semgr.c File Reference

#include <ntoskrnl.h>
#include <debug.h>

Include dependency graph for semgr.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
static BOOLEAN	SepInitExports (VOID)
	Initializes all the security exports upon initialization phase of the module.
BOOLEAN NTAPI	SepInitializationPhase0 (VOID)
	Handles the phase 0 procedure of the SRM initialization.
BOOLEAN NTAPI	SepInitializationPhase1 (VOID)
	Handles the phase 1 procedure of the SRM initialization.
BOOLEAN NTAPI	SeInitSystem (VOID)
	Main security manager initialization function.
NTSTATUS NTAPI	SeDefaultObjectMethod (_In_ PVOID Object, _In_ SECURITY_OPERATION_CODE OperationType, _In_ PSECURITY_INFORMATION SecurityInformation, _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, _Inout_opt_ PULONG ReturnLength, _Inout_ PSECURITY_DESCRIPTOR *OldSecurityDescriptor, _In_ POOL_TYPE PoolType, _In_ PGENERIC_MAPPING GenericMapping)
	Internal function that is responsible for querying, deleting, assigning and setting a security descriptor for an object in the NT kernel. It is the default security method for objects regarding the security context of objects.
VOID NTAPI	SeQuerySecurityAccessMask (_In_ SECURITY_INFORMATION SecurityInformation, _Out_ PACCESS_MASK DesiredAccess)
	Queries the access mask from a security information context.
VOID NTAPI	SeSetSecurityAccessMask (_In_ SECURITY_INFORMATION SecurityInformation, _Out_ PACCESS_MASK DesiredAccess)
	Sets the access mask for a security information context.
NTSTATUS NTAPI	SeReportSecurityEvent (_In_ ULONG Flags, _In_ PUNICODE_STRING SourceName, _In_opt_ PSID UserSid, _In_ PSE_ADT_PARAMETER_ARRAY AuditParameters)
	Report a security event to the security manager.
_Const_ NTSTATUS NTAPI	SeSetAuditParameter (_Inout_ PSE_ADT_PARAMETER_ARRAY AuditParameters, _In_ SE_ADT_PARAMETER_TYPE Type, _In_range_(<, SE_MAX_AUDIT_PARAMETERS) ULONG Index, _In_reads_(_Inexpressible_("depends on SE_ADT_PARAMETER_TYPE")) PVOID Data)
	Sets an array of audit parameters for later security auditing use.

Variables
PTOKEN	SeAnonymousLogonToken = NULL
PTOKEN	SeAnonymousLogonTokenNoEveryone = NULL
PSE_EXPORTS	SeExports = NULL
SE_EXPORTS	SepExports
ULONG	SidInTokenCalls = 0
ULONG	ExpInitializationPhase
ERESOURCE	SepSubjectContextLock

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 14 of file semgr.c.

Function Documentation

SeDefaultObjectMethod()

NTSTATUS NTAPI SeDefaultObjectMethod	(	_In_ PVOID	Object,
		_In_ SECURITY_OPERATION_CODE	OperationType,
		_In_ PSECURITY_INFORMATION	SecurityInformation,
		_Inout_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_Inout_opt_ PULONG	ReturnLength,
		_Inout_ PSECURITY_DESCRIPTOR *	OldSecurityDescriptor,
		_In_ POOL_TYPE	PoolType,
		_In_ PGENERIC_MAPPING	GenericMapping
	)

Internal function that is responsible for querying, deleting, assigning and setting a security descriptor for an object in the NT kernel. It is the default security method for objects regarding the security context of objects.

Parameters

[in]	Object	The object that has the default security method, which the function has been called upon.
[in]	OperationType	Operation type to perform to that object.
[in]	SecurityInformation	Auxiliary security information of the object.
[in,out]	SecurityDescriptor	A security descriptor. This SD is used accordingly to the operation type requested by the caller.
[in,out]	ReturnLength	The length size of the queried security descriptor, in bytes.
[in,out]	OldSecurityDescriptor	The old SD that belonged to the object, in case we're either deleting or replacing it.
[in]	PoolType	Pool type allocation for the security descriptor.
[in]	GenericMapping	The generic mapping of access rights masks for the object.

