165 lines
4.1 KiB
C
165 lines
4.1 KiB
C
/*++
|
||
|
||
Copyright (c) 1989 Microsoft Corporation
|
||
|
||
Module Name:
|
||
|
||
psimpers.c
|
||
|
||
Abstract:
|
||
|
||
This module implements the NtImpersonateThread() service.
|
||
|
||
|
||
Author:
|
||
|
||
Jim Kelly (JimK) 20-Apr-1991
|
||
|
||
Revision History:
|
||
|
||
--*/
|
||
|
||
#include "psp.h"
|
||
|
||
#ifdef ALLOC_PRAGMA
|
||
#pragma alloc_text(PAGE, NtImpersonateThread)
|
||
#endif //ALLOC_PRAGMA
|
||
|
||
|
||
NTSTATUS
|
||
NtImpersonateThread(
|
||
IN HANDLE ServerThreadHandle,
|
||
IN HANDLE ClientThreadHandle,
|
||
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos
|
||
)
|
||
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This routine is used to cause the server thread to impersonate the client
|
||
thread. The impersonation is done according to the specified quality
|
||
of service parameters.
|
||
|
||
|
||
|
||
Arguments:
|
||
|
||
ServerThreadHandle - Is a handle to the server thread (the impersonator, or
|
||
doing the impersonation). This handle must be open for
|
||
THREAD_IMPERSONATE access.
|
||
|
||
ClientThreadHandle - Is a handle to the Client thread (the impersonatee, or
|
||
one being impersonated). This handle must be open for
|
||
THREAD_DIRECT_IMPERSONATION access.
|
||
|
||
|
||
SecurityQos - A pointer to security quality of service information
|
||
indicating what form of impersonation is to be performed.
|
||
|
||
|
||
|
||
Return Value:
|
||
|
||
STATUS_SUCCESS - Indicates the call completed successfully.
|
||
|
||
|
||
--*/
|
||
|
||
{
|
||
|
||
|
||
KPROCESSOR_MODE PreviousMode;
|
||
NTSTATUS Status;
|
||
PETHREAD ClientThread, ServerThread;
|
||
SECURITY_QUALITY_OF_SERVICE CapturedQos;
|
||
SECURITY_CLIENT_CONTEXT ClientSecurityContext;
|
||
|
||
//
|
||
// Get previous processor mode and probe and capture arguments if necessary
|
||
//
|
||
|
||
PreviousMode = KeGetPreviousMode();
|
||
|
||
try {
|
||
|
||
if (PreviousMode != KernelMode) {
|
||
ProbeForReadSmallStructure (SecurityQos,
|
||
sizeof (SECURITY_QUALITY_OF_SERVICE),
|
||
sizeof (ULONG));
|
||
}
|
||
CapturedQos = *SecurityQos;
|
||
|
||
} except (ExSystemExceptionFilter ()) {
|
||
return GetExceptionCode ();
|
||
}
|
||
|
||
|
||
|
||
//
|
||
// Reference the client thread, checking for appropriate access.
|
||
//
|
||
|
||
Status = ObReferenceObjectByHandle (ClientThreadHandle, // Handle
|
||
THREAD_DIRECT_IMPERSONATION, // DesiredAccess
|
||
PsThreadType, // ObjectType
|
||
PreviousMode, // AccessMode
|
||
&ClientThread, // Object
|
||
NULL); // GrantedAccess
|
||
|
||
if (!NT_SUCCESS (Status)) {
|
||
return Status;
|
||
}
|
||
|
||
//
|
||
// Reference the client thread, checking for appropriate access.
|
||
//
|
||
|
||
Status = ObReferenceObjectByHandle (ServerThreadHandle, // Handle
|
||
THREAD_IMPERSONATE, // DesiredAccess
|
||
PsThreadType, // ObjectType
|
||
PreviousMode, // AccessMode
|
||
&ServerThread, // Object
|
||
NULL); // GrantedAccess
|
||
|
||
if (!NT_SUCCESS (Status)) {
|
||
ObDereferenceObject (ClientThread);
|
||
return Status;
|
||
}
|
||
|
||
|
||
//
|
||
// Get the client's security context
|
||
//
|
||
|
||
Status = SeCreateClientSecurity (ClientThread, // ClientThread
|
||
&CapturedQos, // SecurityQos
|
||
FALSE, // ServerIsRemote
|
||
&ClientSecurityContext); // ClientContext
|
||
|
||
if (!NT_SUCCESS (Status)) {
|
||
ObDereferenceObject (ServerThread);
|
||
ObDereferenceObject (ClientThread);
|
||
return Status;
|
||
}
|
||
|
||
|
||
//
|
||
// Impersonate the client
|
||
//
|
||
|
||
Status = SeImpersonateClientEx (&ClientSecurityContext, ServerThread);
|
||
|
||
SeDeleteClientSecurity (&ClientSecurityContext);
|
||
|
||
//
|
||
// Done.
|
||
//
|
||
|
||
|
||
ObDereferenceObject (ServerThread);
|
||
ObDereferenceObject (ClientThread);
|
||
|
||
return Status ;
|
||
}
|