able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/termsrv/winsta/server/acl.c

3564 lines
92 KiB
C
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
/*************************************************************************
*
* acl.c
*
* Routines to manage Window Station Security.
*
*
* Copyright Microsoft Corporation, 1998
*
*************************************************************************/
#include "precomp.h"
#pragma hdrstop
#include <winsta.h>
#include <rpc.h>
#include <seopaque.h>
/*
* NOTE: Please keep all security code for ICASRV and CITRIX WINSTATIONS
* in this file. This helps to compartmentilize the security routines
* to make it easier to update/debug our policies.
*
*/
#if DBG
ULONG
DbgPrint(
PCH Format,
...
);
#define DBGPRINT(x) DbgPrint x
#if DBGTRACE
#define TRACE0(x) DbgPrint x
#define TRACE1(x) DbgPrint x
#else
#define TRACE0(x)
#define TRACE1(x)
#endif
#else
#define DBGPRINT(x)
#define TRACE0(x)
#define TRACE1(x)
#endif
/*
* Forward references
*/
VOID
CleanUpSD(
PSECURITY_DESCRIPTOR pSD
);
NTSTATUS IcaRegWinStationEnumerate( PULONG, PWINSTATIONNAME, PULONG );
NTSTATUS
ConfigureSecurity(
IN PWSTR ValueName,
IN ULONG ValueType,
IN PVOID ValueData,
IN ULONG ValueLength,
IN PVOID Context,
IN PVOID EntryContext
);
NTSTATUS
ConfigureConsoleSecurity(
IN PWSTR ValueName,
IN ULONG ValueType,
IN PVOID ValueData,
IN ULONG ValueLength,
IN PVOID Context,
IN PVOID EntryContext
);
PSECURITY_DESCRIPTOR
CreateWinStationDefaultSecurityDescriptor();
NTSTATUS
RpcGetClientLogonId(
PULONG pLogonId
);
NTSTATUS
RpcCheckSystemClientEx(
PWINSTATION pWinStation
);
BOOL
IsCallerSystem( VOID );
BOOL
IsCallerAdmin( VOID );
BOOL
IsServiceLoggedAsSystem( VOID );
BOOL
IsSystemToken( HANDLE TokenHandle );
NTSTATUS
RpcCheckSystemClientNoLogonId(
PWINSTATION pWinStation
);
NTSTATUS
RpcCheckClientAccessLocal(
PWINSTATION pWinStation,
ACCESS_MASK DesiredAccess,
BOOLEAN AlreadyImpersonating
);
BOOL
AddAccessToDirectory(
PWCHAR pPath,
DWORD NewAccess,
PSID pSid
);
NTSTATUS
AddAccessToDirectoryObjects(
HANDLE DirectoryHandle,
DWORD NewAccess,
PSID pSid
);
BOOL
AddAceToSecurityDescriptor(
PSECURITY_DESCRIPTOR *ppSd,
PACL *ppDacl,
DWORD Access,
PSID pSid,
BOOLEAN InheritOnly
);
BOOL
SelfRelativeToAbsoluteSD(
PSECURITY_DESCRIPTOR SecurityDescriptorIn,
PSECURITY_DESCRIPTOR *SecurityDescriptorOut,
PULONG ReturnedLength
);
BOOL
AbsoluteToSelfRelativeSD(
PSECURITY_DESCRIPTOR SecurityDescriptorIn,
PSECURITY_DESCRIPTOR *SecurityDescriptorOut,
PULONG ReturnedLength
);
NTSTATUS ApplyWinStaMappingToSD(
PSECURITY_DESCRIPTOR pSecurityDescriptor
);
/*
* Global data
*/
PSECURITY_DESCRIPTOR DefaultWinStationSecurityDescriptor = NULL;
PSECURITY_DESCRIPTOR DefaultConsoleSecurityDescriptor = NULL;
/*
* Structure to lookup the default security descriptor
* for WINSTATIONS.
*/
RTL_QUERY_REGISTRY_TABLE DefaultSecurityTable[] = {
{NULL, RTL_QUERY_REGISTRY_SUBKEY,
REG_WINSTATIONS, NULL,
REG_NONE, NULL, 0},
{ConfigureSecurity, RTL_QUERY_REGISTRY_REQUIRED,
REG_DEFAULTSECURITY, NULL,
REG_NONE, NULL, 0},
{NULL, 0,
NULL, NULL,
REG_NONE, NULL, 0}
};
/*
* Structure to lookup the default console security descriptor
*/
RTL_QUERY_REGISTRY_TABLE ConsoleSecurityTable[] = {
{NULL, RTL_QUERY_REGISTRY_SUBKEY,
REG_WINSTATIONS, NULL,
REG_NONE, NULL, 0},
{ConfigureConsoleSecurity, RTL_QUERY_REGISTRY_REQUIRED,
REG_CONSOLESECURITY, NULL,
REG_NONE, NULL, 0},
{NULL, 0,
NULL, NULL,
REG_NONE, NULL, 0}
};
extern PSID gSystemSid;
extern PSID gAdminSid;
extern RTL_RESOURCE WinStationSecurityLock;
/*
* Structure to lookup the security on a specific WINSTATION
* type name in the registry.
*
* This is control\Terminal Server\WinStations\<name>\Security
*
* <name> is the transport type. IE: TCP, IPX, etc.
*/
RTL_QUERY_REGISTRY_TABLE WinStationSecurityTable[] = {
{ConfigureSecurity, RTL_QUERY_REGISTRY_REQUIRED,
REG_SECURITY, NULL,
REG_NONE, NULL, 0},
{NULL, 0,
NULL, NULL,
REG_NONE, NULL, 0}
};
LPCWSTR szTermsrv = L"Termsrv";
LPCWSTR szTermsrvSession = L"Termsrv Session";
//
// Structure that describes the mapping of generic access rights to object
// specific access rights for Window Station objects.
//
GENERIC_MAPPING WinStaMapping = {
STANDARD_RIGHTS_READ |
WINSTATION_QUERY,
STANDARD_RIGHTS_WRITE |
WINSTATION_SET,
STANDARD_RIGHTS_EXECUTE,
WINSTATION_ALL_ACCESS
};
/*******************************************************************************
*
* WinStationSecurityInit
*
* Initialize the WinStation security.
*
* ENTRY:
* nothing
*
* EXIT:
* STATUS_SUCCESS
*
******************************************************************************/
NTSTATUS
WinStationSecurityInit( VOID )
{
NTSTATUS Status;
/*
* Get the default security descriptor from the registry
*
* This is placed on WinStations that do not have specific
* security placed on them by WinAdmin.
*
* This key is in CurrentControlSet\Control\Terminal Server\WinStations\DefaultSecurity
*/
Status = RtlQueryRegistryValues( RTL_REGISTRY_CONTROL,
REG_TSERVER,
DefaultSecurityTable,
NULL,
DefaultEnvironment
);
/*
* If the key does not exist, create a default security descriptor.
*
* NOTE: This is now created by default always by SM manager. The
* SM default must match the default here.
* This is so that the console is created with the right SD.
*/
if ( ( Status == STATUS_OBJECT_NAME_NOT_FOUND )
|| ( DefaultWinStationSecurityDescriptor == NULL ) ) {
PSECURITY_DESCRIPTOR Default;
ULONG Length;
Default = CreateWinStationDefaultSecurityDescriptor();
ASSERT( Default != NULL );
if (Default == NULL) {
return STATUS_NO_MEMORY;
}
Length = RtlLengthSecurityDescriptor(Default);
// Ensure the complete path exists
RtlCreateRegistryKey( RTL_REGISTRY_CONTROL, REG_TSERVER );
RtlCreateRegistryKey( RTL_REGISTRY_CONTROL, REG_TSERVER_WINSTATIONS );
Status = RtlWriteRegistryValue( RTL_REGISTRY_CONTROL,
REG_TSERVER_WINSTATIONS,
REG_DEFAULTSECURITY, REG_BINARY,
Default, Length );
DefaultWinStationSecurityDescriptor = Default;
}
if (!NT_SUCCESS( Status )) {
DBGPRINT(( "TERMSRV: RtlQueryRegistryValues(Terminal Server) failed - Status == %lx\n", Status ));
}
ASSERT( DefaultWinStationSecurityDescriptor != NULL );
//Just do the same for default console security descriptor
//--------------------------------------------------------------------------------------
/*
* Get the default console security descriptor from the registry
*
* This is placed on WinStations that do not have specific
* security placed on them by WinAdmin.
*
* This key is in CurrentControlSet\Control\Terminal Server\WinStations\ConsoleSecurity
*/
Status = RtlQueryRegistryValues( RTL_REGISTRY_CONTROL,
REG_TSERVER,
ConsoleSecurityTable,
NULL,
DefaultEnvironment
);
/*
* If the key does not exist, set default console SD to be equal to
* default SD
*/
if ( ( Status == STATUS_OBJECT_NAME_NOT_FOUND )
|| ( DefaultConsoleSecurityDescriptor == NULL ) ) {
DefaultConsoleSecurityDescriptor = DefaultWinStationSecurityDescriptor;
}
ASSERT( DefaultConsoleSecurityDescriptor != NULL );
//--------------------------------------------------------------------------------------
return( STATUS_SUCCESS );
}
/*****************************************************************************
*
* ReadWinStationSecurityDescriptor
*
* Read the security descriptor from the registry for the
* WINSTATION name.
*
* The WINSTATION name is the base protocol name, or the one shot name.
* IE: "TCP", or "COM3". It is not an instance name such as "TCP#4".
*
* This is called by the WSF_LISTEN thread to get any specific ACL's
* for the WINSTATION protocol type.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
NTSTATUS
ReadWinStationSecurityDescriptor(
PWINSTATION pWinStation
)
{
LONG cb;
LPWSTR PathBuf;
NTSTATUS Status;
ULONG Length;
PACL Dacl, NewDacl = NULL;
BOOLEAN DaclPresent, DaclDefaulted;
ACL_SIZE_INFORMATION AclInfo;
PACE_HEADER CurrentAce;
ULONG i;
/*
* If no name, we can not lookup the security descriptor.
