able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/printscan/print/spooler/localspl/security.c

2766 lines
82 KiB
C
Raw Permalink Normal View History

Add source files
2020-09-26 03:20:57 -05:00
/*++
Copyright (c) 1990 - 1995 Microsoft Corporation
Module Name:
security.c
Abstract:
This module interfaces with the security system
Author:
Andrew Bell (andrewbe) June 1992
Revision History:
--*/
#include <precomp.h>
/******************************************************************************
The printing security model
---------------------------
In printing we define a hierarchy of three objects:
SERVER
/ \
/ \
/ ...
/
PRINTER
/ \
/ \
/ ...
/
DOCUMENT
The following types of operation may be performed on each of these objects:
SERVER: Install/Deinstall Driver
Create Printer
Enumerate Printers
PRINTER: Pause/Resume
Delete
Connect to/Disconnect
Set
Enumerate Documents
DOCUMENT: Pause/Resume
Delete
Set Attributes
For product LanMan NT, five classes of user are defined, and,
for Windows NT, four classes are defined.
The following privileges are assigned to each class:
Administrators
Print Operators
System Operators
Power Users
Owners
Everyone (World)
******************************************************************************/
#define DBGCHK( Condition, ErrorInfo ) \
if( Condition ) DBGMSG( DBG_WARNING, ErrorInfo )
#define TOKENLENGTH( Token ) ( *( ( (PDWORD)Token ) - 1 ) )
/*>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Came from \\orville\razzle\src\private\newsam\server\bldsam3.c
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/
GENERIC_MAPPING GenericMapping[SPOOLER_OBJECT_COUNT] =
{
{ SERVER_READ, SERVER_WRITE, SERVER_EXECUTE, SERVER_ALL_ACCESS },
{ PRINTER_READ, PRINTER_WRITE, PRINTER_EXECUTE, PRINTER_ALL_ACCESS },
{ JOB_READ, JOB_WRITE, JOB_EXECUTE, JOB_ALL_ACCESS }
};
/* !!! Should these be translatable??? */
LPWSTR ObjectTypeName[SPOOLER_OBJECT_COUNT] =
{
L"Server", L"Printer", L"Document"
};
WCHAR *szSpooler = L"Spooler";
LUID AuditValue;
PSECURITY_DESCRIPTOR pServerSecurityDescriptor;
LUID gLoadDriverPrivilegeLuid;
PSID pLocalSystemSid;
PSID pGuestsSid;
PSID pNetworkLogonSid;
BOOL ServerGenerateOnClose; /* Do we need this for the server? */
#if DBG
#define DBG_ACCESS_TYPE_SERVER_ALL_ACCESS 0
#define DBG_ACCESS_TYPE_SERVER_READ 1
#define DBG_ACCESS_TYPE_SERVER_WRITE 2
#define DBG_ACCESS_TYPE_SERVER_EXECUTE 3
#define DBG_ACCESS_TYPE_PRINTER_ALL_ACCESS 4
#define DBG_ACCESS_TYPE_PRINTER_READ 5
#define DBG_ACCESS_TYPE_PRINTER_WRITE 6
#define DBG_ACCESS_TYPE_PRINTER_EXECUTE 7
#define DBG_ACCESS_TYPE_JOB_ALL_ACCESS 8
#define DBG_ACCESS_TYPE_JOB_READ 9
#define DBG_ACCESS_TYPE_JOB_WRITE 10
#define DBG_ACCESS_TYPE_JOB_EXECUTE 11
#define DBG_ACCESS_TYPE_PRINTER_ACCESS_USE 12
#define DBG_ACCESS_TYPE_PRINTER_ACCESS_ADMINISTER 13
#define DBG_ACCESS_TYPE_SERVER_ACCESS_ENUMERATE 14
#define DBG_ACCESS_TYPE_SERVER_ACCESS_ADMINISTER 15
#define DBG_ACCESS_TYPE_JOB_ACCESS_ADMINISTER 16
#define DBG_ACCESS_TYPE_DELETE 17
#define DBG_ACCESS_TYPE_WRITE_DAC 18
#define DBG_ACCESS_TYPE_WRITE_OWNER 19
#define DBG_ACCESS_TYPE_ACCESS_SYSTEM_SECURITY 20
// These two should come last:
#define DBG_ACCESS_TYPE_UNKNOWN 21
#define DBG_ACCESS_TYPE_COUNT 22
typedef struct _DBG_ACCESS_TYPE_MAPPING
{
DWORD Type;
LPWSTR Name;
}
DBG_ACCESS_TYPE_MAPPING, *PDBG_ACCESS_TYPE_MAPPING;
DBG_ACCESS_TYPE_MAPPING DbgAccessTypeMapping[DBG_ACCESS_TYPE_COUNT] =
{
{ SERVER_ALL_ACCESS, L"SERVER_ALL_ACCESS" },
{ SERVER_READ, L"SERVER_READ" },
{ SERVER_WRITE, L"SERVER_WRITE" },
{ SERVER_EXECUTE, L"SERVER_EXECUTE" },
{ PRINTER_ALL_ACCESS, L"PRINTER_ALL_ACCESS" },
{ PRINTER_READ, L"PRINTER_READ" },
{ PRINTER_WRITE, L"PRINTER_WRITE" },
{ PRINTER_EXECUTE, L"PRINTER_EXECUTE" },
{ JOB_ALL_ACCESS, L"JOB_ALL_ACCESS" },
{ JOB_READ, L"JOB_READ" },
{ JOB_WRITE, L"JOB_WRITE" },
{ JOB_EXECUTE, L"JOB_EXECUTE" },
{ PRINTER_ACCESS_USE, L"PRINTER_ACCESS_USE" },
{ PRINTER_ACCESS_ADMINISTER, L"PRINTER_ACCESS_ADMINISTER" },
{ SERVER_ACCESS_ENUMERATE, L"SERVER_ACCESS_ENUMERATE" },
{ SERVER_ACCESS_ADMINISTER, L"SERVER_ACCESS_ADMINISTER" },
{ JOB_ACCESS_ADMINISTER, L"JOB_ACCESS_ADMINISTER" },
{ DELETE, L"DELETE" },
{ WRITE_DAC, L"WRITE_DAC" },
{ WRITE_OWNER, L"WRITE_OWNER" },
{ ACCESS_SYSTEM_SECURITY, L"ACCESS_SYSTEM_SECURITY" },
{ 0, L"UNKNOWN" }
};
LPWSTR DbgGetAccessTypeName( DWORD AccessType )
{
PDBG_ACCESS_TYPE_MAPPING pMapping;
DWORD i;
pMapping = DbgAccessTypeMapping;
i = 0;
while( ( i < ( DBG_ACCESS_TYPE_COUNT - 1 ) ) && ( pMapping[i].Type != AccessType ) )
i++;
return pMapping[i].Name;
}
#endif /* DBG */
BOOL
BuildJobOwnerSecurityDescriptor(
IN HANDLE hToken,
OUT PSECURITY_DESCRIPTOR *ppSD
);
VOID
DestroyJobOwnerSecurityDescriptor(
IN PSECURITY_DESCRIPTOR pSD
);
BOOL
SetRequiredPrivileges(
IN HANDLE TokenHandle,
OUT PTOKEN_PRIVILEGES *ppPreviousTokenPrivileges,
OUT PDWORD pPreviousTokenPrivilegesLength
);
BOOL
ResetRequiredPrivileges(
IN HANDLE TokenHandle,
IN PTOKEN_PRIVILEGES pPreviousTokenPrivileges,
IN DWORD PreviousTokenPrivilegesLength
);
PSECURITY_DESCRIPTOR
AllocateLocalSD(
PSECURITY_DESCRIPTOR pSystemAllocatedSD
);
DWORD
GetHackOutAce(
PACL pDacl
);
#define MAX_ACE 20
#if DBG
typedef struct _STANDARD_ACE {
ACE_HEADER Header;
ACCESS_MASK Mask;
PSID Sid;
} STANDARD_ACE;
typedef STANDARD_ACE *PSTANDARD_ACE;
//
// The following macros used by DumpAcl(), these macros and DumpAcl() are
// stolen from private\ntos\se\ctaccess.c (written by robertre) for
// debugging purposes.
//
//
// Returns a pointer to the first Ace in an Acl (even if the Acl is empty).
//
#define FirstAce(Acl) ((PVOID)((LPBYTE)(Acl) + sizeof(ACL)))
//
// Returns a pointer to the next Ace in a sequence (even if the input
// Ace is the one in the sequence).
//
#define NextAce(Ace) ((PVOID)((LPBYTE)(Ace) + ((PACE_HEADER)(Ace))->AceSize))
VOID
DumpAcl(
IN PACL Acl
);
#endif //if DBG
/* Dummy access mask which will never be checked, but required
* by the ACL editor, so that Document Properties is not undefined
* for containers (i.e. printers).
* This mask alone must not be used for any other ACE, since it
* will be used to find the no-inherit ACE which propagates
* onto printers.
*/
#define DUMMY_ACE_ACCESS_MASK READ_CONTROL
/* CreateServerSecurityDescriptor
*
* Arguments: None
*
* Return: The security descriptor returned by BuildPrintObjectProtection.
*
*/
PSECURITY_DESCRIPTOR
CreateServerSecurityDescriptor(
VOID
)
{
DWORD ObjectType = SPOOLER_OBJECT_SERVER;
NT_PRODUCT_TYPE NtProductType;
PSID AceSid[MAX_ACE]; // Don't expect more than MAX_ACE ACEs in any of these.
