git.oblomov.eu Git - wine/blob - dlls/advapi32/security.c

   1 /*
   2  * Copyright 1999, 2000 Juergen Schmied <juergen.schmied@debitel.net>
   3  * Copyright 2003 CodeWeavers Inc. (Ulrich Czekalla)
   4  * Copyright 2006 Robert Reif
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  */
  21
  22 #include <stdarg.h>
  23 #include <string.h>
  24
  25 #include "ntstatus.h"
  26 #define WIN32_NO_STATUS
  27 #include "windef.h"
  28 #include "winbase.h"
  29 #include "winerror.h"
  30 #include "winreg.h"
  31 #include "winsafer.h"
  32 #include "winternl.h"
  33 #include "winioctl.h"
  34 #include "accctrl.h"
  35 #include "sddl.h"
  36 #include "winsvc.h"
  37 #include "aclapi.h"
  38 #include "objbase.h"
  39 #include "iads.h"
  40 #include "advapi32_misc.h"
  41 #include "lmcons.h"
  42
  43 #include "wine/debug.h"
  44 #include "wine/unicode.h"
  45
  46 WINE_DEFAULT_DEBUG_CHANNEL(advapi);
  47
  48 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes);
  49 static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags,
  50     PACL pAcl, LPDWORD cBytes);
  51 static BYTE ParseAceStringFlags(LPCWSTR* StringAcl);
  52 static BYTE ParseAceStringType(LPCWSTR* StringAcl);
  53 static DWORD ParseAceStringRights(LPCWSTR* StringAcl);
  54 static BOOL ParseStringSecurityDescriptorToSecurityDescriptor(
  55     LPCWSTR StringSecurityDescriptor,
  56     SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
  57     LPDWORD cBytes);
  58 static DWORD ParseAclStringFlags(LPCWSTR* StringAcl);
  59
  60 typedef struct _ACEFLAG
  61 {
  62    LPCWSTR wstr;
  63    DWORD value;
  64 } ACEFLAG, *LPACEFLAG;
  65
  66 typedef struct _MAX_SID
  67 {
  68     /* same fields as struct _SID */
  69     BYTE Revision;
  70     BYTE SubAuthorityCount;
  71     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  72     DWORD SubAuthority[SID_MAX_SUB_AUTHORITIES];
  73 } MAX_SID;
  74
  75 typedef struct WELLKNOWNSID
  76 {
  77     WCHAR wstr[2];
  78     WELL_KNOWN_SID_TYPE Type;
  79     MAX_SID Sid;
  80 } WELLKNOWNSID;
  81
  82 static const WELLKNOWNSID WellKnownSids[] =
  83 {
  84     { {0,0}, WinNullSid, { SID_REVISION, 1, { SECURITY_NULL_SID_AUTHORITY }, { SECURITY_NULL_RID } } },
  85     { {'W','D'}, WinWorldSid, { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } } },
  86     { {0,0}, WinLocalSid, { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } } },
  87     { {'C','O'}, WinCreatorOwnerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_RID } } },
  88     { {'C','G'}, WinCreatorGroupSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_RID } } },
  89     { {0,0}, WinCreatorOwnerServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_SERVER_RID } } },
  90     { {0,0}, WinCreatorGroupServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_SERVER_RID } } },
  91     { {0,0}, WinNtAuthoritySid, { SID_REVISION, 0, { SECURITY_NT_AUTHORITY }, { SECURITY_NULL_RID } } },
  92     { {0,0}, WinDialupSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_DIALUP_RID } } },
  93     { {'N','U'}, WinNetworkSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_RID } } },
  94     { {0,0}, WinBatchSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BATCH_RID } } },
  95     { {'I','U'}, WinInteractiveSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } } },
  96     { {'S','U'}, WinServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_SERVICE_RID } } },
  97     { {'A','N'}, WinAnonymousSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } } },
  98     { {0,0}, WinProxySid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PROXY_RID } } },
  99     { {'E','D'}, WinEnterpriseControllersSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ENTERPRISE_CONTROLLERS_RID } } },
 100     { {'P','S'}, WinSelfSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PRINCIPAL_SELF_RID } } },
 101     { {'A','U'}, WinAuthenticatedUserSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } } },
 102     { {'R','C'}, WinRestrictedCodeSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_RESTRICTED_CODE_RID } } },
 103     { {0,0}, WinTerminalServerSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_TERMINAL_SERVER_RID } } },
 104     { {0,0}, WinRemoteLogonIdSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_REMOTE_LOGON_RID } } },
 105     { {'S','Y'}, WinLocalSystemSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } } },
 106     { {'L','S'}, WinLocalServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SERVICE_RID } } },
 107     { {'N','S'}, WinNetworkServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_SERVICE_RID } } },
 108     { {0,0}, WinBuiltinDomainSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID } } },
 109     { {'B','A'}, WinBuiltinAdministratorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } } },
 110     { {'B','U'}, WinBuiltinUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } } },
 111     { {'B','G'}, WinBuiltinGuestsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_GUESTS } } },
 112     { {'P','U'}, WinBuiltinPowerUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_POWER_USERS } } },
 113     { {'A','O'}, WinBuiltinAccountOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ACCOUNT_OPS } } },
 114     { {'S','O'}, WinBuiltinSystemOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_SYSTEM_OPS } } },
 115     { {'P','O'}, WinBuiltinPrintOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PRINT_OPS } } },
 116     { {'B','O'}, WinBuiltinBackupOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_BACKUP_OPS } } },
 117     { {'R','E'}, WinBuiltinReplicatorSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REPLICATOR } } },
 118     { {'R','U'}, WinBuiltinPreWindows2000CompatibleAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PREW2KCOMPACCESS } } },
 119     { {'R','D'}, WinBuiltinRemoteDesktopUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS } } },
 120     { {'N','O'}, WinBuiltinNetworkConfigurationOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS } } },
 121     { {0,0}, WinNTLMAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_NTLM_RID } } },
 122     { {0,0}, WinDigestAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_DIGEST_RID } } },
 123     { {0,0}, WinSChannelAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_SCHANNEL_RID } } },
 124     { {0,0}, WinThisOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_THIS_ORGANIZATION_RID } } },
 125     { {0,0}, WinOtherOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_OTHER_ORGANIZATION_RID } } },
 126     { {0,0}, WinBuiltinIncomingForestTrustBuildersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS  } } },
 127     { {0,0}, WinBuiltinPerfMonitoringUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_MONITORING_USERS } } },
 128     { {0,0}, WinBuiltinPerfLoggingUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_LOGGING_USERS } } },
 129     { {0,0}, WinBuiltinAuthorizationAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS } } },
 130     { {0,0}, WinBuiltinTerminalServerLicenseServersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS } } },
 131     { {0,0}, WinBuiltinDCOMUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_DCOM_USERS } } },
 132     { {'L','W'}, WinLowLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_LOW_RID} } },
 133     { {'M','E'}, WinMediumLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_MEDIUM_RID } } },
 134     { {'H','I'}, WinHighLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_HIGH_RID } } },
 135     { {'S','I'}, WinSystemLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_SYSTEM_RID } } },
 136 };
 137
 138 /* these SIDs must be constructed as relative to some domain - only the RID is well-known */
 139 typedef struct WELLKNOWNRID
 140 {
 141     WCHAR wstr[2];
 142     WELL_KNOWN_SID_TYPE Type;
 143     DWORD Rid;
 144 } WELLKNOWNRID;
 145
 146 static const WELLKNOWNRID WellKnownRids[] = {
 147     { {'L','A'}, WinAccountAdministratorSid,    DOMAIN_USER_RID_ADMIN },
 148     { {'L','G'}, WinAccountGuestSid,            DOMAIN_USER_RID_GUEST },
 149     { {0,0}, WinAccountKrbtgtSid,           DOMAIN_USER_RID_KRBTGT },
 150     { {0,0}, WinAccountDomainAdminsSid,     DOMAIN_GROUP_RID_ADMINS },
 151     { {0,0}, WinAccountDomainUsersSid,      DOMAIN_GROUP_RID_USERS },
 152     { {0,0}, WinAccountDomainGuestsSid,     DOMAIN_GROUP_RID_GUESTS },
 153     { {0,0}, WinAccountComputersSid,        DOMAIN_GROUP_RID_COMPUTERS },
 154     { {0,0}, WinAccountControllersSid,      DOMAIN_GROUP_RID_CONTROLLERS },
 155     { {0,0}, WinAccountCertAdminsSid,       DOMAIN_GROUP_RID_CERT_ADMINS },
 156     { {0,0}, WinAccountSchemaAdminsSid,     DOMAIN_GROUP_RID_SCHEMA_ADMINS },
 157     { {0,0}, WinAccountEnterpriseAdminsSid, DOMAIN_GROUP_RID_ENTERPRISE_ADMINS },
 158     { {0,0}, WinAccountPolicyAdminsSid,     DOMAIN_GROUP_RID_POLICY_ADMINS },
 159     { {0,0}, WinAccountRasAndIasServersSid, DOMAIN_ALIAS_RID_RAS_SERVERS },
 160 };
 161
 162
 163 static SID const sidWorld = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY} , { SECURITY_WORLD_RID } };
 164
 165 typedef struct _AccountSid {
 166     WELL_KNOWN_SID_TYPE type;
 167     LPCWSTR account;
 168     LPCWSTR domain;
 169     SID_NAME_USE name_use;
 170     LPCWSTR alias;
 171 } AccountSid;
 172
 173 static const WCHAR Account_Operators[] = { 'A','c','c','o','u','n','t',' ','O','p','e','r','a','t','o','r','s',0 };
 174 static const WCHAR Administrator[] = {'A','d','m','i','n','i','s','t','r','a','t','o','r',0 };
 175 static const WCHAR Administrators[] = { 'A','d','m','i','n','i','s','t','r','a','t','o','r','s',0 };
 176 static const WCHAR ANONYMOUS_LOGON[] = { 'A','N','O','N','Y','M','O','U','S',' ','L','O','G','O','N',0 };
 177 static const WCHAR Authenticated_Users[] = { 'A','u','t','h','e','n','t','i','c','a','t','e','d',' ','U','s','e','r','s',0 };
 178 static const WCHAR Backup_Operators[] = { 'B','a','c','k','u','p',' ','O','p','e','r','a','t','o','r','s',0 };
 179 static const WCHAR BATCH[] = { 'B','A','T','C','H',0 };
 180 static const WCHAR Blank[] = { 0 };
 181 static const WCHAR BUILTIN[] = { 'B','U','I','L','T','I','N',0 };
 182 static const WCHAR Cert_Publishers[] = { 'C','e','r','t',' ','P','u','b','l','i','s','h','e','r','s',0 };
 183 static const WCHAR CREATOR_GROUP[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',0 };
 184 static const WCHAR CREATOR_GROUP_SERVER[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',' ','S','E','R','V','E','R',0 };
 185 static const WCHAR CREATOR_OWNER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',0 };
 186 static const WCHAR CREATOR_OWNER_SERVER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',' ','S','E','R','V','E','R',0 };
 187 static const WCHAR CURRENT_USER[] = { 'C','U','R','R','E','N','T','_','U','S','E','R',0 };
 188 static const WCHAR DIALUP[] = { 'D','I','A','L','U','P',0 };
 189 static const WCHAR Digest_Authentication[] = { 'D','i','g','e','s','t',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 190 static const WCHAR DOMAIN[] = {'D','O','M','A','I','N',0};
 191 static const WCHAR Domain_Admins[] = { 'D','o','m','a','i','n',' ','A','d','m','i','n','s',0 };
 192 static const WCHAR Domain_Computers[] = { 'D','o','m','a','i','n',' ','C','o','m','p','u','t','e','r','s',0 };
 193 static const WCHAR Domain_Controllers[] = { 'D','o','m','a','i','n',' ','C','o','n','t','r','o','l','l','e','r','s',0 };
 194 static const WCHAR Domain_Guests[] = { 'D','o','m','a','i','n',' ','G','u','e','s','t','s',0 };
 195 static const WCHAR Domain_Users[] = { 'D','o','m','a','i','n',' ','U','s','e','r','s',0 };
 196 static const WCHAR Enterprise_Admins[] = { 'E','n','t','e','r','p','r','i','s','e',' ','A','d','m','i','n','s',0 };
 197 static const WCHAR ENTERPRISE_DOMAIN_CONTROLLERS[] = { 'E','N','T','E','R','P','R','I','S','E',' ','D','O','M','A','I','N',' ','C','O','N','T','R','O','L','L','E','R','S',0 };
 198 static const WCHAR Everyone[] = { 'E','v','e','r','y','o','n','e',0 };
 199 static const WCHAR Group_Policy_Creator_Owners[] = { 'G','r','o','u','p',' ','P','o','l','i','c','y',' ','C','r','e','a','t','o','r',' ','O','w','n','e','r','s',0 };
 200 static const WCHAR Guest[] = { 'G','u','e','s','t',0 };
 201 static const WCHAR Guests[] = { 'G','u','e','s','t','s',0 };
 202 static const WCHAR INTERACTIVE[] = { 'I','N','T','E','R','A','C','T','I','V','E',0 };
 203 static const WCHAR LOCAL[] = { 'L','O','C','A','L',0 };
 204 static const WCHAR LOCAL_SERVICE[] = { 'L','O','C','A','L',' ','S','E','R','V','I','C','E',0 };
 205 static const WCHAR LOCAL_SERVICE2[] = { 'L','O','C','A','L','S','E','R','V','I','C','E',0 };
 206 static const WCHAR NETWORK[] = { 'N','E','T','W','O','R','K',0 };
 207 static const WCHAR Network_Configuration_Operators[] = { 'N','e','t','w','o','r','k',' ','C','o','n','f','i','g','u','r','a','t','i','o','n',' ','O','p','e','r','a','t','o','r','s',0 };
 208 static const WCHAR NETWORK_SERVICE[] = { 'N','E','T','W','O','R','K',' ','S','E','R','V','I','C','E',0 };
 209 static const WCHAR NETWORK_SERVICE2[] = { 'N','E','T','W','O','R','K','S','E','R','V','I','C','E',0 };
 210 static const WCHAR NT_AUTHORITY[] = { 'N','T',' ','A','U','T','H','O','R','I','T','Y',0 };
 211 static const WCHAR NT_Pseudo_Domain[] = { 'N','T',' ','P','s','e','u','d','o',' ','D','o','m','a','i','n',0 };
 212 static const WCHAR NTML_Authentication[] = { 'N','T','M','L',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 213 static const WCHAR NULL_SID[] = { 'N','U','L','L',' ','S','I','D',0 };
 214 static const WCHAR Other_Organization[] = { 'O','t','h','e','r',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 };
 215 static const WCHAR Performance_Log_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','L','o','g',' ','U','s','e','r','s',0 };
 216 static const WCHAR Performance_Monitor_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','M','o','n','i','t','o','r',' ','U','s','e','r','s',0 };
 217 static const WCHAR Power_Users[] = { 'P','o','w','e','r',' ','U','s','e','r','s',0 };
 218 static const WCHAR Pre_Windows_2000_Compatible_Access[] = { 'P','r','e','-','W','i','n','d','o','w','s',' ','2','0','0','0',' ','C','o','m','p','a','t','i','b','l','e',' ','A','c','c','e','s','s',0 };
 219 static const WCHAR Print_Operators[] = { 'P','r','i','n','t',' ','O','p','e','r','a','t','o','r','s',0 };
 220 static const WCHAR PROXY[] = { 'P','R','O','X','Y',0 };
 221 static const WCHAR RAS_and_IAS_Servers[] = { 'R','A','S',' ','a','n','d',' ','I','A','S',' ','S','e','r','v','e','r','s',0 };
 222 static const WCHAR Remote_Desktop_Users[] = { 'R','e','m','o','t','e',' ','D','e','s','k','t','o','p',' ','U','s','e','r','s',0 };
 223 static const WCHAR REMOTE_INTERACTIVE_LOGON[] = { 'R','E','M','O','T','E',' ','I','N','T','E','R','A','C','T','I','V','E',' ','L','O','G','O','N',0 };
 224 static const WCHAR Replicators[] = { 'R','e','p','l','i','c','a','t','o','r','s',0 };
 225 static const WCHAR RESTRICTED[] = { 'R','E','S','T','R','I','C','T','E','D',0 };
 226 static const WCHAR SChannel_Authentication[] = { 'S','C','h','a','n','n','e','l',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 227 static const WCHAR Schema_Admins[] = { 'S','c','h','e','m','a',' ','A','d','m','i','n','s',0 };
 228 static const WCHAR SELF[] = { 'S','E','L','F',0 };
 229 static const WCHAR Server_Operators[] = { 'S','e','r','v','e','r',' ','O','p','e','r','a','t','o','r','s',0 };
 230 static const WCHAR SERVICE[] = { 'S','E','R','V','I','C','E',0 };
 231 static const WCHAR SYSTEM[] = { 'S','Y','S','T','E','M',0 };
 232 static const WCHAR TERMINAL_SERVER_USER[] = { 'T','E','R','M','I','N','A','L',' ','S','E','R','V','E','R',' ','U','S','E','R',0 };
 233 static const WCHAR This_Organization[] = { 'T','h','i','s',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 };
 234 static const WCHAR Users[] = { 'U','s','e','r','s',0 };
 235
 236 static const AccountSid ACCOUNT_SIDS[] = {
 237     { WinNullSid, NULL_SID, Blank, SidTypeWellKnownGroup },
 238     { WinWorldSid, Everyone, Blank, SidTypeWellKnownGroup },
 239     { WinLocalSid, LOCAL, Blank, SidTypeWellKnownGroup },
 240     { WinCreatorOwnerSid, CREATOR_OWNER, Blank, SidTypeWellKnownGroup },
 241     { WinCreatorGroupSid, CREATOR_GROUP, Blank, SidTypeWellKnownGroup },
 242     { WinCreatorOwnerServerSid, CREATOR_OWNER_SERVER, Blank, SidTypeWellKnownGroup },
 243     { WinCreatorGroupServerSid, CREATOR_GROUP_SERVER, Blank, SidTypeWellKnownGroup },
 244     { WinNtAuthoritySid, NT_Pseudo_Domain, NT_Pseudo_Domain, SidTypeDomain },
 245     { WinDialupSid, DIALUP, NT_AUTHORITY, SidTypeWellKnownGroup },
 246     { WinNetworkSid, NETWORK, NT_AUTHORITY, SidTypeWellKnownGroup },
 247     { WinBatchSid, BATCH, NT_AUTHORITY, SidTypeWellKnownGroup },
 248     { WinInteractiveSid, INTERACTIVE, NT_AUTHORITY, SidTypeWellKnownGroup },
 249     { WinServiceSid, SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup },
 250     { WinAnonymousSid, ANONYMOUS_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup },
 251     { WinProxySid, PROXY, NT_AUTHORITY, SidTypeWellKnownGroup },
 252     { WinEnterpriseControllersSid, ENTERPRISE_DOMAIN_CONTROLLERS, NT_AUTHORITY, SidTypeWellKnownGroup },
 253     { WinSelfSid, SELF, NT_AUTHORITY, SidTypeWellKnownGroup },
 254     { WinAuthenticatedUserSid, Authenticated_Users, NT_AUTHORITY, SidTypeWellKnownGroup },
 255     { WinRestrictedCodeSid, RESTRICTED, NT_AUTHORITY, SidTypeWellKnownGroup },
 256     { WinTerminalServerSid, TERMINAL_SERVER_USER, NT_AUTHORITY, SidTypeWellKnownGroup },
 257     { WinRemoteLogonIdSid, REMOTE_INTERACTIVE_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup },
 258     { WinLocalSystemSid, SYSTEM, NT_AUTHORITY, SidTypeWellKnownGroup },
 259     { WinLocalServiceSid, LOCAL_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup, LOCAL_SERVICE2 },
 260     { WinNetworkServiceSid, NETWORK_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup , NETWORK_SERVICE2},
 261     { WinBuiltinDomainSid, BUILTIN, BUILTIN, SidTypeDomain },
 262     { WinBuiltinAdministratorsSid, Administrators, BUILTIN, SidTypeAlias },
 263     { WinBuiltinUsersSid, Users, BUILTIN, SidTypeAlias },
 264     { WinBuiltinGuestsSid, Guests, BUILTIN, SidTypeAlias },
 265     { WinBuiltinPowerUsersSid, Power_Users, BUILTIN, SidTypeAlias },
 266     { WinBuiltinAccountOperatorsSid, Account_Operators, BUILTIN, SidTypeAlias },
 267     { WinBuiltinSystemOperatorsSid, Server_Operators, BUILTIN, SidTypeAlias },
 268     { WinBuiltinPrintOperatorsSid, Print_Operators, BUILTIN, SidTypeAlias },
 269     { WinBuiltinBackupOperatorsSid, Backup_Operators, BUILTIN, SidTypeAlias },
