/*++ Copyright (c) 1996 Microsoft Corporation Module Name: service.cpp Abstract: Routines to configure/analyze general settings of services plus some helper APIs Author: Jin Huang (jinhuang) 25-Jun-1997 Revision History: --*/ #include "headers.h" #include "serverp.h" #include "service.h" #include "pfp.h" //#define SCESVC_DBG 1 SCESTATUS ScepConfigureGeneralServices( IN PSCECONTEXT hProfile, IN PSCE_SERVICES pServiceList, IN DWORD ConfigOptions ) /* Routine Descripton: Configure startup and security descriptor settings for the list of services passed in. Arguments: pServiceList - the list of services to configure Return Value: SCE status */ { SCESTATUS SceErr=SCESTATUS_SUCCESS; PSCE_SERVICES pNode; DWORD nServices=0; BOOL bDoneSettingSaclDacl = FALSE; NTSTATUS NtStatus = 0; SID_IDENTIFIER_AUTHORITY IdAuth=SECURITY_NT_AUTHORITY; DWORD rcSaveRsop = ERROR_SUCCESS; PSCESECTION hSectionDomain=NULL; PSCESECTION hSectionTattoo=NULL; PSCE_SERVICES pServiceCurrent=NULL; DWORD ServiceLen=0; if ( (ConfigOptions & SCE_POLICY_TEMPLATE) && ScepIsSystemShutDown() ) { return(SCESTATUS_SERVICE_NOT_SUPPORT); } if ( pServiceList != NULL ) { SC_HANDLE hScManager; // // open the manager // hScManager = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS // SC_MANAGER_CONNECT | // SC_MANAGER_QUERY_LOCK_STATUS | // SC_MANAGER_MODIFY_BOOT_CONFIG ); SC_HANDLE hService=NULL; DWORD rc=NO_ERROR; if ( NULL == hScManager ) { rc = GetLastError(); ScepLogOutput3(1, rc, SCEDLL_ERROR_OPEN, L"Service Control Manager"); ScepPostProgress(TICKS_GENERAL_SERVICES, AREA_SYSTEM_SERVICE, NULL); return( ScepDosErrorToSceStatus(rc) ); } LPQUERY_SERVICE_CONFIG pConfig=NULL; DWORD BytesNeeded; // // Adjust privilege for setting SACL // rc = SceAdjustPrivilege( SE_SECURITY_PRIVILEGE, TRUE, NULL ); // // if can't adjust privilege, ignore (will error out later if SACL is requested) // if ( rc != NO_ERROR ) { ScepLogOutput3(1, rc, SCEDLL_ERROR_ADJUST, L"SE_SECURITY_PRIVILEGE"); rc = NO_ERROR; } // // Adjust privilege for setting ownership (if required) // rc = SceAdjustPrivilege( SE_TAKE_OWNERSHIP_PRIVILEGE, TRUE, NULL ); // // if can't adjust privilege, ignore (will error out later if acls need to be written) // if ( rc != NO_ERROR ) { ScepLogOutput3(1, rc, SCEDLL_ERROR_ADJUST, L"SE_TAKE_OWNERSHIP_PRIVILEGE"); rc = NO_ERROR; } // // get AdminsSid in case need to take ownership later // NtStatus = RtlAllocateAndInitializeSid( &IdAuth, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdminsSid ); // // open the policy/tattoo tables // if ( ConfigOptions & SCE_POLICY_TEMPLATE ) { ScepTattooOpenPolicySections( hProfile, szServiceGeneral, &hSectionDomain, &hSectionTattoo ); } // // Loop through each service to set general setting // for ( pNode=pServiceList; pNode != NULL && rc == NO_ERROR; pNode = pNode->Next ) { // // print the service name // if ( nServices < TICKS_GENERAL_SERVICES ) { ScepPostProgress(1, AREA_SYSTEM_SERVICE, pNode->ServiceName); nServices++; } ScepLogOutput3(2,0, SCEDLL_SCP_CONFIGURE, pNode->ServiceName); if ( (ConfigOptions & SCE_POLICY_TEMPLATE) && ScepIsSystemShutDown() ) { rc = ERROR_NOT_SUPPORTED; break; } ServiceLen = 0; if ( (ConfigOptions & SCE_POLICY_TEMPLATE) && hSectionDomain && hSectionTattoo ) { // // check if we need to query current setting for the service // ServiceLen = wcslen(pNode->ServiceName); if ( ScepTattooIfQueryNeeded(hSectionDomain, hSectionTattoo, pNode->ServiceName, ServiceLen, NULL, NULL ) ) { rc = ScepQueryAndAddService( hScManager, pNode->ServiceName, NULL, &pServiceCurrent ); if ( ERROR_SUCCESS != rc ) { ScepLogOutput3(1,0,SCESRV_POLICY_TATTOO_ERROR_QUERY,rc,pNode->ServiceName); rc = NO_ERROR; } else { ScepLogOutput3(3,0,SCESRV_POLICY_TATTOO_QUERY,pNode->ServiceName); } } } bDoneSettingSaclDacl = FALSE; rcSaveRsop = ERROR_SUCCESS; // // open the service // hService = OpenService( hScManager, pNode->ServiceName, SERVICE_QUERY_CONFIG | SERVICE_CHANGE_CONFIG | READ_CONTROL | WRITE_DAC | // WRITE_OWNER | owner can't be set for a service ACCESS_SYSTEM_SECURITY ); // if access was denied, try to take ownership // and try to open service again if (hService == NULL && (ERROR_ACCESS_DENIED == (rc = GetLastError())) && pNode->General.pSecurityDescriptor) { DWORD rcTakeOwnership = NO_ERROR; if (AdminsSid) { if ( NO_ERROR == (rcTakeOwnership = SetNamedSecurityInfo( (LPWSTR)pNode->ServiceName, SE_SERVICE, OWNER_SECURITY_INFORMATION, AdminsSid, NULL, NULL, NULL ))) { // // ownership changed, open service again and set SACL and DACL // get a handle to set security // if ( hService = OpenService( hScManager, pNode->ServiceName, READ_CONTROL | WRITE_DAC | ACCESS_SYSTEM_SECURITY )) { if ( SetServiceObjectSecurity( hService, pNode->SeInfo & (DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION), pNode->General.pSecurityDescriptor ) ) { bDoneSettingSaclDacl = TRUE; CloseServiceHandle(hService); hService = NULL; // // re-open the service only if there are other config info // to set (startup type). // So when NOSTARTTYPE is set, do not need to reopen the service // if (!(ConfigOptions & SCE_SETUP_SERVICE_NOSTARTTYPE)) { if (!(hService = OpenService( hScManager, pNode->ServiceName, SERVICE_QUERY_CONFIG | SERVICE_CHANGE_CONFIG )) ) { rc = GetLastError(); } else { // //clear any error we have seen so far since everything has succeeded // rc = NO_ERROR; } } } else { // // shouldn't fail here unless Service Control Manager // fails for some reason. // rc = GetLastError(); } } else { // // still fail to open the service to set DACL. this should // not happen for admin logons since the current logon is // one of the owner. But for normal user logon, this could // fail (actually normal user logon should fail to set // the owner rc = GetLastError(); } } } else { // // AdminSid failed to be initialized, get the error // rcTakeOwnership = RtlNtStatusToDosError(NtStatus); } if ( NO_ERROR != rcTakeOwnership || NO_ERROR != rc ) { // // log the error occurred in take ownership process // reset error back to access denied so it will also be // logged as failure to open the service // if (NO_ERROR != rcTakeOwnership) ScepLogOutput3(2,rcTakeOwnership, SCEDLL_ERROR_TAKE_OWNER, (LPWSTR)pNode->ServiceName); else ScepLogOutput3(2, rc, SCEDLL_ERROR_OPEN, (LPWSTR)pNode->ServiceName); rc = ERROR_ACCESS_DENIED; } } if ( hService != NULL ) { if (ConfigOptions & SCE_SETUP_SERVICE_NOSTARTTYPE) { // // do not configure service start type // if ( pNode->General.pSecurityDescriptor != NULL ) { if ( !SetServiceObjectSecurity( hService, pNode->SeInfo & (DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION), pNode->General.pSecurityDescriptor ) ) { rc = GetLastError(); } else bDoneSettingSaclDacl = TRUE; } } else { // // query the length of config // if ( !QueryServiceConfig( hService, NULL, 0, &BytesNeeded ) ) { rc = GetLastError(); if ( rc == ERROR_INSUFFICIENT_BUFFER ) { pConfig = (LPQUERY_SERVICE_CONFIG)ScepAlloc(0, BytesNeeded); if ( pConfig != NULL ) { // // the real query of config // if ( QueryServiceConfig( hService, pConfig, BytesNeeded, &BytesNeeded ) ) { rc = ERROR_SUCCESS; // // change pConfig->dwStartType to the new value // if ( pNode->Startup != (BYTE)(pConfig->dwStartType) ) { // // congigure the service startup // if ( !ChangeServiceConfig( hService, pConfig->dwServiceType, pNode->Startup, pConfig->dwErrorControl, pConfig->lpBinaryPathName, pConfig->lpLoadOrderGroup, NULL, pConfig->lpDependencies, pConfig->lpServiceStartName, NULL, pConfig->lpDisplayName ) ) { rc = GetLastError(); } } if ( rc == NO_ERROR && pNode->General.pSecurityDescriptor != NULL && !bDoneSettingSaclDacl) { if ( !SetServiceObjectSecurity( hService, pNode->SeInfo & (DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION), pNode->General.pSecurityDescriptor ) ) { rc = GetLastError(); } else bDoneSettingSaclDacl = TRUE; } } else { rc = GetLastError(); ScepLogOutput3(3,rc, SCEDLL_ERROR_QUERY_INFO, pNode->ServiceName); } ScepFree(pConfig); pConfig = NULL; } else { // // cannot allocate pConfig // rc = ERROR_NOT_ENOUGH_MEMORY; } } else { ScepLogOutput3(3,rc, SCEDLL_ERROR_QUERY_INFO, pNode->ServiceName); } } else { // // should not fall in here // rc = ERROR_SUCCESS; } } CloseServiceHandle (hService); hService = NULL; if ( rc != NO_ERROR ) { ScepLogOutput3(1, rc, SCEDLL_SCP_ERROR_CONFIGURE, pNode->ServiceName); rcSaveRsop = rc; if ( ERROR_INVALID_OWNER == rc || ERROR_INVALID_PRIMARY_GROUP == rc || ERROR_INVALID_SECURITY_DESCR == rc || ERROR_INVALID_ACL == rc || ERROR_ACCESS_DENIED == rc ) { gWarningCode = rc; rc = NO_ERROR; } } else if ( !(ConfigOptions & SCE_SETUP_SERVICE_NOSTARTTYPE) && pNode->Startup == SERVICE_DISABLED ) { // // if the service type is "disabled", we should also stop the service // if ( hService = OpenService( hScManager, pNode->ServiceName, SERVICE_STOP )) { SERVICE_STATUS ServiceStatus; if (!ControlService(hService, SERVICE_CONTROL_STOP, &ServiceStatus )) { if ( ERROR_SERVICE_NOT_ACTIVE != GetLastError() ) { ScepLogOutput3(2, GetLastError(), SCEDLL_SCP_ERROR_STOP, pNode->ServiceName); } } CloseServiceHandle (hService); hService = NULL; } else { ScepLogOutput3(2, GetLastError(), SCEDLL_SCP_ERROR_OPENFORSTOP, pNode->ServiceName); } } } else { // // cannot open the service or some error taking ownership // if (rc != NO_ERROR) { ScepLogOutput3(1, rc, SCEDLL_ERROR_OPEN, pNode->ServiceName); // either of setting security/startup type failed - save it for RSOP log rcSaveRsop = (rcSaveRsop == ERROR_SUCCESS ? rc: rcSaveRsop); if ( rc == ERROR_SERVICE_DOES_NOT_EXIST ) rc = NO_ERROR; } } if (ConfigOptions & SCE_RSOP_CALLBACK) ScepRsopLog(SCE_RSOP_SERVICES_INFO, rcSaveRsop != NO_ERROR ? rcSaveRsop : rc, pNode->ServiceName, 0, 0); if ( (ConfigOptions & SCE_POLICY_TEMPLATE) && hSectionDomain && hSectionTattoo ) { // // manage the tattoo value of this one // ScepTattooManageOneServiceValue( hSectionDomain, hSectionTattoo, pNode->ServiceName, ServiceLen, pServiceCurrent, rc ); } if ( pServiceCurrent ) { SceFreePSCE_SERVICES(pServiceCurrent); pServiceCurrent = NULL; } } CloseServiceHandle (hScManager); if (AdminsSid) { RtlFreeSid(AdminsSid); AdminsSid = NULL; } SceAdjustPrivilege( SE_TAKE_OWNERSHIP_PRIVILEGE, FALSE, NULL ); SceAdjustPrivilege( SE_SECURITY_PRIVILEGE, FALSE, NULL ); SceErr = ScepDosErrorToSceStatus(rc); } if ( nServices < TICKS_GENERAL_SERVICES ) { ScepPostProgress(TICKS_GENERAL_SERVICES-nServices, AREA_SYSTEM_SERVICE, NULL); } SceJetCloseSection(&hSectionDomain, TRUE); SceJetCloseSection(&hSectionTattoo, TRUE); return(SceErr); } SCESTATUS ScepAnalyzeGeneralServices( IN PSCECONTEXT hProfile, IN DWORD Options ) /* Routine Description: Analyze all available services on the current system. The base profile (SCEP) is in hProfile Arguments: hProfile - the database context handle Return Value: SCE status */ { if ( hProfile == NULL ) { ScepPostProgress(TICKS_GENERAL_SERVICES, AREA_SYSTEM_SERVICE, NULL); return(SCESTATUS_INVALID_PARAMETER); } SCESTATUS rc; PSCE_SERVICES pServiceList=NULL; DWORD nServices=0; rc = SceEnumerateServices( &pServiceList, FALSE ); rc = ScepDosErrorToSceStatus(rc); if ( rc == SCESTATUS_SUCCESS ) { PSCESECTION hSectionScep=NULL, hSectionSap=NULL; // // open the sap section. If it is not there, creates it // rc = ScepStartANewSection( hProfile, &hSectionSap, (Options & SCE_GENERATE_ROLLBACK) ? SCEJET_TABLE_SMP : SCEJET_TABLE_SAP, szServiceGeneral ); if ( rc == SCESTATUS_SUCCESS ) { PSCE_SERVICES pNode = pServiceList; // // open SCEP section. should be success always because the StartANewSection // creates the section if it is not there // rc = ScepOpenSectionForName( hProfile, (Options & SCE_GENERATE_ROLLBACK) ? SCE_ENGINE_SMP : SCE_ENGINE_SCP, // SCE_ENGINE_SMP, szServiceGeneral, &hSectionScep ); if ( rc == SCESTATUS_SUCCESS ) { // // analyze each service // PSCE_SERVICES pOneService=NULL; BOOL IsDifferent; for ( pNode=pServiceList; pNode != NULL; pNode=pNode->Next ) { ScepLogOutput3(2, 0, SCEDLL_SAP_ANALYZE, pNode->ServiceName); if ( nServices < TICKS_SPECIFIC_SERVICES ) { ScepPostProgress(1, AREA_SYSTEM_SERVICE, NULL); nServices++; } // // get setting from the SMP profile // rc = ScepGetSingleServiceSetting( hSectionScep, pNode->ServiceName, &pOneService ); if ( rc == SCESTATUS_SUCCESS ) { // // there is a SMP entry for the service, compare and save // rc = ScepCompareSingleServiceSetting( pOneService, pNode, &IsDifferent ); if ( rc == SCESTATUS_SUCCESS && IsDifferent ) { // // write the service as mismatch // pNode->Status = (Options & SCE_GENERATE_ROLLBACK) ? 0 : SCE_STATUS_MISMATCH; pNode->SeInfo = pOneService->SeInfo; rc = ScepSetSingleServiceSetting( hSectionSap, pNode ); } } else if ( rc == SCESTATUS_RECORD_NOT_FOUND ) { // // this service is not defined // if ( !