security.c File Reference

#include "services.h"
#include <debug.h>

Include dependency graph for security.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
static VOID	ScmFreeSids (VOID)
static DWORD	ScmCreateSids (VOID)
static DWORD	ScmCreateAcls (VOID)
static VOID	ScmFreeAcls (VOID)
static DWORD	ScmCreateDefaultSD (VOID)
static VOID	ScmFreeDefaultSD (VOID)
static DWORD	ScmCreatePipeSD (VOID)
static VOID	ScmFreePipeSD (VOID)
DWORD	ScmCreateDefaultServiceSD (PSECURITY_DESCRIPTOR *ppSecurityDescriptor)
DWORD	ScmInitializeSecurity (VOID)
VOID	ScmShutdownSecurity (VOID)

Variables
static PSID	pNullSid = NULL
static PSID	pWorldSid = NULL
static PSID	pLocalSystemSid = NULL
static PSID	pAuthenticatedUserSid = NULL
static PSID	pAliasAdminsSid = NULL
static PACL	pDefaultDacl = NULL
static PACL	pDefaultSacl = NULL
static PACL	pPipeDacl = NULL
static PSECURITY_DESCRIPTOR	pDefaultSD = NULL
PSECURITY_DESCRIPTOR	pPipeSD = NULL

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 13 of file security.c.

Function Documentation

ScmCreateAcls()

static DWORD ScmCreateAcls ( VOID  )

static

Definition at line 127 of file security.c.

{
    ULONG ulLength;
 
    /* Create DACL */
    ulLength = sizeof(ACL) +
               (sizeof(ACE) + RtlLengthSid(pLocalSystemSid)) +
               (sizeof(ACE) + RtlLengthSid(pAliasAdminsSid)) +
               (sizeof(ACE) + RtlLengthSid(pAuthenticatedUserSid));
 
    pDefaultDacl = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, ulLength);
    if (pDefaultDacl == NULL)
        return ERROR_OUTOFMEMORY;
 
    RtlCreateAcl(pDefaultDacl, ulLength, ACL_REVISION);
 
    RtlAddAccessAllowedAce(pDefaultDacl,
                           ACL_REVISION,
                           READ_CONTROL | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_INTERROGATE |
                           SERVICE_PAUSE_CONTINUE | SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS |
                           SERVICE_START | SERVICE_STOP | SERVICE_USER_DEFINED_CONTROL,
                           pLocalSystemSid);
 
    RtlAddAccessAllowedAce(pDefaultDacl,
                           ACL_REVISION,
                           SERVICE_ALL_ACCESS,
                           pAliasAdminsSid);
 
    RtlAddAccessAllowedAce(pDefaultDacl,
                           ACL_REVISION,
                           READ_CONTROL | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_INTERROGATE |
                           SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_USER_DEFINED_CONTROL,
                           pAuthenticatedUserSid);
 
    /* Create SACL */
    ulLength = sizeof(ACL) +
               (sizeof(ACE) + RtlLengthSid(pNullSid));
 
    pDefaultSacl = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, ulLength);
    if (pDefaultSacl == NULL)
        return ERROR_OUTOFMEMORY;
 
    RtlCreateAcl(pDefaultSacl, ulLength, ACL_REVISION);
 
    RtlAddAuditAccessAce(pDefaultSacl,
                         ACL_REVISION,
                         SERVICE_ALL_ACCESS,
                         pNullSid,
                         FALSE,
                         TRUE);
 
    /* Create the pipe DACL */
    ulLength = sizeof(ACL) +
               (sizeof(ACE) + RtlLengthSid(pWorldSid));
 
    pPipeDacl = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, ulLength);
    if (pPipeDacl == NULL)
        return ERROR_OUTOFMEMORY;
 
    RtlCreateAcl(pPipeDacl, ulLength, ACL_REVISION);
 
    RtlAddAccessAllowedAce(pPipeDacl,
                           ACL_REVISION,
                           GENERIC_ALL,
                           pWorldSid);
 
    return ERROR_SUCCESS;
}

Referenced by ScmInitializeSecurity().

ScmCreateDefaultSD()

static DWORD ScmCreateDefaultSD ( VOID  )

static

Definition at line 214 of file security.c.

