1390 lines
39 KiB
C
1390 lines
39 KiB
C
/****************************************************************************
|
|
|
|
PROGRAM: ACLEDIT.C
|
|
|
|
PURPOSE: Contains routines that edit security on Nt objects
|
|
|
|
****************************************************************************/
|
|
|
|
#include "pviewp.h"
|
|
#include <sedapi.h>
|
|
|
|
|
|
//
|
|
// Define the type of a pointer to the DACL editor fn
|
|
//
|
|
|
|
typedef DWORD (*LPFNDACLEDITOR) ( HWND,
|
|
HANDLE,
|
|
LPWSTR,
|
|
PSED_OBJECT_TYPE_DESCRIPTOR,
|
|
PSED_APPLICATION_ACCESSES,
|
|
LPWSTR,
|
|
PSED_FUNC_APPLY_SEC_CALLBACK,
|
|
ULONG_PTR,
|
|
PSECURITY_DESCRIPTOR,
|
|
BOOLEAN,
|
|
BOOLEAN, // CantWriteDacl
|
|
LPDWORD,
|
|
DWORD );
|
|
|
|
|
|
//
|
|
// Declare globals used to reference dynamically loaded ACLEditor module
|
|
//
|
|
|
|
HMODULE hModAclEditor = NULL;
|
|
LPFNDACLEDITOR lpfnDaclEditor = NULL;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//
|
|
// Define security information for each type of object
|
|
//
|
|
|
|
|
|
|
|
//
|
|
// Define the maximum number of accesses per object type
|
|
//
|
|
|
|
#define MAX_ACCESSES 30
|
|
|
|
|
|
//
|
|
// Define structure to contain the security information for
|
|
// an object type
|
|
//
|
|
|
|
typedef struct _OBJECT_TYPE_SECURITY_INFO {
|
|
LPWSTR TypeName;
|
|
SED_HELP_INFO HelpInfo ;
|
|
SED_OBJECT_TYPE_DESCRIPTOR SedObjectTypeDescriptor;
|
|
GENERIC_MAPPING GenericMapping;
|
|
SED_APPLICATION_ACCESSES AppAccesses ;
|
|
SED_APPLICATION_ACCESS AppAccess[MAX_ACCESSES];
|
|
|
|
} OBJECT_TYPE_SECURITY_INFO, *POBJECT_TYPE_SECURITY_INFO;
|
|
|
|
|
|
//
|
|
// Define name of help file
|
|
//
|
|
|
|
#define HELP_FILENAME L"pview.hlp"
|
|
|
|
|
|
|
|
//
|
|
// Define dummy access (used as filler)
|
|
//
|
|
|
|
#define DUMMY_ACCESS \
|
|
{ \
|
|
0, \
|
|
0, \
|
|
0, \
|
|
NULL \
|
|
}
|
|
|
|
|
|
|
|
//
|
|
// Define generic accesses
|
|
//
|
|
|
|
#define GENERIC_ACCESSES_5(Type) \
|
|
{ \
|
|
Type, \
|
|
GENERIC_ALL, \
|
|
0, \
|
|
L"All Access" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
GENERIC_READ, \
|
|
0, \
|
|
L"Read" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
GENERIC_WRITE, \
|
|
0, \
|
|
L"Write" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
GENERIC_EXECUTE, \
|
|
0, \
|
|
L"Execute" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
0, \
|
|
0, \
|
|
L"None" \
|
|
}
|
|
|
|
|
|
//
|
|
// Define generic accesses to be shown in special access dialog
|
|
//
|
|
|
|
#define SPECIAL_GENERIC_ACCESSES_4(Type) \
|
|
{ \
|
|
Type, \
|
|
GENERIC_ALL, \
|
|
0, \
|
|
L"Generic All" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
GENERIC_READ, \
|
|
0, \
|
|
L"Generic Read" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
GENERIC_WRITE, \
|
|
0, \
|
|
L"Generic Write" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
GENERIC_EXECUTE, \
|
|
0, \
|
|
L"Generic Execute" \
|
|
}
|
|
|
|
|
|
//
|
|
// Define standard accesses
|
|
//
|
|
|
|
#define STANDARD_ACCESSES_5(Type) \
|
|
{ \
|
|
Type, \
|
|
DELETE, \
|
|
0, \
|
|
L"Delete" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
READ_CONTROL, \
|
|
0, \
|
|
L"Read Control" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
WRITE_DAC, \
|
|
0, \
|
|
L"Write DAC" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
WRITE_OWNER, \
|
|
0, \
|
|
L"Write Owner" \
|
|
}, \
|
|
{ \
|
|
Type, \
|
|
SYNCHRONIZE, \
|
|
0, \
|
|
L"Synchronize" \
|
|
}
|
|
|
|
|
|
|
|
|
|
//
|
|
// Define security info for 'DEFAULT' ACLs found in tokens
