se.h File Reference

Go to the source code of this file.

Classes
struct	_KNOWN_ACE
struct	_KNOWN_OBJECT_ACE
struct	_KNOWN_COMPOUND_ACE
struct	_ACCESS_CHECK_RIGHTS
struct	_TOKEN_AUDIT_POLICY_INFORMATION

Macros
#define	TOKEN_CREATE_METHOD   0xCUL
#define	TOKEN_DUPLICATE_METHOD   0xDUL
#define	TOKEN_FILTER_METHOD   0xFUL
#define	SepAcquireTokenLockExclusive(Token)
#define	SepAcquireTokenLockShared(Token)
#define	SepReleaseTokenLock(Token)

Typedefs
typedef struct _KNOWN_ACE	KNOWN_ACE
typedef struct _KNOWN_ACE *	PKNOWN_ACE
typedef struct _KNOWN_OBJECT_ACE	KNOWN_OBJECT_ACE
typedef struct _KNOWN_OBJECT_ACE *	PKNOWN_OBJECT_ACE
typedef struct _KNOWN_COMPOUND_ACE	KNOWN_COMPOUND_ACE
typedef struct _KNOWN_COMPOUND_ACE *	PKNOWN_COMPOUND_ACE
typedef struct _ACCESS_CHECK_RIGHTS	ACCESS_CHECK_RIGHTS
typedef struct _ACCESS_CHECK_RIGHTS *	PACCESS_CHECK_RIGHTS
typedef enum _ACCESS_CHECK_RIGHT_TYPE	ACCESS_CHECK_RIGHT_TYPE
typedef struct _TOKEN_AUDIT_POLICY_INFORMATION	TOKEN_AUDIT_POLICY_INFORMATION
typedef struct _TOKEN_AUDIT_POLICY_INFORMATION *	PTOKEN_AUDIT_POLICY_INFORMATION

Enumerations
enum	_ACCESS_CHECK_RIGHT_TYPE { AccessCheckMaximum, AccessCheckRegular }

Functions
FORCEINLINE PSID	SepGetGroupFromDescriptor (_Inout_ PVOID _Descriptor)
FORCEINLINE PSID	SepGetOwnerFromDescriptor (_Inout_ PVOID _Descriptor)
FORCEINLINE PACL	SepGetDaclFromDescriptor (_Inout_ PVOID _Descriptor)
FORCEINLINE PACL	SepGetSaclFromDescriptor (_Inout_ PVOID _Descriptor)
VOID NTAPI	SepInitializeTokenImplementation (VOID)
	Internal function that initializes critical kernel data for access token implementation in SRM. More...
PTOKEN NTAPI	SepCreateSystemProcessToken (VOID)
	Creates the system process token. More...
PTOKEN	SepCreateSystemAnonymousLogonToken (VOID)
	Creates the anonymous logon token for the system. The difference between this token and the other one is the inclusion of everyone SID group (being SeWorldSid). The other token lacks such group. More...
PTOKEN	SepCreateSystemAnonymousLogonTokenNoEveryone (VOID)
	Creates the anonymous logon token for the system. This kind of token doesn't include the everyone SID group (being SeWorldSid). More...
NTSTATUS NTAPI	SepDuplicateToken (_In_ PTOKEN Token, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ BOOLEAN EffectiveOnly, _In_ TOKEN_TYPE TokenType, _In_ SECURITY_IMPERSONATION_LEVEL Level, _In_ KPROCESSOR_MODE PreviousMode, _Out_ PTOKEN *NewAccessToken)
	Duplicates an access token, from an existing valid token. More...
NTSTATUS NTAPI	SepCreateToken (_Out_ PHANDLE TokenHandle, _In_ KPROCESSOR_MODE PreviousMode, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ TOKEN_TYPE TokenType, _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, _In_ PLUID AuthenticationId, _In_ PLARGE_INTEGER ExpirationTime, _In_ PSID_AND_ATTRIBUTES User, _In_ ULONG GroupCount, _In_ PSID_AND_ATTRIBUTES Groups, _In_ ULONG GroupsLength, _In_ ULONG PrivilegeCount, _In_ PLUID_AND_ATTRIBUTES Privileges, _In_opt_ PSID Owner, _In_ PSID PrimaryGroup, _In_opt_ PACL DefaultDacl, _In_ PTOKEN_SOURCE TokenSource, _In_ BOOLEAN SystemToken)
	Internal function responsible for access token object creation in the kernel. A fully created token objected is inserted into the token handle, thus the handle becoming a valid handle to an access token object and ready for use. More...
BOOLEAN NTAPI	SepTokenIsOwner (_In_ PACCESS_TOKEN _Token, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ BOOLEAN TokenLocked)
	Checks if a token belongs to the main user, being the owner. More...
NTSTATUS	SepCreateTokenLock (_Inout_ PTOKEN Token)
	Creates a lock for the token. More...
VOID	SepDeleteTokenLock (_Inout_ PTOKEN Token)
	Deletes a lock of a token. More...
VOID	SepUpdatePrivilegeFlagsToken (_Inout_ PTOKEN Token)
	Updates the token's flags based upon the privilege that the token has been granted. The function uses the private helper, SepUpdateSinglePrivilegeFlagToken, in order to update the flags of a token. More...
NTSTATUS	SepFindPrimaryGroupAndDefaultOwner (_In_ PTOKEN Token, _In_ PSID PrimaryGroup, _In_opt_ PSID DefaultOwner, _Out_opt_ PULONG PrimaryGroupIndex, _Out_opt_ PULONG DefaultOwnerIndex)
	Finds the primary group and default owner entity based on the submitted primary group instance and an access token. More...
VOID	SepUpdateSinglePrivilegeFlagToken (_Inout_ PTOKEN Token, _In_ ULONG Index)
	Updates the token's flags based upon the privilege that the token has been granted. The flag can either be taken out or given to the token if the attributes of the specified privilege is enabled or not. More...
VOID	SepRemovePrivilegeToken (_Inout_ PTOKEN Token, _In_ ULONG Index)
	Removes a privilege from the token. More...
VOID	SepRemoveUserGroupToken (_Inout_ PTOKEN Token, _In_ ULONG Index)
	Removes a group from the token. More...
ULONG	SepComputeAvailableDynamicSpace (_In_ ULONG DynamicCharged, _In_ PSID PrimaryGroup, _In_opt_ PACL DefaultDacl)
	Computes the exact available dynamic area of an access token whilst querying token statistics. More...
NTSTATUS	SepRebuildDynamicPartOfToken (_In_ PTOKEN Token, _In_ ULONG NewDynamicPartSize)
BOOLEAN NTAPI	SeTokenCanImpersonate (_In_ PTOKEN ProcessToken, _In_ PTOKEN TokenToImpersonate, _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
	Ensures that client impersonation can occur by checking if the token we're going to assign as the impersonation token can be actually impersonated in the first place. The routine is used primarily by PsImpersonateClient. More...
VOID NTAPI	SeGetTokenControlInformation (_In_ PACCESS_TOKEN _Token, _Out_ PTOKEN_CONTROL TokenControl)
	Retrieves token control information. More...
VOID NTAPI	SeDeassignPrimaryToken (_Inout_ PEPROCESS Process)
	Removes the primary token of a process. More...
NTSTATUS NTAPI	SeSubProcessToken (_In_ PTOKEN Parent, _Out_ PTOKEN *Token, _In_ BOOLEAN InUse, _In_ ULONG SessionId)
	Subtracts a token in exchange of duplicating a new one. More...
NTSTATUS NTAPI	SeIsTokenChild (_In_ PTOKEN Token, _Out_ PBOOLEAN IsChild)
	Checks if the token is a child of the other token of the current process that the calling thread is invoking this function. More...
NTSTATUS NTAPI	SeIsTokenSibling (_In_ PTOKEN Token, _Out_ PBOOLEAN IsSibling)
	Checks if the token is a sibling of the other token of the current process that the calling thread is invoking this function. More...
NTSTATUS NTAPI	SeExchangePrimaryToken (_In_ PEPROCESS Process, _In_ PACCESS_TOKEN NewAccessToken, _Out_ PACCESS_TOKEN *OldAccessToken)
	Replaces the old access token of a process (pointed by the EPROCESS kernel structure) with a new access token. The new access token must be a primary token for use. More...
NTSTATUS NTAPI	SeCopyClientToken (_In_ PACCESS_TOKEN Token, _In_ SECURITY_IMPERSONATION_LEVEL Level, _In_ KPROCESSOR_MODE PreviousMode, _Out_ PACCESS_TOKEN *NewToken)
	Copies an existing access token (technically duplicating a new one). More...
BOOLEAN NTAPI	SeTokenIsInert (_In_ PTOKEN Token)
	Determines if a token is a sandbox inert token or not, based upon the token flags. More...
ULONG	RtlLengthSidAndAttributes (_In_ ULONG Count, _In_ PSID_AND_ATTRIBUTES Src)
	Computes the length size of a SID. More...
BOOLEAN NTAPI	SeInitSystem (VOID)
	Main security manager initialization function. More...
NTSTATUS NTAPI	SeDefaultObjectMethod (_In_ PVOID Object, _In_ SECURITY_OPERATION_CODE OperationType, _In_ PSECURITY_INFORMATION SecurityInformation, _Inout_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor, _Inout_opt_ PULONG ReturnLength, _Inout_opt_ PSECURITY_DESCRIPTOR *OldSecurityDescriptor, _In_ POOL_TYPE PoolType, _In_ PGENERIC_MAPPING GenericMapping)
VOID NTAPI	SeQuerySecurityAccessMask (_In_ SECURITY_INFORMATION SecurityInformation, _Out_ PACCESS_MASK DesiredAccess)
	Queries the access mask from a security information context. More...
VOID NTAPI	SeSetSecurityAccessMask (_In_ SECURITY_INFORMATION SecurityInformation, _Out_ PACCESS_MASK DesiredAccess)
	Sets the access mask for a security information context. More...
VOID NTAPI	SepInitPrivileges (VOID)
	Initializes the privileges during the startup phase of the security manager module. This function serves as a placeholder as it currently does nothing. More...
BOOLEAN NTAPI	SepPrivilegeCheck (_In_ PTOKEN Token, _In_ PLUID_AND_ATTRIBUTES Privileges, _In_ ULONG PrivilegeCount, _In_ ULONG PrivilegeControl, _In_ KPROCESSOR_MODE PreviousMode)
	Checks the privileges pointed by Privileges array argument if they exist and match with the privileges from an access token. More...
NTSTATUS NTAPI	SePrivilegePolicyCheck (_Inout_ PACCESS_MASK DesiredAccess, _Inout_ PACCESS_MASK GrantedAccess, _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_ PTOKEN Token, _Out_opt_ PPRIVILEGE_SET *OutPrivilegeSet, _In_ KPROCESSOR_MODE PreviousMode)
	Checks the security policy and returns a set of privileges based upon the said security policy context. More...
BOOLEAN NTAPI	SeCheckAuditPrivilege (_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_ KPROCESSOR_MODE PreviousMode)
	Checks a single privilege and performs an audit against a privileged service based on a security subject context. More...
BOOLEAN NTAPI	SeCheckPrivilegedObject (_In_ LUID PrivilegeValue, _In_ HANDLE ObjectHandle, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE PreviousMode)
	Checks a privileged object if such object has the specific privilege submitted by the caller. More...
NTSTATUS NTAPI	SeCaptureLuidAndAttributesArray (_In_ PLUID_AND_ATTRIBUTES Src, _In_ ULONG PrivilegeCount, _In_ KPROCESSOR_MODE PreviousMode, _In_ PLUID_AND_ATTRIBUTES AllocatedMem, _In_ ULONG AllocatedLength, _In_ POOL_TYPE PoolType, _In_ BOOLEAN CaptureIfKernel, _Out_ PLUID_AND_ATTRIBUTES *Dest, _Inout_ PULONG Length)
VOID NTAPI	SeReleaseLuidAndAttributesArray (_In_ PLUID_AND_ATTRIBUTES Privilege, _In_ KPROCESSOR_MODE PreviousMode, _In_ BOOLEAN CaptureIfKernel)
	Releases a LUID with attributes structure. More...
BOOLEAN NTAPI	SepInitSecurityIDs (VOID)
	Initializes all the SIDs known in the system. More...
NTSTATUS NTAPI	SepCaptureSid (_In_ PSID InputSid, _In_ KPROCESSOR_MODE AccessMode, _In_ POOL_TYPE PoolType, _In_ BOOLEAN CaptureIfKernel, _Out_ PSID *CapturedSid)
	Captures a SID. More...
VOID NTAPI	SepReleaseSid (_In_ PSID CapturedSid, _In_ KPROCESSOR_MODE AccessMode, _In_ BOOLEAN CaptureIfKernel)
	Releases a captured SID. More...
BOOLEAN NTAPI	SepSidInToken (_In_ PACCESS_TOKEN _Token, _In_ PSID Sid)
	Checks if a SID is present in a token. More...
BOOLEAN NTAPI	SepSidInTokenEx (_In_ PACCESS_TOKEN _Token, _In_ PSID PrincipalSelfSid, _In_ PSID _Sid, _In_ BOOLEAN Deny, _In_ BOOLEAN Restricted)
	Checks if a SID is present in a token. More...
PSID NTAPI	SepGetSidFromAce (_In_ UCHAR AceType, _In_ PACE Ace)
	Captures a security identifier from a given access control entry. This identifier is valid for the whole of its lifetime. More...
NTSTATUS NTAPI	SeCaptureSidAndAttributesArray (_In_ PSID_AND_ATTRIBUTES SrcSidAndAttributes, _In_ ULONG AttributeCount, _In_ KPROCESSOR_MODE PreviousMode, _In_opt_ PVOID AllocatedMem, _In_ ULONG AllocatedLength, _In_ POOL_TYPE PoolType, _In_ BOOLEAN CaptureIfKernel, _Out_ PSID_AND_ATTRIBUTES *CapturedSidAndAttributes, _Out_ PULONG ResultLength)
	Captures a SID with attributes. More...
VOID NTAPI	SeReleaseSidAndAttributesArray (_In_ _Post_invalid_ PSID_AND_ATTRIBUTES CapturedSidAndAttributes, _In_ KPROCESSOR_MODE AccessMode, _In_ BOOLEAN CaptureIfKernel)
	Releases a captured SID with attributes. More...
BOOLEAN NTAPI	SepInitDACLs (VOID)
	Initializes known discretionary access control lists in the system upon kernel and Executive initialization procedure. More...
NTSTATUS NTAPI	SepCreateImpersonationTokenDacl (_In_ PTOKEN Token, _In_ PTOKEN PrimaryToken, _Out_ PACL *Dacl)
	Allocates a discretionary access control list based on certain properties of a regular and primary access tokens. More...
NTSTATUS NTAPI	SepCaptureAcl (_In_ PACL InputAcl, _In_ KPROCESSOR_MODE AccessMode, _In_ POOL_TYPE PoolType, _In_ BOOLEAN CaptureIfKernel, _Out_ PACL *CapturedAcl)
	Captures an access control list from an already valid input ACL. More...
VOID NTAPI	SepReleaseAcl (_In_ PACL CapturedAcl, _In_ KPROCESSOR_MODE AccessMode, _In_ BOOLEAN CaptureIfKernel)
	Releases (frees) a captured ACL from the memory pool. More...
NTSTATUS	SepPropagateAcl (_Out_writes_bytes_opt_(DaclLength) PACL AclDest, _Inout_ PULONG AclLength, _In_reads_bytes_(AclSource->AclSize) PACL AclSource, _In_ PSID Owner, _In_ PSID Group, _In_ BOOLEAN IsInherited, _In_ BOOLEAN IsDirectoryObject, _In_ PGENERIC_MAPPING GenericMapping)
PACL	SepSelectAcl (_In_opt_ PACL ExplicitAcl, _In_ BOOLEAN ExplicitPresent, _In_ BOOLEAN ExplicitDefaulted, _In_opt_ PACL ParentAcl, _In_opt_ PACL DefaultAcl, _Out_ PULONG AclLength, _In_ PSID Owner, _In_ PSID Group, _Out_ PBOOLEAN AclPresent, _Out_ PBOOLEAN IsInherited, _In_ BOOLEAN IsDirectoryObject, _In_ PGENERIC_MAPPING GenericMapping)
	Selects an ACL and returns it to the caller. More...
BOOLEAN NTAPI	SepInitSDs (VOID)
	Initializes the known security descriptors in the system. More...
NTSTATUS NTAPI	SeSetWorldSecurityDescriptor (_In_ SECURITY_INFORMATION SecurityInformation, _In_ PISECURITY_DESCRIPTOR SecurityDescriptor, _In_ PULONG BufferLength)
	Sets a "World" security descriptor. More...
NTSTATUS NTAPI	SeComputeQuotaInformationSize (_In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _Out_ PULONG QuotaInfoSize)
BOOLEAN NTAPI	SeRmInitPhase0 (VOID)
	Manages the phase 0 initialization of the security reference monitoring module of the kernel. More...
BOOLEAN NTAPI	SeRmInitPhase1 (VOID)
	Manages the phase 1 initialization of the security reference monitoring module of the kernel. More...
NTSTATUS NTAPI	SepRmInsertLogonSessionIntoToken (_Inout_ PTOKEN Token)
	Inserts a logon session into an access token specified by the caller. More...
NTSTATUS NTAPI	SepRmRemoveLogonSessionFromToken (_Inout_ PTOKEN Token)
	Removes a logon session from an access token. More...
NTSTATUS	SepRmReferenceLogonSession (_Inout_ PLUID LogonLuid)
NTSTATUS	SepRmDereferenceLogonSession (_Inout_ PLUID LogonLuid)
NTSTATUS NTAPI	SepRegQueryHelper (_In_ PCWSTR KeyName, _In_ PCWSTR ValueName, _In_ ULONG ValueType, _In_ ULONG DataLength, _Out_ PVOID ValueData)
	A private registry helper that returns the desired value data based on the specifics requested by the caller. More...
NTSTATUS NTAPI	SeGetLogonIdDeviceMap (_In_ PLUID LogonId, _Out_ PDEVICE_MAP *DeviceMap)
	Retrieves the DOS device map from a logon session. More...
NTSTATUS NTAPI	SeInitializeProcessAuditName (_In_ PFILE_OBJECT FileObject, _In_ BOOLEAN DoAudit, _Out_ POBJECT_NAME_INFORMATION *AuditInfo)
	Initializes a process audit name and returns it to the caller. More...
BOOLEAN NTAPI	SeDetailedAuditingWithToken (_In_ PTOKEN Token)
	Peforms a detailed security auditing with an access token. More...
VOID NTAPI	SeAuditProcessExit (_In_ PEPROCESS Process)
	Peforms a security auditing against a process that is about to be terminated. More...
VOID NTAPI	SeAuditProcessCreate (_In_ PEPROCESS Process)
	Peforms a security auditing against a process that is about to be created. More...
VOID NTAPI	SePrivilegedServiceAuditAlarm (_In_opt_ PUNICODE_STRING ServiceName, _In_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_ PPRIVILEGE_SET PrivilegeSet, _In_ BOOLEAN AccessGranted)
	Performs an audit alarm to a privileged service request. More...
VOID NTAPI	SeCaptureSubjectContextEx (_In_ PETHREAD Thread, _In_ PEPROCESS Process, _Out_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
	An extended function that captures the security subject context based upon the specified thread and process. More...
NTSTATUS NTAPI	SepCaptureSecurityQualityOfService (_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ KPROCESSOR_MODE AccessMode, _In_ POOL_TYPE PoolType, _In_ BOOLEAN CaptureIfKernel, _Out_ PSECURITY_QUALITY_OF_SERVICE *CapturedSecurityQualityOfService, _Out_ PBOOLEAN Present)
	Captures the security quality of service data given the object attributes from an object. More...
VOID NTAPI	SepReleaseSecurityQualityOfService (_In_opt_ PSECURITY_QUALITY_OF_SERVICE CapturedSecurityQualityOfService, _In_ KPROCESSOR_MODE AccessMode, _In_ BOOLEAN CaptureIfKernel)
	Releases (frees) the captured SQOS data from an object in the memory pool. More...
NTSTATUS	SeCaptureObjectTypeList (_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, _In_ ULONG ObjectTypeListLength, _In_ KPROCESSOR_MODE PreviousMode, _Out_ POBJECT_TYPE_LIST *CapturedObjectTypeList)
	Captures a list of object types. More...
VOID	SeReleaseObjectTypeList (_In_ _Post_invalid_ POBJECT_TYPE_LIST CapturedObjectTypeList, _In_ KPROCESSOR_MODE PreviousMode)
	Releases a buffer list of object types. More...
NTSTATUS NTAPI	SeCreateAccessStateEx (_In_ PETHREAD Thread, _In_ PEPROCESS Process, _In_ OUT PACCESS_STATE AccessState, _In_ PAUX_ACCESS_DATA AuxData, _In_ ACCESS_MASK Access, _In_ PGENERIC_MAPPING GenericMapping)
BOOLEAN NTAPI	SeFastTraverseCheck (_In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ PACCESS_STATE AccessState, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE AccessMode)
	Determines whether security access rights can be given to an object depending on the security descriptor. Unlike the regular access check procedure in the NT kernel, the fast traverse check is a faster way to quickly check if access can be made into an object. More...

