From 20ef076be65e1ff7075530d05dc3ce186b9ba985 Mon Sep 17 00:00:00 2001 From: Eric Kohl Date: Sat, 28 Dec 2013 01:45:36 +0000 Subject: [PATCH] [LSASRV][MSV1_0] - Add default group SIDs to the token groups list (WorldSID aka Everyone and the logon type SID). - Remove these SIDs from the hard-coded list. svn path=/trunk/; revision=61457 --- reactos/dll/win32/lsasrv/authpackage.c | 133 +++++++++++++++++++++++++ reactos/dll/win32/lsasrv/lookup.c | 15 ++- reactos/dll/win32/lsasrv/lsasrv.h | 5 + reactos/dll/win32/msv1_0/msv1_0.c | 35 +------ 4 files changed, 149 insertions(+), 39 deletions(-) diff --git a/reactos/dll/win32/lsasrv/authpackage.c b/reactos/dll/win32/lsasrv/authpackage.c index 4e5f2ad4f6b..abda76a53dc 100644 --- a/reactos/dll/win32/lsasrv/authpackage.c +++ b/reactos/dll/win32/lsasrv/authpackage.c @@ -726,6 +726,128 @@ LsapAddLocalGroups( return STATUS_SUCCESS; } +static +NTSTATUS +LsapAddDefaultGroups( + IN PVOID TokenInformation, + IN LSA_TOKEN_INFORMATION_TYPE TokenInformationType, + IN SECURITY_LOGON_TYPE LogonType) +{ + PLSA_TOKEN_INFORMATION_V1 TokenInfo1; + PTOKEN_GROUPS Groups; + ULONG i, Length; + PSID SrcSid; + + if (TokenInformationType == LsaTokenInformationV1) + { + TokenInfo1 = (PLSA_TOKEN_INFORMATION_V1)TokenInformation; + + if (TokenInfo1->Groups != NULL) + { + Length = sizeof(TOKEN_GROUPS) + + (TokenInfo1->Groups->GroupCount + 2 - ANYSIZE_ARRAY) * sizeof(SID_AND_ATTRIBUTES); + + Groups = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, Length); + if (Groups == NULL) + { + ERR("Group buffer allocation failed!\n"); + return STATUS_INSUFFICIENT_RESOURCES; + } + + Groups->GroupCount = TokenInfo1->Groups->GroupCount; + + for (i = 0; i < TokenInfo1->Groups->GroupCount; i++) + { + Groups->Groups[i].Sid = TokenInfo1->Groups->Groups[i].Sid; + Groups->Groups[i].Attributes = TokenInfo1->Groups->Groups[i].Attributes; + } + + RtlFreeHeap(RtlGetProcessHeap(), 0, TokenInfo1->Groups); + + TokenInfo1->Groups = Groups; + + } + else + { + Length = sizeof(TOKEN_GROUPS) + + (2 - ANYSIZE_ARRAY) * sizeof(SID_AND_ATTRIBUTES); + + Groups = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, Length); + if (Groups == NULL) + { + ERR("Group buffer allocation failed!\n"); + return STATUS_INSUFFICIENT_RESOURCES; + } + + TokenInfo1->Groups = Groups; + } + + /* Append the World SID (aka Everyone) */ + Length = RtlLengthSid(LsapWorldSid); + Groups->Groups[Groups->GroupCount].Sid = RtlAllocateHeap(RtlGetProcessHeap(), + HEAP_ZERO_MEMORY, + Length); + if (Groups->Groups[Groups->GroupCount].Sid == NULL) + return STATUS_INSUFFICIENT_RESOURCES; + + RtlCopyMemory(Groups->Groups[Groups->GroupCount].Sid, + LsapWorldSid, + Length); + + Groups->Groups[Groups->GroupCount].Attributes = + SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY; + + Groups->GroupCount++; + + /* Append the logon type SID */ + switch (LogonType) + { + case Interactive: + SrcSid = LsapInteractiveSid; + break; + + case Network: + SrcSid = LsapNetworkSid; + break; + + case Batch: + SrcSid = LsapBatchSid; + break; + + case Service: + SrcSid = LsapServiceSid; + break; + + default: + FIXME("LogonType %d is not supported!\n", LogonType); + return STATUS_NOT_IMPLEMENTED; + } + + Length = RtlLengthSid(SrcSid); + Groups->Groups[Groups->GroupCount].Sid = RtlAllocateHeap(RtlGetProcessHeap(), + HEAP_ZERO_MEMORY, + Length); + if (Groups->Groups[Groups->GroupCount].Sid == NULL) + return STATUS_INSUFFICIENT_RESOURCES; + + RtlCopyMemory(Groups->Groups[Groups->GroupCount].Sid, + SrcSid, + Length); + + Groups->Groups[Groups->GroupCount].Attributes = + SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY; + + Groups->GroupCount++; + } + else + { + FIXME("TokenInformationType %d is not supported!