xref: /reactos/ntoskrnl/ob/obsecure.c (revision c2c66aff) 
1 /*
2 * PROJECT:         ReactOS Kernel
3 * LICENSE:         GPL - See COPYING in the top level directory
4 * FILE:            ntoskrnl/ob/obsecure.c
5 * PURPOSE:         SRM Interface of the Object Manager
6 * PROGRAMMERS:     Alex Ionescu (alex@relsoft.net)
7 *                  Eric Kohl
8 */
9 
10 /* INCLUDES *****************************************************************/
11 
12 #include <ntoskrnl.h>
13 #define NDEBUG
14 #include <debug.h>
15 
16 /* PRIVATE FUNCTIONS *********************************************************/
17 
18 NTSTATUS
19 NTAPI
20 ObAssignObjectSecurityDescriptor(IN PVOID Object,
21                                  IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
22                                  IN POOL_TYPE PoolType)
23 {
24     POBJECT_HEADER ObjectHeader;
25     NTSTATUS Status;
26     PSECURITY_DESCRIPTOR NewSd;
27     PEX_FAST_REF FastRef;
28     PAGED_CODE();
29 
30     /* Get the object header */
31     ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
32     FastRef = (PEX_FAST_REF)&ObjectHeader->SecurityDescriptor;
33     if (!SecurityDescriptor)
34     {
35         /* Nothing to assign */
36         ExInitializeFastReference(FastRef, NULL);
37         return STATUS_SUCCESS;
38     }
39 
40     /* Add it to our internal cache */
41     Status = ObLogSecurityDescriptor(SecurityDescriptor,
42                                      &NewSd,
43                                      MAX_FAST_REFS + 1);
44     if (NT_SUCCESS(Status))
45     {
46         /* Free the old copy */
47         ExFreePoolWithTag(SecurityDescriptor, TAG_SD);
48 
49         /* Set the new pointer */
50         ASSERT(NewSd);
51         ExInitializeFastReference(FastRef, NewSd);
52     }
53 
54     /* Return status */
55     return Status;
56 }
57 
58 NTSTATUS
59 NTAPI
60 ObDeassignSecurity(IN OUT PSECURITY_DESCRIPTOR *SecurityDescriptor)
61 {
62     EX_FAST_REF FastRef;
63     ULONG Count;
64     PSECURITY_DESCRIPTOR OldSecurityDescriptor;
65 
66     /* Get the fast reference and capture it */
67     FastRef = *(PEX_FAST_REF)SecurityDescriptor;
68 
69     /* Don't free again later */
70     *SecurityDescriptor = NULL;
71 
72     /* Get the descriptor and reference count */
73     OldSecurityDescriptor = ExGetObjectFastReference(FastRef);
74     Count = ExGetCountFastReference(FastRef);
75 
76     /* Dereference the descriptor */
77     ObDereferenceSecurityDescriptor(OldSecurityDescriptor, Count + 1);
78 
79     /* All done */
80     return STATUS_SUCCESS;
81 }
82 
83 NTSTATUS
84 NTAPI
85 ObQuerySecurityDescriptorInfo(IN PVOID Object,
86                               IN PSECURITY_INFORMATION SecurityInformation,
87                               OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
88                               IN OUT PULONG Length,
89                               IN PSECURITY_DESCRIPTOR *OutputSecurityDescriptor)
90 {
91     POBJECT_HEADER ObjectHeader;
92     NTSTATUS Status;
93     PSECURITY_DESCRIPTOR ObjectSd;
94     PAGED_CODE();
95 
96     /* Get the object header */
97     ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
98 
99     /* Get the SD */
100     ObjectSd = ObpReferenceSecurityDescriptor(ObjectHeader);
101 
102     /* Query the information */
103     Status = SeQuerySecurityDescriptorInfo(SecurityInformation,
104                                            SecurityDescriptor,
105                                            Length,
106                                            &ObjectSd);
107 
108     /* Check if we have an object SD and dereference it, if so */
109     if (ObjectSd) ObDereferenceSecurityDescriptor(ObjectSd, 1);
110 
111     /* Return status */
112     return Status;
113 }
114 
115 NTSTATUS
116 NTAPI
117 ObSetSecurityDescriptorInfo(IN PVOID Object,
118                             IN PSECURITY_INFORMATION SecurityInformation,
119                             IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
120                             IN OUT PSECURITY_DESCRIPTOR *OutputSecurityDescriptor,
121                             IN POOL_TYPE PoolType,
122                             IN PGENERIC_MAPPING GenericMapping)
123 {
124     NTSTATUS Status;
125     POBJECT_HEADER ObjectHeader;
126     PSECURITY_DESCRIPTOR OldDescriptor, NewDescriptor, CachedDescriptor;
127     PEX_FAST_REF FastRef;
128     EX_FAST_REF OldValue;
129     ULONG Count;
130     PAGED_CODE();
131 
132     /* Get the object header */
133     ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
134     while (TRUE)
135     {
136         /* Reference the old descriptor */
137         OldDescriptor = ObpReferenceSecurityDescriptor(ObjectHeader);
138         NewDescriptor = OldDescriptor;
139 
140         /* Set the SD information */
141         Status = SeSetSecurityDescriptorInfo(Object,