Variables
SID_IDENTIFIER_AUTHORITY	SeNullSidAuthority
SID_IDENTIFIER_AUTHORITY	SeWorldSidAuthority
SID_IDENTIFIER_AUTHORITY	SeLocalSidAuthority
SID_IDENTIFIER_AUTHORITY	SeCreatorSidAuthority
SID_IDENTIFIER_AUTHORITY	SeNtSidAuthority
PSID	SeNullSid
PSID	SeWorldSid
PSID	SeLocalSid
PSID	SeCreatorOwnerSid
PSID	SeCreatorGroupSid
PSID	SeCreatorOwnerServerSid
PSID	SeCreatorGroupServerSid
PSID	SeNtAuthoritySid
PSID	SeDialupSid
PSID	SeNetworkSid
PSID	SeBatchSid
PSID	SeInteractiveSid
PSID	SeServiceSid
PSID	SeAnonymousLogonSid
PSID	SePrincipalSelfSid
PSID	SeLocalSystemSid
PSID	SeAuthenticatedUserSid
PSID	SeRestrictedCodeSid
PSID	SeAliasAdminsSid
PSID	SeAliasUsersSid
PSID	SeAliasGuestsSid
PSID	SeAliasPowerUsersSid
PSID	SeAliasAccountOpsSid
PSID	SeAliasSystemOpsSid
PSID	SeAliasPrintOpsSid
PSID	SeAliasBackupOpsSid
PSID	SeAuthenticatedUsersSid
PSID	SeRestrictedSid
PSID	SeLocalServiceSid
PSID	SeNetworkServiceSid
const LUID	SeCreateTokenPrivilege
const LUID	SeAssignPrimaryTokenPrivilege
const LUID	SeLockMemoryPrivilege
const LUID	SeIncreaseQuotaPrivilege
const LUID	SeUnsolicitedInputPrivilege
const LUID	SeTcbPrivilege
const LUID	SeSecurityPrivilege
const LUID	SeTakeOwnershipPrivilege
const LUID	SeLoadDriverPrivilege
const LUID	SeSystemProfilePrivilege
const LUID	SeSystemtimePrivilege
const LUID	SeProfileSingleProcessPrivilege
const LUID	SeIncreaseBasePriorityPrivilege
const LUID	SeCreatePagefilePrivilege
const LUID	SeCreatePermanentPrivilege
const LUID	SeBackupPrivilege
const LUID	SeRestorePrivilege
const LUID	SeShutdownPrivilege
const LUID	SeDebugPrivilege
const LUID	SeAuditPrivilege
const LUID	SeSystemEnvironmentPrivilege
const LUID	SeChangeNotifyPrivilege
const LUID	SeRemoteShutdownPrivilege
const LUID	SeUndockPrivilege
const LUID	SeSyncAgentPrivilege
const LUID	SeEnableDelegationPrivilege
const LUID	SeManageVolumePrivilege
const LUID	SeImpersonatePrivilege
const LUID	SeCreateGlobalPrivilege
const LUID	SeTrustedCredmanPrivilege
const LUID	SeRelabelPrivilege
const LUID	SeIncreaseWorkingSetPrivilege
const LUID	SeTimeZonePrivilege
const LUID	SeCreateSymbolicLinkPrivilege
PACL	SePublicDefaultUnrestrictedDacl
PACL	SePublicOpenDacl
PACL	SePublicOpenUnrestrictedDacl
PACL	SeUnrestrictedDacl
PACL	SeSystemAnonymousLogonDacl
PSECURITY_DESCRIPTOR	SePublicDefaultSd
PSECURITY_DESCRIPTOR	SePublicDefaultUnrestrictedSd
PSECURITY_DESCRIPTOR	SePublicOpenSd
PSECURITY_DESCRIPTOR	SePublicOpenUnrestrictedSd
PSECURITY_DESCRIPTOR	SeSystemDefaultSd
PSECURITY_DESCRIPTOR	SeUnrestrictedSd
PSECURITY_DESCRIPTOR	SeSystemAnonymousLogonSd
PTOKEN	SeAnonymousLogonToken
PTOKEN	SeAnonymousLogonTokenNoEveryone

Macro Definition Documentation

SepAcquireTokenLockExclusive

#define SepAcquireTokenLockExclusive

(

Token

)

Value:

{                                                                              \
    KeEnterCriticalRegion();                                                   \
    ExAcquireResourceExclusiveLite(((PTOKEN)Token)->TokenLock, TRUE);          \
}

Definition at line 275 of file se.h.

SepAcquireTokenLockShared

#define SepAcquireTokenLockShared

(

Token

)

Value:

{                                                                              \
    KeEnterCriticalRegion();                                                   \
    ExAcquireResourceSharedLite(((PTOKEN)Token)->TokenLock, TRUE);             \
}

Definition at line 280 of file se.h.

SepReleaseTokenLock

#define SepReleaseTokenLock

(

Token

)

Value:

{                                                                              \
    ExReleaseResourceLite(((PTOKEN)Token)->TokenLock);                         \
    KeLeaveCriticalRegion();                                                   \
}

Definition at line 286 of file se.h.

TOKEN_CREATE_METHOD

#define TOKEN_CREATE_METHOD   0xCUL

Definition at line 70 of file se.h.

TOKEN_DUPLICATE_METHOD

#define TOKEN_DUPLICATE_METHOD   0xDUL

Definition at line 71 of file se.h.

TOKEN_FILTER_METHOD

#define TOKEN_FILTER_METHOD   0xFUL

Definition at line 72 of file se.h.

Typedef Documentation

ACCESS_CHECK_RIGHT_TYPE

typedef enum _ACCESS_CHECK_RIGHT_TYPE ACCESS_CHECK_RIGHT_TYPE

ACCESS_CHECK_RIGHTS

typedef struct _ACCESS_CHECK_RIGHTS ACCESS_CHECK_RIGHTS

KNOWN_ACE

typedef struct _KNOWN_ACE KNOWN_ACE

KNOWN_COMPOUND_ACE

typedef struct _KNOWN_COMPOUND_ACE KNOWN_COMPOUND_ACE

KNOWN_OBJECT_ACE

typedef struct _KNOWN_OBJECT_ACE KNOWN_OBJECT_ACE

PACCESS_CHECK_RIGHTS

typedef struct _ACCESS_CHECK_RIGHTS * PACCESS_CHECK_RIGHTS

PKNOWN_ACE

typedef struct _KNOWN_ACE * PKNOWN_ACE

PKNOWN_COMPOUND_ACE

typedef struct _KNOWN_COMPOUND_ACE * PKNOWN_COMPOUND_ACE

PKNOWN_OBJECT_ACE

typedef struct _KNOWN_OBJECT_ACE * PKNOWN_OBJECT_ACE

PTOKEN_AUDIT_POLICY_INFORMATION

typedef struct _TOKEN_AUDIT_POLICY_INFORMATION * PTOKEN_AUDIT_POLICY_INFORMATION

TOKEN_AUDIT_POLICY_INFORMATION

typedef struct _TOKEN_AUDIT_POLICY_INFORMATION TOKEN_AUDIT_POLICY_INFORMATION

Enumeration Type Documentation

_ACCESS_CHECK_RIGHT_TYPE

enum _ACCESS_CHECK_RIGHT_TYPE

Enumerator
AccessCheckMaximum
AccessCheckRegular

Definition at line 48 of file se.h.

{
    AccessCheckMaximum,
    AccessCheckRegular
} ACCESS_CHECK_RIGHT_TYPE;

Function Documentation

RtlLengthSidAndAttributes()

ULONG RtlLengthSidAndAttributes	(	_In_ ULONG	Count,
		_In_ PSID_AND_ATTRIBUTES	Src
	)

Computes the length size of a SID.

Parameters

[in]	Count	Total count of entries that have SIDs in them (that being PSID_AND_ATTRIBUTES in this context).
[in]	Src	Source that points to the attributes and SID entry structure.

Returns

Returns the total length of a SID size.

Definition at line 965 of file token.c.

{
    ULONG i;
    ULONG uLength;

    PAGED_CODE();

    uLength = Count * sizeof(SID_AND_ATTRIBUTES);
    for (i = 0; i < Count; i++)
        uLength += RtlLengthSid(Src[i].Sid);

    return uLength;
}

Referenced by NtQueryInformationToken(), SepPerformTokenFiltering(), and SeQueryInformationToken().

SeAuditProcessCreate()

VOID NTAPI SeAuditProcessCreate

(

_In_ PEPROCESS

Process

)

Peforms a security auditing against a process that is about to be created.

@unimplemented

Parameters

[in]

Process

An object that points to a process which is in process of creation.

Returns

Nothing.

Definition at line 56 of file audit.c.

{
    /* FIXME */
}

Referenced by PspCreateProcess().

SeAuditProcessExit()

VOID NTAPI SeAuditProcessExit

(

_In_ PEPROCESS

Process

)

Peforms a security auditing against a process that is about to be terminated.

@unimplemented

Parameters

[in]

Process

An object that points to a process which is in process of termination.

Returns

Nothing.

Definition at line 77 of file audit.c.

{
    /* FIXME */
}

Referenced by PspExitThread().

SeCaptureLuidAndAttributesArray()

NTSTATUS NTAPI SeCaptureLuidAndAttributesArray	(	_In_ PLUID_AND_ATTRIBUTES	Src,
		_In_ ULONG	PrivilegeCount,
		_In_ KPROCESSOR_MODE	PreviousMode,
		_In_ PLUID_AND_ATTRIBUTES	AllocatedMem,
		_In_ ULONG	AllocatedLength,
		_In_ POOL_TYPE	PoolType,
		_In_ BOOLEAN	CaptureIfKernel,
		_Out_ PLUID_AND_ATTRIBUTES *	Dest,
		_Inout_ PULONG	Length
	)

Referenced by NtAdjustPrivilegesToken(), NtCreateToken(), and NtFilterToken().

