xref: /reactos/base/system/services/database.c (revision 45fd48bd) 
1 /*
2  * PROJECT:     ReactOS Service Control Manager
3  * LICENSE:     GPL - See COPYING in the top level directory
4  * FILE:        base/system/services/database.c
5  * PURPOSE:     Database control interface
6  * COPYRIGHT:   Copyright 2002-2006 Eric Kohl
7  *              Copyright 2006 Herv� Poussineau <hpoussin@reactos.org>
8  *              Copyright 2007 Ged Murphy <gedmurphy@reactos.org>
9  *                             Gregor Brunmar <gregor.brunmar@home.se>
10  *
11  */
12 
13 /* INCLUDES *****************************************************************/
14 
15 #include "services.h"
16 
17 #include <userenv.h>
18 #include <strsafe.h>
19 
20 #include <reactos/undocuser.h>
21 
22 #define NDEBUG
23 #include <debug.h>
24 
25 
26 /* GLOBALS *******************************************************************/
27 
28 LIST_ENTRY ImageListHead;
29 LIST_ENTRY ServiceListHead;
30 
31 static RTL_RESOURCE DatabaseLock;
32 static DWORD ResumeCount = 1;
33 static DWORD NoInteractiveServices = 0;
34 
35 /* The critical section synchronizes service control requests */
36 static CRITICAL_SECTION ControlServiceCriticalSection;
37 static DWORD PipeTimeout = 30000; /* 30 Seconds */
38 
39 
40 /* FUNCTIONS *****************************************************************/
41 
42 static DWORD
43 ScmCreateNewControlPipe(PSERVICE_IMAGE pServiceImage)
44 {
45     WCHAR szControlPipeName[MAX_PATH + 1];
46     HKEY hServiceCurrentKey = INVALID_HANDLE_VALUE;
47     DWORD ServiceCurrent = 0;
48     DWORD KeyDisposition;
49     DWORD dwKeySize;
50     DWORD dwError;
51 
52     /* Get the service number */
53     /* TODO: Create registry entry with correct write access */
54     dwError = RegCreateKeyExW(HKEY_LOCAL_MACHINE,
55                               L"SYSTEM\\CurrentControlSet\\Control\\ServiceCurrent", 0, NULL,
56                               REG_OPTION_VOLATILE,
57                               KEY_WRITE | KEY_READ,
58                               NULL,
59                               &hServiceCurrentKey,
60                               &KeyDisposition);
61     if (dwError != ERROR_SUCCESS)
62     {
63         DPRINT1("RegCreateKeyEx() failed with error %lu\n", dwError);
64         return dwError;
65     }
66 
67     if (KeyDisposition == REG_OPENED_EXISTING_KEY)
68     {
69         dwKeySize = sizeof(DWORD);
70         dwError = RegQueryValueExW(hServiceCurrentKey,
71                                    L"", 0, NULL, (BYTE*)&ServiceCurrent, &dwKeySize);
72 
73         if (dwError != ERROR_SUCCESS)
74         {
75             RegCloseKey(hServiceCurrentKey);
76             DPRINT1("RegQueryValueEx() failed with error %lu\n", dwError);
77             return dwError;
78         }
79 
80         ServiceCurrent++;
81     }
82 
83     dwError = RegSetValueExW(hServiceCurrentKey, L"", 0, REG_DWORD, (BYTE*)&ServiceCurrent, sizeof(ServiceCurrent));
84 
85     RegCloseKey(hServiceCurrentKey);
86 
87     if (dwError != ERROR_SUCCESS)
88     {
89         DPRINT1("RegSetValueExW() failed (Error %lu)\n", dwError);
90         return dwError;
91     }
92 
93     /* Create '\\.\pipe\net\NtControlPipeXXX' instance */
94     StringCchPrintfW(szControlPipeName, ARRAYSIZE(szControlPipeName),
95                      L"\\\\.\\pipe\\net\\NtControlPipe%lu", ServiceCurrent);
96 
97     DPRINT("PipeName: %S\n", szControlPipeName);
98 
99     pServiceImage->hControlPipe = CreateNamedPipeW(szControlPipeName,
100                                                    PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED,
101                                                    PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT,
102                                                    100,
103                                                    8000,
104                                                    4,
105                                                    PipeTimeout,
106                                                    NULL);
107     DPRINT("CreateNamedPipeW(%S) done\n", szControlPipeName);
108     if (pServiceImage->hControlPipe == INVALID_HANDLE_VALUE)
109     {
110         DPRINT1("Failed to create control pipe!\n");
111         return GetLastError();
112     }
113 
114     return ERROR_SUCCESS;
115 }
116 
117 
118 static PSERVICE_IMAGE
119 ScmGetServiceImageByImagePath(LPWSTR lpImagePath)
120 {
121     PLIST_ENTRY ImageEntry;
122     PSERVICE_IMAGE CurrentImage;
123 
124     DPRINT("ScmGetServiceImageByImagePath(%S) called\n", lpImagePath);
125 
126     ImageEntry = ImageListHead.Flink;
127     while (ImageEntry != &ImageListHead)
128     {
129         CurrentImage = CONTAINING_RECORD(ImageEntry,
130                                          SERVICE_IMAGE,
131                                          ImageListEntry);
132         if (_wcsicmp(CurrentImage->pszImagePath, lpImagePath) == 0)
133         {
134             DPRINT("Found image: '%S'\n", CurrentImage->pszImagePath);
135             return CurrentImage;
136         }
137 
138         ImageEntry = ImageEntry->Flink;
139     }
140 
141     DPRINT("Couldn't find a matching image\n");
142 
143     return NULL;
144 
145 }
146 
147 
148 static
149 BOOL
150 ScmIsSameServiceAccount(
151     _In_ PCWSTR pszAccountName1,
152     _In_ PCWSTR pszAccountName2)
153 {
154     if (pszAccountName1 == NULL && pszAccountName2 == NULL)
155         return TRUE;
156 
157     if (pszAccountName1 == NULL && pszAccountName2 && wcscmp(pszAccountName2, L"LocalSystem") == 0)
158         return TRUE;
159 
160     if (pszAccountName2 == NULL && pszAccountName1 && wcscmp(pszAccountName1, L"LocalSystem") == 0)
161         return TRUE;
162 
163     if (pszAccountName1 && pszAccountName2 && wcscmp(pszAccountName1, pszAccountName2) == 0)
164         return TRUE;
165 
166     return FALSE;
167 }
168 
169 
170 static
171 BOOL
172 ScmIsLocalSystemAccount(
173     _In_ PCWSTR pszAccountName)
174 {
175     if (pszAccountName == NULL ||
176         wcscmp(pszAccountName, L"LocalSystem") == 0)
177         return TRUE;
178 
179     return FALSE;
180 }
181 
182 
183 static
184 DWORD
185 ScmLogonService(
186     IN PSERVICE pService,
187     IN PSERVICE_IMAGE pImage)
188 {
189     DWORD dwError = ERROR_SUCCESS;
190     PROFILEINFOW ProfileInfo;
191     PWSTR pszUserName = NULL;
192     PWSTR pszDomainName = NULL;
193     PWSTR pszPassword = NULL;
194     PWSTR ptr;
195 
196     DPRINT("ScmLogonService(%p %p)\n", pService, pImage);
197     DPRINT("Service %S\n", pService->lpServiceName);
198 
199     if (ScmIsLocalSystemAccount(pImage->pszAccountName))
200         return ERROR_SUCCESS;
201 
202     /* Get the user and domain names */
203     ptr = wcschr(pImage->pszAccountName, L'\\');
204     if (ptr != NULL)
205     {
206         *ptr = L'\0';
207         pszUserName = ptr + 1;
208         pszDomainName = pImage->pszAccountName;
209     }
210     else
211     {
212         // ERROR_INVALID_SERVICE_ACCOUNT
213         pszUserName = pImage->pszAccountName;
214         pszDomainName = NULL;
215     }
216 
217     /* Build the service 'password' */
218     pszPassword = HeapAlloc(GetProcessHeap(),
219                             HEAP_ZERO_MEMORY,
220                             (wcslen(pService->lpServiceName) + 5) * sizeof(WCHAR));
221     if (pszPassword == NULL)
222     {
223         dwError = ERROR_NOT_ENOUGH_MEMORY;
224         goto done;
225     }
226 
227     wcscpy(pszPassword, L"_SC_");
228     wcscat(pszPassword, pService->lpServiceName);
229 
230     DPRINT("Domain: %S  User: %S  Password: %S\n", pszDomainName, pszUserName, pszPassword);
231 
232     /* Do the service logon */
233     if (!LogonUserW(pszUserName,
234                     pszDomainName,
235                     pszPassword,
236                     LOGON32_LOGON_SERVICE,
237                     LOGON32_PROVIDER_DEFAULT,
238                     &pImage->hToken))
239     {
240         dwError = GetLastError();
241         DPRINT1("LogonUserW() failed (Error %lu)\n", dwError);
242 
243         /* Normalize the returned error */
244         dwError = ERROR_SERVICE_LOGON_FAILED;
245         goto done;
246     }
247 
248     /* Load the user profile; the per-user environment variables are thus correctly initialized */
249     ZeroMemory(&ProfileInfo, sizeof(ProfileInfo));
250     ProfileInfo.dwSize = sizeof(ProfileInfo);
251     ProfileInfo.dwFlags = PI_NOUI;
252     ProfileInfo.lpUserName = pszUserName;
253     // ProfileInfo.lpProfilePath = NULL;
254     // ProfileInfo.lpDefaultPath = NULL;
255     // ProfileInfo.lpServerName = NULL;
256     // ProfileInfo.lpPolicyPath = NULL;
257     // ProfileInfo.hProfile = NULL;
258 
259     if (!LoadUserProfileW(pImage->hToken, &ProfileInfo))
260     {
261         dwError = GetLastError();
262         DPRINT1("LoadUserProfileW() failed (Error %lu)\n", dwError);
263         goto done;
264     }
265 
266     pImage->hProfile = ProfileInfo.hProfile;
267 
268 done:
269     if (pszPassword != NULL)
270         HeapFree(GetProcessHeap(), 0, pszPassword);
271 
272     if (ptr != NULL)
273         *ptr = L'\\';
274 
275     return dwError;
276 }
277 
278 
279 static DWORD
280 ScmCreateOrReferenceServiceImage(PSERVICE pService)
281 {
282     RTL_QUERY_REGISTRY_TABLE QueryTable[3];
283     UNICODE_STRING ImagePath;
284     UNICODE_STRING ObjectName;
285     PSERVICE_IMAGE pServiceImage = NULL;
286     NTSTATUS Status;
287     DWORD dwError = ERROR_SUCCESS;
288     DWORD dwRecordSize;
289     LPWSTR pString;
290 
291     DPRINT("ScmCreateOrReferenceServiceImage(%p)\n", pService);
292 
293     RtlInitUnicodeString(&ImagePath, NULL);
294     RtlInitUnicodeString(&ObjectName, NULL);
295 
296     /* Get service data */
297     RtlZeroMemory(&QueryTable,
