able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/termsrv/setup/dll/securd.cpp

1656 lines
45 KiB
C++
Raw Permalink Normal View History

Add source files
2020-09-26 03:20:57 -05:00
//+-------------------------------------------------------------------------
//
//
// Copyright (C) Microsoft
//
// File: securd.cpp
//
// History: 30-March-2000 a-skuzin Created
//
//--------------------------------------------------------------------------
#include "stdafx.h"
#include <winsta.h>
#include <regapi.h>
#include "secupgrd.h"
#include "state.h"
// from winnt.h
#define MAXDWORD 0xffffffff
//Global variables
BYTE g_DefaultSD[] = { 0x01,0x00,0x14,0x80,0x88,0x00,0x00,0x00,0x94,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x14,0x00,0x00,0x00,
0x02,0x00,0x74,0x00,0x05,0x00,0x00,0x00,0x00,0x00,
0x18,0x00,0xBF,0x03,0x0F,0x00,0x01,0x02,0x00,0x00,
0x00,0x00,0x00,0x05,0x20,0x00,0x00,0x00,0x20,0x02,
0x00,0x00,0x00,0x00,0x14,0x00,0xBF,0x03,0x0F,0x00,
0x01,0x01,0x00,0x00,0x00,0x00,0x00,0x05,0x12,0x00,
0x00,0x00,0x00,0x00,0x18,0x00,0xA1,0x01,0x00,0x00,
0x01,0x02,0x00,0x00,0x00,0x00,0x00,0x05,0x20,0x00,
0x00,0x00,0x2B,0x02,0x00,0x00,0x00,0x00,0x14,0x00,
0x81,0x00,0x00,0x00,0x01,0x01,0x00,0x00,0x00,0x00,
0x00,0x05,0x13,0x00,0x00,0x00,0x00,0x00,0x14,0x00,
0x81,0x00,0x00,0x00,0x01,0x01,0x00,0x00,0x00,0x00,
0x00,0x05,0x14,0x00,0x00,0x00,0x01,0x01,0x00,0x00,
0x00,0x00,0x00,0x05,0x12,0x00,0x00,0x00,0x01,0x01,
0x00,0x00,0x00,0x00,0x00,0x05,0x12,0x00,0x00,0x00 };
BYTE g_ConsoleSD[] = { 0x01,0x00,0x14,0x80,0x70,0x00,0x00,0x00,0x7C,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x14,0x00,0x00,0x00,
0x02,0x00,0x5C,0x00,0x04,0x00,0x00,0x00,0x00,0x00,
0x18,0x00,0xBF,0x03,0x0F,0x00,0x01,0x02,0x00,0x00,
0x00,0x00,0x00,0x05,0x20,0x00,0x00,0x00,0x20,0x02,
0x00,0x00,0x00,0x00,0x14,0x00,0x81,0x00,0x00,0x00,
0x01,0x01,0x00,0x00,0x00,0x00,0x00,0x05,0x13,0x00,
0x00,0x00,0x00,0x00,0x14,0x00,0x81,0x00,0x00,0x00,
0x01,0x01,0x00,0x00,0x00,0x00,0x00,0x05,0x14,0x00,
0x00,0x00,0x00,0x00,0x14,0x00,0xBF,0x03,0x0F,0x00,
0x01,0x01,0x00,0x00,0x00,0x00,0x00,0x05,0x12,0x00,
0x00,0x00,0x01,0x01,0x00,0x00,0x00,0x00,0x00,0x05,
0x12,0x00,0x00,0x00,0x01,0x01,0x00,0x00,0x00,0x00,
0x00,0x05,0x12,0x00,0x00,0x00 };
DWORD AreThereAnyCustomSecurityDescriptors( BOOL &any )
{
HKEY hKey;
DWORD err;
err=RegOpenKeyEx(
HKEY_LOCAL_MACHINE,
REG_WINSTATION_KEY,
0,
KEY_READ,
&hKey
);
if( err!=ERROR_SUCCESS )
{
LOGMESSAGE1(_T("Could not open TS key %d"),err);
return err;
}
CDefaultSD DefaultSD;
CDefaultSD ConsoleSD;
//Load default SD from the registry, since we need to compare to this
err = DefaultSD.Init(hKey,DefaultRDPSD);
if( err!=ERROR_SUCCESS )
{
RegCloseKey(hKey);
return err;
}
//Load default console SD from the registry, since we need to compare to this
err = ConsoleSD.Init(hKey,DefaultConsoleSD);
if( err!=ERROR_SUCCESS )
{
RegCloseKey(hKey);
return err;
}
CNameAndSDList NameSDList;
DWORD dwTotalWinStations = 0;
DWORD dwDefaultWinStations = 0;
err=EnumWinStationSecurityDescriptors( hKey, &NameSDList);
if(err == ERROR_SUCCESS)
{
dwTotalWinStations = NameSDList.size();
if(dwTotalWinStations)
{
CNameAndSDList::iterator it;
for(it=NameSDList.begin();it!=NameSDList.end(); it++)
{
if((*it).IsDefaultOrEmpty(&DefaultSD,&ConsoleSD))
{
dwDefaultWinStations++;
}
}
//If all descriptors are default
if(dwDefaultWinStations == dwTotalWinStations)
{
any = FALSE;
}
else
{
any = TRUE;
}
}
}
RegCloseKey(hKey);
return err;
}
/*****************************************************************************
*
* SetupWorker
*
* ENTRY:
* IN const TSState &State
*
*
* NOTES:
*
* EXIT:
* Returns: 0 if success, error code if failure
*
****************************************************************************/
DWORD
SetupWorker(
IN const TSState &State )
{
DWORD Result;
const BOOL bStandAlone = State.IsStandAlone();
const BOOL bClean = State.IsTSFreshInstall();
const BOOL bAppServer = State.IsItAppServer();
const BOOL bServer = State.IsServer();
LOGMESSAGE4(_T("SetupWorker( %d, %d, %d, %d )"), bClean, bStandAlone, bServer, bAppServer );
if (!bStandAlone) // we are in GUI-setup mode
{
// clean install of OS or OS upgrade
Result = SetupWorkerNotStandAlone( bClean, bServer,bAppServer );
}
else
{
// we are being called from Add/Remove Programs, which means, we are
// switching modes
BOOL anyCustomSDs;
Result = AreThereAnyCustomSecurityDescriptors( anyCustomSDs ) ;
LOGMESSAGE1(_T("AreThereAnyCustomSecurityDescriptors = %d"), anyCustomSDs );
if ( Result == ERROR_SUCCESS )
{
if (!anyCustomSDs )
{
// make sure we don't have a left-over privilage on the EveryoneSID
Result = GrantRemotePrivilegeToEveryone( FALSE );
}
if (bAppServer)
{
// copy the content of the Local\Users into the RDU-group if and only
// if there are no custom security dscriptors.
