subject.c File Reference

#include <ntoskrnl.h>
#include <debug.h>

Include dependency graph for subject.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
VOID NTAPI	SeCaptureSubjectContextEx (_In_ PETHREAD Thread, _In_ PEPROCESS Process, _Out_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
	An extended function that captures the security subject context based upon the specified thread and process.
VOID NTAPI	SeCaptureSubjectContext (_Out_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
	Captures the security subject context of the calling thread and calling process.
VOID NTAPI	SeLockSubjectContext (_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
	Locks both the referenced primary and client access tokens of a security subject context.
VOID NTAPI	SeUnlockSubjectContext (_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
	Unlocks both the referenced primary and client access tokens of a security subject context.
VOID NTAPI	SeReleaseSubjectContext (_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
	Releases both the primary and client tokens of a security subject context.

Variables
ERESOURCE	SepSubjectContextLock

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 11 of file subject.c.

Function Documentation

SeCaptureSubjectContext()

VOID NTAPI SeCaptureSubjectContext

(

_Out_ PSECURITY_SUBJECT_CONTEXT

SubjectContext

)

Captures the security subject context of the calling thread and calling process.

Parameters

[out]

SubjectContext

The returned security subject context.

Returns

Nothing.

Definition at line 85 of file subject.c.

{
    /* Call the extended API */
    SeCaptureSubjectContextEx(PsGetCurrentThread(),
                              PsGetCurrentProcess(),
                              SubjectContext);
}

Referenced by create_directory_fcb(), create_subvol(), fcb_get_sd(), FilterToken(), HasPrivilege(), KsCreateDefaultSecurity(), mknod(), nfs41_get_sec_ctx(), nfs41_GetLUID(), nfs41_UpcallCreate(), NtCloseObjectAuditAlarm(), NtOpenObjectAuditAlarm(), NtPrivilegedServiceAuditAlarm(), NtSetUuidSeed(), RxStartMinirdr(), SeCheckPrivilegedObject(), SepAccessCheck(), SepAccessCheckAndAuditAlarm(), SeReportSecurityEvent(), SeSinglePrivilegeCheck(), set_link_information(), set_rename_information(), START_TEST(), SystemThread(), UDFCheckAccessRights(), and UDFSetAccessRights().

SeCaptureSubjectContextEx()

VOID NTAPI SeCaptureSubjectContextEx	(	_In_ PETHREAD	Thread,
		_In_ PEPROCESS	Process,
		_Out_ PSECURITY_SUBJECT_CONTEXT	SubjectContext
	)

An extended function that captures the security subject context based upon the specified thread and process.

Parameters

[in]	Thread	A thread where the calling thread's token is to be referenced for the security context.
[in]	Process	A process where the main process' token is to be referenced for the security context.
[out]	SubjectContext	The returned security subject context.

Returns

Nothing.

Definition at line 41 of file subject.c.

{
    BOOLEAN CopyOnOpen, EffectiveOnly;
 
    PAGED_CODE();
 
    /* Save the unique ID */
    SubjectContext->ProcessAuditId = Process->UniqueProcessId;
 
    /* Check if we have a thread */
    if (!Thread)
    {
        /* We don't, so no token */
        SubjectContext->ClientToken = NULL;
    }
    else
    {
        /* Get the impersonation token */
        SubjectContext->ClientToken = PsReferenceImpersonationToken(Thread,
                                                                    &CopyOnOpen,
                                                                    &EffectiveOnly,
                                                                    &SubjectContext->ImpersonationLevel);
    }
 
    /* Get the primary token */
    SubjectContext->PrimaryToken = PsReferencePrimaryToken(Process);
}

Referenced by SeCaptureSubjectContext(), and SeCreateAccessStateEx().

SeLockSubjectContext()

VOID NTAPI SeLockSubjectContext

(

_In_ PSECURITY_SUBJECT_CONTEXT

SubjectContext

)

Locks both the referenced primary and client access tokens of a security subject context.