142                                              SecurityInformation,
143                                              SecurityDescriptor,
144                                              &NewDescriptor,
145                                              PoolType,
146                                              GenericMapping);
147         if (!NT_SUCCESS(Status))
148         {
149             /* We failed, dereference the old one */
150             if (OldDescriptor) ObDereferenceSecurityDescriptor(OldDescriptor, 1);
151             break;
152         }
153 
154         /* Now add this to the cache */
155         Status = ObLogSecurityDescriptor(NewDescriptor,
156                                          &CachedDescriptor,
157                                          MAX_FAST_REFS + 1);
158 
159         /* Let go of our uncached copy */
160         ExFreePool(NewDescriptor);
161 
162         /* Check for success */
163         if (!NT_SUCCESS(Status))
164         {
165             /* We failed, dereference the old one */
166             ObDereferenceSecurityDescriptor(OldDescriptor, 1);
167             break;
168         }
169 
170         /* Do the swap */
171         FastRef = (PEX_FAST_REF)OutputSecurityDescriptor;
172         OldValue = ExCompareSwapFastReference(FastRef,
173                                               CachedDescriptor,
174                                               OldDescriptor);
175 
176         /* Make sure the swap worked */
177         if (ExGetObjectFastReference(OldValue) == OldDescriptor)
178         {
179             /* Flush waiters */
180             ObpAcquireObjectLock(ObjectHeader);
181             ObpReleaseObjectLock(ObjectHeader);
182 
183             /* And dereference the old one */
184             Count = ExGetCountFastReference(OldValue);
185             ObDereferenceSecurityDescriptor(OldDescriptor, Count + 2);
186             break;
187         }
188         else
189         {
190             /* Someone changed it behind our back -- try again */
191             ObDereferenceSecurityDescriptor(OldDescriptor, 1);
192             ObDereferenceSecurityDescriptor(CachedDescriptor,
193                                             MAX_FAST_REFS + 1);
194         }
195     }
196 
197     /* Return status */
198     return Status;
199 }
200 
201 BOOLEAN
202 NTAPI
203 ObCheckCreateObjectAccess(IN PVOID Object,
204                           IN ACCESS_MASK CreateAccess,
205                           IN PACCESS_STATE AccessState,
206                           IN PUNICODE_STRING ComponentName,
207                           IN BOOLEAN LockHeld,
208                           IN KPROCESSOR_MODE AccessMode,
209                           OUT PNTSTATUS AccessStatus)
210 {
211     POBJECT_HEADER ObjectHeader;
212     POBJECT_TYPE ObjectType;
213     PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
214     BOOLEAN SdAllocated;
215     BOOLEAN Result = TRUE;
216     ACCESS_MASK GrantedAccess = 0;
217     PPRIVILEGE_SET Privileges = NULL;
218     NTSTATUS Status;
219     PAGED_CODE();
220 
221     /* Get the header and type */
222     ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
223     ObjectType = ObjectHeader->Type;
224 
225     /* Get the security descriptor */
226     Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated);
227     if (!NT_SUCCESS(Status))
228     {
229         /* We failed */
230         *AccessStatus = Status;
231         return FALSE;
232     }
233 
234     /* Lock the security context */
235     SeLockSubjectContext(&AccessState->SubjectSecurityContext);
236 
237     /* Check if we have an SD */
238     if (SecurityDescriptor)
239     {
240         /* Now do the entire access check */
241         Result = SeAccessCheck(SecurityDescriptor,
242                                &AccessState->SubjectSecurityContext,
243                                TRUE,
244                                CreateAccess,
245                                0,
246                                &Privileges,
247                                &ObjectType->TypeInfo.GenericMapping,
248                                AccessMode,
249                                &GrantedAccess,
250                                AccessStatus);
251         if (Privileges)
252         {
253             /* We got privileges, append them to the access state and free them */
254             Status = SeAppendPrivileges(AccessState, Privileges);
255             SeFreePrivileges(Privileges);
256         }
257     }
258 
259     /* We're done, unlock the context and release security */
260     SeUnlockSubjectContext(&AccessState->SubjectSecurityContext);
261     ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
262     return Result;
263 }
264 
265 BOOLEAN
266 NTAPI
267 ObpCheckTraverseAccess(IN PVOID Object,
