[ros-diffs] [tfaber] 69265: [KMTESTS:CM] - Add a test for registry hive security descriptors

Author: tfaber
Date: Fri Sep 18 11:06:11 2015
New Revision: 69265
URL: http://svn.reactos.org/svn/reactos?rev=69265&view=rev
Log:
[KMTESTS:CM]
- Add a test for registry hive security descriptors
Added:
    trunk/rostests/kmtests/ntos_cm/   (with props)
    trunk/rostests/kmtests/ntos_cm/CmSecurity.c   (with props)
Modified:
    trunk/rostests/kmtests/CMakeLists.txt
    trunk/rostests/kmtests/kmtest_drv/testlist.c
Modified: trunk/rostests/kmtests/CMakeLists.txt
URL:
http://svn.reactos.org/svn/reactos/trunk/rostests/kmtests/CMakeLists.txt?re…
==============================================================================
--- trunk/rostests/kmtests/CMakeLists.txt       [iso-8859-1] (original)
+++ trunk/rostests/kmtests/CMakeLists.txt       [iso-8859-1] Fri Sep 18 11:06:11 2015
@@ -35,6 +35,7 @@
     npfs/NpfsHelpers.c
     npfs/NpfsReadWrite.c
     npfs/NpfsVolumeInfo.c
+    ntos_cm/CmSecurity.c
     ntos_ex/ExCallback.c
     ntos_ex/ExDoubleList.c
     ntos_ex/ExFastMutex.c
Modified: trunk/rostests/kmtests/kmtest_drv/testlist.c
URL:
http://svn.reactos.org/svn/reactos/trunk/rostests/kmtests/kmtest_drv/testli…
==============================================================================
--- trunk/rostests/kmtests/kmtest_drv/testlist.c        [iso-8859-1] (original)
+++ trunk/rostests/kmtests/kmtest_drv/testlist.c        [iso-8859-1] Fri Sep 18 11:06:11
2015
@@ -7,6 +7,7 @@
 #include <kmt_test.h>
+KMT_TESTFUNC Test_CmSecurity;
 KMT_TESTFUNC Test_Example;
 KMT_TESTFUNC Test_ExCallback;
 KMT_TESTFUNC Test_ExDoubleList;
@@ -68,6 +69,7 @@
 const KMT_TEST TestList[] =
 {
+    { "CmSecurity",                         Test_CmSecurity },
     { "ExCallback",                         Test_ExCallback },
     { "ExDoubleList",                       Test_ExDoubleList },
     { "ExFastMutex",                        Test_ExFastMutex },
Propchange: trunk/rostests/kmtests/ntos_cm/
------------------------------------------------------------------------------
--- bugtraq:logregex    (added)
+++ bugtraq:logregex    Fri Sep 18 11:06:11 2015
@@ -0,0 +1,2 @@
+([Ii]ssue|[Bb]ug)s? #?(\d+)(,? ?#?(\d+))*(,? ?(and |or )?#?(\d+))?
+(\d+)
Propchange: trunk/rostests/kmtests/ntos_cm/
------------------------------------------------------------------------------
    bugtraq:message = See issue #%BUGID% for more details.
Propchange: trunk/rostests/kmtests/ntos_cm/
------------------------------------------------------------------------------
    bugtraq:url = http://www.reactos.org/bugzilla/show_bug.cgi?id=%BUGID%
Propchange: trunk/rostests/kmtests/ntos_cm/
------------------------------------------------------------------------------
    tsvn:logminsize = 10
Added: trunk/rostests/kmtests/ntos_cm/CmSecurity.c
URL:
http://svn.reactos.org/svn/reactos/trunk/rostests/kmtests/ntos_cm/CmSecurit…
==============================================================================
--- trunk/rostests/kmtests/ntos_cm/CmSecurity.c (added)
+++ trunk/rostests/kmtests/ntos_cm/CmSecurity.c [iso-8859-1] Fri Sep 18 11:06:11 2015
@@ -0,0 +1,260 @@
+/*
+ * PROJECT:         ReactOS kernel-mode tests
+ * LICENSE:         LGPLv2+ - See COPYING.LIB in the top level directory
+ * PURPOSE:         Kernel-Mode Test Suite NPFS security test
+ * PROGRAMMER:      Thomas Faber &lt;thomas.faber(a)reactos.org&gt;
+ */
+
+#include <kmt_test.h>
+#include "../ntos_se/se.h"
+
+#define CheckKeySecurity(name, AceCount, ...) CheckKeySecurity_(name, AceCount, __FILE__,
__LINE__, ##__VA_ARGS__)
+#define CheckKeySecurity_(name, AceCount, file, line, ...) CheckKeySecurity__(name,
AceCount, file ":" KMT_STRINGIZE(line), ##__VA_ARGS__)
+static
+VOID
+CheckKeySecurity__(
+    _In_ PCWSTR KeyName,
+    _In_ ULONG AceCount,
+    _In_ PCSTR FileAndLine,
+    ...)
