ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
Sweden-Number/server/token.c

1507 lines
50 KiB
C
Raw Blame History

/*
* Tokens
*
* Copyright (C) 1998 Alexandre Julliard
* Copyright (C) 2003 Mike McCormack
* Copyright (C) 2005 Robert Shearman
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
*/
#include "config.h"
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <sys/types.h>
#include <unistd.h>
#include "ntstatus.h"
#define WIN32_NO_STATUS
#include "windef.h"
#include "winternl.h"
#include "handle.h"
#include "thread.h"
#include "process.h"
#include "request.h"
#include "security.h"
#define MAX_SUBAUTH_COUNT 1
const struct luid SeIncreaseQuotaPrivilege = { 5, 0 };
const struct luid SeTcbPrivilege = { 7, 0 };
const struct luid SeSecurityPrivilege = { 8, 0 };
const struct luid SeTakeOwnershipPrivilege = { 9, 0 };
const struct luid SeLoadDriverPrivilege = { 10, 0 };
const struct luid SeSystemProfilePrivilege = { 11, 0 };
const struct luid SeSystemtimePrivilege = { 12, 0 };
const struct luid SeProfileSingleProcessPrivilege = { 13, 0 };
const struct luid SeIncreaseBasePriorityPrivilege = { 14, 0 };
const struct luid SeCreatePagefilePrivilege = { 15, 0 };
const struct luid SeBackupPrivilege = { 17, 0 };
const struct luid SeRestorePrivilege = { 18, 0 };
const struct luid SeShutdownPrivilege = { 19, 0 };
const struct luid SeDebugPrivilege = { 20, 0 };
const struct luid SeSystemEnvironmentPrivilege = { 22, 0 };
const struct luid SeChangeNotifyPrivilege = { 23, 0 };
const struct luid SeRemoteShutdownPrivilege = { 24, 0 };
const struct luid SeUndockPrivilege = { 25, 0 };
const struct luid SeManageVolumePrivilege = { 28, 0 };
const struct luid SeImpersonatePrivilege = { 29, 0 };
const struct luid SeCreateGlobalPrivilege = { 30, 0 };
struct sid_attrs
{
const struct sid *sid;
unsigned int attrs;
};
const struct sid world_sid = { SID_REVISION, 1, SECURITY_WORLD_SID_AUTHORITY, { SECURITY_WORLD_RID } };
const struct sid local_system_sid = { SID_REVISION, 1, SECURITY_NT_AUTHORITY, { SECURITY_LOCAL_SYSTEM_RID } };
const struct sid high_label_sid = { SID_REVISION, 1, SECURITY_MANDATORY_LABEL_AUTHORITY, { SECURITY_MANDATORY_HIGH_RID } };
const struct sid local_user_sid = { SID_REVISION, 5, SECURITY_NT_AUTHORITY, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
const struct sid builtin_admins_sid = { SID_REVISION, 2, SECURITY_NT_AUTHORITY, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
const struct sid builtin_users_sid = { SID_REVISION, 2, SECURITY_NT_AUTHORITY, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } };
const struct sid domain_users_sid = { SID_REVISION, 5, SECURITY_NT_AUTHORITY, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, DOMAIN_GROUP_RID_USERS } };
static const struct sid local_sid = { SID_REVISION, 1, SECURITY_LOCAL_SID_AUTHORITY, { SECURITY_LOCAL_RID } };
static const struct sid interactive_sid = { SID_REVISION, 1, SECURITY_NT_AUTHORITY, { SECURITY_INTERACTIVE_RID } };
static const struct sid anonymous_logon_sid = { SID_REVISION, 1, SECURITY_NT_AUTHORITY, { SECURITY_ANONYMOUS_LOGON_RID } };
static const struct sid authenticated_user_sid = { SID_REVISION, 1, SECURITY_NT_AUTHORITY, { SECURITY_AUTHENTICATED_USER_RID } };
static struct luid prev_luid_value = { 1000, 0 };
static const WCHAR token_name[] = {'T','o','k','e','n'};
struct type_descr token_type =
{
{ token_name, sizeof(token_name) }, /* name */
TOKEN_ALL_ACCESS | SYNCHRONIZE, /* valid_access */
{ /* mapping */
STANDARD_RIGHTS_READ | TOKEN_QUERY_SOURCE | TOKEN_QUERY | TOKEN_DUPLICATE,
STANDARD_RIGHTS_WRITE | TOKEN_ADJUST_SESSIONID | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_GROUPS
| TOKEN_ADJUST_PRIVILEGES,
STANDARD_RIGHTS_EXECUTE | TOKEN_IMPERSONATE | TOKEN_ASSIGN_PRIMARY,
TOKEN_ALL_ACCESS
},
};
struct token
{
struct object obj; /* object header */
struct luid token_id; /* system-unique id of token */
struct luid modified_id; /* new id allocated every time token is modified */
struct list privileges; /* privileges available to the token */
struct list groups; /* groups that the user of this token belongs to (sid_and_attributes) */
struct sid *user; /* SID of user this token represents */
struct sid *owner; /* SID of owner (points to user or one of groups) */
struct sid *primary_group; /* SID of user's primary group (points to one of groups) */
unsigned int primary; /* is this a primary or impersonation token? */
unsigned int session_id; /* token session id */
struct acl *default_dacl; /* the default DACL to assign to objects created by this user */
int impersonation_level; /* impersonation level this token is capable of if non-primary token */
int elevation; /* elevation type */
};
struct privilege
{
struct list entry;
struct luid luid;
unsigned enabled : 1; /* is the privilege currently enabled? */
unsigned def : 1; /* is the privilege enabled by default? */
};
struct group
{
struct list entry;
unsigned int attrs;
struct sid sid;
};
static void token_dump( struct object *obj, int verbose );
static void token_destroy( struct object *obj );
static const struct object_ops token_ops =
{
sizeof(struct token), /* size */
&token_type, /* type */
token_dump, /* dump */
no_add_queue, /* add_queue */
NULL, /* remove_queue */
NULL, /* signaled */
NULL, /* satisfied */
no_signal, /* signal */
no_get_fd, /* get_fd */
default_map_access, /* map_access */
default_get_sd, /* get_sd */
default_set_sd, /* set_sd */
