117 lines
2.5 KiB
C
117 lines
2.5 KiB
C
|
/*++
|
|||
|
|
|
|||
|
|
Copyright (c) 1991-1996 Microsoft Corporation
|
|||
|
|
|
|||
|
|
Module Name:
|
|||
|
|
|
|||
|
|
nlsecure.c
|
|||
|
|
|
|||
|
|
Abstract:
|
|||
|
|
|
|||
|
|
This module contains the Netlogon service support routines
|
|||
|
|
which create security objects and enforce security _access checking.
|
|||
|
|
|
|||
|
|
Author:
|
|||
|
|
|
|||
|
|
Cliff Van Dyke (CliffV) 22-Aug-1991
|
|||
|
|
|
|||
|
|
Revision History:
|
|||
|
|
|
|||
|
|
--*/
|
|||
|
|
|
|||
|
|
|
|||
|
|
#include "logonsrv.h" // Include files common to entire service
|
|||
|
|
#pragma hdrstop
|
|||
|
|
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// Include nlsecure.h again allocating the actual variables
|
|||
|
|
// this time around.
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
#define NLSECURE_ALLOCATE
|
|||
|
|
#include "nlsecure.h"
|
|||
|
|
#undef NLSECURE_ALLOCATE
|
|||
|
|
|
|||
|
|
|
|||
|
|
NTSTATUS
|
|||
|
|
NlCreateNetlogonObjects(
|
|||
|
|
VOID
|
|||
|
|
)
|
|||
|
|
/*++
|
|||
|
|
|
|||
|
|
Routine Description:
|
|||
|
|
|
|||
|
|
This function creates the workstation user-mode objects which are
|
|||
|
|
represented by security descriptors.
|
|||
|
|
|
|||
|
|
Arguments:
|
|||
|
|
|
|||
|
|
None.
|
|||
|
|
|
|||
|
|
Return Value:
|
|||
|
|
|
|||
|
|
NT status code
|
|||
|
|
|
|||
|
|
--*/
|
|||
|
|
{
|
|||
|
|
NTSTATUS Status;
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// Order matters! These ACEs are inserted into the DACL in the
|
|||
|
|
// following order. Security access is granted or denied based on
|
|||
|
|
// the order of the ACEs in the DACL.
|
|||
|
|
//
|
|||
|
|
//
|
|||
|
|
// Members of Group SECURITY_LOCAL aren't allowed to do a UAS logon
|
|||
|
|
// to force it to be done remotely.
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
ACE_DATA AceData[] = {
|
|||
|
|
|
|||
|
|
{ACCESS_DENIED_ACE_TYPE, 0, 0,
|
|||
|
|
NETLOGON_UAS_LOGON_ACCESS |
|
|||
|
|
NETLOGON_UAS_LOGOFF_ACCESS,
|
|||
|
|
&LocalSid},
|
|||
|
|
|
|||
|
|
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
|
|||
|
|
GENERIC_ALL, &AliasAdminsSid},
|
|||
|
|
|
|||
|
|
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
|
|||
|
|
NETLOGON_CONTROL_ACCESS, &AliasAccountOpsSid},
|
|||
|
|
|
|||
|
|
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
|
|||
|
|
NETLOGON_CONTROL_ACCESS, &AliasSystemOpsSid},
|
|||
|
|
|
|||
|
|
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
|
|||
|
|
NETLOGON_CONTROL_ACCESS |
|
|||
|
|
NETLOGON_SERVICE_ACCESS, &LocalSystemSid},
|
|||
|
|
|
|||
|
|
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
|
|||
|
|
NETLOGON_SERVICE_ACCESS, &LocalServiceSid},
|
|||
|
|
|
|||
|
|
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
|
|||
|
|
NETLOGON_FTINFO_ACCESS, &AuthenticatedUserSid},
|
|||
|
|
|
|||
|
|
{ACCESS_ALLOWED_ACE_TYPE, 0, 0,
|
|||
|
|
NETLOGON_UAS_LOGON_ACCESS |
|
|||
|
|
NETLOGON_UAS_LOGOFF_ACCESS |
|
|||
|
|
NETLOGON_QUERY_ACCESS, &WorldSid}
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// Actually create the security descriptor.
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
Status = NetpCreateSecurityObject(
|
|||
|
|
AceData,
|
|||
|
|
sizeof(AceData)/sizeof(AceData[0]),
|
|||
|
|
AliasAdminsSid,
|
|||
|
|
AliasAdminsSid,
|
|||
|
|
&NlGlobalNetlogonInfoMapping,
|
|||
|
|
&NlGlobalNetlogonSecurityDescriptor );
|
|||
|
|
|
|||
|
|
return Status;
|
|||
|
|
|
|||
|
|
}
|