 270     { WinBuiltinReplicatorSid, Replicators, BUILTIN, SidTypeAlias },
 271     { WinBuiltinPreWindows2000CompatibleAccessSid, Pre_Windows_2000_Compatible_Access, BUILTIN, SidTypeAlias },
 272     { WinBuiltinRemoteDesktopUsersSid, Remote_Desktop_Users, BUILTIN, SidTypeAlias },
 273     { WinBuiltinNetworkConfigurationOperatorsSid, Network_Configuration_Operators, BUILTIN, SidTypeAlias },
 274     { WinNTLMAuthenticationSid, NTML_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 275     { WinDigestAuthenticationSid, Digest_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 276     { WinSChannelAuthenticationSid, SChannel_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 277     { WinThisOrganizationSid, This_Organization, NT_AUTHORITY, SidTypeWellKnownGroup },
 278     { WinOtherOrganizationSid, Other_Organization, NT_AUTHORITY, SidTypeWellKnownGroup },
 279     { WinBuiltinPerfMonitoringUsersSid, Performance_Monitor_Users, BUILTIN, SidTypeAlias },
 280     { WinBuiltinPerfLoggingUsersSid, Performance_Log_Users, BUILTIN, SidTypeAlias },
 281 };
 282 /*
 283  * ACE access rights
 284  */
 285 static const WCHAR SDDL_READ_CONTROL[]     = {'R','C',0};
 286 static const WCHAR SDDL_WRITE_DAC[]        = {'W','D',0};
 287 static const WCHAR SDDL_WRITE_OWNER[]      = {'W','O',0};
 288 static const WCHAR SDDL_STANDARD_DELETE[]  = {'S','D',0};
 289
 290 static const WCHAR SDDL_READ_PROPERTY[]    = {'R','P',0};
 291 static const WCHAR SDDL_WRITE_PROPERTY[]   = {'W','P',0};
 292 static const WCHAR SDDL_CREATE_CHILD[]     = {'C','C',0};
 293 static const WCHAR SDDL_DELETE_CHILD[]     = {'D','C',0};
 294 static const WCHAR SDDL_LIST_CHILDREN[]    = {'L','C',0};
 295 static const WCHAR SDDL_SELF_WRITE[]       = {'S','W',0};
 296 static const WCHAR SDDL_LIST_OBJECT[]      = {'L','O',0};
 297 static const WCHAR SDDL_DELETE_TREE[]      = {'D','T',0};
 298 static const WCHAR SDDL_CONTROL_ACCESS[]   = {'C','R',0};
 299
 300 static const WCHAR SDDL_FILE_ALL[]         = {'F','A',0};
 301 static const WCHAR SDDL_FILE_READ[]        = {'F','R',0};
 302 static const WCHAR SDDL_FILE_WRITE[]       = {'F','W',0};
 303 static const WCHAR SDDL_FILE_EXECUTE[]     = {'F','X',0};
 304
 305 static const WCHAR SDDL_KEY_ALL[]          = {'K','A',0};
 306 static const WCHAR SDDL_KEY_READ[]         = {'K','R',0};
 307 static const WCHAR SDDL_KEY_WRITE[]        = {'K','W',0};
 308 static const WCHAR SDDL_KEY_EXECUTE[]      = {'K','X',0};
 309
 310 static const WCHAR SDDL_GENERIC_ALL[]      = {'G','A',0};
 311 static const WCHAR SDDL_GENERIC_READ[]     = {'G','R',0};
 312 static const WCHAR SDDL_GENERIC_WRITE[]    = {'G','W',0};
 313 static const WCHAR SDDL_GENERIC_EXECUTE[]  = {'G','X',0};
 314
 315 /*
 316  * ACL flags
 317  */
 318 static const WCHAR SDDL_PROTECTED[]             = {'P',0};
 319 static const WCHAR SDDL_AUTO_INHERIT_REQ[]      = {'A','R',0};
 320 static const WCHAR SDDL_AUTO_INHERITED[]        = {'A','I',0};
 321
 322 /*
 323  * ACE types
 324  */
 325 static const WCHAR SDDL_ACCESS_ALLOWED[]        = {'A',0};
 326 static const WCHAR SDDL_ACCESS_DENIED[]         = {'D',0};
 327 static const WCHAR SDDL_OBJECT_ACCESS_ALLOWED[] = {'O','A',0};
 328 static const WCHAR SDDL_OBJECT_ACCESS_DENIED[]  = {'O','D',0};
 329 static const WCHAR SDDL_AUDIT[]                 = {'A','U',0};
 330 static const WCHAR SDDL_ALARM[]                 = {'A','L',0};
 331 static const WCHAR SDDL_OBJECT_AUDIT[]          = {'O','U',0};
 332 static const WCHAR SDDL_OBJECT_ALARMp[]         = {'O','L',0};
 333
 334 /*
 335  * ACE flags
 336  */
 337 static const WCHAR SDDL_CONTAINER_INHERIT[]  = {'C','I',0};
 338 static const WCHAR SDDL_OBJECT_INHERIT[]     = {'O','I',0};
 339 static const WCHAR SDDL_NO_PROPAGATE[]       = {'N','P',0};
 340 static const WCHAR SDDL_INHERIT_ONLY[]       = {'I','O',0};
 341 static const WCHAR SDDL_INHERITED[]          = {'I','D',0};
 342 static const WCHAR SDDL_AUDIT_SUCCESS[]      = {'S','A',0};
 343 static const WCHAR SDDL_AUDIT_FAILURE[]      = {'F','A',0};
 344
 345 const char * debugstr_sid(PSID sid)
 346 {
 347     int auth = 0;
 348     SID * psid = sid;
 349
 350     if (psid == NULL)
 351         return "(null)";
 352
 353     auth = psid->IdentifierAuthority.Value[5] +
 354            (psid->IdentifierAuthority.Value[4] << 8) +
 355            (psid->IdentifierAuthority.Value[3] << 16) +
 356            (psid->IdentifierAuthority.Value[2] << 24);
 357
 358     switch (psid->SubAuthorityCount) {
 359     case 0:
 360         return wine_dbg_sprintf("S-%d-%d", psid->Revision, auth);
 361     case 1:
 362         return wine_dbg_sprintf("S-%d-%d-%u", psid->Revision, auth,
 363             psid->SubAuthority[0]);
 364     case 2:
 365         return wine_dbg_sprintf("S-%d-%d-%u-%u", psid->Revision, auth,
 366             psid->SubAuthority[0], psid->SubAuthority[1]);
 367     case 3:
 368         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u", psid->Revision, auth,
 369             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2]);
 370     case 4:
 371         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u", psid->Revision, auth,
 372             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 373             psid->SubAuthority[3]);
 374     case 5:
 375         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u", psid->Revision, auth,
 376             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 377             psid->SubAuthority[3], psid->SubAuthority[4]);
 378     case 6:
 379         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 380             psid->SubAuthority[3], psid->SubAuthority[1], psid->SubAuthority[2],
 381             psid->SubAuthority[0], psid->SubAuthority[4], psid->SubAuthority[5]);
 382     case 7:
 383         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 384             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 385             psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
 386             psid->SubAuthority[6]);
 387     case 8:
 388         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 389             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 390             psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
 391             psid->SubAuthority[6], psid->SubAuthority[7]);
 392     }
 393     return "(too-big)";
 394 }
 395
 396 /* set last error code from NT status and get the proper boolean return value */
 397 /* used for functions that are a simple wrapper around the corresponding ntdll API */
 398 static inline BOOL set_ntstatus( NTSTATUS status )
 399 {
 400     if (status) SetLastError( RtlNtStatusToDosError( status ));
 401     return !status;
 402 }
 403
 404 #define WINE_SIZE_OF_WORLD_ACCESS_ACL   (sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD))
 405
 406 static void GetWorldAccessACL(PACL pACL)
 407 {
 408     PACCESS_ALLOWED_ACE pACE = (PACCESS_ALLOWED_ACE) (pACL + 1);
 409
 410     pACL->AclRevision = ACL_REVISION;
 411     pACL->Sbz1 = 0;
 412     pACL->AclSize = WINE_SIZE_OF_WORLD_ACCESS_ACL;
 413     pACL->AceCount = 1;
 414     pACL->Sbz2 = 0;
 415
 416     pACE->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 417     pACE->Header.AceFlags = CONTAINER_INHERIT_ACE;
 418     pACE->Header.AceSize = sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD);
 419     pACE->Mask = 0xf3ffffff; /* Everything except reserved bits */
 420     memcpy(&pACE->SidStart, &sidWorld, sizeof(sidWorld));
 421 }
 422
 423 /************************************************************
 424  *                ADVAPI_IsLocalComputer
 425  *
 426  * Checks whether the server name indicates local machine.
 427  */
 428 BOOL ADVAPI_IsLocalComputer(LPCWSTR ServerName)
 429 {
 430     DWORD dwSize = MAX_COMPUTERNAME_LENGTH + 1;
 431     BOOL Result;
 432     LPWSTR buf;
 433
 434     if (!ServerName || !ServerName[0])
 435         return TRUE;
 436
 437     buf = HeapAlloc(GetProcessHeap(), 0, dwSize * sizeof(WCHAR));
 438     Result = GetComputerNameW(buf,  &dwSize);
 439     if (Result && (ServerName[0] == '\\') && (ServerName[1] == '\\'))
 440         ServerName += 2;
 441     Result = Result && !lstrcmpW(ServerName, buf);
 442     HeapFree(GetProcessHeap(), 0, buf);
 443
 444     return Result;
 445 }
 446
 447 /************************************************************
 448  *                ADVAPI_GetComputerSid
 449  */
 450 BOOL ADVAPI_GetComputerSid(PSID sid)
 451 {
 452     static const struct /* same fields as struct SID */
 453     {
 454         BYTE Revision;
 455         BYTE SubAuthorityCount;
 456         SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
 457         DWORD SubAuthority[4];
 458     } computer_sid =
 459     { SID_REVISION, 4, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0 } };
 460
 461     memcpy( sid, &computer_sid, sizeof(computer_sid) );
 462     return TRUE;
 463 }
 464
 465 /*      ##############################
 466         ######  TOKEN FUNCTIONS ######
 467         ##############################
 468 */
 469
 470 /******************************************************************************
 471  * OpenProcessToken                     [ADVAPI32.@]
 472  * Opens the access token associated with a process handle.
 473  *
 474  * PARAMS
 475  *   ProcessHandle [I] Handle to process
 476  *   DesiredAccess [I] Desired access to process
 477  *   TokenHandle   [O] Pointer to handle of open access token
 478  *
 479  * RETURNS
 480  *  Success: TRUE. TokenHandle contains the access token.
 481  *  Failure: FALSE.
 482  *
 483  * NOTES
 484  *  See NtOpenProcessToken.
 485  */
 486 BOOL WINAPI
 487 OpenProcessToken( HANDLE ProcessHandle, DWORD DesiredAccess,
 488                   HANDLE *TokenHandle )
 489 {
 490         return set_ntstatus(NtOpenProcessToken( ProcessHandle, DesiredAccess, TokenHandle ));
 491 }
 492
 493 /******************************************************************************
 494  * OpenThreadToken [ADVAPI32.@]
 495  *
 496  * Opens the access token associated with a thread handle.
 497  *
 498  * PARAMS
 499  *   ThreadHandle  [I] Handle to process
 500  *   DesiredAccess [I] Desired access to the thread
 501  *   OpenAsSelf    [I] ???
 502  *   TokenHandle   [O] Destination for the token handle
 503  *
 504  * RETURNS
 505  *  Success: TRUE. TokenHandle contains the access token.
 506  *  Failure: FALSE.
 507  *
 508  * NOTES
 509  *  See NtOpenThreadToken.
 510  */
 511 BOOL WINAPI
 512 OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess,
 513                  BOOL OpenAsSelf, HANDLE *TokenHandle)
 514 {
 515         return set_ntstatus( NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle));
 516 }
 517
 518 BOOL WINAPI
 519 AdjustTokenGroups( HANDLE TokenHandle, BOOL ResetToDefault, PTOKEN_GROUPS NewState,
 520                    DWORD BufferLength, PTOKEN_GROUPS PreviousState, PDWORD ReturnLength )
 521 {
 522     return set_ntstatus( NtAdjustGroupsToken(TokenHandle, ResetToDefault, NewState, BufferLength,
 523                                              PreviousState, ReturnLength));
 524 }
 525
 526 /******************************************************************************
 527  * AdjustTokenPrivileges [ADVAPI32.@]
 528  *
 529  * Adjust the privileges of an open token handle.
 530  *
 531  * PARAMS
 532  *  TokenHandle          [I]   Handle from OpenProcessToken() or OpenThreadToken()
 533  *  DisableAllPrivileges [I]   TRUE=Remove all privileges, FALSE=Use NewState
 534  *  NewState             [I]   Desired new privileges of the token
 535  *  BufferLength         [I]   Length of NewState
 536  *  PreviousState        [O]   Destination for the previous state
 537  *  ReturnLength         [I/O] Size of PreviousState
 538  *
 539  *
 540  * RETURNS
 541  *  Success: TRUE. Privileges are set to NewState and PreviousState is updated.
 542  *  Failure: FALSE.
 543  *
 544  * NOTES
 545  *  See NtAdjustPrivilegesToken.
 546  */
 547 BOOL WINAPI
 548 AdjustTokenPrivileges( HANDLE TokenHandle, BOOL DisableAllPrivileges,
 549                        PTOKEN_PRIVILEGES NewState, DWORD BufferLength,
 550                        PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength )
 551 {
 552     NTSTATUS status;
 553
 554     TRACE("\n");
 555
 556     status = NtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges,
 557                                                      NewState, BufferLength, PreviousState,
 558                                                      ReturnLength);
 559     SetLastError( RtlNtStatusToDosError( status ));
 560     if ((status == STATUS_SUCCESS) || (status == STATUS_NOT_ALL_ASSIGNED))
 561         return TRUE;
 562     else
 563         return FALSE;
 564 }
 565
 566 /******************************************************************************
 567  * CheckTokenMembership [ADVAPI32.@]
 568  *
 569  * Determine if an access token is a member of a SID.
 570  *
 571  * PARAMS
 572  *   TokenHandle [I] Handle from OpenProcessToken() or OpenThreadToken()
 573  *   SidToCheck  [I] SID that possibly contains the token
 574  *   IsMember    [O] Destination for result.
 575  *
 576  * RETURNS
 577  *  Success: TRUE. IsMember is TRUE if TokenHandle is a member, FALSE otherwise.
 578  *  Failure: FALSE.
 579  */
 580 BOOL WINAPI
 581 CheckTokenMembership( HANDLE token, PSID sid_to_check,
 582                       PBOOL is_member )
 583 {
 584     PTOKEN_GROUPS token_groups = NULL;
 585     HANDLE thread_token = NULL;
 586     DWORD size, i;
 587     BOOL ret;
 588
 589     TRACE("(%p %s %p)\n", token, debugstr_sid(sid_to_check), is_member);
 590
 591     *is_member = FALSE;
 592
 593     if (!token)
 594     {
 595         if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &thread_token))
 596         {
 597             HANDLE process_token;
 598             ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &process_token);
 599             if (!ret)
 600                 goto exit;
 601             ret = DuplicateTokenEx(process_token, TOKEN_QUERY,
 602                 NULL, SecurityImpersonation, TokenImpersonation,
 603                 &thread_token);
 604             CloseHandle(process_token);
 605             if (!ret)
 606                 goto exit;
 607         }
 608         token = thread_token;
 609     }
 610     else
 611     {
 612         TOKEN_TYPE type;
 613
 614         ret = GetTokenInformation(token, TokenType, &type, sizeof(TOKEN_TYPE), &size);
 615         if (!ret) goto exit;
 616
 617         if (type == TokenPrimary)
 618         {
 619             SetLastError(ERROR_NO_IMPERSONATION_TOKEN);
 620             return FALSE;
 621         }
 622     }
 623
 624     ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
 625     if (!ret && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
 626         goto exit;
 627
 628     token_groups = HeapAlloc(GetProcessHeap(), 0, size);
 629     if (!token_groups)
 630     {
 631         ret = FALSE;
 632         goto exit;
 633     }
 634
 635     ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
 636     if (!ret)
 637         goto exit;
 638
 639     for (i = 0; i < token_groups->GroupCount; i++)
 640     {
 641         TRACE("Groups[%d]: {0x%x, %s}\n", i,
 642             token_groups->Groups[i].Attributes,
 643             debugstr_sid(token_groups->Groups[i].Sid));
 644         if ((token_groups->Groups[i].Attributes & SE_GROUP_ENABLED) &&
 645             EqualSid(sid_to_check, token_groups->Groups[i].Sid))
 646         {
 647             *is_member = TRUE;
 648             TRACE("sid enabled and found in token\n");
 649             break;
 650         }
 651     }
 652
 653 exit:
 654     HeapFree(GetProcessHeap(), 0, token_groups);
 655     if (thread_token != NULL) CloseHandle(thread_token);
 656
 657     return ret;
 658 }
 659
 660 /******************************************************************************
 661  * GetTokenInformation [ADVAPI32.@]
 662  *
 663  * Get a type of information about an access token.
 664  *
 665  * PARAMS
 666  *   token           [I] Handle from OpenProcessToken() or OpenThreadToken()
 667  *   tokeninfoclass  [I] A TOKEN_INFORMATION_CLASS from "winnt.h"
 668  *   tokeninfo       [O] Destination for token information
 669  *   tokeninfolength [I] Length of tokeninfo
 670  *   retlen          [O] Destination for returned token information length
 671  *
 672  * RETURNS
 673  *  Success: TRUE. tokeninfo contains retlen bytes of token information
 674  *  Failure: FALSE.
 675  *
 676  * NOTES
 677  *  See NtQueryInformationToken.
 678  */
 679 BOOL WINAPI
 680 GetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
 681                      LPVOID tokeninfo, DWORD tokeninfolength, LPDWORD retlen )
 682 {
 683     TRACE("(%p, %s, %p, %d, %p):\n",
 684           token,
 685           (tokeninfoclass == TokenUser) ? "TokenUser" :
 686           (tokeninfoclass == TokenGroups) ? "TokenGroups" :
 687           (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" :
 688           (tokeninfoclass == TokenOwner) ? "TokenOwner" :
 689           (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" :
 690           (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" :
 691           (tokeninfoclass == TokenSource) ? "TokenSource" :
 692           (tokeninfoclass == TokenType) ? "TokenType" :
 693           (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" :
 694           (tokeninfoclass == TokenStatistics) ? "TokenStatistics" :
 695           (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" :
 696           (tokeninfoclass == TokenSessionId) ? "TokenSessionId" :
 697           (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" :
 698           (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" :
 699           (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" :
 700           "Unknown",
 701           tokeninfo, tokeninfolength, retlen);
 702     return set_ntstatus( NtQueryInformationToken( token, tokeninfoclass, tokeninfo,
 703                                                   tokeninfolength, retlen));
 704 }
 705
 706 /******************************************************************************
 707  * SetTokenInformation [ADVAPI32.@]
 708  *
 709  * Set information for an access token.
 710  *
 711  * PARAMS
 712  *   token           [I] Handle from OpenProcessToken() or OpenThreadToken()
 713  *   tokeninfoclass  [I] A TOKEN_INFORMATION_CLASS from "winnt.h"
 714  *   tokeninfo       [I] Token information to set
 715  *   tokeninfolength [I] Length of tokeninfo
 716  *
 717  * RETURNS
 718  *  Success: TRUE. The information for the token is set to tokeninfo.
