ReactOS 0.4.15-dev-7788-g1ad9096
access.c
Go to the documentation of this file.
1/*
2 * PROJECT: ReactOS Kernel
3 * LICENSE: GPL-2.0-or-later (https://spdx.org/licenses/GPL-2.0-or-later)
4 * PURPOSE: Security access state functions support
5 * COPYRIGHT: Copyright Alex Ionescu <alex@relsoft.net>
6 */
7
8/* INCLUDES *******************************************************************/
9
10#include <ntoskrnl.h>
11#define NDEBUG
12#include <debug.h>
13
14/* PUBLIC FUNCTIONS ***********************************************************/
15
47 _In_ PAUX_ACCESS_DATA AuxData,
48 _In_ ACCESS_MASK Access,
50{
51 ACCESS_MASK AccessMask = Access;
53 PAGED_CODE();
54
55 /* Map the Generic Acess to Specific Access if we have a Mapping */
56 if ((Access & GENERIC_ACCESS) && (GenericMapping))
57 {
59 }
60
61 /* Initialize the Access State */
63 ASSERT(AccessState->SecurityDescriptor == NULL);
64 ASSERT(AccessState->PrivilegesAllocated == FALSE);
65
66 /* Initialize and save aux data */
67 RtlZeroMemory(AuxData, sizeof(AUX_ACCESS_DATA));
68 AccessState->AuxData = AuxData;
69
70 /* Capture the Subject Context */
72 Process,
73 &AccessState->SubjectSecurityContext);
74
75 /* Set Access State Data */
76 AccessState->RemainingDesiredAccess = AccessMask;
77 AccessState->OriginalDesiredAccess = AccessMask;
79
80 /* Get the Token to use */
81 Token = SeQuerySubjectContextToken(&AccessState->SubjectSecurityContext);
82
83 /* Check for Travers Privilege */
84 if (Token->TokenFlags & TOKEN_HAS_TRAVERSE_PRIVILEGE)
85 {
86 /* Preserve the Traverse Privilege */
88 }
89
90 /* Set the Auxiliary Data */
91 AuxData->PrivilegeSet = (PPRIVILEGE_SET)((ULONG_PTR)AccessState +
93 Privileges));
94 if (GenericMapping) AuxData->GenericMapping = *GenericMapping;
95
96 /* Return Sucess */
97 return STATUS_SUCCESS;
98}
99
120NTAPI
123 _In_ PAUX_ACCESS_DATA AuxData,
124 _In_ ACCESS_MASK Access,
126{
127 PAGED_CODE();
128
129 /* Call the extended API */
133 AuxData,
134 Access,
136}
137
148VOID
149NTAPI
152{
153 PAUX_ACCESS_DATA AuxData;
154 PAGED_CODE();
155
156 /* Get the Auxiliary Data */
157 AuxData = AccessState->AuxData;
158
159 /* Deallocate Privileges */
160 if (AccessState->PrivilegesAllocated)
162
163 /* Deallocate Name and Type Name */
164 if (AccessState->ObjectName.Buffer)
165 {
166 ExFreePool(AccessState->ObjectName.Buffer);
167 }
168
169 if (AccessState->ObjectTypeName.Buffer)
170 {
171 ExFreePool(AccessState->ObjectTypeName.Buffer);
172 }
173
174 /* Release the Subject Context */
175 SeReleaseSubjectContext(&AccessState->SubjectSecurityContext);
176}
177
191VOID
192NTAPI
196{
197 PAGED_CODE();
198
199 /* Set the Generic Mapping */
200 ((PAUX_ACCESS_DATA)AccessState->AuxData)->GenericMapping = *GenericMapping;
201}
202
203/* EOF */
#define PAGED_CODE()
static GENERIC_MAPPING GenericMapping
Definition: SeInheritance.c:11
LONG NTSTATUS
Definition: precomp.h:26
#define GENERIC_ACCESS
Definition: security.c:35
#define NULL
Definition: types.h:112
#define FALSE
Definition: types.h:117
#define PsGetCurrentThread()
Definition: env_spec_w32.h:81
#define ExFreePool(addr)
Definition: env_spec_w32.h:352
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:223
#define ASSERT(a)
Definition: mode.c:44
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1109
#define _Inout_
Definition: ms_sal.h:378
#define _In_
Definition: ms_sal.h:308
_In_ ACCESS_MASK AccessMask
Definition: exfuncs.h:186
NTSYSAPI VOID NTAPI RtlMapGenericMask(PACCESS_MASK AccessMask, PGENERIC_MAPPING GenericMapping)
struct _AUX_ACCESS_DATA * PAUX_ACCESS_DATA
ULONG ACCESS_MASK
Definition: nt_native.h:40
VOID NTAPI ExAllocateLocallyUniqueId(OUT LUID *LocallyUniqueId)
Definition: uuid.c:335
VOID NTAPI SeCaptureSubjectContextEx(_In_ PETHREAD Thread, _In_ PEPROCESS Process, _Out_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
An extended function that captures the security subject context based upon the specified thread and p...
Definition: subject.c:41
VOID NTAPI SeSetAccessStateGenericMapping(_In_ PACCESS_STATE AccessState, _In_ PGENERIC_MAPPING GenericMapping)
Sets a new generic mapping for an allocated access state.
Definition: access.c:193
NTSTATUS NTAPI SeCreateAccessState(_Inout_ PACCESS_STATE AccessState, _In_ PAUX_ACCESS_DATA AuxData, _In_ ACCESS_MASK Access, _In_ PGENERIC_MAPPING GenericMapping)
Creates an access state.
Definition: access.c:121
NTSTATUS NTAPI SeCreateAccessStateEx(_In_ PETHREAD Thread, _In_ PEPROCESS Process, _Inout_ PACCESS_STATE AccessState, _In_ PAUX_ACCESS_DATA AuxData, _In_ ACCESS_MASK Access, _In_ PGENERIC_MAPPING GenericMapping)
An extended function that creates an access state.
Definition: access.c:43
VOID NTAPI SeDeleteAccessState(_In_ PACCESS_STATE AccessState)
Deletes an allocated access state from the memory.
Definition: access.c:150
#define STATUS_SUCCESS
Definition: shellext.h:65
PPRIVILEGE_SET PrivilegeSet
Definition: setypes.h:258
VOID NTAPI SeReleaseSubjectContext(_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext)
Releases both the primary and client tokens of a security subject context.
Definition: subject.c:171
#define TAG_PRIVILEGE_SET
Definition: tag.h:157
#define FIELD_OFFSET(t, f)
Definition: typedefs.h:255
#define NTAPI
Definition: typedefs.h:36
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:262
uint32_t ULONG_PTR
Definition: typedefs.h:65
#define PsGetCurrentProcess
Definition: psfuncs.h:17
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET * Privileges
Definition: sefuncs.h:17
#define SeQuerySubjectContextToken(SubjectContext)
Definition: sefuncs.h:583
_In_opt_ PVOID _In_opt_ PUNICODE_STRING _In_ PSECURITY_DESCRIPTOR _In_ PACCESS_STATE AccessState
Definition: sefuncs.h:417
#define TOKEN_HAS_TRAVERSE_PRIVILEGE
Definition: setypes.h:1178
struct _PRIVILEGE_SET * PPRIVILEGE_SET