(Options & SCE_GENERATE_ROLLBACK) ) { // // save the record with not configured status // pNode->Status = SCE_STATUS_NOT_CONFIGURED; rc = ScepSetSingleServiceSetting( hSectionSap, pNode ); } else { // // ignore this one // rc = SCESTATUS_SUCCESS; } } SceFreePSCE_SERVICES(pOneService); pOneService = NULL; if ( rc != SCESTATUS_SUCCESS ) { ScepLogOutput3(1, ScepSceStatusToDosError(rc), SCEDLL_SAP_ERROR_ANALYZE, pNode->ServiceName); if ( SCESTATUS_ACCESS_DENIED == rc ) { gWarningCode = ScepSceStatusToDosError(rc); if ( !(Options & SCE_GENERATE_ROLLBACK) ) { // // raise a error status // pNode->Status = SCE_STATUS_ERROR_NOT_AVAILABLE; rc = ScepSetSingleServiceSetting( hSectionSap, pNode ); } rc = SCESTATUS_SUCCESS; } else { break; } } } SceJetCloseSection(&hSectionScep, TRUE); } if ( !(Options & SCE_GENERATE_ROLLBACK ) ) { // // raise any error item // for ( PSCE_SERVICES pNodeTmp=pNode; pNodeTmp != NULL; pNodeTmp = pNodeTmp->Next ) { pNodeTmp->Status = SCE_STATUS_ERROR_NOT_AVAILABLE; ScepSetSingleServiceSetting( hSectionSap, pNode ); } } SceJetCloseSection(&hSectionSap, TRUE); } if ( rc != SCESTATUS_SUCCESS ) ScepLogOutput3(1, ScepSceStatusToDosError(rc), SCEDLL_SAP_ERROR_OUT); } if ( nServices < TICKS_GENERAL_SERVICES ) { ScepPostProgress(TICKS_GENERAL_SERVICES-nServices, AREA_SYSTEM_SERVICE, NULL); } return(rc); } SCESTATUS ScepGetSingleServiceSetting( IN PSCESECTION hSection, IN PWSTR ServiceName, OUT PSCE_SERVICES *pOneService ) /* Routine Description: Get service settings for the service from the section Arguments: hSection - the section handle ServiceName - the service name pOneService - the service settings Return Value: SCE status */ { if ( hSection == NULL || ServiceName == NULL || pOneService == NULL ) { return(SCESTATUS_INVALID_PARAMETER); } SCESTATUS rc; DWORD ValueLen; // // seek to the record and get length for name and value // rc = SceJetGetValue( hSection, SCEJET_EXACT_MATCH_NO_CASE, ServiceName, NULL, 0, NULL, NULL, 0, &ValueLen ); if ( rc == SCESTATUS_SUCCESS ) { PWSTR Value=NULL; // // allocate memory for the service name and value string // Value = (PWSTR)ScepAlloc( LMEM_ZEROINIT, ValueLen+2); if ( Value != NULL ) { // // Get the service and its value // rc = SceJetGetValue( hSection, SCEJET_CURRENT, NULL, NULL, 0, NULL, Value, ValueLen, &ValueLen ); if ( rc == SCESTATUS_SUCCESS ) { Value[ValueLen/2] = L'\0'; DWORD Win32Rc=NO_ERROR; PSECURITY_DESCRIPTOR pTempSD=NULL; DWORD SDsize=0; SECURITY_INFORMATION SeInfo=0; if ( ValueLen >= 2 && Value[1] != L'\0' ) { // // convert to security descriptor // Win32Rc = ConvertTextSecurityDescriptor( Value+1, &pTempSD, &SDsize, &SeInfo ); } if ( Win32Rc == NO_ERROR ) { ScepChangeAclRevision(pTempSD, ACL_REVISION); // // create this service node // *pOneService = (PSCE_SERVICES)ScepAlloc( LMEM_FIXED, sizeof(SCE_SERVICES) ); if ( *pOneService != NULL ) { (*pOneService)->ServiceName = (PWSTR)ScepAlloc(LMEM_FIXED, (wcslen(ServiceName)+1)*sizeof(WCHAR)); if ( (*pOneService)->ServiceName != NULL ) { wcscpy( (*pOneService)->ServiceName, ServiceName); (*pOneService)->DisplayName = NULL; (*pOneService)->Status = *((BYTE *)Value); (*pOneService)->Startup = *((BYTE *)Value+1); (*pOneService)->General.pSecurityDescriptor = pTempSD; (*pOneService)->SeInfo = SeInfo; (*pOneService)->Next = NULL; // // DO NOT free the following buffers // pTempSD = NULL; } else { rc = SCESTATUS_NOT_ENOUGH_RESOURCE; ScepFree(*pOneService); } } else { rc = SCESTATUS_NOT_ENOUGH_RESOURCE; } if ( pTempSD != NULL ) { ScepFree(pTempSD); } } else { rc = ScepDosErrorToSceStatus(Win32Rc); } } ScepFree(Value); } else rc = SCESTATUS_NOT_ENOUGH_RESOURCE; } return(rc); } SCESTATUS ScepCompareSingleServiceSetting( IN PSCE_SERVICES pNode1, IN PSCE_SERVICES pNode2, OUT PBOOL pIsDifferent ) /* Routine Description: Comare two service settings. Arguments: pNode1 - the first service pNode2 - the second service pIsDifferent - output TRUE if different Return Value: SCE status */ { SCESTATUS rc=SCESTATUS_SUCCESS; if ( pNode1->Startup == pNode2->Startup ) { BYTE resultSD = 0; rc = ScepCompareObjectSecurity( SE_SERVICE, FALSE, pNode1->General.pSecurityDescriptor, pNode2->General.pSecurityDescriptor, pNode1->SeInfo & (DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION), &resultSD ); if ( resultSD ) { *pIsDifferent = TRUE; } else *pIsDifferent = FALSE; } else *pIsDifferent = TRUE; return(rc); } SCESTATUS ScepSetSingleServiceSetting( IN PSCESECTION hSection, IN PSCE_SERVICES pOneService ) /* Routine Description: Set service settings for the service from the section Arguments: hSection - the section handle pOneService - the service settings Return Value: SCE status */ { if ( hSection == NULL || pOneService == NULL ) { return(SCESTATUS_INVALID_PARAMETER); } SCESTATUS rc=SCESTATUS_SUCCESS; PWSTR SDspec=NULL; DWORD SDsize=0; if ( (pOneService->Status != SCE_STATUS_NOT_ANALYZED) && (pOneService->Status != SCE_STATUS_ERROR_NOT_AVAILABLE) && (pOneService->General.pSecurityDescriptor != NULL) ) { DWORD Win32Rc; Win32Rc = ConvertSecurityDescriptorToText ( pOneService->General.pSecurityDescriptor, pOneService->SeInfo, &SDspec, &SDsize // number of w-chars ); rc = ScepDosErrorToSceStatus(Win32Rc); } if ( rc == SCESTATUS_SUCCESS ) { PWSTR Value=NULL; DWORD ValueLen; ValueLen = (SDsize+1)*sizeof(WCHAR); Value = (PWSTR)ScepAlloc( (UINT)0, ValueLen+sizeof(WCHAR) ); if ( Value != NULL ) { // // The first byte is status, the second byte is startup // *((BYTE *)Value) = pOneService->Status; *((BYTE *)Value+1) = pOneService->Startup; if ( SDspec != NULL ) { swprintf(Value+1, L"%s", SDspec ); } Value[SDsize+1] = L'\0'; //terminate this string // // set the value // rc = SceJetSetLine( hSection, pOneService->ServiceName, FALSE, Value, ValueLen, 0 ); ScepFree( Value ); switch ( pOneService->Status ) { case SCE_STATUS_ERROR_NOT_AVAILABLE: ScepLogOutput3(2, 0, SCEDLL_STATUS_ERROR, pOneService->ServiceName); break; case SCE_STATUS_NOT_CONFIGURED: ScepLogOutput3(2, 0, SCEDLL_STATUS_NC, pOneService->ServiceName); break; case SCE_STATUS_NOT_ANALYZED: ScepLogOutput3(2, 0, SCEDLL_STATUS_NEW, pOneService->ServiceName); break; default: ScepLogOutput3(2, 0, SCEDLL_STATUS_MISMATCH, pOneService->ServiceName); break; } } else rc = SCESTATUS_NOT_ENOUGH_RESOURCE; } if ( SDspec != NULL ) { ScepFree( SDspec ); } return(rc); } SCESTATUS ScepInvokeSpecificServices( IN PSCECONTEXT hProfile, IN BOOL bConfigure, IN SCE_ATTACHMENT_TYPE aType ) /* Routine Description: Call each service engine for configure or analyze Arguments: hProfile - the profile handle bConfigure - TRUE = to