 719  *  Failure: FALSE.
 720  */
 721 BOOL WINAPI
 722 SetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
 723                      LPVOID tokeninfo, DWORD tokeninfolength )
 724 {
 725     TRACE("(%p, %s, %p, %d): stub\n",
 726           token,
 727           (tokeninfoclass == TokenUser) ? "TokenUser" :
 728           (tokeninfoclass == TokenGroups) ? "TokenGroups" :
 729           (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" :
 730           (tokeninfoclass == TokenOwner) ? "TokenOwner" :
 731           (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" :
 732           (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" :
 733           (tokeninfoclass == TokenSource) ? "TokenSource" :
 734           (tokeninfoclass == TokenType) ? "TokenType" :
 735           (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" :
 736           (tokeninfoclass == TokenStatistics) ? "TokenStatistics" :
 737           (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" :
 738           (tokeninfoclass == TokenSessionId) ? "TokenSessionId" :
 739           (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" :
 740           (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" :
 741           (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" :
 742           "Unknown",
 743           tokeninfo, tokeninfolength);
 744
 745     return set_ntstatus( NtSetInformationToken( token, tokeninfoclass, tokeninfo, tokeninfolength ));
 746 }
 747
 748 /*************************************************************************
 749  * SetThreadToken [ADVAPI32.@]
 750  *
 751  * Assigns an 'impersonation token' to a thread so it can assume the
 752  * security privileges of another thread or process.  Can also remove
 753  * a previously assigned token.
 754  *
 755  * PARAMS
 756  *   thread          [O] Handle to thread to set the token for
 757  *   token           [I] Token to set
 758  *
 759  * RETURNS
 760  *  Success: TRUE. The threads access token is set to token
 761  *  Failure: FALSE.
 762  *
 763  * NOTES
 764  *  Only supported on NT or higher. On Win9X this function does nothing.
 765  *  See SetTokenInformation.
 766  */
 767 BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token)
 768 {
 769     return set_ntstatus( NtSetInformationThread( thread ? *thread : GetCurrentThread(),
 770                                                  ThreadImpersonationToken, &token, sizeof token ));
 771 }
 772
 773 /*************************************************************************
 774  * CreateRestrictedToken [ADVAPI32.@]
 775  *
 776  * Create a new more restricted token from an existing token.
 777  *
 778  * PARAMS
 779  *   baseToken       [I] Token to base the new restricted token on
 780  *   flags           [I] Options
 781  *   nDisableSids    [I] Length of disableSids array
 782  *   disableSids     [I] Array of SIDs to disable in the new token
 783  *   nDeletePrivs    [I] Length of deletePrivs array
 784  *   deletePrivs     [I] Array of privileges to delete in the new token
 785  *   nRestrictSids   [I] Length of restrictSids array
 786  *   restrictSids    [I] Array of SIDs to restrict in the new token
 787  *   newToken        [O] Address where the new token is stored
 788  *
 789  * RETURNS
 790  *  Success: TRUE
 791  *  Failure: FALSE
 792  */
 793 BOOL WINAPI CreateRestrictedToken(
 794     HANDLE baseToken,
 795     DWORD flags,
 796     DWORD nDisableSids,
 797     PSID_AND_ATTRIBUTES disableSids,
 798     DWORD nDeletePrivs,
 799     PLUID_AND_ATTRIBUTES deletePrivs,
 800     DWORD nRestrictSids,
 801     PSID_AND_ATTRIBUTES restrictSids,
 802     PHANDLE newToken)
 803 {
 804     FIXME("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p): stub\n",
 805           baseToken, flags, nDisableSids, disableSids,
 806           nDeletePrivs, deletePrivs,
 807           nRestrictSids, restrictSids,
 808           newToken);
 809     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
 810     return FALSE;
 811 }
 812
 813 /*      ##############################
 814         ######  SID FUNCTIONS   ######
 815         ##############################
 816 */
 817
 818 /******************************************************************************
 819  * AllocateAndInitializeSid [ADVAPI32.@]
 820  *
 821  * PARAMS
 822  *   pIdentifierAuthority []
 823  *   nSubAuthorityCount   []
 824  *   nSubAuthority0       []
 825  *   nSubAuthority1       []
 826  *   nSubAuthority2       []
 827  *   nSubAuthority3       []
 828  *   nSubAuthority4       []
 829  *   nSubAuthority5       []
 830  *   nSubAuthority6       []
 831  *   nSubAuthority7       []
 832  *   pSid                 []
 833  */
 834 BOOL WINAPI
 835 AllocateAndInitializeSid( PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
 836                           BYTE nSubAuthorityCount,
 837                           DWORD nSubAuthority0, DWORD nSubAuthority1,
 838                           DWORD nSubAuthority2, DWORD nSubAuthority3,
 839                           DWORD nSubAuthority4, DWORD nSubAuthority5,
 840                           DWORD nSubAuthority6, DWORD nSubAuthority7,
 841                           PSID *pSid )
 842 {
 843     return set_ntstatus( RtlAllocateAndInitializeSid(
 844                              pIdentifierAuthority, nSubAuthorityCount,
 845                              nSubAuthority0, nSubAuthority1, nSubAuthority2, nSubAuthority3,
 846                              nSubAuthority4, nSubAuthority5, nSubAuthority6, nSubAuthority7,
 847                              pSid ));
 848 }
 849
 850 /******************************************************************************
 851  * FreeSid [ADVAPI32.@]
 852  *
 853  * PARAMS
 854  *   pSid []
 855  */
 856 PVOID WINAPI
 857 FreeSid( PSID pSid )
 858 {
 859         RtlFreeSid(pSid);
 860         return NULL; /* is documented like this */
 861 }
 862
 863 /******************************************************************************
 864  * CopySid [ADVAPI32.@]
 865  *
 866  * PARAMS
 867  *   nDestinationSidLength []
 868  *   pDestinationSid       []
 869  *   pSourceSid            []
 870  */
 871 BOOL WINAPI
 872 CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid )
 873 {
 874         return RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid);
 875 }
 876
 877 /******************************************************************************
 878  * CreateWellKnownSid [ADVAPI32.@]
 879  */
 880 BOOL WINAPI
 881 CreateWellKnownSid( WELL_KNOWN_SID_TYPE WellKnownSidType,
 882                     PSID DomainSid,
 883                     PSID pSid,
 884                     DWORD* cbSid)
 885 {
 886     unsigned int i;
 887     TRACE("(%d, %s, %p, %p)\n", WellKnownSidType, debugstr_sid(DomainSid), pSid, cbSid);
 888
 889     if (cbSid == NULL || (DomainSid && !IsValidSid(DomainSid)))
 890     {
 891         SetLastError(ERROR_INVALID_PARAMETER);
 892         return FALSE;
 893     }
 894
 895     for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++) {
 896         if (WellKnownSids[i].Type == WellKnownSidType) {
 897             DWORD length = GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
 898
 899             if (*cbSid < length)
 900             {
 901                 *cbSid = length;
 902                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
 903                 return FALSE;
 904             }
 905             if (!pSid)
 906             {
 907                 SetLastError(ERROR_INVALID_PARAMETER);
 908                 return FALSE;
 909             }
 910             CopyMemory(pSid, &WellKnownSids[i].Sid.Revision, length);
 911             *cbSid = length;
 912             return TRUE;
 913         }
 914     }
 915
 916     if (DomainSid == NULL || *GetSidSubAuthorityCount(DomainSid) == SID_MAX_SUB_AUTHORITIES)
 917     {
 918         SetLastError(ERROR_INVALID_PARAMETER);
 919         return FALSE;
 920     }
 921
 922     for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
 923         if (WellKnownRids[i].Type == WellKnownSidType) {
 924             UCHAR domain_subauth = *GetSidSubAuthorityCount(DomainSid);
 925             DWORD domain_sid_length = GetSidLengthRequired(domain_subauth);
 926             DWORD output_sid_length = GetSidLengthRequired(domain_subauth + 1);
 927
 928             if (*cbSid < output_sid_length)
 929             {
 930                 *cbSid = output_sid_length;
 931                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
 932                 return FALSE;
 933             }
 934             if (!pSid)
 935             {
 936                 SetLastError(ERROR_INVALID_PARAMETER);
 937                 return FALSE;
 938             }
 939             CopyMemory(pSid, DomainSid, domain_sid_length);
 940             (*GetSidSubAuthorityCount(pSid))++;
 941             (*GetSidSubAuthority(pSid, domain_subauth)) = WellKnownRids[i].Rid;
 942             *cbSid = output_sid_length;
 943             return TRUE;
 944         }
 945
 946     SetLastError(ERROR_INVALID_PARAMETER);
 947     return FALSE;
 948 }
 949
 950 /******************************************************************************
 951  * IsWellKnownSid [ADVAPI32.@]
 952  */
 953 BOOL WINAPI
 954 IsWellKnownSid( PSID pSid, WELL_KNOWN_SID_TYPE WellKnownSidType )
 955 {
 956     unsigned int i;
 957     TRACE("(%s, %d)\n", debugstr_sid(pSid), WellKnownSidType);
 958
 959     for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
 960         if (WellKnownSids[i].Type == WellKnownSidType)
 961             if (EqualSid(pSid, (PSID)&(WellKnownSids[i].Sid.Revision)))
 962                 return TRUE;
 963
 964     return FALSE;
 965 }
 966
 967 BOOL WINAPI
 968 IsTokenRestricted( HANDLE TokenHandle )
 969 {
 970     TOKEN_GROUPS *groups;
 971     DWORD size;
 972     NTSTATUS status;
 973     BOOL restricted;
 974
 975     TRACE("(%p)\n", TokenHandle);
 976
 977     status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, NULL, 0, &size);
 978     if (status != STATUS_BUFFER_TOO_SMALL)
 979         return FALSE;
 980
 981     groups = HeapAlloc(GetProcessHeap(), 0, size);
 982     if (!groups)
 983     {
 984         SetLastError(ERROR_OUTOFMEMORY);
 985         return FALSE;
 986     }
 987
 988     status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, groups, size, &size);
 989     if (status != STATUS_SUCCESS)
 990     {
 991         HeapFree(GetProcessHeap(), 0, groups);
 992         return set_ntstatus(status);
 993     }
 994
 995     if (groups->GroupCount)
 996         restricted = TRUE;
 997     else
 998         restricted = FALSE;
 999
1000     HeapFree(GetProcessHeap(), 0, groups);
1001
1002     return restricted;
1003 }
1004
1005 /******************************************************************************
1006  * IsValidSid [ADVAPI32.@]
1007  *
1008  * PARAMS
1009  *   pSid []
1010  */
1011 BOOL WINAPI
1012 IsValidSid( PSID pSid )
1013 {
1014         return RtlValidSid( pSid );
1015 }
1016
1017 /******************************************************************************
1018  * EqualSid [ADVAPI32.@]
1019  *
1020  * PARAMS
1021  *   pSid1 []
1022  *   pSid2 []
1023  */
1024 BOOL WINAPI
1025 EqualSid( PSID pSid1, PSID pSid2 )
1026 {
1027         BOOL ret = RtlEqualSid( pSid1, pSid2 );
1028         SetLastError(ERROR_SUCCESS);
1029         return ret;
1030 }
1031
1032 /******************************************************************************
1033  * EqualPrefixSid [ADVAPI32.@]
1034  */
1035 BOOL WINAPI EqualPrefixSid (PSID pSid1, PSID pSid2)
1036 {
1037         return RtlEqualPrefixSid(pSid1, pSid2);
1038 }
1039
1040 /******************************************************************************
1041  * GetSidLengthRequired [ADVAPI32.@]
1042  *
1043  * PARAMS
1044  *   nSubAuthorityCount []
1045  */
1046 DWORD WINAPI
1047 GetSidLengthRequired( BYTE nSubAuthorityCount )
1048 {
1049         return RtlLengthRequiredSid(nSubAuthorityCount);
1050 }
1051
1052 /******************************************************************************
1053  * InitializeSid [ADVAPI32.@]
1054  *
1055  * PARAMS
1056  *   pIdentifierAuthority []
1057  */
1058 BOOL WINAPI
1059 InitializeSid (
1060         PSID pSid,
1061         PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
1062         BYTE nSubAuthorityCount)
1063 {
1064         return RtlInitializeSid(pSid, pIdentifierAuthority, nSubAuthorityCount);
1065 }
1066
1067 DWORD WINAPI
1068 GetEffectiveRightsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pAccessRights )
1069 {
1070     FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights);
1071
1072     *pAccessRights = STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL;
1073     return 0;
1074 }
1075
1076 DWORD WINAPI
1077 GetEffectiveRightsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pAccessRights )
1078 {
1079     FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights);
1080
1081     return 1;
1082 }
1083
1084 /******************************************************************************
1085  * GetSidIdentifierAuthority [ADVAPI32.@]
1086  *
1087  * PARAMS
1088  *   pSid []
1089  */
1090 PSID_IDENTIFIER_AUTHORITY WINAPI
1091 GetSidIdentifierAuthority( PSID pSid )
1092 {
1093         return RtlIdentifierAuthoritySid(pSid);
1094 }
1095
1096 /******************************************************************************
1097  * GetSidSubAuthority [ADVAPI32.@]
1098  *
1099  * PARAMS
1100  *   pSid          []
1101  *   nSubAuthority []
1102  */
1103 PDWORD WINAPI
1104 GetSidSubAuthority( PSID pSid, DWORD nSubAuthority )
1105 {
1106         SetLastError(ERROR_SUCCESS);
1107         return RtlSubAuthoritySid(pSid, nSubAuthority);
1108 }
1109
1110 /******************************************************************************
1111  * GetSidSubAuthorityCount [ADVAPI32.@]
1112  *
1113  * PARAMS
1114  *   pSid []
1115  */
1116 PUCHAR WINAPI
1117 GetSidSubAuthorityCount (PSID pSid)
1118 {
1119         SetLastError(ERROR_SUCCESS);
1120         return RtlSubAuthorityCountSid(pSid);
1121 }
1122
1123 /******************************************************************************
1124  * GetLengthSid [ADVAPI32.@]
1125  *
1126  * PARAMS
1127  *   pSid []
1128  */
1129 DWORD WINAPI
1130 GetLengthSid (PSID pSid)
1131 {
1132         return RtlLengthSid(pSid);
1133 }
1134
1135 /*      ##############################################
1136         ######  SECURITY DESCRIPTOR FUNCTIONS   ######
1137         ##############################################
1138 */
1139
1140  /******************************************************************************
1141  * BuildSecurityDescriptorA [ADVAPI32.@]
1142  *
1143  * Builds a SD from
1144  *
1145  * PARAMS
1146  *  pOwner                [I]
1147  *  pGroup                [I]
1148  *  cCountOfAccessEntries [I]
1149  *  pListOfAccessEntries  [I]
1150  *  cCountOfAuditEntries  [I]
1151  *  pListofAuditEntries   [I]
1152  *  pOldSD                [I]
1153  *  lpdwBufferLength      [I/O]
1154  *  pNewSD                [O]
1155  *
1156  * RETURNS
1157  *  Success: ERROR_SUCCESS
1158  *  Failure: nonzero error code from Winerror.h
1159  */
1160 DWORD WINAPI BuildSecurityDescriptorA(
1161     IN PTRUSTEEA pOwner,
1162     IN PTRUSTEEA pGroup,
1163     IN ULONG cCountOfAccessEntries,
1164     IN PEXPLICIT_ACCESSA pListOfAccessEntries,
1165     IN ULONG cCountOfAuditEntries,
1166     IN PEXPLICIT_ACCESSA pListofAuditEntries,
1167     IN PSECURITY_DESCRIPTOR pOldSD,
1168     IN OUT PULONG lpdwBufferLength,
1169     OUT PSECURITY_DESCRIPTOR* pNewSD)
1170 {
1171     FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup,
1172           cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries,
1173           pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD);
1174
1175     return ERROR_CALL_NOT_IMPLEMENTED;
1176 }
1177
1178 /******************************************************************************
1179  * BuildSecurityDescriptorW [ADVAPI32.@]
1180  *
1181  * See BuildSecurityDescriptorA.