if (!anyCustomSDs ) // there are no custom security descriptors
{
Result = CopyUsersGroupToRDUsersGroup();
}
}
else
{
// we are switching to Remote-Admin mode, secure machine by
// removing the content of the RDU-Group
Result = RemoveAllFromRDUsersGroup();
}
}
else
{
LOGMESSAGE1(_T("AreThereAnyCustomSecurityDescriptors() returned : %d"),Result );
}
}
return Result;
}
/*****************************************************************************
*
* SetupWorkerNoStandAlone
* This will be called when machine is being upgraded or fresh OS is being installed.
* It is NOT called if switching modes (AS <->RA )
*
* ENTRY:
* none
*
*
* NOTES:
* IN BOOL bClean
* IN BOOL bServer
* IN BOOL bAppServer
*
* EXIT:
* Returns: 0 if success, error code if failure
*
****************************************************************************/
DWORD SetupWorkerNotStandAlone(
IN BOOL bClean,
IN BOOL bServer,
IN BOOL bAppServer)
{
HKEY hKey;
DWORD err;
err=RegOpenKeyEx(
HKEY_LOCAL_MACHINE,
REG_WINSTATION_KEY,
0,
KEY_READ|KEY_WRITE,
&hKey
);
if( err!=ERROR_SUCCESS )
{
LOGMESSAGE1(_T("Could not open TS key %d"),err);
return err;
}
if(bClean)
{
if(bAppServer)
{
err = CopyUsersGroupToRDUsersGroup();
LOGMESSAGE1(_T("CopyUsersGroupToRDUsersGroup() returned : %d"),err);
if(err != ERROR_SUCCESS)
{
RegCloseKey(hKey);
return err;
}
}
}
else
{
err = GrantRemoteUsersAccessToWinstations(hKey,bServer,bAppServer);
LOGMESSAGE1(_T("GrantRemoteUsersAccessToWinstations() returned : %d"),err);
if(err != ERROR_SUCCESS)
{
RegCloseKey(hKey);
return err;
}
}
err = SetNewDefaultSecurity(hKey);
LOGMESSAGE1(_T("SetNewDefaultSecurity() returned : %d"),err);
err = SetNewConsoleSecurity(hKey,bServer);
LOGMESSAGE1(_T("SetNewConsoleSecurity() returned : %d"),err);
RegCloseKey(hKey);
return err;
}
/*****************************************************************************
*
* GrantRemoteUsersAccessToWinstations
*
* if all winstations have default SD - copies all members from "Users" to
* "Remote Desktop Users", then deletes all winstation's security descriptors;
* otherwise grants "Everyone" with "SeRemoteInteractiveLogonRight" privilege
* and then adds "Remote Desktop Users" to each winstation's security descriptor
*
* ENTRY:
* IN HKEY hKey - handle to HKLM\SYSTEM\CurrentControlSet\
* Control\Terminal Server\WinStations
* IN BOOL bAppServer
*
* NOTES:
*
*
* EXIT:
* Returns: 0 if success, error code if failure
*
****************************************************************************/
DWORD
GrantRemoteUsersAccessToWinstations(
IN HKEY hKey,
IN BOOL bServer,
IN BOOL bAppServer)
{
DWORD err;
CDefaultSD DefaultSD;
CDefaultSD ConsoleSD;
//Load default SD from the registry
err = DefaultSD.Init(hKey,DefaultRDPSD);
if( err!=ERROR_SUCCESS )
{
//Default SD may not be present if TS was
//never enabled.
if(err == ERROR_FILE_NOT_FOUND)
{
err = ERROR_SUCCESS;
//Copy all members of "Users" group to
//"Remote Desktop Users" group.
