ReactOS 0.4.15-dev-7788-g1ad9096
cmse.c
Go to the documentation of this file.
1/*
2 * PROJECT: ReactOS Kernel
3 * LICENSE: GPL - See COPYING in the top level directory
4 * FILE: ntoskrnl/config/cmse.c
5 * PURPOSE: Configuration Manager - Security Subsystem Interface
6 * PROGRAMMERS: Alex Ionescu (alex.ionescu@reactos.org)
7 */
8
9/* INCLUDES ******************************************************************/
10
11#include "ntoskrnl.h"
12#define NDEBUG
13#include "debug.h"
14
15/* GLOBALS *******************************************************************/
16
17/* FUNCTIONS *****************************************************************/
18
22{
25 PACL Acl, AclCopy;
26 PSID Sid[4];
29 ULONG AceLength, AclLength, SidLength;
30 PACE_HEADER AceHeader;
31 ULONG i;
32 PAGED_CODE();
33
34 /* Phase 1: Allocate SIDs */
35 SidLength = RtlLengthRequiredSid(1);
39 SidLength = RtlLengthRequiredSid(2);
41
42 /* Make sure all SIDs were allocated */
43 if (!Sid[0] || !Sid[1] || !Sid[2] || !Sid[3])
44 {
45 /* Bugcheck */
46 KeBugCheckEx(REGISTRY_ERROR, 11, 1, 0, 0);
47 }
48
49 /* Phase 2: Initialize all SIDs */
54 if (!NT_SUCCESS(Status)) KeBugCheckEx(REGISTRY_ERROR, 11, 2, 0, 0);
55
56 /* Phase 2: Setup SID Sub Authorities */
62
63 /* Make sure all SIDs are valid */
68
69 /* Phase 3: Calculate ACL Length */
70 AclLength = sizeof(ACL);
71 for (i = 0; i < 4; i++)
72 {
73 /* This is what MSDN says to do */
74 AceLength = FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart);
75 AceLength += SeLengthSid(Sid[i]);
76 AclLength += AceLength;
77 }
78
79 /* Phase 3: Allocate the ACL */
81 if (!Acl) KeBugCheckEx(REGISTRY_ERROR, 11, 3, 0, 0);
82
83 /* Phase 4: Create the ACL */
85 if (!NT_SUCCESS(Status)) KeBugCheckEx(REGISTRY_ERROR, 11, 4, Status, 0);
86
87 /* Phase 5: Build the ACL */
92 if (!NT_SUCCESS(Status)) KeBugCheckEx(REGISTRY_ERROR, 11, 5, Status, 0);
93
94 /* Phase 5: Make the ACEs inheritable */
95 Status = RtlGetAce(Acl, 0, (PVOID*)&AceHeader);
97 AceHeader->AceFlags |= CONTAINER_INHERIT_ACE;
98 Status = RtlGetAce(Acl, 1, (PVOID*)&AceHeader);
100 AceHeader->AceFlags |= CONTAINER_INHERIT_ACE;
101 Status = RtlGetAce(Acl, 2, (PVOID*)&AceHeader);
103 AceHeader->AceFlags |= CONTAINER_INHERIT_ACE;
104 Status = RtlGetAce(Acl, 3, (PVOID*)&AceHeader);
106 AceHeader->AceFlags |= CONTAINER_INHERIT_ACE;
107
108 /* Phase 6: Allocate the security descriptor and make space for the ACL */
110 sizeof(SECURITY_DESCRIPTOR) +
111 AclLength,
112 TAG_CMSD);
113 if (!SecurityDescriptor) KeBugCheckEx(REGISTRY_ERROR, 11, 6, 0, 0);
114
115 /* Phase 6: Make a copy of the ACL */
117 RtlCopyMemory(AclCopy, Acl, AclLength);
118
119 /* Phase 7: Create the security descriptor */
122 if (!NT_SUCCESS(Status)) KeBugCheckEx(REGISTRY_ERROR, 11, 7, Status, 0);
123
124 /* Phase 8: Set the ACL as a DACL */
126 TRUE,
127 AclCopy,
128 FALSE);
129 if (!NT_SUCCESS(Status)) KeBugCheckEx(REGISTRY_ERROR, 11, 8, Status, 0);
130
