audit.c File Reference

#include <ntoskrnl.h>
#include <debug.h>

Include dependency graph for audit.c:

Go to the source code of this file.

Macros
#define	NDEBUG
#define	SEP_PRIVILEGE_SET_MAX_COUNT   60

Functions
BOOLEAN NTAPI	SeDetailedAuditingWithToken (_In_ PTOKEN Token)
	Peforms a detailed security auditing with an access token.
VOID NTAPI	SeAuditProcessCreate (_In_ PEPROCESS Process)
	Peforms a security auditing against a process that is about to be created.
VOID NTAPI	SeAuditProcessExit (_In_ PEPROCESS Process)
	Peforms a security auditing against a process that is about to be terminated.
NTSTATUS NTAPI	SeInitializeProcessAuditName (_In_ PFILE_OBJECT FileObject, _In_ BOOLEAN DoAudit, _Out_ POBJECT_NAME_INFORMATION *AuditInfo)
	Initializes a process audit name and returns it to the caller.
NTSTATUS NTAPI	SeLocateProcessImageName (_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
	Finds the process image name of a specific process.
VOID NTAPI	SepAdtCloseObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_ PVOID HandleId, _In_ PSID Sid)
	Closes an audit alarm event of an object.
VOID NTAPI	SepAdtPrivilegedServiceAuditAlarm (_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_opt_ PUNICODE_STRING SubsystemName, _In_opt_ PUNICODE_STRING ServiceName, _In_ PTOKEN Token, _In_ PTOKEN PrimaryToken, _In_ PPRIVILEGE_SET Privileges, _In_ BOOLEAN AccessGranted)
	Performs an audit alarm to a privileged service request. This is a worker function.
VOID NTAPI	SePrivilegedServiceAuditAlarm (_In_opt_ PUNICODE_STRING ServiceName, _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_ PPRIVILEGE_SET PrivilegeSet, _In_ BOOLEAN AccessGranted)
	Performs an audit alarm to a privileged service request.
static _Must_inspect_result_ NTSTATUS	SepAccessCheckAndAuditAlarmWorker (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_ PUNICODE_STRING ObjectTypeName, _In_ PUNICODE_STRING ObjectName, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, _In_ ACCESS_MASK DesiredAccess, _In_ AUDIT_EVENT_TYPE AuditType, _In_ BOOLEAN HaveAuditPrivilege, _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, _In_ ULONG ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping, _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccessList, _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatusList, _Out_ PBOOLEAN GenerateOnClose, _In_ BOOLEAN UseResultList)
	Worker function that serves as the main heart and brain of the whole concept and implementation of auditing in the kernel.
_Must_inspect_result_ NTSTATUS NTAPI	SepAccessCheckAndAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ PHANDLE ClientTokenHandle, _In_ PUNICODE_STRING ObjectTypeName, _In_ PUNICODE_STRING ObjectName, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, _In_ ACCESS_MASK DesiredAccess, _In_ AUDIT_EVENT_TYPE AuditType, _In_ ULONG Flags, _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, _In_ ULONG ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping, _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccessList, _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatusList, _Out_ PBOOLEAN GenerateOnClose, _In_ BOOLEAN UseResultList)
	Performs security auditing, if the specific object can be granted security access or not.
VOID NTAPI	SeAuditHardLinkCreation (_In_ PUNICODE_STRING FileName, _In_ PUNICODE_STRING LinkName, _In_ BOOLEAN bSuccess)
	Performs an audit against a hard link creation.
BOOLEAN NTAPI	SeAuditingFileEvents (_In_ BOOLEAN AccessGranted, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor)
	Determines whether auditing against file events is being done or not.
BOOLEAN NTAPI	SeAuditingFileEventsWithContext (_In_ BOOLEAN AccessGranted, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext)
	Determines whether auditing against file events with subject context is being done or not.
BOOLEAN NTAPI	SeAuditingHardLinkEvents (_In_ BOOLEAN AccessGranted, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor)
	Determines whether auditing against hard links events is being done or not.
BOOLEAN NTAPI	SeAuditingHardLinkEventsWithContext (_In_ BOOLEAN AccessGranted, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext)
	Determines whether auditing against hard links events with subject context is being done or not.
BOOLEAN NTAPI	SeAuditingFileOrGlobalEvents (_In_ BOOLEAN AccessGranted, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext)
	Determines whether auditing against files or global events with subject context is being done or not.
VOID NTAPI	SeCloseObjectAuditAlarm (_In_ PVOID Object, _In_ HANDLE Handle, _In_ BOOLEAN PerformAction)
	Closes an alarm audit of an object.
VOID NTAPI	SeDeleteObjectAuditAlarm (_In_ PVOID Object, _In_ HANDLE Handle)
	Deletes an alarm audit of an object.
VOID NTAPI	SeOpenObjectAuditAlarm (_In_ PUNICODE_STRING ObjectTypeName, _In_opt_ PVOID Object, _In_opt_ PUNICODE_STRING AbsoluteObjectName, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ PACCESS_STATE AccessState, _In_ BOOLEAN ObjectCreated, _In_ BOOLEAN AccessGranted, _In_ KPROCESSOR_MODE AccessMode, _Out_ PBOOLEAN GenerateOnClose)
	Creates an audit with alarm notification of an object that is being opened.
VOID NTAPI	SeOpenObjectForDeleteAuditAlarm (_In_ PUNICODE_STRING ObjectTypeName, _In_opt_ PVOID Object, _In_opt_ PUNICODE_STRING AbsoluteObjectName, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ PACCESS_STATE AccessState, _In_ BOOLEAN ObjectCreated, _In_ BOOLEAN AccessGranted, _In_ KPROCESSOR_MODE AccessMode, _Out_ PBOOLEAN GenerateOnClose)
	Creates an audit with alarm notification of an object that is being opened for deletion.
VOID NTAPI	SePrivilegeObjectAuditAlarm (_In_ HANDLE Handle, _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_ ACCESS_MASK DesiredAccess, _In_ PPRIVILEGE_SET Privileges, _In_ BOOLEAN AccessGranted, _In_ KPROCESSOR_MODE CurrentMode)
	Raises an audit with alarm notification message when an object tries to acquire this privilege.
NTSTATUS NTAPI	NtCloseObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)
	Raises an alarm audit message when an object is about to be closed.
NTSTATUS NTAPI	NtDeleteObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)
	Raises an alarm audit message when an object is about to be deleted.
VOID NTAPI	SepOpenObjectAuditAlarm (_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ PUNICODE_STRING ObjectTypeName, _In_ PUNICODE_STRING ObjectName, _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ PTOKEN ClientToken, _In_ ACCESS_MASK DesiredAccess, _In_ ACCESS_MASK GrantedAccess, _In_opt_ PPRIVILEGE_SET Privileges, _In_ BOOLEAN ObjectCreation, _In_ BOOLEAN AccessGranted, _Out_ PBOOLEAN GenerateOnClose)
	Raises an alarm audit message when an object is about to be opened.
__kernel_entry NTSTATUS NTAPI	NtOpenObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ PUNICODE_STRING ObjectTypeName, _In_ PUNICODE_STRING ObjectName, _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ HANDLE ClientTokenHandle, _In_ ACCESS_MASK DesiredAccess, _In_ ACCESS_MASK GrantedAccess, _In_opt_ PPRIVILEGE_SET PrivilegeSet, _In_ BOOLEAN ObjectCreation, _In_ BOOLEAN AccessGranted, _Out_ PBOOLEAN GenerateOnClose)
	Raises an alarm audit message when an object is about to be opened.
__kernel_entry NTSTATUS NTAPI	NtPrivilegedServiceAuditAlarm (_In_opt_ PUNICODE_STRING SubsystemName, _In_opt_ PUNICODE_STRING ServiceName, _In_ HANDLE ClientTokenHandle, _In_ PPRIVILEGE_SET Privileges, _In_ BOOLEAN AccessGranted)
	Raises an alarm audit message when a caller attempts to request a privileged service call.
NTSTATUS NTAPI	NtPrivilegeObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_ PVOID HandleId, _In_ HANDLE ClientToken, _In_ ULONG DesiredAccess, _In_ PPRIVILEGE_SET Privileges, _In_ BOOLEAN AccessGranted)
	Raises an alarm audit message when a caller attempts to access a privileged object.
_Must_inspect_result_ __kernel_entry NTSTATUS NTAPI	NtAccessCheckAndAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ PUNICODE_STRING ObjectTypeName, _In_ PUNICODE_STRING ObjectName, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ACCESS_MASK DesiredAccess, _In_ PGENERIC_MAPPING GenericMapping, _In_ BOOLEAN ObjectCreation, _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus, _Out_ PBOOLEAN GenerateOnClose)
	Raises an alarm audit message when a caller attempts to access an object and determine if the access can be made.
_Must_inspect_result_ __kernel_entry NTSTATUS NTAPI	NtAccessCheckByTypeAndAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ PUNICODE_STRING ObjectTypeName, _In_ PUNICODE_STRING ObjectName, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, _In_ ACCESS_MASK DesiredAccess, _In_ AUDIT_EVENT_TYPE AuditType, _In_ ULONG Flags, _In_reads_opt_(ObjectTypeLength) POBJECT_TYPE_LIST ObjectTypeList, _In_ ULONG ObjectTypeLength, _In_ PGENERIC_MAPPING GenericMapping, _In_ BOOLEAN ObjectCreation, _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus, _Out_ PBOOLEAN GenerateOnClose)
	Raises an alarm audit message when a caller attempts to access an object and determine if the access can be made by type.
_Must_inspect_result_ __kernel_entry NTSTATUS NTAPI	NtAccessCheckByTypeResultListAndAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ PUNICODE_STRING ObjectTypeName, _In_ PUNICODE_STRING ObjectName, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, _In_ ACCESS_MASK DesiredAccess, _In_ AUDIT_EVENT_TYPE AuditType, _In_ ULONG Flags, _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, _In_ ULONG ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping, _In_ BOOLEAN ObjectCreation, _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccessList, _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatusList, _Out_ PBOOLEAN GenerateOnClose)
	Raises an alarm audit message when a caller attempts to access an object and determine if the access can be made by given type result.
_Must_inspect_result_ __kernel_entry NTSTATUS NTAPI	NtAccessCheckByTypeResultListAndAuditAlarmByHandle (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ HANDLE ClientToken, _In_ PUNICODE_STRING ObjectTypeName, _In_ PUNICODE_STRING ObjectName, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, _In_ ACCESS_MASK DesiredAccess, _In_ AUDIT_EVENT_TYPE AuditType, _In_ ULONG Flags, _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, _In_ ULONG ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping, _In_ BOOLEAN ObjectCreation, _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccessList, _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatusList, _Out_ PBOOLEAN GenerateOnClose)
	Raises an alarm audit message when a caller attempts to access an object and determine if the access can be made by given type result and a token handle.

