1500 lines
46 KiB
C++
1500 lines
46 KiB
C++
|
/*++
|
|||
|
|
|
|||
|
|
Copyright (c) 1996 Microsoft Corporation
|
|||
|
|
|
|||
|
|
Module Name:
|
|||
|
|
|
|||
|
|
service.cpp
|
|||
|
|
|
|||
|
|
Abstract:
|
|||
|
|
|
|||
|
|
Routines to configure/analyze general settings of services plus
|
|||
|
|
some helper APIs
|
|||
|
|
|
|||
|
|
Author:
|
|||
|
|
|
|||
|
|
Jin Huang (jinhuang) 25-Jun-1997
|
|||
|
|
|
|||
|
|
Revision History:
|
|||
|
|
|
|||
|
|
--*/
|
|||
|
|
#include "headers.h"
|
|||
|
|
#include "serverp.h"
|
|||
|
|
#include "service.h"
|
|||
|
|
#include "pfp.h"
|
|||
|
|
|
|||
|
|
//#define SCESVC_DBG 1
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
SCESTATUS
|
|||
|
|
ScepConfigureGeneralServices(
|
|||
|
|
IN PSCECONTEXT hProfile,
|
|||
|
|
IN PSCE_SERVICES pServiceList,
|
|||
|
|
IN DWORD ConfigOptions
|
|||
|
|
)
|
|||
|
|
/*
|
|||
|
|
Routine Descripton:
|
|||
|
|
|
|||
|
|
Configure startup and security descriptor settings for the list of
|
|||
|
|
services passed in.
|
|||
|
|
|
|||
|
|
Arguments:
|
|||
|
|
|
|||
|
|
pServiceList - the list of services to configure
|
|||
|
|
|
|||
|
|
Return Value:
|
|||
|
|
|
|||
|
|
SCE status
|
|||
|
|
*/
|
|||
|
|
{
|
|||
|
|
SCESTATUS SceErr=SCESTATUS_SUCCESS;
|
|||
|
|
PSCE_SERVICES pNode;
|
|||
|
|
DWORD nServices=0;
|
|||
|
|
BOOL bDoneSettingSaclDacl = FALSE;
|
|||
|
|
NTSTATUS NtStatus = 0;
|
|||
|
|
SID_IDENTIFIER_AUTHORITY IdAuth=SECURITY_NT_AUTHORITY;
|
|||
|
|
DWORD rcSaveRsop = ERROR_SUCCESS;
|
|||
|
|
|
|||
|
|
PSCESECTION hSectionDomain=NULL;
|
|||
|
|
PSCESECTION hSectionTattoo=NULL;
|
|||
|
|
PSCE_SERVICES pServiceCurrent=NULL;
|
|||
|
|
DWORD ServiceLen=0;
|
|||
|
|
|
|||
|
|
|
|||
|
|
if ( (ConfigOptions & SCE_POLICY_TEMPLATE) &&
|
|||
|
|
ScepIsSystemShutDown() ) {
|
|||
|
|
|
|||
|
|
return(SCESTATUS_SERVICE_NOT_SUPPORT);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( pServiceList != NULL ) {
|
|||
|
|
|
|||
|
|
SC_HANDLE hScManager;
|
|||
|
|
//
|
|||
|
|
// open the manager
|
|||
|
|
//
|
|||
|
|
hScManager = OpenSCManager(
|
|||
|
|
NULL,
|
|||
|
|
NULL,
|
|||
|
|
SC_MANAGER_ALL_ACCESS
|
|||
|
|
// SC_MANAGER_CONNECT |
|
|||
|
|
// SC_MANAGER_QUERY_LOCK_STATUS |
|
|||
|
|
// SC_MANAGER_MODIFY_BOOT_CONFIG
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
SC_HANDLE hService=NULL;
|
|||
|
|
DWORD rc=NO_ERROR;
|
|||
|
|
|
|||
|
|
if ( NULL == hScManager ) {
|
|||
|
|
|
|||
|
|
rc = GetLastError();
|
|||
|
|
ScepLogOutput3(1, rc, SCEDLL_ERROR_OPEN, L"Service Control Manager");
|
|||
|
|
|
|||
|
|
ScepPostProgress(TICKS_GENERAL_SERVICES,
|
|||
|
|
AREA_SYSTEM_SERVICE,
|
|||
|
|
NULL);
|
|||
|
|
|
|||
|
|
return( ScepDosErrorToSceStatus(rc) );
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
LPQUERY_SERVICE_CONFIG pConfig=NULL;
|
|||
|
|
DWORD BytesNeeded;
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// Adjust privilege for setting SACL
|
|||
|
|
//
|
|||
|
|
rc = SceAdjustPrivilege( SE_SECURITY_PRIVILEGE, TRUE, NULL );
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// if can't adjust privilege, ignore (will error out later if SACL is requested)
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
if ( rc != NO_ERROR ) {
|
|||
|
|
|
|||
|
|
ScepLogOutput3(1, rc, SCEDLL_ERROR_ADJUST, L"SE_SECURITY_PRIVILEGE");
|
|||
|
|
rc = NO_ERROR;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// Adjust privilege for setting ownership (if required)
|
|||
|
|
//
|
|||
|
|
rc = SceAdjustPrivilege( SE_TAKE_OWNERSHIP_PRIVILEGE, TRUE, NULL );
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// if can't adjust privilege, ignore (will error out later if acls need to be written)
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
if ( rc != NO_ERROR ) {
|
|||
|
|
|
|||
|
|
ScepLogOutput3(1, rc, SCEDLL_ERROR_ADJUST, L"SE_TAKE_OWNERSHIP_PRIVILEGE");
|
|||
|
|
rc = NO_ERROR;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// get AdminsSid in case need to take ownership later
|
|||
|
|
//
|
|||
|
|
NtStatus = RtlAllocateAndInitializeSid(
|
|||
|
|
&IdAuth,
|
|||
|
|
2,
|
|||
|
|
SECURITY_BUILTIN_DOMAIN_RID,
|
|||
|
|
DOMAIN_ALIAS_RID_ADMINS,
|
|||
|
|
0,
|
|||
|
|
0,
|
|||
|
|
0,
|
|||
|
|
0,
|
|||
|
|
0,
|
|||
|
|
0,
|
|||
|
|
&AdminsSid );
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// open the policy/tattoo tables
|
|||
|
|
//
|
|||
|
|
if ( ConfigOptions & SCE_POLICY_TEMPLATE ) {
|
|||
|
|
|
|||
|
|
ScepTattooOpenPolicySections(
|
|||
|
|
hProfile,
|
|||
|
|
szServiceGeneral,
|
|||
|
|
&hSectionDomain,
|
|||
|
|
&hSectionTattoo
|
|||
|
|
);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// Loop through each service to set general setting
|
|||
|
|
//
|
|||
|
|
for ( pNode=pServiceList;
|
|||
|
|
pNode != NULL && rc == NO_ERROR; pNode = pNode->Next ) {
|
|||
|
|
//
|
|||
|
|
// print the service name
|
|||
|
|
//
|
|||
|
|
if ( nServices < TICKS_GENERAL_SERVICES ) {
|
|||
|
|
ScepPostProgress(1,
|
|||
|
|
AREA_SYSTEM_SERVICE,
|
|||
|
|
pNode->ServiceName);
|
|||
|
|
nServices++;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
ScepLogOutput3(2,0, SCEDLL_SCP_CONFIGURE, pNode->ServiceName);
|
|||
|
|
|
|||
|
|
if ( (ConfigOptions & SCE_POLICY_TEMPLATE) &&
|
|||
|
|
ScepIsSystemShutDown() ) {
|
|||
|
|
|
|||
|
|
rc = ERROR_NOT_SUPPORTED;
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
ServiceLen = 0;
|
|||
|
|
if ( (ConfigOptions & SCE_POLICY_TEMPLATE) &&
|
|||
|
|
hSectionDomain && hSectionTattoo ) {
|
|||
|
|
//
|
|||
|
|
// check if we need to query current setting for the service
|
|||
|
|
//
|
|||
|
|
ServiceLen = wcslen(pNode->ServiceName);
|
|||
|
|
|
|||
|
|
if ( ScepTattooIfQueryNeeded(hSectionDomain, hSectionTattoo,
|
|||
|
|
pNode->ServiceName, ServiceLen, NULL, NULL ) ) {
|
|||
|
|
|
|||
|
|
rc = ScepQueryAndAddService(