//And we are done
if(bAppServer)
{
err = CopyUsersGroupToRDUsersGroup();
}
}
return err;
}
//Load default console SD from the registry
err = ConsoleSD.Init(hKey,DefaultConsoleSD);
if( err!=ERROR_SUCCESS )
{
return err;
}
BOOL bDefaultSDHasRemoteUsers;
err = DefaultSD.DoesDefaultSDHaveRemoteUsers(&bDefaultSDHasRemoteUsers);
if( err!=ERROR_SUCCESS )
{
return err;
}
else
{
//in this case assume that system already has been upgraded before.
if(bDefaultSDHasRemoteUsers)
{
return ERROR_SUCCESS;
}
}
CNameAndSDList NameSDList;
DWORD dwTotalWinStations = 0;
DWORD dwDefaultWinStations = 0;
err=EnumWinStationSecurityDescriptors( hKey, &NameSDList);
if(err == ERROR_SUCCESS)
{
dwTotalWinStations = NameSDList.size();
if(dwTotalWinStations)
{
CNameAndSDList::iterator it;
for(it=NameSDList.begin();it!=NameSDList.end(); it++)
{
if((*it).IsDefaultOrEmpty(&DefaultSD,&ConsoleSD))
{
dwDefaultWinStations++;
}
}
//If all descriptors are default
if(dwDefaultWinStations == dwTotalWinStations)
{
//Copy all members of "Users" group to
//"Remote Desktop Users" group.
if(bAppServer)
{
err = CopyUsersGroupToRDUsersGroup();
}
//remove all ald default SDs (because we will have
//different default SD
for(it=NameSDList.begin();it!=NameSDList.end(); it++)
{
if((*it).m_pSD)
{
//in case of error, continue with other winstations
//but return first error.
if(!err)
{
err = RemoveWinstationSecurity( hKey, (*it).m_pName );
}
else
{
RemoveWinstationSecurity( hKey, (*it).m_pName );
}
}
}
}
else
{
//Grant "SeRemoteInteractiveLogonRight" privilege to "Everyone"
err = GrantRemotePrivilegeToEveryone( TRUE );
//Add "Remote Desktop Users" group to WinStation's DS.
//Add also "LocalService" and "NetworkService".
//NOTE: (*it).m_pSD is being changed during each call
//to AddLocalAndNetworkServiceToWinstationSD or
//AddRemoteUsersToWinstationSD
for(it=NameSDList.begin();it!=NameSDList.end(); it++)
{
//On server - skip console
if(bServer && (*it).IsConsole())
{
//if SD is not NULL add "LocalService" and "NetworkService" to it
if((*it).m_pSD)
{
if(!err)
{
err = AddLocalAndNetworkServiceToWinstationSD( hKey, &(*it) );
}
else
{
AddLocalAndNetworkServiceToWinstationSD( hKey, &(*it) );
}
}
continue;
}
//if SD is not NULL add RDU to it
if((*it).m_pSD)
{
//in case of error, continue with other winstations
//but return first error.
if(!err)
{
err = AddRemoteUsersToWinstationSD( hKey, &(*it) );
}
else
{
AddRemoteUsersToWinstationSD( hKey, &(*it) );
}
//add "LocalService" and "NetworkService" to SD
if(!err)
{
err = AddLocalAndNetworkServiceToWinstationSD( hKey, &(*it) );
}
else
{
AddLocalAndNetworkServiceToWinstationSD( hKey, &(*it) );
}
}
}
}
}
}
return err;
}
/*****************************************************************************
*
* AddRemoteUserToWinstationSD
*
* Grants "user access" permissions to a winstation to "REMOTE DESKTOP USERS"
*
* ENTRY:
* IN HKEY hKeyParent - handle to HKLM\SYSTEM\CurrentControlSet\
* Control\Terminal Server\WinStations
* IN CNameAndSD *pNameSD - name and security descriptor of a winstation
*
*
* NOTES:
*
*
* EXIT:
* Returns: 0 if success, error code if failure
*
*
*
****************************************************************************/
DWORD
AddRemoteUsersToWinstationSD(
IN HKEY hKeyParent,
IN CNameAndSD *pNameSD)
{
//
DWORD err = ERROR_SUCCESS;
PACL pDacl = NULL;
SID_IDENTIFIER_AUTHORITY sia = SECURITY_NT_AUTHORITY;
PSID pRUSid=NULL;
if( !AllocateAndInitializeSid( &sia, 2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS,
0, 0, 0, 0, 0, 0,&pRUSid ) )
{
return GetLastError();
}
//get dacl
err = GetDacl(pNameSD->m_pSD, &pDacl );
if( err == ERROR_SUCCESS ) {
if(!pDacl)
{
//It shuold never be in our case
//so we return error here
FreeSid(pRUSid);
return ERROR_INVALID_PARAMETER;
}
//let's add it
err = AddUserToDacl( hKeyParent, pDacl, pRUSid, WINSTATION_USER_ACCESS, pNameSD );
}
FreeSid(pRUSid);
return err;
}
/*****************************************************************************
*
* AddLocalAndNetworkServiceToWinstationSD
*
* Grants WINSTATION_QUERY | WINSTATION_MSG permissions to
* a winstation to LocalService and NetworkService accounts
*
* ENTRY:
* IN HKEY hKeyParent - handle to HKLM\SYSTEM\CurrentControlSet\
* Control\Terminal Server\WinStations
* IN CNameAndSD *pNameSD - name and security descriptor of a winstation
*
*
* NOTES:
*
*
* EXIT:
* Returns: 0 if success, error code if failure
*
*
*
****************************************************************************/
DWORD
AddLocalAndNetworkServiceToWinstationSD(
IN HKEY hKeyParent,
IN CNameAndSD *pNameSD)
{
//
DWORD err = ERROR_SUCCESS;
PACL pDacl = NULL;
SID_IDENTIFIER_AUTHORITY sia = SECURITY_NT_AUTHORITY;
PSID pLSSid=NULL;
PSID pNSSid=NULL;
if( !AllocateAndInitializeSid( &sia, 1,
SECURITY_LOCAL_SERVICE_RID,
0, 0, 0, 0, 0, 0, 0,&pLSSid ) )
{
return GetLastError();
}
if( !AllocateAndInitializeSid( &sia, 1,
SECURITY_NETWORK_SERVICE_RID,
0, 0, 0, 0, 0, 0, 0,&pNSSid ) )
{
FreeSid(pLSSid);
return GetLastError();
}
//get dacl
err = GetDacl(pNameSD->m_pSD, &pDacl );
if( err == ERROR_SUCCESS ) {
if(!pDacl)
{
//It shuold never be in our case
//so we return error here
FreeSid(pLSSid);
FreeSid(pNSSid);
return ERROR_INVALID_PARAMETER;
}
//let's add it
err = AddUserToDacl( hKeyParent, pDacl, pLSSid,
WINSTATION_QUERY | WINSTATION_MSG, pNameSD );
if(err == ERROR_SUCCESS)
{
//SD has been changed. It makes pDacl invalid.
