Author: ekohl Date: Wed Dec 25 18:15:53 2013 New Revision: 61415
URL: http://svn.reactos.org/svn/reactos?rev=61415&view=rev Log: [][LSASRV][MSV1_0] - Move the creation of the token owner SID from msv1_0 to lsasrv. - If the user is a member of the administrators group, the adminstrators group becomes the owner of the token. Otheriwse, the user is the owner of the token.
Modified: trunk/reactos/dll/win32/lsasrv/authpackage.c trunk/reactos/dll/win32/lsasrv/lookup.c trunk/reactos/dll/win32/lsasrv/lsasrv.h trunk/reactos/dll/win32/msv1_0/msv1_0.c
Modified: trunk/reactos/dll/win32/lsasrv/authpackage.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/lsasrv/authpackag... ============================================================================== --- trunk/reactos/dll/win32/lsasrv/authpackage.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/lsasrv/authpackage.c [iso-8859-1] Wed Dec 25 18:15:53 2013 @@ -645,6 +645,47 @@
static NTSTATUS +LsapSetTokenOwner( + IN PVOID TokenInformation, + IN LSA_TOKEN_INFORMATION_TYPE TokenInformationType) +{ + PLSA_TOKEN_INFORMATION_V1 TokenInfo1; + PSID OwnerSid = NULL; + ULONG i, Length; + + if (TokenInformationType == LsaTokenInformationV1) + { + TokenInfo1 = (PLSA_TOKEN_INFORMATION_V1)TokenInformation; + + if (TokenInfo1->Owner.Owner != NULL) + return STATUS_SUCCESS; + + OwnerSid = TokenInfo1->User.User.Sid; + for (i = 0; i < TokenInfo1->Groups->GroupCount; i++) + { + if (EqualSid(TokenInfo1->Groups->Groups[i].Sid, LsapAdministratorsSid)) + { + OwnerSid = LsapAdministratorsSid; + break; + } + } + + Length = RtlLengthSid(OwnerSid); + TokenInfo1->Owner.Owner = DispatchTable.AllocateLsaHeap(Length); + if (TokenInfo1->Owner.Owner == NULL) + return STATUS_INSUFFICIENT_RESOURCES; + + RtlCopyMemory(TokenInfo1->Owner.Owner, + OwnerSid, + Length); + } + + return STATUS_SUCCESS; +} + + +static +NTSTATUS LsapAddTokenDefaultDacl( IN PVOID TokenInformation, IN LSA_TOKEN_INFORMATION_TYPE TokenInformationType) @@ -821,6 +862,13 @@ goto done; }
+ Status = LsapSetTokenOwner(TokenInformation, + TokenInformationType); + if (!NT_SUCCESS(Status)) + { + ERR("LsapSetTokenOwner() failed (Status 0x%08lx)\n", Status); + goto done; + }
Status = LsapAddTokenDefaultDacl(TokenInformation, TokenInformationType);
Modified: trunk/reactos/dll/win32/lsasrv/lookup.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/lsasrv/lookup.c?r... ============================================================================== --- trunk/reactos/dll/win32/lsasrv/lookup.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/lsasrv/lookup.c [iso-8859-1] Wed Dec 25 18:15:53 2013 @@ -81,6 +81,7 @@
LIST_ENTRY WellKnownSidListHead; PSID LsapLocalSystemSid = NULL; +PSID LsapAdministratorsSid = NULL;
/* FUNCTIONS ***************************************************************/ @@ -521,7 +522,7 @@ szAccountName, szDomainName, SidTypeAlias, - NULL); + &LsapAdministratorsSid);
/* Users Alias Sid */ LsapLoadString(hInstance, IDS_ALIAS_RID_USERS, szAccountName, 80);
Modified: trunk/reactos/dll/win32/lsasrv/lsasrv.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/lsasrv/lsasrv.h?r... ============================================================================== --- trunk/reactos/dll/win32/lsasrv/lsasrv.h [iso-8859-1] (original) +++ trunk/reactos/dll/win32/lsasrv/lsasrv.h [iso-8859-1] Wed Dec 25 18:15:53 2013 @@ -92,6 +92,7 @@ extern UNICODE_STRING AccountDomainName;
extern PSID LsapLocalSystemSid; +extern PSID LsapAdministratorsSid;
/* authpackage.c */
Modified: trunk/reactos/dll/win32/msv1_0/msv1_0.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/msv1_0/msv1_0.c?r... ============================================================================== --- trunk/reactos/dll/win32/msv1_0/msv1_0.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/msv1_0/msv1_0.c [iso-8859-1] Wed Dec 25 18:15:53 2013 @@ -271,8 +271,7 @@ BuildTokenGroups(IN PSID AccountDomainSid, IN PLUID LogonId, OUT PTOKEN_GROUPS *Groups, - OUT PSID *PrimaryGroupSid, - OUT PSID *OwnerSid) + OUT PSID *PrimaryGroupSid) { SID_IDENTIFIER_AUTHORITY WorldAuthority = {SECURITY_WORLD_SID_AUTHORITY}; SID_IDENTIFIER_AUTHORITY LocalAuthority = {SECURITY_LOCAL_SID_AUTHORITY}; @@ -374,7 +373,6 @@ TokenGroups->Groups[GroupCount].Attributes = SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY | SE_GROUP_LOGON_ID; GroupCount++; - *OwnerSid = Sid;
/* Member of 'Local users */ RtlAllocateAndInitializeSid(&LocalAuthority, @@ -548,38 +546,12 @@
static NTSTATUS -BuildTokenOwner(PTOKEN_OWNER Owner, - PSID OwnerSid) -{ - ULONG RidCount; - ULONG Size; - - RidCount = *RtlSubAuthorityCountSid(OwnerSid); - Size = RtlLengthRequiredSid(RidCount); - - Owner->Owner = DispatchTable.AllocateLsaHeap(Size); - if (Owner->Owner == NULL) - { - return STATUS_INSUFFICIENT_RESOURCES; - } - - RtlCopyMemory(Owner->Owner, - OwnerSid, - Size); - - return STATUS_SUCCESS; -} - - -static -NTSTATUS BuildTokenInformationBuffer(PLSA_TOKEN_INFORMATION_V1 *TokenInformation, PRPC_SID AccountDomainSid, ULONG RelativeId, PLUID LogonId) { PLSA_TOKEN_INFORMATION_V1 Buffer = NULL; - PSID OwnerSid = NULL; PSID PrimaryGroupSid = NULL; ULONG i; NTSTATUS Status = STATUS_SUCCESS; @@ -604,8 +576,7 @@ Status = BuildTokenGroups((PSID)AccountDomainSid, LogonId, &Buffer->Groups, - &PrimaryGroupSid, - &OwnerSid); + &PrimaryGroupSid); if (!NT_SUCCESS(Status)) goto done;
@@ -615,11 +586,6 @@ goto done;
Status = BuildTokenPrivileges(&Buffer->Privileges); - if (!NT_SUCCESS(Status)) - goto done; - - Status = BuildTokenOwner(&Buffer->Owner, - OwnerSid); if (!NT_SUCCESS(Status)) goto done;
@@ -649,9 +615,6 @@
if (Buffer->Privileges != NULL) DispatchTable.FreeLsaHeap(Buffer->Privileges); - - if (Buffer->Owner.Owner != NULL) - DispatchTable.FreeLsaHeap(Buffer->Owner.Owner);
if (Buffer->DefaultDacl.DefaultDacl != NULL) DispatchTable.FreeLsaHeap(Buffer->DefaultDacl.DefaultDacl);