wine/dlls/advapi32/security.c

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~ [ freetext search ] ~ [ file search ] ~

Version: ~ [ wine-1.1.38 ] ~ [ wine-1.1.37 ] ~ [ wine-1.1.36 ] ~ [ wine-1.1.35 ] ~ [ wine-1.1.34 ] ~ [ wine-1.1.33 ] ~ [ wine-1.1.32 ] ~ [ wine-1.1.31 ] ~ [ wine-1.1.30 ] ~ [ wine-1.1.29 ] ~ [ wine-1.1.28 ] ~ [ wine-1.1.27 ] ~ [ wine-1.1.26 ] ~ [ wine-1.1.25 ] ~ [ wine-1.1.24 ] ~ [ wine-1.1.23 ] ~ [ wine-1.1.22 ] ~ [ wine-1.1.21 ] ~ [ wine-1.1.20 ] ~ [ wine-1.1.19 ] ~ [ wine-1.1.18 ] ~ [ wine-1.1.17 ] ~ [ wine-1.1.16 ] ~ [ wine-1.1.15 ] ~ [ wine-1.1.14 ] ~ [ wine-1.1.13 ] ~ [ wine-1.1.12 ] ~ [ wine-1.1.11 ] ~ [ wine-1.1.10 ] ~ [ wine-1.1.9 ] ~ [ wine-1.1.8 ] ~ [ wine-1.1.7 ] ~ [ wine-1.0.1 ] ~ [ wine-1.1.6 ] ~ [ wine-1.1.5 ] ~ [ wine-1.1.4 ] ~ [ wine-1.1.3 ] ~ [ wine-1.1.2 ] ~ [ wine-1.1.1 ] ~ [ wine-1.1.0 ] ~ [ wine-1.0 ] ~

1 /* 2 * Copyright 1999, 2000 Juergen Schmied <juergen.schmied@debitel.net> 3 * Copyright 2003 CodeWeavers Inc. (Ulrich Czekalla) 4 * Copyright 2006 Robert Reif 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2.1 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, write to the Free Software 18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA 19 * 20 */ 21 22 #include <stdarg.h> 23 #include <string.h> 24 25 #include "ntstatus.h" 26 #define WIN32_NO_STATUS 27 #include "windef.h" 28 #include "winbase.h" 29 #include "winerror.h" 30 #include "winreg.h" 31 #include "winsafer.h" 32 #include "winternl.h" 33 #include "winioctl.h" 34 #include "ntsecapi.h" 35 #include "accctrl.h" 36 #include "sddl.h" 37 #include "winsvc.h" 38 #include "aclapi.h" 39 #include "objbase.h" 40 #include "iads.h" 41 #include "advapi32_misc.h" 42 #include "lmcons.h" 43 44 #include "wine/debug.h" 45 #include "wine/unicode.h" 46 47 WINE_DEFAULT_DEBUG_CHANNEL(advapi); 48 49 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes); 50 static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags, 51 PACL pAcl, LPDWORD cBytes); 52 static BYTE ParseAceStringFlags(LPCWSTR* StringAcl); 53 static BYTE ParseAceStringType(LPCWSTR* StringAcl); 54 static DWORD ParseAceStringRights(LPCWSTR* StringAcl); 55 static BOOL ParseStringSecurityDescriptorToSecurityDescriptor( 56 LPCWSTR StringSecurityDescriptor, 57 SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor, 58 LPDWORD cBytes); 59 static DWORD ParseAclStringFlags(LPCWSTR* StringAcl); 60 61 typedef struct _ACEFLAG 62 { 63 LPCWSTR wstr; 64 DWORD value; 65 } ACEFLAG, *LPACEFLAG; 66 67 typedef struct _MAX_SID 68 { 69 /* same fields as struct _SID */ 70 BYTE Revision; 71 BYTE SubAuthorityCount; 72 SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 73 DWORD SubAuthority[SID_MAX_SUB_AUTHORITIES]; 74 } MAX_SID; 75 76 typedef struct WELLKNOWNSID 77 { 78 WCHAR wstr[2]; 79 WELL_KNOWN_SID_TYPE Type; 80 MAX_SID Sid; 81 } WELLKNOWNSID; 82 83 static const WELLKNOWNSID WellKnownSids[] = 84 { 85 { {0,0}, WinNullSid, { SID_REVISION, 1, { SECURITY_NULL_SID_AUTHORITY }, { SECURITY_NULL_RID } } }, 86 { {'W','D'}, WinWorldSid, { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } } }, 87 { {0,0}, WinLocalSid, { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } } }, 88 { {'C','O'}, WinCreatorOwnerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_RID } } }, 89 { {'C','G'}, WinCreatorGroupSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_RID } } }, 90 { {0,0}, WinCreatorOwnerServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_SERVER_RID } } }, 91 { {0,0}, WinCreatorGroupServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_SERVER_RID } } }, 92 { {0,0}, WinNtAuthoritySid, { SID_REVISION, 0, { SECURITY_NT_AUTHORITY }, { SECURITY_NULL_RID } } }, 93 { {0,0}, WinDialupSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_DIALUP_RID } } }, 94 { {'N','U'}, WinNetworkSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_RID } } }, 95 { {0,0}, WinBatchSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BATCH_RID } } }, 96 { {'I','U'}, WinInteractiveSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } } }, 97 { {'S','U'}, WinServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_SERVICE_RID } } }, 98 { {'A','N'}, WinAnonymousSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } } }, 99 { {0,0}, WinProxySid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PROXY_RID } } }, 100 { {'E','D'}, WinEnterpriseControllersSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ENTERPRISE_CONTROLLERS_RID } } }, 101 { {'P','S'}, WinSelfSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PRINCIPAL_SELF_RID } } }, 102 { {'A','U'}, WinAuthenticatedUserSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } } }, 103 { {'R','C'}, WinRestrictedCodeSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_RESTRICTED_CODE_RID } } }, 104 { {0,0}, WinTerminalServerSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_TERMINAL_SERVER_RID } } }, 105 { {0,0}, WinRemoteLogonIdSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_REMOTE_LOGON_RID } } }, 106 { {'S','Y'}, WinLocalSystemSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } } }, 107 { {'L','S'}, WinLocalServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SERVICE_RID } } }, 108 { {'N','S'}, WinNetworkServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_SERVICE_RID } } }, 109 { {0,0}, WinBuiltinDomainSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID } } }, 110 { {'B','A'}, WinBuiltinAdministratorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } } }, 111 { {'B','U'}, WinBuiltinUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } } }, 112 { {'B','G'}, WinBuiltinGuestsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_GUESTS } } }, 113 { {'P','U'}, WinBuiltinPowerUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_POWER_USERS } } }, 114 { {'A','O'}, WinBuiltinAccountOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ACCOUNT_OPS } } }, 115 { {'S','O'}, WinBuiltinSystemOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_SYSTEM_OPS } } }, 116 { {'P','O'}, WinBuiltinPrintOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PRINT_OPS } } }, 117 { {'B','O'}, WinBuiltinBackupOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_BACKUP_OPS } } }, 118 { {'R','E'}, WinBuiltinReplicatorSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REPLICATOR } } }, 119 { {'R','U'}, WinBuiltinPreWindows2000CompatibleAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PREW2KCOMPACCESS } } }, 120 { {'R','D'}, WinBuiltinRemoteDesktopUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS } } }, 121 { {'N','O'}, WinBuiltinNetworkConfigurationOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS } } }, 122 { {0,0}, WinNTLMAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_NTLM_RID } } }, 123 { {0,0}, WinDigestAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_DIGEST_RID } } }, 124 { {0,0}, WinSChannelAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_SCHANNEL_RID } } }, 125 { {0,0}, WinThisOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_THIS_ORGANIZATION_RID } } }, 126 { {0,0}, WinOtherOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_OTHER_ORGANIZATION_RID } } }, 127 { {0,0}, WinBuiltinIncomingForestTrustBuildersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS } } }, 128 { {0,0}, WinBuiltinPerfMonitoringUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_MONITORING_USERS } } }, 129 { {0,0}, WinBuiltinPerfLoggingUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_LOGGING_USERS } } }, 130 { {0,0}, WinBuiltinAuthorizationAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS } } }, 131 { {0,0}, WinBuiltinTerminalServerLicenseServersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS } } }, 132 { {0,0}, WinBuiltinDCOMUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_DCOM_USERS } } }, 133 { {'L','W'}, WinLowLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_LOW_RID} } }, 134 { {'M','E'}, WinMediumLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_MEDIUM_RID } } }, 135 { {'H','I'}, WinHighLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_HIGH_RID } } }, 136 { {'S','I'}, WinSystemLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_SYSTEM_RID } } }, 137 }; 138 139 /* these SIDs must be constructed as relative to some domain - only the RID is well-known */ 140 typedef struct WELLKNOWNRID 141 { 142 WELL_KNOWN_SID_TYPE Type; 143 DWORD Rid; 144 } WELLKNOWNRID; 145 146 static const WELLKNOWNRID WellKnownRids[] = { 147 { WinAccountAdministratorSid, DOMAIN_USER_RID_ADMIN }, 148 { WinAccountGuestSid, DOMAIN_USER_RID_GUEST }, 149 { WinAccountKrbtgtSid, DOMAIN_USER_RID_KRBTGT }, 150 { WinAccountDomainAdminsSid, DOMAIN_GROUP_RID_ADMINS }, 151 { WinAccountDomainUsersSid, DOMAIN_GROUP_RID_USERS }, 152 { WinAccountDomainGuestsSid, DOMAIN_GROUP_RID_GUESTS }, 153 { WinAccountComputersSid, DOMAIN_GROUP_RID_COMPUTERS }, 154 { WinAccountControllersSid, DOMAIN_GROUP_RID_CONTROLLERS }, 155 { WinAccountCertAdminsSid, DOMAIN_GROUP_RID_CERT_ADMINS }, 156 { WinAccountSchemaAdminsSid, DOMAIN_GROUP_RID_SCHEMA_ADMINS }, 157 { WinAccountEnterpriseAdminsSid, DOMAIN_GROUP_RID_ENTERPRISE_ADMINS }, 158 { WinAccountPolicyAdminsSid, DOMAIN_GROUP_RID_POLICY_ADMINS }, 159 { WinAccountRasAndIasServersSid, DOMAIN_ALIAS_RID_RAS_SERVERS }, 160 }; 161 162 163 static SID const sidWorld = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY} , { SECURITY_WORLD_RID } }; 164 165 typedef struct _AccountSid { 166 WELL_KNOWN_SID_TYPE type; 167 LPCWSTR account; 168 LPCWSTR domain; 169 SID_NAME_USE name_use; 170 LPCWSTR alias; 171 } AccountSid; 172 173 static const WCHAR Account_Operators[] = { 'A','c','c','o','u','n','t',' ','O','p','e','r','a','t','o','r','s',0 }; 174 static const WCHAR Administrator[] = {'A','d','m','i','n','i','s','t','r','a','t','o','r',0 }; 175 static const WCHAR Administrators[] = { 'A','d','m','i','n','i','s','t','r','a','t','o','r','s',0 }; 176 static const WCHAR ANONYMOUS_LOGON[] = { 'A','N','O','N','Y','M','O','U','S',' ','L','O','G','O','N',0 }; 177 static const WCHAR Authenticated_Users[] = { 'A','u','t','h','e','n','t','i','c','a','t','e','d',' ','U','s','e','r','s',0 }; 178 static const WCHAR Backup_Operators[] = { 'B','a','c','k','u','p',' ','O','p','e','r','a','t','o','r','s',0 }; 179 static const WCHAR BATCH[] = { 'B','A','T','C','H',0 }; 180 static const WCHAR Blank[] = { 0 }; 181 static const WCHAR BUILTIN[] = { 'B','U','I','L','T','I','N',0 }; 182 static const WCHAR Cert_Publishers[] = { 'C','e','r','t',' ','P','u','b','l','i','s','h','e','r','s',0 }; 183 static const WCHAR CREATOR_GROUP[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',0 }; 184 static const WCHAR CREATOR_GROUP_SERVER[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',' ','S','E','R','V','E','R',0 }; 185 static const WCHAR CREATOR_OWNER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',0 }; 186 static const WCHAR CREATOR_OWNER_SERVER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',' ','S','E','R','V','E','R',0 }; 187 static const WCHAR CURRENT_USER[] = { 'C','U','R','R','E','N','T','_','U','S','E','R',0 }; 188 static const WCHAR DIALUP[] = { 'D','I','A','L','U','P',0 }; 189 static const WCHAR Digest_Authentication[] = { 'D','i','g','e','s','t',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 }; 190 static const WCHAR DOMAIN[] = {'D','O','M','A','I','N',0}; 191 static const WCHAR Domain_Admins[] = { 'D','o','m','a','i','n',' ','A','d','m','i','n','s',0 }; 192 static const WCHAR Domain_Computers[] = { 'D','o','m','a','i','n',' ','C','o','m','p','u','t','e','r','s',0 }; 193 static const WCHAR Domain_Controllers[] = { 'D','o','m','a','i','n',' ','C','o','n','t','r','o','l','l','e','r','s',0 }; 194 static const WCHAR Domain_Guests[] = { 'D','o','m','a','i','n',' ','G','u','e','s','t','s',0 }; 195 static const WCHAR Domain_Users[] = { 'D','o','m','a','i','n',' ','U','s','e','r','s',0 }; 196 static const WCHAR Enterprise_Admins[] = { 'E','n','t','e','r','p','r','i','s','e',' ','A','d','m','i','n','s',0 }; 197 static const WCHAR ENTERPRISE_DOMAIN_CONTROLLERS[] = { 'E','N','T','E','R','P','R','I','S','E',' ','D','O','M','A','I','N',' ','C','O','N','T','R','O','L','L','E','R','S',0 }; 198 static const WCHAR Everyone[] = { 'E','v','e','r','y','o','n','e',0 }; 199 static const WCHAR Group_Policy_Creator_Owners[] = { 'G','r','o','u','p',' ','P','o','l','i','c','y',' ','C','r','e','a','t','o','r',' ','O','w','n','e','r','s',0 }; 200 static const WCHAR Guest[] = { 'G','u','e','s','t',0 }; 201 static const WCHAR Guests[] = { 'G','u','e','s','t','s',0 }; 202 static const WCHAR INTERACTIVE[] = { 'I','N','T','E','R','A','C','T','I','V','E',0 }; 203 static const WCHAR LOCAL[] = { 'L','O','C','A','L',0 }; 204 static const WCHAR LOCAL_SERVICE[] = { 'L','O','C','A','L',' ','S','E','R','V','I','C','E',0 }; 205 static const WCHAR LOCAL_SERVICE2[] = { 'L','O','C','A','L','S','E','R','V','I','C','E',0 }; 206 static const WCHAR NETWORK[] = { 'N','E','T','W','O','R','K',0 }; 207 static const WCHAR Network_Configuration_Operators[] = { 'N','e','t','w','o','r','k',' ','C','o','n','f','i','g','u','r','a','t','i','o','n',' ','O','p','e','r','a','t','o','r','s',0 }; 208 static const WCHAR NETWORK_SERVICE[] = { 'N','E','T','W','O','R','K',' ','S','E','R','V','I','C','E',0 }; 209 static const WCHAR NETWORK_SERVICE2[] = { 'N','E','T','W','O','R','K','S','E','R','V','I','C','E',0 }; 210 static const WCHAR NT_AUTHORITY[] = { 'N','T',' ','A','U','T','H','O','R','I','T','Y',0 }; 211 static const WCHAR NT_Pseudo_Domain[] = { 'N','T',' ','P','s','e','u','d','o',' ','D','o','m','a','i','n',0 }; 212 static const WCHAR NTML_Authentication[] = { 'N','T','M','L',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 }; 213 static const WCHAR NULL_SID[] = { 'N','U','L','L',' ','S','I','D',0 }; 214 static const WCHAR Other_Organization[] = { 'O','t','h','e','r',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 }; 215 static const WCHAR Performance_Log_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','L','o','g',' ','U','s','e','r','s',0 }; 216 static const WCHAR Performance_Monitor_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','M','o','n','i','t','o','r',' ','U','s','e','r','s',0 }; 217 static const WCHAR Power_Users[] = { 'P','o','w','e','r',' ','U','s','e','r','s',0 }; 218 static const WCHAR Pre_Windows_2000_Compatible_Access[] = { 'P','r','e','-','W','i','n','d','o','w','s',' ','2','','','',' ','C','o','m','p','a','t','i','b','l','e',' ','A','c','c','e','s','s',0 }; 219 static const WCHAR Print_Operators[] = { 'P','r','i','n','t',' ','O','p','e','r','a','t','o','r','s',0 }; 220 static const WCHAR PROXY[] = { 'P','R','O','X','Y',0 }; 221 static const WCHAR RAS_and_IAS_Servers[] = { 'R','A','S',' ','a','n','d',' ','I','A','S',' ','S','e','r','v','e','r','s',0 }; 222 static const WCHAR Remote_Desktop_Users[] = { 'R','e','m','o','t','e',' ','D','e','s','k','t','o','p',' ','U','s','e','r','s',0 }; 223 static const WCHAR REMOTE_INTERACTIVE_LOGON[] = { 'R','E','M','O','T','E',' ','I','N','T','E','R','A','C','T','I','V','E',' ','L','O','G','O','N',0 }; 224 static const WCHAR Replicators[] = { 'R','e','p','l','i','c','a','t','o','r','s',0 }; 225 static const WCHAR RESTRICTED[] = { 'R','E','S','T','R','I','C','T','E','D',0 }; 226 static const WCHAR SChannel_Authentication[] = { 'S','C','h','a','n','n','e','l',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 }; 227 static const WCHAR Schema_Admins[] = { 'S','c','h','e','m','a',' ','A','d','m','i','n','s',0 }; 228 static const WCHAR SELF[] = { 'S','E','L','F',0 }; 229 static const WCHAR Server_Operators[] = { 'S','e','r','v','e','r',' ','O','p','e','r','a','t','o','r','s',0 }; 230 static const WCHAR SERVICE[] = { 'S','E','R','V','I','C','E',0 }; 231 static const WCHAR SYSTEM[] = { 'S','Y','S','T','E','M',0 }; 232 static const WCHAR TERMINAL_SERVER_USER[] = { 'T','E','R','M','I','N','A','L',' ','S','E','R','V','E','R',' ','U','S','E','R',0 }; 233 static const WCHAR This_Organization[] = { 'T','h','i','s',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 }; 234 static const WCHAR Users[] = { 'U','s','e','r','s',0 }; 235 236 static const AccountSid ACCOUNT_SIDS[] = { 237 { WinNullSid, NULL_SID, Blank, SidTypeWellKnownGroup }, 238 { WinWorldSid, Everyone, Blank, SidTypeWellKnownGroup }, 239 { WinLocalSid, LOCAL, Blank, SidTypeWellKnownGroup }, 240 { WinCreatorOwnerSid, CREATOR_OWNER, Blank, SidTypeWellKnownGroup }, 241 { WinCreatorGroupSid, CREATOR_GROUP, Blank, SidTypeWellKnownGroup }, 242 { WinCreatorOwnerServerSid, CREATOR_OWNER_SERVER, Blank, SidTypeWellKnownGroup }, 243 { WinCreatorGroupServerSid, CREATOR_GROUP_SERVER, Blank, SidTypeWellKnownGroup }, 244 { WinNtAuthoritySid, NT_Pseudo_Domain, NT_Pseudo_Domain, SidTypeDomain }, 245 { WinDialupSid, DIALUP, NT_AUTHORITY, SidTypeWellKnownGroup }, 246 { WinNetworkSid, NETWORK, NT_AUTHORITY, SidTypeWellKnownGroup }, 247 { WinBatchSid, BATCH, NT_AUTHORITY, SidTypeWellKnownGroup }, 248 { WinInteractiveSid, INTERACTIVE, NT_AUTHORITY, SidTypeWellKnownGroup }, 249 { WinServiceSid, SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup }, 250 { WinAnonymousSid, ANONYMOUS_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup }, 251 { WinProxySid, PROXY, NT_AUTHORITY, SidTypeWellKnownGroup }, 252 { WinEnterpriseControllersSid, ENTERPRISE_DOMAIN_CONTROLLERS, NT_AUTHORITY, SidTypeWellKnownGroup }, 253 { WinSelfSid, SELF, NT_AUTHORITY, SidTypeWellKnownGroup }, 254 { WinAuthenticatedUserSid, Authenticated_Users, NT_AUTHORITY, SidTypeWellKnownGroup }, 255 { WinRestrictedCodeSid, RESTRICTED, NT_AUTHORITY, SidTypeWellKnownGroup }, 256 { WinTerminalServerSid, TERMINAL_SERVER_USER, NT_AUTHORITY, SidTypeWellKnownGroup }, 257 { WinRemoteLogonIdSid, REMOTE_INTERACTIVE_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup }, 258 { WinLocalSystemSid, SYSTEM, NT_AUTHORITY, SidTypeWellKnownGroup }, 259 { WinLocalServiceSid, LOCAL_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup, LOCAL_SERVICE2 }, 260 { WinNetworkServiceSid, NETWORK_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup , NETWORK_SERVICE2}, 261 { WinBuiltinDomainSid, BUILTIN, BUILTIN, SidTypeDomain }, 262 { WinBuiltinAdministratorsSid, Administrators, BUILTIN, SidTypeAlias }, 263 { WinBuiltinUsersSid, Users, BUILTIN, SidTypeAlias }, 264 { WinBuiltinGuestsSid, Guests, BUILTIN, SidTypeAlias }, 265 { WinBuiltinPowerUsersSid, Power_Users, BUILTIN, SidTypeAlias }, 266 { WinBuiltinAccountOperatorsSid, Account_Operators, BUILTIN, SidTypeAlias }, 267 { WinBuiltinSystemOperatorsSid, Server_Operators, BUILTIN, SidTypeAlias }, 268 { WinBuiltinPrintOperatorsSid, Print_Operators, BUILTIN, SidTypeAlias }, 269 { WinBuiltinBackupOperatorsSid, Backup_Operators, BUILTIN, SidTypeAlias }, 270 { WinBuiltinReplicatorSid, Replicators, BUILTIN, SidTypeAlias }, 271 { WinBuiltinPreWindows2000CompatibleAccessSid, Pre_Windows_2000_Compatible_Access, BUILTIN, SidTypeAlias }, 272 { WinBuiltinRemoteDesktopUsersSid, Remote_Desktop_Users, BUILTIN, SidTypeAlias }, 273 { WinBuiltinNetworkConfigurationOperatorsSid, Network_Configuration_Operators, BUILTIN, SidTypeAlias }, 274 { WinNTLMAuthenticationSid, NTML_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup }, 275 { WinDigestAuthenticationSid, Digest_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup }, 276 { WinSChannelAuthenticationSid, SChannel_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup }, 277 { WinThisOrganizationSid, This_Organization, NT_AUTHORITY, SidTypeWellKnownGroup }, 278 { WinOtherOrganizationSid, Other_Organization, NT_AUTHORITY, SidTypeWellKnownGroup }, 279 { WinBuiltinPerfMonitoringUsersSid, Performance_Monitor_Users, BUILTIN, SidTypeAlias }, 280 { WinBuiltinPerfLoggingUsersSid, Performance_Log_Users, BUILTIN, SidTypeAlias }, 281 }; 282 /* 283 * ACE access rights 284 */ 285 static const WCHAR SDDL_READ_CONTROL[] = {'R','C',0}; 286 static const WCHAR SDDL_WRITE_DAC[] = {'W','D',0}; 287 static const WCHAR SDDL_WRITE_OWNER[] = {'W','O',0}; 288 static const WCHAR SDDL_STANDARD_DELETE[] = {'S','D',0}; 289 290 static const WCHAR SDDL_READ_PROPERTY[] = {'R','P',0}; 291 static const WCHAR SDDL_WRITE_PROPERTY[] = {'W','P',0}; 292 static const WCHAR SDDL_CREATE_CHILD[] = {'C','C',0}; 293 static const WCHAR SDDL_DELETE_CHILD[] = {'D','C',0}; 294 static const WCHAR SDDL_LIST_CHILDREN[] = {'L','C',0}; 295 static const WCHAR SDDL_SELF_WRITE[] = {'S','W',0}; 296 static const WCHAR SDDL_LIST_OBJECT[] = {'L','O',0}; 297 static const WCHAR SDDL_DELETE_TREE[] = {'D','T',0}; 298 static const WCHAR SDDL_CONTROL_ACCESS[] = {'C','R',0}; 299 300 static const WCHAR SDDL_FILE_ALL[] = {'F','A',0}; 301 static const WCHAR SDDL_FILE_READ[] = {'F','R',0}; 302 static const WCHAR SDDL_FILE_WRITE[] = {'F','W',0}; 303 static const WCHAR SDDL_FILE_EXECUTE[] = {'F','X',0}; 304 305 static const WCHAR SDDL_KEY_ALL[] = {'K','A',0}; 306 static const WCHAR SDDL_KEY_READ[] = {'K','R',0}; 307 static const WCHAR SDDL_KEY_WRITE[] = {'K','W',0}; 308 static const WCHAR SDDL_KEY_EXECUTE[] = {'K','X',0}; 309 310 static const WCHAR SDDL_GENERIC_ALL[] = {'G','A',0}; 311 static const WCHAR SDDL_GENERIC_READ[] = {'G','R',0}; 312 static const WCHAR SDDL_GENERIC_WRITE[] = {'G','W',0}; 313 static const WCHAR SDDL_GENERIC_EXECUTE[] = {'G','X',0}; 314 315 /* 316 * ACL flags 317 */ 318 static const WCHAR SDDL_PROTECTED[] = {'P',0}; 319 static const WCHAR SDDL_AUTO_INHERIT_REQ[] = {'A','R',0}; 320 static const WCHAR SDDL_AUTO_INHERITED[] = {'A','I',0}; 321 322 /* 323 * ACE types 324 */ 325 static const WCHAR SDDL_ACCESS_ALLOWED[] = {'A',0}; 326 static const WCHAR SDDL_ACCESS_DENIED[] = {'D',0}; 327 static const WCHAR SDDL_OBJECT_ACCESS_ALLOWED[] = {'O','A',0}; 328 static const WCHAR SDDL_OBJECT_ACCESS_DENIED[] = {'O','D',0}; 329 static const WCHAR SDDL_AUDIT[] = {'A','U',0}; 330 static const WCHAR SDDL_ALARM[] = {'A','L',0}; 331 static const WCHAR SDDL_OBJECT_AUDIT[] = {'O','U',0}; 332 static const WCHAR SDDL_OBJECT_ALARMp[] = {'O','L',0}; 333 334 /* 335 * ACE flags 336 */ 337 static const WCHAR SDDL_CONTAINER_INHERIT[] = {'C','I',0}; 338 static const WCHAR SDDL_OBJECT_INHERIT[] = {'O','I',0}; 339 static const WCHAR SDDL_NO_PROPAGATE[] = {'N','P',0}; 340 static const WCHAR SDDL_INHERIT_ONLY[] = {'I','O',0}; 341 static const WCHAR SDDL_INHERITED[] = {'I','D',0}; 342 static const WCHAR SDDL_AUDIT_SUCCESS[] = {'S','A',0}; 343 static const WCHAR SDDL_AUDIT_FAILURE[] = {'F','A',0}; 344 345 const char * debugstr_sid(PSID sid) 346 { 347 int auth = 0; 348 SID * psid = sid; 349 350 if (psid == NULL) 351 return "(null)"; 352 353 auth = psid->IdentifierAuthority.Value[5] + 354 (psid->IdentifierAuthority.Value[4] << 8) + 355 (psid->IdentifierAuthority.Value[3] << 16) + 356 (psid->IdentifierAuthority.Value[2] << 24); 357 358 switch (psid->SubAuthorityCount) { 359 case 0: 360 return wine_dbg_sprintf("S-%d-%d", psid->Revision, auth); 361 case 1: 362 return wine_dbg_sprintf("S-%d-%d-%u", psid->Revision, auth, 363 psid->SubAuthority[0]); 364 case 2: 365 return wine_dbg_sprintf("S-%d-%d-%u-%u", psid->Revision, auth, 366 psid->SubAuthority[0], psid->SubAuthority[1]); 367 case 3: 368 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u", psid->Revision, auth, 369 psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2]); 370 case 4: 371 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u", psid->Revision, auth, 372 psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2], 373 psid->SubAuthority[3]); 374 case 5: 375 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u", psid->Revision, auth, 376 psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2], 377 psid->SubAuthority[3], psid->SubAuthority[4]); 378 case 6: 379 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u", psid->Revision, auth, 380 psid->SubAuthority[3], psid->SubAuthority[1], psid->SubAuthority[2], 381 psid->SubAuthority[0], psid->SubAuthority[4], psid->SubAuthority[5]); 382 case 7: 383 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth, 384 psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2], 385 psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5], 386 psid->SubAuthority[6]); 387 case 8: 388 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth, 389 psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2], 390 psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5], 391 psid->SubAuthority[6], psid->SubAuthority[7]); 392 } 393 return "(too-big)"; 394 } 395 396 /* set last error code from NT status and get the proper boolean return value */ 397 /* used for functions that are a simple wrapper around the corresponding ntdll API */ 398 static inline BOOL set_ntstatus( NTSTATUS status ) 399 { 400 if (status) SetLastError( RtlNtStatusToDosError( status )); 401 return !status; 402 } 403 404 #define WINE_SIZE_OF_WORLD_ACCESS_ACL (sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD)) 405 406 static void GetWorldAccessACL(PACL pACL) 407 { 408 PACCESS_ALLOWED_ACE pACE = (PACCESS_ALLOWED_ACE) (pACL + 1); 409 410 pACL->AclRevision = ACL_REVISION; 411 pACL->Sbz1 = 0; 412 pACL->AclSize = WINE_SIZE_OF_WORLD_ACCESS_ACL; 413 pACL->AceCount = 1; 414 pACL->Sbz2 = 0; 415 416 pACE->Header.AceType = ACCESS_ALLOWED_ACE_TYPE; 417 pACE->Header.AceFlags = CONTAINER_INHERIT_ACE; 418 pACE->Header.AceSize = sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD); 419 pACE->Mask = 0xf3ffffff; /* Everything except reserved bits */ 420 memcpy(&pACE->SidStart, &sidWorld, sizeof(sidWorld)); 421 } 422 423 /************************************************************ 424 * ADVAPI_IsLocalComputer 425 * 426 * Checks whether the server name indicates local machine. 427 */ 428 BOOL ADVAPI_IsLocalComputer(LPCWSTR ServerName) 429 { 430 DWORD dwSize = MAX_COMPUTERNAME_LENGTH + 1; 431 BOOL Result; 432 LPWSTR buf; 433 434 if (!ServerName || !ServerName[0]) 435 return TRUE; 436 437 buf = HeapAlloc(GetProcessHeap(), 0, dwSize * sizeof(WCHAR)); 438 Result = GetComputerNameW(buf, &dwSize); 439 if (Result && (ServerName[0] == '\\') && (ServerName[1] == '\\')) 440 ServerName += 2; 441 Result = Result && !lstrcmpW(ServerName, buf); 442 HeapFree(GetProcessHeap(), 0, buf); 443 444 return Result; 445 } 446 447 /************************************************************ 448 * ADVAPI_GetComputerSid 449 * 450 * Reads the computer SID from the registry. 451 */ 452 BOOL ADVAPI_GetComputerSid(PSID sid) 453 { 454 HKEY key; 455 LONG ret; 456 BOOL retval = FALSE; 457 static const WCHAR Account[] = { 'S','E','C','U','R','I','T','Y','\\','S','A','M','\\','D','o','m','a','i','n','s','\\','A','c','c','o','u','n','t',0 }; 458 static const WCHAR V[] = { 'V',0 }; 459 460 if ((ret = RegOpenKeyExW(HKEY_LOCAL_MACHINE, Account, 0, 461 KEY_READ, &key)) == ERROR_SUCCESS) 462 { 463 DWORD size = 0; 464 ret = RegQueryValueExW(key, V, NULL, NULL, NULL, &size); 465 if (ret == ERROR_MORE_DATA || ret == ERROR_SUCCESS) 466 { 467 BYTE * data = HeapAlloc(GetProcessHeap(), 0, size); 468 if (data) 469 { 470 if ((ret = RegQueryValueExW(key, V, NULL, NULL, 471 data, &size)) == ERROR_SUCCESS) 472 { 473 /* the SID is in the last 24 bytes of the binary data */ 474 CopyMemory(sid, &data[size-24], 24); 475 retval = TRUE; 476 } 477 HeapFree(GetProcessHeap(), 0, data); 478 } 479 } 480 RegCloseKey(key); 481 } 482 483 if(retval == TRUE) return retval; 484 485 /* create a new random SID */ 486 if (RegCreateKeyExW(HKEY_LOCAL_MACHINE, Account, 487 0, NULL, 0, KEY_ALL_ACCESS, NULL, &key, NULL) == ERROR_SUCCESS) 488 { 489 PSID new_sid; 490 SID_IDENTIFIER_AUTHORITY identifierAuthority = {SECURITY_NT_AUTHORITY}; 491 DWORD id[3]; 492 493 if (RtlGenRandom(id, sizeof(id))) 494 { 495 if (AllocateAndInitializeSid(&identifierAuthority, 4, SECURITY_NT_NON_UNIQUE, id[0], id[1], id[2], 0, 0, 0, 0, &new_sid)) 496 { 497 if (RegSetValueExW(key, V, 0, REG_BINARY, new_sid, GetLengthSid(new_sid)) == ERROR_SUCCESS) 498 retval = CopySid(GetLengthSid(new_sid), sid, new_sid); 499 500 FreeSid(new_sid); 501 } 502 } 503 RegCloseKey(key); 504 } 505 506 return retval; 507 } 508 509 /* ############################## 510 ###### TOKEN FUNCTIONS ###### 511 ############################## 512 */ 513 514 /****************************************************************************** 515 * OpenProcessToken [ADVAPI32.@] 516 * Opens the access token associated with a process handle. 517 * 518 * PARAMS 519 * ProcessHandle [I] Handle to process 520 * DesiredAccess [I] Desired access to process 521 * TokenHandle [O] Pointer to handle of open access token 522 * 523 * RETURNS 524 * Success: TRUE. TokenHandle contains the access token. 525 * Failure: FALSE. 526 * 527 * NOTES 528 * See NtOpenProcessToken. 529 */ 530 BOOL WINAPI 531 OpenProcessToken( HANDLE ProcessHandle, DWORD DesiredAccess, 532 HANDLE *TokenHandle ) 533 { 534 return set_ntstatus(NtOpenProcessToken( ProcessHandle, DesiredAccess, TokenHandle )); 535 } 536 537 /****************************************************************************** 538 * OpenThreadToken [ADVAPI32.@] 539 * 540 * Opens the access token associated with a thread handle. 541 * 542 * PARAMS 543 * ThreadHandle [I] Handle to process 544 * DesiredAccess [I] Desired access to the thread 545 * OpenAsSelf [I] ??? 546 * TokenHandle [O] Destination for the token handle 547 * 548 * RETURNS 549 * Success: TRUE. TokenHandle contains the access token. 550 * Failure: FALSE. 551 * 552 * NOTES 553 * See NtOpenThreadToken. 554 */ 555 BOOL WINAPI 556 OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess, 557 BOOL OpenAsSelf, HANDLE *TokenHandle) 558 { 559 return set_ntstatus( NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle)); 560 } 561 562 BOOL WINAPI 563 AdjustTokenGroups( HANDLE TokenHandle, BOOL ResetToDefault, PTOKEN_GROUPS NewState, 564 DWORD BufferLength, PTOKEN_GROUPS PreviousState, PDWORD ReturnLength ) 565 { 566 return set_ntstatus( NtAdjustGroupsToken(TokenHandle, ResetToDefault, NewState, BufferLength, 567 PreviousState, ReturnLength)); 568 } 569 570 /****************************************************************************** 571 * AdjustTokenPrivileges [ADVAPI32.@] 572 * 573 * Adjust the privileges of an open token handle. 574 * 575 * PARAMS 576 * TokenHandle [I] Handle from OpenProcessToken() or OpenThreadToken() 577 * DisableAllPrivileges [I] TRUE=Remove all privileges, FALSE=Use NewState 578 * NewState [I] Desired new privileges of the token 579 * BufferLength [I] Length of NewState 580 * PreviousState [O] Destination for the previous state 581 * ReturnLength [I/O] Size of PreviousState 582 * 583 * 584 * RETURNS 585 * Success: TRUE. Privileges are set to NewState and PreviousState is updated. 586 * Failure: FALSE. 587 * 588 * NOTES 589 * See NtAdjustPrivilegesToken. 590 */ 591 BOOL WINAPI 592 AdjustTokenPrivileges( HANDLE TokenHandle, BOOL DisableAllPrivileges, 593 PTOKEN_PRIVILEGES NewState, DWORD BufferLength, 594 PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength ) 595 { 596 NTSTATUS status; 597 598 TRACE("\n"); 599 600 status = NtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges, 601 NewState, BufferLength, PreviousState, 602 ReturnLength); 603 SetLastError( RtlNtStatusToDosError( status )); 604 if ((status == STATUS_SUCCESS) || (status == STATUS_NOT_ALL_ASSIGNED)) 605 return TRUE; 606 else 607 return FALSE; 608 } 609 610 /****************************************************************************** 611 * CheckTokenMembership [ADVAPI32.@] 612 * 613 * Determine if an access token is a member of a SID. 614 * 615 * PARAMS 616 * TokenHandle [I] Handle from OpenProcessToken() or OpenThreadToken() 617 * SidToCheck [I] SID that possibly contains the token 618 * IsMember [O] Destination for result. 619 * 620 * RETURNS 621 * Success: TRUE. IsMember is TRUE if TokenHandle is a member, FALSE otherwise. 622 * Failure: FALSE. 623 */ 624 BOOL WINAPI 625 CheckTokenMembership( HANDLE token, PSID sid_to_check, 626 PBOOL is_member ) 627 { 628 PTOKEN_GROUPS token_groups = NULL; 629 HANDLE thread_token = NULL; 630 DWORD size, i; 631 BOOL ret; 632 633 TRACE("(%p %s %p)\n", token, debugstr_sid(sid_to_check), is_member); 634 635 *is_member = FALSE; 636 637 if (!token) 638 { 639 if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &thread_token)) 640 { 641 HANDLE process_token; 642 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &process_token); 643 if (!ret) 644 goto exit; 645 ret = DuplicateTokenEx(process_token, TOKEN_QUERY, 646 NULL, SecurityImpersonation, TokenImpersonation, 647 &thread_token); 648 CloseHandle(process_token); 649 if (!ret) 650 goto exit; 651 } 652 token = thread_token; 653 } 654 655 ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size); 656 if (!ret && GetLastError() != ERROR_INSUFFICIENT_BUFFER) 657 goto exit; 658 659 token_groups = HeapAlloc(GetProcessHeap(), 0, size); 660 if (!token_groups) 661 { 662 ret = FALSE; 663 goto exit; 664 } 665 666 ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size); 667 if (!ret) 668 goto exit; 669 670 for (i = 0; i < token_groups->GroupCount; i++) 671 { 672 TRACE("Groups[%d]: {0x%x, %s}\n", i, 673 token_groups->Groups[i].Attributes, 674 debugstr_sid(token_groups->Groups[i].Sid)); 675 if ((token_groups->Groups[i].Attributes & SE_GROUP_ENABLED) && 676 EqualSid(sid_to_check, token_groups->Groups[i].Sid)) 677 { 678 *is_member = TRUE; 679 TRACE("sid enabled and found in token\n"); 680 break; 681 } 682 } 683 684 exit: 685 HeapFree(GetProcessHeap(), 0, token_groups); 686 if (thread_token != NULL) CloseHandle(thread_token); 687 688 return ret; 689 } 690 691 /****************************************************************************** 692 * GetTokenInformation [ADVAPI32.@] 693 * 694 * Get a type of information about an access token. 