|
|
//
|
|
|
|
OBJECT_TYPE_SECURITY_INFO DefaultSecurityInfo = {
|
|
|
|
//
|
|
// Type name
|
|
//
|
|
|
|
L"DEFAULT",
|
|
|
|
//
|
|
// Help info
|
|
//
|
|
|
|
{
|
|
HELP_FILENAME,
|
|
{0, 0, 0, 0, 0, 0, 0}
|
|
},
|
|
|
|
|
|
|
|
//
|
|
// Acleditor object type descriptor
|
|
//
|
|
|
|
{
|
|
SED_REVISION1, // Revision
|
|
FALSE, // Is container
|
|
FALSE, // AllowNewObjectPermissions
|
|
FALSE, // MapSpecificPermsToGeneric
|
|
NULL, // Pointer to generic mapping
|
|
NULL, // Pointer to generic mapping for new objects
|
|
L"Default", // Object type name
|
|
NULL, // Pointer to help info
|
|
NULL, // ApplyToSubContainerTitle
|
|
NULL, // ApplyToObjectsTitle
|
|
NULL, // ApplyToSubContainerConfirmation
|
|
L"Special...", // SpecialObjectAccessTitle
|
|
NULL // SpecialNewObjectAccessTitle
|
|
},
|
|
|
|
|
|
|
|
//
|
|
// Generic mapping
|
|
//
|
|
|
|
{
|
|
STANDARD_RIGHTS_READ,
|
|
STANDARD_RIGHTS_WRITE,
|
|
STANDARD_RIGHTS_EXECUTE,
|
|
STANDARD_RIGHTS_ALL
|
|
},
|
|
|
|
|
|
//
|
|
// Application access structure
|
|
//
|
|
|
|
{
|
|
14, // Access count (must match list below)
|
|
NULL, // Pointer to accesses
|
|
L"Read", // Default new access
|
|
},
|
|
|
|
|
|
//
|
|
// Application accesses
|
|
//
|
|
|
|
{
|
|
GENERIC_ACCESSES_5(SED_DESC_TYPE_RESOURCE),
|
|
STANDARD_ACCESSES_5(SED_DESC_TYPE_RESOURCE_SPECIAL),
|
|
SPECIAL_GENERIC_ACCESSES_4(SED_DESC_TYPE_RESOURCE_SPECIAL),
|
|
|
|
DUMMY_ACCESS, // 15
|
|
DUMMY_ACCESS, // 16
|
|
DUMMY_ACCESS, // 17
|
|
DUMMY_ACCESS, // 18
|
|
DUMMY_ACCESS, // 19
|
|
DUMMY_ACCESS, // 20
|
|
DUMMY_ACCESS, // 21
|
|
DUMMY_ACCESS, // 22
|
|
DUMMY_ACCESS, // 23
|
|
DUMMY_ACCESS, // 24
|
|
DUMMY_ACCESS, // 25
|
|
DUMMY_ACCESS, // 26
|
|
DUMMY_ACCESS, // 27
|
|
DUMMY_ACCESS, // 28
|
|
DUMMY_ACCESS, // 29
|
|
DUMMY_ACCESS // 30
|
|
}
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
//
|
|
// Define security info for each type of object
|
|
//
|
|
|
|
OBJECT_TYPE_SECURITY_INFO ObjectTypeSecurityInfo[] = {
|
|
|
|
//
|
|
// PROCESS
|
|
//
|
|
|
|
{
|
|
//
|
|
// Type name
|
|
//
|
|
|
|
L"Process",
|
|
|
|
//
|
|
// Help info
|
|
//
|
|
|
|
{
|
|
HELP_FILENAME,
|
|
{0, 0, 0, 0, 0, 0, 0}
|
|
},
|
|
|
|
|
|
|
|
//
|
|
// Acleditor object type descriptor
|
|
//
|
|
|
|
{
|
|
SED_REVISION1, // Revision
|
|
FALSE, // Is container
|
|
FALSE, // AllowNewObjectPermissions
|
|
FALSE, // MapSpecificPermsToGeneric
|
|
NULL, // Pointer to generic mapping
|
|
NULL, // Pointer to generic mapping for new objects
|
|
L"Process", // Object type name
|
|
NULL, // Pointer to help info
|
|
NULL, // ApplyToSubContainerTitle
|
|
NULL, // ApplyToObjectsTitle
|
|
NULL, // ApplyToSubContainerConfirmation
|
|
L"Special...", // SpecialObjectAccessTitle
|
|
NULL // SpecialNewObjectAccessTitle
|
|
},
|
|
|
|
|
|
|
|
//
|
|
// Generic mapping
|
|
//
|
|
|
|
{
|
|
PROCESS_QUERY_INFORMATION | STANDARD_RIGHTS_READ,
|
|
PROCESS_SET_INFORMATION | STANDARD_RIGHTS_WRITE,
|
|
STANDARD_RIGHTS_EXECUTE,
|
|
PROCESS_ALL_ACCESS
|
|
},
|
|
|
|
|
|
//
|
|
// Application access structure
|
|
//
|
|
|
|
{
|
|
21, // Access count (must match list below)
|
|
NULL, // Pointer to accesses
|
|
L"Read", // Default new access
|
|
},
|
|
|
|
|
|
//
|
|
// Application accesses
|
|
//
|
|
|
|
{
|
|
GENERIC_ACCESSES_5(SED_DESC_TYPE_RESOURCE),
|
|
STANDARD_ACCESSES_5(SED_DESC_TYPE_RESOURCE_SPECIAL),
|
|
|
|
{ // 11
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_TERMINATE,
|
|
0,
|
|
L"Terminate"
|
|
},
|
|
{ // 12
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_CREATE_THREAD,