298                   sizeof(QueryTable));
299 
300     QueryTable[0].Name = L"ImagePath";
301     QueryTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT | RTL_QUERY_REGISTRY_REQUIRED;
302     QueryTable[0].EntryContext = &ImagePath;
303     QueryTable[1].Name = L"ObjectName";
304     QueryTable[1].Flags = RTL_QUERY_REGISTRY_DIRECT;
305     QueryTable[1].EntryContext = &ObjectName;
306 
307     Status = RtlQueryRegistryValues(RTL_REGISTRY_SERVICES,
308                                     pService->lpServiceName,
309                                     QueryTable,
310                                     NULL,
311                                     NULL);
312     if (!NT_SUCCESS(Status))
313     {
314         DPRINT1("RtlQueryRegistryValues() failed (Status %lx)\n", Status);
315         return RtlNtStatusToDosError(Status);
316     }
317 
318     DPRINT("ImagePath: '%wZ'\n", &ImagePath);
319     DPRINT("ObjectName: '%wZ'\n", &ObjectName);
320 
321     pServiceImage = ScmGetServiceImageByImagePath(ImagePath.Buffer);
322     if (pServiceImage == NULL)
323     {
324         dwRecordSize = sizeof(SERVICE_IMAGE) +
325                        ImagePath.Length + sizeof(WCHAR) +
326                        ((ObjectName.Length != 0) ? (ObjectName.Length + sizeof(WCHAR)) : 0);
327 
328         /* Create a new service image */
329         pServiceImage = HeapAlloc(GetProcessHeap(),
330                                   HEAP_ZERO_MEMORY,
331                                   dwRecordSize);
332         if (pServiceImage == NULL)
333         {
334             dwError = ERROR_NOT_ENOUGH_MEMORY;
335             goto done;
336         }
337 
338         pServiceImage->dwImageRunCount = 1;
339         pServiceImage->hControlPipe = INVALID_HANDLE_VALUE;
340         pServiceImage->hProcess = INVALID_HANDLE_VALUE;
341 
342         pString = (PWSTR)((INT_PTR)pServiceImage + sizeof(SERVICE_IMAGE));
343 
344         /* Set the image path */
345         pServiceImage->pszImagePath = pString;
346         wcscpy(pServiceImage->pszImagePath,
347                ImagePath.Buffer);
348 
349         /* Set the account name */
350         if (ObjectName.Length > 0)
351         {
352             pString = pString + wcslen(pString) + 1;
353 
354             pServiceImage->pszAccountName = pString;
355             wcscpy(pServiceImage->pszAccountName,
356                    ObjectName.Buffer);
357         }
358 
359         /* Service logon */
360         dwError = ScmLogonService(pService, pServiceImage);
361         if (dwError != ERROR_SUCCESS)
362         {
363             DPRINT1("ScmLogonService() failed (Error %lu)\n", dwError);
364 
365             /* Release the service image */
366             HeapFree(GetProcessHeap(), 0, pServiceImage);
367 
368             goto done;
369         }
370 
371         /* Create the control pipe */
372         dwError = ScmCreateNewControlPipe(pServiceImage);
373         if (dwError != ERROR_SUCCESS)
374         {
375             DPRINT1("ScmCreateNewControlPipe() failed (Error %lu)\n", dwError);
376 
377             /* Unload the user profile */
378             if (pServiceImage->hProfile != NULL)
379                 UnloadUserProfile(pServiceImage->hToken, pServiceImage->hProfile);
380 
381             /* Close the logon token */
382             if (pServiceImage->hToken != NULL)
383                 CloseHandle(pServiceImage->hToken);
384 
385             /* Release the service image */
386             HeapFree(GetProcessHeap(), 0, pServiceImage);
387 
388             goto done;
389         }
390 
391         /* FIXME: Add more initialization code here */
392 
393 
394         /* Append service record */
395         InsertTailList(&ImageListHead,
396                        &pServiceImage->ImageListEntry);
397     }
398     else
399     {
400 //        if ((lpService->Status.dwServiceType & SERVICE_WIN32_SHARE_PROCESS) == 0)
401 
402         /* Fail if services in an image use different accounts */
403         if (!ScmIsSameServiceAccount(pServiceImage->pszAccountName, ObjectName.Buffer))
404         {
405             dwError = ERROR_DIFFERENT_SERVICE_ACCOUNT;
406             goto done;
407         }
408 
409         /* Increment the run counter */
410         pServiceImage->dwImageRunCount++;
411     }
412 
413     DPRINT("pServiceImage->pszImagePath: %S\n", pServiceImage->pszImagePath);
414     DPRINT("pServiceImage->pszAccountName: %S\n", pServiceImage->pszAccountName);
415     DPRINT("pServiceImage->dwImageRunCount: %lu\n", pServiceImage->dwImageRunCount);
416 
417     /* Link the service image to the service */
418     pService->lpImage = pServiceImage;
419 
420 done:
421     RtlFreeUnicodeString(&ObjectName);
422     RtlFreeUnicodeString(&ImagePath);
423 
424     DPRINT("ScmCreateOrReferenceServiceImage() done (Error: %lu)\n", dwError);
425 
426     return dwError;
427 }
428 
429 
430 VOID
431 ScmRemoveServiceImage(PSERVICE_IMAGE pServiceImage)
432 {
433     DPRINT1("ScmRemoveServiceImage() called\n");
434 
435     /* FIXME: Terminate the process */
436 
437     /* Remove the service image from the list */
438     RemoveEntryList(&pServiceImage->ImageListEntry);
439 
440     /* Close the process handle */
441     if (pServiceImage->hProcess != INVALID_HANDLE_VALUE)
442         CloseHandle(pServiceImage->hProcess);
443 
444     /* Close the control pipe */
445     if (pServiceImage->hControlPipe != INVALID_HANDLE_VALUE)
446         CloseHandle(pServiceImage->hControlPipe);
447 
448     /* Unload the user profile */
449     if (pServiceImage->hProfile != NULL)
450         UnloadUserProfile(pServiceImage->hToken, pServiceImage->hProfile);
451 
452     /* Close the logon token */
453     if (pServiceImage->hToken != NULL)
454         CloseHandle(pServiceImage->hToken);
455 
456     /* Release the service image */
457     HeapFree(GetProcessHeap(), 0, pServiceImage);
458 }
459 
460 
461 PSERVICE
462 ScmGetServiceEntryByName(LPCWSTR lpServiceName)
463 {
464     PLIST_ENTRY ServiceEntry;
465     PSERVICE CurrentService;
466 
467     DPRINT("ScmGetServiceEntryByName() called\n");
468 
469     ServiceEntry = ServiceListHead.Flink;
470     while (ServiceEntry != &ServiceListHead)
471     {
472         CurrentService = CONTAINING_RECORD(ServiceEntry,
473                                            SERVICE,
474                                            ServiceListEntry);
475         if (_wcsicmp(CurrentService->lpServiceName, lpServiceName) == 0)
476         {
477             DPRINT("Found service: '%S'\n", CurrentService->lpServiceName);
478             return CurrentService;
479         }
480 
481         ServiceEntry = ServiceEntry->Flink;
482     }
483 
484     DPRINT("Couldn't find a matching service\n");
485 
486     return NULL;
487 }
488 
489 
490 PSERVICE
491 ScmGetServiceEntryByDisplayName(LPCWSTR lpDisplayName)
492 {
493     PLIST_ENTRY ServiceEntry;
494     PSERVICE CurrentService;
495 
496     DPRINT("ScmGetServiceEntryByDisplayName() called\n");
497 
498     ServiceEntry = ServiceListHead.Flink;
499     while (ServiceEntry != &ServiceListHead)
500     {
501         CurrentService = CONTAINING_RECORD(ServiceEntry,
502                                            SERVICE,
503                                            ServiceListEntry);
504         if (_wcsicmp(CurrentService->lpDisplayName, lpDisplayName) == 0)
505         {
506             DPRINT("Found service: '%S'\n", CurrentService->lpDisplayName);
507             return CurrentService;
508         }
509 
510         ServiceEntry = ServiceEntry->Flink;
511     }
512 
513     DPRINT("Couldn't find a matching service\n");
514 
515     return NULL;
516 }
517 
518 
519 PSERVICE
520 ScmGetServiceEntryByResumeCount(DWORD dwResumeCount)
521 {
522     PLIST_ENTRY ServiceEntry;
523     PSERVICE CurrentService;
524 
525     DPRINT("ScmGetServiceEntryByResumeCount() called\n");
526 
527     ServiceEntry = ServiceListHead.Flink;
528     while (ServiceEntry != &ServiceListHead)
529     {
530         CurrentService = CONTAINING_RECORD(ServiceEntry,
531                                            SERVICE,
532                                            ServiceListEntry);
533         if (CurrentService->dwResumeCount > dwResumeCount)
534         {
535             DPRINT("Found service: '%S'\n", CurrentService->lpDisplayName);
536             return CurrentService;
537         }
538 
539         ServiceEntry = ServiceEntry->Flink;
540     }
541 
542     DPRINT("Couldn't find a matching service\n");
543 
544     return NULL;
545 }
546 
547 
548 DWORD
549 ScmCreateNewServiceRecord(LPCWSTR lpServiceName,
550                           PSERVICE *lpServiceRecord,
551                           DWORD dwServiceType,
552                           DWORD dwStartType)
553 {
554     PSERVICE lpService = NULL;
555 
556     DPRINT("Service: '%S'\n", lpServiceName);
557 
558     /* Allocate service entry */
559     lpService = HeapAlloc(GetProcessHeap(),
560                           HEAP_ZERO_MEMORY,
561                           FIELD_OFFSET(SERVICE, szServiceName[wcslen(lpServiceName) + 1]));
562     if (lpService == NULL)
563         return ERROR_NOT_ENOUGH_MEMORY;
564 
565     *lpServiceRecord = lpService;
566 
567     /* Copy service name */
568     wcscpy(lpService->szServiceName, lpServiceName);
569     lpService->lpServiceName = lpService->szServiceName;
570     lpService->lpDisplayName = lpService->lpServiceName;
571 
572     /* Set the start type */
573     lpService->dwStartType = dwStartType;
574 
575     /* Set the resume count */
576     lpService->dwResumeCount = ResumeCount++;
577 
578     /* Append service record */
579     InsertTailList(&ServiceListHead,
580                    &lpService->ServiceListEntry);
581 
582     /* Initialize the service status */
