able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/admin/extens/acldiag/accessck.cpp

1210 lines
35 KiB
C++
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
//+---------------------------------------------------------------------------
//
// Microsoft Windows
// Copyright (C) Microsoft Corporation, 1999.
//
// File: AccessCk.cpp
//
// Contents: Functions imported and modified from ntos\se\accessck.c
//
//
//----------------------------------------------------------------------------
#include "stdafx.h"
#include "AccessCk.h"
#include "adutils.h"
typedef enum {
UpdateRemaining,
UpdateCurrentGranted,
UpdateCurrentDenied
} ACCESS_MASK_FIELD_TO_UPDATE;
//
// Prototypes
//
BOOLEAN
SepSidInSIDList (
IN list<PSID>& psidList,
IN PSID PrincipalSelfSid,
IN PSID Sid);
HRESULT
SepAddAccessTypeList (
IN PIOBJECT_TYPE_LIST ObjectTypeList,
IN size_t ObjectTypeListLength,
IN ULONG StartIndex,
IN ACCESS_MASK AccessMask,
IN ACCESS_MASK_FIELD_TO_UPDATE FieldToUpdate,
IN PSID grantingSid
);
BOOLEAN
SepObjectInTypeList (
IN GUID *ObjectType,
IN PIOBJECT_TYPE_LIST ObjectTypeList,
IN size_t ObjectTypeListLength,
OUT PULONG ReturnedIndex
);
HRESULT
SepUpdateParentTypeList (
IN PIOBJECT_TYPE_LIST ObjectTypeList,
IN size_t ObjectTypeListLength,
IN ULONG StartIndex,
IN PSID grantingSid
);
HRESULT
SetGrantingSid (
IOBJECT_TYPE_LIST& ObjectTypeItem,
ACCESS_MASK_FIELD_TO_UPDATE FieldToUpdate,
ACCESS_MASK oldAccessBits,
ACCESS_MASK newAccessBits,
PSID grantingSid);
///////////////////////////////////////////////////////////////////////////////
PSID SePrincipalSelfSid = 0;
static SID_IDENTIFIER_AUTHORITY SepNtAuthority = SECURITY_NT_AUTHORITY;
HRESULT SepInit ()
{
HRESULT hr = S_OK;
ULONG SidWithOneSubAuthority = RtlLengthRequiredSid (1);
SePrincipalSelfSid = (PSID) CoTaskMemAlloc (SidWithOneSubAuthority);
if ( SePrincipalSelfSid )
{
SID_IDENTIFIER_AUTHORITY SeNtAuthority = SepNtAuthority;
RtlInitializeSid (SePrincipalSelfSid, &SeNtAuthority, 1);
*(RtlSubAuthoritySid (SePrincipalSelfSid, 0)) = SECURITY_PRINCIPAL_SELF_RID;
}
else
hr = E_OUTOFMEMORY;
return hr;
}
VOID SepCleanup ()
{
if ( SePrincipalSelfSid )
{
CoTaskMemFree (SePrincipalSelfSid);
SePrincipalSelfSid = 0;
}
}
///////////////////////////////////////////////////////////////////////////////
HRESULT
SepMaximumAccessCheck(
list<PSID>& psidList,
IN PACL Dacl,
IN PSID PrincipalSelfSid,
IN size_t LocalTypeListLength,
IN PIOBJECT_TYPE_LIST LocalTypeList,
IN size_t ObjectTypeListLength
)
/*++
Routine Description:
Does an access check for maximum allowed or with a result list. The current
granted access is stored in the Remaining access and then another access
check is run.
Arguments:
psidList - list of object sid to check, plus sids of all groups that the object belongs to
Dacl - ACL to check
PrincipalSelfSid - Sid to use in replacing the well-known self sid
LocalTypeListLength - Length of list of types.
LocalTypeList - List of types.
ObjectTypeList - Length of caller-supplied list of object types.