no_get_full_name, /* get_full_name */
no_lookup_name, /* lookup_name */
no_link_name, /* link_name */
NULL, /* unlink_name */
no_open_file, /* open_file */
no_kernel_obj_list, /* get_kernel_obj_list */
no_close_handle, /* close_handle */
token_destroy /* destroy */
};
static void token_dump( struct object *obj, int verbose )
{
struct token *token = (struct token *)obj;
assert( obj->ops == &token_ops );
fprintf( stderr, "Token id=%d.%u primary=%u impersonation level=%d\n", token->token_id.high_part,
token->token_id.low_part, token->primary, token->impersonation_level );
}
void security_set_thread_token( struct thread *thread, obj_handle_t handle )
{
if (!handle)
{
if (thread->token)
release_object( thread->token );
thread->token = NULL;
}
else
{
struct token *token = (struct token *)get_handle_obj( current->process,
handle,
TOKEN_IMPERSONATE,
&token_ops );
if (token)
{
if (thread->token)
release_object( thread->token );
thread->token = token;
}
}
}
const struct sid *security_unix_uid_to_sid( uid_t uid )
{
/* very simple mapping: either the current user or not the current user */
if (uid == getuid())
return &local_user_sid;
else
return &anonymous_logon_sid;
}
static int acl_is_valid( const struct acl *acl, data_size_t size )
{
ULONG i;
const struct ace *ace;
if (size < sizeof(*acl)) return FALSE;
size = min(size, MAX_ACL_LEN);
size -= sizeof(*acl);
for (i = 0, ace = ace_first( acl ); i < acl->count; i++, ace = ace_next( ace ))
{
if (size < sizeof(*ace) || size < ace->size) return FALSE;
size -= ace->size;
switch (ace->type)
{
case ACCESS_DENIED_ACE_TYPE:
case ACCESS_ALLOWED_ACE_TYPE:
case SYSTEM_AUDIT_ACE_TYPE:
case SYSTEM_ALARM_ACE_TYPE:
case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
break;
default:
return FALSE;
}
if (!sid_valid_size( (const struct sid *)(ace + 1), ace->size - sizeof(*ace) )) return FALSE;
}
return TRUE;
}
static unsigned int get_sid_count( const struct sid *sid, data_size_t size )
{
unsigned int count;
for (count = 0; sid_valid_size( sid, size ); count++)
{
size -= sid_len( sid );
sid = (const struct sid *)((char *)sid + sid_len( sid ));
}
return count;
}
/* checks whether all members of a security descriptor fit inside the size
* of memory specified */
int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
{
size_t offset = sizeof(struct security_descriptor);
const struct sid *group;
const struct sid *owner;
const struct acl *sacl;
const struct acl *dacl;
int dummy;
if (size < offset)
return FALSE;
if (sd->owner_len >= offsetof(struct sid, sub_auth[255]) || offset + sd->owner_len > size) return FALSE;
owner = sd_get_owner( sd );
offset += sd->owner_len;
if (owner && !sid_valid_size( owner, sd->owner_len )) return FALSE;
if (sd->group_len >= offsetof(struct sid, sub_auth[255]) || offset + sd->group_len > size) return FALSE;
group = sd_get_group( sd );
offset += sd->group_len;
if (group && !sid_valid_size( group, sd->group_len )) return FALSE;
if ((sd->sacl_len >= MAX_ACL_LEN) || (offset + sd->sacl_len > size))
return FALSE;
sacl = sd_get_sacl( sd, &dummy );
if (sacl && !acl_is_valid( sacl, sd->sacl_len ))
return FALSE;
offset += sd->sacl_len;
if ((sd->dacl_len >= MAX_ACL_LEN) || (offset + sd->dacl_len > size))
return FALSE;
dacl = sd_get_dacl( sd, &dummy );
if (dacl && !acl_is_valid( dacl, sd->dacl_len ))
return FALSE;
offset += sd->dacl_len;
return TRUE;
}
/* extract security labels from SACL */
struct acl *extract_security_labels( const struct acl *sacl )
{
size_t size = sizeof(*sacl);
const struct ace *ace;
struct ace *label_ace;
unsigned int i, count = 0;
struct acl *label_acl;
for (i = 0, ace = ace_first( sacl ); i < sacl->count; i++, ace = ace_next( ace ))
{
if (ace->type == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
{
size += ace->size;
count++;
}
}
label_acl = mem_alloc( size );
if (!label_acl) return NULL;
label_acl->revision = sacl->revision;
label_acl->pad1 = 0;
label_acl->size = size;
label_acl->count = count;
label_acl->pad2 = 0;
label_ace = ace_first( label_acl );
for (i = 0, ace = ace_first( sacl ); i < sacl->count; i++, ace = ace_next( ace ))
{
if (ace->type == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
{
memcpy( label_ace, ace, ace->size );
label_ace = ace_next( label_ace );
}
}
return label_acl;
}
/* replace security labels in an existing SACL */
struct acl *replace_security_labels( const struct acl *old_sacl, const struct acl *new_sacl )
{
const struct ace *ace;
struct ace *replaced_ace;
unsigned int i, count = 0;
unsigned char revision = ACL_REVISION;
struct acl *replaced_acl;
data_size_t size = sizeof(*replaced_acl);
if (old_sacl)
{
revision = max( revision, old_sacl->revision );
for (i = 0, ace = ace_first( old_sacl ); i < old_sacl->count; i++, ace = ace_next( ace ))
{
if (ace->type == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
size += ace->size;
count++;
}
}
if (new_sacl)
{
revision = max( revision, new_sacl->revision );
for (i = 0, ace = ace_first( new_sacl ); i < new_sacl->count; i++, ace = ace_next( ace ))
{
if (ace->type != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
size += ace->size;
count++;
}
}
if (size > MAX_ACL_LEN)
{
set_error( STATUS_INVALID_ACL );
return NULL;
}
replaced_acl = mem_alloc( size );
if (!replaced_acl) return NULL;
replaced_acl->revision = revision;
replaced_acl->pad1 = 0;
replaced_acl->size = size;
replaced_acl->count = count;
replaced_acl->pad2 = 0;