SeCaptureObjectTypeList()

NTSTATUS SeCaptureObjectTypeList	(	_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST	ObjectTypeList,
		_In_ ULONG	ObjectTypeListLength,
		_In_ KPROCESSOR_MODE	PreviousMode,
		_Out_ POBJECT_TYPE_LIST *	CapturedObjectTypeList
	)

Captures a list of object types.

Parameters

[in]	ObjectTypeList	An existing list of object types.
[in]	ObjectTypeListLength	The length size of the list.
[in]	PreviousMode	Processor access level mode.
[out]	CapturedObjectTypeList	The captured list of object types.

Returns

Returns STATUS_SUCCESS if the list of object types has been captured successfully. STATUS_INVALID_PARAMETER is returned if the caller hasn't supplied a buffer list of object types. STATUS_INSUFFICIENT_RESOURCES is returned if pool memory allocation for the captured list has failed.

Definition at line 39 of file objtype.c.

{
    SIZE_T Size;

    if (PreviousMode == KernelMode)
    {
        return STATUS_NOT_IMPLEMENTED;
    }

    if (ObjectTypeListLength == 0)
    {
        *CapturedObjectTypeList = NULL;
        return STATUS_SUCCESS;
    }

    if (ObjectTypeList == NULL)
    {
        return STATUS_INVALID_PARAMETER;
    }

    /* Calculate the list size and check for integer overflow */
    Size = ObjectTypeListLength * sizeof(OBJECT_TYPE_LIST);
    if (Size == 0)
    {
        return STATUS_INVALID_PARAMETER;
    }

    /* Allocate a new list */
    *CapturedObjectTypeList = ExAllocatePoolWithTag(PagedPool, Size, TAG_SEPA);
    if (*CapturedObjectTypeList == NULL)
    {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    _SEH2_TRY
    {
        ProbeForRead(ObjectTypeList, Size, sizeof(ULONG));
        RtlCopyMemory(*CapturedObjectTypeList, ObjectTypeList, Size);
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        ExFreePoolWithTag(*CapturedObjectTypeList, TAG_SEPA);
        *CapturedObjectTypeList = NULL;
        _SEH2_YIELD(return _SEH2_GetExceptionCode());
    }
    _SEH2_END;

    return STATUS_SUCCESS;
}

Referenced by SepAccessCheckAndAuditAlarm().

SeCaptureSidAndAttributesArray()

NTSTATUS NTAPI SeCaptureSidAndAttributesArray	(	_In_ PSID_AND_ATTRIBUTES	SrcSidAndAttributes,
		_In_ ULONG	AttributeCount,
		_In_ KPROCESSOR_MODE	PreviousMode,
		_In_opt_ PVOID	AllocatedMem,
		_In_ ULONG	AllocatedLength,
		_In_ POOL_TYPE	PoolType,
		_In_ BOOLEAN	CaptureIfKernel,
		_Out_ PSID_AND_ATTRIBUTES *	CapturedSidAndAttributes,
		_Out_ PULONG	ResultLength
	)

Captures a SID with attributes.

Parameters

[in]	SrcSidAndAttributes	Source of the SID with attributes to be captured.
[in]	AttributeCount	The number count of attributes, in total.
[in]	PreviousMode	Processor access level mode.
[in]	AllocatedMem	The allocated memory buffer for the captured SID. If the caller supplies no allocated block of memory then the function will allocate some buffer block of memory for the captured SID automatically.
[in]	AllocatedLength	The length of the buffer that points to the allocated memory, in bytes.
[in]	PoolType	The pool type for the captured SID and attributes to assign.
[in]	CaptureIfKernel	If set to TRUE, the capturing is done within the kernel. Otherwise the capturing is done in a kernel mode driver.
[out]	CapturedSidAndAttributes	The captured SID and attributes.
[out]	ResultLength	The length of the captured SID and attributes, in bytes.

Returns

Returns STATUS_SUCCESS if SID and attributes capturing has been completed successfully. STATUS_INVALID_PARAMETER is returned if the count of attributes exceeds the maximum threshold that the kernel can permit, with the purpose of avoiding integer overflows. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the captured SID has failed. STATUS_BUFFER_TOO_SMALL is returned if the length of the allocated buffer is less than the required size. STATUS_INVALID_SID is returned if a SID doesn't meet certain requirements to be considered a valid SID by the security manager. A failure NTSTATUS code is returned otherwise.

Remarks

A security identifier (SID) is a variable-length data structure that can change in size over time, depending on the factors that influence this effect in question. An attacker can take advantage of this fact and can potentially modify certain properties of a SID making it different in size than it was originally before. This is what we'd call, a TOCTOU vulnerability.

For this reason, the logic of copying the SIDs and their attributes into a new buffer goes like this: first, allocate a buffer array that just holds the lengths and subauthority count of each SID. Such information is copied in the first loop. Then in a second loop, iterate over the array with SID provided and copy them into the final array. The moment we're doing this, validate the lengths of each SID basing upon the captured lengths we've got before. In this way we ensure that the SIDs have remained intact. The validation checks are done in user mode as a general rule that we just cannot trust UM and whatever data is coming from it.

Definition at line 711 of file sid.c.

{
    ULONG ArraySize, RequiredLength, SidLength, i;
    ULONG TempArrayValidate, TempLengthValidate;
    PSID_AND_ATTRIBUTES SidAndAttributes;
    _SEH2_VOLATILE PSID_VALIDATE ValidateArray;
    PUCHAR CurrentDest;
    PISID Sid;
    NTSTATUS Status;
    PAGED_CODE();

    ValidateArray = NULL;
    SidAndAttributes = NULL;
    *CapturedSidAndAttributes = NULL;
    *ResultLength = 0;

    if (AttributeCount == 0)
    {
        return STATUS_SUCCESS;
    }

    if (AttributeCount > SE_MAXIMUM_GROUP_LIMIT)
    {
        DPRINT1("SeCaptureSidAndAttributesArray(): Maximum group limit exceeded!\n");
        return STATUS_INVALID_PARAMETER;
    }

    if ((PreviousMode == KernelMode) && !CaptureIfKernel)
    {
        *CapturedSidAndAttributes = SrcSidAndAttributes;
        return STATUS_SUCCESS;
    }

    ArraySize = AttributeCount * sizeof(SID_AND_ATTRIBUTES);
    RequiredLength = ALIGN_UP_BY(ArraySize, sizeof(ULONG));

    if (PreviousMode != KernelMode)
    {
        /* Check for user mode data */
        _SEH2_TRY
        {
            /* First probe the whole array */
            ProbeForRead(SrcSidAndAttributes, ArraySize, sizeof(ULONG));

            /* We're in user mode, set up the size for the temporary array */
            TempArrayValidate = AttributeCount * sizeof(SID_VALIDATE);
            TempLengthValidate = ALIGN_UP_BY(TempArrayValidate, sizeof(ULONG));

            /*
             * Allocate a buffer for the array that we're going to
             * temporarily hold the subauthority count and the SID
             * elements. We'll be going to use this array to perform
             * validation checks later.
             */
            ValidateArray = ExAllocatePoolWithTag(PoolType | POOL_RAISE_IF_ALLOCATION_FAILURE,
                                                  TempLengthValidate,
                                                  TAG_SID_VALIDATE);

            /* Loop the array elements */
            for (i = 0; i < AttributeCount; i++)
            {
                /* Get the SID and probe the minimal structure */
                Sid = SrcSidAndAttributes[i].Sid;
                ProbeForRead(Sid, sizeof(*Sid), sizeof(ULONG));

                /*
                 * Capture the subauthority count and hold it
                 * into the temporary array for later validation.
                 * This way we ensure that the said count of each
                 * SID has remained the same.
                 */
                ValidateArray[i].SubAuthorityCount = Sid->SubAuthorityCount;

                /* Capture the SID */
                ValidateArray[i].ProbeSid = Sid;

                /* Calculate the SID length and probe the full SID */
                SidLength = RtlLengthRequiredSid(ValidateArray[i].SubAuthorityCount);
                ProbeForRead(ValidateArray[i].ProbeSid, SidLength, sizeof(ULONG));

                /* Add the aligned length to the required length */
                RequiredLength += ALIGN_UP_BY(SidLength, sizeof(ULONG));
            }
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            Status = _SEH2_GetExceptionCode();
            _SEH2_YIELD(goto Cleanup);
        }
        _SEH2_END;
    }
    else
    {
        /* Loop the array elements */
        for (i = 0; i < AttributeCount; i++)
        {
            /* Get the SID and it's length */
            Sid = SrcSidAndAttributes[i].Sid;
            SidLength = RtlLengthRequiredSid(Sid->SubAuthorityCount);

            /* Add the aligned length to the required length */
            RequiredLength += ALIGN_UP_BY(SidLength, sizeof(ULONG));
        }
    }

    /* Assume success */
    Status = STATUS_SUCCESS;
    *ResultLength = RequiredLength;

    /* Check if we have no buffer */
    if (AllocatedMem == NULL)
    {
        /* Allocate a new buffer */
        SidAndAttributes = ExAllocatePoolWithTag(PoolType,
                                                 RequiredLength,
                                                 TAG_SID_AND_ATTRIBUTES);
        if (SidAndAttributes == NULL)
        {
            DPRINT1("SeCaptureSidAndAttributesArray(): Failed to allocate memory for SID and attributes array (requested size -> %lu)!\n", RequiredLength);
            Status = STATUS_INSUFFICIENT_RESOURCES;
            goto Cleanup;
        }
    }
    /* Otherwise check if the buffer is large enough */
    else if (AllocatedLength >= RequiredLength)
    {
        /* Buffer is large enough, use it */
        SidAndAttributes = AllocatedMem;
    }
    else
    {
        /* Buffer is too small, fail */
        DPRINT1("SeCaptureSidAndAttributesArray(): The provided buffer is small (expected size -> %lu || current size -> %lu)!\n", RequiredLength, AllocatedLength);
        Status = STATUS_BUFFER_TOO_SMALL;
        goto Cleanup;
    }

    *CapturedSidAndAttributes = SidAndAttributes;

    /* Check again for user mode */
    if (PreviousMode != KernelMode)
    {
        _SEH2_TRY
        {
            /* The rest of the data starts after the array */
            CurrentDest = (PUCHAR)SidAndAttributes;
            CurrentDest += ALIGN_UP_BY(ArraySize, sizeof(ULONG));

            /* Loop the array elements */
            for (i = 0; i < AttributeCount; i++)
            {
                /*
                 * Get the SID length from the subauthority
                 * count we've captured before.
                 */
                SidLength = RtlLengthRequiredSid(ValidateArray[i].SubAuthorityCount);

                /* Copy attributes */
                SidAndAttributes[i].Attributes = SrcSidAndAttributes[i].Attributes;

                /* Copy the SID to the current destination address */
                SidAndAttributes[i].Sid = (PSID)CurrentDest;
                RtlCopyMemory(CurrentDest, ValidateArray[i].ProbeSid, SidLength);

                /* Obtain the SID we've captured before for validation */
                Sid = SidAndAttributes[i].Sid;

                /* Validate that the subauthority count hasn't changed */
                if (ValidateArray[i].SubAuthorityCount !=
                    Sid->SubAuthorityCount)
                {
                    /* It's changed, bail out */
                    DPRINT1("SeCaptureSidAndAttributesArray(): The subauthority counts have changed (captured count -> %u || current count -> %u)\n",
                            ValidateArray[i].SubAuthorityCount, Sid->SubAuthorityCount);
                    Status = STATUS_INVALID_SID;
                    goto Cleanup;
                }

                /* Validate that the SID length is the same */
                if (SidLength != RtlLengthSid(Sid))
                {
                    /* They're no longer the same, bail out */
                    DPRINT1("SeCaptureSidAndAttributesArray(): The SID lengths have changed (captured length -> %lu || current length -> %lu)\n",
                            SidLength, RtlLengthSid(Sid));
                    Status = STATUS_INVALID_SID;
                    goto Cleanup;
                }

                /* Check that the SID is valid */
                if (!RtlValidSid(Sid))
                {
                    DPRINT1("SeCaptureSidAndAttributesArray(): The SID is not valid!\n");
                    Status = STATUS_INVALID_SID;
                    goto Cleanup;
                }

                /* Update the current destination address */
                CurrentDest += ALIGN_UP_BY(SidLength, sizeof(ULONG));
            }
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            Status = _SEH2_GetExceptionCode();
        }
        _SEH2_END;
    }
    else
    {
        /* The rest of the data starts after the array */
        CurrentDest = (PUCHAR)SidAndAttributes;
        CurrentDest += ALIGN_UP_BY(ArraySize, sizeof(ULONG));

        /* Loop the array elements */
        for (i = 0; i < AttributeCount; i++)
        {
            /* Get the SID and it's length */
            Sid = SrcSidAndAttributes[i].Sid;
            SidLength = RtlLengthRequiredSid(Sid->SubAuthorityCount);

            /* Copy attributes */
            SidAndAttributes[i].Attributes = SrcSidAndAttributes[i].Attributes;

            /* Copy the SID to the current destination address */
            SidAndAttributes[i].Sid = (PSID)CurrentDest;
            RtlCopyMemory(CurrentDest, SrcSidAndAttributes[i].Sid, SidLength);

            /* Update the current destination address */
            CurrentDest += ALIGN_UP_BY(SidLength, sizeof(ULONG));
        }
    }

Cleanup:
    /* Check for failure */
    if (!NT_SUCCESS(Status))
    {
        /* Check if we allocated a new array */
        if ((SidAndAttributes != AllocatedMem) && (SidAndAttributes != NULL))
        {
            /* Free the array */
            ExFreePoolWithTag(SidAndAttributes, TAG_SID_AND_ATTRIBUTES);
        }

        /* Set returned address to NULL */
        *CapturedSidAndAttributes = NULL;
    }

    /* Free the temporary validation array */
    if ((PreviousMode != KernelMode) && (ValidateArray != NULL))
    {
        ExFreePoolWithTag(ValidateArray, TAG_SID_VALIDATE);
    }

    return Status;
}

Referenced by NtAdjustGroupsToken(), NtCreateToken(), and NtFilterToken().

SeCaptureSubjectContextEx()

VOID NTAPI SeCaptureSubjectContextEx	(	_In_ PETHREAD	Thread,
		_In_ PEPROCESS	Process,
		_Out_ PSECURITY_SUBJECT_CONTEXT	SubjectContext
	)

An extended function that captures the security subject context based upon the specified thread and process.

Parameters

[in]	Thread	A thread where the calling thread's token is to be referenced for the security context.
[in]	Process	A process where the main process' token is to be referenced for the security context.
[out]	SubjectContext	The returned security subject context.

Returns

Nothing.

Definition at line 41 of file subject.c.

{
    BOOLEAN CopyOnOpen, EffectiveOnly;

    PAGED_CODE();

    /* Save the unique ID */
    SubjectContext->ProcessAuditId = Process->UniqueProcessId;

    /* Check if we have a thread */
    if (!Thread)
    {
        /* We don't, so no token */
        SubjectContext->ClientToken = NULL;
    }
    else
    {
        /* Get the impersonation token */
        SubjectContext->ClientToken = PsReferenceImpersonationToken(Thread,
                                                                    &CopyOnOpen,
                                                                    &EffectiveOnly,
                                                                    &SubjectContext->ImpersonationLevel);
    }

    /* Get the primary token */
    SubjectContext->PrimaryToken = PsReferencePrimaryToken(Process);
}

Referenced by SeCaptureSubjectContext(), and SeCreateAccessStateEx().

