskrnl/se/sid.c | 42 ++++++++++++++++-------------------------- sdk/include/xdk/setypes.h | 4 ++++ 2 files changed, 20 insertions(+), 26 deletions(-) diff --git a/ntoskrnl/se/sid.c b/ntoskrnl/se/sid.c index 557447f539f..033d322d708 100644 --- a/ntoskrnl/se/sid.c +++ b/ntoskrnl/se/sid.c @@ -580,51 +580,41 @@ SepGetSidFromAce( _In_ UCHAR AceType, _In_ PACE Ace) { - PSID Sid; + PULONG Flags; + ULONG GuidSize = 0; + PSID Sid = NULL; PAGED_CODE(); /* Sanity check */ ASSERT(Ace); - /* Initialize the SID */ - Sid = NULL; - /* Obtain the SID based upon ACE type */ switch (AceType) { case ACCESS_DENIED_ACE_TYPE: - { - Sid = (PSID)&((PACCESS_DENIED_ACE)Ace)->SidStart; - break; - } - case ACCESS_ALLOWED_ACE_TYPE: + case SYSTEM_AUDIT_ACE_TYPE: + case SYSTEM_ALARM_ACE_TYPE: { - Sid = (PSID)&((PACCESS_ALLOWED_ACE)Ace)->SidStart; + Sid = (PSID)&((PKNOWN_ACE)Ace)->SidStart; break; } case ACCESS_DENIED_OBJECT_ACE_TYPE: - { - Sid = (PSID)&((PACCESS_DENIED_OBJECT_ACE)Ace)->SidStart; - break; - } - case ACCESS_ALLOWED_OBJECT_ACE_TYPE: { - Sid = (PSID)&((PACCESS_ALLOWED_OBJECT_ACE)Ace)->SidStart; - break; - } + Flags = (PULONG)&((PKNOWN_OBJECT_ACE)Ace)->Flags; + if (*Flags & ACE_OBJECT_TYPE_PRESENT) + { + GuidSize += sizeof(GUID); + } - case SYSTEM_AUDIT_ACE_TYPE: - { - Sid = (PSID)&((PSYSTEM_AUDIT_ACE)Ace)->SidStart; - break; - } + if (*Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT) + { + GuidSize += sizeof(GUID); + } - case SYSTEM_ALARM_ACE_TYPE: - { - Sid = (PSID)&((PSYSTEM_ALARM_ACE)Ace)->SidStart; + Sid = (PSID)((ULONG_PTR)&((PKNOWN_OBJECT_ACE)Ace)->SidStart + GuidSize); break; } diff --git a/sdk/include/xdk/setypes.h b/sdk/include/xdk/setypes.h index a46e4295274..0a538747bda 100644 --- a/sdk/include/xdk/setypes.h +++ b/sdk/include/xdk/setypes.h @@ -801,6 +801,10 @@ typedef struct _SYSTEM_MANDATORY_LABEL_ACE { $ULONG SidStart; } SYSTEM_MANDATORY_LABEL_ACE, *PSYSTEM_MANDATORY_LABEL_ACE; +/* Object ACE flags */ +#define ACE_OBJECT_TYPE_PRESENT 0x00000001 +#define ACE_INHERITED_OBJECT_TYPE_PRESENT 0x00000002 + #define SYSTEM_MANDATORY_LABEL_NO_WRITE_UP 0x1 #define SYSTEM_MANDATORY_LABEL_NO_READ_UP 0x2 #define SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP 0x4

