acchksup.c File Reference

#include "fatprocs.h"

Include dependency graph for acchksup.c:

Go to the source code of this file.

Macros
#define	Dbg   (DEBUG_TRACE_ACCHKSUP)

Functions
NTSTATUS	FatCreateRestrictEveryoneToken (IN PACCESS_TOKEN Token, OUT PACCESS_TOKEN *RestrictedToken)
BOOLEAN	FatCheckFileAccess (PIRP_CONTEXT IrpContext, IN UCHAR DirentAttributes, IN PACCESS_MASK DesiredAccess)
BOOLEAN	FatCheckManageVolumeAccess (_In_ PIRP_CONTEXT IrpContext, _In_ PACCESS_STATE AccessState, _In_ KPROCESSOR_MODE ProcessorMode)
NTSTATUS	FatExplicitDeviceAccessGranted (IN PIRP_CONTEXT IrpContext, IN PDEVICE_OBJECT DeviceObject, IN PACCESS_STATE AccessState, IN KPROCESSOR_MODE ProcessorMode)

Macro Definition Documentation

Dbg

#define Dbg   (DEBUG_TRACE_ACCHKSUP)

Definition at line 22 of file acchksup.c.

Function Documentation

FatCheckFileAccess()

BOOLEAN FatCheckFileAccess	(	PIRP_CONTEXT	IrpContext,
		IN UCHAR	DirentAttributes,
		IN PACCESS_MASK	DesiredAccess
	)

Definition at line 39 of file acchksup.c.

{
    BOOLEAN Result;
 
    DebugTrace(+1, Dbg, "FatCheckFileAccess\n", 0);
    DebugTrace( 0, Dbg, "DirentAttributes = %8lx\n", DirentAttributes);
    DebugTrace( 0, Dbg, "DesiredAccess    = %8lx\n", *DesiredAccess);
 
    PAGED_CODE();
 
    //
    //  This procedures is programmed like a string of filters each
    //  filter checks to see if some access is allowed,  if it is not allowed
    //  the filter return FALSE to the user without further checks otherwise
    //  it moves on to the next filter.  The filter check is to check for
    //  desired access flags that are not allowed for a particular dirent
    //
 
    Result = TRUE;
 
    _SEH2_TRY {
 
        //
        //  Check for Volume ID or Device Dirents, these are not allowed user
        //  access at all
        //
 
        if (FlagOn(DirentAttributes, FAT_DIRENT_ATTR_VOLUME_ID) ||
            FlagOn(DirentAttributes, FAT_DIRENT_ATTR_DEVICE)) {
 
            DebugTrace(0, Dbg, "Cannot access volume id or device\n", 0);
 
            try_return( Result = FALSE );
        }
 
        //
        //  Check the desired access for the object - we only blackball that
        //  we do not understand.  The model of filesystems using ACLs is that
        //  they do not type the ACL to the object the ACL is on.  Permissions
        //  are not checked for consistency vs. the object type - dir/file.
        //
 
        if (FlagOn(*DesiredAccess, ~(DELETE |
                                     READ_CONTROL |
                                     WRITE_OWNER |
                                     WRITE_DAC |
                                     SYNCHRONIZE |
                                     ACCESS_SYSTEM_SECURITY |
                                     FILE_WRITE_DATA |
                                     FILE_READ_EA |
                                     FILE_WRITE_EA |
                                     FILE_READ_ATTRIBUTES |
                                     FILE_WRITE_ATTRIBUTES |
                                     FILE_LIST_DIRECTORY |
                                     FILE_TRAVERSE |
                                     FILE_DELETE_CHILD |
                                     FILE_APPEND_DATA |
                                     MAXIMUM_ALLOWED))) {
 