SeCheckAuditPrivilege()

BOOLEAN NTAPI SeCheckAuditPrivilege	(	_In_ PSECURITY_SUBJECT_CONTEXT	SubjectContext,
		_In_ KPROCESSOR_MODE	PreviousMode
	)

Checks a single privilege and performs an audit against a privileged service based on a security subject context.

Parameters

[in]	DesiredAccess	Security subject context used for privileged service auditing.
[in]	PreviousMode	Processor level access mode.

Returns

Returns TRUE if service auditing and privilege checking tests have succeeded, FALSE otherwise.

Definition at line 360 of file priv.c.

{
    PRIVILEGE_SET PrivilegeSet;
    BOOLEAN Result;
    PAGED_CODE();

    /* Initialize the privilege set with the single privilege */
    PrivilegeSet.PrivilegeCount = 1;
    PrivilegeSet.Control = PRIVILEGE_SET_ALL_NECESSARY;
    PrivilegeSet.Privilege[0].Luid = SeAuditPrivilege;
    PrivilegeSet.Privilege[0].Attributes = 0;

    /* Check against the primary token! */
    Result = SepPrivilegeCheck(SubjectContext->PrimaryToken,
                               &PrivilegeSet.Privilege[0],
                               1,
                               PRIVILEGE_SET_ALL_NECESSARY,
                               PreviousMode);

    if (PreviousMode != KernelMode)
    {
        SePrivilegedServiceAuditAlarm(NULL,
                                      SubjectContext,
                                      &PrivilegeSet,
                                      Result);
    }

    return Result;
}

Referenced by NtCloseObjectAuditAlarm(), NtOpenObjectAuditAlarm(), NtPrivilegedServiceAuditAlarm(), and SepAccessCheckAndAuditAlarm().

SeCheckPrivilegedObject()

BOOLEAN NTAPI SeCheckPrivilegedObject	(	_In_ LUID	PrivilegeValue,
		_In_ HANDLE	ObjectHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ KPROCESSOR_MODE	PreviousMode
	)

Checks a privileged object if such object has the specific privilege submitted by the caller.

Parameters

[in]	PrivilegeValue	A privilege to be checked against the one from the object.
[in]	ObjectHandle	A handle to any kind of object.
[in]	DesiredAccess	Desired access right mask requested by the caller.
[in]	PreviousMode	Processor level access mode.

Returns

Returns TRUE if the privilege is present, FALSE otherwise.

Definition at line 803 of file priv.c.

{
    SECURITY_SUBJECT_CONTEXT SubjectContext;
    PRIVILEGE_SET Priv;
    BOOLEAN Result;

    PAGED_CODE();

    SeCaptureSubjectContext(&SubjectContext);

    Priv.PrivilegeCount = 1;
    Priv.Control = PRIVILEGE_SET_ALL_NECESSARY;
    Priv.Privilege[0].Luid = PrivilegeValue;
    Priv.Privilege[0].Attributes = SE_PRIVILEGE_ENABLED;

    Result = SePrivilegeCheck(&Priv, &SubjectContext, PreviousMode);
    if (PreviousMode != KernelMode)
    {
#if 0
        SePrivilegeObjectAuditAlarm(ObjectHandle,
                                    &SubjectContext,
                                    DesiredAccess,
                                    &PrivilegeValue,
                                    Result,
                                    PreviousMode);
#endif
    }

    SeReleaseSubjectContext(&SubjectContext);

    return Result;
}

Referenced by NtSetInformationProcess(), and NtSetInformationThread().

SeComputeQuotaInformationSize()

NTSTATUS NTAPI SeComputeQuotaInformationSize	(	_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_Out_ PULONG	QuotaInfoSize
	)

Referenced by ObpCaptureObjectCreateInformation().

SeCopyClientToken()

NTSTATUS NTAPI SeCopyClientToken	(	_In_ PACCESS_TOKEN	Token,
		_In_ SECURITY_IMPERSONATION_LEVEL	Level,
		_In_ KPROCESSOR_MODE	PreviousMode,
		_Out_ PACCESS_TOKEN *	NewToken
	)

Copies an existing access token (technically duplicating a new one).

Parameters

[in]	Token	Token to copy.
[in]	Level	Impersonation security level to assign to the newly copied token.
[in]	PreviousMode	Processor request level mode.
[out]	NewToken	The newly copied token.

Returns

Returns STATUS_SUCCESS when token copying has finished successfully. A failure NTSTATUS code is returned otherwise.

Definition at line 1296 of file token.c.

{
    NTSTATUS Status;
    OBJECT_ATTRIBUTES ObjectAttributes;

    PAGED_CODE();

    InitializeObjectAttributes(&ObjectAttributes,
                               NULL,
                               0,
                               NULL,
                               NULL);

    Status = SepDuplicateToken(Token,
                               &ObjectAttributes,
                               FALSE,
                               TokenImpersonation,
                               Level,
                               PreviousMode,
                               (PTOKEN*)NewToken);

    return Status;
}

Referenced by PsImpersonateClient(), and SepCreateClientSecurity().

SeCreateAccessStateEx()

NTSTATUS NTAPI SeCreateAccessStateEx	(	_In_ PETHREAD	Thread,
		_In_ PEPROCESS	Process,
		_In_ OUT PACCESS_STATE	AccessState,
		_In_ PAUX_ACCESS_DATA	AuxData,
		_In_ ACCESS_MASK	Access,
		_In_ PGENERIC_MAPPING	GenericMapping
	)

Referenced by PspCreateProcess(), and PspCreateThread().

SeDeassignPrimaryToken()

VOID NTAPI SeDeassignPrimaryToken

(

_Inout_ PEPROCESS

Process

)

Removes the primary token of a process.

Parameters

[in,out]

Process

The process instance with the access token to be removed.

Returns

Nothing.

Definition at line 936 of file token.c.

{
    PTOKEN OldToken;

    /* Remove the Token */
    OldToken = ObFastReplaceObject(&Process->Token, NULL);

    /* Mark the Old Token as free */
    OldToken->TokenInUse = FALSE;

    /* Dereference the Token */
    ObDereferenceObject(OldToken);
}

Referenced by PspDeleteProcessSecurity(), and SeAssignPrimaryToken().

SeDefaultObjectMethod()

NTSTATUS NTAPI SeDefaultObjectMethod	(	_In_ PVOID	Object,
		_In_ SECURITY_OPERATION_CODE	OperationType,
		_In_ PSECURITY_INFORMATION	SecurityInformation,
		_Inout_opt_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_Inout_opt_ PULONG	ReturnLength,
		_Inout_opt_ PSECURITY_DESCRIPTOR *	OldSecurityDescriptor,
		_In_ POOL_TYPE	PoolType,
		_In_ PGENERIC_MAPPING	GenericMapping
	)

SeDetailedAuditingWithToken()

BOOLEAN NTAPI SeDetailedAuditingWithToken

(

_In_ PTOKEN

Token

)

Peforms a detailed security auditing with an access token.

@unimplemented

Parameters

[in]

Token

A valid token object.

Returns

To be added...

Definition at line 34 of file audit.c.

{
    /* FIXME */
    return FALSE;
}

Referenced by ObInitProcess(), PspCreateProcess(), and PspExitThread().

SeExchangePrimaryToken()

NTSTATUS NTAPI SeExchangePrimaryToken	(	_In_ PEPROCESS	Process,
		_In_ PACCESS_TOKEN	NewAccessToken,
		_Out_ PACCESS_TOKEN *	OldAccessToken
	)

Replaces the old access token of a process (pointed by the EPROCESS kernel structure) with a new access token. The new access token must be a primary token for use.

Parameters

[in]	Process	The process instance where its access token is about to be replaced.
[in]	NewAccessToken	The new token that it's going to replace the old one.
[out]	OldAccessToken	The returned old token that's been replaced, which the caller can do anything.

Returns

Returns STATUS_SUCCESS if the exchange operation between tokens has completed successfully. STATUS_BAD_TOKEN_TYPE is returned if the new token is not a primary one so that we cannot exchange it with the old one from the process. STATUS_TOKEN_ALREADY_IN_USE is returned if both tokens aren't equal which means one of them has different properties (groups, privileges, etc.) and as such one of them is currently in use. A failure NTSTATUS code is returned otherwise.

Definition at line 846 of file token.c.

{
    PTOKEN OldToken;
    PTOKEN NewToken = (PTOKEN)NewAccessToken;

    PAGED_CODE();

    if (NewToken->TokenType != TokenPrimary)
        return STATUS_BAD_TOKEN_TYPE;

    if (NewToken->TokenInUse)
    {
        BOOLEAN IsEqual;
        NTSTATUS Status;

        /* Maybe we're trying to set the same token */
        OldToken = PsReferencePrimaryToken(Process);
        if (OldToken == NewToken)
        {
            /* So it's a nop. */
            *OldAccessToken = OldToken;
            return STATUS_SUCCESS;
        }

        Status = SepCompareTokens(OldToken, NewToken, &IsEqual);
        if (!NT_SUCCESS(Status))
        {
            PsDereferencePrimaryToken(OldToken);
            *OldAccessToken = NULL;
            return Status;
        }

        if (!IsEqual)
        {
            PsDereferencePrimaryToken(OldToken);
            *OldAccessToken = NULL;
            return STATUS_TOKEN_ALREADY_IN_USE;
        }
        /* Silently return STATUS_SUCCESS but do not set the new token,
         * as it's already in use elsewhere. */
        *OldAccessToken = OldToken;
        return STATUS_SUCCESS;
    }

    /* Lock the new token */
    SepAcquireTokenLockExclusive(NewToken);

    /* Mark new token in use */
    NewToken->TokenInUse = TRUE;

    /* Set the session ID for the new token */
    NewToken->SessionId = MmGetSessionId(Process);

    /* Unlock the new token */
    SepReleaseTokenLock(NewToken);

    /* Reference the new token */
    ObReferenceObject(NewToken);

    /* Replace the old with the new */
    OldToken = ObFastReplaceObject(&Process->Token, NewToken);

    /* Lock the old token */
    SepAcquireTokenLockExclusive(OldToken);

    /* Mark the old token as free */
    OldToken->TokenInUse = FALSE;

    /* Unlock the old token */
    SepReleaseTokenLock(OldToken);

    *OldAccessToken = (PACCESS_TOKEN)OldToken;
    return STATUS_SUCCESS;
}

Referenced by PspAssignPrimaryToken().

SeFastTraverseCheck()

BOOLEAN NTAPI SeFastTraverseCheck	(	_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ PACCESS_STATE	AccessState,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ KPROCESSOR_MODE	AccessMode
	)

Determines whether security access rights can be given to an object depending on the security descriptor. Unlike the regular access check procedure in the NT kernel, the fast traverse check is a faster way to quickly check if access can be made into an object.

Parameters

[in]	SecurityDescriptor	Security descriptor of the object that is being accessed.
[in]	AccessState	An access state to determine if the access token in the current security context of the object is an restricted token.
[in]	DesiredAccess	The access right bitmask where the calling thread wants to acquire.
[in]	AccessMode	Process level request mode.

Returns

Returns TRUE if access onto the specific object is allowed, FALSE otherwise.

Definition at line 1054 of file accesschk.c.

{
    PACL Dacl;
    ULONG AceIndex;
    PKNOWN_ACE Ace;

    PAGED_CODE();

    ASSERT(AccessMode != KernelMode);

    if (SecurityDescriptor == NULL)
        return FALSE;

    /* Get DACL */
    Dacl = SepGetDaclFromDescriptor(SecurityDescriptor);
    /* If no DACL, grant access */
    if (Dacl == NULL)
        return TRUE;

    /* No ACE -> Deny */
    if (!Dacl->AceCount)
        return FALSE;

    /* Can't perform the check on restricted token */
    if (AccessState->Flags & TOKEN_IS_RESTRICTED)
        return FALSE;

    /* Browse the ACEs */
    for (AceIndex = 0, Ace = (PKNOWN_ACE)((ULONG_PTR)Dacl + sizeof(ACL));
         AceIndex < Dacl->AceCount;
         AceIndex++, Ace = (PKNOWN_ACE)((ULONG_PTR)Ace + Ace->Header.AceSize))
    {
        if (Ace->Header.AceFlags & INHERIT_ONLY_ACE)
            continue;

        /* If access-allowed ACE */
        if (Ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE)
        {
            /* Check if all accesses are granted */
            if (!(Ace->Mask & DesiredAccess))
                continue;

            /* Check SID and grant access if matching */
            if (RtlEqualSid(SeWorldSid, &(Ace->SidStart)))
                return TRUE;
        }
        /* If access-denied ACE */
        else if (Ace->Header.AceType == ACCESS_DENIED_ACE_TYPE)
        {
            /* Here, only check if it denies any access wanted and deny if so */
            if (Ace->Mask & DesiredAccess)
                return FALSE;
        }
    }

    /* Faulty, deny */
    return FALSE;
}

Referenced by IopParseDevice(), and ObpCheckTraverseAccess().

SeGetLogonIdDeviceMap()

NTSTATUS NTAPI SeGetLogonIdDeviceMap	(	_In_ PLUID	LogonId,
		_Out_ PDEVICE_MAP *	DeviceMap
	)

Retrieves the DOS device map from a logon session.

Parameters

[in]	LogonId	A valid logon session ID.
[out]	DeviceMap	The returned device map buffer from the logon session.

Returns

Returns STATUS_SUCCESS if the device map could be gathered from the logon session. STATUS_INVALID_PARAMETER is returned if one of the parameters aren't initialized (that is, the caller has submitted a NULL pointer variable). STATUS_NO_SUCH_LOGON_SESSION is returned if no such session could be found. A failure NTSTATUS code is returned otherwise.

Definition at line 1347 of file srm.c.

