[ion] 23248: - Make use of PsChangeQuantumTable on system startup to setup the raw priority separation. - Call PspComputeQuantumAndPriority in PspCreateProcess to calculate process base priority and quantum for child threads. - Add security code to calculate process's access rights to itself, as documented in WI II.

Author: ion
Date: Sun Jul 23 21:01:43 2006
New Revision: 23248

URL: http://svn.reactos.org/svn/reactos?rev=23248&view=rev
Log:
- Make use of PsChangeQuantumTable on system startup to setup the raw priority
separation.
- Call PspComputeQuantumAndPriority in PspCreateProcess to calculate process base priority
and quantum for child threads.
- Add security code to calculate process's access rights to itself, as documented in
WI II.

Modified:
    trunk/reactos/ntoskrnl/KrnlFun.c
    trunk/reactos/ntoskrnl/include/internal/ps.h
    trunk/reactos/ntoskrnl/ps/process.c
    trunk/reactos/ntoskrnl/ps/psmgr.c

Modified: trunk/reactos/ntoskrnl/KrnlFun.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/KrnlFun.c?rev=232…
==============================================================================
--- trunk/reactos/ntoskrnl/KrnlFun.c (original)
+++ trunk/reactos/ntoskrnl/KrnlFun.c Sun Jul 23 21:01:43 2006
@@ -27,7 +27,7 @@
 // Ps:
 //  - Figure out why processes don't die.
 //  - Generate process cookie for user-more thread.
-//  - Add security calls where necessary.
+//  - Add security calls where necessary for thread creation.
 //  - Add tracing.
 //  - Add failure/race checks for thread creation.
 //

Modified: trunk/reactos/ntoskrnl/include/internal/ps.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/include/internal/…
==============================================================================
--- trunk/reactos/ntoskrnl/include/internal/ps.h (original)
+++ trunk/reactos/ntoskrnl/include/internal/ps.h Sun Jul 23 21:01:43 2006
@@ -149,6 +149,13 @@
 NTAPI
 PspGetSystemDllEntryPoints(
     VOID
+);
+
+VOID
+NTAPI
+PsChangeQuantumTable(
+    IN BOOLEAN Immediate,
+    IN ULONG PrioritySeparation
 );
 
 //
@@ -343,6 +350,7 @@
 extern PVOID PspSystemDllBase;
 extern BOOLEAN PspUseJobSchedulingClasses;
 extern CHAR PspJobSchedulingClasses[PSP_JOB_SCHEDULING_CLASSES];
+extern ULONG PsRawPrioritySeparation;
 
 //
 // Inlined Functions

Modified: trunk/reactos/ntoskrnl/ps/process.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ps/process.c?rev=…
==============================================================================
--- trunk/reactos/ntoskrnl/ps/process.c (original)
+++ trunk/reactos/ntoskrnl/ps/process.c Sun Jul 23 21:01:43 2006
@@ -27,6 +27,7 @@
 
 LARGE_INTEGER ShortPsLockDelay;
 
+ULONG PsRawPrioritySeparation = 0;
 ULONG PsPrioritySeparation;
 CHAR PspForegroundQuantum[3];
 
@@ -360,7 +361,7 @@
     PEPORT ExceptionPortObject;
     PDBGK_DEBUG_OBJECT DebugObject;
     PSECTION_OBJECT SectionObject;
-    NTSTATUS Status;
+    NTSTATUS Status, AccessStatus;
     KPROCESSOR_MODE PreviousMode;
     PHYSICAL_ADDRESS DirectoryTableBase;
     KAFFINITY Affinity;
@@ -371,6 +372,10 @@
     ACCESS_STATE LocalAccessState;
     PACCESS_STATE AccessState = &LocalAccessState;
     AUX_DATA AuxData;
+    UCHAR Quantum;
+    BOOLEAN Result, SdAllocated;
+    PSECURITY_DESCRIPTOR SecurityDescriptor;
+    SECURITY_SUBJECT_CONTEXT SubjectContext;
     PAGED_CODE();
     DirectoryTableBase.QuadPart = 0;
 