1182  */
1183 DWORD WINAPI BuildSecurityDescriptorW(
1184     IN PTRUSTEEW pOwner,
1185     IN PTRUSTEEW pGroup,
1186     IN ULONG cCountOfAccessEntries,
1187     IN PEXPLICIT_ACCESSW pListOfAccessEntries,
1188     IN ULONG cCountOfAuditEntries,
1189     IN PEXPLICIT_ACCESSW pListofAuditEntries,
1190     IN PSECURITY_DESCRIPTOR pOldSD,
1191     IN OUT PULONG lpdwBufferLength,
1192     OUT PSECURITY_DESCRIPTOR* pNewSD)
1193 {
1194     FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup,
1195           cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries,
1196           pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD);
1197
1198     return ERROR_CALL_NOT_IMPLEMENTED;
1199 }
1200
1201 /******************************************************************************
1202  * InitializeSecurityDescriptor [ADVAPI32.@]
1203  *
1204  * PARAMS
1205  *   pDescr   []
1206  *   revision []
1207  */
1208 BOOL WINAPI
1209 InitializeSecurityDescriptor( PSECURITY_DESCRIPTOR pDescr, DWORD revision )
1210 {
1211         return set_ntstatus( RtlCreateSecurityDescriptor(pDescr, revision ));
1212 }
1213
1214
1215 /******************************************************************************
1216  * MakeAbsoluteSD [ADVAPI32.@]
1217  */
1218 BOOL WINAPI MakeAbsoluteSD (
1219         IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
1220         OUT PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
1221         OUT LPDWORD lpdwAbsoluteSecurityDescriptorSize,
1222         OUT PACL pDacl,
1223         OUT LPDWORD lpdwDaclSize,
1224         OUT PACL pSacl,
1225         OUT LPDWORD lpdwSaclSize,
1226         OUT PSID pOwner,
1227         OUT LPDWORD lpdwOwnerSize,
1228         OUT PSID pPrimaryGroup,
1229         OUT LPDWORD lpdwPrimaryGroupSize)
1230 {
1231     return set_ntstatus( RtlSelfRelativeToAbsoluteSD(pSelfRelativeSecurityDescriptor,
1232                                                      pAbsoluteSecurityDescriptor,
1233                                                      lpdwAbsoluteSecurityDescriptorSize,
1234                                                      pDacl, lpdwDaclSize, pSacl, lpdwSaclSize,
1235                                                      pOwner, lpdwOwnerSize,
1236                                                      pPrimaryGroup, lpdwPrimaryGroupSize));
1237 }
1238
1239 /******************************************************************************
1240  * GetKernelObjectSecurity [ADVAPI32.@]
1241  */
1242 BOOL WINAPI GetKernelObjectSecurity(
1243         HANDLE Handle,
1244         SECURITY_INFORMATION RequestedInformation,
1245         PSECURITY_DESCRIPTOR pSecurityDescriptor,
1246         DWORD nLength,
1247         LPDWORD lpnLengthNeeded )
1248 {
1249     TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", Handle, RequestedInformation,
1250           pSecurityDescriptor, nLength, lpnLengthNeeded);
1251
1252     return set_ntstatus( NtQuerySecurityObject(Handle, RequestedInformation, pSecurityDescriptor,
1253                                                nLength, lpnLengthNeeded ));
1254 }
1255
1256 /******************************************************************************
1257  * GetPrivateObjectSecurity [ADVAPI32.@]
1258  */
1259 BOOL WINAPI GetPrivateObjectSecurity(
1260         PSECURITY_DESCRIPTOR ObjectDescriptor,
1261         SECURITY_INFORMATION SecurityInformation,
1262         PSECURITY_DESCRIPTOR ResultantDescriptor,
1263         DWORD DescriptorLength,
1264         PDWORD ReturnLength )
1265 {
1266     SECURITY_DESCRIPTOR desc;
1267     BOOL defaulted, present;
1268     PACL pacl;
1269     PSID psid;
1270
1271     TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", ObjectDescriptor, SecurityInformation,
1272           ResultantDescriptor, DescriptorLength, ReturnLength);
1273
1274     if (!InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION))
1275         return FALSE;
1276
1277     if (SecurityInformation & OWNER_SECURITY_INFORMATION)
1278     {
1279         if (!GetSecurityDescriptorOwner(ObjectDescriptor, &psid, &defaulted))
1280             return FALSE;
1281         SetSecurityDescriptorOwner(&desc, psid, defaulted);
1282     }
1283
1284     if (SecurityInformation & GROUP_SECURITY_INFORMATION)
1285     {
1286         if (!GetSecurityDescriptorGroup(ObjectDescriptor, &psid, &defaulted))
1287             return FALSE;
1288         SetSecurityDescriptorGroup(&desc, psid, defaulted);
1289     }
1290
1291     if (SecurityInformation & DACL_SECURITY_INFORMATION)
1292     {
1293         if (!GetSecurityDescriptorDacl(ObjectDescriptor, &present, &pacl, &defaulted))
1294             return FALSE;
1295         SetSecurityDescriptorDacl(&desc, present, pacl, defaulted);
1296     }
1297
1298     if (SecurityInformation & SACL_SECURITY_INFORMATION)
1299     {
1300         if (!GetSecurityDescriptorSacl(ObjectDescriptor, &present, &pacl, &defaulted))
1301             return FALSE;
1302         SetSecurityDescriptorSacl(&desc, present, pacl, defaulted);
1303     }
1304
1305     *ReturnLength = DescriptorLength;
1306     return MakeSelfRelativeSD(&desc, ResultantDescriptor, ReturnLength);
1307 }
1308
1309 /******************************************************************************
1310  * GetSecurityDescriptorLength [ADVAPI32.@]
1311  */
1312 DWORD WINAPI GetSecurityDescriptorLength( PSECURITY_DESCRIPTOR pDescr)
1313 {
1314         return RtlLengthSecurityDescriptor(pDescr);
1315 }
1316
1317 /******************************************************************************
1318  * GetSecurityDescriptorOwner [ADVAPI32.@]
1319  *
1320  * PARAMS
1321  *   pOwner            []
1322  *   lpbOwnerDefaulted []
1323  */
1324 BOOL WINAPI
1325 GetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pDescr, PSID *pOwner,
1326                             LPBOOL lpbOwnerDefaulted )
1327 {
1328     BOOLEAN defaulted;
1329     BOOL ret = set_ntstatus( RtlGetOwnerSecurityDescriptor( pDescr, pOwner, &defaulted ));
1330     *lpbOwnerDefaulted = defaulted;
1331     return ret;
1332 }
1333
1334 /******************************************************************************
1335  * SetSecurityDescriptorOwner [ADVAPI32.@]
1336  *
1337  * PARAMS
1338  */
1339 BOOL WINAPI SetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1340                                    PSID pOwner, BOOL bOwnerDefaulted)
1341 {
1342     return set_ntstatus( RtlSetOwnerSecurityDescriptor(pSecurityDescriptor, pOwner, bOwnerDefaulted));
1343 }
1344 /******************************************************************************
1345  * GetSecurityDescriptorGroup                   [ADVAPI32.@]
1346  */
1347 BOOL WINAPI GetSecurityDescriptorGroup(
1348         PSECURITY_DESCRIPTOR SecurityDescriptor,
1349         PSID *Group,
1350         LPBOOL GroupDefaulted)
1351 {
1352     BOOLEAN defaulted;
1353     BOOL ret = set_ntstatus( RtlGetGroupSecurityDescriptor(SecurityDescriptor, Group, &defaulted ));
1354     *GroupDefaulted = defaulted;
1355     return ret;
1356 }
1357 /******************************************************************************
1358  * SetSecurityDescriptorGroup [ADVAPI32.@]
1359  */
1360 BOOL WINAPI SetSecurityDescriptorGroup ( PSECURITY_DESCRIPTOR SecurityDescriptor,
1361                                            PSID Group, BOOL GroupDefaulted)
1362 {
1363     return set_ntstatus( RtlSetGroupSecurityDescriptor( SecurityDescriptor, Group, GroupDefaulted));
1364 }
1365
1366 /******************************************************************************
1367  * IsValidSecurityDescriptor [ADVAPI32.@]
1368  *
1369  * PARAMS
1370  *   lpsecdesc []
1371  */
1372 BOOL WINAPI
1373 IsValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor )
1374 {
1375     return set_ntstatus( RtlValidSecurityDescriptor(SecurityDescriptor));
1376 }
1377
1378 /******************************************************************************
1379  *  GetSecurityDescriptorDacl                   [ADVAPI32.@]
1380  */
1381 BOOL WINAPI GetSecurityDescriptorDacl(
1382         IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
1383         OUT LPBOOL lpbDaclPresent,
1384         OUT PACL *pDacl,
1385         OUT LPBOOL lpbDaclDefaulted)
1386 {
1387     BOOLEAN present, defaulted;
1388     BOOL ret = set_ntstatus( RtlGetDaclSecurityDescriptor(pSecurityDescriptor, &present, pDacl, &defaulted));
1389     *lpbDaclPresent = present;
1390     *lpbDaclDefaulted = defaulted;
1391     return ret;
1392 }
1393
1394 /******************************************************************************
1395  *  SetSecurityDescriptorDacl                   [ADVAPI32.@]
1396  */
1397 BOOL WINAPI
1398 SetSecurityDescriptorDacl (
1399         PSECURITY_DESCRIPTOR lpsd,
1400         BOOL daclpresent,
1401         PACL dacl,
1402         BOOL dacldefaulted )
1403 {
1404     return set_ntstatus( RtlSetDaclSecurityDescriptor (lpsd, daclpresent, dacl, dacldefaulted ) );
1405 }
1406 /******************************************************************************
1407  *  GetSecurityDescriptorSacl                   [ADVAPI32.@]
1408  */
1409 BOOL WINAPI GetSecurityDescriptorSacl(
1410         IN PSECURITY_DESCRIPTOR lpsd,
1411         OUT LPBOOL lpbSaclPresent,
1412         OUT PACL *pSacl,
1413         OUT LPBOOL lpbSaclDefaulted)
1414 {
1415     BOOLEAN present, defaulted;
1416     BOOL ret = set_ntstatus( RtlGetSaclSecurityDescriptor(lpsd, &present, pSacl, &defaulted) );
1417     *lpbSaclPresent = present;
1418     *lpbSaclDefaulted = defaulted;
1419     return ret;
1420 }
1421
1422 /**************************************************************************
1423  * SetSecurityDescriptorSacl                    [ADVAPI32.@]
1424  */
1425 BOOL WINAPI SetSecurityDescriptorSacl (
1426         PSECURITY_DESCRIPTOR lpsd,
1427         BOOL saclpresent,
1428         PACL lpsacl,
1429         BOOL sacldefaulted)
1430 {
1431     return set_ntstatus (RtlSetSaclSecurityDescriptor(lpsd, saclpresent, lpsacl, sacldefaulted));
1432 }
1433 /******************************************************************************
1434  * MakeSelfRelativeSD [ADVAPI32.@]
1435  *
1436  * PARAMS
1437  *   lpabssecdesc  []
1438  *   lpselfsecdesc []
1439  *   lpbuflen      []
1440  */
1441 BOOL WINAPI
1442 MakeSelfRelativeSD(
1443         IN PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
1444         IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
1445         IN OUT LPDWORD lpdwBufferLength)
1446 {
1447     return set_ntstatus( RtlMakeSelfRelativeSD( pAbsoluteSecurityDescriptor,
1448                                                 pSelfRelativeSecurityDescriptor, lpdwBufferLength));
1449 }
1450
1451 /******************************************************************************
1452  * GetSecurityDescriptorControl                 [ADVAPI32.@]
1453  */
1454
1455 BOOL WINAPI GetSecurityDescriptorControl ( PSECURITY_DESCRIPTOR  pSecurityDescriptor,
1456                  PSECURITY_DESCRIPTOR_CONTROL pControl, LPDWORD lpdwRevision)
1457 {
1458     return set_ntstatus( RtlGetControlSecurityDescriptor(pSecurityDescriptor,pControl,lpdwRevision));
1459 }
1460
1461 /******************************************************************************
1462  * SetSecurityDescriptorControl                 [ADVAPI32.@]
1463  */
1464 BOOL WINAPI SetSecurityDescriptorControl( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1465   SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest,
1466   SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet )
1467 {
1468     return set_ntstatus( RtlSetControlSecurityDescriptor(
1469         pSecurityDescriptor, ControlBitsOfInterest, ControlBitsToSet ) );
1470 }
1471
1472 /*      ##############################
1473         ######  ACL FUNCTIONS   ######
1474         ##############################
1475 */
1476
1477 /*************************************************************************
1478  * InitializeAcl [ADVAPI32.@]
1479  */
1480 BOOL WINAPI InitializeAcl(PACL acl, DWORD size, DWORD rev)
1481 {
1482     return set_ntstatus( RtlCreateAcl(acl, size, rev));
1483 }
1484
1485 BOOL WINAPI ImpersonateNamedPipeClient( HANDLE hNamedPipe )
1486 {
1487     IO_STATUS_BLOCK io_block;
1488
1489     TRACE("(%p)\n", hNamedPipe);
1490
1491     return set_ntstatus( NtFsControlFile(hNamedPipe, NULL, NULL, NULL,
1492                          &io_block, FSCTL_PIPE_IMPERSONATE, NULL, 0, NULL, 0) );
1493 }
1494
1495 /******************************************************************************
1496  *  AddAccessAllowedAce [ADVAPI32.@]
1497  */
1498 BOOL WINAPI AddAccessAllowedAce(
1499         IN OUT PACL pAcl,
1500         IN DWORD dwAceRevision,
1501         IN DWORD AccessMask,
1502         IN PSID pSid)
1503 {
1504     return set_ntstatus(RtlAddAccessAllowedAce(pAcl, dwAceRevision, AccessMask, pSid));
1505 }
1506
1507 /******************************************************************************
1508  *  AddAccessAllowedAceEx [ADVAPI32.@]
1509  */
1510 BOOL WINAPI AddAccessAllowedAceEx(
1511         IN OUT PACL pAcl,
1512         IN DWORD dwAceRevision,
1513         IN DWORD AceFlags,
1514         IN DWORD AccessMask,
1515         IN PSID pSid)
1516 {
1517     return set_ntstatus(RtlAddAccessAllowedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid));
1518 }
1519
1520 /******************************************************************************
1521  *  AddAccessDeniedAce [ADVAPI32.@]
1522  */
1523 BOOL WINAPI AddAccessDeniedAce(
1524         IN OUT PACL pAcl,
1525         IN DWORD dwAceRevision,
1526         IN DWORD AccessMask,
1527         IN PSID pSid)
1528 {
1529     return set_ntstatus(RtlAddAccessDeniedAce(pAcl, dwAceRevision, AccessMask, pSid));
1530 }
1531
1532 /******************************************************************************
1533  *  AddAccessDeniedAceEx [ADVAPI32.@]
1534  */
1535 BOOL WINAPI AddAccessDeniedAceEx(
1536         IN OUT PACL pAcl,
1537         IN DWORD dwAceRevision,
1538         IN DWORD AceFlags,
1539         IN DWORD AccessMask,
1540         IN PSID pSid)
1541 {
1542     return set_ntstatus(RtlAddAccessDeniedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid));
1543 }
1544
1545 /******************************************************************************
1546  *  AddAce [ADVAPI32.@]
1547  */
1548 BOOL WINAPI AddAce(
1549         IN OUT PACL pAcl,
1550         IN DWORD dwAceRevision,
1551         IN DWORD dwStartingAceIndex,
1552         LPVOID pAceList,
1553         DWORD nAceListLength)
1554 {
1555     return set_ntstatus(RtlAddAce(pAcl, dwAceRevision, dwStartingAceIndex, pAceList, nAceListLength));
1556 }
1557
1558 /******************************************************************************
1559  * DeleteAce [ADVAPI32.@]
1560  */
1561 BOOL WINAPI DeleteAce(PACL pAcl, DWORD dwAceIndex)
1562 {
1563     return set_ntstatus(RtlDeleteAce(pAcl, dwAceIndex));
1564 }
1565
1566 /******************************************************************************
1567  *  FindFirstFreeAce [ADVAPI32.@]
1568  */
1569 BOOL WINAPI FindFirstFreeAce(IN PACL pAcl, LPVOID * pAce)
1570 {
1571         return RtlFirstFreeAce(pAcl, (PACE_HEADER *)pAce);
1572 }
1573
1574 /******************************************************************************
1575  * GetAce [ADVAPI32.@]
1576  */
1577 BOOL WINAPI GetAce(PACL pAcl,DWORD dwAceIndex,LPVOID *pAce )
1578 {
1579     return set_ntstatus(RtlGetAce(pAcl, dwAceIndex, pAce));
1580 }
1581
1582 /******************************************************************************
1583  * GetAclInformation [ADVAPI32.@]
1584  */
1585 BOOL WINAPI GetAclInformation(
1586   PACL pAcl,
1587   LPVOID pAclInformation,
1588   DWORD nAclInformationLength,
1589   ACL_INFORMATION_CLASS dwAclInformationClass)
1590 {
1591     return set_ntstatus(RtlQueryInformationAcl(pAcl, pAclInformation,
1592                                                nAclInformationLength, dwAclInformationClass));
1593 }
1594
1595 /******************************************************************************
1596  *  IsValidAcl [ADVAPI32.@]
1597  */
1598 BOOL WINAPI IsValidAcl(IN PACL pAcl)
1599 {
1600         return RtlValidAcl(pAcl);
1601 }
1602
1603 /*      ##############################
1604         ######  MISC FUNCTIONS  ######
1605         ##############################
1606 */
1607
1608 /******************************************************************************
1609  * AllocateLocallyUniqueId [ADVAPI32.@]
1610  *
1611  * PARAMS
1612  *   lpLuid []
1613  */
1614 BOOL WINAPI AllocateLocallyUniqueId( PLUID lpLuid )
1615 {
1616     return set_ntstatus(NtAllocateLocallyUniqueId(lpLuid));
1617 }
1618
1619 static const WCHAR SE_CREATE_TOKEN_NAME_W[] =
1620  { 'S','e','C','r','e','a','t','e','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 };
1621 static const WCHAR SE_ASSIGNPRIMARYTOKEN_NAME_W[] =
1622  { 'S','e','A','s','s','i','g','n','P','r','i','m','a','r','y','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 };
1623 static const WCHAR SE_LOCK_MEMORY_NAME_W[] =
1624  { 'S','e','L','o','c','k','M','e','m','o','r','y','P','r','i','v','i','l','e','g','e',0 };
1625 static const WCHAR SE_INCREASE_QUOTA_NAME_W[] =
1626  { 'S','e','I','n','c','r','e','a','s','e','Q','u','o','t','a','P','r','i','v','i','l','e','g','e',0 };
1627 static const WCHAR SE_MACHINE_ACCOUNT_NAME_W[] =
1628  { 'S','e','M','a','c','h','i','n','e','A','c','c','o','u','n','t','P','r','i','v','i','l','e','g','e',0 };
1629 static const WCHAR SE_TCB_NAME_W[] =
1630  { 'S','e','T','c','b','P','r','i','v','i','l','e','g','e',0 };
1631 static const WCHAR SE_SECURITY_NAME_W[] =
1632  { 'S','e','S','e','c','u','r','i','t','y','P','r','i','v','i','l','e','g','e',0 };
1633 static const WCHAR SE_TAKE_OWNERSHIP_NAME_W[] =
1634  { 'S','e','T','a','k','e','O','w','n','e','r','s','h','i','p','P','r','i','v','i','l','e','g','e',0 };
1635 static const WCHAR SE_LOAD_DRIVER_NAME_W[] =
1636  { 'S','e','L','o','a','d','D','r','i','v','e','r','P','r','i','v','i','l','e','g','e',0 };
1637 static const WCHAR SE_SYSTEM_PROFILE_NAME_W[] =
1638  { 'S','e','S','y','s','t','e','m','P','r','o','f','i','l','e','P','r','i','v','i','l','e','g','e',0 };
1639 static const WCHAR SE_SYSTEMTIME_NAME_W[] =
1640  { 'S','e','S','y','s','t','e','m','t','i','m','e','P','r','i','v','i','l','e','g','e',0 };
1641 static const WCHAR SE_PROF_SINGLE_PROCESS_NAME_W[] =
1642  { 'S','e','P','r','o','f','i','l','e','S','i','n','g','l','e','P','r','o','c','e','s','s','P','r','i','v','i','l','e','g','e',0 };
1643 static const WCHAR SE_INC_BASE_PRIORITY_NAME_W[] =
1644  { 'S','e','I','n','c','r','e','a','s','e','B','a','s','e','P','r','i','o','r','i','t','y','P','r','i','v','i','l','e','g','e',0 };
1645 static const WCHAR SE_CREATE_PAGEFILE_NAME_W[] =
1646  { 'S','e','C','r','e','a','t','e','P','a','g','e','f','i','l','e','P','r','i','v','i','l','e','g','e',0 };
1647 static const WCHAR SE_CREATE_PERMANENT_NAME_W[] =
1648  { 'S','e','C','r','e','a','t','e','P','e','r','m','a','n','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1649 static const WCHAR SE_BACKUP_NAME_W[] =
1650  { 'S','e','B','a','c','k','u','p','P','r','i','v','i','l','e','g','e',0 };
1651 static const WCHAR SE_RESTORE_NAME_W[] =
1652  { 'S','e','R','e','s','t','o','r','e','P','r','i','v','i','l','e','g','e',0 };
1653 static const WCHAR SE_SHUTDOWN_NAME_W[] =
1654  { 'S','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 };
1655 static const WCHAR SE_DEBUG_NAME_W[] =
1656  { 'S','e','D','e','b','u','g','P','r','i','v','i','l','e','g','e',0 };
1657 static const WCHAR SE_AUDIT_NAME_W[] =
1658  { 'S','e','A','u','d','i','t','P','r','i','v','i','l','e','g','e',0 };
1659 static const WCHAR SE_SYSTEM_ENVIRONMENT_NAME_W[] =
1660  { 'S','e','S','y','s','t','e','m','E','n','v','i','r','o','n','m','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1661 static const WCHAR SE_CHANGE_NOTIFY_NAME_W[] =
1662  { 'S','e','C','h','a','n','g','e','N','o','t','i','f','y','P','r','i','v','i','l','e','g','e',0 };
1663 static const WCHAR SE_REMOTE_SHUTDOWN_NAME_W[] =
1664  { 'S','e','R','e','m','o','t','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 };
1665 static const WCHAR SE_UNDOCK_NAME_W[] =
1666  { 'S','e','U','n','d','o','c','k','P','r','i','v','i','l','e','g','e',0 };
1667 static const WCHAR SE_SYNC_AGENT_NAME_W[] =
1668  { 'S','e','S','y','n','c','A','g','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1669 static const WCHAR SE_ENABLE_DELEGATION_NAME_W[] =
1670  { 'S','e','E','n','a','b','l','e','D','e','l','e','g','a','t','i','o','n','P','r','i','v','i','l','e','g','e',0 };
1671 static const WCHAR SE_MANAGE_VOLUME_NAME_W[] =
1672  { 'S','e','M','a','n','a','g','e','V','o','l','u','m','e','P','r','i','v','i','l','e','g','e',0 };
1673 static const WCHAR SE_IMPERSONATE_NAME_W[] =
1674  { 'S','e','I','m','p','e','r','s','o','n','a','t','e','P','r','i','v','i','l','e','g','e',0 };
1675 static const WCHAR SE_CREATE_GLOBAL_NAME_W[] =
1676  { 'S','e','C','r','e','a','t','e','G','l','o','b','a','l','P','r','i','v','i','l','e','g','e',0 };
1677
1678 static const WCHAR * const WellKnownPrivNames[SE_MAX_WELL_KNOWN_PRIVILEGE + 1] =
1679 {
1680     NULL,
1681     NULL,
1682     SE_CREATE_TOKEN_NAME_W,
1683     SE_ASSIGNPRIMARYTOKEN_NAME_W,
1684     SE_LOCK_MEMORY_NAME_W,
1685     SE_INCREASE_QUOTA_NAME_W,
1686     SE_MACHINE_ACCOUNT_NAME_W,
1687     SE_TCB_NAME_W,
1688     SE_SECURITY_NAME_W,
1689     SE_TAKE_OWNERSHIP_NAME_W,
1690     SE_LOAD_DRIVER_NAME_W,
1691     SE_SYSTEM_PROFILE_NAME_W,
1692     SE_SYSTEMTIME_NAME_W,
1693     SE_PROF_SINGLE_PROCESS_NAME_W,
1694     SE_INC_BASE_PRIORITY_NAME_W,
1695     SE_CREATE_PAGEFILE_NAME_W,
1696     SE_CREATE_PERMANENT_NAME_W,
1697     SE_BACKUP_NAME_W,
1698     SE_RESTORE_NAME_W,
1699     SE_SHUTDOWN_NAME_W,
1700     SE_DEBUG_NAME_W,
1701     SE_AUDIT_NAME_W,
1702     SE_SYSTEM_ENVIRONMENT_NAME_W,
1703     SE_CHANGE_NOTIFY_NAME_W,
1704     SE_REMOTE_SHUTDOWN_NAME_W,
1705     SE_UNDOCK_NAME_W,
1706     SE_SYNC_AGENT_NAME_W,
1707     SE_ENABLE_DELEGATION_NAME_W,
1708     SE_MANAGE_VOLUME_NAME_W,
1709     SE_IMPERSONATE_NAME_W,
1710     SE_CREATE_GLOBAL_NAME_W,
1711 };
1712
1713 /******************************************************************************
1714  * LookupPrivilegeValueW                        [ADVAPI32.@]
1715  *
1716  * See LookupPrivilegeValueA.