            DebugTrace(0, Dbg, "Cannot open object\n", 0);
 
            try_return( Result = FALSE );
        }
 
        //
        //  Check for a read-only Dirent
        //
 
        if (FlagOn(DirentAttributes, FAT_DIRENT_ATTR_READ_ONLY)) {
 
            //
            //  Check the desired access for a read-only dirent.  AccessMask will contain
            //  the flags we're going to allow.
            //
 
            ACCESS_MASK AccessMask = DELETE | READ_CONTROL | WRITE_OWNER | WRITE_DAC |
                                    SYNCHRONIZE | ACCESS_SYSTEM_SECURITY | FILE_READ_DATA |
                                    FILE_READ_EA | FILE_WRITE_EA | FILE_READ_ATTRIBUTES |
                                    FILE_WRITE_ATTRIBUTES | FILE_EXECUTE | FILE_LIST_DIRECTORY |
                                    FILE_TRAVERSE;
 
            //
            //  If this is a subdirectory also allow add file/directory and delete.
            //
 
            if (FlagOn(DirentAttributes, FAT_DIRENT_ATTR_DIRECTORY)) {
 
                AccessMask |= FILE_ADD_SUBDIRECTORY | FILE_ADD_FILE | FILE_DELETE_CHILD;
            }
 
            if (FlagOn(*DesiredAccess, ~AccessMask)) {
 
                DebugTrace(0, Dbg, "Cannot open readonly\n", 0);
 
                try_return( Result = FALSE );
            }
        }
 
    try_exit: NOTHING;
    } _SEH2_FINALLY {
 
        DebugUnwind( FatCheckFileAccess );
 
        DebugTrace(-1, Dbg, "FatCheckFileAccess -> %08lx\n", Result);
    } _SEH2_END;
 
    UNREFERENCED_PARAMETER( IrpContext );
 
    return Result;
}

Referenced by FatCheckFileAccess().

FatCheckManageVolumeAccess()

BOOLEAN FatCheckManageVolumeAccess	(	_In_ PIRP_CONTEXT	IrpContext,
		_In_ PACCESS_STATE	AccessState,
		_In_ KPROCESSOR_MODE	ProcessorMode
	)

Definition at line 176 of file acchksup.c.

{
    PRIVILEGE_SET PrivilegeSet;
 
    PAGED_CODE();
 
    PrivilegeSet.PrivilegeCount = 1;
    PrivilegeSet.Control = PRIVILEGE_SET_ALL_NECESSARY;
    PrivilegeSet.Privilege[0].Luid = RtlConvertLongToLuid( SE_MANAGE_VOLUME_PRIVILEGE );
    PrivilegeSet.Privilege[0].Attributes = 0;
 
    if (SePrivilegeCheck( &PrivilegeSet,
                          &AccessState->SubjectSecurityContext,
                          ProcessorMode )) {
 
        return TRUE;
    }
 
    UNREFERENCED_PARAMETER( IrpContext );
 
    return FALSE;
}

Referenced by FatExplicitDeviceAccessGranted().

FatCreateRestrictEveryoneToken()

NTSTATUS FatCreateRestrictEveryoneToken	(	IN PACCESS_TOKEN	Token,
		OUT PACCESS_TOKEN *	RestrictedToken
	)

Definition at line 359 of file acchksup.c.

{
    //
    // Array of sids to disable.
    //
 
    TOKEN_GROUPS SidsToDisable;
 
    NTSTATUS Status = STATUS_SUCCESS;
 
    PAGED_CODE();
 
    //
    //  Restricted token will contain the original sids with one change:
    //  If Everyone sid is present in the token, it will be marked for DenyOnly.
    //
 
    *RestrictedToken = NULL;
 
    //
    //  Put Everyone sid in the array of sids to disable. This will mark it
    //  for SE_GROUP_USE_FOR_DENY_ONLY and it'll only be applicable for Deny aces.
    //
 
    SidsToDisable.GroupCount = 1;
    SidsToDisable.Groups[0].Attributes = 0;
    SidsToDisable.Groups[0].Sid = SeExports->SeWorldSid;
 
    Status = SeFilterToken(
                 Token,            // Token that needs to be restricted.
                 0,                // No flags
                 &SidsToDisable,   // Disable everyone sid
                 NULL,             // Do not create any restricted sids
                 NULL,             // Do not delete any privileges
                 RestrictedToken   // Restricted token
                 );
 
    return Status;
}

Referenced by FatExplicitDeviceAccessGranted().

