[reactos] 01/02: [NTOS:SE] Implement token groups adjusting

[George Bișoc]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=8e6fc7a5f560664c4aa10…

commit 8e6fc7a5f560664c4aa102aea9060960c253cafc
Author:     George Bișoc <george.bisoc(a)reactos.org>
AuthorDate: Sat Sep 18 17:14:27 2021 +0200
Commit:     George Bișoc <george.bisoc(a)reactos.org>
CommitDate: Thu Sep 23 17:38:31 2021 +0200

    [NTOS:SE] Implement token groups adjusting
---
 ntoskrnl/se/token.c       | 485 ++++++++++++++++++++++++++++++++++++++++++++--
 sdk/include/ndk/sefuncs.h |   2 +-
 2 files changed, 474 insertions(+), 13 deletions(-)

diff --git a/ntoskrnl/se/token.c b/ntoskrnl/se/token.c
index b8492238c05..9c8492edfcc 100644
--- a/ntoskrnl/se/token.c
+++ b/ntoskrnl/se/token.c
@@ -4273,18 +4273,262 @@ NtDuplicateToken(
 
 /**
  * @brief
- * Changes the groups list of SIDs of a token.
+ * Private routine that iterates over the groups of an
+ * access token to be adjusted as per on request by the
+ * caller, where a group can be enabled or disabled.
+ *
+ * @param[in] Token
+ * Access token where its groups are to be enabled or disabled.
+ *
+ * @param[in] NewState
+ * A list of groups with new state attributes to be assigned to
+ * the token.
+ *
+ * @param[in] NewStateCount
+ * The captured count number of groups in the list.
+ *
+ * @param[in] ApplyChanges
+ * If set to FALSE, the function will only iterate over the token's
+ * groups without performing any kind of modification. If set to TRUE,
+ * the changes will be applied immediately when the function has done
+ * looping the groups.
+ *
+ * @param[in] ResetToDefaultStates
+ * The function will reset the groups in an access token to default
+ * states if set to TRUE. In such scenario the function ignores
+ * NewState outright. Otherwise if set to FALSE, the function will
+ * use NewState to assign the newly attributes to adjust the token's
+ * groups. SE_GROUP_ENABLED_BY_DEFAULT is a flag indicator that is used
+ * for such purpose.
+ *
+ * @param[out] ChangesMade
+ * Returns TRUE if changes to token's groups have been made, otherwise
+ * FALSE is returned. Bear in mind such changes aren't always deterministic.
+ * See remarks for further details.
+ *
+ * @param[out] PreviousGroupsState
+ * If requested by the caller, the function will return the previous state
+ * of groups in an access token prior taking action on adjusting the token.
+ * This is a UM (user mode) pointer and it's prone to raise exceptions
+ * if such pointer address is not valid.
+ *
+ * @param[out] ChangedGroups
+ * Returns the total number of changed groups in an access token. This
+ * argument could also indicate the number of groups to be changed if
+ * the calling thread hasn't chosen to apply the changes yet. A number
+ * of 0 indicates no groups have been or to be changed because the groups'
+ * attributes in a token are the same as the ones from NewState given by
+ * the caller.
+ *
+ * @return
+ * STATUS_SUCCESS is returned if the function has successfully completed
+ * the operation of adjusting groups in a token. STATUS_CANT_DISABLE_MANDATORY
+ * is returned if there was an attempt to disable a mandatory group which is
+ * not possible. STATUS_CANT_ENABLE_DENY_ONLY is returned if there was an attempt
+ * to enable a "use for Deny only" group which is not allowed, that is, a
restricted
+ * group. STATUS_NOT_ALL_ASSIGNED is returned if not all the groups are actually
+ * assigned to the token.
+ *
+ * @remarks
+ * Token groups adjusting can be judged to be deterministic or not based on the
+ * NT status code value. That is, STATUS_SUCCESS indicates the function not only
+ * has iterated over the whole groups in a token, it also has applied the changes
+ * thoroughly without impediment and the results perfectly match with the request
+ * desired by the caller. In this situation the condition is deemed deterministic.
+ * In a different situation however, if the status code was STATUS_NOT_ALL_ASSIGNED,
+ * the function would still continue looping the groups in a token and apply the
+ * changes whenever possible where the respective groups actually exist in the
+ * token. This kind of situation is deemed as indeterministic.