1717  */
1718 BOOL WINAPI
1719 LookupPrivilegeValueW( LPCWSTR lpSystemName, LPCWSTR lpName, PLUID lpLuid )
1720 {
1721     UINT i;
1722
1723     TRACE("%s,%s,%p\n",debugstr_w(lpSystemName), debugstr_w(lpName), lpLuid);
1724
1725     if (!ADVAPI_IsLocalComputer(lpSystemName))
1726     {
1727         SetLastError(RPC_S_SERVER_UNAVAILABLE);
1728         return FALSE;
1729     }
1730     if (!lpName)
1731     {
1732         SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1733         return FALSE;
1734     }
1735     for( i=SE_MIN_WELL_KNOWN_PRIVILEGE; i<=SE_MAX_WELL_KNOWN_PRIVILEGE; i++ )
1736     {
1737         if( !WellKnownPrivNames[i] )
1738             continue;
1739         if( strcmpiW( WellKnownPrivNames[i], lpName) )
1740             continue;
1741         lpLuid->LowPart = i;
1742         lpLuid->HighPart = 0;
1743         TRACE( "%s -> %08x-%08x\n",debugstr_w( lpSystemName ),
1744                lpLuid->HighPart, lpLuid->LowPart );
1745         return TRUE;
1746     }
1747     SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1748     return FALSE;
1749 }
1750
1751 /******************************************************************************
1752  * LookupPrivilegeValueA                        [ADVAPI32.@]
1753  *
1754  * Retrieves LUID used on a system to represent the privilege name.
1755  *
1756  * PARAMS
1757  *  lpSystemName [I] Name of the system
1758  *  lpName       [I] Name of the privilege
1759  *  lpLuid       [O] Destination for the resulting LUID
1760  *
1761  * RETURNS
1762  *  Success: TRUE. lpLuid contains the requested LUID.
1763  *  Failure: FALSE.
1764  */
1765 BOOL WINAPI
1766 LookupPrivilegeValueA( LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid )
1767 {
1768     UNICODE_STRING lpSystemNameW;
1769     UNICODE_STRING lpNameW;
1770     BOOL ret;
1771
1772     RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
1773     RtlCreateUnicodeStringFromAsciiz(&lpNameW,lpName);
1774     ret = LookupPrivilegeValueW(lpSystemNameW.Buffer, lpNameW.Buffer, lpLuid);
1775     RtlFreeUnicodeString(&lpNameW);
1776     RtlFreeUnicodeString(&lpSystemNameW);
1777     return ret;
1778 }
1779
1780 BOOL WINAPI LookupPrivilegeDisplayNameA( LPCSTR lpSystemName, LPCSTR lpName, LPSTR lpDisplayName,
1781                                          LPDWORD cchDisplayName, LPDWORD lpLanguageId )
1782 {
1783     FIXME("%s %s %s %p %p - stub\n", debugstr_a(lpSystemName), debugstr_a(lpName),
1784           debugstr_a(lpDisplayName), cchDisplayName, lpLanguageId);
1785
1786     return FALSE;
1787 }
1788
1789 BOOL WINAPI LookupPrivilegeDisplayNameW( LPCWSTR lpSystemName, LPCWSTR lpName, LPWSTR lpDisplayName,
1790                                          LPDWORD cchDisplayName, LPDWORD lpLanguageId )
1791 {
1792     FIXME("%s %s %s %p %p - stub\n", debugstr_w(lpSystemName), debugstr_w(lpName),
1793           debugstr_w(lpDisplayName), cchDisplayName, lpLanguageId);
1794
1795     return FALSE;
1796 }
1797
1798 /******************************************************************************
1799  * LookupPrivilegeNameA                 [ADVAPI32.@]
1800  *
1801  * See LookupPrivilegeNameW.
1802  */
1803 BOOL WINAPI
1804 LookupPrivilegeNameA( LPCSTR lpSystemName, PLUID lpLuid, LPSTR lpName,
1805  LPDWORD cchName)
1806 {
1807     UNICODE_STRING lpSystemNameW;
1808     BOOL ret;
1809     DWORD wLen = 0;
1810
1811     TRACE("%s %p %p %p\n", debugstr_a(lpSystemName), lpLuid, lpName, cchName);
1812
1813     RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
1814     ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, NULL, &wLen);
1815     if (!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
1816     {
1817         LPWSTR lpNameW = HeapAlloc(GetProcessHeap(), 0, wLen * sizeof(WCHAR));
1818
1819         ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, lpNameW,
1820          &wLen);
1821         if (ret)
1822         {
1823             /* Windows crashes if cchName is NULL, so will I */
1824             unsigned int len = WideCharToMultiByte(CP_ACP, 0, lpNameW, -1, lpName,
1825              *cchName, NULL, NULL);
1826
1827             if (len == 0)
1828             {
1829                 /* WideCharToMultiByte failed */
1830                 ret = FALSE;
1831             }
1832             else if (len > *cchName)
1833             {
1834                 *cchName = len;
1835                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
1836                 ret = FALSE;
1837             }
1838             else
1839             {
1840                 /* WideCharToMultiByte succeeded, output length needs to be
1841                  * length not including NULL terminator
1842                  */
1843                 *cchName = len - 1;
1844             }
1845         }
1846         HeapFree(GetProcessHeap(), 0, lpNameW);
1847     }
1848     RtlFreeUnicodeString(&lpSystemNameW);
1849     return ret;
1850 }
1851
1852 /******************************************************************************
1853  * LookupPrivilegeNameW                 [ADVAPI32.@]
1854  *
1855  * Retrieves the privilege name referred to by the LUID lpLuid.
1856  *
1857  * PARAMS
1858  *  lpSystemName [I]   Name of the system
1859  *  lpLuid       [I]   Privilege value
1860  *  lpName       [O]   Name of the privilege
1861  *  cchName      [I/O] Number of characters in lpName.
1862  *
1863  * RETURNS
1864  *  Success: TRUE. lpName contains the name of the privilege whose value is
1865  *  *lpLuid.
1866  *  Failure: FALSE.
1867  *
1868  * REMARKS
1869  *  Only well-known privilege names (those defined in winnt.h) can be retrieved
1870  *  using this function.
1871  *  If the length of lpName is too small, on return *cchName will contain the
1872  *  number of WCHARs needed to contain the privilege, including the NULL
1873  *  terminator, and GetLastError will return ERROR_INSUFFICIENT_BUFFER.
1874  *  On success, *cchName will contain the number of characters stored in
1875  *  lpName, NOT including the NULL terminator.
1876  */
1877 BOOL WINAPI
1878 LookupPrivilegeNameW( LPCWSTR lpSystemName, PLUID lpLuid, LPWSTR lpName,
1879  LPDWORD cchName)
1880 {
1881     size_t privNameLen;
1882
1883     TRACE("%s,%p,%p,%p\n",debugstr_w(lpSystemName), lpLuid, lpName, cchName);
1884
1885     if (!ADVAPI_IsLocalComputer(lpSystemName))
1886     {
1887         SetLastError(RPC_S_SERVER_UNAVAILABLE);
1888         return FALSE;
1889     }
1890     if (lpLuid->HighPart || (lpLuid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
1891      lpLuid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE))
1892     {
1893         SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1894         return FALSE;
1895     }
1896     privNameLen = strlenW(WellKnownPrivNames[lpLuid->LowPart]);
1897     /* Windows crashes if cchName is NULL, so will I */
1898     if (*cchName <= privNameLen)
1899     {
1900         *cchName = privNameLen + 1;
1901         SetLastError(ERROR_INSUFFICIENT_BUFFER);
1902         return FALSE;
1903     }
1904     else
1905     {
1906         strcpyW(lpName, WellKnownPrivNames[lpLuid->LowPart]);
1907         *cchName = privNameLen;
1908         return TRUE;
1909     }
1910 }
1911
1912 /******************************************************************************
1913  * GetFileSecurityA [ADVAPI32.@]
1914  *
1915  * Obtains Specified information about the security of a file or directory.
1916  *
1917  * PARAMS
1918  *  lpFileName           [I] Name of the file to get info for
1919  *  RequestedInformation [I] SE_ flags from "winnt.h"
1920  *  pSecurityDescriptor  [O] Destination for security information
1921  *  nLength              [I] Length of pSecurityDescriptor
1922  *  lpnLengthNeeded      [O] Destination for length of returned security information
1923  *
1924  * RETURNS
1925  *  Success: TRUE. pSecurityDescriptor contains the requested information.
1926  *  Failure: FALSE. lpnLengthNeeded contains the required space to return the info.
1927  *
1928  * NOTES
1929  *  The information returned is constrained by the callers access rights and
1930  *  privileges.
1931  */
1932 BOOL WINAPI
1933 GetFileSecurityA( LPCSTR lpFileName,
1934                     SECURITY_INFORMATION RequestedInformation,
1935                     PSECURITY_DESCRIPTOR pSecurityDescriptor,
1936                     DWORD nLength, LPDWORD lpnLengthNeeded )
1937 {
1938     BOOL r;
1939     LPWSTR name;
1940
1941     name = SERV_dup(lpFileName);
1942     r = GetFileSecurityW( name, RequestedInformation, pSecurityDescriptor,
1943                           nLength, lpnLengthNeeded );
1944     HeapFree( GetProcessHeap(), 0, name );
1945
1946     return r;
1947 }
1948
1949 /******************************************************************************
1950  * GetFileSecurityW [ADVAPI32.@]
1951  *
1952  * See GetFileSecurityA.
1953  */
1954 BOOL WINAPI
1955 GetFileSecurityW( LPCWSTR lpFileName,
1956                     SECURITY_INFORMATION RequestedInformation,
1957                     PSECURITY_DESCRIPTOR pSecurityDescriptor,
1958                     DWORD nLength, LPDWORD lpnLengthNeeded )
1959 {
1960     HANDLE hfile;
1961     NTSTATUS status;
1962     DWORD access = 0;
1963
1964     TRACE("(%s,%d,%p,%d,%p)\n", debugstr_w(lpFileName),
1965           RequestedInformation, pSecurityDescriptor,
1966           nLength, lpnLengthNeeded);
1967
1968     if (RequestedInformation & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|
1969                                 DACL_SECURITY_INFORMATION))
1970         access |= READ_CONTROL;
1971     if (RequestedInformation & SACL_SECURITY_INFORMATION)
1972         access |= ACCESS_SYSTEM_SECURITY;
1973
1974     hfile = CreateFileW( lpFileName, access, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1975                          NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0 );
1976     if ( hfile == INVALID_HANDLE_VALUE )
1977         return FALSE;
1978
1979     status = NtQuerySecurityObject( hfile, RequestedInformation, pSecurityDescriptor,
1980                                     nLength, lpnLengthNeeded );
1981     CloseHandle( hfile );
1982     return set_ntstatus( status );
1983 }
1984
1985
1986 /******************************************************************************
1987  * LookupAccountSidA [ADVAPI32.@]
1988  */
1989 BOOL WINAPI
1990 LookupAccountSidA(
1991         IN LPCSTR system,
1992         IN PSID sid,
1993         OUT LPSTR account,
1994         IN OUT LPDWORD accountSize,
1995         OUT LPSTR domain,
1996         IN OUT LPDWORD domainSize,
1997         OUT PSID_NAME_USE name_use )
1998 {
1999     DWORD len;
2000     BOOL r;
2001     LPWSTR systemW;
2002     LPWSTR accountW = NULL;
2003     LPWSTR domainW = NULL;
2004     DWORD accountSizeW = *accountSize;
2005     DWORD domainSizeW = *domainSize;
2006
2007     systemW = SERV_dup(system);
2008     if (account)
2009         accountW = HeapAlloc( GetProcessHeap(), 0, accountSizeW * sizeof(WCHAR) );
2010     if (domain)
2011         domainW = HeapAlloc( GetProcessHeap(), 0, domainSizeW * sizeof(WCHAR) );
2012
2013     r = LookupAccountSidW( systemW, sid, accountW, &accountSizeW, domainW, &domainSizeW, name_use );
2014
2015     if (r) {
2016         if (accountW && *accountSize) {
2017             len = WideCharToMultiByte( CP_ACP, 0, accountW, -1, NULL, 0, NULL, NULL );
2018             WideCharToMultiByte( CP_ACP, 0, accountW, -1, account, len, NULL, NULL );
2019             *accountSize = len;
2020         } else
2021             *accountSize = accountSizeW + 1;
2022
2023         if (domainW && *domainSize) {
2024             len = WideCharToMultiByte( CP_ACP, 0, domainW, -1, NULL, 0, NULL, NULL );
2025             WideCharToMultiByte( CP_ACP, 0, domainW, -1, domain, len, NULL, NULL );
2026             *domainSize = len;
2027         } else
2028             *domainSize = domainSizeW + 1;
2029     }
2030     else
2031     {
2032         *accountSize = accountSizeW + 1;
2033         *domainSize = domainSizeW + 1;
2034     }
2035
2036     HeapFree( GetProcessHeap(), 0, systemW );
2037     HeapFree( GetProcessHeap(), 0, accountW );
2038     HeapFree( GetProcessHeap(), 0, domainW );
2039
2040     return r;
2041 }
2042
2043 /******************************************************************************
2044  * LookupAccountSidW [ADVAPI32.@]
2045  *
2046  * PARAMS
2047  *   system      []
2048  *   sid         []
2049  *   account     []
2050  *   accountSize []
2051  *   domain      []
2052  *   domainSize  []
2053  *   name_use    []
2054  */
2055
2056 BOOL WINAPI
2057 LookupAccountSidW(
2058         IN LPCWSTR system,
2059         IN PSID sid,
2060         OUT LPWSTR account,
2061         IN OUT LPDWORD accountSize,
2062         OUT LPWSTR domain,
2063         IN OUT LPDWORD domainSize,
2064         OUT PSID_NAME_USE name_use )
2065 {
2066     unsigned int i, j;
2067     const WCHAR * ac = NULL;
2068     const WCHAR * dm = NULL;
2069     SID_NAME_USE use = 0;
2070     LPWSTR computer_name = NULL;
2071     LPWSTR account_name = NULL;
2072
2073     TRACE("(%s,sid=%s,%p,%p(%u),%p,%p(%u),%p)\n",
2074           debugstr_w(system),debugstr_sid(sid),
2075           account,accountSize,accountSize?*accountSize:0,
2076           domain,domainSize,domainSize?*domainSize:0,
2077           name_use);
2078
2079     if (!ADVAPI_IsLocalComputer(system)) {
2080         FIXME("Only local computer supported!\n");
2081         SetLastError(RPC_S_SERVER_UNAVAILABLE);
2082         return FALSE;
2083     }
2084
2085     /* check the well known SIDs first */
2086     for (i = 0; i <= 60; i++) {
2087         if (IsWellKnownSid(sid, i)) {
2088             for (j = 0; j < (sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0])); j++) {
2089                 if (ACCOUNT_SIDS[j].type == i) {
2090                     ac = ACCOUNT_SIDS[j].account;
2091                     dm = ACCOUNT_SIDS[j].domain;
2092                     use = ACCOUNT_SIDS[j].name_use;
2093                 }
2094             }
2095             break;
2096         }
2097     }
2098
2099     if (dm == NULL) {
2100         MAX_SID local;
2101
2102         /* check for the local computer next */
2103         if (ADVAPI_GetComputerSid(&local)) {
2104             DWORD size = MAX_COMPUTERNAME_LENGTH + 1;
2105             BOOL result;
2106
2107             computer_name = HeapAlloc(GetProcessHeap(), 0, size * sizeof(WCHAR));
2108             result = GetComputerNameW(computer_name,  &size);
2109
2110             if (result) {
2111                 if (EqualSid(sid, &local)) {
2112                     dm = computer_name;
2113                     ac = Blank;
2114                     use = 3;
2115                 } else {
2116                     local.SubAuthorityCount++;
2117
2118                     if (EqualPrefixSid(sid, &local)) {
2119                         dm = computer_name;
2120                         use = 1;
2121                         switch (((MAX_SID *)sid)->SubAuthority[4]) {
2122                         case DOMAIN_USER_RID_ADMIN:
2123                             ac = Administrator;
2124                             break;
2125                         case DOMAIN_USER_RID_GUEST:
2126                             ac = Guest;
2127                             break;
2128                         case DOMAIN_GROUP_RID_ADMINS:
2129                             ac = Domain_Admins;
2130                             break;
2131                         case DOMAIN_GROUP_RID_USERS:
2132                             ac = Domain_Users;
2133                             break;
2134                         case DOMAIN_GROUP_RID_GUESTS:
2135                             ac = Domain_Guests;
2136                             break;
2137                         case DOMAIN_GROUP_RID_COMPUTERS:
2138                             ac = Domain_Computers;
2139                             break;
2140                         case DOMAIN_GROUP_RID_CONTROLLERS:
2141                             ac = Domain_Controllers;
2142                             break;
2143                         case DOMAIN_GROUP_RID_CERT_ADMINS:
2144                             ac = Cert_Publishers;
2145                             break;
2146                         case DOMAIN_GROUP_RID_SCHEMA_ADMINS:
2147                             ac = Schema_Admins;
2148                             break;
2149                         case DOMAIN_GROUP_RID_ENTERPRISE_ADMINS:
2150                             ac = Enterprise_Admins;
2151                             break;
2152                         case DOMAIN_GROUP_RID_POLICY_ADMINS:
2153                             ac = Group_Policy_Creator_Owners;
2154                             break;
2155                         case DOMAIN_ALIAS_RID_RAS_SERVERS:
2156                             ac = RAS_and_IAS_Servers;
2157                             break;
2158                         case 1000:      /* first user account */
2159                             size = UNLEN + 1;
2160                             account_name = HeapAlloc(
2161                                 GetProcessHeap(), 0, size * sizeof(WCHAR));
2162                             if (GetUserNameW(account_name, &size))
2163                                 ac = account_name;
2164                             else
2165                                 dm = NULL;
2166
2167                             break;
2168                         default:
2169                             dm = NULL;
2170                             break;
2171                         }
2172                     }
2173                 }
2174             }
2175         }
2176     }
2177
2178     if (dm) {
2179         DWORD ac_len = lstrlenW(ac);
2180         DWORD dm_len = lstrlenW(dm);
2181         BOOL status = TRUE;
2182
2183         if (*accountSize > ac_len) {
2184             if (account)
2185                 lstrcpyW(account, ac);
2186         }
2187         if (*domainSize > dm_len) {
2188             if (domain)
2189                 lstrcpyW(domain, dm);
2190         }
2191         if ((*accountSize && *accountSize < ac_len) ||
2192             (!account && !*accountSize && ac_len)   ||
2193             (*domainSize && *domainSize < dm_len)   ||
2194             (!domain && !*domainSize && dm_len))
2195         {
2196             SetLastError(ERROR_INSUFFICIENT_BUFFER);
2197             status = FALSE;
2198         }
2199         if (*domainSize)
2200             *domainSize = dm_len;
2201         else
2202             *domainSize = dm_len + 1;
2203         if (*accountSize)
2204             *accountSize = ac_len;
2205         else
2206             *accountSize = ac_len + 1;
2207
2208         HeapFree(GetProcessHeap(), 0, account_name);
2209         HeapFree(GetProcessHeap(), 0, computer_name);
2210         if (status) *name_use = use;
2211         return status;
2212     }
2213
2214     HeapFree(GetProcessHeap(), 0, account_name);
2215     HeapFree(GetProcessHeap(), 0, computer_name);
2216     SetLastError(ERROR_NONE_MAPPED);
2217     return FALSE;
2218 }
2219
2220 /******************************************************************************
2221  * SetFileSecurityA [ADVAPI32.@]
2222  *
2223  * See SetFileSecurityW.