//So we need to get it again
err = GetDacl(pNameSD->m_pSD, &pDacl );
ASSERT(pDacl);
if(err == ERROR_SUCCESS)
{
err = AddUserToDacl( hKeyParent, pDacl, pNSSid,
WINSTATION_QUERY | WINSTATION_MSG, pNameSD );
}
}
}
FreeSid(pLSSid);
FreeSid(pNSSid);
return err;
}
/*****************************************************************************
*
* AddUserToDacl
*
* Grants
* WINSTATION_USER_ACCESS
* permissions to a winstation to user, defined by SID
*
* ENTRY:
*
* IN HKEY hKeyParent - handle to HKLM\SYSTEM\CurrentControlSet\
* Control\Terminal Server\WinStations
* IN PACL pOldACL: pointer to prewvious DACL of the key
* IN PSID pSid: pointer to SID of user to grant permissions to
* IN DWORD dwAccessMask: access flags for this SID
* IN CNameAndSD *pNameSD - name and security descriptor of a winstation
* NOTES:
*
* EXIT:
* Returns: error code if cannot grant permissions; ERROR_SUCCESS otherwise.
*
****************************************************************************/
DWORD
AddUserToDacl(
IN HKEY hKeyParent,
IN PACL pOldACL,
IN PSID pSid,
IN DWORD dwAccessMask,
IN CNameAndSD *pNameSD)
{
//See if this user is already in the DACL.
//In this case don't add the user
//search ACL for "REMOTE USERS" SID
ACL_SIZE_INFORMATION asiAclSize;
DWORD dwBufLength=sizeof(asiAclSize);
ACCESS_ALLOWED_ACE *paaAllowedAce;
DWORD dwAcl_i;
ASSERT(pOldACL);
if (GetAclInformation(pOldACL,
(LPVOID)&asiAclSize,
(DWORD)dwBufLength,
(ACL_INFORMATION_CLASS)AclSizeInformation))
{
for (dwAcl_i = 0; dwAcl_i < asiAclSize.AceCount; dwAcl_i++)
{
if(GetAce( pOldACL, dwAcl_i, (LPVOID *)&paaAllowedAce))
{
if(EqualSid((PSID)&(paaAllowedAce->SidStart),pSid))
{
//some permission already exist, we don't need to
//do anything (even if it is a different permission!)
return ERROR_SUCCESS;
}
}
}
}
DWORD err=ERROR_SUCCESS;
PACL pNewACL;
ACCESS_ALLOWED_ACE *pNewACE;
//calculate space needed for 1 additional ACE
WORD wSidSize=(WORD)GetLengthSid( pSid);
WORD wAceSize=(sizeof(ACCESS_ALLOWED_ACE)+wSidSize-sizeof( DWORD ));
pNewACL=(PACL)LocalAlloc(LPTR,pOldACL->AclSize+wAceSize);
if(!pNewACL)
{
return GetLastError();
}
//copy old ACL to new ACL
memcpy(pNewACL,pOldACL,pOldACL->AclSize);
//correct size
pNewACL->AclSize+=wAceSize;
//prepare new ACE
//----------------------------------------------------------
pNewACE=(ACCESS_ALLOWED_ACE*)LocalAlloc(LPTR,wAceSize);
if(!pNewACE)
{
LocalFree(pNewACL);
return GetLastError();
}
pNewACE->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
pNewACE->Header.AceFlags = 0;
pNewACE->Header.AceSize = wAceSize;
pNewACE->Mask = dwAccessMask;
CopySid( wSidSize, (PSID) &(pNewACE->SidStart), pSid);
//append new ACE to the ACL
if(!AddAce(pNewACL,pNewACL->AclRevision,MAXDWORD,pNewACE,wAceSize))
{
err=GetLastError();
}
else
{
//create new security descriptor
SECURITY_DESCRIPTOR NewAbsSD;
if(InitializeSecurityDescriptor(&NewAbsSD, SECURITY_DESCRIPTOR_REVISION) &&
SetSecurityDescriptorDacl(&NewAbsSD,TRUE,pNewACL,FALSE) )
{
//---------------------------------------------------------
//Copy all other stuff from the old SD to the new SD
SECURITY_DESCRIPTOR_CONTROL sdc;
DWORD dwRevision;
if(GetSecurityDescriptorControl(pNameSD->m_pSD,&sdc,&dwRevision))
{
//Clear SE_SELF_RELATIVE flag
sdc &=~SE_SELF_RELATIVE;
SetSecurityDescriptorControl(&NewAbsSD,sdc,sdc);
}
PSID pSid = NULL;
BOOL bDefaulted;
if(GetSecurityDescriptorOwner(pNameSD->m_pSD,&pSid,&bDefaulted) && pSid)
{
SetSecurityDescriptorOwner(&NewAbsSD,pSid,bDefaulted);
}
pSid = NULL;
if(GetSecurityDescriptorGroup(pNameSD->m_pSD,&pSid,&bDefaulted) && pSid)
{
SetSecurityDescriptorGroup(&NewAbsSD,pSid,bDefaulted);
}
PACL pSacl = NULL;
BOOL bSaclPresent;
if(GetSecurityDescriptorSacl(pNameSD->m_pSD,&bSaclPresent,&pSacl,&bDefaulted))
{
SetSecurityDescriptorSacl(&NewAbsSD,bSaclPresent,pSacl,bDefaulted);
}
//---------------------------------------------------------
DWORD dwSDLen = GetSecurityDescriptorLength( &NewAbsSD );
PSECURITY_DESCRIPTOR pSD;
pSD = ( PSECURITY_DESCRIPTOR )LocalAlloc(LPTR,dwSDLen);
if(pSD)
{
if(MakeSelfRelativeSD( &NewAbsSD , pSD , &dwSDLen ))
{
err = SetWinStationSecurity(hKeyParent, pNameSD->m_pName, pSD );
if(err == ERROR_SUCCESS)
{
pNameSD->SetSD(pSD);
}
}
else
{
err=GetLastError();
}
}
else
{
err=GetLastError();
}
}
else
{
err=GetLastError();
}
}
LocalFree(pNewACE);
LocalFree(pNewACL);
return err;
}
/*****************************************************************************
*
* GetDacl
*
* Gets security descriptor DACL.
