/*++ Copyright (c) 1989 Microsoft Corporation Module Name: tokenp.h Abstract: This module contains the internal (private) declarations needed by the TOKEN object routines. It also contains global variables needed by the TOKEN object routines. Author: Jim Kelly (JimK) 18-May-1990 Revision History: v10: robertre Added SepAccessCheck and SepPrivilegeCheck prototypes v11: robertre Added parameter to SepAccessCheck --*/ #ifndef _TOKENP_ #define _TOKENP_ //#define TOKEN_DEBUG #include "ntos.h" #include "sep.h" #include "seopaque.h" ///////////////////////////////////////////////////////////////////////// // // // Token Diagnostics // // // ///////////////////////////////////////////////////////////////////////// #if DBG #define TOKEN_DIAGNOSTICS_ENABLED 1 #endif // DBG // // These definitions are useful diagnostics aids // #if TOKEN_DIAGNOSTICS_ENABLED // // Test for enabled diagnostic // #define IF_TOKEN_GLOBAL( FlagName ) \ if (TokenGlobalFlag & (TOKEN_DIAG_##FlagName)) // // Diagnostics print statement // #define TokenDiagPrint( FlagName, _Text_ ) \ IF_TOKEN_GLOBAL( FlagName ) \ DbgPrint _Text_ #else // !TOKEN_DIAGNOSTICS_ENABLED // // No diagnostics included in build // // // Test for diagnostics enabled // #define IF_TOKEN_GLOBAL( FlagName ) if (FALSE) // // Diagnostics print statement (expands to no-op) // #define TokenDiagPrint( FlagName, _Text_ ) ; #endif // TOKEN_DIAGNOSTICS_ENABLED // // The following flags enable or disable various diagnostic // capabilities within token code. These flags are set in // TokenGlobalFlag (only available within a DBG system). // // // TOKEN_LOCKS - Display information about acquisition and freeing // of token locks. // #define TOKEN_DIAG_TOKEN_LOCKS ((ULONG) 0x00000001L) ///////////////////////////////////////////////////////////////////////// // // // Token Related Constants // // // ///////////////////////////////////////////////////////////////////////// // // By default, a token is charged the following for its dynamic component. // The dynamic component houses the default ACL and primary group ID. // If the size of these parameters passed upon token creation are larger // than this default, then the larger value will be charged. // #define TOKEN_DEFAULT_DYNAMIC_CHARGE 500 ///////////////////////////////////////////////////////////////////////// // // // Token Object Body // // // ///////////////////////////////////////////////////////////////////////// // // Tokens have three parts: // // Fixed part of body, // Variable part of body, // Dynamic part (not in body). // // The fixed and variable parts are allocated in a single block of memory. // The dynamic part is a separately allocated block of memory. // // The fixed part of the body contains the fixed length fields. These // are defined in the TOKEN data type. // // The variable part of the body is variable in length and contains // privileges and user/group SIDs. This part is variable in length // between different token objects, but does not change once established // for an individual token. // // The dynamic part is used to house default discretionary ACL information // and the primary group ID. // // Pictorially, a token looks like: // // ============== +---------------+ // ^ | | // | | | // | | | // | | DynamicPart o-----------+ // | |- - - - - - - -| | // +-----o Privileges | | // Token | |- - - - - - - -| | // Body | +--o UserAndGroups | | // | | | |- - - - - - - -| | // | | +--o RestrictedSids| \|/ // | | | |- - - - - - - -| +---------------------+ // | | | | PrimaryGroup o------->| [Primary