able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/base/screg/sc/server/scsec.cxx

1755 lines
47 KiB
C++
Raw Permalink Normal View History

Add source files
2020-09-26 03:20:57 -05:00
/*++
Copyright (c) 1992 Microsoft Corporation
Module Name:
scsec.cxx
Abstract:
This module contains security related routines:
RQueryServiceObjectSecurity
RSetServiceObjectSecurity
ScCreateScManagerObject
ScCreateScServiceObject
ScGrantAccess
ScPrivilegeCheckAndAudit
ScAccessValidate
ScAccessCheckAndAudit
ScGetPrivilege
ScReleasePrivilege
Author:
Rita Wong (ritaw) 10-Mar-1992
Environment:
Calls NT native APIs.
Revision History:
10-Mar-1992 ritaw
created
16-Apr-1992 JohnRo
Process services which are marked for delete accordingly.
06-Aug-1992 Danl
Fixed a debug print statement. It indicated it was from the
ScLoadDeviceDriver function - rather than in ScGetPrivilege.
21-Jan-1995 AnirudhS
Added ScGrantAccess and ScPrivilegeCheckAndAudit.
--*/
#include "precomp.hxx"
#include "scconfig.h" // ScOpenServiceConfigKey
#include "scsec.h" // Object names and security functions
#include "control.h" // SERVICE_SET_STATUS
#include "account.h" // ScLookupServiceAccount
#include "align.h" // ROUND_UP_COUNT
#define PRIVILEGE_BUF_SIZE 512
//-------------------------------------------------------------------//
// //
// Static global variables //
// //
//-------------------------------------------------------------------//
//
// Security descriptor of the SCManager objects to control user accesses
// to the Service Control Manager and its database.
//
PSECURITY_DESCRIPTOR ScManagerSd;
//
// Structure that describes the mapping of Generic access rights to
// object specific access rights for the ScManager object.
//
GENERIC_MAPPING ScManagerObjectMapping = {
STANDARD_RIGHTS_READ | // Generic read
SC_MANAGER_ENUMERATE_SERVICE |
SC_MANAGER_QUERY_LOCK_STATUS,
STANDARD_RIGHTS_WRITE | // Generic write
SC_MANAGER_CREATE_SERVICE |
SC_MANAGER_MODIFY_BOOT_CONFIG,
STANDARD_RIGHTS_EXECUTE | // Generic execute
SC_MANAGER_CONNECT |
SC_MANAGER_LOCK,
SC_MANAGER_ALL_ACCESS // Generic all
};
//
// Structure that describes the mapping of generic access rights to
// object specific access rights for the Service object.
//
GENERIC_MAPPING ScServiceObjectMapping = {
STANDARD_RIGHTS_READ | // Generic read
SERVICE_QUERY_CONFIG |
SERVICE_QUERY_STATUS |
SERVICE_ENUMERATE_DEPENDENTS |
SERVICE_INTERROGATE,
STANDARD_RIGHTS_WRITE | // Generic write
SERVICE_CHANGE_CONFIG,
STANDARD_RIGHTS_EXECUTE | // Generic execute
SERVICE_START |
SERVICE_STOP |
SERVICE_PAUSE_CONTINUE |
SERVICE_USER_DEFINED_CONTROL,
SERVICE_ALL_ACCESS // Generic all
};
//-------------------------------------------------------------------//
// //
// Functions //
// //
//-------------------------------------------------------------------//
DWORD
RQueryServiceObjectSecurity(
IN SC_RPC_HANDLE hService,
IN SECURITY_INFORMATION dwSecurityInformation,
OUT LPBYTE lpSecurityDescriptor,
IN DWORD cbBufSize,
OUT LPDWORD pcbBytesNeeded
)
/*++
Routine Description:
This is the worker function for QueryServiceObjectSecurity API.
It returns the security descriptor information of a service
object.
Arguments:
hService - Supplies the context handle to an existing service object.
dwSecurityInformation - Supplies the bitwise flags describing the
security information being queried.
lpSecurityInformation - Supplies the output buffer from the user
which security descriptor information will be written to on
return.
cbBufSize - Supplies the size of lpSecurityInformation buffer.
pcbBytesNeeded - Returns the number of bytes needed of the
lpSecurityInformation buffer to get all the requested
information.
Return Value:
NO_ERROR - The operation was successful.
ERROR_INVALID_HANDLE - The specified handle was invalid.
ERROR_ACCESS_DENIED - The specified handle was not opened for
either READ_CONTROL or ACCESS_SYSTEM_SECURITY
access.
ERROR_INVALID_PARAMETER - The dwSecurityInformation parameter is
invalid.
ERROR_INSUFFICIENT_BUFFER - The specified output buffer is smaller
than the required size returned in pcbBytesNeeded. None of
the security descriptor is returned.
Note:
It is expected that the RPC Stub functions will find the following
parameter problems:
Bad pointers for lpSecurityDescriptor, and pcbBytesNeeded.
--*/
{
NTSTATUS ntstatus;
ACCESS_MASK DesiredAccess = 0;
PSECURITY_DESCRIPTOR ServiceSd;
DWORD ServiceSdSize = 0;
//
// Check the handle.
//
if (!ScIsValidServiceHandle(hService))
{
return ERROR_INVALID_HANDLE;
}
//
// Check the validity of dwSecurityInformation
//
if ((dwSecurityInformation == 0) ||
((dwSecurityInformation &
(OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION |
DACL_SECURITY_INFORMATION |
SACL_SECURITY_INFORMATION)) != dwSecurityInformation))
{
return ERROR_INVALID_PARAMETER;
}
//
// Set the desired access based on the requested SecurityInformation
//
if (dwSecurityInformation & SACL_SECURITY_INFORMATION) {
DesiredAccess |= ACCESS_SYSTEM_SECURITY;
}
if (dwSecurityInformation & (DACL_SECURITY_INFORMATION |
OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION)) {
DesiredAccess |= READ_CONTROL;
}
//
// Was the handle opened for the requested access?