{
    NTSTATUS Status;
    WCHAR Buffer[63];
    PDEVICE_MAP LocalMap;
    HANDLE DirectoryHandle, LinkHandle;
    OBJECT_ATTRIBUTES ObjectAttributes;
    PSEP_LOGON_SESSION_REFERENCES CurrentSession;
    UNICODE_STRING DirectoryName, LinkName, TargetName;

    PAGED_CODE();

    if  (LogonId == NULL ||
         DeviceMap == NULL)
    {
        return STATUS_INVALID_PARAMETER;
    }

    /* Acquire the database lock */
    KeAcquireGuardedMutex(&SepRmDbLock);

    /* Loop all existing sessions */
    for (CurrentSession = SepLogonSessions;
         CurrentSession != NULL;
         CurrentSession = CurrentSession->Next)
    {
        /* Check if the LUID matches the provided one */
        if (RtlEqualLuid(&CurrentSession->LogonId, LogonId))
        {
            break;
        }
    }

    /* No session found, fail */
    if (CurrentSession == NULL)
    {
        /* Release the database lock */
        KeReleaseGuardedMutex(&SepRmDbLock);

        return STATUS_NO_SUCH_LOGON_SESSION;
    }

    /* The found session has a device map, return it! */
    if (CurrentSession->pDeviceMap != NULL)
    {
        *DeviceMap = CurrentSession->pDeviceMap;

        /* Release the database lock */
        KeReleaseGuardedMutex(&SepRmDbLock);

        return STATUS_SUCCESS;
    }

    /* At that point, we'll setup a new device map for the session */
    LocalMap = NULL;

    /* Reference the session so that it doesn't go away */
    CurrentSession->ReferenceCount += 1;

    /* Release the database lock */
    KeReleaseGuardedMutex(&SepRmDbLock);

    /* Create our object directory given the LUID */
    _snwprintf(Buffer,
               sizeof(Buffer) / sizeof(WCHAR),
               L"\\Sessions\\0\\DosDevices\\%08x-%08x",
               LogonId->HighPart,
               LogonId->LowPart);
    RtlInitUnicodeString(&DirectoryName, Buffer);

    InitializeObjectAttributes(&ObjectAttributes,
                               &DirectoryName,
                               OBJ_KERNEL_HANDLE | OBJ_OPENIF | OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);
    Status = ZwCreateDirectoryObject(&DirectoryHandle,
                                     DIRECTORY_ALL_ACCESS,
                                     &ObjectAttributes);
    if (NT_SUCCESS(Status))
    {
        /* Create the associated device map */
        Status = ObSetDirectoryDeviceMap(&LocalMap, DirectoryHandle);
        if (NT_SUCCESS(Status))
        {
            /* Make Global point to \Global?? in the directory */
            RtlInitUnicodeString(&LinkName, L"Global");
            RtlInitUnicodeString(&TargetName, L"\\Global??");

            InitializeObjectAttributes(&ObjectAttributes,
                                       &LinkName,
                                       OBJ_KERNEL_HANDLE | OBJ_OPENIF | OBJ_CASE_INSENSITIVE | OBJ_PERMANENT,
                                       DirectoryHandle,
                                       NULL);
            Status = ZwCreateSymbolicLinkObject(&LinkHandle,
                                                SYMBOLIC_LINK_ALL_ACCESS,
                                                &ObjectAttributes,
                                                &TargetName);
            if (!NT_SUCCESS(Status))
            {
                ObfDereferenceDeviceMap(LocalMap);
            }
            else
            {
                ZwClose(LinkHandle);
            }
        }

        ZwClose(DirectoryHandle);
    }

    /* Acquire the database lock */
    KeAcquireGuardedMutex(&SepRmDbLock);

    /* If we succeed... */
    if (NT_SUCCESS(Status))
    {
        /* The session now has a device map? We raced with someone else */
        if (CurrentSession->pDeviceMap != NULL)
        {
            /* Give up on our new device map */
            ObfDereferenceDeviceMap(LocalMap);
        }
        /* Otherwise use our newly allocated device map */
        else
        {
            CurrentSession->pDeviceMap = LocalMap;
        }

        /* Return the device map */
        *DeviceMap = CurrentSession->pDeviceMap;
    }
    /* Zero output */
    else
    {
        *DeviceMap = NULL;
    }

    /* Release the database lock */
    KeReleaseGuardedMutex(&SepRmDbLock);

    /* We're done with the session */
    SepRmDereferenceLogonSession(&CurrentSession->LogonId);

    return Status;
}

Referenced by ObpReferenceDeviceMap(), and ObpSetCurrentProcessDeviceMap().

SeGetTokenControlInformation()

VOID NTAPI SeGetTokenControlInformation	(	_In_ PACCESS_TOKEN	_Token,
		_Out_ PTOKEN_CONTROL	TokenControl
	)

Retrieves token control information.

Parameters

[in]	_Token	A valid token object.
[out]	SecurityDescriptor	The returned token control information.

Returns

Nothing.

Definition at line 1474 of file token.c.

{
    PTOKEN Token = _Token;
    PAGED_CODE();

    /* Capture the main fields */
    TokenControl->AuthenticationId = Token->AuthenticationId;
    TokenControl->TokenId = Token->TokenId;
    TokenControl->TokenSource = Token->TokenSource;

    /* Lock the token */
    SepAcquireTokenLockShared(Token);

    /* Capture the modified ID */
    TokenControl->ModifiedId = Token->ModifiedId;

    /* Unlock it */
    SepReleaseTokenLock(Token);
}

Referenced by SepCreateClientSecurity().

SeInitializeProcessAuditName()

NTSTATUS NTAPI SeInitializeProcessAuditName	(	_In_ PFILE_OBJECT	FileObject,
		_In_ BOOLEAN	DoAudit,
		_Out_ POBJECT_NAME_INFORMATION *	AuditInfo
	)

Initializes a process audit name and returns it to the caller.

Parameters

[in]	FileObject	File object that points to a name to be queried.
[in]	DoAudit	If set to TRUE, the function will perform various security auditing onto the audit name.
[out]	AuditInfo	The returned audit info data.

Returns

Returns STATUS_SUCCESS if process audit name initialization has completed successfully. STATUS_NO_MEMORY is returned if pool allocation for object name info has failed. A failure NTSTATUS code is returned otherwise.

Definition at line 105 of file audit.c.

{
    OBJECT_NAME_INFORMATION LocalNameInfo;
    POBJECT_NAME_INFORMATION ObjectNameInfo = NULL;
    ULONG ReturnLength = 8;
    NTSTATUS Status;

    PAGED_CODE();
    ASSERT(AuditInfo);

    /* Check if we should do auditing */
    if (DoAudit)
    {
        /* FIXME: TODO */
    }

    /* Now query the name */
    Status = ObQueryNameString(FileObject,
                               &LocalNameInfo,
                               sizeof(LocalNameInfo),
                               &ReturnLength);
    if (((Status == STATUS_BUFFER_OVERFLOW) ||
         (Status == STATUS_BUFFER_TOO_SMALL) ||
         (Status == STATUS_INFO_LENGTH_MISMATCH)) &&
        (ReturnLength != sizeof(LocalNameInfo)))
    {
        /* Allocate required size */
        ObjectNameInfo = ExAllocatePoolWithTag(NonPagedPool,
                                               ReturnLength,
                                               TAG_SEPA);
        if (ObjectNameInfo)
        {
            /* Query the name again */
            Status = ObQueryNameString(FileObject,
                                       ObjectNameInfo,
                                       ReturnLength,
                                       &ReturnLength);
        }
    }

    /* Check if we got here due to failure */
    if ((ObjectNameInfo) &&
        (!(NT_SUCCESS(Status)) || (ReturnLength == sizeof(LocalNameInfo))))
    {
        /* First, free any buffer we might've allocated */
        ASSERT(FALSE);
        if (ObjectNameInfo) ExFreePool(ObjectNameInfo);

        /* Now allocate a temporary one */
        ReturnLength = sizeof(OBJECT_NAME_INFORMATION);
        ObjectNameInfo = ExAllocatePoolWithTag(NonPagedPool,
                                               sizeof(OBJECT_NAME_INFORMATION),
                                               TAG_SEPA);
        if (ObjectNameInfo)
        {
            /* Clear it */
            RtlZeroMemory(ObjectNameInfo, ReturnLength);
            Status = STATUS_SUCCESS;
        }
    }

    /* Check if memory allocation failed */
    if (!ObjectNameInfo) Status = STATUS_NO_MEMORY;

    /* Return the audit name */
    *AuditInfo = ObjectNameInfo;

    /* Return status */
    return Status;
}

Referenced by MmInitializeProcessAddressSpace(), and SeLocateProcessImageName().

SeInitSystem()

BOOLEAN NTAPI SeInitSystem

(

VOID

)

Main security manager initialization function.

Returns

Returns a boolean value according to the phase initialization routine that handles it. If TRUE, the routine deems the initialization phase as complete, FALSE otherwise.

Definition at line 285 of file semgr.c.

{
    /* Check the initialization phase */
    switch (ExpInitializationPhase)
    {
        case 0:

            /* Do Phase 0 */
            return SepInitializationPhase0();

        case 1:

            /* Do Phase 1 */
            return SepInitializationPhase1();

        default:

            /* Don't know any other phase! Bugcheck! */
            KeBugCheckEx(UNEXPECTED_INITIALIZATION_CALL,
                         0,
                         ExpInitializationPhase,
                         0,
                         0);
            return FALSE;
    }
}

Referenced by ExpInitializeExecutive(), and Phase1InitializationDiscard().

SeIsTokenChild()

NTSTATUS NTAPI SeIsTokenChild	(	_In_ PTOKEN	Token,
		_Out_ PBOOLEAN	IsChild
	)

Checks if the token is a child of the other token of the current process that the calling thread is invoking this function.

Parameters

[in]	Token	An access token to determine if it's a child or not.
[out]	IsChild	The returned boolean result.

Returns

Returns STATUS_SUCCESS when the function finishes its operation. STATUS_UNSUCCESSFUL is returned if primary token of the current calling process couldn't be referenced otherwise.

Definition at line 1187 of file token.c.

{
    PTOKEN ProcessToken;
    LUID ProcessTokenId, CallerParentId;

    /* Assume failure */
    *IsChild = FALSE;

    /* Reference the process token */
    ProcessToken = PsReferencePrimaryToken(PsGetCurrentProcess());
    if (!ProcessToken)
        return STATUS_UNSUCCESSFUL;

    /* Get its token ID */
    ProcessTokenId = ProcessToken->TokenId;

    /* Dereference the token */
    ObFastDereferenceObject(&PsGetCurrentProcess()->Token, ProcessToken);

    /* Get our parent token ID */
    CallerParentId = Token->ParentTokenId;

    /* Compare the token IDs */
    if (RtlEqualLuid(&CallerParentId, &ProcessTokenId))
        *IsChild = TRUE;

    /* Return success */
    return STATUS_SUCCESS;
}

Referenced by PspSetPrimaryToken().

SeIsTokenSibling()

NTSTATUS NTAPI SeIsTokenSibling	(	_In_ PTOKEN	Token,
		_Out_ PBOOLEAN	IsSibling
	)

Checks if the token is a sibling of the other token of the current process that the calling thread is invoking this function.

Parameters

[in]	Token	An access token to determine if it's a sibling or not.
[out]	IsSibling	The returned boolean result.

Returns

Returns STATUS_SUCCESS when the function finishes its operation. STATUS_UNSUCCESSFUL is returned if primary token of the current calling process couldn't be referenced otherwise.

Definition at line 1236 of file token.c.

{
    PTOKEN ProcessToken;
    LUID ProcessParentId, ProcessAuthId;
    LUID CallerParentId, CallerAuthId;

    /* Assume failure */
    *IsSibling = FALSE;

    /* Reference the process token */
    ProcessToken = PsReferencePrimaryToken(PsGetCurrentProcess());
    if (!ProcessToken)
        return STATUS_UNSUCCESSFUL;

    /* Get its parent and authentication IDs */
    ProcessParentId = ProcessToken->ParentTokenId;
    ProcessAuthId = ProcessToken->AuthenticationId;

    /* Dereference the token */
    ObFastDereferenceObject(&PsGetCurrentProcess()->Token, ProcessToken);

    /* Get our parent and authentication IDs */
    CallerParentId = Token->ParentTokenId;
    CallerAuthId = Token->AuthenticationId;

    /* Compare the token IDs */
    if (RtlEqualLuid(&CallerParentId, &ProcessParentId) &&
        RtlEqualLuid(&CallerAuthId, &ProcessAuthId))
    {
        *IsSibling = TRUE;
    }

    /* Return success */
    return STATUS_SUCCESS;
}

Referenced by PspSetPrimaryToken().

SepCaptureAcl()

NTSTATUS NTAPI SepCaptureAcl	(	_In_ PACL	InputAcl,
		_In_ KPROCESSOR_MODE	AccessMode,
		_In_ POOL_TYPE	PoolType,
		_In_ BOOLEAN	CaptureIfKernel,
		_Out_ PACL *	CapturedAcl
	)

Captures an access control list from an already valid input ACL.

Parameters

[in]	InputAcl	A valid ACL.
[in]	AccessMode	Processor level access mode. The processor mode determines how the input arguments are probed.
[in]	PoolType	Pool type for new captured ACL for creation. The pool type determines in which memory pool the ACL data should reside.
[in]	CaptureIfKernel	If set to TRUE and the processor access mode being KernelMode, we are capturing an ACL directly in the kernel. Otherwise we are capturing within a kernel mode driver.
[out]	CapturedAcl	The returned and allocated captured ACL.

Returns

Returns STATUS_SUCCESS if the ACL has been successfully captured. STATUS_INSUFFICIENT_RESOURCES is returned otherwise.

Definition at line 352 of file acl.c.

{
    PACL NewAcl;
    ULONG AclSize;

    PAGED_CODE();

    /* If in kernel mode and we do not capture, just
     * return the given ACL and don't validate it. */
    if ((AccessMode == KernelMode) && !CaptureIfKernel)
    {
        *CapturedAcl = InputAcl;
        return STATUS_SUCCESS;
    }

    /* Otherwise, capture and validate the ACL, depending on the access mode */
    if (AccessMode != KernelMode)
    {
        _SEH2_TRY
        {
            ProbeForRead(InputAcl,
                         sizeof(ACL),
                         sizeof(ULONG));
            AclSize = InputAcl->AclSize;
            ProbeForRead(InputAcl,
                         AclSize,
                         sizeof(ULONG));
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Return the exception code */
            _SEH2_YIELD(return _SEH2_GetExceptionCode());
        }
        _SEH2_END;

        /* Validate the minimal size an ACL can have */
        if (AclSize < sizeof(ACL))
            return STATUS_INVALID_ACL;

        NewAcl = ExAllocatePoolWithTag(PoolType,
                                       AclSize,
                                       TAG_ACL);
        if (!NewAcl)
            return STATUS_INSUFFICIENT_RESOURCES;

        _SEH2_TRY
        {
            RtlCopyMemory(NewAcl, InputAcl, AclSize);
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Free the ACL and return the exception code */
            ExFreePoolWithTag(NewAcl, TAG_ACL);
            _SEH2_YIELD(return _SEH2_GetExceptionCode());
        }
        _SEH2_END;
    }
    else
    {
        AclSize = InputAcl->AclSize;

        /* Validate the minimal size an ACL can have */
        if (AclSize < sizeof(ACL))
            return STATUS_INVALID_ACL;

        NewAcl = ExAllocatePoolWithTag(PoolType,
                                       AclSize,
                                       TAG_ACL);
        if (!NewAcl)
            return STATUS_INSUFFICIENT_RESOURCES;

        RtlCopyMemory(NewAcl, InputAcl, AclSize);
    }

    /* Validate the captured ACL */
    if (!RtlValidAcl(NewAcl))
    {
        /* Free the ACL and fail */
        ExFreePoolWithTag(NewAcl, TAG_ACL);
        return STATUS_INVALID_ACL;
    }

    /* It's valid, return it */
    *CapturedAcl = NewAcl;
    return STATUS_SUCCESS;
}

Referenced by NtCreateToken(), and NtSetInformationToken().

SepCaptureSecurityQualityOfService()

NTSTATUS NTAPI SepCaptureSecurityQualityOfService	(	_In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ KPROCESSOR_MODE	AccessMode,
		_In_ POOL_TYPE	PoolType,
		_In_ BOOLEAN	CaptureIfKernel,
		_Out_ PSECURITY_QUALITY_OF_SERVICE *	CapturedSecurityQualityOfService,
		_Out_ PBOOLEAN	Present
	)

Captures the security quality of service data given the object attributes from an object.

Parameters

[in]	ObjectAttributes	Attributes of an object where SQOS is to be retrieved. If the caller doesn't fill object attributes to the function, it automatically assumes SQOS is not present, or if, there's no SQOS present in the object attributes list of the object itself.
[in]	AccessMode	Processor access mode.
[in]	PoolType	The pool type for the captured SQOS to be used for allocation.
[in]	CaptureIfKernel	Capture access condition. To be set to TRUE if the capture is done within the kernel, FALSE if the capture is done in a kernel mode driver or user mode otherwise.
[out]	CapturedSecurityQualityOfService	The captured SQOS data from the object.
[out]	Present	Returns TRUE if SQOS is present in an object, FALSE otherwise. FALSE is also immediately returned if no object attributes is given to the call.

Returns

STATUS_SUCCESS if SQOS from the object has been fully and successfully captured. STATUS_INVALID_PARAMETER if the caller submits an invalid object attributes list. STATUS_INSUFFICIENT_RESOURCES if the function has failed to allocate some resources in the pool for the captured SQOS. A failure NTSTATUS code is returned otherwise.