268                        IN ACCESS_MASK TraverseAccess,
269                        IN PACCESS_STATE AccessState OPTIONAL,
270                        IN BOOLEAN LockHeld,
271                        IN KPROCESSOR_MODE AccessMode,
272                        OUT PNTSTATUS AccessStatus)
273 {
274     POBJECT_HEADER ObjectHeader;
275     POBJECT_TYPE ObjectType;
276     PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
277     BOOLEAN SdAllocated;
278     BOOLEAN Result;
279     ACCESS_MASK GrantedAccess = 0;
280     PPRIVILEGE_SET Privileges = NULL;
281     NTSTATUS Status;
282     PAGED_CODE();
283 
284     /* Get the header and type */
285     ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
286     ObjectType = ObjectHeader->Type;
287 
288     /* Get the security descriptor */
289     Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated);
290     if (!NT_SUCCESS(Status))
291     {
292         /* We failed */
293         *AccessStatus = Status;
294         return FALSE;
295     }
296 
297     /* First try to perform a fast traverse check
298      * If it fails, then the entire access check will
299      * have to be done.
300      */
301     Result = SeFastTraverseCheck(SecurityDescriptor,
302                                  AccessState,
303                                  FILE_WRITE_DATA,
304                                  AccessMode);
305     if (Result)
306     {
307         ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
308         return TRUE;
309     }
310 
311     /* Lock the security context */
312     SeLockSubjectContext(&AccessState->SubjectSecurityContext);
313 
314     /* Now do the entire access check */
315     Result = SeAccessCheck(SecurityDescriptor,
316                            &AccessState->SubjectSecurityContext,
317                            TRUE,
318                            TraverseAccess,
319                            0,
320                            &Privileges,
321                            &ObjectType->TypeInfo.GenericMapping,
322                            AccessMode,
323                            &GrantedAccess,
324                            AccessStatus);
325     if (Privileges)
326     {
327         /* We got privileges, append them to the access state and free them */
328         Status = SeAppendPrivileges(AccessState, Privileges);
329         SeFreePrivileges(Privileges);
330     }
331 
332     /* We're done, unlock the context and release security */
333     SeUnlockSubjectContext(&AccessState->SubjectSecurityContext);
334     ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
335     return Result;
336 }
337 
338 BOOLEAN
339 NTAPI
340 ObpCheckObjectReference(IN PVOID Object,
341                         IN OUT PACCESS_STATE AccessState,
342                         IN BOOLEAN LockHeld,
343                         IN KPROCESSOR_MODE AccessMode,
344                         OUT PNTSTATUS AccessStatus)
345 {
346     POBJECT_HEADER ObjectHeader;
347     POBJECT_TYPE ObjectType;
348     PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
349     BOOLEAN SdAllocated;
350     BOOLEAN Result;
351     ACCESS_MASK GrantedAccess = 0;
352     PPRIVILEGE_SET Privileges = NULL;
353     NTSTATUS Status;
354     PAGED_CODE();
355 
356     /* Get the header and type */
357     ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
358     ObjectType = ObjectHeader->Type;
359 
360     /* Get the security descriptor */
361     Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated);
362     if (!NT_SUCCESS(Status))
363     {
364         /* We failed */
365         *AccessStatus = Status;
366         return FALSE;
367     }
368 
369     /* Lock the security context */
370     SeLockSubjectContext(&AccessState->SubjectSecurityContext);
371 
372     /* Now do the entire access check */
373     Result = SeAccessCheck(SecurityDescriptor,
374                            &AccessState->SubjectSecurityContext,
375                            TRUE,
376                            AccessState->RemainingDesiredAccess,
377                            AccessState->PreviouslyGrantedAccess,
378                            &Privileges,
379                            &ObjectType->TypeInfo.GenericMapping,
380                            AccessMode,
381                            &GrantedAccess,
382                            AccessStatus);
383     if (Result)
384     {
385         /* Update the access state */
386         AccessState->RemainingDesiredAccess &= ~GrantedAccess;
387         AccessState->PreviouslyGrantedAccess |= GrantedAccess;
388     }
389 
390     /* Check if we have an SD */
391     if (SecurityDescriptor)
392     {
393         /* Do audit alarm */
394 #if 0
395         SeObjectReferenceAuditAlarm(&AccessState->OperationID,
396                                     Object,
397                                     SecurityDescriptor,