Variables
UNICODE_STRING	SeSubsystemName = RTL_CONSTANT_STRING(L"Security")

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 12 of file audit.c.

SEP_PRIVILEGE_SET_MAX_COUNT

#define SEP_PRIVILEGE_SET_MAX_COUNT   60

Definition at line 15 of file audit.c.

Function Documentation

NtAccessCheckAndAuditAlarm()

_Must_inspect_result_ __kernel_entry NTSTATUS NTAPI NtAccessCheckAndAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ PUNICODE_STRING	ObjectTypeName,
		_In_ PUNICODE_STRING	ObjectName,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ PGENERIC_MAPPING	GenericMapping,
		_In_ BOOLEAN	ObjectCreation,
		_Out_ PACCESS_MASK	GrantedAccess,
		_Out_ PNTSTATUS	AccessStatus,
		_Out_ PBOOLEAN	GenerateOnClose
	)

Raises an alarm audit message when a caller attempts to access an object and determine if the access can be made.

Parameters

[in]	SubsystemName	A Unicode string that points to a name of the subsystem.
[in]	HandleId	A handle to an ID that is used as identification instance for auditing.
[in]	ObjectTypeName	The name of the object type.
[in]	ObjectName	The object name.
[in]	SecurityDescriptor	A security descriptor.
[in]	DesiredAccess	The desired access rights masks requested by the caller.
[in]	GenericMapping	The generic mapping of access mask rights.
[in]	ObjectCreation	Set this to TRUE if the object has just been created.
[out]	GrantedAccess	Returns the granted access rights.
[out]	AccessStatus	Returns a NTSTATUS status code indicating whether access check can be granted or not.
[out]	GenerateOnClose	Returns TRUE if the function has generated a list of granted access rights and status codes on termination, FALSE otherwise.

Returns

See SepAccessCheckAndAuditAlarm.

Definition at line 2125 of file audit.c.

{
    /* Call the internal function */
    return SepAccessCheckAndAuditAlarm(SubsystemName,
                                       HandleId,
                                       NULL,
                                       ObjectTypeName,
                                       ObjectName,
                                       SecurityDescriptor,
                                       NULL,
                                       DesiredAccess,
                                       AuditEventObjectAccess,
                                       0,
                                       NULL,
                                       0,
                                       GenericMapping,
                                       GrantedAccess,
                                       AccessStatus,
                                       GenerateOnClose,
                                       FALSE);
}

Referenced by AccessCheckAndAuditAlarmA(), and AccessCheckAndAuditAlarmW().

NtAccessCheckByTypeAndAuditAlarm()

_Must_inspect_result_ __kernel_entry NTSTATUS NTAPI NtAccessCheckByTypeAndAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ PUNICODE_STRING	ObjectTypeName,
		_In_ PUNICODE_STRING	ObjectName,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_opt_ PSID	PrincipalSelfSid,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ AUDIT_EVENT_TYPE	AuditType,
		_In_ ULONG	Flags,
		_In_reads_opt_(ObjectTypeLength) POBJECT_TYPE_LIST	ObjectTypeList,
		_In_ ULONG	ObjectTypeLength,
		_In_ PGENERIC_MAPPING	GenericMapping,
		_In_ BOOLEAN	ObjectCreation,
		_Out_ PACCESS_MASK	GrantedAccess,
		_Out_ PNTSTATUS	AccessStatus,
		_Out_ PBOOLEAN	GenerateOnClose
	)

Raises an alarm audit message when a caller attempts to access an object and determine if the access can be made by type.

Parameters

[in]	SubsystemName	A Unicode string that points to a name of the subsystem.
[in]	HandleId	A handle to an ID that is used as identification instance for auditing.
[in]	ObjectTypeName	The name of the object type.
[in]	ObjectName	The object name.
[in]	SecurityDescriptor	A security descriptor.
[in]	PrincipalSelfSid	A principal self user SID.
[in]	DesiredAccess	The desired access rights masks requested by the caller.
[in]	AuditType	Type of audit to start, influencing how the audit should be done.
[in]	Flags	Flag bitmask, used to check if auditing can be done without privileges.
[in]	ObjectTypeList	A list of object types.
[in]	ObjectTypeLength	The length size of the list.
[in]	GenericMapping	The generic mapping of access mask rights.
[in]	ObjectCreation	Set this to TRUE if the object has just been created.
[out]	GrantedAccess	Returns the granted access rights.
[out]	AccessStatus	Returns a NTSTATUS status code indicating whether access check can be granted or not.
[out]	GenerateOnClose	Returns TRUE if the function has generated a list of granted access rights and status codes on termination, FALSE otherwise.

Returns

See SepAccessCheckAndAuditAlarm.

Definition at line 2222 of file audit.c.

{
    /* Call the internal function */
    return SepAccessCheckAndAuditAlarm(SubsystemName,
                                       HandleId,
                                       NULL,
                                       ObjectTypeName,
                                       ObjectName,
                                       SecurityDescriptor,
                                       PrincipalSelfSid,
                                       DesiredAccess,
                                       AuditType,
                                       Flags,
                                       ObjectTypeList,
                                       ObjectTypeLength,
                                       GenericMapping,
                                       GrantedAccess,
                                       AccessStatus,
                                       GenerateOnClose,
                                       FALSE);
}

NtAccessCheckByTypeResultListAndAuditAlarm()

_Must_inspect_result_ __kernel_entry NTSTATUS NTAPI NtAccessCheckByTypeResultListAndAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ PUNICODE_STRING	ObjectTypeName,
		_In_ PUNICODE_STRING	ObjectName,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_opt_ PSID	PrincipalSelfSid,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ AUDIT_EVENT_TYPE	AuditType,
		_In_ ULONG	Flags,
		_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST	ObjectTypeList,
		_In_ ULONG	ObjectTypeListLength,
		_In_ PGENERIC_MAPPING	GenericMapping,
		_In_ BOOLEAN	ObjectCreation,
		_Out_writes_(ObjectTypeListLength) PACCESS_MASK	GrantedAccessList,
		_Out_writes_(ObjectTypeListLength) PNTSTATUS	AccessStatusList,
		_Out_ PBOOLEAN	GenerateOnClose
	)

Raises an alarm audit message when a caller attempts to access an object and determine if the access can be made by given type result.

Parameters

[in]	SubsystemName	A Unicode string that points to a name of the subsystem.
[in]	HandleId	A handle to an ID that is used as identification instance for auditing.
[in]	ObjectTypeName	The name of the object type.
[in]	ObjectName	The object name.
[in]	SecurityDescriptor	A security descriptor.
[in]	PrincipalSelfSid	A principal self user SID.
[in]	DesiredAccess	The desired access rights masks requested by the caller.
[in]	AuditType	Type of audit to start, influencing how the audit should be done.
[in]	Flags	Flag bitmask, used to check if auditing can be done without privileges.
[in]	ObjectTypeList	A list of object types.
[in]	ObjectTypeLength	The length size of the list.
[in]	GenericMapping	The generic mapping of access mask rights.
[in]	ObjectCreation	Set this to TRUE if the object has just been created.
[out]	GrantedAccessList	Returns the granted access rights.
[out]	AccessStatusList	Returns a NTSTATUS status code indicating whether access check can be granted or not.
[out]	GenerateOnClose	Returns TRUE if the function has generated a list of granted access rights and status codes on termination, FALSE otherwise.

Returns

See SepAccessCheckAndAuditAlarm.

Definition at line 2324 of file audit.c.

{
    /* Call the internal function */
    return SepAccessCheckAndAuditAlarm(SubsystemName,
                                       HandleId,
                                       NULL,
                                       ObjectTypeName,
                                       ObjectName,
                                       SecurityDescriptor,
                                       PrincipalSelfSid,
                                       DesiredAccess,
                                       AuditType,
                                       Flags,
                                       ObjectTypeList,
                                       ObjectTypeListLength,
                                       GenericMapping,
                                       GrantedAccessList,
                                       AccessStatusList,
                                       GenerateOnClose,
                                       TRUE);
}

NtAccessCheckByTypeResultListAndAuditAlarmByHandle()

_Must_inspect_result_ __kernel_entry NTSTATUS NTAPI NtAccessCheckByTypeResultListAndAuditAlarmByHandle	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ HANDLE	ClientToken,
		_In_ PUNICODE_STRING	ObjectTypeName,
		_In_ PUNICODE_STRING	ObjectName,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_opt_ PSID	PrincipalSelfSid,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ AUDIT_EVENT_TYPE	AuditType,
		_In_ ULONG	Flags,
		_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST	ObjectTypeList,
		_In_ ULONG	ObjectTypeListLength,
		_In_ PGENERIC_MAPPING	GenericMapping,
		_In_ BOOLEAN	ObjectCreation,
		_Out_writes_(ObjectTypeListLength) PACCESS_MASK	GrantedAccessList,
		_Out_writes_(ObjectTypeListLength) PNTSTATUS	AccessStatusList,
		_Out_ PBOOLEAN	GenerateOnClose
	)

Raises an alarm audit message when a caller attempts to access an object and determine if the access can be made by given type result and a token handle.

Parameters

[in]	SubsystemName	A Unicode string that points to a name of the subsystem.
[in]	HandleId	A handle to an ID that is used as identification instance for auditing.
[in]	ClientToken	A handle to a client access token.
[in]	ObjectTypeName	The name of the object type.
[in]	ObjectName	The object name.
[in]	SecurityDescriptor	A security descriptor.
[in]	PrincipalSelfSid	A principal self user SID.
[in]	DesiredAccess	The desired access rights masks requested by the caller.
[in]	AuditType	Type of audit to start, influencing how the audit should be done.
[in]	Flags	Flag bitmask, used to check if auditing can be done without privileges.
[in]	ObjectTypeList	A list of object types.
[in]	ObjectTypeLength	The length size of the list.
[in]	GenericMapping	The generic mapping of access mask rights.
[in]	ObjectCreation	Set this to TRUE if the object has just been created.
[out]	GrantedAccessList	Returns the granted access rights.
[out]	AccessStatusList	Returns a NTSTATUS status code indicating whether access check can be granted or not.
[out]	GenerateOnClose	Returns TRUE if the function has generated a list of granted access rights and status codes on termination, FALSE otherwise.