Returns

Returns STATUS_SUCCESS if the specific operation tasked has been completed. Otherwise a failure NTSTATUS code is returned.

Definition at line 351 of file semgr.c.

{
    PAGED_CODE();
 
    /* Select the operation type */
    switch (OperationType)
    {
            /* Setting a new descriptor */
        case SetSecurityDescriptor:
 
            /* Sanity check */
            ASSERT((PoolType == PagedPool) || (PoolType == NonPagedPool));
 
            /* Set the information */
            return ObSetSecurityDescriptorInfo(Object,
                                               SecurityInformation,
                                               SecurityDescriptor,
                                               OldSecurityDescriptor,
                                               PoolType,
                                               GenericMapping);
 
        case QuerySecurityDescriptor:
 
            /* Query the information */
            return ObQuerySecurityDescriptorInfo(Object,
                                                 SecurityInformation,
                                                 SecurityDescriptor,
                                                 ReturnLength,
                                                 OldSecurityDescriptor);
 
        case DeleteSecurityDescriptor:
 
            /* De-assign it */
            return ObDeassignSecurity(OldSecurityDescriptor);
 
        case AssignSecurityDescriptor:
 
            /* Assign it */
            ObAssignObjectSecurityDescriptor(Object, SecurityDescriptor, PoolType);
            return STATUS_SUCCESS;
 
        default:
 
            /* Bug check */
            KeBugCheckEx(SECURITY_SYSTEM, 0, STATUS_INVALID_PARAMETER, 0, 0);
    }
 
    /* Should never reach here */
    ASSERT(FALSE);
    return STATUS_SUCCESS;
}

SeInitSystem()

BOOLEAN NTAPI SeInitSystem

(

VOID

)

Main security manager initialization function.

Returns

Returns a boolean value according to the phase initialization routine that handles it. If TRUE, the routine deems the initialization phase as complete, FALSE otherwise.

Definition at line 285 of file semgr.c.

{
    /* Check the initialization phase */
    switch (ExpInitializationPhase)
    {
        case 0:
 
            /* Do Phase 0 */
            return SepInitializationPhase0();
 
        case 1:
 
            /* Do Phase 1 */
            return SepInitializationPhase1();
 
        default:
 
            /* Don't know any other phase! Bugcheck! */
            KeBugCheckEx(UNEXPECTED_INITIALIZATION_CALL,
                         0,
                         ExpInitializationPhase,
                         0,
                         0);
            return FALSE;
    }
}

Referenced by ExpInitializeExecutive(), and Phase1InitializationDiscard().

SepInitExports()

static BOOLEAN SepInitExports ( VOID  )

static

Initializes all the security exports upon initialization phase of the module.

Returns

Returns TRUE.

Definition at line 41 of file semgr.c.

{
    SepExports.SeCreateTokenPrivilege = SeCreateTokenPrivilege;
    SepExports.SeAssignPrimaryTokenPrivilege = SeAssignPrimaryTokenPrivilege;
    SepExports.SeLockMemoryPrivilege = SeLockMemoryPrivilege;
    SepExports.SeIncreaseQuotaPrivilege = SeIncreaseQuotaPrivilege;
    SepExports.SeUnsolicitedInputPrivilege = SeUnsolicitedInputPrivilege;
    SepExports.SeTcbPrivilege = SeTcbPrivilege;
    SepExports.SeSecurityPrivilege = SeSecurityPrivilege;
    SepExports.SeTakeOwnershipPrivilege = SeTakeOwnershipPrivilege;
    SepExports.SeLoadDriverPrivilege = SeLoadDriverPrivilege;
    SepExports.SeCreatePagefilePrivilege = SeCreatePagefilePrivilege;
    SepExports.SeIncreaseBasePriorityPrivilege = SeIncreaseBasePriorityPrivilege;
    SepExports.SeSystemProfilePrivilege = SeSystemProfilePrivilege;
    SepExports.SeSystemtimePrivilege = SeSystemtimePrivilege;
    SepExports.SeProfileSingleProcessPrivilege = SeProfileSingleProcessPrivilege;
    SepExports.SeCreatePermanentPrivilege = SeCreatePermanentPrivilege;
    SepExports.SeBackupPrivilege = SeBackupPrivilege;
    SepExports.SeRestorePrivilege = SeRestorePrivilege;
    SepExports.SeShutdownPrivilege = SeShutdownPrivilege;
    SepExports.SeDebugPrivilege = SeDebugPrivilege;
    SepExports.SeAuditPrivilege = SeAuditPrivilege;
    SepExports.SeSystemEnvironmentPrivilege = SeSystemEnvironmentPrivilege;
    SepExports.SeChangeNotifyPrivilege = SeChangeNotifyPrivilege;
    SepExports.SeRemoteShutdownPrivilege = SeRemoteShutdownPrivilege;
 