configure, FALSE=to analyze aType - attachment type "services" or "policy" Return Value: SCE status */ { // // for posting progress // DWORD nServices=0; AREA_INFORMATION Area=0; DWORD nMaxTicks=0; switch(aType) { case SCE_ATTACHMENT_SERVICE: Area = AREA_SYSTEM_SERVICE; nMaxTicks = TICKS_SPECIFIC_SERVICES; break; case SCE_ATTACHMENT_POLICY: Area = AREA_SECURITY_POLICY; nMaxTicks = TICKS_SPECIFIC_POLICIES; break; } if ( hProfile == NULL ) { ScepPostProgress(nMaxTicks, Area, NULL); return(SCESTATUS_INVALID_PARAMETER); } // // call available service engines to configure specific setting // SCESTATUS SceErr ; PSCE_SERVICES pSvcEngineList=NULL; SCEP_HANDLE sceHandle; SCESVC_CALLBACK_INFO sceCbInfo; SceErr = ScepEnumServiceEngines(&pSvcEngineList, aType); if ( SceErr == SCESTATUS_SUCCESS) { HINSTANCE hDll; PF_ConfigAnalyzeService pfTemp; for ( PSCE_SERVICES pNode=pSvcEngineList; pNode != NULL; pNode = pNode->Next ) { ScepLogOutput3(2, 0, SCEDLL_LOAD_ATTACHMENT, pNode->ServiceName); if ( nServices < nMaxTicks ) { ScepPostProgress(1, Area, pNode->ServiceName); nServices++; } // // load the dll. // hDll = LoadLibrary(pNode->General.ServiceEngineName); if ( hDll != NULL ) { if ( bConfigure ) { // // call SceSvcAttachmentConfig from the dll // pfTemp = (PF_ConfigAnalyzeService) GetProcAddress(hDll, "SceSvcAttachmentConfig") ; } else { // // call SceSvcAttachmentAnalyze from the dll // pfTemp = (PF_ConfigAnalyzeService) GetProcAddress(hDll, "SceSvcAttachmentAnalyze") ; } if ( pfTemp != NULL ) { // // prepare the handle first // sceHandle.hProfile = (PVOID)hProfile; sceHandle.ServiceName = (PCWSTR)(pNode->ServiceName); sceCbInfo.sceHandle = &sceHandle; sceCbInfo.pfQueryInfo = &SceCbQueryInfo; sceCbInfo.pfSetInfo = &SceCbSetInfo; sceCbInfo.pfFreeInfo = &SceSvcpFreeMemory; sceCbInfo.pfLogInfo = &ScepLogOutput2; // // call the SceSvcAttachmentConfig/Analyze from the DLL // __try { SceErr = (*pfTemp)((PSCESVC_CALLBACK_INFO)&sceCbInfo); } __except (EXCEPTION_EXECUTE_HANDLER) { SceErr = SCESTATUS_SERVICE_NOT_SUPPORT; } } else { // // this API is not supported // SceErr = SCESTATUS_SERVICE_NOT_SUPPORT; } // // try to free the library handle. If it fails, just leave it // to to the process to terminate // FreeLibrary(hDll); } else SceErr = SCESTATUS_SERVICE_NOT_SUPPORT; if ( SceErr == SCESTATUS_SERVICE_NOT_SUPPORT ) { if ( bConfigure ) ScepLogOutput3(1, ScepSceStatusToDosError(SceErr), SCEDLL_SCP_NOT_SUPPORT); else ScepLogOutput3(1, ScepSceStatusToDosError(SceErr), SCEDLL_SAP_NOT_SUPPORT); SceErr = SCESTATUS_SUCCESS; } else if ( SceErr != SCESTATUS_SUCCESS && SceErr != SCESTATUS_RECORD_NOT_FOUND ) { ScepLogOutput3(1, ScepSceStatusToDosError(SceErr), SCEDLL_ERROR_LOAD, pNode->ServiceName); } if ( SceErr != SCESTATUS_SUCCESS && SceErr != SCESTATUS_SERVICE_NOT_SUPPORT && SceErr != SCESTATUS_RECORD_NOT_FOUND ) break; } // // free the buffer // SceFreePSCE_SERVICES(pSvcEngineList); } else if ( SceErr != SCESTATUS_SUCCESS && SceErr != SCESTATUS_PROFILE_NOT_FOUND && SceErr != SCESTATUS_RECORD_NOT_FOUND ) { ScepLogOutput3(1, ScepSceStatusToDosError(SceErr), SCEDLL_SAP_ERROR_ENUMERATE, L"services"); } if ( SceErr == SCESTATUS_PROFILE_NOT_FOUND || SceErr == SCESTATUS_RECORD_NOT_FOUND || SceErr == SCESTATUS_SERVICE_NOT_SUPPORT ) { // // no service engine defined // SceErr = SCESTATUS_SUCCESS; } if ( nServices < nMaxTicks ) { ScepPostProgress(nMaxTicks-nServices, Area, NULL); } return(SceErr); } SCESTATUS ScepEnumServiceEngines( OUT PSCE_SERVICES *pSvcEngineList, IN SCE_ATTACHMENT_TYPE aType ) /* Routine Description: Query all services which has a service engine for security manager The service engine information is in the registry: MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SeCEdit Arguments: pSvcEngineList - the service engine list aType - attachment type (service or policy) Return Value: SCE status */ { if ( pSvcEngineList == NULL ) { return(SCESTATUS_INVALID_PARAMETER); } DWORD Win32Rc; HKEY hKey=NULL; switch ( aType ) { case SCE_ATTACHMENT_SERVICE: Win32Rc = RegOpenKeyEx( HKEY_LOCAL_MACHINE, SCE_ROOT_SERVICE_PATH, 0, KEY_READ, &hKey ); break; case SCE_ATTACHMENT_POLICY: Win32Rc = RegOpenKeyEx( HKEY_LOCAL_MACHINE, SCE_ROOT_POLICY_PATH, 0, KEY_READ, &hKey ); break; default: return SCESTATUS_INVALID_PARAMETER; } if ( Win32Rc == ERROR_SUCCESS ) { TCHAR Buffer[MAX_PATH]; DWORD BufSize; DWORD index = 0; DWORD EnumRc; FILETIME LastWriteTime; PWSTR BufTmp=NULL; PWSTR EngineName=NULL; DWORD RegType; // // enumerate all subkeys of the key // do { memset(Buffer, '\0', MAX_PATH*sizeof(WCHAR)); BufSize = MAX_PATH; EnumRc = RegEnumKeyEx( hKey, index, Buffer, &BufSize, NULL, NULL, NULL, &LastWriteTime); if ( EnumRc == ERROR_SUCCESS ) { index++; // // get the service name, query service engine name // BufSize += wcslen(SCE_ROOT_SERVICE_PATH) + 1; //62; BufTmp = (PWSTR)ScepAlloc( 0, (BufSize+1)*sizeof(WCHAR)); if ( BufTmp != NULL ) { switch ( aType ) { case SCE_ATTACHMENT_SERVICE: swprintf(BufTmp, L"%s\\%s", SCE_ROOT_SERVICE_PATH, Buffer); Win32Rc = ScepRegQueryValue( HKEY_LOCAL_MACHINE, BufTmp, L"ServiceAttachmentPath", (PVOID *)&EngineName, &RegType ); break; case SCE_ATTACHMENT_POLICY: // policies swprintf(BufTmp, L"%s\\%s", SCE_ROOT_POLICY_PATH, Buffer); Win32Rc = ScepRegQueryValue( HKEY_LOCAL_MACHINE, BufTmp, L"PolicyAttachmentPath", (PVOID *)&EngineName, &RegType ); break; } if ( Win32Rc == ERROR_SUCCESS ) { // // get the service engine name and service name // add them to the service node // Win32Rc = ScepAddOneServiceToList( Buffer, // service name NULL, 0, (PVOID)EngineName, 0, FALSE, pSvcEngineList ); // // free the buffer if it's not added to the list // if ( Win32Rc != ERROR_SUCCESS && EngineName ) { ScepFree(EngineName); } EngineName = NULL; } else if ( Win32Rc == ERROR_FILE_NOT_FOUND ) { // // if no service engine name, ignore this service // Win32Rc = ERROR_SUCCESS; } ScepFree(BufTmp); BufTmp = NULL; } else { Win32Rc = ERROR_NOT_ENOUGH_MEMORY; } if ( Win32Rc != ERROR_SUCCESS ) { break; } } } while ( EnumRc != ERROR_NO_MORE_ITEMS ); RegCloseKey(hKey); // // remember the error code from enumeration // if ( EnumRc != ERROR_SUCCESS && EnumRc != ERROR_NO_MORE_ITEMS ) { if ( Win32Rc == ERROR_SUCCESS ) Win32Rc = EnumRc; } } if ( Win32Rc != NO_ERROR && *pSvcEngineList != NULL ) { // // free memory allocated for the list // SceFreePSCE_SERVICES(*pSvcEngineList); *pSvcEngineList = NULL; } return( ScepDosErrorToSceStatus(Win32Rc) ); }