replaced_ace = (struct ace *)(replaced_acl + 1);
if (old_sacl)
{
for (i = 0, ace = ace_first( old_sacl ); i < old_sacl->count; i++, ace = ace_next( ace ))
{
if (ace->type == SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
memcpy( replaced_ace, ace, ace->size );
replaced_ace = ace_next( replaced_ace );
}
}
if (new_sacl)
{
for (i = 0, ace = ace_first( new_sacl ); i < new_sacl->count; i++, ace = ace_next( ace ))
{
if (ace->type != SYSTEM_MANDATORY_LABEL_ACE_TYPE) continue;
memcpy( replaced_ace, ace, ace->size );
replaced_ace = ace_next( replaced_ace );
}
}
return replaced_acl;
}
static inline int is_equal_luid( struct luid luid1, struct luid luid2 )
{
return (luid1.low_part == luid2.low_part && luid1.high_part == luid2.high_part);
}
static inline void allocate_luid( struct luid *luid )
{
prev_luid_value.low_part++;
*luid = prev_luid_value;
}
DECL_HANDLER( allocate_locally_unique_id )
{
allocate_luid( &reply->luid );
}
static inline struct luid_attr luid_and_attr_from_privilege( const struct privilege *in )
{
struct luid_attr ret = { in->luid };
ret.attrs = (in->enabled ? SE_PRIVILEGE_ENABLED : 0) |
(in->def ? SE_PRIVILEGE_ENABLED_BY_DEFAULT : 0);
return ret;
}
static struct privilege *privilege_add( struct token *token, struct luid luid, int enabled )
{
struct privilege *privilege = mem_alloc( sizeof(*privilege) );
if (privilege)
{
privilege->luid = luid;
privilege->def = privilege->enabled = (enabled != 0);
list_add_tail( &token->privileges, &privilege->entry );
}
return privilege;
}
static inline void privilege_remove( struct privilege *privilege )
{
list_remove( &privilege->entry );
free( privilege );
}
static void token_destroy( struct object *obj )
{
struct token* token;
struct list *cursor, *cursor_next;
assert( obj->ops == &token_ops );
token = (struct token *)obj;
free( token->user );
LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->privileges )
{
struct privilege *privilege = LIST_ENTRY( cursor, struct privilege, entry );
privilege_remove( privilege );
}
LIST_FOR_EACH_SAFE( cursor, cursor_next, &token->groups )
{
struct group *group = LIST_ENTRY( cursor, struct group, entry );
list_remove( &group->entry );
free( group );
}
free( token->default_dacl );
}
/* creates a new token.
* groups may be NULL if group_count is 0.
* privs may be NULL if priv_count is 0.
* default_dacl may be NULL, indicating that all objects created by the user
* are unsecured.
* modified_id may be NULL, indicating that a new modified_id luid should be
* allocated.
*/
static struct token *create_token( unsigned int primary, unsigned int session_id, const struct sid *user,
const struct sid_attrs *groups, unsigned int group_count,
const struct luid_attr *privs, unsigned int priv_count,
const struct acl *default_dacl, const struct luid *modified_id,
int impersonation_level, int elevation )
{
struct token *token = alloc_object( &token_ops );
if (token)
{
unsigned int i;
allocate_luid( &token->token_id );
if (modified_id)
token->modified_id = *modified_id;
else
allocate_luid( &token->modified_id );
list_init( &token->privileges );
list_init( &token->groups );
token->primary = primary;
token->session_id = session_id;
/* primary tokens don't have impersonation levels */
if (primary)
token->impersonation_level = -1;
else
token->impersonation_level = impersonation_level;
token->default_dacl = NULL;
token->primary_group = NULL;
token->elevation = elevation;
/* copy user */
token->user = memdup( user, sid_len( user ));
if (!token->user)
{
release_object( token );
return NULL;
}
/* copy groups */
for (i = 0; i < group_count; i++)
{
size_t size = offsetof( struct group, sid.sub_auth[groups[i].sid->sub_count] );
struct group *group = mem_alloc( size );
if (!group)
{
release_object( token );
return NULL;
}
group->attrs = groups[i].attrs;
copy_sid( &group->sid, groups[i].sid );
list_add_tail( &token->groups, &group->entry );
/* Use first owner capable group as owner and primary group */
if (!token->primary_group && (group->attrs & SE_GROUP_OWNER))
{
token->owner = &group->sid;
token->primary_group = &group->sid;
}
}
/* copy privileges */
for (i = 0; i < priv_count; i++)
{
/* note: we don't check uniqueness: the caller must make sure
* privs doesn't contain any duplicate luids */
if (!privilege_add( token, privs[i].luid, privs[i].attrs & SE_PRIVILEGE_ENABLED ))
{
release_object( token );
return NULL;
}
}
if (default_dacl)
{
token->default_dacl = memdup( default_dacl, default_dacl->size );
if (!token->default_dacl)
{
release_object( token );
return NULL;
}
}
}
return token;
}
static int filter_group( struct group *group, const struct sid *filter, unsigned int count )
{
unsigned int i;
for (i = 0; i < count; i++)
{
if (equal_sid( &group->sid, filter )) return 1;
filter = (const struct sid *)((char *)filter + sid_len( filter ));
}
return 0;
}
static int filter_privilege( struct privilege *privilege, const struct luid_attr *filter, unsigned int count )
{
unsigned int i;
for (i = 0; i < count; i++)
if (is_equal_luid( privilege->luid, filter[i].luid )) return 1;
return 0;
}
struct token *token_duplicate( struct token *src_token, unsigned primary,
int impersonation_level, const struct security_descriptor *sd,
const struct luid_attr *remove_privs, unsigned int remove_priv_count,
const struct sid *remove_groups, unsigned int remove_group_count)
{
const struct luid *modified_id =
primary || (impersonation_level == src_token->impersonation_level) ?