|
|
0,
|
|
L"Create thread"
|
|
},
|
|
{ // 13
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_VM_OPERATION,
|
|
0,
|
|
L"VM Operation"
|
|
},
|
|
{ // 14
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_VM_READ,
|
|
0,
|
|
L"VM Read"
|
|
},
|
|
{ // 15
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_VM_WRITE,
|
|
0,
|
|
L"VM Write"
|
|
},
|
|
{ // 16
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_DUP_HANDLE,
|
|
0,
|
|
L"Duplicate handle"
|
|
},
|
|
{ // 17
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_CREATE_PROCESS,
|
|
0,
|
|
L"Create process",
|
|
},
|
|
{ // 18
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_SET_QUOTA,
|
|
0,
|
|
L"Set quota"
|
|
},
|
|
{ // 19
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_SET_INFORMATION,
|
|
0,
|
|
L"Set information"
|
|
},
|
|
{ // 20
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_QUERY_INFORMATION,
|
|
0,
|
|
L"Query information"
|
|
},
|
|
{ // 21
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
PROCESS_SET_PORT,
|
|
0,
|
|
L"Set port"
|
|
},
|
|
|
|
DUMMY_ACCESS, // 22
|
|
DUMMY_ACCESS, // 23
|
|
DUMMY_ACCESS, // 24
|
|
DUMMY_ACCESS, // 25
|
|
DUMMY_ACCESS, // 26
|
|
DUMMY_ACCESS, // 27
|
|
DUMMY_ACCESS, // 28
|
|
DUMMY_ACCESS, // 29
|
|
DUMMY_ACCESS // 30
|
|
}
|
|
},
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//
|
|
// THREAD
|
|
//
|
|
|
|
{
|
|
//
|
|
// Type name
|
|
//
|
|
|
|
L"Thread",
|
|
|
|
//
|
|
// Help info
|
|
//
|
|
|
|
{
|
|
HELP_FILENAME,
|
|
{0, 0, 0, 0, 0, 0, 0}
|
|
},
|
|
|
|
|
|
|
|
//
|
|
// Acleditor object type descriptor
|
|
//
|
|
|
|
{
|
|
SED_REVISION1, // Revision
|
|
FALSE, // Is container
|
|
FALSE, // AllowNewObjectPermissions
|
|
FALSE, // MapSpecificPermsToGeneric
|
|
NULL, // Pointer to generic mapping
|
|
NULL, // Pointer to generic mapping for new objects
|
|
L"Thread", // Object type name
|
|
NULL, // Pointer to help info
|
|
NULL, // ApplyToSubContainerTitle
|
|
NULL, // ApplyToObjectsTitle
|
|
NULL, // ApplyToSubContainerConfirmation
|
|
L"Special...", // SpecialObjectAccessTitle
|
|
NULL // SpecialNewObjectAccessTitle
|
|
},
|
|
|
|
|
|
|
|
//
|
|
// Generic mapping
|
|
//
|
|
|
|
{
|
|
THREAD_QUERY_INFORMATION | STANDARD_RIGHTS_READ,
|
|
THREAD_SET_INFORMATION | STANDARD_RIGHTS_WRITE,
|
|
STANDARD_RIGHTS_EXECUTE,
|
|
THREAD_ALL_ACCESS
|
|
},
|
|
|
|
|
|
//
|
|
// Application access structure
|
|
//
|
|
|
|
{
|
|
20, // Access count (must match list below)
|
|
NULL, // Pointer to accesses
|
|
L"Read", // Default new access
|
|
},
|
|
|
|
|
|
//
|
|
// Application accesses
|
|
//
|
|
|
|
{
|
|
GENERIC_ACCESSES_5(SED_DESC_TYPE_RESOURCE),
|
|
STANDARD_ACCESSES_5(SED_DESC_TYPE_RESOURCE_SPECIAL),
|
|
|
|
{ // 11
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
THREAD_TERMINATE,
|
|
0,
|
|
L"Terminate"
|
|
},
|
|
{ // 12
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
THREAD_SUSPEND_RESUME,
|
|
0,
|
|
L"Suspend/Resume"
|
|
},
|
|
{ // 13
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
THREAD_ALERT,
|
|
0,
|
|
L"Alert"
|
|
},
|
|
{ // 14
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
THREAD_GET_CONTEXT,
|
|
0,
|
|
L"Get context"
|
|
},
|
|
{ // 15
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
THREAD_SET_CONTEXT,
|
|
0,
|
|
L"Set context"
|
|
},
|
|
{ // 16
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
THREAD_SET_INFORMATION,
|
|
0,
|
|
L"Set information"
|
|
},
|
|
{ // 17
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