1 year, 10 months

[reactos] 05/10: [NTOS:SE] Implement access security checks by type

by George Bișoc

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=a42f642ea117ffc27a378… commit a42f642ea117ffc27a378c4938b555dfdd461a45 Author: George Bișoc <george.bisoc(a)reactos.org> AuthorDate: Wed Jun 21 17:55:19 2023 +0200 Commit: unknown <george.bisoc(a)reactos.org> CommitDate: Tue Aug 22 17:54:17 2023 +0200 [NTOS:SE] Implement access security checks by type - Implement SepDenyAccessObjectTypeResultList, SepAllowAccessObjectTypeResultList, SepDenyAccessObjectTypeList and SepAllowAccessObjectTypeList. These routines will be used to grant or deny access to sub-objects of an object in the list. - Refactor SepAnalyzeAcesFromDacl and SepAccessCheck to accomodate the newly implemented access check by type mechanism. - SepAccessCheck will now be SepAccessCheckWorker, a worker helper function that further abstracts the access check mechanism in the kernel. Whereas the SepAccessCheck name will be used as a centralized function used by the access check NT system calls. - Deprecate SepGetSDOwner and SepGetSDGroup in favor of SepGetOwnerFromDescriptor and SepGetGroupFromDescriptor. The former functions were buggy as they might potentially return garbage data if either the owner or group were passed as NULL to a security descriptor, hence a second chance exception fault. This was caught when writing tests for NtAccessCheckByType. - Shorten the debug prints by removing the name of the functions, the person who reads the debugger output has to look at the source code anyway. --- ntoskrnl/se/accesschk.c | 1928 ++++++++++++++++++++++++++++++++++------------- 1 file changed, 1409 insertions(+), 519 deletions(-) diff --git a/ntoskrnl/se/accesschk.c b/ntoskrnl/se/accesschk.c index 690f7c029e7..d63e07429e8 100644 --- a/ntoskrnl/se/accesschk.c +++ b/ntoskrnl/se/accesschk.c @@ -15,6 +15,371 @@ /* PRIVATE FUNCTIONS **********************************************************/ +/** + * @brief + * Denies access of a target object and the children objects + * in an object type list. + * + * @param[in,out] ObjectTypeList + * A pointer to an object type list where access is to be + * denied for the target object and its children in the + * hierarchy list. + * + * @param[in] ObjectTypeListLength + * The length of the object type list. This length represents + * the number of object elements in the list. + * + * @param[in] AccessMask + * The access mask right that is to be denied for the object. + * + * @param[in] ObjectTypeGuid + * A pointer to a object type GUID, that identifies the object. + * This GUID is used to search for the target object in the list. + * If this parameter is set to NULL, the function will deny access + * starting from the object itself in the list (aka the root). + */ +static +VOID +SepDenyAccessObjectTypeResultList( + _Inout_ POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, + _In_ ULONG ObjectTypeListLength, + _In_ ACCESS_MASK AccessMask, + _In_opt_ PGUID ObjectTypeGuid) +{ + ULONG ObjectTypeIndex; + ULONG ReturnedObjectIndex; + USHORT Level; + + PAGED_CODE(); + + DPRINT("Access rights 0x%08lx\n", AccessMask); + + /* + * The object type of interest is the one that was supplied + * by the creator who made the ACE. If the object type was + * not supplied then we have no clear indication from where + * shall we start updating the access rights of objects on + * this list, so we have to begin from the root (aka the + * object itself). + */ + if (!ObjectTypeGuid) + { + DPRINT("No object type provided, updating access rights from root\n"); + ReturnedObjectIndex = 0; + goto LoopAndUpdateRightsObjects; + } + + /* Check if that object exists in the list */ + if (SepObjectTypeGuidInList(ObjectTypeList, + ObjectTypeListLength, + ObjectTypeGuid, + &ReturnedObjectIndex)) + { +LoopAndUpdateRightsObjects: + /* Update the access rights of the target object */ + ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.DeniedAccessRights |= + (AccessMask & ~ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.GrantedAccessRights); + DPRINT("Denied rights 0x%08lx of target object at index %lu\n", + ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.DeniedAccessRights, ReturnedObjectIndex); + + /* And update the children of the target object */ + for (ObjectTypeIndex = ReturnedObjectIndex + 1; + ObjectTypeIndex < ObjectTypeListLength; + ObjectTypeIndex++) + { + /* + * Stop looking for children objects if we hit an object that has + * the same level as the target object or less. + */ + Level = ObjectTypeList[ObjectTypeIndex].Level; + if (Level <= ObjectTypeList[ReturnedObjectIndex].Level) + { + DPRINT("We looked for all children objects, stop looking\n"); + break; + } + + /* Update the access right of the child */ + ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.DeniedAccessRights |= + (AccessMask & ~ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.GrantedAccessRights); + DPRINT("Denied rights 0x%08lx of child object at index %lu\n", + ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.DeniedAccessRights, ObjectTypeIndex); + } + } +} + +/** + * @brief + * Allows access of a target object and the children objects + * in an object type list. + * + * @param[in,out] ObjectTypeList + * A pointer to an object type list where access is to be + * allowed for the target object and its children in the + * hierarchy list. + * + * @param[in] ObjectTypeListLength + * The length of the object type list. This length represents + * the number of object elements in the list. + * + * @param[in] AccessMask + * The access mask right that is to be allowed for the object. + * + * @param[in] ObjectTypeGuid + * A pointer to a object type GUID, that identifies the object. + * This GUID is used to search for the target object in the list. + * If this parameter is set to NULL, the function will allow access + * starting from the object itself in the list (aka the root). + */ +static +VOID +SepAllowAccessObjectTypeResultList( + _Inout_ POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, + _In_ ULONG ObjectTypeListLength, + _In_ ACCESS_MASK AccessMask, + _In_opt_ PGUID ObjectTypeGuid) +{ + ULONG ObjectTypeIndex; + ULONG ReturnedObjectIndex; + USHORT Level; + + PAGED_CODE(); + + DPRINT("Access rights 0x%08lx\n", AccessMask); + + /* + * Begin updating the access rights from the root object + * (see comment in SepDenyAccessObjectTypeListMaximum). + */ + if (!ObjectTypeGuid) + { + DPRINT("No object type provided, updating access rights from root\n"); + ReturnedObjectIndex = 0; + goto LoopAndUpdateRightsObjects; + } + + /* Check if that object exists in the list */ + if (SepObjectTypeGuidInList(ObjectTypeList, + ObjectTypeListLength, + ObjectTypeGuid, + &ReturnedObjectIndex)) + { +LoopAndUpdateRightsObjects: + /* Update the access rights of the target object */ + ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.GrantedAccessRights |= + (AccessMask & ~ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.DeniedAccessRights); + DPRINT("Granted rights 0x%08lx of target object at index %lu\n", + ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.GrantedAccessRights, ReturnedObjectIndex); + + /* And update the children of the target object */ + for (ObjectTypeIndex = ReturnedObjectIndex + 1; + ObjectTypeIndex < ObjectTypeListLength; + ObjectTypeIndex++) + { + /* + * Stop looking for children objects if we hit an object that has + * the same level as the target object or less. + */ + Level = ObjectTypeList[ObjectTypeIndex].Level; + if (Level <= ObjectTypeList[ReturnedObjectIndex].Level) + { + break; + } + + /* Update the access right of the child */ + ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.GrantedAccessRights |= + (AccessMask & ~ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.DeniedAccessRights); + DPRINT("Granted rights 0x%08lx of child object at index %lu\n", + ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.GrantedAccessRights, ObjectTypeIndex); + } + } +} + +/** + * @brief + * Denies access of a target object in the object type + * list. This access is denied for the whole hierarchy + * in the list. + * + * @param[in,out] ObjectTypeList + * A pointer to an object type list where access is to be + * denied for the target object. This operation applies + * for the entire hierarchy of the object type list. + * + * @param[in] ObjectTypeListLength + * The length of the object type list. This length represents + * the number of object elements in the list. + * + * @param[in] AccessMask + * The access mask right that is to be denied for the object. + * + * @param[in] ObjectTypeGuid + * A pointer to a object type GUID, that identifies the object. + * This GUID is used to search for the target object in the list. + * If this parameter is set to NULL, the function will deny access + * to the object itself in the list (aka the root). + * + * @param[out] BreakOnDeny + * A pointer returned boolean value to the caller. The function + * will return TRUE if the requested remaining right is denied + * by the ACE, otherwise it returns FALSE. + */ +static +VOID +SepDenyAccessObjectTypeList( + _Inout_ POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, + _In_ ULONG ObjectTypeListLength, + _In_ ACCESS_MASK AccessMask, + _In_opt_ PGUID ObjectTypeGuid, + _Out_opt_ PBOOLEAN BreakOnDeny) +{ + ULONG ReturnedObjectIndex; + BOOLEAN MustBreak; + + PAGED_CODE(); + + DPRINT("Access rights 0x%08lx\n", AccessMask); + + /* Assume we do not want to break at first */ + MustBreak = FALSE; + + /* + * If no object type was supplied then tell the caller it has to break on + * searching for other ACEs if the requested remaining access right is + * denied by the deny ACE itself. Track down that denied right too. + */ + if (!ObjectTypeGuid) + { + if (ObjectTypeList[0].ObjectAccessRights.RemainingAccessRights & AccessMask) + { + DPRINT("Root object requests remaining access right that is denied 0x%08lx\n", AccessMask); + MustBreak = TRUE; + } + + ObjectTypeList[0].ObjectAccessRights.DeniedAccessRights |= + (AccessMask & ~ObjectTypeList[0].ObjectAccessRights.GrantedAccessRights); + DPRINT("Denied rights of root object 0x%08lx\n", ObjectTypeList[0].ObjectAccessRights.DeniedAccessRights); + goto Quit; + } + + /* + * If the object exists tell the caller it has to break down if the requested + * remaining access right is denied by the ACE. Track down the denied right too. + */ + if (SepObjectTypeGuidInList(ObjectTypeList, + ObjectTypeListLength, + ObjectTypeGuid, + &ReturnedObjectIndex)) + { + if (ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.RemainingAccessRights & AccessMask) + { + DPRINT("Object at index %lu requests remaining access right that is denied 0x%08lx\n", ReturnedObjectIndex, AccessMask); + MustBreak = TRUE; + } + + ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.DeniedAccessRights |= + (AccessMask & ~ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.GrantedAccessRights); + DPRINT("Denied rights 0x%08lx of object at index %lu\n", + ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.DeniedAccessRights, ReturnedObjectIndex); + } + +Quit: + /* Signal the caller he has to break if he wants to */ + if (BreakOnDeny) + { + *BreakOnDeny = MustBreak; + } +} + +/** + * @brief + * Allows access of a target object in the object type + * list. This access is allowed for the whole hierarchy + * in the list. + * + * @param[in,out] ObjectTypeList + * A pointer to an object type list where access is to be + * allowed for the target object. This operation applies + * for the entire hierarchy of the object type list. + * + * @param[in] ObjectTypeListLength + * The length of the object type list. This length represents + * the number of object elements in the list. + * + * @param[in] AccessMask + * The access mask right that is to be allowed for the object. + * + * @param[in] RemoveRemainingRights + * If set to TRUE, the function will remove the remaining rights + * of a target object. It will also grant access of the said object. + * Otherwise if set to FALSE, the function will only grant access. + * + * @param[in] ObjectTypeGuid + * A pointer to a object type GUID, that identifies the object. + * This GUID is used to search for the target object in the list. + * If this parameter is set to NULL, the function will allow access + * to the object itself in the list (aka the root). + */ +static +VOID +SepAllowAccessObjectTypeList( + _Inout_ POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, + _In_ ULONG ObjectTypeListLength, + _In_ ACCESS_MASK AccessMask, + _In_ BOOLEAN RemoveRemainingRights, + _In_opt_ PGUID ObjectTypeGuid) +{ + ULONG ReturnedObjectIndex; + + PAGED_CODE(); + + DPRINT("Access rights 0x%08lx\n", AccessMask); + + /* + * If no object type was supplied then remove the remaining rights + * of the object itself, the root. Track down that right to the + * granted rights as well. + */ + if (!ObjectTypeGuid) + { + if (RemoveRemainingRights) + { + ObjectTypeList[0].ObjectAccessRights.RemainingAccessRights &= ~AccessMask; + DPRINT("Remaining rights of root object 0x%08lx\n", ObjectTypeList[0].ObjectAccessRights.RemainingAccessRights); + } + + ObjectTypeList[0].ObjectAccessRights.GrantedAccessRights |= + (AccessMask & ~ObjectTypeList[0].ObjectAccessRights.DeniedAccessRights); + DPRINT("Granted rights of root object 0x%08lx\n", ObjectTypeList[0].ObjectAccessRights.GrantedAccessRights); + return; + } + + /* + * Grant access to the object if it exists by removing the remaining + * rights. Unlike the NtAccessCheckByTypeResultList variant we do not + * care about the children of the target object beccause NtAccessCheckByType + * will either grant or deny access to the entire hierarchy of the list. + */ + if (SepObjectTypeGuidInList(ObjectTypeList, + ObjectTypeListLength, + ObjectTypeGuid, + &ReturnedObjectIndex)) + { + /* Remove the remaining rights of that object */ + if (RemoveRemainingRights) + { + ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.RemainingAccessRights &= ~AccessMask; + DPRINT("Remaining rights of object 0x%08lx at index %lu\n", + ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.RemainingAccessRights, ReturnedObjectIndex); + } + + /* And track it down to the granted access rights */ + ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.GrantedAccessRights |= + (AccessMask & ~ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.DeniedAccessRights); + DPRINT("Granted rights of object 0x%08lx at index %lu\n", + ObjectTypeList[ReturnedObjectIndex].ObjectAccessRights.GrantedAccessRights, ReturnedObjectIndex); + } +} + /** * @brief * Analyzes an access control entry that is present in a discretionary @@ -78,11 +443,19 @@ * question represents the number of elements in such array. This parameter must be 0 * if no array list is provided. * + * @param[in] UseResultList + * This parameter is to used to determine how to perform an object type access check. + * If set to TRUE, the function will either grant or deny access to the object and sub-objects + * in the hierarchy list. If set to FALSE, the function will either grant or deny access to + * the target that will affect the entire hierarchy of the list. This