ACCESS_MASK AceMask[MAX_ACE]; // Access masks corresponding to Sids
BYTE InheritFlags[MAX_ACE]; //
UCHAR AceType[MAX_ACE];
DWORD AceCount;
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
SID_IDENTIFIER_AUTHORITY WorldSidAuthority = SECURITY_WORLD_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY CreatorSidAuthority = SECURITY_CREATOR_SID_AUTHORITY;
PSID WorldSid = NULL;
PSID AdminsAliasSid = NULL;
PSID PrintOpsAliasSid = NULL;
PSID SystemOpsAliasSid = NULL;
PSID PowerUsersAliasSid = NULL;
PSID CreatorOwnerSid = NULL;
PSECURITY_DESCRIPTOR ServerSD = NULL;
BOOL OK;
//
// Printer SD
//
AceCount = 0;
/* Creator-Owner SID: */
OK = AllocateAndInitializeSid( &CreatorSidAuthority, 1,
SECURITY_CREATOR_OWNER_RID,
0, 0, 0, 0, 0, 0, 0,
&CreatorOwnerSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
/* The following is a dummy ACE needed for the ACL editor.
* Note this is a gross hack, and will result in two ACEs
* being propagated onto printers when they are created,
* one of which must be deleted.
*/
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = CreatorOwnerSid;
AceMask[AceCount] = DUMMY_ACE_ACCESS_MASK;
InheritFlags[AceCount] = INHERIT_ONLY_ACE | CONTAINER_INHERIT_ACE;
AceCount++;
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = CreatorOwnerSid;
AceMask[AceCount] = GENERIC_ALL;
InheritFlags[AceCount] = INHERIT_ONLY_ACE | OBJECT_INHERIT_ACE;
AceCount++;
/* World SID */
OK = AllocateAndInitializeSid( &WorldSidAuthority, 1,
SECURITY_WORLD_RID,
0, 0, 0, 0, 0, 0, 0,
&WorldSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = WorldSid;
AceMask[AceCount] = SERVER_EXECUTE;
InheritFlags[AceCount] = 0;
AceCount++;
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = WorldSid;
AceMask[AceCount] = GENERIC_EXECUTE;
InheritFlags[AceCount] = INHERIT_ONLY_ACE | CONTAINER_INHERIT_ACE;
AceCount++;
/* Admins alias SID */
OK = AllocateAndInitializeSid( &NtAuthority, 2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_ADMINS,
0, 0, 0, 0, 0, 0,
&AdminsAliasSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = AdminsAliasSid;
AceMask[AceCount] = SERVER_ALL_ACCESS;
InheritFlags[AceCount] = 0;
AceCount++;
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = AdminsAliasSid;
AceMask[AceCount] = GENERIC_ALL;
InheritFlags[AceCount] = INHERIT_ONLY_ACE | CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE;
AceCount++;
OK = RtlGetNtProductType( &NtProductType );
DBGCHK( !OK, ( "Couldn't get product type" ) );
if ( !OK ) {
goto CleanUp;
}
switch (NtProductType) {
case NtProductLanManNt:
// case NtProductMember:
/* Print Ops alias SID */
OK = AllocateAndInitializeSid( &NtAuthority, 2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_PRINT_OPS,
0, 0, 0, 0, 0, 0,
&PrintOpsAliasSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = PrintOpsAliasSid;
AceMask[AceCount] = SERVER_ALL_ACCESS;
InheritFlags[AceCount] = 0;
AceCount++;
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = PrintOpsAliasSid;
AceMask[AceCount] = GENERIC_ALL;
InheritFlags[AceCount] = INHERIT_ONLY_ACE | CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE;
AceCount++;
/* System Ops alias SID */
OK = AllocateAndInitializeSid( &NtAuthority, 2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_SYSTEM_OPS,
0, 0, 0, 0, 0, 0,
&SystemOpsAliasSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = SystemOpsAliasSid;
AceMask[AceCount] = SERVER_ALL_ACCESS;
InheritFlags[AceCount] = 0;
AceCount++;
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = SystemOpsAliasSid;
AceMask[AceCount] = GENERIC_ALL;
InheritFlags[AceCount] = INHERIT_ONLY_ACE | CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE;
AceCount++;
break;
case NtProductWinNt:
default:
{
OSVERSIONINFOEX OsVersion = {0};
OsVersion.dwOSVersionInfoSize = sizeof(OsVersion);
//
// Whistler Personal does not have the Power Users group.
//
if (GetVersionEx((LPOSVERSIONINFO)&OsVersion) &&
!(OsVersion.wProductType==VER_NT_WORKSTATION && OsVersion.wSuiteMask & VER_SUITE_PERSONAL)) {
OK = AllocateAndInitializeSid( &NtAuthority, 2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_POWER_USERS,
0, 0, 0, 0, 0, 0,
&PowerUsersAliasSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = PowerUsersAliasSid;
AceMask[AceCount] = SERVER_ALL_ACCESS;
InheritFlags[AceCount] = 0;
AceCount++;
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = PowerUsersAliasSid;
AceMask[AceCount] = GENERIC_ALL;
InheritFlags[AceCount] = INHERIT_ONLY_ACE | CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE;
AceCount++;
}
}
break;
}
DBGCHK( ( AceCount > MAX_ACE ), ( "ACE count exceeded" ) );
if ( AceCount > MAX_ACE ) {
goto CleanUp;
}
OK = BuildPrintObjectProtection( AceType,
AceCount,
AceSid,
AceMask,
InheritFlags,
AdminsAliasSid,
AdminsAliasSid,
&GenericMapping[ObjectType],
&ServerSD );
DBGCHK( !OK, ( "BuildPrintObjectProtection failed" ) );
CleanUp:
if (WorldSid) {
FreeSid( WorldSid );
}
if (AdminsAliasSid) {
FreeSid( AdminsAliasSid );
}
if (CreatorOwnerSid) {
FreeSid( CreatorOwnerSid );
}
if (PrintOpsAliasSid) {
FreeSid( PrintOpsAliasSid );
}
if (SystemOpsAliasSid) {
FreeSid( SystemOpsAliasSid );
}
if (PowerUsersAliasSid) {
FreeSid( PowerUsersAliasSid );
}
pServerSecurityDescriptor = ServerSD;
return ServerSD;
}
/* CreatePrinterSecurityDescriptor
*
* Creates a default security descriptor for a printer by inheritance
* of the access flags in the local spooler's security descriptor.
* The resulting descriptor is allocated from the process' heap
* and should be freed by DeletePrinterSecurityDescriptor.
*
* Argument: pCreatorSecurityDescriptor - if the creator supplies
* a security descriptor, this should point to it. Otherwise
* it should be NULL.
*
* Return: The printer's security descriptor
*
*/
PSECURITY_DESCRIPTOR
CreatePrinterSecurityDescriptor(
PSECURITY_DESCRIPTOR pCreatorSecurityDescriptor
)
{
HANDLE ClientToken;
PSECURITY_DESCRIPTOR pPrivateObjectSecurity;
PSECURITY_DESCRIPTOR pPrinterSecurityDescriptor;
DWORD ObjectType = SPOOLER_OBJECT_PRINTER;
BOOL OK;
HANDLE hToken;
BOOL DaclPresent;
PACL pDacl;
BOOL DaclDefaulted = FALSE;
DWORD HackOutAce;
if( GetTokenHandle( &ClientToken ) )
{
hToken = RevertToPrinterSelf( );
OK = CreatePrivateObjectSecurity( pServerSecurityDescriptor,
pCreatorSecurityDescriptor,
&pPrivateObjectSecurity,
TRUE, // This is a container
ClientToken,
&GenericMapping[ObjectType] );
ImpersonatePrinterClient( hToken );
CloseHandle(ClientToken);
DBGCHK( !OK, ( "CreatePrivateObjectSecurity failed: Error %d", GetLastError() ) );
if( !OK )
return NULL;
pPrinterSecurityDescriptor = pPrivateObjectSecurity;
if( !pCreatorSecurityDescriptor )
{
GetSecurityDescriptorDacl( pPrinterSecurityDescriptor,
&DaclPresent,
&pDacl,
&DaclDefaulted );
/* HACK HACK HACK HACK HACK
*
* We defined an extra ACE for the benefit of the ACL editor.
* This is container-inherit,
* and we want it to propagate onto documents.
* However, this means it will also propagate onto printers,
* which we definitely don't want.
*/
HackOutAce = GetHackOutAce( pDacl );
if( HackOutAce != (DWORD)-1 )
DeleteAce( pDacl, HackOutAce );
#if DBG
if( MODULE_DEBUG & DBG_SECURITY ){
DBGMSG( DBG_SECURITY, ( "Printer security descriptor DACL:\n" ));
DumpAcl( pDacl );
}
#endif /* DBG */
}
}
else
{
OK = FALSE;
}
return ( OK ? pPrinterSecurityDescriptor : NULL );
}
/*
*
*/
DWORD GetHackOutAce( PACL pDacl )
{
DWORD i;
PACCESS_ALLOWED_ACE pAce;
BOOL OK = TRUE;
i = 0;
while( OK )
{
OK = GetAce( pDacl, i, (LPVOID *)&pAce );
DBGCHK( !OK, ( "Failed to get ACE. Error %d", GetLastError() ) );
/* Find the dummy ace that isn't inherit-only:
*/
if( OK && ( pAce->Mask == DUMMY_ACE_ACCESS_MASK )
&&( !( pAce->Header.AceFlags & INHERIT_ONLY_ACE ) ) )
return i;
}
return (DWORD)-1;
}
/* SetPrinterSecurityDescriptor
*
* Arguments:
*
* SecurityInformation - Type of security information to be applied,
* typically DACL_SECURITY_INFORMATION. (This is a 32-bit array.)