*
* ENTRY:
*
* IN PSECURITY_DESCRIPTOR *pSD: pointer to SD
* OUT PACL *ppDacl: pointer to pointer to DACL inside SD
*
* NOTES:
* Do not try to free DACL!
*
* EXIT:
* Returns: error code if cannot get DACL; ERROR_SUCCESS otherwise.
*
****************************************************************************/
DWORD
GetDacl(
IN PSECURITY_DESCRIPTOR pSD,
OUT PACL *ppDacl)
{
BOOL bDaclPresent;
BOOL bDaclDefaulted;
*ppDacl=NULL;
if(GetSecurityDescriptorDacl(pSD,&bDaclPresent,ppDacl,&bDaclDefaulted)) {
if(!bDaclPresent){
*ppDacl=NULL;
}
} else {
return GetLastError();
}
return ERROR_SUCCESS;
}
/*****************************************************************************
*
* GetSacl
*
* Gets security descriptor SACL.
*
* ENTRY:
*
* IN PSECURITY_DESCRIPTOR *pSD: pointer to SD
* OUT PACL *ppSacl: pointer to pointer to SACL inside SD
*
* NOTES:
* Do not try to free SACL!
*
* EXIT:
* Returns: error code if cannot get SACL; ERROR_SUCCESS otherwise.
*
****************************************************************************/
DWORD
GetSacl(
IN PSECURITY_DESCRIPTOR pSD,
OUT PACL *ppSacl)
{
BOOL bSaclPresent;
BOOL bSaclDefaulted;
*ppSacl=NULL;
if(GetSecurityDescriptorSacl(pSD,&bSaclPresent,ppSacl,&bSaclDefaulted)) {
if(!bSaclPresent){
*ppSacl=NULL;
}
} else {
return GetLastError();
}
return ERROR_SUCCESS;
}
/*****************************************************************************
*
* EnumWinStationSecurityDescriptors
*
* Enumerates winstations and gets their security descriptors
*
* ENTRY:
*
* IN HKEY hKeyParent - handle to HKLM\SYSTEM\CurrentControlSet\
* Control\Terminal Server\WinStations
* OUT CNameAndSDList - name and security descriptor of a winstation
* NOTES:
* Call LocalFree function to free SD, do not try to free DACL!
*
* EXIT:
* Returns: error code or ERROR_SUCCESS
*
****************************************************************************/
DWORD
EnumWinStationSecurityDescriptors(
IN HKEY hKeyParent,
OUT CNameAndSDList *pNameSDList)
{
DWORD err;
DWORD dwIndex;
TCHAR wszTmpName[MAX_PATH+1];
DWORD cbTmpName=MAX_PATH;
FILETIME ftLastWriteTime;
for(dwIndex=0;;dwIndex++)
{
cbTmpName=MAX_PATH;
err=RegEnumKeyEx(
hKeyParent, // handle of key to enumerate
dwIndex, // index of subkey to enumerate
wszTmpName, // address of buffer for subkey name
&cbTmpName, // address for size of subkey buffer
NULL, // reserved
NULL, // address of buffer for class string
NULL, // address for size of class buffer
&ftLastWriteTime // address for time key last written to
);
if((err!=ERROR_SUCCESS)&&
(err!=ERROR_MORE_DATA)&&
(err!=ERROR_NO_MORE_ITEMS))
{
return err;
}
if(err==ERROR_NO_MORE_ITEMS)
break;
else
{
CNameAndSD Entry(wszTmpName);
err = GetWinStationSecurity(hKeyParent, Entry.m_pName,
_T("Security"), &(Entry.m_pSD));
if( err == ERROR_SUCCESS || err == ERROR_FILE_NOT_FOUND )
{
pNameSDList->push_back(Entry);
}
}
}
return ERROR_SUCCESS;
}
/*****************************************************************************
*
* GetWinStationSecurity
*
* Returns WinStation's security descriptor.