THREAD_QUERY_INFORMATION,
|
|
0,
|
|
L"Query information"
|
|
},
|
|
{ // 18
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
THREAD_SET_THREAD_TOKEN,
|
|
0,
|
|
L"Set token"
|
|
},
|
|
{ // 19
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
THREAD_IMPERSONATE,
|
|
0,
|
|
L"Impersonate"
|
|
},
|
|
{ // 20
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
THREAD_DIRECT_IMPERSONATION,
|
|
0,
|
|
L"Direct impersonation"
|
|
},
|
|
|
|
DUMMY_ACCESS, // 21
|
|
DUMMY_ACCESS, // 22
|
|
DUMMY_ACCESS, // 23
|
|
DUMMY_ACCESS, // 24
|
|
DUMMY_ACCESS, // 25
|
|
DUMMY_ACCESS, // 26
|
|
DUMMY_ACCESS, // 27
|
|
DUMMY_ACCESS, // 28
|
|
DUMMY_ACCESS, // 29
|
|
DUMMY_ACCESS // 30
|
|
}
|
|
},
|
|
|
|
|
|
|
|
|
|
|
|
//
|
|
// TOKEN
|
|
//
|
|
|
|
{
|
|
//
|
|
// Type name
|
|
//
|
|
|
|
L"Token",
|
|
|
|
//
|
|
// Help info
|
|
//
|
|
|
|
{
|
|
HELP_FILENAME,
|
|
{0, 0, 0, 0, 0, 0, 0}
|
|
},
|
|
|
|
|
|
|
|
//
|
|
// Acleditor object type descriptor
|
|
//
|
|
|
|
{
|
|
SED_REVISION1, // Revision
|
|
FALSE, // Is container
|
|
FALSE, // AllowNewObjectPermissions
|
|
FALSE, // MapSpecificPermsToGeneric
|
|
NULL, // Pointer to generic mapping
|
|
NULL, // Pointer to generic mapping for new objects
|
|
L"Token", // Object type name
|
|
NULL, // Pointer to help info
|
|
NULL, // ApplyToSubContainerTitle
|
|
NULL, // ApplyToObjectsTitle
|
|
NULL, // ApplyToSubContainerConfirmation
|
|
L"Special...", // SpecialObjectAccessTitle
|
|
NULL // SpecialNewObjectAccessTitle
|
|
},
|
|
|
|
|
|
|
|
//
|
|
// Generic mapping
|
|
//
|
|
|
|
{
|
|
TOKEN_READ,
|
|
TOKEN_WRITE,
|
|
TOKEN_EXECUTE,
|
|
TOKEN_ALL_ACCESS
|
|
},
|
|
|
|
|
|
//
|
|
// Application access structure
|
|
//
|
|
|
|
{
|
|
18, // Access count (must match list below)
|
|
NULL, // Pointer to accesses
|
|
L"Read", // Default new access
|
|
},
|
|
|
|
|
|
//
|
|
// Application accesses
|
|
//
|
|
|
|
{
|
|
GENERIC_ACCESSES_5(SED_DESC_TYPE_RESOURCE),
|
|
STANDARD_ACCESSES_5(SED_DESC_TYPE_RESOURCE_SPECIAL),
|
|
|
|
{ // 11
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
TOKEN_ASSIGN_PRIMARY,
|
|
0,
|
|
L"Assign primary"
|
|
},
|
|
{ // 12
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
TOKEN_DUPLICATE,
|
|
0,
|
|
L"Duplicate"
|
|
},
|
|
{ // 13
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
TOKEN_IMPERSONATE,
|
|
0,
|
|
L"Impersonate"
|
|
},
|
|
{ // 14
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
TOKEN_QUERY,
|
|
0,
|
|
L"Query"
|
|
},
|
|
{ // 15
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
TOKEN_QUERY_SOURCE,
|
|
0,
|
|
L"Query source"
|
|
},
|
|
{ // 16
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
TOKEN_ADJUST_PRIVILEGES,
|
|
0,
|
|
L"Adjust Privileges"
|
|
},
|
|
{ // 17
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
TOKEN_ADJUST_GROUPS,
|
|
0,
|
|
L"Adjust Groups"
|
|
},
|
|
{ // 18
|
|
SED_DESC_TYPE_RESOURCE_SPECIAL,
|
|
TOKEN_ADJUST_DEFAULT,
|
|
0,
|
|
L"Adjust Default"
|
|
},
|
|
|
|
DUMMY_ACCESS, // 19
|
|
DUMMY_ACCESS, // 20
|
|
DUMMY_ACCESS, // 21
|
|
DUMMY_ACCESS, // 22
|
|
DUMMY_ACCESS, // 23
|
|
DUMMY_ACCESS, // 24
|
|
DUMMY_ACCESS, // 25
|
|
DUMMY_ACCESS, // 26
|
|
DUMMY_ACCESS, // 27
|
|
DUMMY_ACCESS, // 28
|
|
DUMMY_ACCESS, // 29
|
|
DUMMY_ACCESS // 30
|
|
}
|
|
}
|
|
|
|
};
|
|
|
|
|
|
/***************************************************************************\
|
|
* InitializeACLEditor
|
|
*
|
|
* Purpose : Initializes this module.
|
|
*
|
|
* Returns TRUE on success, FALSE on failure
|
|
*
|
|
* History:
|
|
* 09-17-92 Davidc Created.
