Microsoft/NT4
Microsoft/NT4
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
ce47f986d8
NT4/private/newsam2/server/secdescr.c

3088 lines
89 KiB
C
Raw Normal View History

First commit
2001-01-01 00:00:00 +01:00
/*++
Copyright (c) 1991 Microsoft Corporation
Module Name:
SecDescr.c
Abstract:
This file contains services related to the establishment of and modification
of security descriptors for SAM objects.
Note that there are a couple of special security descriptors that this routine
does not build. These are the security descriptors for the DOMAIN_ADMIN group,
the ADMIN user account, and the SAM object. For the first release, in which
creation of domains is not supported, the DOMAIN object's security descriptor
is also not created here.
These security descriptors are built by the program that initializes a SAM
database.
Author:
Jim Kelly (JimK) 14-Oct-1991
Environment:
User Mode - Win32
Revision History:
--*/
///////////////////////////////////////////////////////////////////////////////
// //
// Includes //
// //
///////////////////////////////////////////////////////////////////////////////
#include <samsrvp.h>
///////////////////////////////////////////////////////////////////////////////
// //
// private service prototypes //
// //
///////////////////////////////////////////////////////////////////////////////
NTSTATUS
SampValidatePassedSD(
IN ULONG Length,
IN PISECURITY_DESCRIPTOR PassedSD
);
NTSTATUS
SampCheckForDescriptorRestrictions(
IN PSAMP_OBJECT Context,
IN SAMP_OBJECT_TYPE ObjectType,
IN ULONG ObjectRid,
IN PISECURITY_DESCRIPTOR PassedSD
);
NTSTATUS
SampBuildSamProtection(
IN PSID WorldSid,
IN PSID AdminsAliasSid,
IN ULONG AceCount,
IN PSID AceSid[],
IN ACCESS_MASK AceMask[],
IN PGENERIC_MAPPING GenericMap,
IN BOOLEAN UserObject,
OUT PULONG DescriptorLength,
OUT PSECURITY_DESCRIPTOR *Descriptor,
OUT PULONG *RidToReplace OPTIONAL
);
///////////////////////////////////////////////////////////////////////////////
// //
// Services available for use throughout SAM //
// //
///////////////////////////////////////////////////////////////////////////////
NTSTATUS
SampInitializeDomainDescriptors(
ULONG Index
)
/*++
Routine Description:
This routine initializes security descriptors needed to protect
user, group, and alias objects.
These security descriptors are placed in the SampDefinedDomains[] array.
This routine expects all SIDs to be previously initialized.
The following security descriptors are prepared:
AdminUserSD - Contains a SD appropriate for applying to
a user object that is a member of the ADMINISTRATORS
alias.
AdminGroupSD - Contains a SD appropriate for applying to
a group object that is a member of the ADMINISTRATORS
alias.
NormalUserSD - Contains a SD appropriate for applying to
a user object that is NOT a member of the ADMINISTRATORS
alias.
NormalGroupSD - Contains a SD appropriate for applying to
a Group object that is NOT a member of the ADMINISTRATORS
alias.
NormalAliasSD - Contains a SD appropriate for applying to
newly created alias objects.
Additionally, the following related information is provided:
AdminUserRidPointer
NormalUserRidPointer
Points to the last RID of the ACE in the corresponding
SD's DACL which grants access to the user. This rid
must be replaced with the user's rid being the SD is
applied to the user object.
AdminUserSDLength
AdminGroupSDLength
NormalUserSDLength
NormalGroupSDLength
NormalAliasSDLength
The length, in bytes, of the corresponding security
descriptor.
Arguments:
Index - The index of the domain whose security descriptors are being
created. The Sid field of this domain's data structure is already
expected to be set.
Return Value:
STATUS_SUCCESS - The security descriptors have been successfully initialized.
STATUS_INSUFFICIENT_RESOURCES - Heap could not be allocated to produce the needed
security descriptors.
--*/
{
NTSTATUS Status;
ULONG Size;
PSID AceSid[10]; // Don't expect more than 10 ACEs in any of these.
ACCESS_MASK AceMask[10]; // Access masks corresponding to Sids
GENERIC_MAPPING AliasMap = {ALIAS_READ,
ALIAS_WRITE,
ALIAS_EXECUTE,
ALIAS_ALL_ACCESS
};
GENERIC_MAPPING GroupMap = {GROUP_READ,
GROUP_WRITE,
GROUP_EXECUTE,
GROUP_ALL_ACCESS
};
GENERIC_MAPPING UserMap = {USER_READ,
USER_WRITE,
USER_EXECUTE,
USER_ALL_ACCESS
};
SID_IDENTIFIER_AUTHORITY
BuiltinAuthority = SECURITY_NT_AUTHORITY;
ULONG AdminsSidBuffer[8],
AccountSidBuffer[8];
PSID AdminsAliasSid = &AdminsSidBuffer[0],
AccountAliasSid = &AccountSidBuffer[0],
AnySidInAccountDomain = NULL;
SAMTRACE("SampInitializeDomainDescriptors");
//
// Make sure the buffer we've alloted for the simple sids above
// are large enough.
//
//
// ADMINISTRATORS and ACCOUNT_OPERATORS aliases
// are is S-1-5-20-x (2 sub-authorities)
//
ASSERT( RtlLengthRequiredSid(2) <= ( 8 * sizeof(ULONG) ) );
////////////////////////////////////////////////////////////////////////////////////
// //
// Initialize the SIDs we'll need.
// //
////////////////////////////////////////////////////////////////////////////////////
RtlInitializeSid( AdminsAliasSid, &BuiltinAuthority, 2 );
*(RtlSubAuthoritySid( AdminsAliasSid, 0 )) = SECURITY_BUILTIN_DOMAIN_RID;
*(RtlSubAuthoritySid( AdminsAliasSid, 1 )) = DOMAIN_ALIAS_RID_ADMINS;
RtlInitializeSid( AccountAliasSid, &BuiltinAuthority, 2 );
*(RtlSubAuthoritySid( AccountAliasSid, 0 )) = SECURITY_BUILTIN_DOMAIN_RID;
*(RtlSubAuthoritySid( AccountAliasSid, 1 )) = DOMAIN_ALIAS_RID_ACCOUNT_OPS;
//
// Initialize a SID that can be used to represent accounts
// in this domain.
//
// This is the same as the domain sid found in the DefinedDomains[]
// array except it has one more sub-authority.
// It doesn't matter what the value of the last RID is because it
// is always replaced before use.
//
Size = RtlLengthSid( SampDefinedDomains[Index].Sid ) + sizeof(ULONG);
AnySidInAccountDomain = RtlAllocateHeap( RtlProcessHeap(), 0, Size);
ASSERT( AnySidInAccountDomain != NULL );
Status = RtlCopySid(
Size,
AnySidInAccountDomain,
SampDefinedDomains[Index].Sid );
ASSERT(NT_SUCCESS(Status));
(*RtlSubAuthorityCountSid( AnySidInAccountDomain )) += 1;
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//
//
//
//
// The following security is assigned to groups that are made
// members of the ADMINISTRATORS alias.
//
//
// Owner: Administrators Alias
// Group: Administrators Alias
//
// Dacl: Grant Grant
// WORLD Administrators
// (Execute | Read) GenericAll
//
// Sacl: Audit
// Success | Fail
// WORLD
// (Write | Delete | WriteDacl | AccessSystemSecurity)
//
//
//
// All other aliases and groups must be assigned the following
// security:
//
// Owner: Administrators Alias
// Group: Administrators Alias
//
// Dacl: Grant Grant Grant
// WORLD Administrators AccountOperators Alias
// (Execute | Read) GenericAll GenericAll
//
// Sacl: Audit
// Success | Fail
// WORLD
// (Write | Delete | WriteDacl | AccessSystemSecurity)
//
//
//
//
//
// The following security is assigned to users that are made a
// member of the ADMINISTRATORS alias. This includes direct
// inclusion or indirect inclusion through group membership.
//
//
// Owner: Administrators Alias
// Group: Administrators Alias
//
// Dacl: Grant Grant Grant
// WORLD Administrators User's SID
// (Execute | Read) GenericAll GenericWrite
//
// Sacl: Audit
// Success | Fail
// WORLD
// (Write | Delete | WriteDacl | AccessSystemSecurity)
//
//
//
//
// All other users must be assigned the following
// security:
//
// Owner: AccountOperators Alias
// Group: AccountOperators Alias
//
// Dacl: Grant Grant Grant Grant
// WORLD Administrators Account Operators Alias User's SID
// (Execute | Read) GenericAll GenericAll GenericWrite
//
// Sacl: Audit
// Success | Fail
// WORLD
// (Write | Delete | WriteDacl | AccessSystemSecurity)
//
//
// !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
//
// Note that because we are going to cram these ACLs directly
// into the backing store, we must map the generic accesses
// beforehand.
//
// !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
//
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//
// We're not particularly good about freeing memory on error
// conditions below. Generally speaking, if this doens't
// initialize correctly, the system is hosed.