    SepExports.SeNullSid = SeNullSid;
    SepExports.SeWorldSid = SeWorldSid;
    SepExports.SeLocalSid = SeLocalSid;
    SepExports.SeCreatorOwnerSid = SeCreatorOwnerSid;
    SepExports.SeCreatorGroupSid = SeCreatorGroupSid;
    SepExports.SeNtAuthoritySid = SeNtAuthoritySid;
    SepExports.SeDialupSid = SeDialupSid;
    SepExports.SeNetworkSid = SeNetworkSid;
    SepExports.SeBatchSid = SeBatchSid;
    SepExports.SeInteractiveSid = SeInteractiveSid;
    SepExports.SeLocalSystemSid = SeLocalSystemSid;
    SepExports.SeAliasAdminsSid = SeAliasAdminsSid;
    SepExports.SeAliasUsersSid = SeAliasUsersSid;
    SepExports.SeAliasGuestsSid = SeAliasGuestsSid;
    SepExports.SeAliasPowerUsersSid = SeAliasPowerUsersSid;
    SepExports.SeAliasAccountOpsSid = SeAliasAccountOpsSid;
    SepExports.SeAliasSystemOpsSid = SeAliasSystemOpsSid;
    SepExports.SeAliasPrintOpsSid = SeAliasPrintOpsSid;
    SepExports.SeAliasBackupOpsSid = SeAliasBackupOpsSid;
    SepExports.SeAuthenticatedUsersSid = SeAuthenticatedUsersSid;
    SepExports.SeRestrictedSid = SeRestrictedSid;
    SepExports.SeAnonymousLogonSid = SeAnonymousLogonSid;
    SepExports.SeLocalServiceSid = SeLocalServiceSid;
    SepExports.SeNetworkServiceSid = SeNetworkServiceSid;
 
    SepExports.SeUndockPrivilege = SeUndockPrivilege;
    SepExports.SeSyncAgentPrivilege = SeSyncAgentPrivilege;
    SepExports.SeEnableDelegationPrivilege = SeEnableDelegationPrivilege;
    SepExports.SeManageVolumePrivilege = SeManageVolumePrivilege;
    SepExports.SeImpersonatePrivilege = SeImpersonatePrivilege;
    SepExports.SeCreateGlobalPrivilege = SeCreateGlobalPrivilege;
 
    SeExports = &SepExports;
    return TRUE;
}

Referenced by SepInitializationPhase0().

SepInitializationPhase0()

BOOLEAN NTAPI SepInitializationPhase0

(

VOID

)

Handles the phase 0 procedure of the SRM initialization.

Returns

Returns TRUE if the phase 0 initialization has succeeded and that we can proceed further with next initialization phase, FALSE otherwise.

Definition at line 115 of file semgr.c.