&src_token->modified_id : NULL;
struct token *token = NULL;
struct privilege *privilege;
struct group *group;
if (!primary &&
(impersonation_level < SecurityAnonymous ||
impersonation_level > SecurityDelegation ||
(!src_token->primary && (impersonation_level > src_token->impersonation_level))))
{
set_error( STATUS_BAD_IMPERSONATION_LEVEL );
return NULL;
}
token = create_token( primary, src_token->session_id, src_token->user, NULL, 0,
NULL, 0, src_token->default_dacl, modified_id,
impersonation_level, src_token->elevation );
if (!token) return token;
/* copy groups */
token->primary_group = NULL;
LIST_FOR_EACH_ENTRY( group, &src_token->groups, struct group, entry )
{
size_t size = offsetof( struct group, sid.sub_auth[group->sid.sub_count] );
struct group *newgroup = mem_alloc( size );
if (!newgroup)
{
release_object( token );
return NULL;
}
memcpy( newgroup, group, size );
if (filter_group( group, remove_groups, remove_group_count ))
{
newgroup->attrs &= ~(SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT);
newgroup->attrs |= SE_GROUP_USE_FOR_DENY_ONLY;
}
list_add_tail( &token->groups, &newgroup->entry );
if (src_token->primary_group == &group->sid)
{
token->owner = &newgroup->sid;
token->primary_group = &newgroup->sid;
}
}
assert( token->primary_group );
/* copy privileges */
LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
{
if (filter_privilege( privilege, remove_privs, remove_priv_count )) continue;
if (!privilege_add( token, privilege->luid, privilege->enabled ))
{
release_object( token );
return NULL;
}
}
if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
return token;
}
static struct acl *create_default_dacl( const struct sid *user )
{
struct ace *ace;
struct acl *default_dacl;
size_t default_dacl_size = sizeof(*default_dacl) + 2 * sizeof(*ace) +
sid_len( &local_system_sid ) + sid_len( user );
default_dacl = mem_alloc( default_dacl_size );
if (!default_dacl) return NULL;
default_dacl->revision = ACL_REVISION;
default_dacl->pad1 = 0;
default_dacl->size = default_dacl_size;
default_dacl->count = 2;
default_dacl->pad2 = 0;
/* GENERIC_ALL for Local System */
ace = set_ace( ace_first( default_dacl ), &local_system_sid, ACCESS_ALLOWED_ACE_TYPE, 0, GENERIC_ALL );
/* GENERIC_ALL for specified user */
set_ace( ace_next( ace ), user, ACCESS_ALLOWED_ACE_TYPE, 0, GENERIC_ALL );
return default_dacl;
}
struct sid_data
{
SID_IDENTIFIER_AUTHORITY idauth;
int count;
unsigned int subauth[MAX_SUBAUTH_COUNT];
};
static struct security_descriptor *create_security_label_sd( struct token *token, const struct sid *label_sid )
{
size_t sid_size = sid_len( label_sid ), sacl_size, sd_size;
struct security_descriptor *sd;
struct acl *sacl;
sacl_size = sizeof(*sacl) + sizeof(struct ace) + sid_size;
sd_size = sizeof(struct security_descriptor) + sacl_size;
if (!(sd = mem_alloc( sd_size )))
return NULL;
sd->control = SE_SACL_PRESENT;
sd->owner_len = 0;
sd->group_len = 0;
sd->sacl_len = sacl_size;
sd->dacl_len = 0;
sacl = (struct acl *)(sd + 1);
sacl->revision = ACL_REVISION;
sacl->pad1 = 0;
sacl->size = sacl_size;
sacl->count = 1;
sacl->pad2 = 0;
set_ace( ace_first( sacl ), label_sid, SYSTEM_MANDATORY_LABEL_ACE_TYPE, 0,
SYSTEM_MANDATORY_LABEL_NO_WRITE_UP );
assert( sd_is_valid( sd, sd_size ) );
return sd;
}
int token_assign_label( struct token *token, const struct sid *label )
{
struct security_descriptor *sd;
int ret = 0;
if ((sd = create_security_label_sd( token, label )))
{
ret = set_sd_defaults_from_token( &token->obj, sd, LABEL_SECURITY_INFORMATION, token );
free( sd );
}
return ret;
}
struct token *get_token_obj( struct process *process, obj_handle_t handle, unsigned int access )
{
return (struct token *)get_handle_obj( process, handle, access, &token_ops );
}
struct token *token_create_admin( unsigned primary, int impersonation_level, int elevation, unsigned int session_id )
{
struct token *token = NULL;
struct sid alias_admins_sid = { SID_REVISION, 2, SECURITY_NT_AUTHORITY, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS }};
struct sid alias_users_sid = { SID_REVISION, 2, SECURITY_NT_AUTHORITY, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS }};
/* on Windows, this value changes every time the user logs on */
struct sid logon_sid = { SID_REVISION, 3, SECURITY_NT_AUTHORITY, { SECURITY_LOGON_IDS_RID, 0, 0 /* FIXME: should be randomly generated when tokens are inherited by new processes */ }};
