#include "stdafx.h" #include "macros.h" USE_HANDLE_MACROS("SCHMMGMT(aclpage.cpp)") #include "dataobj.h" #include "compdata.h" #include "cookie.h" #include "snapmgr.h" #include "schmutil.h" #include "cache.h" #include "relation.h" #include "attrpage.h" #include "advui.h" #include "aclpage.h" #include "ntsecapi.h" #include "sddlp.h" HRESULT GetDomainSid(LPCWSTR pszLdapPath, PSID *ppSid); // // CDynamicLibraryBase // This is the base class for CDSSecDll and CAclUiDll. // This was taken from the dnsmgr snap in. // class CDynamicLibraryBase { public: CDynamicLibraryBase() { m_lpszLibraryName = NULL; m_lpszFunctionName = NULL; m_hLibrary = NULL; m_pfFunction = NULL; } virtual ~CDynamicLibraryBase() { if ( m_hLibrary != NULL ) { ::FreeLibrary(m_hLibrary); m_hLibrary = NULL; } } // // Load a DLL and get a single entry point. // BOOL Load() { if (m_hLibrary != NULL) return TRUE; // already loaded ASSERT(m_lpszLibraryName != NULL); m_hLibrary = ::LoadLibrary(m_lpszLibraryName); if (NULL == m_hLibrary) { // The library is not present return FALSE; } ASSERT(m_lpszFunctionName != NULL); ASSERT(m_pfFunction == NULL); m_pfFunction = ::GetProcAddress(m_hLibrary, m_lpszFunctionName ); if ( NULL == m_pfFunction ) { // The library is present but does not have the entry point ::FreeLibrary( m_hLibrary ); m_hLibrary = NULL; return FALSE; } ASSERT(m_hLibrary != NULL); ASSERT(m_pfFunction != NULL); return TRUE; } protected: LPCSTR m_lpszFunctionName; LPCTSTR m_lpszLibraryName; FARPROC m_pfFunction; HMODULE m_hLibrary; }; // // CDsSecDLL - Holds the wrapper for the ACL editor wrapper. // class CDsSecDLL : public CDynamicLibraryBase { public: CDsSecDLL() { m_lpszLibraryName = _T("dssec.dll"); m_lpszFunctionName = "DSCreateISecurityInfoObject"; } HRESULT DSCreateISecurityInfoObject( LPCWSTR pwszObjectPath, // in LPCWSTR pwszObjectClass, // in DWORD dwFlags, // in LPSECURITYINFO* ppISecurityInfo, // out PFNREADOBJECTSECURITY pfnReadSd, // in PFNWRITEOBJECTSECURITY pfnWriteSd, // in LPARAM lpContext ); // in }; HRESULT CDsSecDLL::DSCreateISecurityInfoObject( LPCWSTR pwszObjectPath, // in LPCWSTR pwszObjectClass, // in DWORD dwFlags, // in LPSECURITYINFO* ppISecurityInfo, // out PFNREADOBJECTSECURITY pfnReadSd, // in PFNWRITEOBJECTSECURITY pfnWriteSd,// in LPARAM lpContext // in ) { // // Call the function of the same name. // ASSERT(m_hLibrary != NULL); ASSERT(m_pfFunction != NULL); return ((PFNDSCREATEISECINFO)m_pfFunction)( pwszObjectPath, pwszObjectClass, dwFlags, ppISecurityInfo, pfnReadSd, pfnWriteSd, lpContext ); } // // CAclUiDLL - Where the UI Actually Lives. // class CAclUiDLL : public CDynamicLibraryBase { public: CAclUiDLL() { m_lpszLibraryName = _T("aclui.dll"); m_lpszFunctionName = "CreateSecurityPage"; } HPROPSHEETPAGE CreateSecurityPage( LPSECURITYINFO psi ); }; HPROPSHEETPAGE CAclUiDLL::CreateSecurityPage( LPSECURITYINFO psi ) { ASSERT(m_hLibrary != NULL); ASSERT(m_pfFunction != NULL); return ((ACLUICREATESECURITYPAGEPROC)m_pfFunction) (psi); } // // CISecurityInformationWrapper - The wrapper for the routine that gets // sent to CreateSecurityPage(). // class CISecurityInformationWrapper : public ISecurityInformation { public: CISecurityInformationWrapper( CAclEditorPage* pAclEditorPage ) { m_dwRefCount = 0; ASSERT(pAclEditorPage != NULL); m_pAclEditorPage = pAclEditorPage; m_pISecInfo = NULL; } ~CISecurityInformationWrapper() { ASSERT(m_dwRefCount == 0); if (m_pISecInfo != NULL) m_pISecInfo->Release(); } public: // // *** IUnknown methods *** // Call through to the to actual SecurityInformation interface. // STDMETHOD(QueryInterface) (REFIID riid, LPVOID * ppvObj) { return m_pISecInfo->QueryInterface(riid, ppvObj); } STDMETHOD_(ULONG,AddRef) () { m_dwRefCount++; return m_pISecInfo->AddRef(); } STDMETHOD_(ULONG,Release) () { m_dwRefCount--; ISecurityInformation* pISecInfo = m_pISecInfo; return pISecInfo->Release(); } // // *** ISecurityInformation methods *** // These are also call through. // STDMETHOD(GetObjectInformation) (PSI_OBJECT_INFO pObjectInfo ) { HRESULT hr = m_pISecInfo->GetObjectInformation(pObjectInfo); if (m_szPageTitle.IsEmpty()) { m_szPageTitle.LoadString(IDS_DEFAULT_SECURITY); } pObjectInfo->dwFlags |= SI_PAGE_TITLE; pObjectInfo->pszPageTitle = (PWSTR)(PCWSTR)m_szPageTitle; return hr; } STDMETHOD(GetAccessRights) (const GUID* pguidObjectType, DWORD dwFlags, // SI_EDIT_AUDITS, SI_EDIT_PROPERTIES PSI_ACCESS *ppAccess, ULONG *pcAccesses, ULONG *piDefaultAccess ) { return m_pISecInfo->GetAccessRights(pguidObjectType, dwFlags, ppAccess, pcAccesses, piDefaultAccess); } STDMETHOD(MapGeneric) (const GUID *pguidObjectType, UCHAR *pAceFlags, ACCESS_MASK *pMask) { return m_pISecInfo->MapGeneric(pguidObjectType, pAceFlags, pMask); } STDMETHOD(GetInheritTypes) (PSI_INHERIT_TYPE *ppInheritTypes, ULONG *pcInheritTypes ) { return m_pISecInfo->GetInheritTypes(ppInheritTypes, pcInheritTypes); } STDMETHOD(PropertySheetPageCallback)(HWND hwnd, UINT uMsg, SI_PAGE_TYPE uPage ) { return m_pISecInfo->PropertySheetPageCallback(hwnd, uMsg, uPage); } STDMETHOD(GetSecurity) (SECURITY_INFORMATION RequestedInformation, PSECURITY_DESCRIPTOR *ppSecurityDescriptor, BOOL fDefault) { return m_pISecInfo->GetSecurity( RequestedInformation, ppSecurityDescriptor, fDefault ); } STDMETHOD(SetSecurity) (SECURITY_INFORMATION securityInformation, PSECURITY_DESCRIPTOR pSecurityDescriptor ) { return m_pISecInfo->SetSecurity( securityInformation, pSecurityDescriptor ); } private: DWORD m_dwRefCount; ISecurityInformation* m_pISecInfo; // interface pointer to the wrapped interface CAclEditorPage* m_pAclEditorPage; // back pointer CString m_szPageTitle; friend class CAclEditorPage; }; // // Static instances of the dynamically loaded DLLs. // CDsSecDLL g_DsSecDLL; CAclUiDLL g_AclUiDLL; // // CAclEditorPage Routines. // HRESULT CAclEditorPage::CreateInstance( CAclEditorPage ** ppAclPage, LPCTSTR lpszLDAPPath, LPCTSTR lpszObjectClass ) { HRESULT hr = S_OK; CAclEditorPage* pAclEditorPage = new CAclEditorPage; if (pAclEditorPage != NULL) { hr = pAclEditorPage->Initialize( lpszLDAPPath, lpszObjectClass ); if ( SUCCEEDED(hr) ) { *ppAclPage = pAclEditorPage; } else { delete pAclEditorPage; pAclEditorPage = NULL; } } else hr = HRESULT_FROM_WIN32( ERROR_OUTOFMEMORY ); return hr; } CAclEditorPage::CAclEditorPage() { m_pISecInfoWrap = new CISecurityInformationWrapper(this); } CAclEditorPage::~CAclEditorPage() { delete m_pISecInfoWrap; } HRESULT ReadSecurity( LPCWSTR lpszLdapPath, SECURITY_INFORMATION RequestedInformation, PSECURITY_DESCRIPTOR *ppSecDesc, LPARAM lpContext ); HRESULT WriteSecurity( LPCWSTR lpszLdapPath, SECURITY_INFORMATION securityInformation, PSECURITY_DESCRIPTOR pSecDesc, LPARAM lpContext ); HRESULT GetObjectSecurityDescriptor( LPCWSTR lpszLdapPath, PSECURITY_DESCRIPTOR * ppSecDesc, IADs ** ppIADsObject = NULL ); HRESULT CAclEditorPage::Initialize( LPCTSTR lpszLDAPPath, LPCTSTR lpszObjectClass ) { // // Get ISecurityInfo* for this object from DSSEC.DLL // if (!g_DsSecDLL.Load()) return E_INVALIDARG; ASSERT(m_pISecInfoWrap->m_pISecInfo == NULL); return g_DsSecDLL.DSCreateISecurityInfoObject( lpszLDAPPath, lpszObjectClass, DSSI_NO_ACCESS_CHECK | DSSI_NO_EDIT_OWNER | ( IsReadOnly(lpszLDAPPath) ? DSSI_READ_ONLY : 0 ), &(m_pISecInfoWrap->m_pISecInfo), ReadSecurity, WriteSecurity, 0 ); } HPROPSHEETPAGE CAclEditorPage::CreatePage() { ASSERT(m_pISecInfoWrap->m_pISecInfo != NULL); if (!g_AclUiDLL.Load()) return NULL; // // Call into ACLUI.DLL to create the page // passing the wrapper interface. // return g_AclUiDLL.CreateSecurityPage(m_pISecInfoWrap); } HRESULT ReadSecurity( LPCWSTR lpszLdapPath, SECURITY_INFORMATION /*RequestedInformation*/, // ignoring... PSECURITY_DESCRIPTOR* ppSecDesc, LPARAM /*lpContext*/) { return GetObjectSecurityDescriptor( lpszLdapPath, ppSecDesc ); } #define BREAK_ON_FAILED_BOOL(fResult) \ if ( !fResult ) \ { \ ASSERT( FALSE ); \ break; \ } const SECURITY_INFORMATION ALL_SECURITY_INFORMATION = OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION; HRESULT WriteSecurity( LPCWSTR lpszLdapPath, SECURITY_INFORMATION securityInformation, PSECURITY_DESCRIPTOR pModificationDescriptor, LPARAM /*lpContext*/) { HRESULT hr = S_OK; BOOL fResult = TRUE; IADs * pIADsObject = NULL; PSECURITY_DESCRIPTOR pSecDesc = NULL; LPWSTR pstrSecDesc = NULL; const UINT cAbsoluteSecDescSize = 5; struct { PVOID pData; DWORD dwDataSize; } absSecDesc[cAbsoluteSecDescSize]; const PSECURITY_DESCRIPTOR & pAbsSecDesc = (PSECURITY_DESCRIPTOR) absSecDesc[0].pData; ZeroMemory( absSecDesc, sizeof(absSecDesc) ); // we only support changes in DACL & SACL ASSERT( securityInformation & (DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION) ); ASSERT( IsValidSecurityDescriptor(pModificationDescriptor) ); do { hr = GetObjectSecurityDescriptor( lpszLdapPath, &pSecDesc, &pIADsObject ); BREAK_ON_FAILED_HRESULT(hr); ASSERT(pIADsObject); fResult = MakeAbsoluteSD( pSecDesc, (PSECURITY_DESCRIPTOR) absSecDesc[0].pData, &absSecDesc[0].dwDataSize, (PACL) absSecDesc[1].pData, &absSecDesc[1].dwDataSize, (PACL) absSecDesc[2].pData, &absSecDesc[2].dwDataSize, (PSID) absSecDesc[3].pData, &absSecDesc[3].dwDataSize, (PSID) absSecDesc[4].pData, &absSecDesc[4].dwDataSize ); ASSERT( !fResult ); // the call must fail the first time hr = HRESULT_FROM_WIN32(::GetLastError()); if( ERROR_INSUFFICIENT_BUFFER != HRESULT_CODE(hr) ) BREAK_ON_FAILED_HRESULT(hr); fResult = TRUE; hr = HRESULT_FROM_WIN32( ERROR_OUTOFMEMORY ); // allocate memory for the security descriptor for( UINT i = 0; i < cAbsoluteSecDescSize; i++ ) if( absSecDesc[i].dwDataSize > 0 ) if( NULL == (absSecDesc[i].pData = new BYTE[ absSecDesc[i].dwDataSize ]) ) break; hr = S_OK; fResult = MakeAbsoluteSD( pSecDesc, (PSECURITY_DESCRIPTOR) absSecDesc[0].pData, &absSecDesc[0].dwDataSize, (PACL) absSecDesc[1].pData, &absSecDesc[1].dwDataSize, (PACL) absSecDesc[2].pData, &absSecDesc[2].dwDataSize, (PSID) absSecDesc[3].pData, &absSecDesc[3].dwDataSize, (PSID) absSecDesc[4].pData, &absSecDesc[4].dwDataSize ); BREAK_ON_FAILED_BOOL( fResult ); // for convinience, have another reference. ASSERT( absSecDesc[0].pData == pAbsSecDesc ); ASSERT( IsValidSecurityDescriptor(pAbsSecDesc) ); // Apply DACL changes if( securityInformation & DACL_SECURITY_INFORMATION ) { BOOL bDaclPresent = FALSE; PACL pDacl = NULL; BOOL bDaclDefaulted = FALSE; SECURITY_DESCRIPTOR_CONTROL control = 0; DWORD dwRevision = 0; fResult = GetSecurityDescriptorDacl( pModificationDescriptor, &bDaclPresent, &pDacl, &bDaclDefaulted ); BREAK_ON_FAILED_BOOL( fResult ); fResult = SetSecurityDescriptorDacl( pAbsSecDesc, bDaclPresent, pDacl, bDaclDefaulted ); BREAK_ON_FAILED_BOOL( fResult ); fResult = GetSecurityDescriptorControl( pModificationDescriptor, &control, &dwRevision ); BREAK_ON_FAILED_BOOL( fResult ); fResult = SetSecurityDescriptorControl( pAbsSecDesc, SE_DACL_PROTECTED, control & SE_DACL_PROTECTED ); BREAK_ON_FAILED_BOOL( fResult ); } // Apply SACL changes if( securityInformation & SACL_SECURITY_INFORMATION ) { BOOL bSaclPresent = FALSE; PACL pSacl = NULL; BOOL bSaclDefaulted = FALSE; SECURITY_DESCRIPTOR_CONTROL control = 0; DWORD dwRevision = 0; fResult = GetSecurityDescriptorSacl( pModificationDescriptor, &bSaclPresent, &pSacl, &bSaclDefaulted ); BREAK_ON_FAILED_BOOL( fResult ); fResult = SetSecurityDescriptorSacl( pAbsSecDesc, bSaclPresent, pSacl, bSaclDefaulted ); BREAK_ON_FAILED_BOOL( fResult ); fResult = GetSecurityDescriptorControl( pModificationDescriptor, &control, &dwRevision ); BREAK_ON_FAILED_BOOL( fResult ); fResult = SetSecurityDescriptorControl( pAbsSecDesc, SE_SACL_PROTECTED, control & SE_SACL_PROTECTED ); BREAK_ON_FAILED_BOOL( fResult ); } // Convert Security Descriptor to string format fResult = ConvertSecurityDescriptorToStringSecurityDescriptor( pAbsSecDesc, SDDL_REVISION, ALL_SECURITY_INFORMATION, &pstrSecDesc, NULL ); BREAK_ON_FAILED_BOOL( fResult ); ASSERT(pstrSecDesc); CComVariant v(pstrSecDesc); hr = pIADsObject->Put( const_cast((LPCTSTR)g_DefaultAcl), v); BREAK_ON_FAILED_HRESULT(hr); hr = pIADsObject->SetInfo( ); } while (0); if( !fResult ) hr = HRESULT_FROM_WIN32(::GetLastError()); if( pIADsObject ) pIADsObject->Release(); if( pstrSecDesc ) LocalFree( pstrSecDesc ); for( UINT i = 0; i < cAbsoluteSecDescSize; i++ ) if( absSecDesc[i].pData ) delete absSecDesc[i].pData; return hr; } HRESULT GetObjectSecurityDescriptor( LPCWSTR lpszLdapPath, PSECURITY_DESCRIPTOR * ppSecDesc, IADs ** ppIADsObject /* = NULL */) // returns pIADsObject for future use. { HRESULT hr = S_OK; IADs * pIADsObject = NULL; CComVariant AdsResult; PSID pDomainSid = NULL; *ppSecDesc = NULL; do { hr = ::ADsGetObject( const_cast((LPCWSTR) lpszLdapPath), IID_IADs, (void **) &pIADsObject ); BREAK_ON_FAILED_HRESULT(hr); ASSERT(pIADsObject); hr = pIADsObject->Get( const_cast((LPCTSTR) g_DefaultAcl), &AdsResult); BREAK_ON_FAILED_HRESULT(hr); pDomainSid = NULL; GetDomainSid(lpszLdapPath, &pDomainSid); if(pDomainSid) { if(!ConvertStringSDToSDDomain(pDomainSid, NULL, V_BSTR(&AdsResult), SDDL_REVISION, ppSecDesc, NULL )) { ASSERT( FALSE ); hr = HRESULT_FROM_WIN32(::GetLastError()); break; } } else if( !ConvertStringSecurityDescriptorToSecurityDescriptor( V_BSTR(&AdsResult), SDDL_REVISION, ppSecDesc, NULL ) ) { ASSERT( FALSE ); hr = HRESULT_FROM_WIN32(::GetLastError()); break; } ASSERT( IsValidSecurityDescriptor(*ppSecDesc) ); } while (0); if( pIADsObject ) { ASSERT( SUCCEEDED(hr) ); if( !ppIADsObject ) // if caller doesn't need pIADsObject { pIADsObject->Release(); // release it } else { *ppIADsObject = pIADsObject; // otherwise, return it } } if(pDomainSid) LocalFree(pDomainSid); return hr; } BOOL CAclEditorPage::IsReadOnly( LPCTSTR lpszLDAPPath ) { ASSERT( lpszLDAPPath ); HRESULT hr = S_OK; BOOL fFound = FALSE; CComPtr ipADs; CStringList strlist; do { // // Open the schema container. // hr = ADsGetObject( (LPWSTR)(LPCWSTR)lpszLDAPPath, IID_IADs, (void **)&ipADs ); BREAK_ON_FAILED_HRESULT(hr); // extract the list of allowed classes hr = GetStringListElement( ipADs, &g_allowedAttributesEffective, strlist ); BREAK_ON_FAILED_HRESULT(hr); // search for needed attributes for( POSITION pos = strlist.GetHeadPosition(); !fFound && pos != NULL; ) { CString * pstr = &strlist.GetNext( pos ); fFound = !pstr->CompareNoCase( g_DefaultAcl ); } } while( FALSE ); return !fFound; // in case something fails, make read-only. } LSA_HANDLE GetLSAConnection(LPCTSTR pszServer, DWORD dwAccessDesired) { LSA_HANDLE hPolicy = NULL; LSA_UNICODE_STRING uszServer = {0}; LSA_UNICODE_STRING *puszServer = NULL; LSA_OBJECT_ATTRIBUTES oa; SECURITY_QUALITY_OF_SERVICE sqos; sqos.Length = sizeof(sqos); sqos.ImpersonationLevel = SecurityImpersonation; sqos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING; sqos.EffectiveOnly = FALSE; InitializeObjectAttributes(&oa, NULL, 0, NULL, NULL); oa.SecurityQualityOfService = &sqos; if (pszServer && *pszServer && RtlCreateUnicodeString(&uszServer, pszServer)) { puszServer = &uszServer; } LsaOpenPolicy(puszServer, &oa, dwAccessDesired, &hPolicy); if (puszServer) RtlFreeUnicodeString(puszServer); return hPolicy; } HRESULT GetDomainSid(LPCWSTR pszLdapPath, PSID *ppSid) { HRESULT hr = S_OK; NTSTATUS nts = STATUS_SUCCESS; PPOLICY_ACCOUNT_DOMAIN_INFO pDomainInfo = NULL; LSA_HANDLE hLSA = 0; if(!pszLdapPath || !ppSid) return E_INVALIDARG; *ppSid = NULL; IADsPathname *pPath = NULL; BSTR bstrServer = NULL; CoCreateInstance(CLSID_Pathname, NULL, CLSCTX_INPROC_SERVER, IID_IADsPathname, (LPVOID*)&pPath); if(pPath) { if(SUCCEEDED(pPath->Set((BSTR)pszLdapPath,ADS_SETTYPE_FULL))) { if(SUCCEEDED(pPath->Retrieve(ADS_FORMAT_SERVER, &bstrServer))) { hLSA = GetLSAConnection(bstrServer, POLICY_VIEW_LOCAL_INFORMATION); if (!hLSA) { hr = E_FAIL; goto exit_gracefully; } nts = LsaQueryInformationPolicy(hLSA, PolicyAccountDomainInformation, (PVOID*)&pDomainInfo); if(nts != STATUS_SUCCESS) { hr = E_FAIL; goto exit_gracefully; } if (pDomainInfo && pDomainInfo->DomainSid) { ULONG cbSid = GetLengthSid(pDomainInfo->DomainSid); *ppSid = (PSID) LocalAlloc(LPTR, cbSid); if (!*ppSid) { hr = E_OUTOFMEMORY; goto exit_gracefully; } CopyMemory(*ppSid, pDomainInfo->DomainSid, cbSid); } } } } exit_gracefully: if(pDomainInfo) LsaFreeMemory(pDomainInfo); if(hLSA) LsaClose(hLSA); if(bstrServer) SysFreeString(bstrServer); if(pPath) pPath->Release(); return hr; }