2224  */
2225 BOOL WINAPI SetFileSecurityA( LPCSTR lpFileName,
2226                                 SECURITY_INFORMATION RequestedInformation,
2227                                 PSECURITY_DESCRIPTOR pSecurityDescriptor)
2228 {
2229     BOOL r;
2230     LPWSTR name;
2231
2232     name = SERV_dup(lpFileName);
2233     r = SetFileSecurityW( name, RequestedInformation, pSecurityDescriptor );
2234     HeapFree( GetProcessHeap(), 0, name );
2235
2236     return r;
2237 }
2238
2239 /******************************************************************************
2240  * SetFileSecurityW [ADVAPI32.@]
2241  *
2242  * Sets the security of a file or directory.
2243  *
2244  * PARAMS
2245  *   lpFileName           []
2246  *   RequestedInformation []
2247  *   pSecurityDescriptor  []
2248  *
2249  * RETURNS
2250  *  Success: TRUE.
2251  *  Failure: FALSE.
2252  */
2253 BOOL WINAPI
2254 SetFileSecurityW( LPCWSTR lpFileName,
2255                     SECURITY_INFORMATION RequestedInformation,
2256                     PSECURITY_DESCRIPTOR pSecurityDescriptor )
2257 {
2258     HANDLE file;
2259     DWORD access = 0;
2260     NTSTATUS status;
2261
2262     TRACE("(%s, 0x%x, %p)\n", debugstr_w(lpFileName), RequestedInformation,
2263           pSecurityDescriptor );
2264
2265     if (RequestedInformation & OWNER_SECURITY_INFORMATION ||
2266         RequestedInformation & GROUP_SECURITY_INFORMATION)
2267         access |= WRITE_OWNER;
2268     if (RequestedInformation & SACL_SECURITY_INFORMATION)
2269         access |= ACCESS_SYSTEM_SECURITY;
2270     if (RequestedInformation & DACL_SECURITY_INFORMATION)
2271         access |= WRITE_DAC;
2272
2273     file = CreateFileW( lpFileName, access, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
2274                         NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL );
2275     if (file == INVALID_HANDLE_VALUE)
2276         return FALSE;
2277
2278     status = NtSetSecurityObject( file, RequestedInformation, pSecurityDescriptor );
2279     CloseHandle( file );
2280     return set_ntstatus( status );
2281 }
2282
2283 /******************************************************************************
2284  * QueryWindows31FilesMigration [ADVAPI32.@]
2285  *
2286  * PARAMS
2287  *   x1 []
2288  */
2289 BOOL WINAPI
2290 QueryWindows31FilesMigration( DWORD x1 )
2291 {
2292         FIXME("(%d):stub\n",x1);
2293         return TRUE;
2294 }
2295
2296 /******************************************************************************
2297  * SynchronizeWindows31FilesAndWindowsNTRegistry [ADVAPI32.@]
2298  *
2299  * PARAMS
2300  *   x1 []
2301  *   x2 []
2302  *   x3 []
2303  *   x4 []
2304  */
2305 BOOL WINAPI
2306 SynchronizeWindows31FilesAndWindowsNTRegistry( DWORD x1, DWORD x2, DWORD x3,
2307                                                DWORD x4 )
2308 {
2309         FIXME("(0x%08x,0x%08x,0x%08x,0x%08x):stub\n",x1,x2,x3,x4);
2310         return TRUE;
2311 }
2312
2313 /******************************************************************************
2314  * NotifyBootConfigStatus [ADVAPI32.@]
2315  *
2316  * PARAMS
2317  *   x1 []
2318  */
2319 BOOL WINAPI
2320 NotifyBootConfigStatus( BOOL x1 )
2321 {
2322         FIXME("(0x%08d):stub\n",x1);
2323         return 1;
2324 }
2325
2326 /******************************************************************************
2327  * RevertToSelf [ADVAPI32.@]
2328  *
2329  * Ends the impersonation of a user.
2330  *
2331  * PARAMS
2332  *   void []
2333  *
2334  * RETURNS
2335  *  Success: TRUE.
2336  *  Failure: FALSE.
2337  */
2338 BOOL WINAPI
2339 RevertToSelf( void )
2340 {
2341     HANDLE Token = NULL;
2342     return set_ntstatus( NtSetInformationThread( GetCurrentThread(),
2343         ThreadImpersonationToken, &Token, sizeof(Token) ) );
2344 }
2345
2346 /******************************************************************************
2347  * ImpersonateSelf [ADVAPI32.@]
2348  *
2349  * Makes an impersonation token that represents the process user and assigns
2350  * to the current thread.
2351  *
2352  * PARAMS
2353  *  ImpersonationLevel [I] Level at which to impersonate.
2354  *
2355  * RETURNS
2356  *  Success: TRUE.
2357  *  Failure: FALSE.
2358  */
2359 BOOL WINAPI
2360 ImpersonateSelf(SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
2361 {
2362     return set_ntstatus( RtlImpersonateSelf( ImpersonationLevel ) );
2363 }
2364
2365 /******************************************************************************
2366  * ImpersonateLoggedOnUser [ADVAPI32.@]
2367  */
2368 BOOL WINAPI ImpersonateLoggedOnUser(HANDLE hToken)
2369 {
2370     DWORD size;
2371     NTSTATUS Status;
2372     HANDLE ImpersonationToken;
2373     TOKEN_TYPE Type;
2374     static BOOL warn = TRUE;
2375
2376     if (warn)
2377     {
2378         FIXME( "(%p)\n", hToken );
2379         warn = FALSE;
2380     }
2381     if (!GetTokenInformation( hToken, TokenType, &Type,
2382                               sizeof(TOKEN_TYPE), &size ))
2383         return FALSE;
2384
2385     if (Type == TokenPrimary)
2386     {
2387         OBJECT_ATTRIBUTES ObjectAttributes;
2388
2389         InitializeObjectAttributes( &ObjectAttributes, NULL, 0, NULL, NULL );
2390
2391         Status = NtDuplicateToken( hToken,
2392                                    TOKEN_IMPERSONATE | TOKEN_QUERY,
2393                                    &ObjectAttributes,
2394                                    SecurityImpersonation,
2395                                    TokenImpersonation,
2396                                    &ImpersonationToken );
2397         if (Status != STATUS_SUCCESS)
2398         {
2399             ERR( "NtDuplicateToken failed with error 0x%08x\n", Status );
2400             SetLastError( RtlNtStatusToDosError( Status ) );
2401             return FALSE;
2402         }
2403     }
2404     else
2405         ImpersonationToken = hToken;
2406
2407     Status = NtSetInformationThread( GetCurrentThread(),
2408                                      ThreadImpersonationToken,
2409                                      &ImpersonationToken,
2410                                      sizeof(ImpersonationToken) );
2411
2412     if (Type == TokenPrimary)
2413         NtClose( ImpersonationToken );
2414
2415     if (Status != STATUS_SUCCESS)
2416     {
2417         ERR( "NtSetInformationThread failed with error 0x%08x\n", Status );
2418         SetLastError( RtlNtStatusToDosError( Status ) );
2419         return FALSE;
2420     }
2421
2422     return TRUE;
2423 }
2424
2425 /******************************************************************************
2426  * AccessCheck [ADVAPI32.@]
2427  */
2428 BOOL WINAPI
2429 AccessCheck(
2430         PSECURITY_DESCRIPTOR SecurityDescriptor,
2431         HANDLE ClientToken,
2432         DWORD DesiredAccess,
2433         PGENERIC_MAPPING GenericMapping,
2434         PPRIVILEGE_SET PrivilegeSet,
2435         LPDWORD PrivilegeSetLength,
2436         LPDWORD GrantedAccess,
2437         LPBOOL AccessStatus)
2438 {
2439     NTSTATUS access_status;
2440     BOOL ret = set_ntstatus( NtAccessCheck(SecurityDescriptor, ClientToken, DesiredAccess,
2441                                            GenericMapping, PrivilegeSet, PrivilegeSetLength,
2442                                            GrantedAccess, &access_status) );
2443     if (ret) *AccessStatus = set_ntstatus( access_status );
2444     return ret;
2445 }
2446
2447
2448 /******************************************************************************
2449  * AccessCheckByType [ADVAPI32.@]
2450  */
2451 BOOL WINAPI AccessCheckByType(
2452     PSECURITY_DESCRIPTOR pSecurityDescriptor,
2453     PSID PrincipalSelfSid,
2454     HANDLE ClientToken,
2455     DWORD DesiredAccess,
2456     POBJECT_TYPE_LIST ObjectTypeList,
2457     DWORD ObjectTypeListLength,
2458     PGENERIC_MAPPING GenericMapping,
2459     PPRIVILEGE_SET PrivilegeSet,
2460     LPDWORD PrivilegeSetLength,
2461     LPDWORD GrantedAccess,
2462     LPBOOL AccessStatus)
2463 {
2464         FIXME("stub\n");
2465
2466         *AccessStatus = TRUE;
2467
2468         return !*AccessStatus;
2469 }
2470
2471 /******************************************************************************
2472  * MapGenericMask [ADVAPI32.@]
2473  *
2474  * Maps generic access rights into specific access rights according to the
2475  * supplied mapping.
2476  *
2477  * PARAMS
2478  *  AccessMask     [I/O] Access rights.
2479  *  GenericMapping [I] The mapping between generic and specific rights.
2480  *
2481  * RETURNS
2482  *  Nothing.
2483  */
2484 VOID WINAPI MapGenericMask( PDWORD AccessMask, PGENERIC_MAPPING GenericMapping )
2485 {
2486     RtlMapGenericMask( AccessMask, GenericMapping );
2487 }
2488
2489 /*************************************************************************
2490  * SetKernelObjectSecurity [ADVAPI32.@]
2491  */
2492 BOOL WINAPI SetKernelObjectSecurity (
2493         IN HANDLE Handle,
2494         IN SECURITY_INFORMATION SecurityInformation,
2495         IN PSECURITY_DESCRIPTOR SecurityDescriptor )
2496 {
2497     return set_ntstatus (NtSetSecurityObject (Handle, SecurityInformation, SecurityDescriptor));
2498 }
2499
2500
2501 /******************************************************************************
2502  *  AddAuditAccessAce [ADVAPI32.@]
2503  */
2504 BOOL WINAPI AddAuditAccessAce(
2505     IN OUT PACL pAcl,
2506     IN DWORD dwAceRevision,
2507     IN DWORD dwAccessMask,
2508     IN PSID pSid,
2509     IN BOOL bAuditSuccess,
2510     IN BOOL bAuditFailure)
2511 {
2512     return set_ntstatus( RtlAddAuditAccessAce(pAcl, dwAceRevision, dwAccessMask, pSid,
2513                                               bAuditSuccess, bAuditFailure) );
2514 }
2515
2516 /******************************************************************************
2517  *  AddAuditAccessAce [ADVAPI32.@]
2518  */
2519 BOOL WINAPI AddAuditAccessAceEx(
2520     IN OUT PACL pAcl,
2521     IN DWORD dwAceRevision,
2522     IN DWORD dwAceFlags,
2523     IN DWORD dwAccessMask,
2524     IN PSID pSid,
2525     IN BOOL bAuditSuccess,
2526     IN BOOL bAuditFailure)
2527 {
2528     return set_ntstatus( RtlAddAuditAccessAceEx(pAcl, dwAceRevision, dwAceFlags, dwAccessMask, pSid,
2529                                               bAuditSuccess, bAuditFailure) );
2530 }
2531
2532 /******************************************************************************
2533  * LookupAccountNameA [ADVAPI32.@]
2534  */
2535 BOOL WINAPI
2536 LookupAccountNameA(
2537         IN LPCSTR system,
2538         IN LPCSTR account,
2539         OUT PSID sid,
2540         OUT LPDWORD cbSid,
2541         LPSTR ReferencedDomainName,
2542         IN OUT LPDWORD cbReferencedDomainName,
2543         OUT PSID_NAME_USE name_use )
2544 {
2545     BOOL ret;
2546     UNICODE_STRING lpSystemW;
2547     UNICODE_STRING lpAccountW;
2548     LPWSTR lpReferencedDomainNameW = NULL;
2549
2550     RtlCreateUnicodeStringFromAsciiz(&lpSystemW, system);
2551     RtlCreateUnicodeStringFromAsciiz(&lpAccountW, account);
2552
2553     if (ReferencedDomainName)
2554         lpReferencedDomainNameW = HeapAlloc(GetProcessHeap(), 0, *cbReferencedDomainName * sizeof(WCHAR));
2555
2556     ret = LookupAccountNameW(lpSystemW.Buffer, lpAccountW.Buffer, sid, cbSid, lpReferencedDomainNameW,
2557         cbReferencedDomainName, name_use);
2558
2559     if (ret && lpReferencedDomainNameW)
2560     {
2561         WideCharToMultiByte(CP_ACP, 0, lpReferencedDomainNameW, -1,
2562             ReferencedDomainName, *cbReferencedDomainName+1, NULL, NULL);
2563     }
2564
2565     RtlFreeUnicodeString(&lpSystemW);
2566     RtlFreeUnicodeString(&lpAccountW);
2567     HeapFree(GetProcessHeap(), 0, lpReferencedDomainNameW);
2568
2569     return ret;
2570 }
2571
2572 /******************************************************************************
2573  * lookup_user_account_name
2574  */
2575 static BOOL lookup_user_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName,
2576                                      LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2577 {
2578     char buffer[sizeof(TOKEN_USER) + sizeof(SID) + sizeof(DWORD)*SID_MAX_SUB_AUTHORITIES];
2579     DWORD len = sizeof(buffer);
2580     HANDLE token;
2581     BOOL ret;
2582     PSID pSid;
2583     WCHAR domainName[MAX_COMPUTERNAME_LENGTH + 1];
2584     DWORD nameLen;
2585
2586     if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
2587     {
2588         if (GetLastError() != ERROR_NO_TOKEN) return FALSE;
2589         if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) return FALSE;
2590     }
2591
2592     ret = GetTokenInformation(token, TokenUser, buffer, len, &len);
2593     CloseHandle( token );
2594
2595     if (!ret) return FALSE;
2596
2597     pSid = ((TOKEN_USER *)buffer)->User.Sid;
2598
2599     if (Sid != NULL && (*cbSid >= GetLengthSid(pSid)))
2600        CopySid(*cbSid, Sid, pSid);
2601     if (*cbSid < GetLengthSid(pSid))
2602     {
2603        SetLastError(ERROR_INSUFFICIENT_BUFFER);
2604        ret = FALSE;
2605     }
2606     *cbSid = GetLengthSid(pSid);
2607
2608     nameLen = MAX_COMPUTERNAME_LENGTH + 1;
2609     if (!GetComputerNameW(domainName, &nameLen))
2610     {
2611         domainName[0] = 0;
2612         nameLen = 0;
2613     }
2614     if (*cchReferencedDomainName <= nameLen || !ret)
2615     {
2616         SetLastError(ERROR_INSUFFICIENT_BUFFER);
2617         nameLen += 1;
2618         ret = FALSE;
2619     }
2620     else if (ReferencedDomainName)
2621         strcpyW(ReferencedDomainName, domainName);
2622
2623     *cchReferencedDomainName = nameLen;
2624
2625     if (ret)
2626         *peUse = SidTypeUser;
2627
2628     return ret;
2629 }
2630
2631 /******************************************************************************
2632  * lookup_computer_account_name
2633  */
2634 static BOOL lookup_computer_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName,
2635                                          LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2636 {
2637     MAX_SID local;
2638     BOOL ret;
2639     WCHAR domainName[MAX_COMPUTERNAME_LENGTH + 1];
2640     DWORD nameLen;
2641
2642     if ((ret = ADVAPI_GetComputerSid(&local)))
2643     {
2644         if (Sid != NULL && (*cbSid >= GetLengthSid(&local)))
2645            CopySid(*cbSid, Sid, &local);
2646         if (*cbSid < GetLengthSid(&local))
2647         {
2648            SetLastError(ERROR_INSUFFICIENT_BUFFER);
2649            ret = FALSE;
2650         }
2651         *cbSid = GetLengthSid(&local);
2652     }
2653
2654     nameLen = MAX_COMPUTERNAME_LENGTH + 1;
2655     if (!GetComputerNameW(domainName, &nameLen))
2656     {
2657         domainName[0] = 0;
2658         nameLen = 0;
2659     }
2660     if (*cchReferencedDomainName <= nameLen || !ret)
2661     {
2662         SetLastError(ERROR_INSUFFICIENT_BUFFER);
2663         nameLen += 1;
2664         ret = FALSE;
2665     }
2666     else if (ReferencedDomainName)
2667         strcpyW(ReferencedDomainName, domainName);
2668
2669     *cchReferencedDomainName = nameLen;
2670
2671     if (ret)
2672         *peUse = SidTypeDomain;
2673
2674     return ret;
2675 }
2676
2677 static void split_domain_account( const LSA_UNICODE_STRING *str, LSA_UNICODE_STRING *account,
2678                                   LSA_UNICODE_STRING *domain )
2679 {
2680     WCHAR *p = str->Buffer + str->Length / sizeof(WCHAR) - 1;
2681
2682     while (p > str->Buffer && *p != '\\') p--;
2683
2684     if (*p == '\\')
2685     {
2686         domain->Buffer = str->Buffer;
2687         domain->Length = (p - str->Buffer) * sizeof(WCHAR);
2688
2689         account->Buffer = p + 1;
2690         account->Length = str->Length - ((p - str->Buffer + 1) * sizeof(WCHAR));
2691     }
2692     else
2693     {
2694         domain->Buffer = NULL;
2695         domain->Length = 0;
2696
2697         account->Buffer = str->Buffer;
2698         account->Length = str->Length;
2699     }
2700 }
2701
2702 static BOOL match_domain( ULONG idx, const LSA_UNICODE_STRING *domain )
2703 {
2704     ULONG len = strlenW( ACCOUNT_SIDS[idx].domain );
2705
2706     if (len == domain->Length / sizeof(WCHAR) && !strncmpiW( domain->Buffer, ACCOUNT_SIDS[idx].domain, len ))
2707         return TRUE;
2708
2709     return FALSE;
2710 }
2711
2712 static BOOL match_account( ULONG idx, const LSA_UNICODE_STRING *account )
2713 {
2714     ULONG len = strlenW( ACCOUNT_SIDS[idx].account );
2715
2716     if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].account, len ))
2717         return TRUE;
2718
2719     if (ACCOUNT_SIDS[idx].alias)
2720     {
2721         len = strlenW( ACCOUNT_SIDS[idx].alias );
2722         if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].alias, len ))
2723             return TRUE;
2724     }
2725     return FALSE;
2726 }
2727
2728 /*
2729  * Helper function for LookupAccountNameW
2730  */
2731 BOOL lookup_local_wellknown_name( const LSA_UNICODE_STRING *account_and_domain,
2732                                   PSID Sid, LPDWORD cbSid,
2733                                   LPWSTR ReferencedDomainName,
2734                                   LPDWORD cchReferencedDomainName,
2735                                   PSID_NAME_USE peUse, BOOL *handled )
2736 {
2737     PSID pSid;
2738     LSA_UNICODE_STRING account, domain;
2739     BOOL ret = TRUE;
2740     ULONG i;
2741
2742     *handled = FALSE;
2743     split_domain_account( account_and_domain, &account, &domain );
2744
2745     for (i = 0; i < sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0]); i++)
2746     {
2747         /* check domain first */
2748         if (domain.Buffer && !match_domain( i, &domain )) continue;
2749
2750         if (match_account( i, &account ))
2751         {
2752             DWORD len, sidLen = SECURITY_MAX_SID_SIZE;
2753
2754             if (!(pSid = HeapAlloc( GetProcessHeap(), 0, sidLen ))) return FALSE;
2755
2756             if ((ret = CreateWellKnownSid( ACCOUNT_SIDS[i].type, NULL, pSid, &sidLen )))
2757             {
2758                 if (*cbSid < sidLen)
2759                 {
2760                     SetLastError(ERROR_INSUFFICIENT_BUFFER);
2761                     ret = FALSE;
2762                 }
2763                 else if (Sid)
2764                 {
2765                     CopySid(*cbSid, Sid, pSid);
2766                 }
2767                 *cbSid = sidLen;
2768             }
2769
2770             len = strlenW( ACCOUNT_SIDS[i].domain );
2771             if (*cchReferencedDomainName <= len || !ret)
2772             {
2773                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2774                 len++;
2775                 ret = FALSE;
2776             }
2777             else if (ReferencedDomainName)
2778             {
2779                 strcpyW( ReferencedDomainName, ACCOUNT_SIDS[i].domain );
2780             }
2781
2782             *cchReferencedDomainName = len;
2783             if (ret)
2784                 *peUse = ACCOUNT_SIDS[i].name_use;
2785
2786             HeapFree(GetProcessHeap(), 0, pSid);
2787             *handled = TRUE;
2788             return ret;
2789         }
2790     }
2791     return ret;
2792 }
2793
2794 BOOL lookup_local_user_name( const LSA_UNICODE_STRING *account_and_domain,
