obsecure.c File Reference

#include <ntoskrnl.h>
#include <debug.h>

Include dependency graph for obsecure.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
NTSTATUS NTAPI	ObAssignObjectSecurityDescriptor (IN PVOID Object, IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL, IN POOL_TYPE PoolType)
NTSTATUS NTAPI	ObDeassignSecurity (IN OUT PSECURITY_DESCRIPTOR *SecurityDescriptor)
NTSTATUS NTAPI	ObQuerySecurityDescriptorInfo (IN PVOID Object, IN PSECURITY_INFORMATION SecurityInformation, OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PULONG Length, IN PSECURITY_DESCRIPTOR *OutputSecurityDescriptor)
NTSTATUS NTAPI	ObSetSecurityDescriptorInfo (IN PVOID Object, IN PSECURITY_INFORMATION SecurityInformation, IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PSECURITY_DESCRIPTOR *OutputSecurityDescriptor, IN POOL_TYPE PoolType, IN PGENERIC_MAPPING GenericMapping)
BOOLEAN NTAPI	ObCheckCreateObjectAccess (IN PVOID Object, IN ACCESS_MASK CreateAccess, IN PACCESS_STATE AccessState, IN PUNICODE_STRING ComponentName, IN BOOLEAN LockHeld, IN KPROCESSOR_MODE AccessMode, OUT PNTSTATUS AccessStatus)
BOOLEAN NTAPI	ObpCheckTraverseAccess (IN PVOID Object, IN ACCESS_MASK TraverseAccess, IN PACCESS_STATE AccessState OPTIONAL, IN BOOLEAN LockHeld, IN KPROCESSOR_MODE AccessMode, OUT PNTSTATUS AccessStatus)
BOOLEAN NTAPI	ObpCheckObjectReference (IN PVOID Object, IN OUT PACCESS_STATE AccessState, IN BOOLEAN LockHeld, IN KPROCESSOR_MODE AccessMode, OUT PNTSTATUS AccessStatus)
BOOLEAN NTAPI	ObCheckObjectAccess (IN PVOID Object, IN OUT PACCESS_STATE AccessState, IN BOOLEAN LockHeld, IN KPROCESSOR_MODE AccessMode, OUT PNTSTATUS ReturnedStatus)
NTSTATUS NTAPI	ObAssignSecurity (IN PACCESS_STATE AccessState, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PVOID Object, IN POBJECT_TYPE Type)
NTSTATUS NTAPI	ObGetObjectSecurity (IN PVOID Object, OUT PSECURITY_DESCRIPTOR *SecurityDescriptor, OUT PBOOLEAN MemoryAllocated)
VOID NTAPI	ObReleaseObjectSecurity (IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN BOOLEAN MemoryAllocated)
NTSTATUS NTAPI	ObSetSecurityObjectByPointer (IN PVOID Object, IN SECURITY_INFORMATION SecurityInformation, IN PSECURITY_DESCRIPTOR SecurityDescriptor)
NTSTATUS NTAPI	NtQuerySecurityObject (IN HANDLE Handle, IN SECURITY_INFORMATION SecurityInformation, OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN ULONG Length, OUT PULONG ResultLength)
NTSTATUS NTAPI	NtSetSecurityObject (IN HANDLE Handle, IN SECURITY_INFORMATION SecurityInformation, IN PSECURITY_DESCRIPTOR SecurityDescriptor)
NTSTATUS NTAPI	ObQueryObjectAuditingByHandle (IN HANDLE Handle, OUT PBOOLEAN GenerateOnClose)

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 13 of file obsecure.c.

Function Documentation

NtQuerySecurityObject()

NTSTATUS NTAPI NtQuerySecurityObject	(	IN HANDLE	Handle,
		IN SECURITY_INFORMATION	SecurityInformation,
		OUT PSECURITY_DESCRIPTOR	SecurityDescriptor,
		IN ULONG	Length,
		OUT PULONG	ResultLength
	)

Definition at line 803 of file obsecure.c.