{
    PAGED_CODE();
 
    if (!ExLuidInitialization()) return FALSE;
    if (!SepInitSecurityIDs()) return FALSE;
    if (!SepInitDACLs()) return FALSE;
    if (!SepInitSDs()) return FALSE;
    SepInitPrivileges();
    if (!SepInitExports()) return FALSE;
 
    /* Initialize the subject context lock */
    ExInitializeResource(&SepSubjectContextLock);
 
    /* Initialize token objects */
    SepInitializeTokenImplementation();
 
    /* Initialize logon sessions */
    if (!SeRmInitPhase0()) return FALSE;
 
    /* Clear impersonation info for the idle thread */
    PsGetCurrentThread()->ImpersonationInfo = NULL;
    PspClearCrossThreadFlag(PsGetCurrentThread(),
                            CT_ACTIVE_IMPERSONATION_INFO_BIT);
 
    /* Initialize the boot token */
    ObInitializeFastReference(&PsGetCurrentProcess()->Token, NULL);
    ObInitializeFastReference(&PsGetCurrentProcess()->Token,
                              SepCreateSystemProcessToken());
 
    /* Initialise the anonymous logon tokens */
    SeAnonymousLogonToken = SepCreateSystemAnonymousLogonToken();
    if (!SeAnonymousLogonToken)
        return FALSE;
 
    SeAnonymousLogonTokenNoEveryone = SepCreateSystemAnonymousLogonTokenNoEveryone();
    if (!SeAnonymousLogonTokenNoEveryone)
        return FALSE;
 
    return TRUE;
}

Referenced by SeInitSystem().

SepInitializationPhase1()

BOOLEAN NTAPI SepInitializationPhase1

(

VOID

)

Handles the phase 1 procedure of the SRM initialization.

Returns

Returns TRUE if the phase 1 initialization has succeeded, FALSE otherwise.

Definition at line 168 of file semgr.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING Name;
    HANDLE SecurityHandle;
    HANDLE EventHandle;
    NTSTATUS Status;
    SECURITY_DESCRIPTOR SecurityDescriptor;
    PACL Dacl;
    ULONG DaclLength;
 
    PAGED_CODE();
 
    /* Insert the system token into the tree */
    Status = ObInsertObject((PVOID)(PsGetCurrentProcess()->Token.Value &
                                    ~MAX_FAST_REFS),
                            NULL,
                            0,
                            0,
                            NULL,
                            NULL);
    ASSERT(NT_SUCCESS(Status));
 
    /* Create a security descriptor for the directory */
    RtlCreateSecurityDescriptor(&SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
 
    /* Setup the ACL */
    DaclLength = sizeof(ACL) + 3 * sizeof(ACCESS_ALLOWED_ACE) +
                 RtlLengthSid(SeLocalSystemSid) +
                 RtlLengthSid(SeAliasAdminsSid) +
                 RtlLengthSid(SeWorldSid);
    Dacl = ExAllocatePoolWithTag(NonPagedPool, DaclLength, TAG_SE);
    if (Dacl == NULL)
    {
        return FALSE;
    }
 
    Status = RtlCreateAcl(Dacl, DaclLength, ACL_REVISION);
    ASSERT(NT_SUCCESS(Status));
 
    /* Grant full access to SYSTEM */
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    DIRECTORY_ALL_ACCESS,
                                    SeLocalSystemSid);
    ASSERT(NT_SUCCESS(Status));
 
    /* Allow admins to traverse and query */
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    READ_CONTROL | DIRECTORY_TRAVERSE | DIRECTORY_QUERY,
                                    SeAliasAdminsSid);
    ASSERT(NT_SUCCESS(Status));
 
    /* Allow anyone to traverse */
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    DIRECTORY_TRAVERSE,
                                    SeWorldSid);
    ASSERT(NT_SUCCESS(Status));
 
    /* And link ACL and SD */
    Status = RtlSetDaclSecurityDescriptor(&SecurityDescriptor, TRUE, Dacl, FALSE);
    ASSERT(NT_SUCCESS(Status));
 
    /* Create '\Security' directory */
    RtlInitUnicodeString(&Name, L"\\Security");
    InitializeObjectAttributes(&ObjectAttributes,
                               &Name,
                               OBJ_PERMANENT | OBJ_CASE_INSENSITIVE,
                               0,
                               &SecurityDescriptor);
 
    Status = ZwCreateDirectoryObject(&SecurityHandle,
                                     DIRECTORY_ALL_ACCESS,
                                     &ObjectAttributes);
    ASSERT(NT_SUCCESS(Status));
 