|
|||
|
|
hScManager,
|
|||
|
|
pNode->ServiceName,
|
|||
|
|
NULL,
|
|||
|
|
&pServiceCurrent
|
|||
|
|
);
|
|||
|
|
if ( ERROR_SUCCESS != rc ) {
|
|||
|
|
ScepLogOutput3(1,0,SCESRV_POLICY_TATTOO_ERROR_QUERY,rc,pNode->ServiceName);
|
|||
|
|
rc = NO_ERROR;
|
|||
|
|
} else {
|
|||
|
|
ScepLogOutput3(3,0,SCESRV_POLICY_TATTOO_QUERY,pNode->ServiceName);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
bDoneSettingSaclDacl = FALSE;
|
|||
|
|
rcSaveRsop = ERROR_SUCCESS;
|
|||
|
|
//
|
|||
|
|
// open the service
|
|||
|
|
//
|
|||
|
|
hService = OpenService(
|
|||
|
|
hScManager,
|
|||
|
|
pNode->ServiceName,
|
|||
|
|
SERVICE_QUERY_CONFIG |
|
|||
|
|
SERVICE_CHANGE_CONFIG |
|
|||
|
|
READ_CONTROL |
|
|||
|
|
WRITE_DAC |
|
|||
|
|
// WRITE_OWNER | owner can't be set for a service
|
|||
|
|
ACCESS_SYSTEM_SECURITY
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
// if access was denied, try to take ownership
|
|||
|
|
// and try to open service again
|
|||
|
|
|
|||
|
|
if (hService == NULL &&
|
|||
|
|
(ERROR_ACCESS_DENIED == (rc = GetLastError())) &&
|
|||
|
|
pNode->General.pSecurityDescriptor) {
|
|||
|
|
|
|||
|
|
DWORD rcTakeOwnership = NO_ERROR;
|
|||
|
|
|
|||
|
|
if (AdminsSid) {
|
|||
|
|
|
|||
|
|
if ( NO_ERROR == (rcTakeOwnership = SetNamedSecurityInfo(
|
|||
|
|
(LPWSTR)pNode->ServiceName,
|
|||
|
|
SE_SERVICE,
|
|||
|
|
OWNER_SECURITY_INFORMATION,
|
|||
|
|
AdminsSid,
|
|||
|
|
NULL,
|
|||
|
|
NULL,
|
|||
|
|
NULL
|
|||
|
|
))) {
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// ownership changed, open service again and set SACL and DACL
|
|||
|
|
// get a handle to set security
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
|
|||
|
|
if ( hService = OpenService(
|
|||
|
|
hScManager,
|
|||
|
|
pNode->ServiceName,
|
|||
|
|
READ_CONTROL |
|
|||
|
|
WRITE_DAC |
|
|||
|
|
ACCESS_SYSTEM_SECURITY
|
|||
|
|
)) {
|
|||
|
|
|
|||
|
|
if ( SetServiceObjectSecurity(
|
|||
|
|
hService,
|
|||
|
|
pNode->SeInfo & (DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION),
|
|||
|
|
pNode->General.pSecurityDescriptor
|
|||
|
|
) ) {
|
|||
|
|
|
|||
|
|
bDoneSettingSaclDacl = TRUE;
|
|||
|
|
|
|||
|
|
CloseServiceHandle(hService);
|
|||
|
|
hService = NULL;
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// re-open the service only if there are other config info
|
|||
|
|
// to set (startup type).
|
|||
|
|
// So when NOSTARTTYPE is set, do not need to reopen the service
|
|||
|
|
//
|
|||
|
|
if (!(ConfigOptions & SCE_SETUP_SERVICE_NOSTARTTYPE)) {
|
|||
|
|
|
|||
|
|
if (!(hService = OpenService(
|
|||
|
|
hScManager,
|
|||
|
|
pNode->ServiceName,
|
|||
|
|
SERVICE_QUERY_CONFIG |
|
|||
|
|
SERVICE_CHANGE_CONFIG
|
|||
|
|
)) ) {
|
|||
|
|
|
|||
|
|
rc = GetLastError();
|
|||
|
|
}
|
|||
|
|
else {
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
//clear any error we have seen so far since everything has succeeded
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
rc = NO_ERROR;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
//
|
|||
|
|
// shouldn't fail here unless Service Control Manager
|
|||
|
|
// fails for some reason.
|
|||
|
|
//
|
|||
|
|
rc = GetLastError();
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
//
|
|||
|
|
// still fail to open the service to set DACL. this should
|
|||
|
|
// not happen for admin logons since the current logon is
|
|||
|
|
// one of the owner. But for normal user logon, this could
|
|||
|
|
// fail (actually normal user logon should fail to set
|
|||
|
|
// the owner
|
|||
|
|
|
|||
|
|
rc = GetLastError();
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
//
|
|||
|
|
// AdminSid failed to be initialized, get the error
|
|||
|
|
//
|
|||
|
|
rcTakeOwnership = RtlNtStatusToDosError(NtStatus);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( NO_ERROR != rcTakeOwnership || NO_ERROR != rc ) {
|
|||
|
|
//
|
|||
|
|
// log the error occurred in take ownership process
|
|||
|
|
// reset error back to access denied so it will also be
|
|||
|
|
// logged as failure to open the service
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
if (NO_ERROR != rcTakeOwnership)
|
|||
|
|
|
|||
|
|
ScepLogOutput3(2,rcTakeOwnership, SCEDLL_ERROR_TAKE_OWNER, (LPWSTR)pNode->ServiceName);
|
|||
|
|
|
|||
|
|
else
|
|||
|
|
|
|||
|
|
ScepLogOutput3(2, rc, SCEDLL_ERROR_OPEN, (LPWSTR)pNode->ServiceName);
|
|||
|
|
|
|||
|
|
rc = ERROR_ACCESS_DENIED;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( hService != NULL ) {
|
|||
|
|
|
|||
|
|
if (ConfigOptions & SCE_SETUP_SERVICE_NOSTARTTYPE) {
|
|||
|
|
//
|
|||
|
|
// do not configure service start type
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
if ( pNode->General.pSecurityDescriptor != NULL ) {
|
|||
|
|
|
|||
|
|
if ( !SetServiceObjectSecurity(
|
|||
|
|
hService,
|
|||
|
|
pNode->SeInfo & (DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION),
|
|||
|
|
pNode->General.pSecurityDescriptor
|
|||
|
|
) ) {
|
|||
|
|
|
|||
|
|
rc = GetLastError();
|
|||
|
|
}
|
|||
|
|
else
|
|||
|
|
bDoneSettingSaclDacl = TRUE;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// query the length of config
|
|||
|
|
//
|
|||
|
|
if ( !QueryServiceConfig(
|
|||
|
|
hService,
|
|||
|
|
NULL,
|
|||
|
|
0,
|
|||
|
|
&BytesNeeded
|
|||
|
|
) ) {
|
|||
|
|
|
|||
|
|
rc = GetLastError();
|
|||
|
|
|
|||
|
|
if ( rc == ERROR_INSUFFICIENT_BUFFER ) {
|
|||
|
|
|
|||
|
|
pConfig = (LPQUERY_SERVICE_CONFIG)ScepAlloc(0, BytesNeeded);
|
|||
|
|
|
|||
|
|
if ( pConfig != NULL ) {
|
|||
|
|
//
|
|||
|
|
// the real query of config
|
|||
|
|
//
|
|||
|
|
if ( QueryServiceConfig(
|
|||
|
|
hService,
|
|||
|
|
pConfig,
|
|||
|
|
BytesNeeded,
|
|||
|
|
&BytesNeeded
|
|||
|
|
) ) {
|
|||
|
|
rc = ERROR_SUCCESS;