*/
if( pWinStation->WinStationName[0] == UNICODE_NULL ) {
TRACE0(("TERMSRV: ReadWinStationSecurityDescriptor: No name on WinStation LogonId %d\n",pWinStation->LogonId));
return( STATUS_NO_SECURITY_ON_OBJECT );
}
TRACE0(("TERMSRV: ReadWinStationSecurityDescriptor: Name %ws\n",&pWinStation->WinStationName));
cb = sizeof( REG_TSERVER_WINSTATIONS ) +
sizeof( L"\\" ) +
sizeof(WINSTATIONNAME) +
sizeof(UNICODE_NULL);
PathBuf = MemAlloc( cb );
if ( PathBuf == NULL )
return( STATUS_NO_MEMORY );
wcscpy( PathBuf, REG_TSERVER_WINSTATIONS );
wcscat( PathBuf, L"\\" );
wcscat( PathBuf, pWinStation->WinStationName );
Status = RtlQueryRegistryValues( RTL_REGISTRY_CONTROL,
PathBuf,
WinStationSecurityTable,
pWinStation,
DefaultEnvironment
);
/*
* Do not let a Winstation with no security descriptor
*/
if ( ( ( Status == STATUS_OBJECT_NAME_NOT_FOUND )
|| ( pWinStation->pSecurityDescriptor == NULL) )
&& (DefaultWinStationSecurityDescriptor != NULL) )
{
//
// Free the old one if allocated
//
if ( pWinStation->pSecurityDescriptor ) {
// must break up into absolute format and self-relative
CleanUpSD(pWinStation->pSecurityDescriptor);
pWinStation->pSecurityDescriptor = NULL;
}
if(_wcsicmp( pWinStation->WinStationName, L"Console" ))
{
// RtlCopySecurityDescriptor only works with self-relative format
Status = RtlCopySecurityDescriptor(DefaultWinStationSecurityDescriptor,
&(pWinStation->pSecurityDescriptor));
}
else
{
//It is a console winstation
Status = RtlCopySecurityDescriptor(DefaultConsoleSecurityDescriptor,
&(pWinStation->pSecurityDescriptor));
}
}
TRACE0(("TERMSRV: ReadWinStationSecurityDescriptor: Status 0x%x\n",Status));
MemFree( PathBuf );
return( Status );
}
/*****************************************************************************
*
* ConfigureSecurity
*
* Processing function called by RtlQueryRegistryValues() to process the
* WINSTATION security descriptor read from the registry.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
NTSTATUS
ConfigureSecurity(
IN PWSTR ValueName,
IN ULONG ValueType,
IN PVOID ValueData,
IN ULONG ValueLength,
IN PVOID Context,
IN PVOID EntryContext
)
{
NTSTATUS Status;
PSECURITY_DESCRIPTOR * ppSD;
PWINSTATION pWinStation = (PWINSTATION)Context;
PSID pOwnerSid = NULL;
BOOLEAN bOD;
PSID pGroupSid = NULL;
BOOLEAN bGD;
PSID SystemSid;
SID_IDENTIFIER_AUTHORITY NtSidAuthority = SECURITY_NT_AUTHORITY;
/*
* Ensure value type is REG_BINARY and length of value data
* is at least the length of a minimum security descriptor
* and not unreasonably large.
*/
if ( ValueType != REG_BINARY ||
ValueLength < SECURITY_DESCRIPTOR_MIN_LENGTH ||
ValueLength > MAXUSHORT ) {
DBGPRINT(( "TERMSRV: ConfigureSecurity, ValueType=0x%x\n", ValueType ));
return( STATUS_INVALID_SECURITY_DESCR );
}
if( !IsValidSecurityDescriptor( ValueData )) {
DBGPRINT(( "TERMSRV: ConfigureSecurity, Invalid Security Descriptor in registry\n"));
return( STATUS_INVALID_SECURITY_DESCR );
}
//
// HACK needed for TS 4.0 security descriptors conversion
//
if (!NT_SUCCESS(RtlGetOwnerSecurityDescriptor( ValueData, &pOwnerSid, &bOD))
|| (pOwnerSid == NULL))
{
DBGPRINT(( "TERMSRV: ConfigureSecurity, Invalid Security Descriptor in registry: Can't get owner\n"));
return( STATUS_INVALID_SECURITY_DESCR );
}
if (!NT_SUCCESS(RtlGetGroupSecurityDescriptor( ValueData, &pGroupSid, &bGD)))
{
DBGPRINT(( "TERMSRV: ConfigureSecurity, Invalid Security Descriptor in registry: Can't get group\n"));
return( STATUS_INVALID_SECURITY_DESCR );
}
if( pWinStation ) {
/*
* WinStation specific security descriptor
*/
ppSD = &(pWinStation->pSecurityDescriptor);
}
else {
/*
* Update the global default security descriptor
*/
ppSD = &DefaultWinStationSecurityDescriptor;
}
//
// Free old one if allocated
//
if (*ppSD != NULL) {
CleanUpSD(*ppSD);
//RtlDeleteSecurityObject( ppSD );
*ppSD = NULL;
}
if (pGroupSid != NULL)
{
//
// Regular case:
// Copy the value read in registry
//
// RtlCopySecurityDescriptor only works with self-relative format
RtlCopySecurityDescriptor((PSECURITY_DESCRIPTOR)ValueData, ppSD);
}
else
{
//
// Conversion for TS 4 descriptors
//
PSECURITY_DESCRIPTOR AbsoluteSD = NULL;
if (SelfRelativeToAbsoluteSD ( (PSECURITY_DESCRIPTOR)ValueData, &AbsoluteSD, NULL))
{
// set the owner as group (both should be system sid)
Status = RtlSetGroupSecurityDescriptor(AbsoluteSD, pOwnerSid, FALSE);
if (NT_SUCCESS(Status))
{
// need also to force the mapping. Sigh !
Status = ApplyWinStaMappingToSD(AbsoluteSD);
if ((!NT_SUCCESS(Status)) || ( !AbsoluteToSelfRelativeSD (AbsoluteSD, ppSD, NULL)))
{
Status = STATUS_INVALID_SECURITY_DESCR;
}
}
// Absolute SD was only needed temporarily
CleanUpSD( AbsoluteSD );
}
else
{
Status = STATUS_INVALID_SECURITY_DESCR;
}
if (!NT_SUCCESS(Status))
{
DBGPRINT(( "TERMSRV: ConfigureSecurity, Invalid Security Descriptor in registry\n"));
return( STATUS_INVALID_SECURITY_DESCR );
}
}
return( STATUS_SUCCESS );
}
/*****************************************************************************
*
* ConfigureConsoleSecurity
*
* Processing function called by RtlQueryRegistryValues() to process the
* default console security descriptor read from the registry.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
NTSTATUS
ConfigureConsoleSecurity(
IN PWSTR ValueName,
IN ULONG ValueType,
IN PVOID ValueData,
IN ULONG ValueLength,
IN PVOID Context,
IN PVOID EntryContext
)
{
NTSTATUS Status;
PSECURITY_DESCRIPTOR * ppSD;
PSID pOwnerSid = NULL;
BOOLEAN bOD;
PSID pGroupSid = NULL;
BOOLEAN bGD;
/*
* Ensure value type is REG_BINARY and length of value data
* is at least the length of a minimum security descriptor
* and not unreasonably large.
*/
if ( ValueType != REG_BINARY ||
ValueLength < SECURITY_DESCRIPTOR_MIN_LENGTH ||
ValueLength > MAXUSHORT ) {
DBGPRINT(( "TERMSRV: ConfigureConsoleSecurity, ValueType=0x%x\n", ValueType ));
return( STATUS_INVALID_SECURITY_DESCR );
}
if( !IsValidSecurityDescriptor( ValueData )) {
DBGPRINT(( "TERMSRV: ConfigureConsoleSecurity, Invalid Security Descriptor in registry\n"));
return( STATUS_INVALID_SECURITY_DESCR );
}
//
// HACK needed for TS 4.0 security descriptors conversion
//
if (!NT_SUCCESS(RtlGetOwnerSecurityDescriptor( ValueData, &pOwnerSid, &bOD))
|| (pOwnerSid == NULL))
{
DBGPRINT(( "TERMSRV: ConfigureConsoleSecurity, Invalid Security Descriptor in registry: Can't get owner\n"));
return( STATUS_INVALID_SECURITY_DESCR );
}
if (!NT_SUCCESS(RtlGetGroupSecurityDescriptor( ValueData, &pGroupSid, &bGD))
||(pGroupSid == NULL))
{
DBGPRINT(( "TERMSRV: ConfigureConsoleSecurity, Invalid Security Descriptor in registry: Can't get group\n"));
return( STATUS_INVALID_SECURITY_DESCR );
}
/*
* Update the global default security descriptor
*/
ppSD = &DefaultConsoleSecurityDescriptor;
//
// Free old one if allocated
//
if (*ppSD != NULL) {
CleanUpSD(*ppSD);
//RtlDeleteSecurityObject( ppSD );
*ppSD = NULL;
}
//
// Regular case:
// Copy the value read in registry
//
// RtlCopySecurityDescriptor only works with self-relative format
RtlCopySecurityDescriptor((PSECURITY_DESCRIPTOR)ValueData, ppSD);
return( STATUS_SUCCESS );
}
/*****************************************************************************
*
* WinStationGetSecurityDescriptor
*
* Return a pointer to the security descriptor that should be enforced
* on this winstation. This could be a specific, or a global
* default security descriptor.
*
* ENTRY: pWinStation the aimed winstation
*
* EXIT: the SD of this winstation,
* or the default SD if this winstation hs no SD (it should not happen !)
*
****************************************************************************/
PSECURITY_DESCRIPTOR
WinStationGetSecurityDescriptor(
PWINSTATION pWinStation
)
{
PSECURITY_DESCRIPTOR SecurityDescriptor;
SecurityDescriptor = pWinStation->pSecurityDescriptor ?
pWinStation->pSecurityDescriptor :
DefaultWinStationSecurityDescriptor;
return( SecurityDescriptor );
}
/*****************************************************************************
*
* WinStationFreeSecurityDescriptor
*
* Release the winstation security descriptor.
*
* If its the global default, it is not free'd.
*
* ENTRY: the winstation
*
* EXIT: nothing
*
****************************************************************************/
VOID
WinStationFreeSecurityDescriptor(
PWINSTATION pWinStation
)
{
// console disconnect
if ( pWinStation->pSecurityDescriptor == DefaultWinStationSecurityDescriptor && pWinStation->LogonId != 0) {
pWinStation->pSecurityDescriptor = NULL;
}
// Catch callers mis-managing the security descriptor
ASSERT( pWinStation->pSecurityDescriptor != DefaultWinStationSecurityDescriptor );
if (pWinStation->pSecurityDescriptor) {
//RtlDeleteSecurityObject( &(pWinStation->pSecurityDescriptor) );
CleanUpSD(pWinStation->pSecurityDescriptor);
pWinStation->pSecurityDescriptor = NULL;
}
return;
}
/*****************************************************************************
*
* WinStationInheritSecurityDescriptor
*
* Copy the security descriptor to the target WinStation and set it
* on the kernel object.
*
* ENTRY:
* pSecurityDescriptor (input)
* pointer to SD to be inherited
* pTargetWinStation (input)
* pointer to WinStation to inherit the SD
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
NTSTATUS
WinStationInheritSecurityDescriptor(
PVOID pSecurityDescriptor,
PWINSTATION pTargetWinStation
)
{
NTSTATUS Status;
//
// If the listen WinStation has a security descriptor, this means
// that all WinStations of this protocol (TD) type will inherit
// the security descriptor set by WinCfg.
//
if ( pSecurityDescriptor ) {
ASSERT( IsValidSecurityDescriptor( pSecurityDescriptor ) );
if ( pTargetWinStation->pSecurityDescriptor ) {
//RtlDeleteSecurityObject( &(pTargetWinStation->pSecurityDescriptor) );
CleanUpSD(pTargetWinStation->pSecurityDescriptor);
pTargetWinStation->pSecurityDescriptor = NULL;
}
// RtlCopySecurityDescriptor only works with self-relative format
Status = RtlCopySecurityDescriptor(pSecurityDescriptor,
&(pTargetWinStation->pSecurityDescriptor) );
return (Status);
}
//
// If no specific security descriptor on the listen WinStation,
// the default was set on the object when it was created for the pool.
//
return( STATUS_SUCCESS );
}
/*****************************************************************************
*
* RpcCheckClientAccess
*
* Verify whether client has the desired access to a WinStation.
*
* NOTE: This is called under an RPC context.