Group SID] | // | | | |- - - - - - - -| | o | // | | | | DefaultAcl o---+ | o | // | | | |- - - - - - - -| | | o | // | | | | o | | |- - - - - - - - - - -| // | | | | o | +--->| [ Default Acl ] | // v | | | o | | o | // ==============| | |===============| | o | // ^ | +->| SIDs Array | | o | // | | | [User SID ] | +---------------------+ // | | | [Group SID ] | // | | [Group SID ] | // Variable | | [Rest. Sid ] | // Part | | o | // | |- - - - - - - -| // | +---->| Privileges | // | | Array | // v | | // ============== +---------------+ // // WARNING: The positions of fields illustrated in this picture are not // intented to reflect their actual or even relative positions // within the real data structures. The exception to this is // that THE USER SID IS THE FIRST SID IN THE UserAndGroups // ARRAY. // // // ! ! ! ! IMPORTANT ! ! ! ! // // The access validation routines assume the SIDs are arranged // in a particular order within the variable part of the token. // Any changes to the order of the SIDs must be coordinated with // corresponding changes to the access validation routines. // // ! ! ! ! ! ! ! ! ! ! ! typedef struct _TOKEN { // // Fields arranged by size to preserve alignment. // Large fields before small fields. // // // The following fields are either ReadOnly or ReadWrite. // ReadOnly fields may be referenced any time a pointer to the // token is still valid. ReadWrite fields may only be referenced // when the TokenLock is held. // The dynamic part of the token (pointed to by the DynamicPart field) // is also protected by the token lock. // // ReadOnly fields are marked Ro: in their comment. // ReadWrite fields are marked Wr: in their comment. // TOKEN_SOURCE TokenSource; // Ro: 16-Bytes LUID TokenId; // Ro: 8-Bytes LUID AuthenticationId; // Ro: 8-Bytes LUID ParentTokenId; // Ro: 8-Bytes LARGE_INTEGER ExpirationTime; // Ro: 8-Bytes PERESOURCE TokenLock; // Ro: #if DBG || TOKEN_LEAK_MONITOR #define TRACE_SIZE 30 // // This code is for tracking token leaks, in conjunction with !obtrace. // HANDLE ProcessCid; // Cid of creator process HANDLE ThreadCid; // Cid of creator thread UCHAR ImageFileName[16]; // Image name of creator process ULONG CreateMethod; // Either 0xC (SepCreateToken) 0xD (SepDuplicateToken) or 0xF (SepFilterToken) ULONG_PTR CreateTrace[TRACE_SIZE]; // Stack backtrace that created this token (usermode part is first 20 nonzero stack entries) #endif // // Each time the security information in a token is changed, the // following ID is changed. Fields that cause this field to be // updated are marked as (Mod) in their comment field. // LUID ModifiedId; // Wr: 8-Bytes ULONG SessionId; // Wr: 4-bytes ULONG UserAndGroupCount; // Ro: 4-Bytes ULONG RestrictedSidCount; // Ro: 4-Bytes ULONG PrivilegeCount; // Ro: 4-Bytes ULONG VariableLength; // Ro: 4-Bytes ULONG DynamicCharged; // Ro: 4-Bytes ULONG DynamicAvailable; // Wr: 4-Bytes (Mod) ULONG DefaultOwnerIndex; // Wr: 4-Bytes (Mod) PSID_AND_ATTRIBUTES UserAndGroups; // Wr: 4-Bytes (Mod) PSID_AND_ATTRIBUTES RestrictedSids; // Ro: 4-Bytes PSID PrimaryGroup; // Wr: 4-Bytes (Mod) PLUID_AND_ATTRIBUTES Privileges; // Wr: 4-Bytes (Mod) PULONG DynamicPart; // Wr: 4-Bytes (Mod) PACL DefaultDacl; // Wr: 4-Bytes (Mod) TOKEN_TYPE TokenType; // Ro: 1-Byte SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; // Ro: 1-Byte UCHAR TokenFlags; // Ro: 4-Bytes BOOLEAN TokenInUse; // Wr: 1-Byte PSECURITY_TOKEN_PROXY_DATA ProxyData; // Ro: 4-Bytes PSECURITY_TOKEN_AUDIT_DATA AuditData; // Ro: 4-Bytes // // This marks the beginning