*
* ENTRY:
*
* IN HKEY hKeyParent - handle to HKLM\SYSTEM\CurrentControlSet\
* Control\Terminal Server\WinStations
* IN PWINSTATIONNAMEW pWSName - name of a winstation
* if pWSName is NULL - function returns default SD
* OUT PSECURITY_DESCRIPTOR *ppSecurityDescriptor - pointer to pointer to SD
*
* NOTES:
* Call LocalFree function to free SD!
*
* EXIT:
* Returns: error code or ERROR_SUCCESS
*
****************************************************************************/
DWORD
GetWinStationSecurity(
IN HKEY hKeyParent,
IN PWINSTATIONNAME pWSName,
IN LPCTSTR szValueName,
OUT PSECURITY_DESCRIPTOR *ppSecurityDescriptor)
{
DWORD SDLength = 0;
DWORD ValueType =0;
HKEY hKey = NULL;
DWORD err;
*ppSecurityDescriptor = NULL;
if(pWSName)
{
err = RegOpenKeyEx(hKeyParent, pWSName, 0,KEY_READ, &hKey );
}
else
{
//If pWSName - get defauilt SD
hKey = hKeyParent;
err = ERROR_SUCCESS;
}
if(err == ERROR_SUCCESS)
{
err = RegQueryValueEx( hKey, szValueName, NULL, &ValueType,NULL, &SDLength );
if(err == ERROR_SUCCESS )
{
//Return error if not correct data type
if (ValueType == REG_BINARY)
{
//Allocate a buffer to read the Security info and read it
// ACLUI uses LocalFree
*ppSecurityDescriptor = ( PSECURITY_DESCRIPTOR )LocalAlloc( LMEM_FIXED , SDLength );
if ( *ppSecurityDescriptor )
{
err = RegQueryValueEx( hKey, szValueName, NULL, &ValueType,
(BYTE *) *ppSecurityDescriptor, &SDLength );
if(err == ERROR_SUCCESS )
{
//Check for a valid SD before returning.
if(! IsValidSecurityDescriptor( *ppSecurityDescriptor ) )
{
LocalFree(*ppSecurityDescriptor);
*ppSecurityDescriptor = NULL;
err = ERROR_INVALID_DATA;
}
}
else
{
LocalFree(*ppSecurityDescriptor);
*ppSecurityDescriptor = NULL;
}
}
else
{
err = ERROR_NOT_ENOUGH_MEMORY;
}
}
else
{
err = ERROR_INVALID_DATA;
}
}
if(hKey != hKeyParent)
{
RegCloseKey(hKey);
}
}
return err;
} // GetWinStationSecurity
/*****************************************************************************
*
* SetWinStationSecurity
*
* Writes winstation security descriptor to the registry
*
* ENTRY:
*
* IN HKEY hKeyParent - handle to HKLM\SYSTEM\CurrentControlSet\
* Control\Terminal Server\WinStations
* IN PWINSTATIONNAMEW pWSName - name of a winstation
* IN PSECURITY_DESCRIPTOR pSecurityDescriptor - pointer to SD
*
* NOTES:
* Call LocalFree function to free SD, do not try to free DACL!
*
* EXIT:
* Returns: 0: if success
* Error code: otherwise
*
****************************************************************************/
DWORD
SetWinStationSecurity(
IN HKEY hKeyParent,
IN PWINSTATIONNAME pWSName,
IN PSECURITY_DESCRIPTOR pSecurityDescriptor )
{
HKEY hKey = NULL;
DWORD err;
err = RegOpenKeyEx(hKeyParent, pWSName, 0,KEY_WRITE, &hKey );
if(err == ERROR_SUCCESS)
{
err = RegSetValueEx(hKey, _T("Security"),0,REG_BINARY,(LPBYTE)pSecurityDescriptor,
GetSecurityDescriptorLength(pSecurityDescriptor));
RegCloseKey(hKey);
}
return err;
} // SetWinStationSecurity
/*****************************************************************************
*
* RemoveWinStationSecurity
*
* Removes winstation's security descriptor from the registry
*
* ENTRY:
*
* IN HKEY hKeyParent - handle to HKLM\SYSTEM\CurrentControlSet\
* Control\Terminal Server\WinStations
* IN PWINSTATIONNAMEW pWSName - name of a winstation
*
* NOTES:
*
*
* EXIT:
* Returns: 0: if success
* Error code: otherwise
*
****************************************************************************/
DWORD
RemoveWinstationSecurity(
IN HKEY hKeyParent,
IN PWINSTATIONNAME pWSName)
{
HKEY hKey = NULL;
DWORD err;
err = RegOpenKeyEx(hKeyParent, pWSName, 0,KEY_WRITE, &hKey );
if(err == ERROR_SUCCESS)
{
err = RegDeleteValue(hKey, _T("Security"));
RegCloseKey(hKey);
}
return err;
}
/*****************************************************************************
*
* SetNewDefaultSecurity
*
* Sets new default security descriptor
*
* ENTRY:
*
* IN HKEY hKeyParent - handle to HKLM\SYSTEM\CurrentControlSet\
* Control\Terminal Server\WinStations
*
* NOTES:
*
*
* EXIT:
* Returns: 0: if success
* Error code: otherwise
*
****************************************************************************/
DWORD
SetNewDefaultSecurity(
IN HKEY hKey)
{
//
DWORD err;
err = RegSetValueEx(hKey, _T("DefaultSecurity"), 0, REG_BINARY,
(LPBYTE)g_DefaultSD, sizeof(g_DefaultSD));
return err;
}
/*****************************************************************************
*
* SetNewConsoleSecurity
*
* Sets new console security descriptor
*
* ENTRY:
*
* IN HKEY hKeyParent - handle to HKLM\SYSTEM\CurrentControlSet\
* Control\Terminal Server\WinStations
* IN BOOL bServer
* NOTES:
*
*
* EXIT:
* Returns: 0: if success
* Error code: otherwise
*
****************************************************************************/
DWORD
SetNewConsoleSecurity(
IN HKEY hKeyParent,
IN BOOL bServer)
{
//
DWORD err;
//Set default console security
if(bServer)
{
err = RegSetValueEx(hKeyParent, _T("ConsoleSecurity"), 0, REG_BINARY,
(LPBYTE)g_ConsoleSD, sizeof(g_ConsoleSD));
}
else
{
// on Professional it's the same as "DefaultSecurity"
err = RegSetValueEx(hKeyParent, _T("ConsoleSecurity"), 0, REG_BINARY,
(LPBYTE)g_DefaultSD, sizeof(g_DefaultSD));
}
return err;
}
/*****************************************************************************
*
* CDefaultSD::DoesDefaultSDHaveRemoteUsers
*
* Checks if defauilt SD has "Remote Desktop Users" SID.