//
if (! RtlAreAllAccessesGranted(
((LPSC_HANDLE_STRUCT)hService)->AccessGranted,
DesiredAccess
)) {
return ERROR_ACCESS_DENIED;
}
//
//
RtlZeroMemory(lpSecurityDescriptor, cbBufSize);
//
// Get the database lock for reading
//
CServiceRecordSharedLock RLock;
//
// The most up-to-date service security descriptor is always kept in
// the service record.
//
ServiceSd =
((LPSC_HANDLE_STRUCT)hService)->Type.ScServiceObject.ServiceRecord->ServiceSd;
//
// Retrieve the appropriate security information from ServiceSd
// and place it in the user supplied buffer.
//
ntstatus = RtlQuerySecurityObject(
ServiceSd,
dwSecurityInformation,
(PSECURITY_DESCRIPTOR) lpSecurityDescriptor,
cbBufSize,
&ServiceSdSize
);
if (! NT_SUCCESS(ntstatus)) {
if (ntstatus == STATUS_BAD_DESCRIPTOR_FORMAT) {
//
// Internal error: our security descriptor is bad!
//
SC_LOG0(ERROR,
"RQueryServiceObjectSecurity: Our security descriptor is bad!\n");
ASSERT(FALSE);
return ERROR_GEN_FAILURE;
}
else if (ntstatus == STATUS_BUFFER_TOO_SMALL) {
//
// Return the required size to the user
//
*pcbBytesNeeded = ServiceSdSize;
return ERROR_INSUFFICIENT_BUFFER;
}
else {
return RtlNtStatusToDosError(ntstatus);
}
}
//
// Return the required size to the user
//
*pcbBytesNeeded = ServiceSdSize;
return NO_ERROR;
}
DWORD
RSetServiceObjectSecurity(
IN SC_RPC_HANDLE hService,
IN SECURITY_INFORMATION dwSecurityInformation,
IN LPBYTE lpSecurityDescriptor,
IN DWORD cbBufSize
)
/*++
Routine Description:
This is the worker function for SetServiceObjectSecurity API.
It modifies the security descriptor information of a service
object.
Arguments:
hService - Supplies the context handle to the service.
dwSecurityInformation - Supplies the bitwise flags of security
information being queried.
lpSecurityInformation - Supplies a buffer which contains a
well-formed self-relative security descriptor.
cbBufSize - Supplies the size of lpSecurityInformation buffer.
Return Value:
NO_ERROR - The operation was successful.
ERROR_INVALID_HANDLE - The specified handle was invalid.
ERROR_ACCESS_DENIED - The specified handle was not opened for
either WRITE_OWNER, WRITE_DAC, or ACCESS_SYSTEM_SECURITY
access.
ERROR_INVALID_PARAMETER - The lpSecurityDescriptor or dwSecurityInformation
parameter is invalid.
Note:
It is expected that the RPC Stub functions will find the following
parameter problems:
Bad pointers for lpSecurityDescriptor.
--*/
{
DWORD status;
NTSTATUS ntstatus;
RPC_STATUS rpcstatus;
ACCESS_MASK DesiredAccess = 0;
LPSERVICE_RECORD serviceRecord;
HANDLE ClientTokenHandle = NULL;
LPBYTE lpTempSD = lpSecurityDescriptor;
UNREFERENCED_PARAMETER(cbBufSize); // for RPC marshalling code
//
// Check the handle.
//
if (!ScIsValidServiceHandle(hService))
{
return ERROR_INVALID_HANDLE;
}
//
// Silently ignore flags we don't understand that may come
// from higher-level object managers.
//
dwSecurityInformation &= (OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION |
DACL_SECURITY_INFORMATION |
SACL_SECURITY_INFORMATION);
if (dwSecurityInformation == 0)
{
return NO_ERROR;
}
#ifdef _WIN64
if (PtrToUlong(lpSecurityDescriptor) & (sizeof(PVOID) - 1))
{
//
// SD isn't properly aligned. Alloc an aligned heap buffer
// and copy it in to fix things up.
//
lpTempSD = (LPBYTE) LocalAlloc(LMEM_FIXED, cbBufSize);
if (lpTempSD == NULL)
{
status = ERROR_NOT_ENOUGH_MEMORY;
goto CleanExit;
}
RtlCopyMemory(lpTempSD, lpSecurityDescriptor, cbBufSize);
}
#endif // _WIN64
//
// Check the validity of lpSecurityInformation
//
if (! RtlValidRelativeSecurityDescriptor(
(PSECURITY_DESCRIPTOR) lpTempSD,
cbBufSize,
dwSecurityInformation
))
{
status = ERROR_INVALID_PARAMETER;
goto CleanExit;
}
//
// Set the desired access based on the specified SecurityInformation
//
if (dwSecurityInformation & SACL_SECURITY_INFORMATION) {
DesiredAccess |= ACCESS_SYSTEM_SECURITY;
}
if (dwSecurityInformation & (OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION)) {
DesiredAccess |= WRITE_OWNER;
}
if (dwSecurityInformation & DACL_SECURITY_INFORMATION) {
DesiredAccess |= WRITE_DAC;
}
//
// Make sure the specified fields are present in the provided
// security descriptor.
// Security descriptors must have owner and group fields.