of the variable part of the token. // It must follow all other fields in the token. // ULONG VariablePart; // Wr: 4-Bytes (Mod) } TOKEN, * PTOKEN; // // Where: // // TokenSource - Information provided by the executive component that // requested the logon that the token represents. // // // TokenId - Is an LUID value. Each token object has a uniquely // assigned LUID. // // // AuthenticationId - Is the LUID assigned by the domain controller for // the logon session. // // // ExpirationTime - Not yet supported in NT. // // // ModifiedId - Is an LUID which is changed each time a modification is // made to this token which changes the security semantics of the // token. This includes enabling/disabling privileges and groups // and changing default ACLs, et cetera. Any token which is a // duplicate of this token will have the same ModifiedId (until // one or the other is changed). This does not cover changes to // non-security semantics fields, like TokenInUse. // // // UserAndGroupCount - Indicates the number of user/group IDs in this token. // This value must be at least 1. A value of 1 indicates a user // ID with no supplemental group IDs. A value of 5 indicates a // user ID and 4 supplemental group IDs. // // PrivilegeCount - Indicates how many privileges are included in // this token. May be zero or larger. // // TokenType - Indicates which type of token this token object is. // // ImpersonationLevel - For TokenImpersonation type tokens, this field // indicates the impersonation level. For TokenPrimary type tokens, // this field is ignored. // // DynamicCharged - Indicates how much pool quota has been charged // for the dynamic portion of this token. // // DynamicAvailable - Indicates how much of the charged quota is still // available for use. This is modified when pool associated // with the dynamic portion of the token is allocated or freed, // such as when the default DACL or primary group is replaced. // // // DefaultOwnerIndex - If non-zero, identifies an ID that has explicitly // been established as the default owner for this token. If it is zero, // the standard default (user ID) is used as the default owner. // // UserAndGroups - Points to an array of SID_AND_ATTRIBUTES. The first // element in this array is the token's user ID. Any additional // elements are those of groups. The number of entries in this // array is one greater than // // PrimaryGroup - Points to an SID that is to be used as the primary // group of the token. There are no value restrictions // placed upon what can be used as a primary group. This // SID is not one of user or group IDs (although it may have the // same value as one of those IDs). // // Privileges - Points to an array of privileges represented as // LUID_AND_ATTRIBUTES. The number of elements in this array // is contained in the PrivilegesCount field. // // TokenInUse - Is a boolean that indicates whether a primary token // is already in use by a process. This field value is only // valid for primary tokens. // // ProxyData - Optionally points to a Proxy data structure, containing // the information to be passed to AVR routines by file systems. // This field being non-null identifies the token as a proxy token. // // AuditData - Optionally points to an Audit data structure, containing // global auditing data for this subject. // // NOTE: Access to this field is guarded by the global // PROCESS SECURITY FIELDS LOCK. // VariablePart - Is the beginning of the variable part of the token. // //////////////////////////////////////////////////////////////////////// // // Internal