ReactOS  0.4.14-dev-52-g6116262
token.c File Reference
#include <advapi32.h>
#include <ndk/setypes.h>
Include dependency graph for token.c:

Go to the source code of this file.

Functions

 WINE_DEFAULT_DEBUG_CHANNEL (advapi)
 
BOOL WINAPI CheckTokenMembership (IN HANDLE ExistingTokenHandle, IN PSID SidToCheck, OUT PBOOL IsMember)
 
BOOL WINAPI IsTokenRestricted (HANDLE TokenHandle)
 
PSID WINAPI GetSiteSidFromToken (IN HANDLE TokenHandle)
 

Function Documentation

◆ CheckTokenMembership()

BOOL WINAPI CheckTokenMembership ( IN HANDLE  ExistingTokenHandle,
IN PSID  SidToCheck,
OUT PBOOL  IsMember 
)

Definition at line 21 of file token.c.

24 {
27  struct
28  {
29  PRIVILEGE_SET PrivilegeSet;
31  } PrivBuffer;
32  ULONG PrivBufferSize = sizeof(PrivBuffer);
34  {
39  };
40  PACL Dacl;
41  ULONG SidLen;
42  HANDLE hToken = NULL;
44 
45  /* doesn't return gracefully if IsMember is NULL! */
46  *IsMember = FALSE;
47 
48  SidLen = RtlLengthSid(SidToCheck);
49 
50  if (ExistingTokenHandle == NULL)
51  {
54  FALSE,
55  &hToken);
56 
57  if (Status == STATUS_NO_TOKEN)
58  {
59  /* we're not impersonating, open the primary token */
62  &hToken);
63  if (NT_SUCCESS(Status))
64  {
65  HANDLE hNewToken = FALSE;
66  BOOL DupRet;
67 
68  /* duplicate the primary token to create an impersonation token */
69  DupRet = DuplicateTokenEx(hToken,
71  NULL,
74  &hNewToken);
75 
76  NtClose(hToken);
77 
78  if (!DupRet)
79  {
80  WARN("Failed to duplicate the primary token!\n");
81  return FALSE;
82  }
83 
84  hToken = hNewToken;
85  }
86  }
87 
88  if (!NT_SUCCESS(Status))
89  {
90  goto Cleanup;
91  }
92  }
93  else
94  {
95  hToken = ExistingTokenHandle;
96  }
97 
98  /* create a security descriptor */
99  SecurityDescriptor = RtlAllocateHeap(RtlGetProcessHeap(),
100  0,
101  sizeof(SECURITY_DESCRIPTOR) +
102  sizeof(ACL) + SidLen +
103  FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart));
104  if (SecurityDescriptor == NULL)
105  {
107  goto Cleanup;
108  }
109 
112  if (!NT_SUCCESS(Status))
113  {
114  goto Cleanup;
115  }
116 
117  /* set the owner and group */
119  SidToCheck,
120  FALSE);
121  if (!NT_SUCCESS(Status))
122  {
123  goto Cleanup;
124  }
125 
127  SidToCheck,
128  FALSE);
129  if (!NT_SUCCESS(Status))
130  {
131  goto Cleanup;
132  }
133 
134  /* create the DACL */
135  Dacl = (PACL)(SecurityDescriptor + 1);
137  sizeof(ACL) + SidLen + FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart),
138  ACL_REVISION);
139  if (!NT_SUCCESS(Status))
140  {
141  goto Cleanup;
142  }
143 
145  ACL_REVISION,
146  0x1,
147  SidToCheck);
148  if (!NT_SUCCESS(Status))
149  {
150  goto Cleanup;
151  }
152 
153  /* assign the DACL to the security descriptor */
155  TRUE,
156  Dacl,
157  FALSE);
158  if (!NT_SUCCESS(Status))
159  {
160  goto Cleanup;
161  }
162 
163  /* it's time to perform the access check. Just use _some_ desired access right
164  (same as for the ACE) and see if we're getting it granted. This indicates
165  our SID is a member of the token. We however can't use a generic access
166  right as those aren't mapped and return an error (STATUS_GENERIC_NOT_MAPPED). */
168  hToken,
169  0x1,
171  &PrivBuffer.PrivilegeSet,
172  &PrivBufferSize,
173  &GrantedAccess,
174  &AccessStatus);
176  {
177  *IsMember = TRUE;
178  }
179 
180 Cleanup:
181  if (hToken != NULL && hToken != ExistingTokenHandle)
182  {
183  NtClose(hToken);
184  }
185 
186  if (SecurityDescriptor != NULL)
187  {
188  RtlFreeHeap(RtlGetProcessHeap(),
189  0,
191  }
192 
193  if (!NT_SUCCESS(Status))
194  {
196  return FALSE;
197  }
198 
199  return TRUE;
200 }
#define TRUE
Definition: types.h:120
#define STATUS_INSUFFICIENT_RESOURCES
Definition: udferr_usr.h:158