    /* Free the DACL */
    ExFreePoolWithTag(Dacl, TAG_SE);
 
    /* Create 'LSA_AUTHENTICATION_INITIALIZED' event */
    RtlInitUnicodeString(&Name, L"LSA_AUTHENTICATION_INITIALIZED");
    InitializeObjectAttributes(&ObjectAttributes,
                               &Name,
                               OBJ_PERMANENT | OBJ_CASE_INSENSITIVE,
                               SecurityHandle,
                               SePublicDefaultSd);
 
    Status = ZwCreateEvent(&EventHandle,
                           GENERIC_WRITE,
                           &ObjectAttributes,
                           NotificationEvent,
                           FALSE);
    ASSERT(NT_SUCCESS(Status));
 
    Status = ZwClose(EventHandle);
    ASSERT(NT_SUCCESS(Status));
 
    Status = ZwClose(SecurityHandle);
    ASSERT(NT_SUCCESS(Status));
 
    return TRUE;
}

Referenced by SeInitSystem().

SeQuerySecurityAccessMask()

VOID NTAPI SeQuerySecurityAccessMask	(	_In_ SECURITY_INFORMATION	SecurityInformation,
		_Out_ PACCESS_MASK	DesiredAccess
	)

Queries the access mask from a security information context.

Parameters

[in]	SecurityInformation	The security information context where the access mask is to be gathered.
[out]	DesiredAccess	The queried access mask right.

Returns

Nothing.

Definition at line 427 of file semgr.c.

{
    *DesiredAccess = 0;
 
    if (SecurityInformation & (OWNER_SECURITY_INFORMATION |
                               GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION))
    {
        *DesiredAccess |= READ_CONTROL;
    }
 
    if (SecurityInformation & SACL_SECURITY_INFORMATION)
    {
        *DesiredAccess |= ACCESS_SYSTEM_SECURITY;
    }
}

Referenced by NtQuerySecurityObject().

SeReportSecurityEvent()

NTSTATUS NTAPI SeReportSecurityEvent	(	_In_ ULONG	Flags,
		_In_ PUNICODE_STRING	SourceName,
		_In_opt_ PSID	UserSid,
		_In_ PSE_ADT_PARAMETER_ARRAY	AuditParameters
	)

Report a security event to the security manager.

@unimplemented

Parameters

[in]	Flags	Flags that influence how the event should be reported.
[in]	SourceName	A Unicode string that represents the source name of the event.
[in]	UserSid	The SID that represents a user that initiated the reporting.
[in]	AuditParameters	An array of parameters for auditing purposes. This is used for reporting the event which the security manager will take care subsequently of doing eventual security auditing.

Returns

Returns STATUS_SUCCESS if the security event has been reported. STATUS_INVALID_PARAMETER is returned if one of the parameters do not satisfy the requirements expected by the function.

Definition at line 508 of file semgr.c.

{
    SECURITY_SUBJECT_CONTEXT SubjectContext;
    PTOKEN EffectiveToken;
    PISID Sid;
    NTSTATUS Status;
 
    /* Validate parameters */
    if ((Flags != 0) ||
        (SourceName == NULL) ||
        (SourceName->Buffer == NULL) ||
        (SourceName->Length == 0) ||
        (AuditParameters == NULL) ||
        (AuditParameters->ParameterCount > SE_MAX_AUDIT_PARAMETERS - 4))
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /* Validate the source name */
    Status = RtlValidateUnicodeString(0, SourceName);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }
 
    /* Check if we have a user SID */
    if (UserSid != NULL)
    {
        /* Validate it */
        if (!RtlValidSid(UserSid))
        {
            return STATUS_INVALID_PARAMETER;
        }
 
        /* Use the user SID */
        Sid = UserSid;
    }
    else
    {
        /* No user SID, capture the security subject context */
        SeCaptureSubjectContext(&SubjectContext);
 
        /* Extract the effective token */
        EffectiveToken = SubjectContext.ClientToken ?
            SubjectContext.ClientToken : SubjectContext.PrimaryToken;
 