2795                              PSID Sid, LPDWORD cbSid,
2796                              LPWSTR ReferencedDomainName,
2797                              LPDWORD cchReferencedDomainName,
2798                              PSID_NAME_USE peUse, BOOL *handled )
2799 {
2800     DWORD nameLen;
2801     LPWSTR userName = NULL;
2802     LSA_UNICODE_STRING account, domain;
2803     BOOL ret = TRUE;
2804
2805     *handled = FALSE;
2806     split_domain_account( account_and_domain, &account, &domain );
2807
2808     /* Let the current Unix user id masquerade as first Windows user account */
2809
2810     nameLen = UNLEN + 1;
2811     if (!(userName = HeapAlloc( GetProcessHeap(), 0, nameLen * sizeof(WCHAR) ))) return FALSE;
2812
2813     if (domain.Buffer)
2814     {
2815         /* check to make sure this account is on this computer */
2816         if (GetComputerNameW( userName, &nameLen ) &&
2817             (domain.Length / sizeof(WCHAR) != nameLen || strncmpW( domain.Buffer, userName, nameLen )))
2818         {
2819             SetLastError(ERROR_NONE_MAPPED);
2820             ret = FALSE;
2821         }
2822         nameLen = UNLEN + 1;
2823     }
2824
2825     if (GetUserNameW( userName, &nameLen ) &&
2826         account.Length / sizeof(WCHAR) == nameLen - 1 && !strncmpW( account.Buffer, userName, nameLen - 1 ))
2827     {
2828             ret = lookup_user_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse );
2829             *handled = TRUE;
2830     }
2831     else
2832     {
2833         nameLen = UNLEN + 1;
2834         if (GetComputerNameW( userName, &nameLen ) &&
2835             account.Length / sizeof(WCHAR) == nameLen && !strncmpW( account.Buffer, userName , nameLen ))
2836         {
2837             ret = lookup_computer_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse );
2838             *handled = TRUE;
2839         }
2840     }
2841
2842     HeapFree(GetProcessHeap(), 0, userName);
2843     return ret;
2844 }
2845
2846 /******************************************************************************
2847  * LookupAccountNameW [ADVAPI32.@]
2848  */
2849 BOOL WINAPI LookupAccountNameW( LPCWSTR lpSystemName, LPCWSTR lpAccountName, PSID Sid,
2850                                 LPDWORD cbSid, LPWSTR ReferencedDomainName,
2851                                 LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2852 {
2853     BOOL ret, handled;
2854     LSA_UNICODE_STRING account;
2855
2856     TRACE("%s %s %p %p %p %p %p\n", debugstr_w(lpSystemName), debugstr_w(lpAccountName),
2857           Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse);
2858
2859     if (!ADVAPI_IsLocalComputer( lpSystemName ))
2860     {
2861         FIXME("remote computer not supported\n");
2862         SetLastError( RPC_S_SERVER_UNAVAILABLE );
2863         return FALSE;
2864     }
2865
2866     if (!lpAccountName || !strcmpW( lpAccountName, Blank ))
2867     {
2868         lpAccountName = BUILTIN;
2869     }
2870
2871     RtlInitUnicodeString( &account, lpAccountName );
2872
2873     /* Check well known SIDs first */
2874     ret = lookup_local_wellknown_name( &account, Sid, cbSid, ReferencedDomainName,
2875                                        cchReferencedDomainName, peUse, &handled );
2876     if (handled)
2877         return ret;
2878
2879     /* Check user names */
2880     ret = lookup_local_user_name( &account, Sid, cbSid, ReferencedDomainName,
2881                                   cchReferencedDomainName, peUse, &handled);
2882     if (handled)
2883         return ret;
2884
2885     SetLastError( ERROR_NONE_MAPPED );
2886     return FALSE;
2887 }
2888
2889 /******************************************************************************
2890  * PrivilegeCheck [ADVAPI32.@]
2891  */
2892 BOOL WINAPI PrivilegeCheck( HANDLE ClientToken, PPRIVILEGE_SET RequiredPrivileges, LPBOOL pfResult)
2893 {
2894     BOOL ret;
2895     BOOLEAN Result;
2896
2897     TRACE("%p %p %p\n", ClientToken, RequiredPrivileges, pfResult);
2898
2899     ret = set_ntstatus (NtPrivilegeCheck (ClientToken, RequiredPrivileges, &Result));
2900     if (ret)
2901         *pfResult = Result;
2902     return ret;
2903 }
2904
2905 /******************************************************************************
2906  * AccessCheckAndAuditAlarmA [ADVAPI32.@]
2907  */
2908 BOOL WINAPI AccessCheckAndAuditAlarmA(LPCSTR Subsystem, LPVOID HandleId, LPSTR ObjectTypeName,
2909   LPSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess,
2910   PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess,
2911   LPBOOL AccessStatus, LPBOOL pfGenerateOnClose)
2912 {
2913         FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_a(Subsystem),
2914                 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName),
2915                 SecurityDescriptor, DesiredAccess, GenericMapping,
2916                 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose);
2917         return TRUE;
2918 }
2919
2920 /******************************************************************************
2921  * AccessCheckAndAuditAlarmW [ADVAPI32.@]
2922  */
2923 BOOL WINAPI AccessCheckAndAuditAlarmW(LPCWSTR Subsystem, LPVOID HandleId, LPWSTR ObjectTypeName,
2924   LPWSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess,
2925   PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess,
2926   LPBOOL AccessStatus, LPBOOL pfGenerateOnClose)
2927 {
2928         FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_w(Subsystem),
2929                 HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName),
2930                 SecurityDescriptor, DesiredAccess, GenericMapping,
2931                 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose);
2932         return TRUE;
2933 }
2934
2935 BOOL WINAPI ObjectCloseAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
2936 {
2937     FIXME("stub (%s,%p,%x)\n", debugstr_a(SubsystemName), HandleId, GenerateOnClose);
2938
2939     return TRUE;
2940 }
2941
2942 BOOL WINAPI ObjectCloseAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
2943 {
2944     FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose);
2945
2946     return TRUE;
2947 }
2948
2949 BOOL WINAPI ObjectDeleteAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
2950 {
2951     FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose);
2952
2953     return TRUE;
2954 }
2955
2956 BOOL WINAPI ObjectOpenAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, LPSTR ObjectTypeName,
2957   LPSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess,
2958   DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted,
2959   LPBOOL GenerateOnClose)
2960 {
2961         FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_a(SubsystemName),
2962                 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName), pSecurityDescriptor,
2963         ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted,
2964         GenerateOnClose);
2965
2966     return TRUE;
2967 }
2968
2969 BOOL WINAPI ObjectOpenAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, LPWSTR ObjectTypeName,
2970   LPWSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess,
2971   DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted,
2972   LPBOOL GenerateOnClose)
2973 {
2974     FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_w(SubsystemName),
2975         HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName), pSecurityDescriptor,
2976         ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted,
2977         GenerateOnClose);
2978
2979     return TRUE;
2980 }
2981
2982 BOOL WINAPI ObjectPrivilegeAuditAlarmA( LPCSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken,
2983   DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted)
2984 {
2985     FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_a(SubsystemName), HandleId, ClientToken,
2986           DesiredAccess, Privileges, AccessGranted);
2987
2988     return TRUE;
2989 }
2990
2991 BOOL WINAPI ObjectPrivilegeAuditAlarmW( LPCWSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken,
2992   DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted)
2993 {
2994     FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_w(SubsystemName), HandleId, ClientToken,
2995           DesiredAccess, Privileges, AccessGranted);
2996
2997     return TRUE;
2998 }
2999
3000 BOOL WINAPI PrivilegedServiceAuditAlarmA( LPCSTR SubsystemName, LPCSTR ServiceName, HANDLE ClientToken,
3001                                    PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3002 {
3003     FIXME("stub (%s,%s,%p,%p,%x)\n", debugstr_a(SubsystemName), debugstr_a(ServiceName),
3004           ClientToken, Privileges, AccessGranted);
3005
3006     return TRUE;
3007 }
3008
3009 BOOL WINAPI PrivilegedServiceAuditAlarmW( LPCWSTR SubsystemName, LPCWSTR ServiceName, HANDLE ClientToken,
3010                                    PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3011 {
3012     FIXME("stub %s,%s,%p,%p,%x)\n", debugstr_w(SubsystemName), debugstr_w(ServiceName),
3013           ClientToken, Privileges, AccessGranted);
3014
3015     return TRUE;
3016 }
3017
3018 /******************************************************************************
3019  * GetSecurityInfo [ADVAPI32.@]
3020  *
3021  * Retrieves a copy of the security descriptor associated with an object.
3022  *
3023  * PARAMS
3024  *  hObject              [I] A handle for the object.
3025  *  ObjectType           [I] The type of object.
3026  *  SecurityInfo         [I] A bitmask indicating what info to retrieve.
3027  *  ppsidOwner           [O] If non-null, receives a pointer to the owner SID.
3028  *  ppsidGroup           [O] If non-null, receives a pointer to the group SID.
3029  *  ppDacl               [O] If non-null, receives a pointer to the DACL.
3030  *  ppSacl               [O] If non-null, receives a pointer to the SACL.
3031  *  ppSecurityDescriptor [O] Receives a pointer to the security descriptor,
3032  *                           which must be freed with LocalFree.
3033  *
3034  * RETURNS
3035  *  ERROR_SUCCESS if all's well, and a WIN32 error code otherwise.
3036  */
3037 DWORD WINAPI GetSecurityInfo(
3038     HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3039     SECURITY_INFORMATION SecurityInfo, PSID *ppsidOwner,
3040     PSID *ppsidGroup, PACL *ppDacl, PACL *ppSacl,
3041     PSECURITY_DESCRIPTOR *ppSecurityDescriptor
3042 )
3043 {
3044     PSECURITY_DESCRIPTOR sd;
3045     NTSTATUS status;
3046     ULONG n1, n2;
3047     BOOL present, defaulted;
3048
3049     status = NtQuerySecurityObject(hObject, SecurityInfo, NULL, 0, &n1);
3050     if (status != STATUS_BUFFER_TOO_SMALL && status != STATUS_SUCCESS)
3051         return RtlNtStatusToDosError(status);
3052
3053     sd = LocalAlloc(0, n1);
3054     if (!sd)
3055         return ERROR_NOT_ENOUGH_MEMORY;
3056
3057     status = NtQuerySecurityObject(hObject, SecurityInfo, sd, n1, &n2);
3058     if (status != STATUS_SUCCESS)
3059     {
3060         LocalFree(sd);
3061         return RtlNtStatusToDosError(status);
3062     }
3063
3064     if (ppsidOwner)
3065     {
3066         *ppsidOwner = NULL;
3067         GetSecurityDescriptorOwner(sd, ppsidOwner, &defaulted);
3068     }
3069     if (ppsidGroup)
3070     {
3071         *ppsidGroup = NULL;
3072         GetSecurityDescriptorGroup(sd, ppsidGroup, &defaulted);
3073     }
3074     if (ppDacl)
3075     {
3076         *ppDacl = NULL;
3077         GetSecurityDescriptorDacl(sd, &present, ppDacl, &defaulted);
3078     }
3079     if (ppSacl)
3080     {
3081         *ppSacl = NULL;
3082         GetSecurityDescriptorSacl(sd, &present, ppSacl, &defaulted);
3083     }
3084     if (ppSecurityDescriptor)
3085         *ppSecurityDescriptor = sd;
3086
3087     /* The security descriptor (sd) cannot be freed if ppSecurityDescriptor is
3088      * NULL, because native happily returns the SIDs and ACLs that are requested
3089      * in this case.
3090      */
3091
3092     return ERROR_SUCCESS;
3093 }
3094
3095 /******************************************************************************
3096  * GetSecurityInfoExA [ADVAPI32.@]
3097  */
3098 DWORD WINAPI GetSecurityInfoExA(
3099         HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3100         SECURITY_INFORMATION SecurityInfo, LPCSTR lpProvider,
3101         LPCSTR lpProperty, PACTRL_ACCESSA *ppAccessList,
3102         PACTRL_AUDITA *ppAuditList, LPSTR *lppOwner, LPSTR *lppGroup
3103 )
3104 {
3105   FIXME("stub!\n");
3106   return ERROR_BAD_PROVIDER;
3107 }
3108
3109 /******************************************************************************
3110  * GetSecurityInfoExW [ADVAPI32.@]
3111  */
3112 DWORD WINAPI GetSecurityInfoExW(
3113         HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3114         SECURITY_INFORMATION SecurityInfo, LPCWSTR lpProvider,
3115         LPCWSTR lpProperty, PACTRL_ACCESSW *ppAccessList,
3116         PACTRL_AUDITW *ppAuditList, LPWSTR *lppOwner, LPWSTR *lppGroup
3117 )
3118 {
3119   FIXME("stub!\n");
3120   return ERROR_BAD_PROVIDER;
3121 }
3122
3123 /******************************************************************************
3124  * BuildExplicitAccessWithNameA [ADVAPI32.@]
3125  */
3126 VOID WINAPI BuildExplicitAccessWithNameA( PEXPLICIT_ACCESSA pExplicitAccess,
3127                                           LPSTR pTrusteeName, DWORD AccessPermissions,
3128                                           ACCESS_MODE AccessMode, DWORD Inheritance )
3129 {
3130     TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_a(pTrusteeName),
3131           AccessPermissions, AccessMode, Inheritance);
3132
3133     pExplicitAccess->grfAccessPermissions = AccessPermissions;
3134     pExplicitAccess->grfAccessMode = AccessMode;
3135     pExplicitAccess->grfInheritance = Inheritance;
3136
3137     pExplicitAccess->Trustee.pMultipleTrustee = NULL;
3138     pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3139     pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3140     pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3141     pExplicitAccess->Trustee.ptstrName = pTrusteeName;
3142 }
3143
3144 /******************************************************************************
3145  * BuildExplicitAccessWithNameW [ADVAPI32.@]
3146  */
3147 VOID WINAPI BuildExplicitAccessWithNameW( PEXPLICIT_ACCESSW pExplicitAccess,
3148                                           LPWSTR pTrusteeName, DWORD AccessPermissions,
3149                                           ACCESS_MODE AccessMode, DWORD Inheritance )
3150 {
3151     TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_w(pTrusteeName),
3152           AccessPermissions, AccessMode, Inheritance);
3153
3154     pExplicitAccess->grfAccessPermissions = AccessPermissions;
3155     pExplicitAccess->grfAccessMode = AccessMode;
3156     pExplicitAccess->grfInheritance = Inheritance;
3157
3158     pExplicitAccess->Trustee.pMultipleTrustee = NULL;
3159     pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3160     pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3161     pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3162     pExplicitAccess->Trustee.ptstrName = pTrusteeName;
3163 }
3164
3165 /******************************************************************************
3166  * BuildTrusteeWithObjectsAndNameA [ADVAPI32.@]
3167  */
3168 VOID WINAPI BuildTrusteeWithObjectsAndNameA( PTRUSTEEA pTrustee, POBJECTS_AND_NAME_A pObjName,
3169                                              SE_OBJECT_TYPE ObjectType, LPSTR ObjectTypeName,
3170                                              LPSTR InheritedObjectTypeName, LPSTR Name )
3171 {
3172     DWORD ObjectsPresent = 0;
3173
3174     TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
3175           ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_a(Name));
3176
3177     /* Fill the OBJECTS_AND_NAME structure */
3178     pObjName->ObjectType = ObjectType;
3179     if (ObjectTypeName != NULL)
3180     {
3181         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3182     }
3183
3184     pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
3185     if (InheritedObjectTypeName != NULL)
3186     {
3187         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3188     }
3189
3190     pObjName->ObjectsPresent = ObjectsPresent;
3191     pObjName->ptstrName = Name;
3192
3193     /* Fill the TRUSTEE structure */
3194     pTrustee->pMultipleTrustee = NULL;
3195     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3196     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
3197     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3198     pTrustee->ptstrName = (LPSTR)pObjName;
3199 }
3200
3201 /******************************************************************************
3202  * BuildTrusteeWithObjectsAndNameW [ADVAPI32.@]
3203  */
3204 VOID WINAPI BuildTrusteeWithObjectsAndNameW( PTRUSTEEW pTrustee, POBJECTS_AND_NAME_W pObjName,
3205                                              SE_OBJECT_TYPE ObjectType, LPWSTR ObjectTypeName,
3206                                              LPWSTR InheritedObjectTypeName, LPWSTR Name )
3207 {
3208     DWORD ObjectsPresent = 0;
3209
3210     TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
3211           ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_w(Name));
3212
3213     /* Fill the OBJECTS_AND_NAME structure */
3214     pObjName->ObjectType = ObjectType;
3215     if (ObjectTypeName != NULL)
3216     {
3217         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3218     }
3219
3220     pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
3221     if (InheritedObjectTypeName != NULL)
3222     {
3223         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3224     }
3225
3226     pObjName->ObjectsPresent = ObjectsPresent;
3227     pObjName->ptstrName = Name;
3228
3229     /* Fill the TRUSTEE structure */
3230     pTrustee->pMultipleTrustee = NULL;
3231     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3232     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
3233     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3234     pTrustee->ptstrName = (LPWSTR)pObjName;
3235 }
3236
3237 /******************************************************************************
3238  * BuildTrusteeWithObjectsAndSidA [ADVAPI32.@]
3239  */
3240 VOID WINAPI BuildTrusteeWithObjectsAndSidA( PTRUSTEEA pTrustee, POBJECTS_AND_SID pObjSid,
3241                                             GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid )
3242 {
3243     DWORD ObjectsPresent = 0;
3244
3245     TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
3246
3247     /* Fill the OBJECTS_AND_SID structure */
3248     if (pObjectGuid != NULL)
3249     {
3250         pObjSid->ObjectTypeGuid = *pObjectGuid;
3251         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3252     }
3253     else
3254     {
3255         ZeroMemory(&pObjSid->ObjectTypeGuid,
3256                    sizeof(GUID));
3257     }
3258
3259     if (pInheritedObjectGuid != NULL)
3260     {
3261         pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
3262         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3263     }