*
* pModificationDescriptor - A pointer to a pointer to a security
* descriptor to be applied to the previous descriptor.
*
* pObjectSecurityDescriptor - The previous descriptor which is to be
* modified.
*
*
* Return:
*
* Boolean indicating success or otherwise.
*
*/
BOOL
SetPrinterSecurityDescriptor(
SECURITY_INFORMATION SecurityInformation,
PSECURITY_DESCRIPTOR pModificationDescriptor,
PSECURITY_DESCRIPTOR *ppObjectsSecurityDescriptor
)
{
HANDLE ClientToken;
DWORD ObjectType = SPOOLER_OBJECT_PRINTER;
BOOL OK = FALSE;
HANDLE hToken;
if( GetTokenHandle( &ClientToken ) )
{
/* SetPrivateObjectSecurity should not be called when we are
* impersonating a client, since it may need to allocate memory:
*/
hToken = RevertToPrinterSelf( );
OK = SetPrivateObjectSecurity( SecurityInformation,
pModificationDescriptor,
ppObjectsSecurityDescriptor,
&GenericMapping[ObjectType],
ClientToken );
ImpersonatePrinterClient( hToken );
DBGCHK( !OK, ( "SetPrivateObjectSecurity failed: Error %d", GetLastError() ) );
CloseHandle(ClientToken);
}
return OK;
}
/* CreateDocumentSecurityDescriptor
*
* Creates a default security descriptor for a document by inheritance
* of the access flags in the supplied printer security descriptor.
* The resulting descriptor is allocated from the process' heap
* and should be freed by DeleteDocumentSecurityDescriptor.
*
* Argument: The printer's security descriptor
*
* Return: The document's security descriptor
*
*/
PSECURITY_DESCRIPTOR
CreateDocumentSecurityDescriptor(
PSECURITY_DESCRIPTOR pPrinterSecurityDescriptor
)
{
HANDLE ClientToken;
PSECURITY_DESCRIPTOR pPrivateObjectSecurity;
PSECURITY_DESCRIPTOR pDocumentSecurityDescriptor;
PSECURITY_DESCRIPTOR pSD = NULL;
DWORD ObjectType = SPOOLER_OBJECT_DOCUMENT;
BOOL OK = FALSE;
HANDLE hToken;
if( GetTokenHandle( &ClientToken ) )
{
hToken = RevertToPrinterSelf( );
//
// The function CreateDocumentSecurityDescriptor does not preserve
// the last error correctly. If CreatePrivateObjectSecurityEx fails,
// it sets the last error. But after that,
//
OK = BuildJobOwnerSecurityDescriptor(ClientToken, &pSD) &&
CreatePrivateObjectSecurityEx(pPrinterSecurityDescriptor,
pSD,
&pPrivateObjectSecurity,
NULL,
FALSE, // This is not a container
SEF_DACL_AUTO_INHERIT | SEF_SACL_AUTO_INHERIT,
ClientToken,
&GenericMapping[ObjectType] );
DestroyJobOwnerSecurityDescriptor(pSD);
ImpersonatePrinterClient( hToken );
CloseHandle(ClientToken);
DBGCHK( !OK, ( "CreatePrivateObjectSecurity failed: Error %d", GetLastError() ) );
if( !OK )
return NULL;
pDocumentSecurityDescriptor = pPrivateObjectSecurity;
#if DBG
if( MODULE_DEBUG & DBG_SECURITY )
{
BOOL DaclPresent;
PACL pDacl;
BOOL DaclDefaulted = FALSE;
GetSecurityDescriptorDacl( pDocumentSecurityDescriptor,
&DaclPresent,
&pDacl,
&DaclDefaulted );
DBGMSG( DBG_SECURITY, ( "Document security descriptor DACL:\n" ));
DumpAcl( pDacl );
}
#endif /* DBG */
}
else
{
OK = FALSE;
}
return ( OK ? pDocumentSecurityDescriptor : NULL );
}
/*
*
*/
BOOL DeletePrinterSecurity(
PINIPRINTER pIniPrinter
)
{
BOOL OK;
OK = DestroyPrivateObjectSecurity( &pIniPrinter->pSecurityDescriptor );
pIniPrinter->pSecurityDescriptor = NULL;
DBGCHK( !OK, ( "DestroyPrivateObjectSecurity failed. Error %d", GetLastError() ) );
return OK;
}
/*
*
*/
BOOL DeleteDocumentSecurity(
PINIJOB pIniJob
)
{
BOOL OK;
OK = DestroyPrivateObjectSecurity( &pIniJob->pSecurityDescriptor );
DBGCHK( !OK, ( "DestroyPrivateObjectSecurity failed. Error %d", GetLastError() ) );
OK = ObjectCloseAuditAlarm( szSpooler, pIniJob,
pIniJob->GenerateOnClose );
DBGCHK( !OK, ( "ObjectCloseAuditAlarm failed. Error %d", GetLastError() ) );
return OK;
}
#ifdef OLDSTUFF
/* AllocateLocalSD
*
* Makes a copy of a security descriptor, allocating it out of the local heap.
* The source descriptor MUST be in self-relative format.
*
* Argument
*
* pSourceSD - Pointer to a self-relative security descriptor
*
*
* Returns
*
* A pointer to a locally allocated security descriptor.
*
* If the function fails to allocate the memory, NULL is returned.
*
* Note, if an invalid security descriptor is passed to
* GetSecurityDescriptorLength, the return value is undefined,
* therefore the caller should ensure that the source is valid.
*/
PSECURITY_DESCRIPTOR AllocateLocalSD( PSECURITY_DESCRIPTOR pSourceSD )
{
DWORD Length;
PSECURITY_DESCRIPTOR pLocalSD;
Length = GetSecurityDescriptorLength( pSourceSD );
pLocalSD = AllocSplMem( Length );
if( pLocalSD )
{
memcpy( pLocalSD, pSourceSD, Length );
}
return pLocalSD;
}
#endif /* OLDSTUFF */
//>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
BOOL
BuildPrintObjectProtection(
IN PUCHAR AceType,
IN DWORD AceCount,
IN PSID *AceSid,
IN ACCESS_MASK *AceMask,
IN BYTE *InheritFlags,
IN PSID OwnerSid,
IN PSID GroupSid,
IN PGENERIC_MAPPING GenericMap,
OUT PSECURITY_DESCRIPTOR *ppSecurityDescriptor
)
/*++
Routine Description:
This routine builds a self-relative security descriptor ready
to be applied to one of the print manager objects.
If so indicated, a pointer to the last RID of the SID in the last
ACE of the DACL is returned and a flag set indicating that the RID
must be replaced before the security descriptor is applied to an object.
This is to support USER object protection, which must grant some
access to the user represented by the object.
The SACL of each of these objects will be set to:
Audit
Success | Fail
WORLD
(Write | Delete | WriteDacl | AccessSystemSecurity)
Arguments:
AceType - Array of AceTypes.
Must be ACCESS_ALLOWED_ACE_TYPE or ACCESS_DENIED_ACE_TYPE.
AceCount - The number of ACEs to be included in the DACL.
AceSid - Points to an array of SIDs to be granted access by the DACL.
If the target SAM object is a User object, then the last entry
in this array is expected to be the SID of an account within the
domain with the last RID not yet set. The RID will be set during
actual account creation.
AceMask - Points to an array of accesses to be granted by the DACL.
The n'th entry of this array corresponds to the n'th entry of
the AceSid array. These masks should not include any generic
access types.
InheritFlags - Pointer to an array of inherit flags.
The n'th entry of this array corresponds to the n'th entry of
the AceSid array.
OwnerSid - The SID of the owner to be assigned to the descriptor.
GroupSid - The SID of the group to be assigned to the descriptor.
GenericMap - Points to a generic mapping for the target object type.
ppSecurityDescriptor - Receives a pointer to the security descriptor.
This will be allcated from the process' heap, not the spooler's,
and should therefore be freed with LocalFree().
IN DWORD AceCount,
IN PSID *AceSid,
IN ACCESS_MASK *AceMask,
IN BYTE *InheritFlags,
IN PSID OwnerSid,
IN PSID GroupSid,
IN PGENERIC_MAPPING GenericMap,
OUT PSECURITY_DESCRIPTOR *ppSecurityDescriptor
Return Value:
TBS.
--*/
{
SECURITY_DESCRIPTOR Absolute;
PSECURITY_DESCRIPTOR Relative = NULL;
PACL TmpAcl= NULL;
PACCESS_ALLOWED_ACE TmpAce;
DWORD SDLength;
DWORD DaclLength;
DWORD i;
BOOL bReturn = FALSE;
//
// The approach is to set up an absolute security descriptor that
// looks like what we want and then copy it to make a self-relative
// security descriptor.