*
* ENTRY:
* pWinStation (input)
* Pointer to WinStation to query access to
*
* DesiredAccess (input)
* Access mask of desired client access
*
* AlreadyImpersonating (input)
* BOOLEAN that specifies caller is already impersonating client
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
NTSTATUS
RpcCheckClientAccess(
PWINSTATION pWinStation,
ACCESS_MASK DesiredAccess,
BOOLEAN AlreadyImpersonating
)
{
NTSTATUS Status;
RPC_STATUS RpcStatus;
BOOL bAccessCheckOk = FALSE;
DWORD GrantedAccess;
BOOL AccessStatus;
BOOL fGenerateOnClose;
/*
* Impersonate the client
*/
if ( !AlreadyImpersonating ) {
RpcStatus = RpcImpersonateClient( NULL );
if ( RpcStatus != RPC_S_OK ) {
DBGPRINT(("TERMSRV: CheckClientAccess: Not impersonating! RpcStatus 0x%x\n",RpcStatus));
return( STATUS_CANNOT_IMPERSONATE );
}
}
bAccessCheckOk = AccessCheckAndAuditAlarm(szTermsrv,
NULL,
(LPWSTR)szTermsrvSession,
(LPWSTR)szTermsrvSession,
WinStationGetSecurityDescriptor(pWinStation),
DesiredAccess,
&WinStaMapping,
FALSE,
&GrantedAccess,
&AccessStatus,
&fGenerateOnClose);
if ( !AlreadyImpersonating ) {
RpcRevertToSelf();
}
if (bAccessCheckOk)
{
if (AccessStatus == FALSE)
{
Status = NtCurrentTeb()->LastStatusValue;
TRACE((hTrace,TC_ICASRV,TT_ERROR, "TERMSRV: RpcCheckClientAccess, AccessCheckAndAuditAlarm(%u) returned error 0x%x\n",
pWinStation->LogonId, Status ));
}
else
{
TRACE((hTrace,TC_ICASRV,TT_API3, "TERMSRV: RpcCheckClientAccess, AccessCheckAndAuditAlarm(%u) returned no error \n",
pWinStation->LogonId));
Status = STATUS_SUCCESS;
}
}
else
{
Status = NtCurrentTeb()->LastStatusValue;
TRACE((hTrace,TC_ICASRV,TT_ERROR, "TERMSRV: RpcCheckClientAccess, AccessCheckAndAuditAlarm(%u) failed 0x%x\n",
pWinStation->LogonId, Status ));
}
return (Status);
}
/*****************************************************************************
*
* _CheckConnectAccess
*
* Check for connect access to the WINSTATION.
*
* This is called under RPC context.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
_CheckConnectAccess(
PWINSTATION pSourceWinStation,
PSID pClientSid,
ULONG ClientLogonId,
PWCHAR pPassword,
DWORD PasswordSize
)
{
NTSTATUS Status;
BOOLEAN fWrongPassword;
UNICODE_STRING PasswordString;
/*
* First check that the current RPC caller has WINSTATION_CONNECT access
* to the target WINSTATIONS object. This is controlled by either the
* default, or per WINSTATION ACL setup from the registry.
*/
Status = RpcCheckClientAccess( pSourceWinStation, WINSTATION_CONNECT, FALSE );
if ( !NT_SUCCESS( Status ) ) {
/*
* clear the password parameter to prevent it being paged cleartext
*/
RtlZeroMemory( pPassword, wcslen(pPassword) * sizeof(WCHAR) );
return( Status );
}
//
// C2 WARNING - WARNING - WARNING
//
// Comments by JohnR 01/21/97 - The design of this feature was redone.
//
// There was legacy code which has WinLogon store the users password
// scrambled in the PWINSTATION structure for all users to support
// the feature in which a user logged on as account User1 may type the
// "connect <winstation>" command, in which the disconnected winstation
// logged in as account User2 may be connected to, if the proper account
// password is supplied from the command line. The password verification
// was a simple string compare between the winstations stored password,
// and the password supplied by the caller.
//
// The problems with this are many:
//
// - LSA should do all authentication. The password may have
// been changed, or the account disabled. Also all authentication
// code must be in a centralized location.
//
// - The Logon Hours may have expired on the account. Another violation
// of policy.
//
// - No auditing is performed on failure, in violation of
// security policy.
//
// - The users password, though scrambled, is passed around the
// system in code not explicitly designed to handle user authentication.
// This code is not known, or registered with LSA as an authentication
// provider. Network redirectors, WinLogon, etc. do this registration.
//
//
// FIX that was be done:
//
// The users password is no longer set in the PWINSTATION
// by WinLogon. When a user wants to do a "connect <winstation>",
// the account name and password of the winstation to connect to
// is passed to LSA as a normal authentication. This means that
// ICASRV.EXE is properly registered as a logon provider. If the
// account and password is valid, a token is returned. This token
// can then be closed, and the user connected to the winstation.
// If failure, return the access denied error. The benefits are:
//
// - LSA authentication
// - ICASRV registration as a logon provider
// - Auditing
// - Password change, account disable handling
// - Logon hours enforcement
// - Password no longer passed around the system
//
//
// C2 WARNING
//
// Even with this routine using LSA, the WinFrame connect.exe command
// could be trojan horsed. It is not in the trusted path. At least it is
// a system utility that users should not allow writing to. Though a user
// has to watch their %PATH%. A better design would be for the connect
// commands function to be part of the WinLogon's GINA screen like our
// current Disconnect... option. This will keep the password gathering
// in the trusted path. But this is no worse than "net.exe", WinFile, etc.,
// or anything else that asks for a network resource password.
//
// C2 WARNING - WARNING - WARNING
//
/*
* If different username/domain check the password by calling LogonUser()
*/
// SALIMC CHANGE
if ( pSourceWinStation->pUserSid && !RtlEqualSid( pClientSid, pSourceWinStation->pUserSid ) &&
!RtlEqualSid( pClientSid, gSystemSid ) ) {
HANDLE hToken;
BOOL Result;
Result = LogonUser(
pSourceWinStation->UserName,
pSourceWinStation->Domain,
pPassword,
LOGON32_LOGON_INTERACTIVE, // Logon Type
LOGON32_PROVIDER_DEFAULT, // Logon Provider
&hToken // Token that represents the account
);
/*
* clear the password parameter to prevent it being paged cleartext
*/
RtlZeroMemory( pPassword, wcslen(pPassword) * sizeof(WCHAR) );
/*
* check for account restriction which indicates a blank password
* on the account that is correct though - allow this thru on console
*/
if( !Result && (PasswordSize == sizeof(WCHAR)) && (GetLastError() == ERROR_ACCOUNT_RESTRICTION) && (USER_SHARED_DATA->ActiveConsoleId == ClientLogonId)) {
return( STATUS_SUCCESS );
}
if( !Result) {
DBGPRINT(("TERMSRV: _CheckConnectAccess: User Account %ws\\%ws not valid %d\n",pSourceWinStation->Domain,pSourceWinStation->UserName,GetLastError()));
return( STATUS_LOGON_FAILURE );
}
/*
* Close the token handle since we only needed to determine
* if the account and password is still valid.
*/
CloseHandle( hToken );
return( STATUS_SUCCESS );
}
else {
return( STATUS_SUCCESS );
}
// NOTREACHED
}
/*****************************************************************************
*
* RpcCheckSystemClient
*
* Inquire in the current RPC call context whether we were
* called by a local SYSTEM mode caller.
*
* WinStation API's that are only to be called by the WinLogon
* process call this function.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
NTSTATUS
RpcCheckSystemClient(
ULONG TargetLogonId
)
{
NTSTATUS Status;
PWINSTATION pWinStation;
pWinStation = FindWinStationById( TargetLogonId, FALSE );
if ( pWinStation == NULL ) {
return( STATUS_CTX_WINSTATION_NOT_FOUND );
}
Status = RpcCheckSystemClientEx( pWinStation );
ReleaseWinStation( pWinStation );
return( Status );
}
/*****************************************************************************
*
* RpcCheckSystemClientEx
*
* Inquire in the current RPC call context whether we were
* called by a local SYSTEM mode caller.
*
* WinStation API's that are only to be called by the WinLogon
* process call this function.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
NTSTATUS
RpcCheckSystemClientEx(
PWINSTATION pWinStation
)
{
ULONG ClientLogonId;
RPC_STATUS RpcStatus;
NTSTATUS Status = STATUS_SUCCESS;
Status = RpcCheckSystemClientNoLogonId( pWinStation );
if( !NT_SUCCESS(Status) ) {
return( Status);
}
/*
* Impersonate the client
*/
RpcStatus = RpcImpersonateClient( NULL );
if( RpcStatus != RPC_S_OK ) {
TRACE0(("TERMSRV: RpcCheckSystemClient: Not impersonating! RpcStatus 0x%x\n",RpcStatus));
return( STATUS_CANNOT_IMPERSONATE );
}
/*
* Check that the LogonId of the client is the same
* as the LogonId of the WINSTATION being targeted.
*/
Status = RpcGetClientLogonId( &ClientLogonId );
if( !NT_SUCCESS(Status) ) {
TRACE0(("TERMSRV: RpcCheckSystemClient: Could not get clients LogonId 0x%x\n",Status));
RpcRevertToSelf();
return( STATUS_ACCESS_DENIED );
}
if( ClientLogonId != pWinStation->LogonId ) {
TRACE0(("TERMSRV: RpcCheckSystemClient: Caller LogonId %d does not match target %d\n",ClientLogonId,pWinStation->LogonId));
RpcRevertToSelf();
return( STATUS_ACCESS_DENIED );
}
RpcRevertToSelf();
return( STATUS_SUCCESS );
}
/*****************************************************************************
*
* RpcCheckSystemClientNoLogonId
*
* Inquire in the current RPC call context whether we were
* called by a local SYSTEM mode caller.
*
* WinStation API's that are only to be called by the WinLogon
* process call this function.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
NTSTATUS
RpcCheckSystemClientNoLogonId(
PWINSTATION pWinStation
)
{
UINT LocalFlag;
RPC_STATUS RpcStatus;
RPC_AUTHZ_HANDLE Privs;
PWCHAR pServerPrincName;
ULONG AuthnLevel, AuthnSvc, AuthzSvc;
NTSTATUS Status = STATUS_SUCCESS;
/*
* The following checking is to keep from screwing up
* the state due to attempts to invoke this local
* only API remotely, across LogonId's, or from an application.
*/
/*
* Impersonate the client
*/
RpcStatus = RpcImpersonateClient( NULL );
if( RpcStatus != RPC_S_OK ) {
TRACE0(("TERMSRV: RpcCheckSystemClient: Not impersonating! RpcStatus 0x%x\n",RpcStatus));
return( STATUS_CANNOT_IMPERSONATE );
}
/*
* Inquire if local RPC call
*/
RpcStatus = I_RpcBindingIsClientLocal(
0, // Active RPC call we are servicing
&LocalFlag
);
if( RpcStatus != RPC_S_OK ) {
TRACE0(("TERMSRV: RpcCheckSystemClient: Could not query local client RpcStatus 0x%x\n",RpcStatus));
RpcRevertToSelf();
return( STATUS_ACCESS_DENIED );
}
if( !LocalFlag ) {
TRACE0(("TERMSRV: RpcCheckSystemClient: Not a local client call\n"));
RpcRevertToSelf();
return( STATUS_ACCESS_DENIED );
}
#ifdef notdef
// This is not working in 4.0. Its not returning
// the principle name on the LPC transport.
// So we resort to looking into the thread token.
/*
* Get the principle name, and see if its the built in LSA
* local account "SYSTEM".