NTSYSAPI NTSTATUS NTAPI RtlSetGroupSecurityDescriptor(IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSID Group, IN BOOLEAN GroupDefaulted)
Definition: sd.c:410
#define STANDARD_RIGHTS_WRITE
Definition: nt_native.h:66
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK _Out_ PNTSTATUS AccessStatus
Definition: sefuncs.h:13
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
Definition: wsk.h:182
_In_ CLIPOBJ _In_ BRUSHOBJ _In_ LONG x1
Definition: winddi.h:3706
#define WARN(fmt,...)
Definition: debug.h:111
LONG NTSTATUS
Definition: precomp.h:26
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
Definition: heap.c:606
#define NtCurrentThread()
#define TOKEN_IMPERSONATE
Definition: setypes.h:873
NTSYSAPI NTSTATUS NTAPI RtlCreateSecurityDescriptor(_Out_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Revision)
NTSTATUS NTAPI NtOpenProcessToken(IN HANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, OUT PHANDLE TokenHandle)
Definition: security.c:350
#define STANDARD_RIGHTS_EXECUTE
Definition: nt_native.h:67
NTSYSAPI NTSTATUS WINAPI RtlAddAccessAllowedAce(PACL, DWORD, DWORD, PSID)
NTSYSAPI NTSTATUS NTAPI RtlCreateAcl(PACL Acl, ULONG AclSize, ULONG AclRevision)
#define SECURITY_DESCRIPTOR_REVISION
Definition: setypes.h:58
unsigned int BOOL
Definition: ntddk_ex.h:94
smooth NULL
Definition: ftsmooth.c:416
NTSYSAPI NTSTATUS WINAPI RtlSetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR, BOOLEAN, PACL, BOOLEAN)
NTSYSAPI ULONG NTAPI RtlLengthSid(IN PSID Sid)
Definition: sid.c:150
#define NtCurrentProcess()
Definition: nt_native.h:1657
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
Definition: heap.c:588
struct _ACL * PACL
Definition: security.c:104
#define TOKEN_QUERY
Definition: setypes.h:874
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define SetLastError(x)
Definition: compat.h:409
BOOL WINAPI DuplicateTokenEx(IN HANDLE ExistingTokenHandle, IN DWORD dwDesiredAccess, IN LPSECURITY_ATTRIBUTES lpTokenAttributes OPTIONAL, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, IN TOKEN_TYPE TokenType, OUT PHANDLE DuplicateTokenHandle)
Definition: security.c:3394
#define STATUS_NO_TOKEN
Definition: ntstatus.h:346
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET * Privileges
Definition: sefuncs.h:13
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
Definition: obhandle.c:3399
#define TOKEN_DUPLICATE
Definition: setypes.h:872
_Out_writes_bytes_to_opt_ AbsoluteSecurityDescriptorSize PSECURITY_DESCRIPTOR _Inout_ PULONG _Out_writes_bytes_to_opt_ DaclSize PACL Dacl
Definition: rtlfuncs.h:1553
NTSYSAPI NTSTATUS WINAPI RtlSetOwnerSecurityDescriptor(PSECURITY_DESCRIPTOR, PSID, BOOLEAN)
#define STANDARD_RIGHTS_READ
Definition: nt_native.h:65
static const WCHAR Cleanup[]
Definition: register.c:80
Status
Definition: gdiplustypes.h:24
NTSYSAPI ULONG WINAPI RtlNtStatusToDosError(NTSTATUS)
static GENERIC_MAPPING GenericMapping
Definition: SeInheritance.c:11
#define STANDARD_RIGHTS_ALL
Definition: nt_native.h:69
NTSTATUS NTAPI NtAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN HANDLE TokenHandle, IN ACCESS_MASK DesiredAccess, IN PGENERIC_MAPPING GenericMapping, OUT PPRIVILEGE_SET PrivilegeSet OPTIONAL, IN OUT PULONG PrivilegeSetLength, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus)
Definition: accesschk.c:529
#define FIELD_OFFSET(t, f)
Definition: typedefs.h:254
#define ACL_REVISION
Definition: setypes.h:39
NTSTATUS NTAPI NtOpenThreadToken(IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN BOOLEAN OpenAsSelf, OUT PHANDLE TokenHandle)
Definition: token.c:3858
unsigned int ULONG
Definition: retypes.h:1
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
Definition: sefuncs.h:13
ULONG ACCESS_MASK
Definition: nt_native.h:40