398                                     &AccessState->SubjectSecurityContext,
399                                     AccessState->RemainingDesiredAccess |
400                                     AccessState->PreviouslyGrantedAccess,
401                                     ((PAUX_ACCESS_DATA)(AccessState->AuxData))->
402                                     PrivilegeSet,
403                                     Result,
404                                     AccessMode);
405 #endif
406     }
407 
408     /* We're done, unlock the context and release security */
409     SeUnlockSubjectContext(&AccessState->SubjectSecurityContext);
410     ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
411     return Result;
412 }
413 
414 /*++
415 * @name ObCheckObjectAccess
416 *
417 *     The ObCheckObjectAccess routine <FILLMEIN>
418 *
419 * @param Object
420 *        <FILLMEIN>
421 *
422 * @param AccessState
423 *        <FILLMEIN>
424 *
425 * @param LockHeld
426 *        <FILLMEIN>
427 *
428 * @param AccessMode
429 *        <FILLMEIN>
430 *
431 * @param ReturnedStatus
432 *        <FILLMEIN>
433 *
434 * @return TRUE if access was granted, FALSE otherwise.
435 *
436 * @remarks None.
437 *
438 *--*/
439 BOOLEAN
440 NTAPI
441 ObCheckObjectAccess(IN PVOID Object,
442                     IN OUT PACCESS_STATE AccessState,
443                     IN BOOLEAN LockHeld,
444                     IN KPROCESSOR_MODE AccessMode,
445                     OUT PNTSTATUS ReturnedStatus)
446 {
447     POBJECT_HEADER ObjectHeader;
448     POBJECT_TYPE ObjectType;
449     PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
450     BOOLEAN SdAllocated;
451     NTSTATUS Status;
452     BOOLEAN Result;
453     ACCESS_MASK GrantedAccess;
454     PPRIVILEGE_SET Privileges = NULL;
455     PAGED_CODE();
456 
457     /* Get the object header and type */
458     ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
459     ObjectType = ObjectHeader->Type;
460 
461     /* Get security information */
462     Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated);
463     if (!NT_SUCCESS(Status))
464     {
465         /* Return failure */
466         *ReturnedStatus = Status;
467         return FALSE;
468     }
469     else if (!SecurityDescriptor)
470     {
471         /* Otherwise, if we don't actually have an SD, return success */
472         *ReturnedStatus = Status;
473         return TRUE;
474     }
475 
476     /* Lock the security context */
477     SeLockSubjectContext(&AccessState->SubjectSecurityContext);
478 
479     /* Now do the entire access check */
480     Result = SeAccessCheck(SecurityDescriptor,
481                            &AccessState->SubjectSecurityContext,
482                            TRUE,
483                            AccessState->RemainingDesiredAccess,
484                            AccessState->PreviouslyGrantedAccess,
485                            &Privileges,
486                            &ObjectType->TypeInfo.GenericMapping,
487                            AccessMode,
488                            &GrantedAccess,
489                            ReturnedStatus);
490     if (Privileges)
491     {
492         /* We got privileges, append them to the access state and free them */
493         Status = SeAppendPrivileges(AccessState, Privileges);
494         SeFreePrivileges(Privileges);
495     }
496 
497     /* Check if access was granted */
498     if (Result)
499     {
500         /* Update the access state */
501         AccessState->RemainingDesiredAccess &= ~(GrantedAccess |
502                                                  MAXIMUM_ALLOWED);
503         AccessState->PreviouslyGrantedAccess |= GrantedAccess;
504     }
505 
506     /* Do audit alarm */
507     SeOpenObjectAuditAlarm(&ObjectType->Name,
508                            Object,
509                            NULL,
510                            SecurityDescriptor,
511                            AccessState,
512                            FALSE,
513                            Result,
514                            AccessMode,
515                            &AccessState->GenerateOnClose);
516 
517     /* We're done, unlock the context and release security */
518     SeUnlockSubjectContext(&AccessState->SubjectSecurityContext);
519     ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated);
520     return Result;
521 }
522 
523 /* PUBLIC FUNCTIONS **********************************************************/
524 
525 /*++
526 * @name ObAssignSecurity
527 * @implemented NT4
528 *
529 *     The ObAssignSecurity routine <FILLMEIN>
530 *
531 * @param AccessState
532 *        <FILLMEIN>
533 *
534 * @param SecurityDescriptor
535 *        <FILLMEIN>
536 *
537 * @param Object
538 *        <FILLMEIN>
539 *
540 * @param Type
541 *        <FILLMEIN>
542 *
543 * @return STATUS_SUCCESS or appropriate error value.
