From c9780d9095fe7f7ceb901d1dab425d4fcdba7caa Mon Sep 17 00:00:00 2001
From: Alex Mendoza <182437269+MuerteSeguraZ@users.noreply.github.com>
Date: Thu, 30 Jul 2026 00:04:33 +0200
Subject: [PATCH] [NTOS:OB] Validate ACCESS_SYSTEM_SECURITY in
 ObpIncrementHandleCount

Validate ACCESS_SYSTEM_SECURITY access requests when creating a new
handle in ObpIncrementHandleCount.

- Check for SeSecurityPrivilege (with SeSinglePrivilegeCheck) when a
  caller requests ACCESS_SYSTEM_SECURITY on handle creation.
- Take away ACCESS_SYSTEM_SECURITY from RemainingDesiredAccess /
  PreviouslyGrantedAccess if the privilege isn't held.
---
 ntoskrnl/ob/obhandle.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/ntoskrnl/ob/obhandle.c b/ntoskrnl/ob/obhandle.c
index 192e192feba..f2e1aa05942 100644
--- a/ntoskrnl/ob/obhandle.c
+++ b/ntoskrnl/ob/obhandle.c
@@ -954,8 +954,17 @@ ObpIncrementHandleCount(IN PVOID Object,
         /* Check if the caller is trying to access system security */
         if (AccessState->RemainingDesiredAccess & ACCESS_SYSTEM_SECURITY)
         {
-            /* FIXME: TODO */
-            DPRINT1("ACCESS_SYSTEM_SECURITY not validated!\n");
+            /* Client must be warranted SeSecurityPrivilege to touch SACLs */
+            if (!SeSinglePrivilegeCheck(SeSecurityPrivilege, ProbeMode))
+            {
+                /* FIXME: Generate an audit alarm, security manager must be alerted */
+                Status = STATUS_PRIVILEGE_NOT_HELD;
+                goto Quickie;
+            }
+
+            /* Privilege held, grant it so the access state reflects reality */
+            AccessState->PreviouslyGrantedAccess |= ACCESS_SYSTEM_SECURITY;
+            AccessState->RemainingDesiredAccess &= ~ACCESS_SYSTEM_SECURITY;
         }
     }