const struct sid *user_sid = security_unix_uid_to_sid( getuid() );
struct acl *default_dacl = create_default_dacl( user_sid );
const struct luid_attr admin_privs[] =
{
{ SeChangeNotifyPrivilege, SE_PRIVILEGE_ENABLED },
{ SeTcbPrivilege, 0 },
{ SeSecurityPrivilege, 0 },
{ SeBackupPrivilege, 0 },
{ SeRestorePrivilege, 0 },
{ SeSystemtimePrivilege, 0 },
{ SeShutdownPrivilege, 0 },
{ SeRemoteShutdownPrivilege, 0 },
{ SeTakeOwnershipPrivilege, 0 },
{ SeDebugPrivilege, 0 },
{ SeSystemEnvironmentPrivilege, 0 },
{ SeSystemProfilePrivilege, 0 },
{ SeProfileSingleProcessPrivilege, 0 },
{ SeIncreaseBasePriorityPrivilege, 0 },
{ SeLoadDriverPrivilege, SE_PRIVILEGE_ENABLED },
{ SeCreatePagefilePrivilege, 0 },
{ SeIncreaseQuotaPrivilege, 0 },
{ SeUndockPrivilege, 0 },
{ SeManageVolumePrivilege, 0 },
{ SeImpersonatePrivilege, SE_PRIVILEGE_ENABLED },
{ SeCreateGlobalPrivilege, SE_PRIVILEGE_ENABLED },
};
/* note: we don't include non-builtin groups here for the user -
* telling us these is the job of a client-side program */
const struct sid_attrs admin_groups[] =
{
{ &world_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
{ &local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
{ &interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
{ &authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
{ &domain_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
{ &alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER },
{ &alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY },
{ &logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID },
};
token = create_token( primary, session_id, user_sid, admin_groups, ARRAY_SIZE( admin_groups ),
admin_privs, ARRAY_SIZE( admin_privs ), default_dacl,
NULL, impersonation_level, elevation );
/* we really need a primary group */
assert( token->primary_group );
free( default_dacl );
return token;
}
static struct privilege *token_find_privilege( struct token *token, struct luid luid, int enabled_only )
{
struct privilege *privilege;
LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
{
if (is_equal_luid( luid, privilege->luid ))
{
if (enabled_only && !privilege->enabled)
return NULL;
return privilege;
}
}
return NULL;
}
static unsigned int token_adjust_privileges( struct token *token, const struct luid_attr *privs,
unsigned int count, struct luid_attr *mod_privs,
unsigned int mod_privs_count )
{
unsigned int i, modified_count = 0;
/* mark as modified */
allocate_luid( &token->modified_id );
for (i = 0; i < count; i++)
{
struct privilege *privilege = token_find_privilege( token, privs[i].luid, FALSE );
if (!privilege)
{
set_error( STATUS_NOT_ALL_ASSIGNED );
continue;
}
if (privs[i].attrs & SE_PRIVILEGE_REMOVED) privilege_remove( privilege );
else
{
/* save previous state for caller */
if (mod_privs_count)
{
*mod_privs++ = luid_and_attr_from_privilege( privilege );
mod_privs_count--;
modified_count++;
}
privilege->enabled = !!(privs[i].attrs & SE_PRIVILEGE_ENABLED);
}
}
return modified_count;
}
static void token_disable_privileges( struct token *token )
{
struct privilege *privilege;
/* mark as modified */
allocate_luid( &token->modified_id );
LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
privilege->enabled = FALSE;
}
int token_check_privileges( struct token *token, int all_required, const struct luid_attr *reqprivs,
unsigned int count, struct luid_attr *usedprivs)
{
unsigned int i, enabled_count = 0;
for (i = 0; i < count; i++)
{
struct privilege *privilege = token_find_privilege( token, reqprivs[i].luid, TRUE );
if (usedprivs)
usedprivs[i] = reqprivs[i];
if (privilege && privilege->enabled)
{
enabled_count++;
if (usedprivs) usedprivs[i].attrs |= SE_PRIVILEGE_USED_FOR_ACCESS;
}
}
if (all_required)
return (enabled_count == count);
else
return (enabled_count > 0);
}
int token_sid_present( struct token *token, const struct sid *sid, int deny )
{
struct group *group;
if (equal_sid( token->user, sid )) return TRUE;
LIST_FOR_EACH_ENTRY( group, &token->groups, struct group, entry )
{
if (!(group->attrs & SE_GROUP_ENABLED)) continue;
if (!deny && (group->attrs & SE_GROUP_USE_FOR_DENY_ONLY)) continue;
if (equal_sid( &group->sid, sid )) return TRUE;
}
return FALSE;
}
/* Checks access to a security descriptor. 'sd' must have been validated by
* caller. It returns STATUS_SUCCESS if call succeeded or an error indicating
* the reason. 'status' parameter will indicate if access is granted or denied.