{
    NTSTATUS Status;
 
    /* Create the absolute security descriptor */
    pDefaultSD = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(SECURITY_DESCRIPTOR));
    if (pDefaultSD == NULL)
        return ERROR_OUTOFMEMORY;
 
    DPRINT("pDefaultSD %p\n", pDefaultSD);
 
    Status = RtlCreateSecurityDescriptor(pDefaultSD,
                                         SECURITY_DESCRIPTOR_REVISION);
    if (!NT_SUCCESS(Status))
        return RtlNtStatusToDosError(Status);
 
    Status = RtlSetOwnerSecurityDescriptor(pDefaultSD,
                                           pLocalSystemSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        return RtlNtStatusToDosError(Status);
 
    Status = RtlSetGroupSecurityDescriptor(pDefaultSD,
                                           pLocalSystemSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        return RtlNtStatusToDosError(Status);
 
    Status = RtlSetDaclSecurityDescriptor(pDefaultSD,
                                          TRUE,
                                          pDefaultDacl,
                                          FALSE);
    if (!NT_SUCCESS(Status))
        return RtlNtStatusToDosError(Status);
 
    Status = RtlSetSaclSecurityDescriptor(pDefaultSD,
                                          TRUE,
                                          pDefaultSacl,
                                          FALSE);
    if (!NT_SUCCESS(Status))
        return RtlNtStatusToDosError(Status);
 
    return ERROR_SUCCESS;
}

Referenced by ScmInitializeSecurity().

ScmCreateDefaultServiceSD()

DWORD ScmCreateDefaultServiceSD

(

PSECURITY_DESCRIPTOR *

ppSecurityDescriptor

)

Definition at line 320 of file security.c.

{
    PSECURITY_DESCRIPTOR pRelativeSD = NULL;
    DWORD dwBufferLength = 0;
    NTSTATUS Status;
    DWORD dwError = ERROR_SUCCESS;
 
    /* Convert the absolute SD to a self-relative SD */
    Status = RtlAbsoluteToSelfRelativeSD(pDefaultSD,
                                         NULL,
                                         &dwBufferLength);
    if (Status != STATUS_BUFFER_TOO_SMALL)
    {
        dwError = RtlNtStatusToDosError(Status);
        goto done;
    }
 
    DPRINT("BufferLength %lu\n", dwBufferLength);
 
    pRelativeSD = RtlAllocateHeap(RtlGetProcessHeap(),
                                  HEAP_ZERO_MEMORY,
                                  dwBufferLength);
    if (pRelativeSD == NULL)
    {
        dwError = ERROR_OUTOFMEMORY;
        goto done;
    }
    DPRINT("pRelativeSD %p\n", pRelativeSD);
 
    Status = RtlAbsoluteToSelfRelativeSD(pDefaultSD,
                                         pRelativeSD,
                                         &dwBufferLength);
    if (!NT_SUCCESS(Status))
    {
        dwError = RtlNtStatusToDosError(Status);
        goto done;
    }
 
    *ppSecurityDescriptor = pRelativeSD;
 
done:
    if (dwError != ERROR_SUCCESS)
    {
        if (pRelativeSD != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, pRelativeSD);
    }
 
    return dwError;
}

Referenced by CreateServiceListEntry(), and RCreateServiceW().

ScmCreatePipeSD()

static DWORD ScmCreatePipeSD ( VOID  )

static

Definition at line 271 of file security.c.

{
    NTSTATUS Status;
 
    /* Create the absolute security descriptor */
    pPipeSD = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(SECURITY_DESCRIPTOR));
    if (pPipeSD == NULL)
        return ERROR_OUTOFMEMORY;
 
    DPRINT("pPipeSD %p\n", pDefaultSD);
 
    Status = RtlCreateSecurityDescriptor(pPipeSD,
                                         SECURITY_DESCRIPTOR_REVISION);
    if (!NT_SUCCESS(Status))
        return RtlNtStatusToDosError(Status);
 
    Status = RtlSetOwnerSecurityDescriptor(pPipeSD,
                                           pLocalSystemSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        return RtlNtStatusToDosError(Status);
 
    Status = RtlSetGroupSecurityDescriptor(pPipeSD,
                                           pLocalSystemSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        return RtlNtStatusToDosError(Status);
 
    Status = RtlSetDaclSecurityDescriptor(pPipeSD,
                                          TRUE,
                                          pPipeDacl,
                                          FALSE);
    if (!NT_SUCCESS(Status))
        return RtlNtStatusToDosError(Status);
 
    return ERROR_SUCCESS;
}

Referenced by ScmInitializeSecurity().