|
|
\***************************************************************************/
|
|
|
|
BOOL
|
|
InitializeAclEditor(
|
|
VOID
|
|
)
|
|
{
|
|
//
|
|
// Load the acleditor module and get the proc addresses we need
|
|
//
|
|
|
|
hModAclEditor = LoadLibrary(TEXT("acledit.dll"));
|
|
if (hModAclEditor == NULL) {
|
|
return(FALSE);
|
|
}
|
|
|
|
lpfnDaclEditor = (LPFNDACLEDITOR)GetProcAddress(hModAclEditor,
|
|
TEXT("SedDiscretionaryAclEditor"));
|
|
if (lpfnDaclEditor == NULL) {
|
|
return(FALSE);
|
|
}
|
|
|
|
return(TRUE);
|
|
}
|
|
|
|
|
|
/***************************************************************************\
|
|
* FindObjectSecurityInfo
|
|
*
|
|
* Purpose : Searches for object type in our security info table and
|
|
* returns pointer to security info if found.
|
|
* Any pointers in the security info are initialized by this routine.
|
|
*
|
|
* Returns pointer to security info or NULL on failure
|
|
*
|
|
* History:
|
|
* 09-17-92 Davidc Created.
|
|
\***************************************************************************/
|
|
|
|
POBJECT_TYPE_SECURITY_INFO
|
|
FindObjectSecurityInfo(
|
|
HANDLE Object
|
|
)
|
|
{
|
|
NTSTATUS Status;
|
|
POBJECT_TYPE_SECURITY_INFO SecurityInfo;
|
|
POBJECT_TYPE_INFORMATION TypeInfo;
|
|
ULONG Length;
|
|
BOOL Found;
|
|
ULONG i;
|
|
|
|
//
|
|
// Get the object type
|
|
//
|
|
|
|
Status = NtQueryObject(
|
|
Object,
|
|
ObjectTypeInformation,
|
|
NULL,
|
|
0,
|
|
&Length
|
|
);
|
|
if (Status != STATUS_INFO_LENGTH_MISMATCH) {
|
|
DbgPrint("NtQueryObject failed, status = 0x%lx\n", Status);
|
|
return(NULL);
|
|
}
|
|
|
|
TypeInfo = Alloc(Length);
|
|
if (TypeInfo == NULL) {
|
|
DbgPrint("Failed to allocate %ld bytes for object type\n", Length);
|
|
return(NULL);
|
|
}
|
|
|
|
|
|
Status = NtQueryObject(
|
|
Object,
|
|
ObjectTypeInformation,
|
|
TypeInfo,
|
|
Length,
|
|
NULL
|
|
);
|
|
if (!NT_SUCCESS(Status)) {
|
|
DbgPrint("NtQueryObject failed, status = 0x%lx\n", Status);
|
|
Free(TypeInfo);
|
|
return(NULL);
|
|
}
|
|
|
|
|
|
//
|
|
// Search for the type in our array of security info
|
|
//
|
|
|
|
Found = FALSE;
|
|
for ( i=0;
|
|
i < (sizeof(ObjectTypeSecurityInfo) / sizeof(*ObjectTypeSecurityInfo));
|
|
i++
|
|
) {
|
|
|
|
UNICODE_STRING FoundType;
|
|
|
|
SecurityInfo = &ObjectTypeSecurityInfo[i];
|
|
|
|
RtlInitUnicodeString(&FoundType, SecurityInfo->TypeName);
|
|
|
|
if (RtlEqualUnicodeString(&TypeInfo->TypeName, &FoundType, TRUE)) {
|
|
Found = TRUE;
|
|
break;
|
|
}
|
|
}
|
|
|
|
Free(TypeInfo);
|
|
|
|
return(Found ? SecurityInfo : NULL);
|
|
}
|
|
|
|
|
|
|
|
|
|
/***************************************************************************\
|
|
* EditObjectDacl
|
|
*
|
|
* Purpose : Displays and allows the user to edit the Dacl on an object
|
|
*
|
|
* Returns TRUE on success, FALSE on failure (Use GetLastError for detail)
|
|
*
|
|
* History:
|
|
* 09-17-92 Davidc Created.
|
|
\***************************************************************************/
|
|
|
|
BOOL
|
|
EditObjectDacl(
|
|
HWND Owner,
|
|
LPWSTR ObjectName,
|
|
HANDLE Object,
|
|
PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
POBJECT_TYPE_SECURITY_INFO SecurityInfo,
|
|
PSED_FUNC_APPLY_SEC_CALLBACK SetSecurityCallback,
|
|
DWORD *EditResult
|
|
)
|
|
{
|
|
DWORD Result;
|
|
HANDLE Instance;
|
|
|
|
//
|
|
// Initialize the pointer fields in the security info structure
|
|
//
|
|
|
|
SecurityInfo->AppAccesses.AccessGroup = SecurityInfo->AppAccess;
|
|
SecurityInfo->SedObjectTypeDescriptor.GenericMapping =
|
|
&SecurityInfo->GenericMapping;
|
|
SecurityInfo->SedObjectTypeDescriptor.GenericMappingNewObjects =
|
|
&SecurityInfo->GenericMapping;
|
|
SecurityInfo->SedObjectTypeDescriptor.HelpInfo =
|
|
&SecurityInfo->HelpInfo;
|
|
|
|
//
|
|
// Get the application instance handle
|
|
//
|
|
|
|
Instance = (HANDLE)(NtCurrentPeb()->ImageBaseAddress);
|
|
ASSERT(Instance != 0);
|
|
|
|
|
|
//
|
|
// Call the ACL editor, it will call our ApplyNtObjectSecurity function
|
|
// to store any ACL changes in the token.
