diff --git a/ntoskrnl/config/cmse.c b/ntoskrnl/config/cmse.c index add246cebe2..42fba907907 100644 --- a/ntoskrnl/config/cmse.c +++ b/ntoskrnl/config/cmse.c @@ -265,7 +265,8 @@ CmpSecurityMethod(IN PVOID ObjectBody, IN OUT PULONG BufferLength, IN OUT PSECURITY_DESCRIPTOR *OldSecurityDescriptor, IN POOL_TYPE PoolType, - IN PGENERIC_MAPPING GenericMapping) + IN PGENERIC_MAPPING GenericMapping, + IN KPROCESSOR_MODE AccessMode) { PCM_KEY_CONTROL_BLOCK Kcb; NTSTATUS Status = STATUS_SUCCESS; diff --git a/ntoskrnl/ex/win32k.c b/ntoskrnl/ex/win32k.c index 6de5231349a..086ca09bb6c 100644 --- a/ntoskrnl/ex/win32k.c +++ b/ntoskrnl/ex/win32k.c @@ -47,6 +47,7 @@ PKWIN32_SESSION_CALLOUT ExpDesktopObjectClose = NULL; /* FUNCTIONS ****************************************************************/ +static NTSTATUS NTAPI ExpWin32SessionCallout( @@ -108,6 +109,7 @@ ExpWin32SessionCallout( return Status; } +static BOOLEAN NTAPI ExpDesktopOkToClose( IN PEPROCESS Process OPTIONAL, @@ -130,6 +132,7 @@ ExpDesktopOkToClose( IN PEPROCESS Process OPTIONAL, return NT_SUCCESS(Status); } +static BOOLEAN NTAPI ExpWindowStationOkToClose( IN PEPROCESS Process OPTIONAL, @@ -152,6 +155,7 @@ ExpWindowStationOkToClose( IN PEPROCESS Process OPTIONAL, return NT_SUCCESS(Status); } +static VOID NTAPI ExpWinStaObjectDelete(PVOID DeletedObject) @@ -166,6 +170,7 @@ ExpWinStaObjectDelete(PVOID DeletedObject) &Parameters); } +static NTSTATUS NTAPI ExpWinStaObjectParse(IN PVOID ParseObject, @@ -197,6 +202,8 @@ ExpWinStaObjectParse(IN PVOID ParseObject, ExpWindowStationObjectParse, &Parameters); } + +static VOID NTAPI ExpDesktopDelete(PVOID DeletedObject) @@ -211,12 +218,14 @@ ExpDesktopDelete(PVOID DeletedObject) &Parameters); } +static NTSTATUS NTAPI ExpDesktopOpen(IN OB_OPEN_REASON Reason, + IN KPROCESSOR_MODE AccessMode, IN PEPROCESS Process OPTIONAL, IN PVOID ObjectBody, - IN ACCESS_MASK GrantedAccess, + IN PACCESS_MASK GrantedAccess, IN ULONG HandleCount) { WIN32_OPENMETHOD_PARAMETERS Parameters; @@ -224,7 +233,7 @@ ExpDesktopOpen(IN OB_OPEN_REASON Reason, Parameters.OpenReason = Reason; Parameters.Process = Process; Parameters.Object = ObjectBody; - Parameters.GrantedAccess = GrantedAccess; + Parameters.GrantedAccess = *GrantedAccess; Parameters.HandleCount = HandleCount; return ExpWin32SessionCallout(ObjectBody, @@ -232,6 +241,7 @@ ExpDesktopOpen(IN OB_OPEN_REASON Reason, &Parameters); } +static VOID NTAPI ExpDesktopClose(IN PEPROCESS Process OPTIONAL, diff --git a/ntoskrnl/include/internal/cm.h b/ntoskrnl/include/internal/cm.h index 4cc8e34d57c..6ed66241428 100644 --- a/ntoskrnl/include/internal/cm.h +++ b/ntoskrnl/include/internal/cm.h @@ -730,7 +730,8 @@ CmpSecurityMethod( IN OUT PULONG CapturedLength, IN OUT PSECURITY_DESCRIPTOR *ObjectSecurityDescriptor, IN POOL_TYPE PoolType, - IN PGENERIC_MAPPING GenericMapping + IN PGENERIC_MAPPING GenericMapping, + IN KPROCESSOR_MODE AccessMode ); NTSTATUS diff --git a/ntoskrnl/include/internal/io.h b/ntoskrnl/include/internal/io.h index f4261416170..dbcb7a4c3bf 