+ * For STATUS_CANT_DISABLE_MANDATORY and STATUS_CANT_ENABLE_DENY_ONLY the scenario
+ * is even more indeterministic as the iteration of groups comes to a halt thus
+ * leaving all other possible groups to be adjusted.
+ */
+static
+NTSTATUS
+SepAdjustGroups(
+    _In_ PTOKEN Token,
+    _In_opt_ PSID_AND_ATTRIBUTES NewState,
+    _In_ ULONG NewStateCount,
+    _In_ BOOLEAN ApplyChanges,
+    _In_ BOOLEAN ResetToDefaultStates,
+    _Out_ PBOOLEAN ChangesMade,
+    _Out_opt_ PTOKEN_GROUPS PreviousGroupsState,
+    _Out_ PULONG ChangedGroups)
+{
+    ULONG GroupsInToken, GroupsInList;
+    ULONG ChangeCount, GroupsCount, NewAttributes;
+
+    PAGED_CODE();
+
+    /* Ensure that the token we get is not plain garbage */
+    ASSERT(Token);
+
+    /* Initialize the counters and begin the work */
+    *ChangesMade = FALSE;
+    GroupsCount = 0;
+    ChangeCount = 0;
+
+    /* Begin looping all the groups in the token */
+    for (GroupsInToken = 0; GroupsInToken < Token->UserAndGroupCount;
GroupsInToken++)
+    {
+        /* Does the caller want to reset groups to default states? */
+        if (ResetToDefaultStates)
+        {
+            /*
+             * SE_GROUP_ENABLED_BY_DEFAULT is a special indicator that informs us
+             * if a certain group has been enabled by default or not. In case
+             * a group is enabled by default but it is not currently enabled then
+             * at that point we must enable it back by default. For now just
+             * assign the respective SE_GROUP_ENABLED attribute as we'll do the
+             * eventual work later.
+             */
+            if ((Token->UserAndGroups[GroupsInToken].Attributes &
SE_GROUP_ENABLED_BY_DEFAULT) &&
+                (Token->UserAndGroups[GroupsInToken].Attributes &
SE_GROUP_ENABLED) == 0)
+            {
+                NewAttributes = Token->UserAndGroups[GroupsInToken].Attributes |=
SE_GROUP_ENABLED;
+            }
+
+            /*
+             * Unlike the case above, a group that hasn't been enabled by
+             * default but it's currently enabled then we must disable
+             * it back.
+             */
+            if ((Token->UserAndGroups[GroupsInToken].Attributes &
SE_GROUP_ENABLED_BY_DEFAULT) == 0 &&
+                (Token->UserAndGroups[GroupsInToken].Attributes &
SE_GROUP_ENABLED))
+            {
+                NewAttributes = Token->UserAndGroups[GroupsInToken].Attributes &
~SE_GROUP_ENABLED;
+            }
+        }
+        else
+        {
+            /* Loop the provided groups in the list then */
+            for (GroupsInList = 0; GroupsInList < NewStateCount; GroupsInList++)
+            {
+                /* Does this group exist in the token? */
+                if (RtlEqualSid(&Token->UserAndGroups[GroupsInToken].Sid,
+                                &NewState[GroupsInList].Sid))
+                {
+                    /*
+                     * This is the group that we're looking for.
+                     * However, it could be that the group is a
+                     * mandatory group which we are not allowed
+                     * and cannot disable it.
+                     */
+                    if ((Token->UserAndGroups[GroupsInToken].Attributes &
SE_GROUP_MANDATORY) &&
+                        (NewState[GroupsInList].Attributes & SE_GROUP_ENABLED) == 0)
+                    {
+                        /* It is mandatory, forget about this group */
+                        DPRINT1("SepAdjustGroups(): The SID group is
mandatory!\n");
+                        return STATUS_CANT_DISABLE_MANDATORY;
+                    }
+
+                    /*
+                     * We've to ensure that apart the group mustn't be
+                     * mandatory, it mustn't be a restricted group as
+                     * well. That is, the group is marked with
+                     * SE_GROUP_USE_FOR_DENY_ONLY flag and no one
+                     * can enable it because it's for "deny" use only.