{
    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
    PVOID Object;
    POBJECT_HEADER Header;
    POBJECT_TYPE Type;
    ACCESS_MASK DesiredAccess;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Check if we came from user mode */
    if (PreviousMode != KernelMode)
    {
        /* Enter SEH */
        _SEH2_TRY
        {
            /* Probe the SD and the length pointer */
            ProbeForWrite(SecurityDescriptor, Length, sizeof(ULONG));
            ProbeForWriteUlong(ResultLength);
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Return the exception code */
            _SEH2_YIELD(return _SEH2_GetExceptionCode());
        }
        _SEH2_END;
    }
 
    /* Get the required access rights for the operation */
    SeQuerySecurityAccessMask(SecurityInformation, &DesiredAccess);
 
    /* Reference the object */
    Status = ObReferenceObjectByHandle(Handle,
                                       DesiredAccess,
                                       NULL,
                                       PreviousMode,
                                       &Object,
                                       NULL);
    if (!NT_SUCCESS(Status)) return Status;
 
    /* Get the Object Header and Type */
    Header = OBJECT_TO_OBJECT_HEADER(Object);
    Type = Header->Type;
 
    /* Call the security procedure's query function */
    Status = Type->TypeInfo.SecurityProcedure(Object,
                                              QuerySecurityDescriptor,
                                              &SecurityInformation,
                                              SecurityDescriptor,
                                              &Length,
                                              &Header->SecurityDescriptor,
                                              Type->TypeInfo.PoolType,
                                              &Type->TypeInfo.GenericMapping);
 
    /* Dereference the object */
    ObDereferenceObject(Object);
 
    /* Protect write with SEH */
    _SEH2_TRY
    {
        /* Return the needed length */
        *ResultLength = Length;
    }
    _SEH2_EXCEPT(ExSystemExceptionFilter())
    {
        /* Get the exception code */
        Status = _SEH2_GetExceptionCode();
    }
    _SEH2_END;
 
    /* Return status */
    return Status;
}

Referenced by AccRewriteGetHandleRights(), get_security_descriptor(), GetFileSecurityW(), GetKernelObjectSecurity(), GetUserObjectSecurity(), RegGetKeySecurity(), RegQueryInfoKeyW(), and test_security_info().

NtSetSecurityObject()

NTSTATUS NTAPI NtSetSecurityObject	(	IN HANDLE	Handle,
		IN SECURITY_INFORMATION	SecurityInformation,
		IN PSECURITY_DESCRIPTOR	SecurityDescriptor
	)

Definition at line 903 of file obsecure.c.

{
    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
    PVOID Object;
    SECURITY_DESCRIPTOR_RELATIVE *CapturedDescriptor;
    ACCESS_MASK DesiredAccess = 0;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Make sure the caller doesn't pass a NULL security descriptor! */
    if (!SecurityDescriptor) return STATUS_ACCESS_VIOLATION;
 
    /* Set the required access rights for the operation */
    SeSetSecurityAccessMask(SecurityInformation, &DesiredAccess);
 
    /* Reference the object */
    Status = ObReferenceObjectByHandle(Handle,
                                       DesiredAccess,
                                       NULL,
                                       PreviousMode,
                                       &Object,
                                       NULL);
    if (NT_SUCCESS(Status))
    {
        /* Capture and make a copy of the security descriptor */
        Status = SeCaptureSecurityDescriptor(SecurityDescriptor,
                                             PreviousMode,
                                             PagedPool,
                                             TRUE,
                                             (PSECURITY_DESCRIPTOR*)
                                             &CapturedDescriptor);
        if (!NT_SUCCESS(Status))
        {
            /* Fail */
            ObDereferenceObject(Object);
            return Status;
        }
 
        /* Sanity check */
        ASSERT(CapturedDescriptor->Control & SE_SELF_RELATIVE);
 
        /*
         * Make sure the security descriptor passed by the caller
         * is valid for the operation we're about to perform
         */
        if (((SecurityInformation & OWNER_SECURITY_INFORMATION) &&
             !(CapturedDescriptor->Owner)) ||
            ((SecurityInformation & GROUP_SECURITY_INFORMATION) &&
             !(CapturedDescriptor->Group)))
        {
            /* Set the failure status */
            Status = STATUS_INVALID_SECURITY_DESCR;
        }
        else
        {
            /* Set security */
            Status = ObSetSecurityObjectByPointer(Object,
                                                  SecurityInformation,
                                                  CapturedDescriptor);
        }
 
        /* Release the descriptor and return status */
        SeReleaseSecurityDescriptor((PSECURITY_DESCRIPTOR)CapturedDescriptor,
                                    PreviousMode,
                                    TRUE);
 
        /* Now we can dereference the object */
        ObDereferenceObject(Object);
    }
 
    return Status;
}

ObAssignObjectSecurityDescriptor()

NTSTATUS NTAPI ObAssignObjectSecurityDescriptor	(	IN PVOID	Object,
		IN PSECURITY_DESCRIPTOR SecurityDescriptor	OPTIONAL,
		IN POOL_TYPE	PoolType
	)

Definition at line 20 of file obsecure.c.