583     lpService->Status.dwServiceType = dwServiceType;
584     lpService->Status.dwCurrentState = SERVICE_STOPPED;
585     lpService->Status.dwControlsAccepted = 0;
586     lpService->Status.dwWin32ExitCode =
587         (dwStartType == SERVICE_DISABLED) ? ERROR_SERVICE_DISABLED : ERROR_SERVICE_NEVER_STARTED;
588     lpService->Status.dwServiceSpecificExitCode = 0;
589     lpService->Status.dwCheckPoint = 0;
590     lpService->Status.dwWaitHint =
591         (dwServiceType & SERVICE_DRIVER) ? 0 : 2000; /* 2 seconds */
592 
593     return ERROR_SUCCESS;
594 }
595 
596 
597 VOID
598 ScmDeleteServiceRecord(PSERVICE lpService)
599 {
600     DPRINT("Deleting Service %S\n", lpService->lpServiceName);
601 
602     /* Delete the display name */
603     if (lpService->lpDisplayName != NULL &&
604         lpService->lpDisplayName != lpService->lpServiceName)
605         HeapFree(GetProcessHeap(), 0, lpService->lpDisplayName);
606 
607     /* Dereference the service image */
608     if (lpService->lpImage)
609     {
610         lpService->lpImage->dwImageRunCount--;
611 
612         if (lpService->lpImage->dwImageRunCount == 0)
613         {
614             ScmRemoveServiceImage(lpService->lpImage);
615             lpService->lpImage = NULL;
616         }
617     }
618 
619     /* Decrement the group reference counter */
620     ScmSetServiceGroup(lpService, NULL);
621 
622     /* Release the SecurityDescriptor */
623     if (lpService->pSecurityDescriptor != NULL)
624         HeapFree(GetProcessHeap(), 0, lpService->pSecurityDescriptor);
625 
626     /* Remove the Service from the List */
627     RemoveEntryList(&lpService->ServiceListEntry);
628 
629     DPRINT("Deleted Service %S\n", lpService->lpServiceName);
630 
631     /* Delete the service record */
632     HeapFree(GetProcessHeap(), 0, lpService);
633 
634     DPRINT("Done\n");
635 }
636 
637 
638 static DWORD
639 CreateServiceListEntry(LPCWSTR lpServiceName,
640                        HKEY hServiceKey)
641 {
642     PSERVICE lpService = NULL;
643     LPWSTR lpDisplayName = NULL;
644     LPWSTR lpGroup = NULL;
645     DWORD dwSize;
646     DWORD dwError;
647     DWORD dwServiceType;
648     DWORD dwStartType;
649     DWORD dwErrorControl;
650     DWORD dwTagId;
651 
652     DPRINT("Service: '%S'\n", lpServiceName);
653     if (*lpServiceName == L'{')
654         return ERROR_SUCCESS;
655 
656     dwSize = sizeof(DWORD);
657     dwError = RegQueryValueExW(hServiceKey,
658                                L"Type",
659                                NULL,
660                                NULL,
661                                (LPBYTE)&dwServiceType,
662                                &dwSize);
663     if (dwError != ERROR_SUCCESS)
664         return ERROR_SUCCESS;
665 
666     if (((dwServiceType & ~SERVICE_INTERACTIVE_PROCESS) != SERVICE_WIN32_OWN_PROCESS) &&
667         ((dwServiceType & ~SERVICE_INTERACTIVE_PROCESS) != SERVICE_WIN32_SHARE_PROCESS) &&
668         (dwServiceType != SERVICE_KERNEL_DRIVER) &&
669         (dwServiceType != SERVICE_FILE_SYSTEM_DRIVER))
670         return ERROR_SUCCESS;
671 
672     DPRINT("Service type: %lx\n", dwServiceType);
673 
674     dwSize = sizeof(DWORD);
675     dwError = RegQueryValueExW(hServiceKey,
676                                L"Start",
677                                NULL,
678                                NULL,
679                                (LPBYTE)&dwStartType,
680                                &dwSize);
681     if (dwError != ERROR_SUCCESS)
682         return ERROR_SUCCESS;
683 
684     DPRINT("Start type: %lx\n", dwStartType);
685 
686     dwSize = sizeof(DWORD);
687     dwError = RegQueryValueExW(hServiceKey,
688                                L"ErrorControl",
689                                NULL,
690                                NULL,
691                                (LPBYTE)&dwErrorControl,
692                                &dwSize);
693     if (dwError != ERROR_SUCCESS)
694         return ERROR_SUCCESS;
695 
696     DPRINT("Error control: %lx\n", dwErrorControl);
697 
698     dwError = RegQueryValueExW(hServiceKey,
699                                L"Tag",
700                                NULL,
701                                NULL,
702                                (LPBYTE)&dwTagId,
703                                &dwSize);
704     if (dwError != ERROR_SUCCESS)
705         dwTagId = 0;
706 
707     DPRINT("Tag: %lx\n", dwTagId);
708 
709     dwError = ScmReadString(hServiceKey,
710                             L"Group",
711                             &lpGroup);
712     if (dwError != ERROR_SUCCESS)
713         lpGroup = NULL;
714 
715     DPRINT("Group: %S\n", lpGroup);
716 
717     dwError = ScmReadString(hServiceKey,
718                             L"DisplayName",
719                             &lpDisplayName);
720     if (dwError != ERROR_SUCCESS)
721         lpDisplayName = NULL;
722 
723     DPRINT("Display name: %S\n", lpDisplayName);
724 
725     dwError = ScmCreateNewServiceRecord(lpServiceName,
726                                         &lpService,
727                                         dwServiceType,
728                                         dwStartType);
729     if (dwError != ERROR_SUCCESS)
730         goto done;
731 
732     lpService->dwErrorControl = dwErrorControl;
733     lpService->dwTag = dwTagId;
734 
735     if (lpGroup != NULL)
736     {
737         dwError = ScmSetServiceGroup(lpService, lpGroup);
738         if (dwError != ERROR_SUCCESS)
739             goto done;
740     }
741 
742     if (lpDisplayName != NULL)
743     {
744         lpService->lpDisplayName = lpDisplayName;
745         lpDisplayName = NULL;
746     }
747 
748     DPRINT("ServiceName: '%S'\n", lpService->lpServiceName);
749     if (lpService->lpGroup != NULL)
750     {
751         DPRINT("Group: '%S'\n", lpService->lpGroup->lpGroupName);
752     }
753     DPRINT("Start %lx  Type %lx  Tag %lx  ErrorControl %lx\n",
754            lpService->dwStartType,
755            lpService->Status.dwServiceType,
756            lpService->dwTag,
757            lpService->dwErrorControl);
758 
759     if (ScmIsDeleteFlagSet(hServiceKey))
760         lpService->bDeleted = TRUE;
761 
762     if (lpService->Status.dwServiceType & SERVICE_WIN32)
763     {
764         dwError = ScmReadSecurityDescriptor(hServiceKey,
765                                             &lpService->pSecurityDescriptor);
766         if (dwError != ERROR_SUCCESS)
767             goto done;
768 
769         /* Assing the default security descriptor if the security descriptor cannot be read */
770         if (lpService->pSecurityDescriptor == NULL)
771         {
772             DPRINT("No security descriptor found! Assign default security descriptor!\n");
773             dwError = ScmCreateDefaultServiceSD(&lpService->pSecurityDescriptor);
774             if (dwError != ERROR_SUCCESS)
775                 goto done;
776 
777             dwError = ScmWriteSecurityDescriptor(hServiceKey,
778                                                  lpService->pSecurityDescriptor);
779             if (dwError != ERROR_SUCCESS)
780                 goto done;
781         }
782     }
783 
784 done:
785     if (lpGroup != NULL)
786         HeapFree(GetProcessHeap(), 0, lpGroup);
787 
788     if (lpDisplayName != NULL)
789         HeapFree(GetProcessHeap(), 0, lpDisplayName);
790 
791     if (lpService != NULL)
792     {
793         ASSERT(lpService->lpImage == NULL);
794     }
795 
796     return dwError;
797 }
798 
799 
800 VOID
801 ScmDeleteMarkedServices(VOID)
802 {
803     PLIST_ENTRY ServiceEntry;
804     PSERVICE CurrentService;
805     HKEY hServicesKey;
806     DWORD dwError;
807 
808     ServiceEntry = ServiceListHead.Flink;
809     while (ServiceEntry != &ServiceListHead)
810     {
811         CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
812 
813         ServiceEntry = ServiceEntry->Flink;
814 
815         if (CurrentService->bDeleted != FALSE)
816         {
817             dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
818                                     L"System\\CurrentControlSet\\Services",
819                                     0,
820                                     DELETE,
821                                     &hServicesKey);
822             if (dwError == ERROR_SUCCESS)
823             {
824                 dwError = ScmDeleteRegKey(hServicesKey, CurrentService->lpServiceName);
825                 RegCloseKey(hServicesKey);
826                 if (dwError == ERROR_SUCCESS)
827                 {
828                     RemoveEntryList(&CurrentService->ServiceListEntry);
829                     HeapFree(GetProcessHeap(), 0, CurrentService);
830                 }
831             }
832 
833             if (dwError != ERROR_SUCCESS)
834                 DPRINT1("Delete service failed: %S\n", CurrentService->lpServiceName);
835         }
836     }
837 }
838 
839 
840 static
841 VOID
842 ScmGetNoInteractiveServicesValue(VOID)
843 {
844     HKEY hKey;
845     DWORD dwKeySize;
846     LONG lError;
847 
848     lError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
849                            L"SYSTEM\\CurrentControlSet\\Control\\Windows",
850                            0,
851                            KEY_READ,
852                            &hKey);
853     if (lError == ERROR_SUCCESS)
854     {
855         dwKeySize = sizeof(NoInteractiveServices);
856         lError = RegQueryValueExW(hKey,
857                                   L"NoInteractiveServices",
858                                   0,
859                                   NULL,
860                                   (LPBYTE)&NoInteractiveServices,
861                                   &dwKeySize);