version of Object Type list // //////////////////////////////////////////////////////////////////////// typedef struct _IOBJECT_TYPE_LIST { USHORT Level; USHORT Flags; #define OBJECT_SUCCESS_AUDIT 0x1 #define OBJECT_FAILURE_AUDIT 0x2 GUID ObjectType; LONG ParentIndex; ULONG Remaining; ULONG CurrentGranted; ULONG CurrentDenied; } IOBJECT_TYPE_LIST, *PIOBJECT_TYPE_LIST; NTSTATUS SeCaptureObjectTypeList ( IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL, IN ULONG ObjectTypeListLength, IN KPROCESSOR_MODE RequestorMode, OUT PIOBJECT_TYPE_LIST *CapturedObjectTypeList ); VOID SeFreeCapturedObjectTypeList( IN PVOID ObjectTypeList ); ///////////////////////////////////////////////////////////////////////// // // // Token Specific Macros // // // ///////////////////////////////////////////////////////////////////////// #ifndef TOKEN_DIAGNOSTICS_ENABLED #define SepAcquireTokenReadLock(T) KeEnterCriticalRegion(); \ ExAcquireResourceSharedLite((T)->TokenLock, TRUE) #define SepAcquireTokenWriteLock(T) KeEnterCriticalRegion(); \ ExAcquireResourceExclusiveLite((T)->TokenLock, TRUE) #define SepReleaseTokenReadLock(T) ExReleaseResourceLite((T)->TokenLock); \ KeLeaveCriticalRegion() #else // TOKEN_DIAGNOSTICS_ENABLED #define SepAcquireTokenReadLock(T) if (TokenGlobalFlag & TOKEN_DIAG_TOKEN_LOCKS) { \ DbgPrint("SE (Token): Acquiring Token READ Lock for access to token 0x%lx\n", (T)); \ } \ KeEnterCriticalRegion(); \ ExAcquireResourceSharedLite((T)->TokenLock, TRUE) #define SepAcquireTokenWriteLock(T) if (TokenGlobalFlag & TOKEN_DIAG_TOKEN_LOCKS) { \ DbgPrint("SE (Token): Acquiring Token WRITE Lock for access to token 0x%lx ********************* EXCLUSIVE *****\n", (T)); \ } \ KeEnterCriticalRegion(); \ ExAcquireResourceExclusiveLite((T)->TokenLock, TRUE) #define SepReleaseTokenReadLock(T) if (TokenGlobalFlag & TOKEN_DIAG_TOKEN_LOCKS) { \ DbgPrint("SE (Token): Releasing Token Lock for access to token 0x%lx\n", (T)); \ } \ ExReleaseResourceLite((T)->TokenLock); \ KeLeaveCriticalRegion() #endif // TOKEN_DIAGNOSTICS_ENABLED #define SepReleaseTokenWriteLock(T,M) \ { \ if ((M)) { \ ExAllocateLocallyUniqueId( &((PTOKEN)(T))->ModifiedId ); \ } \ SepReleaseTokenReadLock( T ); \ } // // Reference individual privilege attribute flags of any privilege array // // P - is a pointer to an array of privileges (PLUID_AND_ATTRIBUTES) // I - is the index of the privilege // A - is the name of the attribute desired (e.g., Enabled, EnabledByDefault, etc. ) // #define SepArrayPrivilegeAttributes(P,I) ( (P)[I].Attributes ) // // Reference individual privilege attribute flags of token privileges // // T - is a pointer to a token // I - is the index of the privilege // A - is the name of the attribute desired (e.g., Enabled, EnabledByDefault, etc. ) // #define SepTokenPrivilegeAttributes(T,I) ( (T)->Privileges[I].Attributes ) // // Reference individual group attribute flags of any group array // // G - is a pointer to the array of groups (SID_AND_ATTRIBUTES[]) // I - is the index of the group // #define SepArrayGroupAttributes(G,I) ( (G)[I].Attributes ) // // Reference individual group attribute flags of token groups // // T - is a pointer to a token // I - is the index of the group // #define SepTokenGroupAttributes(T,I) ( (T)->UserAndGroups[I].Attributes ) //////////////////////////////////////////////////////////////////////// // // // Private Routine Declarations // // // //////////////////////////////////////////////////////////////////////// NTSTATUS SepAdjustGroups( IN PTOKEN