|
|
//
|
|
|
|
Result = (*lpfnDaclEditor)(
|
|
Owner,
|
|
Instance,
|
|
NULL, // server
|
|
&SecurityInfo->SedObjectTypeDescriptor, // object type
|
|
&SecurityInfo->AppAccesses, // application accesses
|
|
ObjectName,
|
|
SetSecurityCallback, // Callback
|
|
(ULONG_PTR)Object, // Context
|
|
SecurityDescriptor,
|
|
(BOOLEAN)(SecurityDescriptor == NULL), // Couldn't read DACL
|
|
FALSE, // CantWriteDacl
|
|
EditResult,
|
|
0
|
|
);
|
|
|
|
if (Result != ERROR_SUCCESS) {
|
|
DbgPrint("DAcleditor failed, error = %d\n", Result);
|
|
SetLastError(Result);
|
|
}
|
|
|
|
return (Result == ERROR_SUCCESS);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/***************************************************************************\
|
|
* ApplyNtObjectSecurity
|
|
*
|
|
* Purpose : Called by ACL editor to set new security on an object
|
|
*
|
|
* Returns ERROR_SUCCESS or win error code.
|
|
*
|
|
* History:
|
|
* 09-17-92 Davidc Created.
|
|
\***************************************************************************/
|
|
|
|
DWORD
|
|
ApplyNtObjectSecurity(
|
|
HWND hwndParent,
|
|
HANDLE hInstance,
|
|
ULONG_PTR CallbackContext,
|
|
PSECURITY_DESCRIPTOR SecDesc,
|
|
PSECURITY_DESCRIPTOR SecDescNewObjects,
|
|
BOOLEAN ApplyToSubContainers,
|
|
BOOLEAN ApplyToSubObjects,
|
|
LPDWORD StatusReturn
|
|
)
|
|
{
|
|
HANDLE Object = (HANDLE)CallbackContext;
|
|
NTSTATUS Status;
|
|
|
|
*StatusReturn = SED_STATUS_FAILED_TO_MODIFY;
|
|
|
|
//
|
|
// Set the new DACL on the object
|
|
//
|
|
|
|
Status = NtSetSecurityObject(Object,
|
|
DACL_SECURITY_INFORMATION,
|
|
SecDesc);
|
|
if (NT_SUCCESS(Status)) {
|
|
*StatusReturn = SED_STATUS_MODIFIED;
|
|
} else {
|
|
DbgPrint("Failed to set new ACL on object, status = 0x%lx\n", Status);
|
|
if (Status == STATUS_ACCESS_DENIED) {
|
|
MessageBox(hwndParent,
|
|
"You do not have permission to set the permissions on this object",
|
|
NULL, MB_ICONSTOP | MB_APPLMODAL | MB_OK);
|
|
} else {
|
|
MessageBox(hwndParent,
|
|
"Unable to set object security",
|
|
NULL, MB_ICONSTOP | MB_APPLMODAL | MB_OK);
|
|
}
|
|
}
|
|
|
|
return(ERROR_SUCCESS);
|
|
}
|
|
|
|
|
|
/***************************************************************************\
|
|
* EditNtObjectDacl
|
|
*
|
|
* Purpose : Displays and allows the user to edit the Dacl on an NT object
|
|
*
|
|
* Returns TRUE on success, FALSE on failure (Use GetLastError for detail)
|
|
*
|
|
* History:
|
|
* 09-17-92 Davidc Created.
|
|
\***************************************************************************/
|
|
|
|
BOOL
|
|
EditNtObjectDacl(
|
|
HWND Owner,
|
|
LPWSTR ObjectName,
|
|
HANDLE Object,
|
|
PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
DWORD *EditResult
|
|
)
|
|
{
|
|
BOOL Result;
|
|
POBJECT_TYPE_SECURITY_INFO SecurityInfo;
|
|
|
|
|
|
//
|
|
// Lookup our security info for an object of this type
|
|
//
|
|
|
|
SecurityInfo = FindObjectSecurityInfo(Object);
|
|
if (SecurityInfo == NULL) {
|
|
MessageBox(Owner, "Unable to edit the security on an object of this type",
|
|
NULL, MB_ICONSTOP | MB_APPLMODAL | MB_OK);
|
|
return(FALSE);
|
|
}
|
|
|
|
|
|
//
|
|
// Edit the ACL. Our callback function will be called to change the
|
|
// new permissions
|
|
//
|
|
|
|
Result = EditObjectDacl(
|
|
Owner,
|
|
ObjectName,
|
|
Object,
|
|
SecurityDescriptor,
|
|
SecurityInfo,
|
|
ApplyNtObjectSecurity,
|
|
EditResult
|
|
);
|
|
return (Result);
|
|
|
|
}
|
|
|
|
|
|
/***************************************************************************\
|
|
* EditNtObjectSecurity
|
|
*
|
|
* Purpose : Displays and allows the user to edit the protection on an NT object
|
|
*
|
|
* Parameters:
|
|
*
|
|
* hwndOwner - Owner window for dialog
|
|
* Object - handle to NT object. Should have been opened for MAXIMUM_ALLOWED
|
|
* Name - Name of object
|
|
*
|
|
* Returns TRUE on success, FALSE on failure (Use GetLastError for detail)
|
|
*
|
|
* History:
|
|
* 09-17-92 Davidc Created.