@@ -687,21 +692,74 @@
     /* Cleanup on failure */
     if (!NT_SUCCESS(Status)) goto Cleanup;
 
-    /* FIXME: Compute Quantum and Priority */
-
-    /* 
-     * FIXME: ObGetObjectSecurity(Process, &SecurityDescriptor)
-     *        SeAccessCheck
-     */
+    /* Compute Quantum and Priority */
+    Process->Pcb.BasePriority = PspComputeQuantumAndPriority(Process,
+                                                             0,
+                                                             &Quantum);
+    Process->Pcb.QuantumReset = Quantum;
+
+    /* Check if we have a parent other then the initial system process */
+    if ((Parent) && (Parent != PsInitialSystemProcess))
+    {
+        /* Get the process's SD */
+        Status = ObGetObjectSecurity(Process,
+                                     &SecurityDescriptor,
+                                     &SdAllocated);
+        if (!NT_SUCCESS(Status))
+        {
+            /* We failed, close the handle and clean up */
+            ObCloseHandle(hProcess, PreviousMode);
+            goto CleanupWithRef;
+        }
+
+        /* Create the subject context */
+        SubjectContext.ProcessAuditId = Process;
+        SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process);
+        SubjectContext.ClientToken = NULL;
+
+        /* Do the access check */
+        if (!SecurityDescriptor) DPRINT1("FIX PS SDs!!\n");
+        Result = SeAccessCheck(SecurityDescriptor,
+                               &SubjectContext,
+                               FALSE,
+                               MAXIMUM_ALLOWED,
+                               0,
+                               NULL,
+                               &PsProcessType->TypeInfo.GenericMapping,
+                               PreviousMode,
+                               &Process->GrantedAccess,
+                               &AccessStatus);
+
+        /* Dereference the token and let go the SD */
+        ObFastDereferenceObject(&Process->Token,
+                                SubjectContext.PrimaryToken);
+        ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
+
+        /* Remove access if it failed */
+        if (!Result) Process->GrantedAccess = 0;
+
+        /* Give the process some basic access */
+        Process->GrantedAccess |= (PROCESS_VM_OPERATION |
+                                   PROCESS_VM_READ |
+                                   PROCESS_VM_WRITE |
+                                   PROCESS_QUERY_INFORMATION |
+                                   PROCESS_TERMINATE |
+                                   PROCESS_CREATE_THREAD |
+                                   PROCESS_DUP_HANDLE |
+                                   PROCESS_CREATE_PROCESS |
+                                   PROCESS_SET_INFORMATION);
+    }
+    else
+    {
+        /* Set full granted access */
+        Process->GrantedAccess = PROCESS_ALL_ACCESS;
+    }
 
     /* Sanity check */
     ASSERT(IsListEmpty(&Process->ThreadListHead));
 
     /* Set the Creation Time */
     KeQuerySystemTime(&Process->CreateTime);
-
-    /* Set the granted access */
-    Process->GrantedAccess = PROCESS_ALL_ACCESS;
 
     /* Protect against bad user-mode pointer */
     _SEH_TRY

Modified: trunk/reactos/ntoskrnl/ps/psmgr.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ps/psmgr.c?rev=23…
==============================================================================
--- trunk/reactos/ntoskrnl/ps/psmgr.c (original)
+++ trunk/reactos/ntoskrnl/ps/psmgr.c Sun Jul 23 21:01:43 2006
@@ -158,6 +158,9 @@
 
    InitializeListHead(&PsActiveProcessHead);
    KeInitializeGuardedMutex(&PspActiveProcessMutex);
+
+   /* Setup the quantum table */
+   PsChangeQuantumTable(FALSE, PsRawPrioritySeparation);
 
    /*
     * Initialize the default quota block.