131 /* Free the SIDs and original ACL */
132 for (i = 0; i < 4; i++) ExFreePoolWithTag(Sid[i], TAG_CMSD);
134
135 /* Return the security descriptor */
136 return SecurityDescriptor;
137}
138
144{
146 ULONG SidSize;
147 ULONG AclSize;
148 ULONG SdSize;
151 ULONG Owner = 0;
152 ULONG Group = 0;
153 ULONG Dacl = 0;
154
156
157 DPRINT("CmpQuerySecurityDescriptor()\n");
158
159 if (SecurityInformation == 0)
160 {
162 }
163
164 SidSize = RtlLengthSid(SeWorldSid);
165 RelSd = SecurityDescriptor;
166 SdSize = sizeof(*RelSd);
167
169 {
170 Owner = SdSize;
171 SdSize += SidSize;
172 }
173
175 {
176 Group = SdSize;
177 SdSize += SidSize;
178 }
179
181 {
183 Dacl = SdSize;
184 AclSize = sizeof(ACL) + sizeof(ACE) + SidSize;
185 SdSize += AclSize;
186 }
187
189 {
191 }
192
193 if (*BufferLength < SdSize)
194 {
195 *BufferLength = SdSize;
197 }
198
199 *BufferLength = SdSize;
200
203 if (!NT_SUCCESS(Status))
204 return Status;
205
206 RelSd->Control |= Control;
207 RelSd->Owner = Owner;
208 RelSd->Group = Group;
209 RelSd->Dacl = Dacl;
210
211 if (Owner)
212 RtlCopyMemory((PUCHAR)RelSd + Owner,
214 SidSize);
215
216 if (Group)
217 RtlCopyMemory((PUCHAR)RelSd + Group,
219 SidSize);
220
221 if (Dacl)
222 {
223 Status = RtlCreateAcl((PACL)((PUCHAR)RelSd + Dacl),
224 AclSize,
226 if (NT_SUCCESS(Status))
227 {
231 SeWorldSid);
232 }
233 }
234
236 return Status;
237}
238
245{
246 DPRINT("CmpSetSecurityDescriptor()\n");
247 return STATUS_SUCCESS;
248}
249
253{
254 DPRINT("CmpAssignSecurityDescriptor(%p %p)\n",
255 Kcb, SecurityDescriptor);
256 return STATUS_SUCCESS;
257}
258
260NTAPI
262 IN SECURITY_OPERATION_CODE OperationCode,
266 IN OUT PSECURITY_DESCRIPTOR *OldSecurityDescriptor,
269{
272
273 DBG_UNREFERENCED_PARAMETER(OldSecurityDescriptor);
275
276 Kcb = ((PCM_KEY_BODY)ObjectBody)->KeyControlBlock;
277
278 /* Acquire the hive lock */
280
281 /* Acquire the KCB lock */
282 if (OperationCode == QuerySecurityDescriptor)
283 {
284 /* Avoid recursive locking if somebody already holds it */
285 if (!((PCM_KEY_BODY)ObjectBody)->KcbLocked)
286 {
288 }
289 }
290 else
291 {
292 ASSERT(!((PCM_KEY_BODY)ObjectBody)->KcbLocked);
294 }
295
296 /* Don't touch deleted keys */
297 if (Kcb->Delete)
298 {
299 /* Release the KCB lock */
301
302 /* Release the hive lock */
304 return STATUS_KEY_DELETED;
305 }
306
307 switch (OperationCode)
308 {
309 case SetSecurityDescriptor:
310 DPRINT("Set security descriptor\n");
315 PoolType,
317 break;
318
319 case QuerySecurityDescriptor:
320 DPRINT("Query security descriptor\n");
325 break;
326
327 case DeleteSecurityDescriptor:
328 DPRINT("Delete security descriptor\n");
329 /* HACK */
330 break;
331
332 case AssignSecurityDescriptor:
333 DPRINT("Assign security descriptor\n");
336 break;
337
338 default:
339 KeBugCheckEx(SECURITY_SYSTEM, 0, STATUS_INVALID_PARAMETER, 0, 0);
340 }
341
342 /*
343 * Release the KCB lock, but only if we locked it ourselves and
344 * nobody else was locking it by themselves.