Returns

See SepAccessCheckAndAuditAlarm.

Definition at line 2430 of file audit.c.

{
    UNREFERENCED_PARAMETER(ObjectCreation);
 
    /* Call the internal function */
    return SepAccessCheckAndAuditAlarm(SubsystemName,
                                       HandleId,
                                       &ClientToken,
                                       ObjectTypeName,
                                       ObjectName,
                                       SecurityDescriptor,
                                       PrincipalSelfSid,
                                       DesiredAccess,
                                       AuditType,
                                       Flags,
                                       ObjectTypeList,
                                       ObjectTypeListLength,
                                       GenericMapping,
                                       GrantedAccessList,
                                       AccessStatusList,
                                       GenerateOnClose,
                                       TRUE);
}

NtCloseObjectAuditAlarm()

NTSTATUS NTAPI NtCloseObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

Raises an alarm audit message when an object is about to be closed.

Parameters

[in]	SubsystemName	A Unicode string that points to the name of the subsystem.
[in]	HandleId	A handle of an ID used for identification instance for auditing.
[in]	GenerateOnClose	A boolean value previously created by the "open" equivalent of this function. If the caller explicitly sets this to FALSE, the function assumes that the object is not opened.

Returns

Returns STATUS_SUCCESS if all the operations have completed successfully. STATUS_PRIVILEGE_NOT_HELD is returned if the security subject context does not have the audit privilege to actually begin auditing procedures in the first place.

Definition at line 1358 of file audit.c.

{
    SECURITY_SUBJECT_CONTEXT SubjectContext;
    UNICODE_STRING CapturedSubsystemName;
    KPROCESSOR_MODE PreviousMode;
    BOOLEAN UseImpersonationToken;
    PETHREAD CurrentThread;
    BOOLEAN CopyOnOpen, EffectiveOnly;
    SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
    NTSTATUS Status;
    PTOKEN Token;
    PAGED_CODE();
 
    /* Get the previous mode (only user mode is supported!) */
    PreviousMode = ExGetPreviousMode();
    ASSERT(PreviousMode != KernelMode);
 
    /* Do we even need to do anything? */
    if (!GenerateOnClose)
    {
        /* Nothing to do, return success */
        return STATUS_SUCCESS;
    }
 
    /* Capture the security subject context */
    SeCaptureSubjectContext(&SubjectContext);
 
    /* Check for audit privilege */
    if (!SeCheckAuditPrivilege(&SubjectContext, PreviousMode))
    {
        DPRINT1("Caller does not have SeAuditPrivilege\n");
        Status = STATUS_PRIVILEGE_NOT_HELD;
        goto Cleanup;
    }
 
    /* Probe and capture the subsystem name */
    Status = ProbeAndCaptureUnicodeString(&CapturedSubsystemName,
                                          PreviousMode,
                                          SubsystemName);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to capture subsystem name!\n");
        goto Cleanup;
    }
 
    /* Get the current thread and check if it's impersonating */
    CurrentThread = PsGetCurrentThread();
    if (PsIsThreadImpersonating(CurrentThread))
    {
        /* Get the impersonation token */
        Token = PsReferenceImpersonationToken(CurrentThread,
                                              &CopyOnOpen,
                                              &EffectiveOnly,
                                              &ImpersonationLevel);
        UseImpersonationToken = TRUE;
    }
    else
    {
        /* Get the primary token */
        Token = PsReferencePrimaryToken(PsGetCurrentProcess());
        UseImpersonationToken = FALSE;
    }
 
    /* Call the internal function */
    SepAdtCloseObjectAuditAlarm(&CapturedSubsystemName,
                                HandleId,
                                Token->UserAndGroups->Sid);
 
    /* Release the captured subsystem name */
    ReleaseCapturedUnicodeString(&CapturedSubsystemName, PreviousMode);
 
    /* Check what token we used */
    if (UseImpersonationToken)
    {
        /* Release impersonation token */
        PsDereferenceImpersonationToken(Token);
    }
    else
    {
        /* Release primary token */
        PsDereferencePrimaryToken(Token);
    }
 
    Status = STATUS_SUCCESS;
 
Cleanup:
 
    /* Release the security subject context */
    SeReleaseSubjectContext(&SubjectContext);
 
    return Status;
}

Referenced by ObjectCloseAuditAlarmA(), and ObjectCloseAuditAlarmW().

NtDeleteObjectAuditAlarm()

NTSTATUS NTAPI NtDeleteObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

Raises an alarm audit message when an object is about to be deleted.

@unimplemented

Parameters

[in]	SubsystemName	A Unicode string that points to the name of the subsystem.
[in]	HandleId	A handle of an ID used for identification instance for auditing.
[in]	GenerateOnClose	A boolean value previously created by the "open" equivalent of this function. If the caller explicitly sets this to FALSE, the function assumes that the object is not opened.

Returns

To be added...

Definition at line 1475 of file audit.c.

{
    UNIMPLEMENTED;
    return STATUS_NOT_IMPLEMENTED;
}

Referenced by ObjectDeleteAuditAlarmA(), and ObjectDeleteAuditAlarmW().

NtOpenObjectAuditAlarm()

__kernel_entry NTSTATUS NTAPI NtOpenObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ PUNICODE_STRING	ObjectTypeName,
		_In_ PUNICODE_STRING	ObjectName,
		_In_opt_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ HANDLE	ClientTokenHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ ACCESS_MASK	GrantedAccess,
		_In_opt_ PPRIVILEGE_SET	PrivilegeSet,
		_In_ BOOLEAN	ObjectCreation,
		_In_ BOOLEAN	AccessGranted,
		_Out_ PBOOLEAN	GenerateOnClose
	)

Raises an alarm audit message when an object is about to be opened.

Parameters

[in]	SubsystemName	A Unicode string that points to a name of the subsystem.
[in]	HandleId	A handle to an ID used for identification instance for auditing.
[in]	ObjectTypeName	A Unicode string that points to an object type name.
[in]	ObjectName	The name of the object.
[in]	SecurityDescriptor	A security descriptor.
[in]	ClientTokenHandle	A handle to a client access token.
[in]	DesiredAccess	The desired access rights masks requested by the caller.
[in]	GrantedAccess	The granted access mask rights.
[in]	PrivilegeSet	If specified, the function will use this set of privileges to audit.
[in]	ObjectCreation	Set this to TRUE if the object has just been created.
[in]	AccessGranted	Set this to TRUE if the access attempt was deemed as granted.
[out]	GenerateOnClose	A boolean flag returned to the caller once audit generation procedure finishes.

Returns

Returns STATUS_SUCCESS if all the operations have been completed successfully. STATUS_PRIVILEGE_NOT_HELD is returned if the given subject context does not hold the required audit privilege to actually begin auditing in the first place. STATUS_BAD_IMPERSONATION_LEVEL is returned if the security impersonation level of the client token is not on par with the impersonation level that alllows impersonation. STATUS_INVALID_PARAMETER is returned if the caller has submitted a bogus set of privileges as such array set exceeds the maximum count of privileges that the kernel can accept. A failure NTSTATUS code is returned otherwise.

Definition at line 1622 of file audit.c.

{
    PTOKEN ClientToken;
    PSECURITY_DESCRIPTOR CapturedSecurityDescriptor;
    UNICODE_STRING CapturedSubsystemName, CapturedObjectTypeName, CapturedObjectName;
    ULONG PrivilegeCount, PrivilegeSetSize;
    volatile PPRIVILEGE_SET CapturedPrivilegeSet;
    BOOLEAN LocalGenerateOnClose;
    PVOID CapturedHandleId;
    SECURITY_SUBJECT_CONTEXT SubjectContext;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Only user mode is supported! */
    ASSERT(ExGetPreviousMode() != KernelMode);
 
    /* Start clean */
    ClientToken = NULL;
    CapturedSecurityDescriptor = NULL;
    CapturedPrivilegeSet = NULL;
    CapturedSubsystemName.Buffer = NULL;
    CapturedObjectTypeName.Buffer = NULL;
    CapturedObjectName.Buffer = NULL;
 
    /* Reference the client token */
    Status = ObReferenceObjectByHandle(ClientTokenHandle,
                                       TOKEN_QUERY,
                                       SeTokenObjectType,
                                       UserMode,
                                       (PVOID*)&ClientToken,
                                       NULL);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to reference token handle %p: %lx\n",
                ClientTokenHandle, Status);
        return Status;
    }
 
    /* Capture the security subject context */
    SeCaptureSubjectContext(&SubjectContext);
 
    /* Validate the token's impersonation level */
    if ((ClientToken->TokenType == TokenImpersonation) &&
        (ClientToken->ImpersonationLevel < SecurityIdentification))
    {
        DPRINT1("Invalid impersonation level (%u)\n", ClientToken->ImpersonationLevel);
        Status = STATUS_BAD_IMPERSONATION_LEVEL;
        goto Cleanup;
    }
 
    /* Check for audit privilege */
    if (!SeCheckAuditPrivilege(&SubjectContext, UserMode))
    {
        DPRINT1("Caller does not have SeAuditPrivilege\n");
        Status = STATUS_PRIVILEGE_NOT_HELD;
        goto Cleanup;
    }
 
    /* Check for NULL SecurityDescriptor */
    if (SecurityDescriptor == NULL)
    {
        /* Nothing to do */
        Status = STATUS_SUCCESS;
        goto Cleanup;
    }
 
    /* Capture the security descriptor */
    Status = SeCaptureSecurityDescriptor(SecurityDescriptor,
                                         UserMode,
                                         PagedPool,
                                         FALSE,
                                         &CapturedSecurityDescriptor);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to capture security descriptor!\n");
        goto Cleanup;
    }
 
    _SEH2_TRY
    {
        /* Check if we have a privilege set */
        if (PrivilegeSet != NULL)
        {
            /* Probe the basic privilege set structure */
            ProbeForRead(PrivilegeSet, sizeof(PRIVILEGE_SET), sizeof(ULONG));
 
            /* Validate privilege count */
            PrivilegeCount = PrivilegeSet->PrivilegeCount;
            if (PrivilegeCount > SEP_PRIVILEGE_SET_MAX_COUNT)
            {
                Status = STATUS_INVALID_PARAMETER;
                _SEH2_YIELD(goto Cleanup);
            }
 
            /* Calculate the size of the PrivilegeSet structure */
            PrivilegeSetSize = FIELD_OFFSET(PRIVILEGE_SET, Privilege[PrivilegeCount]);
 
            /* Probe the whole structure */
            ProbeForRead(PrivilegeSet, PrivilegeSetSize, sizeof(ULONG));
 