|
|
\***************************************************************************/
|
|
|
|
BOOL
|
|
EditNtObjectSecurity(
|
|
HWND hwndOwner,
|
|
HANDLE Object,
|
|
LPWSTR ObjectName
|
|
)
|
|
{
|
|
NTSTATUS Status;
|
|
BOOL Success = FALSE;
|
|
DWORD EditResult;
|
|
PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
|
|
ULONG Length;
|
|
|
|
//
|
|
// If we don't have an address for the DACL editor, we can't do anything
|
|
//
|
|
|
|
if (lpfnDaclEditor == NULL) {
|
|
DbgPrint("EditNtObjectSecurity - no ACL editor loaded\n");
|
|
return(FALSE);
|
|
}
|
|
|
|
//
|
|
// Read the existing security from the object
|
|
//
|
|
|
|
Status = NtQuerySecurityObject(Object,
|
|
OWNER_SECURITY_INFORMATION |
|
|
GROUP_SECURITY_INFORMATION |
|
|
DACL_SECURITY_INFORMATION,
|
|
NULL,
|
|
0,
|
|
&Length);
|
|
ASSERT(!NT_SUCCESS(Status));
|
|
|
|
if (Status != STATUS_BUFFER_TOO_SMALL) {
|
|
DbgPrint("Failed to query object security, status = 0x%lx\n", Status);
|
|
} else {
|
|
|
|
SecurityDescriptor = Alloc(Length);
|
|
if (SecurityDescriptor == NULL) {
|
|
DbgPrint("Failed to allocate %ld bytes for object SD\n", Length);
|
|
goto CleanupAndExit;
|
|
}
|
|
|
|
Status = NtQuerySecurityObject(Object,
|
|
OWNER_SECURITY_INFORMATION |
|
|
GROUP_SECURITY_INFORMATION |
|
|
DACL_SECURITY_INFORMATION,
|
|
SecurityDescriptor,
|
|
Length,
|
|
&Length);
|
|
if (!NT_SUCCESS(Status)) {
|
|
DbgPrint("Failed to query object security, status = 0x%lx\n", Status);
|
|
goto CleanupAndExit;
|
|
}
|
|
|
|
ASSERT(RtlValidSecurityDescriptor(SecurityDescriptor));
|
|
}
|
|
|
|
//
|
|
// Call the ACL editor, it will call our ApplyNtObjectSecurity function
|
|
// to store any ACL changes in the object.
|
|
//
|
|
|
|
Success = EditNtObjectDacl(
|
|
hwndOwner,
|
|
ObjectName,
|
|
Object,
|
|
SecurityDescriptor,
|
|
&EditResult
|
|
);
|
|
if (!Success) {
|
|
DbgPrint("PVIEW: Failed to edit object DACL\n");
|
|
}
|
|
|
|
CleanupAndExit:
|
|
|
|
if (SecurityDescriptor != NULL) {
|
|
Free(SecurityDescriptor);
|
|
}
|
|
|
|
return(Success);
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/***************************************************************************\
|
|
* ApplyTokenDefaultDacl
|
|
*
|
|
* Purpose : Called by ACL editor to set new security on an object
|
|
*
|
|
* Returns ERROR_SUCCESS or win error code.
|
|
*
|
|
* History:
|
|
* 09-17-92 Davidc Created.
|
|
\***************************************************************************/
|
|
|
|
DWORD
|
|
ApplyTokenDefaultDacl(
|
|
HWND hwndParent,
|
|
HANDLE hInstance,
|
|
ULONG_PTR CallbackContext,
|
|
PSECURITY_DESCRIPTOR SecDesc,
|
|
PSECURITY_DESCRIPTOR SecDescNewObjects,
|
|
BOOLEAN ApplyToSubContainers,
|
|
BOOLEAN ApplyToSubObjects,
|
|
LPDWORD StatusReturn
|
|
)
|
|
{
|
|
HANDLE Token = (HANDLE)CallbackContext;
|
|
TOKEN_DEFAULT_DACL DefaultDacl;
|
|
NTSTATUS Status;
|
|
BOOLEAN DaclPresent;
|
|
BOOLEAN DaclDefaulted;
|
|
|
|
Status = RtlGetDaclSecurityDescriptor (
|
|
SecDesc,
|
|
&DaclPresent,
|
|
&DefaultDacl.DefaultDacl,
|
|
&DaclDefaulted
|
|
);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
|
|
ASSERT(DaclPresent);
|
|
|
|
|
|
Status = NtSetInformationToken(
|
|
Token, // Handle
|
|
TokenDefaultDacl, // TokenInformationClass
|
|
&DefaultDacl, // TokenInformation
|
|
sizeof(DefaultDacl) // TokenInformationLength
|
|
);
|
|
if (NT_SUCCESS(Status)) {
|
|
*StatusReturn = SED_STATUS_MODIFIED;
|
|
} else {
|
|
DbgPrint("SetInformationToken failed, status = 0x%lx\n", Status);
|
|
*StatusReturn = SED_STATUS_FAILED_TO_MODIFY;
|
|
|
|
if (Status == STATUS_ACCESS_DENIED) {
|
|
MessageBox(hwndParent,
|
|
"You do not have permission to set the default ACL in this token",
|
|
NULL, MB_ICONSTOP | MB_APPLMODAL | MB_OK);
|
|
} else {
|
|
MessageBox(hwndParent,
|
|
"Unable to set default ACL in token",
|
|
NULL, MB_ICONSTOP | MB_APPLMODAL | MB_OK);
|
|
}
|
|
}
|
|
|
|
return(ERROR_SUCCESS);
|
|
}
|
|
|
|
|
|
/***************************************************************************\
|
|
* EditTokenDefaultAcl
|
|
*
|
|
* Purpose : Displays and allows the user to edit the default ACL in a token
|
|
*
|
|
* Parameters:
|
|
*
|
|
* hwndOwner - Owner window for dialog
|
|
* Object - handle to token - opened for TOKEN_QUERY access
|
|
* Name - Name of token
|
|
*
|
|
* Returns TRUE on success, FALSE on failure (Use GetLastError for detail)
|
|
*
|
|
* History:
|
|
* 09-17-92 Davidc Created.