{
    POBJECT_HEADER ObjectHeader;
    NTSTATUS Status;
    PSECURITY_DESCRIPTOR NewSd;
    PEX_FAST_REF FastRef;
    PAGED_CODE();
 
    /* Get the object header */
    ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
    FastRef = (PEX_FAST_REF)&ObjectHeader->SecurityDescriptor;
    if (!SecurityDescriptor)
    {
        /* Nothing to assign */
        ExInitializeFastReference(FastRef, NULL);
        return STATUS_SUCCESS;
    }
 
    /* Add it to our internal cache */
    Status = ObLogSecurityDescriptor(SecurityDescriptor,
                                     &NewSd,
                                     MAX_FAST_REFS + 1);
    if (NT_SUCCESS(Status))
    {
        /* Free the old copy */
        ExFreePoolWithTag(SecurityDescriptor, TAG_SD);
 
        /* Set the new pointer */
        ASSERT(NewSd);
        ExInitializeFastReference(FastRef, NewSd);
    }
 
    /* Return status */
    return Status;
}

Referenced by SeDefaultObjectMethod(), and WmipSecurityMethod().

ObAssignSecurity()

NTSTATUS NTAPI ObAssignSecurity	(	IN PACCESS_STATE	AccessState,
		IN PSECURITY_DESCRIPTOR	SecurityDescriptor,
		IN PVOID	Object,
		IN POBJECT_TYPE	Type
	)

Definition at line 550 of file obsecure.c.

{
    PSECURITY_DESCRIPTOR NewDescriptor;
    NTSTATUS Status;
    KIRQL CalloutIrql;
    PAGED_CODE();
 
    /* Build the new security descriptor */
    Status = SeAssignSecurity(SecurityDescriptor,
                              AccessState->SecurityDescriptor,
                              &NewDescriptor,
                              (Type == ObpDirectoryObjectType),
                              &AccessState->SubjectSecurityContext,
                              &Type->TypeInfo.GenericMapping,
                              PagedPool);
    if (!NT_SUCCESS(Status)) return Status;
 
    /* Call the security method */
    ObpCalloutStart(&CalloutIrql);
    Status = Type->TypeInfo.SecurityProcedure(Object,
                                              AssignSecurityDescriptor,
                                              NULL,
                                              NewDescriptor,
                                              NULL,
                                              NULL,
                                              PagedPool,
                                              &Type->TypeInfo.GenericMapping);
    ObpCalloutEnd(CalloutIrql, "Security", Type, Object);
 
    /* Check for failure and deassign security if so */
    if (!NT_SUCCESS(Status)) SeDeassignSecurity(&NewDescriptor);
 
    /* Return to caller */
    return Status;
}

Referenced by IntAssignDesktopSecurityOnParse(), and ObInsertObject().

ObCheckCreateObjectAccess()

BOOLEAN NTAPI ObCheckCreateObjectAccess	(	IN PVOID	Object,
		IN ACCESS_MASK	CreateAccess,
		IN PACCESS_STATE	AccessState,
		IN PUNICODE_STRING	ComponentName,
		IN BOOLEAN	LockHeld,
		IN KPROCESSOR_MODE	AccessMode,
		OUT PNTSTATUS	AccessStatus
	)

Definition at line 203 of file obsecure.c.