862         RegCloseKey(hKey);
863     }
864 }
865 
866 
867 DWORD
868 ScmCreateServiceDatabase(VOID)
869 {
870     WCHAR szSubKey[MAX_PATH];
871     HKEY hServicesKey;
872     HKEY hServiceKey;
873     DWORD dwSubKey;
874     DWORD dwSubKeyLength;
875     FILETIME ftLastChanged;
876     DWORD dwError;
877 
878     DPRINT("ScmCreateServiceDatabase() called\n");
879 
880     /* Retrieve the NoInteractiveServies value */
881     ScmGetNoInteractiveServicesValue();
882 
883     /* Create the service group list */
884     dwError = ScmCreateGroupList();
885     if (dwError != ERROR_SUCCESS)
886         return dwError;
887 
888     /* Initialize image and service lists */
889     InitializeListHead(&ImageListHead);
890     InitializeListHead(&ServiceListHead);
891 
892     /* Initialize the database lock */
893     RtlInitializeResource(&DatabaseLock);
894 
895     dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
896                             L"System\\CurrentControlSet\\Services",
897                             0,
898                             KEY_READ,
899                             &hServicesKey);
900     if (dwError != ERROR_SUCCESS)
901         return dwError;
902 
903     dwSubKey = 0;
904     for (;;)
905     {
906         dwSubKeyLength = MAX_PATH;
907         dwError = RegEnumKeyExW(hServicesKey,
908                                 dwSubKey,
909                                 szSubKey,
910                                 &dwSubKeyLength,
911                                 NULL,
912                                 NULL,
913                                 NULL,
914                                 &ftLastChanged);
915         if (dwError == ERROR_SUCCESS &&
916             szSubKey[0] != L'{')
917         {
918             DPRINT("SubKeyName: '%S'\n", szSubKey);
919 
920             dwError = RegOpenKeyExW(hServicesKey,
921                                     szSubKey,
922                                     0,
923                                     KEY_READ,
924                                     &hServiceKey);
925             if (dwError == ERROR_SUCCESS)
926             {
927                 dwError = CreateServiceListEntry(szSubKey,
928                                                  hServiceKey);
929 
930                 RegCloseKey(hServiceKey);
931             }
932         }
933 
934         if (dwError != ERROR_SUCCESS)
935             break;
936 
937         dwSubKey++;
938     }
939 
940     RegCloseKey(hServicesKey);
941 
942     /* Wait for the LSA server */
943     ScmWaitForLsa();
944 
945     /* Delete services that are marked for delete */
946     ScmDeleteMarkedServices();
947 
948     DPRINT("ScmCreateServiceDatabase() done\n");
949 
950     return ERROR_SUCCESS;
951 }
952 
953 
954 VOID
955 ScmShutdownServiceDatabase(VOID)
956 {
957     DPRINT("ScmShutdownServiceDatabase() called\n");
958 
959     ScmDeleteMarkedServices();
960     RtlDeleteResource(&DatabaseLock);
961 
962     DPRINT("ScmShutdownServiceDatabase() done\n");
963 }
964 
965 
966 static NTSTATUS
967 ScmCheckDriver(PSERVICE Service)
968 {
969     OBJECT_ATTRIBUTES ObjectAttributes;
970     UNICODE_STRING DirName;
971     HANDLE DirHandle;
972     NTSTATUS Status;
973     POBJECT_DIRECTORY_INFORMATION DirInfo;
974     ULONG BufferLength;
975     ULONG DataLength;
976     ULONG Index;
977 
978     DPRINT("ScmCheckDriver(%S) called\n", Service->lpServiceName);
979 
980     if (Service->Status.dwServiceType == SERVICE_KERNEL_DRIVER)
981     {
982         RtlInitUnicodeString(&DirName, L"\\Driver");
983     }
984     else // if (Service->Status.dwServiceType == SERVICE_FILE_SYSTEM_DRIVER)
985     {
986         ASSERT(Service->Status.dwServiceType == SERVICE_FILE_SYSTEM_DRIVER);
987         RtlInitUnicodeString(&DirName, L"\\FileSystem");
988     }
989 
990     InitializeObjectAttributes(&ObjectAttributes,
991                                &DirName,
992                                0,
993                                NULL,
994                                NULL);
995 
996     Status = NtOpenDirectoryObject(&DirHandle,
997                                    DIRECTORY_QUERY | DIRECTORY_TRAVERSE,
998                                    &ObjectAttributes);
999     if (!NT_SUCCESS(Status))
1000     {
1001         return Status;
1002     }
1003 
1004     BufferLength = sizeof(OBJECT_DIRECTORY_INFORMATION) +
1005                        2 * MAX_PATH * sizeof(WCHAR);
1006     DirInfo = HeapAlloc(GetProcessHeap(),
1007                         HEAP_ZERO_MEMORY,
1008                         BufferLength);
1009 
1010     Index = 0;
1011     while (TRUE)
1012     {
1013         Status = NtQueryDirectoryObject(DirHandle,
1014                                         DirInfo,
1015                                         BufferLength,
1016                                         TRUE,
1017                                         FALSE,
1018                                         &Index,
1019                                         &DataLength);
1020         if (Status == STATUS_NO_MORE_ENTRIES)
1021         {
1022             /* FIXME: Add current service to 'failed service' list */
1023             DPRINT("Service '%S' failed\n", Service->lpServiceName);
1024             break;
1025         }
1026 
1027         if (!NT_SUCCESS(Status))
1028             break;
1029 
1030         DPRINT("Comparing: '%S'  '%wZ'\n", Service->lpServiceName, &DirInfo->Name);
1031 
1032         if (_wcsicmp(Service->lpServiceName, DirInfo->Name.Buffer) == 0)
1033         {
1034             DPRINT("Found: '%S'  '%wZ'\n",
1035                    Service->lpServiceName, &DirInfo->Name);
1036 
1037             /* Mark service as 'running' */
1038             Service->Status.dwCurrentState = SERVICE_RUNNING;
1039             Service->Status.dwControlsAccepted = SERVICE_ACCEPT_STOP;
1040             Service->Status.dwWin32ExitCode = ERROR_SUCCESS;
1041             Service->Status.dwServiceSpecificExitCode = 0;
1042             Service->Status.dwCheckPoint = 0;
1043             Service->Status.dwWaitHint = 0;
1044 
1045             /* Mark the service group as 'running' */
1046             if (Service->lpGroup != NULL)
1047             {
1048                 Service->lpGroup->ServicesRunning = TRUE;
1049             }
1050 
1051             break;
1052         }
1053     }
1054 
1055     HeapFree(GetProcessHeap(),
1056              0,
1057              DirInfo);
1058     NtClose(DirHandle);
1059 
1060     return STATUS_SUCCESS;
1061 }
1062 
1063 
1064 VOID
1065 ScmGetBootAndSystemDriverState(VOID)
1066 {
1067     PLIST_ENTRY ServiceEntry;
1068     PSERVICE CurrentService;
1069 
1070     DPRINT("ScmGetBootAndSystemDriverState() called\n");
1071 
1072     ServiceEntry = ServiceListHead.Flink;
1073     while (ServiceEntry != &ServiceListHead)
1074     {
1075         CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
1076 
1077         if (CurrentService->dwStartType == SERVICE_BOOT_START ||
1078             CurrentService->dwStartType == SERVICE_SYSTEM_START)
1079         {
1080             /* Check driver */
1081             DPRINT("  Checking service: %S\n", CurrentService->lpServiceName);
1082 
1083             ScmCheckDriver(CurrentService);
1084         }
1085 
1086         ServiceEntry = ServiceEntry->Flink;
1087     }
1088 
1089     DPRINT("ScmGetBootAndSystemDriverState() done\n");
1090 }
1091 
1092 
1093 DWORD
1094 ScmControlService(HANDLE hControlPipe,
1095                   PWSTR pServiceName,
1096                   SERVICE_STATUS_HANDLE hServiceStatus,
1097                   DWORD dwControl)
1098 {
1099     PSCM_CONTROL_PACKET ControlPacket;
1100     SCM_REPLY_PACKET ReplyPacket;
1101 
1102     DWORD dwWriteCount = 0;
1103     DWORD dwReadCount = 0;
1104     DWORD PacketSize;
1105     PWSTR Ptr;
1106     DWORD dwError = ERROR_SUCCESS;
1107     BOOL bResult;
1108     OVERLAPPED Overlapped = {0};
1109 
1110     DPRINT("ScmControlService() called\n");
1111 
1112     /* Acquire the service control critical section, to synchronize requests */
1113     EnterCriticalSection(&ControlServiceCriticalSection);
1114 
1115     /* Calculate the total length of the start command line */
1116     PacketSize = sizeof(SCM_CONTROL_PACKET);
1117     PacketSize += (DWORD)((wcslen(pServiceName) + 1) * sizeof(WCHAR));
1118 
1119     ControlPacket = HeapAlloc(GetProcessHeap(),
1120                               HEAP_ZERO_MEMORY,
1121                               PacketSize);
1122     if (ControlPacket == NULL)
1123     {
1124         LeaveCriticalSection(&ControlServiceCriticalSection);
1125         return ERROR_NOT_ENOUGH_MEMORY;
1126     }
1127 
1128     ControlPacket->dwSize = PacketSize;
1129     ControlPacket->dwControl = dwControl;
1130     ControlPacket->hServiceStatus = hServiceStatus;
1131 
1132     ControlPacket->dwServiceNameOffset = sizeof(SCM_CONTROL_PACKET);
1133 
1134     Ptr = (PWSTR)((PBYTE)ControlPacket + ControlPacket->dwServiceNameOffset);
1135     wcscpy(Ptr, pServiceName);
1136 
1137     ControlPacket->dwArgumentsCount = 0;
1138     ControlPacket->dwArgumentsOffset = 0;
1139 
1140     bResult = WriteFile(hControlPipe,
1141                         ControlPacket,
1142                         PacketSize,
1143                         &dwWriteCount,
1144                         &Overlapped);
1145     if (bResult == FALSE)
1146     {
1147         DPRINT("WriteFile() returned FALSE\n");
1148 
1149         dwError = GetLastError();
1150         if (dwError == ERROR_IO_PENDING)
1151         {
1152             DPRINT("dwError: ERROR_IO_PENDING\n");
1153 
1154             dwError = WaitForSingleObject(hControlPipe,
1155                                           PipeTimeout);
1156             DPRINT("WaitForSingleObject() returned %lu\n", dwError);