|
|
\***************************************************************************/
|
|
|
|
BOOL
|
|
EditTokenDefaultDacl(
|
|
HWND hwndOwner,
|
|
HANDLE Token,
|
|
LPWSTR ObjectName
|
|
)
|
|
{
|
|
NTSTATUS Status;
|
|
BOOL Result = FALSE;
|
|
DWORD EditResult;
|
|
PTOKEN_DEFAULT_DACL DefaultDacl = NULL;
|
|
PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
|
|
ULONG InfoLength;
|
|
|
|
//
|
|
// If we don't have an address for the DACL editor, we can't do anything
|
|
//
|
|
|
|
if (lpfnDaclEditor == NULL) {
|
|
DbgPrint("EditNtObjectSecurity - no ACL editor loaded\n");
|
|
return(FALSE);
|
|
}
|
|
|
|
//
|
|
// Read the default DACL from the token
|
|
//
|
|
|
|
Status = NtQueryInformationToken(
|
|
Token, // Handle
|
|
TokenDefaultDacl, // TokenInformationClass
|
|
NULL, // TokenInformation
|
|
0, // TokenInformationLength
|
|
&InfoLength // ReturnLength
|
|
);
|
|
|
|
ASSERT(!NT_SUCCESS(Status));
|
|
|
|
if (Status == STATUS_BUFFER_TOO_SMALL) {
|
|
|
|
DefaultDacl = Alloc(InfoLength);
|
|
if (DefaultDacl == NULL) {
|
|
goto CleanupAndExit;
|
|
}
|
|
|
|
Status = NtQueryInformationToken(
|
|
Token, // Handle
|
|
TokenDefaultDacl, // TokenInformationClass
|
|
DefaultDacl, // TokenInformation
|
|
InfoLength, // TokenInformationLength
|
|
&InfoLength // ReturnLength
|
|
);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
DbgPrint("NtQueryInformationToken failed, status = 0x%lx\n", Status);
|
|
goto CleanupAndExit;
|
|
}
|
|
|
|
|
|
//
|
|
// Create a security descriptor
|
|
//
|
|
|
|
SecurityDescriptor = Alloc(SECURITY_DESCRIPTOR_MIN_LENGTH);
|
|
|
|
if (SecurityDescriptor == NULL) {
|
|
DbgPrint("Failed to allocate security descriptor\n");
|
|
goto CleanupAndExit;
|
|
}
|
|
|
|
Status = RtlCreateSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
|
|
|
|
//
|
|
// Set the DACL on the security descriptor
|
|
//
|
|
|
|
Status = RtlSetDaclSecurityDescriptor(
|
|
SecurityDescriptor,
|
|
TRUE, // DACL present
|
|
DefaultDacl->DefaultDacl,
|
|
FALSE // DACL defaulted
|
|
);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
|
|
ASSERT(RtlValidSecurityDescriptor(SecurityDescriptor));
|
|
}
|
|
|
|
|
|
|
|
//
|
|
// Call the ACL editor, it will call our ApplyTokenDefaultAcl function
|
|
// to store any default ACL changes in the token.
|
|
//
|
|
|
|
Result = EditObjectDacl(
|
|
hwndOwner,
|
|
ObjectName,
|
|
Token,
|
|
SecurityDescriptor,
|
|
&DefaultSecurityInfo,
|
|
ApplyTokenDefaultDacl,
|
|
&EditResult
|
|
);
|
|
if (!Result) {
|
|
DbgPrint("Failed to edit token default ACL\n");
|
|
}
|
|
|
|
CleanupAndExit:
|
|
|
|
if (SecurityDescriptor != NULL) {
|
|
Free(SecurityDescriptor);
|
|
}
|
|
if (DefaultDacl != NULL) {
|
|
Free(DefaultDacl);
|
|
}
|
|
|
|
return(Result);
|
|
}
|