695 * 696 * PARAMS 697 * token [I] Handle from OpenProcessToken() or OpenThreadToken() 698 * tokeninfoclass [I] A TOKEN_INFORMATION_CLASS from "winnt.h" 699 * tokeninfo [O] Destination for token information 700 * tokeninfolength [I] Length of tokeninfo 701 * retlen [O] Destination for returned token information length 702 * 703 * RETURNS 704 * Success: TRUE. tokeninfo contains retlen bytes of token information 705 * Failure: FALSE. 706 * 707 * NOTES 708 * See NtQueryInformationToken. 709 */ 710 BOOL WINAPI 711 GetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass, 712 LPVOID tokeninfo, DWORD tokeninfolength, LPDWORD retlen ) 713 { 714 TRACE("(%p, %s, %p, %d, %p):\n", 715 token, 716 (tokeninfoclass == TokenUser) ? "TokenUser" : 717 (tokeninfoclass == TokenGroups) ? "TokenGroups" : 718 (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" : 719 (tokeninfoclass == TokenOwner) ? "TokenOwner" : 720 (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" : 721 (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" : 722 (tokeninfoclass == TokenSource) ? "TokenSource" : 723 (tokeninfoclass == TokenType) ? "TokenType" : 724 (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" : 725 (tokeninfoclass == TokenStatistics) ? "TokenStatistics" : 726 (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" : 727 (tokeninfoclass == TokenSessionId) ? "TokenSessionId" : 728 (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" : 729 (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" : 730 (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" : 731 "Unknown", 732 tokeninfo, tokeninfolength, retlen); 733 return set_ntstatus( NtQueryInformationToken( token, tokeninfoclass, tokeninfo, 734 tokeninfolength, retlen)); 735 } 736 737 /****************************************************************************** 738 * SetTokenInformation [ADVAPI32.@] 739 * 740 * Set information for an access token. 741 * 742 * PARAMS 743 * token [I] Handle from OpenProcessToken() or OpenThreadToken() 744 * tokeninfoclass [I] A TOKEN_INFORMATION_CLASS from "winnt.h" 745 * tokeninfo [I] Token information to set 746 * tokeninfolength [I] Length of tokeninfo 747 * 748 * RETURNS 749 * Success: TRUE. The information for the token is set to tokeninfo. 750 * Failure: FALSE. 751 */ 752 BOOL WINAPI 753 SetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass, 754 LPVOID tokeninfo, DWORD tokeninfolength ) 755 { 756 TRACE("(%p, %s, %p, %d): stub\n", 757 token, 758 (tokeninfoclass == TokenUser) ? "TokenUser" : 759 (tokeninfoclass == TokenGroups) ? "TokenGroups" : 760 (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" : 761 (tokeninfoclass == TokenOwner) ? "TokenOwner" : 762 (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" : 763 (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" : 764 (tokeninfoclass == TokenSource) ? "TokenSource" : 765 (tokeninfoclass == TokenType) ? "TokenType" : 766 (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" : 767 (tokeninfoclass == TokenStatistics) ? "TokenStatistics" : 768 (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" : 769 (tokeninfoclass == TokenSessionId) ? "TokenSessionId" : 770 (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" : 771 (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" : 772 (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" : 773 "Unknown", 774 tokeninfo, tokeninfolength); 775 776 return set_ntstatus( NtSetInformationToken( token, tokeninfoclass, tokeninfo, tokeninfolength )); 777 } 778 779 /************************************************************************* 780 * SetThreadToken [ADVAPI32.@] 781 * 782 * Assigns an 'impersonation token' to a thread so it can assume the 783 * security privileges of another thread or process. Can also remove 784 * a previously assigned token. 785 * 786 * PARAMS 787 * thread [O] Handle to thread to set the token for 788 * token [I] Token to set 789 * 790 * RETURNS 791 * Success: TRUE. The threads access token is set to token 792 * Failure: FALSE. 793 * 794 * NOTES 795 * Only supported on NT or higher. On Win9X this function does nothing. 796 * See SetTokenInformation. 797 */ 798 BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token) 799 { 800 return set_ntstatus( NtSetInformationThread( thread ? *thread : GetCurrentThread(), 801 ThreadImpersonationToken, &token, sizeof token )); 802 } 803 804 /************************************************************************* 805 * CreateRestrictedToken [ADVAPI32.@] 806 * 807 * Create a new more restricted token from an existing token. 808 * 809 * PARAMS 810 * baseToken [I] Token to base the new restricted token on 811 * flags [I] Options 812 * nDisableSids [I] Length of disableSids array 813 * disableSids [I] Array of SIDs to disable in the new token 814 * nDeletePrivs [I] Length of deletePrivs array 815 * deletePrivs [I] Array of privileges to delete in the new token 816 * nRestrictSids [I] Length of restrictSids array 817 * restrictSids [I] Array of SIDs to restrict in the new token 818 * newToken [O] Address where the new token is stored 819 * 820 * RETURNS 821 * Success: TRUE 822 * Failure: FALSE 823 */ 824 BOOL WINAPI CreateRestrictedToken( 825 HANDLE baseToken, 826 DWORD flags, 827 DWORD nDisableSids, 828 PSID_AND_ATTRIBUTES disableSids, 829 DWORD nDeletePrivs, 830 PLUID_AND_ATTRIBUTES deletePrivs, 831 DWORD nRestrictSids, 832 PSID_AND_ATTRIBUTES restrictSids, 833 PHANDLE newToken) 834 { 835 FIXME("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p): stub\n", 836 baseToken, flags, nDisableSids, disableSids, 837 nDeletePrivs, deletePrivs, 838 nRestrictSids, restrictSids, 839 newToken); 840 SetLastError(ERROR_CALL_NOT_IMPLEMENTED); 841 return FALSE; 842 } 843 844 /* ############################## 845 ###### SID FUNCTIONS ###### 846 ############################## 847 */ 848 849 /****************************************************************************** 850 * AllocateAndInitializeSid [ADVAPI32.@] 851 * 852 * PARAMS 853 * pIdentifierAuthority [] 854 * nSubAuthorityCount [] 855 * nSubAuthority0 [] 856 * nSubAuthority1 [] 857 * nSubAuthority2 [] 858 * nSubAuthority3 [] 859 * nSubAuthority4 [] 860 * nSubAuthority5 [] 861 * nSubAuthority6 [] 862 * nSubAuthority7 [] 863 * pSid [] 864 */ 865 BOOL WINAPI 866 AllocateAndInitializeSid( PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority, 867 BYTE nSubAuthorityCount, 868 DWORD nSubAuthority0, DWORD nSubAuthority1, 869 DWORD nSubAuthority2, DWORD nSubAuthority3, 870 DWORD nSubAuthority4, DWORD nSubAuthority5, 871 DWORD nSubAuthority6, DWORD nSubAuthority7, 872 PSID *pSid ) 873 { 874 return set_ntstatus( RtlAllocateAndInitializeSid( 875 pIdentifierAuthority, nSubAuthorityCount, 876 nSubAuthority0, nSubAuthority1, nSubAuthority2, nSubAuthority3, 877 nSubAuthority4, nSubAuthority5, nSubAuthority6, nSubAuthority7, 878 pSid )); 879 } 880 881 /****************************************************************************** 882 * FreeSid [ADVAPI32.@] 883 * 884 * PARAMS 885 * pSid [] 886 */ 887 PVOID WINAPI 888 FreeSid( PSID pSid ) 889 { 890 RtlFreeSid(pSid); 891 return NULL; /* is documented like this */ 892 } 893 894 /****************************************************************************** 895 * CopySid [ADVAPI32.@] 896 * 897 * PARAMS 898 * nDestinationSidLength [] 899 * pDestinationSid [] 900 * pSourceSid [] 901 */ 902 BOOL WINAPI 903 CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid ) 904 { 905 return RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid); 906 } 907 908 /****************************************************************************** 909 * CreateWellKnownSid [ADVAPI32.@] 910 */ 911 BOOL WINAPI 912 CreateWellKnownSid( WELL_KNOWN_SID_TYPE WellKnownSidType, 913 PSID DomainSid, 914 PSID pSid, 915 DWORD* cbSid) 916 { 917 unsigned int i; 918 TRACE("(%d, %s, %p, %p)\n", WellKnownSidType, debugstr_sid(DomainSid), pSid, cbSid); 919 920 if (cbSid == NULL || (DomainSid && !IsValidSid(DomainSid))) 921 { 922 SetLastError(ERROR_INVALID_PARAMETER); 923 return FALSE; 924 } 925 926 for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++) { 927 if (WellKnownSids[i].Type == WellKnownSidType) { 928 DWORD length = GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount); 929 930 if (*cbSid < length) 931 { 932 *cbSid = length; 933 SetLastError(ERROR_INSUFFICIENT_BUFFER); 934 return FALSE; 935 } 936 if (!pSid) 937 { 938 SetLastError(ERROR_INVALID_PARAMETER); 939 return FALSE; 940 } 941 CopyMemory(pSid, &WellKnownSids[i].Sid.Revision, length); 942 *cbSid = length; 943 return TRUE; 944 } 945 } 946 947 if (DomainSid == NULL || *GetSidSubAuthorityCount(DomainSid) == SID_MAX_SUB_AUTHORITIES) 948 { 949 SetLastError(ERROR_INVALID_PARAMETER); 950 return FALSE; 951 } 952 953 for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++) 954 if (WellKnownRids[i].Type == WellKnownSidType) { 955 UCHAR domain_subauth = *GetSidSubAuthorityCount(DomainSid); 956 DWORD domain_sid_length = GetSidLengthRequired(domain_subauth); 957 DWORD output_sid_length = GetSidLengthRequired(domain_subauth + 1); 958 959 if (*cbSid < output_sid_length) 960 { 961 *cbSid = output_sid_length; 962 SetLastError(ERROR_INSUFFICIENT_BUFFER); 963 return FALSE; 964 } 965 if (!pSid) 966 { 967 SetLastError(ERROR_INVALID_PARAMETER); 968 return FALSE; 969 } 970 CopyMemory(pSid, DomainSid, domain_sid_length); 971 (*GetSidSubAuthorityCount(pSid))++; 972 (*GetSidSubAuthority(pSid, domain_subauth)) = WellKnownRids[i].Rid; 973 *cbSid = output_sid_length; 974 return TRUE; 975 } 976 977 SetLastError(ERROR_INVALID_PARAMETER); 978 return FALSE; 979 } 980 981 /****************************************************************************** 982 * IsWellKnownSid [ADVAPI32.@] 983 */ 984 BOOL WINAPI 985 IsWellKnownSid( PSID pSid, WELL_KNOWN_SID_TYPE WellKnownSidType ) 986 { 987 unsigned int i; 988 TRACE("(%s, %d)\n", debugstr_sid(pSid), WellKnownSidType); 989 990 for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++) 991 if (WellKnownSids[i].Type == WellKnownSidType) 992 if (EqualSid(pSid, (PSID)&(WellKnownSids[i].Sid.Revision))) 993 return TRUE; 994 995 return FALSE; 996 } 997 998 BOOL WINAPI 999 IsTokenRestricted( HANDLE TokenHandle ) 1000 { 1001 TOKEN_GROUPS *groups; 1002 DWORD size; 1003 NTSTATUS status; 1004 BOOL restricted; 1005 1006 TRACE("(%p)\n", TokenHandle); 1007 1008 status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, NULL, 0, &size); 1009 if (status != STATUS_BUFFER_TOO_SMALL) 1010 return FALSE; 1011 1012 groups = HeapAlloc(GetProcessHeap(), 0, size); 1013 if (!groups) 1014 { 1015 SetLastError(ERROR_OUTOFMEMORY); 1016 return FALSE; 1017 } 1018 1019 status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, groups, size, &size); 1020 if (status != STATUS_SUCCESS) 1021 { 1022 HeapFree(GetProcessHeap(), 0, groups); 1023 return set_ntstatus(status); 1024 } 1025 1026 if (groups->GroupCount) 1027 restricted = TRUE; 1028 else 1029 restricted = FALSE; 1030 1031 HeapFree(GetProcessHeap(), 0, groups); 1032 1033 return restricted; 1034 } 1035 1036 /****************************************************************************** 1037 * IsValidSid [ADVAPI32.@] 1038 * 1039 * PARAMS 1040 * pSid [] 1041 */ 1042 BOOL WINAPI 1043 IsValidSid( PSID pSid ) 1044 { 1045 return RtlValidSid( pSid ); 1046 } 1047 1048 /****************************************************************************** 1049 * EqualSid [ADVAPI32.@] 1050 * 1051 * PARAMS 1052 * pSid1 [] 1053 * pSid2 [] 1054 */ 1055 BOOL WINAPI 1056 EqualSid( PSID pSid1, PSID pSid2 ) 1057 { 1058 BOOL ret = RtlEqualSid( pSid1, pSid2 ); 1059 SetLastError(ERROR_SUCCESS); 1060 return ret; 1061 } 1062 1063 /****************************************************************************** 1064 * EqualPrefixSid [ADVAPI32.@] 1065 */ 1066 BOOL WINAPI EqualPrefixSid (PSID pSid1, PSID pSid2) 1067 { 1068 return RtlEqualPrefixSid(pSid1, pSid2); 1069 } 1070 1071 /****************************************************************************** 1072 * GetSidLengthRequired [ADVAPI32.@] 1073 * 1074 * PARAMS 1075 * nSubAuthorityCount [] 1076 */ 1077 DWORD WINAPI 1078 GetSidLengthRequired( BYTE nSubAuthorityCount ) 1079 { 1080 return RtlLengthRequiredSid(nSubAuthorityCount); 1081 } 1082 1083 /****************************************************************************** 1084 * InitializeSid [ADVAPI32.@] 1085 * 1086 * PARAMS 1087 * pIdentifierAuthority [] 1088 */ 1089 BOOL WINAPI 1090 InitializeSid ( 1091 PSID pSid, 1092 PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority, 1093 BYTE nSubAuthorityCount) 1094 { 1095 return RtlInitializeSid(pSid, pIdentifierAuthority, nSubAuthorityCount); 1096 } 1097 1098 DWORD WINAPI 1099 GetEffectiveRightsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pAccessRights ) 1100 { 1101 FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights); 1102 1103 *pAccessRights = STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL; 1104 return 0; 1105 } 1106 1107 DWORD WINAPI 1108 GetEffectiveRightsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pAccessRights ) 1109 { 1110 FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights); 1111 1112 return 1; 1113 } 1114 1115 /****************************************************************************** 1116 * GetSidIdentifierAuthority [ADVAPI32.@] 1117 * 1118 * PARAMS 1119 * pSid [] 1120 */ 1121 PSID_IDENTIFIER_AUTHORITY WINAPI 1122 GetSidIdentifierAuthority( PSID pSid ) 1123 { 1124 return RtlIdentifierAuthoritySid(pSid); 1125 } 1126 1127 /****************************************************************************** 1128 * GetSidSubAuthority [ADVAPI32.@] 1129 * 1130 * PARAMS 1131 * pSid [] 1132 * nSubAuthority [] 1133 */ 1134 PDWORD WINAPI 1135 GetSidSubAuthority( PSID pSid, DWORD nSubAuthority ) 1136 { 1137 SetLastError(ERROR_SUCCESS); 1138 return RtlSubAuthoritySid(pSid, nSubAuthority); 1139 } 1140 1141 /****************************************************************************** 1142 * GetSidSubAuthorityCount [ADVAPI32.@] 1143 * 1144 * PARAMS 1145 * pSid [] 1146 */ 1147 PUCHAR WINAPI 1148 GetSidSubAuthorityCount (PSID pSid) 1149 { 1150 SetLastError(ERROR_SUCCESS); 1151 return RtlSubAuthorityCountSid(pSid); 1152 } 1153 1154 /****************************************************************************** 1155 * GetLengthSid [ADVAPI32.@] 1156 * 1157 * PARAMS 1158 * pSid [] 1159 */ 1160 DWORD WINAPI 1161 GetLengthSid (PSID pSid) 1162 { 1163 return RtlLengthSid(pSid); 1164 } 1165 1166 /* ############################################## 1167 ###### SECURITY DESCRIPTOR FUNCTIONS ###### 1168 ############################################## 1169 */ 1170 1171 /****************************************************************************** 1172 * BuildSecurityDescriptorA [ADVAPI32.@] 1173 * 1174 * Builds a SD from 1175 * 1176 * PARAMS 1177 * pOwner [I] 1178 * pGroup [I] 1179 * cCountOfAccessEntries [I] 1180 * pListOfAccessEntries [I] 1181 * cCountOfAuditEntries [I] 1182 * pListofAuditEntries [I] 1183 * pOldSD [I] 1184 * lpdwBufferLength [I/O] 1185 * pNewSD [O] 1186 * 1187 * RETURNS 1188 * Success: ERROR_SUCCESS 1189 * Failure: nonzero error code from Winerror.h 1190 */ 1191 DWORD WINAPI BuildSecurityDescriptorA( 1192 IN PTRUSTEEA pOwner, 1193 IN PTRUSTEEA pGroup, 1194 IN ULONG cCountOfAccessEntries, 1195 IN PEXPLICIT_ACCESSA pListOfAccessEntries, 1196 IN ULONG cCountOfAuditEntries, 1197 IN PEXPLICIT_ACCESSA pListofAuditEntries, 1198 IN PSECURITY_DESCRIPTOR pOldSD, 1199 IN OUT PULONG lpdwBufferLength, 1200 OUT PSECURITY_DESCRIPTOR* pNewSD) 1201 { 1202 FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup, 1203 cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries, 1204 pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD); 1205 1206 return ERROR_CALL_NOT_IMPLEMENTED; 1207 } 1208 1209 /****************************************************************************** 1210 * BuildSecurityDescriptorW [ADVAPI32.@] 1211 * 1212 * See BuildSecurityDescriptorA. 1213 */ 1214 DWORD WINAPI BuildSecurityDescriptorW( 1215 IN PTRUSTEEW pOwner, 1216 IN PTRUSTEEW pGroup, 1217 IN ULONG cCountOfAccessEntries, 1218 IN PEXPLICIT_ACCESSW pListOfAccessEntries, 1219 IN ULONG cCountOfAuditEntries, 1220 IN PEXPLICIT_ACCESSW pListofAuditEntries, 1221 IN PSECURITY_DESCRIPTOR pOldSD, 1222 IN OUT PULONG lpdwBufferLength, 1223 OUT PSECURITY_DESCRIPTOR* pNewSD) 1224 { 1225 FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup, 1226 cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries, 1227 pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD); 1228 1229 return ERROR_CALL_NOT_IMPLEMENTED; 1230 } 1231 1232 /****************************************************************************** 1233 * InitializeSecurityDescriptor [ADVAPI32.@] 1234 * 1235 * PARAMS 1236 * pDescr [] 1237 * revision [] 1238 */ 1239 BOOL WINAPI 1240 InitializeSecurityDescriptor( PSECURITY_DESCRIPTOR pDescr, DWORD revision ) 1241 { 1242 return set_ntstatus( RtlCreateSecurityDescriptor(pDescr, revision )); 1243 } 1244 1245 1246 /****************************************************************************** 1247 * MakeAbsoluteSD [ADVAPI32.