security.c File Reference

#include <advapi32.h>
#include <sddl.h>

Include dependency graph for security.c:

Go to the source code of this file.

Classes
struct	_ACEFLAG
union	_MAX_SID
struct	WELLKNOWNSID
struct	WELLKNOWNRID

Macros
#define	ADS_RIGHT_DS_CREATE_CHILD   0x0001
#define	ADS_RIGHT_DS_DELETE_CHILD   0x0002
#define	ADS_RIGHT_ACTRL_DS_LIST   0x0004
#define	ADS_RIGHT_DS_SELF   0x0008
#define	ADS_RIGHT_DS_READ_PROP   0x0010
#define	ADS_RIGHT_DS_WRITE_PROP   0x0020
#define	ADS_RIGHT_DS_DELETE_TREE   0x0040
#define	ADS_RIGHT_DS_LIST_OBJECT   0x0080
#define	ADS_RIGHT_DS_CONTROL_ACCESS   0x0100

Typedefs
typedef struct _ACEFLAG	ACEFLAG
typedef struct _ACEFLAG *	LPACEFLAG
typedef struct _MAX_SID	MAX_SID
typedef struct WELLKNOWNSID	WELLKNOWNSID
typedef struct WELLKNOWNRID	WELLKNOWNRID

Functions
	WINE_DEFAULT_DEBUG_CHANNEL (advapi)
static BOOL	ParseStringSidToSid (LPCWSTR StringSid, PSID pSid, LPDWORD cBytes)
static const char *	debugstr_sid (PSID sid)
static __inline BOOL	set_ntstatus (NTSTATUS status)
static LPWSTR	SERV_dup (LPCSTR str)
BOOL	ADVAPI_IsLocalComputer (LPCWSTR ServerName)
BOOL	ADVAPI_GetComputerSid (PSID sid)
BOOL WINAPI	OpenProcessToken (HANDLE ProcessHandle, DWORD DesiredAccess, PHANDLE TokenHandle)
BOOL WINAPI	OpenThreadToken (HANDLE ThreadHandle, DWORD DesiredAccess, BOOL OpenAsSelf, HANDLE *TokenHandle)
BOOL WINAPI	AdjustTokenGroups (HANDLE TokenHandle, BOOL ResetToDefault, PTOKEN_GROUPS NewState, DWORD BufferLength, PTOKEN_GROUPS PreviousState, PDWORD ReturnLength)
BOOL WINAPI	AdjustTokenPrivileges (HANDLE TokenHandle, BOOL DisableAllPrivileges, PTOKEN_PRIVILEGES NewState, DWORD BufferLength, PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength)
BOOL WINAPI	GetTokenInformation (HANDLE TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, LPVOID TokenInformation, DWORD TokenInformationLength, PDWORD ReturnLength)
BOOL WINAPI	SetTokenInformation (HANDLE TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, LPVOID TokenInformation, DWORD TokenInformationLength)
BOOL WINAPI	SetThreadToken (IN PHANDLE ThreadHandle OPTIONAL, IN HANDLE TokenHandle)
BOOL WINAPI	CreateRestrictedToken (_In_ HANDLE ExistingTokenHandle, _In_ DWORD Flags, _In_ DWORD DisableSidCount, _In_reads_opt_(DisableSidCount) PSID_AND_ATTRIBUTES SidsToDisable, _In_ DWORD DeletePrivilegeCount, _In_reads_opt_(DeletePrivilegeCount) PLUID_AND_ATTRIBUTES PrivilegesToDelete, _In_ DWORD RestrictedSidCount, _In_reads_opt_(RestrictedSidCount) PSID_AND_ATTRIBUTES SidsToRestrict, _Outptr_ PHANDLE NewTokenHandle)
	Creates a filtered token that is a restricted one of the regular access token. A restricted token can have disabled SIDs, deleted privileges and/or restricted SIDs added.
BOOL WINAPI	AllocateAndInitializeSid (PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority, BYTE nSubAuthorityCount, DWORD nSubAuthority0, DWORD nSubAuthority1, DWORD nSubAuthority2, DWORD nSubAuthority3, DWORD nSubAuthority4, DWORD nSubAuthority5, DWORD nSubAuthority6, DWORD nSubAuthority7, PSID *pSid)
PVOID WINAPI	FreeSid (PSID pSid)
BOOL WINAPI	CopySid (DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid)
BOOL WINAPI	CreateWellKnownSid (IN WELL_KNOWN_SID_TYPE WellKnownSidType, IN PSID DomainSid OPTIONAL, OUT PSID pSid, IN OUT DWORD *cbSid)
BOOL WINAPI	IsWellKnownSid (IN PSID pSid, IN WELL_KNOWN_SID_TYPE WellKnownSidType)
BOOL WINAPI	IsValidSid (PSID pSid)
BOOL WINAPI	EqualSid (PSID pSid1, PSID pSid2)
BOOL WINAPI	EqualPrefixSid (PSID pSid1, PSID pSid2)
DWORD WINAPI	GetSidLengthRequired (UCHAR nSubAuthorityCount)
BOOL WINAPI	InitializeSid (PSID Sid, PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority, BYTE nSubAuthorityCount)
PSID_IDENTIFIER_AUTHORITY WINAPI	GetSidIdentifierAuthority (PSID pSid)
PDWORD WINAPI	GetSidSubAuthority (PSID pSid, DWORD nSubAuthority)
PUCHAR WINAPI	GetSidSubAuthorityCount (PSID pSid)
DWORD WINAPI	GetLengthSid (PSID pSid)
BOOL WINAPI	InitializeSecurityDescriptor (PSECURITY_DESCRIPTOR pSecurityDescriptor, DWORD dwRevision)
BOOL WINAPI	MakeAbsoluteSD (PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor, PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor, LPDWORD lpdwAbsoluteSecurityDescriptorSize, PACL pDacl, LPDWORD lpdwDaclSize, PACL pSacl, LPDWORD lpdwSaclSize, PSID pOwner, LPDWORD lpdwOwnerSize, PSID pPrimaryGroup, LPDWORD lpdwPrimaryGroupSize)
BOOL WINAPI	GetKernelObjectSecurity (HANDLE Handle, SECURITY_INFORMATION RequestedInformation, PSECURITY_DESCRIPTOR pSecurityDescriptor, DWORD nLength, LPDWORD lpnLengthNeeded)
BOOL WINAPI	InitializeAcl (PACL pAcl, DWORD nAclLength, DWORD dwAclRevision)
BOOL WINAPI	ImpersonateNamedPipeClient (HANDLE hNamedPipe)
BOOL WINAPI	AddAccessAllowedAce (PACL pAcl, DWORD dwAceRevision, DWORD AccessMask, PSID pSid)
BOOL WINAPI	AddAccessAllowedAceEx (PACL pAcl, DWORD dwAceRevision, DWORD AceFlags, DWORD AccessMask, PSID pSid)
BOOL WINAPI	AddAccessDeniedAce (PACL pAcl, DWORD dwAceRevision, DWORD AccessMask, PSID pSid)
BOOL WINAPI	AddAccessDeniedAceEx (PACL pAcl, DWORD dwAceRevision, DWORD AceFlags, DWORD AccessMask, PSID pSid)
BOOL WINAPI	AddAce (PACL pAcl, DWORD dwAceRevision, DWORD dwStartingAceIndex, LPVOID pAceList, DWORD nAceListLength)
BOOL WINAPI	DeleteAce (PACL pAcl, DWORD dwAceIndex)
BOOL WINAPI	FindFirstFreeAce (PACL pAcl, LPVOID *pAce)
BOOL WINAPI	GetAce (PACL pAcl, DWORD dwAceIndex, LPVOID *pAce)
BOOL WINAPI	GetAclInformation (PACL pAcl, LPVOID pAclInformation, DWORD nAclInformationLength, ACL_INFORMATION_CLASS dwAclInformationClass)
BOOL WINAPI	IsValidAcl (PACL pAcl)
BOOL WINAPI	AllocateLocallyUniqueId (PLUID Luid)
BOOL WINAPI	LookupPrivilegeDisplayNameA (LPCSTR lpSystemName, LPCSTR lpName, LPSTR lpDisplayName, LPDWORD cchDisplayName, LPDWORD lpLanguageId)
BOOL WINAPI	LookupPrivilegeNameA (LPCSTR lpSystemName, PLUID lpLuid, LPSTR lpName, LPDWORD cchName)
BOOL WINAPI	GetFileSecurityA (LPCSTR lpFileName, SECURITY_INFORMATION RequestedInformation, PSECURITY_DESCRIPTOR pSecurityDescriptor, DWORD nLength, LPDWORD lpnLengthNeeded)
BOOL WINAPI	GetFileSecurityW (LPCWSTR lpFileName, SECURITY_INFORMATION RequestedInformation, PSECURITY_DESCRIPTOR pSecurityDescriptor, DWORD nLength, LPDWORD lpnLengthNeeded)
BOOL WINAPI	SetFileSecurityA (LPCSTR lpFileName, SECURITY_INFORMATION SecurityInformation, PSECURITY_DESCRIPTOR pSecurityDescriptor)
BOOL WINAPI	SetFileSecurityW (LPCWSTR lpFileName, SECURITY_INFORMATION SecurityInformation, PSECURITY_DESCRIPTOR pSecurityDescriptor)
BOOL WINAPI	QueryWindows31FilesMigration (DWORD x1)
BOOL WINAPI	SynchronizeWindows31FilesAndWindowsNTRegistry (DWORD x1, DWORD x2, DWORD x3, DWORD x4)
BOOL WINAPI	RevertToSelf (VOID)
BOOL WINAPI	ImpersonateSelf (SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
BOOL WINAPI	AccessCheck (IN PSECURITY_DESCRIPTOR pSecurityDescriptor, IN HANDLE ClientToken, IN DWORD DesiredAccess, IN PGENERIC_MAPPING GenericMapping, OUT PPRIVILEGE_SET PrivilegeSet OPTIONAL, IN OUT LPDWORD PrivilegeSetLength, OUT LPDWORD GrantedAccess, OUT LPBOOL AccessStatus)
BOOL WINAPI	AccessCheckByType (_In_ PSECURITY_DESCRIPTOR pSecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, _In_ HANDLE ClientToken, _In_ DWORD DesiredAccess, _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, _In_ DWORD ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping, _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet, _Inout_ LPDWORD PrivilegeSetLength, _Out_ LPDWORD GrantedAccess, _Out_ LPBOOL AccessStatus)
	Determines whether security access can be granted to a client that requests such access on the object type list. The access is either granted or denied for the whole object hierarchy in the list.
BOOL WINAPI	AccessCheckByTypeResultList (_In_ PSECURITY_DESCRIPTOR pSecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, _In_ HANDLE ClientToken, _In_ DWORD DesiredAccess, _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList, _In_ DWORD ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping, _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet, _Inout_ LPDWORD PrivilegeSetLength, _Out_writes_(ObjectTypeListLength) LPDWORD GrantedAccess, _Out_writes_(ObjectTypeListLength) LPBOOL AccessStatus)
	Determines whether security access can be granted to a client that requests such access on the object type list. Unlike the AccessCheckByType variant, this function will grant or deny access to each individual object and sub-object in the list.
BOOL WINAPI	SetKernelObjectSecurity (HANDLE Handle, SECURITY_INFORMATION SecurityInformation, PSECURITY_DESCRIPTOR SecurityDescriptor)
BOOL WINAPI	AddAuditAccessAce (PACL pAcl, DWORD dwAceRevision, DWORD dwAccessMask, PSID pSid, BOOL bAuditSuccess, BOOL bAuditFailure)
BOOL WINAPI	AddAuditAccessAceEx (PACL pAcl, DWORD dwAceRevision, DWORD AceFlags, DWORD dwAccessMask, PSID pSid, BOOL bAuditSuccess, BOOL bAuditFailure)
BOOL WINAPI	LookupAccountNameA (LPCSTR SystemName, LPCSTR AccountName, PSID Sid, LPDWORD SidLength, LPSTR ReferencedDomainName, LPDWORD hReferencedDomainNameLength, PSID_NAME_USE SidNameUse)
BOOL WINAPI	PrivilegeCheck (HANDLE ClientToken, PPRIVILEGE_SET RequiredPrivileges, LPBOOL pfResult)
DWORD WINAPI	GetSecurityInfoExA (HANDLE hObject, SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo, LPCSTR lpProvider, LPCSTR lpProperty, PACTRL_ACCESSA *ppAccessList, PACTRL_AUDITA *ppAuditList, LPSTR *lppOwner, LPSTR *lppGroup)
DWORD WINAPI	GetSecurityInfoExW (HANDLE hObject, SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo, LPCWSTR lpProvider, LPCWSTR lpProperty, PACTRL_ACCESSW *ppAccessList, PACTRL_AUDITW *ppAuditList, LPWSTR *lppOwner, LPWSTR *lppGroup)
VOID WINAPI	BuildExplicitAccessWithNameA (PEXPLICIT_ACCESSA pExplicitAccess, LPSTR pTrusteeName, DWORD AccessPermissions, ACCESS_MODE AccessMode, DWORD Inheritance)
VOID WINAPI	BuildExplicitAccessWithNameW (PEXPLICIT_ACCESSW pExplicitAccess, LPWSTR pTrusteeName, DWORD AccessPermissions, ACCESS_MODE AccessMode, DWORD Inheritance)
VOID WINAPI	BuildTrusteeWithObjectsAndNameA (PTRUSTEEA pTrustee, POBJECTS_AND_NAME_A pObjName, SE_OBJECT_TYPE ObjectType, LPSTR ObjectTypeName, LPSTR InheritedObjectTypeName, LPSTR Name)
VOID WINAPI	BuildTrusteeWithObjectsAndNameW (PTRUSTEEW pTrustee, POBJECTS_AND_NAME_W pObjName, SE_OBJECT_TYPE ObjectType, LPWSTR ObjectTypeName, LPWSTR InheritedObjectTypeName, LPWSTR Name)
VOID WINAPI	BuildTrusteeWithObjectsAndSidA (PTRUSTEEA pTrustee, POBJECTS_AND_SID pObjSid, GUID *pObjectGuid, GUID *pInheritedObjectGuid, PSID pSid)
VOID WINAPI	BuildTrusteeWithObjectsAndSidW (PTRUSTEEW pTrustee, POBJECTS_AND_SID pObjSid, GUID *pObjectGuid, GUID *pInheritedObjectGuid, PSID pSid)
VOID WINAPI	BuildTrusteeWithSidA (PTRUSTEE_A pTrustee, PSID pSid)
VOID WINAPI	BuildTrusteeWithSidW (PTRUSTEE_W pTrustee, PSID pSid)
VOID WINAPI	BuildTrusteeWithNameA (PTRUSTEE_A pTrustee, LPSTR name)
VOID WINAPI	BuildTrusteeWithNameW (PTRUSTEE_W pTrustee, LPWSTR name)
TRUSTEE_FORM WINAPI	GetTrusteeFormA (PTRUSTEEA pTrustee)
TRUSTEE_FORM WINAPI	GetTrusteeFormW (PTRUSTEEW pTrustee)
LPSTR WINAPI	GetTrusteeNameA (PTRUSTEE_A pTrustee)
LPWSTR WINAPI	GetTrusteeNameW (PTRUSTEE_W pTrustee)
TRUSTEE_TYPE WINAPI	GetTrusteeTypeA (PTRUSTEE_A pTrustee)
TRUSTEE_TYPE WINAPI	GetTrusteeTypeW (PTRUSTEE_W pTrustee)
BOOL WINAPI	SetAclInformation (PACL pAcl, LPVOID pAclInformation, DWORD nAclInformationLength, ACL_INFORMATION_CLASS dwAclInformationClass)
DWORD WINAPI	SetNamedSecurityInfoA (LPSTR pObjectName, SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo, PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
BOOL WINAPI	AreAllAccessesGranted (DWORD GrantedAccess, DWORD DesiredAccess)
BOOL WINAPI	AreAnyAccessesGranted (DWORD GrantedAccess, DWORD DesiredAccess)
static DWORD	ParseAclStringFlags (LPCWSTR *StringAcl)
static BYTE	ParseAceStringType (LPCWSTR *StringAcl)
static BYTE	ParseAceStringFlags (LPCWSTR *StringAcl)
static DWORD	ParseAceStringRights (LPCWSTR *StringAcl)
static BOOL	ParseStringAclToAcl (LPCWSTR StringAcl, LPDWORD lpdwFlags, PACL pAcl, LPDWORD cBytes)
static BOOL	ParseStringSecurityDescriptorToSecurityDescriptor (LPCWSTR StringSecurityDescriptor, SECURITY_DESCRIPTOR_RELATIVE *SecurityDescriptor, LPDWORD cBytes)
BOOL WINAPI	ConvertStringSecurityDescriptorToSecurityDescriptorA (LPCSTR StringSecurityDescriptor, DWORD StringSDRevision, PSECURITY_DESCRIPTOR *SecurityDescriptor, PULONG SecurityDescriptorSize)
BOOL WINAPI	ConvertStringSecurityDescriptorToSecurityDescriptorW (LPCWSTR StringSecurityDescriptor, DWORD StringSDRevision, PSECURITY_DESCRIPTOR *SecurityDescriptor, PULONG SecurityDescriptorSize)
static void	DumpString (LPCWSTR string, int cch, WCHAR **pwptr, ULONG *plen)
static BOOL	DumpSidNumeric (PSID psid, WCHAR **pwptr, ULONG *plen)
static BOOL	DumpSid (PSID psid, WCHAR **pwptr, ULONG *plen)
static void	DumpRights (DWORD mask, WCHAR **pwptr, ULONG *plen)
static BOOL	DumpAce (LPVOID pace, WCHAR **pwptr, ULONG *plen)
static BOOL	DumpAcl (PACL pacl, WCHAR **pwptr, ULONG *plen, BOOL protected, BOOL autoInheritReq, BOOL autoInherited)
static BOOL	DumpOwner (PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
static BOOL	DumpGroup (PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
static BOOL	DumpDacl (PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
static BOOL	DumpSacl (PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
BOOL WINAPI	ConvertSecurityDescriptorToStringSecurityDescriptorW (PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION RequestedInformation, LPWSTR *OutputString, PULONG OutputLen)
BOOL WINAPI	ConvertSecurityDescriptorToStringSecurityDescriptorA (PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION Information, LPSTR *OutputString, PULONG OutputLen)
BOOL WINAPI	ConvertStringSidToSidW (LPCWSTR StringSid, PSID *Sid)
BOOL WINAPI	ConvertStringSidToSidA (LPCSTR StringSid, PSID *Sid)
BOOL WINAPI	ConvertSidToStringSidW (PSID Sid, LPWSTR *StringSid)
BOOL WINAPI	ConvertSidToStringSidA (PSID Sid, LPSTR *StringSid)
static DWORD	GetUnicodeEnvironmentSize (PVOID pEnvironment)
static DWORD	GetAnsiEnvironmentSize (PVOID pEnvironment)
BOOL WINAPI	CreateProcessWithLogonW (_In_ LPCWSTR lpUsername, _In_opt_ LPCWSTR lpDomain, _In_ LPCWSTR lpPassword, _In_ DWORD dwLogonFlags, _In_opt_ LPCWSTR lpApplicationName, _Inout_opt_ LPWSTR lpCommandLine, _In_ DWORD dwCreationFlags, _In_opt_ LPVOID lpEnvironment, _In_opt_ LPCWSTR lpCurrentDirectory, _In_ LPSTARTUPINFOW lpStartupInfo, _Out_ LPPROCESS_INFORMATION lpProcessInformation)
BOOL WINAPI	CreateProcessWithTokenW (HANDLE token, DWORD logon_flags, LPCWSTR application_name, LPWSTR command_line, DWORD creation_flags, void *environment, LPCWSTR current_directory, STARTUPINFOW *startup_info, PROCESS_INFORMATION *process_information)
BOOL WINAPI	DuplicateTokenEx (IN HANDLE ExistingTokenHandle, IN DWORD dwDesiredAccess, IN LPSECURITY_ATTRIBUTES lpTokenAttributes OPTIONAL, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, IN TOKEN_TYPE TokenType, OUT PHANDLE DuplicateTokenHandle)
BOOL WINAPI	DuplicateToken (IN HANDLE ExistingTokenHandle, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, OUT PHANDLE DuplicateTokenHandle)
static DWORD	ComputeStringSidSize (LPCWSTR StringSid)
DWORD WINAPI	GetNamedSecurityInfoA (LPSTR pObjectName, SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo, PSID *ppsidOwner, PSID *ppsidGroup, PACL *ppDacl, PACL *ppSacl, PSECURITY_DESCRIPTOR *ppSecurityDescriptor)
BOOL WINAPI	GetWindowsAccountDomainSid (PSID sid, PSID domain_sid, DWORD *size)
BOOL WINAPI	EqualDomainSid (IN PSID pSid1, IN PSID pSid2, OUT BOOL *pfEqual)

