[ros-diffs] [ekohl] 74157: [NTOS:OB] - Allocate all of the kernel objects security descriptor and the dos devices security descriptor from the paged pool, instead of just the ACLs. - Replace special security d...

Author: ekohl
Date: Mon Mar 13 00:10:23 2017
New Revision: 74157

URL: http://svn.reactos.org/svn/reactos?rev=74157&view=rev
Log:
[NTOS:OB]
- Allocate all of the kernel objects security descriptor and the dos devices security
descriptor from the paged pool, instead of just the ACLs.
- Replace special security descriptor free routines by calls to ExFreePoolWithTag.
- Replace the TAG_OB_DIR_SD by TAG_SD.

Modified:
    trunk/reactos/ntoskrnl/include/internal/tag.h
    trunk/reactos/ntoskrnl/ob/obinit.c
    trunk/reactos/ntoskrnl/ob/obname.c

Modified: trunk/reactos/ntoskrnl/include/internal/tag.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/include/internal/…
==============================================================================
--- trunk/reactos/ntoskrnl/include/internal/tag.h	[iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/include/internal/tag.h	[iso-8859-1] Mon Mar 13 00:10:23 2017
@@ -150,7 +150,6 @@
 /* Object Manager Tags */
 #define OB_NAME_TAG             'mNbO'
 #define OB_DIR_TAG              'iDbO'
-#define TAG_OB_DIR_SD           'sDbO'
 
 
 /* formerly located in ps/cid.c */

Modified: trunk/reactos/ntoskrnl/ob/obinit.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ob/obinit.c?rev=7…
==============================================================================
--- trunk/reactos/ntoskrnl/ob/obinit.c	[iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/ob/obinit.c	[iso-8859-1] Mon Mar 13 00:10:23 2017
@@ -58,32 +58,37 @@
 NTSTATUS
 NTAPI
 INIT_FUNCTION
-ObpCreateKernelObjectsSD(OUT PSECURITY_DESCRIPTOR SecurityDescriptor)
-{
-    ULONG AclLength;
+ObpCreateKernelObjectsSD(OUT PSECURITY_DESCRIPTOR *SecurityDescriptor)
+{
+    PSECURITY_DESCRIPTOR Sd = NULL;
     PACL Dacl;
+    ULONG AclSize, SdSize;
     NTSTATUS Status;
 
-    /* Initialize the SD */
-    Status = RtlCreateSecurityDescriptor(SecurityDescriptor,
-                                         SECURITY_DESCRIPTOR_REVISION);
-    if (!NT_SUCCESS(Status))
-        return Status;
-
-    /* Allocate the DACL */
-    AclLength = sizeof(ACL) +
-                sizeof(ACE) + RtlLengthSid(SeWorldSid) +
-                sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid) +
-                sizeof(ACE) + RtlLengthSid(SeLocalSystemSid);
-
-    Dacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_OB_DIR_SD);
-    if (Dacl == NULL)
+    AclSize = sizeof(ACL) +
+              sizeof(ACE) + RtlLengthSid(SeWorldSid) +
+              sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid) +
+              sizeof(ACE) + RtlLengthSid(SeLocalSystemSid);
+
+    SdSize = sizeof(SECURITY_DESCRIPTOR) + AclSize;
+
+    /* Allocate the SD and ACL */
+    Sd = ExAllocatePoolWithTag(PagedPool, SdSize, TAG_SD);
+    if (Sd == NULL)
     {
         return STATUS_INSUFFICIENT_RESOURCES;
     }
 
+    /* Initialize the SD */
+    Status = RtlCreateSecurityDescriptor(Sd,
+                                         SECURITY_DESCRIPTOR_REVISION);
+    if (!NT_SUCCESS(Status))
+        goto done;
+
+    Dacl = (PACL)((INT_PTR)Sd + sizeof(SECURITY_DESCRIPTOR));
+
     /* Initialize the DACL */
-    RtlCreateAcl(Dacl, AclLength, ACL_REVISION);
+    RtlCreateAcl(Dacl, AclSize, ACL_REVISION);
 