1157 
1158             if (dwError == WAIT_TIMEOUT)
1159             {
1160                 bResult = CancelIo(hControlPipe);
1161                 if (bResult == FALSE)
1162                 {
1163                     DPRINT1("CancelIo() failed (Error: %lu)\n", GetLastError());
1164                 }
1165 
1166                 dwError = ERROR_SERVICE_REQUEST_TIMEOUT;
1167                 goto Done;
1168             }
1169             else if (dwError == WAIT_OBJECT_0)
1170             {
1171                 bResult = GetOverlappedResult(hControlPipe,
1172                                               &Overlapped,
1173                                               &dwWriteCount,
1174                                               TRUE);
1175                 if (bResult == FALSE)
1176                 {
1177                     dwError = GetLastError();
1178                     DPRINT1("GetOverlappedResult() failed (Error %lu)\n", dwError);
1179 
1180                     goto Done;
1181                 }
1182             }
1183         }
1184         else
1185         {
1186             DPRINT1("WriteFile() failed (Error %lu)\n", dwError);
1187             goto Done;
1188         }
1189     }
1190 
1191     /* Read the reply */
1192     Overlapped.hEvent = (HANDLE) NULL;
1193 
1194     bResult = ReadFile(hControlPipe,
1195                        &ReplyPacket,
1196                        sizeof(SCM_REPLY_PACKET),
1197                        &dwReadCount,
1198                        &Overlapped);
1199     if (bResult == FALSE)
1200     {
1201         DPRINT("ReadFile() returned FALSE\n");
1202 
1203         dwError = GetLastError();
1204         if (dwError == ERROR_IO_PENDING)
1205         {
1206             DPRINT("dwError: ERROR_IO_PENDING\n");
1207 
1208             dwError = WaitForSingleObject(hControlPipe,
1209                                           PipeTimeout);
1210             DPRINT("WaitForSingleObject() returned %lu\n", dwError);
1211 
1212             if (dwError == WAIT_TIMEOUT)
1213             {
1214                 bResult = CancelIo(hControlPipe);
1215                 if (bResult == FALSE)
1216                 {
1217                     DPRINT1("CancelIo() failed (Error: %lu)\n", GetLastError());
1218                 }
1219 
1220                 dwError = ERROR_SERVICE_REQUEST_TIMEOUT;
1221                 goto Done;
1222             }
1223             else if (dwError == WAIT_OBJECT_0)
1224             {
1225                 bResult = GetOverlappedResult(hControlPipe,
1226                                               &Overlapped,
1227                                               &dwReadCount,
1228                                               TRUE);
1229                 if (bResult == FALSE)
1230                 {
1231                     dwError = GetLastError();
1232                     DPRINT1("GetOverlappedResult() failed (Error %lu)\n", dwError);
1233 
1234                     goto Done;
1235                 }
1236             }
1237         }
1238         else
1239         {
1240             DPRINT1("ReadFile() failed (Error %lu)\n", dwError);
1241             goto Done;
1242         }
1243     }
1244 
1245 Done:
1246     /* Release the control packet */
1247     HeapFree(GetProcessHeap(),
1248              0,
1249              ControlPacket);
1250 
1251     if (dwReadCount == sizeof(SCM_REPLY_PACKET))
1252     {
1253         dwError = ReplyPacket.dwError;
1254     }
1255 
1256     LeaveCriticalSection(&ControlServiceCriticalSection);
1257 
1258     DPRINT("ScmControlService() done\n");
1259 
1260     return dwError;
1261 }
1262 
1263 
1264 static DWORD
1265 ScmSendStartCommand(PSERVICE Service,
1266                     DWORD argc,
1267                     LPWSTR* argv)
1268 {
1269     DWORD dwError = ERROR_SUCCESS;
1270     PSCM_CONTROL_PACKET ControlPacket;
1271     SCM_REPLY_PACKET ReplyPacket;
1272     DWORD PacketSize;
1273     DWORD i;
1274     PWSTR Ptr;
1275     PWSTR *pOffPtr;
1276     PWSTR pArgPtr;
1277     BOOL bResult;
1278     DWORD dwWriteCount = 0;
1279     DWORD dwReadCount = 0;
1280     OVERLAPPED Overlapped = {0};
1281 
1282     DPRINT("ScmSendStartCommand() called\n");
1283 
1284     /* Calculate the total length of the start command line */
1285     PacketSize = sizeof(SCM_CONTROL_PACKET);
1286     PacketSize += (DWORD)((wcslen(Service->lpServiceName) + 1) * sizeof(WCHAR));
1287 
1288     /*
1289      * Calculate the required packet size for the start argument vector 'argv',
1290      * composed of the list of pointer offsets, followed by UNICODE strings.
1291      * The strings are stored continuously after the vector of offsets, with
1292      * the offsets being relative to the beginning of the vector, as in the
1293      * following layout (with N == argc):
1294      *     [argOff(0)]...[argOff(N-1)][str(0)]...[str(N-1)] .
1295      */
1296     if (argc > 0 && argv != NULL)
1297     {
1298         PacketSize = ALIGN_UP(PacketSize, PWSTR);
1299         PacketSize += (argc * sizeof(PWSTR));
1300 
1301         DPRINT("Argc: %lu\n", argc);
1302         for (i = 0; i < argc; i++)
1303         {
1304             DPRINT("Argv[%lu]: %S\n", i, argv[i]);
1305             PacketSize += (DWORD)((wcslen(argv[i]) + 1) * sizeof(WCHAR));
1306         }
1307     }
1308 
1309     /* Allocate a control packet */
1310     ControlPacket = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PacketSize);
1311     if (ControlPacket == NULL)
1312         return ERROR_NOT_ENOUGH_MEMORY;
1313 
1314     ControlPacket->dwSize = PacketSize;
1315     ControlPacket->dwControl = (Service->Status.dwServiceType & SERVICE_WIN32_OWN_PROCESS)
1316                                ? SERVICE_CONTROL_START_OWN
1317                                : SERVICE_CONTROL_START_SHARE;
1318     ControlPacket->hServiceStatus = (SERVICE_STATUS_HANDLE)Service;
1319 
1320     /* Copy the start command line */
1321     ControlPacket->dwServiceNameOffset = sizeof(SCM_CONTROL_PACKET);
1322     Ptr = (PWSTR)((ULONG_PTR)ControlPacket + ControlPacket->dwServiceNameOffset);
1323     wcscpy(Ptr, Service->lpServiceName);
1324 
1325     ControlPacket->dwArgumentsCount  = 0;
1326     ControlPacket->dwArgumentsOffset = 0;
1327 
1328     /* Copy the argument vector */
1329     if (argc > 0 && argv != NULL)
1330     {
1331         Ptr += wcslen(Service->lpServiceName) + 1;
1332         pOffPtr = (PWSTR*)ALIGN_UP_POINTER(Ptr, PWSTR);
1333         pArgPtr = (PWSTR)((ULONG_PTR)pOffPtr + argc * sizeof(PWSTR));
1334 
1335         ControlPacket->dwArgumentsCount  = argc;
1336         ControlPacket->dwArgumentsOffset = (DWORD)((ULONG_PTR)pOffPtr - (ULONG_PTR)ControlPacket);
1337 
1338         DPRINT("dwArgumentsCount: %lu\n", ControlPacket->dwArgumentsCount);
1339         DPRINT("dwArgumentsOffset: %lu\n", ControlPacket->dwArgumentsOffset);
1340 
1341         for (i = 0; i < argc; i++)
1342         {
1343             wcscpy(pArgPtr, argv[i]);
1344             pOffPtr[i] = (PWSTR)((ULONG_PTR)pArgPtr - (ULONG_PTR)pOffPtr);
1345             DPRINT("offset[%lu]: %p\n", i, pOffPtr[i]);
1346             pArgPtr += wcslen(argv[i]) + 1;
1347         }
1348     }
1349 
1350     bResult = WriteFile(Service->lpImage->hControlPipe,
1351                         ControlPacket,
1352                         PacketSize,
1353                         &dwWriteCount,
1354                         &Overlapped);
1355     if (bResult == FALSE)
1356     {
1357         DPRINT("WriteFile() returned FALSE\n");
1358 
1359         dwError = GetLastError();
1360         if (dwError == ERROR_IO_PENDING)
1361         {
1362             DPRINT("dwError: ERROR_IO_PENDING\n");
1363 
1364             dwError = WaitForSingleObject(Service->lpImage->hControlPipe,
1365                                           PipeTimeout);
1366             DPRINT("WaitForSingleObject() returned %lu\n", dwError);
1367 
1368             if (dwError == WAIT_TIMEOUT)
1369             {
1370                 bResult = CancelIo(Service->lpImage->hControlPipe);
1371                 if (bResult == FALSE)
1372                 {
1373                     DPRINT1("CancelIo() failed (Error: %lu)\n", GetLastError());
1374                 }
1375 
1376                 dwError = ERROR_SERVICE_REQUEST_TIMEOUT;
1377                 goto Done;
1378             }
1379             else if (dwError == WAIT_OBJECT_0)
1380             {
1381                 bResult = GetOverlappedResult(Service->lpImage->hControlPipe,
1382                                               &Overlapped,
1383                                               &dwWriteCount,
1384                                               TRUE);
1385                 if (bResult == FALSE)
1386                 {
1387                     dwError = GetLastError();
1388                     DPRINT1("GetOverlappedResult() failed (Error %lu)\n", dwError);
1389 
1390                     goto Done;
1391                 }
1392             }
1393         }
1394         else
1395         {
1396             DPRINT1("WriteFile() failed (Error %lu)\n", dwError);
1397             goto Done;
1398         }
1399     }
1400 
1401     /* Read the reply */
1402     Overlapped.hEvent = (HANDLE) NULL;
1403 
1404     bResult = ReadFile(Service->lpImage->hControlPipe,
1405                        &ReplyPacket,
1406                        sizeof(SCM_REPLY_PACKET),
1407                        &dwReadCount,
1408                        &Overlapped);
1409     if (bResult == FALSE)
1410     {
1411         DPRINT("ReadFile() returned FALSE\n");
1412 
1413         dwError = GetLastError();
1414         if (dwError == ERROR_IO_PENDING)
1415         {
1416             DPRINT("dwError: ERROR_IO_PENDING\n");
1417 
1418             dwError = WaitForSingleObject(Service->lpImage->hControlPipe,