Variables
static const WELLKNOWNSID	WellKnownSids []
static const WELLKNOWNRID	WellKnownRids []
static const SID	sidWorld = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY} , { SECURITY_WORLD_RID } }
static const WCHAR	SDDL_NO_READ_UP [] = {'N','R',0}
static const WCHAR	SDDL_NO_WRITE_UP [] = {'N','W',0}
static const WCHAR	SDDL_NO_EXECUTE_UP [] = {'N','X',0}
static const WCHAR	SDDL_ACCESS_ALLOWED [] = {'A',0}
static const WCHAR	SDDL_ACCESS_DENIED [] = {'D',0}
static const WCHAR	SDDL_OBJECT_ACCESS_ALLOWED [] = {'O','A',0}
static const WCHAR	SDDL_OBJECT_ACCESS_DENIED [] = {'O','D',0}
static const WCHAR	SDDL_AUDIT [] = {'A','U',0}
static const WCHAR	SDDL_ALARM [] = {'A','L',0}
static const WCHAR	SDDL_MANDATORY_LABEL [] = {'M','L',0}
static const WCHAR	SDDL_OBJECT_AUDIT [] = {'O','U',0}
static const WCHAR	SDDL_OBJECT_ALARM [] = {'O','L',0}
static const WCHAR	SDDL_CONTAINER_INHERIT [] = {'C','I',0}
static const WCHAR	SDDL_OBJECT_INHERIT [] = {'O','I',0}
static const WCHAR	SDDL_NO_PROPAGATE [] = {'N','P',0}
static const WCHAR	SDDL_INHERIT_ONLY [] = {'I','O',0}
static const WCHAR	SDDL_INHERITED [] = {'I','D',0}
static const WCHAR	SDDL_AUDIT_SUCCESS [] = {'S','A',0}
static const WCHAR	SDDL_AUDIT_FAILURE [] = {'F','A',0}
static const ACEFLAG	AceType []
static const ACEFLAG	AceFlags []
static const ACEFLAG	AceRights []
static const LPCWSTR	AceRightBitNames [32]

Macro Definition Documentation

ADS_RIGHT_ACTRL_DS_LIST

#define ADS_RIGHT_ACTRL_DS_LIST   0x0004

Definition at line 155 of file security.c.

ADS_RIGHT_DS_CONTROL_ACCESS

#define ADS_RIGHT_DS_CONTROL_ACCESS   0x0100

Definition at line 161 of file security.c.

ADS_RIGHT_DS_CREATE_CHILD

#define ADS_RIGHT_DS_CREATE_CHILD   0x0001

Definition at line 153 of file security.c.

ADS_RIGHT_DS_DELETE_CHILD

#define ADS_RIGHT_DS_DELETE_CHILD   0x0002

Definition at line 154 of file security.c.

ADS_RIGHT_DS_DELETE_TREE

#define ADS_RIGHT_DS_DELETE_TREE   0x0040

Definition at line 159 of file security.c.

ADS_RIGHT_DS_LIST_OBJECT

#define ADS_RIGHT_DS_LIST_OBJECT   0x0080

Definition at line 160 of file security.c.

ADS_RIGHT_DS_READ_PROP

#define ADS_RIGHT_DS_READ_PROP   0x0010

Definition at line 157 of file security.c.

ADS_RIGHT_DS_SELF

#define ADS_RIGHT_DS_SELF   0x0008

Definition at line 156 of file security.c.

ADS_RIGHT_DS_WRITE_PROP

#define ADS_RIGHT_DS_WRITE_PROP   0x0020

Definition at line 158 of file security.c.

Typedef Documentation

ACEFLAG

typedef struct _ACEFLAG ACEFLAG

LPACEFLAG

typedef struct _ACEFLAG * LPACEFLAG

MAX_SID

typedef struct _MAX_SID MAX_SID

WELLKNOWNRID

typedef struct WELLKNOWNRID WELLKNOWNRID

WELLKNOWNSID

typedef struct WELLKNOWNSID WELLKNOWNSID

Function Documentation

AccessCheck()

BOOL WINAPI AccessCheck	(	IN PSECURITY_DESCRIPTOR	pSecurityDescriptor,
		IN HANDLE	ClientToken,
		IN DWORD	DesiredAccess,
		IN PGENERIC_MAPPING	GenericMapping,
		OUT PPRIVILEGE_SET PrivilegeSet	OPTIONAL,
		IN OUT LPDWORD	PrivilegeSetLength,
		OUT LPDWORD	GrantedAccess,
		OUT LPBOOL	AccessStatus
	)

Definition at line 1650 of file security.c.

{
    NTSTATUS Status;
    NTSTATUS NtAccessStatus;
 
    /* Do the access check */
    Status = NtAccessCheck(pSecurityDescriptor,
                           ClientToken,
                           DesiredAccess,
                           GenericMapping,
                           PrivilegeSet,
                           (PULONG)PrivilegeSetLength,
                           (PACCESS_MASK)GrantedAccess,
                           &NtAccessStatus);
 
    /* See if the access check operation succeeded */
    if (!NT_SUCCESS(Status))
    {
        /* Check failed */
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    /* Now check the access status  */
    if (!NT_SUCCESS(NtAccessStatus))
    {
        /* Access denied */
        SetLastError(RtlNtStatusToDosError(NtAccessStatus));
        *AccessStatus = FALSE;
    }
    else
    {
        /* Access granted */
        *AccessStatus = TRUE;
    }
 
    /* Check succeeded */
    return TRUE;
}

Referenced by test_AccessCheck(), test_default_handle_security(), and test_FileSecurity().

AccessCheckByType()

BOOL WINAPI AccessCheckByType	(	_In_ PSECURITY_DESCRIPTOR	pSecurityDescriptor,
		_In_opt_ PSID	PrincipalSelfSid,
		_In_ HANDLE	ClientToken,
		_In_ DWORD	DesiredAccess,
		_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST	ObjectTypeList,
		_In_ DWORD	ObjectTypeListLength,
		_In_ PGENERIC_MAPPING	GenericMapping,
		_Out_writes_bytes_ *PrivilegeSetLength PPRIVILEGE_SET	PrivilegeSet,
		_Inout_ LPDWORD	PrivilegeSetLength,
		_Out_ LPDWORD	GrantedAccess,
		_Out_ LPBOOL	AccessStatus
	)

Determines whether security access can be granted to a client that requests such access on the object type list. The access is either granted or denied for the whole object hierarchy in the list.

Parameters

[in]	pSecurityDescriptor	A pointer to a security descriptor that identifies the security information of an object being accessed. This function walks through this descriptor for any ACLs and respective access rights if access can be granted.
[in]	PrincipalSelfSid	A pointer to a principal self SID. This parameter can be NULL if the associated object being checked for access does not represent a principal.
[in]	ClientToken	A handle to an access token, that identifies the client of which requests access to the target object.
[in]	DesiredAccess	The access right bitmask where the client wants to acquire. This can be an OR'ed set of multiple access rights or MAXIMUM_ALLOWED to request all of possible access rights the target object allows. If only some rights were granted but not all the access is deemed as denied.
[in]	ObjectTypeList	A pointer to a given object type list. If this parameter is not NULL the function will perform an access check against the main object and sub-objects of this list. If this parameter is NULL and ObjectTypeListLength is 0, the function will perform a normal access check instead.
[in]	ObjectTypeListLength	The length of the object type list array, pointed by ObjectTypeList. This length in question represents the number of elements in such array. This parameter must be 0 if no array list is provided.
[in]	GenericMapping	The generic mapping of access rights of an object type.
[out]	PrivilegeSet	A pointer to a set of privileges that were used to perform the access check, returned to caller. This function will return no privileges (privilege count set to 0) if no privileges were used to accomplish the access check. This parameter must not be NULL!
[in,out]	PrivilegeSetLength	The total length size of a set of privileges. This length represents the count of elements in the privilege set array.
[out]	GrantedAccess	A pointer to granted access rights, returned to the caller.
[out]	AccessStatus	A pointer to a boolean value that indicates whether access is granted or denied to the client that requests access to the entire hierarchy of an object type list. If ObjectTypeList is NULL, this value represents the access that is granted or denied to the target object, just like in AccessCheck.

Returns

The function returns TRUE if the access check operation has completed successfully, otherwise it returns FALSE.

Definition at line 1767 of file security.c.

{
    NTSTATUS Status;
    NTSTATUS NtAccessStatus;
 
    Status = NtAccessCheckByType(pSecurityDescriptor,
                                 PrincipalSelfSid,
                                 ClientToken,
                                 DesiredAccess,
                                 ObjectTypeList,
                                 ObjectTypeListLength,
                                 GenericMapping,
                                 PrivilegeSet,
                                 PrivilegeSetLength,
                                 (PACCESS_MASK)GrantedAccess,
                                 &NtAccessStatus);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    if (!NT_SUCCESS(NtAccessStatus))
    {
        SetLastError(RtlNtStatusToDosError(NtAccessStatus));
        *AccessStatus = FALSE;
    }
    else
    {
        *AccessStatus = TRUE;
    }
 
    return TRUE;
}

AccessCheckByTypeResultList()

BOOL WINAPI AccessCheckByTypeResultList	(	_In_ PSECURITY_DESCRIPTOR	pSecurityDescriptor,
		_In_opt_ PSID	PrincipalSelfSid,
		_In_ HANDLE	ClientToken,
		_In_ DWORD	DesiredAccess,
		_In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST	ObjectTypeList,
		_In_ DWORD	ObjectTypeListLength,
		_In_ PGENERIC_MAPPING	GenericMapping,
		_Out_writes_bytes_ *PrivilegeSetLength PPRIVILEGE_SET	PrivilegeSet,
		_Inout_ LPDWORD	PrivilegeSetLength,
		_Out_writes_(ObjectTypeListLength) LPDWORD	GrantedAccess,
		_Out_writes_(ObjectTypeListLength) LPBOOL	AccessStatus
	)

Determines whether security access can be granted to a client that requests such access on the object type list. Unlike the AccessCheckByType variant, this function will grant or deny access to each individual object and sub-object in the list.

Parameters

[in]	pSecurityDescriptor	A pointer to a security descriptor that identifies the security information of an object being accessed. This function walks through this descriptor for any ACLs and respective access rights if access can be granted.
[in]	PrincipalSelfSid	A pointer to a principal self SID. This parameter can be NULL if the associated object being checked for access does not represent a principal.
[in]	ClientToken	A handle to an access token, that identifies the client of which requests access to the target object.
[in]	DesiredAccess	The access right bitmask where the client wants to acquire. This can be an OR'ed set of multiple access rights or MAXIMUM_ALLOWED to request all of possible access rights the target object allows. If only some rights were granted but not all the access is deemed as denied.
[in]	ObjectTypeList	A pointer to a given object type list. This function will perform an access check against the main object and sub-objects of this list. This parameter must not be NULL!
[in]	ObjectTypeListLength	The length of the object type list array, pointed by ObjectTypeList. This length in question represents the number of elements in such array. This parameter must be 0 if no array list is provided.
[in]	GenericMapping	The generic mapping of access rights of an object type.
[out]	PrivilegeSet	A pointer to a set of privileges that were used to perform the access check, returned to caller. This function will return no privileges (privilege count set to 0) if no privileges were used to accomplish the access check. This parameter must not be NULL!
[in,out]	PrivilegeSetLength	The total length size of a set of privileges. This length represents the count of elements in the privilege set array.
[out]	GrantedAccess	A pointer to granted access rights. This parameter is an array of granted rights for the object and each sub-object of an object type list.
[out]	AccessStatus	A pointer to a boolean value that indicates whether access is granted or denied to the client that requests access to the object and sub-objects of an object type list. This parameter is an array of boolean values for the object and each individual sub-object of the list.