//
//
// Normal Alias SD
//
AceSid[0] = SampWorldSid;
AceMask[0] = (ALIAS_EXECUTE | ALIAS_READ);
AceSid[1] = AdminsAliasSid;
AceMask[1] = (ALIAS_ALL_ACCESS);
AceSid[2] = AccountAliasSid;
AceMask[2] = (ALIAS_ALL_ACCESS);
Status = SampBuildSamProtection(
SampWorldSid, // WorldSid
AdminsAliasSid, // AdminsAliasSid
3, // AceCount
&AceSid[0], // AceSid array
&AceMask[0], // Ace Mask array
&AliasMap, // GenericMap
FALSE, // Not user object
&SampDefinedDomains[Index].NormalAliasSDLength, // Descriptor
&SampDefinedDomains[Index].NormalAliasSD, // Descriptor
NULL // RidToReplace
);
if (!NT_SUCCESS(Status)) {
goto done;
}
//
// Admin Group SD
//
AceSid[0] = SampWorldSid;
AceMask[0] = (GROUP_EXECUTE | GROUP_READ);
AceSid[1] = AdminsAliasSid;
AceMask[1] = (GROUP_ALL_ACCESS);
Status = SampBuildSamProtection(
SampWorldSid, // WorldSid
AdminsAliasSid, // AdminsAliasSid
2, // AceCount
&AceSid[0], // AceSid array
&AceMask[0], // Ace Mask array
&GroupMap, // GenericMap
FALSE, // Not user object
&SampDefinedDomains[Index].AdminGroupSDLength, // Descriptor
&SampDefinedDomains[Index].AdminGroupSD, // Descriptor
NULL // RidToReplace
);
if (!NT_SUCCESS(Status)) {
goto done;
}
//
// Normal GROUP SD
//
AceSid[0] = SampWorldSid;
AceMask[0] = (GROUP_EXECUTE | GROUP_READ);
AceSid[1] = AdminsAliasSid;
AceMask[1] = (GROUP_ALL_ACCESS);
AceSid[2] = AccountAliasSid;
AceMask[2] = (GROUP_ALL_ACCESS);
Status = SampBuildSamProtection(
SampWorldSid, // WorldSid
AdminsAliasSid, // AdminsAliasSid
3, // AceCount
&AceSid[0], // AceSid array
&AceMask[0], // Ace Mask array
&GroupMap, // GenericMap
FALSE, // Not user object
&SampDefinedDomains[Index].NormalGroupSDLength, // Descriptor
&SampDefinedDomains[Index].NormalGroupSD, // Descriptor
NULL // RidToReplace
);
if (!NT_SUCCESS(Status)) {
goto done;
}
//
// Admin User SD
//
AceSid[0] = SampWorldSid;
AceMask[0] = (USER_EXECUTE | USER_READ);
AceSid[1] = AdminsAliasSid;
AceMask[1] = (USER_ALL_ACCESS);
AceSid[2] = AnySidInAccountDomain;
AceMask[2] = (USER_WRITE);
Status = SampBuildSamProtection(
SampWorldSid, // WorldSid
AdminsAliasSid, // AdminsAliasSid
3, // AceCount
&AceSid[0], // AceSid array
&AceMask[0], // Ace Mask array
&UserMap, // GenericMap
TRUE, // Not user object
&SampDefinedDomains[Index].AdminUserSDLength, // Descriptor
&SampDefinedDomains[Index].AdminUserSD, // Descriptor
&SampDefinedDomains[Index].AdminUserRidPointer // RidToReplace
);
if (!NT_SUCCESS(Status)) {
goto done;
}
//
// Normal User SD
//
AceSid[0] = SampWorldSid;
AceMask[0] = (USER_EXECUTE | USER_READ);
AceSid[1] = AdminsAliasSid;
AceMask[1] = (USER_ALL_ACCESS);
AceSid[2] = AccountAliasSid;
AceMask[2] = (USER_ALL_ACCESS);
AceSid[3] = AnySidInAccountDomain;
AceMask[3] = (USER_WRITE);
Status = SampBuildSamProtection(
SampWorldSid, // WorldSid
AdminsAliasSid, // AdminsAliasSid
4, // AceCount
&AceSid[0], // AceSid array
&AceMask[0], // Ace Mask array
&UserMap, // GenericMap
TRUE, // Not user object
&SampDefinedDomains[Index].NormalUserSDLength, // Descriptor
&SampDefinedDomains[Index].NormalUserSD, // Descriptor
&SampDefinedDomains[Index].NormalUserRidPointer // RidToReplace
);
if (!NT_SUCCESS(Status)) {
goto done;
}
done:
RtlFreeHeap( RtlProcessHeap(), 0, AnySidInAccountDomain );
return(Status);
}
NTSTATUS
SampBuildSamProtection(
IN PSID WorldSid,
IN PSID AdminsAliasSid,
IN ULONG AceCount,
IN PSID AceSid[],
IN ACCESS_MASK AceMask[],
IN PGENERIC_MAPPING GenericMap,
IN BOOLEAN UserObject,
OUT PULONG DescriptorLength,
OUT PSECURITY_DESCRIPTOR *Descriptor,
OUT PULONG *RidToReplace OPTIONAL
)
/*++
Routine Description:
This routine builds a self-relative security descriptor ready
to be applied to one of the SAM objects.
If so indicated, a pointer to the last RID of the SID in the last
ACE of the DACL is returned and a flag set indicating that the RID
must be replaced before the security descriptor is applied to an object.
This is to support USER object protection, which must grant some
access to the user represented by the object.
The owner and group of each security descriptor will be set
to:
Owner: Administrators Alias
Group: Administrators Alias
The SACL of each of these objects will be set to:
Audit
Success | Fail
WORLD
(Write | Delete | WriteDacl | AccessSystemSecurity)
Arguments:
AceCount - The number of ACEs to be included in the DACL.
AceSid - Points to an array of SIDs to be granted access by the DACL.
If the target SAM object is a User object, then the last entry
in this array is expected to be the SID of an account within the
domain with the last RID not yet set. The RID will be set during
actual account creation.
AceMask - Points to an array of accesses to be granted by the DACL.
The n'th entry of this array corresponds to the n'th entry of
the AceSid array. These masks should not include any generic
access types.
GenericMap - Points to a generic mapping for the target object type.
UserObject - Indicates whether the target SAM object is a User object
or not. If TRUE (it is a User object), then the resultant
protection will be set up indicating Rid replacement is necessary.
DescriptorLength - Receives the length of the resultant SD.
Descriptor - Receives a pointer to the resultant SD.
RidToReplace - Is required aif userObject is TRUE and will be set
to point to the user's RID.
Return Value:
TBS.
--*/
{
NTSTATUS Status;
SECURITY_DESCRIPTOR Absolute;
PSECURITY_DESCRIPTOR Relative;
PACL TmpAcl;
PACCESS_ALLOWED_ACE TmpAce;
PSID TmpSid;
ULONG Length, i;
PULONG RidLocation;
BOOLEAN IgnoreBoolean;
ACCESS_MASK MappedMask;
SAMTRACE("SampBuildSamProtection");
//
// The approach is to set up an absolute security descriptor that
// looks like what we want and then copy it to make a self-relative
// security descriptor.
//
Status = RtlCreateSecurityDescriptor(
&Absolute,
SECURITY_DESCRIPTOR_REVISION1
);
ASSERT( NT_SUCCESS(Status) );
//
// Owner
//
Status = RtlSetOwnerSecurityDescriptor (&Absolute, AdminsAliasSid, FALSE );
ASSERT(NT_SUCCESS(Status));
//
// Group
//
Status = RtlSetGroupSecurityDescriptor (&Absolute, AdminsAliasSid, FALSE );
ASSERT(NT_SUCCESS(Status));
//
// Discretionary ACL
//
// Calculate its length,
// Allocate it,
// Initialize it,
// Add each ACE
// Add it to the security descriptor
//
Length = (ULONG)sizeof(ACL);
for (i=0; i<AceCount; i++) {
Length += RtlLengthSid( AceSid[i] ) +
(ULONG)sizeof(ACCESS_ALLOWED_ACE) -
(ULONG)sizeof(ULONG); //Subtract out SidStart field length
}
TmpAcl = RtlAllocateHeap( RtlProcessHeap(), 0, Length );
ASSERT(TmpAcl != NULL);
Status = RtlCreateAcl( TmpAcl, Length, ACL_REVISION2);
ASSERT( NT_SUCCESS(Status) );
for (i=0; i<AceCount; i++) {
MappedMask = AceMask[i];
RtlMapGenericMask( &MappedMask, GenericMap );
Status = RtlAddAccessAllowedAce (
TmpAcl,
ACL_REVISION2,
MappedMask,
AceSid[i]
);
ASSERT( NT_SUCCESS(Status) );
}
Status = RtlSetDaclSecurityDescriptor (&Absolute, TRUE, TmpAcl, FALSE );
ASSERT(NT_SUCCESS(Status));
//
// Sacl
//
Length = (ULONG)sizeof(ACL) +
RtlLengthSid( WorldSid ) +
(ULONG)sizeof(SYSTEM_AUDIT_ACE) -
(ULONG)sizeof(ULONG); //Subtract out SidStart field length
TmpAcl = RtlAllocateHeap( RtlProcessHeap(), 0, Length );
ASSERT(TmpAcl != NULL);
Status = RtlCreateAcl( TmpAcl, Length, ACL_REVISION2);
ASSERT( NT_SUCCESS(Status) );
Status = RtlAddAuditAccessAce (
TmpAcl,
ACL_REVISION2,
GenericMap->GenericWrite | DELETE | WRITE_DAC | ACCESS_SYSTEM_SECURITY,
WorldSid,
TRUE, //AuditSuccess,
TRUE //AuditFailure
);
ASSERT( NT_SUCCESS(Status) );
Status = RtlSetSaclSecurityDescriptor (&Absolute, TRUE, TmpAcl, FALSE );
ASSERT(NT_SUCCESS(Status));
//
// Convert the Security Descriptor to Self-Relative
//
// Get the length needed
// Allocate that much memory
// Copy it
// Free the generated absolute ACLs
//
Length = 0;
Status = RtlAbsoluteToSelfRelativeSD( &Absolute, NULL, &Length );
ASSERT(Status == STATUS_BUFFER_TOO_SMALL);
Relative = RtlAllocateHeap( RtlProcessHeap(), 0, Length );
ASSERT(Relative != NULL);
Status = RtlAbsoluteToSelfRelativeSD(&Absolute, Relative, &Length );
ASSERT(NT_SUCCESS(Status));
RtlFreeHeap( RtlProcessHeap(), 0, Absolute.Dacl );
RtlFreeHeap( RtlProcessHeap(), 0, Absolute.Sacl );
//
// If the object is a user object, then get the address of the
// last RID of the SID in the last ACE in the DACL.