\n", TokenInformationType); + return STATUS_NOT_IMPLEMENTED; + } + + return STATUS_SUCCESS; +} + static NTSTATUS @@ -832,11 +954,13 @@ LsapLogonUser(PLSA_API_MSG RequestMsg, HANDLE TokenHandle = NULL; ULONG i; ULONG PackageId; + SECURITY_LOGON_TYPE LogonType; NTSTATUS Status; TRACE("(%p %p)\n", RequestMsg, LogonContext); PackageId = RequestMsg->LogonUser.Request.AuthenticationPackage; + LogonType = RequestMsg->LogonUser.Request.LogonType; /* Get the right authentication package */ Package = LsapGetAuthenticationPackage(PackageId); @@ -959,6 +1083,15 @@ LsapLogonUser(PLSA_API_MSG RequestMsg, } } + Status = LsapAddDefaultGroups(TokenInformation, + TokenInformationType, + LogonType); + if (!NT_SUCCESS(Status)) + { + ERR("LsapAddDefaultGroups() failed (Status 0x%08lx)\n", Status); + goto done; + } + Status = LsapSetTokenOwner(TokenInformation, TokenInformationType); if (!NT_SUCCESS(Status)) diff --git a/reactos/dll/win32/lsasrv/lookup.c b/reactos/dll/win32/lsasrv/lookup.c index 937594d1ac1..be83d49ff04 100644 --- a/reactos/dll/win32/lsasrv/lookup.c +++ b/reactos/dll/win32/lsasrv/lookup.c @@ -80,6 +80,11 @@ typedef struct _WELL_KNOWN_SID LIST_ENTRY WellKnownSidListHead; +PSID LsapWorldSid = NULL; +PSID LsapNetworkSid = NULL; +PSID LsapBatchSid = NULL; +PSID LsapInteractiveSid = NULL; +PSID LsapServiceSid = NULL; PSID LsapLocalSystemSid = NULL; PSID LsapAdministratorsSid = NULL; @@ -215,7 +220,7 @@ LsapInitSids(VOID) szAccountName, L"", SidTypeWellKnownGroup, - NULL); + &LsapWorldSid); /* Local Sid */ LsapLoadString(hInstance, IDS_LOCAL_RID, szAccountName, 80); @@ -300,7 +305,7 @@ LsapInitSids(VOID) szAccountName, szDomainName, SidTypeWellKnownGroup, - NULL); + &LsapNetworkSid); /* Batch Sid*/ LsapLoadString(hInstance, IDS_BATCH_RID, szAccountName, 80); @@ -312,7 +317,7 @@ LsapInitSids(VOID) szAccountName, szDomainName, SidTypeWellKnownGroup, - NULL); + &LsapBatchSid); /* Interactive Sid */ LsapLoadString(hInstance, IDS_INTERACTIVE_RID, szAccountName, 80); @@ -324,7 +329,7 @@ LsapInitSids(VOID) szAccountName, szDomainName, SidTypeWellKnownGroup, - NULL); + &LsapInteractiveSid); /* Service Sid */ LsapLoadString(hInstance, IDS_SERVICE_RID, szAccountName, 80); @@ -336,7 +341,7 @@ LsapInitSids(VOID) szAccountName, szDomainName, SidTypeWellKnownGroup, - NULL); + &LsapServiceSid); /* Anonymous Logon Sid */ LsapLoadString(hInstance, IDS_ANONYMOUS_LOGON_RID, szAccountName, 80); diff --git a/reactos/dll/win32/lsasrv/lsasrv.h b/reactos/dll/win32/lsasrv/lsasrv.h index 50a449e64d3..50b8276472d 100644 --- a/reactos/dll/win32/lsasrv/lsasrv.h +++ b/reactos/dll/win32/lsasrv/lsasrv.h @@ -91,6 +91,11 @@ extern UNICODE_STRING BuiltinDomainName; extern PSID AccountDomainSid; extern UNICODE_STRING AccountDomainName; +extern PSID LsapWorldSid; +extern PSID LsapNetworkSid; +extern PSID LsapBatchSid; +extern PSID LsapInteractiveSid; +extern PSID LsapServiceSid; extern PSID LsapLocalSystemSid; extern PSID LsapAdministratorsSid; diff --git a/reactos/dll/win32/msv1_0/msv1_0.c b/reactos/dll/win32/msv1_0/msv1_0.c index c8b1970a7b8..b7ef433ccbc 100644 --- a/reactos/dll/win32/msv1_0/msv1_0.c +++ b/reactos/dll/win32/msv1_0/msv1_0.c @@ -273,10 +273,9 @@ BuildTokenGroups(IN PSID AccountDomainSid, OUT PTOKEN_GROUPS *Groups, OUT PSID *PrimaryGroupSid) { - SID_IDENTIFIER_AUTHORITY WorldAuthority = {SECURITY_WORLD_SID_AUTHORITY}; SID_IDENTIFIER_AUTHORITY SystemAuthority = {SECURITY_NT_AUTHORITY}; PTOKEN_GROUPS TokenGroups; -#define MAX_GROUPS 6 +#define MAX_GROUPS 4 DWORD GroupCount = 0; PSID Sid; NTSTATUS Status = STATUS_SUCCESS; @@ -301,22 +300,6 @@ BuildTokenGroups(IN PSID AccountDomainSid, *PrimaryGroupSid = Sid; GroupCount++; - /* Member of 'Everyone' */ - RtlAllocateAndInitializeSid(&WorldAuthority, - 1, - SECURITY_WORLD_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - &Sid); - TokenGroups->Groups[GroupCount].Sid = Sid; - TokenGroups->Groups[GroupCount].Attributes = - SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY; - GroupCount++; #if 1 /* Member of 'Administrators' */ @@ -356,22 +339,6 @@ BuildTokenGroups(IN PSID AccountDomainSid, SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY; GroupCount++; - /* Member of 'Interactive users' */ - RtlAllocateAndInitializeSid(&SystemAuthority, - 1, - SECURITY_INTERACTIVE_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - SECURITY_NULL_RID, - &Sid); - TokenGroups->Groups[GroupCount].Sid = Sid; - TokenGroups->Groups[GroupCount].Attributes = - SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY; - GroupCount++; /* Member of 'Authenticated users' */ RtlAllocateAndInitializeSid(&SystemAuthority,