+                     */
+                    if ((Token->UserAndGroups[GroupsInToken].Attributes &
SE_GROUP_USE_FOR_DENY_ONLY) &&
+                        (NewState[GroupsInList].Attributes & SE_GROUP_ENABLED))
+                    {
+                        /* This group is restricted, forget about it */
+                        DPRINT1("SepAdjustGroups(): The SID group is for use deny
only!\n");
+                        return STATUS_CANT_ENABLE_DENY_ONLY;
+                    }
+
+                    /* Copy the attributes and stop searching */
+                    NewAttributes = NewState[GroupsInList].Attributes;
+                    NewAttributes &= SE_GROUP_ENABLED;
+                    NewAttributes = Token->UserAndGroups[GroupsInToken].Attributes
& ~SE_GROUP_ENABLED;
+                    break;
+                }
+
+                /* Did we find the specific group we wanted? */
+                if (GroupsInList == NewStateCount)
+                {
+                    /* We didn't, continue with the next token's group */
+                    continue;
+                }
+            }
+
+            /* Count the group that we found it */
+            GroupsCount++;
+
+            /* Does the token have the same attributes as the caller requested them? */
+            if (Token->UserAndGroups[GroupsInToken].Attributes != NewAttributes)
+            {
+                /*
+                 * No, then it's time to make some adjustment to the
+                 * token's groups. Does the caller want the previous states
+                 * of groups?
+                 */
+                if (PreviousGroupsState != NULL)
+                {
+                    PreviousGroupsState->Groups[ChangeCount] =
Token->UserAndGroups[GroupsInToken];
+                }
+
+                /* Time to apply the changes now? */
+                if (ApplyChanges)
+                {
+                    /* The caller gave us consent, apply and report that we made changes!
*/
+                    Token->UserAndGroups[GroupsInToken].Attributes = NewAttributes;
+                    *ChangesMade = TRUE;
+                }
+
+                /* Increment the count change */
+                ChangeCount++;
+            }
+        }
+    }
+
+    /* Report the number of previous saved groups */
+    if (PreviousGroupsState != NULL)
+    {
+        PreviousGroupsState->GroupCount = ChangeCount;
+    }
+
+    /* Report the number of changed groups */
+    *ChangedGroups = ChangeCount;
+
+    /* Did we miss some groups? */
+    if (!ResetToDefaultStates && (GroupsCount < NewStateCount))
+    {
+        /*
+         * If we're at this stage then we are in a situation
+         * where the adjust changes done to token's groups is
+         * not deterministic as the caller might have wanted
+         * as per NewState parameter.
+         */
+        DPRINT1("SepAdjustGroups(): The token hasn't all the groups
assigned!\n");
+        return STATUS_NOT_ALL_ASSIGNED;
+    }
+
+    return STATUS_SUCCESS;
+}
+
+/**
+ * @brief
+ * Changes the list of groups by enabling or disabling them
+ * in an access token. Unlike NtAdjustPrivilegesToken,
+ * this API routine does not remove groups.
  *
  * @param[in] TokenHandle
- * Token handle where the list of groups SIDs are to be adjusted.
+ * Token handle where the list of groups SID are to be adjusted.
+ * The access token must have TOKEN_ADJUST_GROUPS access right
+ * in order to change the groups in a token. The token must also
+ * have TOKEN_QUERY access right if the caller requests the previous
+ * states of groups list, that is, PreviousState is not NULL.
  *
  * @param[in] ResetToDefault
- * If set to TRUE, the function resets the list of groups SIDs to default.
- * All the rest of parameters are ignored.
+ * If set to TRUE, the function resets the list of groups to default
+ * enabled and disabled states. NewState is ignored in this case.
+ * Otherwise if the parameter is set to FALSE, the function expects
+ * a new list of groups from NewState to be adjusted within the token.
  *
  * @param[in] NewState
- * A new list of groups SIDs that the function will use it accordingly to
- * modify the current list of groups SIDs of a token.
+ * A new list of groups SID that the function will use it accordingly to
+ * modify the current list of groups SID of a token.
  *
  * @param[in] BufferLength
  * The length size of the buffer that is pointed by the NewState parameter
@@ -4292,14 +4536,20 @@ NtDuplicateToken(
  *
  * @param[out] PreviousState
  * If specified, the function will return to the caller the old list of groups
- * SIDs.
+ * SID. If this parameter is NULL, ReturnLength must also be NULL.
  *
  * @param[out] ReturnLength
  * If specified, the function will return the total size length of the old list
  * of groups SIDs, in bytes.