{
    POBJECT_HEADER ObjectHeader;
    POBJECT_TYPE ObjectType;
    PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
    BOOLEAN SdAllocated;
    BOOLEAN Result = TRUE;
    ACCESS_MASK GrantedAccess = 0;
    PPRIVILEGE_SET Privileges = NULL;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Get the header and type */
    ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
    ObjectType = ObjectHeader->Type;
 
    /* Get the security descriptor */
    Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated);
    if (!NT_SUCCESS(Status))
    {
        /* We failed */
        *AccessStatus = Status;
        return FALSE;
    }
 
    /* Lock the security context */
    SeLockSubjectContext(&AccessState->SubjectSecurityContext);
 
    /* Check if we have an SD */
    if (SecurityDescriptor)
    {
        /* Now do the entire access check */
        Result = SeAccessCheck(SecurityDescriptor,
                               &AccessState->SubjectSecurityContext,
                               TRUE,
                               CreateAccess,
                               0,
                               &Privileges,
                               &ObjectType->TypeInfo.GenericMapping,
                               AccessMode,
                               &GrantedAccess,
                               AccessStatus);
        if (Privileges)
        {
            /* We got privileges, append them to the access state and free them */
            Status = SeAppendPrivileges(AccessState, Privileges);
            SeFreePrivileges(Privileges);
        }
    }
 
    /* We're done, unlock the context and release security */
    SeUnlockSubjectContext(&AccessState->SubjectSecurityContext);
    ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
    return Result;
}

Referenced by ObpLookupObjectName().

ObCheckObjectAccess()

BOOLEAN NTAPI ObCheckObjectAccess	(	IN PVOID	Object,
		IN OUT PACCESS_STATE	AccessState,
		IN BOOLEAN	LockHeld,
		IN KPROCESSOR_MODE	AccessMode,
		OUT PNTSTATUS	ReturnedStatus
	)

Definition at line 441 of file obsecure.c.

{
    POBJECT_HEADER ObjectHeader;
    POBJECT_TYPE ObjectType;
    PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
    BOOLEAN SdAllocated;
    NTSTATUS Status;
    BOOLEAN Result;
    ACCESS_MASK GrantedAccess;
    PPRIVILEGE_SET Privileges = NULL;
    PAGED_CODE();
 
    /* Get the object header and type */
    ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
    ObjectType = ObjectHeader->Type;
 
    /* Get security information */
    Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated);
    if (!NT_SUCCESS(Status))
    {
        /* Return failure */
        *ReturnedStatus = Status;
        return FALSE;
    }
    else if (!SecurityDescriptor)
    {
        /* Otherwise, if we don't actually have an SD, return success */
        *ReturnedStatus = Status;
        return TRUE;
    }
 
    /* Lock the security context */
    SeLockSubjectContext(&AccessState->SubjectSecurityContext);
 
    /* Now do the entire access check */
    Result = SeAccessCheck(SecurityDescriptor,
                           &AccessState->SubjectSecurityContext,
                           TRUE,
                           AccessState->RemainingDesiredAccess,
                           AccessState->PreviouslyGrantedAccess,
                           &Privileges,
                           &ObjectType->TypeInfo.GenericMapping,
                           AccessMode,
                           &GrantedAccess,
                           ReturnedStatus);
    if (Privileges)
    {
        /* We got privileges, append them to the access state and free them */
        Status = SeAppendPrivileges(AccessState, Privileges);
        SeFreePrivileges(Privileges);
    }
 
    /* Check if access was granted */
    if (Result)
    {
        /* Update the access state */
        AccessState->RemainingDesiredAccess &= ~(GrantedAccess |
                                                 MAXIMUM_ALLOWED);
        AccessState->PreviouslyGrantedAccess |= GrantedAccess;
    }
 
    /* Do audit alarm */
    SeOpenObjectAuditAlarm(&ObjectType->Name,
                           Object,
                           NULL,
                           SecurityDescriptor,
                           AccessState,
                           FALSE,
                           Result,
                           AccessMode,
                           &AccessState->GenerateOnClose);
 
    /* We're done, unlock the context and release security */
    SeUnlockSubjectContext(&AccessState->SubjectSecurityContext);
    ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
    return Result;
}

Referenced by CmpDoOpen(), and ObpIncrementHandleCount().

ObDeassignSecurity()

NTSTATUS NTAPI ObDeassignSecurity

(

IN OUT PSECURITY_DESCRIPTOR *

SecurityDescriptor

)

Definition at line 60 of file obsecure.c.