parameter is used + * if the access action type is AccessCheckMaximum. + * * @param[in,out] AccessCheckRights * A pointer to a structure that contains the access check rights. This function fills * up this structure with remaining, granted and denied rights to the caller for * access check. Henceforth, this parameter must not be NULL! */ +static VOID SepAnalyzeAcesFromDacl( _In_ ACCESS_CHECK_RIGHT_TYPE ActionType, @@ -93,15 +466,19 @@ SepAnalyzeAcesFromDacl( _In_ BOOLEAN IsTokenRestricted, _In_opt_ PSID PrincipalSelfSid, _In_ PGENERIC_MAPPING GenericMapping, - _In_opt_ POBJECT_TYPE_LIST ObjectTypeList, + _In_opt_ POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, _In_ ULONG ObjectTypeListLength, + _In_ BOOLEAN UseResultList, _Inout_ PACCESS_CHECK_RIGHTS AccessCheckRights) { NTSTATUS Status; PACE CurrentAce; ULONG AceIndex; + ULONG ObjectTypeIndex; PSID Sid; + PGUID ObjectTypeGuid; ACCESS_MASK Access; + BOOLEAN BreakOnDeny; PAGED_CODE(); @@ -109,10 +486,6 @@ SepAnalyzeAcesFromDacl( ASSERT(Dacl); ASSERT(AccessToken); - /* TODO: To be removed once we support object type handling in Se */ - DBG_UNREFERENCED_PARAMETER(ObjectTypeList); - DBG_UNREFERENCED_PARAMETER(ObjectTypeListLength); - /* TODO: To be removed once we support compound ACEs handling in Se */ DBG_UNREFERENCED_PARAMETER(PrimaryAccessToken); @@ -160,7 +533,7 @@ SepAnalyzeAcesFromDacl( /* Deny access rights that have not been granted yet */ AccessCheckRights->DeniedAccessRights |= (Access & ~AccessCheckRights->GrantedAccessRights); - DPRINT("SepAnalyzeAcesFromDacl(): DeniedAccessRights 0x%08lx\n", AccessCheckRights->DeniedAccessRights); + DPRINT("DeniedAccessRights 0x%08lx\n", AccessCheckRights->DeniedAccessRights); } } else if (CurrentAce->Header.AceType == ACCESS_ALLOWED_ACE_TYPE) @@ -182,12 +555,108 @@ SepAnalyzeAcesFromDacl( /* Grant access rights that have not been denied yet */ AccessCheckRights->GrantedAccessRights |= (Access & ~AccessCheckRights->DeniedAccessRights); - DPRINT("SepAnalyzeAcesFromDacl(): GrantedAccessRights 0x%08lx\n", AccessCheckRights->GrantedAccessRights); + DPRINT("GrantedAccessRights 0x%08lx\n", AccessCheckRights->GrantedAccessRights); + } + } + else if (CurrentAce->Header.AceType == ACCESS_DENIED_OBJECT_ACE_TYPE) + { + /* Get the SID and object type from this ACE */ + Sid = SepGetSidFromAce(ACCESS_DENIED_OBJECT_ACE_TYPE, CurrentAce); + ObjectTypeGuid = SepGetObjectTypeGuidFromAce(CurrentAce, TRUE); + ASSERT(Sid); + + if (SepSidInTokenEx(AccessToken, PrincipalSelfSid, Sid, TRUE, IsTokenRestricted)) + { + /* Get this access right from the ACE */ + Access = CurrentAce->AccessMask; + + /* Map this access right if it has a generic mask right */ + if ((Access & GENERIC_ACCESS) && GenericMapping) + { + RtlMapGenericMask(&Access, GenericMapping); + } + + /* If no list was passed treat this is as ACCESS_DENIED_ACE_TYPE */ + if (!ObjectTypeList && !ObjectTypeListLength) + { + AccessCheckRights->DeniedAccessRights |= (Access & ~AccessCheckRights->GrantedAccessRights); + DPRINT("DeniedAccessRights 0x%08lx\n", AccessCheckRights->DeniedAccessRights); + } + else if (!UseResultList) + { + /* + * We have an object type list but the caller wants to deny access + * to the entire hierarchy list. Evaluate the rights of the object + * for the whole list. Ignore what the function tells us if we have + * to break on deny or not because we only want to keep track of + * denied rights. + */ + SepDenyAccessObjectTypeList(ObjectTypeList, + ObjectTypeListLength, + Access, + ObjectTypeGuid, + NULL); + } + else + { + /* Otherwise evaluate the access rights for each sub-object */ + SepDenyAccessObjectTypeResultList(ObjectTypeList, + ObjectTypeListLength, + Access, + ObjectTypeGuid); + } + } + } + else if (CurrentAce->Header.AceType == ACCESS_ALLOWED_OBJECT_ACE_TYPE) + { + /* Get the SID and object type from this ACE */ + Sid = SepGetSidFromAce(ACCESS_ALLOWED_OBJECT_ACE_TYPE, CurrentAce); + ObjectTypeGuid = SepGetObjectTypeGuidFromAce(CurrentAce, FALSE); + ASSERT(Sid); + + if (SepSidInTokenEx(AccessToken, PrincipalSelfSid, Sid, FALSE, IsTokenRestricted)) + { + /* Get this access right from the ACE */ + Access = CurrentAce->AccessMask; + + /* Map this access right if it has a generic mask right */ + if ((Access & GENERIC_ACCESS) && GenericMapping) + { + RtlMapGenericMask(&Access, GenericMapping); + } + + /* If no list was passed treat this is as ACCESS_ALLOWED_ACE_TYPE */ + if (!ObjectTypeList && !ObjectTypeListLength) + { + AccessCheckRights->GrantedAccessRights |= (Access & ~AccessCheckRights->DeniedAccessRights); + DPRINT("GrantedAccessRights 0x%08lx\n", AccessCheckRights->GrantedAccessRights); + } + else if (!UseResultList) + { + /* + * We have an object type list but the caller wants to allow access + * to the entire hierarchy list. Evaluate the rights of the object + * for the whole list. + */ + SepAllowAccessObjectTypeList(ObjectTypeList, + ObjectTypeListLength, + Access, + FALSE, + ObjectTypeGuid); + } + else + { + /* Otherwise evaluate the access rights for each sub-object */ + SepAllowAccessObjectTypeResultList(ObjectTypeList, + ObjectTypeListLength, + Access, + ObjectTypeGuid); + } } } else { - DPRINT1("SepAnalyzeAcesFromDacl(): Unsupported ACE type 0x%lx\n", CurrentAce->Header.AceType); + DPRINT1("Unsupported ACE type 0x%lx\n", CurrentAce->Header.AceType); } } } @@ -207,6 +676,17 @@ SepAnalyzeAcesFromDacl( ASSERT(RemainingAccess != 0); AccessCheckRights->RemainingAccessRights = RemainingAccess; + /* Fill the remaining rights of each object in the list if we have one */ + if (ObjectTypeList && (ObjectTypeListLength != 0)) + { + for (ObjectTypeIndex = 0; + ObjectTypeIndex < ObjectTypeListLength; + ObjectTypeIndex++) + { + ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.RemainingAccessRights = RemainingAccess; + } + } + /* Loop over the DACL to retrieve ACEs */ for (AceIndex = 0; AceIndex < Dacl->AceCount; AceIndex++) { @@ -246,7 +726,7 @@ SepAnalyzeAcesFromDacl( */ if (AccessCheckRights->RemainingAccessRights & Access) { - DPRINT("SepAnalyzeAcesFromDacl(): Refuted access 0x%08lx\n", Access); + DPRINT("Refuted access 0x%08lx\n", Access); AccessCheckRights->DeniedAccessRights |= Access; break; } @@ -270,17 +750,107 @@ SepAnalyzeAcesFromDacl( } /* Remove the remaining rights */ - DPRINT("SepAnalyzeAcesFromDacl(): RemainingAccessRights 0x%08lx Access 0x%08lx\n", AccessCheckRights->RemainingAccessRights, Access); + DPRINT("RemainingAccessRights 0x%08lx Access 0x%08lx\n", AccessCheckRights->RemainingAccessRights, Access); AccessCheckRights->RemainingAccessRights &= ~Access; - DPRINT("SepAnalyzeAcesFromDacl(): RemainingAccessRights 0x%08lx\n", AccessCheckRights->RemainingAccessRights); + DPRINT("RemainingAccessRights 0x%08lx\n", AccessCheckRights->RemainingAccessRights); /* Track the granted access right */ AccessCheckRights->GrantedAccessRights |= Access; } } + else if (CurrentAce->Header.AceType == ACCESS_DENIED_OBJECT_ACE_TYPE) + { + /* Get the SID and object type from this ACE */ + Sid = SepGetSidFromAce(ACCESS_DENIED_OBJECT_ACE_TYPE, CurrentAce); + ObjectTypeGuid = SepGetObjectTypeGuidFromAce(CurrentAce, TRUE); + ASSERT(Sid); + + if (SepSidInTokenEx(AccessToken, PrincipalSelfSid, Sid, TRUE, IsTokenRestricted)) + { + /* Get this access right from the ACE */ + Access = CurrentAce->AccessMask; + + /* Map this access right if it has a generic mask right */ + if ((Access & GENERIC_ACCESS) && GenericMapping) + { + RtlMapGenericMask(&Access, GenericMapping); + } + + /* If no list was passed treat this is as ACCESS_DENIED_ACE_TYPE */ + if (!ObjectTypeList && !ObjectTypeListLength) + { + if (AccessCheckRights->RemainingAccessRights & Access) + { + DPRINT("Refuted access 0x%08lx\n", Access); + AccessCheckRights->DeniedAccessRights |= Access; + break; + } + } + else + { + /* + * Otherwise evaluate the rights of the object for the entire list. + * The function will signal us if the caller requested a right that is + * denied by the ACE of an object in the list. + */ + SepDenyAccessObjectTypeList(ObjectTypeList, + ObjectTypeListLength, + Access, + ObjectTypeGuid, + &BreakOnDeny); + + /* We are acknowledged the caller requested a denied right */ + if (BreakOnDeny) + { + DPRINT("Refuted access 0x%08lx\n", Access); + break; + } + } + } + } + else if (CurrentAce->Header.AceType == ACCESS_ALLOWED_OBJECT_ACE_TYPE) + { + /* Get the SID and object type from this ACE */ + Sid = SepGetSidFromAce(ACCESS_ALLOWED_OBJECT_ACE_TYPE, CurrentAce); + ObjectTypeGuid = SepGetObjectTypeGuidFromAce(CurrentAce, FALSE); + ASSERT(Sid); + + if (SepSidInTokenEx(AccessToken, PrincipalSelfSid, Sid, FALSE, IsTokenRestricted)) + { + /* Get this access right from the ACE */ + Access = CurrentAce->AccessMask; + + /* Map this access right if it has a generic mask right */ + if ((Access & GENERIC_ACCESS) && GenericMapping) + { + RtlMapGenericMask(&Access, GenericMapping); + } + + /* If no list was passed treat this is as ACCESS_ALLOWED_ACE_TYPE */ + if (!ObjectTypeList && !ObjectTypeListLength) + { + /* Remove the remaining rights */ + DPRINT("RemainingAccessRights 0x%08lx Access 0x%08lx\n", AccessCheckRights->RemainingAccessRights, Access); + AccessCheckRights->RemainingAccessRights &= ~Access; + DPRINT("RemainingAccessRights 0x%08lx\n", AccessCheckRights->RemainingAccessRights); + + /* Track the granted access right */ + AccessCheckRights->GrantedAccessRights |= Access; + } + else + { + /* Otherwise evaluate the rights of the object for the entire list */ + SepAllowAccessObjectTypeList(ObjectTypeList, + ObjectTypeListLength, + Access, + TRUE, + ObjectTypeGuid); + } + } + } else { - DPRINT1("SepAnalyzeAcesFromDacl(): Unsupported ACE type 0x%lx\n", CurrentAce->Header.AceType); + DPRINT1("Unsupported ACE type 0x%lx\n", CurrentAce->Header.AceType); } } } @@ -296,11 +866,10 @@ SepAnalyzeAcesFromDacl( /** * @brief - * Private function that determines whether security access rights can be given - * to the calling thread in order to access an object depending on the security - * descriptor and other security context entities, such as an owner. This - * function is the heart and brain of the whole access check algorithm in - * the kernel. + * Private worker function that determines whether security access rights can be + * givento the calling thread in order to access an object depending on the + * security descriptor and other security context entities, such as an owner. This + * function is the heart and brain of the whole access check algorithm in the kernel. * * @param[in] ClientAccessToken * A pointer to a client (thread) access token that requests access rights @@ -368,15 +937,15 @@ SepAnalyzeAcesFromDacl( * Returns TRUE if access onto the specific object is allowed, FALSE * otherwise. */ +static BOOLEAN -NTAPI -SepAccessCheck( +SepAccessCheckWorker( _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PACCESS_TOKEN ClientAccessToken, _In_ PACCESS_TOKEN PrimaryAccessToken, _In_opt_ PSID PrincipalSelfSid, _In_ ACCESS_MASK DesiredAccess, - _In_opt_ POBJECT_TYPE_LIST ObjectTypeList, + _In_opt_ POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, _In_ ULONG ObjectTypeListLength, _In_ ACCESS_MASK PreviouslyGrantedAccess, _In_ PGENERIC_MAPPING GenericMapping, @@ -387,12 +956,16 @@ SepAccessCheck( _Out_ PNTSTATUS AccessStatusList) { ACCESS_MASK RemainingAccess; - ULONG ResultListLength; + ACCESS_MASK WantedRights; + ACCESS_MASK MaskDesired; + ACCESS_MASK GrantedRights = 0; ULONG ResultListIndex; + ULONG ObjectTypeIndex; PACL Dacl; BOOLEAN Present; BOOLEAN Defaulted; NTSTATUS Status; + BOOLEAN AccessIsGranted = FALSE; PACCESS_TOKEN Token = NULL; ACCESS_CHECK_RIGHTS AccessCheckRights = {0}; @@ -408,7 +981,7 @@ SepAccessCheck( if (!PreviouslyGrantedAccess) { /* Then there's nothing to give */ - DPRINT1("SepAccessCheck(): The caller has no previously granted access gained!\n"); + DPRINT1("The caller has no previously granted access gained!\n"); Status = STATUS_ACCESS_DENIED; goto ReturnCommonStatus; } @@ -427,6 +1000,23 @@ SepAccessCheck( /* Initialize remaining access rights */ RemainingAccess = DesiredAccess; + /* + * Initialize the required rights if the caller wants to know access + * for the object and each sub-object in the list. + */ + if (UseResultList) + { + if (DesiredAccess & MAXIMUM_ALLOWED) + { + WantedRights = (DesiredAccess | PreviouslyGrantedAccess) & ~MAXIMUM_ALLOWED; + MaskDesired = ~MAXIMUM_ALLOWED; + } + else + { + WantedRights = MaskDesired = DesiredAccess | PreviouslyGrantedAccess; + } + } + /* * Obtain the token provided by the caller. Client (or also * called impersonation or thread) token takes precedence over @@ -501,15 +1091,19 @@ SepAccessCheck( } else { - DPRINT1("SepAccessCheck(): The DACL has no ACEs and the caller has no previously granted access!\n"); + DPRINT1("The DACL has no ACEs and the caller has no previously granted access!\n"); PreviouslyGrantedAccess = 0; Status = STATUS_ACCESS_DENIED; } goto ReturnCommonStatus; } - /* Determine the MAXIMUM_ALLOWED access rights according to the DACL */ - if (DesiredAccess & MAXIMUM_ALLOWED) + /* + * Determine the MAXIMUM_ALLOWED access rights according to the DACL. + * Or if the caller is supplying a list of object types then determine + * the rights of each object on that list. + */ + if ((DesiredAccess & MAXIMUM_ALLOWED) || UseResultList) { /* Perform access checks against ACEs from this DACL */ SepAnalyzeAcesFromDacl(AccessCheckMaximum, @@ -522,6 +1116,7 @@ SepAccessCheck( GenericMapping, ObjectTypeList, ObjectTypeListLength, + UseResultList, &AccessCheckRights); /* @@ -540,33 +1135,145 @@ SepAccessCheck( GenericMapping, ObjectTypeList, ObjectTypeListLength, + UseResultList, &AccessCheckRights); } - /* Fail if some rights have not been granted */ - RemainingAccess &= ~(MAXIMUM_ALLOWED | AccessCheckRights.GrantedAccessRights); - if (RemainingAccess != 0) + /* The caller did not provide an object type list, check access only for that object */ + if (!ObjectTypeList && !ObjectTypeListLength) { - DPRINT1("SepAccessCheck(): Failed to grant access rights. RemainingAccess = 0x%08lx DesiredAccess = 0x%08lx\n", RemainingAccess, DesiredAccess); - PreviouslyGrantedAccess = 0; - Status = STATUS_ACCESS_DENIED; - goto ReturnCommonStatus; - } + /* Fail if some rights have not been granted */ + RemainingAccess &= ~(MAXIMUM_ALLOWED | AccessCheckRights.GrantedAccessRights); + if (RemainingAccess != 0) + { + DPRINT1("Failed to grant access rights. RemainingAccess = 0x%08lx DesiredAccess = 0x%08lx\n", RemainingAccess, DesiredAccess); + PreviouslyGrantedAccess = 0; + Status = STATUS_ACCESS_DENIED; + goto ReturnCommonStatus; + } - /* Set granted access right and access status */ - PreviouslyGrantedAccess |= AccessCheckRights.GrantedAccessRights; - if (PreviouslyGrantedAccess != 0) - { - Status = STATUS_SUCCESS; + /* Set granted access right and access status */ + PreviouslyGrantedAccess |= AccessCheckRights.GrantedAccessRights; + if (PreviouslyGrantedAccess != 0) + { + Status = STATUS_SUCCESS; + } + else + { + DPRINT1("Failed to grant access rights. PreviouslyGrantedAccess == 0 DesiredAccess = %08lx\n", DesiredAccess); + Status = STATUS_ACCESS_DENIED; + } + + /* We are done here */ + goto ReturnCommonStatus; } - else + else if (!UseResultList) { - DPRINT1("SepAccessCheck(): Failed to grant access rights. PreviouslyGrantedAccess == 0 DesiredAccess = %08lx\n", DesiredAccess); - Status = STATUS_ACCESS_DENIED; - } + /* + * We have a list but the caller wants to know if access can be granted + * to an object in the list. Access will either be granted or denied + * to the whole hierarchy of the list. Look for every object in the list + * that has granted access rights and collect them. + */ + for (ObjectTypeIndex = 0; + ObjectTypeIndex < ObjectTypeListLength; + ObjectTypeIndex++) + { + if (ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.GrantedAccessRights != 0) + { + GrantedRights |= ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.GrantedAccessRights; + } + } - /* We have successfully granted all the rights */ - goto ReturnCommonStatus; + /* Now check if acccess can be granted */ + RemainingAccess &= ~(MAXIMUM_ALLOWED | GrantedRights); + if (RemainingAccess != 0) + { + DPRINT1("Failed to grant access rights to the whole object hierarchy list. RemainingAccess = 0x%08lx DesiredAccess = 0x%08lx\n", + RemainingAccess, DesiredAccess); + PreviouslyGrantedAccess = 0; + Status = STATUS_ACCESS_DENIED; + goto ReturnCommonStatus; + } + + /* Set granted access right and access status */ + PreviouslyGrantedAccess |= GrantedRights; + if (PreviouslyGrantedAccess != 0) + { + Status = STATUS_SUCCESS; + } + else + { + DPRINT1("Failed to grant access rights to the whole object hierarchy list. PreviouslyGrantedAccess == 0 DesiredAccess = %08lx\n", + DesiredAccess); + Status = STATUS_ACCESS_DENIED; + } + + /* We are done here */ + goto ReturnCommonStatus; + } + else + { + /* + * We have a list and the caller wants to know access for each + * sub-object in the list. Report the access status and granted + * rights for the object and each sub-object in the list. + */ + for (ObjectTypeIndex = 0; + ObjectTypeIndex < ObjectTypeListLength; + ObjectTypeIndex++) + { + /* Check if we have some rights */ + GrantedRights = (ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.GrantedAccessRights | PreviouslyGrantedAccess) & MaskDesired; + if (GrantedRights != 0) + { + /* + * If we still have some remaining rights to grant the ultimate + * conclusion is that the caller has no access to the object itself. + */ + RemainingAccess = (~GrantedRights & WantedRights); + if (RemainingAccess != 0) + { + DPRINT1("Failed to grant access rights at specific object at index %lu. RemainingAccess = 0x%08lx DesiredAccess = 0x%08lx\n", + ObjectTypeIndex, RemainingAccess, DesiredAccess); + AccessStatusList[ObjectTypeIndex] = STATUS_ACCESS_DENIED; + } + else + { + AccessStatusList[ObjectTypeIndex] = STATUS_SUCCESS; + } + } + else + { + /* No access is given */ + DPRINT1("Failed to grant access rights at specific object at index %lu. No access is given\n", ObjectTypeIndex); + AccessStatusList[ObjectTypeIndex] = STATUS_ACCESS_DENIED; + } + + /* Return the access rights to the caller */ + GrantedAccessList[ObjectTypeIndex] = GrantedRights; + } + + /* + * We have built a list of access statuses for each object but + * we still need to figure out the common status for the + * function. The same status code will be used to check if + * we should report any security debug stuff once we are done. + */ + Status = STATUS_SUCCESS; + for (ResultListIndex = 0; ResultListIndex < ObjectTypeListLength; ResultListIndex++) + { + /* There is at least one sub-object of which access cannot be granted */ + if (AccessStatusList[ResultListIndex] == STATUS_ACCESS_DENIED) + { + Status = AccessStatusList[ResultListIndex]; + break; + } + } + + /* We are done here */ + goto ReturnCommonStatus; + } } /* Grant rights according to the DACL */ @@ -580,15 +1287,45 @@ SepAccessCheck( GenericMapping, ObjectTypeList, ObjectTypeListLength, + UseResultList, &AccessCheckRights); - /* Fail if some rights have not been granted */ - if (AccessCheckRights.RemainingAccessRights != 0) + /* The caller did not provide an object type list, check access only for that object */ + if (!ObjectTypeList && !ObjectTypeListLength) { - DPRINT1("SepAccessCheck(): Failed to grant access rights. RemainingAccess = 0x%08lx DesiredAccess = 0x%08lx\n", AccessCheckRights.RemainingAccessRights, DesiredAccess); - PreviouslyGrantedAccess = 0; - Status = STATUS_ACCESS_DENIED; - goto ReturnCommonStatus; + /* Fail if some rights have not been granted */ + if (AccessCheckRights.RemainingAccessRights != 0) + { + DPRINT1("Failed to grant access rights. RemainingAccess = 0x%08lx DesiredAccess = 0x%08lx\n", AccessCheckRights.RemainingAccessRights, DesiredAccess); + PreviouslyGrantedAccess = 0; + Status = STATUS_ACCESS_DENIED; + goto ReturnCommonStatus; + } + } + else + { + /* + * We have an object type list, look for the object of which + * remaining rights are all granted. + */ + for (ObjectTypeIndex = 0; + ObjectTypeIndex < ObjectTypeListLength; + ObjectTypeIndex++) + { + if (ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.RemainingAccessRights == 0) + { + AccessIsGranted = TRUE; + break; + } + } + + if (!AccessIsGranted) + { + DPRINT1("Failed to grant access rights to the whole object hierarchy list. DesiredAccess = 0x%08lx\n", DesiredAccess); + PreviouslyGrantedAccess = 0; + Status = STATUS_ACCESS_DENIED; + goto ReturnCommonStatus; + } } /* @@ -607,15 +1344,49 @@ SepAccessCheck( GenericMapping, ObjectTypeList, ObjectTypeListLength, + UseResultList, &AccessCheckRights); - /* Fail if some rights have not been granted */ - if (AccessCheckRights.RemainingAccessRights != 0) + /* The caller did not provide an object type list, check access only for that object */ + if (!ObjectTypeList && !ObjectTypeListLength) { - DPRINT1("SepAccessCheck(): Failed to grant access rights. RemainingAccess = 0x%08lx DesiredAccess = 0x%08lx\n", AccessCheckRights.RemainingAccessRights, DesiredAccess); - PreviouslyGrantedAccess = 0; - Status = STATUS_ACCESS_DENIED; - goto ReturnCommonStatus; + /* Fail if some rights have not been granted */ + if (AccessCheckRights.RemainingAccessRights != 0) + { + DPRINT1("Failed to grant access rights. RemainingAccess = 0x%08lx DesiredAccess = 0x%08lx\n", AccessCheckRights.RemainingAccessRights, DesiredAccess); + PreviouslyGrantedAccess = 0; + Status = STATUS_ACCESS_DENIED; + goto ReturnCommonStatus; + } + } + else + { + /* + * We have an object type list, look for the object of which remaining + * rights are all granted. The user may have access to the requested + * object but on a restricted token case the user is only granted partial + * access. If access is denied to restricted SIDs, the bottom line is that + * access is denied to the user. + */ + AccessIsGranted = FALSE; + for (ObjectTypeIndex = 0; + ObjectTypeIndex < ObjectTypeListLength; + ObjectTypeIndex++) + { + if (ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.RemainingAccessRights == 0) + { + AccessIsGranted = TRUE; + break; + } + } + + if (!AccessIsGranted) + { + DPRINT1("Failed to grant access rights to the whole object hierarchy list. DesiredAccess = 0x%08lx\n", DesiredAccess); + PreviouslyGrantedAccess = 0; + Status = STATUS_ACCESS_DENIED; + goto ReturnCommonStatus; + } } } @@ -625,7 +1396,7 @@ SepAccessCheck( /* Fail if no rights have been granted */ if (PreviouslyGrantedAccess == 0) { - DPRINT1("SepAccessCheck(): Failed to grant access rights. PreviouslyGrantedAccess == 0 DesiredAccess = %08lx\n", DesiredAccess); + DPRINT1("Failed to grant access rights. PreviouslyGrantedAccess == 0 DesiredAccess = %08lx\n", DesiredAccess); Status = STATUS_ACCESS_DENIED; goto ReturnCommonStatus; } @@ -637,11 +1408,10 @@ SepAccessCheck( Status = STATUS_SUCCESS; ReturnCommonStatus: - ResultListLength = UseResultList ? ObjectTypeListLength : 1; - for (ResultListIndex = 0; ResultListIndex < ResultListLength; ResultListIndex++) + if (!UseResultList) { - GrantedAccessList[ResultListIndex] = PreviouslyGrantedAccess; - AccessStatusList[ResultListIndex] = Status; + *GrantedAccessList = PreviouslyGrantedAccess; + *AccessStatusList = Status; } #if DBG @@ -650,67 +1420,25 @@ ReturnCommonStatus: { SepDumpSdDebugInfo(SecurityDescriptor); SepDumpTokenDebugInfo(Token); - SepDumpAccessRightsStats(&AccessCheckRights); + + if (ObjectTypeList && (ObjectTypeListLength != 0)) + { + SepDumpAccessAndStatusList(GrantedAccessList, + AccessStatusList, + UseResultList, + ObjectTypeList, + ObjectTypeListLength); + } + else + { + SepDumpAccessRightsStats(&AccessCheckRights); + } } #endif return NT_SUCCESS(Status); } -/** - * @brief - * Retrieves the main user from a security descriptor. - * - * @param[in] SecurityDescriptor - * A valid allocated security descriptor structure where the owner - * is to be retrieved. - * - * @return - * Returns a SID that represents the main user (owner). - */ -static PSID -SepGetSDOwner( - _In_ PSECURITY_DESCRIPTOR _SecurityDescriptor) -{ - PISECURITY_DESCRIPTOR SecurityDescriptor = _SecurityDescriptor; - PSID Owner; - - if (SecurityDescriptor->Control & SE_SELF_RELATIVE) - Owner = (PSID)((ULONG_PTR)SecurityDescriptor->Owner + - (ULONG_PTR)SecurityDescriptor); - else - Owner = (PSID)SecurityDescriptor->Owner; - - return Owner; -} - -/** - * @brief - * Retrieves the group from a security descriptor. - * - * @param[in] SecurityDescriptor - * A valid allocated security descriptor structure where the group - * is to be retrieved. - * - * @return - * Returns a SID that represents a group. - */ -static PSID -SepGetSDGroup( - _In_ PSECURITY_DESCRIPTOR _SecurityDescriptor) -{ - PISECURITY_DESCRIPTOR SecurityDescriptor = _SecurityDescriptor; - PSID Group; - - if (SecurityDescriptor->Control & SE_SELF_RELATIVE) - Group = (PSID)((ULONG_PTR)SecurityDescriptor->Group + - (ULONG_PTR)SecurityDescriptor); - else - Group = (PSID)SecurityDescriptor->Group; - - return Group; -} - /** * @brief * Retrieves the length size of a set list of privileges structure. @@ -736,71 +1464,133 @@ SepGetPrivilegeSetLength( (PrivilegeSet->PrivilegeCount - 1) * sizeof(LUID_AND_ATTRIBUTES)); } -/* PUBLIC FUNCTIONS ***********************************************************/ - /** * @brief - * Determines whether security access rights can be given to an object - * depending on the security descriptor and other security context - * entities, such as an owner. + * Internal function that performs a security check against the + * client who requests access on a resource object. This function + * is used by access check NT system calls. * * @param[in] SecurityDescriptor - * Security descriptor of the object that is being accessed. + * A pointer to a security descriptor that identifies the security + * information of an object being accessed. This function walks + * through this descriptor for any ACLs and respective access + * rights if access can be granted. * - * @param[in] SubjectSecurityContext - * The captured subject security context. + * @param[in] ClientToken + * A handle to an access token, that identifies the client of which + * requests access to the target object. * - * @param[in] SubjectContextLocked - * If set to TRUE, the caller acknowledges that the subject context - * has already been locked by the caller himself. If set to FALSE, - * the function locks the subject context. + * @param[in] PrincipalSelfSid + * A pointer to a principal self SID. This parameter can be NULL if + * the associated object being checked for access does not represent + * a principal. * * @param[in] DesiredAccess - * Access right bitmask that the calling thread wants to acquire. - * - * @param[in] PreviouslyGrantedAccess - * The access rights previously acquired in the past. - * - * @param[out] Privileges - * The returned set of privileges. + * The access right bitmask where the client wants to acquire. This + * can be an OR'ed set of multiple access rights or MAXIMUM_ALLOWED + * to request all of possible access rights the target object allows. + * If only some rights were granted but not all the access is deemed + * as denied. * * @param[in] GenericMapping * The generic mapping of access rights of an object type. * - * @param[in] AccessMode - * The processor request level mode. + * @param[out] PrivilegeSet + * A pointer to a set of privileges that were used to perform the + * access check, returned to caller. This function will return no + * privileges (privilege count set to 0) if no privileges were used + * to accomplish the access check. This parameter must not be NULL! + * + * @param[in,out] PrivilegeSetLength + * The total length size of a set of privileges. This length represents + * the count of elements in the privilege set array. + * + * @param[in] ObjectTypeList + * A pointer to a given object type list. If this parameter is not NULL + * the function will perform an access check against the main object + * and sub-objects of this list. If this parameter is NULL and + * ObjectTypeListLength is 0, the function will perform a normal + * access check instead. + * + * @param[in] ObjectTypeListLength + * The length of the object type list array, pointed by ObjectTypeList. + * This length in question represents the number of elements in such array. + * This parameter must be 0 if no array list is provided. + * + * @param[in] UseResultList + * If this parameter is set to TRUE, the function will return the GrantedAccess + * and AccessStatus parameter as arrays of granted rights and status value for + * each individual object element pointed by ObjectTypeList. * * @param[out] GrantedAccess - * A list of granted access rights. + * A pointer to granted access rights, returned to the caller. If ObjectTypeList + * is not NULL this paramater is an array of granted access rights for the object + * and each individual sub-object of the list. * * @param[out] AccessStatus - * The returned status code specifying why access cannot be made - * onto an object (if said access is denied in the first place). + * A pointer to a status code, returned to the caller. This status code + * represents whether access is granted or denied to the client on the + * target object. The difference between the status code of the function + * is that code indicates whether the function has successfully completed + * the access check operation. If ObjectTypeList is not NULL, this + * parameter is an array of access status for the object and each individual + * sub-object of the list. * * @return - * Returns TRUE if access onto the specific object is allowed, FALSE - * otherwise. + * Returns STATUS_SUCCESS if access check has been done without problems + * and that the object can be accessed. STATUS_GENERIC_NOT_MAPPED is returned + * if no generic access right is mapped. STATUS_NO_IMPERSONATION_TOKEN is returned + * if the token from the handle is not an impersonation token. + * STATUS_BAD_IMPERSONATION_LEVEL is returned if the token cannot be impersonated + * because the current security impersonation level doesn't permit so. + * STATUS_INVALID_SECURITY_DESCR is returned if the security descriptor given + * to the call is not a valid one. STATUS_BUFFER_TOO_SMALL is returned if + * the buffer to the captured privileges has a length that is less than the required + * size of the set of privileges. STATUS_INVALID_PARAMETER is returned if the caller + * did not