//
if (UserObject == TRUE) {
Status = RtlGetDaclSecurityDescriptor(
Relative,
&IgnoreBoolean,
&TmpAcl,
&IgnoreBoolean
);
ASSERT(NT_SUCCESS(Status));
Status = RtlGetAce ( TmpAcl, AceCount-1, (PVOID *)&TmpAce );
ASSERT(NT_SUCCESS(Status));
TmpSid = (PSID)(&TmpAce->SidStart),
RidLocation = RtlSubAuthoritySid(
TmpSid,
(ULONG)(*RtlSubAuthorityCountSid( TmpSid ) - 1)
);
}
//
// Set the result information
//
(*DescriptorLength) = Length;
(*Descriptor) = Relative;
if (ARGUMENT_PRESENT(RidToReplace)) {
(*RidToReplace) = RidLocation;
}
return(Status);
}
NTSTATUS
SampGetNewAccountSecurity(
IN SAMP_OBJECT_TYPE ObjectType,
IN BOOLEAN Admin,
IN BOOLEAN TrustedClient,
IN BOOLEAN RestrictCreatorAccess,
IN ULONG NewAccountRid,
OUT PSECURITY_DESCRIPTOR *NewDescriptor,
OUT PULONG DescriptorLength
)
/*++
Routine Description:
This service creates a standard self-relative security descriptor
for a new USER, GROUP or ALIAS account.
Note: THIS ROUTINE REFERENCES THE CURRENT TRANSACTION DOMAIN
(ESTABLISHED USING SampSetTransactioDomain()). THIS
SERVICE MAY ONLY BE CALLED AFTER SampSetTransactionDomain()
AND BEFORE SampReleaseWriteLock().
Arguments:
ObjectType - Indicates the type of account for which a new security
descriptor is required. This must be either SampGroupObjectType
or SampUserObjectType.
Admin - if TRUE, indicates the security descriptor will be protecting
an object that is an admin object (e.g., is a member, directly
or indirectly, of the ADMINISTRATORS alias).
TrustedClient - Indicates whether the client is a trusted client
or not. TRUE indicates the client is trusted, FALSE indicates
the client is not trusted.
RestrictCreatorAccess - Indicates whether or not the creator's
access to the object is to be restricted according to
specific rules. Also indicates whether or not the account
is to be given any access to itself. An account will only
be given access to itself if there are no creator access
restrictions.
The following ObjectTypes have restriction rules that may
be requested:
User:
- Admin is assigned as owner of the object.
- Creator is given (DELETE | USER_WRITE) access.
NewAccountRid - The relative ID of the new account.
NewDescriptor - Receives a pointer to the new account's self-relative
security descriptor. Be sure to free this descriptor with
MIDL_user_free() when done.
DescriptorLength - Receives the length (in bytes) of the returned
security descriptor
Return Value:
STATUS_SUCCESS - A new security descriptor has been produced.
STATUS_INSUFFICIENT_RESOURCES - Memory could not be allocated to
produce the security descriptor.
--*/
{
SID_IDENTIFIER_AUTHORITY BuiltinAuthority = SECURITY_NT_AUTHORITY;
ULONG AccountSidBuffer[8];
PSID AccountAliasSid = &AccountSidBuffer[0];
SECURITY_DESCRIPTOR DaclDescriptor;
NTSTATUS NtStatus = STATUS_SUCCESS;
NTSTATUS IgnoreStatus;
HANDLE ClientToken = INVALID_HANDLE_VALUE;
ULONG DataLength = 0;
ACCESS_ALLOWED_ACE *NewAce = NULL;
PACL NewDacl = NULL;
PACL OldDacl = NULL;
PSECURITY_DESCRIPTOR StaticDescriptor = NULL;
PSECURITY_DESCRIPTOR LocalDescriptor = NULL;
PTOKEN_GROUPS ClientGroups = NULL;
PTOKEN_OWNER SubjectOwner = NULL;
PSID SubjectSid = NULL;
ULONG AceLength = 0;
ULONG i;
BOOLEAN AdminAliasFound = FALSE;
BOOLEAN AccountAliasFound = FALSE;
BOOLEAN DaclPresent, DaclDefaulted;
GENERIC_MAPPING GenericMapping;
GENERIC_MAPPING AliasMap = {ALIAS_READ,
ALIAS_WRITE,
ALIAS_EXECUTE,
ALIAS_ALL_ACCESS
};
GENERIC_MAPPING GroupMap = {GROUP_READ,
GROUP_WRITE,
GROUP_EXECUTE,
GROUP_ALL_ACCESS
};
GENERIC_MAPPING UserMap = {USER_READ,
USER_WRITE,
USER_EXECUTE,
USER_ALL_ACCESS
};
SAMTRACE("SampGetNewAccountSecurity");
//
// Security account objects don't pick up security in the normal
// fashion in the release 1 timeframe. They are assigned a well-known
// security descriptor based upon their object type.
//
// Notice that all the accounts with tricky security are created when
// the domain is created (e.g., admin groups and admin user account).
//
switch (ObjectType) {
case SampGroupObjectType:
ASSERT(RestrictCreatorAccess == FALSE);
//
// NewAccountRid parameter is ignored for groups.
//
if (Admin == TRUE) {
StaticDescriptor =
SampDefinedDomains[SampTransactionDomainIndex].AdminGroupSD;
(*DescriptorLength) =
SampDefinedDomains[SampTransactionDomainIndex].AdminGroupSDLength;
} else {
StaticDescriptor =
SampDefinedDomains[SampTransactionDomainIndex].NormalGroupSD;
(*DescriptorLength) =
SampDefinedDomains[SampTransactionDomainIndex].NormalGroupSDLength;
}
GenericMapping = GroupMap;
break;
case SampAliasObjectType:
ASSERT(RestrictCreatorAccess == FALSE);
//
// Admin and NewAccountRid parameters are ignored for aliases.
//
StaticDescriptor =
SampDefinedDomains[SampTransactionDomainIndex].NormalAliasSD;
(*DescriptorLength) =
SampDefinedDomains[SampTransactionDomainIndex].NormalAliasSDLength;
GenericMapping = AliasMap;
break;
case SampUserObjectType:
if (Admin == TRUE) {
StaticDescriptor =
SampDefinedDomains[SampTransactionDomainIndex].AdminUserSD;
(*DescriptorLength) =
SampDefinedDomains[SampTransactionDomainIndex].AdminUserSDLength;
(*SampDefinedDomains[SampTransactionDomainIndex].AdminUserRidPointer)
= NewAccountRid;
} else {
StaticDescriptor =
SampDefinedDomains[SampTransactionDomainIndex].NormalUserSD;
(*DescriptorLength) =
SampDefinedDomains[SampTransactionDomainIndex].NormalUserSDLength;
(*SampDefinedDomains[SampTransactionDomainIndex].NormalUserRidPointer)
= NewAccountRid;
}
GenericMapping = UserMap;
break;
}
//
// We have a pointer to SAM's static security descriptor. Copy it
// into a heap buffer that RtlSetSecurityObject() will like.
//
LocalDescriptor = RtlAllocateHeap( RtlProcessHeap(), 0, (*DescriptorLength) );
if ( LocalDescriptor == NULL ) {
(*NewDescriptor) = NULL;
(*DescriptorLength) = 0;
return(STATUS_INSUFFICIENT_RESOURCES);
}
RtlCopyMemory(
LocalDescriptor,
StaticDescriptor,
(*DescriptorLength)
);
//
// If the caller is to have restricted access to this account,
// then remove the last ACE from the ACL (the one intended for
// the account itself).
//
if (RestrictCreatorAccess) {
NtStatus = RtlGetDaclSecurityDescriptor(
LocalDescriptor,
&DaclPresent,
&OldDacl,
&DaclDefaulted
);
ASSERT(NT_SUCCESS(NtStatus));
ASSERT(DaclPresent);
ASSERT(OldDacl->AceCount >= 1);
OldDacl->AceCount -= 1; // Remove the last ACE from the ACL.