*/
RpcStatus = RpcBindingInqAuthClientW(
0, // Active RPC call we are servicing
&Privs,
&pServerPrincName,
&AuthnLevel,
&AuthnSvc,
&AuthzSvc
);
if( RpcStatus != RPC_S_OK ) {
DBGPRINT(("TERMSRV: RpcCheckSystemClient RpcAuthorizaton query failed! RpcStatus 0x%x\n",RpcStatus));
RpcRevertToSelf();
return( STATUS_ACCESS_DENIED );
}
TRACE0(("TERMSRV: AuthnLevel %d, AuthnSvc %d, AuthzSvc %d pServerPrincName 0x%x, Privs 0x%x\n",AuthnLevel,AuthnSvc,AuthzSvc,pServerPrincName,Privs));
if( AuthnSvc != RPC_C_AUTHN_WINNT ) {
DBGPRINT(("TERMSRV: RpcCheckSystemClient RpcAuthorizaton Type not NT! 0x%x\n",AuthnSvc));
RpcRevertToSelf();
Status = STATUS_ACCESS_DENIED;
}
if( pServerPrincName ) {
TRACE0(("TERMSRV: RpcCheckSystemClient: Principle Name :%ws:\n",pServerPrincName));
// Compare with "SYSTEM"
if( wcsicmp( L"SYSTEM", pServerPrincName ) ) {
DBGPRINT(("TERMSRV: RpcCheckSystemClient: Principle Name :%ws: not SYSTEM\n",pServerPrincName));
Status = STATUS_ACCESS_DENIED;
}
RpcStringFreeW( &pServerPrincName );
}
#else
/*
* Validate that the thread token is SYSTEM
*/
if( !IsCallerSystem() ) {
Status = STATUS_ACCESS_DENIED;
}
#endif
RpcRevertToSelf();
return( Status );
}
/*****************************************************************************
*
* RpcCheckClientAccessLocal
*
* Inquire in the current RPC call context whether we were
* called by a local caller.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
NTSTATUS
RpcCheckClientAccessLocal(
PWINSTATION pWinStation,
ACCESS_MASK DesiredAccess,
BOOLEAN AlreadyImpersonating
)
{
UINT LocalFlag;
RPC_STATUS RpcStatus;
RPC_AUTHZ_HANDLE Privs;
PWCHAR pServerPrincName;
ULONG AuthnLevel, AuthnSvc, AuthzSvc;
NTSTATUS Status;
/*
* Impersonate the client, if not already
*/
if ( !AlreadyImpersonating ) {
RpcStatus = RpcImpersonateClient( NULL );
if ( RpcStatus != RPC_S_OK ) {
DBGPRINT(("TERMSRV: RpcCheckClientAccessLocal: Not impersonating! RpcStatus 0x%x\n",RpcStatus));
return( STATUS_CANNOT_IMPERSONATE );
}
}
/*
* Check for desired access. This will generate an access audit if on.
*/
Status = RpcCheckClientAccess( pWinStation, DesiredAccess, TRUE );
if ( !NT_SUCCESS( Status ) ) {
if ( !AlreadyImpersonating ) {
RpcRevertToSelf();
}
return( Status );
}
/*
* We have now checked security on the WINSTATION, the
* rest of the checking is to keep from screwing up
* the state due to attempts to invoke this local
* only API remotely.
*/
/*
* Inquire if local RPC call
*/
RpcStatus = I_RpcBindingIsClientLocal(
0, // Active RPC call we are servicing
&LocalFlag
);
if ( !AlreadyImpersonating ) {
RpcRevertToSelf();
}
if ( RpcStatus != RPC_S_OK ) {
DBGPRINT(("TERMSRV: RpcCheckClientAccessLocal: Could not query local client RpcStatus 0x%x\n",RpcStatus));
return( STATUS_ACCESS_DENIED );
}
if ( !LocalFlag ) {
DBGPRINT(("TERMSRV: RpcCheckClientAccessLocal: Not a local client call\n"));
return( STATUS_ACCESS_DENIED );
}
return( STATUS_SUCCESS );
}
/*******************************************************************************
*
* AddUserAce
*
* Add an ACE for the currently logged on user to the WinStation object.
*
* ENTRY:
* pWinStation (input)
* Pointer to WinStation to update
*
* EXIT:
* nothing
*
******************************************************************************/
NTSTATUS
AddUserAce( PWINSTATION pWinStation )
{
PACL Dacl = NULL;
BOOLEAN DaclPresent, DaclDefaulted;
ACL_SIZE_INFORMATION AclInfo;
ULONG Length;
NTSTATUS Status;
/*
* Get a pointer to the DACL from the security descriptor.
*/
Status = RtlGetDaclSecurityDescriptor( pWinStation->pSecurityDescriptor, &DaclPresent,
&Dacl, &DaclDefaulted );
if ( !NT_SUCCESS( Status ) || !DaclPresent || !Dacl ) {
return( Status );
}
Status = RtlAddAccessAllowedAce( Dacl, ACL_REVISION,
(WINSTATION_ALL_ACCESS) & ~(STANDARD_RIGHTS_ALL),
pWinStation->pUserSid );
if ( (Status == STATUS_ALLOTTED_SPACE_EXCEEDED) || (Status == STATUS_REVISION_MISMATCH) )
{
//
// We need to copy the security data into a new descriptor
//
Status = RtlQueryInformationAcl( Dacl, &AclInfo, sizeof(AclInfo),
AclSizeInformation );
if ( NT_SUCCESS( Status ) )
{
ULONG AceCount;
PRTL_ACE_DATA pAceData;
PACE_HEADER pAce;
ULONG i;
PSECURITY_DESCRIPTOR pSD;
PSID Owner, Group;
PSID * pSidList;
BOOLEAN OwnerDefaulted, GroupDefaulted;
AceCount = AclInfo.AceCount;
AceCount++;
//
// allocate a RTL_ACE_DATA structure and a list of pPSIDs
//
Length = AceCount * sizeof(RTL_ACE_DATA);
pAceData = MemAlloc(Length);
if (!pAceData)
{
return (STATUS_NO_MEMORY);
}
Length = AceCount * sizeof(PSID *);
pSidList = MemAlloc(Length);
if (!pSidList)
{
MemFree(pAceData);
return (STATUS_NO_MEMORY);
}
for ( i = 0; i < AclInfo.AceCount; i++ )
{
Status = RtlGetAce( Dacl, i, &pAce );
ASSERT( NT_SUCCESS( Status ) );
if (!NT_SUCCESS( Status ))
{
MemFree(pAceData);
MemFree(pSidList);
return STATUS_INVALID_SECURITY_DESCR;
}
pAceData[i].AceType = pAce->AceType;
pAceData[i].InheritFlags = 0;
pAceData[i].AceFlags = 0;
switch (pAce->AceType)
{
case ACCESS_ALLOWED_ACE_TYPE:
pAceData[i].Mask = ((PACCESS_ALLOWED_ACE)pAce)->Mask;
pSidList[i] = (PSID)(&(((PACCESS_ALLOWED_ACE)pAce)->SidStart));
break;
case ACCESS_DENIED_ACE_TYPE:
pAceData[i].Mask = ((PACCESS_DENIED_ACE)pAce)->Mask;
pSidList[i] = (PSID)(&(((PACCESS_DENIED_ACE)pAce)->SidStart));
pAceData[i].Sid = (PSID *)(&(pSidList[i]));
break;
default: // we do not expect anything else
MemFree(pAceData);
MemFree(pSidList);
return STATUS_INVALID_SECURITY_DESCR;
}
pAceData[i].Sid = (PSID *)(&(pSidList[i]));
}
//
// add the new ACE
//
pAceData[i].AceType = ACCESS_ALLOWED_ACE_TYPE;
pAceData[i].InheritFlags = 0;
pAceData[i].AceFlags = 0;
pAceData[i].Mask = (WINSTATION_ALL_ACCESS) & ~(STANDARD_RIGHTS_ALL);
pAceData[i].Sid = &(pWinStation->pUserSid);
//
// get the owner and the group
//
Status = RtlGetOwnerSecurityDescriptor(pWinStation->pSecurityDescriptor,
&Owner,
&OwnerDefaulted);
Status = RtlGetOwnerSecurityDescriptor(pWinStation->pSecurityDescriptor,
&Group,
&GroupDefaulted);
//
// save the old security descriptor
//
pSD = pWinStation->pSecurityDescriptor;
//
// create the new security descriptor
//
Status = RtlCreateUserSecurityObject(pAceData,
AceCount,
Owner,
Group,
FALSE,
&WinStaMapping,
&(pWinStation->pSecurityDescriptor) );
//
// delete the old security descriptor
//
//RtlDeleteSecurityObject( &pSD );
// must break up into absolute format and self-relative
if (pSD) {
CleanUpSD(pSD);
}
//
// free the RTL_ACE_DATA
//
MemFree(pAceData);
MemFree(pSidList);
}
}
return( Status );
}
/*******************************************************************************
*
* RemoveUserAce
*
* Remove the ACE for the currently logged on user from the WinStation object.
*
* ENTRY:
* pWinStation (input)
* Pointer to WinStation to update
*
* EXIT:
* nothing
*
******************************************************************************/
NTSTATUS
RemoveUserAce( PWINSTATION pWinStation )
{
SECURITY_INFORMATION SecInfo = DACL_SECURITY_INFORMATION;
PACL Dacl;
BOOLEAN DaclPresent, DaclDefaulted;
ACL_SIZE_INFORMATION AclInfo;
PACE_HEADER Ace;
ULONG i, Length;
NTSTATUS Status;
/*
* This is probably the console if ICASRV wasn't started soon enough
*
*/
if ( !pWinStation->pUserSid ) {
Status = STATUS_CTX_WINSTATION_NOT_FOUND;
}
else
{
Status = RtlGetDaclSecurityDescriptor( pWinStation->pSecurityDescriptor, &DaclPresent,
&Dacl, &DaclDefaulted );
if ( !NT_SUCCESS( Status ) || !DaclPresent || !Dacl ) {
return( Status );
}
Status = RtlQueryInformationAcl( Dacl, &AclInfo, sizeof(AclInfo),
AclSizeInformation );
if ( !NT_SUCCESS( Status ) ) {
return( Status );
}
/*
* Scan the DACL looking for the ACE that contains the UserSid (it should
* be first), delete the ACE, and set the new security for the WinStation.
*/
for ( i = 0; i < AclInfo.AceCount; i++ ) {
RtlGetAce( Dacl, i, &Ace );
if ( RtlEqualSid( pWinStation->pUserSid,
&((PACCESS_ALLOWED_ACE)Ace)->SidStart ) ) {
RtlDeleteAce( Dacl, i );
break;
}
}
}
return( Status );
}
/*******************************************************************************
*
* ApplyWinStaMappingToSD
*
* Apply the generic mapping on the security descriptor.
*
* ENTRY:
* pSecurityDescriptor
* Pointer to security descriptor to update
*
* EXIT:
* nothing
*
******************************************************************************/
NTSTATUS
ApplyWinStaMappingToSD( PSECURITY_DESCRIPTOR pSecurityDescriptor )
{
PACL Dacl;
BOOLEAN DaclPresent, DaclDefaulted;
ACL_SIZE_INFORMATION AclInfo;
PACE_HEADER Ace;
ULONG i;
NTSTATUS Status;
Status = RtlGetDaclSecurityDescriptor( pSecurityDescriptor, &DaclPresent,
&Dacl, &DaclDefaulted );
if ( !NT_SUCCESS( Status ) || !DaclPresent || !Dacl ) {
return( Status );
}
Status = RtlQueryInformationAcl( Dacl, &AclInfo, sizeof(AclInfo),
AclSizeInformation );
if ( !NT_SUCCESS( Status ) ) {
return( Status );
}
/*
* Scan the DACL applying the generic mapping to each ACE
*/
for ( i = 0; i < AclInfo.AceCount; i++ ) {
RtlGetAce( Dacl, i, &Ace );
RtlApplyAceToObject( Ace, &WinStaMapping );
}
return( Status );
}
/*******************************************************************************
*
* ApplyWinStaMapping
*
* Apply the generic mapping on the security descriptor of the WinStation object.