provide an object type list but the caller wanted to invoke an object type + * result list access check, or if the list is out of order or the list is invalid. + * A failure NTSTATUS code is returned otherwise. + * + * @remarks + * The function performs an access check against the object type list, + * if provided, depending on the UseResultList parameter. That is, if that + * parameter was set to TRUE the function will either grant or deny access + * to each individual sub-object and return an array of access status and + * granted rights for the corresponding object type list. Otherwise the function + * will grant or deny access to the object type list hierarchy as a whole. */ -BOOLEAN -NTAPI -SeAccessCheck( +static +NTSTATUS +SepAccessCheck( _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, - _In_ PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, - _In_ BOOLEAN SubjectContextLocked, + _In_ HANDLE ClientToken, + _In_opt_ PSID PrincipalSelfSid, _In_ ACCESS_MASK DesiredAccess, - _In_ ACCESS_MASK PreviouslyGrantedAccess, - _Out_ PPRIVILEGE_SET* Privileges, _In_ PGENERIC_MAPPING GenericMapping, - _In_ KPROCESSOR_MODE AccessMode, + _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet, + _Inout_ PULONG PrivilegeSetLength, + _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, + _In_ ULONG ObjectTypeListLength, + _In_ BOOLEAN UseResultList, _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus) { - BOOLEAN ret; + PSECURITY_DESCRIPTOR CapturedSecurityDescriptor = NULL; + POBJECT_TYPE_LIST_INTERNAL CapturedObjectTypeList = NULL; + PSID CapturedPrincipalSelfSid = NULL; + SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; + KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); + ACCESS_MASK PreviouslyGrantedAccess = 0; + PPRIVILEGE_SET Privileges = NULL; + ULONG CapturedPrivilegeSetLength, RequiredPrivilegeSetLength; + ULONG ResultListIndex; + PTOKEN Token; + NTSTATUS Status; PAGED_CODE(); /* Check if this is kernel mode */ - if (AccessMode == KernelMode) + if (PreviousMode == KernelMode) { /* Check if kernel wants everything */ if (DesiredAccess & MAXIMUM_ALLOWED) @@ -808,291 +1598,52 @@ SeAccessCheck( /* Give it */ *GrantedAccess = GenericMapping->GenericAll; *GrantedAccess |= (DesiredAccess &~ MAXIMUM_ALLOWED); - *GrantedAccess |= PreviouslyGrantedAccess; } else { - /* Give the desired and previous access */ - *GrantedAccess = DesiredAccess | PreviouslyGrantedAccess; + /* Just give the desired access */ + *GrantedAccess = DesiredAccess; } /* Success */ *AccessStatus = STATUS_SUCCESS; - return TRUE; - } - - /* Check if we didn't get an SD */ - if (!SecurityDescriptor) - { - /* Automatic failure */ - *AccessStatus = STATUS_ACCESS_DENIED; - return FALSE; - } - - /* Check for invalid impersonation */ - if ((SubjectSecurityContext->ClientToken) && - (SubjectSecurityContext->ImpersonationLevel < SecurityImpersonation)) - { - *AccessStatus = STATUS_BAD_IMPERSONATION_LEVEL; - return FALSE; + return STATUS_SUCCESS; } - /* Acquire the lock if needed */ - if (!SubjectContextLocked) - SeLockSubjectContext(SubjectSecurityContext); - - /* Check if the token is the owner and grant WRITE_DAC and READ_CONTROL rights */ - if (DesiredAccess & (WRITE_DAC | READ_CONTROL | MAXIMUM_ALLOWED)) + /* Protect probe in SEH */ + _SEH2_TRY { - PACCESS_TOKEN Token = SubjectSecurityContext->ClientToken ? - SubjectSecurityContext->ClientToken : SubjectSecurityContext->PrimaryToken; + /* Probe all pointers */ + ProbeForRead(GenericMapping, sizeof(GENERIC_MAPPING), sizeof(ULONG)); + ProbeForRead(PrivilegeSetLength, sizeof(ULONG), sizeof(ULONG)); + ProbeForWrite(PrivilegeSet, *PrivilegeSetLength, sizeof(ULONG)); - if (SepTokenIsOwner(Token, - SecurityDescriptor, - FALSE)) + /* + * Probe the access and status list based on the way + * we are going to fill data in. + */ + if (UseResultList) { - if (DesiredAccess & MAXIMUM_ALLOWED) - PreviouslyGrantedAccess |= (WRITE_DAC | READ_CONTROL); - else - PreviouslyGrantedAccess |= (DesiredAccess & (WRITE_DAC | READ_CONTROL)); - - DesiredAccess &= ~(WRITE_DAC | READ_CONTROL); - } - } + /* Bail out on an empty list */ + if (!ObjectTypeListLength) + { + DPRINT1("The object type list is empty\n"); + _SEH2_YIELD(return STATUS_INVALID_PARAMETER); + } - if (DesiredAccess == 0) - { - *GrantedAccess = PreviouslyGrantedAccess; - if (PreviouslyGrantedAccess == 0) - { - DPRINT1("Request for zero access to an object. Denying.\n"); - *AccessStatus = STATUS_ACCESS_DENIED; - ret = FALSE; + ProbeForWrite(GrantedAccess, sizeof(ACCESS_MASK) * ObjectTypeListLength, sizeof(ULONG)); + ProbeForWrite(AccessStatus, sizeof(NTSTATUS) * ObjectTypeListLength, sizeof(ULONG)); } else { - *AccessStatus = STATUS_SUCCESS; - ret = TRUE; + ProbeForWrite(GrantedAccess, sizeof(ACCESS_MASK), sizeof(ULONG)); + ProbeForWrite(AccessStatus, sizeof(NTSTATUS), sizeof(ULONG)); } + + /* Capture the privilege set length and the mapping */ + CapturedPrivilegeSetLength = *PrivilegeSetLength; } - else - { - /* Call the internal function */ - ret = SepAccessCheck(SecurityDescriptor, - SubjectSecurityContext->ClientToken, - SubjectSecurityContext->PrimaryToken, - NULL, - DesiredAccess, - NULL, - 0, - PreviouslyGrantedAccess, - GenericMapping, - AccessMode, - FALSE, - Privileges, - GrantedAccess, - AccessStatus); - } - - /* Release the lock if needed */ - if (!SubjectContextLocked) - SeUnlockSubjectContext(SubjectSecurityContext); - - return ret; -} - -/** - * @brief - * Determines whether security access rights can be given to an object - * depending on the security descriptor. Unlike the regular access check - * procedure in the NT kernel, the fast traverse check is a faster way - * to quickly check if access can be made into an object. - * - * @param[in] SecurityDescriptor - * Security descriptor of the object that is being accessed. - * - * @param[in] AccessState - * An access state to determine if the access token in the current - * security context of the object is an restricted token. - * - * @param[in] DesiredAccess - * The access right bitmask where the calling thread wants to acquire. - * - * @param[in] AccessMode - * Process level request mode. - * - * @return - * Returns TRUE if access onto the specific object is allowed, FALSE - * otherwise. - */ -BOOLEAN -NTAPI -SeFastTraverseCheck( - _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, - _In_ PACCESS_STATE AccessState, - _In_ ACCESS_MASK DesiredAccess, - _In_ KPROCESSOR_MODE AccessMode) -{ - PACL Dacl; - ULONG AceIndex; - PKNOWN_ACE Ace; - - PAGED_CODE(); - - ASSERT(AccessMode != KernelMode); - - if (SecurityDescriptor == NULL) - return FALSE; - - /* Get DACL */ - Dacl = SepGetDaclFromDescriptor(SecurityDescriptor); - /* If no DACL, grant access */ - if (Dacl == NULL) - return TRUE; - - /* No ACE -> Deny */ - if (!Dacl->AceCount) - return FALSE; - - /* Can't perform the check on restricted token */ - if (AccessState->Flags & TOKEN_IS_RESTRICTED) - return FALSE; - - /* Browse the ACEs */ - for (AceIndex = 0, Ace = (PKNOWN_ACE)((ULONG_PTR)Dacl + sizeof(ACL)); - AceIndex < Dacl->AceCount; - AceIndex++, Ace = (PKNOWN_ACE)((ULONG_PTR)Ace + Ace->Header.AceSize)) - { - if (Ace->Header.AceFlags & INHERIT_ONLY_ACE) - continue; - - /* If access-allowed ACE */ - if (Ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE) - { - /* Check if all accesses are granted */ - if (!(Ace->Mask & DesiredAccess)) - continue; - - /* Check SID and grant access if matching */ - if (RtlEqualSid(SeWorldSid, &(Ace->SidStart))) - return TRUE; - } - /* If access-denied ACE */ - else if (Ace->Header.AceType == ACCESS_DENIED_ACE_TYPE) - { - /* Here, only check if it denies any access wanted and deny if so */ - if (Ace->Mask & DesiredAccess) - return FALSE; - } - } - - /* Faulty, deny */ - return FALSE; -} - -/* SYSTEM CALLS ***************************************************************/ - -/** - * @brief - * Determines whether security access rights can be given to an object - * depending on the security descriptor and a valid handle to an access - * token. - * - * @param[in] SecurityDescriptor - * Security descriptor of the object that is being accessed. - * - * @param[in] TokenHandle - * A handle to a token. - * - * @param[in] DesiredAccess - * The access right bitmask where the calling thread wants to acquire. - * - * @param[in] GenericMapping - * The generic mapping of access rights of an object type. - * - * @param[out] PrivilegeSet - * The returned set of privileges. - * - * @param[in,out] PrivilegeSetLength - * The total length size of a set of privileges. - * - * @param[out] GrantedAccess - * A list of granted access rights. - * - * @param[out] AccessStatus - * The returned status code specifying why access cannot be made - * onto an object (if said access is denied in the first place). - * - * @return - * Returns STATUS_SUCCESS if access check has been done without problems - * and that the object can be accessed. STATUS_GENERIC_NOT_MAPPED is returned - * if no generic access right is mapped. STATUS_NO_IMPERSONATION_TOKEN is returned - * if the token from the handle is not an impersonation token. - * STATUS_BAD_IMPERSONATION_LEVEL is returned if the token cannot be impersonated - * because the current security impersonation level doesn't permit so. - * STATUS_INVALID_SECURITY_DESCR is returned if the security descriptor given - * to the call is not a valid one. STATUS_BUFFER_TOO_SMALL is returned if - * the buffer to the captured privileges has a length that is less than the required - * size of the set of privileges. A failure NTSTATUS code is returned otherwise. - */ -NTSTATUS -NTAPI -NtAccessCheck( - _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, - _In_ HANDLE TokenHandle, - _In_ ACCESS_MASK DesiredAccess, - _In_ PGENERIC_MAPPING GenericMapping, - _Out_opt_ PPRIVILEGE_SET PrivilegeSet, - _Inout_ PULONG PrivilegeSetLength, - _Out_ PACCESS_MASK GrantedAccess, - _Out_ PNTSTATUS AccessStatus) -{ - PSECURITY_DESCRIPTOR CapturedSecurityDescriptor = NULL; - SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; - KPROCESSOR_MODE PreviousMode = ExGetPreviousMode(); - ACCESS_MASK PreviouslyGrantedAccess = 0; - PPRIVILEGE_SET Privileges = NULL; - ULONG CapturedPrivilegeSetLength, RequiredPrivilegeSetLength; - PTOKEN Token; - NTSTATUS Status; - - PAGED_CODE(); - - /* Check if this is kernel mode */ - if (PreviousMode == KernelMode) - { - /* Check if kernel wants everything */ - if (DesiredAccess & MAXIMUM_ALLOWED) - { - /* Give it */ - *GrantedAccess = GenericMapping->GenericAll; - *GrantedAccess |= (DesiredAccess &~ MAXIMUM_ALLOWED); - } - else - { - /* Just give the desired access */ - *GrantedAccess = DesiredAccess; - } - - /* Success */ - *AccessStatus = STATUS_SUCCESS; - return STATUS_SUCCESS; - } - - /* Protect probe in SEH */ - _SEH2_TRY - { - /* Probe all pointers */ - ProbeForRead(GenericMapping, sizeof(GENERIC_MAPPING), sizeof(ULONG)); - ProbeForRead(PrivilegeSetLength, sizeof(ULONG), sizeof(ULONG)); - ProbeForWrite(PrivilegeSet, *PrivilegeSetLength, sizeof(ULONG)); - ProbeForWrite(GrantedAccess, sizeof(ACCESS_MASK), sizeof(ULONG)); - ProbeForWrite(AccessStatus, sizeof(NTSTATUS), sizeof(ULONG)); - - /* Capture the privilege set length and the mapping */ - CapturedPrivilegeSetLength = *PrivilegeSetLength; - } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { /* Return the exception code */ _SEH2_YIELD(return _SEH2_GetExceptionCode()); @@ -1101,10 +1652,13 @@ NtAccessCheck( /* Check for unmapped access rights */ if (DesiredAccess & (GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL)) + { + DPRINT1("Some generic rights are not mapped\n"); return STATUS_GENERIC_NOT_MAPPED; + } /* Reference the token */ - Status = ObReferenceObjectByHandle(TokenHandle, + Status = ObReferenceObjectByHandle(ClientToken, TOKEN_QUERY, SeTokenObjectType, PreviousMode, @@ -1112,7 +1666,7 @@ NtAccessCheck( NULL); if (!NT_SUCCESS(Status)) { - DPRINT("Failed to reference token (Status %lx)\n", Status); + DPRINT1("Failed to reference token (Status 0x%08lx)\n", Status); return Status; } @@ -1127,11 +1681,23 @@ NtAccessCheck( /* Check the impersonation level */ if (Token->ImpersonationLevel < SecurityIdentification) { - DPRINT("Impersonation level < SecurityIdentification\n"); + DPRINT1("Impersonation level < SecurityIdentification\n"); ObDereferenceObject(Token); return STATUS_BAD_IMPERSONATION_LEVEL; } + /* Capture the object type list, the list is probed by the function itself */ + Status = SeCaptureObjectTypeList(ObjectTypeList, + ObjectTypeListLength, + PreviousMode, + &CapturedObjectTypeList); + if (!NT_SUCCESS(Status)) + { + DPRINT1("Failed to capture the object type list (Status 0x%08lx)\n", Status); + ObDereferenceObject(Token); + return Status; + } + /* Check for ACCESS_SYSTEM_SECURITY and WRITE_OWNER access */ Status = SePrivilegePolicyCheck(&DesiredAccess, &PreviouslyGrantedAccess, @@ -1141,10 +1707,29 @@ NtAccessCheck( PreviousMode); if (!NT_SUCCESS(Status)) { - DPRINT("SePrivilegePolicyCheck failed (Status 0x%08lx)\n", Status); + DPRINT1("SePrivilegePolicyCheck failed (Status 0x%08lx)\n", Status); + SeReleaseObjectTypeList(CapturedObjectTypeList, PreviousMode); ObDereferenceObject(Token); - *AccessStatus = Status; - *GrantedAccess = 0; + + /* + * The caller does not have the required access to do an access check. + * Propagate the access and status for the whole hierarchy of the list + * or just to single target object. + */ + if (UseResultList) + { + for (ResultListIndex = 0; ResultListIndex < ObjectTypeListLength; ResultListIndex++) + { + AccessStatus[ResultListIndex] = Status; + GrantedAccess[ResultListIndex] = 0; + } + } + else + { + *AccessStatus = Status; + *GrantedAccess = 0; + } + return STATUS_SUCCESS; } @@ -1159,8 +1744,9 @@ NtAccessCheck( /* Fail if the privilege set buffer is too small */ if (CapturedPrivilegeSetLength < RequiredPrivilegeSetLength) { - ObDereferenceObject(Token); SeFreePrivileges(Privileges); + SeReleaseObjectTypeList(CapturedObjectTypeList, PreviousMode); + ObDereferenceObject(Token); *PrivilegeSetLength = RequiredPrivilegeSetLength; return STATUS_BUFFER_TOO_SMALL; } @@ -1180,6 +1766,7 @@ NtAccessCheck( /* Fail if the privilege set buffer is too small */ if (CapturedPrivilegeSetLength < sizeof(PRIVILEGE_SET)) { + SeReleaseObjectTypeList(CapturedObjectTypeList, PreviousMode); ObDereferenceObject(Token); *PrivilegeSetLength = sizeof(PRIVILEGE_SET); return STATUS_BUFFER_TOO_SMALL; @@ -1198,7 +1785,8 @@ NtAccessCheck( &CapturedSecurityDescriptor); if (!NT_SUCCESS(Status)) { - DPRINT("Failed to capture the Security Descriptor\n"); + DPRINT1("Failed to capture the Security Descriptor\n"); + SeReleaseObjectTypeList(CapturedObjectTypeList, PreviousMode); ObDereferenceObject(Token); return Status; } @@ -1206,23 +1794,45 @@ NtAccessCheck( /* Check the captured security descriptor */ if (CapturedSecurityDescriptor == NULL) { - DPRINT("Security Descriptor is NULL\n"); + DPRINT1("Security Descriptor is NULL\n"); + SeReleaseObjectTypeList(CapturedObjectTypeList, PreviousMode); ObDereferenceObject(Token); return STATUS_INVALID_SECURITY_DESCR; } /* Check security descriptor for valid owner and group */ - if (SepGetSDOwner(CapturedSecurityDescriptor) == NULL || - SepGetSDGroup(CapturedSecurityDescriptor) == NULL) + if (SepGetOwnerFromDescriptor(CapturedSecurityDescriptor) == NULL || + SepGetGroupFromDescriptor(CapturedSecurityDescriptor) == NULL) { - DPRINT("Security Descriptor does not have a valid group or owner\n"); + DPRINT1("Security Descriptor does not have a valid group or owner\n"); SeReleaseSecurityDescriptor(CapturedSecurityDescriptor, PreviousMode, FALSE); + SeReleaseObjectTypeList(CapturedObjectTypeList, PreviousMode); ObDereferenceObject(Token); return STATUS_INVALID_SECURITY_DESCR; } + /* Capture the principal self SID if we have one */ + if (PrincipalSelfSid) + { + Status = SepCaptureSid(PrincipalSelfSid, + PreviousMode, + PagedPool, + TRUE, + &CapturedPrincipalSelfSid); + if (!NT_SUCCESS(Status)) + { + DPRINT1("Failed to capture the principal self SID (Status 0x%08lx)\n", Status); + SeReleaseSecurityDescriptor(CapturedSecurityDescriptor, + PreviousMode, + FALSE); + SeReleaseObjectTypeList(CapturedObjectTypeList, PreviousMode); + ObDereferenceObject(Token); + return Status; + } + } + /* Set up the subject context, and lock it */ SeCaptureSubjectContext(&SubjectSecurityContext); @@ -1245,37 +1855,60 @@ NtAccessCheck( if (DesiredAccess == 0) { - *GrantedAccess = PreviouslyGrantedAccess; - *AccessStatus = STATUS_SUCCESS; + /* + * Propagate the access and status for the whole hierarchy + * of the list or just to single target object. + */ + if (UseResultList) + { + for (ResultListIndex = 0; ResultListIndex < ObjectTypeListLength; ResultListIndex++) + { + AccessStatus[ResultListIndex] = STATUS_SUCCESS; + GrantedAccess[ResultListIndex] = PreviouslyGrantedAccess; + } + } + else + { + *GrantedAccess = PreviouslyGrantedAccess; + *AccessStatus = STATUS_SUCCESS; + } } else { /* Now perform the access check */ - SepAccessCheck(CapturedSecurityDescriptor, - Token, - &SubjectSecurityContext.PrimaryToken, - NULL, - DesiredAccess, - NULL, - 0, - PreviouslyGrantedAccess, - GenericMapping, - PreviousMode, - FALSE, - NULL, - GrantedAccess, - AccessStatus); + SepAccessCheckWorker(CapturedSecurityDescriptor, + Token, + &SubjectSecurityContext.PrimaryToken, + CapturedPrincipalSelfSid, + DesiredAccess, + CapturedObjectTypeList, + ObjectTypeListLength, + PreviouslyGrantedAccess, + GenericMapping, + PreviousMode, + UseResultList, + NULL, + GrantedAccess, + AccessStatus); } /* Release subject context and unlock the token */ SeReleaseSubjectContext(&SubjectSecurityContext); SepReleaseTokenLock(Token); + /* Release the caputed principal self SID */ + SepReleaseSid(CapturedPrincipalSelfSid, + PreviousMode, + TRUE); + /* Release the captured security descriptor */ SeReleaseSecurityDescriptor(CapturedSecurityDescriptor, PreviousMode, FALSE); + /* Release the object type list */ + SeReleaseObjectTypeList(CapturedObjectTypeList, PreviousMode); + /* Dereference the token */ ObDereferenceObject(Token); @@ -1283,127 +1916,384 @@ NtAccessCheck( return STATUS_SUCCESS; } +/* PUBLIC FUNCTIONS ***********************************************************/ + /** * @brief - * Determines whether security access could be granted or not on - * an object by the requestor who wants such access through type. + * Determines whether security access rights can be given to an object + * depending on the security descriptor and other security context + * entities, such as an owner. * * @param[in] SecurityDescriptor - * A security descriptor with information data for auditing. - * - * @param[in] PrincipalSelfSid - * A principal self user SID. + * Security descriptor of the object that is being accessed. * - * @param[in] ClientToken - * A client access token. + * @param[in] SubjectSecurityContext + * The captured subject security context. + * + * @param[in] SubjectContextLocked + * If set to TRUE, the caller acknowledges that the subject context + * has already been locked by the caller himself. If set to FALSE, + * the function locks the subject context. * * @param[in] DesiredAccess - * The desired access masks rights requested by the caller. + * Access right bitmask that the calling thread wants to acquire. * - * @param[in] ObjectTypeList - * A list of object types. + * @param[in] PreviouslyGrantedAccess + * The access rights previously acquired in the past. * - * @param[in] ObjectTypeLength - * The length size of the list. + * @param[out] Privileges + * The returned set of privileges. * * @param[in] GenericMapping - * The generic mapping list of access masks rights. - * - * @param[in] PrivilegeSet - * An array set of privileges. + * The generic mapping of access rights of an object type. * - * @param[in,out] PrivilegeSetLength - * The length size of the array set of privileges. + * @param[in] AccessMode + * The processor request level mode. * * @param[out] GrantedAccess - * The returned granted access rights. + * A list of granted access rights. * * @param[out] AccessStatus - * The returned NTSTATUS code indicating the final results - * of auditing. + * The returned status code specifying why access cannot be made + * onto an object (if said access is denied in the first place). * * @return - * To be added... + * Returns TRUE if access onto the specific object is allowed, FALSE + * otherwise. */ -NTSTATUS +BOOLEAN NTAPI -NtAccessCheckByType( +SeAccessCheck( _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, - _In_ PSID PrincipalSelfSid, - _In_ HANDLE ClientToken, + _In_ PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, + _In_ BOOLEAN SubjectContextLocked, _In_ ACCESS_MASK DesiredAccess, - _In_ POBJECT_TYPE_LIST ObjectTypeList, - _In_ ULONG ObjectTypeLength, + _In_ ACCESS_MASK PreviouslyGrantedAccess, + _Out_ PPRIVILEGE_SET* Privileges, _In_ PGENERIC_MAPPING GenericMapping, - _In_ PPRIVILEGE_SET PrivilegeSet, - _Inout_ PULONG PrivilegeSetLength, + _In_ KPROCESSOR_MODE AccessMode, _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus) { - UNIMPLEMENTED; - return STATUS_NOT_IMPLEMENTED; + BOOLEAN ret; + + PAGED_CODE(); + + /* Check if this is kernel mode */ + if (AccessMode == KernelMode) + { + /* Check if kernel wants everything */ + if (DesiredAccess & MAXIMUM_ALLOWED) + { + /* Give it */ + *GrantedAccess = GenericMapping->GenericAll; + *GrantedAccess |= (DesiredAccess &~ MAXIMUM_ALLOWED); + *GrantedAccess |= PreviouslyGrantedAccess; + } + else + { + /* Give the desired and previous access */ + *GrantedAccess = DesiredAccess | PreviouslyGrantedAccess; + } + + /* Success */ + *AccessStatus = STATUS_SUCCESS; + return TRUE; + } + + /* Check if we didn't get an SD */ + if (!SecurityDescriptor) + { + /* Automatic failure */ + *AccessStatus = STATUS_ACCESS_DENIED; + return FALSE; + } + + /* Check for invalid impersonation */ + if ((SubjectSecurityContext->ClientToken) && + (SubjectSecurityContext->ImpersonationLevel < SecurityImpersonation)) + { + *AccessStatus = STATUS_BAD_IMPERSONATION_LEVEL; + return FALSE; + } + + /* Acquire the lock if needed */ + if (!SubjectContextLocked) + SeLockSubjectContext(SubjectSecurityContext); + + /* Check if the token is the owner and grant WRITE_DAC and READ_CONTROL rights */ + if (DesiredAccess & (WRITE_DAC | READ_CONTROL | MAXIMUM_ALLOWED)) + { + PACCESS_TOKEN Token = SubjectSecurityContext->ClientToken ? + SubjectSecurityContext->ClientToken : SubjectSecurityContext->PrimaryToken; + + if (SepTokenIsOwner(Token, + SecurityDescriptor, + FALSE)) + { + if (DesiredAccess & MAXIMUM_ALLOWED) + PreviouslyGrantedAccess |= (WRITE_DAC | READ_CONTROL); + else + PreviouslyGrantedAccess |= (DesiredAccess & (WRITE_DAC | READ_CONTROL)); + + DesiredAccess &= ~(WRITE_DAC | READ_CONTROL); + } + } + + if (DesiredAccess == 0) + { + *GrantedAccess = PreviouslyGrantedAccess; + if (PreviouslyGrantedAccess == 0) + { + DPRINT1("Request for zero access to an object. Denying.\n"); + *AccessStatus = STATUS_ACCESS_DENIED; + ret = FALSE; + } + else + { + *AccessStatus = STATUS_SUCCESS; + ret = TRUE; + } + } + else + { + /* Call the internal function */ + ret = SepAccessCheckWorker(SecurityDescriptor, + SubjectSecurityContext->ClientToken, + SubjectSecurityContext->PrimaryToken, + NULL, + DesiredAccess, + NULL, + 0, + PreviouslyGrantedAccess, + GenericMapping, + AccessMode, + FALSE, + Privileges, + GrantedAccess, + AccessStatus); + } + + /* Release the lock if needed */ + if (!SubjectContextLocked) + SeUnlockSubjectContext(SubjectSecurityContext); + + return ret; } /** * @brief - * Determines whether security access could be granted or not on - * an object by the requestor who wants such access through - * type list. + * Determines whether security access rights can be given to an object + * depending on the security descriptor. Unlike the regular access check + * procedure in the NT kernel, the fast traverse check is a faster way + * to quickly check if access can be made into an object. * * @param[in] SecurityDescriptor - * A security descriptor with information data for auditing. - * - * @param[in] PrincipalSelfSid - * A principal self user SID. + * Security descriptor of the object that is being accessed. * - * @param[in] ClientToken - * A client access token. + * @param[in] AccessState + * An access state to determine if the access token in the current + * security context of the object is an restricted token. * * @param[in] DesiredAccess - * The desired access masks rights requested by the caller. - * - * @param[in] ObjectTypeList - * A list of object types. - * - * @param[in] ObjectTypeLength - * The length size of the list. - * - * @param[in] GenericMapping - * The generic mapping list of access masks rights. - * - * @param[in] PrivilegeSet - * An array set of privileges. - * - * @param[in,out] PrivilegeSetLength - * The length size of the array set of privileges. - * - * @param[out] GrantedAccess - * The returned granted access rights. + * The access right bitmask where the calling thread wants to acquire. * - * @param[out] AccessStatus - * The returned NTSTATUS code indicating the final results - * of auditing. + * @param[in] AccessMode + * Process level request mode. * * @return - * To be added... + * Returns TRUE if access onto the specific object is allowed, FALSE + * otherwise. + */ +BOOLEAN +NTAPI +SeFastTraverseCheck( + _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, + _In_ PACCESS_STATE AccessState, + _In_ ACCESS_MASK DesiredAccess, + _In_ KPROCESSOR_MODE AccessMode) +{ + PACL Dacl; + ULONG AceIndex; + PKNOWN_ACE Ace; + + PAGED_CODE(); + + ASSERT(AccessMode != KernelMode); + + if (SecurityDescriptor == NULL) + return FALSE; + + /* Get DACL */ + Dacl = SepGetDaclFromDescriptor(SecurityDescriptor); + /* If no DACL, grant access */ + if (Dacl == NULL) + return TRUE; + + /* No ACE -> Deny */ + if (!Dacl->AceCount) + return FALSE; + + /* Can't perform the check on restricted token */ + if (AccessState->Flags & TOKEN_IS_RESTRICTED) + return FALSE; + + /* Browse the ACEs */ + for (AceIndex = 0, Ace = (PKNOWN_ACE)((ULONG_PTR)Dacl + sizeof(ACL)); + AceIndex < Dacl->AceCount; + AceIndex++, Ace = (PKNOWN_ACE)((ULONG_PTR)Ace + Ace->Header.AceSize)) + { + if (Ace->Header.AceFlags & INHERIT_ONLY_ACE) + continue; + + /* If access-allowed ACE */ + if (Ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE) + { + /* Check if all accesses are granted */ + if (!(Ace->Mask & DesiredAccess)) + continue; + + /* Check SID and grant access if matching */ + if (RtlEqualSid(SeWorldSid, &(Ace->SidStart))) + return TRUE; + } + /* If access-denied ACE */ + else if (Ace->Header.AceType == ACCESS_DENIED_ACE_TYPE) + { + /* Here, only check if it denies any access wanted and deny if so */ + if (Ace->Mask & DesiredAccess) + return FALSE; + } + } + + /* Faulty, deny */ + return FALSE; +} + +/* SYSTEM CALLS ***************************************************************/ + +/** + * @brief + * Determines whether security access can be granted to a client + * that requests such access on an object. + * + * @remarks + * For more documentation details about the parameters and + * overall function behavior, see SepAccessCheck. */ NTSTATUS NTAPI -NtAccessCheckByTypeResultList( +NtAccessCheck( + _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, + _In_ HANDLE ClientToken, + _In_ ACCESS_MASK DesiredAccess, + _In_ PGENERIC_MAPPING GenericMapping, + _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet, + _Inout_ PULONG PrivilegeSetLength, + _Out_ PACCESS_MASK GrantedAccess, + _Out_ PNTSTATUS AccessStatus) +{ + PAGED_CODE(); + + /* Invoke the internal function to do the job */ + return SepAccessCheck(SecurityDescriptor, + ClientToken, + NULL, + DesiredAccess, + GenericMapping, + PrivilegeSet, + PrivilegeSetLength, + NULL, + 0, + FALSE, + GrantedAccess, + AccessStatus); +} + +/** + * @brief + * Determines whether security access can be granted to a client + * that requests such access on the object type list. The access + * is either granted or denied for the whole object hierarchy + * in the list. + * + * @remarks + * For more documentation details about the parameters and + * overall function behavior, see SepAccessCheck. + */ +NTSTATUS +NTAPI +NtAccessCheckByType( _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, - _In_ PSID PrincipalSelfSid, + _In_opt_ PSID PrincipalSelfSid, _In_ HANDLE ClientToken, _In_ ACCESS_MASK DesiredAccess, - _In_ POBJECT_TYPE_LIST ObjectTypeList, - _In_ ULONG ObjectTypeLength, + _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, + _In_ ULONG ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping, - _In_ PPRIVILEGE_SET PrivilegeSet, + _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength, _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus) { - UNIMPLEMENTED; - return STATUS_NOT_IMPLEMENTED; + PAGED_CODE(); + + /* Invoke the internal function to do the job */ + return SepAccessCheck(SecurityDescriptor, + ClientToken, + PrincipalSelfSid, + DesiredAccess, + GenericMapping, + PrivilegeSet, + PrivilegeSetLength, + ObjectTypeList, + ObjectTypeListLength, + FALSE, + GrantedAccess, + AccessStatus); +} + +/** + * @brief + * Determines whether security access can be granted to a client + * that requests such access on the object type list. Unlike the + * NtAccessCheckByType variant, this function will grant or deny + * access to each individual object and sub-object in the list. + * + * @remarks + * For more documentation details about the parameters and + * overall function behavior, see SepAccessCheck. + */ +NTSTATUS +NTAPI +NtAccessCheckByTypeResultList( + _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, + _In_opt_ PSID PrincipalSelfSid, + _In_ HANDLE ClientToken, + _In_ ACCESS_MASK DesiredAccess, + _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, + _In_ ULONG ObjectTypeListLength, + _In_ PGENERIC_MAPPING GenericMapping, + _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet, + _Inout_ PULONG PrivilegeSetLength, + _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess, + _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus) +{ + PAGED_CODE(); + + /* Invoke the internal function to do the job */ + return SepAccessCheck(SecurityDescriptor, + ClientToken, + PrincipalSelfSid, + DesiredAccess, + GenericMapping, + PrivilegeSet, + PrivilegeSetLength, + ObjectTypeList, + ObjectTypeListLength, + TRUE, + GrantedAccess, + AccessStatus); } /* EOF */