@] 1248 */ 1249 BOOL WINAPI MakeAbsoluteSD ( 1250 IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor, 1251 OUT PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor, 1252 OUT LPDWORD lpdwAbsoluteSecurityDescriptorSize, 1253 OUT PACL pDacl, 1254 OUT LPDWORD lpdwDaclSize, 1255 OUT PACL pSacl, 1256 OUT LPDWORD lpdwSaclSize, 1257 OUT PSID pOwner, 1258 OUT LPDWORD lpdwOwnerSize, 1259 OUT PSID pPrimaryGroup, 1260 OUT LPDWORD lpdwPrimaryGroupSize) 1261 { 1262 return set_ntstatus( RtlSelfRelativeToAbsoluteSD(pSelfRelativeSecurityDescriptor, 1263 pAbsoluteSecurityDescriptor, 1264 lpdwAbsoluteSecurityDescriptorSize, 1265 pDacl, lpdwDaclSize, pSacl, lpdwSaclSize, 1266 pOwner, lpdwOwnerSize, 1267 pPrimaryGroup, lpdwPrimaryGroupSize)); 1268 } 1269 1270 /****************************************************************************** 1271 * GetKernelObjectSecurity [ADVAPI32.@] 1272 */ 1273 BOOL WINAPI GetKernelObjectSecurity( 1274 HANDLE Handle, 1275 SECURITY_INFORMATION RequestedInformation, 1276 PSECURITY_DESCRIPTOR pSecurityDescriptor, 1277 DWORD nLength, 1278 LPDWORD lpnLengthNeeded ) 1279 { 1280 TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", Handle, RequestedInformation, 1281 pSecurityDescriptor, nLength, lpnLengthNeeded); 1282 1283 return set_ntstatus( NtQuerySecurityObject(Handle, RequestedInformation, pSecurityDescriptor, 1284 nLength, lpnLengthNeeded )); 1285 } 1286 1287 /****************************************************************************** 1288 * GetPrivateObjectSecurity [ADVAPI32.@] 1289 */ 1290 BOOL WINAPI GetPrivateObjectSecurity( 1291 PSECURITY_DESCRIPTOR ObjectDescriptor, 1292 SECURITY_INFORMATION SecurityInformation, 1293 PSECURITY_DESCRIPTOR ResultantDescriptor, 1294 DWORD DescriptorLength, 1295 PDWORD ReturnLength ) 1296 { 1297 SECURITY_DESCRIPTOR desc; 1298 BOOL defaulted, present; 1299 PACL pacl; 1300 PSID psid; 1301 1302 TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", ObjectDescriptor, SecurityInformation, 1303 ResultantDescriptor, DescriptorLength, ReturnLength); 1304 1305 if (!InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION)) 1306 return FALSE; 1307 1308 if (SecurityInformation & OWNER_SECURITY_INFORMATION) 1309 { 1310 if (!GetSecurityDescriptorOwner(ObjectDescriptor, &psid, &defaulted)) 1311 return FALSE; 1312 SetSecurityDescriptorOwner(&desc, psid, defaulted); 1313 } 1314 1315 if (SecurityInformation & GROUP_SECURITY_INFORMATION) 1316 { 1317 if (!GetSecurityDescriptorGroup(ObjectDescriptor, &psid, &defaulted)) 1318 return FALSE; 1319 SetSecurityDescriptorGroup(&desc, psid, defaulted); 1320 } 1321 1322 if (SecurityInformation & DACL_SECURITY_INFORMATION) 1323 { 1324 if (!GetSecurityDescriptorDacl(ObjectDescriptor, &present, &pacl, &defaulted)) 1325 return FALSE; 1326 SetSecurityDescriptorDacl(&desc, present, pacl, defaulted); 1327 } 1328 1329 if (SecurityInformation & SACL_SECURITY_INFORMATION) 1330 { 1331 if (!GetSecurityDescriptorSacl(ObjectDescriptor, &present, &pacl, &defaulted)) 1332 return FALSE; 1333 SetSecurityDescriptorSacl(&desc, present, pacl, defaulted); 1334 } 1335 1336 *ReturnLength = DescriptorLength; 1337 return MakeSelfRelativeSD(&desc, ResultantDescriptor, ReturnLength); 1338 } 1339 1340 /****************************************************************************** 1341 * GetSecurityDescriptorLength [ADVAPI32.@] 1342 */ 1343 DWORD WINAPI GetSecurityDescriptorLength( PSECURITY_DESCRIPTOR pDescr) 1344 { 1345 return RtlLengthSecurityDescriptor(pDescr); 1346 } 1347 1348 /****************************************************************************** 1349 * GetSecurityDescriptorOwner [ADVAPI32.@] 1350 * 1351 * PARAMS 1352 * pOwner [] 1353 * lpbOwnerDefaulted [] 1354 */ 1355 BOOL WINAPI 1356 GetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pDescr, PSID *pOwner, 1357 LPBOOL lpbOwnerDefaulted ) 1358 { 1359 BOOLEAN defaulted; 1360 BOOL ret = set_ntstatus( RtlGetOwnerSecurityDescriptor( pDescr, pOwner, &defaulted )); 1361 *lpbOwnerDefaulted = defaulted; 1362 return ret; 1363 } 1364 1365 /****************************************************************************** 1366 * SetSecurityDescriptorOwner [ADVAPI32.@] 1367 * 1368 * PARAMS 1369 */ 1370 BOOL WINAPI SetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pSecurityDescriptor, 1371 PSID pOwner, BOOL bOwnerDefaulted) 1372 { 1373 return set_ntstatus( RtlSetOwnerSecurityDescriptor(pSecurityDescriptor, pOwner, bOwnerDefaulted)); 1374 } 1375 /****************************************************************************** 1376 * GetSecurityDescriptorGroup [ADVAPI32.@] 1377 */ 1378 BOOL WINAPI GetSecurityDescriptorGroup( 1379 PSECURITY_DESCRIPTOR SecurityDescriptor, 1380 PSID *Group, 1381 LPBOOL GroupDefaulted) 1382 { 1383 BOOLEAN defaulted; 1384 BOOL ret = set_ntstatus( RtlGetGroupSecurityDescriptor(SecurityDescriptor, Group, &defaulted )); 1385 *GroupDefaulted = defaulted; 1386 return ret; 1387 } 1388 /****************************************************************************** 1389 * SetSecurityDescriptorGroup [ADVAPI32.@] 1390 */ 1391 BOOL WINAPI SetSecurityDescriptorGroup ( PSECURITY_DESCRIPTOR SecurityDescriptor, 1392 PSID Group, BOOL GroupDefaulted) 1393 { 1394 return set_ntstatus( RtlSetGroupSecurityDescriptor( SecurityDescriptor, Group, GroupDefaulted)); 1395 } 1396 1397 /****************************************************************************** 1398 * IsValidSecurityDescriptor [ADVAPI32.@] 1399 * 1400 * PARAMS 1401 * lpsecdesc [] 1402 */ 1403 BOOL WINAPI 1404 IsValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor ) 1405 { 1406 return set_ntstatus( RtlValidSecurityDescriptor(SecurityDescriptor)); 1407 } 1408 1409 /****************************************************************************** 1410 * GetSecurityDescriptorDacl [ADVAPI32.@] 1411 */ 1412 BOOL WINAPI GetSecurityDescriptorDacl( 1413 IN PSECURITY_DESCRIPTOR pSecurityDescriptor, 1414 OUT LPBOOL lpbDaclPresent, 1415 OUT PACL *pDacl, 1416 OUT LPBOOL lpbDaclDefaulted) 1417 { 1418 BOOLEAN present, defaulted; 1419 BOOL ret = set_ntstatus( RtlGetDaclSecurityDescriptor(pSecurityDescriptor, &present, pDacl, &defaulted)); 1420 *lpbDaclPresent = present; 1421 *lpbDaclDefaulted = defaulted; 1422 return ret; 1423 } 1424 1425 /****************************************************************************** 1426 * SetSecurityDescriptorDacl [ADVAPI32.@] 1427 */ 1428 BOOL WINAPI 1429 SetSecurityDescriptorDacl ( 1430 PSECURITY_DESCRIPTOR lpsd, 1431 BOOL daclpresent, 1432 PACL dacl, 1433 BOOL dacldefaulted ) 1434 { 1435 return set_ntstatus( RtlSetDaclSecurityDescriptor (lpsd, daclpresent, dacl, dacldefaulted ) ); 1436 } 1437 /****************************************************************************** 1438 * GetSecurityDescriptorSacl [ADVAPI32.@] 1439 */ 1440 BOOL WINAPI GetSecurityDescriptorSacl( 1441 IN PSECURITY_DESCRIPTOR lpsd, 1442 OUT LPBOOL lpbSaclPresent, 1443 OUT PACL *pSacl, 1444 OUT LPBOOL lpbSaclDefaulted) 1445 { 1446 BOOLEAN present, defaulted; 1447 BOOL ret = set_ntstatus( RtlGetSaclSecurityDescriptor(lpsd, &present, pSacl, &defaulted) ); 1448 *lpbSaclPresent = present; 1449 *lpbSaclDefaulted = defaulted; 1450 return ret; 1451 } 1452 1453 /************************************************************************** 1454 * SetSecurityDescriptorSacl [ADVAPI32.@] 1455 */ 1456 BOOL WINAPI SetSecurityDescriptorSacl ( 1457 PSECURITY_DESCRIPTOR lpsd, 1458 BOOL saclpresent, 1459 PACL lpsacl, 1460 BOOL sacldefaulted) 1461 { 1462 return set_ntstatus (RtlSetSaclSecurityDescriptor(lpsd, saclpresent, lpsacl, sacldefaulted)); 1463 } 1464 /****************************************************************************** 1465 * MakeSelfRelativeSD [ADVAPI32.@] 1466 * 1467 * PARAMS 1468 * lpabssecdesc [] 1469 * lpselfsecdesc [] 1470 * lpbuflen [] 1471 */ 1472 BOOL WINAPI 1473 MakeSelfRelativeSD( 1474 IN PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor, 1475 IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor, 1476 IN OUT LPDWORD lpdwBufferLength) 1477 { 1478 return set_ntstatus( RtlMakeSelfRelativeSD( pAbsoluteSecurityDescriptor, 1479 pSelfRelativeSecurityDescriptor, lpdwBufferLength)); 1480 } 1481 1482 /****************************************************************************** 1483 * GetSecurityDescriptorControl [ADVAPI32.@] 1484 */ 1485 1486 BOOL WINAPI GetSecurityDescriptorControl ( PSECURITY_DESCRIPTOR pSecurityDescriptor, 1487 PSECURITY_DESCRIPTOR_CONTROL pControl, LPDWORD lpdwRevision) 1488 { 1489 return set_ntstatus( RtlGetControlSecurityDescriptor(pSecurityDescriptor,pControl,lpdwRevision)); 1490 } 1491 1492 /****************************************************************************** 1493 * SetSecurityDescriptorControl [ADVAPI32.@] 1494 */ 1495 BOOL WINAPI SetSecurityDescriptorControl( PSECURITY_DESCRIPTOR pSecurityDescriptor, 1496 SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest, 1497 SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet ) 1498 { 1499 return set_ntstatus( RtlSetControlSecurityDescriptor( 1500 pSecurityDescriptor, ControlBitsOfInterest, ControlBitsToSet ) ); 1501 } 1502 1503 /* ############################## 1504 ###### ACL FUNCTIONS ###### 1505 ############################## 1506 */ 1507 1508 /************************************************************************* 1509 * InitializeAcl [ADVAPI32.@] 1510 */ 1511 BOOL WINAPI InitializeAcl(PACL acl, DWORD size, DWORD rev) 1512 { 1513 return set_ntstatus( RtlCreateAcl(acl, size, rev)); 1514 } 1515 1516 BOOL WINAPI ImpersonateNamedPipeClient( HANDLE hNamedPipe ) 1517 { 1518 IO_STATUS_BLOCK io_block; 1519 1520 TRACE("(%p)\n", hNamedPipe); 1521 1522 return set_ntstatus( NtFsControlFile(hNamedPipe, NULL, NULL, NULL, 1523 &io_block, FSCTL_PIPE_IMPERSONATE, NULL, 0, NULL, 0) ); 1524 } 1525 1526 /****************************************************************************** 1527 * AddAccessAllowedAce [ADVAPI32.@] 1528 */ 1529 BOOL WINAPI AddAccessAllowedAce( 1530 IN OUT PACL pAcl, 1531 IN DWORD dwAceRevision, 1532 IN DWORD AccessMask, 1533 IN PSID pSid) 1534 { 1535 return set_ntstatus(RtlAddAccessAllowedAce(pAcl, dwAceRevision, AccessMask, pSid)); 1536 } 1537 1538 /****************************************************************************** 1539 * AddAccessAllowedAceEx [ADVAPI32.@] 1540 */ 1541 BOOL WINAPI AddAccessAllowedAceEx( 1542 IN OUT PACL pAcl, 1543 IN DWORD dwAceRevision, 1544 IN DWORD AceFlags, 1545 IN DWORD AccessMask, 1546 IN PSID pSid) 1547 { 1548 return set_ntstatus(RtlAddAccessAllowedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid)); 1549 } 1550 1551 /****************************************************************************** 1552 * AddAccessDeniedAce [ADVAPI32.@] 1553 */ 1554 BOOL WINAPI AddAccessDeniedAce( 1555 IN OUT PACL pAcl, 1556 IN DWORD dwAceRevision, 1557 IN DWORD AccessMask, 1558 IN PSID pSid) 1559 { 1560 return set_ntstatus(RtlAddAccessDeniedAce(pAcl, dwAceRevision, AccessMask, pSid)); 1561 } 1562 1563 /****************************************************************************** 1564 * AddAccessDeniedAceEx [ADVAPI32.@] 1565 */ 1566 BOOL WINAPI AddAccessDeniedAceEx( 1567 IN OUT PACL pAcl, 1568 IN DWORD dwAceRevision, 1569 IN DWORD AceFlags, 1570 IN DWORD AccessMask, 1571 IN PSID pSid) 1572 { 1573 return set_ntstatus(RtlAddAccessDeniedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid)); 1574 } 1575 1576 /****************************************************************************** 1577 * AddAce [ADVAPI32.@] 1578 */ 1579 BOOL WINAPI AddAce( 1580 IN OUT PACL pAcl, 1581 IN DWORD dwAceRevision, 1582 IN DWORD dwStartingAceIndex, 1583 LPVOID pAceList, 1584 DWORD nAceListLength) 1585 { 1586 return set_ntstatus(RtlAddAce(pAcl, dwAceRevision, dwStartingAceIndex, pAceList, nAceListLength)); 1587 } 1588 1589 /****************************************************************************** 1590 * DeleteAce [ADVAPI32.@] 1591 */ 1592 BOOL WINAPI DeleteAce(PACL pAcl, DWORD dwAceIndex) 1593 { 1594 return set_ntstatus(RtlDeleteAce(pAcl, dwAceIndex)); 1595 } 1596 1597 /****************************************************************************** 1598 * FindFirstFreeAce [ADVAPI32.@] 1599 */ 1600 BOOL WINAPI FindFirstFreeAce(IN PACL pAcl, LPVOID * pAce) 1601 { 1602 return RtlFirstFreeAce(pAcl, (PACE_HEADER *)pAce); 1603 } 1604 1605 /****************************************************************************** 1606 * GetAce [ADVAPI32.@] 1607 */ 1608 BOOL WINAPI GetAce(PACL pAcl,DWORD dwAceIndex,LPVOID *pAce ) 1609 { 1610 return set_ntstatus(RtlGetAce(pAcl, dwAceIndex, pAce)); 1611 } 1612 1613 /****************************************************************************** 1614 * GetAclInformation [ADVAPI32.@] 1615 */ 1616 BOOL WINAPI GetAclInformation( 1617 PACL pAcl, 1618 LPVOID pAclInformation, 1619 DWORD nAclInformationLength, 1620 ACL_INFORMATION_CLASS dwAclInformationClass) 1621 { 1622 return set_ntstatus(RtlQueryInformationAcl(pAcl, pAclInformation, 1623 nAclInformationLength, dwAclInformationClass)); 1624 } 1625 1626 /****************************************************************************** 1627 * IsValidAcl [ADVAPI32.@] 1628 */ 1629 BOOL WINAPI IsValidAcl(IN PACL pAcl) 1630 { 1631 return RtlValidAcl(pAcl); 1632 } 1633 1634 /* ############################## 1635 ###### MISC FUNCTIONS ###### 1636 ############################## 1637 */ 1638 1639 /****************************************************************************** 1640 * AllocateLocallyUniqueId [ADVAPI32.@] 1641 * 1642 * PARAMS 1643 * lpLuid [] 1644 */ 1645 BOOL WINAPI AllocateLocallyUniqueId( PLUID lpLuid ) 1646 { 1647 return set_ntstatus(NtAllocateLocallyUniqueId(lpLuid)); 1648 } 1649 1650 static const WCHAR SE_CREATE_TOKEN_NAME_W[] = 1651 { 'S','e','C','r','e','a','t','e','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 }; 1652 static const WCHAR SE_ASSIGNPRIMARYTOKEN_NAME_W[] = 1653 { 'S','e','A','s','s','i','g','n','P','r','i','m','a','r','y','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 }; 1654 static const WCHAR SE_LOCK_MEMORY_NAME_W[] = 1655 { 'S','e','L','o','c','k','M','e','m','o','r','y','P','r','i','v','i','l','e','g','e',0 }; 1656 static const WCHAR SE_INCREASE_QUOTA_NAME_W[] = 1657 { 'S','e','I','n','c','r','e','a','s','e','Q','u','o','t','a','P','r','i','v','i','l','e','g','e',0 }; 1658 static const WCHAR SE_MACHINE_ACCOUNT_NAME_W[] = 1659 { 'S','e','M','a','c','h','i','n','e','A','c','c','o','u','n','t','P','r','i','v','i','l','e','g','e',0 }; 1660 static const WCHAR SE_TCB_NAME_W[] = 1661 { 'S','e','T','c','b','P','r','i','v','i','l','e','g','e',0 }; 1662 static const WCHAR SE_SECURITY_NAME_W[] = 1663 { 'S','e','S','e','c','u','r','i','t','y','P','r','i','v','i','l','e','g','e',0 }; 1664 static const WCHAR SE_TAKE_OWNERSHIP_NAME_W[] = 1665 { 'S','e','T','a','k','e','O','w','n','e','r','s','h','i','p','P','r','i','v','i','l','e','g','e',0 }; 1666 static const WCHAR SE_LOAD_DRIVER_NAME_W[] = 1667 { 'S','e','L','o','a','d','D','r','i','v','e','r','P','r','i','v','i','l','e','g','e',0 }; 1668 static const WCHAR SE_SYSTEM_PROFILE_NAME_W[] = 1669 { 'S','e','S','y','s','t','e','m','P','r','o','f','i','l','e','P','r','i','v','i','l','e','g','e',0 }; 1670 static const WCHAR SE_SYSTEMTIME_NAME_W[] = 1671 { 'S','e','S','y','s','t','e','m','t','i','m','e','P','r','i','v','i','l','e','g','e',0 }; 1672 static const WCHAR SE_PROF_SINGLE_PROCESS_NAME_W[] = 1673 { 'S','e','P','r','o','f','i','l','e','S','i','n','g','l','e','P','r','o','c','e','s','s','P','r','i','v','i','l','e','g','e',0 }; 1674 static const WCHAR SE_INC_BASE_PRIORITY_NAME_W[] = 1675 { 'S','e','I','n','c','r','e','a','s','e','B','a','s','e','P','r','i','o','r','i','t','y','P','r','i','v','i','l','e','g','e',0 }; 1676 static const WCHAR SE_CREATE_PAGEFILE_NAME_W[] = 1677 { 'S','e','C','r','e','a','t','e','P','a','g','e','f','i','l','e','P','r','i','v','i','l','e','g','e',0 }; 1678 static const WCHAR SE_CREATE_PERMANENT_NAME_W[] = 1679 { 'S','e','C','r','e','a','t','e','P','e','r','m','a','n','e','n','t','P','r','i','v','i','l','e','g','e',0 }; 1680 static const WCHAR SE_BACKUP_NAME_W[] = 1681 { 'S','e','B','a','c','k','u','p','P','r','i','v','i','l','e','g','e',0 }; 1682 static const WCHAR SE_RESTORE_NAME_W[] = 1683 { 'S','e','R','e','s','t','o','r','e','P','r','i','v','i','l','e','g','e',0 }; 1684 static const WCHAR SE_SHUTDOWN_NAME_W[] = 1685 { 'S','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 }; 1686 static const WCHAR SE_DEBUG_NAME_W[] = 1687 { 'S','e','D','e','b','u','g','P','r','i','v','i','l','e','g','e',0 }; 1688 static const WCHAR SE_AUDIT_NAME_W[] = 1689 { 'S','e','A','u','d','i','t','P','r','i','v','i','l','e','g','e',0 }; 1690 static const WCHAR SE_SYSTEM_ENVIRONMENT_NAME_W[] = 1691 { 'S','e','S','y','s','t','e','m','E','n','v','i','r','o','n','m','e','n','t','P','r','i','v','i','l','e','g','e',0 }; 1692 static const WCHAR SE_CHANGE_NOTIFY_NAME_W[] = 1693 { 'S','e','C','h','a','n','g','e','N','o','t','i','f','y','P','r','i','v','i','l','e','g','e',0 }; 1694 static const WCHAR SE_REMOTE_SHUTDOWN_NAME_W[] = 1695 { 'S','e','R','e','m','o','t','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 }; 1696 static const WCHAR SE_UNDOCK_NAME_W[] = 1697 { 'S','e','U','n','d','o','c','k','P','r','i','v','i','l','e','g','e',0 }; 1698 static const WCHAR SE_SYNC_AGENT_NAME_W[] = 1699 { 'S','e','S','y','n','c','A','g','e','n','t','P','r','i','v','i','l','e','g','e',0 }; 1700 static const WCHAR SE_ENABLE_DELEGATION_NAME_W[] = 1701 { 'S','e','E','n','a','b','l','e','D','e','l','e','g','a','t','i','o','n','P','r','i','v','i','l','e','g','e',0 }; 1702 static const WCHAR SE_MANAGE_VOLUME_NAME_W[] = 1703 { 'S','e','M','a','n','a','g','e','V','o','l','u','m','e','P','r','i','v','i','l','e','g','e',0 }; 1704 static const WCHAR SE_IMPERSONATE_NAME_W[] = 1705 { 'S','e','I','m','p','e','r','s','o','n','a','t','e','P','r','i','v','i','l','e','g','e',0 }; 1706 static const WCHAR SE_CREATE_GLOBAL_NAME_W[] = 1707 { 'S','e','C','r','e','a','t','e','G','l','o','b','a','l','P','r','i','v','i','l','e','g','e',0 }; 1708 1709 static const WCHAR * const WellKnownPrivNames[SE_MAX_WELL_KNOWN_PRIVILEGE + 1] = 1710 { 1711 NULL, 1712 NULL, 1713 SE_CREATE_TOKEN_NAME_W, 1714 SE_ASSIGNPRIMARYTOKEN_NAME_W, 1715 SE_LOCK_MEMORY_NAME_W, 1716 SE_INCREASE_QUOTA_NAME_W, 1717 SE_MACHINE_ACCOUNT_NAME_W, 1718 SE_TCB_NAME_W, 1719 SE_SECURITY_NAME_W, 1720 SE_TAKE_OWNERSHIP_NAME_W, 1721 SE_LOAD_DRIVER_NAME_W, 1722 SE_SYSTEM_PROFILE_NAME_W, 1723 SE_SYSTEMTIME_NAME_W, 1724 SE_PROF_SINGLE_PROCESS_NAME_W, 1725 SE_INC_BASE_PRIORITY_NAME_W, 1726 SE_CREATE_PAGEFILE_NAME_W, 1727 SE_CREATE_PERMANENT_NAME_W, 1728 SE_BACKUP_NAME_W, 1729 SE_RESTORE_NAME_W, 1730 SE_SHUTDOWN_NAME_W, 1731 SE_DEBUG_NAME_W, 1732 SE_AUDIT_NAME_W, 1733 SE_SYSTEM_ENVIRONMENT_NAME_W, 1734 SE_CHANGE_NOTIFY_NAME_W, 1735 SE_REMOTE_SHUTDOWN_NAME_W, 1736 SE_UNDOCK_NAME_W, 1737 SE_SYNC_AGENT_NAME_W, 1738 SE_ENABLE_DELEGATION_NAME_W, 1739 SE_MANAGE_VOLUME_NAME_W, 1740 SE_IMPERSONATE_NAME_W, 1741 SE_CREATE_GLOBAL_NAME_W, 1742 }; 1743 1744 /****************************************************************************** 1745 * LookupPrivilegeValueW [ADVAPI32.