Token, IN BOOLEAN MakeChanges, IN BOOLEAN ResetToDefault, IN ULONG GroupCount OPTIONAL, IN PSID_AND_ATTRIBUTES NewState OPTIONAL, OUT PTOKEN_GROUPS PreviousState OPTIONAL, OUT PSID SidBuffer OPTIONAL, OUT PULONG ReturnLength, OUT PULONG ChangeCount, OUT PBOOLEAN ChangesMade ); NTSTATUS SepAdjustPrivileges( IN PTOKEN Token, IN BOOLEAN MakeChanges, IN BOOLEAN DisableAllPrivileges, IN ULONG PrivilegeCount OPTIONAL, IN PLUID_AND_ATTRIBUTES NewState OPTIONAL, OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL, OUT PULONG ReturnLength, OUT PULONG ChangeCount, OUT PBOOLEAN ChangesMade ); VOID SepAppendDefaultDacl( IN PTOKEN Token, IN PACL PAcl ); VOID SepAppendPrimaryGroup( IN PTOKEN Token, IN PSID PSid ); NTSTATUS SepDuplicateToken( IN PTOKEN ExistingToken, IN POBJECT_ATTRIBUTES ObjectAttributes, IN BOOLEAN EffectiveOnly, IN TOKEN_TYPE TokenType, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel OPTIONAL, IN KPROCESSOR_MODE RequestorMode, OUT PTOKEN *DuplicateToken ); NTSTATUS SepFilterToken( IN PTOKEN ExistingToken, IN KPROCESSOR_MODE RequestorMode, IN ULONG Flags, IN ULONG GroupCount, IN PSID_AND_ATTRIBUTES GroupsToDisable OPTIONAL, IN ULONG PrivilegeCount, IN PLUID_AND_ATTRIBUTES PrivilegesToDelete OPTIONAL, IN ULONG SidCount, IN PSID_AND_ATTRIBUTES RestrictedSids OPTIONAL, IN ULONG SidLength, OUT PTOKEN * FilteredToken ); BOOLEAN SepSidInSidAndAttributes ( IN PSID_AND_ATTRIBUTES SidAndAttributes, IN ULONG SidCount, IN PSID PrincipalSelfSid, IN PSID Sid ); VOID SepRemoveDisabledGroupsAndPrivileges( IN PTOKEN Token, IN ULONG Flags, IN ULONG GroupCount, IN PSID_AND_ATTRIBUTES GroupsToDisable, IN ULONG PrivilegeCount, IN PLUID_AND_ATTRIBUTES PrivilegesToDelete ); VOID SepFreeDefaultDacl( IN PTOKEN Token ); VOID SepFreePrimaryGroup( IN PTOKEN Token ); NTSTATUS SepExpandDynamic( IN PTOKEN Token, IN ULONG NewLength ); BOOLEAN SepIdAssignableAsOwner( IN PTOKEN Token, IN ULONG Index ); VOID SepMakeTokenEffectiveOnly( IN PTOKEN Token ); BOOLEAN SepTokenInitialization( VOID ); VOID SepTokenDeleteMethod ( IN PVOID Token ); // // These are here because if they are placed in sep.h, we don't // have the PTOKEN datatype available. // BOOLEAN SepPrivilegeCheck( IN PTOKEN Token, IN OUT PLUID_AND_ATTRIBUTES RequiredPrivileges, IN ULONG RequiredPrivilegeCount, IN ULONG PrivilegeSetControl, IN KPROCESSOR_MODE PreviousMode ); BOOLEAN SepAccessCheck ( IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSID PrincipalSelfSid, IN PTOKEN PrimaryToken, IN PTOKEN ClientToken OPTIONAL, IN ACCESS_MASK DesiredAccess, IN PIOBJECT_TYPE_LIST ObjectTypeList OPTIONAL, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, IN ACCESS_MASK PreviouslyGrantedAccess, IN KPROCESSOR_MODE PreviousMode, OUT PACCESS_MASK GrantedAccess, OUT PPRIVILEGE_SET *Privileges OPTIONAL, OUT PNTSTATUS AccessStatus, IN BOOLEAN ReturnResultList, OUT PBOOLEAN ReturnSomeAccessGranted, OUT PBOOLEAN ReturnSomeAccessDenied ); BOOLEAN SepObjectInTypeList ( IN GUID *ObjectType, IN PIOBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, OUT PULONG ReturnedIndex ); #ifdef TOKEN_DEBUG VOID SepDumpToken( IN PTOKEN T ); #endif //TOKEN_DEBUG //////////////////////////////////////////////////////////////////////// // // // Global Variables // // // //////////////////////////////////////////////////////////////////////// extern const GENERIC_MAPPING SepTokenMapping; extern POBJECT_TYPE SeTokenObjectType; //extern ERESOURCE SepTokenLock; #ifdef TOKEN_DIAGNOSTICS_ENABLED extern ULONG TokenGlobalFlag; #endif // TOKEN_DIAGNOSTICS_ENABLED #endif // _TOKENP_