ScmCreateSids()

static DWORD ScmCreateSids ( VOID  )

static

Definition at line 55 of file security.c.

{
    SID_IDENTIFIER_AUTHORITY NullAuthority = {SECURITY_NULL_SID_AUTHORITY};
    SID_IDENTIFIER_AUTHORITY WorldAuthority = {SECURITY_WORLD_SID_AUTHORITY};
    SID_IDENTIFIER_AUTHORITY NtAuthority = {SECURITY_NT_AUTHORITY};
    PULONG pSubAuthority;
    ULONG ulLength1 = RtlLengthRequiredSid(1);
    ULONG ulLength2 = RtlLengthRequiredSid(2);
 
    /* Create the Null SID */
    pNullSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, ulLength1);
    if (pNullSid == NULL)
    {
        return ERROR_OUTOFMEMORY;
    }
 
    RtlInitializeSid(pNullSid, &NullAuthority, 1);
    pSubAuthority = RtlSubAuthoritySid(pNullSid, 0);
    *pSubAuthority = SECURITY_NULL_RID;
 
    /* Create the World SID */
    pWorldSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, ulLength1);
    if (pWorldSid == NULL)
    {
        return ERROR_OUTOFMEMORY;
    }
 
    RtlInitializeSid(pWorldSid, &WorldAuthority, 1);
    pSubAuthority = RtlSubAuthoritySid(pWorldSid, 0);
    *pSubAuthority = SECURITY_WORLD_RID;
 
    /* Create the LocalSystem SID */
    pLocalSystemSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, ulLength1);
    if (pLocalSystemSid == NULL)
    {
        return ERROR_OUTOFMEMORY;
    }
 
    RtlInitializeSid(pLocalSystemSid, &NtAuthority, 1);
    pSubAuthority = RtlSubAuthoritySid(pLocalSystemSid, 0);
    *pSubAuthority = SECURITY_LOCAL_SYSTEM_RID;
 
    /* Create the AuthenticatedUser SID */
    pAuthenticatedUserSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, ulLength1);
    if (pAuthenticatedUserSid == NULL)
    {
        return ERROR_OUTOFMEMORY;
    }
 
    RtlInitializeSid(pAuthenticatedUserSid, &NtAuthority, 1);
    pSubAuthority = RtlSubAuthoritySid(pAuthenticatedUserSid, 0);
    *pSubAuthority = SECURITY_AUTHENTICATED_USER_RID;
 
    /* Create the AliasAdmins SID */
    pAliasAdminsSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, ulLength2);
    if (pAliasAdminsSid == NULL)
    {
        return ERROR_OUTOFMEMORY;
    }
 
    RtlInitializeSid(pAliasAdminsSid, &NtAuthority, 2);
    pSubAuthority = RtlSubAuthoritySid(pAliasAdminsSid, 0);
    *pSubAuthority = SECURITY_BUILTIN_DOMAIN_RID;
    pSubAuthority = RtlSubAuthoritySid(pAliasAdminsSid, 1);
    *pSubAuthority = DOMAIN_ALIAS_RID_ADMINS;
 
    return ERROR_SUCCESS;
}

Referenced by ScmInitializeSecurity().

ScmFreeAcls()

static VOID ScmFreeAcls ( VOID  )

static

Definition at line 199 of file security.c.

{
    if (pDefaultDacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pDefaultDacl);
 
    if (pDefaultSacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pDefaultSacl);
 
    if (pPipeDacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pPipeDacl);
}

Referenced by ScmShutdownSecurity().

ScmFreeDefaultSD()

static VOID ScmFreeDefaultSD ( VOID  )

static

Definition at line 262 of file security.c.