544 *
545 * @remarks None.
546 *
547 *--*/
548 NTSTATUS
549 NTAPI
550 ObAssignSecurity(IN PACCESS_STATE AccessState,
551                  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
552                  IN PVOID Object,
553                  IN POBJECT_TYPE Type)
554 {
555     PSECURITY_DESCRIPTOR NewDescriptor;
556     NTSTATUS Status;
557     KIRQL CalloutIrql;
558     PAGED_CODE();
559 
560     /* Build the new security descriptor */
561     Status = SeAssignSecurity(SecurityDescriptor,
562                               AccessState->SecurityDescriptor,
563                               &NewDescriptor,
564                               (Type == ObDirectoryType),
565                               &AccessState->SubjectSecurityContext,
566                               &Type->TypeInfo.GenericMapping,
567                               PagedPool);
568     if (!NT_SUCCESS(Status)) return Status;
569 
570     /* Call the security method */
571     ObpCalloutStart(&CalloutIrql);
572     Status = Type->TypeInfo.SecurityProcedure(Object,
573                                               AssignSecurityDescriptor,
574                                               NULL,
575                                               NewDescriptor,
576                                               NULL,
577                                               NULL,
578                                               PagedPool,
579                                               &Type->TypeInfo.GenericMapping);
580     ObpCalloutEnd(CalloutIrql, "Security", Type, Object);
581 
582     /* Check for failure and deassign security if so */
583     if (!NT_SUCCESS(Status)) SeDeassignSecurity(&NewDescriptor);
584 
585     /* Return to caller */
586     return Status;
587 }
588 
589 /*++
590 * @name ObGetObjectSecurity
591 * @implemented NT4
592 *
593 *     The ObGetObjectSecurity routine <FILLMEIN>
594 *
595 * @param Object
596 *        <FILLMEIN>
597 *
598 * @param SecurityDescriptor
599 *        <FILLMEIN>
600 *
601 * @param MemoryAllocated
602 *        <FILLMEIN>
603 *
604 * @return STATUS_SUCCESS or appropriate error value.
605 *
606 * @remarks None.
607 *
608 *--*/
609 NTSTATUS
610 NTAPI
611 ObGetObjectSecurity(IN PVOID Object,
612                     OUT PSECURITY_DESCRIPTOR *SecurityDescriptor,
613                     OUT PBOOLEAN MemoryAllocated)
614 {
615     POBJECT_HEADER Header;
616     POBJECT_TYPE Type;
617     ULONG Length = 0;
618     NTSTATUS Status;
619     SECURITY_INFORMATION SecurityInformation;
620     KIRQL CalloutIrql;
621     PAGED_CODE();
622 
623     /* Get the object header and type */
624     Header = OBJECT_TO_OBJECT_HEADER(Object);
625     Type = Header->Type;
626 
627     /* Tell the caller that we didn't have to allocate anything yet */
628     *MemoryAllocated = FALSE;
629 
630     /* Check if the object uses default security */
631     if (Type->TypeInfo.SecurityProcedure == SeDefaultObjectMethod)
632     {
633         /* Reference the descriptor */
634         *SecurityDescriptor = ObpReferenceSecurityDescriptor(Header);
635         return STATUS_SUCCESS;
636     }
637 
638     /* Set mask to query */
639     SecurityInformation =  OWNER_SECURITY_INFORMATION |
640                            GROUP_SECURITY_INFORMATION |
641                            DACL_SECURITY_INFORMATION |
642                            SACL_SECURITY_INFORMATION;
643 
644     /* Get the security descriptor size */
645     ObpCalloutStart(&CalloutIrql);
646     Status = Type->TypeInfo.SecurityProcedure(Object,
647                                               QuerySecurityDescriptor,
648                                               &SecurityInformation,
649                                               *SecurityDescriptor,
650                                               &Length,
651                                               &Header->SecurityDescriptor,
652                                               Type->TypeInfo.PoolType,
653                                               &Type->TypeInfo.GenericMapping);
654     ObpCalloutEnd(CalloutIrql, "Security", Type, Object);
655 
656     /* Check for failure */
657     if (Status != STATUS_BUFFER_TOO_SMALL) return Status;
658 
659     /* Allocate security descriptor */