{
    EX_FAST_REF FastRef;
    ULONG Count;
    PSECURITY_DESCRIPTOR OldSecurityDescriptor;
 
    /* Get the fast reference and capture it */
    FastRef = *(PEX_FAST_REF)SecurityDescriptor;
 
    /* Don't free again later */
    *SecurityDescriptor = NULL;
 
    /* Get the descriptor and reference count */
    OldSecurityDescriptor = ExGetObjectFastReference(FastRef);
    Count = ExGetCountFastReference(FastRef);
 
    /* Dereference the descriptor */
    ObDereferenceSecurityDescriptor(OldSecurityDescriptor, Count + 1);
 
    /* All done */
    return STATUS_SUCCESS;
}

Referenced by SeDefaultObjectMethod(), and WmipSecurityMethod().

ObGetObjectSecurity()

NTSTATUS NTAPI ObGetObjectSecurity	(	IN PVOID	Object,
		OUT PSECURITY_DESCRIPTOR *	SecurityDescriptor,
		OUT PBOOLEAN	MemoryAllocated
	)

Definition at line 611 of file obsecure.c.

{
    POBJECT_HEADER Header;
    POBJECT_TYPE Type;
    ULONG Length = 0;
    NTSTATUS Status;
    SECURITY_INFORMATION SecurityInformation;
    KIRQL CalloutIrql;
    PAGED_CODE();
 
    /* Get the object header and type */
    Header = OBJECT_TO_OBJECT_HEADER(Object);
    Type = Header->Type;
 
    /* Tell the caller that we didn't have to allocate anything yet */
    *MemoryAllocated = FALSE;
 
    /* Check if the object uses default security */
    if (Type->TypeInfo.SecurityProcedure == SeDefaultObjectMethod)
    {
        /* Reference the descriptor */
        *SecurityDescriptor = ObpReferenceSecurityDescriptor(Header);
        return STATUS_SUCCESS;
    }
 
    /* Set mask to query */
    SecurityInformation =  OWNER_SECURITY_INFORMATION |
                           GROUP_SECURITY_INFORMATION |
                           DACL_SECURITY_INFORMATION |
                           SACL_SECURITY_INFORMATION;
 
    /* Get the security descriptor size */
    ObpCalloutStart(&CalloutIrql);
    Status = Type->TypeInfo.SecurityProcedure(Object,
                                              QuerySecurityDescriptor,
                                              &SecurityInformation,
                                              *SecurityDescriptor,
                                              &Length,
                                              &Header->SecurityDescriptor,
                                              Type->TypeInfo.PoolType,
                                              &Type->TypeInfo.GenericMapping);
    ObpCalloutEnd(CalloutIrql, "Security", Type, Object);
 
    /* Check for failure */
    if (Status != STATUS_BUFFER_TOO_SMALL) return Status;
 
    /* Allocate security descriptor */
    *SecurityDescriptor = ExAllocatePoolWithTag(PagedPool,
                                                Length,
                                                TAG_SEC_QUERY);
    if (!(*SecurityDescriptor)) return STATUS_INSUFFICIENT_RESOURCES;
    *MemoryAllocated = TRUE;
 
    /* Query security descriptor */
    ObpCalloutStart(&CalloutIrql);
    Status = Type->TypeInfo.SecurityProcedure(Object,
                                              QuerySecurityDescriptor,
                                              &SecurityInformation,
                                              *SecurityDescriptor,
                                              &Length,
                                              &Header->SecurityDescriptor,
                                              Type->TypeInfo.PoolType,
                                              &Type->TypeInfo.GenericMapping);
    ObpCalloutEnd(CalloutIrql, "Security", Type, Object);
 
    /* Check for failure */
    if (!NT_SUCCESS(Status))
    {
        /* Free the descriptor and tell the caller we failed */
        ExFreePoolWithTag(*SecurityDescriptor, TAG_SEC_QUERY);
        *MemoryAllocated = FALSE;
    }
 
    /* Return status */
    return Status;
}

Referenced by CreateDeviceSecurityDescriptor(), IntAssignDesktopSecurityOnParse(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObInsertObject(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), PspCreateProcess(), PspCreateThread(), PspSetPrimaryToken(), and TestObRootSecurity().