Returns

The function returns TRUE if the access check operation has completed successfully, otherwise it returns FALSE.

Definition at line 1881 of file security.c.

{
    NTSTATUS Status;
    DWORD ResultListIndex;
    PNTSTATUS NtAccessStatus = NULL;
 
    Status = NtAccessCheckByTypeResultList(pSecurityDescriptor,
                                           PrincipalSelfSid,
                                           ClientToken,
                                           DesiredAccess,
                                           ObjectTypeList,
                                           ObjectTypeListLength,
                                           GenericMapping,
                                           PrivilegeSet,
                                           PrivilegeSetLength,
                                           (PACCESS_MASK)GrantedAccess,
                                           NtAccessStatus);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    for (ResultListIndex = 0; ResultListIndex < ObjectTypeListLength; ResultListIndex++)
    {
        AccessStatus[ResultListIndex] = RtlNtStatusToDosError(NtAccessStatus[ResultListIndex]);
    }
 
    return TRUE;
}

AddAccessAllowedAce()

BOOL WINAPI AddAccessAllowedAce	(	PACL	pAcl,
		DWORD	dwAceRevision,
		DWORD	AccessMask,
		PSID	pSid
	)

Definition at line 1039 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlAddAccessAllowedAce(pAcl,
                                    dwAceRevision,
                                    AccessMask,
                                    pSid);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by AccRewriteSetEntriesInAcl(), convert_nfs4acl_2_dacl(), CreateDefaultProcessSecurityCommon(), CreateDefaultSecurityDescriptor(), CreateDhcpPipeSecurity(), CreatePnpInstallEventSecurity(), CreatePowrProfSemaphoreSecurity(), GetShellSecurityDescriptor(), test_AccessCheck(), test_AddMandatoryAce(), test_GetExplicitEntriesFromAclW(), test_process_security(), test_SetEntriesInAclA(), and test_SetEntriesInAclW().

AddAccessAllowedAceEx()

BOOL WINAPI AddAccessAllowedAceEx	(	PACL	pAcl,
		DWORD	dwAceRevision,
		DWORD	AceFlags,
		DWORD	AccessMask,
		PSID	pSid
	)

Definition at line 1063 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlAddAccessAllowedAceEx(pAcl,
                                      dwAceRevision,
                                      AceFlags,
                                      AccessMask,
                                      pSid);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by AllowDesktopAccessToUser(), AllowWinstaAccessToUser(), CreateApplicationDesktopSecurity(), CreateScreenSaverSecurity(), CreateWinlogonDesktopSecurity(), CreateWinstaSecurity(), get_sd(), and GetShellSecurityDescriptor().

AddAccessDeniedAce()

BOOL WINAPI AddAccessDeniedAce	(	PACL	pAcl,
		DWORD	dwAceRevision,
		DWORD	AccessMask,
		PSID	pSid
	)

Definition at line 1090 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlAddAccessDeniedAce(pAcl,
                                   dwAceRevision,
                                   AccessMask,
                                   pSid);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by AccRewriteSetEntriesInAcl(), convert_nfs4acl_2_dacl(), GetShellSecurityDescriptor(), test_AccessCheck(), and test_process_security().

AddAccessDeniedAceEx()

BOOL WINAPI AddAccessDeniedAceEx	(	PACL	pAcl,
		DWORD	dwAceRevision,
		DWORD	AceFlags,
		DWORD	AccessMask,
		PSID	pSid
	)

Definition at line 1114 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlAddAccessDeniedAceEx(pAcl,
                                     dwAceRevision,
                                     AceFlags,
                                     AccessMask,
                                     pSid);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by GetShellSecurityDescriptor().

AddAce()

BOOL WINAPI AddAce	(	PACL	pAcl,
		DWORD	dwAceRevision,
		DWORD	dwStartingAceIndex,
		LPVOID	pAceList,
		DWORD	nAceListLength
	)

Definition at line 1141 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlAddAce(pAcl,
                       dwAceRevision,
                       dwStartingAceIndex,
                       pAceList,
                       nAceListLength);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by test_AddAce().

AddAuditAccessAce()

BOOL WINAPI AddAuditAccessAce	(	PACL	pAcl,
		DWORD	dwAceRevision,
		DWORD	dwAccessMask,
		PSID	pSid,
		BOOL	bAuditSuccess,
		BOOL	bAuditFailure
	)

Definition at line 1951 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlAddAuditAccessAce(pAcl,
                                  dwAceRevision,
                                  dwAccessMask,
                                  pSid,
                                  bAuditSuccess,
                                  bAuditFailure);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

AddAuditAccessAceEx()

BOOL WINAPI AddAuditAccessAceEx	(	PACL	pAcl,
		DWORD	dwAceRevision,
		DWORD	AceFlags,
		DWORD	dwAccessMask,
		PSID	pSid,
		BOOL	bAuditSuccess,
		BOOL	bAuditFailure
	)

Definition at line 1979 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlAddAuditAccessAceEx(pAcl,
                                    dwAceRevision,
                                    AceFlags,
                                    dwAccessMask,
                                    pSid,
                                    bAuditSuccess,
                                    bAuditFailure);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

AdjustTokenGroups()

BOOL WINAPI AdjustTokenGroups	(	HANDLE	TokenHandle,
		BOOL	ResetToDefault,
		PTOKEN_GROUPS	NewState,
		DWORD	BufferLength,
		PTOKEN_GROUPS	PreviousState,
		PDWORD	ReturnLength
	)

Definition at line 346 of file security.c.

{
    NTSTATUS Status;
 
    Status = NtAdjustGroupsToken(TokenHandle,
                                 ResetToDefault,
                                 NewState,
                                 BufferLength,
                                 PreviousState,
                                 (PULONG)ReturnLength);
    if (!NT_SUCCESS(Status))
    {
       SetLastError(RtlNtStatusToDosError(Status));
       return FALSE;
    }
 
    return TRUE;
}

AdjustTokenPrivileges()

BOOL WINAPI AdjustTokenPrivileges	(	HANDLE	TokenHandle,
		BOOL	DisableAllPrivileges,
		PTOKEN_PRIVILEGES	NewState,
		DWORD	BufferLength,
		PTOKEN_PRIVILEGES	PreviousState,
		PDWORD	ReturnLength
	)

Definition at line 374 of file security.c.

{
    NTSTATUS Status;
 
    Status = NtAdjustPrivilegesToken(TokenHandle,
                                     DisableAllPrivileges,
                                     NewState,
                                     BufferLength,
                                     PreviousState,
                                     (PULONG)ReturnLength);
    if (STATUS_NOT_ALL_ASSIGNED == Status)
    {
        SetLastError(ERROR_NOT_ALL_ASSIGNED);
        return TRUE;
    }
 
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    /* AdjustTokenPrivileges is documented to do this */
    SetLastError(ERROR_SUCCESS);
 
    return TRUE;
}

Referenced by AcquireRemoveRestorePrivilege(), AddDeviceW(), DisablePrivilege(), DisableTokenPrivileges(), EnablePrivilege(), EnableProcessPrivileges(), enableTokenPrivilege(), CShellCommandSACL::Execute(), FormatEx2(), InstallReactOS(), named_pipe_client_func(), PauseBalanceW(), Privilege(), pSetupEnablePrivilege(), RecvSubvolGUIW(), RecvSubvolW(), RemoveDeviceW(), ResetStatsW(), ResizeDeviceW(), ScmEnableBackupRestorePrivileges(), SendSubvolGUIW(), SendSubvolW(), set_privileges(), SetDriverLoadPrivilege(), SetPrivilege(), SHInvokePrivilegedFunctionW(), ShowScrubW(), ShutdownSystem(), StartBalanceW(), StartScrubW(), StopBalanceW(), StopScrubW(), SystemSetLocalTime(), SystemSetTime(), test8(), test_AdjustTokenPrivileges(), test_SetFileValidData(), test_system_security_access(), UpdateDriver(), WinMain(), and wWinMain().

ADVAPI_GetComputerSid()

BOOL ADVAPI_GetComputerSid

(

PSID

sid

)

Definition at line 273 of file security.c.

{
    static const struct /* same fields as struct SID */
    {
        BYTE Revision;
        BYTE SubAuthorityCount;
        SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
        DWORD SubAuthority[4];
    } computer_sid =
    { SID_REVISION, 4, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0 } };
 
    memcpy( sid, &computer_sid, sizeof(computer_sid) );
    return TRUE;
}

Referenced by ComputeStringSidSize(), and ParseStringSidToSid().

ADVAPI_IsLocalComputer()

BOOL ADVAPI_IsLocalComputer

(

LPCWSTR

ServerName

)

Definition at line 251 of file security.c.

{
    DWORD dwSize = MAX_COMPUTERNAME_LENGTH + 1;
    BOOL Result;
    LPWSTR buf;
 
    if (!ServerName || !ServerName[0])
        return TRUE;
 
    buf = heap_alloc(dwSize * sizeof(WCHAR));
    Result = GetComputerNameW(buf,  &dwSize);
    if (Result && (ServerName[0] == '\\') && (ServerName[1] == '\\'))
        ServerName += 2;
    Result = Result && !lstrcmpW(ServerName, buf);
    heap_free(buf);
 
    return Result;
}

AllocateAndInitializeSid()

BOOL WINAPI AllocateAndInitializeSid	(	PSID_IDENTIFIER_AUTHORITY	pIdentifierAuthority,
		BYTE	nSubAuthorityCount,
		DWORD	nSubAuthority0,
		DWORD	nSubAuthority1,
		DWORD	nSubAuthority2,
		DWORD	nSubAuthority3,
		DWORD	nSubAuthority4,
		DWORD	nSubAuthority5,
		DWORD	nSubAuthority6,
		DWORD	nSubAuthority7,
		PSID *	pSid
	)

Definition at line 674 of file security.c.

{
    return set_ntstatus( RtlAllocateAndInitializeSid(
                             pIdentifierAuthority, nSubAuthorityCount,
                             nSubAuthority0, nSubAuthority1, nSubAuthority2, nSubAuthority3,
                             nSubAuthority4, nSubAuthority5, nSubAuthority6, nSubAuthority7,
                             pSid ));
}

Referenced by AllowDesktopAccessToUser(), AllowWinstaAccessToUser(), check_wellknown_name(), CheckForGuestsAndAdmins(), CreateApplicationDesktopSecurity(), CreateDefaultProcessSecurityCommon(), CreateDefaultSecurityDescriptor(), CreateDhcpPipeSecurity(), CreateLogoffSecurityAttributes(), CreatePnpInstallEventSecurity(), CreatePowrProfSemaphoreSecurity(), CreateScreenSaverSecurity(), CreateWinlogonDesktopSecurity(), CreateWinstaSecurity(), GetShellSecurityDescriptor(), Imm32IsInteractiveUserLogon(), is_process_limited(), is_token_admin(), IsCallerInteractive(), IsInteractiveUserLogon(), IsNTAdmin(), IsUserAdmin(), PerfDataInitialize(), pSetupIsUserAdmin(), SHTestTokenMembership(), START_TEST(), test_AccessCheck(), test_AddMandatoryAce(), test_CreateWellKnownSid(), test_EqualSid(), test_GetExplicitEntriesFromAclW(), test_GetNamedSecurityInfoA(), test_GetSecurityInfo(), test_LookupAccountSid(), test_process_security(), test_reg_create_key(), test_reg_open_key(), test_SetEntriesInAclA(), test_SetEntriesInAclW(), test_sid(), and test_trustee().

AllocateLocallyUniqueId()

BOOL WINAPI AllocateLocallyUniqueId

(

PLUID

Luid

)

Definition at line 1218 of file security.c.

{
    NTSTATUS Status;
 
    Status = NtAllocateLocallyUniqueId (Luid);
    if (!NT_SUCCESS (Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by CookupNodeId(), LogonUserExW(), MyLogonUser(), and wined3d_adapter_init().

AreAllAccessesGranted()

BOOL WINAPI AreAllAccessesGranted	(	DWORD	GrantedAccess,
		DWORD	DesiredAccess
	)

Definition at line 2532 of file security.c.

{
    return (BOOL)RtlAreAllAccessesGranted(GrantedAccess,
                                          DesiredAccess);
}

AreAnyAccessesGranted()

BOOL WINAPI AreAnyAccessesGranted	(	DWORD	GrantedAccess,
		DWORD	DesiredAccess
	)

Definition at line 2544 of file security.c.

{
    return (BOOL)RtlAreAnyAccessesGranted(GrantedAccess,
                                          DesiredAccess);
}

BuildExplicitAccessWithNameA()

VOID WINAPI BuildExplicitAccessWithNameA	(	PEXPLICIT_ACCESSA	pExplicitAccess,
		LPSTR	pTrusteeName,
		DWORD	AccessPermissions,
		ACCESS_MODE	AccessMode,
		DWORD	Inheritance
	)

Definition at line 2130 of file security.c.

{
    pExplicitAccess->grfAccessPermissions = AccessPermissions;
    pExplicitAccess->grfAccessMode = AccessMode;
    pExplicitAccess->grfInheritance = Inheritance;
 
    pExplicitAccess->Trustee.pMultipleTrustee = NULL;
    pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
    pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
    pExplicitAccess->Trustee.ptstrName = pTrusteeName;
}

BuildExplicitAccessWithNameW()

VOID WINAPI BuildExplicitAccessWithNameW	(	PEXPLICIT_ACCESSW	pExplicitAccess,
		LPWSTR	pTrusteeName,
		DWORD	AccessPermissions,
		ACCESS_MODE	AccessMode,
		DWORD	Inheritance
	)

Definition at line 2152 of file security.c.

{
    pExplicitAccess->grfAccessPermissions = AccessPermissions;
    pExplicitAccess->grfAccessMode = AccessMode;
    pExplicitAccess->grfInheritance = Inheritance;
 
    pExplicitAccess->Trustee.pMultipleTrustee = NULL;
    pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
    pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
    pExplicitAccess->Trustee.ptstrName = pTrusteeName;
}

BuildTrusteeWithNameA()

VOID WINAPI BuildTrusteeWithNameA	(	PTRUSTEE_A	pTrustee,
		LPSTR	name
	)

Definition at line 2375 of file security.c.

{
    TRACE("%p %s\n", pTrustee, name);
 
    pTrustee->pMultipleTrustee = NULL;
    pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
    pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
    pTrustee->ptstrName = name;
}

BuildTrusteeWithNameW()

VOID WINAPI BuildTrusteeWithNameW	(	PTRUSTEE_W	pTrustee,
		LPWSTR	name
	)

Definition at line 2391 of file security.c.

{
    TRACE("%p %s\n", pTrustee, name);
 
    pTrustee->pMultipleTrustee = NULL;
    pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
    pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
    pTrustee->ptstrName = name;
}

BuildTrusteeWithObjectsAndNameA()

VOID WINAPI BuildTrusteeWithObjectsAndNameA	(	PTRUSTEEA	pTrustee,
		POBJECTS_AND_NAME_A	pObjName,
		SE_OBJECT_TYPE	ObjectType,
		LPSTR	ObjectTypeName,
		LPSTR	InheritedObjectTypeName,
		LPSTR	Name
	)

Definition at line 2172 of file security.c.

