objtype.c

Go to the documentation of this file.

/*
 * PROJECT:     ReactOS Kernel
 * LICENSE:     GPL-2.0-or-later (https://spdx.org/licenses/GPL-2.0-or-later)
 * PURPOSE:     Security object type list support routines
 * COPYRIGHT:   Copyright Timo Kreuzer <timo.kreuzer@reactos.org>
 *              Copyright 2023 George Bișoc <george.bisoc@reactos.org>
 */
 
/* INCLUDES *******************************************************************/
 
#include <ntoskrnl.h>
#define NDEBUG
#include <debug.h>
 
/* PRIVATE FUNCTIONS **********************************************************/
 
static
NTSTATUS
SepValidateObjectTypeList(
    _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
    _In_ ULONG ObjectTypeListLength)
{
    PGUID ObjectTypeGuid;
    ULONG ObjectTypeIndex;
    USHORT Level, PrevLevel;
    SIZE_T Size;
 
    /* Ensure we do not hit an integer overflow */
    Size = ObjectTypeListLength * sizeof(OBJECT_TYPE_LIST);
    if (Size == 0)
    {
        DPRINT1("The object type list is too big, integer overflow alert!\n");
        return STATUS_INVALID_PARAMETER;
    }
 
    _SEH2_TRY
    {
        /* Ensure we can actually read from that list */
        ProbeForRead(ObjectTypeList, Size, sizeof(ULONG));
 
        /* Begin looping for each object from the list */
        for (ObjectTypeIndex = 0;
             ObjectTypeIndex < ObjectTypeListLength;
             ObjectTypeIndex++)
        {
            /* Get the level of this object and check for validity */
            Level = ObjectTypeList[ObjectTypeIndex].Level;
            if (Level > ACCESS_MAX_LEVEL)
            {
                DPRINT1("Invalid object level found (level %u, at index %lu)\n", Level, ObjectTypeIndex);
                _SEH2_YIELD(return STATUS_INVALID_PARAMETER);
            }
 
            /* Are we past the first position in the list? */
            if (ObjectTypeIndex != 0)
            {
                /* Ensure that we do not have two object roots */
                if (Level == ACCESS_OBJECT_GUID)
                {
                    DPRINT1("This list has two roots (at index %lu)\n", ObjectTypeIndex);
                    _SEH2_YIELD(return STATUS_INVALID_PARAMETER);
                }
 
                /*
                 * Ensure the current level is consistent with the prior level.
                 * That means, if the previous object is the root (denoted by the
                 * level as ACCESS_OBJECT_GUID aka 0) the current object must
                 * be a child of the parent which is the root (also called a
                 * property set). Whereas a property is a sibling of the
                 * child, the property set.
                 */
                if (Level > PrevLevel + 1)
                {
                    DPRINT1("The object levels are not consistent (current level %u, previous level %u, at index %lu)\n",
                            Level, PrevLevel, ObjectTypeIndex);
                    _SEH2_YIELD(return STATUS_INVALID_PARAMETER);
                }
            }
            else
            {
                /* This is the first position so the object must be the root */
                if (Level != ACCESS_OBJECT_GUID)
                {
                    DPRINT1("The object is not the root at first index!\n");
                    _SEH2_YIELD(return STATUS_INVALID_PARAMETER);
                }
            }
 
            /* Get the object type and check that we can read from it */
            ObjectTypeGuid = ObjectTypeList[ObjectTypeIndex].ObjectType;
            ProbeForRead(ObjectTypeGuid, sizeof(GUID), sizeof(ULONG));
 
            /*
             * Cache the level, we need it to ensure the levels between
             * the previous and the next object are consistent with each other.
             */
            PrevLevel = Level;
        }
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        _SEH2_YIELD(return _SEH2_GetExceptionCode());
    }
    _SEH2_END;
 
    return STATUS_SUCCESS;
}
 
static
BOOLEAN
SepIsEqualObjectTypeGuid(
    _In_ CONST GUID *Guid1,
    _In_ CONST GUID *Guid2)
{
    return RtlCompareMemory(Guid1, Guid2, sizeof(GUID)) == sizeof(GUID);
}
 
/* PUBLIC FUNCTIONS ************************************************************/
 
PGUID
SepGetObjectTypeGuidFromAce(
    _In_ PACE Ace,
    _In_ BOOLEAN IsAceDenied)
{
    PGUID ObjectTypeGuid = NULL;
 
    PAGED_CODE();
 
    /* This Ace must not be NULL */
    ASSERT(Ace);
 
    /* Grab the GUID based on the object type ACE header */
    ObjectTypeGuid = IsAceDenied ? (PGUID)&((PACCESS_DENIED_OBJECT_ACE)Ace)->ObjectType :
        (PGUID)&((PACCESS_ALLOWED_OBJECT_ACE)Ace)->ObjectType;
    return ObjectTypeGuid;
}
 