//
if (InitializeSecurityDescriptor( &Absolute,
SECURITY_DESCRIPTOR_REVISION1 ) &&
SetSecurityDescriptorOwner( &Absolute, OwnerSid, FALSE ) &&
SetSecurityDescriptorGroup( &Absolute, GroupSid, FALSE ) ) {
//
// Discretionary ACL
//
// Calculate its length,
// Allocate it,
// Initialize it,
// Add each ACE
// Set ACE as InheritOnly if necessary
// Add it to the security descriptor
//
DaclLength = (DWORD)sizeof(ACL);
for (i=0; i<AceCount; i++) {
DaclLength += GetLengthSid( AceSid[i] ) +
(DWORD)sizeof(ACCESS_ALLOWED_ACE) -
(DWORD)sizeof(DWORD); //Subtract out SidStart field length
}
TmpAcl = AllocSplMem( DaclLength );
if (TmpAcl && InitializeAcl( TmpAcl, DaclLength, ACL_REVISION2 )) {
BOOL bLoop = TRUE;
for (i=0; bLoop && i < AceCount; i++)
{
if( AceType[i] == ACCESS_ALLOWED_ACE_TYPE ) {
bLoop = AddAccessAllowedAce ( TmpAcl, ACL_REVISION2, AceMask[i], AceSid[i] );
} else {
bLoop = AddAccessDeniedAce ( TmpAcl, ACL_REVISION2, AceMask[i], AceSid[i] );
}
if (bLoop) {
if (InheritFlags[i] != 0)
{
if ( bLoop = GetAce( TmpAcl, i, (LPVOID *)&TmpAce )) {
TmpAce->Header.AceFlags = InheritFlags[i];
}
}
}
}
if (bLoop) {
#if DBG
DBGMSG( DBG_SECURITY, ( "Server security descriptor DACL:\n" ) );
DumpAcl(TmpAcl);
#endif /* DBG */
if (SetSecurityDescriptorDacl (&Absolute, TRUE, TmpAcl, FALSE )) {
//
// Convert the Security Descriptor to Self-Relative
//
// Get the length needed
// Allocate that much memory
// Copy it
// Free the generated absolute ACLs
//
SDLength = GetSecurityDescriptorLength( &Absolute );
Relative = LocalAlloc( 0, SDLength );
if (Relative) {
bReturn = MakeSelfRelativeSD(&Absolute, Relative, &SDLength );
}
}
}
}
}
if (bReturn) {
*ppSecurityDescriptor = Relative;
} else {
*ppSecurityDescriptor = NULL;
if (Relative) {
LocalFree(Relative);
}
}
if (TmpAcl){
FreeSplMem(TmpAcl);
}
return(bReturn);
}
BOOL
ValidateObjectAccess(
IN DWORD ObjectType,
IN ACCESS_MASK DesiredAccess,
IN LPVOID ObjectHandle,
OUT PACCESS_MASK pGrantedAccess,
IN PINISPOOLER pIniSpooler
)
/*++
Routine Description:
Arguments:
ObjectType - SPOOLER_OBJECT_* value, which is an index into the global
mapping for spooler objects.
DesiredAccess - The type of access requested.
ObjectHandle - If ObjectType == SPOOLER_OBJECT_PRINTER, this must be
a printer handle, if SPOOLER_OBJECT_DOCUMENT, a pointer to a INIJOB
structure. For SPOOLER_OBJECT_SERVER this is ignored.
Return Value:
TRUE if requested access is granted.
--*/
{
LPWSTR pObjectName;
PSECURITY_DESCRIPTOR pSecurityDescriptor;
PSPOOL pSpool = NULL;
PINIPRINTER pIniPrinter;
PINIJOB pIniJob;
HANDLE ClientToken;
BOOL AccessCheckOK;
BOOL OK;
BOOL AccessStatus = TRUE;
ACCESS_MASK MappedDesiredAccess;
DWORD GrantedAccess = 0;
PBOOL pGenerateOnClose;
BYTE PrivilegeSetBuffer[256];
DWORD PrivilegeSetBufferLength = 256;
PPRIVILEGE_SET pPrivilegeSet;
BOOL HackForNoImpersonationToken = FALSE;
DWORD dwRetCode;
PTOKEN_PRIVILEGES pPreviousTokenPrivileges;
DWORD PreviousTokenPrivilegesLength;
//
// Some Print Providers may not require Security
//
if ( (pIniSpooler->SpoolerFlags & SPL_SECURITY_CHECK) == FALSE ) return TRUE;
switch( ObjectType )
{
case SPOOLER_OBJECT_SERVER:
case SPOOLER_OBJECT_XCV:
if( ObjectHandle )
pSpool = ObjectHandle;
ObjectHandle = pIniSpooler;
pObjectName = pIniSpooler->pMachineName;
pSecurityDescriptor = pServerSecurityDescriptor;
pGenerateOnClose = &ServerGenerateOnClose;
break;
case SPOOLER_OBJECT_PRINTER:
pSpool = ObjectHandle;
pIniPrinter = pSpool->pIniPrinter;
pObjectName = pIniPrinter->pName;
pSecurityDescriptor = pIniPrinter->pSecurityDescriptor;
pGenerateOnClose = &pSpool->GenerateOnClose;
break;
case SPOOLER_OBJECT_DOCUMENT:
pIniJob = (PINIJOB)ObjectHandle;
pObjectName = pIniJob->pDocument;
pSecurityDescriptor = pIniJob->pSecurityDescriptor;
pGenerateOnClose = &pIniJob->GenerateOnClose;
break;
}
MapGenericToSpecificAccess( ObjectType, DesiredAccess, &MappedDesiredAccess );
if (!(OK = GetTokenHandle(&ClientToken))) {
if (pGrantedAccess) {
*pGrantedAccess = 0;
}
return(FALSE);
}
if (MappedDesiredAccess & ACCESS_SYSTEM_SECURITY) {
if (!SetRequiredPrivileges( ClientToken,
&pPreviousTokenPrivileges,
&PreviousTokenPrivilegesLength
)) {
if (pGrantedAccess) {
*pGrantedAccess = 0;
}
CloseHandle(ClientToken);
return(FALSE);
}
}
pPrivilegeSet = (PPRIVILEGE_SET)PrivilegeSetBuffer;
/* Call AccessCheck followed by ObjectOpenAuditAlarm rather than
* AccessCheckAndAuditAlarm, because we may need to enable
* SeSecurityPrivilege in order to check for ACCESS_SYSTEM_SECURITY
* privilege. We must ensure that the security access-checking
* API has the actual token whose security privilege we have enabled.
* AccessCheckAndAuditAlarm is no good for this, because it opens
* the client's token again, which may not have the privilege enabled.
*/
AccessCheckOK = AccessCheck( pSecurityDescriptor,
ClientToken,
MappedDesiredAccess,
&GenericMapping[ObjectType],
pPrivilegeSet,
&PrivilegeSetBufferLength,
&GrantedAccess,
&AccessStatus );
if (!AccessCheckOK) {
if (GetLastError() == ERROR_NO_IMPERSONATION_TOKEN) {
DBGMSG(DBG_TRACE, ("No impersonation token. Access will be granted.\n"));
HackForNoImpersonationToken = TRUE;
dwRetCode = ERROR_SUCCESS;
GrantedAccess = MappedDesiredAccess;
} else {
dwRetCode = GetLastError();
}
pPrivilegeSet = NULL;
} else {
if (!AccessStatus) {
dwRetCode = GetLastError();
}
}
OK = ObjectOpenAuditAlarm( szSpooler,
ObjectHandle,
ObjectTypeName[ObjectType],
pObjectName,
pSecurityDescriptor,
ClientToken,
MappedDesiredAccess,
GrantedAccess,
pPrivilegeSet,
FALSE, /* No new object creation */
AccessStatus,
pGenerateOnClose );
if( MappedDesiredAccess & ACCESS_SYSTEM_SECURITY )
ResetRequiredPrivileges( ClientToken,
pPreviousTokenPrivileges,
PreviousTokenPrivilegesLength );
if( !pSpool )
ObjectCloseAuditAlarm( szSpooler, ObjectHandle, *pGenerateOnClose );
//
// Allowing power users to install printer drivers or other dlls into the
// trusted component base is a security hole. We now require that administrators
// and power users have the load driver privilege present in the token in order
// to be able to preform administrative tasks on the spooler. See bug 352856
// for more details.
//
if (AccessCheckOK &&
AccessStatus &&
ObjectType == SPOOLER_OBJECT_SERVER &&
GrantedAccess & SERVER_ACCESS_ADMINISTER)
{
BOOL bPrivPresent;
DWORD Attributes;
dwRetCode = CheckPrivilegePresent(ClientToken,
&gLoadDriverPrivilegeLuid,
&bPrivPresent,
&Attributes);
if (dwRetCode == ERROR_SUCCESS)
{
//
// The reason why we check if the load driver privilege is present and
// not present AND enabled is the following. Let's assume you have been
// granted the privilege to load drivers.
// When you logon on interactively SeLoadDriverPrivilege is enabled.
// When you logon on via the secondary logon (runas which calls
// CreateProcessWithLogonW) then the privilege is disabled. We do not want
// to have inconsistent behavior regarding administering the spooler server.
//
if (!bPrivPresent)
{
//
// The caller has been granted SERVER_ACCESS_ADMINISTER permission but
// the caller doesn't have the privilege to load drivers. We do not
// grant the desired access in this case.
//
GrantedAccess = 0;
AccessStatus = FALSE;
dwRetCode = ERROR_ACCESS_DENIED;
}
}
else
{
//
// We cannot determine if the privilege is held, so we need to fail
// the AccessCheck function.
//
GrantedAccess = 0;
AccessCheckOK = FALSE;
dwRetCode = GetLastError();
}
}
CloseHandle (ClientToken);
if( pGrantedAccess )
*pGrantedAccess = GrantedAccess;
//
// we do the setlasterror here because we may have failed the AccessCheck
// or we succeeded but are denied access but the ObjectOpenAuditAlarm went
// thru smoothly and now there is no error code to return on the function
// so we specify the dwRetCode if we did fail.