     /* Add the ACEs */
     RtlAddAccessAllowedAce(Dacl,
@@ -102,32 +107,23 @@
                            SeLocalSystemSid);
 
     /* Attach the DACL to the SD */
-    Status = RtlSetDaclSecurityDescriptor(SecurityDescriptor,
+    Status = RtlSetDaclSecurityDescriptor(Sd,
                                           TRUE,
                                           Dacl,
                                           FALSE);
+    if (!NT_SUCCESS(Status))
+        goto done;
+
+    *SecurityDescriptor = Sd;
+
+done:
+    if (!NT_SUCCESS(Status))
+    {
+        if (Sd != NULL)
+            ExFreePoolWithTag(Sd, TAG_SD);
+    }
 
     return Status;
-}
-
-static
-VOID
-NTAPI
-INIT_FUNCTION
-ObpFreeKernelObjectsSD(IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor)
-{
-    PACL Dacl = NULL;
-    BOOLEAN DaclPresent, Defaulted;
-    NTSTATUS Status;
-
-    Status = RtlGetDaclSecurityDescriptor(SecurityDescriptor,
-                                          &DaclPresent,
-                                          &Dacl,
-                                          &Defaulted);
-    if (NT_SUCCESS(Status) && Dacl != NULL)
-    {
-        ExFreePoolWithTag(Dacl, TAG_OB_DIR_SD);
-    }
 }
 
 BOOLEAN
@@ -212,7 +208,7 @@
     POBJECT_HEADER Header;
     POBJECT_HEADER_CREATOR_INFO CreatorInfo;
     POBJECT_HEADER_NAME_INFO NameInfo;
-    SECURITY_DESCRIPTOR KernelObjectsSD;
+    PSECURITY_DESCRIPTOR KernelObjectsSD = NULL;
     NTSTATUS Status;
 
     /* Check if this is actually Phase 1 initialization */
@@ -346,13 +342,13 @@
                                &Name,
                                OBJ_CASE_INSENSITIVE | OBJ_PERMANENT,
                                NULL,
-                               &KernelObjectsSD);
+                               KernelObjectsSD);
 
     /* Create the directory */
     Status = NtCreateDirectoryObject(&Handle,
                                      DIRECTORY_ALL_ACCESS,
                                      &ObjectAttributes);
-    ObpFreeKernelObjectsSD(&KernelObjectsSD);
+    ExFreePoolWithTag(KernelObjectsSD, TAG_SD);
     if (!NT_SUCCESS(Status)) return FALSE;
 
     /* Close the extra handle */

Modified: trunk/reactos/ntoskrnl/ob/obname.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ob/obname.c?rev=7…
==============================================================================
--- trunk/reactos/ntoskrnl/ob/obname.c	[iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/ob/obname.c	[iso-8859-1] Mon Mar 13 00:10:23 2017
@@ -34,35 +34,40 @@
 NTSTATUS
 NTAPI
 INIT_FUNCTION
-ObpCreateGlobalDosDevicesSD(OUT PSECURITY_DESCRIPTOR SecurityDescriptor)
+ObpCreateGlobalDosDevicesSD(OUT PSECURITY_DESCRIPTOR *SecurityDescriptor)
 {
-    ULONG AclLength;
+    PSECURITY_DESCRIPTOR Sd = NULL;
     PACL Dacl;
+    ULONG AclSize, SdSize;
     NTSTATUS Status;
 