1419                                           PipeTimeout);
1420             DPRINT("WaitForSingleObject() returned %lu\n", dwError);
1421 
1422             if (dwError == WAIT_TIMEOUT)
1423             {
1424                 bResult = CancelIo(Service->lpImage->hControlPipe);
1425                 if (bResult == FALSE)
1426                 {
1427                     DPRINT1("CancelIo() failed (Error: %lu)\n", GetLastError());
1428                 }
1429 
1430                 dwError = ERROR_SERVICE_REQUEST_TIMEOUT;
1431                 goto Done;
1432             }
1433             else if (dwError == WAIT_OBJECT_0)
1434             {
1435                 bResult = GetOverlappedResult(Service->lpImage->hControlPipe,
1436                                               &Overlapped,
1437                                               &dwReadCount,
1438                                               TRUE);
1439                 if (bResult == FALSE)
1440                 {
1441                     dwError = GetLastError();
1442                     DPRINT1("GetOverlappedResult() failed (Error %lu)\n", dwError);
1443 
1444                     goto Done;
1445                 }
1446             }
1447         }
1448         else
1449         {
1450             DPRINT1("ReadFile() failed (Error %lu)\n", dwError);
1451             goto Done;
1452         }
1453     }
1454 
1455 Done:
1456     /* Release the control packet */
1457     HeapFree(GetProcessHeap(),
1458              0,
1459              ControlPacket);
1460 
1461     if (dwReadCount == sizeof(SCM_REPLY_PACKET))
1462     {
1463         dwError = ReplyPacket.dwError;
1464     }
1465 
1466     DPRINT("ScmSendStartCommand() done\n");
1467 
1468     return dwError;
1469 }
1470 
1471 
1472 static DWORD
1473 ScmWaitForServiceConnect(PSERVICE Service)
1474 {
1475     DWORD dwRead = 0;
1476     DWORD dwProcessId = 0;
1477     DWORD dwError = ERROR_SUCCESS;
1478     BOOL bResult;
1479     OVERLAPPED Overlapped = {0};
1480 #if 0
1481     LPCWSTR lpLogStrings[3];
1482     WCHAR szBuffer1[20];
1483     WCHAR szBuffer2[20];
1484 #endif
1485 
1486     DPRINT("ScmWaitForServiceConnect()\n");
1487 
1488     Overlapped.hEvent = (HANDLE)NULL;
1489 
1490     bResult = ConnectNamedPipe(Service->lpImage->hControlPipe,
1491                                &Overlapped);
1492     if (bResult == FALSE)
1493     {
1494         DPRINT("ConnectNamedPipe() returned FALSE\n");
1495 
1496         dwError = GetLastError();
1497         if (dwError == ERROR_IO_PENDING)
1498         {
1499             DPRINT("dwError: ERROR_IO_PENDING\n");
1500 
1501             dwError = WaitForSingleObject(Service->lpImage->hControlPipe,
1502                                           PipeTimeout);
1503             DPRINT("WaitForSingleObject() returned %lu\n", dwError);
1504 
1505             if (dwError == WAIT_TIMEOUT)
1506             {
1507                 DPRINT("WaitForSingleObject() returned WAIT_TIMEOUT\n");
1508 
1509                 bResult = CancelIo(Service->lpImage->hControlPipe);
1510                 if (bResult == FALSE)
1511                 {
1512                     DPRINT1("CancelIo() failed (Error: %lu)\n", GetLastError());
1513                 }
1514 
1515 #if 0
1516                 _ultow(PipeTimeout, szBuffer1, 10);
1517                 lpLogStrings[0] = Service->lpDisplayName;
1518                 lpLogStrings[1] = szBuffer1;
1519 
1520                 ScmLogEvent(EVENT_CONNECTION_TIMEOUT,
1521                             EVENTLOG_ERROR_TYPE,
1522                             2,
1523                             lpLogStrings);
1524 #endif
1525                 DPRINT1("Log EVENT_CONNECTION_TIMEOUT by %S\n", Service->lpDisplayName);
1526 
1527                 return ERROR_SERVICE_REQUEST_TIMEOUT;
1528             }
1529             else if (dwError == WAIT_OBJECT_0)
1530             {
1531                 bResult = GetOverlappedResult(Service->lpImage->hControlPipe,
1532                                               &Overlapped,
1533                                               &dwRead,
1534                                               TRUE);
1535                 if (bResult == FALSE)
1536                 {
1537                     dwError = GetLastError();
1538                     DPRINT1("GetOverlappedResult failed (Error %lu)\n", dwError);
1539 
1540                     return dwError;
1541                 }
1542             }
1543         }
1544         else if (dwError != ERROR_PIPE_CONNECTED)
1545         {
1546             DPRINT1("ConnectNamedPipe failed (Error %lu)\n", dwError);
1547             return dwError;
1548         }
1549     }
1550 
1551     DPRINT("Control pipe connected!\n");
1552 
1553     Overlapped.hEvent = (HANDLE) NULL;
1554 
1555     /* Read the process id from pipe */
1556     bResult = ReadFile(Service->lpImage->hControlPipe,
1557                        (LPVOID)&dwProcessId,
1558                        sizeof(DWORD),
1559                        &dwRead,
1560                        &Overlapped);
1561     if (bResult == FALSE)
1562     {
1563         DPRINT("ReadFile() returned FALSE\n");
1564 
1565         dwError = GetLastError();
1566         if (dwError == ERROR_IO_PENDING)
1567         {
1568             DPRINT("dwError: ERROR_IO_PENDING\n");
1569 
1570             dwError = WaitForSingleObject(Service->lpImage->hControlPipe,
1571                                           PipeTimeout);
1572             if (dwError == WAIT_TIMEOUT)
1573             {
1574                 DPRINT("WaitForSingleObject() returned WAIT_TIMEOUT\n");
1575 
1576                 bResult = CancelIo(Service->lpImage->hControlPipe);
1577                 if (bResult == FALSE)
1578                 {
1579                     DPRINT1("CancelIo() failed (Error: %lu)\n", GetLastError());
1580                 }
1581 
1582 #if 0
1583                 _ultow(PipeTimeout, szBuffer1, 10);
1584                 lpLogStrings[0] = szBuffer1;
1585 
1586                 ScmLogEvent(EVENT_READFILE_TIMEOUT,
1587                             EVENTLOG_ERROR_TYPE,
1588                             1,
1589                             lpLogStrings);
1590 #endif
1591                 DPRINT1("Log EVENT_READFILE_TIMEOUT by %S\n", Service->lpDisplayName);
1592 
1593                 return ERROR_SERVICE_REQUEST_TIMEOUT;
1594             }
1595             else if (dwError == WAIT_OBJECT_0)
1596             {
1597                 DPRINT("WaitForSingleObject() returned WAIT_OBJECT_0\n");
1598 
1599                 DPRINT("Process Id: %lu\n", dwProcessId);
1600 
1601                 bResult = GetOverlappedResult(Service->lpImage->hControlPipe,
1602                                               &Overlapped,
1603                                               &dwRead,
1604                                               TRUE);
1605                 if (bResult == FALSE)
1606                 {
1607                     dwError = GetLastError();
1608                     DPRINT1("GetOverlappedResult() failed (Error %lu)\n", dwError);
1609 
1610                     return dwError;
1611                 }
1612             }
1613             else
1614             {
1615                 DPRINT1("WaitForSingleObject() returned %lu\n", dwError);
1616             }
1617         }
1618         else
1619         {
1620             DPRINT1("ReadFile() failed (Error %lu)\n", dwError);
1621             return dwError;
1622         }
1623     }
1624 
1625     if (dwProcessId != Service->lpImage->dwProcessId)
1626     {
1627 #if 0
1628         _ultow(Service->lpImage->dwProcessId, szBuffer1, 10);
1629         _ultow(dwProcessId, szBuffer2, 10);
1630 
1631         lpLogStrings[0] = Service->lpDisplayName;
1632         lpLogStrings[1] = szBuffer1;
1633         lpLogStrings[2] = szBuffer2;
1634 
1635         ScmLogEvent(EVENT_SERVICE_DIFFERENT_PID_CONNECTED,
1636                     EVENTLOG_WARNING_TYPE,
1637                     3,
1638                     lpLogStrings);
1639 #endif
1640 
1641         DPRINT1("Log EVENT_SERVICE_DIFFERENT_PID_CONNECTED by %S\n", Service->lpDisplayName);
1642     }
1643 
1644     DPRINT("ScmWaitForServiceConnect() done\n");
1645 
1646     return ERROR_SUCCESS;
1647 }
1648 
1649 
1650 static DWORD
1651 ScmStartUserModeService(PSERVICE Service,
1652                         DWORD argc,
1653                         LPWSTR* argv)
1654 {
1655     PROCESS_INFORMATION ProcessInformation;
1656     STARTUPINFOW StartupInfo;
1657     LPVOID lpEnvironment;
1658     BOOL Result;
1659     DWORD dwError = ERROR_SUCCESS;
1660 
1661     DPRINT("ScmStartUserModeService(%p)\n", Service);
1662 
1663     /* If the image is already running ... */
1664     if (Service->lpImage->dwImageRunCount > 1)
1665     {
1666         /* ... just send a start command */
1667         return ScmSendStartCommand(Service, argc, argv);
1668     }
1669 
1670     /* Otherwise start its process */
1671     ZeroMemory(&StartupInfo, sizeof(StartupInfo));
1672     StartupInfo.cb = sizeof(StartupInfo);
1673     ZeroMemory(&ProcessInformation, sizeof(ProcessInformation));
1674 
1675     /* Use the interactive desktop if the service is interactive */
1676     if ((NoInteractiveServices == 0) &&
1677         (Service->Status.dwServiceType & SERVICE_INTERACTIVE_PROCESS))
1678     {
1679         StartupInfo.dwFlags |= STARTF_INHERITDESKTOP;
1680         StartupInfo.lpDesktop = L"WinSta0\\Default";
1681     }
1682 
1683     if (Service->lpImage->hToken)
1684     {
1685         /* User token: Run the service under the user account */
1686 
1687         if (!CreateEnvironmentBlock(&lpEnvironment, Service->lpImage->hToken, FALSE))
1688         {
1689             /* We failed, run the service with the current environment */