//
if (!AccessCheckOK || !AccessStatus) {
SetLastError(dwRetCode);
}
return ( ( OK && AccessCheckOK && AccessStatus ) || HackForNoImpersonationToken );
}
/* AccessGranted
*
* Checks whether the desired access is granted, by comparing the GrantedAccess
* mask pointed to by pSpool.
*
* Parameters
*
* ObjectType - SPOOLER_OBJECT_* value, which is an index into the global
* mapping for spooler objects. This will not be SPOOLER_OBJECT_DOCUMENT,
* since we don't have document handles. It could potentially be
* SPOOLER_OBJECT_SERVER.
*
* DesiredAccess - The type of access requested.
*
* pSpool - A pointer to the SPOOL structure
*
* Returns
*
* TRUE - Access is granted
* FALSE - Access is not granted
*/
BOOL
AccessGranted(
DWORD ObjectType,
ACCESS_MASK DesiredAccess,
PSPOOL pSpool
)
{
if ( (pSpool->pIniSpooler->SpoolerFlags & SPL_SECURITY_CHECK) == FALSE ) return TRUE;
MapGenericMask( &DesiredAccess,
&GenericMapping[ObjectType] );
return AreAllAccessesGranted( pSpool->GrantedAccess, DesiredAccess );
}
// Stolen from windows\base\username.c
// !!! Must close the handle that is returned
BOOL
GetTokenHandle(
PHANDLE pTokenHandle
)
{
if (!OpenThreadToken(GetCurrentThread(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
TRUE,
pTokenHandle)) {
if (GetLastError() == ERROR_NO_TOKEN) {
// This means we are not impersonating anybody.
// Instead, lets get the token out of the process.
if (!OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
pTokenHandle)) {
return FALSE;
}
} else
return FALSE;
}
return TRUE;
}
VOID MapGenericToSpecificAccess(
DWORD ObjectType,
DWORD GenericAccess,
PDWORD pSpecificAccess
)
{
*pSpecificAccess = GenericAccess;
MapGenericMask( pSpecificAccess,
&GenericMapping[ObjectType] );
}
/* GetSecurityInformation
*
* Fills in the security information with a mask specifying the contents
* of the security descriptor.
*
* Parameters
*
* pSecurityDescriptor - A pointer to a security descriptor
* that the caller wishes to set. This may be NULL.
*
* pSecurityInformation - A pointer to a buffer to receive
* the security information flags.
*
*
* Warning: This is an egregious hack.
* We need to find out what is being set so we can verify the caller
* has the required privileges.
* There's no way an app like Print Manager can tell us what bits
* of the security descriptor it wants to set.
*
* The following flags may be set:
*
* OWNER_SECURITY_INFORMATION
* GROUP_SECURITY_INFORMATION
* DACL_SECURITY_INFORMATION
* SACL_SECURITY_INFORMATION
*
* Returns
*
* TRUE - No errors occurred
* FALSE - An error occurred
*
*/
BOOL
GetSecurityInformation(
PSECURITY_DESCRIPTOR pSecurityDescriptor,
PSECURITY_INFORMATION pSecurityInformation
)
{
SECURITY_INFORMATION SecurityInformation = 0;
BOOL Defaulted;
PSID pSidOwner;
PSID pSidGroup;
BOOL DaclPresent;
PACL pDacl;
BOOL SaclPresent;
PACL pSacl;
BOOL rc = TRUE;
if( pSecurityDescriptor
&& IsValidSecurityDescriptor( pSecurityDescriptor ) )
{
if( GetSecurityDescriptorOwner( pSecurityDescriptor, &pSidOwner, &Defaulted )
&& GetSecurityDescriptorGroup( pSecurityDescriptor, &pSidGroup, &Defaulted )
&& GetSecurityDescriptorDacl( pSecurityDescriptor, &DaclPresent, &pDacl, &Defaulted )
&& GetSecurityDescriptorSacl( pSecurityDescriptor, &SaclPresent, &pSacl, &Defaulted ) )
{
if( pSidOwner )
SecurityInformation |= OWNER_SECURITY_INFORMATION;
if( pSidGroup )
SecurityInformation |= GROUP_SECURITY_INFORMATION;
if( DaclPresent )
SecurityInformation |= DACL_SECURITY_INFORMATION;
if( SaclPresent )
SecurityInformation |= SACL_SECURITY_INFORMATION;
}
else
rc = FALSE;
}else {
DBGMSG(DBG_TRACE, ("Either NULL pSecurityDescriptor or !IsValidSecurityDescriptor %.8x\n", pSecurityDescriptor));
rc = FALSE;
}
DBGMSG( DBG_TRACE, ("GetSecurityInformation returns %d with SecurityInformation = %08x\n", rc, SecurityInformation) );
*pSecurityInformation = SecurityInformation;
return rc;
}
/* GetPrivilegeRequired
*
* Returns a mask containing the privileges required to set the specified
* security information.
*
* Parameter
*
* SecurityInformation - Flags specifying the security information
* that the caller wishes to set. This may be 0.
*
* Returns
*
* An access mask specifying the privileges required.
*
*/
ACCESS_MASK
GetPrivilegeRequired(
SECURITY_INFORMATION SecurityInformation
)
{
ACCESS_MASK PrivilegeRequired = 0;
if( SecurityInformation & OWNER_SECURITY_INFORMATION )
PrivilegeRequired |= WRITE_OWNER;
if( SecurityInformation & GROUP_SECURITY_INFORMATION )
PrivilegeRequired |= WRITE_OWNER;
if( SecurityInformation & DACL_SECURITY_INFORMATION )
PrivilegeRequired |= WRITE_DAC;
if( SecurityInformation & SACL_SECURITY_INFORMATION )
PrivilegeRequired |= ACCESS_SYSTEM_SECURITY;
return PrivilegeRequired;
}
/* BuildPartialSecurityDescriptor
*
* Creates a copy of the source security descriptor, omitting those
* parts of the descriptor which the AccessGranted mask doesn't give
* read access to.
*
* Parameters
*
* AccessMask - Defines the permissions held by the client.
* This may include READ_CONTROL or ACCESS_SYSTEM_SECURITY.
*
* pSourceSecurityDescriptor - A pointer to the security descriptor
* upon which the partial security descriptor will be based.
* Its Owner, Group, DACL and SACL will be copied appropriately,
*
* ppPartialSecurityDescriptor - A pointer to a variable which
* will receive the address of the newly created descriptor.
* If the AccessMask parameter contains neither READ_CONTROL
* nor ACCESS_SYSTEM_SECURITY, the descriptor will be empty.
* The descriptor will be in self-relative format, and must
* be freed by the caller using FreeSplMem().
*
* pPartialSecurityDescriptorLength - A pointer to a variable
* to receive the length of the security descriptor.
* This should be passed as the second parameter to FreeSplMem()
* when the descriptor is freed.
*
* Returns
*
* TRUE - No error was detected
* FALSE - An error was detected
*
*/
BOOL
BuildPartialSecurityDescriptor(
ACCESS_MASK AccessGranted,
PSECURITY_DESCRIPTOR pSourceSecurityDescriptor,
PSECURITY_DESCRIPTOR *ppPartialSecurityDescriptor,
PDWORD pPartialSecurityDescriptorLength
)
{
SECURITY_DESCRIPTOR AbsolutePartialSecurityDescriptor;
BOOL Defaulted = FALSE;
PSID pOwnerSid = NULL;
PSID pGroupSid = NULL;
BOOL DaclPresent = FALSE;
PACL pDacl = NULL;
BOOL SaclPresent = FALSE;
PACL pSacl = NULL;
BOOL ErrorOccurred = FALSE;
DWORD Length = 0;
PSECURITY_DESCRIPTOR pSelfRelativePartialSecurityDescriptor = NULL;
/* When we've initialized the security descriptor,
* it will have no owner, no primary group, no DACL and no SACL:
*/
if( InitializeSecurityDescriptor( &AbsolutePartialSecurityDescriptor,
SECURITY_DESCRIPTOR_REVISION1 ) )
{
/* If the caller has READ_CONTROL permission,
* set the Owner, Group and DACL:
*/
if( AreAllAccessesGranted( AccessGranted, READ_CONTROL ) )
{
if( GetSecurityDescriptorOwner( pSourceSecurityDescriptor,
&pOwnerSid, &Defaulted ) )
SetSecurityDescriptorOwner( &AbsolutePartialSecurityDescriptor,
pOwnerSid, Defaulted );
else
ErrorOccurred = TRUE;
if( GetSecurityDescriptorGroup( pSourceSecurityDescriptor,
&pGroupSid, &Defaulted ) )
SetSecurityDescriptorGroup( &AbsolutePartialSecurityDescriptor,
pGroupSid, Defaulted );
else
ErrorOccurred = TRUE;
if( GetSecurityDescriptorDacl( pSourceSecurityDescriptor,
&DaclPresent, &pDacl, &Defaulted ) )
SetSecurityDescriptorDacl( &AbsolutePartialSecurityDescriptor,
DaclPresent, pDacl, Defaulted );
else
ErrorOccurred = TRUE;
}
/* If the caller has ACCESS_SYSTEM_SECURITY permission,
* set the SACL:
*/
if( AreAllAccessesGranted( AccessGranted, ACCESS_SYSTEM_SECURITY ) )
{
if( GetSecurityDescriptorSacl( pSourceSecurityDescriptor,
&SaclPresent, &pSacl, &Defaulted ) )
SetSecurityDescriptorSacl( &AbsolutePartialSecurityDescriptor,
SaclPresent, pSacl, Defaulted );
else
ErrorOccurred = TRUE;
}
if( !ErrorOccurred )
{
Length = 0;
if( !MakeSelfRelativeSD( &AbsolutePartialSecurityDescriptor,
pSelfRelativePartialSecurityDescriptor,
&Length ) )
{
if( GetLastError( ) == ERROR_INSUFFICIENT_BUFFER )
{
pSelfRelativePartialSecurityDescriptor = AllocSplMem( Length );
if( !pSelfRelativePartialSecurityDescriptor
|| !MakeSelfRelativeSD( &AbsolutePartialSecurityDescriptor,
pSelfRelativePartialSecurityDescriptor,
&Length ) )
{
ErrorOccurred = TRUE;
}
}
else
{
ErrorOccurred = TRUE;
DBGMSG(DBG_WARNING, ("MakeSelfRelativeSD failed: Error %d\n",
GetLastError()));
}
}
else
{
DBGMSG(DBG_WARNING, ("Expected MakeSelfRelativeSD to fail!\n"));
}
}
}
else
ErrorOccurred = TRUE;
if( !ErrorOccurred )
{
*ppPartialSecurityDescriptor = pSelfRelativePartialSecurityDescriptor;
*pPartialSecurityDescriptorLength = Length;
}
return !ErrorOccurred;
}
BOOL
SetRequiredPrivileges(
IN HANDLE TokenHandle,
OUT PTOKEN_PRIVILEGES *ppPreviousTokenPrivileges,
OUT PDWORD pPreviousTokenPrivilegesLength
)
/*++
Routine Description:
Arguments:
TokenHandle - A token associated with the current thread or process
ppPreviousTokenPrivileges - This will be filled with the address of the
buffer allocated to hold the previously existing privileges for this
process or thread.