}
//
// If the caller is not a trusted client, see if the caller is an
// administrator or an account operator. If not, add an ACCESS_ALLOWED
// ACE to the DACL that gives full access to the creator (or restricted
// access, if so specified).
//
if ( !TrustedClient ) {
NtStatus = I_RpcMapWin32Status(RpcImpersonateClient( NULL ));
if (NT_SUCCESS(NtStatus)) { // if (ImpersonatingClient)
NtStatus = NtOpenThreadToken(
NtCurrentThread(),
TOKEN_QUERY,
TRUE, //OpenAsSelf
&ClientToken
);
//
// Stop impersonating the client
//
IgnoreStatus = I_RpcMapWin32Status(RpcRevertToSelf());
ASSERT( NT_SUCCESS(IgnoreStatus) );
if (NT_SUCCESS(NtStatus)) { // if (TokenOpened)
//
// See if the caller is an administrator or an account
// operator. First, see how big
// a buffer we need to hold the caller's groups.
//
NtStatus = NtQueryInformationToken(
ClientToken,
TokenGroups,
NULL,
0,
&DataLength
);
if ( ( NtStatus == STATUS_BUFFER_TOO_SMALL ) &&
( DataLength > 0 ) ) {
ClientGroups = MIDL_user_allocate( DataLength );
if ( ClientGroups == NULL ) {
NtStatus = STATUS_INSUFFICIENT_RESOURCES;
} else {
//
// Now get a list of the caller's groups.
//
NtStatus = NtQueryInformationToken(
ClientToken,
TokenGroups,
ClientGroups,
DataLength,
&DataLength
);
if ( NT_SUCCESS( NtStatus ) ) {
//
// Build the SID of the ACCOUNT_OPS alias, so we
// can see if the user is included in it.
//
RtlInitializeSid(
AccountAliasSid,
&BuiltinAuthority,
2 );
*(RtlSubAuthoritySid( AccountAliasSid, 0 )) =
SECURITY_BUILTIN_DOMAIN_RID;
*(RtlSubAuthoritySid( AccountAliasSid, 1 )) =
DOMAIN_ALIAS_RID_ACCOUNT_OPS;
//
// See if the ADMIN or ACCOUNT_OPS alias is in
// the caller's groups.
//
for ( i = 0; i < ClientGroups->GroupCount; i++ ) {
SubjectSid = ClientGroups->Groups[i].Sid;
ASSERT( SubjectSid != NULL );
if ( RtlEqualSid( SubjectSid, SampAdministratorsAliasSid ) ) {
AdminAliasFound = TRUE;
break;
}
if ( RtlEqualSid( SubjectSid, AccountAliasSid ) ) {
AccountAliasFound = TRUE;
break;
}
}
//
// If the callers groups did not include the admins
// alias, add an ACCESS_ALLOWED ACE for the owner.
//
if ( !AdminAliasFound && !AccountAliasFound ) {
//
// First, find out what size buffer we need
// to get the owner.
//
NtStatus = NtQueryInformationToken(
ClientToken,
TokenOwner,
NULL,
0,
&DataLength
);
if ( ( NtStatus == STATUS_BUFFER_TOO_SMALL ) &&
( DataLength > 0 ) ) {
SubjectOwner = MIDL_user_allocate( DataLength );
if ( SubjectOwner == NULL ) {
NtStatus = STATUS_INSUFFICIENT_RESOURCES;
} else {
//
// Now, query the owner that will be
// given access to the object
// created.
//
NtStatus = NtQueryInformationToken(
ClientToken,
TokenOwner,
SubjectOwner,
DataLength,
&DataLength
);
if ( NT_SUCCESS( NtStatus ) ) {
//
// Create an ACE that gives the
// owner full access.
//
AceLength = sizeof( ACE_HEADER ) +
sizeof( ACCESS_MASK ) +
RtlLengthSid(
SubjectOwner->Owner );
NewAce = (ACCESS_ALLOWED_ACE *)
MIDL_user_allocate( AceLength );
if ( NewAce == NULL ) {
NtStatus =
STATUS_INSUFFICIENT_RESOURCES;
} else {
NewAce->Header.AceType =
ACCESS_ALLOWED_ACE_TYPE;
NewAce->Header.AceSize = (USHORT) AceLength;
NewAce->Header.AceFlags = 0;
NewAce->Mask = USER_ALL_ACCESS;
//
// If the creator's access is
// to be restricted, change the
// AccessMask.
//
if (RestrictCreatorAccess) {
NewAce->Mask = DELETE |
USER_WRITE |
USER_FORCE_PASSWORD_CHANGE;
}
RtlCopySid(
RtlLengthSid(
SubjectOwner->Owner ),
(PSID)( &NewAce->SidStart ),
SubjectOwner->Owner );
//
// Allocate a new, larger ACL and
// copy the old one into it.
//
NtStatus =
RtlGetDaclSecurityDescriptor(
LocalDescriptor,
&DaclPresent,
&OldDacl,
&DaclDefaulted
);
if ( NT_SUCCESS( NtStatus ) ) {
NewDacl = MIDL_user_allocate(
OldDacl->AclSize +
AceLength );
if ( NewDacl == NULL ) {
NtStatus = STATUS_INSUFFICIENT_RESOURCES;
} else {
RtlCopyMemory(
NewDacl,
OldDacl,
OldDacl->AclSize
);
NewDacl->AclSize =
OldDacl->AclSize +
(USHORT) AceLength;
//
// Add the new ACE
// to the new ACL.
//
NtStatus = RtlAddAce(
NewDacl,
ACL_REVISION2,
1, // add after first ACE (world)
(PVOID)NewAce,
AceLength
);
} // end_if (allocated NewDacl)
} // end_if (get DACL from SD)
} // end_if (allocated NewAce)
} // end_if (Query TokenOwner Succeeded)
} // end_if (Allocated TokenOwner buffer)
} // end_if (Query TokenOwner size Succeeded)
} // end_if (not admin)
} // end_if (Query TokenGroups Succeeded)
} // end_if (Allocated TokenGroups buffer)
} // end_if (Query TokenGroups size Succeeded)
IgnoreStatus = NtClose( ClientToken );
ASSERT(NT_SUCCESS(IgnoreStatus));
} // end_if (TokenOpened)
} // end_if (ImpersonatingClient)
} // end_if (TrustedClient)
if ( NT_SUCCESS( NtStatus ) ) {
//
// If we created a new DACL above, stick it on the security
// descriptor.
//
if ( NewDacl != NULL ) {
NtStatus = RtlCreateSecurityDescriptor(
&DaclDescriptor,
SECURITY_DESCRIPTOR_REVISION1
);
if ( NT_SUCCESS( NtStatus ) ) {
//
// Set the DACL on the LocalDescriptor. Note that this
// call will RtlFreeHeap() the old descriptor, and allocate
// a new one.
//
DaclDescriptor.Control = SE_DACL_PRESENT;
DaclDescriptor.Dacl = NewDacl;
NtStatus = RtlSetSecurityObject(
DACL_SECURITY_INFORMATION,
&DaclDescriptor,
&LocalDescriptor,
&GenericMapping,
NULL
);
}
}
}
if ( NT_SUCCESS( NtStatus ) ) {
//
// Copy the security descriptor and length into buffers for the
// caller. AceLength is 0 if we didn't add an ACE to the DACL
// above.
//
(*DescriptorLength) = (*DescriptorLength) + AceLength;
(*NewDescriptor) = MIDL_user_allocate( (*DescriptorLength) );
if ( (*NewDescriptor) == NULL ) {
NtStatus = STATUS_INSUFFICIENT_RESOURCES;
} else {
RtlCopyMemory(
(*NewDescriptor),
LocalDescriptor,
(*DescriptorLength)
);
}
}
//
// Free up local items that may have been allocated.
//
if ( LocalDescriptor != NULL ) {
RtlFreeHeap( RtlProcessHeap(), 0, LocalDescriptor );
}
if ( ClientGroups != NULL ) {
MIDL_user_free( ClientGroups );
}
if ( SubjectOwner != NULL ) {
MIDL_user_free( SubjectOwner );
}
if ( NewAce != NULL ) {
MIDL_user_free( NewAce );
}
if ( NewDacl != NULL ) {
MIDL_user_free( NewDacl );
}
if ( !NT_SUCCESS( NtStatus ) ) {
(*NewDescriptor) = NULL;
(*DescriptorLength) = 0;
}
return( NtStatus );
}
NTSTATUS
SampModifyAccountSecurity(
IN SAMP_OBJECT_TYPE ObjectType,
IN BOOLEAN Admin,
IN PSECURITY_DESCRIPTOR OldDescriptor,
OUT PSECURITY_DESCRIPTOR *NewDescriptor,
OUT PULONG DescriptorLength
)
/*++
Routine Description:
This service modifies a self-relative security descriptor
for a USER or GROUP to add or remove account operator access.
Arguments:
ObjectType - Indicates the type of account for which a new security
descriptor is required. This must be either SampGroupObjectType
or SampUserObjectType.