@] 1746 * 1747 * See LookupPrivilegeValueA. 1748 */ 1749 BOOL WINAPI 1750 LookupPrivilegeValueW( LPCWSTR lpSystemName, LPCWSTR lpName, PLUID lpLuid ) 1751 { 1752 UINT i; 1753 1754 TRACE("%s,%s,%p\n",debugstr_w(lpSystemName), debugstr_w(lpName), lpLuid); 1755 1756 if (!ADVAPI_IsLocalComputer(lpSystemName)) 1757 { 1758 SetLastError(RPC_S_SERVER_UNAVAILABLE); 1759 return FALSE; 1760 } 1761 if (!lpName) 1762 { 1763 SetLastError(ERROR_NO_SUCH_PRIVILEGE); 1764 return FALSE; 1765 } 1766 for( i=SE_MIN_WELL_KNOWN_PRIVILEGE; i<=SE_MAX_WELL_KNOWN_PRIVILEGE; i++ ) 1767 { 1768 if( !WellKnownPrivNames[i] ) 1769 continue; 1770 if( strcmpiW( WellKnownPrivNames[i], lpName) ) 1771 continue; 1772 lpLuid->LowPart = i; 1773 lpLuid->HighPart = 0; 1774 TRACE( "%s -> %08x-%08x\n",debugstr_w( lpSystemName ), 1775 lpLuid->HighPart, lpLuid->LowPart ); 1776 return TRUE; 1777 } 1778 SetLastError(ERROR_NO_SUCH_PRIVILEGE); 1779 return FALSE; 1780 } 1781 1782 /****************************************************************************** 1783 * LookupPrivilegeValueA [ADVAPI32.@] 1784 * 1785 * Retrieves LUID used on a system to represent the privilege name. 1786 * 1787 * PARAMS 1788 * lpSystemName [I] Name of the system 1789 * lpName [I] Name of the privilege 1790 * lpLuid [O] Destination for the resulting LUID 1791 * 1792 * RETURNS 1793 * Success: TRUE. lpLuid contains the requested LUID. 1794 * Failure: FALSE. 1795 */ 1796 BOOL WINAPI 1797 LookupPrivilegeValueA( LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid ) 1798 { 1799 UNICODE_STRING lpSystemNameW; 1800 UNICODE_STRING lpNameW; 1801 BOOL ret; 1802 1803 RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName); 1804 RtlCreateUnicodeStringFromAsciiz(&lpNameW,lpName); 1805 ret = LookupPrivilegeValueW(lpSystemNameW.Buffer, lpNameW.Buffer, lpLuid); 1806 RtlFreeUnicodeString(&lpNameW); 1807 RtlFreeUnicodeString(&lpSystemNameW); 1808 return ret; 1809 } 1810 1811 BOOL WINAPI LookupPrivilegeDisplayNameA( LPCSTR lpSystemName, LPCSTR lpName, LPSTR lpDisplayName, 1812 LPDWORD cchDisplayName, LPDWORD lpLanguageId ) 1813 { 1814 FIXME("%s %s %s %p %p - stub\n", debugstr_a(lpSystemName), debugstr_a(lpName), 1815 debugstr_a(lpDisplayName), cchDisplayName, lpLanguageId); 1816 1817 return FALSE; 1818 } 1819 1820 BOOL WINAPI LookupPrivilegeDisplayNameW( LPCWSTR lpSystemName, LPCWSTR lpName, LPWSTR lpDisplayName, 1821 LPDWORD cchDisplayName, LPDWORD lpLanguageId ) 1822 { 1823 FIXME("%s %s %s %p %p - stub\n", debugstr_w(lpSystemName), debugstr_w(lpName), 1824 debugstr_w(lpDisplayName), cchDisplayName, lpLanguageId); 1825 1826 return FALSE; 1827 } 1828 1829 /****************************************************************************** 1830 * LookupPrivilegeNameA [ADVAPI32.@] 1831 * 1832 * See LookupPrivilegeNameW. 1833 */ 1834 BOOL WINAPI 1835 LookupPrivilegeNameA( LPCSTR lpSystemName, PLUID lpLuid, LPSTR lpName, 1836 LPDWORD cchName) 1837 { 1838 UNICODE_STRING lpSystemNameW; 1839 BOOL ret; 1840 DWORD wLen = 0; 1841 1842 TRACE("%s %p %p %p\n", debugstr_a(lpSystemName), lpLuid, lpName, cchName); 1843 1844 RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName); 1845 ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, NULL, &wLen); 1846 if (!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER) 1847 { 1848 LPWSTR lpNameW = HeapAlloc(GetProcessHeap(), 0, wLen * sizeof(WCHAR)); 1849 1850 ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, lpNameW, 1851 &wLen); 1852 if (ret) 1853 { 1854 /* Windows crashes if cchName is NULL, so will I */ 1855 unsigned int len = WideCharToMultiByte(CP_ACP, 0, lpNameW, -1, lpName, 1856 *cchName, NULL, NULL); 1857 1858 if (len == 0) 1859 { 1860 /* WideCharToMultiByte failed */ 1861 ret = FALSE; 1862 } 1863 else if (len > *cchName) 1864 { 1865 *cchName = len; 1866 SetLastError(ERROR_INSUFFICIENT_BUFFER); 1867 ret = FALSE; 1868 } 1869 else 1870 { 1871 /* WideCharToMultiByte succeeded, output length needs to be 1872 * length not including NULL terminator 1873 */ 1874 *cchName = len - 1; 1875 } 1876 } 1877 HeapFree(GetProcessHeap(), 0, lpNameW); 1878 } 1879 RtlFreeUnicodeString(&lpSystemNameW); 1880 return ret; 1881 } 1882 1883 /****************************************************************************** 1884 * LookupPrivilegeNameW [ADVAPI32.@] 1885 * 1886 * Retrieves the privilege name referred to by the LUID lpLuid. 1887 * 1888 * PARAMS 1889 * lpSystemName [I] Name of the system 1890 * lpLuid [I] Privilege value 1891 * lpName [O] Name of the privilege 1892 * cchName [I/O] Number of characters in lpName. 1893 * 1894 * RETURNS 1895 * Success: TRUE. lpName contains the name of the privilege whose value is 1896 * *lpLuid. 1897 * Failure: FALSE. 1898 * 1899 * REMARKS 1900 * Only well-known privilege names (those defined in winnt.h) can be retrieved 1901 * using this function. 1902 * If the length of lpName is too small, on return *cchName will contain the 1903 * number of WCHARs needed to contain the privilege, including the NULL 1904 * terminator, and GetLastError will return ERROR_INSUFFICIENT_BUFFER. 1905 * On success, *cchName will contain the number of characters stored in 1906 * lpName, NOT including the NULL terminator. 1907 */ 1908 BOOL WINAPI 1909 LookupPrivilegeNameW( LPCWSTR lpSystemName, PLUID lpLuid, LPWSTR lpName, 1910 LPDWORD cchName) 1911 { 1912 size_t privNameLen; 1913 1914 TRACE("%s,%p,%p,%p\n",debugstr_w(lpSystemName), lpLuid, lpName, cchName); 1915 1916 if (!ADVAPI_IsLocalComputer(lpSystemName)) 1917 { 1918 SetLastError(RPC_S_SERVER_UNAVAILABLE); 1919 return FALSE; 1920 } 1921 if (lpLuid->HighPart || (lpLuid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE || 1922 lpLuid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE)) 1923 { 1924 SetLastError(ERROR_NO_SUCH_PRIVILEGE); 1925 return FALSE; 1926 } 1927 privNameLen = strlenW(WellKnownPrivNames[lpLuid->LowPart]); 1928 /* Windows crashes if cchName is NULL, so will I */ 1929 if (*cchName <= privNameLen) 1930 { 1931 *cchName = privNameLen + 1; 1932 SetLastError(ERROR_INSUFFICIENT_BUFFER); 1933 return FALSE; 1934 } 1935 else 1936 { 1937 strcpyW(lpName, WellKnownPrivNames[lpLuid->LowPart]); 1938 *cchName = privNameLen; 1939 return TRUE; 1940 } 1941 } 1942 1943 /****************************************************************************** 1944 * GetFileSecurityA [ADVAPI32.@] 1945 * 1946 * Obtains Specified information about the security of a file or directory. 1947 * 1948 * PARAMS 1949 * lpFileName [I] Name of the file to get info for 1950 * RequestedInformation [I] SE_ flags from "winnt.h" 1951 * pSecurityDescriptor [O] Destination for security information 1952 * nLength [I] Length of pSecurityDescriptor 1953 * lpnLengthNeeded [O] Destination for length of returned security information 1954 * 1955 * RETURNS 1956 * Success: TRUE. pSecurityDescriptor contains the requested information. 1957 * Failure: FALSE. lpnLengthNeeded contains the required space to return the info. 1958 * 1959 * NOTES 1960 * The information returned is constrained by the callers access rights and 1961 * privileges. 1962 */ 1963 BOOL WINAPI 1964 GetFileSecurityA( LPCSTR lpFileName, 1965 SECURITY_INFORMATION RequestedInformation, 1966 PSECURITY_DESCRIPTOR pSecurityDescriptor, 1967 DWORD nLength, LPDWORD lpnLengthNeeded ) 1968 { 1969 DWORD len; 1970 BOOL r; 1971 LPWSTR name = NULL; 1972 1973 if( lpFileName ) 1974 { 1975 len = MultiByteToWideChar( CP_ACP, 0, lpFileName, -1, NULL, 0 ); 1976 name = HeapAlloc( GetProcessHeap(), 0, len*sizeof(WCHAR) ); 1977 MultiByteToWideChar( CP_ACP, 0, lpFileName, -1, name, len ); 1978 } 1979 1980 r = GetFileSecurityW( name, RequestedInformation, pSecurityDescriptor, 1981 nLength, lpnLengthNeeded ); 1982 HeapFree( GetProcessHeap(), 0, name ); 1983 1984 return r; 1985 } 1986 1987 /****************************************************************************** 1988 * GetFileSecurityW [ADVAPI32.@] 1989 * 1990 * See GetFileSecurityA. 1991 */ 1992 BOOL WINAPI 1993 GetFileSecurityW( LPCWSTR lpFileName, 1994 SECURITY_INFORMATION RequestedInformation, 1995 PSECURITY_DESCRIPTOR pSecurityDescriptor, 1996 DWORD nLength, LPDWORD lpnLengthNeeded ) 1997 { 1998 HANDLE hfile; 1999 NTSTATUS status; 2000 DWORD access = 0; 2001 2002 TRACE("(%s,%d,%p,%d,%p)\n", debugstr_w(lpFileName), 2003 RequestedInformation, pSecurityDescriptor, 2004 nLength, lpnLengthNeeded); 2005 2006 if (RequestedInformation & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION| 2007 DACL_SECURITY_INFORMATION)) 2008 access |= READ_CONTROL; 2009 if (RequestedInformation & SACL_SECURITY_INFORMATION) 2010 access |= ACCESS_SYSTEM_SECURITY; 2011 2012 hfile = CreateFileW( lpFileName, access, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, 2013 NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0 ); 2014 if ( hfile == INVALID_HANDLE_VALUE ) 2015 return FALSE; 2016 2017 status = NtQuerySecurityObject( hfile, RequestedInformation, pSecurityDescriptor, 2018 nLength, lpnLengthNeeded ); 2019 CloseHandle( hfile ); 2020 return set_ntstatus( status ); 2021 } 2022 2023 2024 /****************************************************************************** 2025 * LookupAccountSidA [ADVAPI32.@] 2026 */ 2027 BOOL WINAPI 2028 LookupAccountSidA( 2029 IN LPCSTR system, 2030 IN PSID sid, 2031 OUT LPSTR account, 2032 IN OUT LPDWORD accountSize, 2033 OUT LPSTR domain, 2034 IN OUT LPDWORD domainSize, 2035 OUT PSID_NAME_USE name_use ) 2036 { 2037 DWORD len; 2038 BOOL r; 2039 LPWSTR systemW = NULL; 2040 LPWSTR accountW = NULL; 2041 LPWSTR domainW = NULL; 2042 DWORD accountSizeW = *accountSize; 2043 DWORD domainSizeW = *domainSize; 2044 2045 if (system) { 2046 len = MultiByteToWideChar( CP_ACP, 0, system, -1, NULL, 0 ); 2047 systemW = HeapAlloc( GetProcessHeap(), 0, len * sizeof(WCHAR) ); 2048 MultiByteToWideChar( CP_ACP, 0, system, -1, systemW, len ); 2049 } 2050 if (account) 2051 accountW = HeapAlloc( GetProcessHeap(), 0, accountSizeW * sizeof(WCHAR) ); 2052 if (domain) 2053 domainW = HeapAlloc( GetProcessHeap(), 0, domainSizeW * sizeof(WCHAR) ); 2054 2055 r = LookupAccountSidW( systemW, sid, accountW, &accountSizeW, domainW, &domainSizeW, name_use ); 2056 2057 if (r) { 2058 if (accountW && *accountSize) { 2059 len = WideCharToMultiByte( CP_ACP, 0, accountW, -1, NULL, 0, NULL, NULL ); 2060 WideCharToMultiByte( CP_ACP, 0, accountW, -1, account, len, NULL, NULL ); 2061 *accountSize = len; 2062 } else 2063 *accountSize = accountSizeW + 1; 2064 2065 if (domainW && *domainSize) { 2066 len = WideCharToMultiByte( CP_ACP, 0, domainW, -1, NULL, 0, NULL, NULL ); 2067 WideCharToMultiByte( CP_ACP, 0, domainW, -1, domain, len, NULL, NULL ); 2068 *domainSize = len; 2069 } else 2070 *domainSize = domainSizeW + 1; 2071 } 2072 2073 HeapFree( GetProcessHeap(), 0, systemW ); 2074 HeapFree( GetProcessHeap(), 0, accountW ); 2075 HeapFree( GetProcessHeap(), 0, domainW ); 2076 2077 return r; 2078 } 2079 2080 /****************************************************************************** 2081 * LookupAccountSidW [ADVAPI32.@] 2082 * 2083 * PARAMS 2084 * system [] 2085 * sid [] 2086 * account [] 2087 * accountSize [] 2088 * domain [] 2089 * domainSize [] 2090 * name_use [] 2091 */ 2092 2093 BOOL WINAPI 2094 LookupAccountSidW( 2095 IN LPCWSTR system, 2096 IN PSID sid, 2097 OUT LPWSTR account, 2098 IN OUT LPDWORD accountSize, 2099 OUT LPWSTR domain, 2100 IN OUT LPDWORD domainSize, 2101 OUT PSID_NAME_USE name_use ) 2102 { 2103 unsigned int i, j; 2104 const WCHAR * ac = NULL; 2105 const WCHAR * dm = NULL; 2106 SID_NAME_USE use = 0; 2107 LPWSTR computer_name = NULL; 2108 LPWSTR account_name = NULL; 2109 2110 TRACE("(%s,sid=%s,%p,%p(%u),%p,%p(%u),%p)\n", 2111 debugstr_w(system),debugstr_sid(sid), 2112 account,accountSize,accountSize?*accountSize:0, 2113 domain,domainSize,domainSize?*domainSize:0, 2114 name_use); 2115 2116 if (!ADVAPI_IsLocalComputer(system)) { 2117 FIXME("Only local computer supported!\n"); 2118 SetLastError(RPC_S_SERVER_UNAVAILABLE); 2119 return FALSE; 2120 } 2121 2122 /* check the well known SIDs first */ 2123 for (i = 0; i <= 60; i++) { 2124 if (IsWellKnownSid(sid, i)) { 2125 for (j = 0; j < (sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0])); j++) { 2126 if (ACCOUNT_SIDS[j].type == i) { 2127 ac = ACCOUNT_SIDS[j].account; 2128 dm = ACCOUNT_SIDS[j].domain; 2129 use = ACCOUNT_SIDS[j].name_use; 2130 } 2131 } 2132 break; 2133 } 2134 } 2135 2136 if (dm == NULL) { 2137 MAX_SID local; 2138 2139 /* check for the local computer next */ 2140 if (ADVAPI_GetComputerSid(&local)) { 2141 DWORD size = MAX_COMPUTERNAME_LENGTH + 1; 2142 BOOL result; 2143 2144 computer_name = HeapAlloc(GetProcessHeap(), 0, size * sizeof(WCHAR)); 2145 result = GetComputerNameW(computer_name, &size); 2146 2147 if (result) { 2148 if (EqualSid(sid, &local)) { 2149 dm = computer_name; 2150 ac = Blank; 2151 use = 3; 2152 } else { 2153 local.SubAuthorityCount++; 2154 2155 if (EqualPrefixSid(sid, &local)) { 2156 dm = computer_name; 2157 use = 1; 2158 switch (((MAX_SID *)sid)->SubAuthority[4]) { 2159 case DOMAIN_USER_RID_ADMIN: 2160 ac = Administrator; 2161 break; 2162 case DOMAIN_USER_RID_GUEST: 2163 ac = Guest; 2164 break; 2165 case DOMAIN_GROUP_RID_ADMINS: 2166 ac = Domain_Admins; 2167 break; 2168 case DOMAIN_GROUP_RID_USERS: 2169 ac = Domain_Users; 2170 break; 2171 case DOMAIN_GROUP_RID_GUESTS: 2172 ac = Domain_Guests; 2173 break; 2174 case DOMAIN_GROUP_RID_COMPUTERS: 2175 ac = Domain_Computers; 2176 break; 2177 case DOMAIN_GROUP_RID_CONTROLLERS: 2178 ac = Domain_Controllers; 2179 break; 2180 case DOMAIN_GROUP_RID_CERT_ADMINS: 2181 ac = Cert_Publishers; 2182 break; 2183 case DOMAIN_GROUP_RID_SCHEMA_ADMINS: 2184 ac = Schema_Admins; 2185 break; 2186 case DOMAIN_GROUP_RID_ENTERPRISE_ADMINS: 2187 ac = Enterprise_Admins; 2188 break; 2189 case DOMAIN_GROUP_RID_POLICY_ADMINS: 2190 ac = Group_Policy_Creator_Owners; 2191 break; 2192 case DOMAIN_ALIAS_RID_RAS_SERVERS: 2193 ac = RAS_and_IAS_Servers; 2194 break; 2195 case 1000: /* first user account */ 2196 size = UNLEN + 1; 2197 account_name = HeapAlloc( 2198 GetProcessHeap(), 0, size * sizeof(WCHAR)); 2199 if (GetUserNameW(account_name, &size)) 2200 ac = account_name; 2201 else 2202 dm = NULL; 2203 2204 break; 2205 default: 2206 dm = NULL; 2207 break; 2208 } 2209 } 2210 } 2211 } 2212 } 2213 } 2214 2215 if (dm) { 2216 DWORD ac_len = lstrlenW(ac); 2217 DWORD dm_len = lstrlenW(dm); 2218 BOOL status = TRUE; 2219 2220 if (*accountSize > ac_len) { 2221 if (account) 2222 lstrcpyW(account, ac); 2223 } 2224 if (*domainSize > dm_len) { 2225 if (domain) 2226 lstrcpyW(domain, dm); 2227 } 2228 if (((*accountSize != 0) && (*accountSize < ac_len)) || 2229 ((*domainSize != 0) && (*domainSize < dm_len))) { 2230 SetLastError(ERROR_INSUFFICIENT_BUFFER); 2231 status = FALSE; 2232 } 2233 if (*domainSize) 2234 *domainSize = dm_len; 2235 else 2236 *domainSize = dm_len + 1; 2237 if (*accountSize) 2238 *accountSize = ac_len; 2239 else 2240 *accountSize = ac_len + 1; 2241 *name_use = use; 2242 HeapFree(GetProcessHeap(), 0, account_name); 2243 HeapFree(GetProcessHeap(), 0, computer_name); 2244 return status; 2245 } 2246 2247 HeapFree(GetProcessHeap(), 0, account_name); 2248 HeapFree(GetProcessHeap(), 0, computer_name); 2249 SetLastError(ERROR_NONE_MAPPED); 2250 return FALSE; 2251 } 2252 2253 /****************************************************************************** 2254 * SetFileSecurityA [ADVAPI32.