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// change pConfig->dwStartType to the new value
|
|||
|
|
//
|
|||
|
|
if ( pNode->Startup != (BYTE)(pConfig->dwStartType) ) {
|
|||
|
|
//
|
|||
|
|
// congigure the service startup
|
|||
|
|
//
|
|||
|
|
if ( !ChangeServiceConfig(
|
|||
|
|
hService,
|
|||
|
|
pConfig->dwServiceType,
|
|||
|
|
pNode->Startup,
|
|||
|
|
pConfig->dwErrorControl,
|
|||
|
|
pConfig->lpBinaryPathName,
|
|||
|
|
pConfig->lpLoadOrderGroup,
|
|||
|
|
NULL,
|
|||
|
|
pConfig->lpDependencies,
|
|||
|
|
pConfig->lpServiceStartName,
|
|||
|
|
NULL,
|
|||
|
|
pConfig->lpDisplayName
|
|||
|
|
) ) {
|
|||
|
|
|
|||
|
|
rc = GetLastError();
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( rc == NO_ERROR &&
|
|||
|
|
pNode->General.pSecurityDescriptor != NULL &&
|
|||
|
|
!bDoneSettingSaclDacl) {
|
|||
|
|
|
|||
|
|
if ( !SetServiceObjectSecurity(
|
|||
|
|
hService,
|
|||
|
|
pNode->SeInfo & (DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION),
|
|||
|
|
pNode->General.pSecurityDescriptor
|
|||
|
|
) ) {
|
|||
|
|
|
|||
|
|
rc = GetLastError();
|
|||
|
|
}
|
|||
|
|
else
|
|||
|
|
bDoneSettingSaclDacl = TRUE;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
|
|||
|
|
rc = GetLastError();
|
|||
|
|
|
|||
|
|
ScepLogOutput3(3,rc, SCEDLL_ERROR_QUERY_INFO, pNode->ServiceName);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
ScepFree(pConfig);
|
|||
|
|
pConfig = NULL;
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
//
|
|||
|
|
// cannot allocate pConfig
|
|||
|
|
//
|
|||
|
|
rc = ERROR_NOT_ENOUGH_MEMORY;
|
|||
|
|
}
|
|||
|
|
} else {
|
|||
|
|
|
|||
|
|
ScepLogOutput3(3,rc, SCEDLL_ERROR_QUERY_INFO, pNode->ServiceName);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
//
|
|||
|
|
// should not fall in here
|
|||
|
|
//
|
|||
|
|
rc = ERROR_SUCCESS;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
CloseServiceHandle (hService);
|
|||
|
|
hService = NULL;
|
|||
|
|
|
|||
|
|
if ( rc != NO_ERROR ) {
|
|||
|
|
|
|||
|
|
ScepLogOutput3(1, rc, SCEDLL_SCP_ERROR_CONFIGURE, pNode->ServiceName);
|
|||
|
|
|
|||
|
|
rcSaveRsop = rc;
|
|||
|
|
|
|||
|
|
if ( ERROR_INVALID_OWNER == rc ||
|
|||
|
|
ERROR_INVALID_PRIMARY_GROUP == rc ||
|
|||
|
|
ERROR_INVALID_SECURITY_DESCR == rc ||
|
|||
|
|
ERROR_INVALID_ACL == rc ||
|
|||
|
|
ERROR_ACCESS_DENIED == rc ) {
|
|||
|
|
|
|||
|
|
gWarningCode = rc;
|
|||
|
|
rc = NO_ERROR;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else if ( !(ConfigOptions & SCE_SETUP_SERVICE_NOSTARTTYPE) &&
|
|||
|
|
pNode->Startup == SERVICE_DISABLED ) {
|
|||
|
|
//
|
|||
|
|
// if the service type is "disabled", we should also stop the service
|
|||
|
|
//
|
|||
|
|
if ( hService = OpenService(
|
|||
|
|
hScManager,
|
|||
|
|
pNode->ServiceName,
|
|||
|
|
SERVICE_STOP
|
|||
|
|
)) {
|
|||
|
|
|
|||
|
|
SERVICE_STATUS ServiceStatus;
|
|||
|
|
|
|||
|
|
if (!ControlService(hService,
|
|||
|
|
SERVICE_CONTROL_STOP,
|
|||
|
|
&ServiceStatus
|
|||
|
|
)) {
|
|||
|
|
if ( ERROR_SERVICE_NOT_ACTIVE != GetLastError() ) {
|
|||
|
|
ScepLogOutput3(2, GetLastError(), SCEDLL_SCP_ERROR_STOP, pNode->ServiceName);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
CloseServiceHandle (hService);
|
|||
|
|
hService = NULL;
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
ScepLogOutput3(2, GetLastError(), SCEDLL_SCP_ERROR_OPENFORSTOP, pNode->ServiceName);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
//
|
|||
|
|
// cannot open the service or some error taking ownership
|
|||
|
|
//
|
|||
|
|
if (rc != NO_ERROR) {
|
|||
|
|
ScepLogOutput3(1, rc, SCEDLL_ERROR_OPEN, pNode->ServiceName);
|
|||
|
|
// either of setting security/startup type failed - save it for RSOP log
|
|||
|
|
rcSaveRsop = (rcSaveRsop == ERROR_SUCCESS ? rc: rcSaveRsop);
|
|||
|
|
if ( rc == ERROR_SERVICE_DOES_NOT_EXIST )
|
|||
|
|
rc = NO_ERROR;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if (ConfigOptions & SCE_RSOP_CALLBACK)
|
|||
|
|
|
|||
|
|
ScepRsopLog(SCE_RSOP_SERVICES_INFO,
|
|||
|
|
rcSaveRsop != NO_ERROR ? rcSaveRsop : rc,
|
|||
|
|
pNode->ServiceName,
|
|||
|
|
0,
|
|||
|
|
0);
|
|||
|
|
|
|||
|
|
if ( (ConfigOptions & SCE_POLICY_TEMPLATE) &&
|
|||
|
|
hSectionDomain && hSectionTattoo ) {
|
|||
|
|
//
|
|||
|
|
// manage the tattoo value of this one
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
ScepTattooManageOneServiceValue(
|
|||
|
|
hSectionDomain,
|
|||
|
|
hSectionTattoo,
|
|||
|
|
pNode->ServiceName,
|
|||
|
|
ServiceLen,
|
|||
|
|
pServiceCurrent,
|
|||
|
|
rc
|
|||
|
|
);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( pServiceCurrent ) {
|
|||
|
|
SceFreePSCE_SERVICES(pServiceCurrent);
|
|||
|
|
pServiceCurrent = NULL;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
CloseServiceHandle (hScManager);
|
|||
|
|
|
|||
|
|
if (AdminsSid) {
|
|||
|
|
RtlFreeSid(AdminsSid);
|
|||
|
|
AdminsSid = NULL;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
SceAdjustPrivilege( SE_TAKE_OWNERSHIP_PRIVILEGE, FALSE, NULL );
|
|||
|
|
SceAdjustPrivilege( SE_SECURITY_PRIVILEGE, FALSE, NULL );
|
|||
|
|
|
|||
|
|
SceErr = ScepDosErrorToSceStatus(rc);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( nServices < TICKS_GENERAL_SERVICES ) {
|
|||
|
|
|
|||
|
|
ScepPostProgress(TICKS_GENERAL_SERVICES-nServices,
|
|||
|
|
AREA_SYSTEM_SERVICE,
|
|||
|
|
NULL);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
SceJetCloseSection(&hSectionDomain, TRUE);
|
|||
|
|
SceJetCloseSection(&hSectionTattoo, TRUE);
|
|||
|
|
|
|||
|
|
return(SceErr);
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
SCESTATUS
|
|||
|
|
ScepAnalyzeGeneralServices(
|
|||
|
|
IN PSCECONTEXT hProfile,
|
|||
|
|
IN DWORD Options
|
|||
|
|
)
|
|||
|
|
/*
|
|||
|
|
Routine Description:
|
|||
|
|
|
|||
|
|
Analyze all available services on the current system.