Admin - if TRUE, indicates the security descriptor will be protecting
an object that is an admin object (e.g., is a member, directly
or indirectly, of the ADMINISTRATORS or an operator alias).
NewDescriptor - Receives a pointer to the new account's self-relative
security descriptor. Be sure to free this descriptor with
MIDL_user_free() when done.
DescriptorLength - Receives the length (in bytes) of the returned
security descriptor
Return Value:
STATUS_SUCCESS - A new security descriptor has been produced.
STATUS_INSUFFICIENT_RESOURCES - Memory could not be allocated to
produce the security descriptor.
--*/
{
SID_IDENTIFIER_AUTHORITY BuiltinAuthority = SECURITY_NT_AUTHORITY;
ULONG AccountSidBuffer[8];
PSID AccountAliasSid = &AccountSidBuffer[0];
NTSTATUS NtStatus = STATUS_SUCCESS;
NTSTATUS IgnoreStatus;
ULONG Length;
ULONG i,j;
ULONG AccountOpAceIndex;
ULONG AceCount;
PACL OldDacl;
PACL NewDacl = NULL;
BOOLEAN DaclDefaulted;
BOOLEAN DaclPresent;
ACL_SIZE_INFORMATION AclSizeInfo;
PACCESS_ALLOWED_ACE Ace;
PGENERIC_MAPPING GenericMapping;
ACCESS_MASK AccountOpAccess;
SECURITY_DESCRIPTOR AbsoluteDescriptor;
PSECURITY_DESCRIPTOR LocalDescriptor = NULL;
GENERIC_MAPPING GroupMap = {GROUP_READ,
GROUP_WRITE,
GROUP_EXECUTE,
GROUP_ALL_ACCESS
};
GENERIC_MAPPING UserMap = {USER_READ,
USER_WRITE,
USER_EXECUTE,
USER_ALL_ACCESS
};
SAMTRACE("SampModifyAccountSecurity");
NtStatus = RtlCopySecurityDescriptor(
OldDescriptor,
&LocalDescriptor
);
if (!NT_SUCCESS(NtStatus)) {
goto Cleanup;
}
//
// Build the SID of the ACCOUNT_OPS alias, so we
// can see if is in the DACL or we can add it to the DACL.
//
RtlInitializeSid(
AccountAliasSid,
&BuiltinAuthority,
2
);
*(RtlSubAuthoritySid( AccountAliasSid, 0 )) =
SECURITY_BUILTIN_DOMAIN_RID;
*(RtlSubAuthoritySid( AccountAliasSid, 1 )) =
DOMAIN_ALIAS_RID_ACCOUNT_OPS;
//
// The approach is to set up an absolute security descriptor that
// contains the new DACL, and then merge that into the existing
// security descriptor.
//
IgnoreStatus = RtlCreateSecurityDescriptor(
&AbsoluteDescriptor,
SECURITY_DESCRIPTOR_REVISION1
);
ASSERT( NT_SUCCESS(IgnoreStatus) );
//
// Figure out the access granted to account operators and the
// generic mask to use.
//
if (ObjectType == SampUserObjectType) {
AccountOpAccess = USER_ALL_ACCESS;
GenericMapping = &UserMap;
} else if (ObjectType == SampGroupObjectType) {
AccountOpAccess = GROUP_ALL_ACCESS;
GenericMapping = &GroupMap;
} else {
//
// This doesn't apply to aliases, domains, or servers.
//
return(STATUS_INVALID_PARAMETER);
}
//
// Get the old DACL off the passed in security descriptor.
//
IgnoreStatus = RtlGetDaclSecurityDescriptor(
OldDescriptor,
&DaclPresent,
&OldDacl,
&DaclDefaulted
);
ASSERT(NT_SUCCESS(IgnoreStatus));
//
// We will only modify the DACL if it is present
//
if (!DaclPresent) {
*NewDescriptor = LocalDescriptor;
*DescriptorLength = RtlLengthSecurityDescriptor(LocalDescriptor);
return(STATUS_SUCCESS);
}
//
// Get the count of ACEs
//
IgnoreStatus = RtlQueryInformationAcl(
OldDacl,
&AclSizeInfo,
sizeof(AclSizeInfo),
AclSizeInformation
);
ASSERT(NT_SUCCESS(IgnoreStatus));
//
// Calculate the lenght of the new ACL.
//
Length = (ULONG)sizeof(ACL);
AccountOpAceIndex = 0xffffffff;
for (i = 0; i < AclSizeInfo.AceCount; i++) {
IgnoreStatus = RtlGetAce(
OldDacl,
i,
(PVOID *) &Ace
);
ASSERT(NT_SUCCESS(IgnoreStatus));
//
// Check if this is an access allowed ACE, and the ACE is for
// the Account Operators alias.
//
if ( (Ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE) &&
RtlEqualSid( AccountAliasSid,
&Ace->SidStart ) ) {
AccountOpAceIndex = i;
continue;
}
Length += Ace->Header.AceSize;
}
if (!Admin) {
//
// If we are making this account not be an admin account and it already
// has an account operator ace, we are done.
//
if ( AccountOpAceIndex != 0xffffffff ) {
*NewDescriptor = LocalDescriptor;
*DescriptorLength = RtlLengthSecurityDescriptor(LocalDescriptor);
return(STATUS_SUCCESS);
} else {
//
// Add the size of an account operator ace to the required length
//
Length += sizeof(ACCESS_ALLOWED_ACE) +
RtlLengthSid(AccountAliasSid) -
sizeof(ULONG);
}
}
NewDacl = RtlAllocateHeap( RtlProcessHeap(), 0, Length );
if (NewDacl == NULL) {
NtStatus = STATUS_INSUFFICIENT_RESOURCES;
goto Cleanup;
}
IgnoreStatus = RtlCreateAcl( NewDacl, Length, ACL_REVISION2);
ASSERT( NT_SUCCESS(IgnoreStatus) );
//
// Add the old ACEs back into this ACL.
//
for (i = 0, j = 0; i < AclSizeInfo.AceCount; i++) {
if (i == AccountOpAceIndex) {
ASSERT(Admin);
continue;
}
//
// Add back in the old ACEs
//
IgnoreStatus = RtlGetAce(
OldDacl,
i,
(PVOID *) &Ace
);
ASSERT(NT_SUCCESS(IgnoreStatus));
IgnoreStatus = RtlAddAce (
NewDacl,
ACL_REVISION2,
j,
Ace,
Ace->Header.AceSize
);
ASSERT( NT_SUCCESS(IgnoreStatus) );
}
//
// If we are making this account not be an administrator, add the
// access allowed ACE for the account operator. This ACE is always
// the second to last one.
//
if (!Admin) {
IgnoreStatus = RtlAddAccessAllowedAce(
NewDacl,
ACL_REVISION2,
AccountOpAccess,
AccountAliasSid
);
ASSERT(NT_SUCCESS(IgnoreStatus));
}
//
// Insert this DACL into the security descriptor.
//
IgnoreStatus = RtlSetDaclSecurityDescriptor (
&AbsoluteDescriptor,
TRUE, // DACL present
NewDacl,
FALSE // DACL not defaulted
);
ASSERT(NT_SUCCESS(IgnoreStatus));
//
// Now call RtlSetSecurityObject to merge the existing security descriptor
// with the new DACL we just created.
//
NtStatus = RtlSetSecurityObject(
DACL_SECURITY_INFORMATION,
&AbsoluteDescriptor,
&LocalDescriptor,
GenericMapping,
NULL
);
if (!NT_SUCCESS(NtStatus)) {
goto Cleanup;
}
*NewDescriptor = LocalDescriptor;
*DescriptorLength = RtlLengthSecurityDescriptor(LocalDescriptor);
LocalDescriptor = NULL;
Cleanup:
if ( NewDacl != NULL ) {
RtlFreeHeap(RtlProcessHeap(),0, NewDacl );
}
if (LocalDescriptor != NULL) {
RtlDeleteSecurityObject(&LocalDescriptor);
}
return( NtStatus );
}
NTSTATUS
SampGetObjectSD(
IN PSAMP_OBJECT Context,
OUT PULONG SecurityDescriptorLength,
OUT PSECURITY_DESCRIPTOR *SecurityDescriptor
)
/*++
Routine Description:
This retrieves a security descriptor from a SAM object's backing store.
Arguments:
Context - The object to which access is being requested.
SecurityDescriptorLength - Receives the length of the security descriptor.
SecurityDescriptor - Receives a pointer to the security descriptor.
Return Value:
STATUS_SUCCESS - The security descriptor has been retrieved.
STATUS_INTERNAL_DB_CORRUPTION - The object does not have a security descriptor.
This is bad.
STATUS_INSUFFICIENT_RESOURCES - Memory could not be allocated to retrieve the
security descriptor.
STATUS_UNKNOWN_REVISION - The security descriptor retrieved is no one known by
this revision of SAM.