{
    if (pDefaultSD != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pDefaultSD);
}

Referenced by ScmShutdownSecurity().

ScmFreePipeSD()

static VOID ScmFreePipeSD ( VOID  )

static

Definition at line 312 of file security.c.

{
    if (pPipeSD != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pPipeSD);
}

Referenced by ScmShutdownSecurity().

ScmFreeSids()

static VOID ScmFreeSids ( VOID  )

static

Definition at line 34 of file security.c.

{
    if (pNullSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pNullSid);
 
    if (pWorldSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pWorldSid);
 
    if (pLocalSystemSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pLocalSystemSid);
 
    if (pAuthenticatedUserSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pAuthenticatedUserSid);
 
    if (pAliasAdminsSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pAliasAdminsSid);
}

Referenced by ScmShutdownSecurity().

ScmInitializeSecurity()

DWORD ScmInitializeSecurity

(

VOID

)

Definition at line 373 of file security.c.

{
    DWORD dwError;
 
    dwError = ScmCreateSids();
    if (dwError != ERROR_SUCCESS)
        return dwError;
 
    dwError = ScmCreateAcls();
    if (dwError != ERROR_SUCCESS)
        return dwError;
 
    dwError = ScmCreateDefaultSD();
    if (dwError != ERROR_SUCCESS)
        return dwError;
 
    dwError = ScmCreatePipeSD();
    if (dwError != ERROR_SUCCESS)
        return dwError;
 
    return ERROR_SUCCESS;
}

Referenced by wWinMain().

ScmShutdownSecurity()

VOID ScmShutdownSecurity

(

VOID

)

Definition at line 398 of file security.c.

{
    ScmFreePipeSD();
    ScmFreeDefaultSD();
    ScmFreeAcls();
    ScmFreeSids();
}

Referenced by wWinMain().

Variable Documentation

pAliasAdminsSid

PSID pAliasAdminsSid = NULL

static

Definition at line 20 of file security.c.

Referenced by ScmCreateAcls(), ScmCreateSids(), and ScmFreeSids().

pAuthenticatedUserSid

PSID pAuthenticatedUserSid = NULL

static

Definition at line 19 of file security.c.

Referenced by SampInitializeSAM(), ScmCreateAcls(), ScmCreateSids(), and ScmFreeSids().

pDefaultDacl

PACL pDefaultDacl = NULL

static

Definition at line 22 of file security.c.

Referenced by ScmCreateAcls(), ScmCreateDefaultSD(), and ScmFreeAcls().

pDefaultSacl

PACL pDefaultSacl = NULL

static

Definition at line 23 of file security.c.

Referenced by ScmCreateAcls(), ScmCreateDefaultSD(), and ScmFreeAcls().

pDefaultSD

PSECURITY_DESCRIPTOR pDefaultSD = NULL

static

Definition at line 26 of file security.c.

Referenced by ScmCreateDefaultSD(), ScmCreateDefaultServiceSD(), ScmCreatePipeSD(), and ScmFreeDefaultSD().

pLocalSystemSid

PSID pLocalSystemSid = NULL

static

Definition at line 18 of file security.c.

Referenced by ScmCreateAcls(), ScmCreateDefaultSD(), ScmCreatePipeSD(), ScmCreateSids(), and ScmFreeSids().

pNullSid

PSID pNullSid = NULL

static

Definition at line 16 of file security.c.

Referenced by ScmCreateAcls(), ScmCreateSids(), and ScmFreeSids().

pPipeDacl

PACL pPipeDacl = NULL

static

Definition at line 24 of file security.c.

Referenced by ScmCreateAcls(), ScmCreatePipeSD(), and ScmFreeAcls().

pPipeSD

PSECURITY_DESCRIPTOR pPipeSD = NULL

Definition at line 27 of file security.c.

Referenced by ScmCreateNewControlPipe(), ScmCreatePipeSD(), and ScmFreePipeSD().

pWorldSid

PSID pWorldSid = NULL

static

Definition at line 17 of file security.c.

Referenced by ScmCreateAcls(), ScmCreateSids(), and ScmFreeSids().