Something went wrong. Try again.
Reactos
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407/* * PROJECT: ReactOS Service Control Manager * LICENSE: GPL - See COPYING in the top level directory * FILE: base/system/services/security.c * PURPOSE: Security functions * COPYRIGHT: Eric Kohl */
/* INCLUDES *****************************************************************/
#include "services.h"
#define NDEBUG#include <debug.h>
static PSID pNullSid = NULL;static PSID pWorldSid = NULL;static PSID pLocalSystemSid = NULL;static PSID pAuthenticatedUserSid = NULL;static PSID pAliasAdminsSid = NULL;
static PACL pDefaultDacl = NULL;static PACL pDefaultSacl = NULL;static PACL pPipeDacl = NULL;
static PSECURITY_DESCRIPTOR pDefaultSD = NULL;PSECURITY_DESCRIPTOR pPipeSD = NULL;
/* FUNCTIONS ****************************************************************/
staticVOIDScmFreeSids(VOID){ if (pNullSid != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pNullSid);
if (pWorldSid != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pWorldSid);
if (pLocalSystemSid != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pLocalSystemSid);
if (pAuthenticatedUserSid != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pAuthenticatedUserSid);
if (pAliasAdminsSid != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pAliasAdminsSid);}
staticDWORDScmCreateSids(VOID){ SID_IDENTIFIER_AUTHORITY NullAuthority = {SECURITY_NULL_SID_AUTHORITY}; SID_IDENTIFIER_AUTHORITY WorldAuthority = {SECURITY_WORLD_SID_AUTHORITY}; SID_IDENTIFIER_AUTHORITY NtAuthority = {SECURITY_NT_AUTHORITY}; PULONG pSubAuthority; ULONG ulLength1 = RtlLengthRequiredSid(1); ULONG ulLength2 = RtlLengthRequiredSid(2);
/* Create the Null SID */ pNullSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, ulLength1); if (pNullSid == NULL) { return ERROR_OUTOFMEMORY; }
RtlInitializeSid(pNullSid, &NullAuthority, 1); pSubAuthority = RtlSubAuthoritySid(pNullSid, 0); *pSubAuthority = SECURITY_NULL_RID;
/* Create the World SID */ pWorldSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, ulLength1); if (pWorldSid == NULL) { return ERROR_OUTOFMEMORY; }
RtlInitializeSid(pWorldSid, &WorldAuthority, 1); pSubAuthority = RtlSubAuthoritySid(pWorldSid, 0); *pSubAuthority = SECURITY_WORLD_RID;
/* Create the LocalSystem SID */ pLocalSystemSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, ulLength1); if (pLocalSystemSid == NULL) { return ERROR_OUTOFMEMORY; }
RtlInitializeSid(pLocalSystemSid, &NtAuthority, 1); pSubAuthority = RtlSubAuthoritySid(pLocalSystemSid, 0); *pSubAuthority = SECURITY_LOCAL_SYSTEM_RID;
/* Create the AuthenticatedUser SID */ pAuthenticatedUserSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, ulLength1); if (pAuthenticatedUserSid == NULL) { return ERROR_OUTOFMEMORY; }
RtlInitializeSid(pAuthenticatedUserSid, &NtAuthority, 1); pSubAuthority = RtlSubAuthoritySid(pAuthenticatedUserSid, 0); *pSubAuthority = SECURITY_AUTHENTICATED_USER_RID;
/* Create the AliasAdmins SID */ pAliasAdminsSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, ulLength2); if (pAliasAdminsSid == NULL) { return ERROR_OUTOFMEMORY; }
RtlInitializeSid(pAliasAdminsSid, &NtAuthority, 2); pSubAuthority = RtlSubAuthoritySid(pAliasAdminsSid, 0); *pSubAuthority = SECURITY_BUILTIN_DOMAIN_RID; pSubAuthority = RtlSubAuthoritySid(pAliasAdminsSid, 1); *pSubAuthority = DOMAIN_ALIAS_RID_ADMINS;
return ERROR_SUCCESS;}
staticDWORDScmCreateAcls(VOID){ ULONG ulLength;
/* Create DACL */ ulLength = sizeof(ACL) + (sizeof(ACE) + RtlLengthSid(pLocalSystemSid)) + (sizeof(ACE) + RtlLengthSid(pAliasAdminsSid)) + (sizeof(ACE) + RtlLengthSid(pAuthenticatedUserSid));
pDefaultDacl = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, ulLength); if (pDefaultDacl == NULL) return ERROR_OUTOFMEMORY;
RtlCreateAcl(pDefaultDacl, ulLength, ACL_REVISION);
RtlAddAccessAllowedAce(pDefaultDacl, ACL_REVISION, READ_CONTROL | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_INTERROGATE | SERVICE_PAUSE_CONTINUE | SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_START | SERVICE_STOP | SERVICE_USER_DEFINED_CONTROL, pLocalSystemSid);
RtlAddAccessAllowedAce(pDefaultDacl, ACL_REVISION, SERVICE_ALL_ACCESS, pAliasAdminsSid);
RtlAddAccessAllowedAce(pDefaultDacl, ACL_REVISION, READ_CONTROL | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_INTERROGATE | SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_USER_DEFINED_CONTROL, pAuthenticatedUserSid);
/* Create SACL */ ulLength = sizeof(ACL) + (sizeof(ACE) + RtlLengthSid(pNullSid));