//
if (dwSecurityInformation & OWNER_SECURITY_INFORMATION)
{
if (((PISECURITY_DESCRIPTOR_RELATIVE) lpTempSD)->Owner == 0)
{
status = ERROR_INVALID_PARAMETER;
goto CleanExit;
}
}
if (dwSecurityInformation & GROUP_SECURITY_INFORMATION)
{
if (((PISECURITY_DESCRIPTOR_RELATIVE) lpTempSD)->Group == 0)
{
status = ERROR_INVALID_PARAMETER;
goto CleanExit;
}
}
//
// Was the handle opened for the requested access?
//
if (! RtlAreAllAccessesGranted(
((LPSC_HANDLE_STRUCT)hService)->AccessGranted,
DesiredAccess
))
{
status = ERROR_ACCESS_DENIED;
goto CleanExit;
}
//
// Is this service marked for delete?
//
serviceRecord =
((LPSC_HANDLE_STRUCT)hService)->Type.ScServiceObject.ServiceRecord;
SC_ASSERT( serviceRecord != NULL );
if (DELETE_FLAG_IS_SET(serviceRecord))
{
status = ERROR_SERVICE_MARKED_FOR_DELETE;
goto CleanExit;
}
//
// If caller wants to replace the owner, get a handle to the impersonation
// token.
//
if (dwSecurityInformation & OWNER_SECURITY_INFORMATION)
{
if ((rpcstatus = RpcImpersonateClient(NULL)) != RPC_S_OK)
{
SC_LOG1(
ERROR,
"RSetServiceObjectSecurity: Failed to impersonate client " FORMAT_RPC_STATUS "\n",
rpcstatus
);
ScLogEvent(
NEVENT_CALL_TO_FUNCTION_FAILED,
SC_RPC_IMPERSONATE,
rpcstatus
);
status = rpcstatus;
goto CleanExit;
}
ntstatus = NtOpenThreadToken(
NtCurrentThread(),
TOKEN_QUERY,
TRUE, // OpenAsSelf
&ClientTokenHandle
);
//
// Stop impersonating the client
//
if ((rpcstatus = RpcRevertToSelf()) != RPC_S_OK) {
SC_LOG1(
ERROR,
"RSetServiceObjectSecurity: Failed to revert to self " FORMAT_RPC_STATUS "\n",
rpcstatus
);
ScLogEvent(
NEVENT_CALL_TO_FUNCTION_FAILED,
SC_RPC_REVERT,
rpcstatus
);
ASSERT(FALSE);
status = rpcstatus;
goto CleanExit;
}
if (! NT_SUCCESS(ntstatus))
{
SC_LOG(ERROR,
"RSetServiceObjectSecurity: NtOpenThreadToken failed %08lx\n",
ntstatus);
status = RtlNtStatusToDosError(ntstatus);
goto CleanExit;
}
}
{
CServiceRecordExclusiveLock RLock;
//
// Replace the service security descriptor with the appropriate
// security information specified in the caller supplied security
// descriptor. This routine may reallocate the memory needed to
// contain the new service security descriptor.
//
ntstatus = RtlSetSecurityObject(
dwSecurityInformation,
(PSECURITY_DESCRIPTOR) lpTempSD,
&serviceRecord->ServiceSd,
&ScServiceObjectMapping,
ClientTokenHandle
);
status = RtlNtStatusToDosError(ntstatus);
if (! NT_SUCCESS(ntstatus))
{
SC_LOG1(ERROR,
"RSetServiceObjectSecurity: RtlSetSecurityObject failed %08lx\n",
ntstatus);
}
else
{
HKEY ServiceKey;
//
// Write new security descriptor to the registry
//
status = ScOpenServiceConfigKey(
serviceRecord->ServiceName,
KEY_WRITE,
FALSE,
&ServiceKey
);
if (status == NO_ERROR)
{
status = ScWriteSd(
ServiceKey,
serviceRecord->ServiceSd
);
if (status != NO_ERROR)
{
SC_LOG1(ERROR,
"RSetServiceObjectSecurity: ScWriteSd failed %lu\n",
status);
}
ScRegFlushKey(ServiceKey);
ScRegCloseKey(ServiceKey);
}
}
}
CleanExit:
#ifdef _WIN64
if (lpTempSD != lpSecurityDescriptor)
{
LocalFree(lpTempSD);
}
#endif // _WIN64
if (ClientTokenHandle != NULL)
{
NtClose(ClientTokenHandle);
}
return status;
}
DWORD
ScCreateScManagerObject(
VOID
)
/*++
Routine Description:
This function creates the security descriptor which represents
the ScManager object for both the "ServiceActive" and
"ServicesFailed" databases.
Arguments:
None.
Return Value:
Returns values from calls to:
ScCreateUserSecurityObject
--*/
{
NTSTATUS ntstatus;
ULONG Privilege = SE_SECURITY_PRIVILEGE;
//
// World has SC_MANAGER_CONNECT access and GENERIC_READ access.
// Local admins are allowed GENERIC_ALL access.