@] 2255 * 2256 * See SetFileSecurityW. 2257 */ 2258 BOOL WINAPI SetFileSecurityA( LPCSTR lpFileName, 2259 SECURITY_INFORMATION RequestedInformation, 2260 PSECURITY_DESCRIPTOR pSecurityDescriptor) 2261 { 2262 DWORD len; 2263 BOOL r; 2264 LPWSTR name = NULL; 2265 2266 if( lpFileName ) 2267 { 2268 len = MultiByteToWideChar( CP_ACP, 0, lpFileName, -1, NULL, 0 ); 2269 name = HeapAlloc( GetProcessHeap(), 0, len*sizeof(WCHAR) ); 2270 MultiByteToWideChar( CP_ACP, 0, lpFileName, -1, name, len ); 2271 } 2272 2273 r = SetFileSecurityW( name, RequestedInformation, pSecurityDescriptor ); 2274 HeapFree( GetProcessHeap(), 0, name ); 2275 2276 return r; 2277 } 2278 2279 /****************************************************************************** 2280 * SetFileSecurityW [ADVAPI32.@] 2281 * 2282 * Sets the security of a file or directory. 2283 * 2284 * PARAMS 2285 * lpFileName [] 2286 * RequestedInformation [] 2287 * pSecurityDescriptor [] 2288 * 2289 * RETURNS 2290 * Success: TRUE. 2291 * Failure: FALSE. 2292 */ 2293 BOOL WINAPI 2294 SetFileSecurityW( LPCWSTR lpFileName, 2295 SECURITY_INFORMATION RequestedInformation, 2296 PSECURITY_DESCRIPTOR pSecurityDescriptor ) 2297 { 2298 HANDLE file; 2299 DWORD access = 0; 2300 NTSTATUS status; 2301 2302 TRACE("(%s, 0x%x, %p)\n", debugstr_w(lpFileName), RequestedInformation, 2303 pSecurityDescriptor ); 2304 2305 if (RequestedInformation & OWNER_SECURITY_INFORMATION || 2306 RequestedInformation & GROUP_SECURITY_INFORMATION) 2307 access |= WRITE_OWNER; 2308 if (RequestedInformation & SACL_SECURITY_INFORMATION) 2309 access |= ACCESS_SYSTEM_SECURITY; 2310 if (RequestedInformation & DACL_SECURITY_INFORMATION) 2311 access |= WRITE_DAC; 2312 2313 file = CreateFileW( lpFileName, access, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, 2314 NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL ); 2315 if (file == INVALID_HANDLE_VALUE) 2316 return FALSE; 2317 2318 status = NtSetSecurityObject( file, RequestedInformation, pSecurityDescriptor ); 2319 CloseHandle( file ); 2320 return set_ntstatus( status ); 2321 } 2322 2323 /****************************************************************************** 2324 * QueryWindows31FilesMigration [ADVAPI32.@] 2325 * 2326 * PARAMS 2327 * x1 [] 2328 */ 2329 BOOL WINAPI 2330 QueryWindows31FilesMigration( DWORD x1 ) 2331 { 2332 FIXME("(%d):stub\n",x1); 2333 return TRUE; 2334 } 2335 2336 /****************************************************************************** 2337 * SynchronizeWindows31FilesAndWindowsNTRegistry [ADVAPI32.@] 2338 * 2339 * PARAMS 2340 * x1 [] 2341 * x2 [] 2342 * x3 [] 2343 * x4 [] 2344 */ 2345 BOOL WINAPI 2346 SynchronizeWindows31FilesAndWindowsNTRegistry( DWORD x1, DWORD x2, DWORD x3, 2347 DWORD x4 ) 2348 { 2349 FIXME("(0x%08x,0x%08x,0x%08x,0x%08x):stub\n",x1,x2,x3,x4); 2350 return TRUE; 2351 } 2352 2353 /****************************************************************************** 2354 * NotifyBootConfigStatus [ADVAPI32.@] 2355 * 2356 * PARAMS 2357 * x1 [] 2358 */ 2359 BOOL WINAPI 2360 NotifyBootConfigStatus( BOOL x1 ) 2361 { 2362 FIXME("(0x%08d):stub\n",x1); 2363 return 1; 2364 } 2365 2366 /****************************************************************************** 2367 * RevertToSelf [ADVAPI32.@] 2368 * 2369 * Ends the impersonation of a user. 2370 * 2371 * PARAMS 2372 * void [] 2373 * 2374 * RETURNS 2375 * Success: TRUE. 2376 * Failure: FALSE. 2377 */ 2378 BOOL WINAPI 2379 RevertToSelf( void ) 2380 { 2381 HANDLE Token = NULL; 2382 return set_ntstatus( NtSetInformationThread( GetCurrentThread(), 2383 ThreadImpersonationToken, &Token, sizeof(Token) ) ); 2384 } 2385 2386 /****************************************************************************** 2387 * ImpersonateSelf [ADVAPI32.@] 2388 * 2389 * Makes an impersonation token that represents the process user and assigns 2390 * to the current thread. 2391 * 2392 * PARAMS 2393 * ImpersonationLevel [I] Level at which to impersonate. 2394 * 2395 * RETURNS 2396 * Success: TRUE. 2397 * Failure: FALSE. 2398 */ 2399 BOOL WINAPI 2400 ImpersonateSelf(SECURITY_IMPERSONATION_LEVEL ImpersonationLevel) 2401 { 2402 return set_ntstatus( RtlImpersonateSelf( ImpersonationLevel ) ); 2403 } 2404 2405 /****************************************************************************** 2406 * ImpersonateLoggedOnUser [ADVAPI32.@] 2407 */ 2408 BOOL WINAPI ImpersonateLoggedOnUser(HANDLE hToken) 2409 { 2410 DWORD size; 2411 NTSTATUS Status; 2412 HANDLE ImpersonationToken; 2413 TOKEN_TYPE Type; 2414 static BOOL warn = TRUE; 2415 2416 if (warn) 2417 { 2418 FIXME( "(%p)\n", hToken ); 2419 warn = FALSE; 2420 } 2421 if (!GetTokenInformation( hToken, TokenType, &Type, 2422 sizeof(TOKEN_TYPE), &size )) 2423 return FALSE; 2424 2425 if (Type == TokenPrimary) 2426 { 2427 OBJECT_ATTRIBUTES ObjectAttributes; 2428 2429 InitializeObjectAttributes( &ObjectAttributes, NULL, 0, NULL, NULL ); 2430 2431 Status = NtDuplicateToken( hToken, 2432 TOKEN_IMPERSONATE | TOKEN_QUERY, 2433 &ObjectAttributes, 2434 SecurityImpersonation, 2435 TokenImpersonation, 2436 &ImpersonationToken ); 2437 if (Status != STATUS_SUCCESS) 2438 { 2439 ERR( "NtDuplicateToken failed with error 0x%08x\n", Status ); 2440 SetLastError( RtlNtStatusToDosError( Status ) ); 2441 return FALSE; 2442 } 2443 } 2444 else 2445 ImpersonationToken = hToken; 2446 2447 Status = NtSetInformationThread( GetCurrentThread(), 2448 ThreadImpersonationToken, 2449 &ImpersonationToken, 2450 sizeof(ImpersonationToken) ); 2451 2452 if (Type == TokenPrimary) 2453 NtClose( ImpersonationToken ); 2454 2455 if (Status != STATUS_SUCCESS) 2456 { 2457 ERR( "NtSetInformationThread failed with error 0x%08x\n", Status ); 2458 SetLastError( RtlNtStatusToDosError( Status ) ); 2459 return FALSE; 2460 } 2461 2462 return TRUE; 2463 } 2464 2465 /****************************************************************************** 2466 * AccessCheck [ADVAPI32.@] 2467 */ 2468 BOOL WINAPI 2469 AccessCheck( 2470 PSECURITY_DESCRIPTOR SecurityDescriptor, 2471 HANDLE ClientToken, 2472 DWORD DesiredAccess, 2473 PGENERIC_MAPPING GenericMapping, 2474 PPRIVILEGE_SET PrivilegeSet, 2475 LPDWORD PrivilegeSetLength, 2476 LPDWORD GrantedAccess, 2477 LPBOOL AccessStatus) 2478 { 2479 NTSTATUS access_status; 2480 BOOL ret = set_ntstatus( NtAccessCheck(SecurityDescriptor, ClientToken, DesiredAccess, 2481 GenericMapping, PrivilegeSet, PrivilegeSetLength, 2482 GrantedAccess, &access_status) ); 2483 if (ret) *AccessStatus = set_ntstatus( access_status ); 2484 return ret; 2485 } 2486 2487 2488 /****************************************************************************** 2489 * AccessCheckByType [ADVAPI32.@] 2490 */ 2491 BOOL WINAPI AccessCheckByType( 2492 PSECURITY_DESCRIPTOR pSecurityDescriptor, 2493 PSID PrincipalSelfSid, 2494 HANDLE ClientToken, 2495 DWORD DesiredAccess, 2496 POBJECT_TYPE_LIST ObjectTypeList, 2497 DWORD ObjectTypeListLength, 2498 PGENERIC_MAPPING GenericMapping, 2499 PPRIVILEGE_SET PrivilegeSet, 2500 LPDWORD PrivilegeSetLength, 2501 LPDWORD GrantedAccess, 2502 LPBOOL AccessStatus) 2503 { 2504 FIXME("stub\n"); 2505 2506 *AccessStatus = TRUE; 2507 2508 return !*AccessStatus; 2509 } 2510 2511 /****************************************************************************** 2512 * MapGenericMask [ADVAPI32.@] 2513 * 2514 * Maps generic access rights into specific access rights according to the 2515 * supplied mapping. 2516 * 2517 * PARAMS 2518 * AccessMask [I/O] Access rights. 2519 * GenericMapping [I] The mapping between generic and specific rights. 2520 * 2521 * RETURNS 2522 * Nothing. 2523 */ 2524 VOID WINAPI MapGenericMask( PDWORD AccessMask, PGENERIC_MAPPING GenericMapping ) 2525 { 2526 RtlMapGenericMask( AccessMask, GenericMapping ); 2527 } 2528 2529 /************************************************************************* 2530 * SetKernelObjectSecurity [ADVAPI32.@] 2531 */ 2532 BOOL WINAPI SetKernelObjectSecurity ( 2533 IN HANDLE Handle, 2534 IN SECURITY_INFORMATION SecurityInformation, 2535 IN PSECURITY_DESCRIPTOR SecurityDescriptor ) 2536 { 2537 return set_ntstatus (NtSetSecurityObject (Handle, SecurityInformation, SecurityDescriptor)); 2538 } 2539 2540 2541 /****************************************************************************** 2542 * AddAuditAccessAce [ADVAPI32.@] 2543 */ 2544 BOOL WINAPI AddAuditAccessAce( 2545 IN OUT PACL pAcl, 2546 IN DWORD dwAceRevision, 2547 IN DWORD dwAccessMask, 2548 IN PSID pSid, 2549 IN BOOL bAuditSuccess, 2550 IN BOOL bAuditFailure) 2551 { 2552 return set_ntstatus( RtlAddAuditAccessAce(pAcl, dwAceRevision, dwAccessMask, pSid, 2553 bAuditSuccess, bAuditFailure) ); 2554 } 2555 2556 /****************************************************************************** 2557 * AddAuditAccessAce [ADVAPI32.@] 2558 */ 2559 BOOL WINAPI AddAuditAccessAceEx( 2560 IN OUT PACL pAcl, 2561 IN DWORD dwAceRevision, 2562 IN DWORD dwAceFlags, 2563 IN DWORD dwAccessMask, 2564 IN PSID pSid, 2565 IN BOOL bAuditSuccess, 2566 IN BOOL bAuditFailure) 2567 { 2568 return set_ntstatus( RtlAddAuditAccessAceEx(pAcl, dwAceRevision, dwAceFlags, dwAccessMask, pSid, 2569 bAuditSuccess, bAuditFailure) ); 2570 } 2571 2572 /****************************************************************************** 2573 * LookupAccountNameA [ADVAPI32.@] 2574 */ 2575 BOOL WINAPI 2576 LookupAccountNameA( 2577 IN LPCSTR system, 2578 IN LPCSTR account, 2579 OUT PSID sid, 2580 OUT LPDWORD cbSid, 2581 LPSTR ReferencedDomainName, 2582 IN OUT LPDWORD cbReferencedDomainName, 2583 OUT PSID_NAME_USE name_use ) 2584 { 2585 BOOL ret; 2586 UNICODE_STRING lpSystemW; 2587 UNICODE_STRING lpAccountW; 2588 LPWSTR lpReferencedDomainNameW = NULL; 2589 2590 RtlCreateUnicodeStringFromAsciiz(&lpSystemW, system); 2591 RtlCreateUnicodeStringFromAsciiz(&lpAccountW, account); 2592 2593 if (ReferencedDomainName) 2594 lpReferencedDomainNameW = HeapAlloc(GetProcessHeap(), 0, *cbReferencedDomainName * sizeof(WCHAR)); 2595 2596 ret = LookupAccountNameW(lpSystemW.Buffer, lpAccountW.Buffer, sid, cbSid, lpReferencedDomainNameW, 2597 cbReferencedDomainName, name_use); 2598 2599 if (ret && lpReferencedDomainNameW) 2600 { 2601 WideCharToMultiByte(CP_ACP, 0, lpReferencedDomainNameW, -1, 2602 ReferencedDomainName, *cbReferencedDomainName+1, NULL, NULL); 2603 } 2604 2605 RtlFreeUnicodeString(&lpSystemW); 2606 RtlFreeUnicodeString(&lpAccountW); 2607 HeapFree(GetProcessHeap(), 0, lpReferencedDomainNameW); 2608 2609 return ret; 2610 } 2611 2612 /****************************************************************************** 2613 * lookup_user_account_name 2614 */ 2615 static BOOL lookup_user_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName, 2616 LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse ) 2617 { 2618 char buffer[sizeof(TOKEN_USER) + sizeof(SID) + sizeof(DWORD)*SID_MAX_SUB_AUTHORITIES]; 2619 DWORD len = sizeof(buffer); 2620 HANDLE token; 2621 BOOL ret; 2622 PSID pSid; 2623 static const WCHAR dm[] = {'D','O','M','A','I','N',0}; 2624 DWORD nameLen; 2625 LPCWSTR domainName; 2626 2627 if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token)) 2628 { 2629 if (GetLastError() != ERROR_NO_TOKEN) return FALSE; 2630 if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) return FALSE; 2631 } 2632 2633 ret = GetTokenInformation(token, TokenUser, buffer, len, &len); 2634 CloseHandle( token ); 2635 2636 if (!ret) return FALSE; 2637 2638 pSid = ((TOKEN_USER *)buffer)->User.Sid; 2639 2640 if (Sid != NULL && (*cbSid >= GetLengthSid(pSid))) 2641 CopySid(*cbSid, Sid, pSid); 2642 if (*cbSid < GetLengthSid(pSid)) 2643 { 2644 SetLastError(ERROR_INSUFFICIENT_BUFFER); 2645 ret = FALSE; 2646 } 2647 *cbSid = GetLengthSid(pSid); 2648 2649 domainName = dm; 2650 nameLen = strlenW(domainName); 2651 2652 if (*cchReferencedDomainName <= nameLen || !ret) 2653 { 2654 SetLastError(ERROR_INSUFFICIENT_BUFFER); 2655 nameLen += 1; 2656 ret = FALSE; 2657 } 2658 else if (ReferencedDomainName) 2659 strcpyW(ReferencedDomainName, domainName); 2660 2661 *cchReferencedDomainName = nameLen; 2662 2663 if (ret) 2664 *peUse = SidTypeUser; 2665 2666 return ret; 2667 } 2668 2669 /****************************************************************************** 2670 * lookup_computer_account_name 2671 */ 2672 static BOOL lookup_computer_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName, 2673 LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse ) 2674 { 2675 MAX_SID local; 2676 BOOL ret; 2677 static const WCHAR dm[] = {'D','O','M','A','I','N',0}; 2678 DWORD nameLen; 2679 LPCWSTR domainName; 2680 2681 if ((ret = ADVAPI_GetComputerSid(&local))) 2682 { 2683 if (Sid != NULL && (*cbSid >= GetLengthSid(&local))) 2684 CopySid(*cbSid, Sid, &local); 2685 if (*cbSid < GetLengthSid(&local)) 2686 { 2687 SetLastError(ERROR_INSUFFICIENT_BUFFER); 2688 ret = FALSE; 2689 } 2690 *cbSid = GetLengthSid(&local); 2691 } 2692 2693 domainName = dm; 2694 nameLen = strlenW(domainName); 2695 2696 if (*cchReferencedDomainName <= nameLen || !ret) 2697 { 2698 SetLastError(ERROR_INSUFFICIENT_BUFFER); 2699 nameLen += 1; 2700 ret = FALSE; 2701 } 2702 else if (ReferencedDomainName) 2703 strcpyW(ReferencedDomainName, domainName); 2704 2705 *cchReferencedDomainName = nameLen; 2706 2707 if (ret) 2708 *peUse = SidTypeDomain; 2709 2710 return ret; 2711 } 2712 2713 static void split_domain_account( const LSA_UNICODE_STRING *str, LSA_UNICODE_STRING *account, 2714 LSA_UNICODE_STRING *domain ) 2715 { 2716 WCHAR *p = str->Buffer + str->Length / sizeof(WCHAR) - 1; 2717 2718 while (p > str->Buffer && *p != '\\') p--; 2719 2720 if (*p == '\\') 2721 { 2722 domain->Buffer = str->Buffer; 2723 domain->Length = (p - str->Buffer) * sizeof(WCHAR); 2724 2725 account->Buffer = p + 1; 2726 account->Length = str->Length - ((p - str->Buffer + 1) * sizeof(WCHAR)); 2727 } 2728 else 2729 { 2730 domain->Buffer = NULL; 2731 domain->Length = 0; 2732 2733 account->Buffer = str->Buffer; 2734 account->Length = str->Length; 2735 } 2736 } 2737 2738 static BOOL match_domain( ULONG idx, LSA_UNICODE_STRING *domain ) 2739 { 2740 ULONG len = strlenW( ACCOUNT_SIDS[idx].domain ); 2741 2742 if (len == domain->Length / sizeof(WCHAR) && !strncmpiW( domain->Buffer, ACCOUNT_SIDS[idx].domain, len )) 2743 return TRUE; 2744 2745 return FALSE; 2746 } 2747 2748 static BOOL match_account( ULONG idx, LSA_UNICODE_STRING *account ) 2749 { 2750 ULONG len = strlenW( ACCOUNT_SIDS[idx].account ); 2751 2752 if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].account, len )) 2753 return TRUE; 2754 2755 if (ACCOUNT_SIDS[idx].alias) 2756 { 2757 len = strlenW( ACCOUNT_SIDS[idx].alias ); 2758 if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].alias, len )) 2759 return TRUE; 2760 } 2761 return FALSE; 2762 } 2763 2764 /* 2765 * Helper function for LookupAccountNameW 2766 */ 2767 BOOL lookup_local_wellknown_name( LSA_UNICODE_STRING *account_and_domain, 2768 PSID Sid, LPDWORD cbSid, 2769 LPWSTR ReferencedDomainName, 2770 LPDWORD cchReferencedDomainName, 2771 PSID_NAME_USE peUse, BOOL *handled ) 2772 { 2773 PSID pSid; 2774 LSA_UNICODE_STRING account, domain; 2775 BOOL ret = TRUE; 2776 ULONG i; 2777 2778 *handled = FALSE; 2779 split_domain_account( account_and_domain, &account, &domain ); 2780 2781 for (i = 0; i < sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0]); i++) 2782 { 2783 /* check domain first */ 2784 if (domain.Buffer && !match_domain( i, &domain )) continue; 2785 2786 if (match_account( i, &account )) 2787 { 2788 DWORD len, sidLen = SECURITY_MAX_SID_SIZE; 2789 2790 if (!