  *
  * @return
- * To be added...
+ * STATUS_SUCCESS is returned if the function has successfully adjusted the
+ * token's groups. STATUS_INVALID_PARAMETER is returned if the caller has
+ * submitted one or more invalid parameters, that is, the caller didn't want
+ * to reset the groups to default state but no NewState argument list has been
+ * provided. STATUS_BUFFER_TOO_SMALL is returned if the buffer length given
+ * by the caller is smaller than the required length size. A failure NTSTATUS
+ * code is returned otherwise.
  */
 NTSTATUS
 NTAPI
@@ -4308,11 +4558,222 @@ NtAdjustGroupsToken(
     _In_ BOOLEAN ResetToDefault,
     _In_ PTOKEN_GROUPS NewState,
     _In_ ULONG BufferLength,
-    _Out_opt_ PTOKEN_GROUPS PreviousState,
-    _Out_ PULONG ReturnLength)
+    _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength)
+    PTOKEN_GROUPS PreviousState,
+    _When_(PreviousState != NULL, _Out_) PULONG ReturnLength)
 {
-    UNIMPLEMENTED;
-    return STATUS_NOT_IMPLEMENTED;
+    PTOKEN Token;
+    NTSTATUS Status;
+    KPROCESSOR_MODE PreviousMode;
+    ULONG ChangeCount, RequiredLength;
+    ULONG CapturedCount = 0;
+    ULONG CapturedLength = 0;
+    ULONG NewStateSize = 0;
+    PSID_AND_ATTRIBUTES CapturedGroups = NULL;
+    BOOLEAN ChangesMade = FALSE;
+    BOOLEAN LockAndReferenceAcquired = FALSE;
+
+    PAGED_CODE();
+
+    /*
+     * If the caller doesn't want to reset the groups of an
+     * access token to default states then at least we must
+     * expect a list of groups to be adjusted based on NewState
+     * parameter. Otherwise bail out because the caller has
+     * no idea what they're doing.
+     */
+    if (!ResetToDefault && !NewState)
+    {
+        DPRINT1("NtAdjustGroupsToken(): The caller hasn't provided any list of
groups to adjust!\n");
+        return STATUS_INVALID_PARAMETER;
+    }
+
+    PreviousMode = ExGetPreviousMode();
+
+    if (PreviousMode != KernelMode)
+    {
+        _SEH2_TRY
+        {
+            /* Probe NewState */
+            if (!ResetToDefault)
+            {
+                /* Probe the header */
+                ProbeForRead(NewState, sizeof(*NewState), sizeof(ULONG));
+
+                CapturedCount = NewState->GroupCount;
+                NewStateSize = FIELD_OFFSET(TOKEN_GROUPS, Groups[CapturedCount]);
+
+                ProbeForRead(NewState, NewStateSize, sizeof(ULONG));
+            }
+
+            if (PreviousState != NULL)
+            {
+                ProbeForWrite(PreviousState, BufferLength, sizeof(ULONG));
+                ProbeForWrite(ReturnLength, sizeof(*ReturnLength), sizeof(ULONG));
+            }
+        }
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        {
+            /* Return the exception code */
+            _SEH2_YIELD(return _SEH2_GetExceptionCode());
+        }
+        _SEH2_END;
+    }
+    else
+    {
+        /*
+         * We're calling directly from the kernel, just retrieve
+         * the number count of captured groups outright.
+         */
+        if (!ResetToDefault)
+        {
+            CapturedCount = NewState->GroupCount;
+        }
+    }
+
+    /* Time to capture the NewState list */
+    if (!ResetToDefault)
+    {
+        _SEH2_TRY
+        {
+            Status = SeCaptureSidAndAttributesArray(NewState->Groups,
+                                                    CapturedCount,
+                                                    PreviousMode,
+                                                    NULL,
+                                                    0,
+                                                    PagedPool,
+                                                    TRUE,
+                                                    &CapturedGroups,
+                                                    &CapturedLength);
+        }
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        {
+            Status = _SEH2_GetExceptionCode();
+        }
+        _SEH2_END;
+
+        if (!NT_SUCCESS(Status))
+        {
+            DPRINT1("NtAdjustGroupsToken(): Failed to capture the NewState list of
groups (Status 0x%lx)\n", Status);
+            return Status;
+        }
+    }
+
+    /* Time to reference the token */
+    Status = ObReferenceObjectByHandle(TokenHandle,
+                                       TOKEN_ADJUST_GROUPS | (PreviousState != NULL ?