            /* Allocate a temp buffer */
            CapturedPrivilegeSet = ExAllocatePoolWithTag(PagedPool,
                                                         PrivilegeSetSize,
                                                         TAG_PRIVILEGE_SET);
            if (CapturedPrivilegeSet == NULL)
            {
                DPRINT1("Failed to allocate %u bytes\n", PrivilegeSetSize);
                Status = STATUS_INSUFFICIENT_RESOURCES;
                _SEH2_YIELD(goto Cleanup);
            }
 
            /* Copy the privileges */
            RtlCopyMemory(CapturedPrivilegeSet, PrivilegeSet, PrivilegeSetSize);
        }
 
        if (HandleId != NULL)
        {
            ProbeForRead(HandleId, sizeof(PVOID), sizeof(PVOID));
            CapturedHandleId = *(PVOID*)HandleId;
        }
 
        ProbeForWrite(GenerateOnClose, sizeof(BOOLEAN), sizeof(BOOLEAN));
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        Status = _SEH2_GetExceptionCode();
        DPRINT1("Exception while probing parameters: 0x%lx\n", Status);
        _SEH2_YIELD(goto Cleanup);
    }
    _SEH2_END;
 
    /* Probe and capture the subsystem name */
    Status = ProbeAndCaptureUnicodeString(&CapturedSubsystemName,
                                          UserMode,
                                          SubsystemName);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to capture subsystem name!\n");
        goto Cleanup;
    }
 
    /* Probe and capture the object type name */
    Status = ProbeAndCaptureUnicodeString(&CapturedObjectTypeName,
                                          UserMode,
                                          ObjectTypeName);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to capture object type name!\n");
        goto Cleanup;
    }
 
    /* Probe and capture the object name */
    Status = ProbeAndCaptureUnicodeString(&CapturedObjectName,
                                          UserMode,
                                          ObjectName);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to capture object name!\n");
        goto Cleanup;
    }
 
    /* Call the internal function */
    SepOpenObjectAuditAlarm(&SubjectContext,
                            &CapturedSubsystemName,
                            CapturedHandleId,
                            &CapturedObjectTypeName,
                            &CapturedObjectName,
                            CapturedSecurityDescriptor,
                            ClientToken,
                            DesiredAccess,
                            GrantedAccess,
                            CapturedPrivilegeSet,
                            ObjectCreation,
                            AccessGranted,
                            &LocalGenerateOnClose);
 
    Status = STATUS_SUCCESS;
 
    /* Enter SEH to copy the data back to user mode */
    _SEH2_TRY
    {
        *GenerateOnClose = LocalGenerateOnClose;
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        Status = _SEH2_GetExceptionCode();
        DPRINT1("Exception while copying back data: 0x%lx\n", Status);
    }
    _SEH2_END;
 
Cleanup:
 
    if (CapturedObjectName.Buffer != NULL)
        ReleaseCapturedUnicodeString(&CapturedObjectName, UserMode);
 
    if (CapturedObjectTypeName.Buffer != NULL)
        ReleaseCapturedUnicodeString(&CapturedObjectTypeName, UserMode);
 
    if (CapturedSubsystemName.Buffer != NULL)
        ReleaseCapturedUnicodeString(&CapturedSubsystemName, UserMode);
 
    if (CapturedSecurityDescriptor != NULL)
        SeReleaseSecurityDescriptor(CapturedSecurityDescriptor, UserMode, FALSE);
 
    if (CapturedPrivilegeSet != NULL)
        ExFreePoolWithTag(CapturedPrivilegeSet, TAG_PRIVILEGE_SET);
 
    /* Release the security subject context */
    SeReleaseSubjectContext(&SubjectContext);
 
    ObDereferenceObject(ClientToken);
 
    return Status;
}

Referenced by ObjectOpenAuditAlarmA(), and ObjectOpenAuditAlarmW().

NtPrivilegedServiceAuditAlarm()

__kernel_entry NTSTATUS NTAPI NtPrivilegedServiceAuditAlarm	(	_In_opt_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PUNICODE_STRING	ServiceName,
		_In_ HANDLE	ClientTokenHandle,
		_In_ PPRIVILEGE_SET	Privileges,
		_In_ BOOLEAN	AccessGranted
	)

Raises an alarm audit message when a caller attempts to request a privileged service call.

Parameters

[in]	SubsystemName	A Unicode string that points to a name of the subsystem.
[in]	ServiceName	A Unicode string that points to a name of the privileged service.
[in]	ClientTokenHandle	A handle to a client access token.
[in]	Privileges	An array set of privileges.
[in]	AccessGranted	Set this to TRUE if the access attempt was deemed as granted.

Returns

Returns STATUS_SUCCESS if all the operations have been completed successfully. STATUS_PRIVILEGE_NOT_HELD is returned if the given subject context does not hold the required audit privilege to actually begin auditing in the first place. STATUS_BAD_IMPERSONATION_LEVEL is returned if the security impersonation level of the client token is not on par with the impersonation level that alllows impersonation. STATUS_INVALID_PARAMETER is returned if the caller has submitted a bogus set of privileges as such array set exceeds the maximum count of privileges that the kernel can accept. A failure NTSTATUS code is returned otherwise.

Definition at line 1883 of file audit.c.

{
    KPROCESSOR_MODE PreviousMode;
    PTOKEN ClientToken;
    volatile PPRIVILEGE_SET CapturedPrivileges = NULL;
    UNICODE_STRING CapturedSubsystemName;
    UNICODE_STRING CapturedServiceName;
    ULONG PrivilegeCount, PrivilegesSize;
    SECURITY_SUBJECT_CONTEXT SubjectContext;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Get the previous mode (only user mode is supported!) */
    PreviousMode = ExGetPreviousMode();
    ASSERT(PreviousMode != KernelMode);
 
    CapturedSubsystemName.Buffer = NULL;
    CapturedServiceName.Buffer = NULL;
 
    /* Reference the client token */
    Status = ObReferenceObjectByHandle(ClientTokenHandle,
                                       TOKEN_QUERY,
                                       SeTokenObjectType,
                                       PreviousMode,
                                       (PVOID*)&ClientToken,
                                       NULL);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to reference client token: 0x%lx\n", Status);
        return Status;
    }
 
    /* Validate the token's impersonation level */
    if ((ClientToken->TokenType == TokenImpersonation) &&
        (ClientToken->ImpersonationLevel < SecurityIdentification))
    {
        DPRINT1("Invalid impersonation level (%u)\n", ClientToken->ImpersonationLevel);
        ObDereferenceObject(ClientToken);
        return STATUS_BAD_IMPERSONATION_LEVEL;
    }
 
    /* Capture the security subject context */
    SeCaptureSubjectContext(&SubjectContext);
 
    /* Check for audit privilege */
    if (!SeCheckAuditPrivilege(&SubjectContext, PreviousMode))
    {
        DPRINT1("Caller does not have SeAuditPrivilege\n");
        Status = STATUS_PRIVILEGE_NOT_HELD;
        goto Cleanup;
    }
 
    /* Do we have a subsystem name? */
    if (SubsystemName != NULL)
    {
        /* Probe and capture the subsystem name */
        Status = ProbeAndCaptureUnicodeString(&CapturedSubsystemName,
                                              PreviousMode,
                                              SubsystemName);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("Failed to capture subsystem name!\n");
            goto Cleanup;
        }
    }
 
    /* Do we have a service name? */
    if (ServiceName != NULL)
    {
        /* Probe and capture the service name */
        Status = ProbeAndCaptureUnicodeString(&CapturedServiceName,
                                              PreviousMode,
                                              ServiceName);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("Failed to capture service name!\n");
            goto Cleanup;
        }
    }
 
    _SEH2_TRY
    {
        /* Probe the basic privilege set structure */
        ProbeForRead(Privileges, sizeof(PRIVILEGE_SET), sizeof(ULONG));
 
        /* Validate privilege count */
        PrivilegeCount = Privileges->PrivilegeCount;
        if (PrivilegeCount > SEP_PRIVILEGE_SET_MAX_COUNT)
        {
            Status = STATUS_INVALID_PARAMETER;
            _SEH2_YIELD(goto Cleanup);
        }
 
        /* Calculate the size of the Privileges structure */
        PrivilegesSize = FIELD_OFFSET(PRIVILEGE_SET, Privilege[PrivilegeCount]);
 
        /* Probe the whole structure */
        ProbeForRead(Privileges, PrivilegesSize, sizeof(ULONG));
 
        /* Allocate a temp buffer */
        CapturedPrivileges = ExAllocatePoolWithTag(PagedPool,
                                                   PrivilegesSize,
                                                   TAG_PRIVILEGE_SET);
        if (CapturedPrivileges == NULL)
        {
            DPRINT1("Failed to allocate %u bytes\n", PrivilegesSize);
            Status = STATUS_INSUFFICIENT_RESOURCES;
            _SEH2_YIELD(goto Cleanup);
        }
 
        /* Copy the privileges */
        RtlCopyMemory(CapturedPrivileges, Privileges, PrivilegesSize);
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        Status = _SEH2_GetExceptionCode();
        DPRINT1("Got exception 0x%lx\n", Status);
        _SEH2_YIELD(goto Cleanup);
    }
    _SEH2_END;
 
    /* Call the internal function */
    SepAdtPrivilegedServiceAuditAlarm(&SubjectContext,
                                      SubsystemName ? &CapturedSubsystemName : NULL,
                                      ServiceName ? &CapturedServiceName : NULL,
                                      ClientToken,
                                      SubjectContext.PrimaryToken,
                                      CapturedPrivileges,
                                      AccessGranted);
 
    Status = STATUS_SUCCESS;
 
Cleanup:
    /* Cleanup resources */
    if (CapturedSubsystemName.Buffer != NULL)
        ReleaseCapturedUnicodeString(&CapturedSubsystemName, PreviousMode);
 
    if (CapturedServiceName.Buffer != NULL)
        ReleaseCapturedUnicodeString(&CapturedServiceName, PreviousMode);
 
    if (CapturedPrivileges != NULL)
        ExFreePoolWithTag(CapturedPrivileges, TAG_PRIVILEGE_SET);
 
    /* Release the security subject context */
    SeReleaseSubjectContext(&SubjectContext);
 
    ObDereferenceObject(ClientToken);
 
    return Status;
}

Referenced by PrivilegedServiceAuditAlarmA(), and PrivilegedServiceAuditAlarmW().