//
#define SC_MANAGER_OBJECT_ACES 5 // Number of ACEs in this DACL
SC_ACE_DATA AceData[SC_MANAGER_OBJECT_ACES] = {
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
SC_MANAGER_CONNECT |
GENERIC_READ, &AuthenticatedUserSid},
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
SC_MANAGER_CONNECT |
GENERIC_READ |
SC_MANAGER_MODIFY_BOOT_CONFIG, &LocalSystemSid},
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
GENERIC_ALL, &AliasAdminsSid},
{SYSTEM_AUDIT_ACE_TYPE, 0, FAILED_ACCESS_ACE_FLAG,
GENERIC_ALL, &WorldSid},
{SYSTEM_AUDIT_ACE_TYPE, INHERIT_ONLY_ACE | OBJECT_INHERIT_ACE,
FAILED_ACCESS_ACE_FLAG,
GENERIC_ALL, &WorldSid}
};
//
// You need to have SE_SECURITY_PRIVILEGE privilege to create the SD with a
// SACL
//
ntstatus = ScGetPrivilege(1, &Privilege);
if (ntstatus != NO_ERROR) {
SC_LOG1(ERROR, "ScCreateScManagerObject: ScGetPrivilege Failed %d\n",
ntstatus);
RevertToSelf();
return(ntstatus);
}
ntstatus = ScCreateUserSecurityObject(
NULL, // Parent SD
AceData,
SC_MANAGER_OBJECT_ACES,
LocalSystemSid,
LocalSystemSid,
TRUE, // IsDirectoryObject
TRUE, // UseImpersonationToken
&ScManagerObjectMapping,
&ScManagerSd
);
#undef SC_MANAGER_OBJECT_ACES
if (! NT_SUCCESS(ntstatus)) {
SC_LOG(
ERROR,
"ScCreateScManagerObject: ScCreateUserSecurityObject failed " FORMAT_NTSTATUS "\n",
ntstatus
);
}
ScReleasePrivilege();
return RtlNtStatusToDosError(ntstatus);
}
DWORD
ScCreateScServiceObject(
OUT PSECURITY_DESCRIPTOR *ServiceSd
)
/*++
Routine Description:
This function creates the security descriptor which represents
the Service object.
Arguments:
ServiceSd - Returns service object security descriptor.
Return Value:
Returns values from calls to:
ScCreateUserSecurityObject
--*/
{
NTSTATUS ntstatus;
//
// Authenticated users have read access.
// Local system has service start/stop and all read access.
// Power user has service start and all read access (Workstation and Server).
// Admin and SystemOp (DC) are allowed all access.
//
#define SC_SERVICE_OBJECT_ACES 4 // Number of ACEs in this DACL
SC_ACE_DATA AceData[SC_SERVICE_OBJECT_ACES] = {
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
GENERIC_READ | GENERIC_EXECUTE,
&LocalSystemSid},
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
GENERIC_ALL,
&AliasAdminsSid},
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
GENERIC_READ | SERVICE_USER_DEFINED_CONTROL,
&AuthenticatedUserSid},
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
0,
0}
};
switch(USER_SHARED_DATA->NtProductType)
{
case NtProductWinNt:
case NtProductServer:
//
// Power users are only on Workstation and Server
//
AceData[SC_SERVICE_OBJECT_ACES - 1].Mask = GENERIC_READ | GENERIC_EXECUTE;
AceData[SC_SERVICE_OBJECT_ACES - 1].Sid = &AliasPowerUsersSid;
break;
case NtProductLanManNt:
//
// System Ops (Server Operators) are only on a DC
//
AceData[SC_SERVICE_OBJECT_ACES - 1].Mask = GENERIC_ALL;
AceData[SC_SERVICE_OBJECT_ACES - 1].Sid = &AliasSystemOpsSid;
break;
default:
//
// A new product type has been added -- add code to cover it
//
SC_ASSERT(FALSE);
break;
}
ntstatus = ScCreateUserSecurityObject(
ScManagerSd, // ParentSD
AceData,
SC_SERVICE_OBJECT_ACES,
LocalSystemSid,
LocalSystemSid,
FALSE, // IsDirectoryObject
FALSE, // UseImpersonationToken
&ScServiceObjectMapping,
ServiceSd
);
#undef SC_SERVICE_OBJECT_ACES
return RtlNtStatusToDosError(ntstatus);
}
DWORD
ScGrantAccess(
IN OUT LPSC_HANDLE_STRUCT ContextHandle,
IN ACCESS_MASK DesiredAccess
)
/*++
Routine Description:
This function is called when a new service is created. It validates
the access desired by the caller for the new service handle and
computes the granted access to be stored in the context handle
structure. Since this is object creation, all requested accesses,
except for ACCESS_SYSTEM_SECURITY, are granted automatically.
Arguments:
DesiredAccess - Supplies the client requested desired access.
ContextHandle - On return, the granted access is written back to this
location if this call succeeds.
Return Value:
Returns values from calls to the following, mapped to Win32 error codes:
ScPrivilegeCheckAndAudit
--*/
{
NTSTATUS Status = STATUS_SUCCESS;
ACCESS_MASK AccessToGrant = DesiredAccess;
//
// If MAXIMUM_ALLOWED is requested, add GENERIC_ALL
//
if (AccessToGrant & MAXIMUM_ALLOWED) {
AccessToGrant &= ~MAXIMUM_ALLOWED;
AccessToGrant |= GENERIC_ALL;
}
//
// If ACCESS_SYSTEM_SECURITY is requested, check that we have
// SE_SECURITY_PRIVILEGE.
//
if (AccessToGrant & ACCESS_SYSTEM_SECURITY) {
Status = ScPrivilegeCheckAndAudit(
SE_SECURITY_PRIVILEGE, // check for this privilege
ContextHandle, // client's handle to the object
// (used for auditing only)
DesiredAccess // (used for auditing only)
);
}
if (NT_SUCCESS(Status)) {
//
// Map the generic bits to specific and standard bits.
//
RtlMapGenericMask(
&AccessToGrant,
&ScServiceObjectMapping
);
//
// Return the computed access mask.