*
* ENTRY:
* pWinStation (input)
* Pointer to WinStation to update
*
* EXIT:
* nothing
*
******************************************************************************/
NTSTATUS
ApplyWinStaMapping( PWINSTATION pWinStation )
{
return (ApplyWinStaMappingToSD(pWinStation->pSecurityDescriptor));
}
/*****************************************************************************
*
* BuildEveryOneAllowSD
*
* Build and return an EveryOne (WORLD) allow Security descriptor.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
PSECURITY_DESCRIPTOR
BuildEveryOneAllowSD()
{
BOOL rc;
DWORD Error;
DWORD AclSize;
PACL pAcl = NULL;
PACCESS_ALLOWED_ACE pAce = NULL;
PSECURITY_DESCRIPTOR pSd = NULL;
PSID SeWorldSid = NULL;
SID_IDENTIFIER_AUTHORITY WorldSidAuthority = SECURITY_WORLD_SID_AUTHORITY;
pSd = LocalAlloc(LMEM_FIXED, sizeof(SECURITY_DESCRIPTOR) );
if( pSd == NULL ) {
return( NULL );
}
rc = InitializeSecurityDescriptor( pSd, SECURITY_DESCRIPTOR_REVISION );
if( !rc ) {
TRACE((hTrace,TC_ICASRV,TT_ERROR,"Error initing security descriptor %d\n",GetLastError()));
LocalFree( pSd );
return( NULL );
}
SeWorldSid = (PSID)LocalAlloc(LMEM_FIXED, RtlLengthRequiredSid(1) );
if( SeWorldSid == NULL ) {
LocalFree( pSd );
return( NULL );
}
RtlInitializeSid( SeWorldSid, &WorldSidAuthority, 1 );
*(RtlSubAuthoritySid( SeWorldSid, 0 )) = SECURITY_WORLD_RID;
/*
* Calculate the ACL size
*/
AclSize = sizeof(ACL);
AclSize += sizeof(ACCESS_ALLOWED_ACE);
AclSize += (GetLengthSid( SeWorldSid ) - sizeof(DWORD));
pAcl = LocalAlloc( LMEM_FIXED, AclSize );
if( pAcl == NULL ) {
TRACE((hTrace,TC_ICASRV,TT_ERROR,"Could not allocate memory\n"));
LocalFree( SeWorldSid );
LocalFree( pSd );
return( NULL );
}
rc = InitializeAcl(
pAcl,
AclSize,
ACL_REVISION
);
if( !rc ) {
TRACE((hTrace,TC_ICASRV,TT_ERROR,"Error %d InitializeAcl\n",GetLastError()));
LocalFree( pAcl );
LocalFree( SeWorldSid );
LocalFree( pSd );
return( NULL );
}
/*
* Add the access allowed ACE
*/
rc = AddAccessAllowedAce(
pAcl,
ACL_REVISION,
FILE_ALL_ACCESS,
SeWorldSid
);
if( !rc ) {
Error = GetLastError();
TRACE((hTrace,TC_ICASRV,TT_ERROR,"***ERROR*** adding allow ACE %d for SeWorldSid\n",Error));
LocalFree( pAcl );
LocalFree( SeWorldSid );
LocalFree( pSd );
return( NULL );
}
rc = SetSecurityDescriptorDacl(
pSd,
TRUE,
pAcl,
FALSE
);
if( !rc ) {
TRACE((hTrace,TC_ICASRV,TT_ERROR,"Error %d SetSecurityDescriptorDacl\n",GetLastError()));
LocalFree( pAcl );
LocalFree( SeWorldSid );
LocalFree( pSd );
return( NULL );
}
// These are contained in the SD
// LocalFree( pAcl );
// LocalFree( SeWorldSid );
// Caller can free SD
return( pSd );
}
/*****************************************************************************
*
* CreateWinStationDefaultSecurityDescriptor
*
* Create the default security descriptor for WinStation for
* when we do not find one in the registry.
*
* ENTRY: nothing
*
* EXIT: a self-relative SD, or NULL
*
****************************************************************************/
PSECURITY_DESCRIPTOR
CreateWinStationDefaultSecurityDescriptor()
{
PSECURITY_DESCRIPTOR SecurityDescriptor;
#define DEFAULT_ACE_COUNT 2
RTL_ACE_DATA AceData[DEFAULT_ACE_COUNT] =
{
{ ACCESS_ALLOWED_ACE_TYPE, 0, 0, WINSTATION_ALL_ACCESS, &gSystemSid },
{ ACCESS_ALLOWED_ACE_TYPE, 0, 0, WINSTATION_ALL_ACCESS, &gAdminSid }
};
SecurityDescriptor = NULL;
RtlCreateUserSecurityObject(AceData, DEFAULT_ACE_COUNT, gSystemSid,
gSystemSid, FALSE, &WinStaMapping, &SecurityDescriptor);
return( SecurityDescriptor );
}
/*****************************************************************************
*
* BuildSystemOnlySecurityDescriptor
*
* Create a security descriptor for system access only.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
PSECURITY_DESCRIPTOR
BuildSystemOnlySecurityDescriptor()
{
PACL Dacl;
ULONG Length;
NTSTATUS Status;
PSECURITY_DESCRIPTOR SecurityDescriptor;
SID_IDENTIFIER_AUTHORITY NtSidAuthority = SECURITY_NT_AUTHORITY;
Length = SECURITY_DESCRIPTOR_MIN_LENGTH +
(ULONG)sizeof(ACL) +
(ULONG)sizeof(ACCESS_ALLOWED_ACE) +
RtlLengthSid( gSystemSid );
SecurityDescriptor = MemAlloc(Length);
if (SecurityDescriptor == NULL) {
goto bsosderror;
}
Dacl = (PACL)((PCHAR)SecurityDescriptor + SECURITY_DESCRIPTOR_MIN_LENGTH);
Status = RtlCreateSecurityDescriptor(SecurityDescriptor,
SECURITY_DESCRIPTOR_REVISION);
if (Status != STATUS_SUCCESS) {
goto bsosderror;
}
Status = RtlCreateAcl( Dacl, Length - SECURITY_DESCRIPTOR_MIN_LENGTH,
ACL_REVISION2);
if (Status != STATUS_SUCCESS) {
goto bsosderror;
}
Status = RtlAddAccessAllowedAce (
Dacl,
ACL_REVISION2,
PORT_ALL_ACCESS,
gSystemSid
);
if (Status != STATUS_SUCCESS) {
goto bsosderror;
}
Status = RtlSetDaclSecurityDescriptor (
SecurityDescriptor,
TRUE,
Dacl,
FALSE
);
if (Status != STATUS_SUCCESS) {
goto bsosderror;
}
return( SecurityDescriptor );
bsosderror:
if (SecurityDescriptor) {
MemFree(SecurityDescriptor);
}
return(NULL);
}
/*****************************************************************************
*
* RpcGetClientLogonId
*
* Get the logonid from the client who we should be impersonating.
*
* ENTRY:
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
NTSTATUS
RpcGetClientLogonId(
PULONG pLogonId
)
{
BOOL Result;
HANDLE TokenHandle;
ULONG LogonId, ReturnLength;
NTSTATUS Status = STATUS_SUCCESS;
//
// We should be impersonating the client, so we will get the
// LogonId from out token.
//
Result = OpenThreadToken(
GetCurrentThread(),
TOKEN_QUERY,
FALSE, // Use impersonation
&TokenHandle
);
if( Result ) {
//
// Use the CITRIX extension to GetTokenInformation to
// return the LogonId from the token.
//
// This identifies which WinStation is making this request.
//
Result = GetTokenInformation(
TokenHandle,
(TOKEN_INFORMATION_CLASS)TokenSessionId,
&LogonId,
sizeof(LogonId),
&ReturnLength
);
if( Result ) {
#if DBG
if( ReturnLength != sizeof(LogonId) ) {
DbgPrint("TERMSRV: RpcGetClientLogonId GetTokenInformation: ReturnLength %d != sizeof(LogonId)\n", ReturnLength );
}
#endif
*pLogonId = LogonId;
}
else {
DBGPRINT(("TERMSRV: Error getting token LogonId information %d\n", GetLastError()));
Status = STATUS_NO_IMPERSONATION_TOKEN;
}
CloseHandle( TokenHandle );
}
else {
TRACE0(("SYSLIB: Error opening token %d\n", GetLastError()));
Status = STATUS_NO_IMPERSONATION_TOKEN;
}
return( Status );
}
/*****************************************************************************
*
* IsServiceLoggedAsSystem
*
* Returns whether the termsrv process is running under SYSTEM
* security.
*
* ENTRY:
* None
* Comments
*
* EXIT:
* TRUE if running under system account. FALSE otherwise
*
****************************************************************************/
BOOL
IsServiceLoggedAsSystem( VOID )
{
BOOL Result;
HANDLE TokenHandle;
//
// Open the process token and check if System token.
//
Result = OpenProcessToken(
GetCurrentProcess(),
TOKEN_QUERY,
&TokenHandle
);
if (!Result) {
DBGPRINT(("TERMSRV: IsServiceLoggedAsSystem : Could not open process token %d\n",GetLastError()));
return( FALSE );
}
Result = IsSystemToken(TokenHandle);
return Result;
}
/*****************************************************************************
*
* IsCallerSystem
*
* Returns whether the current thread is running under SYSTEM
* security.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
BOOL
IsCallerSystem( VOID )
{
BOOL Result;
HANDLE TokenHandle;
//
// Open the thread token and check if System token.
//
Result = OpenThreadToken(
GetCurrentThread(),
TOKEN_QUERY,
FALSE, // Use impersonation
&TokenHandle
);
if( !Result ) {
TRACE0(("TERMSRV: IsCallerSystem: Could not open thread token %d\n",GetLastError()));
return( FALSE );
}
Result = IsSystemToken(TokenHandle);
return Result;
}
/*****************************************************************************
*
* IsSystemToken
*
* Returns whether the current token is running under SYSTEM
* security.
*
* ENTRY:
* Param1 Thread or process token
* Comments
*
* EXIT:
* TRUE if System token. FALSE otherwise.
