https://git.reactos.org/?p=reactos.git;a=commitdiff;h=6d0c07c44fae0a93c57f8d...
commit 6d0c07c44fae0a93c57f8d3410545e0f3c201287 Author: Pierre Schweitzer pierre@reactos.org AuthorDate: Sun Sep 30 10:49:13 2018 +0200 Commit: Pierre Schweitzer pierre@reactos.org CommitDate: Sun Sep 30 10:55:43 2018 +0200
[NTOSKRNL] Implement access check for secure open --- ntoskrnl/io/iomgr/file.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 64 insertions(+), 1 deletion(-)
diff --git a/ntoskrnl/io/iomgr/file.c b/ntoskrnl/io/iomgr/file.c index c10729080d..cdc4aaaa3e 100644 --- a/ntoskrnl/io/iomgr/file.c +++ b/ntoskrnl/io/iomgr/file.c @@ -641,7 +641,70 @@ IopParseDevice(IN PVOID ParseObject, ((OpenPacket->RelatedFileObject) || (RemainingName->Length)) && (!VolumeOpen)) { - DPRINT("Fix Secure FSD support!!!\n"); + Privileges = NULL; + GrantedAccess = 0; + + KeEnterCriticalRegion(); + ExAcquireResourceSharedLite(&IopSecurityResource, TRUE); + + /* Lock the subject context */ + SeLockSubjectContext(&AccessState->SubjectSecurityContext); + + /* Do access check */ + AccessGranted = SeAccessCheck(OriginalDeviceObject->SecurityDescriptor, + &AccessState->SubjectSecurityContext, + TRUE, + DesiredAccess, + 0, + &Privileges, + &IoFileObjectType->TypeInfo.GenericMapping, + UserMode, + &GrantedAccess, + &Status); + if (Privileges != NULL) + { + /* Append and free the privileges */ + SeAppendPrivileges(AccessState, Privileges); + SeFreePrivileges(Privileges); + } + + /* Check if we got access */ + if (GrantedAccess) + { + AccessState->PreviouslyGrantedAccess |= GrantedAccess; + AccessState->RemainingDesiredAccess &= ~(GrantedAccess | MAXIMUM_ALLOWED); + } + + FileString.Length = 8; + FileString.MaximumLength = 8; + FileString.Buffer = L"File"; + + /* Do Audit/Alarm for open operation + * NOTA: we audit target device object + */ + SeOpenObjectAuditAlarm(&FileString, + DeviceObject, + CompleteName, + OriginalDeviceObject->SecurityDescriptor, + AccessState, + FALSE, + AccessGranted, + UserMode, + &AccessState->GenerateOnClose); + + SeUnlockSubjectContext(&AccessState->SubjectSecurityContext); + + ExReleaseResourceLite(&IopSecurityResource); + KeLeaveCriticalRegion(); + + /* Check if access failed */ + if (!AccessGranted) + { + /* Dereference the device and fail */ + IopDereferenceDeviceObject(OriginalDeviceObject, FALSE); + if (Vpb) IopDereferenceVpbAndFree(Vpb); + return STATUS_ACCESS_DENIED; + } }
/* Allocate the IRP */