1690             DPRINT1("CreateEnvironmentBlock() failed with error %d; service '%S' will run with the current environment.\n",
1691                     GetLastError(), Service->lpServiceName);
1692             lpEnvironment = NULL;
1693         }
1694 
1695         /* Impersonate the new user */
1696         Result = ImpersonateLoggedOnUser(Service->lpImage->hToken);
1697         if (Result)
1698         {
1699             /* Launch the process in the user's logon session */
1700             Result = CreateProcessAsUserW(Service->lpImage->hToken,
1701                                           NULL,
1702                                           Service->lpImage->pszImagePath,
1703                                           NULL,
1704                                           NULL,
1705                                           FALSE,
1706                                           CREATE_UNICODE_ENVIRONMENT | DETACHED_PROCESS | CREATE_SUSPENDED,
1707                                           lpEnvironment,
1708                                           NULL,
1709                                           &StartupInfo,
1710                                           &ProcessInformation);
1711             if (!Result)
1712                 dwError = GetLastError();
1713 
1714             /* Revert the impersonation */
1715             RevertToSelf();
1716         }
1717         else
1718         {
1719             dwError = GetLastError();
1720             DPRINT1("ImpersonateLoggedOnUser() failed with error %d\n", dwError);
1721         }
1722     }
1723     else
1724     {
1725         /* No user token: Run the service under the LocalSystem account */
1726 
1727         if (!CreateEnvironmentBlock(&lpEnvironment, NULL, TRUE))
1728         {
1729             /* We failed, run the service with the current environment */
1730             DPRINT1("CreateEnvironmentBlock() failed with error %d; service '%S' will run with the current environment.\n",
1731                     GetLastError(), Service->lpServiceName);
1732             lpEnvironment = NULL;
1733         }
1734 
1735         Result = CreateProcessW(NULL,
1736                                 Service->lpImage->pszImagePath,
1737                                 NULL,
1738                                 NULL,
1739                                 FALSE,
1740                                 CREATE_UNICODE_ENVIRONMENT | DETACHED_PROCESS | CREATE_SUSPENDED,
1741                                 lpEnvironment,
1742                                 NULL,
1743                                 &StartupInfo,
1744                                 &ProcessInformation);
1745         if (!Result)
1746             dwError = GetLastError();
1747     }
1748 
1749     if (lpEnvironment)
1750         DestroyEnvironmentBlock(lpEnvironment);
1751 
1752     if (!Result)
1753     {
1754         DPRINT1("Starting '%S' failed with error %d\n",
1755                 Service->lpServiceName, dwError);
1756         return dwError;
1757     }
1758 
1759     DPRINT("Process Id: %lu  Handle %p\n",
1760            ProcessInformation.dwProcessId,
1761            ProcessInformation.hProcess);
1762     DPRINT("Thread Id: %lu  Handle %p\n",
1763            ProcessInformation.dwThreadId,
1764            ProcessInformation.hThread);
1765 
1766     /* Get the process handle and ID */
1767     Service->lpImage->hProcess = ProcessInformation.hProcess;
1768     Service->lpImage->dwProcessId = ProcessInformation.dwProcessId;
1769 
1770     /* Resume the main thread and close its handle */
1771     ResumeThread(ProcessInformation.hThread);
1772     CloseHandle(ProcessInformation.hThread);
1773 
1774     /* Connect control pipe */
1775     dwError = ScmWaitForServiceConnect(Service);
1776     if (dwError != ERROR_SUCCESS)
1777     {
1778         DPRINT1("Connecting control pipe failed! (Error %lu)\n", dwError);
1779         Service->lpImage->dwProcessId = 0;
1780         return dwError;
1781     }
1782 
1783     /* Send the start command */
1784     return ScmSendStartCommand(Service, argc, argv);
1785 }
1786 
1787 
1788 static DWORD
1789 ScmLoadService(PSERVICE Service,
1790                DWORD argc,
1791                LPWSTR* argv)
1792 {
1793     PSERVICE_GROUP Group = Service->lpGroup;
1794     DWORD dwError = ERROR_SUCCESS;
1795     LPCWSTR lpLogStrings[2];
1796     WCHAR szLogBuffer[80];
1797 
1798     DPRINT("ScmLoadService() called\n");
1799     DPRINT("Start Service %p (%S)\n", Service, Service->lpServiceName);
1800 
1801     if (Service->Status.dwCurrentState != SERVICE_STOPPED)
1802     {
1803         DPRINT("Service %S is already running!\n", Service->lpServiceName);
1804         return ERROR_SERVICE_ALREADY_RUNNING;
1805     }
1806 
1807     DPRINT("Service->Type: %lu\n", Service->Status.dwServiceType);
1808 
1809     if (Service->Status.dwServiceType & SERVICE_DRIVER)
1810     {
1811         /* Start the driver */
1812         dwError = ScmStartDriver(Service);
1813     }
1814     else // if (Service->Status.dwServiceType & (SERVICE_WIN32 | SERVICE_INTERACTIVE_PROCESS))
1815     {
1816         /* Start user-mode service */
1817         dwError = ScmCreateOrReferenceServiceImage(Service);
1818         if (dwError == ERROR_SUCCESS)
1819         {
1820             dwError = ScmStartUserModeService(Service, argc, argv);
1821             if (dwError == ERROR_SUCCESS)
1822             {
1823                 Service->Status.dwCurrentState = SERVICE_START_PENDING;
1824                 Service->Status.dwControlsAccepted = 0;
1825             }
1826             else
1827             {
1828                 Service->lpImage->dwImageRunCount--;
1829                 if (Service->lpImage->dwImageRunCount == 0)
1830                 {
1831                     ScmRemoveServiceImage(Service->lpImage);
1832                     Service->lpImage = NULL;
1833                 }
1834             }
1835         }
1836     }
1837 
1838     DPRINT("ScmLoadService() done (Error %lu)\n", dwError);
1839 
1840     if (dwError == ERROR_SUCCESS)
1841     {
1842         if (Group != NULL)
1843         {
1844             Group->ServicesRunning = TRUE;
1845         }
1846 
1847         /* Log a successful service start */
1848         LoadStringW(GetModuleHandle(NULL), IDS_SERVICE_START, szLogBuffer, 80);
1849         lpLogStrings[0] = Service->lpDisplayName;
1850         lpLogStrings[1] = szLogBuffer;
1851 
1852         ScmLogEvent(EVENT_SERVICE_CONTROL_SUCCESS,
1853                     EVENTLOG_INFORMATION_TYPE,
1854                     2,
1855                     lpLogStrings);
1856     }
1857     else
1858     {
1859         if (Service->dwErrorControl != SERVICE_ERROR_IGNORE)
1860         {
1861             /* Log a failed service start */
1862             StringCchPrintfW(szLogBuffer, ARRAYSIZE(szLogBuffer),
1863                              L"%lu", dwError);
1864             lpLogStrings[0] = Service->lpServiceName;
1865             lpLogStrings[1] = szLogBuffer;
1866             ScmLogEvent(EVENT_SERVICE_START_FAILED,
1867                         EVENTLOG_ERROR_TYPE,
1868                         2,
1869                         lpLogStrings);
1870         }
1871 
1872 #if 0
1873         switch (Service->dwErrorControl)
1874         {
1875             case SERVICE_ERROR_SEVERE:
1876                 if (IsLastKnownGood == FALSE)
1877                 {
1878                     /* FIXME: Boot last known good configuration */
1879                 }
1880                 break;
1881 
1882             case SERVICE_ERROR_CRITICAL:
1883                 if (IsLastKnownGood == FALSE)
1884                 {
1885                     /* FIXME: Boot last known good configuration */
1886                 }
1887                 else
1888                 {
1889                     /* FIXME: BSOD! */
1890                 }
1891                 break;
1892         }
1893 #endif
1894     }
1895 
1896     return dwError;
1897 }
1898 
1899 
1900 DWORD
1901 ScmStartService(PSERVICE Service,
1902                 DWORD argc,
1903                 LPWSTR* argv)
1904 {
1905     DWORD dwError = ERROR_SUCCESS;
1906     SC_RPC_LOCK Lock = NULL;
1907 
1908     DPRINT("ScmStartService() called\n");
1909     DPRINT("Start Service %p (%S)\n", Service, Service->lpServiceName);
1910 
1911     /* Acquire the service control critical section, to synchronize starts */
1912     EnterCriticalSection(&ControlServiceCriticalSection);
1913 
1914     /*
1915      * Acquire the user service start lock while the service is starting, if
1916      * needed (i.e. if we are not starting it during the initialization phase).
1917      * If we don't success, bail out.
1918      */
1919     if (!ScmInitialize)
1920     {
1921         dwError = ScmAcquireServiceStartLock(TRUE, &Lock);
1922         if (dwError != ERROR_SUCCESS) goto done;
1923     }
1924 
1925     /* Really start the service */
1926     dwError = ScmLoadService(Service, argc, argv);
1927 
1928     /* Release the service start lock, if needed, and the critical section */
1929     if (Lock) ScmReleaseServiceStartLock(&Lock);
1930 
1931 done:
1932     LeaveCriticalSection(&ControlServiceCriticalSection);
1933 
1934     DPRINT("ScmStartService() done (Error %lu)\n", dwError);
1935 
1936     return dwError;
1937 }
1938 
1939 
1940 VOID
1941 ScmAutoStartServices(VOID)
1942 {
1943     DWORD dwError;
1944     PLIST_ENTRY GroupEntry;
1945     PLIST_ENTRY ServiceEntry;
1946     PSERVICE_GROUP CurrentGroup;
1947     PSERVICE CurrentService;
1948     WCHAR szSafeBootServicePath[MAX_PATH];
1949     DWORD SafeBootEnabled;
1950     HKEY hKey;
1951     DWORD dwKeySize;
1952     ULONG i;
1953 
1954     /*
1955      * This function MUST be called ONLY at initialization time.
1956      * Therefore, no need to acquire the user service start lock.