Return Value:
none
--*/
{
if ( !LocalTypeList || ! Dacl )
return E_POINTER;
if ( PrincipalSelfSid && !IsValidSid (PrincipalSelfSid) )
return E_INVALIDARG;
_TRACE (1, L"Entering SepMaximumAccessCheck\n");
PVOID Ace = 0;
ULONG AceCount = Dacl->AceCount;
ULONG Index = 0;
HRESULT hr = S_OK;
//
// granted == NUL
// denied == NUL
//
// for each ACE
//
// if grant
// for each SID
// if SID match, then add all that is not denied to grant mask
//
// if deny
// for each SID
// if SID match, then add all that is not granted to deny mask
//
ULONG i = 0;
for (Ace = FirstAce (Dacl);
i < AceCount;
i++, Ace = NextAce (Ace))
{
if ( !(((PACE_HEADER)Ace)->AceFlags & INHERIT_ONLY_ACE))
{
switch (((PACE_HEADER)Ace)->AceType)
{
case ACCESS_ALLOWED_ACE_TYPE:
if (SepSidInSIDList(psidList, PrincipalSelfSid, &((PACCESS_ALLOWED_ACE)Ace)->SidStart))
{
//
// Only grant access types from this mask that have
// not already been denied
//
// Optimize 'normal' case
if ( LocalTypeListLength == 1 )
{
// TODO: do granting SID
LocalTypeList->CurrentGranted |=
(((PACCESS_ALLOWED_ACE)Ace)->Mask & ~LocalTypeList->CurrentDenied);
}
else
{
//
// The zeroeth object type represents the object itself.
//
hr = SepAddAccessTypeList(
LocalTypeList, // List to modify
LocalTypeListLength, // Length of list
0, // Element to update
((PACCESS_ALLOWED_ACE)Ace)->Mask, // Access Granted
UpdateCurrentGranted,
&((PACCESS_ALLOWED_ACE)Ace)->SidStart);
}
}
break;
//
// Handle an object specific Access Allowed ACE
//
case ACCESS_ALLOWED_OBJECT_ACE_TYPE:
{
//
// If no object type is in the ACE,
// treat this as an ACCESS_ALLOWED_ACE.
//
GUID* ObjectTypeInAce = RtlObjectAceObjectType(Ace);
if ( ObjectTypeInAce == NULL )
{
if ( SepSidInSIDList(psidList, PrincipalSelfSid, RtlObjectAceSid(Ace)) )
{
// Optimize 'normal' case
if ( LocalTypeListLength == 1 )
{
// TODO: do granting SID
LocalTypeList->CurrentGranted |=
(((PACCESS_ALLOWED_OBJECT_ACE)Ace)->Mask & ~LocalTypeList->CurrentDenied);
}
else
{
hr = SepAddAccessTypeList(
LocalTypeList, // List to modify
LocalTypeListLength, // Length of list
0, // Element to update
((PACCESS_ALLOWED_OBJECT_ACE)Ace)->Mask, // Access Granted
UpdateCurrentGranted,
RtlObjectAceSid(Ace));
}
}
//
// If no object type list was passed,
// don't grant access to anyone.
//
}
else if ( ObjectTypeListLength == 0 )
{
// Drop through
//
// If an object type is in the ACE,
// Find it in the LocalTypeList before using the ACE.
//
}
else
{
if ( SepSidInSIDList(psidList, PrincipalSelfSid, RtlObjectAceSid(Ace)) )
{
if ( SepObjectInTypeList( ObjectTypeInAce,
LocalTypeList,
LocalTypeListLength,
&Index ) )
{
hr = SepAddAccessTypeList(
LocalTypeList, // List to modify
LocalTypeListLength, // Length of list
Index, // Element already updated
((PACCESS_ALLOWED_OBJECT_ACE)Ace)->Mask, // Access Granted
UpdateCurrentGranted,
RtlObjectAceSid(Ace));
}
}
}
}
break;
case ACCESS_ALLOWED_COMPOUND_ACE_TYPE:
//
// If we're impersonating, EToken is set to the Client, and if we're not,
// EToken is set to the Primary. According to the DSA architecture, if
// we're asked to evaluate a compound ACE and we're not impersonating,
// pretend we are impersonating ourselves. So we can just use the EToken
// for the client token, since it's already set to the right thing.
//
if ( SepSidInSIDList(psidList, PrincipalSelfSid, RtlCompoundAceClientSid( Ace )) &&
SepSidInSIDList(psidList, NULL, RtlCompoundAceServerSid( Ace )) )
{
//
// Only grant access types from this mask that have
// not already been denied
//
// Optimize 'normal' case
if ( LocalTypeListLength == 1 )
{
// TODO: do granting SID
LocalTypeList->CurrentGranted |=
(((PCOMPOUND_ACCESS_ALLOWED_ACE)Ace)->Mask & ~LocalTypeList->CurrentDenied);
}
else
{
//
// The zeroeth object type represents the object itself.
//
hr = SepAddAccessTypeList(
LocalTypeList, // List to modify
LocalTypeListLength, // Length of list
0, // Element to update
((PCOMPOUND_ACCESS_ALLOWED_ACE)Ace)->Mask, // Access Granted
UpdateCurrentGranted,
RtlCompoundAceClientSid (Ace));
}
}
break;
case ACCESS_DENIED_ACE_TYPE:
if ( SepSidInSIDList(psidList, PrincipalSelfSid, &((PACCESS_DENIED_ACE)Ace)->SidStart))
{
//
// Only deny access types from this mask that have
// not already been granted
//
// Optimize 'normal' case
if ( LocalTypeListLength == 1 )
{
// TODO: do granting SID
LocalTypeList->CurrentDenied |=
(((PACCESS_DENIED_ACE)Ace)->Mask & ~LocalTypeList->CurrentGranted);
}
else
{
//
// The zeroeth object type represents the object itself.
//
hr = SepAddAccessTypeList(
LocalTypeList, // List to modify
LocalTypeListLength, // Length of list
0, // Element to update
((PACCESS_DENIED_ACE)Ace)->Mask, // Access denied
UpdateCurrentDenied,
&((PACCESS_DENIED_ACE)Ace)->SidStart);
}
}
break;
//
// Handle an object specific Access Denied ACE
//
case ACCESS_DENIED_OBJECT_ACE_TYPE:
{
PSID psid = RtlObjectAceSid(Ace);
ASSERT (IsValidSid (psid));
if ( IsValidSid (psid) && SepSidInSIDList(psidList, PrincipalSelfSid, psid) )
{
//
// If there is no object type in the ACE,
// or if the caller didn't specify an object type list,
// apply this deny ACE to the entire object.
//
GUID* ObjectTypeInAce = RtlObjectAceObjectType(Ace);
if ( ObjectTypeInAce == NULL ||
ObjectTypeListLength == 0 )
{
// TODO: do granting SID
LocalTypeList->CurrentDenied |=
(((PACCESS_DENIED_OBJECT_ACE)Ace)->Mask & ~LocalTypeList->CurrentGranted);
//
// Otherwise apply the deny ACE to the object specified
// in the ACE.
//
}
else if ( SepObjectInTypeList( ObjectTypeInAce,
LocalTypeList,
LocalTypeListLength,
&Index ) )
{
hr = SepAddAccessTypeList(
LocalTypeList, // List to modify
LocalTypeListLength, // Length of list
Index, // Element to update
((PACCESS_DENIED_OBJECT_ACE)Ace)->Mask, // Access denied
UpdateCurrentDenied,
psid);
}
}
}
break;
default:
break;
}
}
}
_TRACE (-1, L"Leaving SepMaximumAccessCheck\n");
return hr;
}
NTSTATUS
SeCaptureObjectTypeList (
IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
IN size_t ObjectTypeListLength,
OUT PIOBJECT_TYPE_LIST *CapturedObjectTypeList
)
/*++
Routine Description:
This routine probes and captures a copy of any object type list
that might have been provided via the ObjectTypeList argument.
The object type list is converted to the internal form that explicitly
specifies the hierarchical relationship between the entries.
The object typs list is validated to ensure a valid hierarchical
relationship is represented.
Arguments:
ObjectTypeList - The object type list from which the type list
information is to be retrieved.
ObjectTypeListLength - Number of elements in ObjectTypeList
CapturedObjectTypeList - Receives the captured type list which
must be freed using SeFreeCapturedObjectTypeList().
Return Value:
STATUS_SUCCESS indicates no exceptions were encountered.
Any access violations encountered will be returned.
--*/
{
_TRACE (1, L"Entering SeCaptureObjectTypeList\n");
NTSTATUS Status = STATUS_SUCCESS;
PIOBJECT_TYPE_LIST LocalTypeList = NULL;
ULONG Levels[ACCESS_MAX_LEVEL+1];
//
// Set default return
//
*CapturedObjectTypeList = NULL;
if ( ObjectTypeListLength == 0 )
{
// Drop through
}
else if ( !ARGUMENT_PRESENT(ObjectTypeList) )
{
Status = STATUS_INVALID_PARAMETER;
}
else
{
//
// Allocate a buffer to copy into.
//
LocalTypeList = new IOBJECT_TYPE_LIST[ObjectTypeListLength];
if ( !LocalTypeList )
{
Status = STATUS_INSUFFICIENT_RESOURCES;
//
// Copy the callers structure to the local structure.
//
}
else
{
GUID * CapturedObjectType = 0;
for (ULONG i=0; i < ObjectTypeListLength; i++ )
{
//
// Limit ourselves
//
USHORT CurrentLevel = ObjectTypeList[i].Level;
if ( CurrentLevel > ACCESS_MAX_LEVEL )
{
Status = STATUS_INVALID_PARAMETER;
break;
}
//
// Copy data the caller passed in
//
LocalTypeList[i].Level = CurrentLevel;
LocalTypeList[i].Flags = 0;
CapturedObjectType = ObjectTypeList[i].ObjectType;
LocalTypeList[i].ObjectType = *CapturedObjectType;
LocalTypeList[i].Remaining = 0;
LocalTypeList[i].CurrentGranted = 0;
LocalTypeList[i].CurrentDenied = 0;
//
// Ensure that the level number is consistent with the
// level number of the previous entry.
//
if ( i == 0 )
{
if ( CurrentLevel != 0 )
{
Status = STATUS_INVALID_PARAMETER;
break;
}
}
else
{
//
// The previous entry is either:
// my immediate parent,
// my sibling, or
// the child (or grandchild, etc.) of my sibling.
//
if ( CurrentLevel > LocalTypeList[i-1].Level + 1 )
{
Status = STATUS_INVALID_PARAMETER;
break;
}
//
// Don't support two roots.
//
if ( CurrentLevel == 0 )
{
Status = STATUS_INVALID_PARAMETER;
break;
}
}
//
// If the above rules are maintained,
// then my parent object is the last object seen that
// has a level one less than mine.
//
if ( CurrentLevel == 0 )
{
LocalTypeList[i].ParentIndex = -1;
}
else
{
LocalTypeList[i].ParentIndex = Levels[CurrentLevel-1];
}
//
// Save this obect as the last object seen at this level.
//
Levels[CurrentLevel] = i;
}
}
} // end_if
*CapturedObjectTypeList = LocalTypeList;
_TRACE (-1, L"Leaving SeCaptureObjectTypeList: Status = 0x%x\n", Status);
return Status;
}
BOOLEAN
SepSidInSIDList (
IN list<PSID>& psidList,
IN PSID PrincipalSelfSid,
IN PSID Sid)
/*++
Routine Description:
Checks to see if a given restricted SID is in the given sid list.
N.B. The code to compute the length of a SID and test for equality
is duplicated from the security runtime since this is such a
frequently used routine.
Arguments:
psidList - the list of sids to be examined
PrincipalSelfSid - If the object being access checked is an object which
represents a principal (e.g., a user object), this parameter should
be the SID of the object. Any ACE containing the constant
PRINCIPAL_SELF_SID is replaced by this SID.
The parameter should be NULL if the object does not represent a principal.
Sid - Pointer to the SID of interest
DenyAce - The ACE being evaluated is a DENY or ACCESS DENIED ace
Restricted - The access check being performed uses the restricted sids.
Return Value:
A value of TRUE indicates that the SID is in the token, FALSE
otherwise.
--*/
{
_TRACE (1, L"Entering SeSidInSIDList\n");
BOOLEAN bRVal = FALSE;
PISID MatchSid = 0;
ASSERT (IsValidSid (Sid));
if ( IsValidSid (Sid) )
{
//
// If Sid is the constant PrincipalSelfSid,
// replace it with the passed in PrincipalSelfSid.
//
if ( PrincipalSelfSid != NULL && EqualSid (SePrincipalSelfSid, Sid) )
{
Sid = PrincipalSelfSid;
}
//
// Get address of user/group array and number of user/groups.
//
//
// Scan through the user/groups and attempt to find a match with the
// specified SID.
//
ULONG i = 0;
for (list<PSID>::iterator itr = psidList.begin ();
itr != psidList.end ();
itr++, i++)
{
ASSERT (IsValidSid (*itr));
MatchSid = (PISID)*itr;
if ( ::EqualSid (Sid, *itr) )
{
bRVal = true;
break;
}
}
}
_TRACE (-1, L"Leaving SeSidInSIDList: %s\n", bRVal ? L"TRUE" : L"FALSE");
return bRVal;
}
HRESULT
SepAddAccessTypeList (
IN PIOBJECT_TYPE_LIST ObjectTypeList,
IN size_t ObjectTypeListLength,
IN ULONG StartIndex,
IN ACCESS_MASK AccessMask,
IN ACCESS_MASK_FIELD_TO_UPDATE FieldToUpdate,
IN PSID grantingSid
)
/*++
Routine Description:
This routine grants the specified AccessMask to all of the objects that
are descendents of the object specified by StartIndex.
The Access fields of the parent objects are also recomputed as needed.
For example, if an ACE granting access to a Property Set is found,
that access is granted to all the Properties in the Property Set.
Arguments:
ObjectTypeList - The object type list to update.
ObjectTypeListLength - Number of elements in ObjectTypeList
StartIndex - Index to the target element to update.
AccessMask - Mask of access to grant to the target element and
all of its decendents
FieldToUpdate - Indicate which fields to update in object type list
Return Value:
None.
--*/
{
if ( !ObjectTypeList )
return E_POINTER;
if ( !IsValidSid (grantingSid) )
return E_INVALIDARG;
_TRACE (1, L"Entering SepAddAccessTypeList\n");
ACCESS_MASK OldRemaining = 0;
ACCESS_MASK OldCurrentGranted = 0;
ACCESS_MASK OldCurrentDenied = 0;
BOOLEAN AvoidParent = FALSE;
HRESULT hr = S_OK;
// PAGED_CODE();
//
// Update the requested field.
//
// Always handle the target entry.
//
// If we've not actually changed the bits,
// early out.
//
switch (FieldToUpdate )
{
case UpdateRemaining:
OldRemaining = ObjectTypeList[StartIndex].Remaining;
ObjectTypeList[StartIndex].Remaining = OldRemaining & ~AccessMask;
if ( OldRemaining == ObjectTypeList[StartIndex].Remaining )
{
return hr;
}
else
{
hr = SetGrantingSid (
ObjectTypeList[StartIndex],
FieldToUpdate,
OldRemaining,
AccessMask & ~ObjectTypeList[StartIndex].Remaining,
grantingSid);
}
break;
case UpdateCurrentGranted:
OldCurrentGranted = ObjectTypeList[StartIndex].CurrentGranted;
ObjectTypeList[StartIndex].CurrentGranted |=
AccessMask & ~ObjectTypeList[StartIndex].CurrentDenied;
if ( OldCurrentGranted == ObjectTypeList[StartIndex].CurrentGranted )
{
//
// We can't simply return here.
// We have to visit our children. Consider the case where there
// was a previous deny ACE on a child. That deny would have
// propagated up the tree to this entry. However, this allow ACE
// needs to be added all of the children that haven't been
// explictly denied.
//
AvoidParent = TRUE;
}
else
{
hr = SetGrantingSid (
ObjectTypeList[StartIndex],
FieldToUpdate,
OldCurrentGranted,
AccessMask & ~ObjectTypeList[StartIndex].CurrentDenied,
grantingSid);
}
break;
case UpdateCurrentDenied:
OldCurrentDenied = ObjectTypeList[StartIndex].CurrentDenied;
ObjectTypeList[StartIndex].CurrentDenied |=
AccessMask & ~ObjectTypeList[StartIndex].CurrentGranted;
if ( OldCurrentDenied == ObjectTypeList[StartIndex].CurrentDenied )
{
return hr;
}
else
{
hr = SetGrantingSid (
ObjectTypeList[StartIndex],
FieldToUpdate,
OldCurrentDenied,
AccessMask & ~ObjectTypeList[StartIndex].CurrentGranted,
grantingSid);
}
break;
default:
return hr;
}
//
// Go update parent of the target.
//
if ( !AvoidParent )
{
hr = SepUpdateParentTypeList( ObjectTypeList,
ObjectTypeListLength,
StartIndex,
grantingSid);
}
//
// Loop handling all children of the target.
//
for (ULONG Index = StartIndex + 1; Index < ObjectTypeListLength; Index++)
{
//
// By definition, the children of an object are all those entries
// immediately following the target. The list of children (or
// grandchildren) stops as soon as we reach an entry the has the
// same level as the target (a sibling) or lower than the target
// (an uncle).
//
if ( ObjectTypeList[Index].Level <= ObjectTypeList[StartIndex].Level )
{
break;
}
//
// Grant access to the children
//
switch (FieldToUpdate)
{
case UpdateRemaining:
ObjectTypeList[Index].Remaining &= ~AccessMask;
hr = SetGrantingSid (
ObjectTypeList[Index],
FieldToUpdate,
OldRemaining,
~AccessMask,
grantingSid);
break;
case UpdateCurrentGranted:
ObjectTypeList[Index].CurrentGranted |=
AccessMask & ~ObjectTypeList[Index].CurrentDenied;
hr = SetGrantingSid (
ObjectTypeList[Index],
FieldToUpdate,
OldCurrentGranted,
AccessMask & ~ObjectTypeList[Index].CurrentDenied,
grantingSid);
break;
case UpdateCurrentDenied:
ObjectTypeList[Index].CurrentDenied |=
AccessMask & ~ObjectTypeList[Index].CurrentGranted;
hr = SetGrantingSid (
ObjectTypeList[Index],
FieldToUpdate,
OldCurrentDenied,
AccessMask & ~ObjectTypeList[Index].CurrentGranted,
grantingSid);
break;
default:
return hr;
}
}
_TRACE (-1, L"Leaving SepAddAccessTypeList\n");
return hr;
}
BOOLEAN
SepObjectInTypeList (
IN GUID *ObjectType,
IN PIOBJECT_TYPE_LIST ObjectTypeList,
IN size_t ObjectTypeListLength,
OUT PULONG ReturnedIndex
)
/*++
Routine Description:
This routine searches an ObjectTypeList to determine if the specified
object type is in the list.
Arguments:
ObjectType - Object Type to search for.
ObjectTypeList - The object type list to search.
ObjectTypeListLength - Number of elements in ObjectTypeList
ReturnedIndex - Index to the element ObjectType was found in
Return Value:
TRUE: ObjectType was found in list.
FALSE: ObjectType was not found in list.
--*/
{
if ( !ObjectType || !ObjectTypeList )
return FALSE;
_TRACE (1, L"Entering SepObjectInTypeList\n");
BOOLEAN bRVal = FALSE;
GUID* LocalObjectType = 0;
#if DBG
HRESULT hr = S_OK;
GUID_TYPE* pType = 0;
wstring strClassName1;
hr = _Module.GetClassFromGUID (*ObjectType, strClassName1, pType);
ASSERT (SUCCEEDED (hr));
#endif
#pragma warning (disable : 4127)
ASSERT( sizeof(GUID) == sizeof(ULONG) * 4 );
#pragma warning (default : 4127)
for (ULONG Index = 0; Index < ObjectTypeListLength; Index++)
{
LocalObjectType = &ObjectTypeList[Index].ObjectType;
#if DBG
wstring strClassName2;
hr = _Module.GetClassFromGUID (*LocalObjectType, strClassName2, pType);
ASSERT (SUCCEEDED (hr));
_TRACE (0, L"\tComparing %s to %s\n", strClassName1.c_str (), strClassName2.c_str ());
#endif
if ( RtlpIsEqualGuid( ObjectType, LocalObjectType ) )
{
*ReturnedIndex = Index;
bRVal = TRUE;
break;
}
}
_TRACE (-1, L"Leaving SepObjectInTypeList: %s\n", bRVal ? L"TRUE" : L"FALSE");
return bRVal;
}
HRESULT
SepUpdateParentTypeList (
IN PIOBJECT_TYPE_LIST ObjectTypeList,
IN size_t ObjectTypeListLength,
IN ULONG StartIndex,
PSID grantingSid
)
/*++
Routine Description:
Update the Access fields of the parent object of the specified object.
The "remaining" field of a parent object is the logical OR of
the remaining field of all of its children.
The CurrentGranted field of the parent is the collection of bits
granted to every one of its children..
The CurrentDenied fields of the parent is the logical OR of
the bits denied to any of its children.
This routine takes an index to one of the children and updates the
remaining field of the parent (and grandparents recursively).
Arguments:
ObjectTypeList - The object type list to update.
ObjectTypeListLength - Number of elements in ObjectTypeList
StartIndex - Index to the "child" element whose parents are to be updated.
Return Value:
None.
--*/
{
if ( !ObjectTypeList )
return E_POINTER;
if ( !IsValidSid (grantingSid) )
return E_INVALIDARG;
_TRACE (1, L"Entering SepUpdateParentTypeList\n");
ACCESS_MASK NewRemaining = 0;
ACCESS_MASK NewCurrentGranted = 0xFFFFFFFF;
ACCESS_MASK NewCurrentDenied = 0;
HRESULT hr = S_OK;
//
// If the target node is at the root,
// we're all done.
//
if ( ObjectTypeList[StartIndex].ParentIndex == -1 )
{
return hr;
}
//
// Get the index to the parent that needs updating and the level of
// the siblings.
//
ULONG ParentIndex = ObjectTypeList[StartIndex].ParentIndex;
ULONG Level = ObjectTypeList[StartIndex].Level;
//
// Loop through all the children.
//
for (UINT Index=ParentIndex+1; Index<ObjectTypeListLength; Index++ )
{
//
// By definition, the children of an object are all those entries
// immediately following the target. The list of children (or
// grandchildren) stops as soon as we reach an entry the has the
// same level as the target (a sibling) or lower than the target
// (an uncle).