//
ContextHandle->AccessGranted = AccessToGrant;
}
return(RtlNtStatusToDosError(Status));
}
NTSTATUS
ScPrivilegeCheckAndAudit(
IN ULONG PrivilegeId,
IN PVOID ObjectHandle,
IN ACCESS_MASK DesiredAccess
)
/*++
Routine Description:
This function is only called from ScGrantAccess. It checks if the given
well known privilege is enabled for an impersonated client. It also
generates an audit for the attempt to use the privilege.
Arguments:
PrivilegeId - Specifies the well known Privilege Id
ObjectHandle - Client's handle to the object (used for auditing)
DesiredAccess - Access that the client requested to the object (used
for auditing)
Return Value:
NTSTATUS - Standard Nt Result Code
STATUS_SUCCESS - The call completed successfully and the client
is either trusted or has the necessary privilege enabled.
STATUS_PRIVILEGE_NOT_HELD - The client does not have the necessary
privilege.
--*/
{
NTSTATUS Status, SecondaryStatus;
HANDLE ClientToken = NULL;
//
// Impersonate the client.
//
Status = I_RpcMapWin32Status(RpcImpersonateClient( NULL ));
if (NT_SUCCESS(Status)) {
//
// Open the current thread's impersonation token (if any).
//
Status = NtOpenThreadToken(
NtCurrentThread(),
TOKEN_QUERY,
TRUE,
&ClientToken
);
if (NT_SUCCESS(Status)) {
PRIVILEGE_SET Privilege;
BOOLEAN PrivilegeHeld = FALSE;
UNICODE_STRING Subsystem;
//
// OK, we have a token open. Now check for the specified privilege.
// On return, PrivilegeHeld indicates whether the client has the
// privilege, and whether we will allow the operation to succeed.
//
Privilege.PrivilegeCount = 1;
Privilege.Control = PRIVILEGE_SET_ALL_NECESSARY;
Privilege.Privilege[0].Luid = RtlConvertLongToLuid(PrivilegeId);
Privilege.Privilege[0].Attributes = 0;
Status = NtPrivilegeCheck(
ClientToken,
&Privilege,
&PrivilegeHeld
);
SC_ASSERT(NT_SUCCESS(Status));
//
// Audit the attempt to use the privilege.
//
RtlInitUnicodeString(&Subsystem, SC_MANAGER_AUDIT_NAME);
Status = NtPrivilegeObjectAuditAlarm(
&Subsystem, // Subsystem name
PrivilegeHeld ? ObjectHandle : NULL,
// Object handle, to display in
// the audit log
ClientToken, // Client's token
DesiredAccess, // Access desired by client
&Privilege, // Privileges attempted to use
PrivilegeHeld // Whether access was granted
);
SC_ASSERT(NT_SUCCESS(Status));
if ( !PrivilegeHeld ) {
Status = STATUS_PRIVILEGE_NOT_HELD;
}
//
// Close the client token.
//
SecondaryStatus = NtClose( ClientToken );
ASSERT(NT_SUCCESS(SecondaryStatus));
}
//
// Stop impersonating the client.
//
SecondaryStatus = I_RpcMapWin32Status(RpcRevertToSelf());
}
return Status;
}
DWORD
ScAccessValidate(
IN OUT LPSC_HANDLE_STRUCT ContextHandle,
IN ACCESS_MASK DesiredAccess
)
/*++
Routine Description:
This function is called due to an open request. It validates the
desired access based on the object type specified in the context
handle structure. If the requested access is granted, it is
written into the context handle structure.
Arguments:
ContextHandle - Supplies a pointer to the context handle structure
which contains information about the object. On return, the
granted access is written back to this structure if this
call succeeds.
DesiredAccess - Supplies the client requested desired access.
Return Value:
ERROR_GEN_FAILURE - Object type is unrecognizable. An internal
error has occured.
Returns values from calls to:
ScAccessCheckAndAudit
Notes:
The supplied ContextHandle must be verified to be valid (i.e., non-NULL)
BEFORE calling this routine.
--*/
{
ACCESS_MASK RequestedAccess = DesiredAccess;
if (ContextHandle->Signature == SC_SIGNATURE) {
//
// Map the generic bits to specific and standard bits.
//
RtlMapGenericMask(&RequestedAccess, &ScManagerObjectMapping);
//
// Check to see if requested access is granted to client
//
return ScAccessCheckAndAudit(
(LPWSTR) SC_MANAGER_AUDIT_NAME,
(LPWSTR) SC_MANAGER_OBJECT_TYPE_NAME,
ContextHandle->Type.ScManagerObject.DatabaseName,
ContextHandle,
ScManagerSd,
RequestedAccess,
&ScManagerObjectMapping
);
}
else if (ContextHandle->Signature == SERVICE_SIGNATURE) {
//
// Special-case the status access check instead of adding the right
// for the service to set its own status to the service's default SD
// because of the following reasons:
//
// 1. This check is tighter -- since an SC_HANDLE can be used
// remotely, this prevents SetServiceStatus from now being
// called remotely because the LUIDs won't match.
//
// 2. Modifying the SD would require lots of extra work for SDs
// that are stored in the registry -- the SCM would have to
// detect that there's no SERVICE_SET_STATUS access ACL on
// the SD and add it (also in calls to SetServiceObjectSecurity).
//
// Note that if the user specifies extraneous access bits (i.e.,
// SERVICE_SET_STATUS & <other bits>), it will be rejected by the
// ScAccessCheckAndAudit call below.
//
if (DesiredAccess == SERVICE_SET_STATUS) {
DWORD dwError = ScStatusAccessCheck(ContextHandle->Type.ScServiceObject.ServiceRecord);
if (dwError == NO_ERROR) {
ContextHandle->AccessGranted = SERVICE_SET_STATUS;
}
return dwError;
}
//
// Map the generic bits to specific and standard bits.