pPreviousTokenPrivilegesLength - This will be filled with the length of the
buffer allocated.
Return Value:
TRUE if successful.
--*/
{
/* Make enough room for TOKEN_PRIVILEGES with an array of 2 Privileges
* (there's 1 by default):
*/
#define PRIV_SECURITY 0
#define PRIV_COUNT 1
LUID SecurityValue;
BYTE TokenPrivilegesBuffer[ sizeof( TOKEN_PRIVILEGES ) +
( ( PRIV_COUNT - 1 ) *
sizeof( LUID_AND_ATTRIBUTES ) ) ];
PTOKEN_PRIVILEGES pTokenPrivileges;
DWORD FirstTryBufferLength = 256;
DWORD BytesNeeded;
//
// First, assert Audit privilege
//
memset( &SecurityValue, 0, sizeof SecurityValue );
if( !LookupPrivilegeValue( NULL, SE_SECURITY_NAME, &SecurityValue ) )
{
DBGMSG( DBG_WARNING,
( "LookupPrivilegeValue failed: Error %d\n", GetLastError( ) ) );
return FALSE;
}
/* Allocate a buffer of a reasonable length to hold the current privileges,
* so we can restore them later:
*/
*pPreviousTokenPrivilegesLength = FirstTryBufferLength;
if( !( *ppPreviousTokenPrivileges = AllocSplMem( FirstTryBufferLength ) ) )
return FALSE;
memset( &TokenPrivilegesBuffer, 0, sizeof TokenPrivilegesBuffer );
pTokenPrivileges = (PTOKEN_PRIVILEGES)&TokenPrivilegesBuffer;
/*
* Set up the privilege set we will need
*/
pTokenPrivileges->PrivilegeCount = PRIV_COUNT;
pTokenPrivileges->Privileges[PRIV_SECURITY].Luid = SecurityValue;
pTokenPrivileges->Privileges[PRIV_SECURITY].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges( TokenHandle,
FALSE,
pTokenPrivileges,
*pPreviousTokenPrivilegesLength,
*ppPreviousTokenPrivileges,
&BytesNeeded )) {
if( GetLastError() == ERROR_INSUFFICIENT_BUFFER )
{
*pPreviousTokenPrivilegesLength = BytesNeeded;
*ppPreviousTokenPrivileges = ReallocSplMem(
*ppPreviousTokenPrivileges,
0,
*pPreviousTokenPrivilegesLength );
if( *ppPreviousTokenPrivileges )
{
if (!AdjustTokenPrivileges( TokenHandle,
FALSE,
pTokenPrivileges,
*pPreviousTokenPrivilegesLength,
*ppPreviousTokenPrivileges,
&BytesNeeded )) {
DBGMSG( DBG_WARNING, ("AdjustTokenPrivileges failed: Error %d\n", GetLastError()));
goto Fail;
}
}
else
{
*pPreviousTokenPrivilegesLength = 0;
goto Fail;
}
}
else
{
DBGMSG( DBG_WARNING, ("AdjustTokenPrivileges failed: Error %d\n", GetLastError()));
goto Fail;
}
}
return TRUE;
Fail:
if (*ppPreviousTokenPrivileges) {
FreeSplMem(*ppPreviousTokenPrivileges);
}
return FALSE;
}
BOOL
ResetRequiredPrivileges(
IN HANDLE TokenHandle,
IN PTOKEN_PRIVILEGES pPreviousTokenPrivileges,
IN DWORD PreviousTokenPrivilegesLength
)
/*++
Routine Description:
Arguments:
TokenHandle - A token associated with the current thread or process
pPreviousTokenPrivileges - The address of the buffer holding the previous
privileges to be reinstated.
PreviousTokenPrivilegesLength - Length of the buffer for deallocation.
Return Value:
TRUE if successful.
--*/
{
BOOL OK;
OK = AdjustTokenPrivileges ( TokenHandle,
FALSE,
pPreviousTokenPrivileges,
0,
NULL,
NULL );
FreeSplMem( pPreviousTokenPrivileges );
return OK;
}
/* CreateEverybodySecurityDescriptor
*
* Creates a security descriptor giving everyone access
*
* Arguments: None
*
* Return: The security descriptor returned by BuildPrintObjectProtection.
*
*/
#undef MAX_ACE
#define MAX_ACE 5
#define DBGCHK( Condition, ErrorInfo ) \
if( Condition ) DBGMSG( DBG_WARNING, ErrorInfo )
PSECURITY_DESCRIPTOR
CreateEverybodySecurityDescriptor(
VOID
)
{
UCHAR AceType[MAX_ACE];
PSID AceSid[MAX_ACE]; // Don't expect more than MAX_ACE ACEs in any of these.
DWORD AceCount;
//
// For Code optimization we replace 5 individaul
// SID_IDENTIFIER_AUTHORITY with an array of
// SID_IDENTIFIER_AUTHORITYs
// where
// SidAuthority[0] = UserSidAuthority
// SidAuthority[1] = PowerSidAuthority
// SidAuthority[2] = CreatorSidAuthority
// SidAuthority[3] = SystemSidAuthority
// SidAuthority[4] = AdminSidAuthority
//
SID_IDENTIFIER_AUTHORITY SidAuthority[MAX_ACE] = {
SECURITY_NT_AUTHORITY,
SECURITY_NT_AUTHORITY,
SECURITY_CREATOR_SID_AUTHORITY,
SECURITY_NT_AUTHORITY,
SECURITY_NT_AUTHORITY
};
//
// For code optimization we replace 5 individual Sids with
// an array of Sids
// where
// Sid[0] = UserSid
// Sid[1] = PowerSid
// Sid[2] = CreatorSid
// Sid[3] = SystemSid
// Sid[4] = AdminSid
//
PSID Sids[MAX_ACE] = {NULL,NULL,NULL,NULL,NULL};
//
// Access masks corresponding to Sids
//
ACCESS_MASK AceMask[MAX_ACE] = {
(FILE_GENERIC_EXECUTE | SYNCHRONIZE | FILE_GENERIC_WRITE | FILE_GENERIC_READ) &
~READ_CONTROL & ~FILE_WRITE_ATTRIBUTES &
~FILE_WRITE_EA&~FILE_READ_DATA&~FILE_LIST_DIRECTORY ,
(FILE_GENERIC_EXECUTE | SYNCHRONIZE | FILE_GENERIC_WRITE | FILE_GENERIC_READ) &
~READ_CONTROL & ~FILE_WRITE_ATTRIBUTES &
~FILE_WRITE_EA&~FILE_READ_DATA&~FILE_LIST_DIRECTORY ,
STANDARD_RIGHTS_ALL | FILE_GENERIC_EXECUTE | FILE_GENERIC_WRITE |
FILE_GENERIC_READ | FILE_ALL_ACCESS ,
STANDARD_RIGHTS_ALL | FILE_GENERIC_EXECUTE | FILE_GENERIC_WRITE |
FILE_GENERIC_READ | FILE_ALL_ACCESS ,
STANDARD_RIGHTS_ALL | FILE_GENERIC_EXECUTE | FILE_GENERIC_WRITE |
FILE_GENERIC_READ | FILE_ALL_ACCESS ,
};
//
// SubAuthorities leading to the proper Group
//
DWORD SubAuthorities[3*MAX_ACE] = {
2 , SECURITY_BUILTIN_DOMAIN_RID , DOMAIN_ALIAS_RID_USERS ,
2 , SECURITY_BUILTIN_DOMAIN_RID , DOMAIN_ALIAS_RID_POWER_USERS ,
1 , SECURITY_CREATOR_OWNER_RID , 0 ,
1 , SECURITY_LOCAL_SYSTEM_RID , 0 ,
2 , SECURITY_BUILTIN_DOMAIN_RID , DOMAIN_ALIAS_RID_ADMINS
};
//
// CONTAINER_INHERIT_ACE -> This folder and subfolders
// OBJECT_INHERIT_ACE -> Files
//
BYTE InheritFlags[MAX_ACE] = {
CONTAINER_INHERIT_ACE,
CONTAINER_INHERIT_ACE,
CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE,
CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE,
CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE
};
PSECURITY_DESCRIPTOR ServerSD = NULL;
//
// Printer SD
//
for(AceCount = 0;
( (AceCount < MAX_ACE) &&
AllocateAndInitializeSid(&SidAuthority[AceCount],
(BYTE)SubAuthorities[AceCount*3],
SubAuthorities[AceCount*3+1],
SubAuthorities[AceCount*3+2],
0, 0, 0, 0, 0, 0,
&Sids[AceCount]));
AceCount++)
{
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = Sids[AceCount];
}
if(AceCount == MAX_ACE)
{
if(!BuildPrintObjectProtection( AceType,
AceCount,
AceSid,
AceMask,
InheritFlags,
NULL,
NULL,
NULL,
&ServerSD ) )
{
DBGMSG( DBG_WARNING,( "Couldn't buidl Print Object protection" ) );
ServerSD = NULL;
}
}
else
{
DBGMSG( DBG_WARNING,( "Couldn't Allocate and initialize SIDs" ) );
}
for(AceCount=0;AceCount<MAX_ACE;AceCount++)
{
if(Sids[AceCount])
FreeSid( Sids[AceCount] );
}
return ServerSD;
}
/* CreateDriversShareSecurityDescriptor
*
* Creates a security descriptor for the drivers$ share.