1 year, 10 months

[reactos] 04/10: [NTOS:SE] Implement object type list utilities

by George Bișoc

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=e38f4c2b360e40e918da9… commit e38f4c2b360e40e918da94cf8fe7245fb9433746 Author: George Bișoc <george.bisoc(a)reactos.org> AuthorDate: Wed Jun 21 17:52:47 2023 +0200 Commit: unknown <george.bisoc(a)reactos.org> CommitDate: Tue Aug 22 17:54:17 2023 +0200 [NTOS:SE] Implement object type list utilities This implements various private kernel routines for object type list management needed for access check code infrastructure. In addition, update the code documentation and add missing comments. --- ntoskrnl/se/objtype.c | 321 ++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 298 insertions(+), 23 deletions(-) diff --git a/ntoskrnl/se/objtype.c b/ntoskrnl/se/objtype.c index 24af8fff4f0..b459c2dc172 100644 --- a/ntoskrnl/se/objtype.c +++ b/ntoskrnl/se/objtype.c @@ -3,6 +3,7 @@ * LICENSE: GPL-2.0-or-later (https://spdx.org/licenses/GPL-2.0-or-later) * PURPOSE: Security object type list support routines * COPYRIGHT: Copyright Timo Kreuzer <timo.kreuzer(a)reactos.org> + * Copyright 2023 George Bișoc <george.bisoc(a)reactos.org> */ /* INCLUDES *******************************************************************/ @@ -11,78 +12,351 @@ #define NDEBUG #include <debug.h> -/* PRIVATE FUNCTIONS ***********************************************************/ +/* PRIVATE FUNCTIONS **********************************************************/ /** * @brief - * Captures a list of object types. + * Validates a list of object types passed from user mode, + * ensuring the following conditions are met for a valid + * list: + * + * - The list must not be too big and it can be read + * - Each object must have a valid level + * - The level hierarchy between objects has to be consistent + * (e.g. a root cannot have a level 2 subordinate object) + * - The list must have only one root and it must be in the + * first position + * - Each object type GUID can be read and captured * * @param[in] ObjectTypeList - * An existing list of object types. + * A pointer to an object type list of which the elements + * are being validated. * * @param[in] ObjectTypeListLength - * The length size of the list. + * The length of the list, representing the number of object + * elements in that list. + * + * @return + * Returns STATUS_SUCCESS if the list has been validated and it + * contains valid objects. STATUS_INVALID_PARAMETER is returned + * if the list is not valid. Otherwise a NTSTATUS code is returned. + */ +static +NTSTATUS +SepValidateObjectTypeList( + _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, + _In_ ULONG ObjectTypeListLength) +{ + PGUID ObjectTypeGuid; + ULONG ObjectTypeIndex; + USHORT Level, PrevLevel; + SIZE_T Size; + + /* Ensure we do not hit an integer overflow */ + Size = ObjectTypeListLength * sizeof(OBJECT_TYPE_LIST); + if (Size == 0) + { + DPRINT1("The object type list is too big, integer overflow alert!\n"); + return STATUS_INVALID_PARAMETER; + } + + _SEH2_TRY + { + /* Ensure we can actually read from that list */ + ProbeForRead(ObjectTypeList, Size, sizeof(ULONG)); + + /* Begin looping for each object from the list */ + for (ObjectTypeIndex = 0; + ObjectTypeIndex < ObjectTypeListLength; + ObjectTypeIndex++) + { + /* Get the level of this object and check for validity */ + Level = ObjectTypeList[ObjectTypeIndex].Level; + if (Level > ACCESS_MAX_LEVEL) + { + DPRINT1("Invalid object level found (level %u, at index %lu)\n", Level, ObjectTypeIndex); + _SEH2_YIELD(return STATUS_INVALID_PARAMETER); + } + + /* Are we past the first position in the list? */ + if (ObjectTypeIndex != 0) + { + /* Ensure that we do not have two object roots */ + if (Level == ACCESS_OBJECT_GUID) + { + DPRINT1("This list has two roots (at index %lu)\n", ObjectTypeIndex); + _SEH2_YIELD(return STATUS_INVALID_PARAMETER); + } + + /* + * Ensure the current level is consistent with the prior level. + * That means, if the previous object is the root (denoted by the + * level as ACCESS_OBJECT_GUID aka 0) the current object must + * be a child of the parent which is the root (also called a + * property set). Whereas a property is a sibling of the + * child, the property set. + */ + if (Level > PrevLevel + 1) + { + DPRINT1("The object levels are not consistent (current level %u, previous level %u, at index %lu)\n", + Level, PrevLevel, ObjectTypeIndex); + _SEH2_YIELD(return STATUS_INVALID_PARAMETER); + } + } + else + { + /* This is the first position so the object must be the root */ + if (Level != ACCESS_OBJECT_GUID) + { + DPRINT1("The object is not the root at first index!\n"); + _SEH2_YIELD(return STATUS_INVALID_PARAMETER); + } + } + + /* Get the object type and check that we can read from it */ + ObjectTypeGuid = ObjectTypeList[ObjectTypeIndex].ObjectType; + ProbeForRead(ObjectTypeGuid, sizeof(GUID), sizeof(ULONG)); + + /* + * Cache the level, we need it to ensure the levels between + * the previous and the next object are consistent with each other. + */ + PrevLevel = Level; + } + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; + + return STATUS_SUCCESS; +} + +/** + * @brief + * Compares two object type GUIDs for equality. + * + * @param[in] Guid1 + * A pointer to the first object type GUID. + * + * @param[in] Guid2 + * A pointer to the second object type GUID. + * + * @return + * Returns TRUE if both GUIDs are equal, FALSE otherwise. + */ +static +BOOLEAN +SepIsEqualObjectTypeGuid( + _In_ CONST GUID *Guid1, + _In_ CONST GUID *Guid2) +{ + return RtlCompareMemory(Guid1, Guid2, sizeof(GUID)) == sizeof(GUID); +} + +/* PUBLIC FUNCTIONS ************************************************************/ + +/** + * @brief + * Captures an object type GUID from an object + * access control entry (ACE). + * + * @param[in] Ace + * A pointer to an access control entry, of which + * the object type GUID is to be captured from. + * + * @param[in] IsAceDenied + * If set to TRUE, the function will capture the + * GUID from a denied object ACE, otherwise from + * the allowed object ACE. + * + * @return + * Returns a pointer to an object type GUID, otherwise + * NULL is returned if the target ACE does not have + * an object type GUID. + */ +PGUID +SepGetObjectTypeGuidFromAce( + _In_ PACE Ace, + _In_ BOOLEAN IsAceDenied) +{ + PGUID ObjectTypeGuid = NULL; + + PAGED_CODE(); + + /* This Ace must not be NULL */ + ASSERT(Ace); + + /* Grab the GUID based on the object type ACE header */ + ObjectTypeGuid = IsAceDenied ? (PGUID)&((PACCESS_DENIED_OBJECT_ACE)Ace)->ObjectType : + (PGUID)&((PACCESS_ALLOWED_OBJECT_ACE)Ace)->ObjectType; + return ObjectTypeGuid; +} + +/** + * @brief + * Searches for an object type GUID if it exists + * on an object type list. + * + * @param[in] ObjectTypeList + * A pointer to an object type list. + * + * @param[in] ObjectTypeListLength + * The length of the list, representing the number + * of object elements in that list. + * + * @param[in] ObjectTypeGuid + * A pointer to an object type GUID to search in the + * list of interest. + * + * @param[out] ObjectIndex + * If the function found the target GUID, the function + * returns a pointer to the object index location to + * this parameter. + * + * @return + * Returns TRUE if the object type GUID of interest exists + * in the target list, FALSE otherwise. + */ +BOOLEAN +SepObjectTypeGuidInList( + _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, + _In_ ULONG ObjectTypeListLength, + _In_ PGUID ObjectTypeGuid, + _Out_ PULONG ObjectIndex) +{ + ULONG ObjectTypeIndex; + GUID ObjectTypeGuidToSearch; + + PAGED_CODE(); + + /* Loop over the object elements */ + for (ObjectTypeIndex = 0; + ObjectTypeIndex < ObjectTypeListLength; + ObjectTypeIndex++) + { + /* Is this the object we are searching for? */ + ObjectTypeGuidToSearch = ObjectTypeList[ObjectTypeIndex].ObjectTypeGuid; + if (SepIsEqualObjectTypeGuid(ObjectTypeGuid, &ObjectTypeGuidToSearch)) + { + /* Return the indext of that object to caller */ + *ObjectIndex = ObjectTypeIndex; + return TRUE; + } + } + + return FALSE; +} + +/** + * @brief + * Captures a list of object types and converts it to + * an internal form for use by the kernel. The list + * is validated before its data is copied. + * + * @param[in] ObjectTypeList + * A pointer to a list of object types passed from + * UM to be captured. + * + * @param[in] ObjectTypeListLength + * The length size of the list. This length represents + * the number of object elements in that list. * * @param[in] PreviousMode - * Processor access level mode. + * Processor access level mode. This has to be set to + * UserMode as object type access check is not supported + * in the kernel. * * @param[out] CapturedObjectTypeList - * The captured list of object types. + * A pointer to a returned captured list of object types. * * @return * Returns STATUS_SUCCESS if the list of object types has been captured * successfully. STATUS_INVALID_PARAMETER is returned if the caller hasn't - * supplied a buffer list of object types. STATUS_INSUFFICIENT_RESOURCES - * is returned if pool memory allocation for the captured list has failed. + * supplied a buffer list of object types or the list is invalid. + * STATUS_INSUFFICIENT_RESOURCES is returned if pool memory allocation + * for the captured list has failed. */ NTSTATUS SeCaptureObjectTypeList( _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, _In_ ULONG ObjectTypeListLength, _In_ KPROCESSOR_MODE PreviousMode, - _Out_ POBJECT_TYPE_LIST *CapturedObjectTypeList) + _Out_ POBJECT_TYPE_LIST_INTERNAL *CapturedObjectTypeList) { + NTSTATUS Status; + ULONG ObjectTypeIndex; SIZE_T Size; + PGUID ObjectTypeGuid; + POBJECT_TYPE_LIST_INTERNAL InternalTypeList; + + PAGED_CODE(); + /* We do not support that in the kernel */ if (PreviousMode == KernelMode) { return STATUS_NOT_IMPLEMENTED; } + /* No count elements of objects means no captured list for you */ if (ObjectTypeListLength == 0) { *CapturedObjectTypeList = NULL; return STATUS_SUCCESS; } + /* Check if the caller supplied a list since we have the count of elements */ if (ObjectTypeList == NULL) { + DPRINT1("The caller did not provide a list of object types!\n"); return STATUS_INVALID_PARAMETER; } - /* Calculate the list size and check for integer overflow */ - Size = ObjectTypeListLength * sizeof(OBJECT_TYPE_LIST); - if (Size == 0) + /* Validate that list before we copy contents from it */ + Status = SepValidateObjectTypeList(ObjectTypeList, ObjectTypeListLength); + if (!NT_SUCCESS(Status)) { - return STATUS_INVALID_PARAMETER; + DPRINT1("SepValidateObjectTypeList failed (Status 0x%08lx)\n", Status); + return Status; } /* Allocate a new list */ - *CapturedObjectTypeList = ExAllocatePoolWithTag(PagedPool, Size, TAG_SEPA); - if (*CapturedObjectTypeList == NULL) + Size = ObjectTypeListLength * sizeof(OBJECT_TYPE_LIST_INTERNAL); + InternalTypeList = ExAllocatePoolWithTag(PagedPool, Size, TAG_SEPA); + if (InternalTypeList == NULL) { + DPRINT1("Failed to allocate pool memory for the object type list!\n"); return STATUS_INSUFFICIENT_RESOURCES; } _SEH2_TRY { - ProbeForRead(ObjectTypeList, Size, sizeof(ULONG)); - RtlCopyMemory(*CapturedObjectTypeList, ObjectTypeList, Size); + /* Loop for every object element, data was already probed */ + for (ObjectTypeIndex = 0; + ObjectTypeIndex < ObjectTypeListLength; + ObjectTypeIndex++) + { + /* Copy the object type GUID */ + ObjectTypeGuid = ObjectTypeList[ObjectTypeIndex].ObjectType; + InternalTypeList[ObjectTypeIndex].ObjectTypeGuid = *ObjectTypeGuid; + + /* Copy the object hierarchy level */ + InternalTypeList[ObjectTypeIndex].Level = ObjectTypeList[ObjectTypeIndex].Level; + + /* Initialize the access check rights */ + InternalTypeList[ObjectTypeIndex].ObjectAccessRights.RemainingAccessRights = 0; + InternalTypeList[ObjectTypeIndex].ObjectAccessRights.GrantedAccessRights = 0; + InternalTypeList[ObjectTypeIndex].ObjectAccessRights.DeniedAccessRights = 0; + } + + /* Give the captured list to caller */ + *CapturedObjectTypeList = InternalTypeList; } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - ExFreePoolWithTag(*CapturedObjectTypeList, TAG_SEPA); - *CapturedObjectTypeList = NULL; + ExFreePoolWithTag(InternalTypeList, TAG_SEPA); + InternalTypeList = NULL; _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; @@ -99,17 +373,18 @@ SeCaptureObjectTypeList( * * @param[in] PreviousMode * Processor access level mode. - * - * @return - * Nothing. */ VOID SeReleaseObjectTypeList( - _In_ _Post_invalid_ POBJECT_TYPE_LIST CapturedObjectTypeList, + _In_ _Post_invalid_ POBJECT_TYPE_LIST_INTERNAL CapturedObjectTypeList, _In_ KPROCESSOR_MODE PreviousMode) { + PAGED_CODE(); + if ((PreviousMode != KernelMode) && (CapturedObjectTypeList != NULL)) + { ExFreePoolWithTag(CapturedObjectTypeList, TAG_SEPA); + } } /* EOF */

1 year, 10 months

[reactos] 03/10: [NTOS:SE] Implement SepDumpAccessAndStatusList

by George Bișoc

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=5f3fab72a9b242394fe64… commit 5f3fab72a9b242394fe64119072c2449e8acead0 Author: George Bișoc <george.bisoc(a)reactos.org> AuthorDate: Wed Jun 21 17:44:34 2023 +0200 Commit: unknown <george.bisoc(a)reactos.org> CommitDate: Tue Aug 22 17:54:17 2023 +0200 [NTOS:SE] Implement SepDumpAccessAndStatusList This function will dump all the access status and granted access rights of each object list of a list whenever an access check by type (or by type result list) fails. This is for debugging purposes. --- ntoskrnl/se/debug.c | 38 +++++++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/ntoskrnl/se/debug.c b/ntoskrnl/se/debug.c index 87e4f1e57e1..1f038ac0702 100644 --- a/ntoskrnl/se/debug.c +++ b/ntoskrnl/se/debug.c @@ -2,7 +2,7 @@ * PROJECT: ReactOS Kernel * LICENSE: GPL-2.0-or-later (https://spdx.org/licenses/GPL-2.0-or-later) * PURPOSE: Security subsystem debug routines support - * COPYRIGHT: Copyright 2022 George Bișoc <george.bisoc(a)reactos.org> + * COPYRIGHT: Copyright 2022-2023 George Bișoc <george.bisoc(a)reactos.org> */ /* INCLUDES *******************************************************************/ @@ -344,4 +344,40 @@ SepDumpAccessRightsStats( #endif } +/** + * @brief + * Dumps access and status values of each object type + * in the result list. + */ +VOID +SepDumpAccessAndStatusList( + _In_ PACCESS_MASK GrantedAccessList, + _In_ PNTSTATUS AccessStatusList, + _In_ BOOLEAN IsResultList, + _In_ POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, + _In_ ULONG ObjectTypeListLength) +{ +#ifndef NDEBUG + ULONG ResultListIndex; + ULONG ObjectTypeIndex; + ULONG ResultListLength; + + DbgPrint("================== ACCESS & STATUS OBJECT TYPE LIST STATISTICS ==================\n"); + ResultListLength = IsResultList ? ObjectTypeListLength : 1; + for (ResultListIndex = 0; ResultListIndex < ResultListLength; ResultListIndex++) + { + DbgPrint("Result Index #%lu, Granted access rights -> 0x%08lx, Access status -> 0x%08lx\n", + ResultListIndex, GrantedAccessList[ResultListIndex], AccessStatusList[ResultListIndex]); + } + + for (ObjectTypeIndex = 0; ObjectTypeIndex < ObjectTypeListLength; ObjectTypeIndex++) + { + DbgPrint("================== #%lu OBJECT ACCESS RIGHTS ==================\n", ObjectTypeIndex); + DbgPrint("Remaining access rights -> 0x%08lx\n", ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.RemainingAccessRights); + DbgPrint("Granted access rights -> 0x%08lx\n", ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.GrantedAccessRights); + DbgPrint("Denied access rights -> 0x%08lx\n", ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.DeniedAccessRights); + } +#endif +} + /* EOF */

1 year, 10 months

[reactos] 02/10: [NTOS:SE] Declare function prototypes & add OBJECT_TYPE_LIST_INTERNAL

by George Bișoc

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=5654ce7b9a1ccd7f35ec6… commit 5654ce7b9a1ccd7f35ec6ae5d27f218ff6bb15d9 Author: George Bișoc <george.bisoc(a)reactos.org> AuthorDate: Tue Jun 20 10:55:35 2023 +0200 Commit: unknown <george.bisoc(a)reactos.org> CommitDate: Tue Aug 22 17:54:17 2023 +0200 [NTOS:SE] Declare function prototypes & add OBJECT_TYPE_LIST_INTERNAL OBJECT_TYPE_LIST_INTERNAL will serve as an internal kernel data structure to hold validated object type contents that are copied from UM. The difference between the public and the internal one is that the internal structure has an additional member for access check rights that have been granted on each object element in the list. --- ntoskrnl/include/internal/se.h | 36 +++++++++++++++++++++++++++++++++--- ntoskrnl/se/audit.c | 4 ++-- 2 files changed, 35 insertions(+), 5 deletions(-) diff --git a/ntoskrnl/include/internal/se.h b/ntoskrnl/include/internal/se.h index d261b03c54a..db32e6bff73 100644 --- a/ntoskrnl/include/internal/se.h +++ b/ntoskrnl/include/internal/se.h @@ -3,7 +3,7 @@ * LICENSE: GPL-2.0-or-later (https://spdx.org/licenses/GPL-2.0-or-later) * PURPOSE: Internal header for the Security Manager * COPYRIGHT: Copyright Eric Kohl - * Copyright 2022 George Bișoc <george.bisoc(a)reactos.org> + * Copyright 2022-2023 George Bișoc <george.bisoc(a)reactos.org> */ #pragma once @@ -45,6 +45,16 @@ typedef struct _ACCESS_CHECK_RIGHTS ACCESS_MASK DeniedAccessRights; } ACCESS_CHECK_RIGHTS, *PACCESS_CHECK_RIGHTS; +// +// Internal object type list structure +// +typedef struct _OBJECT_TYPE_LIST_INTERNAL +{ + GUID ObjectTypeGuid; + USHORT Level; + ACCESS_CHECK_RIGHTS ObjectAccessRights; +} OBJECT_TYPE_LIST_INTERNAL, *POBJECT_TYPE_LIST_INTERNAL; + typedef enum _ACCESS_CHECK_RIGHT_TYPE { AccessCheckMaximum, @@ -304,6 +314,14 @@ SepDumpTokenDebugInfo( VOID SepDumpAccessRightsStats( _In_ PACCESS_CHECK_RIGHTS AccessRights); + +VOID +SepDumpAccessAndStatusList( + _In_ PACCESS_MASK GrantedAccessList, + _In_ PNTSTATUS AccessStatusList, + _In_ BOOLEAN IsResultList, + _In_ POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, + _In_ ULONG ObjectTypeListLength); #endif // DBG // @@ -827,16 +845,28 @@ SepReleaseSecurityQualityOfService( // // Object type list functions // +PGUID +SepGetObjectTypeGuidFromAce( + _In_ PACE Ace, + _In_ BOOLEAN IsAceDenied); + +BOOLEAN +SepObjectTypeGuidInList( + _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, + _In_ ULONG ObjectTypeListLength, + _In_ PGUID ObjectTypeGuid, + _Out_ PULONG ObjectIndex); + NTSTATUS SeCaptureObjectTypeList( _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, _In_ ULONG ObjectTypeListLength, _In_ KPROCESSOR_MODE PreviousMode, - _Out_ POBJECT_TYPE_LIST *CapturedObjectTypeList); + _Out_ POBJECT_TYPE_LIST_INTERNAL *CapturedObjectTypeList); VOID SeReleaseObjectTypeList( - _In_ _Post_invalid_ POBJECT_TYPE_LIST CapturedObjectTypeList, + _In_ _Post_invalid_ POBJECT_TYPE_LIST_INTERNAL CapturedObjectTypeList, _In_ KPROCESSOR_MODE PreviousMode); // diff --git a/ntoskrnl/se/audit.c b/ntoskrnl/se/audit.c index e2a5cc49c23..aae45beb31f 100644 --- a/ntoskrnl/se/audit.c +++ b/ntoskrnl/se/audit.c @@ -497,7 +497,7 @@ SepAccessCheckAndAuditAlarmWorker( _In_ ACCESS_MASK DesiredAccess, _In_ AUDIT_EVENT_TYPE AuditType, _In_ BOOLEAN HaveAuditPrivilege, - _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, + _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, _In_ ULONG ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping, _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccessList, @@ -641,7 +641,7 @@ SepAccessCheckAndAuditAlarm( ACCESS_MASK GrantedAccess, *SafeGrantedAccessList; NTSTATUS AccessStatus, *SafeAccessStatusList; PSID CapturedPrincipalSelfSid; - POBJECT_TYPE_LIST CapturedObjectTypeList; + POBJECT_TYPE_LIST_INTERNAL CapturedObjectTypeList; ULONG i; BOOLEAN LocalGenerateOnClose; NTSTATUS Status;