//
RtlMapGenericMask(&RequestedAccess, &ScServiceObjectMapping);
//
// Check to see if requested access is granted to client
//
return ScAccessCheckAndAudit(
(LPWSTR) SC_MANAGER_AUDIT_NAME,
(LPWSTR) SC_SERVICE_OBJECT_TYPE_NAME,
ContextHandle->Type.ScServiceObject.ServiceRecord->ServiceName,
ContextHandle,
ContextHandle->Type.ScServiceObject.ServiceRecord->ServiceSd,
RequestedAccess,
&ScServiceObjectMapping
);
}
else {
//
// Unknown object type. This should not happen!
//
SC_LOG(ERROR, "ScAccessValidate: Unknown object type, signature=0x%08lx\n",
ContextHandle->Signature);
ASSERT(FALSE);
return ERROR_GEN_FAILURE;
}
}
DWORD
ScAccessCheckAndAudit(
IN LPWSTR SubsystemName,
IN LPWSTR ObjectTypeName,
IN LPWSTR ObjectName,
IN OUT LPSC_HANDLE_STRUCT ContextHandle,
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN ACCESS_MASK DesiredAccess,
IN PGENERIC_MAPPING GenericMapping
)
/*++
Routine Description:
This function impersonates the caller so that it can perform access
validation using NtAccessCheckAndAuditAlarm; and reverts back to
itself before returning.
Arguments:
SubsystemName - Supplies a name string identifying the subsystem
calling this routine.
ObjectTypeName - Supplies the name of the type of the object being
accessed.
ObjectName - Supplies the name of the object being accessed.
ContextHandle - Supplies the context handle to the object. On return, if
this call succeeds, the granted access is written to the AccessGranted
field of this structure, and the SC_HANDLE_GENERATE_ON_CLOSE bit of the
Flags field indicates whether NtCloseAuditAlarm must be called when
this handle is closed.
SecurityDescriptor - A pointer to the Security Descriptor against which
acccess is to be checked.
DesiredAccess - Supplies desired acccess mask. This mask must have been
previously mapped to contain no generic accesses.
GenericMapping - Supplies a pointer to the generic mapping associated
with this object type.
Return Value:
NT status mapped to Win32 errors.
--*/
{
NTSTATUS NtStatus;
RPC_STATUS RpcStatus;
UNICODE_STRING Subsystem;
UNICODE_STRING ObjectType;
UNICODE_STRING Object;
BOOLEAN GenerateOnClose;
NTSTATUS AccessStatus;
RtlInitUnicodeString(&Subsystem, SubsystemName);
RtlInitUnicodeString(&ObjectType, ObjectTypeName);
RtlInitUnicodeString(&Object, ObjectName);
if ((RpcStatus = RpcImpersonateClient(NULL)) != RPC_S_OK)
{
SC_LOG1(ERROR, "ScAccessCheckAndAudit: Failed to impersonate client " FORMAT_RPC_STATUS "\n",
RpcStatus);
ScLogEvent(
NEVENT_CALL_TO_FUNCTION_FAILED,
SC_RPC_IMPERSONATE,
RpcStatus
);
return RpcStatus;
}
NtStatus = NtAccessCheckAndAuditAlarm(
&Subsystem,
(PVOID) ContextHandle,
&ObjectType,
&Object,
SecurityDescriptor,
DesiredAccess,
GenericMapping,
FALSE,
&ContextHandle->AccessGranted, // return access granted
&AccessStatus,
&GenerateOnClose
);
if ((RpcStatus = RpcRevertToSelf()) != RPC_S_OK)
{
SC_LOG(ERROR, "ScAccessCheckAndAudit: Fail to revert to self %08lx\n",
RpcStatus);
ScLogEvent(
NEVENT_CALL_TO_FUNCTION_FAILED,
SC_RPC_REVERT,
RpcStatus
);
ASSERT(FALSE);
return RpcStatus;
}
if (! NT_SUCCESS(NtStatus)) {
if (NtStatus != STATUS_ACCESS_DENIED) {
SC_LOG1(
ERROR,
"ScAccessCheckAndAudit: Error calling NtAccessCheckAndAuditAlarm " FORMAT_NTSTATUS "\n",
NtStatus
);
}
return ERROR_ACCESS_DENIED;
}
if (GenerateOnClose)
{
ContextHandle->Flags |= SC_HANDLE_GENERATE_ON_CLOSE;
}
if (AccessStatus != STATUS_SUCCESS) {
SC_LOG(SECURITY, "ScAccessCheckAndAudit: Access status is %08lx\n",
AccessStatus);
return ERROR_ACCESS_DENIED;
}
SC_LOG(SECURITY, "ScAccessCheckAndAudit: Object name %ws\n", ObjectName);
SC_LOG(SECURITY, " Granted access %08lx\n",
ContextHandle->AccessGranted);
return NO_ERROR;
}
DWORD
ScStatusAccessCheck(
IN LPSERVICE_RECORD lpServiceRecord OPTIONAL
)
{
RPC_STATUS RpcStatus;
DWORD dwStatus;
HANDLE hThreadToken = NULL;
SC_ASSERT(lpServiceRecord == NULL || ScServiceRecordLock.Have());
//
// If OpenService is called for SERVICE_SET_STATUS access on a
// service that's not running, the ImageRecord will be NULL
//
if (lpServiceRecord != NULL && lpServiceRecord->ImageRecord == NULL)
{
return ERROR_SERVICE_NOT_ACTIVE;
}
RpcStatus = RpcImpersonateClient(NULL);
if (RpcStatus != RPC_S_OK)
{
SC_LOG1(ERROR,