BOOLEAN
SepObjectTypeGuidInList(
    _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST_INTERNAL ObjectTypeList,
    _In_ ULONG ObjectTypeListLength,
    _In_ PGUID ObjectTypeGuid,
    _Out_ PULONG ObjectIndex)
{
    ULONG ObjectTypeIndex;
    GUID ObjectTypeGuidToSearch;
 
    PAGED_CODE();
 
    /* Loop over the object elements */
    for (ObjectTypeIndex = 0;
         ObjectTypeIndex < ObjectTypeListLength;
         ObjectTypeIndex++)
    {
        /* Is this the object we are searching for? */
        ObjectTypeGuidToSearch = ObjectTypeList[ObjectTypeIndex].ObjectTypeGuid;
        if (SepIsEqualObjectTypeGuid(ObjectTypeGuid, &ObjectTypeGuidToSearch))
        {
            /* Return the indext of that object to caller */
            *ObjectIndex = ObjectTypeIndex;
            return TRUE;
        }
    }
 
    return FALSE;
}
 
NTSTATUS
SeCaptureObjectTypeList(
    _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
    _In_ ULONG ObjectTypeListLength,
    _In_ KPROCESSOR_MODE PreviousMode,
    _Out_ POBJECT_TYPE_LIST_INTERNAL *CapturedObjectTypeList)
{
    NTSTATUS Status;
    ULONG ObjectTypeIndex;
    SIZE_T Size;
    PGUID ObjectTypeGuid;
    POBJECT_TYPE_LIST_INTERNAL InternalTypeList;
 
    PAGED_CODE();
 
    /* We do not support that in the kernel */
    if (PreviousMode == KernelMode)
    {
        return STATUS_NOT_IMPLEMENTED;
    }
 
    /* No count elements of objects means no captured list for you */
    if (ObjectTypeListLength == 0)
    {
        *CapturedObjectTypeList = NULL;
        return STATUS_SUCCESS;
    }
 
    /* Check if the caller supplied a list since we have the count of elements */
    if (ObjectTypeList == NULL)
    {
        DPRINT1("The caller did not provide a list of object types!\n");
        return STATUS_INVALID_PARAMETER;
    }
 
    /* Validate that list before we copy contents from it */
    Status = SepValidateObjectTypeList(ObjectTypeList, ObjectTypeListLength);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("SepValidateObjectTypeList failed (Status 0x%08lx)\n", Status);
        return Status;
    }
 
    /* Allocate a new list */
    Size = ObjectTypeListLength * sizeof(OBJECT_TYPE_LIST_INTERNAL);
    InternalTypeList = ExAllocatePoolWithTag(PagedPool, Size, TAG_SEPA);
    if (InternalTypeList == NULL)
    {
        DPRINT1("Failed to allocate pool memory for the object type list!\n");
        return STATUS_INSUFFICIENT_RESOURCES;
    }
 
    _SEH2_TRY
    {
        /* Loop for every object element, data was already probed */
        for (ObjectTypeIndex = 0;
             ObjectTypeIndex < ObjectTypeListLength;
             ObjectTypeIndex++)
        {
            /* Copy the object type GUID */
            ObjectTypeGuid = ObjectTypeList[ObjectTypeIndex].ObjectType;
            InternalTypeList[ObjectTypeIndex].ObjectTypeGuid = *ObjectTypeGuid;
 
            /* Copy the object hierarchy level */
            InternalTypeList[ObjectTypeIndex].Level = ObjectTypeList[ObjectTypeIndex].Level;
 
            /* Initialize the access check rights */
            InternalTypeList[ObjectTypeIndex].ObjectAccessRights.RemainingAccessRights = 0;
            InternalTypeList[ObjectTypeIndex].ObjectAccessRights.GrantedAccessRights = 0;
            InternalTypeList[ObjectTypeIndex].ObjectAccessRights.DeniedAccessRights = 0;
        }
 
        /* Give the captured list to caller */
        *CapturedObjectTypeList = InternalTypeList;
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        ExFreePoolWithTag(InternalTypeList, TAG_SEPA);
        InternalTypeList = NULL;
        _SEH2_YIELD(return _SEH2_GetExceptionCode());
    }
    _SEH2_END;
 
    return STATUS_SUCCESS;
}
 
VOID
SeReleaseObjectTypeList(
    _In_  _Post_invalid_ POBJECT_TYPE_LIST_INTERNAL CapturedObjectTypeList,
    _In_ KPROCESSOR_MODE PreviousMode)
{
    PAGED_CODE();
 
    if ((PreviousMode != KernelMode) && (CapturedObjectTypeList != NULL))
    {
        ExFreePoolWithTag(CapturedObjectTypeList, TAG_SEPA);
    }
}
 
/* EOF */