--*/
{
NTSTATUS NtStatus;
ULONG Revision;
SAMTRACE("SampGetObjectSD");
(*SecurityDescriptorLength) = 0;
NtStatus = SampGetAccessAttribute(
Context,
SAMP_OBJECT_SECURITY_DESCRIPTOR,
TRUE, // Make copy
&Revision,
SecurityDescriptor
);
if (NT_SUCCESS(NtStatus)) {
if ( ((Revision && 0xFFFF0000) > SAMP_MAJOR_REVISION) ||
(Revision > SAMP_REVISION) ) {
NtStatus = STATUS_UNKNOWN_REVISION;
}
if (!NT_SUCCESS(NtStatus)) {
MIDL_user_free( (*SecurityDescriptor) );
}
}
if (NT_SUCCESS(NtStatus)) {
*SecurityDescriptorLength = RtlLengthSecurityDescriptor(
(*SecurityDescriptor) );
}
return(NtStatus);
}
NTSTATUS
SamrSetSecurityObject(
IN SAMPR_HANDLE ObjectHandle,
IN SECURITY_INFORMATION SecurityInformation,
IN PSAMPR_SR_SECURITY_DESCRIPTOR SecurityDescriptor
)
/*++
Routine Description:
This function (SamrSetSecurityObject) takes a well formed Security
Descriptor provided by the caller and assigns specified portions of
it to an object. Based on the flags set in the SecurityInformation
parameter and the caller's access rights, this procedure will
replace any or all of the security information associated with an
object.
This is the only function available to users and applications for
changing security information, including the owner ID, group ID, and
the discretionary and system ACLs of an object. The caller must
have WRITE_OWNER access to the object to change the owner or primary
group of the object. The caller must have WRITE_DAC access to the
object to change the discretionary ACL. The caller must have
ACCESS_SYSTEM_SECURITY access to an object to assign a system ACL
to the object.
This API is modelled after the NtSetSecurityObject() system service.
Parameters:
ObjectHandle - A handle to an existing object.
SecurityInformation - Indicates which security information is to
be applied to the object. The value(s) to be assigned are
passed in the SecurityDescriptor parameter.
SecurityDescriptor - A pointer to a well formed self-relative Security
Descriptor and corresponding length.
Return Values:
STATUS_SUCCESS - normal, successful completion.
STATUS_ACCESS_DENIED - The specified handle was not opened for
either WRITE_OWNER, WRITE_DAC, or ACCESS_SYSTEM_SECURITY
access.
STATUS_INVALID_HANDLE - The specified handle is not that of an
opened SAM object.
STATUS_BAD_DESCRIPTOR_FORMAT - Indicates something about security descriptor
is not valid. This may indicate that the structure of the descriptor is
not valid or that a component of the descriptor specified via the
SecurityInformation parameter is not present in the security descriptor.
STATUS_INVALID_PARAMETER - Indicates no security information was specified.
STATUS_LAST_ADMIN - Indicates the new SD could potentially lead
to the administrator account being unusable and therefore
the new protection is being rejected.
--*/
{
NTSTATUS NtStatus, IgnoreStatus, TmpStatus;
PSAMP_OBJECT Context;
SAMP_OBJECT_TYPE FoundType;
SECURITY_DB_OBJECT_TYPE SecurityDbObjectType;
ACCESS_MASK DesiredAccess;
PSECURITY_DESCRIPTOR RetrieveSD, SetSD;
PISECURITY_DESCRIPTOR PassedSD;
ULONG RetrieveSDLength;
ULONG ObjectRid;
ULONG SecurityDescriptorIndex;
HANDLE ClientToken;
BOOLEAN NotificationType = TRUE;
SAMTRACE("SamrSetSecurityObject");
//
// Make sure we understand what RPC is doing for (to) us.
//
if (SecurityDescriptor == NULL) {
return(STATUS_BAD_DESCRIPTOR_FORMAT);
}
if (SecurityDescriptor->SecurityDescriptor == NULL) {
return(STATUS_BAD_DESCRIPTOR_FORMAT);
}
PassedSD = (PISECURITY_DESCRIPTOR)(SecurityDescriptor->SecurityDescriptor);
//
// Validate the passed security descriptor
//
NtStatus = SampValidatePassedSD( SecurityDescriptor->Length, PassedSD );
if (!NT_SUCCESS(NtStatus)) {
return(NtStatus);
}
//
// Set the desired access based upon the specified SecurityInformation
//
DesiredAccess = 0;
if ( SecurityInformation & SACL_SECURITY_INFORMATION) {
DesiredAccess |= ACCESS_SYSTEM_SECURITY;
}
if ( SecurityInformation & (OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION)) {
DesiredAccess |= WRITE_OWNER;
}
if ( SecurityInformation & DACL_SECURITY_INFORMATION ) {
DesiredAccess |= WRITE_DAC;
}
//
// If no information was specified, then return invalid parameter.
//
if (DesiredAccess == 0) {
return(STATUS_INVALID_PARAMETER);
}
//
// Make sure the specified fields are present in the provided security descriptor.
// You can't screw up an SACL or DACL, but you can screw up an owner or group.
// Security descriptors must have owner and group fields.
//
if ( (SecurityInformation & OWNER_SECURITY_INFORMATION) ) {
if (PassedSD->Owner == NULL) {
return(STATUS_BAD_DESCRIPTOR_FORMAT);
}
}
if ( (SecurityInformation & GROUP_SECURITY_INFORMATION) ) {
if (PassedSD->Group == NULL) {
return(STATUS_BAD_DESCRIPTOR_FORMAT);
}
}
//
// See if the handle is valid and opened for the requested access
//
NtStatus = SampAcquireWriteLock();
if (!NT_SUCCESS(NtStatus)) {
return(NtStatus);
}
Context = (PSAMP_OBJECT)ObjectHandle;
NtStatus = SampLookupContext(
Context,
DesiredAccess,
SampUnknownObjectType, // ExpectedType
&FoundType
);
switch ( FoundType ) {
case SampServerObjectType: {
SecurityDescriptorIndex = SAMP_SERVER_SECURITY_DESCRIPTOR;
ObjectRid = 0L;
NotificationType = FALSE;
break;
}
case SampDomainObjectType: {
//
// BUGBUG Bug #4388 - allow account operators to access pre-340
// databases
//
// This fix should NEVER be checked in. It is for one-time
// internal use only.
//
// Pre-340 databases had security descriptors on the domain
// objects that didn't allow account operators to operate on
// accounts. Replicating one of these old databases to a
// newer release copies the bad security descriptors. To avoid
// this, do the following ONE TIME only:
//
// Uncomment the code immediately below. Build a new
// SAMSRV.DLL. Put it on a BDC running the target version
// of the system. Replicate the pre-340 database from the
// PDC (which may be running a more recent version of the
// system, but still has the bad pre-340 descriptors from
// earlier replications).
//
// That's it; you've got a fixed database that can be safely
// replicated in the future. Get rid of this temporary code.
// (And put the real SAMSRV.DLL back on the BDC).
//
// IgnoreStatus = SampDeReferenceContext( Context, FALSE );
// IgnoreStatus = SampReleaseWriteLock( FALSE );
// return( STATUS_SUCCESS );
//
SecurityDbObjectType = SecurityDbObjectSamDomain;
SecurityDescriptorIndex = SAMP_DOMAIN_SECURITY_DESCRIPTOR;
ObjectRid = 0L;
break;
}
case SampUserObjectType: {
SecurityDbObjectType = SecurityDbObjectSamUser;
SecurityDescriptorIndex = SAMP_USER_SECURITY_DESCRIPTOR;
ObjectRid = Context->TypeBody.User.Rid;
break;
}
case SampGroupObjectType: {
SecurityDbObjectType = SecurityDbObjectSamGroup;
SecurityDescriptorIndex = SAMP_GROUP_SECURITY_DESCRIPTOR;
ObjectRid = Context->TypeBody.Group.Rid;
break;
}
case SampAliasObjectType: {
SecurityDbObjectType = SecurityDbObjectSamAlias;
SecurityDescriptorIndex = SAMP_ALIAS_SECURITY_DESCRIPTOR;
ObjectRid = Context->TypeBody.Alias.Rid;
break;
}
default: {
NotificationType = FALSE;
}
}
if (NT_SUCCESS(NtStatus)) {
//
// Get the security descriptor
//
RetrieveSD = NULL;
RetrieveSDLength = 0;
NtStatus = SampGetObjectSD( Context, &RetrieveSDLength, &RetrieveSD);
//
// Make sure the descriptor does not break any Administrator
// restrictions.
//
NtStatus = SampCheckForDescriptorRestrictions( Context,
FoundType,
ObjectRid,
PassedSD );
if (NT_SUCCESS(NtStatus)) {
//
// copy the retrieved descriptor into process heap so we can use RTL routines.
//
SetSD = NULL;
if (NT_SUCCESS(NtStatus)) {
SetSD = RtlAllocateHeap( RtlProcessHeap(), 0, RetrieveSDLength );
if ( SetSD == NULL) {
NtStatus = STATUS_INSUFFICIENT_RESOURCES;
} else {
RtlCopyMemory( SetSD, RetrieveSD, RetrieveSDLength );
}
}
if (NT_SUCCESS(NtStatus)) {
//
// if the caller is replacing the owner and he is not
// trusted, then a handle to the impersonation token is
// necessary. If the caller is trusted then take process
// token.