+    AclSize = sizeof(ACL) +
+              sizeof(ACE) + RtlLengthSid(SeWorldSid) +
+              sizeof(ACE) + RtlLengthSid(SeLocalSystemSid) +
+              sizeof(ACE) + RtlLengthSid(SeWorldSid) +
+              sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid) +
+              sizeof(ACE) + RtlLengthSid(SeLocalSystemSid) +
+              sizeof(ACE) + RtlLengthSid(SeCreatorOwnerSid);
+
+    SdSize = sizeof(SECURITY_DESCRIPTOR) + AclSize;
+
+    /* Allocate the SD and ACL */
+    Sd = ExAllocatePoolWithTag(PagedPool, SdSize, TAG_SD);
+    if (Sd == NULL)
+    {
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
     /* Initialize the SD */
-    Status = RtlCreateSecurityDescriptor(SecurityDescriptor,
+    Status = RtlCreateSecurityDescriptor(Sd,
                                          SECURITY_DESCRIPTOR_REVISION);
     if (!NT_SUCCESS(Status))
         return Status;
 
-    /* Allocate the DACL */
-    AclLength = sizeof(ACL) +
-                sizeof(ACE) + RtlLengthSid(SeWorldSid) +
-                sizeof(ACE) + RtlLengthSid(SeLocalSystemSid) +
-                sizeof(ACE) + RtlLengthSid(SeWorldSid) +
-                sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid) +
-                sizeof(ACE) + RtlLengthSid(SeLocalSystemSid) +
-                sizeof(ACE) + RtlLengthSid(SeCreatorOwnerSid);
-
-    Dacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_OB_DIR_SD);
-    if (Dacl == NULL)
-    {
-        return STATUS_INSUFFICIENT_RESOURCES;
-    }
+    Dacl = (PACL)((INT_PTR)Sd + sizeof(SECURITY_DESCRIPTOR));
 
     /* Initialize the DACL */
-    RtlCreateAcl(Dacl, AclLength, ACL_REVISION);
+    RtlCreateAcl(Dacl, AclSize, ACL_REVISION);
 
     /* Add the ACEs */
     RtlAddAccessAllowedAce(Dacl,
@@ -100,31 +105,23 @@
                              SeCreatorOwnerSid);
 
     /* Attach the DACL to the SD */
-    Status = RtlSetDaclSecurityDescriptor(SecurityDescriptor,
+    Status = RtlSetDaclSecurityDescriptor(Sd,
                                           TRUE,
                                           Dacl,
                                           FALSE);
+    if (!NT_SUCCESS(Status))
+        goto done;
+
+    *SecurityDescriptor = Sd;
+
+done:
+    if (!NT_SUCCESS(Status))
+    {
+        if (Sd != NULL)
+            ExFreePoolWithTag(Sd, TAG_SD);
+    }
 
     return Status;
-}
-
-VOID
-NTAPI
-INIT_FUNCTION
-ObpFreeGlobalDosDevicesSD(IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor)
-{
-    PACL Dacl = NULL;
-    BOOLEAN DaclPresent, Defaulted;
-    NTSTATUS Status;
-
-    Status = RtlGetDaclSecurityDescriptor(SecurityDescriptor,
-                                          &DaclPresent,
-                                          &Dacl,
-                                          &Defaulted);
-    if (NT_SUCCESS(Status) && Dacl != NULL)
-    {
-        ExFreePoolWithTag(Dacl, TAG_OB_DIR_SD);
-    }
 }
 
 NTSTATUS
@@ -135,7 +132,7 @@
     OBJECT_ATTRIBUTES ObjectAttributes;
     UNICODE_STRING RootName, TargetName, LinkName;
     HANDLE Handle, SymHandle;
-    SECURITY_DESCRIPTOR DosDevicesSD;
+    PSECURITY_DESCRIPTOR DosDevicesSD = NULL;
     NTSTATUS Status;
 
     /* Create a custom security descriptor for the global DosDevices directory */
@@ -149,11 +146,11 @@
                                &RootName,
                                OBJ_PERMANENT,
                                NULL,
-                               &DosDevicesSD);
+                               DosDevicesSD);
     Status = NtCreateDirectoryObject(&Handle,
                                      DIRECTORY_ALL_ACCESS,
                                      &ObjectAttributes);
-    ObpFreeGlobalDosDevicesSD(&DosDevicesSD);
+    ExFreePoolWithTag(DosDevicesSD, TAG_SD);
     if (!NT_SUCCESS(Status)) return Status;
 
     /*********************************************\