660     *SecurityDescriptor = ExAllocatePoolWithTag(PagedPool,
661                                                 Length,
662                                                 TAG_SEC_QUERY);
663     if (!(*SecurityDescriptor)) return STATUS_INSUFFICIENT_RESOURCES;
664     *MemoryAllocated = TRUE;
665 
666     /* Query security descriptor */
667     ObpCalloutStart(&CalloutIrql);
668     Status = Type->TypeInfo.SecurityProcedure(Object,
669                                               QuerySecurityDescriptor,
670                                               &SecurityInformation,
671                                               *SecurityDescriptor,
672                                               &Length,
673                                               &Header->SecurityDescriptor,
674                                               Type->TypeInfo.PoolType,
675                                               &Type->TypeInfo.GenericMapping);
676     ObpCalloutEnd(CalloutIrql, "Security", Type, Object);
677 
678     /* Check for failure */
679     if (!NT_SUCCESS(Status))
680     {
681         /* Free the descriptor and tell the caller we failed */
682         ExFreePoolWithTag(*SecurityDescriptor, TAG_SEC_QUERY);
683         *MemoryAllocated = FALSE;
684     }
685 
686     /* Return status */
687     return Status;
688 }
689 
690 /*++
691 * @name ObReleaseObjectSecurity
692 * @implemented NT4
693 *
694 *     The ObReleaseObjectSecurity routine <FILLMEIN>
695 *
696 * @param SecurityDescriptor
697 *        <FILLMEIN>
698 *
699 * @param MemoryAllocated
700 *        <FILLMEIN>
701 *
702 * @return STATUS_SUCCESS or appropriate error value.
703 *
704 * @remarks None.
705 *
706 *--*/
707 VOID
708 NTAPI
709 ObReleaseObjectSecurity(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
710                         IN BOOLEAN MemoryAllocated)
711 {
712     PAGED_CODE();
713 
714     /* Nothing to do in this case */
715     if (!SecurityDescriptor) return;
716 
717     /* Check if we had allocated it from memory */
718     if (MemoryAllocated)
719     {
720         /* Free it */
721         ExFreePool(SecurityDescriptor);
722     }
723     else
724     {
725         /* Otherwise this means we used an internal descriptor */
726         ObDereferenceSecurityDescriptor(SecurityDescriptor, 1);
727     }
728 }
729 
730 /*++
731 * @name ObSetSecurityObjectByPointer
732 * @implemented NT5.1
733 *
734 *     The ObSetSecurityObjectByPointer routine <FILLMEIN>
735 *
736 * @param SecurityDescriptor
737 *        <FILLMEIN>
738 *
739 * @param MemoryAllocated
740 *        <FILLMEIN>
741 *
742 * @return STATUS_SUCCESS or appropriate error value.
743 *
744 * @remarks None.
745 *
746 *--*/
747 NTSTATUS
748 NTAPI
749 ObSetSecurityObjectByPointer(IN PVOID Object,
750                              IN SECURITY_INFORMATION SecurityInformation,
751                              IN PSECURITY_DESCRIPTOR SecurityDescriptor)
752 {
753     POBJECT_TYPE Type;
754     POBJECT_HEADER Header;
755     PAGED_CODE();
756 
757     /* Get the header and type */
758     Header = OBJECT_TO_OBJECT_HEADER(Object);
759     Type = Header->Type;
760 
761     /* Sanity check */
762     ASSERT(SecurityDescriptor);
763 
764     /* Call the security procedure */
765     return Type->TypeInfo.SecurityProcedure(Object,
766                                             SetSecurityDescriptor,
767                                             &SecurityInformation,
768                                             SecurityDescriptor,
769                                             NULL,
770                                             &Header->SecurityDescriptor,
771                                             Type->TypeInfo.PoolType,
772                                             &Type->TypeInfo.GenericMapping);
773 }
774 
775 /*++
776 * @name NtQuerySecurityObject
777 * @implemented NT4
778 *
779 *     The NtQuerySecurityObject routine <FILLMEIN>
780 *
781 * @param Handle
782 *        <FILLMEIN>
783 *
784 * @param SecurityInformation
785 *        <FILLMEIN>
786 *
787 * @param SecurityDescriptor
788 *        <FILLMEIN>
789 *
790 * @param Length
791 *        <FILLMEIN>
792 *
793 * @param ResultLength
794 *        <FILLMEIN>
795 *
796 * @return STATUS_SUCCESS or appropriate error value.