|
|||
|
|
|
|||
|
|
The base profile (SCEP) is in hProfile
|
|||
|
|
|
|||
|
|
Arguments:
|
|||
|
|
|
|||
|
|
hProfile - the database context handle
|
|||
|
|
|
|||
|
|
Return Value:
|
|||
|
|
|
|||
|
|
SCE status
|
|||
|
|
*/
|
|||
|
|
{
|
|||
|
|
if ( hProfile == NULL ) {
|
|||
|
|
|
|||
|
|
ScepPostProgress(TICKS_GENERAL_SERVICES,
|
|||
|
|
AREA_SYSTEM_SERVICE,
|
|||
|
|
NULL);
|
|||
|
|
|
|||
|
|
return(SCESTATUS_INVALID_PARAMETER);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
SCESTATUS rc;
|
|||
|
|
PSCE_SERVICES pServiceList=NULL;
|
|||
|
|
DWORD nServices=0;
|
|||
|
|
|
|||
|
|
rc = SceEnumerateServices( &pServiceList, FALSE );
|
|||
|
|
rc = ScepDosErrorToSceStatus(rc);
|
|||
|
|
|
|||
|
|
if ( rc == SCESTATUS_SUCCESS ) {
|
|||
|
|
|
|||
|
|
PSCESECTION hSectionScep=NULL, hSectionSap=NULL;
|
|||
|
|
//
|
|||
|
|
// open the sap section. If it is not there, creates it
|
|||
|
|
//
|
|||
|
|
rc = ScepStartANewSection(
|
|||
|
|
hProfile,
|
|||
|
|
&hSectionSap,
|
|||
|
|
(Options & SCE_GENERATE_ROLLBACK) ? SCEJET_TABLE_SMP : SCEJET_TABLE_SAP,
|
|||
|
|
szServiceGeneral
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
if ( rc == SCESTATUS_SUCCESS ) {
|
|||
|
|
|
|||
|
|
PSCE_SERVICES pNode = pServiceList;
|
|||
|
|
//
|
|||
|
|
// open SCEP section. should be success always because the StartANewSection
|
|||
|
|
// creates the section if it is not there
|
|||
|
|
//
|
|||
|
|
rc = ScepOpenSectionForName(
|
|||
|
|
hProfile,
|
|||
|
|
(Options & SCE_GENERATE_ROLLBACK) ? SCE_ENGINE_SMP : SCE_ENGINE_SCP, // SCE_ENGINE_SMP,
|
|||
|
|
szServiceGeneral,
|
|||
|
|
&hSectionScep
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
if ( rc == SCESTATUS_SUCCESS ) {
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// analyze each service
|
|||
|
|
//
|
|||
|
|
PSCE_SERVICES pOneService=NULL;
|
|||
|
|
BOOL IsDifferent;
|
|||
|
|
|
|||
|
|
for ( pNode=pServiceList;
|
|||
|
|
pNode != NULL; pNode=pNode->Next ) {
|
|||
|
|
|
|||
|
|
ScepLogOutput3(2, 0, SCEDLL_SAP_ANALYZE, pNode->ServiceName);
|
|||
|
|
|
|||
|
|
if ( nServices < TICKS_SPECIFIC_SERVICES ) {
|
|||
|
|
|
|||
|
|
ScepPostProgress(1,
|
|||
|
|
AREA_SYSTEM_SERVICE,
|
|||
|
|
NULL);
|
|||
|
|
nServices++;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// get setting from the SMP profile
|
|||
|
|
//
|
|||
|
|
rc = ScepGetSingleServiceSetting(
|
|||
|
|
hSectionScep,
|
|||
|
|
pNode->ServiceName,
|
|||
|
|
&pOneService
|
|||
|
|
);
|
|||
|
|
if ( rc == SCESTATUS_SUCCESS ) {
|
|||
|
|
//
|
|||
|
|
// there is a SMP entry for the service, compare and save
|
|||
|
|
//
|
|||
|
|
rc = ScepCompareSingleServiceSetting(
|
|||
|
|
pOneService,
|
|||
|
|
pNode,
|
|||
|
|
&IsDifferent
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
if ( rc == SCESTATUS_SUCCESS && IsDifferent ) {
|
|||
|
|
//
|
|||
|
|
// write the service as mismatch
|
|||
|
|
//
|
|||
|
|
pNode->Status = (Options & SCE_GENERATE_ROLLBACK) ? 0 : SCE_STATUS_MISMATCH;
|
|||
|
|
pNode->SeInfo = pOneService->SeInfo;
|
|||
|
|
|
|||
|
|
rc = ScepSetSingleServiceSetting(
|
|||
|
|
hSectionSap,
|
|||
|
|
pNode
|
|||
|
|
);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else if ( rc == SCESTATUS_RECORD_NOT_FOUND ) {
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// this service is not defined
|
|||
|
|
//
|
|||
|
|
if ( !(Options & SCE_GENERATE_ROLLBACK) ) {
|
|||
|
|
//
|
|||
|
|
// save the record with not configured status
|
|||
|
|
//
|
|||
|
|
pNode->Status = SCE_STATUS_NOT_CONFIGURED;
|
|||
|
|
|
|||
|
|
rc = ScepSetSingleServiceSetting(
|
|||
|
|
hSectionSap,
|
|||
|
|
pNode
|
|||
|
|
);
|
|||
|
|
} else {
|
|||
|
|
//
|
|||
|
|
// ignore this one
|
|||
|
|
//
|
|||
|
|
rc = SCESTATUS_SUCCESS;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
SceFreePSCE_SERVICES(pOneService);
|
|||
|
|
pOneService = NULL;
|
|||
|
|
|
|||
|
|
if ( rc != SCESTATUS_SUCCESS ) {
|
|||
|
|
ScepLogOutput3(1, ScepSceStatusToDosError(rc),
|
|||
|
|
SCEDLL_SAP_ERROR_ANALYZE, pNode->ServiceName);
|
|||
|
|
|
|||
|
|
if ( SCESTATUS_ACCESS_DENIED == rc ) {
|
|||
|
|
gWarningCode = ScepSceStatusToDosError(rc);
|
|||
|
|
|
|||
|
|
if ( !(Options & SCE_GENERATE_ROLLBACK) ) {
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// raise a error status
|
|||
|
|
//
|
|||
|
|
pNode->Status = SCE_STATUS_ERROR_NOT_AVAILABLE;
|
|||
|
|
|
|||
|
|
rc = ScepSetSingleServiceSetting(
|
|||
|
|
hSectionSap,
|
|||
|
|
pNode
|
|||
|
|
);
|
|||
|
|
}
|
|||
|
|
rc = SCESTATUS_SUCCESS;
|
|||
|
|
} else {
|
|||
|
|
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
SceJetCloseSection(&hSectionScep, TRUE);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( !(Options & SCE_GENERATE_ROLLBACK ) ) {
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// raise any error item
|
|||
|
|
//
|
|||
|
|
for ( PSCE_SERVICES pNodeTmp=pNode; pNodeTmp != NULL; pNodeTmp = pNodeTmp->Next ) {
|
|||
|
|
|
|||
|
|
pNodeTmp->Status = SCE_STATUS_ERROR_NOT_AVAILABLE;
