From 56261817357507908f755d0c565cfd3a47e70c02 Mon Sep 17 00:00:00 2001 From: Alex Ionescu Date: Mon, 8 Jan 2007 07:46:17 +0000 Subject: [PATCH] - Implement ObCheckCreateObjectAccess, ObpCheckTraverseAccess, ObpCheckObjectReference. These APIs are not used yet but are all very similar to ObCheckObjectAccess. There are used at different places by Ob to make sure that the current token and access rights permits some privileged operations such as directory traversal, object referencing and object creation. svn path=/trunk/; revision=25368 --- reactos/ntoskrnl/ob/obsecure.c | 207 ++++++++++++++++++++++++++++++++- 1 file changed, 203 insertions(+), 4 deletions(-) diff --git a/reactos/ntoskrnl/ob/obsecure.c b/reactos/ntoskrnl/ob/obsecure.c index 7faad13f83d..7bd90065e2b 100644 --- a/reactos/ntoskrnl/ob/obsecure.c +++ b/reactos/ntoskrnl/ob/obsecure.c @@ -11,10 +11,209 @@ #include #define NDEBUG -#include +#include /* PRIVATE FUNCTIONS *********************************************************/ +BOOLEAN +NTAPI +ObCheckCreateObjectAccess(IN PVOID Object, + IN ACCESS_MASK CreateAccess, + IN PACCESS_STATE AccessState, + IN PUNICODE_STRING ComponentName, + IN BOOLEAN LockHeld, + IN KPROCESSOR_MODE AccessMode, + OUT PNTSTATUS AccessStatus) +{ + POBJECT_HEADER ObjectHeader; + POBJECT_TYPE ObjectType; + PSECURITY_DESCRIPTOR SecurityDescriptor; + BOOLEAN SdAllocated; + BOOLEAN Result = TRUE; + ACCESS_MASK GrantedAccess = 0; + PPRIVILEGE_SET Privileges = NULL; + NTSTATUS Status; + PAGED_CODE(); + + /* Get the header and type */ + ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object); + ObjectType = ObjectHeader->Type; + + /* Get the security descriptor */ + Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated); + if (!NT_SUCCESS(Status)) + { + /* We failed */ + *AccessStatus = Status; + return FALSE; + } + + /* Lock the security context */ + SeLockSubjectContext(&AccessState->SubjectSecurityContext); + + /* Check if we have an SD */ + if (SecurityDescriptor) + { + /* Now do the entire access check */ + Result = SeAccessCheck(SecurityDescriptor, + &AccessState->SubjectSecurityContext, + TRUE, + CreateAccess, + 0, + &Privileges, + &ObjectType->TypeInfo.GenericMapping, + AccessMode, + &GrantedAccess, + AccessStatus); + if (Privileges) + { + /* We got privileges, append them to the access state and free them */ + Status = SeAppendPrivileges(AccessState, Privileges); + SeFreePrivileges(Privileges); + } + } + + /* We're done, unlock the context and release security */ + SeUnlockSubjectContext(&AccessState->SubjectSecurityContext); + ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated); + return Result; +} + +BOOLEAN +NTAPI +ObpCheckTraverseAccess(IN PVOID Object, + IN ACCESS_MASK TraverseAccess, + IN PACCESS_STATE AccessState OPTIONAL, + IN BOOLEAN LockHeld, + IN KPROCESSOR_MODE AccessMode, + OUT PNTSTATUS AccessStatus) +{ + POBJECT_HEADER ObjectHeader; + POBJECT_TYPE ObjectType; + PSECURITY_DESCRIPTOR SecurityDescriptor; + BOOLEAN SdAllocated; + BOOLEAN Result; + ACCESS_MASK GrantedAccess = 0; + PPRIVILEGE_SET Privileges = NULL; + NTSTATUS Status; + PAGED_CODE(); + + /* Get the header and type */ + ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object); + ObjectType = ObjectHeader->Type; + + /* Get the security descriptor */ + Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated); + if (!NT_SUCCESS(Status)) + { + /* We failed */ + *AccessStatus = Status; + return FALSE; + } + + /* Lock the security context */ + SeLockSubjectContext(&AccessState->SubjectSecurityContext); + + /* Now do the entire access check */ + Result = SeAccessCheck(SecurityDescriptor, + &AccessState->SubjectSecurityContext, + TRUE, + TraverseAccess, + 0, + &Privileges, + &ObjectType->TypeInfo.GenericMapping, + AccessMode, + &GrantedAccess, + AccessStatus); + if (Privileges) + { + /* We got privileges, append them to the access state and free them */ + Status = SeAppendPrivileges(AccessState, Privileges); + SeFreePrivileges(Privileges); + } + + /* We're done, unlock the context and release security */ + SeUnlockSubjectContext(&AccessState->SubjectSecurityContext); + ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated); + return Result; +} + +BOOLEAN +NTAPI +ObpCheckObjectReference(IN PVOID Object, + IN OUT PACCESS_STATE AccessState, + IN BOOLEAN LockHeld, + IN KPROCESSOR_MODE AccessMode, + OUT PNTSTATUS AccessStatus) +{ + POBJECT_HEADER ObjectHeader; + POBJECT_TYPE ObjectType; + PSECURITY_DESCRIPTOR SecurityDescriptor; + BOOLEAN SdAllocated; + BOOLEAN Result; + ACCESS_MASK GrantedAccess = 0; + PPRIVILEGE_SET Privileges = NULL; + NTSTATUS Status; + PAGED_CODE(); + + /* Get the header and type */ + ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object); + ObjectType = ObjectHeader->Type; + + /* Get the security descriptor */ + Status = ObGetObjectSecurity(Object, &SecurityDescriptor, &SdAllocated); + if (!NT_SUCCESS(Status)) + { + /* We failed */ + *AccessStatus = Status; + return FALSE; + } + + /* Lock the security context */ + SeLockSubjectContext(&AccessState->SubjectSecurityContext); + + /* Now do the entire access check */ + Result = SeAccessCheck(SecurityDescriptor, + &AccessState->SubjectSecurityContext, + TRUE, + AccessState->RemainingDesiredAccess, + AccessState->PreviouslyGrantedAccess, + &Privileges, + &ObjectType->TypeInfo.GenericMapping, + AccessMode, + &GrantedAccess, + AccessStatus); + if (Result) + { + /* Update the access state */ + AccessState->RemainingDesiredAccess &= ~GrantedAccess; + AccessState->PreviouslyGrantedAccess |= GrantedAccess; + } + + /* Check if we have an SD */ + if (SecurityDescriptor) + { + /* Do audit alarm */ +#if 0 + SeObjectReferenceAuditAlarm(&AccessState->OperationID, + Object, + SecurityDescriptor, + &AccessState->SubjectSecurityContext, + AccessState->RemainingDesiredAccess | + AccessState->PreviouslyGrantedAccess, + ((PAUX_DATA)(AccessState->AuxData))-> + PrivilegeSet, + Result, + AccessMode); +#endif + } + + /* We're done, unlock the context and release security */ + SeUnlockSubjectContext(&AccessState->SubjectSecurityContext); + ObReleaseObjectSecurity(SecurityDescriptor, SdAllocated); + return Result; +} + /*++ * @name ObCheckObjectAccess * @@ -26,7 +225,7 @@ * @param AccessState * * -* @param Unknown +* @param LockHeld * * * @param AccessMode @@ -44,7 +243,7 @@ BOOLEAN NTAPI ObCheckObjectAccess(IN PVOID Object, IN OUT PACCESS_STATE AccessState, - IN BOOLEAN Unknown, + IN BOOLEAN LockHeld, IN KPROCESSOR_MODE AccessMode, OUT PNTSTATUS ReturnedStatus) { @@ -93,7 +292,7 @@ ObCheckObjectAccess(IN PVOID Object, ReturnedStatus); if (Privileges) { - /* We got privileges, append them to teh access state and free them */ + /* We got privileges, append them to the access state and free them */ Status = SeAppendPrivileges(AccessState, Privileges); SeFreePrivileges(Privileges); }