//
ClientToken = 0;
if ( (SecurityInformation & OWNER_SECURITY_INFORMATION) ) {
if(!Context->TrustedClient) {
NtStatus = I_RpcMapWin32Status(RpcImpersonateClient( NULL ));
if (NT_SUCCESS(NtStatus)) {
NtStatus = NtOpenThreadToken(
NtCurrentThread(),
TOKEN_QUERY,
TRUE, //OpenAsSelf
&ClientToken
);
ASSERT( (ClientToken == 0) || NT_SUCCESS(NtStatus) );
//
// Stop impersonating the client
//
IgnoreStatus = I_RpcMapWin32Status(RpcRevertToSelf());
ASSERT( NT_SUCCESS(IgnoreStatus) );
}
}
else {
//
// trusted client
//
NtStatus = NtOpenProcessToken(
NtCurrentProcess(),
TOKEN_QUERY,
&ClientToken );
ASSERT( (ClientToken == 0) || NT_SUCCESS(NtStatus) );
}
}
if (NT_SUCCESS(NtStatus)) {
//
// Build the replacement security descriptor.
// This must be done in process heap to satisfy the needs of the RTL
// routine.
//
NtStatus = RtlSetSecurityObject(
SecurityInformation,
PassedSD,
&SetSD,
&SampObjectInformation[FoundType].GenericMapping,
ClientToken
);
if (ClientToken != 0) {
IgnoreStatus = NtClose( ClientToken );
ASSERT(NT_SUCCESS(IgnoreStatus));
}
if (NT_SUCCESS(NtStatus)) {
//
// Apply the security descriptor back onto the object.
//
NtStatus = SampSetAccessAttribute(
Context,
SecurityDescriptorIndex,
SetSD,
RtlLengthSecurityDescriptor(SetSD)
);
}
}
}
//
// Free up allocated memory
//
if (RetrieveSD != NULL) {
MIDL_user_free( RetrieveSD );
}
if (SetSD != NULL) {
RtlFreeHeap( RtlProcessHeap(), 0, SetSD );
}
//
// De-reference the object
//
if ( NT_SUCCESS( NtStatus ) ) {
NtStatus = SampDeReferenceContext( Context, TRUE );
} else {
IgnoreStatus = SampDeReferenceContext( Context, FALSE );
}
}
} //end_if
//
// Commit the changes to disk.
//
if ( NT_SUCCESS( NtStatus ) ) {
NtStatus = SampCommitAndRetainWriteLock();
if ( NotificationType && NT_SUCCESS( NtStatus ) ) {
SampNotifyNetlogonOfDelta(
SecurityDbChange,
SecurityDbObjectType,
ObjectRid,
(PUNICODE_STRING) NULL,
(DWORD) FALSE, // Replicate immediately
NULL // Delta data
);
}
}
//
// Release lock and propagate errors
//
TmpStatus = SampReleaseWriteLock( FALSE );
if (NT_SUCCESS(NtStatus)) {
NtStatus = TmpStatus;
}
return(NtStatus);
}
NTSTATUS
SampValidatePassedSD(
IN ULONG Length,
IN PISECURITY_DESCRIPTOR PassedSD
)
/*++
Routine Description:
This routine validates that a passed security descriptor is valid and does
not extend beyond its expressed length.
Parameters:
Length - The length of the security descriptor. This should be what RPC
used to allocate memory to receive the security descriptor.
PassedSD - Points to the security descriptor to inspect.
Return Values:
STATUS_SUCCESS - The security descriptor is valid.
STATUS_BAD_DESCRIPTOR_FORMAT - Something was wrong with the security
descriptor. It might have extended beyond its limits or had an
invalid component.
--*/
{
NTSTATUS NtStatus;
PACL Acl;
PSID Sid;
PUCHAR SDEnd;
BOOLEAN Present, IgnoreBoolean;
SAMTRACE("SampValidatePassedSD");
if (Length < SECURITY_DESCRIPTOR_MIN_LENGTH) {
return(STATUS_BAD_DESCRIPTOR_FORMAT);
}
SDEnd = (PUCHAR)PassedSD + Length;
try {
//
// Make sure the DACL is within the SD
//
NtStatus = RtlGetDaclSecurityDescriptor(
(PSECURITY_DESCRIPTOR)PassedSD,
&Present,
&Acl,
&IgnoreBoolean
);
if (!NT_SUCCESS(NtStatus)) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
if (Present) {
if (Acl != NULL) {
//
// Make sure the ACl header is in the buffer.
//
if ( (((PUCHAR)Acl)+sizeof(ACL) > SDEnd) ||
(((PUCHAR)Acl) < (PUCHAR)PassedSD) ) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
//
// Make sure the rest of the ACL is within the buffer
//
if ( ((PUCHAR)Acl)+Acl->AclSize > SDEnd) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
//
// Make sure the rest of the ACL is valid
//
if (!RtlValidAcl( Acl )) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
}
}
//
// Make sure the SACL is within the SD
//
NtStatus = RtlGetSaclSecurityDescriptor(
(PSECURITY_DESCRIPTOR)PassedSD,
&Present,
&Acl,
&IgnoreBoolean
);
if (!NT_SUCCESS(NtStatus)) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
if (Present) {
if (Acl != NULL) {
//
// Make sure the ACl header is in the buffer.
//
if ( (((PUCHAR)Acl)+sizeof(ACL) > SDEnd) ||
(((PUCHAR)Acl) < (PUCHAR)PassedSD) ) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
//
// Make sure the rest of the ACL is within the buffer
//
if ( ((PUCHAR)Acl)+Acl->AclSize > SDEnd) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
//
// Make sure the rest of the ACL is valid
//
if (!RtlValidAcl( Acl )) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
}
}
//
// Make sure the Owner SID is within the SD
//
NtStatus = RtlGetOwnerSecurityDescriptor(
(PSECURITY_DESCRIPTOR)PassedSD,
&Sid,
&IgnoreBoolean
);
if (!NT_SUCCESS(NtStatus)) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
if (Sid != NULL) {
//
// Make sure the SID header is in the SD
//
if ( (((PUCHAR)Sid)+sizeof(SID)-(ANYSIZE_ARRAY*sizeof(ULONG)) > SDEnd) ||
(((PUCHAR)Sid) < (PUCHAR)PassedSD) ) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
//
// Make sure there aren't too many sub-authorities
//
if (((PISID)Sid)->SubAuthorityCount > SID_MAX_SUB_AUTHORITIES) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
//
// Make sure the rest of the SID is within the SD
//
if ( ((PUCHAR)Sid)+RtlLengthSid(Sid) > SDEnd) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
}
//
// Make sure the Group SID is within the SD
//
NtStatus = RtlGetGroupSecurityDescriptor(
(PSECURITY_DESCRIPTOR)PassedSD,
&Sid,
&IgnoreBoolean
);
if (!NT_SUCCESS(NtStatus)) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
if (Sid != NULL) {
//
// Make sure the SID header is in the SD
//
if ( (((PUCHAR)Sid)+sizeof(SID)-(ANYSIZE_ARRAY*sizeof(ULONG)) > SDEnd) ||
(((PUCHAR)Sid) < (PUCHAR)PassedSD) ) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
//
// Make sure there aren't too many sub-authorities
//
if (((PISID)Sid)->SubAuthorityCount > SID_MAX_SUB_AUTHORITIES) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
//
// Make sure the rest of the SID is within the SD
//
if ( ((PUCHAR)Sid)+RtlLengthSid(Sid) > SDEnd) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
}
}
} except(EXCEPTION_EXECUTE_HANDLER) {
return( STATUS_BAD_DESCRIPTOR_FORMAT );
} // end_try
return(STATUS_SUCCESS);
}
NTSTATUS
SampCheckForDescriptorRestrictions(
IN PSAMP_OBJECT Context,
IN SAMP_OBJECT_TYPE ObjectType,
IN ULONG ObjectRid,
IN PISECURITY_DESCRIPTOR PassedSD
)
/*++
Routine Description:
This function ensures that the passed security descriptor,
which is being applied to an object of type 'FoundType' with
a Rid of value 'ObjectRid', does not violate any policies.
For example, you can not set protection on the Administrator
user account such that the administrator is unable to change
her password.
Parameters:
Context - The caller's context. This is used to determine
whether the caller is trusted or not. If the caller is
trusted, then there are no restrictions.
ObjectType - The type of object the new security descriptor
is being applied to.
ObjectRid - The RID of the object the new security descriptor
is being applied to.
PassedSD - The security descriptor passed by the client.
Return Values:
STATUS_SUCCESS - normal, successful completion.
STATUS_LAST_ADMIN - Indicates the new SD could potentially lead
to the administrator account being unusable and therefore
the new protection is being rejected.