NtPrivilegeObjectAuditAlarm()

NTSTATUS NTAPI NtPrivilegeObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_ PVOID	HandleId,
		_In_ HANDLE	ClientToken,
		_In_ ULONG	DesiredAccess,
		_In_ PPRIVILEGE_SET	Privileges,
		_In_ BOOLEAN	AccessGranted
	)

Raises an alarm audit message when a caller attempts to access a privileged object.

Parameters

[in]	SubsystemName	A Unicode string that points to a name of the subsystem.
[in]	HandleId	A handle to an ID that is used as identification instance for auditing.
[in]	ClientToken	A handle to a client access token.
[in]	DesiredAccess	A handle to a client access token.
[in]	Privileges	An array set of privileges.
[in]	AccessGranted	Set this to TRUE if the access attempt was deemed as granted.

Returns

To be added...

Definition at line 2066 of file audit.c.

{
    UNIMPLEMENTED;
    return STATUS_NOT_IMPLEMENTED;
}

Referenced by ObjectPrivilegeAuditAlarmA(), and ObjectPrivilegeAuditAlarmW().

SeAuditHardLinkCreation()

VOID NTAPI SeAuditHardLinkCreation	(	_In_ PUNICODE_STRING	FileName,
		_In_ PUNICODE_STRING	LinkName,
		_In_ BOOLEAN	bSuccess
	)

Performs an audit against a hard link creation.

@unimplemented

Parameters

[in]	FileName	A Unicode string that points to the name of the file.
[in]	LinkName	A Unicode string that points to a link.
[out]	bSuccess	If TRUE, the function has successfully audited the hard link and security access can be granted, FALSE otherwise.

Returns

Nothing.

Definition at line 967 of file audit.c.

{
    UNIMPLEMENTED;
}

SeAuditingFileEvents()

BOOLEAN NTAPI SeAuditingFileEvents	(	_In_ BOOLEAN	AccessGranted,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor
	)

Determines whether auditing against file events is being done or not.

@unimplemented

Parameters

[in]	AccessGranted	If set to TRUE, the access attempt is deemed as successful otherwise set it to FALSE.
[in]	SecurityDescriptor	A security descriptor.

Returns

Returns TRUE if auditing is being currently done, FALSE otherwise.

Definition at line 993 of file audit.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

SeAuditingFileEventsWithContext()

BOOLEAN NTAPI SeAuditingFileEventsWithContext	(	_In_ BOOLEAN	AccessGranted,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_opt_ PSECURITY_SUBJECT_CONTEXT	SubjectSecurityContext
	)

Determines whether auditing against file events with subject context is being done or not.

@unimplemented

Parameters

[in]	AccessGranted	If set to TRUE, the access attempt is deemed as successful otherwise set it to FALSE.
[in]	SecurityDescriptor	A security descriptor.
[in]	SubjectSecurityContext	If specified, the function will check if security auditing is currently being done with this context.

Returns

Returns TRUE if auditing is being currently done, FALSE otherwise.

Definition at line 1023 of file audit.c.

{
    UNIMPLEMENTED_ONCE;
    return FALSE;
}

SeAuditingFileOrGlobalEvents()

BOOLEAN NTAPI SeAuditingFileOrGlobalEvents	(	_In_ BOOLEAN	AccessGranted,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ PSECURITY_SUBJECT_CONTEXT	SubjectSecurityContext
	)

Determines whether auditing against files or global events with subject context is being done or not.

@unimplemented

Parameters

[in]	AccessGranted	If set to TRUE, the access attempt is deemed as successful otherwise set it to FALSE.
[in]	SecurityDescriptor	A security descriptor.
[in]	SubjectSecurityContext	If specified, the function will check if security auditing is currently being done with this context.

Returns

Returns TRUE if auditing is being currently done, FALSE otherwise.

Definition at line 1111 of file audit.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

SeAuditingHardLinkEvents()

BOOLEAN NTAPI SeAuditingHardLinkEvents	(	_In_ BOOLEAN	AccessGranted,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor
	)

Determines whether auditing against hard links events is being done or not.

@unimplemented

Parameters

[in]	AccessGranted	If set to TRUE, the access attempt is deemed as successful otherwise set it to FALSE.
[in]	SecurityDescriptor	A security descriptor.

Returns

Returns TRUE if auditing is being currently done, FALSE otherwise.

Definition at line 1050 of file audit.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

SeAuditingHardLinkEventsWithContext()

BOOLEAN NTAPI SeAuditingHardLinkEventsWithContext	(	_In_ BOOLEAN	AccessGranted,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_opt_ PSECURITY_SUBJECT_CONTEXT	SubjectSecurityContext
	)

Determines whether auditing against hard links events with subject context is being done or not.

@unimplemented

Parameters

[in]	AccessGranted	If set to TRUE, the access attempt is deemed as successful otherwise set it to FALSE.
[in]	SecurityDescriptor	A security descriptor.
[in]	SubjectSecurityContext	If specified, the function will check if security auditing is currently being done with this context.

Returns

Returns TRUE if auditing is being currently done, FALSE otherwise.

Definition at line 1080 of file audit.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

SeAuditProcessCreate()

VOID NTAPI SeAuditProcessCreate

(

_In_ PEPROCESS

Process

)

Peforms a security auditing against a process that is about to be created.

@unimplemented

Parameters

[in]

Process

An object that points to a process which is in process of creation.

Returns

Nothing.

Definition at line 56 of file audit.c.

{
    /* FIXME */
}

Referenced by PspCreateProcess().

SeAuditProcessExit()

VOID NTAPI SeAuditProcessExit

(

_In_ PEPROCESS

Process

)

Peforms a security auditing against a process that is about to be terminated.

@unimplemented

Parameters

[in]

Process

An object that points to a process which is in process of termination.

Returns

Nothing.

Definition at line 77 of file audit.c.

{
    /* FIXME */
}

Referenced by PspExitThread().

SeCloseObjectAuditAlarm()

VOID NTAPI SeCloseObjectAuditAlarm	(	_In_ PVOID	Object,
		_In_ HANDLE	Handle,
		_In_ BOOLEAN	PerformAction
	)

Closes an alarm audit of an object.

@unimplemented

Parameters

[in]	Object	An arbitrary pointer data that points to the object.
[in]	Handle	A handle of the said object.
[in]	PerformAction	Set this to TRUE to perform any auxiliary action, otherwise set to FALSE.

Returns

Nothing.

Definition at line 1140 of file audit.c.

{
    UNIMPLEMENTED;
}

SeDeleteObjectAuditAlarm()

VOID NTAPI SeDeleteObjectAuditAlarm	(	_In_ PVOID	Object,
		_In_ HANDLE	Handle
	)

Deletes an alarm audit of an object.

@unimplemented

Parameters

[in]	Object	An arbitrary pointer data that points to the object.
[in]	Handle	A handle of the said object.

Returns

Nothing.

Definition at line 1163 of file audit.c.

{
    UNIMPLEMENTED;
}

SeDetailedAuditingWithToken()

BOOLEAN NTAPI SeDetailedAuditingWithToken

(

_In_ PTOKEN

Token

)

Peforms a detailed security auditing with an access token.

@unimplemented

Parameters

[in]

Token

A valid token object.

Returns

To be added...

Definition at line 34 of file audit.c.

{
    /* FIXME */
    return FALSE;
}

Referenced by ObInitProcess(), PspCreateProcess(), and PspExitThread().

SeInitializeProcessAuditName()

NTSTATUS NTAPI SeInitializeProcessAuditName	(	_In_ PFILE_OBJECT	FileObject,
		_In_ BOOLEAN	DoAudit,
		_Out_ POBJECT_NAME_INFORMATION *	AuditInfo
	)

Initializes a process audit name and returns it to the caller.

Parameters

[in]	FileObject	File object that points to a name to be queried.
[in]	DoAudit	If set to TRUE, the function will perform various security auditing onto the audit name.
[out]	AuditInfo	The returned audit info data.

Returns

Returns STATUS_SUCCESS if process audit name initialization has completed successfully. STATUS_NO_MEMORY is returned if pool allocation for object name info has failed. A failure NTSTATUS code is returned otherwise.

Definition at line 105 of file audit.c.

{
    OBJECT_NAME_INFORMATION LocalNameInfo;
    POBJECT_NAME_INFORMATION ObjectNameInfo = NULL;
    ULONG ReturnLength = 8;
    NTSTATUS Status;
 
    PAGED_CODE();
    ASSERT(AuditInfo);
 
    /* Check if we should do auditing */
    if (DoAudit)
    {
        /* FIXME: TODO */
    }
 
    /* Now query the name */
    Status = ObQueryNameString(FileObject,
                               &LocalNameInfo,
                               sizeof(LocalNameInfo),
                               &ReturnLength);
    if (((Status == STATUS_BUFFER_OVERFLOW) ||
         (Status == STATUS_BUFFER_TOO_SMALL) ||
         (Status == STATUS_INFO_LENGTH_MISMATCH)) &&
        (ReturnLength != sizeof(LocalNameInfo)))
    {
        /* Allocate required size */
        ObjectNameInfo = ExAllocatePoolWithTag(NonPagedPool,
                                               ReturnLength,
                                               TAG_SEPA);
        if (ObjectNameInfo)
        {
            /* Query the name again */
            Status = ObQueryNameString(FileObject,
                                       ObjectNameInfo,
                                       ReturnLength,
                                       &ReturnLength);
        }
    }
 
    /* Check if we got here due to failure */
    if ((ObjectNameInfo) &&
        (!(NT_SUCCESS(Status)) || (ReturnLength == sizeof(LocalNameInfo))))
    {
        /* First, free any buffer we might've allocated */
        ASSERT(FALSE);
        if (ObjectNameInfo) ExFreePool(ObjectNameInfo);
 
        /* Now allocate a temporary one */
        ReturnLength = sizeof(OBJECT_NAME_INFORMATION);
        ObjectNameInfo = ExAllocatePoolWithTag(NonPagedPool,
                                               sizeof(OBJECT_NAME_INFORMATION),
                                               TAG_SEPA);
        if (ObjectNameInfo)
        {
            /* Clear it */
            RtlZeroMemory(ObjectNameInfo, ReturnLength);
            Status = STATUS_SUCCESS;
        }
    }
 
    /* Check if memory allocation failed */
    if (!ObjectNameInfo) Status = STATUS_NO_MEMORY;
 
    /* Return the audit name */
    *AuditInfo = ObjectNameInfo;
 
    /* Return status */
    return Status;
}

Referenced by MmInitializeProcessAddressSpace(), and SeLocateProcessImageName().

SeLocateProcessImageName()

NTSTATUS NTAPI SeLocateProcessImageName	(	_In_ PEPROCESS	Process,
		_Out_ PUNICODE_STRING *	ProcessImageName
	)

Finds the process image name of a specific process.