Referenced by init_functionpointers(), IsUserAdmin(), pSetupIsUserAdmin(), and SHTestTokenMembership().

◆ GetSiteSidFromToken()

PSID WINAPI GetSiteSidFromToken ( IN HANDLE  TokenHandle)

Definition at line 274 of file token.c.

275 {
276  PTOKEN_GROUPS RestrictedSids;
277  ULONG RetLen;
278  UINT i;
280  PSID PSiteSid = NULL;
282 
285  NULL,
286  0,
287  &RetLen);
289  {
291  return NULL;
292  }
293 
294  RestrictedSids = (PTOKEN_GROUPS)RtlAllocateHeap(RtlGetProcessHeap(),
295  0,
296  RetLen);
297  if (RestrictedSids == NULL)
298  {
300  return NULL;
301  }
302 
305  RestrictedSids,
306  RetLen,
307  &RetLen);
308  if (NT_SUCCESS(Status))
309  {
310  for (i = 0; i < RestrictedSids->GroupCount; i++)
311  {
312  SID* RSSid = RestrictedSids->Groups[i].Sid;
313 
315  &InternetSiteAuthority,
316  sizeof(SID_IDENTIFIER_AUTHORITY)) ==
317  sizeof(SID_IDENTIFIER_AUTHORITY))
318  {
319  PSiteSid = RtlAllocateHeap(RtlGetProcessHeap(),
320  0,
321  RtlLengthSid((RestrictedSids->
322  Groups[i]).Sid));
323  if (PSiteSid == NULL)
324  {
326  }
327  else
328  {
329  RtlCopySid(RtlLengthSid(RestrictedSids->Groups[i].Sid),
330  PSiteSid,
331  RestrictedSids->Groups[i].Sid);
332  }
333 
334  break;
335  }
336  }
337  }
338  else
339  {
341  }
342 
343  RtlFreeHeap(RtlGetProcessHeap(), 0, RestrictedSids);
344  return PSiteSid;
345 }
LONG NTSTATUS
Definition: precomp.h:26
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
Definition: heap.c:606
TOpcodeData Groups[17][8]
#define STATUS_BUFFER_TOO_SMALL
Definition: shellext.h:64
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
Definition: glfuncs.h:248
smooth NULL
Definition: ftsmooth.c:416
_Must_inspect_result_ __kernel_entry NTSTATUS NTAPI NtQueryInformationToken(_In_ HANDLE TokenHandle, _In_ TOKEN_INFORMATION_CLASS TokenInformationClass, _Out_writes_bytes_to_opt_(TokenInformationLength, *ReturnLength) PVOID TokenInformation, _In_ ULONG TokenInformationLength, _Out_ PULONG ReturnLength)
Definition: token.c:1839
_In_ ACCESS_MASK _In_ ULONG _Out_ PHANDLE TokenHandle
Definition: psfuncs.h:715
NTSYSAPI ULONG NTAPI RtlLengthSid(IN PSID Sid)
Definition: sid.c:150
struct _TOKEN_GROUPS * PTOKEN_GROUPS
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
Definition: heap.c:588
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define SetLastError(x)
Definition: compat.h:409
#define SECURITY_INTERNETSITE_AUTHORITY
Definition: setypes.h:30
Status
Definition: gdiplustypes.h:24
NTSYSAPI ULONG WINAPI RtlNtStatusToDosError(NTSTATUS)
SID_AND_ATTRIBUTES Groups[ANYSIZE_ARRAY]
Definition: setypes.h:964
unsigned int UINT
Definition: ndis.h:50
$ULONG GroupCount
Definition: setypes.h:960
unsigned int ULONG
Definition: retypes.h:1
SID_IDENTIFIER_AUTHORITY IdentifierAuthority
Definition: ms-dtyp.idl:201
NTSYSAPI BOOLEAN WINAPI RtlCopySid(DWORD, PSID, PSID)
#define RtlCompareMemory(s1, s2, l)
Definition: env_spec_w32.h:465
#define ERROR_OUTOFMEMORY
Definition: deptool.c:13