--*/
{
NTSTATUS
NtStatus;
BOOLEAN
DaclPresent,
AdminSid,
Done,
IgnoreBoolean;
PACL
Dacl;
ACL_SIZE_INFORMATION
DaclInfo;
PACCESS_ALLOWED_ACE
Ace;
ACCESS_MASK
Accesses,
Remaining;
ULONG
AceIndex;
GENERIC_MAPPING
UserMap = {USER_READ,
USER_WRITE,
USER_EXECUTE,
USER_ALL_ACCESS};
SAMTRACE("SampCheckForDescriptorRestrictions");
//
// No checking for trusted client operations
//
if (Context->TrustedClient) {
return(STATUS_SUCCESS);
}
NtStatus = RtlGetDaclSecurityDescriptor ( (PSECURITY_DESCRIPTOR)PassedSD,
&DaclPresent,
&Dacl,
&IgnoreBoolean //DaclDefaulted
);
ASSERT(NT_SUCCESS(NtStatus));
if (!DaclPresent) {
//
// Not replacing the DACL
//
return(STATUS_SUCCESS);
}
if (Dacl == NULL) {
//
// Assigning "World all access"
//
return(STATUS_SUCCESS);
}
if (!RtlValidAcl(Dacl)) {
return(STATUS_INVALID_ACL);
}
NtStatus = RtlQueryInformationAcl ( Dacl,
&DaclInfo,
sizeof(ACL_SIZE_INFORMATION),
AclSizeInformation
);
ASSERT(NT_SUCCESS(NtStatus));
//
// Enforce Administrator user policies
//
NtStatus = STATUS_SUCCESS;
if (ObjectRid == DOMAIN_USER_RID_ADMIN) {
ASSERT(ObjectType == SampUserObjectType);
//
// For the administrator account, the ACL must grant
// these accesses:
//
Remaining = USER_READ_GENERAL |
USER_READ_PREFERENCES |
USER_WRITE_PREFERENCES |
USER_READ_LOGON |
USER_READ_ACCOUNT |
USER_WRITE_ACCOUNT |
USER_CHANGE_PASSWORD |
USER_FORCE_PASSWORD_CHANGE |
USER_LIST_GROUPS |
USER_READ_GROUP_INFORMATION |
USER_WRITE_GROUP_INFORMATION;
//
// to these SIDs:
//
// <domain>\Administrator
// <builtin>\Administrators
//
// It doesn't matter which accesses are granted to which SIDs,
// as long as collectively all the accesses are granted.
//
//
// Walk the ACEs collecting accesses that are granted to these
// SIDs. Make sure there are no DENYs that prevent them from
// being granted.
//
Done = FALSE;
for ( AceIndex=0;
(AceIndex < DaclInfo.AceCount) && !Done;
AceIndex++) {
NtStatus = RtlGetAce ( Dacl, AceIndex, &((PVOID)Ace) );
//
// Don't do anything with inherit-only ACEs
//
if ((Ace->Header.AceFlags & INHERIT_ONLY_ACE) == 0) {
//
// Note that we expect ACCESS_ALLOWED_ACE and ACCESS_DENIED_ACE
// to be identical structures in the following switch statement.
//
switch (Ace->Header.AceType) {
case ACCESS_ALLOWED_ACE_TYPE:
case ACCESS_DENIED_ACE_TYPE:
{
//
// Is this an interesting SID
//
AdminSid =
RtlEqualSid( ((PSID)(&Ace->SidStart)),
SampAdministratorUserSid)
||
RtlEqualSid( ((PSID)(&Ace->SidStart)),
SampAdministratorsAliasSid);
if (AdminSid) {
//
// Map the accesses granted or denied
//
Accesses = Ace->Mask;
RtlMapGenericMask( &Accesses, &UserMap );
if (Ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE) {
Remaining &= ~Accesses;
if (Remaining == 0) {
//
// All necessary accesses granted
//
Done = TRUE;
}
} else {
ASSERT(Ace->Header.AceType == ACCESS_DENIED_ACE_TYPE);
if (Remaining & Accesses) {
//
// We've just been denied some necessary
// accesses that haven't yet been granted.
//
Done = TRUE;
}
}
}
break;
}
default:
break;
} // end_switch
if (Done) {
break;
}
}
} // end_for
if (Remaining != 0) {
NtStatus = STATUS_LAST_ADMIN;
}
} // end_if (Administrator Account)
return(NtStatus);
}
NTSTATUS
SamrQuerySecurityObject(
IN SAMPR_HANDLE ObjectHandle,
IN SECURITY_INFORMATION SecurityInformation,
OUT PSAMPR_SR_SECURITY_DESCRIPTOR *SecurityDescriptor
)
/*++
Routine Description:
This function (SamrQuerySecurityObject) returns to the caller requested
security information currently assigned to an object.
Based on the caller's access rights this procedure
will return a security descriptor containing any or all of the
object's owner ID, group ID, discretionary ACL or system ACL. To
read the owner ID, group ID, or the discretionary ACL the caller
must be granted READ_CONTROL access to the object. To read the
system ACL the caller must be granted ACCESS_SYSTEM_SECURITY
access.
This API is modelled after the NtQuerySecurityObject() system
service.
Parameters:
ObjectHandle - A handle to an existing object.
SecurityInformation - Supplies a value describing which pieces of
security information are being queried.
SecurityDescriptor - Provides a pointer to a structure to be filled
in with a security descriptor containing the requested security
information. This information is returned in the form of a
self-relative security descriptor.
Return Values:
STATUS_SUCCESS - normal, successful completion.
STATUS_ACCESS_DENIED - The specified handle was not opened for
either READ_CONTROL or ACCESS_SYSTEM_SECURITY
access.
STATUS_INVALID_HANDLE - The specified handle is not that of an
opened SAM object.
--*/
{
NTSTATUS NtStatus, IgnoreStatus;
PSAMP_OBJECT Context;
SAMP_OBJECT_TYPE FoundType;
ACCESS_MASK DesiredAccess;
PSAMPR_SR_SECURITY_DESCRIPTOR RpcSD;
PSECURITY_DESCRIPTOR RetrieveSD, ReturnSD;
ULONG RetrieveSDLength, ReturnSDLength;
SAMTRACE("SamrQuerySecurityObject");
ReturnSD = NULL;
//
// Make sure we understand what RPC is doing for (to) us.
//
ASSERT (*SecurityDescriptor == NULL);
//
// Set the desired access based upon the requested SecurityInformation
//
DesiredAccess = 0;
if ( SecurityInformation & SACL_SECURITY_INFORMATION) {
DesiredAccess |= ACCESS_SYSTEM_SECURITY;
}
if ( SecurityInformation & (DACL_SECURITY_INFORMATION |
OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION)
) {
DesiredAccess |= READ_CONTROL;
}
//
// Allocate the first block of returned memory
//
RpcSD = MIDL_user_allocate( sizeof(SAMPR_SR_SECURITY_DESCRIPTOR) );
if (RpcSD == NULL) {
return(STATUS_INSUFFICIENT_RESOURCES);
}
RpcSD->Length = 0;
RpcSD->SecurityDescriptor = NULL;
//
// See if the handle is valid and opened for the requested access
//
SampAcquireReadLock();
Context = (PSAMP_OBJECT)ObjectHandle;
NtStatus = SampLookupContext(
Context,
DesiredAccess,
SampUnknownObjectType, // ExpectedType
&FoundType
);
if (NT_SUCCESS(NtStatus)) {
//
// Get the security descriptor
//
RetrieveSDLength = 0;
NtStatus = SampGetObjectSD( Context, &RetrieveSDLength, &RetrieveSD);
if (NT_SUCCESS(NtStatus)) {
//
// blank out the parts that aren't to be returned
//
if ( !(SecurityInformation & SACL_SECURITY_INFORMATION) ) {
((PISECURITY_DESCRIPTOR)RetrieveSD)->Control &= ~SE_SACL_PRESENT;
}
if ( !(SecurityInformation & DACL_SECURITY_INFORMATION) ) {
((PISECURITY_DESCRIPTOR)RetrieveSD)->Control &= ~SE_DACL_PRESENT;
}
if ( !(SecurityInformation & OWNER_SECURITY_INFORMATION) ) {
((PISECURITY_DESCRIPTOR)RetrieveSD)->Owner = NULL;
}
if ( !(SecurityInformation & GROUP_SECURITY_INFORMATION) ) {
((PISECURITY_DESCRIPTOR)RetrieveSD)->Group = NULL;
}
//
// Determine how much memory is needed for a self-relative
// security descriptor containing just this information.
//
ReturnSDLength = 0;
NtStatus = RtlMakeSelfRelativeSD(
RetrieveSD,
NULL,
&ReturnSDLength
);
ASSERT(!NT_SUCCESS(NtStatus));
if (NtStatus == STATUS_BUFFER_TOO_SMALL) {
ReturnSD = MIDL_user_allocate( ReturnSDLength );
if (ReturnSD == NULL) {
NtStatus = STATUS_INSUFFICIENT_RESOURCES;
} else {
//
// make an appropriate self-relative security descriptor
//
NtStatus = RtlMakeSelfRelativeSD(
RetrieveSD,
ReturnSD,
&ReturnSDLength
);
}
}
//
// Free up the retrieved SD
//
MIDL_user_free( RetrieveSD );
}
//
// De-reference the object
//
IgnoreStatus = SampDeReferenceContext( Context, FALSE );
}
//
// Free the read lock
//
SampReleaseReadLock();
//
// If we succeeded, set up the return buffer.
// Otherwise, free any allocated memory.
//
if (NT_SUCCESS(NtStatus)) {
RpcSD->Length = ReturnSDLength;
RpcSD->SecurityDescriptor = (PUCHAR)ReturnSD;
(*SecurityDescriptor) = RpcSD;
} else {
MIDL_user_free( RpcSD );
if (ReturnSD != NULL) {
MIDL_user_free(ReturnSD);
}
(*SecurityDescriptor) = NULL;
}
return(NtStatus);
}
Reference in New Issue Copy Permalink