* This reflects the security descriptor applied to the print server,
* in that Everyone is given GENERIC_READ | GENERIC_EXECUTE,
* and everyone with SERVER_ACCESS_ADMINISTER (Administrators,
* Power Users etc.) is given GENERIC_ALL access to the share,
*
* If in future releases we support changes to the print server
* security descriptor (e.g. allowing the ability to deny
* SERVER_ACCESS_ENUMERATE), this routine will have to become more
* sophisticated, as the access to the share will probably need
* to be modified accordingly.
*
* Arguments: None
*
* Return: The security descriptor returned by BuildPrintObjectProtection.
*
*/
#undef MAX_ACE
#define MAX_ACE 20
#define DBGCHK( Condition, ErrorInfo ) \
if( Condition ) DBGMSG( DBG_WARNING, ErrorInfo )
PSECURITY_DESCRIPTOR
CreateDriversShareSecurityDescriptor(
VOID
)
{
DWORD ObjectType = SPOOLER_OBJECT_SERVER;
NT_PRODUCT_TYPE NtProductType;
PSID AceSid[MAX_ACE]; // Don't expect more than MAX_ACE ACEs in any of these.
ACCESS_MASK AceMask[MAX_ACE]; // Access masks corresponding to Sids
BYTE InheritFlags[MAX_ACE]; //
UCHAR AceType[MAX_ACE];
DWORD AceCount;
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
SID_IDENTIFIER_AUTHORITY WorldSidAuthority = SECURITY_WORLD_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY CreatorSidAuthority = SECURITY_CREATOR_SID_AUTHORITY;
PSID WorldSid = NULL;
PSID AdminsAliasSid = NULL;
PSID PrintOpsAliasSid = NULL;
PSID SystemOpsAliasSid = NULL;
PSID PowerUsersAliasSid = NULL;
PSID CreatorOwnerSid = NULL;
PSECURITY_DESCRIPTOR pDriversShareSD = NULL;
BOOL OK;
//
// Printer SD
//
AceCount = 0;
/* Creator-Owner SID: */
OK = AllocateAndInitializeSid( &CreatorSidAuthority, 1,
SECURITY_CREATOR_OWNER_RID,
0, 0, 0, 0, 0, 0, 0,
&CreatorOwnerSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
/* World SID */
OK = AllocateAndInitializeSid( &WorldSidAuthority, 1,
SECURITY_WORLD_RID,
0, 0, 0, 0, 0, 0, 0,
&WorldSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = WorldSid;
AceMask[AceCount] = GENERIC_READ | GENERIC_EXECUTE;
InheritFlags[AceCount] = 0;
AceCount++;
/* Admins alias SID */
OK = AllocateAndInitializeSid( &NtAuthority, 2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_ADMINS,
0, 0, 0, 0, 0, 0,
&AdminsAliasSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = AdminsAliasSid;
AceMask[AceCount] = GENERIC_ALL;
InheritFlags[AceCount] = 0;
AceCount++;
OK = RtlGetNtProductType( &NtProductType );
DBGCHK( !OK, ( "Couldn't get product type" ) );
if (NtProductType == NtProductLanManNt) {
/* Print Ops alias SID */
OK = AllocateAndInitializeSid( &NtAuthority, 2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_PRINT_OPS,
0, 0, 0, 0, 0, 0,
&PrintOpsAliasSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = PrintOpsAliasSid;
AceMask[AceCount] = GENERIC_ALL;
InheritFlags[AceCount] = 0;
AceCount++;
/* System Ops alias SID */
OK = AllocateAndInitializeSid( &NtAuthority, 2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_SYSTEM_OPS,
0, 0, 0, 0, 0, 0,
&SystemOpsAliasSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = SystemOpsAliasSid;
AceMask[AceCount] = GENERIC_ALL;
InheritFlags[AceCount] = 0;
AceCount++;
} else {
//
// LanManNT product
//
OK = AllocateAndInitializeSid( &NtAuthority, 2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_POWER_USERS,
0, 0, 0, 0, 0, 0,
&PowerUsersAliasSid );
DBGCHK( !OK, ( "Couldn't Allocate and initialize SID" ) );
if ( !OK ) {
goto CleanUp;
}
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = PowerUsersAliasSid;
AceMask[AceCount] = GENERIC_ALL;
InheritFlags[AceCount] = 0;
AceCount++;
}
DBGCHK( ( AceCount > MAX_ACE ), ( "ACE count exceeded" ) );
OK = BuildPrintObjectProtection( AceType,
AceCount,
AceSid,
AceMask,
InheritFlags,
AdminsAliasSid,
AdminsAliasSid,
&GenericMapping[ObjectType],
&pDriversShareSD );
CleanUp:
if (WorldSid) {
FreeSid( WorldSid );
}
if (AdminsAliasSid) {
FreeSid( AdminsAliasSid );
}
if (CreatorOwnerSid) {
FreeSid( CreatorOwnerSid );
}
if (PrintOpsAliasSid) {
FreeSid( PrintOpsAliasSid );
}
if (SystemOpsAliasSid) {
FreeSid( SystemOpsAliasSid );
}
if (PowerUsersAliasSid) {
FreeSid( PowerUsersAliasSid );
}
return pDriversShareSD;
}
#if DBG
VOID
DumpAcl(
IN PACL Acl
)
/*++
Routine Description:
This routine dumps via (NetpDbgPrint) an Acl for debug purposes. It is
specialized to dump standard aces.
Arguments:
Acl - Supplies the Acl to dump
Return Value:
None
--*/
{
DWORD i;
PSTANDARD_ACE Ace;
if( MODULE_DEBUG & DBG_SECURITY ) {
DBGMSG( DBG_SECURITY, ( " DumpAcl @%08lx\n", Acl ));
//
// Check if the Acl is null
//
if (Acl == NULL) {
return;
}
//
// Dump the Acl header
//
DBGMSG( DBG_SECURITY,
( " Revision: %02x, Size: %04x, AceCount: %04x\n",
Acl->AclRevision, Acl->AclSize, Acl->AceCount ));
//
// Now for each Ace we want do dump it
//
for (i = 0, Ace = FirstAce(Acl);
i < Acl->AceCount;
i++, Ace = NextAce(Ace) ) {
//
// print out the ace header
//
DBGMSG( DBG_SECURITY, ( " AceHeader: %08lx\n", *(PDWORD)Ace ));
//
// special case on the standard ace types
//
if ((Ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE) ||
(Ace->Header.AceType == ACCESS_DENIED_ACE_TYPE) ||
(Ace->Header.AceType == SYSTEM_AUDIT_ACE_TYPE) ||
(Ace->Header.AceType == SYSTEM_ALARM_ACE_TYPE)) {
//
// The following array is indexed by ace types and must
// follow the allowed, denied, audit, alarm seqeuence
//
static LPSTR AceTypes[] = { "Access Allowed",
"Access Denied ",
"System Audit ",
"System Alarm "
};
DBGMSG( DBG_SECURITY,
( " %s Access Mask: %08lx\n",
AceTypes[Ace->Header.AceType], Ace->Mask ));
} else {
DBGMSG( DBG_SECURITY, (" Unknown Ace Type\n" ));
}
DBGMSG( DBG_SECURITY,
( " AceSize = %d\n AceFlags = ", Ace->Header.AceSize ));
if (Ace->Header.AceFlags & OBJECT_INHERIT_ACE) {
DBGMSG( DBG_SECURITY, ( " OBJECT_INHERIT_ACE\n" ));
DBGMSG( DBG_SECURITY, ( " " ));
}
if (Ace->Header.AceFlags & CONTAINER_INHERIT_ACE) {
DBGMSG( DBG_SECURITY, ( " CONTAINER_INHERIT_ACE\n" ));
DBGMSG( DBG_SECURITY, ( " " ));
}
if (Ace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE) {
DBGMSG( DBG_SECURITY, ( " NO_PROPAGATE_INHERIT_ACE\n" ));
DBGMSG( DBG_SECURITY, ( " " ));
}
if (Ace->Header.AceFlags & INHERIT_ONLY_ACE) {
DBGMSG( DBG_SECURITY, ( " INHERIT_ONLY_ACE\n" ));
DBGMSG( DBG_SECURITY, ( " " ));
}
if (Ace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG) {
DBGMSG( DBG_SECURITY, ( " SUCCESSFUL_ACCESS_ACE_FLAG\n" ));
DBGMSG( DBG_SECURITY, ( " " ));
}
if (Ace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG) {
DBGMSG( DBG_SECURITY, ( " FAILED_ACCESS_ACE_FLAG\n" ));
DBGMSG( DBG_SECURITY, ( " " ));
}
DBGMSG( DBG_SECURITY, ( "\n" ));
}
}
}
#endif // if DBG
/*++
Routine Name
BuildJobOwnerSecurityDescriptor
Routine Description:
This routine builds a SD that will be passed as CreatorDescriptor argument to
CreatePrivateObjectSecurityEx. The SD on any new job will be created using
the SD returned by this function and will inherit from the SD from the print
queue.