{
    DWORD ObjectsPresent = 0;
 
    TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
          ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_a(Name));
 
    /* Fill the OBJECTS_AND_NAME structure */
    pObjName->ObjectType = ObjectType;
    if (ObjectTypeName != NULL)
    {
        ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
    }
 
    pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
    if (InheritedObjectTypeName != NULL)
    {
        ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
    }
 
    pObjName->ObjectsPresent = ObjectsPresent;
    pObjName->ptstrName = Name;
 
    /* Fill the TRUSTEE structure */
    pTrustee->pMultipleTrustee = NULL;
    pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
    pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
    pTrustee->ptstrName = (LPSTR)pObjName;
}

BuildTrusteeWithObjectsAndNameW()

VOID WINAPI BuildTrusteeWithObjectsAndNameW	(	PTRUSTEEW	pTrustee,
		POBJECTS_AND_NAME_W	pObjName,
		SE_OBJECT_TYPE	ObjectType,
		LPWSTR	ObjectTypeName,
		LPWSTR	InheritedObjectTypeName,
		LPWSTR	Name
	)

Definition at line 2208 of file security.c.

{
    DWORD ObjectsPresent = 0;
 
    TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
          ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_w(Name));
 
    /* Fill the OBJECTS_AND_NAME structure */
    pObjName->ObjectType = ObjectType;
    if (ObjectTypeName != NULL)
    {
        ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
    }
 
    pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
    if (InheritedObjectTypeName != NULL)
    {
        ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
    }
 
    pObjName->ObjectsPresent = ObjectsPresent;
    pObjName->ptstrName = Name;
 
    /* Fill the TRUSTEE structure */
    pTrustee->pMultipleTrustee = NULL;
    pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
    pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
    pTrustee->ptstrName = (LPWSTR)pObjName;
}

BuildTrusteeWithObjectsAndSidA()

VOID WINAPI BuildTrusteeWithObjectsAndSidA	(	PTRUSTEEA	pTrustee,
		POBJECTS_AND_SID	pObjSid,
		GUID *	pObjectGuid,
		GUID *	pInheritedObjectGuid,
		PSID	pSid
	)

Definition at line 2245 of file security.c.

{
    DWORD ObjectsPresent = 0;
 
    TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
 
    /* Fill the OBJECTS_AND_SID structure */
    if (pObjectGuid != NULL)
    {
        pObjSid->ObjectTypeGuid = *pObjectGuid;
        ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
    }
    else
    {
        ZeroMemory(&pObjSid->ObjectTypeGuid,
                   sizeof(GUID));
    }
 
    if (pInheritedObjectGuid != NULL)
    {
        pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
        ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
    }
    else
    {
        ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
                   sizeof(GUID));
    }
 
    pObjSid->ObjectsPresent = ObjectsPresent;
    pObjSid->pSid = pSid;
 
    /* Fill the TRUSTEE structure */
    pTrustee->pMultipleTrustee = NULL;
    pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
    pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
    pTrustee->ptstrName = (LPSTR) pObjSid;
}

BuildTrusteeWithObjectsAndSidW()

VOID WINAPI BuildTrusteeWithObjectsAndSidW	(	PTRUSTEEW	pTrustee,
		POBJECTS_AND_SID	pObjSid,
		GUID *	pObjectGuid,
		GUID *	pInheritedObjectGuid,
		PSID	pSid
	)

Definition at line 2294 of file security.c.

{
    DWORD ObjectsPresent = 0;
 
    TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
 
    /* Fill the OBJECTS_AND_SID structure */
    if (pObjectGuid != NULL)
    {
        pObjSid->ObjectTypeGuid = *pObjectGuid;
        ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
    }
    else
    {
        ZeroMemory(&pObjSid->ObjectTypeGuid,
                   sizeof(GUID));
    }
 
    if (pInheritedObjectGuid != NULL)
    {
        pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
        ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
    }
    else
    {
        ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
                   sizeof(GUID));
    }
 
    pObjSid->ObjectsPresent = ObjectsPresent;
    pObjSid->pSid = pSid;
 
    /* Fill the TRUSTEE structure */
    pTrustee->pMultipleTrustee = NULL;
    pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
    pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
    pTrustee->ptstrName = (LPWSTR) pObjSid;
}

BuildTrusteeWithSidA()

VOID WINAPI BuildTrusteeWithSidA	(	PTRUSTEE_A	pTrustee,
		PSID	pSid
	)

Definition at line 2342 of file security.c.

{
    TRACE("%p %p\n", pTrustee, pSid);
 
    pTrustee->pMultipleTrustee = NULL;
    pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    pTrustee->TrusteeForm = TRUSTEE_IS_SID;
    pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
    pTrustee->ptstrName = (LPSTR) pSid;
}

BuildTrusteeWithSidW()

VOID WINAPI BuildTrusteeWithSidW	(	PTRUSTEE_W	pTrustee,
		PSID	pSid
	)

Definition at line 2359 of file security.c.

{
    TRACE("%p %p\n", pTrustee, pSid);
 
    pTrustee->pMultipleTrustee = NULL;
    pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
    pTrustee->TrusteeForm = TRUSTEE_IS_SID;
    pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
    pTrustee->ptstrName = (LPWSTR) pSid;
}

ComputeStringSidSize()

static DWORD ComputeStringSidSize ( LPCWSTR  StringSid )

static

Definition at line 3934 of file security.c.

{
    if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I(-S)+ */
    {
        int ctok = 0;
        while (*StringSid)
        {
            if (*StringSid == '-')
                ctok++;
            StringSid++;
        }
 
        if (ctok >= 3)
            return GetSidLengthRequired(ctok - 2);
    }
    else /* String constant format  - Only available in winxp and above */
    {
        unsigned int i;
 
        for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
            if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
                return GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
 
        for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
            if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
            {
                MAX_SID local;
                ADVAPI_GetComputerSid(&local);
                return GetSidLengthRequired(*GetSidSubAuthorityCount(&local) + 1);
            }
 
    }
 
    return GetSidLengthRequired(0);
}

Referenced by ParseStringSidToSid().

ConvertSecurityDescriptorToStringSecurityDescriptorA()

BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorA	(	PSECURITY_DESCRIPTOR	SecurityDescriptor,
		DWORD	SDRevision,
		SECURITY_INFORMATION	Information,
		LPSTR *	OutputString,
		PULONG	OutputLen
	)

Definition at line 3499 of file security.c.

{
    LPWSTR wstr;
    ULONG len;
    if (ConvertSecurityDescriptorToStringSecurityDescriptorW(SecurityDescriptor, SDRevision, Information, &wstr, &len))
    {
        int lenA;
 
        lenA = WideCharToMultiByte(CP_ACP, 0, wstr, len, NULL, 0, NULL, NULL);
        *OutputString = heap_alloc(lenA);
#ifdef __REACTOS__
        if (*OutputString == NULL)
        {
            LocalFree(wstr);
            *OutputLen = 0;
            return FALSE;
        }
#endif
        WideCharToMultiByte(CP_ACP, 0, wstr, len, *OutputString, lenA, NULL, NULL);
        LocalFree(wstr);
 
        if (OutputLen != NULL)
            *OutputLen = lenA;
        return TRUE;
    }
    else
    {
        *OutputString = NULL;
        if (OutputLen)
            *OutputLen = 0;
        return FALSE;
    }
}

ConvertSecurityDescriptorToStringSecurityDescriptorW()

BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorW	(	PSECURITY_DESCRIPTOR	SecurityDescriptor,
		DWORD	SDRevision,
		SECURITY_INFORMATION	RequestedInformation,
		LPWSTR *	OutputString,
		PULONG	OutputLen
	)

Definition at line 3435 of file security.c.

{
    ULONG len;
    WCHAR *wptr, *wstr;
 
    if (SDRevision != SDDL_REVISION_1)
    {
        ERR("Program requested unknown SDDL revision %d\n", SDRevision);
        SetLastError(ERROR_UNKNOWN_REVISION);
        return FALSE;
    }
 
    len = 0;
    if (RequestedInformation & OWNER_SECURITY_INFORMATION)
        if (!DumpOwner(SecurityDescriptor, NULL, &len))
            return FALSE;
    if (RequestedInformation & GROUP_SECURITY_INFORMATION)
        if (!DumpGroup(SecurityDescriptor, NULL, &len))
            return FALSE;
    if (RequestedInformation & DACL_SECURITY_INFORMATION)
        if (!DumpDacl(SecurityDescriptor, NULL, &len))
            return FALSE;
    if (RequestedInformation & SACL_SECURITY_INFORMATION)
        if (!DumpSacl(SecurityDescriptor, NULL, &len))
            return FALSE;
 
    wstr = wptr = LocalAlloc(0, (len + 1)*sizeof(WCHAR));
#ifdef __REACTOS__
    if (wstr == NULL)
        return FALSE;
#endif
 
    if (RequestedInformation & OWNER_SECURITY_INFORMATION)
        if (!DumpOwner(SecurityDescriptor, &wptr, NULL)) {
            LocalFree (wstr);
            return FALSE;
        }
    if (RequestedInformation & GROUP_SECURITY_INFORMATION)
        if (!DumpGroup(SecurityDescriptor, &wptr, NULL)) {
            LocalFree (wstr);
            return FALSE;
        }
    if (RequestedInformation & DACL_SECURITY_INFORMATION)
        if (!DumpDacl(SecurityDescriptor, &wptr, NULL)) {
            LocalFree (wstr);
            return FALSE;
        }
    if (RequestedInformation & SACL_SECURITY_INFORMATION)
        if (!DumpSacl(SecurityDescriptor, &wptr, NULL)) {
            LocalFree (wstr);
            return FALSE;
        }
    *wptr = 0;
 
    TRACE("ret: %s, %d\n", wine_dbgstr_w(wstr), len);
    *OutputString = wstr;
    if (OutputLen)
        *OutputLen = strlenW(*OutputString)+1;
    return TRUE;
}

Referenced by ConvertSecurityDescriptorToStringSecurityDescriptorA().

ConvertSidToStringSidA()

BOOL WINAPI ConvertSidToStringSidA	(	PSID	Sid,
		LPSTR *	StringSid
	)

Definition at line 3637 of file security.c.

{
    LPWSTR StringSidW;
    int Len;
 
    if (!ConvertSidToStringSidW(Sid, &StringSidW))
    {
        return FALSE;
    }
 
    Len = WideCharToMultiByte(CP_ACP, 0, StringSidW, -1, NULL, 0, NULL, NULL);
    if (Len <= 0)
    {
        LocalFree(StringSidW);
        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
        return FALSE;
    }
 
    *StringSid = LocalAlloc(LMEM_FIXED, Len);
    if (NULL == *StringSid)
    {
        LocalFree(StringSidW);
        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
        return FALSE;
    }
 
    if (!WideCharToMultiByte(CP_ACP, 0, StringSidW, -1, *StringSid, Len, NULL, NULL))
    {
        LocalFree(StringSid);
        LocalFree(StringSidW);
        return FALSE;
    }
 
    LocalFree(StringSidW);
 
    return TRUE;
}

Referenced by debugstr_sid(), get_user_sid(), map_name_2_sid(), test_CreateWellKnownSid(), test_LookupAccountSid(), test_lsa(), test_sid(), test_sid_str(), test_token_attr(), and test_token_label().

ConvertSidToStringSidW()

BOOL WINAPI ConvertSidToStringSidW	(	PSID	Sid,
		LPWSTR *	StringSid
	)

Definition at line 3583 of file security.c.

{
    NTSTATUS Status;
    UNICODE_STRING UnicodeString;
    WCHAR FixedBuffer[64];
 
    if (!RtlValidSid(Sid))
    {
        SetLastError(ERROR_INVALID_SID);
        return FALSE;
    }
 
    UnicodeString.Length = 0;
    UnicodeString.MaximumLength = sizeof(FixedBuffer);
    UnicodeString.Buffer = FixedBuffer;
    Status = RtlConvertSidToUnicodeString(&UnicodeString, Sid, FALSE);
    if (STATUS_BUFFER_TOO_SMALL == Status)
    {
        Status = RtlConvertSidToUnicodeString(&UnicodeString, Sid, TRUE);
    }
 
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    *StringSid = LocalAlloc(LMEM_FIXED, UnicodeString.Length + sizeof(WCHAR));
    if (NULL == *StringSid)
    {
        if (UnicodeString.Buffer != FixedBuffer)
        {
            RtlFreeUnicodeString(&UnicodeString);
        }
      SetLastError(ERROR_NOT_ENOUGH_MEMORY);
      return FALSE;
    }
 
    MoveMemory(*StringSid, UnicodeString.Buffer, UnicodeString.Length);
    ZeroMemory((PCHAR) *StringSid + UnicodeString.Length, sizeof(WCHAR));
    if (UnicodeString.Buffer != FixedBuffer)
    {
        RtlFreeUnicodeString(&UnicodeString);
    }
 
    return TRUE;
}

Referenced by _GetUserSidStringFromToken(), AddUserProfiles(), ConvertSidToStringSidA(), CreateUserProfileExW(), get_user_sid(), GetEventUserName(), GetPrincipalDisplayString(), RecycleBin5::Init(), LsapGetDomainInfo(), LsapLookupAccountDomainSids(), LsapLookupBuiltinDomainSids(), LsapLookupWellKnownSids(), MsiSourceListAddSourceW(), SampAddMemberToAlias(), SampRemoveMemberFromAlias(), SampRemoveMemberFromAllAliases(), SampSetupAddMemberToAlias(), set_user_sid_prop(), START_TEST(), UpdatePrincipalInfo(), WhoamiGroups(), WhoamiLogonId(), and WhoamiUser().

ConvertStringSecurityDescriptorToSecurityDescriptorA()

BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorA	(	LPCSTR	StringSecurityDescriptor,
		DWORD	StringSDRevision,
		PSECURITY_DESCRIPTOR *	SecurityDescriptor,
		PULONG	SecurityDescriptorSize
	)

Definition at line 3032 of file security.c.

{
    UINT len;
    BOOL ret = FALSE;
    LPWSTR StringSecurityDescriptorW;
 
    len = MultiByteToWideChar(CP_ACP, 0, StringSecurityDescriptor, -1, NULL, 0);
    StringSecurityDescriptorW = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
 
    if (StringSecurityDescriptorW)
    {
        MultiByteToWideChar(CP_ACP, 0, StringSecurityDescriptor, -1, StringSecurityDescriptorW, len);
 
        ret = ConvertStringSecurityDescriptorToSecurityDescriptorW(StringSecurityDescriptorW,
                                                                   StringSDRevision, SecurityDescriptor,
                                                                   SecurityDescriptorSize);
        HeapFree(GetProcessHeap(), 0, StringSecurityDescriptorW);
    }
 
    return ret;
}

Referenced by test_profile_directory_readonly().

ConvertStringSecurityDescriptorToSecurityDescriptorW()

BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorW	(	LPCWSTR	StringSecurityDescriptor,
		DWORD	StringSDRevision,
		PSECURITY_DESCRIPTOR *	SecurityDescriptor,
		PULONG	SecurityDescriptorSize
	)

Definition at line 3062 of file security.c.

{
    DWORD cBytes;
    SECURITY_DESCRIPTOR* psd;
    BOOL bret = FALSE;
 
    TRACE("%s\n", debugstr_w(StringSecurityDescriptor));
 
    if (GetVersion() & 0x80000000)
    {
        SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
        goto lend;
    }
    else if (!StringSecurityDescriptor || !SecurityDescriptor)
    {
        SetLastError(ERROR_INVALID_PARAMETER);
        goto lend;
    }
    else if (StringSDRevision != SID_REVISION)
    {
        SetLastError(ERROR_UNKNOWN_REVISION);
        goto lend;
    }
 
    /* Compute security descriptor length */
    if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
        NULL, &cBytes))
        goto lend;
 
    psd = *SecurityDescriptor = LocalAlloc(GMEM_ZEROINIT, cBytes);
    if (!psd) goto lend;
 
    psd->Revision = SID_REVISION;
    psd->Control |= SE_SELF_RELATIVE;
 
    if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
             (SECURITY_DESCRIPTOR_RELATIVE *)psd, &cBytes))
    {
        LocalFree(psd);
        goto lend;
    }
 
    if (SecurityDescriptorSize)
        *SecurityDescriptorSize = cBytes;
 
    bret = TRUE;
 
lend:
    TRACE(" ret=%d\n", bret);
    return bret;
}

Referenced by ConvertStringSecurityDescriptorToSecurityDescriptorA(), InstallOneService(), registry_callback(), and SetupQueueCopyIndirectW().