"ScStatusAccessCheck: Failed to impersonate client " FORMAT_RPC_STATUS "\n",
RpcStatus);
ScLogEvent(
NEVENT_CALL_TO_FUNCTION_FAILED,
SC_RPC_IMPERSONATE,
RpcStatus
);
return RpcStatus;
}
if (!OpenThreadToken(GetCurrentThread(),
TOKEN_QUERY,
TRUE, // Open as self
&hThreadToken))
{
dwStatus = GetLastError();
SC_LOG1(ERROR,
"ScStatusAccessCheck: OpenThreadToken FAILED %d\n",
dwStatus);
}
else
{
TOKEN_STATISTICS TokenStats;
if (!GetTokenInformation(hThreadToken,
TokenStatistics, // Information wanted
&TokenStats,
sizeof(TokenStats), // Buffer size
&dwStatus)) // Size required
{
dwStatus = GetLastError();
SC_LOG1(ERROR,
"ScCreateImageRecord: GetTokenInformation FAILED %d\n",
dwStatus);
}
else
{
LUID SystemLuid = SYSTEM_LUID;
if (RtlEqualLuid(&TokenStats.AuthenticationId,
lpServiceRecord ? &lpServiceRecord->ImageRecord->AccountLuid :
&SystemLuid))
{
dwStatus = NO_ERROR;
}
else
{
dwStatus = ERROR_ACCESS_DENIED;
}
}
CloseHandle(hThreadToken);
}
RpcStatus = RpcRevertToSelf();
if (RpcStatus != RPC_S_OK)
{
SC_LOG(ERROR,
"ScStatusAccessCheck: Fail to revert to self %08lx\n",
RpcStatus);
ScLogEvent(
NEVENT_CALL_TO_FUNCTION_FAILED,
SC_RPC_REVERT,
RpcStatus
);
ASSERT(FALSE);
return RpcStatus;
}
return dwStatus;
}
DWORD
ScGetPrivilege(
IN DWORD numPrivileges,
IN PULONG pulPrivileges
)
/*++
Routine Description:
This function alters the privilege level for the current thread.
It does this by duplicating the token for the current thread, and then
applying the new privileges to that new token, then the current thread
impersonates with that new token.
Privileges can be relinquished by calling ScReleasePrivilege().
Arguments:
numPrivileges - This is a count of the number of privileges in the
array of privileges.
pulPrivileges - This is a pointer to the array of privileges that are
desired. This is an array of ULONGs.
Return Value:
NO_ERROR - If the operation was completely successful.
Otherwise, it returns mapped return codes from the various NT
functions that are called.
--*/
{
DWORD status;
NTSTATUS ntStatus;
HANDLE ourToken;
HANDLE newToken;
OBJECT_ATTRIBUTES Obja;
SECURITY_QUALITY_OF_SERVICE SecurityQofS;
ULONG returnLen;
PTOKEN_PRIVILEGES pTokenPrivilege = NULL;
DWORD i;
//
// Initialize the Privileges Structure
//
pTokenPrivilege = (PTOKEN_PRIVILEGES) LocalAlloc(
LMEM_FIXED,
sizeof(TOKEN_PRIVILEGES) +
(sizeof(LUID_AND_ATTRIBUTES) *
numPrivileges)
);
if (pTokenPrivilege == NULL) {
status = GetLastError();
SC_LOG(ERROR,"ScGetPrivilege:LocalAlloc Failed %d\n", status);
return(status);
}
pTokenPrivilege->PrivilegeCount = numPrivileges;
for (i = 0; i < numPrivileges; i++) {
pTokenPrivilege->Privileges[i].Luid = RtlConvertLongToLuid(
pulPrivileges[i]);
pTokenPrivilege->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED;
}
//
// Initialize Object Attribute Structure.
//
InitializeObjectAttributes(&Obja,NULL,0L,NULL,NULL);
//
// Initialize Security Quality Of Service Structure
//
SecurityQofS.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
SecurityQofS.ImpersonationLevel = SecurityImpersonation;
SecurityQofS.ContextTrackingMode = FALSE; // Snapshot client context
SecurityQofS.EffectiveOnly = FALSE;
Obja.SecurityQualityOfService = &SecurityQofS;
//
// Open our own Token
//
ntStatus = NtOpenProcessToken(
NtCurrentProcess(),
TOKEN_DUPLICATE,
&ourToken);
if (!NT_SUCCESS(ntStatus)) {
SC_LOG(ERROR, "ScGetPrivilege: NtOpenThreadToken Failed "
"FORMAT_NTSTATUS" "\n", ntStatus);
LocalFree(pTokenPrivilege);
return(RtlNtStatusToDosError(ntStatus));
}
//
// Duplicate that Token
//
ntStatus = NtDuplicateToken(
ourToken,
TOKEN_IMPERSONATE | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
&Obja,
FALSE, // Duplicate the entire token
TokenImpersonation, // TokenType
&newToken); // Duplicate token
if (!NT_SUCCESS(ntStatus)) {
SC_LOG(ERROR, "ScGetPrivilege: NtDuplicateToken Failed "
"FORMAT_NTSTATUS" "\n", ntStatus);
LocalFree(pTokenPrivilege);
NtClose(ourToken);
return(RtlNtStatusToDosError(ntStatus));
}
//
// Add new privileges
//
ntStatus = NtAdjustPrivilegesToken(
newToken, // TokenHandle
FALSE, // DisableAllPrivileges
pTokenPrivilege, // NewState
0, // Size of previous state buffer
NULL, // No info on previous state
&returnLen); // numBytes required for buffer.