|
|||
|
|
|
|||
|
|
ScepSetSingleServiceSetting(
|
|||
|
|
hSectionSap,
|
|||
|
|
pNode
|
|||
|
|
);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
SceJetCloseSection(&hSectionSap, TRUE);
|
|||
|
|
}
|
|||
|
|
if ( rc != SCESTATUS_SUCCESS )
|
|||
|
|
ScepLogOutput3(1, ScepSceStatusToDosError(rc), SCEDLL_SAP_ERROR_OUT);
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( nServices < TICKS_GENERAL_SERVICES ) {
|
|||
|
|
|
|||
|
|
ScepPostProgress(TICKS_GENERAL_SERVICES-nServices,
|
|||
|
|
AREA_SYSTEM_SERVICE,
|
|||
|
|
NULL);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
return(rc);
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
SCESTATUS
|
|||
|
|
ScepGetSingleServiceSetting(
|
|||
|
|
IN PSCESECTION hSection,
|
|||
|
|
IN PWSTR ServiceName,
|
|||
|
|
OUT PSCE_SERVICES *pOneService
|
|||
|
|
)
|
|||
|
|
/*
|
|||
|
|
Routine Description:
|
|||
|
|
|
|||
|
|
Get service settings for the service from the section
|
|||
|
|
|
|||
|
|
Arguments:
|
|||
|
|
|
|||
|
|
hSection - the section handle
|
|||
|
|
|
|||
|
|
ServiceName - the service name
|
|||
|
|
|
|||
|
|
pOneService - the service settings
|
|||
|
|
|
|||
|
|
Return Value:
|
|||
|
|
|
|||
|
|
SCE status
|
|||
|
|
*/
|
|||
|
|
{
|
|||
|
|
if ( hSection == NULL || ServiceName == NULL || pOneService == NULL ) {
|
|||
|
|
return(SCESTATUS_INVALID_PARAMETER);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
SCESTATUS rc;
|
|||
|
|
DWORD ValueLen;
|
|||
|
|
//
|
|||
|
|
// seek to the record and get length for name and value
|
|||
|
|
//
|
|||
|
|
rc = SceJetGetValue(
|
|||
|
|
hSection,
|
|||
|
|
SCEJET_EXACT_MATCH_NO_CASE,
|
|||
|
|
ServiceName,
|
|||
|
|
NULL,
|
|||
|
|
0,
|
|||
|
|
NULL,
|
|||
|
|
NULL,
|
|||
|
|
0,
|
|||
|
|
&ValueLen
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
if ( rc == SCESTATUS_SUCCESS ) {
|
|||
|
|
|
|||
|
|
PWSTR Value=NULL;
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// allocate memory for the service name and value string
|
|||
|
|
//
|
|||
|
|
Value = (PWSTR)ScepAlloc( LMEM_ZEROINIT, ValueLen+2);
|
|||
|
|
if ( Value != NULL ) {
|
|||
|
|
//
|
|||
|
|
// Get the service and its value
|
|||
|
|
//
|
|||
|
|
rc = SceJetGetValue(
|
|||
|
|
hSection,
|
|||
|
|
SCEJET_CURRENT,
|
|||
|
|
NULL,
|
|||
|
|
NULL,
|
|||
|
|
0,
|
|||
|
|
NULL,
|
|||
|
|
Value,
|
|||
|
|
ValueLen,
|
|||
|
|
&ValueLen
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
if ( rc == SCESTATUS_SUCCESS ) {
|
|||
|
|
|
|||
|
|
Value[ValueLen/2] = L'\0';
|
|||
|
|
|
|||
|
|
DWORD Win32Rc=NO_ERROR;
|
|||
|
|
PSECURITY_DESCRIPTOR pTempSD=NULL;
|
|||
|
|
DWORD SDsize=0;
|
|||
|
|
SECURITY_INFORMATION SeInfo=0;
|
|||
|
|
|
|||
|
|
if ( ValueLen >= 2 && Value[1] != L'\0' ) {
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// convert to security descriptor
|
|||
|
|
//
|
|||
|
|
Win32Rc = ConvertTextSecurityDescriptor(
|
|||
|
|
Value+1,
|
|||
|
|
&pTempSD,
|
|||
|
|
&SDsize,
|
|||
|
|
&SeInfo
|
|||
|
|
);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( Win32Rc == NO_ERROR ) {
|
|||
|
|
|
|||
|
|
ScepChangeAclRevision(pTempSD, ACL_REVISION);
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// create this service node
|
|||
|
|
//
|
|||
|
|
*pOneService = (PSCE_SERVICES)ScepAlloc( LMEM_FIXED, sizeof(SCE_SERVICES) );
|
|||
|
|
|
|||
|
|
if ( *pOneService != NULL ) {
|
|||
|
|
|
|||
|
|
(*pOneService)->ServiceName = (PWSTR)ScepAlloc(LMEM_FIXED,
|
|||
|
|
(wcslen(ServiceName)+1)*sizeof(WCHAR));
|
|||
|
|
if ( (*pOneService)->ServiceName != NULL ) {
|
|||
|
|
|
|||
|
|
wcscpy( (*pOneService)->ServiceName, ServiceName);
|
|||
|
|
(*pOneService)->DisplayName = NULL;
|
|||
|
|
(*pOneService)->Status = *((BYTE *)Value);
|
|||
|
|
(*pOneService)->Startup = *((BYTE *)Value+1);
|
|||
|
|
(*pOneService)->General.pSecurityDescriptor = pTempSD;
|
|||
|
|
(*pOneService)->SeInfo = SeInfo;
|
|||
|
|
(*pOneService)->Next = NULL;
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// DO NOT free the following buffers
|
|||
|
|
//
|
|||
|
|
pTempSD = NULL;
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
rc = SCESTATUS_NOT_ENOUGH_RESOURCE;
|
|||
|
|
ScepFree(*pOneService);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
rc = SCESTATUS_NOT_ENOUGH_RESOURCE;
|
|||
|
|
}
|
|||
|
|
if ( pTempSD != NULL ) {
|
|||
|
|
ScepFree(pTempSD);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
rc = ScepDosErrorToSceStatus(Win32Rc);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
ScepFree(Value);
|
|||
|
|
|
|||
|
|
} else
|
|||
|
|
rc = SCESTATUS_NOT_ENOUGH_RESOURCE;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
return(rc);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
SCESTATUS
|
|||
|
|
ScepCompareSingleServiceSetting(
|
|||
|
|
IN PSCE_SERVICES pNode1,
|
|||
|
|
IN PSCE_SERVICES pNode2,
|
|||
|
|
OUT PBOOL pIsDifferent
|
|||
|
|
)
|
|||
|
|
/*
|
|||
|
|
Routine Description:
|
|||
|
|
|
|||
|
|
Comare two service settings.