*
* ENTRY:
* OUT LPBOOL pbHas - TRUE if defauilt SD has "Remote Desktop Users" SID.
*
* NOTES:
*
* EXIT:
* Returns: 0: if success
* Error code: otherwise
*
****************************************************************************/
DWORD
CDefaultSD::DoesDefaultSDHaveRemoteUsers(
OUT LPBOOL pbHas)
{
*pbHas = FALSE;
//
DWORD err = ERROR_SUCCESS;
PACL pDacl = NULL;
SID_IDENTIFIER_AUTHORITY sia = SECURITY_NT_AUTHORITY;
PSID pRUSid=NULL;
if( !AllocateAndInitializeSid( &sia, 2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS,
0, 0, 0, 0, 0, 0,&pRUSid ) )
{
return GetLastError();
}
//get dacl
err = GetDacl(m_pSD, &pDacl );
if( err == ERROR_SUCCESS ) {
//search ACL for "REMOTE USERS" SID
ACL_SIZE_INFORMATION asiAclSize;
DWORD dwBufLength=sizeof(asiAclSize);
ACCESS_ALLOWED_ACE *paaAllowedAce;
DWORD dwAcl_i;
if(!pDacl)
{
//It shuold never be in our case
//so we return error here
FreeSid(pRUSid);
return ERROR_INVALID_PARAMETER;
}
else
//DACL present
{
if (GetAclInformation(pDacl,
(LPVOID)&asiAclSize,
(DWORD)dwBufLength,
(ACL_INFORMATION_CLASS)AclSizeInformation))
{
for (dwAcl_i = 0; dwAcl_i < asiAclSize.AceCount; dwAcl_i++)
{
if(GetAce( pDacl, dwAcl_i, (LPVOID *)&paaAllowedAce))
{
if(EqualSid((PSID)&(paaAllowedAce->SidStart),pRUSid))
{
//permission already exist, we don't need to
//do anything
*pbHas = TRUE;
}
}
}
}
}
}
FreeSid(pRUSid);
return err;
}
//*************************************************************
//
// LookupSid()
//
// Purpose: Given SID allocates and returns string containing
// name of the user in format DOMAINNAME\USERNAME
//
// Parameters: IN PSID pSid
// OUT LPWSTR ppName
// OUT SID_NAME_USE *peUse
//
// Return: TRUE if success, FALSE otherwise
//
// Comments:
//
// History: Date Author Comment
// 10/23/00 skuzin Created
//
//*************************************************************
BOOL
LookupSid(
IN PSID pSid,
OUT LPWSTR *ppName,
OUT SID_NAME_USE *peUse)
{
LPWSTR szName = NULL;
DWORD cName = 0;
LPWSTR szDomainName = NULL;
DWORD cDomainName = 0;
*ppName = NULL;
if(!LookupAccountSidW(NULL,pSid,
szName,&cName,
szDomainName,&cDomainName,
peUse) && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
{
//cName and cDomainName include terminating 0
*ppName = (LPWSTR)LocalAlloc(LPTR,(cName+cDomainName)*sizeof(WCHAR));
if(*ppName)
{
szDomainName = *ppName;
szName = &(*ppName)[cDomainName];
if(LookupAccountSidW(NULL,pSid,
szName,&cName,
szDomainName,&cDomainName,
peUse))
{
//user name now in format DOMAINNAME\0USERNAME
//let's replace '\0' with '\\'
//now cName and cDomainName do not include terminating 0
//very confusing
if(cDomainName)
{
(*ppName)[cDomainName] = L'\\';
}
return TRUE;
}
else
{
LocalFree(*ppName);
*ppName = NULL;
}
}
}
return FALSE;
}
//*************************************************************
//
// IsLocal()
//
// Purpose:
//
// Parameters: wszDomainandname - domain\user
// determines whether the user is local or not
// if local - cuts out domain name
//
// Return: NONE
//
// Comments:
//
// History: Date Author Comment
// 03/13/01 skuzin Created
//
//*************************************************************
BOOL
IsLocal(
IN LPWSTR wszLocalCompName,
IN OUT LPWSTR wszDomainandname)
{
LPWSTR wszTmp = wcschr(wszDomainandname,L'\\');
if(!wszTmp)
{
return TRUE;
}
if(!_wcsnicmp(wszDomainandname, wszLocalCompName,wcslen(wszLocalCompName) ))
{
//get rid of useless domain name
wcscpy(wszDomainandname,wszTmp+1);
return TRUE;
}
return FALSE;
}
//*************************************************************
//
// GetAbsoluteSD()
//
// Purpose: Converts self-relative SD to absolute SD
// returns pointers to SACL DACL Owner and Group
// of the absolute SD.