FatExplicitDeviceAccessGranted()

NTSTATUS FatExplicitDeviceAccessGranted	(	IN PIRP_CONTEXT	IrpContext,
		IN PDEVICE_OBJECT	DeviceObject,
		IN PACCESS_STATE	AccessState,
		IN KPROCESSOR_MODE	ProcessorMode
	)

Definition at line 225 of file acchksup.c.

{
    NTSTATUS Status;
 
    PACCESS_TOKEN OriginalAccessToken;
    PACCESS_TOKEN RestrictedAccessToken;
 
    PACCESS_TOKEN *EffectiveToken;
 
    ACCESS_MASK GrantedAccess;
 
    PAGED_CODE();
 
    UNREFERENCED_PARAMETER( IrpContext );
 
    //
    //  If the access state indicates that specific access other
    //  than traverse was acquired, either Everyone does have such
    //  access or explicit access was granted.  In both cases, we're
    //  happy to let this proceed.
    //
 
    if (AccessState->PreviouslyGrantedAccess & (SPECIFIC_RIGHTS_ALL ^
                                                FILE_TRAVERSE)) {
 
        return STATUS_SUCCESS;
    }
 
    //
    //  If the manage volume privilege is held, this also permits access.
    //
 
    if (FatCheckManageVolumeAccess( IrpContext,
                                    AccessState,
                                    ProcessorMode )) {
 
        return STATUS_SUCCESS;
    }
 
    //
    //  Capture the subject context as a prelude to everything below.
    //
 
    SeLockSubjectContext( &AccessState->SubjectSecurityContext );
 
    //
    //  Convert the token in the subject context into one which does not
    //  acquire access through the Everyone SID.
    //
    //  The logic for deciding which token is effective comes from
    //  SeQuerySubjectContextToken; since there is no natural way
    //  of getting a pointer to it, do it by hand.
    //
 
    if (ARGUMENT_PRESENT( AccessState->SubjectSecurityContext.ClientToken )) {
        EffectiveToken = &AccessState->SubjectSecurityContext.ClientToken;
    } else {
        EffectiveToken = &AccessState->SubjectSecurityContext.PrimaryToken;
    }
 
    OriginalAccessToken = *EffectiveToken;
    Status = FatCreateRestrictEveryoneToken( OriginalAccessToken, &RestrictedAccessToken );
 
    if (!NT_SUCCESS(Status)) {
 
        SeReleaseSubjectContext( &AccessState->SubjectSecurityContext );
        return Status;
    }
 
    //
    //  Now see if the resulting context has access to the device through
    //  its explicitly granted access.  We swap in our restricted token
    //  for this check as the effective client token.
    //
 
    *EffectiveToken = RestrictedAccessToken;
 
#ifdef _MSC_VER
#pragma prefast( suppress: 28175, "we're a file system, this is ok to touch" )
#endif
    SeAccessCheck( DeviceObject->SecurityDescriptor,
                   &AccessState->SubjectSecurityContext,
                   FALSE,
                   AccessState->OriginalDesiredAccess,
                   0,
                   NULL,
                   IoGetFileObjectGenericMapping(),
                   ProcessorMode,
                   &GrantedAccess,
                   &Status );
 
    *EffectiveToken = OriginalAccessToken;
 
    //
    //  Cleanup and return.
    //
 
    SeUnlockSubjectContext( &AccessState->SubjectSecurityContext );
    ObDereferenceObject( RestrictedAccessToken );
 
    return Status;
}