|
|||
|
|
|
|||
|
|
Arguments:
|
|||
|
|
|
|||
|
|
pNode1 - the first service
|
|||
|
|
|
|||
|
|
pNode2 - the second service
|
|||
|
|
|
|||
|
|
pIsDifferent - output TRUE if different
|
|||
|
|
|
|||
|
|
Return Value:
|
|||
|
|
|
|||
|
|
SCE status
|
|||
|
|
*/
|
|||
|
|
{
|
|||
|
|
SCESTATUS rc=SCESTATUS_SUCCESS;
|
|||
|
|
|
|||
|
|
if ( pNode1->Startup == pNode2->Startup ) {
|
|||
|
|
|
|||
|
|
BYTE resultSD = 0;
|
|||
|
|
rc = ScepCompareObjectSecurity(
|
|||
|
|
SE_SERVICE,
|
|||
|
|
FALSE,
|
|||
|
|
pNode1->General.pSecurityDescriptor,
|
|||
|
|
pNode2->General.pSecurityDescriptor,
|
|||
|
|
pNode1->SeInfo & (DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION),
|
|||
|
|
&resultSD
|
|||
|
|
);
|
|||
|
|
if ( resultSD ) {
|
|||
|
|
*pIsDifferent = TRUE;
|
|||
|
|
} else
|
|||
|
|
*pIsDifferent = FALSE;
|
|||
|
|
|
|||
|
|
} else
|
|||
|
|
*pIsDifferent = TRUE;
|
|||
|
|
|
|||
|
|
return(rc);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
SCESTATUS
|
|||
|
|
ScepSetSingleServiceSetting(
|
|||
|
|
IN PSCESECTION hSection,
|
|||
|
|
IN PSCE_SERVICES pOneService
|
|||
|
|
)
|
|||
|
|
/*
|
|||
|
|
Routine Description:
|
|||
|
|
|
|||
|
|
Set service settings for the service from the section
|
|||
|
|
|
|||
|
|
Arguments:
|
|||
|
|
|
|||
|
|
hSection - the section handle
|
|||
|
|
|
|||
|
|
pOneService - the service settings
|
|||
|
|
|
|||
|
|
Return Value:
|
|||
|
|
|
|||
|
|
SCE status
|
|||
|
|
*/
|
|||
|
|
{
|
|||
|
|
if ( hSection == NULL || pOneService == NULL ) {
|
|||
|
|
return(SCESTATUS_INVALID_PARAMETER);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
SCESTATUS rc=SCESTATUS_SUCCESS;
|
|||
|
|
PWSTR SDspec=NULL;
|
|||
|
|
DWORD SDsize=0;
|
|||
|
|
|
|||
|
|
|
|||
|
|
if ( (pOneService->Status != SCE_STATUS_NOT_ANALYZED) &&
|
|||
|
|
(pOneService->Status != SCE_STATUS_ERROR_NOT_AVAILABLE) &&
|
|||
|
|
(pOneService->General.pSecurityDescriptor != NULL) ) {
|
|||
|
|
|
|||
|
|
DWORD Win32Rc;
|
|||
|
|
|
|||
|
|
Win32Rc = ConvertSecurityDescriptorToText (
|
|||
|
|
pOneService->General.pSecurityDescriptor,
|
|||
|
|
pOneService->SeInfo,
|
|||
|
|
&SDspec,
|
|||
|
|
&SDsize // number of w-chars
|
|||
|
|
);
|
|||
|
|
rc = ScepDosErrorToSceStatus(Win32Rc);
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( rc == SCESTATUS_SUCCESS ) {
|
|||
|
|
|
|||
|
|
PWSTR Value=NULL;
|
|||
|
|
DWORD ValueLen;
|
|||
|
|
|
|||
|
|
ValueLen = (SDsize+1)*sizeof(WCHAR);
|
|||
|
|
|
|||
|
|
Value = (PWSTR)ScepAlloc( (UINT)0, ValueLen+sizeof(WCHAR) );
|
|||
|
|
|
|||
|
|
if ( Value != NULL ) {
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// The first byte is status, the second byte is startup
|
|||
|
|
//
|
|||
|
|
*((BYTE *)Value) = pOneService->Status;
|
|||
|
|
|
|||
|
|
*((BYTE *)Value+1) = pOneService->Startup;
|
|||
|
|
|
|||
|
|
if ( SDspec != NULL ) {
|
|||
|
|
|
|||
|
|
swprintf(Value+1, L"%s", SDspec );
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
Value[SDsize+1] = L'\0'; //terminate this string
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// set the value
|
|||
|
|
//
|
|||
|
|
rc = SceJetSetLine(
|
|||
|
|
hSection,
|
|||
|
|
pOneService->ServiceName,
|
|||
|
|
FALSE,
|
|||
|
|
Value,
|
|||
|
|
ValueLen,
|
|||
|
|
0
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
ScepFree( Value );
|
|||
|
|
|
|||
|
|
switch ( pOneService->Status ) {
|
|||
|
|
case SCE_STATUS_ERROR_NOT_AVAILABLE:
|
|||
|
|
ScepLogOutput3(2, 0, SCEDLL_STATUS_ERROR, pOneService->ServiceName);
|
|||
|
|
|
|||
|
|
break;
|
|||
|
|
|
|||
|
|
case SCE_STATUS_NOT_CONFIGURED:
|
|||
|
|
|
|||
|
|
ScepLogOutput3(2, 0, SCEDLL_STATUS_NC, pOneService->ServiceName);
|
|||
|
|
|
|||
|
|
break;
|
|||
|
|
|
|||
|
|
case SCE_STATUS_NOT_ANALYZED:
|
|||
|
|
|
|||
|
|
ScepLogOutput3(2, 0, SCEDLL_STATUS_NEW, pOneService->ServiceName);
|
|||
|
|
|
|||
|
|
break;
|
|||
|
|
|
|||
|
|
default:
|
|||
|
|
|
|||
|
|
ScepLogOutput3(2, 0, SCEDLL_STATUS_MISMATCH, pOneService->ServiceName);
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else
|
|||
|
|
rc = SCESTATUS_NOT_ENOUGH_RESOURCE;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( SDspec != NULL ) {
|
|||
|
|
ScepFree( SDspec );
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
return(rc);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
SCESTATUS
|
|||
|
|
ScepInvokeSpecificServices(
|
|||
|
|
IN PSCECONTEXT hProfile,
|
|||
|
|
IN BOOL bConfigure,
|
|||
|
|
IN SCE_ATTACHMENT_TYPE aType
|
|||
|
|
)
|
|||
|
|
/*
|
|||
|
|
Routine Description:
|
|||
|
|
|
|||
|
|
Call each service engine for configure or analyze
|
|||
|
|
|
|||
|
|
Arguments:
|
|||
|
|
|
|||
|
|
hProfile - the profile handle
|
|||
|
|
|
|||
|
|
bConfigure - TRUE = to configure, FALSE=to analyze
|
|||
|
|
|
|||
|
|
aType - attachment type "services" or "policy"
|
|||
|
|
|
|||
|
|
Return Value:
|
|||
|
|
|
|||
|
|
SCE status
|
|||
|
|
*/
|
|||
|
|
{
|
|||
|
|
//
|
|||
|
|
// for posting progress
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
DWORD nServices=0;
|
|||
|
|
AREA_INFORMATION Area=0;
|
|||
|
|
DWORD nMaxTicks=0;
|
|||
|
|
|
|||
|
|
switch(aType) {
|
|||
|
|
case SCE_ATTACHMENT_SERVICE:
|
|||
|
|
Area = AREA_SYSTEM_SERVICE;
|
|||
|
|
nMaxTicks = TICKS_SPECIFIC_SERVICES;
|
|||
|
|
break;
|
|||
|
|
case SCE_ATTACHMENT_POLICY:
|
|||
|
|
Area = AREA_SECURITY_POLICY;
|
|||
|
|
nMaxTicks = TICKS_SPECIFIC_POLICIES;
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( hProfile == NULL ) {
|
|||
|
|
|
|||
|
|
ScepPostProgress(nMaxTicks,
|
|||
|
|
Area,
|
|||
|
|
NULL);
|
|||
|
|
|
|||
|
|
return(SCESTATUS_INVALID_PARAMETER);
|
|||
|
|
}
|
|||
|
|
//
|
|||
|
|
// call available service engines to configure specific setting
|
|||
|
|
//
|
|||
|
|
SCESTATUS SceErr ;
|
|||
|
|
PSCE_SERVICES pSvcEngineList=NULL;
|
|||
|
|
SCEP_HANDLE sceHandle;
|
|||
|
|
SCESVC_CALLBACK_INFO sceCbInfo;
|
|||
|
|
|
|||
|
|
SceErr = ScepEnumServiceEngines(&pSvcEngineList, aType);
|
|||
|
|
|
|||
|
|
if ( SceErr == SCESTATUS_SUCCESS) {
|
|||
|
|
|
|||
|
|
HINSTANCE hDll;
|
|||
|
|
PF_ConfigAnalyzeService pfTemp;
|
|||
|
|
|
|||
|
|
for ( PSCE_SERVICES pNode=pSvcEngineList;
|
|||
|
|
pNode != NULL; pNode = pNode->Next ) {
|
|||
|
|
|
|||
|
|
ScepLogOutput3(2, 0, SCEDLL_LOAD_ATTACHMENT, pNode->ServiceName);
|
|||
|
|
|
|||
|
|
if ( nServices < nMaxTicks ) {
|
|||
|
|
|
|||
|
|
ScepPostProgress(1, Area, pNode->ServiceName);
|
|||
|
|
nServices++;
|
|||
|
|
}
|
|||
|
|
//
|
|||
|
|
// load the dll.