ObpCheckObjectReference()

BOOLEAN NTAPI ObpCheckObjectReference	(	IN PVOID	Object,
		IN OUT PACCESS_STATE	AccessState,
		IN BOOLEAN	LockHeld,
		IN KPROCESSOR_MODE	AccessMode,
		OUT PNTSTATUS	AccessStatus
	)

Definition at line 340 of file obsecure.c.

{
    POBJECT_HEADER ObjectHeader;
    POBJECT_TYPE ObjectType;
    PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
    BOOLEAN SdAllocated;
    BOOLEAN Result;
    ACCESS_MASK GrantedAccess = 0;
    PPRIVILEGE_SET Privileges = NULL;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Get the header and type */
    ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
    ObjectType = ObjectHeader->Type;
 
    /* Get the security descriptor */
    Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated);
    if (!NT_SUCCESS(Status))
    {
        /* We failed */
        *AccessStatus = Status;
        return FALSE;
    }
 
    /* Lock the security context */
    SeLockSubjectContext(&AccessState->SubjectSecurityContext);
 
    /* Now do the entire access check */
    Result = SeAccessCheck(SecurityDescriptor,
                           &AccessState->SubjectSecurityContext,
                           TRUE,
                           AccessState->RemainingDesiredAccess,
                           AccessState->PreviouslyGrantedAccess,
                           &Privileges,
                           &ObjectType->TypeInfo.GenericMapping,
                           AccessMode,
                           &GrantedAccess,
                           AccessStatus);
    if (Result)
    {
        /* Update the access state */
        AccessState->RemainingDesiredAccess &= ~GrantedAccess;
        AccessState->PreviouslyGrantedAccess |= GrantedAccess;
    }
 
    /* Check if we have an SD */
    if (SecurityDescriptor)
    {
        /* Do audit alarm */
#if 0
        SeObjectReferenceAuditAlarm(&AccessState->OperationID,
                                    Object,
                                    SecurityDescriptor,
                                    &AccessState->SubjectSecurityContext,
                                    AccessState->RemainingDesiredAccess |
                                    AccessState->PreviouslyGrantedAccess,
                                    ((PAUX_ACCESS_DATA)(AccessState->AuxData))->
                                    PrivilegeSet,
                                    Result,
                                    AccessMode);
#endif
    }
 
    /* We're done, unlock the context and release security */
    SeUnlockSubjectContext(&AccessState->SubjectSecurityContext);
    ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
    return Result;
}

Referenced by ObReferenceObjectByName().

ObpCheckTraverseAccess()

BOOLEAN NTAPI ObpCheckTraverseAccess	(	IN PVOID	Object,
		IN ACCESS_MASK	TraverseAccess,
		IN PACCESS_STATE AccessState	OPTIONAL,
		IN BOOLEAN	LockHeld,
		IN KPROCESSOR_MODE	AccessMode,
		OUT PNTSTATUS	AccessStatus
	)

Definition at line 267 of file obsecure.c.

{
    POBJECT_HEADER ObjectHeader;
    POBJECT_TYPE ObjectType;
    PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
    BOOLEAN SdAllocated;
    BOOLEAN Result;
    ACCESS_MASK GrantedAccess = 0;
    PPRIVILEGE_SET Privileges = NULL;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Get the header and type */
    ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
    ObjectType = ObjectHeader->Type;
 
    /* Get the security descriptor */
    Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated);
    if (!NT_SUCCESS(Status))
    {
        /* We failed */
        *AccessStatus = Status;
        return FALSE;
    }
 
    /* First try to perform a fast traverse check
     * If it fails, then the entire access check will
     * have to be done.
     */
    Result = SeFastTraverseCheck(SecurityDescriptor,
                                 AccessState,
                                 FILE_WRITE_DATA,
                                 AccessMode);
    if (Result)
    {
        ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
        return TRUE;
    }
 
    /* Lock the security context */
    SeLockSubjectContext(&AccessState->SubjectSecurityContext);
 
    /* Now do the entire access check */
    Result = SeAccessCheck(SecurityDescriptor,
                           &AccessState->SubjectSecurityContext,
                           TRUE,
                           TraverseAccess,
                           0,
                           &Privileges,
                           &ObjectType->TypeInfo.GenericMapping,
                           AccessMode,
                           &GrantedAccess,
                           AccessStatus);
    if (Privileges)
    {
        /* We got privileges, append them to the access state and free them */
        Status = SeAppendPrivileges(AccessState, Privileges);
        SeFreePrivileges(Privileges);
    }
 
    /* We're done, unlock the context and release security */
    SeUnlockSubjectContext(&AccessState->SubjectSecurityContext);
    ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
    return Result;
}

Referenced by ObpLookupObjectName().