BuildJobOwnerSecurityDescriptor --> SD Print queue SD
\ /
\ / Inheritance
\ /
Job SD
The SD created in this function will have as owner the user from the
hToken argument. (The user impersonated by the thread from where we have the
hToken). The ACL grants full access on the job to the local system.
The reason why we need this special SD is the following. If you remove the
creatorowner from the print queue SD and no user has manage docs permissions
CreatePrivateObjectSecurity won't find any inheritable ACEs in the parent.
Thus it grants full permissions to the owner and to the local system. This
leads to a random behavior where according to the UI the user should not be
able to manage his docs, but the SD on the job will grant manage docs rights.
We don't want that. We want the local system to have full privileges on the job
and the user who submitted the job should be granted permissions only if:
- the user has manage doc rights
- creator owner is present in the print queue SD
Arguments:
hToken - impersonation token of the user who creates a new job
ppSD - pointer to recieve SD
Return Value:
Win32 error code
--*/
BOOL
BuildJobOwnerSecurityDescriptor(
IN HANDLE hToken,
OUT PSECURITY_DESCRIPTOR *ppSD
)
{
DWORD Error = ERROR_INVALID_PARAMETER;
if (hToken && ppSD)
{
PVOID pUserInfo = NULL;
DWORD cbUserInfo = 0;
//
// Get the owner from the thread token
//
Error = GetTokenInformation(hToken,
TokenUser,
NULL,
0,
&cbUserInfo) ? ERROR_SUCCESS : GetLastError();
//
// Allocate buffer and try getting the owner again
//
if (Error == ERROR_INSUFFICIENT_BUFFER)
{
if (pUserInfo = AllocSplMem(cbUserInfo))
{
Error = GetTokenInformation(hToken,
TokenUser,
pUserInfo,
cbUserInfo,
&cbUserInfo) ? ERROR_SUCCESS : GetLastError();
}
else
{
Error = GetLastError();
}
}
//
// Build the SD. We grant read control to the owner of the job
//
if (Error == ERROR_SUCCESS)
{
DWORD ObjectType = SPOOLER_OBJECT_DOCUMENT;
PSID AceSid[2];
ACCESS_MASK AceMask[2];
BYTE InheritFlags[2];
UCHAR AceType[2];
DWORD AceCount = 0;
PSID pUserSid;
pUserSid = ((((TOKEN_USER *)pUserInfo)->User)).Sid;
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = ((((TOKEN_USER *)pUserInfo)->User)).Sid;
AceMask[AceCount] = JOB_READ;
InheritFlags[AceCount] = 0;
AceCount++;
AceType[AceCount] = ACCESS_ALLOWED_ACE_TYPE;
AceSid[AceCount] = pLocalSystemSid;
AceMask[AceCount] = JOB_ALL_ACCESS;
InheritFlags[AceCount] = 0;
AceCount++;
Error = BuildPrintObjectProtection(AceType,
AceCount,
AceSid,
AceMask,
InheritFlags,
pUserSid,
NULL,
&GenericMapping[ObjectType],
ppSD) ? ERROR_SUCCESS : GetLastError();
}
FreeSplMem(pUserInfo);
}
SetLastError(Error);
return Error == ERROR_SUCCESS;
}
/*++
Routine Name
DestroyJobOwnerSecurityDescriptor
Routine Description:
This routine frees a SD allocated by CreatejobOwnerSecurityDescriptor
Arguments:
pSD - pointer to SD
Return Value:
None
--*/
VOID
DestroyJobOwnerSecurityDescriptor(
IN PSECURITY_DESCRIPTOR pSD
)
{
if (pSD)
{
LocalFree(pSD);
}
}
/*++
Routine Name
InitializeSecurityStructures
Routine Description:
This routine initializes security structures.
Arguments:
None
Return Value:
TRUE - function succeeded
FALSE - function failed, GetLastError() returns the reason
--*/
BOOL
InitializeSecurityStructures(
VOID
)
{
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
return !!CreateServerSecurityDescriptor() &&
LookupPrivilegeValue(NULL,
SE_LOAD_DRIVER_NAME,
&gLoadDriverPrivilegeLuid) &&
AllocateAndInitializeSid(&NtAuthority,
1,
SECURITY_LOCAL_SYSTEM_RID,
0, 0, 0, 0, 0, 0, 0,
&pLocalSystemSid) &&
AllocateAndInitializeSid(&NtAuthority,
1,
SECURITY_NETWORK_RID,
0, 0, 0, 0, 0, 0, 0,
&pNetworkLogonSid) &&
AllocateAndInitializeSid(&NtAuthority,
2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_GUESTS,
0, 0, 0, 0, 0, 0,
&pGuestsSid);
}
/*++
Routine Name
PrincipalIsRemoteGuest
Routine Description:
This routine checks whether remote guest is present in a token.
Remote guest = network + guest
Arguments:
hToken - handle to token, NULL is ok (see CheckTokenMemberShip)
pbRemoteGuest - pointer to receive BOOL. true means remote guest
Return Value:
ERROR_SUCCESS - pbRemoteGuest is reliable
other win32 error code, do not use pbRemoteGuest
--*/
DWORD
PrincipalIsRemoteGuest(
IN HANDLE hToken,
OUT BOOL *pbRemoteGuest
)
{
DWORD Error = ERROR_INVALID_PARAMETER;
if (pbRemoteGuest)
{
BOOL bNetwork = FALSE;
BOOL bGuests = FALSE;
if (CheckTokenMembership(hToken, pNetworkLogonSid, &bNetwork) &&
CheckTokenMembership(hToken, pGuestsSid, &bGuests))
{
*pbRemoteGuest = bNetwork && bGuests;
Error = ERROR_SUCCESS;
}
else
{
*pbRemoteGuest = FALSE;
Error = GetLastError();
}
}
return Error;
}
/*++
Routine Name
CheckPrivilegePresent
Routine Description:
This routine checks if a certain privilege is present in a token
Arguments:
hToken - thread or process token
pLuid - pointer to luid for the privilege to be searched for
pbPresent - will be set to true is the privilege is present in the token
pAttributes - will be set to the attributes of the privilege. It is a mask
indicating if the privilege is disabled, enabled, enabled by
default.
Return Value:
ERROR_SUCCESS - the function executed successfully and the caller can use
pbPresent and pAttributes
other Win32 error
--*/
DWORD
CheckPrivilegePresent(
IN HANDLE hToken,
IN PLUID pLuid,
IN LPBOOL pbPresent,
IN LPDWORD pAttributes OPTIONAL
)
{
DWORD Error = ERROR_INVALID_PARAMETER;
PVOID pPrivInfo = NULL;
DWORD cbPrivInfo = kGuessTokenPrivileges;
if (pLuid && pbPresent)
{
*pbPresent = FALSE;
pPrivInfo = AllocSplMem(cbPrivInfo);
Error = pPrivInfo ? ERROR_SUCCESS : GetLastError();
if (Error == ERROR_SUCCESS)
{
Error = GetTokenInformation(hToken,
TokenPrivileges,
pPrivInfo,
cbPrivInfo,
&cbPrivInfo) ? ERROR_SUCCESS : GetLastError();
}
//
// Reallocate buffer and try getting the privileges
//
if (Error == ERROR_INSUFFICIENT_BUFFER)
{
FreeSplMem(pPrivInfo);
pPrivInfo = AllocSplMem(cbPrivInfo);
Error = pPrivInfo ? ERROR_SUCCESS : GetLastError();
if (Error == ERROR_SUCCESS)
{
Error = GetTokenInformation(hToken,
TokenPrivileges,
pPrivInfo,
cbPrivInfo,
&cbPrivInfo) ? ERROR_SUCCESS : GetLastError();
}
}
if (Error == ERROR_SUCCESS)
{
TOKEN_PRIVILEGES *pTokenPrivileges = (TOKEN_PRIVILEGES *)pPrivInfo;
DWORD uCount;
//
// Search the privilege in the list of privileges present in the token
//
for (uCount = 0; uCount < pTokenPrivileges->PrivilegeCount; uCount++)
{
if (pTokenPrivileges->Privileges[uCount].Luid.HighPart == pLuid->HighPart &&
pTokenPrivileges->Privileges[uCount].Luid.LowPart == pLuid->LowPart)
{
//
// We found the privilege
//
*pbPresent = TRUE;
if (pAttributes)
{
*pAttributes = pTokenPrivileges->Privileges[uCount].Attributes;
}
break;
}
}
}
FreeSplMem(pPrivInfo);
}
return Error;
}
Reference in a new issue Copy permalink