ConvertStringSidToSidA()

BOOL WINAPI ConvertStringSidToSidA	(	LPCSTR	StringSid,
		PSID *	Sid
	)

Definition at line 3560 of file security.c.

{
    BOOL bret = FALSE;
 
    TRACE("%s, %p\n", debugstr_a(StringSid), Sid);
    if (GetVersion() & 0x80000000)
        SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
    else if (!StringSid || !Sid)
        SetLastError(ERROR_INVALID_PARAMETER);
    else
    {
        WCHAR *wStringSid = SERV_dup(StringSid);
        bret = ConvertStringSidToSidW(wStringSid, Sid);
        heap_free(wStringSid);
    }
    return bret;
}

Referenced by test_LsaLookupSids().

ConvertStringSidToSidW()

BOOL WINAPI ConvertStringSidToSidW	(	LPCWSTR	StringSid,
		PSID *	Sid
	)

Definition at line 3536 of file security.c.

{
    BOOL bret = FALSE;
    DWORD cBytes;
 
    TRACE("%s, %p\n", debugstr_w(StringSid), Sid);
    if (GetVersion() & 0x80000000)
        SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
    else if (!StringSid || !Sid)
        SetLastError(ERROR_INVALID_PARAMETER);
    else if (ParseStringSidToSid(StringSid, NULL, &cBytes))
    {
        PSID pSid = *Sid = LocalAlloc(0, cBytes);
 
        bret = ParseStringSidToSid(StringSid, pSid, &cBytes);
        if (!bret)
            LocalFree(*Sid);
    }
    return bret;
}

Referenced by ConvertStringSidToSidA(), and fill_sid().

CopySid()

BOOL WINAPI CopySid	(	DWORD	nDestinationSidLength,
		PSID	pDestinationSid,
		PSID	pSourceSid
	)

Definition at line 712 of file security.c.

{
    return set_ntstatus(RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid));
}

Referenced by AccpLookupSidByName(), AccRewriteGetExplicitEntriesFromAcl(), AddPrincipalToList(), AuthzGetInformationFromContext(), AuthzInitializeContextFromSid(), BuildDefaultPrincipalAce(), CachedGetUserFromSid(), CacheLookupResults(), GetUserSid(), LookupAccountNameW(), QueueSidLookup(), ReloadPrincipalsList(), and test_LookupAccountSid().

CreateProcessWithLogonW()

BOOL WINAPI CreateProcessWithLogonW	(	_In_ LPCWSTR	lpUsername,
		_In_opt_ LPCWSTR	lpDomain,
		_In_ LPCWSTR	lpPassword,
		_In_ DWORD	dwLogonFlags,
		_In_opt_ LPCWSTR	lpApplicationName,
		_Inout_opt_ LPWSTR	lpCommandLine,
		_In_ DWORD	dwCreationFlags,
		_In_opt_ LPVOID	lpEnvironment,
		_In_opt_ LPCWSTR	lpCurrentDirectory,
		_In_ LPSTARTUPINFOW	lpStartupInfo,
		_Out_ LPPROCESS_INFORMATION	lpProcessInformation
	)

Definition at line 3728 of file security.c.

{
    LPWSTR pszStringBinding = NULL;
    handle_t hBinding = NULL;
    SECL_REQUEST Request;
    SECL_RESPONSE Response;
    RPC_STATUS Status;
 
    TRACE("CreateProcessWithLogonW(%s %s %s 0x%08x %s %s 0x%08x %p %s %p %p)\n", debugstr_w(lpUsername), debugstr_w(lpDomain),
    debugstr_w(lpPassword), dwLogonFlags, debugstr_w(lpApplicationName),
    debugstr_w(lpCommandLine), dwCreationFlags, lpEnvironment, debugstr_w(lpCurrentDirectory),
    lpStartupInfo, lpProcessInformation);
 
    Status = RpcStringBindingComposeW(NULL,
                                      L"ncacn_np",
                                      NULL,
                                      L"\\pipe\\seclogon",
                                      NULL,
                                      &pszStringBinding);
    if (Status != RPC_S_OK)
    {
        WARN("RpcStringBindingCompose returned 0x%x\n", Status);
        SetLastError(Status);
        return FALSE;
    }
 
    /* Set the binding handle that will be used to bind to the server. */
    Status = RpcBindingFromStringBindingW(pszStringBinding,
                                          &hBinding);
    if (Status != RPC_S_OK)
    {
        WARN("RpcBindingFromStringBinding returned 0x%x\n", Status);
    }
 
    Status = RpcStringFreeW(&pszStringBinding);
    if (Status != RPC_S_OK)
    {
        WARN("RpcStringFree returned 0x%x\n", Status);
    }
 
    Request.Username = (LPWSTR)lpUsername;
    Request.Domain = (LPWSTR)lpDomain;
    Request.Password = (LPWSTR)lpPassword;
    Request.ApplicationName = (LPWSTR)lpApplicationName;
    Request.CommandLine = (LPWSTR)lpCommandLine;
    Request.CurrentDirectory = (LPWSTR)lpCurrentDirectory;
 
    if (dwCreationFlags & CREATE_UNICODE_ENVIRONMENT)
        Request.dwEnvironmentSize = GetUnicodeEnvironmentSize(lpEnvironment);
    else
        Request.dwEnvironmentSize = GetAnsiEnvironmentSize(lpEnvironment);
    Request.Environment = lpEnvironment;
 
    TRACE("Request.dwEnvironmentSize %lu\n", Request.dwEnvironmentSize);
    TRACE("Request.Environment %p\n", Request.Environment);
 
    Request.dwLogonFlags = dwLogonFlags;
    Request.dwCreationFlags = dwCreationFlags;
 
    Request.dwProcessId = GetCurrentProcessId();
    TRACE("Request.dwProcessId %lu\n", Request.dwProcessId);
 
    Response.hProcess = 0;
    Response.hThread = 0;
    Response.dwProcessId = 0;
    Response.dwThreadId = 0;
    Response.dwError = ERROR_SUCCESS;
 
    RpcTryExcept
    {
        SeclCreateProcessWithLogonW(hBinding, &Request, &Response);
    }
    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
    {
        WARN("Exception: %lx\n", RpcExceptionCode());
    }
    RpcEndExcept;
 
    if (hBinding)
    {
        Status = RpcBindingFree(&hBinding);
        if (Status != RPC_S_OK)
        {
            WARN("RpcBindingFree returned 0x%x\n", Status);
        }
 
        hBinding = NULL;
    }
 
    TRACE("Response.hProcess %p\n", Response.hProcess);
    TRACE("Response.hThread %p\n", Response.hThread);
    TRACE("Response.dwProcessId %lu\n", Response.dwProcessId);
    TRACE("Response.dwThreadId %lu\n", Response.dwThreadId);
    TRACE("Response.dwError %lu\n", Response.dwError);
    if (Response.dwError != ERROR_SUCCESS)
        SetLastError(Response.dwError);
 
    TRACE("CreateProcessWithLogonW() done\n");
 
    return (Response.dwError == ERROR_SUCCESS);
}

Referenced by wmain().

CreateProcessWithTokenW()

BOOL WINAPI CreateProcessWithTokenW	(	HANDLE	token,
		DWORD	logon_flags,
		LPCWSTR	application_name,
		LPWSTR	command_line,
		DWORD	creation_flags,
		void *	environment,
		LPCWSTR	current_directory,
		STARTUPINFOW *	startup_info,
		PROCESS_INFORMATION *	process_information
	)

Definition at line 3841 of file security.c.

{
    FIXME("%p 0x%08x %s %s 0x%08x %p %s %p %p - semi-stub\n", token,
          logon_flags, debugstr_w(application_name), debugstr_w(command_line),
          creation_flags, environment, debugstr_w(current_directory),
          startup_info, process_information);
 
    /* FIXME: check if handles should be inherited */
    return CreateProcessW( application_name, command_line, NULL, NULL, FALSE, creation_flags, environment,
                           current_directory, startup_info, process_information );
}

CreateRestrictedToken()

BOOL WINAPI CreateRestrictedToken	(	_In_ HANDLE	ExistingTokenHandle,
		_In_ DWORD	Flags,
		_In_ DWORD	DisableSidCount,
		_In_reads_opt_(DisableSidCount) PSID_AND_ATTRIBUTES	SidsToDisable,
		_In_ DWORD	DeletePrivilegeCount,
		_In_reads_opt_(DeletePrivilegeCount) PLUID_AND_ATTRIBUTES	PrivilegesToDelete,
		_In_ DWORD	RestrictedSidCount,
		_In_reads_opt_(RestrictedSidCount) PSID_AND_ATTRIBUTES	SidsToRestrict,
		_Outptr_ PHANDLE	NewTokenHandle
	)

Creates a filtered token that is a restricted one of the regular access token. A restricted token can have disabled SIDs, deleted privileges and/or restricted SIDs added.

Parameters

[in]	ExistingTokenHandle	An existing handle to a token where it's to be filtered.
[in]	Flags	Privilege flag options. This parameter argument influences how the token is filtered. Such parameter can be 0.
[in]	DisableSidCount	The count number of SIDs to disable.
[in]	SidsToDisable	An array list with SIDs that have to be disabled in a token.
[in]	DeletePrivilegeCount	The count number of privileges to be deleted.
[in]	PrivilegesToDelete	An array list with privileges that have to be deleted in a token.
[in]	RestrictedSidCount	The count number of restricted SIDs.
[in]	SidsToRestrict	An array list with restricted SIDs to be added into the token. If the token already has restricted SIDs then the array provided by the caller is redundant information alongside with the existing restricted SIDs in the token.
[out]	NewTokenHandle	The newly received handle to a restricted (filtered) token. The caller can use such handle to duplicate a new token.

Returns

Returns TRUE if the function has successfully completed the operations, otherwise FALSE is returned to indicate failure. For further details the caller has to invoke GetLastError() API call for extended information about the failure.

Definition at line 533 of file security.c.

{
    NTSTATUS Status;
    BOOL Success;
    ULONG Index;
    PTOKEN_GROUPS DisableSids = NULL;
    PTOKEN_GROUPS RestrictedSids = NULL;
    PTOKEN_PRIVILEGES DeletePrivileges = NULL;
 
    /*
     * Capture the elements we're being given from
     * the caller and allocate the groups and/or
     * privileges that have to be filtered in
     * the token.
     */
    if (SidsToDisable != NULL)
    {
        DisableSids = (PTOKEN_GROUPS)LocalAlloc(LMEM_FIXED, DisableSidCount * sizeof(TOKEN_GROUPS));
        if (DisableSids == NULL)
        {
            /* We failed, bail out */
            SetLastError(RtlNtStatusToDosError(STATUS_INSUFFICIENT_RESOURCES));
            return FALSE;
        }
 
        /* Copy the counter and loop the elements to copy the rest */
        DisableSids->GroupCount = DisableSidCount;
        for (Index = 0; Index < DisableSidCount; Index++)
        {
            DisableSids->Groups[Index].Sid = SidsToDisable[Index].Sid;
            DisableSids->Groups[Index].Attributes = SidsToDisable[Index].Attributes;
        }
    }
 
    if (PrivilegesToDelete != NULL)
    {
        DeletePrivileges = (PTOKEN_PRIVILEGES)LocalAlloc(LMEM_FIXED, DeletePrivilegeCount * sizeof(TOKEN_PRIVILEGES));
        if (DeletePrivileges == NULL)
        {
            /* We failed, bail out */
            SetLastError(RtlNtStatusToDosError(STATUS_INSUFFICIENT_RESOURCES));
            Success = FALSE;
            goto Cleanup;
        }
 
        /* Copy the counter and loop the elements to copy the rest */
        DeletePrivileges->PrivilegeCount = DeletePrivilegeCount;
        for (Index = 0; Index < DeletePrivilegeCount; Index++)
        {
            DeletePrivileges->Privileges[Index].Luid = PrivilegesToDelete[Index].Luid;
            DeletePrivileges->Privileges[Index].Attributes = PrivilegesToDelete[Index].Attributes;
        }
    }
 
    if (SidsToRestrict != NULL)
    {
        RestrictedSids = (PTOKEN_GROUPS)LocalAlloc(LMEM_FIXED, RestrictedSidCount * sizeof(TOKEN_GROUPS));
        if (RestrictedSids == NULL)
        {
            /* We failed, bail out */
            SetLastError(RtlNtStatusToDosError(STATUS_INSUFFICIENT_RESOURCES));
            Success = FALSE;
            goto Cleanup;
        }
 
        /* Copy the counter and loop the elements to copy the rest */
        RestrictedSids->GroupCount = RestrictedSidCount;
        for (Index = 0; Index < RestrictedSidCount; Index++)
        {
            RestrictedSids->Groups[Index].Sid = SidsToRestrict[Index].Sid;
            RestrictedSids->Groups[Index].Attributes = SidsToRestrict[Index].Attributes;
        }
    }
 
    /*
     * Call the NT API to request a token filtering
     * operation for us.
     */
    Status = NtFilterToken(ExistingTokenHandle,
                           Flags,
                           DisableSids,
                           DeletePrivileges,
                           RestrictedSids,
                           NewTokenHandle);
    if (!NT_SUCCESS(Status))
    {
        /* We failed to do the job, bail out */
        SetLastError(RtlNtStatusToDosError(Status));
        Success = FALSE;
        goto Cleanup;
    }
 
    /* If we reach here then we've successfully filtered the token */
    Success = TRUE;
 
Cleanup:
    /* Free whatever we allocated before */
    if (DisableSids != NULL)
    {
        LocalFree(DisableSids);
    }
 
    if (DeletePrivileges != NULL)
    {
        LocalFree(DeletePrivileges);
    }
 
    if (RestrictedSids != NULL)
    {
        LocalFree(RestrictedSids);
    }
 
    return Success;
}

Referenced by test_token_security_descriptor().

CreateWellKnownSid()

BOOL WINAPI CreateWellKnownSid	(	IN WELL_KNOWN_SID_TYPE	WellKnownSidType,
		IN PSID DomainSid	OPTIONAL,
		OUT PSID	pSid,
		IN OUT DWORD *	cbSid
	)

Definition at line 722 of file security.c.

{
    unsigned int i;
    TRACE("(%d, %s, %p, %p)\n", WellKnownSidType, debugstr_sid(DomainSid), pSid, cbSid);
 
    if (cbSid == NULL || (DomainSid && !IsValidSid(DomainSid)))
    {
        SetLastError(ERROR_INVALID_PARAMETER);
        return FALSE;
    }
 
    for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++) {
        if (WellKnownSids[i].Type == WellKnownSidType) {
            DWORD length = GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
 
            if (*cbSid < length)
            {
                *cbSid = length;
                SetLastError(ERROR_INSUFFICIENT_BUFFER);
                return FALSE;
            }
            if (!pSid)
            {
                SetLastError(ERROR_INVALID_PARAMETER);
                return FALSE;
            }
            CopyMemory(pSid, &WellKnownSids[i].Sid.Revision, length);
            *cbSid = length;
            return TRUE;
        }
    }
 
    if (DomainSid == NULL || *GetSidSubAuthorityCount(DomainSid) == SID_MAX_SUB_AUTHORITIES)
    {
        SetLastError(ERROR_INVALID_PARAMETER);
        return FALSE;
    }
 
    for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
        if (WellKnownRids[i].Type == WellKnownSidType) {
            UCHAR domain_subauth = *GetSidSubAuthorityCount(DomainSid);
            DWORD domain_sid_length = GetSidLengthRequired(domain_subauth);
            DWORD output_sid_length = GetSidLengthRequired(domain_subauth + 1);
 
            if (*cbSid < output_sid_length)
            {
                *cbSid = output_sid_length;
                SetLastError(ERROR_INSUFFICIENT_BUFFER);
                return FALSE;
            }
            if (!pSid)
            {
                SetLastError(ERROR_INVALID_PARAMETER);
                return FALSE;
            }
            CopyMemory(pSid, DomainSid, domain_sid_length);
            (*GetSidSubAuthorityCount(pSid))++;
            (*GetSidSubAuthority(pSid, domain_subauth)) = WellKnownRids[i].Rid;
            *cbSid = output_sid_length;
            return TRUE;
        }
 
    SetLastError(ERROR_INVALID_PARAMETER);
    return FALSE;
}

Referenced by create_unknownsid(), get_sd(), test_SystemSecurity(), and well_known_sid().

debugstr_sid()

static const char * debugstr_sid ( PSID  sid )

static

Definition at line 174 of file security.c.