ObQueryObjectAuditingByHandle()

NTSTATUS NTAPI ObQueryObjectAuditingByHandle	(	IN HANDLE	Handle,
		OUT PBOOLEAN	GenerateOnClose
	)

Definition at line 997 of file obsecure.c.

{
    PHANDLE_TABLE_ENTRY HandleEntry;
    PVOID HandleTable;
    NTSTATUS Status = STATUS_SUCCESS;
    PAGED_CODE();
 
    /* Check if we're dealing with a kernel handle */
    if (ObpIsKernelHandle(Handle, ExGetPreviousMode()))
    {
        /* Use the kernel table and convert the handle */
        HandleTable = ObpKernelHandleTable;
        Handle = ObKernelHandleToHandle(Handle);
    }
    else
    {
        /* Use the process's handle table */
        HandleTable = PsGetCurrentProcess()->ObjectTable;
    }
 
    /* Enter a critical region while we touch the handle table */
    KeEnterCriticalRegion();
 
    /* Map the handle */
    HandleEntry = ExMapHandleToPointer(HandleTable, Handle);
    if(HandleEntry)
    {
        /* Check if the flag is set */
        *GenerateOnClose = HandleEntry->ObAttributes & OBJ_AUDIT_OBJECT_CLOSE;
 
        /* Unlock the entry */
        ExUnlockHandleTableEntry(HandleTable, HandleEntry);
    }
    else
    {
        /* Otherwise, fail */
        Status = STATUS_INVALID_HANDLE;
    }
 
    /* Leave the critical region and return the status */
    KeLeaveCriticalRegion();
    return Status;
}

ObQuerySecurityDescriptorInfo()

NTSTATUS NTAPI ObQuerySecurityDescriptorInfo	(	IN PVOID	Object,
		IN PSECURITY_INFORMATION	SecurityInformation,
		OUT PSECURITY_DESCRIPTOR	SecurityDescriptor,
		IN OUT PULONG	Length,
		IN PSECURITY_DESCRIPTOR *	OutputSecurityDescriptor
	)

Definition at line 85 of file obsecure.c.

{
    POBJECT_HEADER ObjectHeader;
    NTSTATUS Status;
    PSECURITY_DESCRIPTOR ObjectSd;
    PAGED_CODE();
 
    /* Get the object header */
    ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
 
    /* Get the SD */
    ObjectSd = ObpReferenceSecurityDescriptor(ObjectHeader);
 
    /* Query the information */
    Status = SeQuerySecurityDescriptorInfo(SecurityInformation,
                                           SecurityDescriptor,
                                           Length,
                                           &ObjectSd);
 
    /* Check if we have an object SD and dereference it, if so */
    if (ObjectSd) ObDereferenceSecurityDescriptor(ObjectSd, 1);
 
    /* Return status */
    return Status;
}

Referenced by SeDefaultObjectMethod(), and WmipSecurityMethod().

ObReleaseObjectSecurity()

VOID NTAPI ObReleaseObjectSecurity	(	IN PSECURITY_DESCRIPTOR	SecurityDescriptor,
		IN BOOLEAN	MemoryAllocated
	)

Definition at line 709 of file obsecure.c.

{
    PAGED_CODE();
 
    /* Nothing to do in this case */
    if (!SecurityDescriptor) return;
 
    /* Check if we had allocated it from memory */
    if (MemoryAllocated)
    {
        /* Free it */
        ExFreePoolWithTag(SecurityDescriptor, TAG_SEC_QUERY);
    }
    else
    {
        /* Otherwise this means we used an internal descriptor */
        ObDereferenceSecurityDescriptor(SecurityDescriptor, 1);
    }
}

Referenced by CreateDeviceSecurityDescriptor(), IntAssignDesktopSecurityOnParse(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObInsertObject(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), PspCreateProcess(), PspCreateThread(), PspSetPrimaryToken(), and TestObRootSecurity().