*
****************************************************************************/
BOOL
IsSystemToken( HANDLE TokenHandle )
{
BOOL Result;
ULONG ReturnLength, BufferLength;
NTSTATUS Status;
PTOKEN_USER pTokenUser = NULL;
//Get primary account SID from token and test if local system SID.
if (gSystemSid == NULL) {
return FALSE;
}
ReturnLength = 0;
Result = GetTokenInformation(
TokenHandle,
TokenUser,
NULL,
0,
&ReturnLength
);
if( ReturnLength == 0 ) {
TRACE0(("TERMSRV: IsCallerSystem: Error %d Getting TokenInformation\n",GetLastError()));
CloseHandle( TokenHandle );
return( FALSE );
}
BufferLength = ReturnLength;
pTokenUser = MemAlloc( BufferLength );
if( pTokenUser == NULL ) {
TRACE0(("TERMSRV: IsCallerSystem: Error allocating %d bytes memory\n",BufferLength));
CloseHandle( TokenHandle );
return( FALSE );
}
Result = GetTokenInformation(
TokenHandle,
TokenUser,
pTokenUser,
BufferLength,
&ReturnLength
);
CloseHandle( TokenHandle );
if( !Result ) {
TRACE0(("TERMSRV: IsCallerSystem: Error %d Getting TokenInformation on buffer\n",GetLastError()));
MemFree( pTokenUser );
return( FALSE );
}
if( RtlEqualSid( pTokenUser->User.Sid, gSystemSid) ) {
MemFree( pTokenUser );
return( TRUE );
}
else {
#if DBGTRACE
BOOL OK;
DWORD cDomain;
DWORD cUserName;
WCHAR Domain[256];
WCHAR UserName[256];
SID_NAME_USE UserSidType;
cUserName = sizeof(UserName)/sizeof(WCHAR);
cDomain = sizeof(Domain)/sizeof(WCHAR);
// Now print its account
OK = LookupAccountSidW(
NULL, // Computer Name
pTokenUser->User.Sid,
UserName,
&cUserName,
Domain,
&cDomain,
&UserSidType
);
DBGPRINT(("TERMSRV: IsCallerSystem: Caller SID is not SYSTEM\n"));
if( OK ) {
DBGPRINT(("TERMSRV: IsCallerSystem: CallerAccount Name %ws, Domain %ws, Type %d, SidSize %d\n",UserName,Domain,UserSidType));
}
else {
extern void CtxDumpSid( PSID, PCHAR, PULONG ); // syslib:dumpsd.c
DBGPRINT(("TERMSRV: Could not lookup callers account Error %d\n",GetLastError()));
CtxDumpSid( pTokenUser->User.Sid, NULL, NULL );
}
#else
TRACE0(("TERMSRV: IsCallerSystem: Caller SID is not SYSTEM\n"));
#endif
MemFree( pTokenUser );
return( FALSE );
}
// NOTREACHED
}
/*****************************************************************************
*
* IsCallerAdmin
*
* Returns whether the current thread is running under SYSTEM
* security.
*
* ENTRY:
* Param1 (input/output)
* Comments
*
* EXIT:
* STATUS_SUCCESS - no error
*
****************************************************************************/
BOOL
IsCallerAdmin( VOID )
{
BOOL FoundAdmin;
NTSTATUS Status;
//
// If the admin sid didn't initialize, the service would not have started.
//
ASSERT(gAdminSid != NULL);
if (!CheckTokenMembership(NULL, gAdminSid, &FoundAdmin)) {
FoundAdmin = FALSE;
}
#if DBG
if (!FoundAdmin)
{
DBGPRINT(("TERMSRV: IsCallerAdmin: Caller SID is not ADMINISTRATOR\n"));
}
#endif
return(FoundAdmin);
}
/*******************************************************************************
*
* IsCallerAllowedPasswordAccess
*
* Is the calling process allowed to view the password field?
*
* The caller must be SYSTEM context, IE: WinLogon.
*
* ENTRY:
*
* EXIT:
* nothing
*
******************************************************************************/
BOOLEAN
IsCallerAllowedPasswordAccess()
{
UINT LocalFlag;
RPC_STATUS RpcStatus;
//
// Only a SYSTEM mode caller (IE: Winlogon) is allowed
// to query this value.
//
RpcStatus = RpcImpersonateClient( NULL );
if( RpcStatus != RPC_S_OK ) {
return( FALSE );
}
//
// Inquire if local RPC call
//
RpcStatus = I_RpcBindingIsClientLocal(
0, // Active RPC call we are servicing
&LocalFlag
);
if( RpcStatus != RPC_S_OK ) {
RpcRevertToSelf();
return( FALSE );
}
if( !LocalFlag ) {
RpcRevertToSelf();
return( FALSE );
}
if( !IsCallerSystem() ) {
RpcRevertToSelf();
return( FALSE );
}
RpcRevertToSelf();
return( TRUE );
}
BOOL
ConfigurePerSessionSecurity(
PWINSTATION pWinStation
)
/*++
Routine Description:
Configure security for the new session. This sets the
per session \Sessions\<x>\BasedNamedObjects and
\Sessions\<x>\DosDevices with an ACE that allows the
currently logged on user to be able to create objects
in their sessions directories.
This is called by WinStationNotifyLogon() after the user
has been authenticated. This must be called before the
newly logged on user can create any WIN32 objects
(events, semaphores, etc.), or DosDevices.
Arguments:
Arg - desc
Return Value:
NTSTATUS - STATUS_SUCCESS no error
!STATUS_SUCCESS NT Status code
--*/
{
BOOL Result;
BOOL bRet = TRUE;
DWORD Len;
PWCHAR pBuf;
WCHAR IdBuf[MAX_PATH];
static ProtectionMode = 0;
static GotProtectionMode = FALSE;
PSID CreatorOwnerSid;
PSID LocalSystemSid;
SID_IDENTIFIER_AUTHORITY CreatorAuthority = SECURITY_CREATOR_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
#define SESSIONS_ROOT L"\\Sessions\\"
#define BNO_PATH L"\\BaseNamedObjects"
#define DD_PATH L"\\DosDevices"
//
// We leave the consoles default NT permissions
// alone.
//
if( pWinStation->LogonId == 0 ) {
return TRUE;
}
// Get the Protection mode from Session Manager\ProtectionMode
if( !GotProtectionMode ) {
HANDLE KeyHandle;
NTSTATUS Status;
ULONG ResultLength;
WCHAR ValueBuffer[ 32 ];
UNICODE_STRING NameString;
OBJECT_ATTRIBUTES ObjectAttributes;
PKEY_VALUE_PARTIAL_INFORMATION KeyValueInformation;
GotProtectionMode = TRUE;
RtlInitUnicodeString( &NameString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" );
InitializeObjectAttributes(
&ObjectAttributes,
&NameString,
OBJ_CASE_INSENSITIVE,
NULL,
NULL
);
Status = NtOpenKey(
&KeyHandle,
KEY_READ,
&ObjectAttributes
);
if (NT_SUCCESS(Status)) {
RtlInitUnicodeString( &NameString, L"ProtectionMode" );
KeyValueInformation = (PKEY_VALUE_PARTIAL_INFORMATION)ValueBuffer;
Status = NtQueryValueKey(
KeyHandle,
&NameString,
KeyValuePartialInformation,
KeyValueInformation,
sizeof( ValueBuffer ),
&ResultLength
);
if (NT_SUCCESS(Status)) {
if (KeyValueInformation->Type == REG_DWORD &&
*(PULONG)KeyValueInformation->Data) {
ProtectionMode = *(PULONG)KeyValueInformation->Data;
}
}
NtClose( KeyHandle );
}
}
// Nothing locked down
if( (ProtectionMode & 0x00000003) == 0 ) {
return TRUE;
}
wsprintf( IdBuf, L"%d", pWinStation->LogonId );
Len = wcslen( IdBuf ) + wcslen( SESSIONS_ROOT ) + wcslen( BNO_PATH ) + 2;
pBuf = LocalAlloc( LMEM_FIXED, Len*sizeof(WCHAR) );
if( pBuf == NULL ) {
SetLastError( ERROR_NOT_ENOUGH_MEMORY );
return FALSE;
}
wsprintf( pBuf, L"%s%s%s", SESSIONS_ROOT, IdBuf, BNO_PATH );
Result = AddAccessToDirectory(
pBuf,
GENERIC_ALL,
pWinStation->pUserSid
);
if( !Result ) bRet = FALSE;
if (NT_SUCCESS(RtlAllocateAndInitializeSid(
&CreatorAuthority,
1,
SECURITY_CREATOR_OWNER_RID,
0, 0, 0, 0, 0, 0, 0,
&CreatorOwnerSid
))) {
Result = AddAccessToDirectory(
pBuf,
GENERIC_ALL,
CreatorOwnerSid
);
if( !Result ) {
bRet = FALSE;
}
RtlFreeSid( CreatorOwnerSid );
}
if (NT_SUCCESS(RtlAllocateAndInitializeSid(
&NtAuthority,
1,
SECURITY_LOCAL_SYSTEM_RID,
0, 0, 0, 0, 0, 0, 0,
&LocalSystemSid
))) {
Result = AddAccessToDirectory(
pBuf,
GENERIC_ALL,
LocalSystemSid
);
if( !Result ) {
bRet = FALSE;
}
RtlFreeSid( LocalSystemSid );
}
LocalFree( pBuf );
Len = wcslen( IdBuf ) + wcslen( SESSIONS_ROOT ) + wcslen( DD_PATH ) + 2;
pBuf = LocalAlloc( LMEM_FIXED, Len*sizeof(WCHAR) );
if( pBuf == NULL ) {
SetLastError( ERROR_NOT_ENOUGH_MEMORY );
return FALSE;
}
wsprintf( pBuf, L"%s%s%s", SESSIONS_ROOT, IdBuf, DD_PATH );
Result = AddAccessToDirectory(
pBuf,
GENERIC_READ | GENERIC_EXECUTE,
pWinStation->pUserSid
);
if( !Result ) bRet = FALSE;
LocalFree( pBuf );
return bRet;
}
BOOL
AddAccessToDirectory(
PWCHAR pPath,
DWORD NewAccess,
PSID pSid
)
/*++
Routine Description:
Add Access to the given NT object directory path for
the supplied SID.
This is done by adding a new AccessAllowedAce to
the DACL on the object directory.
Arguments:
Arg - desc
Return Value:
TRUE - Success
FALSE - Error in GetLastError()
--*/
{
BOOL Result;
HANDLE hDir;
NTSTATUS Status;
ULONG LengthNeeded;
OBJECT_ATTRIBUTES Obja;
PSECURITY_DESCRIPTOR pSd,pSelfSD;
PACL pDacl;
UNICODE_STRING UnicodeString;
RtlInitUnicodeString( &UnicodeString, pPath );
InitializeObjectAttributes(
&Obja,
&UnicodeString,
OBJ_CASE_INSENSITIVE | OBJ_OPENIF,
NULL,
NULL // Sd
);
Status = NtCreateDirectoryObject(
&hDir,
DIRECTORY_ALL_ACCESS,
&Obja
);
if( !NT_SUCCESS(Status) ) {
DBGPRINT(("AddAccessToDirectory: NtCreateDirectoryObject 0x%x :%ws:\n",Status,pPath));
SetLastError(RtlNtStatusToDosError(Status));
return FALSE;
}
// Get SD from sessions directory
Status = NtQuerySecurityObject(
hDir,
OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION |
DACL_SECURITY_INFORMATION,
NULL, // pSd
0, // Length
&LengthNeeded
);
// ? bad handle
if ( Status != STATUS_BUFFER_TOO_SMALL ) {
DBGPRINT(("AddAccessToDirectory: NtQuerySecurityObject 0x%x :%ws:\n",Status,pPath));
SetLastError(RtlNtStatusToDosError(Status));
NtClose( hDir );
return FALSE;
}
pSd = LocalAlloc(LMEM_FIXED, LengthNeeded );
if( pSd == NULL ) {
SetLastError( ERROR_NOT_ENOUGH_MEMORY );
NtClose( hDir );
return FALSE;
}
Status = NtQuerySecurityObject(
hDir,
OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION |
DACL_SECURITY_INFORMATION,
pSd,
LengthNeeded,
&LengthNeeded
);
if( !NT_SUCCESS(Status) ) {
DBGPRINT(("AddAccessToDirectory: NtQuerySecurityObject 0x%x :%ws:\n",Status,pPath));
SetLastError(RtlNtStatusToDosError(Status));
LocalFree( pSd );
NtClose( hDir );
return FALSE;
}
Result = AddAceToSecurityDescriptor(
&pSd,
&pDacl,
NewAccess,
pSid,
TRUE
);
if( !Result ) {
DBGPRINT(("AddAccessToDirectory: AddAceToSecurityDescriptor failure :%ws:\n",pPath));
CleanUpSD(pSd);
NtClose( hDir );
return FALSE;
}
Result = AddAceToSecurityDescriptor(
&pSd,
&pDacl,
NewAccess,
pSid,
FALSE
);
if( !Result ) {
DBGPRINT(("AddAccessToDirectory: AddAceToSecurityDescriptor failure :%ws:\n",pPath));
CleanUpSD(pSd);
NtClose( hDir );
return FALSE;
}
Result = FALSE;
// make sure that pSd is not self-relative already
if (!(((PISECURITY_DESCRIPTOR)pSd)->Control & SE_SELF_RELATIVE)) {
Result = AbsoluteToSelfRelativeSD (pSd, &pSelfSD, NULL);
CleanUpSD(pSd);
if ( !Result ) {
NtClose( hDir);
return FALSE;
}
}
// Put a self-relative SD on session directory (note only self-relative sd are allowed)
Status = NtSetSecurityObject(
hDir,
DACL_SECURITY_INFORMATION,
pSelfSD
);
if( !NT_SUCCESS(Status) ) {
DBGPRINT(("AddAccessToDirectory: NtSetSecurityObject 0x%x :%ws:\n",Status,pPath));
SetLastError(RtlNtStatusToDosError(Status));
CleanUpSD(pSelfSD);
NtClose( hDir );
return FALSE;
}
// Result could only be false if the sd is already self-relative
if (Result) {
CleanUpSD(pSelfSD);
}
// Now update any objects in the directory already
Status = AddAccessToDirectoryObjects(
hDir,
NewAccess,
pSid
);
NtClose( hDir );
// AddAccessToDirectoryObjects() may return out of memory.