◆ IsTokenRestricted()

BOOL WINAPI IsTokenRestricted ( HANDLE  TokenHandle)

Definition at line 207 of file token.c.

208 {
209  ULONG RetLength;
210  PTOKEN_GROUPS lpGroups;
212  BOOL Ret = FALSE;
213 
214  /* determine the required buffer size and allocate enough memory to read the
215  list of restricted SIDs */
218  NULL,
219  0,
220  &RetLength);
222  {
224  return FALSE;
225  }
226 
227 AllocAndReadRestrictedSids:
228  lpGroups = (PTOKEN_GROUPS)HeapAlloc(GetProcessHeap(),
229  0,
230  RetLength);
231  if (lpGroups == NULL)
232  {
234  return FALSE;
235  }
236 
237  /* actually read the list of the restricted SIDs */
240  lpGroups,
241  RetLength,
242  &RetLength);
243  if (NT_SUCCESS(Status))
244  {
245  Ret = (lpGroups->GroupCount != 0);
246  }
247  else if (Status == STATUS_BUFFER_TOO_SMALL)
248  {
249  /* looks like the token was modified in the meanwhile, let's just try again */
251  0,
252  lpGroups);
253 
254  goto AllocAndReadRestrictedSids;
255  }
256  else
257  {
259  }
260 
261  /* free allocated memory */
263  0,
264  lpGroups);
265 
266  return Ret;
267 }
LONG NTSTATUS
Definition: precomp.h:26
#define STATUS_BUFFER_TOO_SMALL
Definition: shellext.h:64
unsigned int BOOL
Definition: ntddk_ex.h:94
smooth NULL
Definition: ftsmooth.c:416
_Must_inspect_result_ __kernel_entry NTSTATUS NTAPI NtQueryInformationToken(_In_ HANDLE TokenHandle, _In_ TOKEN_INFORMATION_CLASS TokenInformationClass, _Out_writes_bytes_to_opt_(TokenInformationLength, *ReturnLength) PVOID TokenInformation, _In_ ULONG TokenInformationLength, _Out_ PULONG ReturnLength)
Definition: token.c:1839
_In_ ACCESS_MASK _In_ ULONG _Out_ PHANDLE TokenHandle
Definition: psfuncs.h:715
struct _TOKEN_GROUPS * PTOKEN_GROUPS
#define GetProcessHeap()
Definition: compat.h:395
PVOID WINAPI HeapAlloc(HANDLE, DWORD, SIZE_T)
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define SetLastError(x)
Definition: compat.h:409
Status
Definition: gdiplustypes.h:24
NTSYSAPI ULONG WINAPI RtlNtStatusToDosError(NTSTATUS)
$ULONG GroupCount
Definition: setypes.h:960
unsigned int ULONG
Definition: retypes.h:1
#define HeapFree(x, y, z)
Definition: compat.h:394
#define ERROR_OUTOFMEMORY
Definition: deptool.c:13

◆ WINE_DEFAULT_DEBUG_CHANNEL()

WINE_DEFAULT_DEBUG_CHANNEL ( advapi  )