*
* If both returned value and 'status' are STATUS_SUCCESS then access is granted.
*/
static unsigned int token_access_check( struct token *token,
const struct security_descriptor *sd,
unsigned int desired_access,
struct luid_attr *privs,
unsigned int *priv_count,
const generic_map_t *mapping,
unsigned int *granted_access,
unsigned int *status )
{
unsigned int current_access = 0;
unsigned int denied_access = 0;
ULONG i;
const struct acl *dacl;
int dacl_present;
const struct ace *ace;
const struct sid *owner;
/* assume no access rights */
*granted_access = 0;
/* fail if desired_access contains generic rights */
if (desired_access & (GENERIC_READ|GENERIC_WRITE|GENERIC_EXECUTE|GENERIC_ALL))
{
if (priv_count) *priv_count = 0;
return STATUS_GENERIC_NOT_MAPPED;
}
dacl = sd_get_dacl( sd, &dacl_present );
owner = sd_get_owner( sd );
if (!owner || !sd_get_group( sd ))
{
if (priv_count) *priv_count = 0;
return STATUS_INVALID_SECURITY_DESCR;
}
/* 1: Grant desired access if the object is unprotected */
if (!dacl_present || !dacl)
{
if (priv_count) *priv_count = 0;
if (desired_access & MAXIMUM_ALLOWED)
*granted_access = mapping->all;
else
*granted_access = desired_access;
return *status = STATUS_SUCCESS;
}
/* 2: Check if caller wants access to system security part. Note: access
* is only granted if specifically asked for */
if (desired_access & ACCESS_SYSTEM_SECURITY)
{
const struct luid_attr security_priv = { SeSecurityPrivilege, 0 };
struct luid_attr retpriv = security_priv;
if (token_check_privileges( token, TRUE, &security_priv, 1, &retpriv ))
{
if (priv_count)
{
/* assumes that there will only be one privilege to return */
if (*priv_count >= 1)
{
*priv_count = 1;
*privs = retpriv;
}
else
{
*priv_count = 1;
return STATUS_BUFFER_TOO_SMALL;
}
}
current_access |= ACCESS_SYSTEM_SECURITY;
if (desired_access == current_access)
{
*granted_access = current_access;
return *status = STATUS_SUCCESS;
}
}
else
{
if (priv_count) *priv_count = 0;
*status = STATUS_PRIVILEGE_NOT_HELD;
return STATUS_SUCCESS;
}
}
else if (priv_count) *priv_count = 0;
/* 3: Check whether the token is the owner */
/* NOTE: SeTakeOwnershipPrivilege is not checked for here - it is instead
* checked when a "set owner" call is made, overriding the access rights
* determined here. */
if (token_sid_present( token, owner, FALSE ))
{
current_access |= (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE);
if (desired_access == current_access)
{
*granted_access = current_access;
return *status = STATUS_SUCCESS;
}
}
/* 4: Grant rights according to the DACL */
for (i = 0, ace = ace_first( dacl ); i < dacl->count; i++, ace = ace_next( ace ))
{
const struct sid *sid = (const struct sid *)(ace + 1);
if (ace->flags & INHERIT_ONLY_ACE) continue;
switch (ace->type)
{
case ACCESS_DENIED_ACE_TYPE:
if (token_sid_present( token, sid, TRUE ))
{
unsigned int access = map_access( ace->mask, mapping );
if (desired_access & MAXIMUM_ALLOWED)
denied_access |= access;
else
{
denied_access |= (access & ~current_access);
if (desired_access & access) goto done;
}
}
break;
case ACCESS_ALLOWED_ACE_TYPE:
if (token_sid_present( token, sid, FALSE ))
{
unsigned int access = map_access( ace->mask, mapping );
if (desired_access & MAXIMUM_ALLOWED)
current_access |= access;
else
current_access |= (access & ~denied_access);
}
break;
}
/* don't bother carrying on checking if we've already got all of
* rights we need */
if (desired_access == *granted_access)
break;
}
done:
if (desired_access & MAXIMUM_ALLOWED)
*granted_access = current_access & ~denied_access;
else
if ((current_access & desired_access) == desired_access)
*granted_access = current_access & desired_access;
else
*granted_access = 0;
*status = *granted_access ? STATUS_SUCCESS : STATUS_ACCESS_DENIED;
return STATUS_SUCCESS;
}
const struct acl *token_get_default_dacl( struct token *token )
{
return token->default_dacl;
}
const struct sid *token_get_user( struct token *token )
{
return token->user;
}
const struct sid *token_get_primary_group( struct token *token )
{
return token->primary_group;
}
unsigned int token_get_session_id( struct token *token )
{
return token->session_id;
}
int check_object_access(struct token *token, struct object *obj, unsigned int *access)
{
generic_map_t mapping;
unsigned int status;
int res;
if (!token)
token = current->token ? current->token : current->process->token;
mapping.all = obj->ops->map_access( obj, GENERIC_ALL );
if (!obj->sd)
{
if (*access & MAXIMUM_ALLOWED) *access = mapping.all;
return TRUE;
}
mapping.read = obj->ops->map_access( obj, GENERIC_READ );
mapping.write = obj->ops->map_access( obj, GENERIC_WRITE );
mapping.exec = obj->ops->map_access( obj, GENERIC_EXECUTE );
res = token_access_check( token, obj->sd, *access, NULL, NULL,
&mapping, access, &status ) == STATUS_SUCCESS &&
status == STATUS_SUCCESS;
if (!res) set_error( STATUS_ACCESS_DENIED );
return res;
}
/* open a security token */
DECL_HANDLER(open_token)
{
if (req->flags & OPEN_TOKEN_THREAD)
{
struct thread *thread = get_thread_from_handle( req->handle, 0 );
if (thread)
{
if (thread->token)
{
if (!thread->token->primary && thread->token->impersonation_level <= SecurityAnonymous)