TOKEN_QUERY : 0),
+                                       SeTokenObjectType,
+                                       PreviousMode,
+                                       (PVOID*)&Token,
+                                       NULL);
+    if (!NT_SUCCESS(Status))
+    {
+        /* We couldn't reference the access token, bail out */
+        DPRINT1("NtAdjustGroupsToken(): Failed to reference the token (Status
0x%lx)\n", Status);
+
+        if (CapturedGroups != NULL)
+        {
+            SeReleaseSidAndAttributesArray(CapturedGroups,
+                                           PreviousMode,
+                                           TRUE);
+        }
+
+        goto Quit;
+    }
+
+    /* Lock the token */
+    SepAcquireTokenLockExclusive(Token);
+    LockAndReferenceAcquired = TRUE;
+
+    /* Count the number of groups to be changed */
+    Status = SepAdjustGroups(Token,
+                             CapturedGroups,
+                             CapturedCount,
+                             FALSE,
+                             ResetToDefault,
+                             &ChangesMade,
+                             NULL,
+                             &ChangeCount);
+
+    /* Does the caller want the previous state of groups? */
+    if (PreviousState != NULL)
+    {
+        /* Calculate the required length */
+        RequiredLength = FIELD_OFFSET(TOKEN_GROUPS, Groups[ChangeCount]);
+
+        /* Return the required length to the caller */
+        _SEH2_TRY
+        {
+            *ReturnLength = RequiredLength;
+        }
+        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+        {
+            /* Bail out and return the exception code */
+            Status = _SEH2_GetExceptionCode();
+            _SEH2_YIELD(goto Quit);
+        }
+        _SEH2_END;
+
+        /* The buffer length provided is smaller than the required length, bail out */
+        if (BufferLength < RequiredLength)
+        {
+            Status = STATUS_BUFFER_TOO_SMALL;
+            goto Quit;
+        }
+    }
+
+    /*
+     * Now it's time to apply changes. Wrap the code
+     * in SEH as we are returning the old groups state
+     * list to the caller since PreviousState is a
+     * UM pointer.
+     */
+    _SEH2_TRY
+    {
+        Status = SepAdjustGroups(Token,
+                                 CapturedGroups,
+                                 CapturedCount,
+                                 TRUE,
+                                 ResetToDefault,
+                                 &ChangesMade,
+                                 PreviousState,
+                                 &ChangeCount);
+    }
+    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+    {
+        /* Bail out and return the exception code */
+        Status = _SEH2_GetExceptionCode();
+
+        /* Force the write as we touched the token still */
+        ChangesMade = TRUE;
+        _SEH2_YIELD(goto Quit);
+    }
+    _SEH2_END;
+
+Quit:
+    /* Allocate a new ID for the token as we made changes */
+    if (ChangesMade)
+    {
+        ExAllocateLocallyUniqueId(&Token->ModifiedId);
+    }
+
+    /* Have we successfully acquired the lock and referenced the token before? */
+    if (LockAndReferenceAcquired)
+    {
+        /* Unlock and dereference the token */
+        SepReleaseTokenLock(Token);
+        ObDereferenceObject(Token);
+    }
+
+    /* Release the captured groups */
+    if (CapturedGroups != NULL)
+    {
+        SeReleaseSidAndAttributesArray(CapturedGroups,
+                                       PreviousMode,
+                                       TRUE);
+    }
+
+    return Status;
 }
 
 /**
diff --git a/sdk/include/ndk/sefuncs.h b/sdk/include/ndk/sefuncs.h
index 6fcc96e7fe6..d9a8e58ab83 100644
--- a/sdk/include/ndk/sefuncs.h
+++ b/sdk/include/ndk/sefuncs.h
@@ -150,7 +150,7 @@ NtAdjustGroupsToken(
     _In_opt_ PTOKEN_GROUPS NewState,
     _In_opt_ ULONG BufferLength,
     _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_GROUPS PreviousState,
-    _Out_ PULONG ReturnLength);
+    _When_(PreviousState != NULL, _Out_) PULONG ReturnLength);
 
 _Must_inspect_result_
 __kernel_entry