1 year, 10 months

[reactos] 01/10: [NTOS:SE] Update the NT access check syscalls SAL2 annotations

by George Bișoc

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=edcf3f5363cbaf212654f… commit edcf3f5363cbaf212654f78eda5542b1d7cea4be Author: George Bișoc <george.bisoc(a)reactos.org> AuthorDate: Tue Jun 20 10:42:08 2023 +0200 Commit: unknown <george.bisoc(a)reactos.org> CommitDate: Tue Aug 22 17:53:45 2023 +0200 [NTOS:SE] Update the NT access check syscalls SAL2 annotations The newly updated SAL2 annotations reflect those from Process Hacker. Also these syscalls must have their function's status code checked, as most of other Native syscalls have them checked. --- sdk/include/ndk/sefuncs.h | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/sdk/include/ndk/sefuncs.h b/sdk/include/ndk/sefuncs.h index b0227a223d0..3c24177cb16 100644 --- a/sdk/include/ndk/sefuncs.h +++ b/sdk/include/ndk/sefuncs.h @@ -13,6 +13,7 @@ Abstract: Author: Alex Ionescu (alexi(a)tinykrnl.org) - Updated - 27-Feb-2006 + George Bișoc (george.bisoc(a)reactos.org) - Updated - 23-Apr-2023 --*/ @@ -79,6 +80,8 @@ SeTokenImpersonationLevel( // // Native Calls // +_Must_inspect_result_ +__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI @@ -87,40 +90,44 @@ NtAccessCheck( _In_ HANDLE ClientToken, _In_ ACCESS_MASK DesiredAccess, _In_ PGENERIC_MAPPING GenericMapping, - _Out_ PPRIVILEGE_SET PrivilegeSet, - _Out_ PULONG ReturnLength, + _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet, + _Inout_ PULONG PrivilegeSetLength, _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus); +_Must_inspect_result_ +NTSYSCALLAPI NTSTATUS NTAPI NtAccessCheckByType( _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, - _In_ PSID PrincipalSelfSid, + _In_opt_ PSID PrincipalSelfSid, _In_ HANDLE ClientToken, _In_ ACCESS_MASK DesiredAccess, - _In_ POBJECT_TYPE_LIST ObjectTypeList, - _In_ ULONG ObjectTypeLength, + _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, + _In_ ULONG ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping, - _In_ PPRIVILEGE_SET PrivilegeSet, + _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength, _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus); +_Must_inspect_result_ +NTSYSCALLAPI NTSTATUS NTAPI NtAccessCheckByTypeResultList( _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, - _In_ PSID PrincipalSelfSid, + _In_opt_ PSID PrincipalSelfSid, _In_ HANDLE ClientToken, _In_ ACCESS_MASK DesiredAccess, - _In_ POBJECT_TYPE_LIST ObjectTypeList, - _In_ ULONG ObjectTypeLength, + _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, + _In_ ULONG ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping, - _In_ PPRIVILEGE_SET PrivilegeSet, + _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength, - _Out_ PACCESS_MASK GrantedAccess, - _Out_ PNTSTATUS AccessStatus); + _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess, + _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus); _Must_inspect_result_ __kernel_entry NTSYSCALLAPI @@ -331,8 +338,8 @@ ZwAccessCheck( _In_ HANDLE ClientToken, _In_ ACCESS_MASK DesiredAccess, _In_ PGENERIC_MAPPING GenericMapping, - _Out_ PPRIVILEGE_SET PrivilegeSet, - _Out_ PULONG ReturnLength, + _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet, + _Out_ PULONG PrivilegeSetLength, _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus);

1 year, 10 months

[reactos] 01/01: [KERNEL32] Improve a few NT6 stubs

by Timo Kreuzer

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=08629037ea7cfda9fab9e… commit 08629037ea7cfda9fab9e898b38c8e66ef77373a Author: Timo Kreuzer <timo.kreuzer(a)reactos.org> AuthorDate: Sat Aug 12 08:54:16 2023 +0300 Commit: Timo Kreuzer <timo.kreuzer(a)reactos.org> CommitDate: Tue Aug 22 18:46:31 2023 +0300 [KERNEL32] Improve a few NT6 stubs --- dll/win32/kernel32/kernel32.spec | 52 ++++++++++++++++++++-------------------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/dll/win32/kernel32/kernel32.spec b/dll/win32/kernel32/kernel32.spec index 2853c50d579..e72f99fb295 100644 --- a/dll/win32/kernel32/kernel32.spec +++ b/dll/win32/kernel32/kernel32.spec @@ -169,12 +169,12 @@ @ stdcall -version=0x600+ CreateSymbolicLinkW(wstr wstr long) @ stdcall CreateTapePartition(long long long long) @ stdcall CreateThread(ptr long ptr long long ptr) -@ stub -version=0x600+ CreateThreadpool -@ stub -version=0x600+ CreateThreadpoolCleanupGroup -@ stub -version=0x600+ CreateThreadpoolIo -@ stub -version=0x600+ CreateThreadpoolTimer -@ stub -version=0x600+ CreateThreadpoolWait -@ stub -version=0x600+ CreateThreadpoolWork +@ stdcall -stub -version=0x600+ CreateThreadpool(ptr) +@ stdcall -stub -version=0x600+ CreateThreadpoolCleanupGroup() +@ stdcall -stub -version=0x600+ CreateThreadpoolIo(ptr ptr ptr ptr) +@ stdcall -stub -version=0x600+ CreateThreadpoolTimer(ptr ptr ptr) +@ stdcall -stub -version=0x600+ CreateThreadpoolWait(ptr ptr ptr) +@ stdcall -stub -version=0x600+ CreateThreadpoolWork(ptr ptr ptr) @ stdcall CreateTimerQueue() @ stdcall CreateTimerQueueTimer(ptr long ptr ptr long long long) @ stdcall CreateToolhelp32Snapshot(long long) @@ -202,7 +202,7 @@ @ stub -version=0x600+ DeleteFileTransactedA @ stub -version=0x600+ DeleteFileTransactedW @ stdcall DeleteFileW(wstr) -@ stub -version=0x600+ DeleteProcThreadAttributeList +@ stdcall -stub -version=0x600+ DeleteProcThreadAttributeList(ptr) @ stdcall DeleteTimerQueue(long) @ stdcall DeleteTimerQueueEx(long long) @ stdcall DeleteTimerQueueTimer(long long long) @@ -418,7 +418,7 @@ @ stdcall GetConsoleOutputCP() @ stdcall GetConsoleProcessList(ptr long) ; missing in XP SP3 @ stdcall GetConsoleScreenBufferInfo(long ptr) -@ stub -version=0x600+ GetConsoleScreenBufferInfoEx +@ stdcall -stub -version=0x600+ GetConsoleScreenBufferInfoEx(ptr ptr) @ stdcall GetConsoleSelectionInfo(ptr) @ stdcall GetConsoleTitleA(ptr long) @ stdcall GetConsoleTitleW(ptr long) @@ -544,7 +544,7 @@ @ stdcall GetNumberOfConsoleMouseButtons(ptr) @ stdcall GetOEMCP() @ stdcall GetOverlappedResult(long ptr ptr long) -@ stub -version=0x600+ GetPhysicallyInstalledSystemMemory +@ stdcall -stub -version=0x600+ GetPhysicallyInstalledSystemMemory(ptr) @ stdcall GetPriorityClass(long) @ stdcall GetPrivateProfileIntA(str str long str) @ stdcall GetPrivateProfileIntW(wstr wstr long wstr) @@ -593,7 +593,7 @@ @ stub -version=0x600+ GetSystemDEPPolicy @ stdcall GetSystemDefaultLCID() @ stdcall GetSystemDefaultLangID() -@ stub -version=0x600+ GetSystemDefaultLocaleName +@ stdcall -stub -version=0x600+ GetSystemDefaultLocaleName(ptr long) @ stdcall GetSystemDefaultUILanguage() @ stdcall GetSystemDirectoryA(ptr long) @ stdcall GetSystemDirectoryW(ptr long) @@ -620,7 +620,7 @@ @ stdcall GetTempPathA(long ptr) @ stdcall GetTempPathW(long ptr) @ stdcall GetThreadContext(long ptr) -@ stub -version=0x600+ GetThreadErrorMode +@ stdcall -stub -version=0x600+ GetThreadErrorMode() @ stdcall GetThreadIOPendingFlag(long ptr) @ stdcall GetThreadId(ptr) @ stdcall GetThreadLocale() @@ -636,7 +636,7 @@ @ stdcall -version=0x600+ GetTimeFormatEx(wstr long ptr wstr wstr long) @ stdcall GetTimeFormatW(long long ptr wstr ptr long) @ stdcall GetTimeZoneInformation(ptr) -@ stub -version=0x600+ GetTimeZoneInformationForYear +@ stdcall -stub -version=0x600+ GetTimeZoneInformationForYear(long ptr ptr) @ stdcall -version=0x600+ GetUILanguageInfo(long wstr wstr ptr ptr) @ stdcall GetUserDefaultLCID() @ stdcall GetUserDefaultLangID() @@ -704,19 +704,19 @@ @ stdcall -version=0x351-0x502 HeapUsage(long long long long ptr) @ stdcall HeapValidate(long long ptr) @ stdcall HeapWalk(long ptr) -@ stub -version=0x600+ IdnToAscii -@ stub -version=0x600+ IdnToNameprepUnicode -@ stub -version=0x600+ IdnToUnicode +@ stdcall -stub -version=0x600+ IdnToAscii(long wstr long ptr long) +@ stdcall -stub -version=0x600+ IdnToNameprepUnicode(long wstr long ptr long) +@ stdcall -stub -version=0x600+ IdnToUnicode(long wstr long ptr long) @ stdcall InitAtomTable(long) -@ stub -version=0x600+ InitOnceBeginInitialize -@ stub -version=0x600+ InitOnceComplete +@ stdcall -stub -version=0x600+ InitOnceBeginInitialize(ptr long ptr ptr) +@ stdcall -stub -version=0x600+ InitOnceComplete(ptr long ptr) @ stdcall -version=0x600+ InitOnceExecuteOnce(ptr ptr ptr ptr) -@ stub -version=0x600+ InitOnceInitialize +@ stdcall -stub -version=0x600+ InitOnceInitialize(ptr) @ stdcall -version=0x600+ InitializeConditionVariable(ptr) ntdll.RtlInitializeConditionVariable @ stdcall InitializeCriticalSection(ptr) @ stdcall InitializeCriticalSectionAndSpinCount(ptr long) @ stdcall -version=0x600+ InitializeCriticalSectionEx(ptr long long) -@ stub -version=0x600+ InitializeProcThreadAttributeList +@ stdcall -stub -version=0x600+ InitializeProcThreadAttributeList(ptr long long ptr) @ stdcall InitializeSListHead(ptr) ntdll.RtlInitializeSListHead @ stdcall -version=0x600+ InitializeSRWLock(ptr) ntdll.RtlInitializeSRWLock @ stdcall -arch=i386 -ret64 InterlockedCompareExchange64(ptr double double) ntdll.RtlInterlockedCompareExchange64 @@ -744,7 +744,7 @@ @ stdcall IsDBCSLeadByteEx(long long) @ stdcall IsDebuggerPresent() @ stdcall IsNLSDefinedString(long long ptr long long) -@ stub -version=0x600+ IsNormalizedString +@ stdcall -stub -version=0x600+ IsNormalizedString(long wstr long) @ stdcall IsProcessInJob(long long ptr) @ stdcall IsProcessorFeaturePresent(long) @ stdcall IsSystemResumeAutomatic() @@ -826,8 +826,8 @@ @ stub -version=0x600+ NlsUpdateLocale @ stub -version=0x600+ NlsUpdateSystemLocale @ stub -version=0x600+ NlsWriteEtwEvent -@ stub -version=0x600+ NormalizeString -@ stub -version=0x600+ NotifyUILanguageChange +@ stdcall -stub -version=0x600+ NormalizeString(long wstr long ptr long) +@ stdcall -stub -version=0x600+ NotifyUILanguageChange(long wstr wstr long ptr) @ stdcall OpenConsoleW(wstr long long long) @ stdcall -version=0x500-0x502 OpenDataFile(long long) @ stdcall OpenEventA(long long str) @@ -1072,7 +1072,7 @@ @ stdcall SetTermsrvAppInstallMode(long) @ stdcall SetThreadAffinityMask(long long) @ stdcall SetThreadContext(long ptr) -@ stub -version=0x600+ SetThreadErrorMode +@ stdcall -stub -version=0x600+ SetThreadErrorMode(long ptr) @ stdcall SetThreadExecutionState(long) @ stdcall SetThreadIdealProcessor(long long) @ stdcall SetThreadLocale(long) @@ -1104,7 +1104,7 @@ @ stdcall -version=0x600+ SleepConditionVariableSRW(ptr ptr long long) @ stdcall SleepEx(long long) @ stub -version=0x600+ StartThreadpoolIo -@ stub -version=0x600+ SubmitThreadpoolWork +@ stdcall -stub -version=0x600+ SubmitThreadpoolWork(ptr) @ stdcall SuspendThread(long) @ stdcall SwitchToFiber(ptr) @ stdcall SwitchToThread() @@ -1138,7 +1138,7 @@ @ stdcall UnregisterWait(long) @ stdcall UnregisterWaitEx(long long) @ stub -version=0x600+ UpdateCalendarDayOfWeek -@ stub -version=0x600+ UpdateProcThreadAttribute +@ stdcall -stub -version=0x600+ UpdateProcThreadAttribute(ptr long ptr ptr ptr ptr ptr) @ stdcall UpdateResourceA(long str str long ptr long) @ stdcall UpdateResourceW(long wstr wstr long ptr long) @ stdcall VDMConsoleOperation(long long) @@ -1173,7 +1173,7 @@ @ stub -version=0x600+ WaitForThreadpoolIoCallbacks @ stub -version=0x600+ WaitForThreadpoolTimerCallbacks @ stub -version=0x600+ WaitForThreadpoolWaitCallbacks -@ stub -version=0x600+ WaitForThreadpoolWorkCallbacks +@ stdcall -stub -version=0x600+ WaitForThreadpoolWorkCallbacks(ptr long) @ stdcall WaitNamedPipeA(str long) @ stdcall WaitNamedPipeW(wstr long) @ stdcall -version=0x600+ WakeAllConditionVariable(ptr) ntdll.RtlWakeAllConditionVariable

1 year, 10 months

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs