able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/shell/osshell/security/aclui/misc.cpp

1687 lines
45 KiB
C++
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
//+-------------------------------------------------------------------------
//
// Microsoft Windows
//
// Copyright (C) Microsoft Corporation, 1996 - 1999
//
// File: misc.cpp
//
// This file contains miscellaneous helper functions.
//
//--------------------------------------------------------------------------
#include "aclpriv.h"
/*******************************************************************
NAME: GetAceSid
SYNOPSIS: Gets pointer to SID from an ACE
ENTRY: pAce - pointer to ACE
EXIT:
RETURNS: Pointer to SID if successful, NULL otherwise
NOTES:
HISTORY:
JeffreyS 08-Oct-1996 Created
********************************************************************/
PSID
GetAceSid(PACE_HEADER pAce)
{
switch (pAce->AceType)
{
case ACCESS_ALLOWED_ACE_TYPE:
case ACCESS_DENIED_ACE_TYPE:
case SYSTEM_AUDIT_ACE_TYPE:
case SYSTEM_ALARM_ACE_TYPE:
return (PSID)&((PKNOWN_ACE)pAce)->SidStart;
case ACCESS_ALLOWED_COMPOUND_ACE_TYPE:
return (PSID)&((PKNOWN_COMPOUND_ACE)pAce)->SidStart;
case ACCESS_ALLOWED_OBJECT_ACE_TYPE:
case ACCESS_DENIED_OBJECT_ACE_TYPE:
case SYSTEM_AUDIT_OBJECT_ACE_TYPE:
case SYSTEM_ALARM_OBJECT_ACE_TYPE:
return RtlObjectAceSid(pAce);
}
return NULL;
}
/*******************************************************************
NAME: LocalAllocSid
SYNOPSIS: Copies a SID
ENTRY: pOriginal - pointer to SID to copy
EXIT:
RETURNS: Pointer to SID if successful, NULL otherwise
NOTES: Caller must free the returned SID with LocalFree
HISTORY:
JeffreyS 12-Apr-1999 Created
********************************************************************/
PSID
LocalAllocSid(PSID pOriginal)
{
PSID pCopy = NULL;
if (pOriginal && IsValidSid(pOriginal))
{
DWORD dwLength = GetLengthSid(pOriginal);
pCopy = (PSID)LocalAlloc(LMEM_FIXED, dwLength);
if (NULL != pCopy)
CopyMemory(pCopy, pOriginal, dwLength);
}
return pCopy;
}
/*******************************************************************
NAME: DestroyDPA
SYNOPSIS: LocalFree's all pointers in a Dynamic Pointer
Array and then frees the DPA.
ENTRY: hList - handle of list to destroy
EXIT:
RETURNS: nothing
NOTES:
HISTORY:
JeffreyS 08-Oct-1996 Created
********************************************************************/
int CALLBACK
_LocalFreeCB(LPVOID pVoid, LPVOID /*pData*/)
{
if (pVoid)
LocalFree(pVoid);
return 1;
}
void
DestroyDPA(HDPA hList)
{
if (hList != NULL)
DPA_DestroyCallback(hList, _LocalFreeCB, 0);
}
/*******************************************************************
NAME: GetLSAConnection
SYNOPSIS: Wrapper for LsaOpenPolicy
ENTRY: pszServer - the server on which to make the connection
EXIT:
RETURNS: LSA_HANDLE if successful, NULL otherwise
NOTES:
HISTORY:
JeffreyS 08-Oct-1996 Created
********************************************************************/
LSA_HANDLE
GetLSAConnection(LPCTSTR pszServer, DWORD dwAccessDesired)
{
LSA_HANDLE hPolicy = NULL;
LSA_UNICODE_STRING uszServer = {0};
LSA_UNICODE_STRING *puszServer = NULL;
LSA_OBJECT_ATTRIBUTES oa;
SECURITY_QUALITY_OF_SERVICE sqos;
sqos.Length = SIZEOF(sqos);
sqos.ImpersonationLevel = SecurityImpersonation;
sqos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
sqos.EffectiveOnly = FALSE;
InitializeObjectAttributes(&oa, NULL, 0, NULL, NULL);
oa.SecurityQualityOfService = &sqos;
if (pszServer &&
*pszServer &&
RtlCreateUnicodeString(&uszServer, pszServer))
{
puszServer = &uszServer;
}
LsaOpenPolicy(puszServer, &oa, dwAccessDesired, &hPolicy);
if (puszServer)
RtlFreeUnicodeString(puszServer);
return hPolicy;
}
/*******************************************************************
NAME: LookupSid
SYNOPSIS: Gets the qualified account name for a given SID
ENTRY: pszServer - the server on which to do the lookup
pSid - the SID to lookup
EXIT: *ppszName contains the account name. This buffer
must be freed by the caller with LocalFree.
*pSidType contains the SID type. pSidType is optional.
RETURNS: TRUE if successful, FALSE otherwise
NOTES:
HISTORY:
JeffreyS 08-Oct-1996 Created
JeffreyS 16-Jan-1998 Converted to HDPA (multiple lookup)
********************************************************************/
BOOL
LookupSids(HDPA hSids, LPCTSTR pszServer, LPSECURITYINFO2 psi2, PUSER_LIST *ppUserList)
{
PSIDCACHE pSidCache;
if (NULL == hSids)
return FALSE;
if (ppUserList != NULL)
*ppUserList = NULL;
pSidCache = GetSidCache();
if (NULL != pSidCache)
{
BOOL bRet = pSidCache->LookupSids(hSids, pszServer, psi2, ppUserList);
pSidCache->Release();
return bRet;
}
return FALSE;
}
BOOL
LookupSid(PSID pSid, LPCTSTR pszServer, LPSECURITYINFO2 psi2, PUSER_LIST *ppUserList)
{
BOOL fResult;
HDPA hSids = NULL;
if (NULL == pSid)
return FALSE;
hSids = DPA_Create(1);
if (NULL == hSids)
return FALSE;
DPA_AppendPtr(hSids, pSid);
fResult = LookupSids(hSids, pszServer, psi2, ppUserList);
if (NULL != hSids)
DPA_Destroy(hSids);
return fResult;
}
// Private data structure used by LookupSidsAsync to pass
// data needed by the thread
typedef struct _LOOKUPSIDSDATA
{
HDPA hSids;
LPTSTR pszServer;
HWND hWndNotify;
UINT uMsgNotify;
} LOOKUPSIDSDATA, *PLOOKUPSIDSDATA;
DWORD WINAPI
_LookupSidsAsyncProc(LPVOID pv)
{
PLOOKUPSIDSDATA pdata = (PLOOKUPSIDSDATA)pv;
if (pdata)
{
PSIDCACHE pSidCache = GetSidCache();
if (NULL != pSidCache)
{
pSidCache->LookupSidsAsync(pdata->hSids,
pdata->pszServer,
NULL,
pdata->hWndNotify,
pdata->uMsgNotify);
pSidCache->Release();
}
PostMessage(pdata->hWndNotify, pdata->uMsgNotify, 0, 0);
DestroyDPA(pdata->hSids);
LocalFreeString(&pdata->pszServer);
LocalFree(pdata);
}
FreeLibraryAndExitThread(GetModuleHandle(c_szDllName), 0);
return 0;
}
BOOL
LookupSidsAsync(HDPA hSids,
LPCTSTR pszServer,
LPSECURITYINFO2 psi2,
HWND hWndNotify,
UINT uMsgNotify,
PHANDLE phThread)
{
PLOOKUPSIDSDATA pdata;
if (phThread)
*phThread = NULL;
if (NULL == hSids)
return FALSE;
if (psi2)
{
// Should marshal psi2 into a stream and do this on the
// other thread. Well No one has implemented psi2 so its fine.
BOOL bResult = LookupSids(hSids, pszServer, psi2, NULL);
PostMessage(hWndNotify, uMsgNotify, 0, 0);
return bResult;
}
//
// Copy all of the data so the thread can be abandoned if necessary
//
pdata = (PLOOKUPSIDSDATA)LocalAlloc(LPTR, SIZEOF(LOOKUPSIDSDATA));
if (pdata)
{
int cSids;
int i;
HINSTANCE hInstThisDll;
DWORD dwThreadId;
HANDLE hThread;
cSids = DPA_GetPtrCount(hSids);
pdata->hSids = DPA_Create(cSids);
if (!pdata->hSids)
{
LocalFree(pdata);
return FALSE;
}
for (i = 0; i < cSids; i++)
{
PSID p2 = LocalAllocSid((PSID)DPA_FastGetPtr(hSids, i));
if (p2)
{
DPA_AppendPtr(pdata->hSids, p2);
}
}
if (pszServer)
LocalAllocString(&pdata->pszServer, pszServer);
pdata->hWndNotify = hWndNotify;
pdata->uMsgNotify = uMsgNotify;
// Give the thread we are about to create a ref to the dll,
// so that the dll will remain for the lifetime of the thread
hInstThisDll = LoadLibrary(c_szDllName);
hThread = CreateThread(NULL,
0,
_LookupSidsAsyncProc,
pdata,
NULL,
&dwThreadId);
if (hThread != NULL)
{
if (phThread)
*phThread = hThread;
else
CloseHandle(hThread);
return TRUE;
}
else
{
// Thread creation has failed; clean up
DestroyDPA(pdata->hSids);
LocalFreeString(&pdata->pszServer);
LocalFree(pdata);
FreeLibrary(hInstThisDll);
}
}
return FALSE;
}
BOOL
BuildUserDisplayName(LPTSTR *ppszDisplayName,
LPCTSTR pszName,
LPCTSTR pszLogonName)
{
TCHAR szDisplayName[MAX_PATH];
if (NULL == ppszDisplayName || NULL == pszName)
return FALSE;
*ppszDisplayName = NULL;
if (NULL != pszLogonName && *pszLogonName)
{
return (BOOL)FormatStringID(ppszDisplayName,
::hModule,
IDS_FMT_USER_DISPLAY,
pszName,
pszLogonName);
}
return SUCCEEDED(LocalAllocString(ppszDisplayName, pszName));
}
/*******************************************************************
NAME: LoadImageList
SYNOPSIS: Creates an image list from a bitmap resource
ENTRY: hInstance - the bitmap lives here
pszBitmapID - resource ID of the bitmap
EXIT:
RETURNS: HIMAGELIST if successful, NULL otherwise
NOTES:
In order to calculate the number of images, it is assumed
that the width and height of a single image are the same.
HISTORY:
JeffreyS 08-Oct-1996 Created
********************************************************************/
HIMAGELIST
LoadImageList(HINSTANCE hInstance, LPCTSTR pszBitmapID)
{
HIMAGELIST himl = NULL;
HBITMAP hbm = LoadBitmap(hInstance, pszBitmapID);
if (hbm != NULL)
{
BITMAP bm;
GetObject(hbm, SIZEOF(bm), &bm);
himl = ImageList_Create(bm.bmHeight, // height == width
bm.bmHeight,
ILC_COLOR | ILC_MASK,
bm.bmWidth / bm.bmHeight,
0); // don't need to grow
if (himl != NULL)
ImageList_AddMasked(himl, hbm, CLR_DEFAULT);
DeleteObject(hbm);
}
return himl;
}
/*******************************************************************
NAME: GetSidImageIndex
SYNOPSIS: Gets the image index for the given SID type
ENTRY: sidType - type of SID
sidSys - well-known group type
fRemoteUser - TRUE if SID is a user on a remote system
EXIT:
RETURNS: index into image list
NOTES:
HISTORY:
JeffreyS 08-Oct-1996 Created
********************************************************************/
SID_IMAGE_INDEX
GetSidImageIndex(PSID psid,
SID_NAME_USE sidType)
{
SID_IMAGE_INDEX idBitmap;
switch (sidType)
{
case SidTypeUser:
idBitmap = SID_IMAGE_USER;
break;
case SidTypeAlias:
case SidTypeGroup:
case SidTypeWellKnownGroup:
idBitmap = SID_IMAGE_GROUP;
break;
#if(_WIN32_WINNT >= 0x0500)
case SidTypeComputer:
idBitmap = SID_IMAGE_COMPUTER;
break;
#endif
default:
idBitmap = SID_IMAGE_UNKNOWN;
break;
}
return idBitmap;
}
#if(_WIN32_WINNT >= 0x0500)
#include <dsrole.h>
BOOL IsStandalone(LPCTSTR pszMachine, PBOOL pbIsDC)
{
BOOL bStandalone = TRUE;
PDSROLE_PRIMARY_DOMAIN_INFO_BASIC pDsRole = NULL;
//
// Find out if target machine is a standalone machine or joined to
// an NT domain.
//
__try
{
if (pbIsDC)
*pbIsDC = FALSE;
DsRoleGetPrimaryDomainInformation(pszMachine,
DsRolePrimaryDomainInfoBasic,
(PBYTE*)&pDsRole);
}
__finally
{
}
if (NULL != pDsRole)
{
if (pDsRole->MachineRole == DsRole_RoleStandaloneWorkstation ||
pDsRole->MachineRole == DsRole_RoleStandaloneServer)
{
bStandalone = TRUE;
}
else
bStandalone = FALSE;
if (pbIsDC)
{
if (pDsRole->MachineRole == DsRole_RolePrimaryDomainController ||
pDsRole->MachineRole == DsRole_RoleBackupDomainController)
{
*pbIsDC = TRUE;
}
}
DsRoleFreeMemory(pDsRole);
}
return bStandalone;
}
#else // _WIN32_WINNT < 0x0500
BOOL IsStandalone(LPCTSTR pszMachine, PBOOL pbIsDC)
{
BOOL bStandalone = FALSE;
//implement an NT4 version of this? There is no request for this
//so no need.
if (pbIsDC)
*pbIsDC = FALSE;
return bStandalone;
}
//
// Stuff used by GetUserGroup below
//
#include <getuser.h>
const TCHAR c_szGetUserLib[] = TEXT("netui2.dll");
const char c_szOpenUB[] = "OpenUserBrowser";
const char c_szEnumUBSelection[] = "EnumUserBrowserSelection";
const char c_szCloseUB[] = "CloseUserBrowser";
typedef HUSERBROW (WINAPI *PFN_UB_OPEN)(LPUSERBROWSER);
typedef BOOL (WINAPI *PFN_UB_ENUM)(HUSERBROW, LPUSERDETAILS, LPDWORD);
typedef BOOL (WINAPI *PFN_UB_CLOSE)(HUSERBROW);
PFN_UB_OPEN pfnUBOpen;
PFN_UB_ENUM pfnUBEnum;
PFN_UB_CLOSE pfnUBClose;
#ifndef HC_SED_USER_BROWSER_DIALOG
#define HC_SED_USER_BROWSER_DIALOG 4300
#define HC_SED_USER_BROWSER_AUDIT_DLG 4325
#endif
/*******************************************************************
NAME: GetUserGroup
SYNOPSIS: Invokes the old NT4 user/group picker dialog
ENTRY: hwndOwner - owner window
dwFlags - indicate multi-select, etc.
pszServer - initial focus of dialog
ppUserList - out parameter
EXIT: *ppUserList contains a list of USER_INFO structures
RETURNS: HRESULT
NOTES: *ppUserList must be LocalFree'd by the caller.
HISTORY:
JeffreyS 16-Jan-1998 Created
********************************************************************/
HRESULT
GetUserGroup(HWND hwndOwner,
DWORD dwFlags,
LPCTSTR pszServer,
BOOL /*bStandalone*/,
PUSER_LIST *ppUserList)
{
HRESULT hr = S_OK;
HUSERBROW hUserBrowser = NULL;
USERBROWSER ub;
DWORD dwUDLength = 1024;
PUSERDETAILS pUserDetails = NULL;
PSID_CACHE_ENTRY pEntry;
HDPA hEntryList = NULL;
PSIDCACHE pSidCache = NULL;
TraceEnter(TRACE_MISC, "GetUserGroup");
TraceAssert(ppUserList != NULL);
if (!ppUserList)
TraceLeaveResult(E_INVALIDARG);
*ppUserList = NULL;
if (!g_hGetUserLib)
{
g_hGetUserLib = LoadLibrary(c_szGetUserLib);
if (g_hGetUserLib == NULL)
ExitGracefully(hr, E_FAIL, "Unable to load netui2.dll");
pfnUBOpen = (PFN_UB_OPEN)GetProcAddress(g_hGetUserLib, c_szOpenUB);
pfnUBEnum = (PFN_UB_ENUM)GetProcAddress(g_hGetUserLib, c_szEnumUBSelection);
pfnUBClose = (PFN_UB_CLOSE)GetProcAddress(g_hGetUserLib, c_szCloseUB);
if (!pfnUBOpen || !pfnUBEnum || !pfnUBClose)
{
FreeLibrary(g_hGetUserLib);
g_hGetUserLib = NULL;
ExitGracefully(hr, E_FAIL, "Unable to link to netui2.dll");
}
}
//
// Create the global sid cache object, if necessary
//
pSidCache = GetSidCache();
if (pSidCache == NULL)
ExitGracefully(hr, E_OUTOFMEMORY, "Unable to create SID cache");
ub.ulStructSize = sizeof(ub);
ub.fUserCancelled = FALSE;
ub.fExpandNames = TRUE;
ub.hwndOwner = hwndOwner;
ub.pszTitle = NULL;
ub.pszInitialDomain = (LPTSTR)pszServer;
ub.Flags = USRBROWS_SHOW_ALL | USRBROWS_INCL_ALL;
ub.ulHelpContext = HC_SED_USER_BROWSER_DIALOG;
ub.pszHelpFileName = (LPWSTR)c_szAcluiHelpFile;
#ifdef USRBROWS_INCL_RESTRICTED
ub.Flags &= ~USRBROWS_INCL_RESTRICTED; // NT5 only
#endif
if (!(dwFlags & GU_CONTAINER))
ub.Flags &= ~USRBROWS_INCL_CREATOR;
if (!(dwFlags & GU_MULTI_SELECT))
ub.Flags |= USRBROWS_SINGLE_SELECT;
if (dwFlags & GU_AUDIT_HLP)
ub.ulHelpContext = HC_SED_USER_BROWSER_AUDIT_DLG;
//
// Open the dialog
//
hUserBrowser = (*pfnUBOpen)(&ub);
if (hUserBrowser == NULL)
ExitGracefully(hr, E_FAIL, "OpenUserBrowser returned false");
pUserDetails = (PUSERDETAILS)LocalAlloc(LPTR, dwUDLength);
if (!pUserDetails)
ExitGracefully(hr, E_OUTOFMEMORY, "Unable to allocate UserDetails buffer");
hEntryList = DPA_Create(4);
if (!hEntryList)
ExitGracefully(hr, E_OUTOFMEMORY, "Unable to create SID cache entry list");
//
// Enumerate the results
//
for (;;)
{
if (!(*pfnUBEnum)(hUserBrowser, pUserDetails, &dwUDLength))
{
if (ERROR_INSUFFICIENT_BUFFER == GetLastError())
{
// The details buffer wasn't big enough, reallocate it
LocalFree(pUserDetails);
pUserDetails = (PUSERDETAILS)LocalAlloc(LPTR, dwUDLength);
if (pUserDetails == NULL)
break;
if (!(*pfnUBEnum)(hUserBrowser, pUserDetails, &dwUDLength))
break;
}
else // probably ERROR_NO_MORE_ITEMS
break;
}
//
// See if it's already in the cache
//
pEntry = pSidCache->FindSid(pUserDetails->psidUser);
if (NULL == pEntry)
{
//
// Not in the cache, add it
//
TCHAR szAccountName[MAX_PATH];
TCHAR szDomainName[MAX_PATH];
ULONG nAccountLength;
lstrcpy(szAccountName, pUserDetails->pszAccountName);
lstrcpy(szDomainName, pUserDetails->pszDomainName);
switch (pUserDetails->UserType)
{
case SidTypeUnknown:
case SidTypeInvalid:
// Load unknown account string
LoadString(::hModule, IDS_SID_UNKNOWN, szAccountName, ARRAYSIZE(szAccountName));
break;
case SidTypeAlias:
//if (IsAliasSid(pSid))
// szDomainName[0] = TEXT('\0'); // The domain is "BUILTIN"
break;
case SidTypeDeletedAccount:
// Load deleted account string
LoadString(::hModule, IDS_SID_DELETED, szAccountName, ARRAYSIZE(szAccountName));
break;
case SidTypeWellKnownGroup:
// Don't include the domain for a well-known group
szDomainName[0] = TEXT('\0');
break;
}
//
// Build NT4 "domain\user" style name (logon name)
//
if (szDomainName[0] != TEXT('\0'))
{
lstrcat(szDomainName, TEXT("\\"));
lstrcat(szDomainName, szAccountName);
}
LPCTSTR pszCommonName = pUserDetails->pszFullName;
if (!pszCommonName || !*pszCommonName)
pszCommonName = pUserDetails->pszAccountName;
pEntry = pSidCache->MakeEntry(pUserDetails->psidUser,
pUserDetails->UserType,
pszCommonName,
szDomainName);
if (NULL != pEntry)
pSidCache->AddEntry(pEntry);
}
if (NULL != pEntry)
DPA_AppendPtr(hEntryList, pEntry);
}
//
// Build return list
//
if (DPA_GetPtrCount(hEntryList))
pSidCache->BuildUserList(hEntryList, pszServer, ppUserList);
if (NULL == *ppUserList)
hr = E_FAIL;
exit_gracefully:
if (pSidCache)
pSidCache->Release();
if (NULL != hUserBrowser)
(*pfnUBClose)(hUserBrowser);
if (pUserDetails != NULL)
LocalFree(pUserDetails);
DPA_Destroy(hEntryList);
TraceLeaveResult(hr);
}
#endif // _WIN32_WINNT < 0x0500
/*******************************************************************
NAME: IsDACLCanonical
SYNOPSIS: Checks a DACL for canonical ordering
ENTRY: pDacl - points to DACL to check
EXIT:
RETURNS: Nonzero if DACL is in canonical order, zero otherwise
NOTES:
HISTORY:
JeffreyS 08-Oct-1996 Created
JeffreyS 03-Oct-1997 Make object aces same as non-object aces
********************************************************************/
enum ACELEVEL
{
alNonInheritAccessDenied,
alNonInheritAccessAllowed,
alInheritedAces,
};
BOOL
IsDACLCanonical(PACL pDacl)
{
PACE_HEADER pAce;
ACELEVEL currentAceLevel;
DWORD dwAceCount;
if (pDacl == NULL)
return TRUE;
currentAceLevel = alNonInheritAccessDenied;
dwAceCount = pDacl->AceCount;
if (dwAceCount == 0)
return TRUE;
for (pAce = (PACE_HEADER)FirstAce(pDacl);
dwAceCount > 0;
--dwAceCount, pAce = (PACE_HEADER)NextAce(pAce))
{
ACELEVEL aceLevel;
//
// NOTE: We do not skip INHERIT_ONLY aces because we want them in
// canonical order too.
//
if (pAce->AceFlags & INHERITED_ACE)
{
aceLevel = alInheritedAces; // don't check order here
}
else
{
switch(pAce->AceType)
{
case ACCESS_DENIED_ACE_TYPE:
case ACCESS_DENIED_OBJECT_ACE_TYPE:
aceLevel = alNonInheritAccessDenied;
break;
case ACCESS_ALLOWED_ACE_TYPE:
case ACCESS_ALLOWED_COMPOUND_ACE_TYPE:
case ACCESS_ALLOWED_OBJECT_ACE_TYPE:
aceLevel = alNonInheritAccessAllowed;
break;
default:
return FALSE;
}
}
//
// If the ace type is less than the level we are currently at,
// then it is not canonical.
//
if (aceLevel < currentAceLevel)
return FALSE;
//
// Update the current ace level.
//
currentAceLevel = aceLevel;
}
//
// If we get here, then the DACL is in canonical order.
//
return TRUE;
}
/*******************************************************************
NAME: IsDenyACL
SYNOPSIS: Checks a DACL for Deny ACEs. Also looks for "Deny
All" ACEs.
ENTRY: pDacl - points to DACL to check
EXIT: *pdwWarning is 0, IDS_PERM_DENY, or IDS_PERM_DENY_ALL
RETURNS: Nonzero if DACL contains any Deny ACEs, zero otherwise
NOTES:
HISTORY:
JeffreyS 05-Sep-1997 Created
********************************************************************/
BOOL
IsDenyACL(PACL pDacl,
BOOL fProtected,
DWORD dwFullControlMask,
LPDWORD pdwWarning)
{
DWORD dwWarning = 0;
TraceEnter(TRACE_MISC, "IsDenyACL");
// NULL DACL implies "Allow Everyone Full Control"
if (pDacl == NULL)
goto exit_gracefully;
// Check for empty DACL (no access to anyone)
if (pDacl->AceCount == 0)
{
if (fProtected)
dwWarning = IDS_PERM_DENY_ALL;
// else the object will inherit permissions from the parent.
}
else
{
PACE_HEADER pAce;
int iEntry;
// Iterate through the ACL looking for "Deny All"
for (iEntry = 0, pAce = (PACE_HEADER)FirstAce(pDacl);
iEntry < pDacl->AceCount;
iEntry++, pAce = (PACE_HEADER)NextAce(pAce))
{
if (pAce->AceType != ACCESS_DENIED_ACE_TYPE &&
pAce->AceType != ACCESS_DENIED_OBJECT_ACE_TYPE)
{
// Assuming the ACL is in canonical order, we can
// stop as soon as we find something that isn't
// a Deny ACE. (Deny ACEs come first)
break;
}
// Found a Deny ACE
dwWarning = IDS_PERM_DENY;
// Check for "Deny Everyone Full Control". Don't look
// for ACCESS_DENIED_OBJECT_ACE_TYPE here since Object
// aces don't have as wide an effect as normal aces.
if (pAce->AceType == ACCESS_DENIED_ACE_TYPE &&
((PKNOWN_ACE)pAce)->Mask == dwFullControlMask &&
EqualSid(GetAceSid(pAce), QuerySystemSid(UI_SID_World)))
{
// Found "Deny All"
dwWarning = IDS_PERM_DENY_ALL;
break;
}
}
}
exit_gracefully:
if (pdwWarning != NULL)
*pdwWarning = dwWarning;
TraceLeaveValue(dwWarning != 0);
}
/*******************************************************************
NAME: QuerySystemSid
SYNOPSIS: Retrieves the requested SID
ENTRY: SystemSidType - Which SID to retrieve
EXIT:
RETURNS: PSID if successful, NULL otherwise
HISTORY:
JeffreyS 08-Oct-1996 Created
********************************************************************/
//
// Global array of static system SIDs, corresponding to UI_SystemSid
//
const struct
{
SID sid; // contains 1 subauthority
DWORD dwSubAuth[1]; // we currently need at most 2 subauthorities
} g_StaticSids[COUNT_SYSTEM_SID_TYPES] =
{
{{SID_REVISION,1,SECURITY_WORLD_SID_AUTHORITY, {SECURITY_WORLD_RID}}, {0} },
{{SID_REVISION,1,SECURITY_CREATOR_SID_AUTHORITY,{SECURITY_CREATOR_OWNER_RID}}, {0} },
{{SID_REVISION,1,SECURITY_CREATOR_SID_AUTHORITY,{SECURITY_CREATOR_GROUP_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_DIALUP_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_NETWORK_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_BATCH_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_INTERACTIVE_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_SERVICE_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_ANONYMOUS_LOGON_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_PROXY_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_ENTERPRISE_CONTROLLERS_RID}},{0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_PRINCIPAL_SELF_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_AUTHENTICATED_USER_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_RESTRICTED_CODE_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_TERMINAL_SERVER_RID}}, {0} },
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_LOCAL_SYSTEM_RID}}, {0} },
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_ADMINS} },
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_USERS} },
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_GUESTS} },
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_POWER_USERS} },
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_ACCOUNT_OPS} },
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_SYSTEM_OPS} },
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_PRINT_OPS} },
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_BACKUP_OPS} },
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_REPLICATOR} },
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_RAS_SERVERS} },
};
PSID
QuerySystemSid(UI_SystemSid SystemSidType)
{
if (SystemSidType == UI_SID_Invalid || SystemSidType >= UI_SID_Count)
return NULL;
return (PSID)&g_StaticSids[SystemSidType];
}
//
// Global array of cached token SIDs
//
struct
{
SID sid; // SID contains 1 subauthority
DWORD dwSubAuth[SID_MAX_SUB_AUTHORITIES - 1];
} g_TokenSids[COUNT_TOKEN_SID_TYPES] = {0};
PSID
QueryTokenSid(UI_TokenSid TokenSidType)
{
if (TokenSidType == UI_TSID_Invalid || TokenSidType >= UI_TSID_Count)
return NULL;
if (0 == *GetSidSubAuthorityCount((PSID)&g_TokenSids[TokenSidType]))
{
HANDLE hProcessToken;
// Get the current process's user's SID
if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hProcessToken))
{
BYTE buffer[sizeof(TOKEN_USER) + sizeof(g_TokenSids[0])];
ULONG cbBuffer = sizeof(buffer);
switch (TokenSidType)
{
case UI_TSID_CurrentProcessUser:
if (GetTokenInformation(hProcessToken,
TokenUser,
buffer,
cbBuffer,
&cbBuffer))
{
PTOKEN_USER ptu = (PTOKEN_USER)buffer;
CopyMemory(&g_TokenSids[UI_TSID_CurrentProcessUser],
ptu->User.Sid,
GetLengthSid(ptu->User.Sid));
}
break;
case UI_TSID_CurrentProcessOwner:
if (GetTokenInformation(hProcessToken,
TokenOwner,
buffer,
cbBuffer,
&cbBuffer))
{
PTOKEN_OWNER pto = (PTOKEN_OWNER)buffer;
CopyMemory(&g_TokenSids[UI_TSID_CurrentProcessOwner],
pto->Owner,
GetLengthSid(pto->Owner));
}
break;
case UI_TSID_CurrentProcessPrimaryGroup:
if (GetTokenInformation(hProcessToken,
TokenPrimaryGroup,
buffer,
cbBuffer,
&cbBuffer))
{
PTOKEN_PRIMARY_GROUP ptg = (PTOKEN_PRIMARY_GROUP)buffer;
CopyMemory(&g_TokenSids[UI_TSID_CurrentProcessPrimaryGroup],
ptg->PrimaryGroup,
GetLengthSid(ptg->PrimaryGroup));
}
break;
}
CloseHandle(hProcessToken);
}
if (0 == *GetSidSubAuthorityCount((PSID)&g_TokenSids[TokenSidType]))
return NULL;
}
return (PSID)&g_TokenSids[TokenSidType];
}
/*******************************************************************
NAME: GetAuthenticationID
SYNOPSIS: Retrieves the SID associated with the credentials
currently being used for network access.
(runas /netonly credentials)
ENTRY: pszServer = server on which to lookup the account.
NULL indicates local system.
EXIT:
RETURNS: PSID if successful, NULL otherwise. Caller must
free with LocalFree.
HISTORY:
JeffreyS 05-Aug-1999 Created
********************************************************************/
PSID
GetAuthenticationID(LPCWSTR pszServer)
{
PSID pSid = NULL;
HANDLE hLsa;
NTSTATUS Status;
//
// These LSA calls are delay-loaded from secur32.dll using the linker's
// delay-load mechanism. Therefore, wrap with an exception handler.
//
__try
{
Status = LsaConnectUntrusted(&hLsa);
if (Status == 0)
{
NEGOTIATE_CALLER_NAME_REQUEST Req = {0};
PNEGOTIATE_CALLER_NAME_RESPONSE pResp;
ULONG cbSize;
NTSTATUS SubStatus;
Req.MessageType = NegGetCallerName;
Status = LsaCallAuthenticationPackage(
hLsa,
0,
&Req,
sizeof(Req),
(void**)&pResp,
&cbSize,
&SubStatus);
if ((Status == 0) && (SubStatus == 0))
{
BYTE sid[sizeof(SID) + (SID_MAX_SUB_AUTHORITIES - 1)*sizeof(DWORD)];
PSID psid = (PSID)sid;
DWORD cbSid = sizeof(sid);
WCHAR szDomain[MAX_PATH];
DWORD cchDomain = ARRAYSIZE(szDomain);
SID_NAME_USE sidType;
if (LookupAccountNameW(pszServer,
pResp->CallerName,
psid,
&cbSid,
szDomain,
&cchDomain,
&sidType))
{
pSid = LocalAllocSid(psid);
}
LsaFreeReturnBuffer(pResp);
}
LsaDeregisterLogonProcess(hLsa);
}
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
}
return pSid;
}
/*******************************************************************
NAME: CopyUnicodeString
SYNOPSIS: Allocates a buffer and copies a string from
a UNICODE_STRING sources.
ENTRY: pszDest - pointer to destination buffer
cchDest - # of chars in pszDest (bytes for MBCS)
pSrc - pointer to UNICODE_STRING to copy
EXIT: pszDest - containing copy of string
RETURNS: # of chars copied, or 0 if not successful.
NOTES:
HISTORY:
JeffreyS 22-Jan-1998 Created
********************************************************************/
int
CopyUnicodeString(LPTSTR pszDest, ULONG cchDest, PLSA_UNICODE_STRING pSrc)
{
int nResult;
ULONG cchSrc;
// If UNICODE, cchDest is size of destination buffer in chars
// Else (MBCS) cchDest is size of destination buffer in bytes
if (pszDest == NULL || 0 == cchDest)
return 0;
*pszDest = TEXT('\0');
if (pSrc == NULL || pSrc->Buffer == NULL)
return 0;
// Get # of chars in source (not including NULL)
cchSrc = pSrc->Length/sizeof(WCHAR);
#ifdef UNICODE
//
// Note that pSrc->Buffer may not be NULL terminated so we can't just
// call lstrcpynW with cchDest. Also, if we call lstrcpynW with cchSrc,
// it copies the correct # of chars, but then overwrites the last char
// with NULL giving an incorrect result. If we call lstrcpynW with
// (cchSrc+1) it reads past the end of the buffer, which may fault (360251)
// causing lstrcpynW's exception handler to return 0 without NULL-
// terminating the resulting string.
//
// So let's just copy the bits.
//
nResult = min(cchSrc, cchDest);
CopyMemory(pszDest, pSrc->Buffer, sizeof(WCHAR)*nResult);
if (nResult == (int)cchDest)
--nResult;
pszDest[nResult] = L'\0';
#else
nResult = WideCharToMultiByte(CP_ACP,
0,
pSrc->Buffer,
cchSrc,
pszDest,
cchDest,
NULL,
NULL);
#endif
return nResult;
}
/*******************************************************************
NAME: CopyUnicodeString
SYNOPSIS: Allocates a buffer and copies a string from
a UNICODE_STRING sources.
ENTRY: pSrc - pointer to UNICODE_STRING to copy
EXIT: *ppszResult - points to LocalAlloc'd buffer containing copy.
RETURNS: # of chars copied, or 0 if not successful.
NOTES:
HISTORY:
JeffreyS 22-Jan-1998 Created
********************************************************************/
int
CopyUnicodeString(LPTSTR *ppszResult, PLSA_UNICODE_STRING pSrc)
{
int nResult = 0;
if (NULL == ppszResult)
return 0;
*ppszResult = NULL;
if (NULL != pSrc)
{
ULONG cchResult;
*ppszResult = NULL;
// Get # of chars in source (including NULL)
cchResult = pSrc->Length/SIZEOF(WCHAR) + 1;
// Allocate buffer big enough for either UNICODE or MBCS result
*ppszResult = (LPTSTR)LocalAlloc(LPTR, cchResult * 2);
if (*ppszResult)
{
nResult = CopyUnicodeString(*ppszResult, cchResult, pSrc);
if (0 == nResult)
{
LocalFree(*ppszResult);
*ppszResult = NULL;
}
}
}
return nResult;
}
//
// Test GUIDs safely
//
BOOL IsSameGUID(const GUID *p1, const GUID *p2)
{
BOOL bResult = FALSE;
if (!p1) p1 = &GUID_NULL;
if (!p2) p2 = &GUID_NULL;
__try
{
bResult = InlineIsEqualGUID(*p1, *p2);
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
}
return bResult;
}
/*******************************************************************
NAME: GetCountOfInheritableAces
SYNOPSIS: Get the count of aces in ACL which can be
inherited to child objects
RETURNS: Count of Aces
********************************************************************/
DWORD GetCountOfInheritableAces(PACL pAcl)
{
if(!pAcl)
return 0;
DWORD dwCount = 0;
PACE_HEADER pAce = NULL;
int iEntry = 0;
for (iEntry = 0, pAce = (PACE_HEADER)FirstAce(pAcl);
iEntry < pAcl->AceCount;
iEntry++, pAce = (PACE_HEADER)NextAce(pAce))
{
//
//Consider only explicit aces
//
if((!(pAce->AceFlags & INHERITED_ACE))&&(pAce->AceFlags & (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE)))
dwCount++;
}
return dwCount;
}
/*******************************************************************
NAME: GetCountOfInheritableAces
SYNOPSIS: Get the count of aces in SACL or DACL which can be
inherited to child objects
RETURNS: Count of Aces
********************************************************************/
DWORD GetCountOfInheritableAces(SECURITY_INFORMATION si, PSECURITY_DESCRIPTOR pSD)
{
if(!pSD)
return 0;
PACL pAcl = NULL;
BOOL bPresent;
BOOL bDefault;
if(si & DACL_SECURITY_INFORMATION)
{
if(GetSecurityDescriptorDacl(pSD, &bPresent, &pAcl, &bDefault))
{
return GetCountOfInheritableAces(pAcl);
}
}
else if(si & SACL_SECURITY_INFORMATION)
{
if(GetSecurityDescriptorSacl(pSD, &bPresent, &pAcl, &bDefault))
{
return GetCountOfInheritableAces(pAcl);
}
}
return 0;
}
typedef struct AclBloatInfo{
DWORD dwInheriteAceCount;
SECURITY_INFORMATION si;
HFONT hFont;
BOOL bShowHelp;
}ACL_BLOAT_INFO;
INT_PTR CALLBACK
AclBloatDialogProc(HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
switch (uMsg)
{
case WM_INITDIALOG:
{
ACL_BLOAT_INFO * pInfo= (ACL_BLOAT_INFO*)lParam;
ASSERT(pInfo);
SetWindowLongPtr(hDlg, DWLP_USER, (LONG_PTR)pInfo);
//
//Add a warning icon
//
// add the warning icon
HICON hWarn = LoadIcon(NULL, IDI_WARNING);
SendDlgItemMessage(hDlg, // dialog box window handle
IDC_BLOAT_WARN_ICON, // icon identifier
STM_SETIMAGE, // message to send
(WPARAM) IMAGE_ICON, // image type
(LPARAM) hWarn); // icon handle
//
//Set the title of dialog box
//
LPTSTR pszCaption = NULL;
if(FormatStringID(&pszCaption,
::hModule,
pInfo->si & DACL_SECURITY_INFORMATION ? IDS_PERMISSIONS : IDS_AUDITING))
{
SetWindowText(hDlg, pszCaption);
LocalFreeString(&pszCaption);
}
//
//Set the warning message
//
UINT cItem = pInfo->dwInheriteAceCount;
WCHAR buffer[34];
_itow(cItem,buffer,10);
if(FormatStringID(&pszCaption,
::hModule,
pInfo->si & DACL_SECURITY_INFORMATION ? IDS_ACLBLOAT_NO_LIST_LINE1:IDS_ACLBLOAT_NO_LIST_SACL_LINE1,
buffer))
{
SetDlgItemText(hDlg, IDC_ACLBLOAT_LINE1, pszCaption);
LocalFreeString(&pszCaption);
}
//
//make warning bold
//
MakeBold(GetDlgItem(hDlg,IDC_ACLB_WARNING), &(pInfo->hFont));
//
//Set the line2, hide the Help button and move other buttons.
//
if(!pInfo->bShowHelp)
{
if(FormatStringID(&pszCaption,
::hModule,
pInfo->si & DACL_SECURITY_INFORMATION ? IDS_BLOAT_PERM_LINE2_NOHELP : IDS_BLOAT_AUDIT_LINE2_NOHELP))
{
SetDlgItemText(hDlg, IDC_ACLB_LINE3, pszCaption);
LocalFreeString(&pszCaption);
}
RECT rcHelp, rcCancel;
GetWindowRect(GetDlgItem(hDlg, IDHELP), &rcHelp);
MapWindowPoints(NULL, hDlg, (LPPOINT)&rcHelp, 2);
GetWindowRect(GetDlgItem(hDlg, IDCANCEL), &rcCancel);
MapWindowPoints(NULL, hDlg, (LPPOINT)&rcCancel, 2);
//
//Hide the Help button, Move Cancel to help position
//and Ok to Cancel positon.
//
ShowWindow(GetDlgItem(hDlg, IDHELP),FALSE);
SetWindowPos(GetDlgItem(hDlg, IDCANCEL),
NULL,
rcHelp.left,
rcHelp.top,
0,
0,
SWP_NOACTIVATE | SWP_NOSIZE | SWP_NOZORDER);
SetWindowPos(GetDlgItem(hDlg, IDOK),
NULL,
rcCancel.left,
rcCancel.top,
0,
0,
SWP_NOACTIVATE | SWP_NOSIZE | SWP_NOZORDER);
}
break;
}
case WM_COMMAND:
{
WORD wControlID = GET_WM_COMMAND_ID(wParam, lParam);
switch (wControlID)
{
case IDOK:
{
ACL_BLOAT_INFO * pInfo = (ACL_BLOAT_INFO *)GetWindowLongPtr(hDlg, DWLP_USER);
if(pInfo->hFont)
DeleteObject(pInfo->hFont);
pInfo->hFont = NULL;
EndDialog(hDlg, FALSE);
break;
}
case IDCANCEL:
{
ACL_BLOAT_INFO * pInfo = (ACL_BLOAT_INFO *)GetWindowLongPtr(hDlg, DWLP_USER);
if(pInfo->hFont)
DeleteObject(pInfo->hFont);
pInfo->hFont = NULL;
EndDialog(hDlg, TRUE);
break;
}
case IDHELP:
HtmlHelp(NULL,
L"aclui.chm::/ACLUI_acl_BP.htm",
HH_DISPLAY_TOPIC,
0);
return TRUE;
}
break;
}
}
return FALSE;
}
//
// This function displays the "An error has occured [Continue] [Cancel]" message
//
// Returns IDOK or IDCANCEL
//
BOOL
IsAclBloated(HWND hWndParent, SECURITY_INFORMATION si, DWORD dwInheritAceCount, int idd, BOOL bShowHelp)
{
AclBloatInfo info;
info.dwInheriteAceCount = dwInheritAceCount;
info.si = si;
info.hFont = NULL;
info.bShowHelp = bShowHelp;
return (BOOL)DialogBoxParam(::hModule,
MAKEINTRESOURCE(idd),
hWndParent,
AclBloatDialogProc,
(LPARAM)(&info));
}
BOOL IsAclBloated(HWND hDlg, SECURITY_INFORMATION si, PSECURITY_DESCRIPTOR pSD, DWORD dwOrgInheritAceCount, BOOL bShowHelp)
{
ASSERT(pSD);
BOOL fReturn = FALSE;
DWORD dwNewInheritAceCount = GetCountOfInheritableAces(si, pSD);
if( ((int)dwNewInheritAceCount - (int)dwOrgInheritAceCount) > ACL_BLOAT_LIMIT )
fReturn = IsAclBloated(hDlg,
si,
dwNewInheritAceCount - dwOrgInheritAceCount,
si & DACL_SECURITY_INFORMATION ? IDD_BLOAT_NO_LIST : IDD_BLOAT_NO_LIST_SACL,
bShowHelp);
return fReturn;
}
//
//Sets the font style to bold for the hwnd.
//phNewFont gets handle to newFont which
//is to freed after hwnd is destroyed.
//
HRESULT MakeBold (HWND hwnd, HFONT *phNewFont)
{
HRESULT hr = S_OK;
HFONT hFont = NULL;
*phNewFont = NULL;
LOGFONT LogFont;
if(!hwnd || !phNewFont)
return E_POINTER;
hFont = (HFONT)SendMessage(hwnd,WM_GETFONT,0,0);
if (!hFont)
{
hr = HRESULT_FROM_WIN32(GetLastError());
return hr;
}
if (!GetObject(hFont,sizeof(LOGFONT),(LPVOID)(&LogFont)))
{
hr = HRESULT_FROM_WIN32(GetLastError());
return hr;
}
LogFont.lfWeight = FW_BOLD;
if (!(*phNewFont = CreateFontIndirect(&LogFont)))
{
hr = HRESULT_FROM_WIN32(GetLastError());
return hr;
}
SendMessage(hwnd,WM_SETFONT,(WPARAM)(*phNewFont),MAKELPARAM(FALSE,0));
return S_OK;
}
Reference in a new issue Copy permalink