Definition at line 52 of file sqos.c.

{
    PSECURITY_QUALITY_OF_SERVICE CapturedQos;
    NTSTATUS Status = STATUS_SUCCESS;

    PAGED_CODE();

    ASSERT(CapturedSecurityQualityOfService);
    ASSERT(Present);

    if (ObjectAttributes != NULL)
    {
        if (AccessMode != KernelMode)
        {
            SECURITY_QUALITY_OF_SERVICE SafeQos;

            _SEH2_TRY
            {
                ProbeForRead(ObjectAttributes,
                             sizeof(OBJECT_ATTRIBUTES),
                             sizeof(ULONG));
                if (ObjectAttributes->Length == sizeof(OBJECT_ATTRIBUTES))
                {
                    if (ObjectAttributes->SecurityQualityOfService != NULL)
                    {
                        ProbeForRead(ObjectAttributes->SecurityQualityOfService,
                                     sizeof(SECURITY_QUALITY_OF_SERVICE),
                                     sizeof(ULONG));

                        if (((PSECURITY_QUALITY_OF_SERVICE)ObjectAttributes->SecurityQualityOfService)->Length ==
                            sizeof(SECURITY_QUALITY_OF_SERVICE))
                        {
                            /*
                             * Don't allocate memory here because ExAllocate should bugcheck
                             * the system if it's buggy, SEH would catch that! So make a local
                             * copy of the qos structure.
                             */
                            RtlCopyMemory(&SafeQos,
                                          ObjectAttributes->SecurityQualityOfService,
                                          sizeof(SECURITY_QUALITY_OF_SERVICE));
                            *Present = TRUE;
                        }
                        else
                        {
                            Status = STATUS_INVALID_PARAMETER;
                        }
                    }
                    else
                    {
                        *CapturedSecurityQualityOfService = NULL;
                        *Present = FALSE;
                    }
                }
                else
                {
                    Status = STATUS_INVALID_PARAMETER;
                }
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;

            if (NT_SUCCESS(Status))
            {
                if (*Present)
                {
                    CapturedQos = ExAllocatePoolWithTag(PoolType,
                                                        sizeof(SECURITY_QUALITY_OF_SERVICE),
                                                        TAG_QOS);
                    if (CapturedQos != NULL)
                    {
                        RtlCopyMemory(CapturedQos,
                                      &SafeQos,
                                      sizeof(SECURITY_QUALITY_OF_SERVICE));
                        *CapturedSecurityQualityOfService = CapturedQos;
                    }
                    else
                    {
                        Status = STATUS_INSUFFICIENT_RESOURCES;
                    }
                }
                else
                {
                    *CapturedSecurityQualityOfService = NULL;
                }
            }
        }
        else
        {
            if (ObjectAttributes->Length == sizeof(OBJECT_ATTRIBUTES))
            {
                if (CaptureIfKernel)
                {
                    if (ObjectAttributes->SecurityQualityOfService != NULL)
                    {
                        if (((PSECURITY_QUALITY_OF_SERVICE)ObjectAttributes->SecurityQualityOfService)->Length ==
                            sizeof(SECURITY_QUALITY_OF_SERVICE))
                        {
                            CapturedQos = ExAllocatePoolWithTag(PoolType,
                                                                sizeof(SECURITY_QUALITY_OF_SERVICE),
                                                                TAG_QOS);
                            if (CapturedQos != NULL)
                            {
                                RtlCopyMemory(CapturedQos,
                                              ObjectAttributes->SecurityQualityOfService,
                                              sizeof(SECURITY_QUALITY_OF_SERVICE));
                                *CapturedSecurityQualityOfService = CapturedQos;
                                *Present = TRUE;
                            }
                            else
                            {
                                Status = STATUS_INSUFFICIENT_RESOURCES;
                            }
                        }
                        else
                        {
                            Status = STATUS_INVALID_PARAMETER;
                        }
                    }
                    else
                    {
                        *CapturedSecurityQualityOfService = NULL;
                        *Present = FALSE;
                    }
                }
                else
                {
                    *CapturedSecurityQualityOfService = (PSECURITY_QUALITY_OF_SERVICE)ObjectAttributes->SecurityQualityOfService;
                    *Present = (ObjectAttributes->SecurityQualityOfService != NULL);
                }
            }
            else
            {
                Status = STATUS_INVALID_PARAMETER;
            }
        }
    }
    else
    {
        *CapturedSecurityQualityOfService = NULL;
        *Present = FALSE;
    }

    return Status;
}

Referenced by NtDuplicateToken().

SepCaptureSid()

NTSTATUS NTAPI SepCaptureSid	(	_In_ PSID	InputSid,
		_In_ KPROCESSOR_MODE	AccessMode,
		_In_ POOL_TYPE	PoolType,
		_In_ BOOLEAN	CaptureIfKernel,
		_Out_ PSID *	CapturedSid
	)

Captures a SID.

Parameters

[in]	InputSid	A valid security identifier to be captured.
[in]	AccessMode	Processor level access mode.
[in]	PoolType	Pool memory type for the captured SID to assign upon allocation.
[in]	CaptureIfKernel	If set to TRUE, the capturing is done within the kernel. Otherwise the capturing is done in a kernel mode driver.
[out]	CapturedSid	The captured security identifier, returned to the caller.

Returns

Returns STATUS_SUCCESS if the SID was captured. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the captured SID has failed.

Definition at line 314 of file sid.c.

{
    ULONG SidSize = 0;
    PISID NewSid, Sid = (PISID)InputSid;

    PAGED_CODE();

    if (AccessMode != KernelMode)
    {
        _SEH2_TRY
        {
            ProbeForRead(Sid, FIELD_OFFSET(SID, SubAuthority), sizeof(UCHAR));
            SidSize = RtlLengthRequiredSid(Sid->SubAuthorityCount);
            ProbeForRead(Sid, SidSize, sizeof(UCHAR));
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Return the exception code */
            _SEH2_YIELD(return _SEH2_GetExceptionCode());
        }
        _SEH2_END;

        /* Allocate a SID and copy it */
        NewSid = ExAllocatePoolWithTag(PoolType, SidSize, TAG_SID);
        if (!NewSid)
            return STATUS_INSUFFICIENT_RESOURCES;

        _SEH2_TRY
        {
            RtlCopyMemory(NewSid, Sid, SidSize);

            *CapturedSid = NewSid;
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Free the SID and return the exception code */
            ExFreePoolWithTag(NewSid, TAG_SID);
            _SEH2_YIELD(return _SEH2_GetExceptionCode());
        }
        _SEH2_END;
    }
    else if (!CaptureIfKernel)
    {
        *CapturedSid = InputSid;
    }
    else
    {
        SidSize = RtlLengthRequiredSid(Sid->SubAuthorityCount);

        /* Allocate a SID and copy it */
        NewSid = ExAllocatePoolWithTag(PoolType, SidSize, TAG_SID);
        if (NewSid == NULL)
            return STATUS_INSUFFICIENT_RESOURCES;

        RtlCopyMemory(NewSid, Sid, SidSize);

        *CapturedSid = NewSid;
    }

    return STATUS_SUCCESS;
}

Referenced by NtCreateToken(), NtSecureConnectPort(), NtSetInformationToken(), and SepAccessCheckAndAuditAlarm().

SepComputeAvailableDynamicSpace()

ULONG SepComputeAvailableDynamicSpace	(	_In_ ULONG	DynamicCharged,
		_In_ PSID	PrimaryGroup,
		_In_opt_ PACL	DefaultDacl
	)

Computes the exact available dynamic area of an access token whilst querying token statistics.

Parameters

[in]	DynamicCharged	The current charged dynamic area of an access token. This must not be 0!
[in]	PrimaryGroup	A pointer to a primary group SID.
[in]	DefaultDacl	If provided, this pointer points to a default DACL of an access token.

Returns

Returns the calculated available dynamic area.

Definition at line 659 of file token.c.

{
    ULONG DynamicAvailable;

    PAGED_CODE();

    /* A token's dynamic area is always charged */
    ASSERT(DynamicCharged != 0);

    /*
     * Take into account the default DACL if
     * the token has one. Otherwise the occupied
     * space is just the present primary group.
     */
    DynamicAvailable = DynamicCharged - RtlLengthSid(PrimaryGroup);
    if (DefaultDacl)
    {
        DynamicAvailable -= DefaultDacl->AclSize;
    }

    return DynamicAvailable;
}

Referenced by NtQueryInformationToken(), and SeQueryInformationToken().

SepCreateImpersonationTokenDacl()

NTSTATUS NTAPI SepCreateImpersonationTokenDacl	(	_In_ PTOKEN	Token,
		_In_ PTOKEN	PrimaryToken,
		_Out_ PACL *	Dacl
	)

Allocates a discretionary access control list based on certain properties of a regular and primary access tokens.

Parameters

[in]	Token	An access token.
[in]	PrimaryToken	A primary access token.
[out]	Dacl	The returned allocated DACL.

Returns

Returns STATUS_SUCCESS if DACL creation from tokens has completed successfully. STATUS_INSUFFICIENT_RESOURCES is returned if DACL allocation from memory pool fails otherwise.

Definition at line 277 of file acl.c.

{
    ULONG AclLength;
    PACL TokenDacl;

    PAGED_CODE();

    *Dacl = NULL;

    AclLength = sizeof(ACL) +
        (sizeof(ACE) + RtlLengthSid(SeAliasAdminsSid)) +
        (sizeof(ACE) + RtlLengthSid(SeLocalSystemSid)) +
        (sizeof(ACE) + RtlLengthSid(SeRestrictedCodeSid)) +
        (sizeof(ACE) + RtlLengthSid(Token->UserAndGroups->Sid)) +
        (sizeof(ACE) + RtlLengthSid(PrimaryToken->UserAndGroups->Sid));

    TokenDacl = ExAllocatePoolWithTag(PagedPool, AclLength, TAG_ACL);
    if (TokenDacl == NULL)
    {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    RtlCreateAcl(TokenDacl, AclLength, ACL_REVISION);
    RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
                           Token->UserAndGroups->Sid);
    RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
                           PrimaryToken->UserAndGroups->Sid);
    RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
                           SeAliasAdminsSid);
    RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
                           SeLocalSystemSid);

    if (Token->RestrictedSids != NULL || PrimaryToken->RestrictedSids != NULL)
    {
        RtlAddAccessAllowedAce(TokenDacl, ACL_REVISION, GENERIC_ALL,
                               SeRestrictedCodeSid);
    }

    *Dacl = TokenDacl;

    return STATUS_SUCCESS;
}

Referenced by NtOpenThreadTokenEx().

SepCreateSystemAnonymousLogonToken()

PTOKEN SepCreateSystemAnonymousLogonToken

(

VOID

)

Creates the anonymous logon token for the system. The difference between this token and the other one is the inclusion of everyone SID group (being SeWorldSid). The other token lacks such group.

Returns

Returns the system's anonymous logon token if the operations have completed successfully.

Definition at line 1657 of file token.c.

{
    SID_AND_ATTRIBUTES Groups[32], UserSid;
    PSID PrimaryGroup;
    PTOKEN Token;
    ULONG GroupsLength;
    LARGE_INTEGER Expiration;
    OBJECT_ATTRIBUTES ObjectAttributes;
    NTSTATUS Status;

    /* The token never expires */
    Expiration.QuadPart = -1;

    /* The user is the anonymous logon */
    UserSid.Sid = SeAnonymousLogonSid;
    UserSid.Attributes = 0;

    /* The primary group is also the anonymous logon */
    PrimaryGroup = SeAnonymousLogonSid;

    /* The only group for the token is the World */
    Groups[0].Sid = SeWorldSid;
    Groups[0].Attributes = SE_GROUP_ENABLED | SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT;
    GroupsLength = sizeof(SID_AND_ATTRIBUTES) +
                   SeLengthSid(Groups[0].Sid);
    ASSERT(GroupsLength <= sizeof(Groups));

    /* Initialise the object attributes for the token */
    InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
    ASSERT(SeSystemAnonymousLogonDacl != NULL);

    /* Create token */
    Status = SepCreateToken((PHANDLE)&Token,
                            KernelMode,
                            0,
                            &ObjectAttributes,
                            TokenPrimary,
                            SecurityAnonymous,
                            &SeAnonymousAuthenticationId,
                            &Expiration,
                            &UserSid,
                            1,
                            Groups,
                            GroupsLength,
                            0,
                            NULL,
                            NULL,
                            PrimaryGroup,
                            SeSystemAnonymousLogonDacl,
                            &SeSystemTokenSource,
                            TRUE);
    ASSERT(Status == STATUS_SUCCESS);

    /* Return the anonymous logon token */
    return Token;
}

Referenced by SepInitializationPhase0().

SepCreateSystemAnonymousLogonTokenNoEveryone()

PTOKEN SepCreateSystemAnonymousLogonTokenNoEveryone

(

VOID

)

Creates the anonymous logon token for the system. This kind of token doesn't include the everyone SID group (being SeWorldSid).

Returns

Returns the system's anonymous logon token if the operations have completed successfully.

Definition at line 1725 of file token.c.

{
    SID_AND_ATTRIBUTES UserSid;
    PSID PrimaryGroup;
    PTOKEN Token;
    LARGE_INTEGER Expiration;
    OBJECT_ATTRIBUTES ObjectAttributes;
    NTSTATUS Status;

    /* The token never expires */
    Expiration.QuadPart = -1;

    /* The user is the anonymous logon */
    UserSid.Sid = SeAnonymousLogonSid;
    UserSid.Attributes = 0;

    /* The primary group is also the anonymous logon */
    PrimaryGroup = SeAnonymousLogonSid;

    /* Initialise the object attributes for the token */
    InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
    ASSERT(SeSystemAnonymousLogonDacl != NULL);

    /* Create token */
    Status = SepCreateToken((PHANDLE)&Token,
                            KernelMode,
                            0,
                            &ObjectAttributes,
                            TokenPrimary,
                            SecurityAnonymous,
                            &SeAnonymousAuthenticationId,
                            &Expiration,
                            &UserSid,
                            0,
                            NULL,
                            0,
                            0,
                            NULL,
                            NULL,
                            PrimaryGroup,
                            SeSystemAnonymousLogonDacl,
                            &SeSystemTokenSource,
                            TRUE);
    ASSERT(Status == STATUS_SUCCESS);

    /* Return the anonymous (not including everyone) logon token */
    return Token;
}

Referenced by SepInitializationPhase0().

SepCreateSystemProcessToken()

PTOKEN NTAPI SepCreateSystemProcessToken

(

VOID

)

Creates the system process token.

Returns

Returns the system process token if the operations have completed successfully.

Definition at line 1507 of file token.c.