+{
+    NTSTATUS Status;
+    UNICODE_STRING KeyNameString;
+    OBJECT_ATTRIBUTES ObjectAttributes;
+    HANDLE KeyHandle;
+    PSECURITY_DESCRIPTOR SecurityDescriptor;
+    ULONG SecurityDescriptorSize;
+    PSID Owner;
+    PSID Group;
+    PACL Dacl;
+    PACL Sacl;
+    BOOLEAN Present;
+    BOOLEAN Defaulted;
+    va_list Arguments;
+
+    RtlInitUnicodeString(&KeyNameString, KeyName);
+    InitializeObjectAttributes(&ObjectAttributes,
+                               &KeyNameString,
+                               OBJ_KERNEL_HANDLE,
+                               NULL,
+                               NULL);
+    Status = ZwOpenKey(&KeyHandle,
+                       READ_CONTROL | ACCESS_SYSTEM_SECURITY,
+                       &ObjectAttributes);
+    ok_eq_hex(Status, STATUS_SUCCESS);
+    if (skip(NT_SUCCESS(Status), "No key (%ls)\n", KeyName))
+    {
+        return;
+    }
+
+    Status = ZwQuerySecurityObject(KeyHandle,
+                                   OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION,
+                                   NULL,
+                                   0,
+                                   &SecurityDescriptorSize);
+    ok_eq_hex(Status, STATUS_BUFFER_TOO_SMALL);
+    if (skip(Status == STATUS_BUFFER_TOO_SMALL, "No security size (%ls)\n",
KeyName))
+    {
+        ObCloseHandle(KeyHandle, KernelMode);
+        return;
+    }
+
+    SecurityDescriptor = ExAllocatePoolWithTag(PagedPool,
+                                               SecurityDescriptorSize,
+                                               'dSmK');
+    ok(SecurityDescriptor != NULL, "Failed to allocate %lu bytes\n",
SecurityDescriptorSize);
+    if (skip(SecurityDescriptor != NULL, "No memory for descriptor (%ls)\n",
KeyName))
+    {
+        ObCloseHandle(KeyHandle, KernelMode);
+        return;
+    }
+
+    Status = ZwQuerySecurityObject(KeyHandle,
+                                   OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION,
+                                   SecurityDescriptor,
+                                   SecurityDescriptorSize,
+                                   &SecurityDescriptorSize);
+    ok_eq_hex(Status, STATUS_SUCCESS);
+    if (NT_SUCCESS(Status))
+    {
+        Owner = NULL;
+        Status = RtlGetOwnerSecurityDescriptor(SecurityDescriptor,
+                                               &Owner,
+                                               &Defaulted);
+        CheckSid(Owner, NO_SIZE, SeExports->SeAliasAdminsSid);
+        ok(Defaulted == FALSE, "Owner defaulted for %ls\n", KeyName);
+
+        Group = NULL;
+        Status = RtlGetGroupSecurityDescriptor(SecurityDescriptor,
+                                               &Group,
+                                               &Defaulted);
+        CheckSid(Group, NO_SIZE, SeExports->SeLocalSystemSid);
+        ok(Defaulted == FALSE, "Group defaulted for %ls\n", KeyName);
+
+        Dacl = NULL;
+        Status = RtlGetDaclSecurityDescriptor(SecurityDescriptor,
+                                              &Present,
+                                              &Dacl,
+                                              &Defaulted);
+        ok_eq_hex(Status, STATUS_SUCCESS);
+        ok(Present == TRUE, "DACL not present for %ls\n", KeyName);
+        ok(Defaulted == FALSE, "DACL defaulted for %ls\n", KeyName);
+        va_start(Arguments, FileAndLine);
+        VCheckAcl__(Dacl, AceCount, FileAndLine, Arguments);
+        va_end(Arguments);
+
+        Sacl = NULL;
+        Status = RtlGetSaclSecurityDescriptor(SecurityDescriptor,
+                                              &Present,
+                                              &Sacl,
+                                              &Defaulted);
+        ok_eq_hex(Status, STATUS_SUCCESS);
+        ok(Present == FALSE, "SACL present for %ls\n", KeyName);
+        ok(Defaulted == FALSE, "SACL defaulted for %ls\n", KeyName);
+        ok(Sacl == NULL, "Sacl is %p for %ls\n", Sacl, KeyName);
+    }
+    ExFreePoolWithTag(SecurityDescriptor, 'dSmK');
+    ObCloseHandle(KeyHandle, KernelMode);
+}
+
+START_TEST(CmSecurity)
+{
+    SID_IDENTIFIER_AUTHORITY NtSidAuthority = {SECURITY_NT_AUTHORITY};
+    PSID TerminalServerSid;
+
+    TerminalServerSid = ExAllocatePoolWithTag(PagedPool,
+                                              RtlLengthRequiredSid(1),
+                                              'iSmK');
+    if (TerminalServerSid != NULL)
+    {
+        RtlInitializeSid(TerminalServerSid, &NtSidAuthority, 1);
+        *RtlSubAuthoritySid(TerminalServerSid, 0) = SECURITY_TERMINAL_SERVER_RID;
+    }
+    CheckKeySecurity(L"\\REGISTRY",
+                     4, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeWorldSid,       KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeRestrictedSid,  KEY_READ);
+
+    CheckKeySecurity(L"\\REGISTRY\\MACHINE",
+                     4, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeWorldSid,       KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeRestrictedSid,  KEY_READ);
+
+    CheckKeySecurity(L"\\REGISTRY\\MACHINE\\HARDWARE",
+                     4, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeWorldSid,       KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeRestrictedSid,  KEY_READ);
+
+    CheckKeySecurity(L"\\REGISTRY\\MACHINE\\SAM",
+                     4, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeWorldSid,       KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeRestrictedSid,  KEY_READ);
+