set_error( STATUS_CANT_OPEN_ANONYMOUS );
else
reply->token = alloc_handle( current->process, thread->token,
req->access, req->attributes );
}
else
set_error( STATUS_NO_TOKEN );
release_object( thread );
}
}
else
{
struct process *process = get_process_from_handle( req->handle, 0 );
if (process)
{
if (process->token)
reply->token = alloc_handle( current->process, process->token, req->access,
req->attributes );
else
set_error( STATUS_NO_TOKEN );
release_object( process );
}
}
}
/* adjust the privileges held by a token */
DECL_HANDLER(adjust_token_privileges)
{
struct token *token;
unsigned int access = TOKEN_ADJUST_PRIVILEGES;
if (req->get_modified_state) access |= TOKEN_QUERY;
if ((token = (struct token *)get_handle_obj( current->process, req->handle,
access, &token_ops )))
{
const struct luid_attr *privs = get_req_data();
struct luid_attr *modified_privs = NULL;
unsigned int priv_count = get_req_data_size() / sizeof(*privs);
unsigned int modified_priv_count = 0;
if (req->get_modified_state && !req->disable_all)
{
unsigned int i;
/* count modified privs */
for (i = 0; i < priv_count; i++)
{
struct privilege *privilege = token_find_privilege( token, privs[i].luid, FALSE );
if (privilege && req->get_modified_state)
modified_priv_count++;
}
reply->len = modified_priv_count;
modified_priv_count = min( modified_priv_count, get_reply_max_size() / sizeof(*modified_privs) );
if (modified_priv_count)
modified_privs = set_reply_data_size( modified_priv_count * sizeof(*modified_privs) );
}
reply->len = modified_priv_count * sizeof(*modified_privs);
if (req->disable_all)
token_disable_privileges( token );
else
token_adjust_privileges( token, privs, priv_count, modified_privs, modified_priv_count );
release_object( token );
}
}
/* retrieves the list of privileges that may be held be the token */
DECL_HANDLER(get_token_privileges)
{
struct token *token;
if ((token = (struct token *)get_handle_obj( current->process, req->handle,
TOKEN_QUERY,
&token_ops )))
{
int priv_count = 0;
struct luid_attr *privs;
struct privilege *privilege;
LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
priv_count++;
reply->len = priv_count * sizeof(*privs);
if (reply->len <= get_reply_max_size())
{
privs = set_reply_data_size( priv_count * sizeof(*privs) );
if (privs)
LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
*privs++ = luid_and_attr_from_privilege( privilege );
}
else
set_error(STATUS_BUFFER_TOO_SMALL);
release_object( token );
}
}
/* creates a duplicate of the token */
DECL_HANDLER(duplicate_token)
{
struct token *src_token;
struct unicode_str name;
const struct security_descriptor *sd;
const struct object_attributes *objattr = get_req_object_attributes( &sd, &name, NULL );
if (!objattr) return;
if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
TOKEN_DUPLICATE,
&token_ops )))
{
struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd, NULL, 0, NULL, 0 );
if (token)
{
unsigned int access = req->access ? req->access : get_handle_access( current->process, req->handle );
reply->new_handle = alloc_handle_no_access_check( current->process, token, access, objattr->attributes );
release_object( token );
}
release_object( src_token );
}
}
/* creates a restricted version of a token */
DECL_HANDLER(filter_token)
{
struct token *src_token;
if ((src_token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_DUPLICATE, &token_ops )))
{
const struct luid_attr *filter_privileges = get_req_data();
unsigned int priv_count, group_count;
const struct sid *filter_groups;
struct token *token;
priv_count = min( req->privileges_size, get_req_data_size() ) / sizeof(struct luid_attr);
filter_groups = (const struct sid *)((char *)filter_privileges + priv_count * sizeof(struct luid_attr));
group_count = get_sid_count( filter_groups, get_req_data_size() - priv_count * sizeof(struct luid_attr) );
token = token_duplicate( src_token, src_token->primary, src_token->impersonation_level, NULL,
filter_privileges, priv_count, filter_groups, group_count );
if (token)
{
unsigned int access = get_handle_access( current->process, req->handle );
reply->new_handle = alloc_handle_no_access_check( current->process, token, access, 0 );
release_object( token );
}
release_object( src_token );
}
}
/* checks the specified privileges are held by the token */
DECL_HANDLER(check_token_privileges)
{
struct token *token;
if ((token = (struct token *)get_handle_obj( current->process, req->handle,
TOKEN_QUERY,
&token_ops )))
{
unsigned int count = get_req_data_size() / sizeof(struct luid_attr);
if (!token->primary && token->impersonation_level <= SecurityAnonymous)
set_error( STATUS_BAD_IMPERSONATION_LEVEL );
else if (get_reply_max_size() >= count * sizeof(struct luid_attr))
{
struct luid_attr *usedprivs = set_reply_data_size( count * sizeof(*usedprivs) );
reply->has_privileges = token_check_privileges( token, req->all_required, get_req_data(), count, usedprivs );
}
else
set_error( STATUS_BUFFER_OVERFLOW );
release_object( token );
}
}
/* checks that a user represented by a token is allowed to access an object
* represented by a security descriptor */