|
|||
|
|
//
|
|||
|
|
hDll = LoadLibrary(pNode->General.ServiceEngineName);
|
|||
|
|
|
|||
|
|
if ( hDll != NULL ) {
|
|||
|
|
|
|||
|
|
if ( bConfigure ) {
|
|||
|
|
//
|
|||
|
|
// call SceSvcAttachmentConfig from the dll
|
|||
|
|
//
|
|||
|
|
pfTemp = (PF_ConfigAnalyzeService)
|
|||
|
|
GetProcAddress(hDll,
|
|||
|
|
"SceSvcAttachmentConfig") ;
|
|||
|
|
} else {
|
|||
|
|
//
|
|||
|
|
// call SceSvcAttachmentAnalyze from the dll
|
|||
|
|
//
|
|||
|
|
pfTemp = (PF_ConfigAnalyzeService)
|
|||
|
|
GetProcAddress(hDll,
|
|||
|
|
"SceSvcAttachmentAnalyze") ;
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
if ( pfTemp != NULL ) {
|
|||
|
|
//
|
|||
|
|
// prepare the handle first
|
|||
|
|
//
|
|||
|
|
sceHandle.hProfile = (PVOID)hProfile;
|
|||
|
|
sceHandle.ServiceName = (PCWSTR)(pNode->ServiceName);
|
|||
|
|
|
|||
|
|
sceCbInfo.sceHandle = &sceHandle;
|
|||
|
|
sceCbInfo.pfQueryInfo = &SceCbQueryInfo;
|
|||
|
|
sceCbInfo.pfSetInfo = &SceCbSetInfo;
|
|||
|
|
sceCbInfo.pfFreeInfo = &SceSvcpFreeMemory;
|
|||
|
|
sceCbInfo.pfLogInfo = &ScepLogOutput2;
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// call the SceSvcAttachmentConfig/Analyze from the DLL
|
|||
|
|
//
|
|||
|
|
__try {
|
|||
|
|
|
|||
|
|
SceErr = (*pfTemp)((PSCESVC_CALLBACK_INFO)&sceCbInfo);
|
|||
|
|
|
|||
|
|
} __except (EXCEPTION_EXECUTE_HANDLER) {
|
|||
|
|
SceErr = SCESTATUS_SERVICE_NOT_SUPPORT;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
//
|
|||
|
|
// this API is not supported
|
|||
|
|
//
|
|||
|
|
SceErr = SCESTATUS_SERVICE_NOT_SUPPORT;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// try to free the library handle. If it fails, just leave it
|
|||
|
|
// to to the process to terminate
|
|||
|
|
//
|
|||
|
|
FreeLibrary(hDll);
|
|||
|
|
|
|||
|
|
} else
|
|||
|
|
SceErr = SCESTATUS_SERVICE_NOT_SUPPORT;
|
|||
|
|
|
|||
|
|
if ( SceErr == SCESTATUS_SERVICE_NOT_SUPPORT ) {
|
|||
|
|
if ( bConfigure )
|
|||
|
|
ScepLogOutput3(1, ScepSceStatusToDosError(SceErr),
|
|||
|
|
SCEDLL_SCP_NOT_SUPPORT);
|
|||
|
|
else
|
|||
|
|
ScepLogOutput3(1, ScepSceStatusToDosError(SceErr),
|
|||
|
|
SCEDLL_SAP_NOT_SUPPORT);
|
|||
|
|
SceErr = SCESTATUS_SUCCESS;
|
|||
|
|
|
|||
|
|
} else if ( SceErr != SCESTATUS_SUCCESS &&
|
|||
|
|
SceErr != SCESTATUS_RECORD_NOT_FOUND ) {
|
|||
|
|
ScepLogOutput3(1, ScepSceStatusToDosError(SceErr),
|
|||
|
|
SCEDLL_ERROR_LOAD, pNode->ServiceName);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( SceErr != SCESTATUS_SUCCESS &&
|
|||
|
|
SceErr != SCESTATUS_SERVICE_NOT_SUPPORT &&
|
|||
|
|
SceErr != SCESTATUS_RECORD_NOT_FOUND )
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
//
|
|||
|
|
// free the buffer
|
|||
|
|
//
|
|||
|
|
SceFreePSCE_SERVICES(pSvcEngineList);
|
|||
|
|
|
|||
|
|
} else if ( SceErr != SCESTATUS_SUCCESS &&
|
|||
|
|
SceErr != SCESTATUS_PROFILE_NOT_FOUND &&
|
|||
|
|
SceErr != SCESTATUS_RECORD_NOT_FOUND ) {
|
|||
|
|
ScepLogOutput3(1, ScepSceStatusToDosError(SceErr),
|
|||
|
|
SCEDLL_SAP_ERROR_ENUMERATE, L"services");
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( SceErr == SCESTATUS_PROFILE_NOT_FOUND ||
|
|||
|
|
SceErr == SCESTATUS_RECORD_NOT_FOUND ||
|
|||
|
|
SceErr == SCESTATUS_SERVICE_NOT_SUPPORT ) {
|
|||
|
|
//
|
|||
|
|
// no service engine defined
|
|||
|
|
//
|
|||
|
|
SceErr = SCESTATUS_SUCCESS;
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( nServices < nMaxTicks ) {
|
|||
|
|
|
|||
|
|
ScepPostProgress(nMaxTicks-nServices,
|
|||
|
|
Area,
|
|||
|
|
NULL);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
return(SceErr);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
SCESTATUS
|
|||
|
|
ScepEnumServiceEngines(
|
|||
|
|
OUT PSCE_SERVICES *pSvcEngineList,
|
|||
|
|
IN SCE_ATTACHMENT_TYPE aType
|
|||
|
|
)
|
|||
|
|
/*
|
|||
|
|
Routine Description:
|
|||
|
|
|
|||
|
|
Query all services which has a service engine for security manager
|
|||
|
|
The service engine information is in the registry:
|
|||
|
|
|
|||
|
|
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SeCEdit
|
|||
|
|
|
|||
|
|
Arguments:
|
|||
|
|
|
|||
|
|
pSvcEngineList - the service engine list
|
|||
|
|
|
|||
|
|
aType - attachment type (service or policy)
|
|||
|
|
|
|||
|
|
Return Value:
|
|||
|
|
|
|||
|
|
SCE status
|
|||
|
|
*/
|
|||
|
|
{
|
|||
|
|
if ( pSvcEngineList == NULL ) {
|
|||
|
|