797 *
798 * @remarks None.
799 *
800 *--*/
801 NTSTATUS
802 NTAPI
803 NtQuerySecurityObject(IN HANDLE Handle,
804                       IN SECURITY_INFORMATION SecurityInformation,
805                       OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
806                       IN ULONG Length,
807                       OUT PULONG ResultLength)
808 {
809     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
810     PVOID Object;
811     POBJECT_HEADER Header;
812     POBJECT_TYPE Type;
813     ACCESS_MASK DesiredAccess;
814     NTSTATUS Status;
815     PAGED_CODE();
816 
817     /* Check if we came from user mode */
818     if (PreviousMode != KernelMode)
819     {
820         /* Enter SEH */
821         _SEH2_TRY
822         {
823             /* Probe the SD and the length pointer */
824             ProbeForWrite(SecurityDescriptor, Length, sizeof(ULONG));
825             ProbeForWriteUlong(ResultLength);
826         }
827         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
828         {
829             /* Return the exception code */
830             _SEH2_YIELD(return _SEH2_GetExceptionCode());
831         }
832         _SEH2_END;
833     }
834 
835     /* Get the required access rights for the operation */
836     SeQuerySecurityAccessMask(SecurityInformation, &DesiredAccess);
837 
838     /* Reference the object */
839     Status = ObReferenceObjectByHandle(Handle,
840                                        DesiredAccess,
841                                        NULL,
842                                        PreviousMode,
843                                        &Object,
844                                        NULL);
845     if (!NT_SUCCESS(Status)) return Status;
846 
847     /* Get the Object Header and Type */
848     Header = OBJECT_TO_OBJECT_HEADER(Object);
849     Type = Header->Type;
850 
851     /* Call the security procedure's query function */
852     Status = Type->TypeInfo.SecurityProcedure(Object,
853                                               QuerySecurityDescriptor,
854                                               &SecurityInformation,
855                                               SecurityDescriptor,
856                                               &Length,
857                                               &Header->SecurityDescriptor,
858                                               Type->TypeInfo.PoolType,
859                                               &Type->TypeInfo.GenericMapping);
860 
861     /* Dereference the object */
862     ObDereferenceObject(Object);
863 
864     /* Protect write with SEH */
865     _SEH2_TRY
866     {
867         /* Return the needed length */
868         *ResultLength = Length;
869     }
870     _SEH2_EXCEPT(ExSystemExceptionFilter())
871     {
872         /* Get the exception code */
873         Status = _SEH2_GetExceptionCode();
874     }
875     _SEH2_END;
876 
877     /* Return status */
878     return Status;
879 }
880 
881 /*++
882 * @name NtSetSecurityObject
883 * @implemented NT4
884 *
885 *     The NtSetSecurityObject routine <FILLMEIN>
886 *
887 * @param Handle
888 *        <FILLMEIN>
889 *
890 * @param SecurityInformation
891 *        <FILLMEIN>
892 *
893 * @param SecurityDescriptor
894 *        <FILLMEIN>
895 *
896 * @return STATUS_SUCCESS or appropriate error value.
897 *
898 * @remarks None.