DECL_HANDLER(access_check)
{
data_size_t sd_size = get_req_data_size();
const struct security_descriptor *sd = get_req_data();
struct token *token;
if (!sd_is_valid( sd, sd_size ))
{
set_error( STATUS_ACCESS_VIOLATION );
return;
}
if ((token = (struct token *)get_handle_obj( current->process, req->handle,
TOKEN_QUERY,
&token_ops )))
{
unsigned int status;
struct luid_attr priv;
unsigned int priv_count = 1;
memset(&priv, 0, sizeof(priv));
/* only impersonation tokens may be used with this function */
if (token->primary)
{
set_error( STATUS_NO_IMPERSONATION_TOKEN );
release_object( token );
return;
}
/* anonymous impersonation tokens can't be used */
if (token->impersonation_level <= SecurityAnonymous)
{
set_error( STATUS_BAD_IMPERSONATION_LEVEL );
release_object( token );
return;
}
status = token_access_check( token, sd, req->desired_access, &priv, &priv_count, &req->mapping,
&reply->access_granted, &reply->access_status );
reply->privileges_len = priv_count*sizeof(struct luid_attr);
if ((priv_count > 0) && (reply->privileges_len <= get_reply_max_size()))
{
struct luid_attr *privs = set_reply_data_size( priv_count * sizeof(*privs) );
memcpy( privs, &priv, sizeof(priv) );
}
set_error( status );
release_object( token );
}
}
/* retrieves an SID from the token */
DECL_HANDLER(get_token_sid)
{
struct token *token;
reply->sid_len = 0;
if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
{
const struct sid *sid = NULL;
switch (req->which_sid)
{
case TokenUser:
assert(token->user);
sid = token->user;
break;
case TokenPrimaryGroup:
sid = token->primary_group;
break;
case TokenOwner:
sid = token->owner;
break;
default:
set_error( STATUS_INVALID_PARAMETER );
break;
}
if (sid)
{
reply->sid_len = sid_len( sid );
if (reply->sid_len <= get_reply_max_size()) set_reply_data( sid, reply->sid_len );
else set_error( STATUS_BUFFER_TOO_SMALL );
}
release_object( token );
}
}
/* retrieves the groups that the user represented by the token belongs to */
DECL_HANDLER(get_token_groups)
{
struct token *token;
if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
{
unsigned int group_count = 0;
const struct group *group;
LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
{
if (req->attr_mask && !(group->attrs & req->attr_mask)) continue;
group_count++;
reply->sid_len += sid_len( &group->sid );
}
reply->attr_len = sizeof(unsigned int) * group_count;
if (reply->attr_len + reply->sid_len <= get_reply_max_size())
{
unsigned int *attr_ptr = set_reply_data_size( reply->attr_len + reply->sid_len );
struct sid *sid = (struct sid *)(attr_ptr + group_count);
if (attr_ptr)
{
LIST_FOR_EACH_ENTRY( group, &token->groups, const struct group, entry )
{
if (req->attr_mask && !(group->attrs & req->attr_mask)) continue;
sid = copy_sid( sid, &group->sid );
*attr_ptr++ = group->attrs;
}
}
}
else set_error( STATUS_BUFFER_TOO_SMALL );
release_object( token );
}
}
DECL_HANDLER(get_token_info)
{
struct token *token;
if ((token = (struct token *)get_handle_obj( current->process, req->handle, TOKEN_QUERY, &token_ops )))
{
reply->token_id = token->token_id;
reply->modified_id = token->modified_id;
reply->session_id = token->session_id;
reply->primary = token->primary;
reply->impersonation_level = token->impersonation_level;
reply->elevation = token->elevation;
reply->group_count = list_count( &token->groups );
reply->privilege_count = list_count( &token->privileges );
release_object( token );
}
}
DECL_HANDLER(get_token_default_dacl)
{
struct token *token;
reply->acl_len = 0;
if ((token = (struct token *)get_handle_obj( current->process, req->handle,
TOKEN_QUERY,
&token_ops )))
{
if (token->default_dacl)
reply->acl_len = token->default_dacl->size;
if (reply->acl_len <= get_reply_max_size())
{
struct acl *acl_reply = set_reply_data_size( reply->acl_len );
if (acl_reply)
memcpy( acl_reply, token->default_dacl, reply->acl_len );
}
else set_error( STATUS_BUFFER_TOO_SMALL );
release_object( token );
}
}
DECL_HANDLER(set_token_default_dacl)
{
struct token *token;
const struct acl *acl = get_req_data();
unsigned int acl_size = get_req_data_size();
if (acl_size && !acl_is_valid( acl, acl_size ))
{
set_error( STATUS_INVALID_ACL );
return;
}
if ((token = (struct token *)get_handle_obj( current->process, req->handle,
TOKEN_ADJUST_DEFAULT,
&token_ops )))
{
free( token->default_dacl );
token->default_dacl = NULL;
if (acl_size)
token->default_dacl = memdup( acl, acl_size );
release_object( token );
}
}
DECL_HANDLER(create_linked_token)
{
struct token *token, *linked;
int elevation;
if ((token = (struct token *)get_handle_obj( current->process, req->handle,
TOKEN_QUERY, &token_ops )))
{
switch (token->elevation)
{
case TokenElevationTypeFull:
elevation = TokenElevationTypeLimited;
break;
case TokenElevationTypeLimited:
elevation = TokenElevationTypeFull;
break;
default:
release_object( token );
return;
}
if ((linked = token_create_admin( FALSE, SecurityIdentification, elevation, token->session_id )))
{
reply->linked = alloc_handle( current->process, linked, TOKEN_ALL_ACCESS, 0 );
release_object( linked );
}
release_object( token );
}
}
Reference in New Issue View Git Blame Copy Permalink