345 */
346 if (!((PCM_KEY_BODY)ObjectBody)->KcbLocked)
347 {
349 }
350
351 /* Release the hive lock */
353
354 return Status;
355}
#define PAGED_CODE()
static GENERIC_MAPPING GenericMapping
Definition: SeInheritance.c:11
LONG NTSTATUS
Definition: precomp.h:26
static SID_IDENTIFIER_AUTHORITY NtAuthority
Definition: security.c:40
struct _CM_KEY_BODY * PCM_KEY_BODY
FORCEINLINE VOID CmpAcquireKcbLockExclusive(PCM_KEY_CONTROL_BLOCK Kcb)
Definition: cm_x.h:116
#define CmpAcquireKcbLockShared(k)
Definition: cm_x.h:145
FORCEINLINE VOID CmpReleaseKcbLock(PCM_KEY_CONTROL_BLOCK Kcb)
Definition: cm_x.h:185
#define TAG_CMSD
Definition: cmlib.h:215
VOID NTAPI CmpUnlockRegistry(VOID)
Definition: cmsysini.c:2053
VOID NTAPI CmpLockRegistry(VOID)
Definition: cmsysini.c:1967
#define TRUE
Definition: types.h:120
#define FALSE
Definition: types.h:117
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
static SID_IDENTIFIER_AUTHORITY WorldAuthority
Definition: security.c:14
#define ExAllocatePoolWithTag(hernya, size, tag)
Definition: env_spec_w32.h:350
#define NonPagedPool
Definition: env_spec_w32.h:307
#define PagedPool
Definition: env_spec_w32.h:308
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ SECURITY_INFORMATION SecurityInformation
Definition: fltkernel.h:1340
Status
Definition: gdiplustypes.h:25
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
Definition: glfuncs.h:248
NTSYSAPI NTSTATUS WINAPI RtlAddAccessAllowedAce(PACL, DWORD, DWORD, PSID)
NTSYSAPI NTSTATUS WINAPI RtlSetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR, BOOLEAN, PACL, BOOLEAN)
WORD SECURITY_DESCRIPTOR_CONTROL
Definition: lsa.idl:37
#define ASSERT(a)
Definition: mode.c:44
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1109
DWORD SECURITY_INFORMATION
Definition: ms-dtyp.idl:311
struct _ACL ACL
struct _ACL * PACL
Definition: security.c:105
DWORD * PSECURITY_INFORMATION
Definition: ms-dtyp.idl:311
_Out_writes_bytes_to_opt_ AbsoluteSecurityDescriptorSize PSECURITY_DESCRIPTOR _Inout_ PULONG _Out_writes_bytes_to_opt_ DaclSize PACL Dacl
Definition: rtlfuncs.h:1593
_In_opt_ PSID Group
Definition: rtlfuncs.h:1646
NTSYSAPI PULONG NTAPI RtlSubAuthoritySid(_In_ PSID Sid, _In_ ULONG SubAuthority)
NTSYSAPI ULONG NTAPI RtlLengthRequiredSid(IN ULONG SubAuthorityCount)
Definition: sid.c:54
_Out_writes_bytes_to_opt_ AbsoluteSecurityDescriptorSize PSECURITY_DESCRIPTOR _Inout_ PULONG _Out_writes_bytes_to_opt_ DaclSize PACL _Inout_ PULONG _Out_writes_bytes_to_opt_ SaclSize PACL _Inout_ PULONG _Out_writes_bytes_to_opt_ OwnerSize PSID Owner
Definition: rtlfuncs.h:1597
NTSYSAPI NTSTATUS NTAPI RtlCreateAcl(PACL Acl, ULONG AclSize, ULONG AclRevision)
NTSYSAPI NTSTATUS NTAPI RtlGetAce(PACL Acl, ULONG AceIndex, PVOID *Ace)
NTSYSAPI ULONG NTAPI RtlLengthSid(IN PSID Sid)
Definition: sid.c:150
NTSYSAPI BOOLEAN NTAPI RtlValidSid(IN PSID Sid)
Definition: sid.c:21
NTSYSAPI NTSTATUS NTAPI RtlCreateSecurityDescriptor(_Out_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Revision)
_In_ ULONG _In_ ACCESS_MASK _In_ PSID Sid
Definition: rtlfuncs.h:1133
NTSYSAPI NTSTATUS NTAPI RtlCreateSecurityDescriptorRelative(_Out_ PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor, _In_ ULONG Revision)
#define KEY_ALL_ACCESS
Definition: nt_native.h:1041
#define KEY_READ
Definition: nt_native.h:1023
#define GENERIC_ALL
Definition: nt_native.h:92
#define DBG_UNREFERENCED_PARAMETER(P)
Definition: ntbasedef.h:318