{
    LUID_AND_ATTRIBUTES Privileges[25];
    ULONG GroupAttributes, OwnerAttributes;
    SID_AND_ATTRIBUTES Groups[32];
    LARGE_INTEGER Expiration;
    SID_AND_ATTRIBUTES UserSid;
    ULONG GroupsLength;
    PSID PrimaryGroup;
    OBJECT_ATTRIBUTES ObjectAttributes;
    PSID Owner;
    ULONG i;
    PTOKEN Token;
    NTSTATUS Status;

    /* Don't ever expire */
    Expiration.QuadPart = -1;

    /* All groups mandatory and enabled */
    GroupAttributes = SE_GROUP_ENABLED | SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT;
    OwnerAttributes = SE_GROUP_ENABLED | SE_GROUP_OWNER | SE_GROUP_ENABLED_BY_DEFAULT;

    /* User is Local System */
    UserSid.Sid = SeLocalSystemSid;
    UserSid.Attributes = 0;

    /* Primary group is Local System */
    PrimaryGroup = SeLocalSystemSid;

    /* Owner is Administrators */
    Owner = SeAliasAdminsSid;

    /* Groups are Administrators, World, and Authenticated Users */
    Groups[0].Sid = SeAliasAdminsSid;
    Groups[0].Attributes = OwnerAttributes;
    Groups[1].Sid = SeWorldSid;
    Groups[1].Attributes = GroupAttributes;
    Groups[2].Sid = SeAuthenticatedUsersSid;
    Groups[2].Attributes = GroupAttributes;
    GroupsLength = sizeof(SID_AND_ATTRIBUTES) +
                   SeLengthSid(Groups[0].Sid) +
                   SeLengthSid(Groups[1].Sid) +
                   SeLengthSid(Groups[2].Sid);
    ASSERT(GroupsLength <= sizeof(Groups));

    /* Setup the privileges */
    i = 0;
    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
    Privileges[i++].Luid = SeTcbPrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeCreateTokenPrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeTakeOwnershipPrivilege;

    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
    Privileges[i++].Luid = SeCreatePagefilePrivilege;

    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
    Privileges[i++].Luid = SeLockMemoryPrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeAssignPrimaryTokenPrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeIncreaseQuotaPrivilege;

    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
    Privileges[i++].Luid = SeIncreaseBasePriorityPrivilege;

    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
    Privileges[i++].Luid = SeCreatePermanentPrivilege;

    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
    Privileges[i++].Luid = SeDebugPrivilege;

    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
    Privileges[i++].Luid = SeAuditPrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeSecurityPrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeSystemEnvironmentPrivilege;

    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
    Privileges[i++].Luid = SeChangeNotifyPrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeBackupPrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeRestorePrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeShutdownPrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeLoadDriverPrivilege;

    Privileges[i].Attributes = SE_PRIVILEGE_ENABLED_BY_DEFAULT | SE_PRIVILEGE_ENABLED;
    Privileges[i++].Luid = SeProfileSingleProcessPrivilege;

    Privileges[i].Attributes = 0;
    Privileges[i++].Luid = SeSystemtimePrivilege;
    ASSERT(i == 20);

    /* Setup the object attributes */
    InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
    ASSERT(SeSystemDefaultDacl != NULL);

    /* Create the token */
    Status = SepCreateToken((PHANDLE)&Token,
                            KernelMode,
                            0,
                            &ObjectAttributes,
                            TokenPrimary,
                            SecurityAnonymous,
                            &SeSystemAuthenticationId,
                            &Expiration,
                            &UserSid,
                            3,
                            Groups,
                            GroupsLength,
                            20,
                            Privileges,
                            Owner,
                            PrimaryGroup,
                            SeSystemDefaultDacl,
                            &SeSystemTokenSource,
                            TRUE);
    ASSERT(Status == STATUS_SUCCESS);

    /* Return the token */
    return Token;
}

Referenced by SepInitializationPhase0().

SepCreateToken()

NTSTATUS NTAPI SepCreateToken	(	_Out_ PHANDLE	TokenHandle,
		_In_ KPROCESSOR_MODE	PreviousMode,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ TOKEN_TYPE	TokenType,
		_In_ SECURITY_IMPERSONATION_LEVEL	ImpersonationLevel,
		_In_ PLUID	AuthenticationId,
		_In_ PLARGE_INTEGER	ExpirationTime,
		_In_ PSID_AND_ATTRIBUTES	User,
		_In_ ULONG	GroupCount,
		_In_ PSID_AND_ATTRIBUTES	Groups,
		_In_ ULONG	GroupsLength,
		_In_ ULONG	PrivilegeCount,
		_In_ PLUID_AND_ATTRIBUTES	Privileges,
		_In_opt_ PSID	Owner,
		_In_ PSID	PrimaryGroup,
		_In_opt_ PACL	DefaultDacl,
		_In_ PTOKEN_SOURCE	TokenSource,
		_In_ BOOLEAN	SystemToken
	)

Internal function responsible for access token object creation in the kernel. A fully created token objected is inserted into the token handle, thus the handle becoming a valid handle to an access token object and ready for use.

Parameters

[out]	TokenHandle	Valid token handle that's ready for use after token creation and object insertion.
[in]	PreviousMode	Processor request level mode.
[in]	DesiredAccess	Desired access right for the token object to be granted. This kind of access right impacts how the token can be used and who.
[in]	ObjectAttributes	Object attributes for the token to be created.
[in]	TokenType	Type of token to assign upon creation.
[in]	ImpersonationLevel	Security impersonation level of token to assign upon creation.
[in]	AuthenticationId	Authentication ID that represents the authentication information of the token.
[in]	ExpirationTime	Expiration time of the token to assign. A value of -1 means that the token never expires and its life depends upon the amount of references this token object has.
[in]	User	User entry to assign to the token.
[in]	GroupCount	The total number of groups count for the token.
[in]	Groups	The group entries for the token.
[in]	GroupsLength	The length size of the groups array, pointed by the Groups parameter.
[in]	PrivilegeCount	The total number of priivleges that the newly created token has.
[in]	Privileges	The privileges for the token.
[in]	Owner	The main user (or also owner) that represents the token that we create.
[in]	PrimaryGroup	The main group that represents the token that we create.
[in]	DefaultDacl	A discretionary access control list for the token.
[in]	TokenSource	Source (or the origin) of the access token that creates it.
[in]	SystemToken	If set to TRUE, the newly created token is a system token and only in charge by the internal system. The function directly returns a pointer to the created token object for system kernel use. Otherwise if set to FALSE, the function inserts the object to a handle making it a regular access token.

Returns

Returns STATUS_SUCCESS if token creation has completed successfully. STATUS_INSUFFICIENT_RESOURCES is returned if the dynamic area of memory of the token hasn't been allocated because of lack of memory resources. A failure NTSTATUS code is returned otherwise.

Definition at line 97 of file tokenlif.c.

{
    NTSTATUS Status;
    PTOKEN AccessToken;
    ULONG TokenFlags = 0;
    ULONG PrimaryGroupIndex, DefaultOwnerIndex;
    LUID TokenId;
    LUID ModifiedId;
    PVOID EndMem;
    ULONG PrivilegesLength;
    ULONG UserGroupsLength;
    ULONG VariableLength;
    ULONG DynamicPartSize, TotalSize;
    ULONG TokenPagedCharges;
    ULONG i;

    PAGED_CODE();

    /* Loop all groups */
    for (i = 0; i < GroupCount; i++)
    {
        /* Check for mandatory groups */
        if (Groups[i].Attributes & SE_GROUP_MANDATORY)
        {
            /* Force them to be enabled */
            Groups[i].Attributes |= (SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT);
        }

        /* Check of the group is an admin group */
        if (RtlEqualSid(SeAliasAdminsSid, Groups[i].Sid))
        {
            /* Remember this so we can optimize queries later */
            TokenFlags |= TOKEN_HAS_ADMIN_GROUP;
        }
    }

    /* Allocate unique IDs for the token */
    ExAllocateLocallyUniqueId(&TokenId);
    ExAllocateLocallyUniqueId(&ModifiedId);

    /* Compute how much size we need to allocate for the token */

    /* Privileges size */
    PrivilegesLength = PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
    PrivilegesLength = ALIGN_UP_BY(PrivilegesLength, sizeof(PVOID));

    /* User and groups size */
    UserGroupsLength = (1 + GroupCount) * sizeof(SID_AND_ATTRIBUTES);
    UserGroupsLength += RtlLengthSid(User->Sid);
    for (i = 0; i < GroupCount; i++)
    {
        UserGroupsLength += RtlLengthSid(Groups[i].Sid);
    }
    UserGroupsLength = ALIGN_UP_BY(UserGroupsLength, sizeof(PVOID));

    /* Add the additional groups array length */
    UserGroupsLength += ALIGN_UP_BY(GroupsLength, sizeof(PVOID));

    VariableLength = PrivilegesLength + UserGroupsLength;
    TotalSize = FIELD_OFFSET(TOKEN, VariablePart) + VariableLength;

    /*
     * A token is considered slim if it has the default dynamic
     * contents, or in other words, the primary group and ACL.
     * We judge if such contents are default by checking their
     * total size if it's over the range. On Windows this range
     * is 0x1F4 (aka 500). If the size of the whole dynamic contents
     * is over that range then the token is considered fat and
     * the token will be charged the whole of its token body length
     * plus the dynamic size.
     */
    DynamicPartSize = DefaultDacl ? DefaultDacl->AclSize : 0;
    DynamicPartSize += RtlLengthSid(PrimaryGroup);
    if (DynamicPartSize > SE_TOKEN_DYNAMIC_SLIM)
    {
        TokenPagedCharges = DynamicPartSize + TotalSize;
    }
    else
    {
        TokenPagedCharges = SE_TOKEN_DYNAMIC_SLIM + TotalSize;
    }

    Status = ObCreateObject(PreviousMode,
                            SeTokenObjectType,
                            ObjectAttributes,
                            PreviousMode,
                            NULL,
                            TotalSize,
                            TokenPagedCharges,
                            0,
                            (PVOID*)&AccessToken);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("ObCreateObject() failed (Status 0x%lx)\n", Status);
        return Status;
    }

    /* Zero out the buffer and initialize the token */
    RtlZeroMemory(AccessToken, TotalSize);

    AccessToken->TokenId = TokenId;
    AccessToken->TokenType = TokenType;
    AccessToken->ImpersonationLevel = ImpersonationLevel;

    /* Initialise the lock for the access token */
    Status = SepCreateTokenLock(AccessToken);
    if (!NT_SUCCESS(Status))
        goto Quit;

    AccessToken->TokenSource.SourceIdentifier = TokenSource->SourceIdentifier;
    RtlCopyMemory(AccessToken->TokenSource.SourceName,
                  TokenSource->SourceName,
                  sizeof(TokenSource->SourceName));

    AccessToken->ExpirationTime = *ExpirationTime;
    AccessToken->ModifiedId = ModifiedId;
    AccessToken->DynamicCharged = TokenPagedCharges - TotalSize;

    AccessToken->TokenFlags = TokenFlags & ~TOKEN_SESSION_NOT_REFERENCED;

    /* Copy and reference the logon session */
    AccessToken->AuthenticationId = *AuthenticationId;
    Status = SepRmReferenceLogonSession(&AccessToken->AuthenticationId);
    if (!NT_SUCCESS(Status))
    {
        /* No logon session could be found, bail out */
        DPRINT1("SepRmReferenceLogonSession() failed (Status 0x%lx)\n", Status);
        /* Set the flag for proper cleanup by the delete procedure */
        AccessToken->TokenFlags |= TOKEN_SESSION_NOT_REFERENCED;
        goto Quit;
    }

    /* Insert the referenced logon session into the token */
    Status = SepRmInsertLogonSessionIntoToken(AccessToken);
    if (!NT_SUCCESS(Status))
    {
        /* Failed to insert the logon session into the token, bail out */
        DPRINT1("SepRmInsertLogonSessionIntoToken() failed (Status 0x%lx)\n", Status);
        goto Quit;
    }

    /* Fill in token debug information */
#if DBG
    /*
     * We must determine ourselves that the current
     * process is not the initial CPU one. The initial
     * process is not a "real" process, that is, the
     * Process Manager has not yet been initialized and
     * as a matter of fact we are creating a token before
     * any process gets created by Ps. If it turns out
     * that the current process is the initial CPU process
     * where token creation execution takes place, don't
     * do anything.
     */
    if (PsGetCurrentProcess() != &KiInitialProcess)
    {
        RtlCopyMemory(AccessToken->ImageFileName,
                      PsGetCurrentProcess()->ImageFileName,
                      min(sizeof(AccessToken->ImageFileName), sizeof(PsGetCurrentProcess()->ImageFileName)));

        AccessToken->ProcessCid = PsGetCurrentProcessId();
        AccessToken->ThreadCid = PsGetCurrentThreadId();
    }

    AccessToken->CreateMethod = TOKEN_CREATE_METHOD;
#endif

    /* Assign the data that reside in the token's variable information area */
    AccessToken->VariableLength = VariableLength;
    EndMem = (PVOID)&AccessToken->VariablePart;

    /* Copy the privileges */
    AccessToken->PrivilegeCount = PrivilegeCount;
    AccessToken->Privileges = NULL;
    if (PrivilegeCount > 0)
    {
        AccessToken->Privileges = EndMem;
        EndMem = (PVOID)((ULONG_PTR)EndMem + PrivilegesLength);
        VariableLength -= PrivilegesLength;

        if (PreviousMode != KernelMode)
        {
            _SEH2_TRY
            {
                RtlCopyMemory(AccessToken->Privileges,
                              Privileges,
                              PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES));
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
        }
        else
        {
            RtlCopyMemory(AccessToken->Privileges,
                          Privileges,
                          PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES));
        }

        if (!NT_SUCCESS(Status))
            goto Quit;
    }

    /* Update the privilege flags */
    SepUpdatePrivilegeFlagsToken(AccessToken);

    /* Copy the user and groups */
    AccessToken->UserAndGroupCount = 1 + GroupCount;
    AccessToken->UserAndGroups = EndMem;
    EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount];
    VariableLength -= ((ULONG_PTR)EndMem - (ULONG_PTR)AccessToken->UserAndGroups);

    Status = RtlCopySidAndAttributesArray(1,
                                          User,
                                          VariableLength,
                                          &AccessToken->UserAndGroups[0],
                                          EndMem,
                                          &EndMem,
                                          &VariableLength);
    if (!NT_SUCCESS(Status))
        goto Quit;

    Status = RtlCopySidAndAttributesArray(GroupCount,
                                          Groups,
                                          VariableLength,
                                          &AccessToken->UserAndGroups[1],
                                          EndMem,
                                          &EndMem,
                                          &VariableLength);
    if (!NT_SUCCESS(Status))
        goto Quit;

    /* Find the token primary group and default owner */
    Status = SepFindPrimaryGroupAndDefaultOwner(AccessToken,
                                                PrimaryGroup,
                                                Owner,
                                                &PrimaryGroupIndex,
                                                &DefaultOwnerIndex);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("SepFindPrimaryGroupAndDefaultOwner failed (Status 0x%lx)\n", Status);
        goto Quit;
    }

    /*
     * Now allocate the token's dynamic information area
     * and set the data. The dynamic part consists of two
     * contents, the primary group SID and the default DACL
     * of the token, in this strict order.
     */
    AccessToken->DynamicPart = ExAllocatePoolWithTag(PagedPool,
                                                     DynamicPartSize,
                                                     TAG_TOKEN_DYNAMIC);
    if (AccessToken->DynamicPart == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto Quit;
    }

    /* Unused memory in the dynamic area */
    AccessToken->DynamicAvailable = 0;

    /*
     * Assign the primary group to the token
     * and put it in the dynamic part as well.
     */
    EndMem = (PVOID)AccessToken->DynamicPart;
    AccessToken->PrimaryGroup = EndMem;
    RtlCopySid(RtlLengthSid(AccessToken->UserAndGroups[PrimaryGroupIndex].Sid),
                            EndMem,
                            AccessToken->UserAndGroups[PrimaryGroupIndex].Sid);
    AccessToken->DefaultOwnerIndex = DefaultOwnerIndex;
    EndMem = (PVOID)((ULONG_PTR)EndMem + RtlLengthSid(AccessToken->UserAndGroups[PrimaryGroupIndex].Sid));

    /*
     * We have assigned a primary group and put it in the
     * dynamic part, now it's time to copy the provided
     * default DACL (if it's provided to begin with) into
     * the DACL field of the token and put it at the end
     * tail of the dynamic part too.
     */
    if (DefaultDacl != NULL)
    {
        AccessToken->DefaultDacl = EndMem;

        RtlCopyMemory(EndMem,
                      DefaultDacl,
                      DefaultDacl->AclSize);
    }

    /* Insert the token only if it's not the system token, otherwise return it directly */
    if (!SystemToken)
    {
        Status = ObInsertObject(AccessToken,
                                NULL,
                                DesiredAccess,
                                0,
                                NULL,
                                TokenHandle);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("ObInsertObject() failed (Status 0x%lx)\n", Status);
        }
    }
    else
    {
        /* Return pointer instead of handle */
        *TokenHandle = (HANDLE)AccessToken;
    }

Quit:
    if (!NT_SUCCESS(Status))
    {
        /* Dereference the token, the delete procedure will clean it up */
        ObDereferenceObject(AccessToken);
    }

    return Status;
}

Referenced by NtCreateToken(), SepCreateSystemAnonymousLogonToken(), SepCreateSystemAnonymousLogonTokenNoEveryone(), and SepCreateSystemProcessToken().