Parameters

[in]	Process	Process object submitted by the caller, where the image name is to be located.
[out]	ProcessImageName	An output Unicode string structure with the located process image name.

Returns

Returns STATUS_SUCCESS if process image name has been located successfully. STATUS_NO_MEMORY is returned if pool allocation for the image name has failed. A failure NTSTATUS code is returned otherwise.

Definition at line 199 of file audit.c.

{
    POBJECT_NAME_INFORMATION AuditName;
    PUNICODE_STRING ImageName;
    PFILE_OBJECT FileObject;
    NTSTATUS Status = STATUS_SUCCESS;
 
    PAGED_CODE();
 
    /* Assume failure */
    *ProcessImageName = NULL;
 
    /* Check if we have audit info */
    AuditName = Process->SeAuditProcessCreationInfo.ImageFileName;
    if (!AuditName)
    {
        /* Get the file object */
        Status = PsReferenceProcessFilePointer(Process, &FileObject);
        if (!NT_SUCCESS(Status)) return Status;
 
        /* Initialize the audit structure */
        Status = SeInitializeProcessAuditName(FileObject, TRUE, &AuditName);
        if (NT_SUCCESS(Status))
        {
            /* Set it */
            if (InterlockedCompareExchangePointer((PVOID*)&Process->
                                                  SeAuditProcessCreationInfo.ImageFileName,
                                                  AuditName,
                                                  NULL))
            {
                /* Someone beat us to it, deallocate our copy */
                ExFreePool(AuditName);
            }
        }
 
        /* Dereference the file object */
        ObDereferenceObject(FileObject);
        if (!NT_SUCCESS(Status)) return Status;
    }
 
    /* Get audit info again, now we have it for sure */
    AuditName = Process->SeAuditProcessCreationInfo.ImageFileName;
 
    /* Allocate the output string */
    ImageName = ExAllocatePoolWithTag(NonPagedPool,
                                      AuditName->Name.MaximumLength +
                                      sizeof(UNICODE_STRING),
                                      TAG_SEPA);
    if (!ImageName) return STATUS_NO_MEMORY;
 
    /* Make a copy of it */
    RtlCopyMemory(ImageName,
                  &AuditName->Name,
                  AuditName->Name.MaximumLength + sizeof(UNICODE_STRING));
 
    /* Fix up the buffer */
    ImageName->Buffer = (PWSTR)(ImageName + 1);
 
    /* Return it */
    *ProcessImageName = ImageName;
 
    /* Return status */
    return Status;
}

Referenced by NtQueryInformationProcess(), and QSI_DEF().

SeOpenObjectAuditAlarm()

VOID NTAPI SeOpenObjectAuditAlarm	(	_In_ PUNICODE_STRING	ObjectTypeName,
		_In_opt_ PVOID	Object,
		_In_opt_ PUNICODE_STRING	AbsoluteObjectName,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ PACCESS_STATE	AccessState,
		_In_ BOOLEAN	ObjectCreated,
		_In_ BOOLEAN	AccessGranted,
		_In_ KPROCESSOR_MODE	AccessMode,
		_Out_ PBOOLEAN	GenerateOnClose
	)

Creates an audit with alarm notification of an object that is being opened.

@unimplemented

Parameters

[in]	ObjectTypeName	A Unicode string that points to the object type name.
[in]	Object	If specified, the function will use this parameter to directly open the object.
[in]	AbsoluteObjectName	If specified, the function will use this parameter to directly open the object through the absolute name of the object.
[in]	SecurityDescriptor	A security descriptor.
[in]	AccessState	An access state right mask when opening the object.
[in]	ObjectCreated	Set this to TRUE if the object has been fully created, FALSE otherwise.
[in]	AccessGranted	Set this to TRUE if access was deemed as granted.
[in]	AccessMode	Processor level access mode.
[out]	GenerateOnClose	A boolean flag returned to the caller once audit generation procedure finishes.

Returns

Nothing.

Definition at line 1213 of file audit.c.

{
    PAGED_CODE();
 
    /* Audits aren't done on kernel-mode access */
    if (AccessMode == KernelMode) return;
 
    /* Otherwise, unimplemented! */
    //UNIMPLEMENTED;
    return;
}

Referenced by IopParseDevice(), NpCreateClientEnd(), NpCreateExistingNamedPipe(), and ObCheckObjectAccess().

SeOpenObjectForDeleteAuditAlarm()

VOID NTAPI SeOpenObjectForDeleteAuditAlarm	(	_In_ PUNICODE_STRING	ObjectTypeName,
		_In_opt_ PVOID	Object,
		_In_opt_ PUNICODE_STRING	AbsoluteObjectName,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ PACCESS_STATE	AccessState,
		_In_ BOOLEAN	ObjectCreated,
		_In_ BOOLEAN	AccessGranted,
		_In_ KPROCESSOR_MODE	AccessMode,
		_Out_ PBOOLEAN	GenerateOnClose
	)

Creates an audit with alarm notification of an object that is being opened for deletion.

@unimplemented

Parameters

[in]	ObjectTypeName	A Unicode string that points to the object type name.
[in]	Object	If specified, the function will use this parameter to directly open the object.
[in]	AbsoluteObjectName	If specified, the function will use this parameter to directly open the object through the absolute name of the object.
[in]	SecurityDescriptor	A security descriptor.
[in]	AccessState	An access state right mask when opening the object.
[in]	ObjectCreated	Set this to TRUE if the object has been fully created, FALSE otherwise.
[in]	AccessGranted	Set this to TRUE if access was deemed as granted.
[in]	AccessMode	Processor level access mode.
[out]	GenerateOnClose	A boolean flag returned to the caller once audit generation procedure finishes.

Returns

Nothing.

Definition at line 1276 of file audit.c.

{
    UNIMPLEMENTED;
}

SepAccessCheckAndAuditAlarm()

_Must_inspect_result_ NTSTATUS NTAPI SepAccessCheckAndAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ PHANDLE	ClientTokenHandle,
		_In_ PUNICODE_STRING	ObjectTypeName,
		_In_ PUNICODE_STRING	ObjectName,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_opt_ PSID	PrincipalSelfSid,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ AUDIT_EVENT_TYPE	AuditType,
		_In_ ULONG	Flags,
		_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST	ObjectTypeList,
		_In_ ULONG	ObjectTypeListLength,
		_In_ PGENERIC_MAPPING	GenericMapping,
		_Out_writes_(ObjectTypeListLength) PACCESS_MASK	GrantedAccessList,
		_Out_writes_(ObjectTypeListLength) PNTSTATUS	AccessStatusList,
		_Out_ PBOOLEAN	GenerateOnClose,
		_In_ BOOLEAN	UseResultList
	)

Performs security auditing, if the specific object can be granted security access or not.

Parameters

[in]	SubsystemName	A Unicode string that represents the name of a subsystem that actuates the auditing process.
[in]	HandleId	A handle to an ID used to identify an object where auditing is to be done.
[in]	SubjectContext	Security subject context.
[in]	ObjectTypeName	A Unicode string that represents the name of an object type.
[in]	ObjectName	The name of the object.
[in]	SecurityDescriptor	A security descriptor with internal security information details for audit.
[in]	PrincipalSelfSid	A principal self user SID.
[in]	DesiredAccess	The desired access rights masks requested by the caller.
[in]	AuditType	Type of audit to start. This parameter influences how an audit should be done.
[in]	Flags	Flag bitmask parameter.
[in]	HaveAuditPrivilege	If set to TRUE, the security subject context has the audit privilege thus it is allowed the ability to perform the audit.
[in]	ObjectTypeList	A list of object types.
[in]	ObjectTypeListLength	The length size of the list.
[in]	GenericMapping	The generic mapping table of access rights used whilst performing auditing sequence procedure.
[out]	GrantedAccessList	This parameter is used to return to the caller a list of actual granted access rights masks that the audited object has.
[out]	AccessStatusList	This parameter is used to return to the caller a list of status return codes. The function may actually return a single NTSTATUS code if the calling thread sets UseResultList parameter to FALSE.
[out]	GenerateOnClose	Returns TRUE if the function has generated a list of granted access rights and status codes on termination, FALSE otherwise.
[in]	UseResultList	If set to TRUE, the caller wants that the function should only return a single NTSTATUS code.

Returns

Returns STATUS_SUCCESS if the function has completed the whole internal auditing procedure mechanism with success. STATUS_INVALID_PARAMETER is returned if one of the parameters do not satisfy the general requirements by the function. STATUS_INSUFFICIENT_RESOURCES is returned if pool memory allocation has failed. STATUS_PRIVILEGE_NOT_HELD is returned if the current security subject context does not have the required audit privilege to actually perform auditing in the first place. STATUS_INVALID_SECURITY_DESCR is returned if the security descriptor provided by the caller is not valid, that is, such descriptor doesn't belong to the main user (owner) and current group. STATUS_GENERIC_NOT_MAPPED is returned if the access rights masks aren't actually mapped. A failure NTSTATUS code is returned otherwise.

Definition at line 614 of file audit.c.