ObSetSecurityDescriptorInfo()

NTSTATUS NTAPI ObSetSecurityDescriptorInfo	(	IN PVOID	Object,
		IN PSECURITY_INFORMATION	SecurityInformation,
		IN OUT PSECURITY_DESCRIPTOR	SecurityDescriptor,
		IN OUT PSECURITY_DESCRIPTOR *	OutputSecurityDescriptor,
		IN POOL_TYPE	PoolType,
		IN PGENERIC_MAPPING	GenericMapping
	)

Definition at line 117 of file obsecure.c.

{
    NTSTATUS Status;
    POBJECT_HEADER ObjectHeader;
    PSECURITY_DESCRIPTOR OldDescriptor, NewDescriptor, CachedDescriptor;
    PEX_FAST_REF FastRef;
    EX_FAST_REF OldValue;
    ULONG Count;
    PAGED_CODE();
 
    /* Get the object header */
    ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
    while (TRUE)
    {
        /* Reference the old descriptor */
        OldDescriptor = ObpReferenceSecurityDescriptor(ObjectHeader);
        NewDescriptor = OldDescriptor;
 
        /* Set the SD information */
        Status = SeSetSecurityDescriptorInfo(Object,
                                             SecurityInformation,
                                             SecurityDescriptor,
                                             &NewDescriptor,
                                             PoolType,
                                             GenericMapping);
        if (!NT_SUCCESS(Status))
        {
            /* We failed, dereference the old one */
            if (OldDescriptor) ObDereferenceSecurityDescriptor(OldDescriptor, 1);
            break;
        }
 
        /* Now add this to the cache */
        Status = ObLogSecurityDescriptor(NewDescriptor,
                                         &CachedDescriptor,
                                         MAX_FAST_REFS + 1);
 
        /* Let go of our uncached copy */
        ExFreePool(NewDescriptor);
 
        /* Check for success */
        if (!NT_SUCCESS(Status))
        {
            /* We failed, dereference the old one */
            ObDereferenceSecurityDescriptor(OldDescriptor, 1);
            break;
        }
 
        /* Do the swap */
        FastRef = (PEX_FAST_REF)OutputSecurityDescriptor;
        OldValue = ExCompareSwapFastReference(FastRef,
                                              CachedDescriptor,
                                              OldDescriptor);
 
        /* Make sure the swap worked */
        if (ExGetObjectFastReference(OldValue) == OldDescriptor)
        {
            /* Flush waiters */
            ObpAcquireObjectLock(ObjectHeader);
            ObpReleaseObjectLock(ObjectHeader);
 
            /* And dereference the old one */
            Count = ExGetCountFastReference(OldValue);
            ObDereferenceSecurityDescriptor(OldDescriptor, Count + 2);
            break;
        }
        else
        {
            /* Someone changed it behind our back -- try again */
            ObDereferenceSecurityDescriptor(OldDescriptor, 1);
            ObDereferenceSecurityDescriptor(CachedDescriptor,
                                            MAX_FAST_REFS + 1);
        }
    }
 
    /* Return status */
    return Status;
}

Referenced by SeDefaultObjectMethod(), and WmipSecurityMethod().

ObSetSecurityObjectByPointer()

NTSTATUS NTAPI ObSetSecurityObjectByPointer	(	IN PVOID	Object,
		IN SECURITY_INFORMATION	SecurityInformation,
		IN PSECURITY_DESCRIPTOR	SecurityDescriptor
	)

Definition at line 749 of file obsecure.c.

{
    POBJECT_TYPE Type;
    POBJECT_HEADER Header;
    PAGED_CODE();
 
    /* Get the header and type */
    Header = OBJECT_TO_OBJECT_HEADER(Object);
    Type = Header->Type;
 
    /* Sanity check */
    ASSERT(SecurityDescriptor);
 
    /* Call the security procedure */
    return Type->TypeInfo.SecurityProcedure(Object,
                                            SetSecurityDescriptor,
                                            &SecurityInformation,
                                            SecurityDescriptor,
                                            NULL,
                                            &Header->SecurityDescriptor,
                                            Type->TypeInfo.PoolType,
                                            &Type->TypeInfo.GenericMapping);
}

Referenced by NtSetSecurityObject(), and TiSetupTcpDeviceSD().