return(SCESTATUS_INVALID_PARAMETER);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
DWORD Win32Rc;
|
|||
|
|
HKEY hKey=NULL;
|
|||
|
|
|
|||
|
|
switch ( aType ) {
|
|||
|
|
case SCE_ATTACHMENT_SERVICE:
|
|||
|
|
Win32Rc = RegOpenKeyEx(
|
|||
|
|
HKEY_LOCAL_MACHINE,
|
|||
|
|
SCE_ROOT_SERVICE_PATH,
|
|||
|
|
0,
|
|||
|
|
KEY_READ,
|
|||
|
|
&hKey
|
|||
|
|
);
|
|||
|
|
break;
|
|||
|
|
case SCE_ATTACHMENT_POLICY:
|
|||
|
|
|
|||
|
|
Win32Rc = RegOpenKeyEx(
|
|||
|
|
HKEY_LOCAL_MACHINE,
|
|||
|
|
SCE_ROOT_POLICY_PATH,
|
|||
|
|
0,
|
|||
|
|
KEY_READ,
|
|||
|
|
&hKey
|
|||
|
|
);
|
|||
|
|
break;
|
|||
|
|
default:
|
|||
|
|
return SCESTATUS_INVALID_PARAMETER;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( Win32Rc == ERROR_SUCCESS ) {
|
|||
|
|
|
|||
|
|
TCHAR Buffer[MAX_PATH];
|
|||
|
|
DWORD BufSize;
|
|||
|
|
DWORD index = 0;
|
|||
|
|
DWORD EnumRc;
|
|||
|
|
FILETIME LastWriteTime;
|
|||
|
|
PWSTR BufTmp=NULL;
|
|||
|
|
PWSTR EngineName=NULL;
|
|||
|
|
DWORD RegType;
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// enumerate all subkeys of the key
|
|||
|
|
//
|
|||
|
|
do {
|
|||
|
|
memset(Buffer, '\0', MAX_PATH*sizeof(WCHAR));
|
|||
|
|
BufSize = MAX_PATH;
|
|||
|
|
|
|||
|
|
EnumRc = RegEnumKeyEx(
|
|||
|
|
hKey,
|
|||
|
|
index,
|
|||
|
|
Buffer,
|
|||
|
|
&BufSize,
|
|||
|
|
NULL,
|
|||
|
|
NULL,
|
|||
|
|
NULL,
|
|||
|
|
&LastWriteTime);
|
|||
|
|
|
|||
|
|
if ( EnumRc == ERROR_SUCCESS ) {
|
|||
|
|
index++;
|
|||
|
|
//
|
|||
|
|
// get the service name, query service engine name
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
BufSize += wcslen(SCE_ROOT_SERVICE_PATH) + 1; //62;
|
|||
|
|
BufTmp = (PWSTR)ScepAlloc( 0, (BufSize+1)*sizeof(WCHAR));
|
|||
|
|
if ( BufTmp != NULL ) {
|
|||
|
|
|
|||
|
|
switch ( aType ) {
|
|||
|
|
case SCE_ATTACHMENT_SERVICE:
|
|||
|
|
|
|||
|
|
swprintf(BufTmp, L"%s\\%s", SCE_ROOT_SERVICE_PATH, Buffer);
|
|||
|
|
|
|||
|
|
Win32Rc = ScepRegQueryValue(
|
|||
|
|
HKEY_LOCAL_MACHINE,
|
|||
|
|
BufTmp,
|
|||
|
|
L"ServiceAttachmentPath",
|
|||
|
|
(PVOID *)&EngineName,
|
|||
|
|
&RegType
|
|||
|
|
);
|
|||
|
|
break;
|
|||
|
|
|
|||
|
|
case SCE_ATTACHMENT_POLICY:
|
|||
|
|
// policies
|
|||
|
|
swprintf(BufTmp, L"%s\\%s", SCE_ROOT_POLICY_PATH, Buffer);
|
|||
|
|
|
|||
|
|
Win32Rc = ScepRegQueryValue(
|
|||
|
|
HKEY_LOCAL_MACHINE,
|
|||
|
|
BufTmp,
|
|||
|
|
L"PolicyAttachmentPath",
|
|||
|
|
(PVOID *)&EngineName,
|
|||
|
|
&RegType
|
|||
|
|
);
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( Win32Rc == ERROR_SUCCESS ) {
|
|||
|
|
//
|
|||
|
|
// get the service engine name and service name
|
|||
|
|
// add them to the service node
|
|||
|
|
//
|
|||
|
|
Win32Rc = ScepAddOneServiceToList(
|
|||
|
|
Buffer, // service name
|
|||
|
|
NULL,
|
|||
|
|
0,
|
|||
|
|
(PVOID)EngineName,
|
|||
|
|
0,
|
|||
|
|
FALSE,
|
|||
|
|
pSvcEngineList
|
|||
|
|
);
|
|||
|
|
//
|
|||
|
|
// free the buffer if it's not added to the list
|
|||
|
|
//
|
|||
|
|
if ( Win32Rc != ERROR_SUCCESS && EngineName ) {
|
|||
|
|
ScepFree(EngineName);
|
|||
|
|
}
|
|||
|
|
EngineName = NULL;
|
|||
|
|
|
|||
|
|
} else if ( Win32Rc == ERROR_FILE_NOT_FOUND ) {
|
|||
|
|
//
|
|||
|
|
// if no service engine name, ignore this service
|
|||
|
|
//
|
|||
|
|
Win32Rc = ERROR_SUCCESS;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
ScepFree(BufTmp);
|
|||
|
|
BufTmp = NULL;
|
|||
|
|
|
|||
|
|
} else {
|
|||
|
|
Win32Rc = ERROR_NOT_ENOUGH_MEMORY;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( Win32Rc != ERROR_SUCCESS ) {
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
} while ( EnumRc != ERROR_NO_MORE_ITEMS );
|
|||
|
|
|
|||
|
|
RegCloseKey(hKey);
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// remember the error code from enumeration
|
|||
|
|
//
|
|||
|
|
if ( EnumRc != ERROR_SUCCESS && EnumRc != ERROR_NO_MORE_ITEMS ) {
|
|||
|
|
if ( Win32Rc == ERROR_SUCCESS )
|
|||
|
|
Win32Rc = EnumRc;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if ( Win32Rc != NO_ERROR && *pSvcEngineList != NULL ) {
|
|||
|
|
//
|
|||
|
|
// free memory allocated for the list
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
SceFreePSCE_SERVICES(*pSvcEngineList);
|
|||
|
|
*pSvcEngineList = NULL;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
return( ScepDosErrorToSceStatus(Win32Rc) );
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|