{
    SECURITY_SUBJECT_CONTEXT SubjectContext;
    ULONG ResultListLength;
    GENERIC_MAPPING LocalGenericMapping;
    PTOKEN SubjectContextToken, ClientToken;
    BOOLEAN AllocatedResultLists;
    BOOLEAN HaveAuditPrivilege;
    PSECURITY_DESCRIPTOR CapturedSecurityDescriptor;
    UNICODE_STRING CapturedSubsystemName, CapturedObjectTypeName, CapturedObjectName;
    ACCESS_MASK GrantedAccess, *SafeGrantedAccessList;
    NTSTATUS AccessStatus, *SafeAccessStatusList;
    PSID CapturedPrincipalSelfSid;
    POBJECT_TYPE_LIST_INTERNAL CapturedObjectTypeList;
    ULONG i;
    BOOLEAN LocalGenerateOnClose;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Only user mode is supported! */
    ASSERT(ExGetPreviousMode() != KernelMode);
 
    /* Start clean */
    AllocatedResultLists = FALSE;
    ClientToken = NULL;
    CapturedSecurityDescriptor = NULL;
    CapturedSubsystemName.Buffer = NULL;
    CapturedObjectTypeName.Buffer = NULL;
    CapturedObjectName.Buffer = NULL;
    CapturedPrincipalSelfSid = NULL;
    CapturedObjectTypeList = NULL;
 
    /* Validate AuditType */
    if ((AuditType != AuditEventObjectAccess) &&
        (AuditType != AuditEventDirectoryServiceAccess))
    {
        DPRINT1("Invalid audit type: %u\n", AuditType);
        return STATUS_INVALID_PARAMETER;
    }
 
    /* Capture the security subject context */
    SeCaptureSubjectContext(&SubjectContext);
 
    /* Did the caller pass a token handle? */
    if (ClientTokenHandle == NULL)
    {
        /* Check if we have a token in the subject context */
        if (SubjectContext.ClientToken == NULL)
        {
            Status = STATUS_NO_IMPERSONATION_TOKEN;
            DPRINT1("No token\n");
            goto Cleanup;
        }
 
        /* Check if we have a valid impersonation level */
        if (SubjectContext.ImpersonationLevel < SecurityIdentification)
        {
            Status = STATUS_BAD_IMPERSONATION_LEVEL;
            DPRINT1("Invalid impersonation level 0x%lx\n",
                    SubjectContext.ImpersonationLevel);
            goto Cleanup;
        }
    }
 
    /* Are we using a result list? */
    if (UseResultList)
    {
        /* The list length equals the object type list length */
        ResultListLength = ObjectTypeListLength;
        if ((ResultListLength == 0) || (ResultListLength > 0x1000))
        {
            Status = STATUS_INVALID_PARAMETER;
            DPRINT1("Invalid ResultListLength: 0x%lx\n", ResultListLength);
            goto Cleanup;
        }
 
        /* Allocate a safe buffer from paged pool */
        SafeGrantedAccessList = ExAllocatePoolWithTag(PagedPool,
                                                      2 * ResultListLength * sizeof(ULONG),
                                                      TAG_SEPA);
        if (SafeGrantedAccessList == NULL)
        {
            Status = STATUS_INSUFFICIENT_RESOURCES;
            DPRINT1("Failed to allocate access lists\n");
            goto Cleanup;
        }
 
        SafeAccessStatusList = (PNTSTATUS)&SafeGrantedAccessList[ResultListLength];
        AllocatedResultLists = TRUE;
    }
    else
    {
        /* List length is 1 */
        ResultListLength = 1;
        SafeGrantedAccessList = &GrantedAccess;
        SafeAccessStatusList = &AccessStatus;
    }
 
    _SEH2_TRY
    {
        /* Probe output buffers */
        ProbeForWrite(AccessStatusList,
                      ResultListLength * sizeof(*AccessStatusList),
                      sizeof(*AccessStatusList));
        ProbeForWrite(GrantedAccessList,
                      ResultListLength * sizeof(*GrantedAccessList),
                      sizeof(*GrantedAccessList));
 
        /* Probe generic mapping and make a local copy */
        ProbeForRead(GenericMapping, sizeof(*GenericMapping), sizeof(ULONG));
        LocalGenericMapping = * GenericMapping;
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        Status = _SEH2_GetExceptionCode();
        DPRINT1("Exception while probing parameters: 0x%lx\n", Status);
        _SEH2_YIELD(goto Cleanup);
    }
    _SEH2_END;
 
    /* Do we have a client token? */
    if (ClientTokenHandle != NULL)
    {
        /* Reference the client token */
        Status = ObReferenceObjectByHandle(*ClientTokenHandle,
                                           TOKEN_QUERY,
                                           SeTokenObjectType,
                                           UserMode,
                                           (PVOID*)&ClientToken,
                                           NULL);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("Failed to reference token handle %p: %lx\n",
                    *ClientTokenHandle, Status);
            goto Cleanup;
        }
 
        SubjectContextToken = SubjectContext.ClientToken;
        SubjectContext.ClientToken = ClientToken;
    }
 
    /* Check for audit privilege */
    HaveAuditPrivilege = SeCheckAuditPrivilege(&SubjectContext, UserMode);
    if (!HaveAuditPrivilege && !(Flags & AUDIT_ALLOW_NO_PRIVILEGE))
    {
        DPRINT1("Caller does not have SeAuditPrivilege\n");
        Status = STATUS_PRIVILEGE_NOT_HELD;
        goto Cleanup;
    }
 
    /* Generic access must already be mapped to non-generic access types! */
    if (DesiredAccess & (GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL))
    {
        DPRINT1("Generic access rights requested: 0x%lx\n", DesiredAccess);
        Status = STATUS_GENERIC_NOT_MAPPED;
        goto Cleanup;
    }
 
    /* Capture the security descriptor */
    Status = SeCaptureSecurityDescriptor(SecurityDescriptor,
                                         UserMode,
                                         PagedPool,
                                         FALSE,
                                         &CapturedSecurityDescriptor);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to capture security descriptor!\n");
        goto Cleanup;
    }
 
    /* Validate the Security descriptor */
    if ((SepGetOwnerFromDescriptor(CapturedSecurityDescriptor) == NULL) ||
        (SepGetGroupFromDescriptor(CapturedSecurityDescriptor) == NULL))
    {
        Status = STATUS_INVALID_SECURITY_DESCR;
        DPRINT1("Invalid security descriptor\n");
        goto Cleanup;
    }
 
    /* Probe and capture the subsystem name */
    Status = ProbeAndCaptureUnicodeString(&CapturedSubsystemName,
                                          UserMode,
                                          SubsystemName);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to capture subsystem name!\n");
        goto Cleanup;
    }
 
    /* Probe and capture the object type name */
    Status = ProbeAndCaptureUnicodeString(&CapturedObjectTypeName,
                                          UserMode,
                                          ObjectTypeName);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to capture object type name!\n");
        goto Cleanup;
    }
 
    /* Probe and capture the object name */
    Status = ProbeAndCaptureUnicodeString(&CapturedObjectName,
                                          UserMode,
                                          ObjectName);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to capture object name!\n");
        goto Cleanup;
    }
 
    /* Check if we have a PrincipalSelfSid */
    if (PrincipalSelfSid != NULL)
    {
        /* Capture it */
        Status = SepCaptureSid(PrincipalSelfSid,
                               UserMode,
                               PagedPool,
                               FALSE,
                               &CapturedPrincipalSelfSid);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("Failed to capture PrincipalSelfSid!\n");
            goto Cleanup;
        }
    }
 
    /* Capture the object type list */
    Status = SeCaptureObjectTypeList(ObjectTypeList,
                                     ObjectTypeListLength,
                                     UserMode,
                                     &CapturedObjectTypeList);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to capture object type list!\n");
        goto Cleanup;
    }
 
    /* Call the worker routine with the captured buffers */
    Status = SepAccessCheckAndAuditAlarmWorker(&CapturedSubsystemName,
                                               HandleId,
                                               &SubjectContext,
                                               &CapturedObjectTypeName,
                                               &CapturedObjectName,
                                               CapturedSecurityDescriptor,
                                               CapturedPrincipalSelfSid,
                                               DesiredAccess,
                                               AuditType,
                                               HaveAuditPrivilege,
                                               CapturedObjectTypeList,
                                               ObjectTypeListLength,
                                               &LocalGenericMapping,
                                               SafeGrantedAccessList,
                                               SafeAccessStatusList,
                                               &LocalGenerateOnClose,
                                               UseResultList);
    if (!NT_SUCCESS(Status))
        goto Cleanup;
 
    /* Enter SEH to copy the data back to user mode */
    _SEH2_TRY
    {
        /* Loop all result entries (only 1 when no list was requested) */
        ASSERT(UseResultList || (ResultListLength == 1));
        for (i = 0; i < ResultListLength; i++)
        {
            AccessStatusList[i] = SafeAccessStatusList[i];
            GrantedAccessList[i] = SafeGrantedAccessList[i];
        }
 
        *GenerateOnClose = LocalGenerateOnClose;
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        Status = _SEH2_GetExceptionCode();
        DPRINT1("Exception while copying back data: 0x%lx\n", Status);
    }
    _SEH2_END;
 
Cleanup:
 
    if (CapturedObjectTypeList != NULL)
        SeReleaseObjectTypeList(CapturedObjectTypeList, UserMode);
 
    if (CapturedPrincipalSelfSid != NULL)
        SepReleaseSid(CapturedPrincipalSelfSid, UserMode, FALSE);
 
    if (CapturedObjectName.Buffer != NULL)
        ReleaseCapturedUnicodeString(&CapturedObjectName, UserMode);
 
    if (CapturedObjectTypeName.Buffer != NULL)
        ReleaseCapturedUnicodeString(&CapturedObjectTypeName, UserMode);
 
    if (CapturedSubsystemName.Buffer != NULL)
        ReleaseCapturedUnicodeString(&CapturedSubsystemName, UserMode);
 
    if (CapturedSecurityDescriptor != NULL)
        SeReleaseSecurityDescriptor(CapturedSecurityDescriptor, UserMode, FALSE);
 
    if (ClientToken != NULL)
    {
        ObDereferenceObject(ClientToken);
        SubjectContext.ClientToken = SubjectContextToken;
    }
 
    if (AllocatedResultLists)
        ExFreePoolWithTag(SafeGrantedAccessList, TAG_SEPA);
 
    /* Release the security subject context */
    SeReleaseSubjectContext(&SubjectContext);
 
    return Status;
}

Referenced by NtAccessCheckAndAuditAlarm(), NtAccessCheckByTypeAndAuditAlarm(), NtAccessCheckByTypeResultListAndAuditAlarm(), and NtAccessCheckByTypeResultListAndAuditAlarmByHandle().

SepAccessCheckAndAuditAlarmWorker()

static _Must_inspect_result_ NTSTATUS SepAccessCheckAndAuditAlarmWorker ( _In_ PUNICODE_STRING  SubsystemName, _In_opt_ PVOID  HandleId, _In_ PSECURITY_SUBJECT_CONTEXT  SubjectContext, _In_ PUNICODE_STRING  ObjectTypeName, _In_ PUNICODE_STRING  ObjectName, _In_ PSECURITY_DESCRIPTOR  SecurityDescriptor, _In_opt_ PSID  PrincipalSelfSid, _In_ ACCESS_MASK  DesiredAccess, _In_ AUDIT_EVENT_TYPE  AuditType, _In_ BOOLEAN  HaveAuditPrivilege, _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST_INTERNAL  ObjectTypeList, _In_ ULONG  ObjectTypeListLength, _In_ PGENERIC_MAPPING  GenericMapping, _Out_writes_(ObjectTypeListLength) PACCESS_MASK  GrantedAccessList, _Out_writes_(ObjectTypeListLength) PNTSTATUS  AccessStatusList, _Out_ PBOOLEAN  GenerateOnClose, _In_ BOOLEAN  UseResultList  )

static

Worker function that serves as the main heart and brain of the whole concept and implementation of auditing in the kernel.