899 *
900 *--*/
901 NTSTATUS
902 NTAPI
903 NtSetSecurityObject(IN HANDLE Handle,
904                     IN SECURITY_INFORMATION SecurityInformation,
905                     IN PSECURITY_DESCRIPTOR SecurityDescriptor)
906 {
907     KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
908     PVOID Object;
909     SECURITY_DESCRIPTOR_RELATIVE *CapturedDescriptor;
910     ACCESS_MASK DesiredAccess = 0;
911     NTSTATUS Status;
912     PAGED_CODE();
913 
914     /* Make sure the caller doesn't pass a NULL security descriptor! */
915     if (!SecurityDescriptor) return STATUS_ACCESS_VIOLATION;
916 
917     /* Set the required access rights for the operation */
918     SeSetSecurityAccessMask(SecurityInformation, &DesiredAccess);
919 
920     /* Reference the object */
921     Status = ObReferenceObjectByHandle(Handle,
922                                        DesiredAccess,
923                                        NULL,
924                                        PreviousMode,
925                                        &Object,
926                                        NULL);
927     if (NT_SUCCESS(Status))
928     {
929         /* Capture and make a copy of the security descriptor */
930         Status = SeCaptureSecurityDescriptor(SecurityDescriptor,
931                                              PreviousMode,
932                                              PagedPool,
933                                              TRUE,
934                                              (PSECURITY_DESCRIPTOR*)
935                                              &CapturedDescriptor);
936         if (!NT_SUCCESS(Status))
937         {
938             /* Fail */
939             ObDereferenceObject(Object);
940             return Status;
941         }
942 
943         /* Sanity check */
944         ASSERT(CapturedDescriptor->Control & SE_SELF_RELATIVE);
945 
946         /*
947          * Make sure the security descriptor passed by the caller
948          * is valid for the operation we're about to perform
949          */
950         if (((SecurityInformation & OWNER_SECURITY_INFORMATION) &&
951              !(CapturedDescriptor->Owner)) ||
952             ((SecurityInformation & GROUP_SECURITY_INFORMATION) &&
953              !(CapturedDescriptor->Group)))
954         {
955             /* Set the failure status */
956             Status = STATUS_INVALID_SECURITY_DESCR;
957         }
958         else
959         {
960             /* Set security */
961             Status = ObSetSecurityObjectByPointer(Object,
962                                                   SecurityInformation,
963                                                   CapturedDescriptor);
964         }
965 
966         /* Release the descriptor and return status */
967         SeReleaseSecurityDescriptor((PSECURITY_DESCRIPTOR)CapturedDescriptor,
968                                     PreviousMode,
969                                     TRUE);
970 
971         /* Now we can dereference the object */
972         ObDereferenceObject(Object);
973     }
974 
975     return Status;
976 }
977 
978 /*++
979 * @name ObQueryObjectAuditingByHandle
980 * @implemented NT5
981 *
982 *     The ObDereferenceSecurityDescriptor routine <FILLMEIN>
983 *
984 * @param SecurityDescriptor
985 *        <FILLMEIN>
986 *
987 * @param Count
988 *        <FILLMEIN>
989 *
990 * @return STATUS_SUCCESS or appropriate error value.
991 *
992 * @remarks None.
993 *
994 *--*/
995 NTSTATUS
996 NTAPI
997 ObQueryObjectAuditingByHandle(IN HANDLE Handle,
998                               OUT PBOOLEAN GenerateOnClose)
999 {
1000     PHANDLE_TABLE_ENTRY HandleEntry;
1001     PVOID HandleTable;
1002     NTSTATUS Status = STATUS_SUCCESS;
1003     PAGED_CODE();
1004 
1005     /* Check if we're dealing with a kernel handle */
1006     if (ObpIsKernelHandle(Handle, ExGetPreviousMode()))
1007     {
1008         /* Use the kernel table and convert the handle */
1009         HandleTable = ObpKernelHandleTable;
1010         Handle = ObKernelHandleToHandle(Handle);
1011     }
1012     else
1013     {
1014         /* Use the process's handle table */
1015         HandleTable = PsGetCurrentProcess()->ObjectTable;
1016     }
1017 
1018     /* Enter a critical region while we touch the handle table */
1019     KeEnterCriticalRegion();
1020 
1021     /* Map the handle */
1022     HandleEntry = ExMapHandleToPointer(HandleTable, Handle);
1023     if(HandleEntry)
1024     {
1025         /* Check if the flag is set */
1026         *GenerateOnClose = HandleEntry->ObAttributes & OBJ_AUDIT_OBJECT_CLOSE;
1027 
1028         /* Unlock the entry */
1029         ExUnlockHandleTableEntry(HandleTable, HandleEntry);
1030     }
1031     else
1032     {
1033         /* Otherwise, fail */
1034         Status = STATUS_INVALID_HANDLE;
1035     }
1036 
1037     /* Leave the critical region and return the status */
1038     KeLeaveCriticalRegion();
1039     return Status;
1040 }
1041 
1042 /* EOF */
1043