+    CheckKeySecurity(L"\\REGISTRY\\MACHINE\\SECURITY",
+                     2, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeAliasAdminsSid, WRITE_DAC | READ_CONTROL);
+
+    CheckKeySecurity(L"\\REGISTRY\\MACHINE\\SOFTWARE",
+                    12, ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasUsersSid,      KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasUsersSid,      GENERIC_READ,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasPowerUsersSid, KEY_READ | KEY_WRITE | DELETE,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasPowerUsersSid, GENERIC_READ | GENERIC_WRITE | DELETE,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasAdminsSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasAdminsSid,     GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeLocalSystemSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeLocalSystemSid,     GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasAdminsSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeCreatorOwnerSid,    GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
TerminalServerSid,               KEY_READ | KEY_WRITE | DELETE,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
TerminalServerSid,               GENERIC_READ | GENERIC_WRITE | DELETE);
+
+    CheckKeySecurity(L"\\REGISTRY\\MACHINE\\SYSTEM",
+                    10, ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasUsersSid,      KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasUsersSid,      GENERIC_READ,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasPowerUsersSid, KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasPowerUsersSid, GENERIC_READ,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasAdminsSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasAdminsSid,     GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeLocalSystemSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeLocalSystemSid,     GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasAdminsSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeCreatorOwnerSid,    GENERIC_ALL);
+
+    CheckKeySecurity(L"\\REGISTRY\\USER",
+                     4, ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeLocalSystemSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeAliasAdminsSid, KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeWorldSid,       KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE,
SeExports->SeRestrictedSid,  KEY_READ);
+
+    CheckKeySecurity(L"\\REGISTRY\\USER\\.DEFAULT",
+                    10, ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasUsersSid,      KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasUsersSid,      GENERIC_READ,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasPowerUsersSid, KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasPowerUsersSid, GENERIC_READ,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasAdminsSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasAdminsSid,     GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeLocalSystemSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeLocalSystemSid,     GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasAdminsSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeCreatorOwnerSid,    GENERIC_ALL);
+
+    CheckKeySecurity(L"\\REGISTRY\\USER\\S-1-5-18",
+                    10, ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasUsersSid,      KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasUsersSid,      GENERIC_READ,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasPowerUsersSid, KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasPowerUsersSid, GENERIC_READ,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasAdminsSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeAliasAdminsSid,     GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeLocalSystemSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeLocalSystemSid,     GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasAdminsSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE,
SeExports->SeCreatorOwnerSid,    GENERIC_ALL);
+
+    CheckKeySecurity(L"\\REGISTRY\\USER\\S-1-5-20",
+                     8, ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeNetworkServiceSid,  KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeLocalSystemSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeAliasAdminsSid,     KEY_ALL_ACCESS,
+                        ACCESS_ALLOWED_ACE_TYPE,                     0,
SeExports->SeRestrictedSid,      KEY_READ,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE |
+                                                 OBJECT_INHERIT_ACE,
SeExports->SeNetworkServiceSid,  GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE |
+                                                 OBJECT_INHERIT_ACE,
SeExports->SeLocalSystemSid,     GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE |
+                                                 OBJECT_INHERIT_ACE,
SeExports->SeAliasAdminsSid,     GENERIC_ALL,
+                        ACCESS_ALLOWED_ACE_TYPE, INHERIT_ONLY_ACE |
+                                                 CONTAINER_INHERIT_ACE |
+                                                 OBJECT_INHERIT_ACE,
SeExports->SeRestrictedSid,      GENERIC_READ);
+
+    if (TerminalServerSid != NULL)
+    {
+        ExFreePoolWithTag(TerminalServerSid, 'iSmK');
+    }
+}
Propchange: trunk/rostests/kmtests/ntos_cm/CmSecurity.c
------------------------------------------------------------------------------
    svn:eol-style = native