if (!NT_SUCCESS(ntStatus)) {
SC_LOG(ERROR, "ScGetPrivilege: NtAdjustPrivilegesToken Failed "
"FORMAT_NTSTATUS" "\n", ntStatus);
LocalFree(pTokenPrivilege);
NtClose(ourToken);
NtClose(newToken);
return(RtlNtStatusToDosError(ntStatus));
}
//
// Begin impersonating with the new token
//
ntStatus = NtSetInformationThread(
NtCurrentThread(),
ThreadImpersonationToken,
(PVOID)&newToken,
(ULONG)sizeof(HANDLE));
if (!NT_SUCCESS(ntStatus)) {
SC_LOG(ERROR, "ScGetPrivilege: NtAdjustPrivilegesToken Failed "
"FORMAT_NTSTATUS" "\n", ntStatus);
LocalFree(pTokenPrivilege);
NtClose(ourToken);
NtClose(newToken);
return(RtlNtStatusToDosError(ntStatus));
}
LocalFree(pTokenPrivilege);
NtClose(ourToken);
NtClose(newToken);
return(NO_ERROR);
}
DWORD
ScReleasePrivilege(
VOID
)
/*++
Routine Description:
This function relinquishes privileges obtained by calling ScGetPrivilege().
Arguments:
none
Return Value:
NO_ERROR - If the operation was completely successful.
Otherwise, it returns mapped return codes from the various NT
functions that are called.
--*/
{
NTSTATUS ntStatus;
HANDLE NewToken;
//
// Revert To Self.
//
NewToken = NULL;
ntStatus = NtSetInformationThread(
NtCurrentThread(),
ThreadImpersonationToken,
(PVOID)&NewToken,
(ULONG)sizeof(HANDLE));
if ( !NT_SUCCESS(ntStatus) ) {
return(RtlNtStatusToDosError(ntStatus));
}
return(NO_ERROR);
}
DWORD
ScGetClientSid(
OUT PTOKEN_USER *UserInfo
)
/*++
Routine Description:
This function looks up the SID of the API caller by impersonating
the caller.
Arguments:
UserInfo - Receives a pointer to a buffer allocated by this routine
which contains the TOKEN_USER information of the caller.
Return Value:
Returns the NT error mapped to Win32
--*/
{
DWORD status;
NTSTATUS ntstatus;
RPC_STATUS rpcstatus;
HANDLE CurrentThreadToken = NULL;
DWORD UserInfoSize;
*UserInfo = NULL;
if ((rpcstatus = RpcImpersonateClient(NULL)) != RPC_S_OK)
{
SC_LOG1(
ERROR,
"ScGetUserSid: Failed to impersonate client " FORMAT_RPC_STATUS "\n",
rpcstatus
);
ScLogEvent(
NEVENT_CALL_TO_FUNCTION_FAILED,
SC_RPC_IMPERSONATE,
rpcstatus
);
return ((DWORD) rpcstatus);
}
ntstatus = NtOpenThreadToken(
NtCurrentThread(),
TOKEN_QUERY,
TRUE, // Use service controller's security
// context to open thread token
&CurrentThreadToken
);
status = RtlNtStatusToDosError(ntstatus);
if (! NT_SUCCESS(ntstatus)) {
SC_LOG1(ERROR, "ScGetUserSid: NtOpenThreadToken failed "
FORMAT_NTSTATUS "\n", ntstatus);
goto Cleanup;
}
//
// Call NtQueryInformationToken the first time with 0 input size to
// get size of returned information.
//
ntstatus = NtQueryInformationToken(
CurrentThreadToken,
TokenUser, // User information class
(PVOID) *UserInfo, // Output
0,
&UserInfoSize
);
if (ntstatus != STATUS_BUFFER_TOO_SMALL) {
SC_LOG1(ERROR, "ScGetUserSid: NtQueryInformationToken failed "
FORMAT_NTSTATUS ". Expected BUFFER_TOO_SMALL.\n", ntstatus);
status = RtlNtStatusToDosError(ntstatus);
goto Cleanup;
}
//
// Allocate buffer of returned size
//
*UserInfo = (PTOKEN_USER)LocalAlloc(
LMEM_ZEROINIT,
(UINT) UserInfoSize
);
if (*UserInfo == NULL) {
SC_LOG1(ERROR, "ScGetUserSid: LocalAlloc failed " FORMAT_DWORD
"\n", GetLastError());
status = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
//
// Call NtQueryInformationToken again with the correct buffer size.
//
ntstatus = NtQueryInformationToken(
CurrentThreadToken,
TokenUser, // User information class
(PVOID) *UserInfo, // Output
UserInfoSize,
&UserInfoSize
);
status = RtlNtStatusToDosError(ntstatus);
if (! NT_SUCCESS(ntstatus)) {
SC_LOG1(ERROR, "ScGetUserSid: NtQueryInformationToken failed "
FORMAT_NTSTATUS "\n", ntstatus);
LocalFree(*UserInfo);
*UserInfo = NULL;
}
Cleanup:
if (CurrentThreadToken != NULL)
{
NtClose(CurrentThreadToken);
}
if ((rpcstatus = RpcRevertToSelf()) != RPC_S_OK)
{
SC_LOG1(
ERROR,
"ScGetUserSid: Failed to revert to self " FORMAT_RPC_STATUS "\n",
rpcstatus
);
ScLogEvent(
NEVENT_CALL_TO_FUNCTION_FAILED,
SC_RPC_REVERT,
rpcstatus
);
SC_ASSERT(FALSE);
return ((DWORD) rpcstatus);
}
return status;
}
Reference in a new issue Copy permalink