100644 --- a/ntoskrnl/include/internal/io.h +++ b/ntoskrnl/include/internal/io.h @@ -1193,7 +1193,8 @@ IopGetSetSecurityObject( IN OUT PULONG BufferLength, OUT PSECURITY_DESCRIPTOR *OldSecurityDescriptor, IN POOL_TYPE PoolType, - IN OUT PGENERIC_MAPPING GenericMapping + IN OUT PGENERIC_MAPPING GenericMapping, + IN KPROCESSOR_MODE AccessMode ); NTSTATUS diff --git a/ntoskrnl/include/internal/se.h b/ntoskrnl/include/internal/se.h index c7cbdda046a..355eb1560f1 100644 --- a/ntoskrnl/include/internal/se.h +++ b/ntoskrnl/include/internal/se.h @@ -517,7 +517,8 @@ SeDefaultObjectMethod( _Inout_opt_ PULONG ReturnLength, _Inout_opt_ PSECURITY_DESCRIPTOR *OldSecurityDescriptor, _In_ POOL_TYPE PoolType, - _In_ PGENERIC_MAPPING GenericMapping); + _In_ PGENERIC_MAPPING GenericMapping, + _In_ KPROCESSOR_MODE AccessMode); VOID NTAPI diff --git a/ntoskrnl/io/iomgr/file.c b/ntoskrnl/io/iomgr/file.c index 3dff2c4ded4..e3b98eb4d75 100644 --- a/ntoskrnl/io/iomgr/file.c +++ b/ntoskrnl/io/iomgr/file.c @@ -1655,7 +1655,8 @@ IopGetSetSecurityObject(IN PVOID ObjectBody, IN OUT PULONG BufferLength, IN OUT PSECURITY_DESCRIPTOR *OldSecurityDescriptor, IN POOL_TYPE PoolType, - IN OUT PGENERIC_MAPPING GenericMapping) + IN OUT PGENERIC_MAPPING GenericMapping, + IN KPROCESSOR_MODE AccessMode) { IO_STATUS_BLOCK IoStatusBlock; PIO_STACK_LOCATION StackPtr; diff --git a/ntoskrnl/ob/obhandle.c b/ntoskrnl/ob/obhandle.c index 150f3e142a6..6fcfec1cd62 100644 --- a/ntoskrnl/ob/obhandle.c +++ b/ntoskrnl/ob/obhandle.c @@ -995,13 +995,12 @@ ObpIncrementHandleCount(IN PVOID Object, { /* Call it */ ObpCalloutStart(&CalloutIrql); + ACCESS_MASK GrantedAccess = AccessState ? AccessState->PreviouslyGrantedAccess : 0; Status = ObjectType->TypeInfo.OpenProcedure(OpenReason, + ProbeMode, Process, Object, - AccessState ? - AccessState-> - PreviouslyGrantedAccess : - 0, + &GrantedAccess, ProcessHandleCount); ObpCalloutEnd(CalloutIrql, "Open", ObjectType, Object); @@ -1223,9 +1222,10 @@ ObpIncrementUnnamedHandleCount(IN PVOID Object, /* Call it */ ObpCalloutStart(&CalloutIrql); Status = ObjectType->TypeInfo.OpenProcedure(ObCreateHandle, + AccessMode, Process, Object, - *DesiredAccess, + DesiredAccess, ProcessHandleCount); ObpCalloutEnd(CalloutIrql, "Open", ObjectType, Object); diff --git a/ntoskrnl/ob/oblife.c b/ntoskrnl/ob/oblife.c index 0b50ca94853..afbe1c1710d 100644 --- a/ntoskrnl/ob/oblife.c +++ b/ntoskrnl/ob/oblife.c @@ -195,7 +195,8 @@ ObpDeleteObject(IN PVOID Object, NULL, &Header->SecurityDescriptor, 0, - NULL); + NULL, + ExGetPreviousMode()); ObpCalloutEnd(CalloutIrql, "Security", ObjectType, Object); } @@ -1706,7 +1707,8 @@ NtQueryObject(IN HANDLE ObjectHandle, &BasicInfo->SecurityDescriptorSize, &ObjectHeader->SecurityDescriptor, ObjectType->TypeInfo.PoolType, - &ObjectType->TypeInfo.GenericMapping); + &ObjectType->TypeInfo.GenericMapping, + ExGetPreviousMode()); } /* Break out with success */ diff --git a/ntoskrnl/ob/obsecure.c b/ntoskrnl/ob/obsecure.c index 649ba4ea283..e715f8b382d 100644 --- a/ntoskrnl/ob/obsecure.c +++ b/ntoskrnl/ob/obsecure.c @@ -576,7 +576,8 @@ ObAssignSecurity(IN PACCESS_STATE AccessState, NULL, NULL, PagedPool, - &Type->TypeInfo.GenericMapping); + &Type->TypeInfo.GenericMapping, + ExGetPreviousMode()); ObpCalloutEnd(CalloutIrql, "Security", Type, Object); /* Check for failure and deassign security if so */ @@ -650,7 +651,8 @@ ObGetObjectSecurity(IN PVOID Object, &Length, &Header->SecurityDescriptor, Type->TypeInfo.PoolType, - &Type->TypeInfo.GenericMapping); + &Type->TypeInfo.GenericMapping, + ExGetPreviousMode()); ObpCalloutEnd(CalloutIrql, "Security", Type, Object); /* Check for failure */ @@ -672,7 +674,8 @@ ObGetObjectSecurity(IN PVOID Object, &Length, &Header->SecurityDescriptor, Type->TypeInfo.PoolType, - &Type->TypeInfo.GenericMapping); + &Type->TypeInfo.GenericMapping, + ExGetPreviousMode()); ObpCalloutEnd(CalloutIrql, "Security", Type, Object); /* Check for failure */ @@ -769,7 +772,8 @@ ObSetSecurityObjectByPointer(IN PVOID Object, NULL, &Header->SecurityDescriptor, Type->TypeInfo.PoolType, - &Type->TypeInfo.GenericMapping); + &Type->TypeInfo.GenericMapping, + ExGetPreviousMode()); } /*++ @@ -856,7 +860,8 @@ NtQuerySecurityObject(IN HANDLE Handle, &Length, &Header->SecurityDescriptor, Type->TypeInfo.PoolType, - &Type->TypeInfo.GenericMapping); + &Type->TypeInfo.GenericMapping, + ExGetPreviousMode()); /* Dereference the object */ ObDereferenceObject(Object); diff --git a/ntoskrnl/se/semgr.c b/ntoskrnl/se/semgr.c index a88da9c806c..23a23577310 100644 --- a/ntoskrnl/se/semgr.c +++ b/ntoskrnl/se/semgr.c @@ -356,7 +356,8 @@ SeDefaultObjectMethod( _Inout_opt_ PULONG ReturnLength, _Inout_ PSECURITY_DESCRIPTOR *OldSecurityDescriptor, _In_ POOL_TYPE PoolType, - _In_ PGENERIC_MAPPING GenericMapping) + _In_ PGENERIC_MAPPING GenericMapping, + _In_ KPROCESSOR_MODE AccessMode) { PAGED_CODE(); diff --git a/ntoskrnl/wmi/guidobj.c b/ntoskrnl/wmi/guidobj.c index 9cdbd1afd62..86f24bf2670 100644 --- a/ntoskrnl/wmi/guidobj.c +++ b/ntoskrnl/wmi/guidobj.c @@ -40,7 +40,8 @@ WmipSecurityMethod( _Inout_ PULONG CapturedLength, _Inout_ PSECURITY_DESCRIPTOR *ObjectSecurityDescriptor, _In_ POOL_TYPE PoolType, - _In_ PGENERIC_MAPPING GenericMapping) + _In_ PGENERIC_MAPPING GenericMapping, + _In_ KPROCESSOR_MODE AccessMode) { PAGED_CODE(); diff --git a/sdk/include/ndk/obtypes.h b/sdk/include/ndk/obtypes.h index 726a3fc9c9c..6a413ab62e4 100644 --- a/sdk/include/ndk/obtypes.h +++ b/sdk/include/ndk/obtypes.h @@ -191,9 +191,10 @@ typedef VOID typedef NTSTATUS (NTAPI *OB_OPEN_METHOD)( _In_ OB_OPEN_REASON Reason, + _In_ KPROCESSOR_MODE AccessMode, _In_opt_ PEPROCESS Process, _In_ PVOID ObjectBody, - _In_ ACCESS_MASK GrantedAccess, + _In_ PACCESS_MASK GrantedAccess, _In_ ULONG HandleCount ); @@ -234,7 +235,8 @@ typedef NTSTATUS _Inout_ PULONG CapturedLength, _Inout_ PSECURITY_DESCRIPTOR *ObjectSecurityDescriptor, _In_ POOL_TYPE PoolType, - _In_ PGENERIC_MAPPING GenericMapping + _In_ PGENERIC_MAPPING GenericMapping, + _In_ KPROCESSOR_MODE AccessMode ); typedef NTSTATUS