1957      */
1958     ASSERT(ScmInitialize);
1959 
1960     /* Retrieve the SafeBoot parameter */
1961     dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
1962                             L"SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Option",
1963                             0,
1964                             KEY_READ,
1965                             &hKey);
1966     if (dwError == ERROR_SUCCESS)
1967     {
1968         dwKeySize = sizeof(SafeBootEnabled);
1969         dwError = RegQueryValueExW(hKey,
1970                                    L"OptionValue",
1971                                    0,
1972                                    NULL,
1973                                    (LPBYTE)&SafeBootEnabled,
1974                                    &dwKeySize);
1975         RegCloseKey(hKey);
1976     }
1977 
1978     /* Default to Normal boot if the value doesn't exist */
1979     if (dwError != ERROR_SUCCESS)
1980         SafeBootEnabled = 0;
1981 
1982     /* Acquire the service control critical section, to synchronize starts */
1983     EnterCriticalSection(&ControlServiceCriticalSection);
1984 
1985     /* Clear 'ServiceVisited' flag (or set if not to start in Safe Mode) */
1986     ServiceEntry = ServiceListHead.Flink;
1987     while (ServiceEntry != &ServiceListHead)
1988     {
1989         CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
1990 
1991         /* Build the safe boot path */
1992         StringCchCopyW(szSafeBootServicePath, ARRAYSIZE(szSafeBootServicePath),
1993                        L"SYSTEM\\CurrentControlSet\\Control\\SafeBoot");
1994 
1995         switch (SafeBootEnabled)
1996         {
1997             /* NOTE: Assumes MINIMAL (1) and DSREPAIR (3) load same items */
1998             case 1:
1999             case 3:
2000                 StringCchCatW(szSafeBootServicePath, ARRAYSIZE(szSafeBootServicePath),
2001                               L"\\Minimal\\");
2002                 break;
2003 
2004             case 2:
2005                 StringCchCatW(szSafeBootServicePath, ARRAYSIZE(szSafeBootServicePath),
2006                               L"\\Network\\");
2007                 break;
2008         }
2009 
2010         if (SafeBootEnabled != 0)
2011         {
2012             /* If key does not exist then do not assume safe mode */
2013             dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
2014                                     szSafeBootServicePath,
2015                                     0,
2016                                     KEY_READ,
2017                                     &hKey);
2018             if (dwError == ERROR_SUCCESS)
2019             {
2020                 RegCloseKey(hKey);
2021 
2022                 /* Finish Safe Boot path off */
2023                 StringCchCatW(szSafeBootServicePath, ARRAYSIZE(szSafeBootServicePath),
2024                               CurrentService->lpServiceName);
2025 
2026                 /* Check that the key is in the Safe Boot path */
2027                 dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
2028                                         szSafeBootServicePath,
2029                                         0,
2030                                         KEY_READ,
2031                                         &hKey);
2032                 if (dwError != ERROR_SUCCESS)
2033                 {
2034                     /* Mark service as visited so it is not auto-started */
2035                     CurrentService->ServiceVisited = TRUE;
2036                 }
2037                 else
2038                 {
2039                     /* Must be auto-started in safe mode - mark as unvisited */
2040                     RegCloseKey(hKey);
2041                     CurrentService->ServiceVisited = FALSE;
2042                 }
2043             }
2044             else
2045             {
2046                 DPRINT1("WARNING: Could not open the associated Safe Boot key!");
2047                 CurrentService->ServiceVisited = FALSE;
2048             }
2049         }
2050 
2051         ServiceEntry = ServiceEntry->Flink;
2052     }
2053 
2054     /* Start all services which are members of an existing group */
2055     GroupEntry = GroupListHead.Flink;
2056     while (GroupEntry != &GroupListHead)
2057     {
2058         CurrentGroup = CONTAINING_RECORD(GroupEntry, SERVICE_GROUP, GroupListEntry);
2059 
2060         DPRINT("Group '%S'\n", CurrentGroup->lpGroupName);
2061 
2062         /* Start all services witch have a valid tag */
2063         for (i = 0; i < CurrentGroup->TagCount; i++)
2064         {
2065             ServiceEntry = ServiceListHead.Flink;
2066             while (ServiceEntry != &ServiceListHead)
2067             {
2068                 CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
2069 
2070                 if ((CurrentService->lpGroup == CurrentGroup) &&
2071                     (CurrentService->dwStartType == SERVICE_AUTO_START) &&
2072                     (CurrentService->ServiceVisited == FALSE) &&
2073                     (CurrentService->dwTag == CurrentGroup->TagArray[i]))
2074                 {
2075                     CurrentService->ServiceVisited = TRUE;
2076                     ScmLoadService(CurrentService, 0, NULL);
2077                 }
2078 
2079                 ServiceEntry = ServiceEntry->Flink;
2080              }
2081         }
2082 
2083         /* Start all services which have an invalid tag or which do not have a tag */
2084         ServiceEntry = ServiceListHead.Flink;
2085         while (ServiceEntry != &ServiceListHead)
2086         {
2087             CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
2088 
2089             if ((CurrentService->lpGroup == CurrentGroup) &&
2090                 (CurrentService->dwStartType == SERVICE_AUTO_START) &&
2091                 (CurrentService->ServiceVisited == FALSE))
2092             {
2093                 CurrentService->ServiceVisited = TRUE;
2094                 ScmLoadService(CurrentService, 0, NULL);
2095             }
2096 
2097             ServiceEntry = ServiceEntry->Flink;
2098         }
2099 
2100         GroupEntry = GroupEntry->Flink;
2101     }
2102 
2103     /* Start all services which are members of any non-existing group */
2104     ServiceEntry = ServiceListHead.Flink;
2105     while (ServiceEntry != &ServiceListHead)
2106     {
2107         CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
2108 
2109         if ((CurrentService->lpGroup != NULL) &&
2110             (CurrentService->dwStartType == SERVICE_AUTO_START) &&
2111             (CurrentService->ServiceVisited == FALSE))
2112         {
2113             CurrentService->ServiceVisited = TRUE;
2114             ScmLoadService(CurrentService, 0, NULL);
2115         }
2116 
2117         ServiceEntry = ServiceEntry->Flink;
2118     }
2119 
2120     /* Start all services which are not a member of any group */
2121     ServiceEntry = ServiceListHead.Flink;
2122     while (ServiceEntry != &ServiceListHead)
2123     {
2124         CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
2125 
2126         if ((CurrentService->lpGroup == NULL) &&
2127             (CurrentService->dwStartType == SERVICE_AUTO_START) &&
2128             (CurrentService->ServiceVisited == FALSE))
2129         {
2130             CurrentService->ServiceVisited = TRUE;
2131             ScmLoadService(CurrentService, 0, NULL);
2132         }
2133 
2134         ServiceEntry = ServiceEntry->Flink;
2135     }
2136 
2137     /* Clear 'ServiceVisited' flag again */
2138     ServiceEntry = ServiceListHead.Flink;
2139     while (ServiceEntry != &ServiceListHead)
2140     {
2141         CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
2142         CurrentService->ServiceVisited = FALSE;
2143         ServiceEntry = ServiceEntry->Flink;
2144     }
2145 
2146     /* Release the critical section */
2147     LeaveCriticalSection(&ControlServiceCriticalSection);
2148 }
2149 
2150 
2151 VOID
2152 ScmAutoShutdownServices(VOID)
2153 {
2154     PLIST_ENTRY ServiceEntry;
2155     PSERVICE CurrentService;
2156 
2157     DPRINT("ScmAutoShutdownServices() called\n");
2158 
2159     /* Lock the service database exclusively */
2160     ScmLockDatabaseExclusive();
2161 
2162     ServiceEntry = ServiceListHead.Flink;
2163     while (ServiceEntry != &ServiceListHead)
2164     {
2165         CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
2166 
2167         if ((CurrentService->Status.dwControlsAccepted & SERVICE_ACCEPT_SHUTDOWN) &&
2168             (CurrentService->Status.dwCurrentState == SERVICE_RUNNING ||
2169              CurrentService->Status.dwCurrentState == SERVICE_START_PENDING))
2170         {
2171             /* Send the shutdown notification */
2172             DPRINT("Shutdown service: %S\n", CurrentService->lpServiceName);
2173             ScmControlService(CurrentService->lpImage->hControlPipe,
2174                               CurrentService->lpServiceName,
2175                               (SERVICE_STATUS_HANDLE)CurrentService,
2176                               SERVICE_CONTROL_SHUTDOWN);
2177         }
2178 
2179         ServiceEntry = ServiceEntry->Flink;
2180     }
2181 
2182     /* Unlock the service database */
2183     ScmUnlockDatabase();
2184 
2185     DPRINT("ScmAutoShutdownServices() done\n");
2186 }
2187 
2188 
2189 BOOL
2190 ScmLockDatabaseExclusive(VOID)
2191 {
2192     return RtlAcquireResourceExclusive(&DatabaseLock, TRUE);
2193 }
2194 
2195 
2196 BOOL
2197 ScmLockDatabaseShared(VOID)
2198 {
2199     return RtlAcquireResourceShared(&DatabaseLock, TRUE);
2200 }
2201 
2202 
2203 VOID
2204 ScmUnlockDatabase(VOID)
2205 {
2206     RtlReleaseResource(&DatabaseLock);
2207 }
2208 
2209 
2210 VOID
2211 ScmInitNamedPipeCriticalSection(VOID)
2212 {
2213     HKEY hKey;
2214     DWORD dwKeySize;
2215     DWORD dwError;
2216 
2217     InitializeCriticalSection(&ControlServiceCriticalSection);
2218 
2219     dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
2220                             L"SYSTEM\\CurrentControlSet\\Control",
2221                             0,
2222                             KEY_READ,
2223                             &hKey);
2224    if (dwError == ERROR_SUCCESS)
2225    {
2226         dwKeySize = sizeof(PipeTimeout);
2227         RegQueryValueExW(hKey,
2228                          L"ServicesPipeTimeout",
2229                          0,
2230                          NULL,
2231                          (LPBYTE)&PipeTimeout,
2232                          &dwKeySize);
2233        RegCloseKey(hKey);
2234    }
2235 }
2236 
2237 
2238 VOID
2239 ScmDeleteNamedPipeCriticalSection(VOID)
2240 {
2241     DeleteCriticalSection(&ControlServiceCriticalSection);
2242 }
2243 
2244 /* EOF */
2245