NTSYSAPI NTSTATUS NTAPI RtlInitializeSid(IN OUT PSID Sid, IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, IN UCHAR SubAuthorityCount)
NTSTATUS CmpAssignSecurityDescriptor(IN PCM_KEY_CONTROL_BLOCK Kcb, IN PSECURITY_DESCRIPTOR SecurityDescriptor)
Definition: cmse.c:251
PSECURITY_DESCRIPTOR NTAPI CmpHiveRootSecurityDescriptor(VOID)
Definition: cmse.c:21
NTSTATUS NTAPI CmpSecurityMethod(IN PVOID ObjectBody, IN SECURITY_OPERATION_CODE OperationCode, IN PSECURITY_INFORMATION SecurityInformation, IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PULONG BufferLength, IN OUT PSECURITY_DESCRIPTOR *OldSecurityDescriptor, IN POOL_TYPE PoolType, IN PGENERIC_MAPPING GenericMapping)
Definition: cmse.c:261
NTSTATUS CmpSetSecurityDescriptor(IN PCM_KEY_CONTROL_BLOCK Kcb, IN PSECURITY_INFORMATION SecurityInformation, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN POOL_TYPE PoolType, IN PGENERIC_MAPPING GenericMapping)
Definition: cmse.c:240
NTSTATUS CmpQuerySecurityDescriptor(IN PCM_KEY_CONTROL_BLOCK Kcb, IN SECURITY_INFORMATION SecurityInformation, OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PULONG BufferLength)
Definition: cmse.c:140
PSID SeWorldSid
Definition: sid.c:25
#define STATUS_KEY_DELETED
Definition: ntstatus.h:613
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
Definition: rtlcompat.c:108
#define STATUS_SUCCESS
Definition: shellext.h:65
#define STATUS_BUFFER_TOO_SMALL
Definition: shellext.h:69
#define DPRINT
Definition: sndvol32.h:71
UCHAR AceFlags
Definition: ms-dtyp.idl:211
Definition: rtltypes.h:993
SECURITY_DESCRIPTOR_CONTROL Control
Definition: setypes.h:839
uint32_t * PULONG
Definition: typedefs.h:59
#define FIELD_OFFSET(t, f)
Definition: typedefs.h:255
INT POOL_TYPE
Definition: typedefs.h:78
#define NTAPI
Definition: typedefs.h:36
#define RtlCopyMemory(Destination, Source, Length)
Definition: typedefs.h:263
#define IN
Definition: typedefs.h:39
unsigned char * PUCHAR
Definition: typedefs.h:53
uint32_t ULONG
Definition: typedefs.h:59
#define OUT
Definition: typedefs.h:40
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ _Strict_type_match_ POOL_TYPE PoolType
Definition: wdfdevice.h:3815
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG BufferLength
Definition: wdfdevice.h:3771
_In_ WDF_WMI_PROVIDER_CONTROL Control
Definition: wdfwmi.h:166
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
Definition: wsk.h:191
_In_ ULONG AclLength
Definition: rtlfuncs.h:1842
#define SeLengthSid(Sid)
Definition: sefuncs.h:570
#define CONTAINER_INHERIT_ACE
Definition: setypes.h:747
#define SECURITY_BUILTIN_DOMAIN_RID
Definition: setypes.h:581
#define DACL_SECURITY_INFORMATION
Definition: setypes.h:125
#define SECURITY_WORLD_SID_AUTHORITY
Definition: setypes.h:527
SECURITY_OPERATION_CODE
Definition: setypes.h:170
#define SECURITY_WORLD_RID
Definition: setypes.h:541
#define SECURITY_LOCAL_SYSTEM_RID
Definition: setypes.h:574
#define OWNER_SECURITY_INFORMATION
Definition: setypes.h:123
#define SECURITY_RESTRICTED_CODE_RID
Definition: setypes.h:569
#define SECURITY_NT_AUTHORITY
Definition: setypes.h:554
#define SE_SACL_PRESENT
Definition: setypes.h:823
#define SECURITY_DESCRIPTOR_REVISION
Definition: setypes.h:58
#define GROUP_SECURITY_INFORMATION
Definition: setypes.h:124
#define ACL_REVISION
Definition: setypes.h:39
#define SACL_SECURITY_INFORMATION
Definition: setypes.h:126
#define DOMAIN_ALIAS_RID_ADMINS
Definition: setypes.h:652
#define SE_DACL_PRESENT
Definition: setypes.h:821