Parameters

[in]

SubjectContext

A valid security context with both referenced tokens.

Returns

Nothing.

Definition at line 107 of file subject.c.

{
    PTOKEN PrimaryToken, ClientToken;
    PAGED_CODE();
 
    /* Read both tokens */
    PrimaryToken = SubjectContext->PrimaryToken;
    ClientToken = SubjectContext->ClientToken;
 
    /* Always lock the primary */
    SepAcquireTokenLockShared(PrimaryToken);
 
    /* Lock the impersonation one if it's there */
    if (!ClientToken) return;
    SepAcquireTokenLockShared(ClientToken);
}

Referenced by create_stream(), FatExplicitDeviceAccessGranted(), file_create(), FilterToken(), HasPrivilege(), IopParseDevice(), NpCreateClientEnd(), NpCreateExistingNamedPipe(), NpCreateNewNamedPipe(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), open_file2(), SeAccessCheck(), and START_TEST().

SeReleaseSubjectContext()

VOID NTAPI SeReleaseSubjectContext

(

_In_ PSECURITY_SUBJECT_CONTEXT

SubjectContext

)

Releases both the primary and client tokens of a security subject context.

Parameters

[in]

SubjectContext

The captured security context.

Returns

Nothing.

Definition at line 171 of file subject.c.

{
    PAGED_CODE();
 
    /* Drop reference on the primary */
    ObFastDereferenceObject(&PsGetCurrentProcess()->Token, SubjectContext->PrimaryToken);
    SubjectContext->PrimaryToken = NULL;
 
    /* Drop reference on the impersonation, if there was one */
    PsDereferenceImpersonationToken(SubjectContext->ClientToken);
    SubjectContext->ClientToken = NULL;
}

Referenced by FatExplicitDeviceAccessGranted(), FsRtlCancelNotify(), FsRtlNotifyCleanup(), FsRtlNotifyFilterChangeDirectory(), HasPrivilege(), KsCreateDefaultSecurity(), nfs41_get_sec_ctx(), nfs41_GetLUID(), nfs41_UpcallCreate(), NtCloseObjectAuditAlarm(), NtOpenObjectAuditAlarm(), NtPrivilegedServiceAuditAlarm(), NtSetUuidSeed(), RxStartMinirdr(), SeCheckPrivilegedObject(), SeDeleteAccessState(), SepAccessCheck(), SepAccessCheckAndAuditAlarm(), SeReportSecurityEvent(), SeSinglePrivilegeCheck(), set_link_information(), set_rename_information(), SystemThread(), UDFCheckAccessRights(), and UDFSetAccessRights().

SeUnlockSubjectContext()

VOID NTAPI SeUnlockSubjectContext

(

_In_ PSECURITY_SUBJECT_CONTEXT

SubjectContext

)

Unlocks both the referenced primary and client access tokens of a security subject context.

Parameters

[in]

SubjectContext

A valid security context with both referenced tokens.

Returns

Nothing.

Definition at line 138 of file subject.c.

{
    PTOKEN PrimaryToken, ClientToken;
    PAGED_CODE();
 
    /* Read both tokens */
    PrimaryToken = SubjectContext->PrimaryToken;
    ClientToken = SubjectContext->ClientToken;
 
    /* Unlock the impersonation one if it's there */
    if (ClientToken)
    {
        SepReleaseTokenLock(ClientToken);
    }
 
    /* Always unlock the primary one */
    SepReleaseTokenLock(PrimaryToken);
}

Referenced by create_stream(), FatExplicitDeviceAccessGranted(), file_create(), FilterToken(), HasPrivilege(), IopParseDevice(), NpCreateClientEnd(), NpCreateExistingNamedPipe(), NpCreateNewNamedPipe(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), open_file2(), SeAccessCheck(), START_TEST(), and TestSeAssignSecurity().

Variable Documentation

SepSubjectContextLock

ERESOURCE SepSubjectContextLock

Definition at line 16 of file subject.c.

Referenced by SepInitializationPhase0().