(pSid = HeapAlloc( GetProcessHeap(), 0, sidLen ))) return FALSE; 2791 2792 if ((ret = CreateWellKnownSid( ACCOUNT_SIDS[i].type, NULL, pSid, &sidLen ))) 2793 { 2794 if (*cbSid < sidLen) 2795 { 2796 SetLastError(ERROR_INSUFFICIENT_BUFFER); 2797 ret = FALSE; 2798 } 2799 else if (Sid) 2800 { 2801 CopySid(*cbSid, Sid, pSid); 2802 } 2803 *cbSid = sidLen; 2804 } 2805 2806 len = strlenW( ACCOUNT_SIDS[i].domain ); 2807 if (*cchReferencedDomainName <= len || !ret) 2808 { 2809 SetLastError(ERROR_INSUFFICIENT_BUFFER); 2810 len++; 2811 ret = FALSE; 2812 } 2813 else if (ReferencedDomainName) 2814 { 2815 strcpyW( ReferencedDomainName, ACCOUNT_SIDS[i].domain ); 2816 } 2817 2818 *cchReferencedDomainName = len; 2819 if (ret) 2820 *peUse = ACCOUNT_SIDS[i].name_use; 2821 2822 HeapFree(GetProcessHeap(), 0, pSid); 2823 *handled = TRUE; 2824 return ret; 2825 } 2826 } 2827 return ret; 2828 } 2829 2830 BOOL lookup_local_user_name( LSA_UNICODE_STRING *account_and_domain, 2831 PSID Sid, LPDWORD cbSid, 2832 LPWSTR ReferencedDomainName, 2833 LPDWORD cchReferencedDomainName, 2834 PSID_NAME_USE peUse, BOOL *handled ) 2835 { 2836 DWORD nameLen; 2837 LPWSTR userName = NULL; 2838 LSA_UNICODE_STRING account, domain; 2839 BOOL ret = TRUE; 2840 2841 *handled = FALSE; 2842 split_domain_account( account_and_domain, &account, &domain ); 2843 2844 /* Let the current Unix user id masquerade as first Windows user account */ 2845 2846 nameLen = UNLEN + 1; 2847 if (!(userName = HeapAlloc( GetProcessHeap(), 0, nameLen * sizeof(WCHAR) ))) return FALSE; 2848 2849 if (domain.Buffer) 2850 { 2851 /* check to make sure this account is on this computer */ 2852 if (GetComputerNameW( userName, &nameLen ) && 2853 (domain.Length / sizeof(WCHAR) != nameLen || strncmpW( domain.Buffer, userName, nameLen ))) 2854 { 2855 SetLastError(ERROR_NONE_MAPPED); 2856 ret = FALSE; 2857 } 2858 nameLen = UNLEN + 1; 2859 } 2860 2861 if (GetUserNameW( userName, &nameLen ) && 2862 account.Length / sizeof(WCHAR) == nameLen - 1 && !strncmpW( account.Buffer, userName, nameLen - 1 )) 2863 { 2864 ret = lookup_user_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse ); 2865 *handled = TRUE; 2866 } 2867 else 2868 { 2869 nameLen = UNLEN + 1; 2870 if (GetComputerNameW( userName, &nameLen ) && 2871 account.Length / sizeof(WCHAR) == nameLen && !strncmpW( account.Buffer, userName , nameLen )) 2872 { 2873 ret = lookup_computer_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse ); 2874 *handled = TRUE; 2875 } 2876 } 2877 2878 HeapFree(GetProcessHeap(), 0, userName); 2879 return ret; 2880 } 2881 2882 /****************************************************************************** 2883 * LookupAccountNameW [ADVAPI32.@] 2884 */ 2885 BOOL WINAPI LookupAccountNameW( LPCWSTR lpSystemName, LPCWSTR lpAccountName, PSID Sid, 2886 LPDWORD cbSid, LPWSTR ReferencedDomainName, 2887 LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse ) 2888 { 2889 BOOL ret, handled; 2890 LSA_UNICODE_STRING account; 2891 2892 FIXME("%s %s %p %p %p %p %p - stub\n", debugstr_w(lpSystemName), debugstr_w(lpAccountName), 2893 Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse); 2894 2895 if (!ADVAPI_IsLocalComputer( lpSystemName )) 2896 { 2897 SetLastError( RPC_S_SERVER_UNAVAILABLE ); 2898 return FALSE; 2899 } 2900 2901 if (!lpAccountName || !strcmpW( lpAccountName, Blank )) 2902 { 2903 lpAccountName = BUILTIN; 2904 } 2905 2906 RtlInitUnicodeString( &account, lpAccountName ); 2907 2908 /* Check well known SIDs first */ 2909 ret = lookup_local_wellknown_name( &account, Sid, cbSid, ReferencedDomainName, 2910 cchReferencedDomainName, peUse, &handled ); 2911 if (handled) 2912 return ret; 2913 2914 /* Check user names */ 2915 ret = lookup_local_user_name( &account, Sid, cbSid, ReferencedDomainName, 2916 cchReferencedDomainName, peUse, &handled); 2917 if (handled) 2918 return ret; 2919 2920 SetLastError( ERROR_NONE_MAPPED ); 2921 return FALSE; 2922 } 2923 2924 /****************************************************************************** 2925 * PrivilegeCheck [ADVAPI32.@] 2926 */ 2927 BOOL WINAPI PrivilegeCheck( HANDLE ClientToken, PPRIVILEGE_SET RequiredPrivileges, LPBOOL pfResult) 2928 { 2929 BOOL ret; 2930 BOOLEAN Result; 2931 2932 TRACE("%p %p %p\n", ClientToken, RequiredPrivileges, pfResult); 2933 2934 ret = set_ntstatus (NtPrivilegeCheck (ClientToken, RequiredPrivileges, &Result)); 2935 if (ret) 2936 *pfResult = Result; 2937 return ret; 2938 } 2939 2940 /****************************************************************************** 2941 * AccessCheckAndAuditAlarmA [ADVAPI32.@] 2942 */ 2943 BOOL WINAPI AccessCheckAndAuditAlarmA(LPCSTR Subsystem, LPVOID HandleId, LPSTR ObjectTypeName, 2944 LPSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess, 2945 PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess, 2946 LPBOOL AccessStatus, LPBOOL pfGenerateOnClose) 2947 { 2948 FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_a(Subsystem), 2949 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName), 2950 SecurityDescriptor, DesiredAccess, GenericMapping, 2951 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose); 2952 return TRUE; 2953 } 2954 2955 /****************************************************************************** 2956 * AccessCheckAndAuditAlarmW [ADVAPI32.@] 2957 */ 2958 BOOL WINAPI AccessCheckAndAuditAlarmW(LPCWSTR Subsystem, LPVOID HandleId, LPWSTR ObjectTypeName, 2959 LPWSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess, 2960 PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess, 2961 LPBOOL AccessStatus, LPBOOL pfGenerateOnClose) 2962 { 2963 FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_w(Subsystem), 2964 HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName), 2965 SecurityDescriptor, DesiredAccess, GenericMapping, 2966 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose); 2967 return TRUE; 2968 } 2969 2970 BOOL WINAPI ObjectCloseAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose) 2971 { 2972 FIXME("stub (%s,%p,%x)\n", debugstr_a(SubsystemName), HandleId, GenerateOnClose); 2973 2974 return TRUE; 2975 } 2976 2977 BOOL WINAPI ObjectCloseAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose) 2978 { 2979 FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose); 2980 2981 return TRUE; 2982 } 2983 2984 BOOL WINAPI ObjectDeleteAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose) 2985 { 2986 FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose); 2987 2988 return TRUE; 2989 } 2990 2991 BOOL WINAPI ObjectOpenAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, LPSTR ObjectTypeName, 2992 LPSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess, 2993 DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted, 2994 LPBOOL GenerateOnClose) 2995 { 2996 FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_a(SubsystemName), 2997 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName), pSecurityDescriptor, 2998 ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted, 2999 GenerateOnClose); 3000 3001 return TRUE; 3002 } 3003 3004 BOOL WINAPI ObjectOpenAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, LPWSTR ObjectTypeName, 3005 LPWSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess, 3006 DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted, 3007 LPBOOL GenerateOnClose) 3008 { 3009 FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_w(SubsystemName), 3010 HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName), pSecurityDescriptor, 3011 ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted, 3012 GenerateOnClose); 3013 3014 return TRUE; 3015 } 3016 3017 BOOL WINAPI ObjectPrivilegeAuditAlarmA( LPCSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken, 3018 DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted) 3019 { 3020 FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_a(SubsystemName), HandleId, ClientToken, 3021 DesiredAccess, Privileges, AccessGranted); 3022 3023 return TRUE; 3024 } 3025 3026 BOOL WINAPI ObjectPrivilegeAuditAlarmW( LPCWSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken, 3027 DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted) 3028 { 3029 FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_w(SubsystemName), HandleId, ClientToken, 3030 DesiredAccess, Privileges, AccessGranted); 3031 3032 return TRUE; 3033 } 3034 3035 BOOL WINAPI PrivilegedServiceAuditAlarmA( LPCSTR SubsystemName, LPCSTR ServiceName, HANDLE ClientToken, 3036 PPRIVILEGE_SET Privileges, BOOL AccessGranted) 3037 { 3038 FIXME("stub (%s,%s,%p,%p,%x)\n", debugstr_a(SubsystemName), debugstr_a(ServiceName), 3039 ClientToken, Privileges, AccessGranted); 3040 3041 return TRUE; 3042 } 3043 3044 BOOL WINAPI PrivilegedServiceAuditAlarmW( LPCWSTR SubsystemName, LPCWSTR ServiceName, HANDLE ClientToken, 3045 PPRIVILEGE_SET Privileges, BOOL AccessGranted) 3046 { 3047 FIXME("stub %s,%s,%p,%p,%x)\n", debugstr_w(SubsystemName), debugstr_w(ServiceName), 3048 ClientToken, Privileges, AccessGranted); 3049 3050 return TRUE; 3051 } 3052 3053 /****************************************************************************** 3054 * GetSecurityInfo [ADVAPI32.@] 3055 * 3056 * Retrieves a copy of the security descriptor associated with an object. 3057 * 3058 * PARAMS 3059 * hObject [I] A handle for the object. 3060 * ObjectType [I] The type of object. 3061 * SecurityInfo [I] A bitmask indicating what info to retrieve. 3062 * ppsidOwner [O] If non-null, receives a pointer to the owner SID. 3063 * ppsidGroup [O] If non-null, receives a pointer to the group SID. 3064 * ppDacl [O] If non-null, receives a pointer to the DACL. 3065 * ppSacl [O] If non-null, receives a pointer to the SACL. 3066 * ppSecurityDescriptor [O] Receives a pointer to the security descriptor, 3067 * which must be freed with LocalFree. 3068 * 3069 * RETURNS 3070 * ERROR_SUCCESS if all's well, and a WIN32 error code otherwise. 3071 */ 3072 DWORD WINAPI GetSecurityInfo( 3073 HANDLE hObject, SE_OBJECT_TYPE ObjectType, 3074 SECURITY_INFORMATION SecurityInfo, PSID *ppsidOwner, 3075 PSID *ppsidGroup, PACL *ppDacl, PACL *ppSacl, 3076 PSECURITY_DESCRIPTOR *ppSecurityDescriptor 3077 ) 3078 { 3079 PSECURITY_DESCRIPTOR sd; 3080 NTSTATUS status; 3081 ULONG n1, n2; 3082 BOOL present, defaulted; 3083 3084 status = NtQuerySecurityObject(hObject, SecurityInfo, NULL, 0, &n1); 3085 if (status != STATUS_BUFFER_TOO_SMALL && status != STATUS_SUCCESS) 3086 return RtlNtStatusToDosError(status); 3087 3088 sd = LocalAlloc(0, n1); 3089 if (!sd) 3090 return ERROR_NOT_ENOUGH_MEMORY; 3091 3092 status = NtQuerySecurityObject(hObject, SecurityInfo, sd, n1, &n2); 3093 if (status != STATUS_SUCCESS) 3094 { 3095 LocalFree(sd); 3096 return RtlNtStatusToDosError(status); 3097 } 3098 3099 if (ppsidOwner) 3100 { 3101 *ppsidOwner = NULL; 3102 GetSecurityDescriptorOwner(sd, ppsidOwner, &defaulted); 3103 } 3104 if (ppsidGroup) 3105 { 3106 *ppsidGroup = NULL; 3107 GetSecurityDescriptorGroup(sd, ppsidGroup, &defaulted); 3108 } 3109 if (ppDacl) 3110 { 3111 *ppDacl = NULL; 3112 GetSecurityDescriptorDacl(sd, &present, ppDacl, &defaulted); 3113 } 3114 if (ppSacl) 3115 { 3116 *ppSacl = NULL; 3117 GetSecurityDescriptorSacl(sd, &present, ppSacl, &defaulted); 3118 } 3119 if (ppSecurityDescriptor) 3120 *ppSecurityDescriptor = sd; 3121 3122 /* The security descriptor (sd) cannot be freed if ppSecurityDescriptor is 3123 * NULL, because native happily returns the SIDs and ACLs that are requested 3124 * in this case. 3125 */ 3126 3127 return ERROR_SUCCESS; 3128 } 3129 3130 /****************************************************************************** 3131 * GetSecurityInfoExA [ADVAPI32.@] 3132 */ 3133 DWORD WINAPI GetSecurityInfoExA( 3134 HANDLE hObject, SE_OBJECT_TYPE ObjectType, 3135 SECURITY_INFORMATION SecurityInfo, LPCSTR lpProvider, 3136 LPCSTR lpProperty, PACTRL_ACCESSA *ppAccessList, 3137 PACTRL_AUDITA *ppAuditList, LPSTR *lppOwner, LPSTR *lppGroup 3138 ) 3139 { 3140 FIXME("stub!\n"); 3141 return ERROR_BAD_PROVIDER; 3142 } 3143 3144 /****************************************************************************** 3145 * GetSecurityInfoExW [ADVAPI32.@] 3146 */ 3147 DWORD WINAPI GetSecurityInfoExW( 3148 HANDLE hObject, SE_OBJECT_TYPE ObjectType, 3149 SECURITY_INFORMATION SecurityInfo, LPCWSTR lpProvider, 3150 LPCWSTR lpProperty, PACTRL_ACCESSW *ppAccessList, 3151 PACTRL_AUDITW *ppAuditList, LPWSTR *lppOwner, LPWSTR *lppGroup 3152 ) 3153 { 3154 FIXME("stub!\n"); 3155 return ERROR_BAD_PROVIDER; 3156 } 3157 3158 /****************************************************************************** 3159 * BuildExplicitAccessWithNameA [ADVAPI32.@] 3160 */ 3161 VOID WINAPI BuildExplicitAccessWithNameA( PEXPLICIT_ACCESSA pExplicitAccess, 3162 LPSTR pTrusteeName, DWORD AccessPermissions, 3163 ACCESS_MODE AccessMode, DWORD Inheritance ) 3164 { 3165 TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_a(pTrusteeName), 3166 AccessPermissions, AccessMode, Inheritance); 3167 3168 pExplicitAccess->grfAccessPermissions = AccessPermissions; 3169 pExplicitAccess->grfAccessMode = AccessMode; 3170 pExplicitAccess->grfInheritance = Inheritance; 3171 3172 pExplicitAccess->Trustee.pMultipleTrustee = NULL; 3173 pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; 3174 pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME; 3175 pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN; 3176 pExplicitAccess->Trustee.ptstrName = pTrusteeName; 3177 } 3178 3179 /****************************************************************************** 3180 * BuildExplicitAccessWithNameW [ADVAPI32.@] 3181 */ 3182 VOID WINAPI BuildExplicitAccessWithNameW( PEXPLICIT_ACCESSW pExplicitAccess, 3183 LPWSTR pTrusteeName, DWORD AccessPermissions, 3184 ACCESS_MODE AccessMode, DWORD Inheritance ) 3185 { 3186 TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_w(pTrusteeName), 3187 AccessPermissions, AccessMode, Inheritance); 3188 3189 pExplicitAccess->grfAccessPermissions = AccessPermissions; 3190 pExplicitAccess->grfAccessMode = AccessMode; 3191 pExplicitAccess->grfInheritance = Inheritance; 3192 3193 pExplicitAccess->Trustee.pMultipleTrustee = NULL; 3194 pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; 3195 pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME; 3196 pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN; 3197 pExplicitAccess->Trustee.ptstrName = pTrusteeName; 3198 } 3199 3200 /****************************************************************************** 3201 * BuildTrusteeWithObjectsAndNameA [ADVAPI32.@] 3202 */ 3203 VOID WINAPI BuildTrusteeWithObjectsAndNameA( PTRUSTEEA pTrustee, POBJECTS_AND_NAME_A pObjName, 3204 SE_OBJECT_TYPE ObjectType, LPSTR ObjectTypeName, 3205 LPSTR InheritedObjectTypeName, LPSTR Name ) 3206 { 3207 DWORD ObjectsPresent = 0; 3208 3209 TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName, 3210 ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_a(Name)); 3211 3212 /* Fill the OBJECTS_AND_NAME structure */ 3213 pObjName->ObjectType = ObjectType; 3214 if (ObjectTypeName != NULL) 3215 { 3216 ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT; 3217 } 3218 3219 pObjName->InheritedObjectTypeName = InheritedObjectTypeName; 3220 if (InheritedObjectTypeName != NULL) 3221 { 3222 ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT; 3223 } 3224 3225 pObjName->ObjectsPresent = ObjectsPresent; 3226 pObjName->ptstrName = Name; 3227 3228 /* Fill the TRUSTEE structure */ 3229 pTrustee->pMultipleTrustee = NULL; 3230 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; 3231 pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME; 3232 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN; 3233 pTrustee->ptstrName = (LPSTR)pObjName; 3234 } 3235 3236 /****************************************************************************** 3237 * BuildTrusteeWithObjectsAndNameW [ADVAPI32.@] 3238 */ 3239 VOID WINAPI BuildTrusteeWithObjectsAndNameW( PTRUSTEEW pTrustee, POBJECTS_AND_NAME_W pObjName, 3240 SE_OBJECT_TYPE ObjectType, LPWSTR ObjectTypeName, 3241 LPWSTR InheritedObjectTypeName, LPWSTR Name ) 3242 { 3243 DWORD ObjectsPresent = 0; 3244 3245 TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName, 3246 ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_w(Name)); 3247 3248 /* Fill the OBJECTS_AND_NAME structure */ 3249 pObjName->ObjectType = ObjectType; 3250 if (ObjectTypeName != NULL) 3251 { 3252 ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT; 3253 } 3254 3255 pObjName->InheritedObjectTypeName = InheritedObjectTypeName; 3256 if (InheritedObjectTypeName != NULL) 3257 { 3258 ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT; 3259 } 3260 3261 pObjName->ObjectsPresent = ObjectsPresent; 3262 pObjName->ptstrName = Name; 3263 3264 /* Fill the TRUSTEE structure */ 3265 pTrustee->pMultipleTrustee = NULL; 3266 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; 3267 pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME; 3268 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN; 3269 pTrustee->ptstrName = (LPWSTR)pObjName; 3270 } 3271 3272 /****************************************************************************** 3273 * BuildTrusteeWithObjectsAndSidA [ADVAPI32.