        /* Use the user-and-groups SID */
        Sid = EffectiveToken->UserAndGroups->Sid;
    }
 
    UNIMPLEMENTED;
 
    /* Check if we captured the subject context */
    if (Sid != UserSid)
    {
        /* Release it */
        SeReleaseSubjectContext(&SubjectContext);
    }
 
    /* Return success */
    return STATUS_SUCCESS;
}

SeSetAuditParameter()

_Const_ NTSTATUS NTAPI SeSetAuditParameter	(	_Inout_ PSE_ADT_PARAMETER_ARRAY	AuditParameters,
		_In_ SE_ADT_PARAMETER_TYPE	Type,
		_In_range_(<, SE_MAX_AUDIT_PARAMETERS) ULONG	Index,
		_In_reads_(_Inexpressible_("depends on SE_ADT_PARAMETER_TYPE")) PVOID	Data
	)

Sets an array of audit parameters for later security auditing use.

@unimplemented

Parameters

[in,out]	AuditParameters	An array of audit parameters to be set.
[in]	Type	The type of audit parameters to be set.
[in]	Index	Index number that represents an instance of an audit parameters. Such index must be within the maximum range of audit parameters.
[in]	Data	An arbitrary buffer data that is bounds to what kind of audit parameter type must be set.

Returns

To be added...

Definition at line 600 of file semgr.c.

{
    UNIMPLEMENTED;
    return STATUS_SUCCESS;
}

SeSetSecurityAccessMask()

VOID NTAPI SeSetSecurityAccessMask	(	_In_ SECURITY_INFORMATION	SecurityInformation,
		_Out_ PACCESS_MASK	DesiredAccess
	)

Sets the access mask for a security information context.

Parameters

[in]	SecurityInformation	The security information context to apply a new access right.
[out]	DesiredAccess	The returned access mask right.

Returns

Nothing.

Definition at line 460 of file semgr.c.

{
    *DesiredAccess = 0;
 
    if (SecurityInformation & (OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION))
    {
        *DesiredAccess |= WRITE_OWNER;
    }
 
    if (SecurityInformation & DACL_SECURITY_INFORMATION)
    {
        *DesiredAccess |= WRITE_DAC;
    }
 
    if (SecurityInformation & SACL_SECURITY_INFORMATION)
    {
        *DesiredAccess |= ACCESS_SYSTEM_SECURITY;
    }
}

Referenced by NtSetSecurityObject().

Variable Documentation

ExpInitializationPhase

ULONG ExpInitializationPhase

extern

Definition at line 68 of file init.c.

Referenced by ExInitSystem(), ExpInitializeExecutive(), ExpInitNls(), IopMountVolume(), MiReloadBootLoadedDrivers(), Phase1InitializationDiscard(), and SeInitSystem().

SeAnonymousLogonToken

PTOKEN SeAnonymousLogonToken = NULL

Definition at line 19 of file semgr.c.

Referenced by SepImpersonateAnonymousToken(), and SepInitializationPhase0().

SeAnonymousLogonTokenNoEveryone

PTOKEN SeAnonymousLogonTokenNoEveryone = NULL

Definition at line 20 of file semgr.c.

Referenced by SepImpersonateAnonymousToken(), and SepInitializationPhase0().

SeExports

PSE_EXPORTS SeExports = NULL

Definition at line 21 of file semgr.c.

Referenced by CheckKeySecurity__(), FatCreateRestrictEveryoneToken(), FilterToken(), IntCreateServiceSecurity(), SepInitExports(), SePrivilegedServiceAuditAlarm(), START_TEST(), TestObRootSecurity(), TestSeAssignSecurity(), TiCreateSecurityDescriptor(), UDFCheckAccessRights(), and UDFCommonCreate().

SepExports

SE_EXPORTS SepExports

Definition at line 22 of file semgr.c.

Referenced by SepInitExports().

SepSubjectContextLock

ERESOURCE SepSubjectContextLock

extern

Definition at line 16 of file subject.c.

Referenced by SepInitializationPhase0().

SidInTokenCalls

ULONG SidInTokenCalls = 0

Definition at line 23 of file semgr.c.