//
// Parameters:
// IN PSECURITY_DESCRIPTOR pSelfRelativeSD
// OUT PSECURITY_DESCRIPTOR *ppAbsoluteSD
// OUT PACL *ppDacl
// OUT PACL *ppSacl
// OUT PSID *ppOwner
// OUT PSID *ppPrimaryGroup
//
// Return: error code if fails, ERROR_SUCCESS otherwise
//
// Comments: caller needs to free
// every returned pointer using LocalFree function.
//
// History: Date Author Comment
// 03/13/01 skuzin Created
//
//*************************************************************
DWORD
GetAbsoluteSD(
IN PSECURITY_DESCRIPTOR pSelfRelativeSD,
OUT PSECURITY_DESCRIPTOR *ppAbsoluteSD,
OUT PACL *ppDacl,
OUT PACL *ppSacl,
OUT PSID *ppOwner,
OUT PSID *ppPrimaryGroup)
{
DWORD dwAbsoluteSDSize = 0; // absolute SD size
DWORD dwDaclSize = 0; // size of DACL
DWORD dwSaclSize = 0; // size of SACL
DWORD dwOwnerSize = 0; // size of owner SID
DWORD dwPrimaryGroupSize = 0; // size of group SID
*ppAbsoluteSD = NULL;
*ppDacl = NULL;
*ppSacl = NULL;
*ppOwner = NULL;
*ppPrimaryGroup = NULL;
MakeAbsoluteSD(
pSelfRelativeSD, // self-relative SD
NULL, // absolute SD
&dwAbsoluteSDSize, // absolute SD size
NULL, // DACL
&dwDaclSize, // size of DACL
NULL, // SACL
&dwSaclSize, // size of SACL
NULL, // owner SID
&dwOwnerSize, // size of owner SID
NULL, // primary-group SID
&dwPrimaryGroupSize // size of group SID
);
try
{
if(dwAbsoluteSDSize)
{
*ppAbsoluteSD = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR,dwAbsoluteSDSize);
if(!(*ppAbsoluteSD))
{
throw GetLastError();
}
}
if(dwDaclSize)
{
*ppDacl = (PACL)LocalAlloc(LPTR,dwDaclSize);
if(!(*ppDacl))
{
throw GetLastError();
}
}
if(dwSaclSize)
{
*ppSacl = (PACL)LocalAlloc(LPTR,dwSaclSize);
if(!(*ppSacl))
{
throw GetLastError();
}
}
if(dwOwnerSize)
{
*ppOwner = (PSID)LocalAlloc(LPTR,dwOwnerSize);
if(!(*ppOwner))
{
throw GetLastError();
}
}
if(dwPrimaryGroupSize)
{
*ppPrimaryGroup = (PSID)LocalAlloc(LPTR,dwPrimaryGroupSize);
if(!(*ppPrimaryGroup))
{
throw GetLastError();
}
}
if(!MakeAbsoluteSD(
pSelfRelativeSD, // self-relative SD
*ppAbsoluteSD, // absolute SD
&dwAbsoluteSDSize, // absolute SD size
*ppDacl, // DACL
&dwDaclSize, // size of DACL
*ppSacl, // SACL
&dwSaclSize, // size of SACL
*ppOwner, // owner SID
&dwOwnerSize, // size of owner SID
*ppPrimaryGroup, // primary-group SID
&dwPrimaryGroupSize // size of group SID
))
{
throw GetLastError();
}
}
catch(DWORD ret)
{
if(*ppAbsoluteSD)
{
LocalFree(*ppAbsoluteSD);
*ppAbsoluteSD = NULL;
}
if(*ppDacl)
{
LocalFree(*ppDacl);
*ppDacl = NULL;
}
if(*ppSacl)
{
LocalFree(*ppSacl);
*ppSacl = NULL;
}
if(*ppOwner)
{
LocalFree(*ppOwner);
*ppOwner = NULL;
}
if(*ppPrimaryGroup)
{
LocalFree(*ppPrimaryGroup);
*ppPrimaryGroup = NULL;
}
return ret;
}
return ERROR_SUCCESS;
}
//*************************************************************
//
// GetAbsoluteSD()
//
// Purpose: Converts absolute SD to self-relative SD
// returns pointer to self-relative SD.
//
// Parameters:
// IN PSECURITY_DESCRIPTOR pAbsoluteSD,
// OUT PSECURITY_DESCRIPTOR *ppSelfRelativeSD
//
// Return: error code if fails, ERROR_SUCCESS otherwise
//
// Comments: caller needs to free
// returned pointer using LocalFree function.
//
// History: Date Author Comment
// 03/13/01 skuzin Created
//
//*************************************************************
DWORD
GetSelfRelativeSD(
IN PSECURITY_DESCRIPTOR pAbsoluteSD,
OUT PSECURITY_DESCRIPTOR *ppSelfRelativeSD)
{
DWORD dwBufferLength = 0;
*ppSelfRelativeSD = NULL;
MakeSelfRelativeSD(pAbsoluteSD, NULL, &dwBufferLength);
if(dwBufferLength)
{
*ppSelfRelativeSD = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR,dwBufferLength);
if(*ppSelfRelativeSD)
{
if(!MakeSelfRelativeSD(pAbsoluteSD, *ppSelfRelativeSD, &dwBufferLength))
{
DWORD dwResult = GetLastError();
LocalFree(*ppSelfRelativeSD);
return dwResult;
}
}
}
else
{
return GetLastError();
}
return ERROR_SUCCESS;
}
Reference in a new issue Copy permalink