[ekohl] 74103: [NTOS:OB] - Define and use a pool tag for directory security descriptors. - Use a custom security descriptor to create the KernelObjects directory.

Author: ekohl
Date: Sun Mar  5 21:28:10 2017
New Revision: 74103

URL: http://svn.reactos.org/svn/reactos?rev=74103&view=rev
Log:
[NTOS:OB]
- Define and use a pool tag for directory security descriptors.
- Use a custom security descriptor to create the KernelObjects directory.

Modified:
    trunk/reactos/ntoskrnl/include/internal/tag.h
    trunk/reactos/ntoskrnl/ob/obinit.c
    trunk/reactos/ntoskrnl/ob/obname.c

Modified: trunk/reactos/ntoskrnl/include/internal/tag.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/include/internal/…
==============================================================================
--- trunk/reactos/ntoskrnl/include/internal/tag.h	[iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/include/internal/tag.h	[iso-8859-1] Sun Mar  5 21:28:10 2017
@@ -150,6 +150,8 @@
 /* Object Manager Tags */
 #define OB_NAME_TAG             'mNbO'
 #define OB_DIR_TAG              'iDbO'
+#define TAG_OB_DIR_SD           'sDbO'
+
 
 /* formerly located in ps/cid.c */
 #define TAG_CIDOBJECT 'ODIC'

Modified: trunk/reactos/ntoskrnl/ob/obinit.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ob/obinit.c?rev=7…
==============================================================================
--- trunk/reactos/ntoskrnl/ob/obinit.c	[iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/ob/obinit.c	[iso-8859-1] Sun Mar  5 21:28:10 2017
@@ -53,6 +53,82 @@
 ULONG ObpInitializationPhase;
 
 /* PRIVATE FUNCTIONS *********************************************************/
+
+static
+NTSTATUS
+NTAPI
+INIT_FUNCTION
+ObpCreateKernelObjectsSD(OUT PSECURITY_DESCRIPTOR SecurityDescriptor)
+{
+    ULONG AclLength;
+    PACL Dacl;
+    NTSTATUS Status;
+
+    /* Initialize the SD */
+    Status = RtlCreateSecurityDescriptor(SecurityDescriptor,
+                                         SECURITY_DESCRIPTOR_REVISION);
+    if (!NT_SUCCESS(Status))
+        return Status;
+
+    /* Allocate the DACL */
+    AclLength = sizeof(ACL) +
+                sizeof(ACE) + RtlLengthSid(SeWorldSid) +
+                sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid) +
+                sizeof(ACE) + RtlLengthSid(SeLocalSystemSid);
+
+    Dacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_OB_DIR_SD);
+    if (Dacl == NULL)
+    {
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+    /* Initialize the DACL */
+    RtlCreateAcl(Dacl, AclLength, ACL_REVISION);
+
+    /* Add the ACEs */
+    RtlAddAccessAllowedAce(Dacl,
+                           ACL_REVISION,
+                           GENERIC_READ,
+                           SeWorldSid);
+
+    RtlAddAccessAllowedAce(Dacl,
+                           ACL_REVISION,
+                           GENERIC_ALL,
+                           SeAliasAdminsSid);
+
+    RtlAddAccessAllowedAce(Dacl,
+                           ACL_REVISION,
+                           GENERIC_ALL,
+                           SeLocalSystemSid);
+
+    /* Attach the DACL to the SD */
+    Status = RtlSetDaclSecurityDescriptor(SecurityDescriptor,
+                                          TRUE,
+                                          Dacl,
+                                          FALSE);
+
+    return Status;
+}
+
+static
+VOID
+NTAPI
+INIT_FUNCTION
+ObpFreeKernelObjectsSD(IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor)
+{
+    PACL Dacl = NULL;
+    BOOLEAN DaclPresent, Defaulted;
+    NTSTATUS Status;
+
+    Status = RtlGetDaclSecurityDescriptor(SecurityDescriptor,
+                                          &DaclPresent,
+                                          &Dacl,
+                                          &Defaulted);
+    if (NT_SUCCESS(Status) && Dacl != NULL)
+    {
+        ExFreePool(Dacl);
+    }
+}
 
 BOOLEAN
 INIT_FUNCTION
@@ -136,6 +212,7 @@
     POBJECT_HEADER Header;
     POBJECT_HEADER_CREATOR_INFO CreatorInfo;
     POBJECT_HEADER_NAME_INFO NameInfo;
+    SECURITY_DESCRIPTOR KernelObjectsSD;
     NTSTATUS Status;
 
     /* Check if this is actually Phase 1 initialization */
@@ -258,25 +335,31 @@
     Status = NtClose(Handle);
     if (!NT_SUCCESS(Status)) return FALSE;
 
-    /* Initialize Object Types directory attributes */
+    /* Create a custom security descriptor for the KernelObjects directory */
+    Status = ObpCreateKernelObjectsSD(&KernelObjectsSD);
+    if (!NT_SUCCESS(Status))
+        return FALSE;
+
+    /* Initialize the KernelObjects directory attributes */
     RtlInitUnicodeString(&Name, L"\\KernelObjects");
     InitializeObjectAttributes(&ObjectAttributes,
                                &Name,
                                OBJ_CASE_INSENSITIVE | OBJ_PERMANENT,
                                NULL,
-                               NULL);
-    
+                               &KernelObjectsSD);
+
     /* Create the directory */
     Status = NtCreateDirectoryObject(&Handle,
                                      DIRECTORY_ALL_ACCESS,
                                      &ObjectAttributes);
-    if (!NT_SUCCESS(Status)) return FALSE;
-    
+    ObpFreeKernelObjectsSD(&KernelObjectsSD);
+    if (!NT_SUCCESS(Status)) return FALSE;
+
     /* Close the extra handle */
     Status = NtClose(Handle);
     if (!NT_SUCCESS(Status)) return FALSE;
 
-    /* Initialize Object Types directory attributes */
+    /* Initialize ObjectTypes directory attributes */
     RtlInitUnicodeString(&Name, L"\\ObjectTypes");
     InitializeObjectAttributes(&ObjectAttributes,
                                &Name,

Modified: trunk/reactos/ntoskrnl/ob/obname.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ob/obname.c?rev=7…
==============================================================================
--- trunk/reactos/ntoskrnl/ob/obname.c	[iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/ob/obname.c	[iso-8859-1] Sun Mar  5 21:28:10 2017
@@ -55,10 +55,10 @@
                 sizeof(ACE) + RtlLengthSid(SeLocalSystemSid) +
                 sizeof(ACE) + RtlLengthSid(SeCreatorOwnerSid);
 
-    Dacl = ExAllocatePool(PagedPool, AclLength);
+    Dacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_OB_DIR_SD);
     if (Dacl == NULL)
     {
-        return STATUS_NO_MEMORY;
+        return STATUS_INSUFFICIENT_RESOURCES;
     }
 
     /* Initialize the DACL */