if ( !NT_SUCCESS( Status ) )
{
return FALSE;
}
return TRUE;
}
BOOL
AddAceToSecurityDescriptor(
PSECURITY_DESCRIPTOR *ppSd,
PACL *ppDacl,
DWORD Access,
PSID pSid,
BOOLEAN InheritOnly
)
/*++
Routine Description:
Adds the given ACE/SID to the security descriptor. It will
re-allocate the security descriptor if more room is needed.
Arguments:
ppSD - Pointer to PSECURITY_DESCRIPTOR
ppDacl - Pointer to PACL, returns the newly created DACL for freeing
after the security has been set.
Access - Access mask for ACE
pSid - Pointer to Sid this ACE is representing
Return Value:
TRUE - Success
FALSE - Error
--*/
{
ULONG i;
BOOL Result;
BOOL DaclPresent;
BOOL DaclDefaulted;
DWORD Length;
DWORD NewAceLength, NewAclLength;
PACE_HEADER OldAce;
PACE_HEADER NewAce;
ACL_SIZE_INFORMATION AclInfo;
PACL Dacl = NULL;
PACL NewDacl = NULL;
PACL NewAceDacl = NULL;
PSECURITY_DESCRIPTOR NewSD = NULL;
PSECURITY_DESCRIPTOR OldSD = NULL;
BOOL SDAllocated = FALSE;
OldSD = *ppSd;
*ppDacl = NULL;
/*
* Convert SecurityDescriptor to absolute format. It generates
* a new SecurityDescriptor for its output which we must free.
*/
if (((PISECURITY_DESCRIPTOR)OldSD)->Control & SE_SELF_RELATIVE) {
Result = SelfRelativeToAbsoluteSD( OldSD, &NewSD, NULL );
if ( !Result ) {
DBGPRINT(("Could not convert to AbsoluteSD %d\n",GetLastError()));
return( FALSE );
}
SDAllocated = TRUE;
} else {
NewSD = OldSD;
}
// Must get DACL pointer again from new (absolute) SD
Result = GetSecurityDescriptorDacl(
NewSD,
&DaclPresent,
&Dacl,
&DaclDefaulted
);
if( !Result ) {
DBGPRINT(("Could not get Dacl %d\n",GetLastError()));
goto ErrorCleanup;
}
//
// If no DACL, no need to add the user since no DACL
// means all accesss
//
if( !DaclPresent ) {
DBGPRINT(("SD has no DACL, Present %d, Defaulted %d\n",DaclPresent,DaclDefaulted));
if (SDAllocated && NewSD) {
CleanUpSD(NewSD);
}
return( TRUE );
}
//
// Code can return DaclPresent, but a NULL which means
// a NULL Dacl is present. This allows no access to the object.
//
if( Dacl == NULL ) {
DBGPRINT(("SD has NULL DACL, Present %d, Defaulted %d\n",DaclPresent,DaclDefaulted));
goto ErrorCleanup;
}
// Get the current ACL's size
Result = GetAclInformation(
Dacl,
&AclInfo,
sizeof(AclInfo),
AclSizeInformation
);
if( !Result ) {
DBGPRINT(("Error GetAclInformation %d\n",GetLastError()));
goto ErrorCleanup;
}
//
// Create a new ACL to put the new access allowed ACE on
// to get the right structures and sizes.
//
NewAclLength = sizeof(ACL) +
sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG) +
GetLengthSid( pSid );
NewAceDacl = LocalAlloc( LMEM_FIXED, NewAclLength );
if ( NewAceDacl == NULL ) {
DBGPRINT(("Error LocalAlloc %d bytes\n",NewAclLength));
goto ErrorCleanup;
}
Result = InitializeAcl( NewAceDacl, NewAclLength, ACL_REVISION );
if( !Result ) {
DBGPRINT(("Error Initializing Acl %d\n",GetLastError()));
goto ErrorCleanup;
}
Result = AddAccessAllowedAce(
NewAceDacl,
ACL_REVISION,
Access,
pSid
);
if( !Result ) {
DBGPRINT(("Error adding Ace %d\n",GetLastError()));
goto ErrorCleanup;
}
TRACE0(("Added 0x%x Access to ACL\n",Access));
Result = GetAce( NewAceDacl, 0, &NewAce );
if( !Result ) {
DBGPRINT(("Error getting Ace %d\n",GetLastError()));
goto ErrorCleanup;
}
/*
* Allocate new DACL and copy existing ACE list
*/
Length = AclInfo.AclBytesInUse + NewAce->AceSize;
NewDacl = LocalAlloc( LMEM_FIXED, Length );
if( NewDacl == NULL ) {
DBGPRINT(("Error LocalAlloc %d bytes\n",Length));
goto ErrorCleanup;
}
Result = InitializeAcl( NewDacl, Length, ACL_REVISION );
if( !Result ) {
DBGPRINT(("Error Initializing Acl %d\n",GetLastError()));
goto ErrorCleanup;
}
if (InheritOnly) {
/*
* Make this an inherit ACE
*/
NewAce->AceFlags |= (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE);
}
/*
* Insert new ACE at the front of the DACL
*/
Result = AddAce( NewDacl, ACL_REVISION, 0, NewAce, NewAce->AceSize );
if( !Result ) {
DBGPRINT(("Error Adding New Ace to Acl %d\n",GetLastError()));
goto ErrorCleanup;
}
/*
* Now put the ACE's on the old Dacl to the new Dacl
*/
for ( i = 0; i < AclInfo.AceCount; i++ ) {
Result = GetAce( Dacl, i, &OldAce );
if( !Result ) {
DBGPRINT(("Error getting old Ace from Acl %d\n",GetLastError()));
goto ErrorCleanup;
}
Result = AddAce( NewDacl, ACL_REVISION, i+1, OldAce, OldAce->AceSize );
if( !Result ) {
DBGPRINT(("Error setting old Ace to Acl %d\n",GetLastError()));
goto ErrorCleanup;
}
}
/*
* Set new DACL for Security Descriptor
*/
Result = SetSecurityDescriptorDacl(
NewSD,
TRUE,
NewDacl,
FALSE
);
if( !Result ) {
DBGPRINT(("Error setting New Dacl to SD %d\n",GetLastError()));
goto ErrorCleanup;
}
// NewSD is in absolute format and it's dacl is being replaced by NewDacl
// thus it makes perfect sense to delete the old dacl
if (Dacl) {
LocalFree( Dacl );
}
// If we allocated the SD, release the callers old security descriptor,
// otherwise, release the old SDs DACL.
if (SDAllocated) {
CleanUpSD(OldSD);
}
// Release the template Ace Dacl
LocalFree( NewAceDacl );
*ppSd = NewSD;
*ppDacl = NewDacl;
return( TRUE );
ErrorCleanup:
if (NewDacl) {
LocalFree( NewDacl );
}
if (NewAceDacl) {
LocalFree( NewAceDacl );
}
if (SDAllocated && NewSD) {
CleanUpSD( NewSD );
}
// If the SD wasn't allocated, and we got far enough to get a valid
// DACL, free the DACL.
if (Dacl) {
LocalFree( Dacl );
}
return( FALSE );
}
BOOL
AbsoluteToSelfRelativeSD(
PSECURITY_DESCRIPTOR SecurityDescriptorIn,
PSECURITY_DESCRIPTOR *SecurityDescriptorOut,
PULONG ReturnedLength
)
/*++
Routine Description:
Make a security descriptor self-relative
Return Value:
TRUE - Success
FALSE - Failure
--*/
{
BOOL Result;
PSECURITY_DESCRIPTOR pSD;
DWORD dwLength = 0;
/*
* Determine buffer size needed to convert absolute to self-relative SD .
* We use try-except here since if the input security descriptor value
* is sufficiently messed up, it is possible for this call to trap.
*/
try {
Result = MakeSelfRelativeSD(
SecurityDescriptorIn,
NULL,
&dwLength);
} except( EXCEPTION_EXECUTE_HANDLER ) {
SetLastError( ERROR_INVALID_SECURITY_DESCR );
Result = FALSE;
}
if ( Result || (GetLastError() != ERROR_INSUFFICIENT_BUFFER) ) {
DBGPRINT(("SUSERVER: AbsoluteToSelfRelativeSD, Error %d\n",GetLastError()));
return( FALSE );
}
/*
* Allocate memory for the self-relative SD
*/
pSD = LocalAlloc( LMEM_FIXED, dwLength );
if ( pSD == NULL )
return( FALSE );
/*
* Now convert absolute SD to self-relative format.
* We use try-except here since if the input security descriptor value
* is sufficiently messed up, it is possible for this call to trap.
*/
try {
Result = MakeSelfRelativeSD(SecurityDescriptorIn,
pSD,
&dwLength);
} except( EXCEPTION_EXECUTE_HANDLER ) {
SetLastError( ERROR_INVALID_SECURITY_DESCR );
Result = FALSE;
}
if ( !Result ) {
DBGPRINT(("SUSERVER: SelfRelativeToAbsoluteSD, Error %d\n",GetLastError()));
LocalFree( pSD );
return( FALSE );
}
*SecurityDescriptorOut = pSD;
if ( ReturnedLength )
*ReturnedLength = dwLength;
return( TRUE );
}
BOOL
SelfRelativeToAbsoluteSD(
PSECURITY_DESCRIPTOR SecurityDescriptorIn,
PSECURITY_DESCRIPTOR *SecurityDescriptorOut,
PULONG ReturnedLength
)
/*++
Routine Description:
Make a security descriptor absolute
Arguments:
Arg - desc
Return Value:
TRUE - Success
FALSE - Failure
--*/
{
BOOL Result;
PACL pDacl, pSacl;
PSID pOwner, pGroup;
PSECURITY_DESCRIPTOR pSD;
ULONG SdSize, DaclSize, SaclSize, OwnerSize, GroupSize;
/*
* Determine buffer size needed to convert self-relative SD to absolute.
* We use try-except here since if the input security descriptor value
* is sufficiently messed up, it is possible for this call to trap.