@] 3274 */ 3275 VOID WINAPI BuildTrusteeWithObjectsAndSidA( PTRUSTEEA pTrustee, POBJECTS_AND_SID pObjSid, 3276 GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid ) 3277 { 3278 DWORD ObjectsPresent = 0; 3279 3280 TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid); 3281 3282 /* Fill the OBJECTS_AND_SID structure */ 3283 if (pObjectGuid != NULL) 3284 { 3285 pObjSid->ObjectTypeGuid = *pObjectGuid; 3286 ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT; 3287 } 3288 else 3289 { 3290 ZeroMemory(&pObjSid->ObjectTypeGuid, 3291 sizeof(GUID)); 3292 } 3293 3294 if (pInheritedObjectGuid != NULL) 3295 { 3296 pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid; 3297 ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT; 3298 } 3299 else 3300 { 3301 ZeroMemory(&pObjSid->InheritedObjectTypeGuid, 3302 sizeof(GUID)); 3303 } 3304 3305 pObjSid->ObjectsPresent = ObjectsPresent; 3306 pObjSid->pSid = pSid; 3307 3308 /* Fill the TRUSTEE structure */ 3309 pTrustee->pMultipleTrustee = NULL; 3310 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; 3311 pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID; 3312 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN; 3313 pTrustee->ptstrName = (LPSTR) pObjSid; 3314 } 3315 3316 /****************************************************************************** 3317 * BuildTrusteeWithObjectsAndSidW [ADVAPI32.@] 3318 */ 3319 VOID WINAPI BuildTrusteeWithObjectsAndSidW( PTRUSTEEW pTrustee, POBJECTS_AND_SID pObjSid, 3320 GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid ) 3321 { 3322 DWORD ObjectsPresent = 0; 3323 3324 TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid); 3325 3326 /* Fill the OBJECTS_AND_SID structure */ 3327 if (pObjectGuid != NULL) 3328 { 3329 pObjSid->ObjectTypeGuid = *pObjectGuid; 3330 ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT; 3331 } 3332 else 3333 { 3334 ZeroMemory(&pObjSid->ObjectTypeGuid, 3335 sizeof(GUID)); 3336 } 3337 3338 if (pInheritedObjectGuid != NULL) 3339 { 3340 pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid; 3341 ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT; 3342 } 3343 else 3344 { 3345 ZeroMemory(&pObjSid->InheritedObjectTypeGuid, 3346 sizeof(GUID)); 3347 } 3348 3349 pObjSid->ObjectsPresent = ObjectsPresent; 3350 pObjSid->pSid = pSid; 3351 3352 /* Fill the TRUSTEE structure */ 3353 pTrustee->pMultipleTrustee = NULL; 3354 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; 3355 pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID; 3356 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN; 3357 pTrustee->ptstrName = (LPWSTR) pObjSid; 3358 } 3359 3360 /****************************************************************************** 3361 * BuildTrusteeWithSidA [ADVAPI32.@] 3362 */ 3363 VOID WINAPI BuildTrusteeWithSidA(PTRUSTEEA pTrustee, PSID pSid) 3364 { 3365 TRACE("%p %p\n", pTrustee, pSid); 3366 3367 pTrustee->pMultipleTrustee = NULL; 3368 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; 3369 pTrustee->TrusteeForm = TRUSTEE_IS_SID; 3370 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN; 3371 pTrustee->ptstrName = pSid; 3372 } 3373 3374 /****************************************************************************** 3375 * BuildTrusteeWithSidW [ADVAPI32.@] 3376 */ 3377 VOID WINAPI BuildTrusteeWithSidW(PTRUSTEEW pTrustee, PSID pSid) 3378 { 3379 TRACE("%p %p\n", pTrustee, pSid); 3380 3381 pTrustee->pMultipleTrustee = NULL; 3382 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; 3383 pTrustee->TrusteeForm = TRUSTEE_IS_SID; 3384 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN; 3385 pTrustee->ptstrName = pSid; 3386 } 3387 3388 /****************************************************************************** 3389 * BuildTrusteeWithNameA [ADVAPI32.@] 3390 */ 3391 VOID WINAPI BuildTrusteeWithNameA(PTRUSTEEA pTrustee, LPSTR name) 3392 { 3393 TRACE("%p %s\n", pTrustee, debugstr_a(name) ); 3394 3395 pTrustee->pMultipleTrustee = NULL; 3396 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; 3397 pTrustee->TrusteeForm = TRUSTEE_IS_NAME; 3398 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN; 3399 pTrustee->ptstrName = name; 3400 } 3401 3402 /****************************************************************************** 3403 * BuildTrusteeWithNameW [ADVAPI32.@] 3404 */ 3405 VOID WINAPI BuildTrusteeWithNameW(PTRUSTEEW pTrustee, LPWSTR name) 3406 { 3407 TRACE("%p %s\n", pTrustee, debugstr_w(name) ); 3408 3409 pTrustee->pMultipleTrustee = NULL; 3410 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE; 3411 pTrustee->TrusteeForm = TRUSTEE_IS_NAME; 3412 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN; 3413 pTrustee->ptstrName = name; 3414 } 3415 3416 /****************************************************************************** 3417 * GetTrusteeFormA [ADVAPI32.@] 3418 */ 3419 TRUSTEE_FORM WINAPI GetTrusteeFormA(PTRUSTEEA pTrustee) 3420 { 3421 TRACE("(%p)\n", pTrustee); 3422 3423 if (!pTrustee) 3424 return TRUSTEE_BAD_FORM; 3425 3426 return pTrustee->TrusteeForm; 3427 } 3428 3429 /****************************************************************************** 3430 * GetTrusteeFormW [ADVAPI32.@] 3431 */ 3432 TRUSTEE_FORM WINAPI GetTrusteeFormW(PTRUSTEEW pTrustee) 3433 { 3434 TRACE("(%p)\n", pTrustee); 3435 3436 if (!pTrustee) 3437 return TRUSTEE_BAD_FORM; 3438 3439 return pTrustee->TrusteeForm; 3440 } 3441 3442 /****************************************************************************** 3443 * GetTrusteeNameA [ADVAPI32.@] 3444 */ 3445 LPSTR WINAPI GetTrusteeNameA(PTRUSTEEA pTrustee) 3446 { 3447 TRACE("(%p)\n", pTrustee); 3448 3449 if (!pTrustee) 3450 return NULL; 3451 3452 return pTrustee->ptstrName; 3453 } 3454 3455 /****************************************************************************** 3456 * GetTrusteeNameW [ADVAPI32.@] 3457 */ 3458 LPWSTR WINAPI GetTrusteeNameW(PTRUSTEEW pTrustee) 3459 { 3460 TRACE("(%p)\n", pTrustee); 3461 3462 if (!pTrustee) 3463 return NULL; 3464 3465 return pTrustee->ptstrName; 3466 } 3467 3468 /****************************************************************************** 3469 * GetTrusteeTypeA [ADVAPI32.@] 3470 */ 3471 TRUSTEE_TYPE WINAPI GetTrusteeTypeA(PTRUSTEEA pTrustee) 3472 { 3473 TRACE("(%p)\n", pTrustee); 3474 3475 if (!pTrustee) 3476 return TRUSTEE_IS_UNKNOWN; 3477 3478 return pTrustee->TrusteeType; 3479 } 3480 3481 /****************************************************************************** 3482 * GetTrusteeTypeW [ADVAPI32.@] 3483 */ 3484 TRUSTEE_TYPE WINAPI GetTrusteeTypeW(PTRUSTEEW pTrustee) 3485 { 3486 TRACE("(%p)\n", pTrustee); 3487 3488 if (!pTrustee) 3489 return TRUSTEE_IS_UNKNOWN; 3490 3491 return pTrustee->TrusteeType; 3492 } 3493 3494 BOOL WINAPI SetAclInformation( PACL pAcl, LPVOID pAclInformation, 3495 DWORD nAclInformationLength, 3496 ACL_INFORMATION_CLASS dwAclInformationClass ) 3497 { 3498 FIXME("%p %p 0x%08x 0x%08x - stub\n", pAcl, pAclInformation, 3499 nAclInformationLength, dwAclInformationClass); 3500 3501 return TRUE; 3502 } 3503 3504 /****************************************************************************** 3505 * SetEntriesInAclA [ADVAPI32.@] 3506 */ 3507 DWORD WINAPI SetEntriesInAclA( ULONG count, PEXPLICIT_ACCESSA pEntries, 3508 PACL OldAcl, PACL* NewAcl ) 3509 { 3510 FIXME("%d %p %p %p\n",count,pEntries,OldAcl,NewAcl); 3511 if (NewAcl) 3512 *NewAcl = NULL; 3513 return ERROR_SUCCESS; 3514 } 3515 3516 /****************************************************************************** 3517 * SetEntriesInAclW [ADVAPI32.@] 3518 */ 3519 DWORD WINAPI SetEntriesInAclW( ULONG count, PEXPLICIT_ACCESSW pEntries, 3520 PACL OldAcl, PACL* NewAcl ) 3521 { 3522 ULONG i; 3523 PSID *ppsid; 3524 DWORD ret = ERROR_SUCCESS; 3525 DWORD acl_size = sizeof(ACL); 3526 NTSTATUS status; 3527 3528 TRACE("%d %p %p %p\n", count, pEntries, OldAcl, NewAcl); 3529 3530 *NewAcl = NULL; 3531 3532 if (!count && !OldAcl) 3533 return ERROR_SUCCESS; 3534 3535 /* allocate array of maximum sized sids allowed */ 3536 ppsid = HeapAlloc(GetProcessHeap(), 0, count * (sizeof(SID *) + FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]))); 3537 if (!ppsid) 3538 return ERROR_OUTOFMEMORY; 3539 3540 for (i = 0; i < count; i++) 3541 { 3542 ppsid[i] = (char *)&ppsid[count] + i * FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]); 3543 3544 TRACE("[%d]:\n\tgrfAccessPermissions = 0x%x\n\tgrfAccessMode = %d\n\tgrfInheritance = 0x%x\n\t" 3545 "Trustee.pMultipleTrustee = %p\n\tMultipleTrusteeOperation = %d\n\tTrusteeForm = %d\n\t" 3546 "Trustee.TrusteeType = %d\n\tptstrName = %p\n", i, 3547 pEntries[i].grfAccessPermissions, pEntries[i].grfAccessMode, pEntries[i].grfInheritance, 3548 pEntries[i].Trustee.pMultipleTrustee, pEntries[i].Trustee.MultipleTrusteeOperation, 3549 pEntries[i].Trustee.TrusteeForm, pEntries[i].Trustee.TrusteeType, 3550 pEntries[i].Trustee.ptstrName); 3551 3552 if (pEntries[i].Trustee.MultipleTrusteeOperation == TRUSTEE_IS_IMPERSONATE) 3553 { 3554 WARN("bad multiple trustee operation %d for trustee %d\n", pEntries[i].Trustee.MultipleTrusteeOperation, i); 3555 ret = ERROR_INVALID_PARAMETER; 3556 goto exit; 3557 } 3558 3559 switch (pEntries[i].Trustee.TrusteeForm) 3560 { 3561 case TRUSTEE_IS_SID: 3562 if (!CopySid(FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]), 3563 ppsid[i], pEntries[i].Trustee.ptstrName)) 3564 { 3565 WARN("bad sid %p for trustee %d\n", pEntries[i].Trustee.ptstrName, i); 3566 ret = ERROR_INVALID_PARAMETER; 3567 goto exit; 3568 } 3569 break; 3570 case TRUSTEE_IS_NAME: 3571 { 3572 DWORD sid_size = FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]); 3573 DWORD domain_size = MAX_COMPUTERNAME_LENGTH + 1; 3574 SID_NAME_USE use; 3575 if (!strcmpW( pEntries[i].Trustee.ptstrName, CURRENT_USER )) 3576 { 3577 if (!lookup_user_account_name( ppsid[i], &sid_size, NULL, &domain_size, &use )) 3578 { 3579 ret = GetLastError(); 3580 goto exit; 3581 } 3582 } 3583 else if (!LookupAccountNameW(NULL, pEntries[i].Trustee.ptstrName, ppsid[i], &sid_size, NULL, &domain_size, &use)) 3584 { 3585 WARN("bad user name %s for trustee %d\n", debugstr_w(pEntries[i].Trustee.ptstrName), i); 3586 ret = ERROR_INVALID_PARAMETER; 3587 goto exit; 3588 } 3589 break; 3590 } 3591 case TRUSTEE_IS_OBJECTS_AND_SID: 3592 FIXME("TRUSTEE_IS_OBJECTS_AND_SID unimplemented\n"); 3593 break; 3594 case TRUSTEE_IS_OBJECTS_AND_NAME: 3595 FIXME("TRUSTEE_IS_OBJECTS_AND_NAME unimplemented\n"); 3596 break; 3597 default: 3598 WARN("bad trustee form %d for trustee %d\n", pEntries[i].Trustee.TrusteeForm, i); 3599 ret = ERROR_INVALID_PARAMETER; 3600 goto exit; 3601 } 3602 3603 /* Note: we overestimate the ACL size here as a tradeoff between 3604 * instructions (simplicity) and memory */ 3605 switch (pEntries[i].grfAccessMode) 3606 { 3607 case GRANT_ACCESS: 3608 case SET_ACCESS: 3609 acl_size += FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart) + GetLengthSid(ppsid[i]); 3610 break; 3611 case DENY_ACCESS: 3612 acl_size += FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart) + GetLengthSid(ppsid[i]); 3613 break; 3614 case SET_AUDIT_SUCCESS: 3615 case SET_AUDIT_FAILURE: 3616 acl_size += FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart) + GetLengthSid(ppsid[i]); 3617 break; 3618 case REVOKE_ACCESS: 3619 break; 3620 default: 3621 WARN("bad access mode %d for trustee %d\n", pEntries[i].grfAccessMode, i); 3622 ret = ERROR_INVALID_PARAMETER; 3623 goto exit; 3624 } 3625 } 3626 3627 if (OldAcl) 3628 { 3629 ACL_SIZE_INFORMATION size_info; 3630 3631 status = RtlQueryInformationAcl(OldAcl, &size_info, sizeof(size_info), AclSizeInformation); 3632 if (status != STATUS_SUCCESS) 3633 { 3634 ret = RtlNtStatusToDosError(status); 3635 goto exit; 3636 } 3637 acl_size += size_info.AclBytesInUse - sizeof(ACL); 3638 } 3639 3640 *NewAcl = LocalAlloc(0, acl_size); 3641 if (!*NewAcl) 3642 { 3643 ret = ERROR_OUTOFMEMORY; 3644 goto exit; 3645 } 3646 3647 status = RtlCreateAcl( *NewAcl, acl_size, ACL_REVISION ); 3648 if (status != STATUS_SUCCESS) 3649 { 3650 ret = RtlNtStatusToDosError(status); 3651 goto exit; 3652 } 3653 3654 for (i = 0; i < count; i++) 3655 { 3656 switch (pEntries[i].grfAccessMode) 3657 { 3658 case GRANT_ACCESS: 3659 status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION, 3660 pEntries[i].grfInheritance, 3661 pEntries[i].grfAccessPermissions, 3662 ppsid[i]); 3663 break; 3664 case SET_ACCESS: 3665 { 3666 ULONG j; 3667 BOOL add = TRUE; 3668 if (OldAcl) 3669 { 3670 for (j = 0; ; j++) 3671 { 3672 const ACE_HEADER *existing_ace_header; 3673 status = RtlGetAce(OldAcl, j, (LPVOID *)&existing_ace_header); 3674 if (status != STATUS_SUCCESS) 3675 break; 3676 if (pEntries[i].grfAccessMode == SET_ACCESS && 3677 existing_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE && 3678 EqualSid(ppsid[i], &((ACCESS_ALLOWED_ACE *)existing_ace_header)->SidStart)) 3679 { 3680 add = FALSE; 3681 break; 3682 } 3683 } 3684 } 3685 if (add) 3686 status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION, 3687 pEntries[i].grfInheritance, 3688 pEntries[i].grfAccessPermissions, 3689 ppsid[i]); 3690 break; 3691 } 3692 case DENY_ACCESS: 3693 status = RtlAddAccessDeniedAceEx(*NewAcl, ACL_REVISION, 3694 pEntries[i].grfInheritance, 3695 pEntries[i].grfAccessPermissions, 3696 ppsid[i]); 3697 break; 3698 case SET_AUDIT_SUCCESS: 3699 status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION, 3700 pEntries[i].grfInheritance, 3701 pEntries[i].grfAccessPermissions, 3702 ppsid[i], TRUE, FALSE); 3703 break; 3704 case SET_AUDIT_FAILURE: 3705 status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION, 3706 pEntries[i].grfInheritance, 3707 pEntries[i].grfAccessPermissions, 3708 ppsid[i], FALSE, TRUE); 3709 break; 3710 default: 3711 FIXME("unhandled access mode %d\n", pEntries[i].grfAccessMode); 3712 } 3713 } 3714 3715 if (OldAcl) 3716 { 3717 for (i = 0; ; i++) 3718 { 3719 BOOL add = TRUE; 3720 ULONG j; 3721 const ACE_HEADER *old_ace_header; 3722 status = RtlGetAce(OldAcl, i, (LPVOID *)&old_ace_header); 3723 if (status != STATUS_SUCCESS) break; 3724 for (j = 0; j < count; j++) 3725 { 3726 if (pEntries[j].grfAccessMode == SET_ACCESS && 3727 old_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE && 3728 EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart)) 3729 { 3730 status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION, pEntries[j].grfInheritance, pEntries[j].grfAccessPermissions, ppsid[j]); 3731 add = FALSE; 3732 break; 3733 } 3734 else if (pEntries[j].grfAccessMode == REVOKE_ACCESS) 3735 { 3736 switch (old_ace_header->AceType) 3737 { 3738 case ACCESS_ALLOWED_ACE_TYPE: 3739 if (EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart)) 3740 add = FALSE; 3741 break; 3742 case ACCESS_DENIED_ACE_TYPE: 3743 if (EqualSid(ppsid[j], &((ACCESS_DENIED_ACE *)old_ace_header)->SidStart)) 3744 add = FALSE; 3745 break; 3746 case SYSTEM_AUDIT_ACE_TYPE: 3747 if (EqualSid(ppsid[j], &((SYSTEM_AUDIT_ACE *)old_ace_header)->SidStart)) 3748 add = FALSE; 3749 break; 3750 case SYSTEM_ALARM_ACE_TYPE: 3751 if (EqualSid(ppsid[j], &((SYSTEM_ALARM_ACE *)old_ace_header)->SidStart)) 3752 add = FALSE; 3753 break; 3754 default: 3755 FIXME("unhandled ace type %d\n", old_ace_header->AceType); 3756 } 3757 3758 if (!add) 3759 break; 3760 } 3761 } 3762 if (add) 3763 status = RtlAddAce(*NewAcl, ACL_REVISION, 1, (PACE_HEADER)old_ace_header, old_ace_header->AceSize); 3764 if (status != STATUS_SUCCESS) 3765 { 3766 WARN("RtlAddAce failed with error 0x%08x\n", status); 3767 ret = RtlNtStatusToDosError(status); 3768 break; 3769 } 3770 } 3771 } 3772 3773 exit: 3774 HeapFree(GetProcessHeap(), 0, ppsid); 3775 return ret; 3776 } 3777 3778 /****************************************************************************** 3779 * SetNamedSecurityInfoA [ADVAPI32.@] 3780 */ 3781 DWORD WINAPI SetNamedSecurityInfoA(LPSTR pObjectName, 3782 SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo, 3783 PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl) 3784 { 3785 DWORD len; 3786 LPWSTR wstr = NULL; 3787 DWORD r; 3788 3789 TRACE("%s %d %d %p %p %p %p\n", debugstr_a(pObjectName), ObjectType, 3790 SecurityInfo, psidOwner, psidGroup, pDacl, pSacl); 3791 3792 if( pObjectName ) 3793 { 3794 len = MultiByteToWideChar( CP_ACP, 0, pObjectName, -1, NULL, 0 ); 3795 wstr = HeapAlloc( GetProcessHeap(), 0, len*sizeof(WCHAR)); 3796 MultiByteToWideChar( CP_ACP, 0, pObjectName, -1, wstr, len ); 3797 } 3798 3799 r = SetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, psidOwner, 3800 psidGroup, pDacl, pSacl ); 3801 3802 HeapFree( GetProcessHeap(), 0, wstr ); 3803 3804 return r; 3805 } 3806 3807 BOOL WINAPI SetPrivateObjectSecurity( SECURITY_INFORMATION SecurityInformation, 3808 PSECURITY_DESCRIPTOR ModificationDescriptor, 3809 PSECURITY_DESCRIPTOR* ObjectsSecurityDescriptor, 3810 PGENERIC_MAPPING GenericMapping, 3811 HANDLE Token ) 3812 { 3813 FIXME("0x%08x %p %p %p %p - stub\n", SecurityInformation, ModificationDescriptor, 3814 ObjectsSecurityDescriptor, GenericMapping, Token); 3815 3816 return TRUE; 3817 } 3818 3819 BOOL WINAPI AreAllAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess ) 3820 { 3821 return RtlAreAllAccessesGranted( GrantedAccess, DesiredAccess ); 3822 }

Wine Cross Reference wine/dlls/advapi32/security.c

Wine Cross Reference
wine/dlls/advapi32/security.c