SepCreateTokenLock()

NTSTATUS SepCreateTokenLock

(

_Inout_ PTOKEN

Token

)

Creates a lock for the token.

Parameters

[in,out]

Token

A token which lock has to be created.

Returns

STATUS_SUCCESS if the pool allocation and resource initialisation have completed successfully, otherwise STATUS_INSUFFICIENT_RESOURCES on a pool allocation failure.

Definition at line 45 of file token.c.

{
    PAGED_CODE();

    Token->TokenLock = ExAllocatePoolWithTag(NonPagedPool,
                                             sizeof(ERESOURCE),
                                             TAG_SE_TOKEN_LOCK);
    if (Token->TokenLock == NULL)
    {
        DPRINT1("SepCreateTokenLock(): Failed to allocate memory!\n");
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    ExInitializeResourceLite(Token->TokenLock);
    return STATUS_SUCCESS;
}

Referenced by SepCreateToken(), SepDuplicateToken(), and SepPerformTokenFiltering().

SepDeleteTokenLock()

VOID SepDeleteTokenLock

(

_Inout_ PTOKEN

Token

)

Deletes a lock of a token.

Parameters

[in,out]

Token

A token which contains the lock.

Returns

Nothing.

Definition at line 74 of file token.c.

{
    PAGED_CODE();

    ExDeleteResourceLite(Token->TokenLock);
    ExFreePoolWithTag(Token->TokenLock, TAG_SE_TOKEN_LOCK);
}

Referenced by SepDeleteToken().

SepDuplicateToken()

NTSTATUS NTAPI SepDuplicateToken	(	_In_ PTOKEN	Token,
		_In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ BOOLEAN	EffectiveOnly,
		_In_ TOKEN_TYPE	TokenType,
		_In_ SECURITY_IMPERSONATION_LEVEL	Level,
		_In_ KPROCESSOR_MODE	PreviousMode,
		_Out_ PTOKEN *	NewAccessToken
	)

Duplicates an access token, from an existing valid token.

Parameters

[in]	Token	Access token to duplicate.
[in]	ObjectAttributes	Object attributes for the new token.
[in]	EffectiveOnly	If set to TRUE, the function removes all the disabled privileges and groups of the token to duplicate.
[in]	TokenType	Type of token.
[in]	Level	Security impersonation level of a token.
[in]	PreviousMode	The processor request level mode.
[out]	NewAccessToken	The duplicated token.

Returns

Returns STATUS_SUCCESS if the token has been duplicated. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation of the dynamic part of the token for duplication has failed due to the lack of memory resources. A failure NTSTATUS code is returned otherwise.

Definition at line 471 of file tokenlif.c.

{
    NTSTATUS Status;
    PTOKEN AccessToken;
    PVOID EndMem;
    ULONG PrimaryGroupIndex;
    ULONG VariableLength;
    ULONG DynamicPartSize, TotalSize;
    ULONG PrivilegesIndex, GroupsIndex;

    PAGED_CODE();

    /* Compute how much size we need to allocate for the token */
    VariableLength = Token->VariableLength;
    TotalSize = FIELD_OFFSET(TOKEN, VariablePart) + VariableLength;

    /*
     * Compute how much size we need to allocate
     * the dynamic part of the newly duplicated
     * token.
     */
    DynamicPartSize = Token->DefaultDacl ? Token->DefaultDacl->AclSize : 0;
    DynamicPartSize += RtlLengthSid(Token->PrimaryGroup);

    Status = ObCreateObject(PreviousMode,
                            SeTokenObjectType,
                            ObjectAttributes,
                            PreviousMode,
                            NULL,
                            TotalSize,
                            Token->DynamicCharged,
                            TotalSize,
                            (PVOID*)&AccessToken);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("ObCreateObject() failed (Status 0x%lx)\n", Status);
        return Status;
    }

    /* Zero out the buffer and initialize the token */
    RtlZeroMemory(AccessToken, TotalSize);

    ExAllocateLocallyUniqueId(&AccessToken->TokenId);

    AccessToken->TokenType = TokenType;
    AccessToken->ImpersonationLevel = Level;

    /* Initialise the lock for the access token */
    Status = SepCreateTokenLock(AccessToken);
    if (!NT_SUCCESS(Status))
    {
        ObDereferenceObject(AccessToken);
        return Status;
    }

    /* Copy the immutable fields */
    AccessToken->TokenSource.SourceIdentifier = Token->TokenSource.SourceIdentifier;
    RtlCopyMemory(AccessToken->TokenSource.SourceName,
                  Token->TokenSource.SourceName,
                  sizeof(Token->TokenSource.SourceName));

    AccessToken->AuthenticationId = Token->AuthenticationId;
    AccessToken->ParentTokenId = Token->ParentTokenId;
    AccessToken->ExpirationTime = Token->ExpirationTime;
    AccessToken->OriginatingLogonSession = Token->OriginatingLogonSession;
    AccessToken->DynamicCharged = Token->DynamicCharged;

    /* Lock the source token and copy the mutable fields */
    SepAcquireTokenLockShared(Token);

    AccessToken->SessionId = Token->SessionId;
    AccessToken->ModifiedId = Token->ModifiedId;

    AccessToken->TokenFlags = Token->TokenFlags & ~TOKEN_SESSION_NOT_REFERENCED;

    /* Reference the logon session */
    Status = SepRmReferenceLogonSession(&AccessToken->AuthenticationId);
    if (!NT_SUCCESS(Status))
    {
        /* No logon session could be found, bail out */
        DPRINT1("SepRmReferenceLogonSession() failed (Status 0x%lx)\n", Status);
        /* Set the flag for proper cleanup by the delete procedure */
        AccessToken->TokenFlags |= TOKEN_SESSION_NOT_REFERENCED;
        goto Quit;
    }

    /* Insert the referenced logon session into the token */
    Status = SepRmInsertLogonSessionIntoToken(AccessToken);
    if (!NT_SUCCESS(Status))
    {
        /* Failed to insert the logon session into the token, bail out */
        DPRINT1("SepRmInsertLogonSessionIntoToken() failed (Status 0x%lx)\n", Status);
        goto Quit;
    }

    /* Fill in token debug information */
#if DBG
    RtlCopyMemory(AccessToken->ImageFileName,
                  PsGetCurrentProcess()->ImageFileName,
                  min(sizeof(AccessToken->ImageFileName), sizeof(PsGetCurrentProcess()->ImageFileName)));

    AccessToken->ProcessCid = PsGetCurrentProcessId();
    AccessToken->ThreadCid = PsGetCurrentThreadId();
    AccessToken->CreateMethod = TOKEN_DUPLICATE_METHOD;
#endif

    /* Assign the data that reside in the token's variable information area */
    AccessToken->VariableLength = VariableLength;
    EndMem = (PVOID)&AccessToken->VariablePart;

    /* Copy the privileges */
    AccessToken->PrivilegeCount = 0;
    AccessToken->Privileges = NULL;
    if (Token->Privileges && (Token->PrivilegeCount > 0))
    {
        ULONG PrivilegesLength = Token->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
        PrivilegesLength = ALIGN_UP_BY(PrivilegesLength, sizeof(PVOID));

        ASSERT(VariableLength >= PrivilegesLength);

        AccessToken->PrivilegeCount = Token->PrivilegeCount;
        AccessToken->Privileges = EndMem;
        EndMem = (PVOID)((ULONG_PTR)EndMem + PrivilegesLength);
        VariableLength -= PrivilegesLength;

        RtlCopyMemory(AccessToken->Privileges,
                      Token->Privileges,
                      AccessToken->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES));
    }

    /* Copy the user and groups */
    AccessToken->UserAndGroupCount = 0;
    AccessToken->UserAndGroups = NULL;
    if (Token->UserAndGroups && (Token->UserAndGroupCount > 0))
    {
        AccessToken->UserAndGroupCount = Token->UserAndGroupCount;
        AccessToken->UserAndGroups = EndMem;
        EndMem = &AccessToken->UserAndGroups[AccessToken->UserAndGroupCount];
        VariableLength -= ((ULONG_PTR)EndMem - (ULONG_PTR)AccessToken->UserAndGroups);

        Status = RtlCopySidAndAttributesArray(AccessToken->UserAndGroupCount,
                                              Token->UserAndGroups,
                                              VariableLength,
                                              AccessToken->UserAndGroups,
                                              EndMem,
                                              &EndMem,
                                              &VariableLength);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("RtlCopySidAndAttributesArray(UserAndGroups) failed (Status 0x%lx)\n", Status);
            goto Quit;
        }
    }

    /* Find the token primary group */
    Status = SepFindPrimaryGroupAndDefaultOwner(AccessToken,
                                                Token->PrimaryGroup,
                                                NULL,
                                                &PrimaryGroupIndex,
                                                NULL);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("SepFindPrimaryGroupAndDefaultOwner failed (Status 0x%lx)\n", Status);
        goto Quit;
    }

    /* Copy the restricted SIDs */
    AccessToken->RestrictedSidCount = 0;
    AccessToken->RestrictedSids = NULL;
    if (Token->RestrictedSids && (Token->RestrictedSidCount > 0))
    {
        AccessToken->RestrictedSidCount = Token->RestrictedSidCount;
        AccessToken->RestrictedSids = EndMem;
        EndMem = &AccessToken->RestrictedSids[AccessToken->RestrictedSidCount];
        VariableLength -= ((ULONG_PTR)EndMem - (ULONG_PTR)AccessToken->RestrictedSids);

        Status = RtlCopySidAndAttributesArray(AccessToken->RestrictedSidCount,
                                              Token->RestrictedSids,
                                              VariableLength,
                                              AccessToken->RestrictedSids,
                                              EndMem,
                                              &EndMem,
                                              &VariableLength);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("RtlCopySidAndAttributesArray(RestrictedSids) failed (Status 0x%lx)\n", Status);
            goto Quit;
        }
    }

    /*
     * Filter the token by removing the disabled privileges
     * and groups if the caller wants to duplicate an access
     * token as effective only.
     */
    if (EffectiveOnly)
    {
        /* Begin querying the groups and search for disabled ones */
        for (GroupsIndex = 0; GroupsIndex < AccessToken->UserAndGroupCount; GroupsIndex++)
        {
            /*
             * A group or user is considered disabled if its attributes is either
             * 0 or SE_GROUP_ENABLED is not included in the attributes flags list.
             * That is because a certain user and/or group can have several attributes
             * that bear no influence on whether a user/group is enabled or not
             * (SE_GROUP_ENABLED_BY_DEFAULT for example which is a mere indicator
             * that the group has just been enabled by default). A mandatory
             * group (that is, the group has SE_GROUP_MANDATORY attribute)
             * by standards it's always enabled and no one can disable it.
             */
            if (AccessToken->UserAndGroups[GroupsIndex].Attributes == 0 ||
                (AccessToken->UserAndGroups[GroupsIndex].Attributes & SE_GROUP_ENABLED) == 0)
            {
                /*
                 * If this group is an administrators group
                 * and the token belongs to such group,
                 * we've to take away TOKEN_HAS_ADMIN_GROUP
                 * for the fact that's not enabled and as
                 * such the token no longer belongs to
                 * this group.
                 */
                if (RtlEqualSid(SeAliasAdminsSid,
                                &AccessToken->UserAndGroups[GroupsIndex].Sid))
                {
                    AccessToken->TokenFlags &= ~TOKEN_HAS_ADMIN_GROUP;
                }

                /*
                 * A group is not enabled, it's time to remove
                 * from the token and update the groups index
                 * accordingly and continue with the next group.
                 */
                SepRemoveUserGroupToken(AccessToken, GroupsIndex);
                GroupsIndex--;
            }
        }

        /* Begin querying the privileges and search for disabled ones */
        for (PrivilegesIndex = 0; PrivilegesIndex < AccessToken->PrivilegeCount; PrivilegesIndex++)
        {
            /*
             * A privilege is considered disabled if its attributes is either
             * 0 or SE_PRIVILEGE_ENABLED is not included in the attributes flags list.
             * That is because a certain privilege can have several attributes
             * that bear no influence on whether a privilege is enabled or not
             * (SE_PRIVILEGE_ENABLED_BY_DEFAULT for example which is a mere indicator
             * that the privilege has just been enabled by default).
             */
            if (AccessToken->Privileges[PrivilegesIndex].Attributes == 0 ||
                (AccessToken->Privileges[PrivilegesIndex].Attributes & SE_PRIVILEGE_ENABLED) == 0)
            {
                /*
                 * A privilege is not enabled, therefor it's time
                 * to strip it from the token and continue with the next
                 * privilege. Of course we must also want to update the
                 * privileges index accordingly.
                 */
                SepRemovePrivilegeToken(AccessToken, PrivilegesIndex);
                PrivilegesIndex--;
            }
        }
    }

    /* Now allocate the token's dynamic information area and set the data */
    AccessToken->DynamicPart = ExAllocatePoolWithTag(PagedPool,
                                                     DynamicPartSize,
                                                     TAG_TOKEN_DYNAMIC);
    if (AccessToken->DynamicPart == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto Quit;
    }

    /* Unused memory in the dynamic area */
    AccessToken->DynamicAvailable = 0;

    /*
     * Assign the primary group to the token
     * and put it in the dynamic part as well.
     */
    EndMem = (PVOID)AccessToken->DynamicPart;
    AccessToken->PrimaryGroup = EndMem;
    RtlCopySid(RtlLengthSid(AccessToken->UserAndGroups[PrimaryGroupIndex].Sid),
                            EndMem,
                            AccessToken->UserAndGroups[PrimaryGroupIndex].Sid);
    AccessToken->DefaultOwnerIndex = Token->DefaultOwnerIndex;
    EndMem = (PVOID)((ULONG_PTR)EndMem + RtlLengthSid(AccessToken->UserAndGroups[PrimaryGroupIndex].Sid));

    /*
     * The existing token has a default DACL only
     * if it has an allocated dynamic part.
     */
    if (Token->DynamicPart && Token->DefaultDacl)
    {
        AccessToken->DefaultDacl = EndMem;

        RtlCopyMemory(EndMem,
                      Token->DefaultDacl,
                      Token->DefaultDacl->AclSize);
    }

    /* Return the token to the caller */
    *NewAccessToken = AccessToken;
    Status = STATUS_SUCCESS;

Quit:
    if (!NT_SUCCESS(Status))
    {
        /* Dereference the token, the delete procedure will clean it up */
        ObDereferenceObject(AccessToken);
    }

    /* Unlock the source token */
    SepReleaseTokenLock(Token);

    return Status;
}