{
    int auth = 0;
    SID * psid = (SID *)sid;
 
    if (psid == NULL)
        return "(null)";
 
    auth = psid->IdentifierAuthority.Value[5] +
           (psid->IdentifierAuthority.Value[4] << 8) +
           (psid->IdentifierAuthority.Value[3] << 16) +
           (psid->IdentifierAuthority.Value[2] << 24);
 
    switch (psid->SubAuthorityCount) {
    case 0:
        return wine_dbg_sprintf("S-%d-%d", psid->Revision, auth);
    case 1:
        return wine_dbg_sprintf("S-%d-%d-%lu", psid->Revision, auth,
            psid->SubAuthority[0]);
    case 2:
        return wine_dbg_sprintf("S-%d-%d-%lu-%lu", psid->Revision, auth,
            psid->SubAuthority[0], psid->SubAuthority[1]);
    case 3:
        return wine_dbg_sprintf("S-%d-%d-%lu-%lu-%lu", psid->Revision, auth,
            psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2]);
    case 4:
        return wine_dbg_sprintf("S-%d-%d-%lu-%lu-%lu-%lu", psid->Revision, auth,
            psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
            psid->SubAuthority[3]);
    case 5:
        return wine_dbg_sprintf("S-%d-%d-%lu-%lu-%lu-%lu-%lu", psid->Revision, auth,
            psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
            psid->SubAuthority[3], psid->SubAuthority[4]);
    case 6:
        return wine_dbg_sprintf("S-%d-%d-%lu-%lu-%lu-%lu-%lu-%lu", psid->Revision, auth,
            psid->SubAuthority[3], psid->SubAuthority[1], psid->SubAuthority[2],
            psid->SubAuthority[0], psid->SubAuthority[4], psid->SubAuthority[5]);
    case 7:
        return wine_dbg_sprintf("S-%d-%d-%lu-%lu-%lu-%lu-%lu-%lu-%lu", psid->Revision, auth,
            psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
            psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
            psid->SubAuthority[6]);
    case 8:
        return wine_dbg_sprintf("S-%d-%d-%lu-%lu-%lu-%lu-%lu-%lu-%lu-%lu", psid->Revision, auth,
            psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
            psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
            psid->SubAuthority[6], psid->SubAuthority[7]);
    }
    return "(too-big)";
}

Referenced by check_wellknown_name(), CreateWellKnownSid(), IsWellKnownSid(), test_EqualSid(), test_GetNamedSecurityInfoA(), test_GetSecurityInfo(), test_GetWindowsAccountDomainSid(), test_group_equal(), test_inherited_dacl(), test_owner_equal(), and test_TokenIntegrityLevel().

DeleteAce()

BOOL WINAPI DeleteAce	(	PACL	pAcl,
		DWORD	dwAceIndex
	)

Definition at line 1166 of file security.c.

{
    return set_ntstatus(RtlDeleteAce(pAcl, dwAceIndex));
}

DumpAce()

static BOOL DumpAce ( LPVOID  pace, WCHAR **  pwptr, ULONG *  plen  )

static

Definition at line 3260 of file security.c.

{
    ACCESS_ALLOWED_ACE *piace; /* all the supported ACEs have the same memory layout */
    static const WCHAR openbr = '(';
    static const WCHAR closebr = ')';
    static const WCHAR semicolon = ';';
 
    if (((PACE_HEADER)pace)->AceType > SYSTEM_ALARM_ACE_TYPE || ((PACE_HEADER)pace)->AceSize < sizeof(ACCESS_ALLOWED_ACE))
    {
        SetLastError(ERROR_INVALID_ACL);
        return FALSE;
    }
 
    piace = pace;
    DumpString(&openbr, 1, pwptr, plen);
    switch (piace->Header.AceType)
    {
        case ACCESS_ALLOWED_ACE_TYPE:
            DumpString(SDDL_ACCESS_ALLOWED, -1, pwptr, plen);
            break;
        case ACCESS_DENIED_ACE_TYPE:
            DumpString(SDDL_ACCESS_DENIED, -1, pwptr, plen);
            break;
        case SYSTEM_AUDIT_ACE_TYPE:
            DumpString(SDDL_AUDIT, -1, pwptr, plen);
            break;
        case SYSTEM_ALARM_ACE_TYPE:
            DumpString(SDDL_ALARM, -1, pwptr, plen);
            break;
    }
    DumpString(&semicolon, 1, pwptr, plen);
 
    if (piace->Header.AceFlags & OBJECT_INHERIT_ACE)
        DumpString(SDDL_OBJECT_INHERIT, -1, pwptr, plen);
    if (piace->Header.AceFlags & CONTAINER_INHERIT_ACE)
        DumpString(SDDL_CONTAINER_INHERIT, -1, pwptr, plen);
    if (piace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE)
        DumpString(SDDL_NO_PROPAGATE, -1, pwptr, plen);
    if (piace->Header.AceFlags & INHERIT_ONLY_ACE)
        DumpString(SDDL_INHERIT_ONLY, -1, pwptr, plen);
    if (piace->Header.AceFlags & INHERITED_ACE)
        DumpString(SDDL_INHERITED, -1, pwptr, plen);
    if (piace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG)
        DumpString(SDDL_AUDIT_SUCCESS, -1, pwptr, plen);
    if (piace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG)
        DumpString(SDDL_AUDIT_FAILURE, -1, pwptr, plen);
    DumpString(&semicolon, 1, pwptr, plen);
    DumpRights(piace->Mask, pwptr, plen);
    DumpString(&semicolon, 1, pwptr, plen);
    /* objects not supported */
    DumpString(&semicolon, 1, pwptr, plen);
    /* objects not supported */
    DumpString(&semicolon, 1, pwptr, plen);
    if (!DumpSid((PSID)&piace->SidStart, pwptr, plen))
        return FALSE;
    DumpString(&closebr, 1, pwptr, plen);
    return TRUE;
}

Referenced by DumpAcl().

DumpAcl()

static BOOL DumpAcl ( PACL  pacl, WCHAR **  pwptr, ULONG *  plen, BOOL  protected, BOOL  autoInheritReq, BOOL  autoInherited  )

static

Definition at line 3319 of file security.c.

{
    WORD count;
    int i;
 
    if (protected)
        DumpString(SDDL_PROTECTED, -1, pwptr, plen);
    if (autoInheritReq)
        DumpString(SDDL_AUTO_INHERIT_REQ, -1, pwptr, plen);
    if (autoInherited)
        DumpString(SDDL_AUTO_INHERITED, -1, pwptr, plen);
 
    if (pacl == NULL)
        return TRUE;
 
    if (!IsValidAcl(pacl))
        return FALSE;
 
    count = pacl->AceCount;
    for (i = 0; i < count; i++)
    {
        LPVOID ace;
        if (!GetAce(pacl, i, &ace))
            return FALSE;
        if (!DumpAce(ace, pwptr, plen))
            return FALSE;
    }
 
    return TRUE;
}

Referenced by DumpDacl(), and DumpSacl().

DumpDacl()

static BOOL DumpDacl ( PSECURITY_DESCRIPTOR  SecurityDescriptor, WCHAR **  pwptr, ULONG *  plen  )

static

Definition at line 3386 of file security.c.

{
    static const WCHAR dacl[] = {'D',':',0};
    SECURITY_DESCRIPTOR_CONTROL control;
    BOOL present, defaulted;
    DWORD revision;
    PACL pacl;
 
    if (!GetSecurityDescriptorDacl(SecurityDescriptor, &present, &pacl, &defaulted))
        return FALSE;
 
    if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
        return FALSE;
 
    if (!present)
        return TRUE;
 
    DumpString(dacl, 2, pwptr, plen);
    if (!DumpAcl(pacl, pwptr, plen, control & SE_DACL_PROTECTED, control & SE_DACL_AUTO_INHERIT_REQ, control & SE_DACL_AUTO_INHERITED))
        return FALSE;
    return TRUE;
}

Referenced by ConvertSecurityDescriptorToStringSecurityDescriptorW().

DumpGroup()

static BOOL DumpGroup ( PSECURITY_DESCRIPTOR  SecurityDescriptor, WCHAR **  pwptr, ULONG *  plen  )

static

Definition at line 3368 of file security.c.

{
    static const WCHAR prefix[] = {'G',':',0};
    BOOL bDefaulted;
    PSID psid;
 
    if (!GetSecurityDescriptorGroup(SecurityDescriptor, &psid, &bDefaulted))
        return FALSE;
 
    if (psid == NULL)
        return TRUE;
 
    DumpString(prefix, -1, pwptr, plen);
    if (!DumpSid(psid, pwptr, plen))
        return FALSE;
    return TRUE;
}

Referenced by ConvertSecurityDescriptorToStringSecurityDescriptorW().

DumpOwner()

static BOOL DumpOwner ( PSECURITY_DESCRIPTOR  SecurityDescriptor, WCHAR **  pwptr, ULONG *  plen  )

static

Definition at line 3350 of file security.c.

{
    static const WCHAR prefix[] = {'O',':',0};
    BOOL bDefaulted;
    PSID psid;
 
    if (!GetSecurityDescriptorOwner(SecurityDescriptor, &psid, &bDefaulted))
        return FALSE;
 
    if (psid == NULL)
        return TRUE;
 
    DumpString(prefix, -1, pwptr, plen);
    if (!DumpSid(psid, pwptr, plen))
        return FALSE;
    return TRUE;
}

Referenced by ConvertSecurityDescriptorToStringSecurityDescriptorW().

DumpRights()

static void DumpRights ( DWORD  mask, WCHAR **  pwptr, ULONG *  plen  )

static

Definition at line 3221 of file security.c.

{
    static const WCHAR fmtW[] = {'0','x','%','x',0};
    WCHAR buf[15];
    size_t i;
 
    if (mask == 0)
        return;
 
    /* first check if the right have name */
    for (i = 0; i < sizeof(AceRights)/sizeof(AceRights[0]); i++)
    {
        if (AceRights[i].wstr == NULL)
            break;
        if (mask == AceRights[i].value)
        {
            DumpString(AceRights[i].wstr, -1, pwptr, plen);
            return;
        }
    }
 
    /* then check if it can be built from bit names */
    for (i = 0; i < 32; i++)
    {
        if ((mask & (1 << i)) && (AceRightBitNames[i] == NULL))
        {
            /* can't be built from bit names */
            sprintfW(buf, fmtW, mask);
            DumpString(buf, -1, pwptr, plen);
            return;
        }
    }
 
    /* build from bit names */
    for (i = 0; i < 32; i++)
        if (mask & (1 << i))
            DumpString(AceRightBitNames[i], -1, pwptr, plen);
}

Referenced by DumpAce().

DumpSacl()

static BOOL DumpSacl ( PSECURITY_DESCRIPTOR  SecurityDescriptor, WCHAR **  pwptr, ULONG *  plen  )

static

Definition at line 3409 of file security.c.

{
    static const WCHAR sacl[] = {'S',':',0};
    SECURITY_DESCRIPTOR_CONTROL control;
    BOOL present, defaulted;
    DWORD revision;
    PACL pacl;
 
    if (!GetSecurityDescriptorSacl(SecurityDescriptor, &present, &pacl, &defaulted))
        return FALSE;
 
    if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
        return FALSE;
 
    if (!present)
        return TRUE;
 
    DumpString(sacl, 2, pwptr, plen);
    if (!DumpAcl(pacl, pwptr, plen, control & SE_SACL_PROTECTED, control & SE_SACL_AUTO_INHERIT_REQ, control & SE_SACL_AUTO_INHERITED))
        return FALSE;
    return TRUE;
}

Referenced by ConvertSecurityDescriptorToStringSecurityDescriptorW().

DumpSid()

static BOOL DumpSid ( PSID  psid, WCHAR **  pwptr, ULONG *  plen  )

static

Definition at line 3171 of file security.c.

{
    size_t i;
    for (i = 0; i < sizeof(WellKnownSids) / sizeof(WellKnownSids[0]); i++)
    {
        if (WellKnownSids[i].wstr[0] && EqualSid(psid, (PSID)&(WellKnownSids[i].Sid.Revision)))
        {
            DumpString(WellKnownSids[i].wstr, 2, pwptr, plen);
            return TRUE;
        }
    }
 
    return DumpSidNumeric(psid, pwptr, plen);
}

Referenced by DumpAce(), DumpGroup(), and DumpOwner().

DumpSidNumeric()

static BOOL DumpSidNumeric ( PSID  psid, WCHAR **  pwptr, ULONG *  plen  )

static

Definition at line 3132 of file security.c.

{
    DWORD i;
    WCHAR fmt[] = { 'S','-','%','u','-','%','d',0 };
    WCHAR subauthfmt[] = { '-','%','u',0 };
    WCHAR buf[26];
    SID *pisid = psid;
 
    if( !IsValidSid( psid ) || pisid->Revision != SDDL_REVISION)
    {
        SetLastError(ERROR_INVALID_SID);
        return FALSE;
    }
 
    if (pisid->IdentifierAuthority.Value[0] ||
     pisid->IdentifierAuthority.Value[1])
    {
        FIXME("not matching MS' bugs\n");
        SetLastError(ERROR_INVALID_SID);
        return FALSE;
    }
 
    sprintfW( buf, fmt, pisid->Revision,
        MAKELONG(
            MAKEWORD( pisid->IdentifierAuthority.Value[5],
                    pisid->IdentifierAuthority.Value[4] ),
            MAKEWORD( pisid->IdentifierAuthority.Value[3],
                    pisid->IdentifierAuthority.Value[2] )
        ) );
    DumpString(buf, -1, pwptr, plen);
 
    for( i=0; i<pisid->SubAuthorityCount; i++ )
    {
        sprintfW( buf, subauthfmt, pisid->SubAuthority[i] );
        DumpString(buf, -1, pwptr, plen);
    }
    return TRUE;
}

Referenced by DumpSid().

DumpString()

static void DumpString ( LPCWSTR  string, int  cch, WCHAR **  pwptr, ULONG *  plen  )

static

Definition at line 3117 of file security.c.

{
    if (cch == -1)
        cch = strlenW(string);
 
    if (plen)
        *plen += cch;
 
    if (pwptr)
    {
        memcpy(*pwptr, string, sizeof(WCHAR)*cch);
        *pwptr += cch;
    }
}

Referenced by DumpAce(), DumpAcl(), DumpDacl(), DumpGroup(), DumpOwner(), DumpRights(), DumpSacl(), DumpSid(), and DumpSidNumeric().

DuplicateToken()

BOOL WINAPI DuplicateToken	(	IN HANDLE	ExistingTokenHandle,
		IN SECURITY_IMPERSONATION_LEVEL	ImpersonationLevel,
		OUT PHANDLE	DuplicateTokenHandle
	)

Definition at line 3919 of file security.c.

{
    return DuplicateTokenEx(ExistingTokenHandle,
                            TOKEN_IMPERSONATE | TOKEN_QUERY,
                            NULL,
                            ImpersonationLevel,
                            TokenImpersonation,
                            DuplicateTokenHandle);
}

Referenced by GetDuplicateToken(), test_AccessCheck(), test_CheckTokenMembership(), test_impersonation_level(), test_kernel_objects_security(), and test_token_attr().