@unimplemented

Parameters

[in]	SubsystemName	A Unicode string that represents the name of a subsystem that actuates the auditing process.
[in]	HandleId	A handle to an ID used to identify an object where auditing is to be done.
[in]	SubjectContext	Security subject context.
[in]	ObjectTypeName	A Unicode string that represents the name of an object type.
[in]	ObjectName	The name of the object.
[in]	SecurityDescriptor	A security descriptor with internal security information details for audit.
[in]	PrincipalSelfSid	A principal self user SID.
[in]	DesiredAccess	The desired access rights masks requested by the caller.
[in]	AuditType	Type of audit to start. This parameter influences how an audit should be done.
[in]	HaveAuditPrivilege	If set to TRUE, the security subject context has the audit privilege thus it is allowed the ability to perform the audit.
[in]	ObjectTypeList	A list of object types.
[in]	ObjectTypeListLength	The length size of the list.
[in]	GenericMapping	The generic mapping table of access rights used whilst performing auditing sequence procedure.
[out]	GrantedAccessList	This parameter is used to return to the caller a list of actual granted access rights masks that the audited object has.
[out]	AccessStatusList	This parameter is used to return to the caller a list of status return codes. The function may actually return a single NTSTATUS code if the calling thread sets UseResultList parameter to FALSE.
[out]	GenerateOnClose	Returns TRUE if the function has generated a list of granted access rights and status codes on termination, FALSE otherwise.
[in]	UseResultList	If set to TRUE, the caller wants that the function should only return a single NTSTATUS code.

Returns

Returns STATUS_SUCCESS if the function has completed the whole internal auditing procedure mechanism with success.

FIXME: we should do some real work here...

HACK: we just pretend all access is granted!

Definition at line 489 of file audit.c.

{
    ULONG ResultListLength, i;
 
    /* Get the length of the result list */
    ResultListLength = UseResultList ? ObjectTypeListLength : 1;
 
    UNIMPLEMENTED;
 
    for (i = 0; i < ResultListLength; i++)
    {
        GrantedAccessList[i] = DesiredAccess;
        AccessStatusList[i] = STATUS_SUCCESS;
    }
 
    *GenerateOnClose = FALSE;
 
    return STATUS_SUCCESS;
}

Referenced by SepAccessCheckAndAuditAlarm().

SepAdtCloseObjectAuditAlarm()

VOID NTAPI SepAdtCloseObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_ PVOID	HandleId,
		_In_ PSID	Sid
	)

Closes an audit alarm event of an object.

Parameters

[in]	SubsystemName	A Unicode string pointing to the name of the subsystem where auditing alarm event has to be closed.
[in]	HandleId	A handle to an ID where such ID represents the identification of the object where audit alarm is to be closed.
[in]	Sid	A SID that represents the user who attempted to close the audit alarm.

Returns

Nothing.

Definition at line 287 of file audit.c.

{
    UNIMPLEMENTED;
}

Referenced by NtCloseObjectAuditAlarm().

SepAdtPrivilegedServiceAuditAlarm()

VOID NTAPI SepAdtPrivilegedServiceAuditAlarm	(	_In_ PSECURITY_SUBJECT_CONTEXT	SubjectContext,
		_In_opt_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PUNICODE_STRING	ServiceName,
		_In_ PTOKEN	Token,
		_In_ PTOKEN	PrimaryToken,
		_In_ PPRIVILEGE_SET	Privileges,
		_In_ BOOLEAN	AccessGranted
	)

Performs an audit alarm to a privileged service request. This is a worker function.

Parameters

[in]	SubjectContext	A security subject context used for the auditing process.
[in]	SubsystemName	A Unicode string that represents the name of a subsystem that actuated the procedure of alarm auditing of a privileged service.
[in]	ServiceName	A Unicode string that represents the name of a privileged service request for auditing.
[in]	Token	An access token.
[in]	PrimaryToken	A primary access token.
[in]	Privileges	An array set of privileges used to check if the privileged service does actually have all the required set of privileges for security access.
[in]	AccessGranted	When auditing is done, the function will return TRUE to the caller if access is granted, FALSE otherwise.

Returns

Nothing.

Definition at line 332 of file audit.c.

{
    DPRINT("SepAdtPrivilegedServiceAuditAlarm is unimplemented\n");
}

Referenced by NtPrivilegedServiceAuditAlarm(), and SePrivilegedServiceAuditAlarm().

SepOpenObjectAuditAlarm()

VOID NTAPI SepOpenObjectAuditAlarm	(	_In_ PSECURITY_SUBJECT_CONTEXT	SubjectContext,
		_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ PUNICODE_STRING	ObjectTypeName,
		_In_ PUNICODE_STRING	ObjectName,
		_In_opt_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ PTOKEN	ClientToken,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ ACCESS_MASK	GrantedAccess,
		_In_opt_ PPRIVILEGE_SET	Privileges,
		_In_ BOOLEAN	ObjectCreation,
		_In_ BOOLEAN	AccessGranted,
		_Out_ PBOOLEAN	GenerateOnClose
	)

Raises an alarm audit message when an object is about to be opened.

@unimplemented

Parameters

[in]	SubjectContext	A security subject context for auditing.
[in]	SubsystemName	A Unicode string that points to a name of the subsystem.
[in]	HandleId	A handle to an ID used for identification instance for auditing.
[in]	ObjectTypeName	A Unicode string that points to an object type name.
[in]	ObjectName	The name of the object.
[in]	SecurityDescriptor	A security descriptor.
[in]	ClientToken	A client access token, representing the client we want to impersonate.
[in]	DesiredAccess	The desired access rights masks requested by the caller.
[in]	GrantedAccess	The granted access mask rights.
[in]	Privileges	If specified, the function will use this set of privileges to audit.
[in]	ObjectCreation	Set this to TRUE if the object has just been created.
[in]	AccessGranted	Set this to TRUE if the access attempt was deemed as granted.
[out]	GenerateOnClose	A boolean flag returned to the caller once audit generation procedure finishes.

Returns

Nothing.

Definition at line 1535 of file audit.c.

{
    DBG_UNREFERENCED_PARAMETER(SubjectContext);
    DBG_UNREFERENCED_PARAMETER(SubsystemName);
    DBG_UNREFERENCED_PARAMETER(HandleId);
    DBG_UNREFERENCED_PARAMETER(ObjectTypeName);
    DBG_UNREFERENCED_PARAMETER(ObjectName);
    DBG_UNREFERENCED_PARAMETER(SecurityDescriptor);
    DBG_UNREFERENCED_PARAMETER(ClientToken);
    DBG_UNREFERENCED_PARAMETER(DesiredAccess);
    DBG_UNREFERENCED_PARAMETER(GrantedAccess);
    DBG_UNREFERENCED_PARAMETER(Privileges);
    DBG_UNREFERENCED_PARAMETER(ObjectCreation);
    DBG_UNREFERENCED_PARAMETER(AccessGranted);
    UNIMPLEMENTED;
    *GenerateOnClose = FALSE;
}

Referenced by NtOpenObjectAuditAlarm().

SePrivilegedServiceAuditAlarm()

VOID NTAPI SePrivilegedServiceAuditAlarm	(	_In_opt_ PUNICODE_STRING	ServiceName,
		_In_ PSECURITY_SUBJECT_CONTEXT	SubjectContext,
		_In_ PPRIVILEGE_SET	PrivilegeSet,
		_In_ BOOLEAN	AccessGranted
	)

Performs an audit alarm to a privileged service request.

Parameters

[in]	ServiceName	A Unicode string that represents the name of a privileged service request for auditing.
[in]	SubjectContext	A security subject context used for the auditing process.
[in]	PrivilegeSet	An array set of privileges used to check if the privileged service does actually have all the required set of privileges for security access.
[in]	AccessGranted	When auditing is done, the function will return TRUE to the caller if access is granted, FALSE otherwise.

Returns

Nothing.

Definition at line 369 of file audit.c.

{
    PTOKEN EffectiveToken;
    PSID UserSid;
    PAGED_CODE();
 
    /* Get the effective token */
    if (SubjectContext->ClientToken != NULL)
        EffectiveToken = SubjectContext->ClientToken;
    else
        EffectiveToken = SubjectContext->PrimaryToken;
 
    /* Get the user SID */
    UserSid = EffectiveToken->UserAndGroups->Sid;
 
    /* Check if this is the local system SID */
    if (RtlEqualSid(UserSid, SeLocalSystemSid))
    {
        /* Nothing to do */
        return;
    }
 
    /* Check if this is the network service or local service SID */
    if (RtlEqualSid(UserSid, SeExports->SeNetworkServiceSid) ||
        RtlEqualSid(UserSid, SeExports->SeLocalServiceSid))
    {
        // FIXME: should continue for a certain set of privileges
        return;
    }
 
    /* Call the worker function */
    SepAdtPrivilegedServiceAuditAlarm(SubjectContext,
                                      &SeSubsystemName,
                                      ServiceName,
                                      SubjectContext->ClientToken,
                                      SubjectContext->PrimaryToken,
                                      PrivilegeSet,
                                      AccessGranted);
 
}

Referenced by SeCheckAuditPrivilege(), and SeSinglePrivilegeCheck().

SePrivilegeObjectAuditAlarm()

VOID NTAPI SePrivilegeObjectAuditAlarm	(	_In_ HANDLE	Handle,
		_In_ PSECURITY_SUBJECT_CONTEXT	SubjectContext,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ PPRIVILEGE_SET	Privileges,
		_In_ BOOLEAN	AccessGranted,
		_In_ KPROCESSOR_MODE	CurrentMode
	)

Raises an audit with alarm notification message when an object tries to acquire this privilege.

@unimplemented

Parameters

[in]	Handle	A handle to an object.
[in]	SubjectContext	The security subject context for auditing.
[in]	DesiredAccess	The desired right access masks requested by the caller.
[in]	Privileges	An array set of privileges for auditing.
[out]	AccessGranted	When the auditing procedure routine ends, it returns TRUE to the caller if the object has the required privileges for access, FALSE otherwise.
[in]	CurrentMode	Processor level access mode.

Returns

Nothing.

Definition at line 1321 of file audit.c.

{
    UNIMPLEMENTED;
}

Referenced by HasPrivilege(), ObpCreateHandle(), and SeCheckPrivilegedObject().

Variable Documentation

SeSubsystemName

UNICODE_STRING SeSubsystemName = RTL_CONSTANT_STRING(L"Security")

Definition at line 17 of file audit.c.

Referenced by SePrivilegedServiceAuditAlarm().