//
if ( ObjectTypeList[Index].Level <= ObjectTypeList[ParentIndex].Level )
{
break;
}
//
// Only handle direct children of the parent.
//
if ( ObjectTypeList[Index].Level != Level )
{
continue;
}
//
// Compute the new bits for the parent.
//
NewRemaining |= ObjectTypeList[Index].Remaining;
NewCurrentGranted &= ObjectTypeList[Index].CurrentGranted;
NewCurrentDenied |= ObjectTypeList[Index].CurrentDenied;
}
//
// If we've not changed the access to the parent,
// we're done.
//
if ( NewRemaining == ObjectTypeList[ParentIndex].Remaining &&
NewCurrentGranted == ObjectTypeList[ParentIndex].CurrentGranted &&
NewCurrentDenied == ObjectTypeList[ParentIndex].CurrentDenied )
{
return hr;
}
//
// Change the parent.
//
hr = SetGrantingSid (
ObjectTypeList[ParentIndex],
UpdateRemaining,
ObjectTypeList[ParentIndex].Remaining,
NewRemaining,
grantingSid);
ObjectTypeList[ParentIndex].Remaining = NewRemaining;
hr = SetGrantingSid (
ObjectTypeList[ParentIndex],
UpdateCurrentGranted,
ObjectTypeList[ParentIndex].CurrentGranted,
NewCurrentGranted,
grantingSid);
ObjectTypeList[ParentIndex].CurrentGranted = NewCurrentGranted;
hr = SetGrantingSid (
ObjectTypeList[ParentIndex],
UpdateCurrentDenied,
ObjectTypeList[ParentIndex].CurrentDenied,
NewCurrentDenied,
grantingSid);
ObjectTypeList[ParentIndex].CurrentDenied = NewCurrentDenied;
//
// Go update the grand parents.
//
hr = SepUpdateParentTypeList( ObjectTypeList,
ObjectTypeListLength,
ParentIndex,
grantingSid);
_TRACE (-1, L"Leaving SepUpdateParentTypeList\n");
return hr;
}
PSID AllocAndCopySid (PSID pSid)
{
if ( !pSid )
return 0;
DWORD dwSidLen = GetLengthSid (pSid);
PSID pSidCopy = CoTaskMemAlloc (dwSidLen);
if ( pSidCopy )
{
if ( CopySid (dwSidLen, pSidCopy, pSid) )
{
ASSERT (IsValidSid (pSidCopy));
}
}
return pSidCopy;
}
HRESULT SetGrantingSid (
IOBJECT_TYPE_LIST& ObjectTypeItem,
ACCESS_MASK_FIELD_TO_UPDATE FieldToUpdate,
ACCESS_MASK oldAccessBits,
ACCESS_MASK newAccessBits,
PSID grantingSid)
{
if ( !IsValidSid (grantingSid) )
return E_INVALIDARG;
HRESULT hr = S_OK;
UINT nSid = 0;
for (ULONG nBit = 0x1; nBit; nBit <<= 1, nSid++)
{
if ( (newAccessBits & nBit) &&
!(oldAccessBits & nBit) )
{
switch (FieldToUpdate)
{
case UpdateCurrentGranted:
if ( !ObjectTypeItem.grantingSid[nSid] )
{
ObjectTypeItem.grantingSid[nSid] = AllocAndCopySid (grantingSid);
if ( !ObjectTypeItem.grantingSid[nSid] )
hr = E_OUTOFMEMORY;
break;
}
break;
case UpdateCurrentDenied:
if ( !ObjectTypeItem.denyingSid[nSid] )
{
ObjectTypeItem.denyingSid[nSid] = AllocAndCopySid (grantingSid);
if ( !ObjectTypeItem.denyingSid[nSid] )
hr = E_OUTOFMEMORY;
break;
}
break;
case UpdateRemaining:
break;
default:
break;
}
}
}
return hr;
}
Reference in a new issue Copy permalink