DuplicateTokenEx()

BOOL WINAPI DuplicateTokenEx	(	IN HANDLE	ExistingTokenHandle,
		IN DWORD	dwDesiredAccess,
		IN LPSECURITY_ATTRIBUTES lpTokenAttributes	OPTIONAL,
		IN SECURITY_IMPERSONATION_LEVEL	ImpersonationLevel,
		IN TOKEN_TYPE	TokenType,
		OUT PHANDLE	DuplicateTokenHandle
	)

Definition at line 3859 of file security.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
    NTSTATUS Status;
    SECURITY_QUALITY_OF_SERVICE Sqos;
 
    TRACE("%p 0x%08x 0x%08x 0x%08x %p\n", ExistingTokenHandle, dwDesiredAccess,
        ImpersonationLevel, TokenType, DuplicateTokenHandle);
 
    Sqos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
    Sqos.ImpersonationLevel = ImpersonationLevel;
    Sqos.ContextTrackingMode = 0;
    Sqos.EffectiveOnly = FALSE;
 
    if (lpTokenAttributes != NULL)
    {
        InitializeObjectAttributes(&ObjectAttributes,
                                   NULL,
                                   lpTokenAttributes->bInheritHandle ? OBJ_INHERIT : 0,
                                   NULL,
                                   lpTokenAttributes->lpSecurityDescriptor);
    }
    else
    {
        InitializeObjectAttributes(&ObjectAttributes,
                                   NULL,
                                   0,
                                   NULL,
                                   NULL);
    }
 
    ObjectAttributes.SecurityQualityOfService = &Sqos;
 
    Status = NtDuplicateToken(ExistingTokenHandle,
                              dwDesiredAccess,
                              &ObjectAttributes,
                              FALSE,
                              TokenType,
                              DuplicateTokenHandle);
    if (!NT_SUCCESS(Status))
    {
        ERR("NtDuplicateToken failed: Status %08x\n", Status);
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    TRACE("Returning token %p.\n", *DuplicateTokenHandle);
 
    return TRUE;
}

Referenced by CheckTokenMembership(), DuplicateToken(), LaunchProcess(), START_TEST(), test_CreateRestrictedToken(), test_token_security_descriptor(), and WlxStartApplication().

EqualDomainSid()

BOOL WINAPI EqualDomainSid	(	IN PSID	pSid1,
		IN PSID	pSid2,
		OUT BOOL *	pfEqual
	)

Definition at line 4184 of file security.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

EqualPrefixSid()

BOOL WINAPI EqualPrefixSid	(	PSID	pSid1,
		PSID	pSid2
	)

Definition at line 841 of file security.c.

{
    return RtlEqualPrefixSid (pSid1, pSid2);
}

Referenced by test_process_security().

EqualSid()

BOOL WINAPI EqualSid	(	PSID	pSid1,
		PSID	pSid2
	)

Definition at line 829 of file security.c.

{
    SetLastError(ERROR_SUCCESS);
    return RtlEqualSid (pSid1, pSid2);
}

Referenced by _test_group(), CachedGetUserFromSid(), check_wellknown_name(), CheckForGuestsAndAdmins(), DequeueSidLookup(), DumpSid(), FindSidInCache(), FindSidInPrincipalsListAddAce(), GetEventUserName(), is_token_admin(), IsNTAdmin(), IsWellKnownSid(), LsapSetTokenOwner(), map_nfs4ace_who(), PrintSid(), QueueSidLookup(), RunningAsSYSTEM(), test_AddMandatoryAce(), test_child_token_sd(), test_child_token_sd_medium(), test_child_token_sd_restricted(), test_CreateRestrictedToken(), test_default_dacl_owner_sid(), test_EqualSid(), test_GetExplicitEntriesFromAclW(), test_GetNamedSecurityInfoA(), test_GetSecurityInfo(), test_GetWindowsAccountDomainSid(), test_group_equal(), test_inherited_dacl(), test_owner_equal(), test_SystemSecurity(), test_token_label(), test_token_security_descriptor(), test_TokenIntegrityLevel(), and UpdatePrincipalInfo().

FindFirstFreeAce()

BOOL WINAPI FindFirstFreeAce	(	PACL	pAcl,
		LPVOID *	pAce
	)

Definition at line 1176 of file security.c.

{
    return RtlFirstFreeAce(pAcl,
                           (PACE*)pAce);
}

FreeSid()

PVOID WINAPI FreeSid

(

PSID

pSid

)

Definition at line 698 of file security.c.

{
    return RtlFreeSid(pSid);
}

Referenced by AllowDesktopAccessToUser(), AllowWinstaAccessToUser(), check_wellknown_name(), CheckForGuestsAndAdmins(), CreateApplicationDesktopSecurity(), CreateDefaultProcessSecurityCommon(), CreateDefaultSecurityDescriptor(), CreateDhcpPipeSecurity(), CreatePnpInstallEventSecurity(), CreatePowrProfSemaphoreSecurity(), CreateScreenSaverSecurity(), CreateWinlogonDesktopSecurity(), CreateWinstaSecurity(), GetShellSecurityDescriptor(), Imm32IsInteractiveUserLogon(), is_process_limited(), is_token_admin(), IsCallerInteractive(), IsInteractiveUserLogon(), IsNTAdmin(), IsUserAdmin(), PerfDataUninitialize(), pSetupIsUserAdmin(), SHTestTokenMembership(), START_TEST(), test_AccessCheck(), test_AddMandatoryAce(), test_CreateWellKnownSid(), test_EqualSid(), test_GetExplicitEntriesFromAclW(), test_GetNamedSecurityInfoA(), test_GetSecurityInfo(), test_LookupAccountSid(), test_LsaLookupSids(), test_process_security(), test_reg_create_key(), test_reg_open_key(), test_SetEntriesInAclA(), test_SetEntriesInAclW(), test_sid(), and test_trustee().

GetAce()

BOOL WINAPI GetAce	(	PACL	pAcl,
		DWORD	dwAceIndex,
		LPVOID *	pAce
	)

Definition at line 1186 of file security.c.

{
    return set_ntstatus(RtlGetAce(pAcl, dwAceIndex, pAce));
}

Referenced by AccRewriteGetExplicitEntriesFromAcl(), AccRewriteSetEntriesInAcl(), DumpAcl(), CSecurityDescriptor::GetDACLEntry(), CSecurityDescriptor::GetSACLEntry(), map_dacl_2_nfs4acl(), PrintFileDacl(), ReloadPrincipalsList(), and test_GetShellSecurityDescriptor().

GetAclInformation()

BOOL WINAPI GetAclInformation	(	PACL	pAcl,
		LPVOID	pAclInformation,
		DWORD	nAclInformationLength,
		ACL_INFORMATION_CLASS	dwAclInformationClass
	)

Definition at line 1194 of file security.c.

{
    return set_ntstatus(RtlQueryInformationAcl(pAcl, pAclInformation,
                                               nAclInformationLength, dwAclInformationClass));
}

Referenced by AccRewriteSetEntriesInAcl(), CSecurityDescriptor::GetDACLEntriesCount(), CSecurityDescriptor::GetSACLEntriesCount(), and test_GetShellSecurityDescriptor().

GetAnsiEnvironmentSize()

static DWORD GetAnsiEnvironmentSize ( PVOID  pEnvironment )

static

Definition at line 3702 of file security.c.

{
    INT Length, TotalLength = 0;
    PCHAR Ptr;
 
    if (pEnvironment == NULL)
        return 0;
 
    Ptr = (PCHAR)pEnvironment;
    while (*Ptr != ANSI_NULL)
    {
        Length = strlen(Ptr) + 1;
        TotalLength += Length;
        Ptr = Ptr + Length;
    }
 
    return TotalLength + 1;
}

Referenced by CreateProcessWithLogonW().

GetFileSecurityA()

BOOL WINAPI GetFileSecurityA	(	LPCSTR	lpFileName,
		SECURITY_INFORMATION	RequestedInformation,
		PSECURITY_DESCRIPTOR	pSecurityDescriptor,
		DWORD	nLength,
		LPDWORD	lpnLengthNeeded
	)

Definition at line 1373 of file security.c.

{
    UNICODE_STRING FileName;
    BOOL bResult;
 
    if (!RtlCreateUnicodeStringFromAsciiz(&FileName, lpFileName))
    {
        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
        return FALSE;
    }
 
    bResult = GetFileSecurityW(FileName.Buffer,
                               RequestedInformation,
                               pSecurityDescriptor,
                               nLength,
                               lpnLengthNeeded);
 
    RtlFreeUnicodeString(&FileName);
 
    return bResult;
}

Referenced by test_FileSecurity().

GetFileSecurityW()

BOOL WINAPI GetFileSecurityW	(	LPCWSTR	lpFileName,
		SECURITY_INFORMATION	RequestedInformation,
		PSECURITY_DESCRIPTOR	pSecurityDescriptor,
		DWORD	nLength,
		LPDWORD	lpnLengthNeeded
	)

Definition at line 1404 of file security.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK StatusBlock;
    UNICODE_STRING FileName;
    ULONG AccessMask = 0;
    HANDLE FileHandle;
    NTSTATUS Status;
 
    TRACE("GetFileSecurityW() called\n");
 
    QuerySecurityAccessMask(RequestedInformation, &AccessMask);
 
    if (!RtlDosPathNameToNtPathName_U(lpFileName,
                                      &FileName,
                                      NULL,
                                      NULL))
    {
        ERR("Invalid path\n");
        SetLastError(ERROR_INVALID_NAME);
        return FALSE;
    }
 
    InitializeObjectAttributes(&ObjectAttributes,
                               &FileName,
                               OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);
 
    Status = NtOpenFile(&FileHandle,
                        AccessMask,
                        &ObjectAttributes,
                        &StatusBlock,
                        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
                        0);
 
    RtlFreeHeap(RtlGetProcessHeap(),
                0,
                FileName.Buffer);
 
    if (!NT_SUCCESS(Status))
    {
        ERR("NtOpenFile() failed (Status %lx)\n", Status);
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    Status = NtQuerySecurityObject(FileHandle,
                                   RequestedInformation,
                                   pSecurityDescriptor,
                                   nLength,
                                   lpnLengthNeeded);
    NtClose(FileHandle);
    if (!NT_SUCCESS(Status))
    {
        ERR("NtQuerySecurityObject() failed (Status %lx)\n", Status);
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by GetFileSecurityA(), and RetreiveFileSecurity().

GetKernelObjectSecurity()

BOOL WINAPI GetKernelObjectSecurity	(	HANDLE	Handle,
		SECURITY_INFORMATION	RequestedInformation,
		PSECURITY_DESCRIPTOR	pSecurityDescriptor,
		DWORD	nLength,
		LPDWORD	lpnLengthNeeded
	)

Definition at line 987 of file security.c.

{
    TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", Handle, RequestedInformation,
          pSecurityDescriptor, nLength, lpnLengthNeeded);
 
    return set_ntstatus( NtQuerySecurityObject(Handle, RequestedInformation, pSecurityDescriptor,
                                               nLength, lpnLengthNeeded ));
}

Referenced by test_AddMandatoryAce(), test_child_token_sd(), test_child_token_sd_medium(), test_child_token_sd_restricted(), test_default_dacl_owner_sid(), test_get_security_descriptor(), test_token_label(), and test_token_security_descriptor().

GetLengthSid()

DWORD WINAPI GetLengthSid

(

PSID

pSid

)

Definition at line 919 of file security.c.

{
    return (DWORD)RtlLengthSid(pSid);
}

Referenced by AccpCalcNeededAceSize(), AccpLookupCurrentUser(), AccpLookupSidByName(), AccRewriteGetExplicitEntriesFromAcl(), AddPrincipalToList(), AllowAccessOnSession(), AllowDesktopAccessToUser(), AllowWinstaAccessToUser(), AuthzGetInformationFromContext(), AuthzInitializeContextFromSid(), AuthzpQueryToken(), BuildDefaultPrincipalAce(), CachedGetUserFromSid(), CacheLookupResults(), CreateApplicationDesktopSecurity(), CreateDefaultProcessSecurityCommon(), CreateDefaultSecurityDescriptor(), CreateDhcpPipeSecurity(), CreatePnpInstallEventSecurity(), CreatePowrProfSemaphoreSecurity(), CreateScreenSaverSecurity(), CreateUserProfileExW(), CreateWinlogonDesktopSecurity(), CreateWinstaSecurity(), fill_sid(), GetShellSecurityDescriptor(), GetUserSid(), LsarpCreateAccount(), QueueSidLookup(), ReloadPrincipalsList(), and test_LookupAccountName().

GetNamedSecurityInfoA()

DWORD WINAPI GetNamedSecurityInfoA	(	LPSTR	pObjectName,
		SE_OBJECT_TYPE	ObjectType,
		SECURITY_INFORMATION	SecurityInfo,
		PSID *	ppsidOwner,
		PSID *	ppsidGroup,
		PACL *	ppDacl,
		PACL *	ppSacl,
		PSECURITY_DESCRIPTOR *	ppSecurityDescriptor
	)

Definition at line 4102 of file security.c.

{
    DWORD len;
    LPWSTR wstr = NULL;
    DWORD r;
 
    TRACE("%s %d %d %p %p %p %p %p\n", pObjectName, ObjectType, SecurityInfo,
        ppsidOwner, ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor);
 
    if( pObjectName )
    {
        len = MultiByteToWideChar( CP_ACP, 0, pObjectName, -1, NULL, 0 );
        wstr = HeapAlloc( GetProcessHeap(), 0, len*sizeof(WCHAR));
        MultiByteToWideChar( CP_ACP, 0, pObjectName, -1, wstr, len );
    }
 
    r = GetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, ppsidOwner,
                           ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor );
 
    HeapFree( GetProcessHeap(), 0, wstr );
 
    return r;
}

GetSecurityInfoExA()

DWORD WINAPI GetSecurityInfoExA	(	HANDLE	hObject,
		SE_OBJECT_TYPE	ObjectType,
		SECURITY_INFORMATION	SecurityInfo,
		LPCSTR	lpProvider,
		LPCSTR	lpProperty,
		PACTRL_ACCESSA *	ppAccessList,
		PACTRL_AUDITA *	ppAuditList,
		LPSTR *	lppOwner,
		LPSTR *	lppGroup
	)

Definition at line 2092 of file security.c.

{
    FIXME("%s() not implemented!\n", __FUNCTION__);
    return ERROR_BAD_PROVIDER;
}

GetSecurityInfoExW()

DWORD WINAPI GetSecurityInfoExW	(	HANDLE	hObject,
		SE_OBJECT_TYPE	ObjectType,
		SECURITY_INFORMATION	SecurityInfo,
		LPCWSTR	lpProvider,
		LPCWSTR	lpProperty,
		PACTRL_ACCESSW *	ppAccessList,
		PACTRL_AUDITW *	ppAuditList,
		LPWSTR *	lppOwner,
		LPWSTR *	lppGroup
	)

Definition at line 2112 of file security.c.

{
    FIXME("%s() not implemented!\n", __FUNCTION__);
    return ERROR_BAD_PROVIDER;
}

GetSidIdentifierAuthority()

PSID_IDENTIFIER_AUTHORITY WINAPI GetSidIdentifierAuthority

(

PSID

pSid

)

Definition at line 885 of file security.c.

{
    SetLastError(ERROR_SUCCESS);
    return RtlIdentifierAuthoritySid(pSid);
}

Referenced by GetTextSid(), GetTextualSid(), and test_GetSidIdentifierAuthority().

GetSidLengthRequired()

DWORD WINAPI GetSidLengthRequired

(

UCHAR

nSubAuthorityCount

)

Definition at line 852 of file security.c.

{
    return (DWORD)RtlLengthRequiredSid(nSubAuthorityCount);
}

Referenced by ComputeStringSidSize(), CreateWellKnownSid(), GetWindowsAccountDomainSid(), LookupAccountNameW(), ParseStringSidToSid(), test_CreateWellKnownSid(), test_GetWindowsAccountDomainSid(), and test_LookupAccountSid().

GetSidSubAuthority()

PDWORD WINAPI GetSidSubAuthority	(	PSID	pSid,
		DWORD	nSubAuthority
	)

Definition at line 896 of file security.c.