pDefaultSacl = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, ulLength); if (pDefaultSacl == NULL) return ERROR_OUTOFMEMORY;
RtlCreateAcl(pDefaultSacl, ulLength, ACL_REVISION);
RtlAddAuditAccessAce(pDefaultSacl, ACL_REVISION, SERVICE_ALL_ACCESS, pNullSid, FALSE, TRUE);
/* Create the pipe DACL */ ulLength = sizeof(ACL) + (sizeof(ACE) + RtlLengthSid(pWorldSid));
pPipeDacl = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, ulLength); if (pPipeDacl == NULL) return ERROR_OUTOFMEMORY;
RtlCreateAcl(pPipeDacl, ulLength, ACL_REVISION);
RtlAddAccessAllowedAce(pPipeDacl, ACL_REVISION, GENERIC_ALL, pWorldSid);
return ERROR_SUCCESS;}
staticVOIDScmFreeAcls(VOID){ if (pDefaultDacl != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pDefaultDacl);
if (pDefaultSacl != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pDefaultSacl);
if (pPipeDacl != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pPipeDacl);}
staticDWORDScmCreateDefaultSD(VOID){ NTSTATUS Status;
/* Create the absolute security descriptor */ pDefaultSD = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(SECURITY_DESCRIPTOR)); if (pDefaultSD == NULL) return ERROR_OUTOFMEMORY;
DPRINT("pDefaultSD %p\n", pDefaultSD);
Status = RtlCreateSecurityDescriptor(pDefaultSD, SECURITY_DESCRIPTOR_REVISION); if (!NT_SUCCESS(Status)) return RtlNtStatusToDosError(Status);
Status = RtlSetOwnerSecurityDescriptor(pDefaultSD, pLocalSystemSid, FALSE); if (!NT_SUCCESS(Status)) return RtlNtStatusToDosError(Status);
Status = RtlSetGroupSecurityDescriptor(pDefaultSD, pLocalSystemSid, FALSE); if (!NT_SUCCESS(Status)) return RtlNtStatusToDosError(Status);
Status = RtlSetDaclSecurityDescriptor(pDefaultSD, TRUE, pDefaultDacl, FALSE); if (!NT_SUCCESS(Status)) return RtlNtStatusToDosError(Status);
Status = RtlSetSaclSecurityDescriptor(pDefaultSD, TRUE, pDefaultSacl, FALSE); if (!NT_SUCCESS(Status)) return RtlNtStatusToDosError(Status);
return ERROR_SUCCESS;}
staticVOIDScmFreeDefaultSD(VOID){ if (pDefaultSD != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pDefaultSD);}
staticDWORDScmCreatePipeSD(VOID){ NTSTATUS Status;
/* Create the absolute security descriptor */ pPipeSD = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(SECURITY_DESCRIPTOR)); if (pPipeSD == NULL) return ERROR_OUTOFMEMORY;
DPRINT("pPipeSD %p\n", pDefaultSD);
Status = RtlCreateSecurityDescriptor(pPipeSD, SECURITY_DESCRIPTOR_REVISION); if (!NT_SUCCESS(Status)) return RtlNtStatusToDosError(Status);
Status = RtlSetOwnerSecurityDescriptor(pPipeSD, pLocalSystemSid, FALSE); if (!NT_SUCCESS(Status)) return RtlNtStatusToDosError(Status);
Status = RtlSetGroupSecurityDescriptor(pPipeSD, pLocalSystemSid, FALSE); if (!NT_SUCCESS(Status)) return RtlNtStatusToDosError(Status);
Status = RtlSetDaclSecurityDescriptor(pPipeSD, TRUE, pPipeDacl, FALSE); if (!NT_SUCCESS(Status)) return RtlNtStatusToDosError(Status);
return ERROR_SUCCESS;}
staticVOIDScmFreePipeSD(VOID){ if (pPipeSD != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pPipeSD);}
DWORDScmCreateDefaultServiceSD( PSECURITY_DESCRIPTOR *ppSecurityDescriptor){ PSECURITY_DESCRIPTOR pRelativeSD = NULL; DWORD dwBufferLength = 0; NTSTATUS Status; DWORD dwError = ERROR_SUCCESS;
/* Convert the absolute SD to a self-relative SD */ Status = RtlAbsoluteToSelfRelativeSD(pDefaultSD, NULL, &dwBufferLength); if (Status != STATUS_BUFFER_TOO_SMALL) { dwError = RtlNtStatusToDosError(Status); goto done; }
DPRINT("BufferLength %lu\n", dwBufferLength);
pRelativeSD = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, dwBufferLength); if (pRelativeSD == NULL) { dwError = ERROR_OUTOFMEMORY; goto done; } DPRINT("pRelativeSD %p\n", pRelativeSD);
Status = RtlAbsoluteToSelfRelativeSD(pDefaultSD, pRelativeSD, &dwBufferLength); if (!NT_SUCCESS(Status)) { dwError = RtlNtStatusToDosError(Status); goto done; }
*ppSecurityDescriptor = pRelativeSD;
done: if (dwError != ERROR_SUCCESS) { if (pRelativeSD != NULL) RtlFreeHeap(RtlGetProcessHeap(), 0, pRelativeSD); }
return dwError;}
DWORDScmInitializeSecurity(VOID){ DWORD dwError;
dwError = ScmCreateSids(); if (dwError != ERROR_SUCCESS) return dwError;
dwError = ScmCreateAcls(); if (dwError != ERROR_SUCCESS) return dwError;
dwError = ScmCreateDefaultSD(); if (dwError != ERROR_SUCCESS) return dwError;
dwError = ScmCreatePipeSD(); if (dwError != ERROR_SUCCESS) return dwError;
return ERROR_SUCCESS;}
VOIDScmShutdownSecurity(VOID){ ScmFreePipeSD(); ScmFreeDefaultSD(); ScmFreeAcls(); ScmFreeSids();}
/* EOF */