*/
try {
SdSize = DaclSize = SaclSize = OwnerSize = GroupSize = 0;
Result = MakeAbsoluteSD(
SecurityDescriptorIn,
NULL, &SdSize,
NULL, &DaclSize,
NULL, &SaclSize,
NULL, &OwnerSize,
NULL, &GroupSize
);
} except( EXCEPTION_EXECUTE_HANDLER ) {
SetLastError( ERROR_INVALID_SECURITY_DESCR );
Result = FALSE;
}
if ( Result || (GetLastError() != ERROR_INSUFFICIENT_BUFFER) ) {
DBGPRINT(("SUSERVER: SelfRelativeToAbsoluteSD, Error %d\n",GetLastError()));
return( FALSE );
}
/*
* Allocate memory for the absolute SD and setup various pointers
*/
pSD = NULL;
pDacl = NULL;
pSacl = NULL;
pOwner = NULL;
pGroup = NULL;
if (SdSize>0) {
pSD = LocalAlloc( LMEM_FIXED, SdSize);
if ( pSD == NULL )
goto error;
}
if (DaclSize>0) {
pDacl = LocalAlloc( LMEM_FIXED, DaclSize);
if ( pDacl == NULL ){
goto error;
}
}
if (SaclSize>0) {
pSacl = LocalAlloc( LMEM_FIXED, SaclSize);
if ( pSacl == NULL ){
goto error;
}
}
if (OwnerSize>0) {
pOwner = LocalAlloc( LMEM_FIXED, OwnerSize);
if ( pOwner == NULL ){
goto error;
}
}
if (GroupSize>0) {
pGroup = LocalAlloc( LMEM_FIXED, GroupSize);
if ( pGroup == NULL ){
goto error;
}
}
//pDacl = (PACL)((PCHAR)pSD + SdSize);
///pSacl = (PACL)((PCHAR)pDacl + DaclSize);
//pOwner = (PSID)((PCHAR)pSacl + SaclSize);
//pGroup = (PSID)((PCHAR)pOwner + OwnerSize);
/*
* Now convert self-relative SD to absolute format.
* We use try-except here since if the input security descriptor value
* is sufficiently messed up, it is possible for this call to trap.
*/
try {
Result = MakeAbsoluteSD(
SecurityDescriptorIn,
pSD, &SdSize,
pDacl, &DaclSize,
pSacl, &SaclSize,
pOwner, &OwnerSize,
pGroup, &GroupSize
);
} except( EXCEPTION_EXECUTE_HANDLER ) {
SetLastError( ERROR_INVALID_SECURITY_DESCR );
Result = FALSE;
}
if ( !Result ) {
DBGPRINT(("SUSERVER: SelfRelativeToAbsoluteSD, Error %d\n",GetLastError()));
goto error;
}
*SecurityDescriptorOut = pSD;
if ( ReturnedLength )
*ReturnedLength = SdSize + DaclSize + SaclSize + OwnerSize + GroupSize;
return( TRUE );
error:
if (pSD) {
LocalFree(pSD);
}
if (pDacl) {
LocalFree(pDacl);
}
if (pSacl) {
LocalFree(pSacl);
}
if (pOwner) {
LocalFree(pOwner);
}
if (pGroup) {
LocalFree(pGroup);
}
return( FALSE );
}
VOID
CleanUpSD(
PSECURITY_DESCRIPTOR pSD
)
/*++
Routine Description:
delete the security descriptor
Arguments:
Arg - desc
Return Value:
TRUE - Success
FALSE - Error in GetLastError()
--*/
{
if (pSD) {
if (((PISECURITY_DESCRIPTOR)pSD)->Control & SE_SELF_RELATIVE){
LocalFree( pSD );
}else{
ULONG_PTR Dacl,Owner,Group,Sacl;
ULONG_PTR SDTop = (ULONG_PTR)pSD;
ULONG_PTR SDBottom = LocalSize(pSD)+SDTop;
Dacl = (ULONG_PTR)((PISECURITY_DESCRIPTOR)pSD)->Dacl;
Owner = (ULONG_PTR)((PISECURITY_DESCRIPTOR)pSD)->Owner;
Group = (ULONG_PTR)((PISECURITY_DESCRIPTOR)pSD)->Group;
Sacl = (ULONG_PTR)((PISECURITY_DESCRIPTOR)pSD)->Sacl;
// make sure that the dacl, owner, group, sacl are not within the SD boundary
if (Dacl) {
if (Dacl>=SDBottom|| Dacl<SDTop) {
LocalFree(((PISECURITY_DESCRIPTOR)pSD)->Dacl);
}
}
if (Owner) {
if (Owner>=SDBottom || Owner<SDTop) {
LocalFree(((PISECURITY_DESCRIPTOR)pSD)->Owner);
}
}
if (Group) {
if (Group>=SDBottom || Group<SDTop) {
LocalFree(((PISECURITY_DESCRIPTOR)pSD)->Group);
}
}
if (Sacl) {
if (Sacl>=SDBottom || Sacl<SDTop) {
LocalFree(((PISECURITY_DESCRIPTOR)pSD)->Sacl);
}
}
LocalFree(pSD);
}
}
}
NTSTATUS
AddAccessToDirectoryObjects(
HANDLE DirectoryHandle,
DWORD NewAccess,
PSID pSid
)
/*++
Routine Description:
Add Access to the objects in the given NT object directory
for the supplied SID.
This is done by adding a new AccessAllowedAce to the DACL's
on the objects in the directory.
Arguments:
Arg - desc
Return Value:
TRUE - Success
FALSE - Error in GetLastError()
--*/
{
BOOL Result;
ULONG Context;
HANDLE LinkHandle;
NTSTATUS Status;
BOOLEAN RestartScan;
ULONG ReturnedLength;
ULONG LengthNeeded;
OBJECT_ATTRIBUTES Attributes;
PSECURITY_DESCRIPTOR pSd,pSelfSD;
PACL pDacl;
POBJECT_DIRECTORY_INFORMATION pDirInfo;
RestartScan = TRUE;
Context = 0;
pDirInfo = (POBJECT_DIRECTORY_INFORMATION) LocalAlloc(LMEM_FIXED, 4096 );
if ( !pDirInfo)
{
return STATUS_NO_MEMORY;
}
while (TRUE) {
Status = NtQueryDirectoryObject( DirectoryHandle,
pDirInfo,
4096 ,
TRUE,
RestartScan,
&Context,
&ReturnedLength
);
RestartScan = FALSE;
//
// Check the status of the operation.
//
if (!NT_SUCCESS( Status )) {
if (Status == STATUS_NO_MORE_ENTRIES) {
Status = STATUS_SUCCESS;
}
break;
}
// SymbolicLink
if (!wcscmp( pDirInfo->TypeName.Buffer, L"SymbolicLink" )) {
InitializeObjectAttributes(
&Attributes,
&pDirInfo->Name,
OBJ_CASE_INSENSITIVE,
DirectoryHandle,
NULL
);
Status = NtOpenSymbolicLinkObject(
&LinkHandle,
SYMBOLIC_LINK_ALL_ACCESS,
&Attributes
);
}
else {
continue;
}
if (!NT_SUCCESS( Status )) {
continue;
}
// GetSecurity
Status = NtQuerySecurityObject(
LinkHandle,
OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION |
DACL_SECURITY_INFORMATION,
NULL, // pSd
0, // Length
&LengthNeeded
);
if( Status != STATUS_BUFFER_TOO_SMALL ) {
DBGPRINT(("NtQuerySecurityObject 0x%x\n",Status));
NtClose( LinkHandle );
continue;
}
pSd = LocalAlloc(LMEM_FIXED, LengthNeeded );
if( pSd == NULL ) {
NtClose( LinkHandle );
continue;
}
Status = NtQuerySecurityObject(
LinkHandle,
OWNER_SECURITY_INFORMATION |
GROUP_SECURITY_INFORMATION |
DACL_SECURITY_INFORMATION,
pSd, // pSd
LengthNeeded, // Length
&LengthNeeded
);
if( !NT_SUCCESS(Status) ) {
DBGPRINT(("NtQuerySecurityObject 0x%x\n",Status));
NtClose( LinkHandle );
LocalFree( pSd );
continue;
}
// Mung ACL
Result = AddAceToSecurityDescriptor(
&pSd,
&pDacl,
NewAccess,
pSid,
FALSE
);
if( !Result ) {
NtClose( LinkHandle );
CleanUpSD(pSd);
continue;
}
// make sure that pSd is not self-relative already.
if (!(((PISECURITY_DESCRIPTOR)pSd)->Control & SE_SELF_RELATIVE)) {
if (!AbsoluteToSelfRelativeSD (pSd, &pSelfSD, NULL)){
NtClose( LinkHandle );
CleanUpSD(pSd);
continue;
}
}
// SetSecurity only accepts self-relative formats
Status = NtSetSecurityObject(
LinkHandle,
DACL_SECURITY_INFORMATION,
pSelfSD
);
NtClose( LinkHandle );
//
// These must be freed regardless of the success of
// NtSetSecurityObject
//
// pDacl lives inside of pSd
CleanUpSD(pSd);
CleanUpSD(pSelfSD);
} // end while
LocalFree( pDirInfo );
return STATUS_SUCCESS;
}
/*******************************************************************************
*
* ReInitializeSecurityWorker
*
* ReInitialize the default WinStation security descriptor and force all active
* sessions to update their security descirptors
*
* ENTRY:
* nothing
*
* EXIT:
* STATUS_SUCCESS
*
******************************************************************************/
NTSTATUS
ReInitializeSecurityWorker( VOID )
{
NTSTATUS Status;
ULONG WinStationCount;
ULONG ByteCount;
WINSTATIONNAME * pWinStationName;
ULONG i;
PWINSTATION pWinStation;
/*
* Update Default Security Descriptor
*/
RtlAcquireResourceExclusive(&WinStationSecurityLock, TRUE);
WinStationSecurityInit();
RtlReleaseResource(&WinStationSecurityLock);
/*
* Get the number of WinStations in the registry
*/
WinStationCount = 0;
Status = IcaRegWinStationEnumerate( &WinStationCount, NULL, &ByteCount );
if ( !NT_SUCCESS(Status) )
return Status;
/*
* Allocate a buffer for the WinStation names
*/
pWinStationName = MemAlloc( ByteCount );
if ( pWinStationName == NULL ) {
return STATUS_NO_MEMORY;
}
/*
* Get list of WinStation names from registry
*/
WinStationCount = (ULONG) -1;
Status = IcaRegWinStationEnumerate( &WinStationCount,
(PWINSTATIONNAME)pWinStationName,
&ByteCount );
if ( !NT_SUCCESS(Status) ) {
MemFree( pWinStationName );
return Status;
}
/*
* Check if any WinStations need to be created or reset
*/
for ( i = 0; i < WinStationCount; i++ ) {
/*
* Ignore console WinStation
*/
if ( _wcsicmp( pWinStationName[i], L"Console" ) ) {
/*
* If this WinStation exists, then see if the Registry data
* has changed. If so, then reset the WinStation.
*/
if ( pWinStation = FindWinStationByName( pWinStationName[i], FALSE ) ) {
/*
* Winstations should update their security
* descriptors.
*/
RtlAcquireResourceExclusive(&WinStationSecurityLock, TRUE);
ReadWinStationSecurityDescriptor( pWinStation );
RtlReleaseResource(&WinStationSecurityLock);
ReleaseWinStation( pWinStation );
}
}
}
/*
* Free buffers
*/
MemFree( pWinStationName );
return( STATUS_SUCCESS );
}
Reference in a new issue Copy permalink