{
    SetLastError(ERROR_SUCCESS);
    return (PDWORD)RtlSubAuthoritySid(pSid, nSubAuthority);
}

Referenced by CreateWellKnownSid(), GetTextSid(), GetTextualSid(), GetWindowsAccountDomainSid(), LookupAccountNameW(), test_GetSecurityInfo(), test_GetWindowsAccountDomainSid(), and test_sid().

GetSidSubAuthorityCount()

PUCHAR WINAPI GetSidSubAuthorityCount

(

PSID

pSid

)

Definition at line 908 of file security.c.

{
    SetLastError(ERROR_SUCCESS);
    return RtlSubAuthorityCountSid(pSid);
}

Referenced by ComputeStringSidSize(), CreateWellKnownSid(), GetTextSid(), GetTextualSid(), GetWindowsAccountDomainSid(), LookupAccountNameW(), test_CreateWellKnownSid(), and test_LookupAccountSid().

GetTokenInformation()

BOOL WINAPI GetTokenInformation	(	HANDLE	TokenHandle,
		TOKEN_INFORMATION_CLASS	TokenInformationClass,
		LPVOID	TokenInformation,
		DWORD	TokenInformationLength,
		PDWORD	ReturnLength
	)

Definition at line 411 of file security.c.

{
    NTSTATUS Status;
 
    Status = NtQueryInformationToken(TokenHandle,
                                     TokenInformationClass,
                                     TokenInformation,
                                     TokenInformationLength,
                                     (PULONG)ReturnLength);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
  return TRUE;
}

Referenced by _GetUserSidStringFromToken(), AccpLookupCurrentUser(), AddUserProfiles(), AllowAccessOnSession(), are_all_privileges_disabled(), AuthzpQueryToken(), CheckForGuestsAndAdmins(), CreateProfile(), DoesUserHavePrivilege(), DwInitializeSdFromThreadToken(), get_admin_token(), get_current_group(), get_current_owner(), get_privilege_count(), get_user_sid(), GetFromToken(), GetShellSecurityDescriptor(), GetUserAndDomainName(), GetUserNameW(), GetUserSid(), GetUserSIDString(), GetUserToken(), ImpersonatePrinterClient(), RecycleBin5::Init(), is_process_elevated(), is_process_limited(), is_token_admin(), IsNTAdmin(), LoadUserProfileW(), named_pipe_client_func(), PerfDataRefresh(), RunningAsSYSTEM(), SHCreateSessionKey(), SHGetUserSessionId(), SHTestTokenPrivilegeW(), START_TEST(), TakeOwnershipOfFile(), test_CheckTokenMembership(), test_child_token_sd_medium(), test_child_token_sd_restricted(), test_CreateDirectoryA(), test_CreateRestrictedToken(), test_GetNamedSecurityInfoA(), test_GetSecurityInfo(), test_GetTokenInformation(), test_GetWindowsAccountDomainSid(), test_ImpersonateNamedPipeClient(), test_impersonation_level(), test_LookupAccountSid(), test_lsa(), test_LsaLookupSids(), test_process_security(), test_pseudo_tokens(), test_token_attr(), test_token_security_descriptor(), test_TokenIntegrityLevel(), TestGetUserObjectInfoW(), validate_impersonation_token(), and WhoamiGetTokenInfo().

GetTrusteeFormA()

TRUSTEE_FORM WINAPI GetTrusteeFormA

(

PTRUSTEEA

pTrustee

)

Definition at line 2406 of file security.c.

{
    TRACE("(%p)\n", pTrustee);
 
    if (!pTrustee)
        return TRUSTEE_BAD_FORM;
 
    return pTrustee->TrusteeForm;
}

Referenced by InternalExplicitAccessAToW(), and InternalTrusteeAToW().

GetTrusteeFormW()

TRUSTEE_FORM WINAPI GetTrusteeFormW

(

PTRUSTEEW

pTrustee

)

Definition at line 2419 of file security.c.

{
    TRACE("(%p)\n", pTrustee);
 
    if (!pTrustee)
        return TRUSTEE_BAD_FORM;
 
    return pTrustee->TrusteeForm;
}

GetTrusteeNameA()

LPSTR WINAPI GetTrusteeNameA

(

PTRUSTEE_A

pTrustee

)

Definition at line 2433 of file security.c.

{
    return pTrustee->ptstrName;
}

Referenced by InternalExplicitAccessAToW(), and InternalTrusteeAToW().

GetTrusteeNameW()

LPWSTR WINAPI GetTrusteeNameW

(

PTRUSTEE_W

pTrustee

)

Definition at line 2443 of file security.c.

{
    return pTrustee->ptstrName;
}

GetTrusteeTypeA()

TRUSTEE_TYPE WINAPI GetTrusteeTypeA

(

PTRUSTEE_A

pTrustee

)

Definition at line 2452 of file security.c.

{
    return pTrustee->TrusteeType;
}

GetTrusteeTypeW()

TRUSTEE_TYPE WINAPI GetTrusteeTypeW

(

PTRUSTEE_W

pTrustee

)

Definition at line 2461 of file security.c.

{
    return pTrustee->TrusteeType;
}

GetUnicodeEnvironmentSize()

static DWORD GetUnicodeEnvironmentSize ( PVOID  pEnvironment )

static

Definition at line 3679 of file security.c.

{
    INT Length, TotalLength = 0;
    PWCHAR Ptr;
 
    if (pEnvironment == NULL)
        return 0;
 
    Ptr = (PWCHAR)pEnvironment;
    while (*Ptr != UNICODE_NULL)
    {
        Length = wcslen(Ptr) + 1;
        TotalLength += Length;
        Ptr = Ptr + Length;
    }
 
    return (TotalLength + 1) * sizeof(WCHAR);
}

Referenced by CreateProcessWithLogonW().

GetWindowsAccountDomainSid()

BOOL WINAPI GetWindowsAccountDomainSid	(	PSID	sid,
		PSID	domain_sid,
		DWORD *	size
	)

Definition at line 4136 of file security.c.

{
    SID_IDENTIFIER_AUTHORITY domain_ident = { SECURITY_NT_AUTHORITY };
    DWORD required_size;
    int i;
 
    FIXME( "(%p %p %p): semi-stub\n", sid, domain_sid, size );
 
    if (!sid || !IsValidSid( sid ))
    {
        SetLastError( ERROR_INVALID_SID );
        return FALSE;
    }
 
    if (!size)
    {
        SetLastError( ERROR_INVALID_PARAMETER );
        return FALSE;
    }
 
    if (*GetSidSubAuthorityCount( sid ) < 4)
    {
        SetLastError( ERROR_INVALID_SID );
        return FALSE;
    }
 
    required_size = GetSidLengthRequired( 4 );
    if (*size < required_size || !domain_sid)
    {
        *size = required_size;
        SetLastError( domain_sid ? ERROR_INSUFFICIENT_BUFFER :
                                   ERROR_INVALID_PARAMETER );
        return FALSE;
    }
 
    InitializeSid( domain_sid, &domain_ident, 4 );
    for (i = 0; i < 4; i++)
        *GetSidSubAuthority( domain_sid, i ) = *GetSidSubAuthority( sid, i );
 
    *size = required_size;
    return TRUE;
}

ImpersonateNamedPipeClient()

BOOL WINAPI ImpersonateNamedPipeClient

(

HANDLE

hNamedPipe

)

Definition at line 1024 of file security.c.

{
    IO_STATUS_BLOCK io_block;
 
    TRACE("(%p)\n", hNamedPipe);
 
    return set_ntstatus( NtFsControlFile(hNamedPipe, NULL, NULL, NULL,
                         &io_block, FSCTL_PIPE_IMPERSONATE, NULL, 0, NULL, 0) );
}

Referenced by rpcrt4_conn_np_impersonate_client(), and test_ImpersonateNamedPipeClient().

ImpersonateSelf()

BOOL WINAPI ImpersonateSelf

(

SECURITY_IMPERSONATION_LEVEL

ImpersonationLevel

)

Definition at line 1631 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlImpersonateSelf(ImpersonationLevel);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by test_FileSecurity(), and test_impersonation_level().

InitializeAcl()

BOOL WINAPI InitializeAcl	(	PACL	pAcl,
		DWORD	nAclLength,
		DWORD	dwAclRevision
	)

Definition at line 1006 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlCreateAcl(pAcl,
                          nAclLength,
                          dwAclRevision);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by AccRewriteSetEntriesInAcl(), AllowDesktopAccessToUser(), AllowWinstaAccessToUser(), convert_nfs4acl_2_dacl(), CreateApplicationDesktopSecurity(), CreateDefaultProcessSecurityCommon(), CreateDefaultSecurityDescriptor(), CreateDhcpPipeSecurity(), CreatePnpInstallEventSecurity(), CreatePowrProfSemaphoreSecurity(), CreateScreenSaverSecurity(), CreateWinlogonDesktopSecurity(), CreateWinstaSecurity(), get_sd(), GetShellSecurityDescriptor(), test_AccessCheck(), test_acls(), test_AddAce(), test_AddMandatoryAce(), test_ConvertSecurityDescriptorToString(), test_CreateDirectoryA(), test_event(), test_GetExplicitEntriesFromAclW(), test_GetNamedSecurityInfoA(), test_GetSecurityInfo(), test_maximum_allowed(), test_process_security(), test_SetEntriesInAclA(), test_SetEntriesInAclW(), and test_token_security_descriptor().

InitializeSecurityDescriptor()

BOOL WINAPI InitializeSecurityDescriptor	(	PSECURITY_DESCRIPTOR	pSecurityDescriptor,
		DWORD	dwRevision
	)

Definition at line 929 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlCreateSecurityDescriptor(pSecurityDescriptor,
                                         dwRevision);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by AllowDesktopAccessToUser(), AllowWinstaAccessToUser(), CreateAllAccessSecurityAttributes(), CreateApplicationDesktopSecurity(), CreateDefaultProcessSecurityCommon(), CreateDefaultSecurityDescriptor(), CreateDhcpPipeSecurity(), CreateLogoffSecurityAttributes(), CreatePnpInstallEventSecurity(), CreatePowrProfSemaphoreSecurity(), CreateProfileMutex(), CreatePublicEvent(), CreateScreenSaverSecurity(), CreateWinlogonDesktopSecurity(), CreateWinstaSecurity(), DwInitializeSdFromThreadToken(), get_sd(), GetShellSecurityDescriptor(), handle_getacl(), InitializeAudioDeviceListLock(), pSetSecurityInfoCheck(), START_TEST(), TakeOwnershipOfFile(), test_AccessCheck(), test_AddMandatoryAce(), test_BuildSecurityDescriptorW(), test_ConvertSecurityDescriptorToString(), test_CopyBindInfo(), test_CreateDirectoryA(), test_default_dacl_owner_sid(), test_event(), test_GetNamedSecurityInfoA(), test_GetSecurityInfo(), test_maximum_allowed(), test_process_security(), test_reg_create_key(), test_reg_open_key(), test_security_descriptor(), test_security_info(), and test_token_security_descriptor().

InitializeSid()

BOOL WINAPI InitializeSid	(	PSID	Sid,
		PSID_IDENTIFIER_AUTHORITY	pIdentifierAuthority,
		BYTE	nSubAuthorityCount
	)

Definition at line 862 of file security.c.

{
    NTSTATUS Status;
 
    Status = RtlInitializeSid(Sid,
                              pIdentifierAuthority,
                              nSubAuthorityCount);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by GetWindowsAccountDomainSid(), and test_GetWindowsAccountDomainSid().

IsValidAcl()

BOOL WINAPI IsValidAcl

(

PACL

pAcl

)

Definition at line 1209 of file security.c.

{
    return RtlValidAcl (pAcl);
}

Referenced by DumpAcl(), CSecurityDescriptor::HasValidDACL(), CSecurityDescriptor::HasValidSACL(), test_acls(), test_GetNamedSecurityInfoA(), test_GetSecurityInfo(), and test_GetShellSecurityDescriptor().

IsValidSid()

BOOL WINAPI IsValidSid

(

PSID

pSid

)

Definition at line 819 of file security.c.

{
    return (BOOL)RtlValidSid(pSid);
}

Referenced by AuthzInitializeContextFromSid(), CreateWellKnownSid(), DumpSidNumeric(), CShellCommandDACL::Execute(), CShellCommandOwner::Execute(), CShellCommandSACL::Execute(), GetEventUserName(), GetTextualSid(), GetWindowsAccountDomainSid(), map_name_2_sid(), test_CreateWellKnownSid(), and test_GetSidIdentifierAuthority().

IsWellKnownSid()

BOOL WINAPI IsWellKnownSid	(	IN PSID	pSid,
		IN WELL_KNOWN_SID_TYPE	WellKnownSidType
	)

Definition at line 796 of file security.c.

{
    unsigned int i;
    TRACE("(%s, %d)\n", debugstr_sid(pSid), WellKnownSidType);
 
    for (i = 0; i < sizeof(WellKnownSids) / sizeof(WellKnownSids[0]); i++)
    {
        if (WellKnownSids[i].Type == WellKnownSidType)
        {
            if (EqualSid(pSid, (PSID)(&WellKnownSids[i].Sid.Revision)))
                return TRUE;
        }
    }
 
    return FALSE;
}

Referenced by is_well_known_sid(), and test_token_attr().

LookupAccountNameA()

BOOL WINAPI LookupAccountNameA	(	LPCSTR	SystemName,
		LPCSTR	AccountName,
		PSID	Sid,
		LPDWORD	SidLength,
		LPSTR	ReferencedDomainName,
		LPDWORD	hReferencedDomainNameLength,
		PSID_NAME_USE	SidNameUse
	)

Definition at line 2012 of file security.c.

{
    BOOL ret;
    UNICODE_STRING lpSystemW;
    UNICODE_STRING lpAccountW;
    LPWSTR lpReferencedDomainNameW = NULL;
 
    RtlCreateUnicodeStringFromAsciiz(&lpSystemW, SystemName);
    RtlCreateUnicodeStringFromAsciiz(&lpAccountW, AccountName);
 
    if (ReferencedDomainName)
        lpReferencedDomainNameW = HeapAlloc(GetProcessHeap(),
                                            0,
                                            *hReferencedDomainNameLength * sizeof(WCHAR));
 
    ret = LookupAccountNameW(lpSystemW.Buffer,
                             lpAccountW.Buffer,
                             Sid,
                             SidLength,
                             lpReferencedDomainNameW,
                             hReferencedDomainNameLength,
                             SidNameUse);
 
    if (ret && lpReferencedDomainNameW)
    {
        WideCharToMultiByte(CP_ACP,
                            0,
                            lpReferencedDomainNameW,
                            *hReferencedDomainNameLength + 1,
                            ReferencedDomainName,
                            *hReferencedDomainNameLength + 1,
                            NULL,
                            NULL);
    }
 
    RtlFreeUnicodeString(&lpSystemW);
    RtlFreeUnicodeString(&lpAccountW);
    HeapFree(GetProcessHeap(), 0, lpReferencedDomainNameW);
 
    return ret;
}

Referenced by check_wellknown_name(), and test_LookupAccountName().

LookupPrivilegeDisplayNameA()

BOOL WINAPI LookupPrivilegeDisplayNameA	(	LPCSTR	lpSystemName,
		LPCSTR	lpName,
		LPSTR	lpDisplayName,
		LPDWORD	cchDisplayName,
		LPDWORD	lpLanguageId
	)

Definition at line 1239 of file security.c.

{
    UNICODE_STRING lpSystemNameW;
    UNICODE_STRING lpNameW;
    BOOL ret;
    DWORD wLen = 0;
 
    TRACE("%s %s %p %p %p\n", debugstr_a(lpSystemName), debugstr_a(lpName), lpName, cchDisplayName, lpLanguageId);
 
    RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
    RtlCreateUnicodeStringFromAsciiz(&lpNameW, lpName);
    ret = LookupPrivilegeDisplayNameW(lpSystemNameW.Buffer, lpNameW.Buffer, NULL, &wLen, lpLanguageId);
    if (!ret