3264     else
3265     {
3266         ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
3267                    sizeof(GUID));
3268     }
3269
3270     pObjSid->ObjectsPresent = ObjectsPresent;
3271     pObjSid->pSid = pSid;
3272
3273     /* Fill the TRUSTEE structure */
3274     pTrustee->pMultipleTrustee = NULL;
3275     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3276     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
3277     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3278     pTrustee->ptstrName = (LPSTR) pObjSid;
3279 }
3280
3281 /******************************************************************************
3282  * BuildTrusteeWithObjectsAndSidW [ADVAPI32.@]
3283  */
3284 VOID WINAPI BuildTrusteeWithObjectsAndSidW( PTRUSTEEW pTrustee, POBJECTS_AND_SID pObjSid,
3285                                             GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid )
3286 {
3287     DWORD ObjectsPresent = 0;
3288
3289     TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
3290
3291     /* Fill the OBJECTS_AND_SID structure */
3292     if (pObjectGuid != NULL)
3293     {
3294         pObjSid->ObjectTypeGuid = *pObjectGuid;
3295         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3296     }
3297     else
3298     {
3299         ZeroMemory(&pObjSid->ObjectTypeGuid,
3300                    sizeof(GUID));
3301     }
3302
3303     if (pInheritedObjectGuid != NULL)
3304     {
3305         pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
3306         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3307     }
3308     else
3309     {
3310         ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
3311                    sizeof(GUID));
3312     }
3313
3314     pObjSid->ObjectsPresent = ObjectsPresent;
3315     pObjSid->pSid = pSid;
3316
3317     /* Fill the TRUSTEE structure */
3318     pTrustee->pMultipleTrustee = NULL;
3319     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3320     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
3321     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3322     pTrustee->ptstrName = (LPWSTR) pObjSid;
3323 }
3324
3325 /******************************************************************************
3326  * BuildTrusteeWithSidA [ADVAPI32.@]
3327  */
3328 VOID WINAPI BuildTrusteeWithSidA(PTRUSTEEA pTrustee, PSID pSid)
3329 {
3330     TRACE("%p %p\n", pTrustee, pSid);
3331
3332     pTrustee->pMultipleTrustee = NULL;
3333     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3334     pTrustee->TrusteeForm = TRUSTEE_IS_SID;
3335     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3336     pTrustee->ptstrName = pSid;
3337 }
3338
3339 /******************************************************************************
3340  * BuildTrusteeWithSidW [ADVAPI32.@]
3341  */
3342 VOID WINAPI BuildTrusteeWithSidW(PTRUSTEEW pTrustee, PSID pSid)
3343 {
3344     TRACE("%p %p\n", pTrustee, pSid);
3345
3346     pTrustee->pMultipleTrustee = NULL;
3347     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3348     pTrustee->TrusteeForm = TRUSTEE_IS_SID;
3349     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3350     pTrustee->ptstrName = pSid;
3351 }
3352
3353 /******************************************************************************
3354  * BuildTrusteeWithNameA [ADVAPI32.@]
3355  */
3356 VOID WINAPI BuildTrusteeWithNameA(PTRUSTEEA pTrustee, LPSTR name)
3357 {
3358     TRACE("%p %s\n", pTrustee, debugstr_a(name) );
3359
3360     pTrustee->pMultipleTrustee = NULL;
3361     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3362     pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
3363     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3364     pTrustee->ptstrName = name;
3365 }
3366
3367 /******************************************************************************
3368  * BuildTrusteeWithNameW [ADVAPI32.@]
3369  */
3370 VOID WINAPI BuildTrusteeWithNameW(PTRUSTEEW pTrustee, LPWSTR name)
3371 {
3372     TRACE("%p %s\n", pTrustee, debugstr_w(name) );
3373
3374     pTrustee->pMultipleTrustee = NULL;
3375     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3376     pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
3377     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3378     pTrustee->ptstrName = name;
3379 }
3380
3381 /******************************************************************************
3382  * GetTrusteeFormA [ADVAPI32.@]
3383  */
3384 TRUSTEE_FORM WINAPI GetTrusteeFormA(PTRUSTEEA pTrustee)
3385 {
3386     TRACE("(%p)\n", pTrustee);
3387
3388     if (!pTrustee)
3389         return TRUSTEE_BAD_FORM;
3390
3391     return pTrustee->TrusteeForm;
3392 }
3393
3394 /******************************************************************************
3395  * GetTrusteeFormW [ADVAPI32.@]
3396  */
3397 TRUSTEE_FORM WINAPI GetTrusteeFormW(PTRUSTEEW pTrustee)
3398 {
3399     TRACE("(%p)\n", pTrustee);
3400
3401     if (!pTrustee)
3402         return TRUSTEE_BAD_FORM;
3403
3404     return pTrustee->TrusteeForm;
3405 }
3406
3407 /******************************************************************************
3408  * GetTrusteeNameA [ADVAPI32.@]
3409  */
3410 LPSTR WINAPI GetTrusteeNameA(PTRUSTEEA pTrustee)
3411 {
3412     TRACE("(%p)\n", pTrustee);
3413
3414     if (!pTrustee)
3415         return NULL;
3416
3417     return pTrustee->ptstrName;
3418 }
3419
3420 /******************************************************************************
3421  * GetTrusteeNameW [ADVAPI32.@]
3422  */
3423 LPWSTR WINAPI GetTrusteeNameW(PTRUSTEEW pTrustee)
3424 {
3425     TRACE("(%p)\n", pTrustee);
3426
3427     if (!pTrustee)
3428         return NULL;
3429
3430     return pTrustee->ptstrName;
3431 }
3432
3433 /******************************************************************************
3434  * GetTrusteeTypeA [ADVAPI32.@]
3435  */
3436 TRUSTEE_TYPE WINAPI GetTrusteeTypeA(PTRUSTEEA pTrustee)
3437 {
3438     TRACE("(%p)\n", pTrustee);
3439
3440     if (!pTrustee)
3441         return TRUSTEE_IS_UNKNOWN;
3442
3443     return pTrustee->TrusteeType;
3444 }
3445
3446 /******************************************************************************
3447  * GetTrusteeTypeW [ADVAPI32.@]
3448  */
3449 TRUSTEE_TYPE WINAPI GetTrusteeTypeW(PTRUSTEEW pTrustee)
3450 {
3451     TRACE("(%p)\n", pTrustee);
3452
3453     if (!pTrustee)
3454         return TRUSTEE_IS_UNKNOWN;
3455
3456     return pTrustee->TrusteeType;
3457 }
3458
3459 BOOL WINAPI SetAclInformation( PACL pAcl, LPVOID pAclInformation,
3460                                DWORD nAclInformationLength,
3461                                ACL_INFORMATION_CLASS dwAclInformationClass )
3462 {
3463     FIXME("%p %p 0x%08x 0x%08x - stub\n", pAcl, pAclInformation,
3464           nAclInformationLength, dwAclInformationClass);
3465
3466     return TRUE;
3467 }
3468
3469 static DWORD trustee_name_A_to_W(TRUSTEE_FORM form, char *trustee_nameA, WCHAR **ptrustee_nameW)
3470 {
3471     switch (form)
3472     {
3473     case TRUSTEE_IS_NAME:
3474     {
3475         *ptrustee_nameW = SERV_dup(trustee_nameA);
3476         return ERROR_SUCCESS;
3477     }
3478     case TRUSTEE_IS_OBJECTS_AND_NAME:
3479     {
3480         OBJECTS_AND_NAME_A *objA = (OBJECTS_AND_NAME_A *)trustee_nameA;
3481         OBJECTS_AND_NAME_W *objW = NULL;
3482
3483         if (objA)
3484         {
3485             if (!(objW = HeapAlloc( GetProcessHeap(), 0, sizeof(OBJECTS_AND_NAME_W) )))
3486                 return ERROR_NOT_ENOUGH_MEMORY;
3487
3488             objW->ObjectsPresent = objA->ObjectsPresent;
3489             objW->ObjectType = objA->ObjectType;
3490             objW->ObjectTypeName = SERV_dup(objA->ObjectTypeName);
3491             objW->InheritedObjectTypeName = SERV_dup(objA->InheritedObjectTypeName);
3492             objW->ptstrName = SERV_dup(objA->ptstrName);
3493         }
3494
3495         *ptrustee_nameW = (WCHAR *)objW;
3496         return ERROR_SUCCESS;
3497     }
3498     /* These forms do not require conversion. */
3499     case TRUSTEE_IS_SID:
3500     case TRUSTEE_IS_OBJECTS_AND_SID:
3501         *ptrustee_nameW = (WCHAR *)trustee_nameA;
3502         return ERROR_SUCCESS;
3503     default:
3504         return ERROR_INVALID_PARAMETER;
3505     }
3506 }
3507
3508 static void free_trustee_name(TRUSTEE_FORM form, WCHAR *trustee_nameW)
3509 {
3510     switch (form)
3511     {
3512     case TRUSTEE_IS_NAME:
3513         HeapFree( GetProcessHeap(), 0, trustee_nameW );
3514         break;
3515     case TRUSTEE_IS_OBJECTS_AND_NAME:
3516     {
3517         OBJECTS_AND_NAME_W *objW = (OBJECTS_AND_NAME_W *)trustee_nameW;
3518
3519         if (objW)
3520         {
3521             HeapFree( GetProcessHeap(), 0, objW->ptstrName );
3522             HeapFree( GetProcessHeap(), 0, objW->InheritedObjectTypeName );
3523             HeapFree( GetProcessHeap(), 0, objW->ObjectTypeName );
3524             HeapFree( GetProcessHeap(), 0, objW );
3525         }
3526
3527         break;
3528     }
3529     /* Other forms did not require allocation, so no freeing is necessary. */
3530     default:
3531         break;
3532     }
3533 }
3534
3535 /******************************************************************************
3536  * SetEntriesInAclA [ADVAPI32.@]
3537  */
3538 DWORD WINAPI SetEntriesInAclA( ULONG count, PEXPLICIT_ACCESSA pEntries,
3539                                PACL OldAcl, PACL* NewAcl )
3540 {
3541     DWORD err = ERROR_SUCCESS;
3542     EXPLICIT_ACCESSW *pEntriesW;
3543     UINT alloc_index, free_index;
3544
3545     TRACE("%d %p %p %p\n", count, pEntries, OldAcl, NewAcl);
3546
3547     if (NewAcl)
3548         *NewAcl = NULL;
3549
3550     if (!count && !OldAcl)
3551         return ERROR_SUCCESS;
3552
3553     pEntriesW = HeapAlloc( GetProcessHeap(), 0, count * sizeof(EXPLICIT_ACCESSW) );
3554     if (!pEntriesW)
3555         return ERROR_NOT_ENOUGH_MEMORY;
3556
3557     for (alloc_index = 0; alloc_index < count; ++alloc_index)
3558     {
3559         pEntriesW[alloc_index].grfAccessPermissions = pEntries[alloc_index].grfAccessPermissions;
3560         pEntriesW[alloc_index].grfAccessMode = pEntries[alloc_index].grfAccessMode;
3561         pEntriesW[alloc_index].grfInheritance = pEntries[alloc_index].grfInheritance;
3562         pEntriesW[alloc_index].Trustee.pMultipleTrustee = NULL; /* currently not supported */
3563         pEntriesW[alloc_index].Trustee.MultipleTrusteeOperation = pEntries[alloc_index].Trustee.MultipleTrusteeOperation;
3564         pEntriesW[alloc_index].Trustee.TrusteeForm = pEntries[alloc_index].Trustee.TrusteeForm;
3565         pEntriesW[alloc_index].Trustee.TrusteeType = pEntries[alloc_index].Trustee.TrusteeType;
3566
3567         err = trustee_name_A_to_W( pEntries[alloc_index].Trustee.TrusteeForm,
3568                                    pEntries[alloc_index].Trustee.ptstrName,
3569                                    &pEntriesW[alloc_index].Trustee.ptstrName );
3570         if (err != ERROR_SUCCESS)
3571         {
3572             if (err == ERROR_INVALID_PARAMETER)
3573                 WARN("bad trustee form %d for trustee %d\n",
3574                      pEntries[alloc_index].Trustee.TrusteeForm, alloc_index);
3575
3576             goto cleanup;
3577         }
3578     }
3579
3580     err = SetEntriesInAclW( count, pEntriesW, OldAcl, NewAcl );
3581
3582 cleanup:
3583     /* Free any previously allocated trustee name buffers, taking into account
3584      * a possible out-of-memory condition while building the EXPLICIT_ACCESSW
3585      * list. */
3586     for (free_index = 0; free_index < alloc_index; ++free_index)
3587         free_trustee_name( pEntriesW[free_index].Trustee.TrusteeForm, pEntriesW[free_index].Trustee.ptstrName );
3588
3589     HeapFree( GetProcessHeap(), 0, pEntriesW );
3590     return err;
3591 }
3592
3593 /******************************************************************************
3594  * SetEntriesInAclW [ADVAPI32.@]
3595  */
3596 DWORD WINAPI SetEntriesInAclW( ULONG count, PEXPLICIT_ACCESSW pEntries,
3597                                PACL OldAcl, PACL* NewAcl )
3598 {
3599     ULONG i;
3600     PSID *ppsid;
3601     DWORD ret = ERROR_SUCCESS;
3602     DWORD acl_size = sizeof(ACL);
3603     NTSTATUS status;
3604
3605     TRACE("%d %p %p %p\n", count, pEntries, OldAcl, NewAcl);
3606
3607     if (NewAcl)
3608         *NewAcl = NULL;
3609
3610     if (!count && !OldAcl)
3611         return ERROR_SUCCESS;
3612
3613     /* allocate array of maximum sized sids allowed */
3614     ppsid = HeapAlloc(GetProcessHeap(), 0, count * (sizeof(SID *) + FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES])));
3615     if (!ppsid)
3616         return ERROR_OUTOFMEMORY;
3617
3618     for (i = 0; i < count; i++)
3619     {
3620         ppsid[i] = (char *)&ppsid[count] + i * FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]);
3621
3622         TRACE("[%d]:\n\tgrfAccessPermissions = 0x%x\n\tgrfAccessMode = %d\n\tgrfInheritance = 0x%x\n\t"
3623               "Trustee.pMultipleTrustee = %p\n\tMultipleTrusteeOperation = %d\n\tTrusteeForm = %d\n\t"
3624               "Trustee.TrusteeType = %d\n\tptstrName = %p\n", i,
3625               pEntries[i].grfAccessPermissions, pEntries[i].grfAccessMode, pEntries[i].grfInheritance,
3626               pEntries[i].Trustee.pMultipleTrustee, pEntries[i].Trustee.MultipleTrusteeOperation,
3627               pEntries[i].Trustee.TrusteeForm, pEntries[i].Trustee.TrusteeType,
3628               pEntries[i].Trustee.ptstrName);
3629
3630         if (pEntries[i].Trustee.MultipleTrusteeOperation == TRUSTEE_IS_IMPERSONATE)
3631         {
3632             WARN("bad multiple trustee operation %d for trustee %d\n", pEntries[i].Trustee.MultipleTrusteeOperation, i);
3633             ret = ERROR_INVALID_PARAMETER;
3634             goto exit;
3635         }
3636
3637         switch (pEntries[i].Trustee.TrusteeForm)
3638         {
3639         case TRUSTEE_IS_SID:
3640             if (!CopySid(FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]),
3641                          ppsid[i], pEntries[i].Trustee.ptstrName))
3642             {
3643                 WARN("bad sid %p for trustee %d\n", pEntries[i].Trustee.ptstrName, i);
3644                 ret = ERROR_INVALID_PARAMETER;
3645                 goto exit;
3646             }
3647             break;
3648         case TRUSTEE_IS_NAME:
3649         {
3650             DWORD sid_size = FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]);
3651             DWORD domain_size = MAX_COMPUTERNAME_LENGTH + 1;
3652             SID_NAME_USE use;
3653             if (!strcmpW( pEntries[i].Trustee.ptstrName, CURRENT_USER ))
3654             {
3655                 if (!lookup_user_account_name( ppsid[i], &sid_size, NULL, &domain_size, &use ))
3656                 {
3657                     ret = GetLastError();
3658                     goto exit;
3659                 }
3660             }
3661             else if (!LookupAccountNameW(NULL, pEntries[i].Trustee.ptstrName, ppsid[i], &sid_size, NULL, &domain_size, &use))
3662             {
3663                 WARN("bad user name %s for trustee %d\n", debugstr_w(pEntries[i].Trustee.ptstrName), i);
3664                 ret = ERROR_INVALID_PARAMETER;
3665                 goto exit;
3666             }
3667             break;
3668         }
3669         case TRUSTEE_IS_OBJECTS_AND_SID:
3670             FIXME("TRUSTEE_IS_OBJECTS_AND_SID unimplemented\n");
3671             break;
3672         case TRUSTEE_IS_OBJECTS_AND_NAME:
3673             FIXME("TRUSTEE_IS_OBJECTS_AND_NAME unimplemented\n");
3674             break;
3675         default:
3676             WARN("bad trustee form %d for trustee %d\n", pEntries[i].Trustee.TrusteeForm, i);
3677             ret = ERROR_INVALID_PARAMETER;
3678             goto exit;
3679         }
3680
3681         /* Note: we overestimate the ACL size here as a tradeoff between
3682          * instructions (simplicity) and memory */
3683         switch (pEntries[i].grfAccessMode)
3684         {
3685         case GRANT_ACCESS:
3686         case SET_ACCESS:
3687             acl_size += FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart) + GetLengthSid(ppsid[i]);
3688             break;
3689         case DENY_ACCESS:
3690             acl_size += FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart) + GetLengthSid(ppsid[i]);
3691             break;
3692         case SET_AUDIT_SUCCESS:
3693         case SET_AUDIT_FAILURE:
3694             acl_size += FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart) + GetLengthSid(ppsid[i]);
3695             break;
3696         case REVOKE_ACCESS:
3697             break;
3698         default:
3699             WARN("bad access mode %d for trustee %d\n", pEntries[i].grfAccessMode, i);
3700             ret = ERROR_INVALID_PARAMETER;
3701             goto exit;
3702         }
3703     }
3704
3705     if (OldAcl)
3706     {
3707         ACL_SIZE_INFORMATION size_info;
3708
3709         status = RtlQueryInformationAcl(OldAcl, &size_info, sizeof(size_info), AclSizeInformation);
3710         if (status != STATUS_SUCCESS)
3711         {
3712             ret = RtlNtStatusToDosError(status);
3713             goto exit;
3714         }
3715         acl_size += size_info.AclBytesInUse - sizeof(ACL);
3716     }
3717
3718     *NewAcl = LocalAlloc(0, acl_size);
3719     if (!*NewAcl)
3720     {
3721         ret = ERROR_OUTOFMEMORY;
3722         goto exit;
3723     }
3724
3725     status = RtlCreateAcl( *NewAcl, acl_size, ACL_REVISION );
3726     if (status != STATUS_SUCCESS)
3727     {
3728         ret = RtlNtStatusToDosError(status);
3729         goto exit;
3730     }
3731
3732     for (i = 0; i < count; i++)
3733     {
3734         switch (pEntries[i].grfAccessMode)
3735         {
3736         case GRANT_ACCESS:
3737             status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION,
3738                                               pEntries[i].grfInheritance,
3739                                               pEntries[i].grfAccessPermissions,
3740                                               ppsid[i]);
3741             break;
3742         case SET_ACCESS:
3743         {
3744             ULONG j;
3745             BOOL add = TRUE;
3746             if (OldAcl)
3747             {
3748                 for (j = 0; ; j++)
3749                 {
3750                     const ACE_HEADER *existing_ace_header;
3751                     status = RtlGetAce(OldAcl, j, (LPVOID *)&existing_ace_header);
3752                     if (status != STATUS_SUCCESS)
3753                         break;
3754                     if (pEntries[i].grfAccessMode == SET_ACCESS &&
3755                         existing_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE &&
3756                         EqualSid(ppsid[i], &((ACCESS_ALLOWED_ACE *)existing_ace_header)->SidStart))
3757                     {
3758                         add = FALSE;
3759                         break;
3760                     }
3761                 }
3762             }
3763             if (add)
3764                 status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION,
3765                                                   pEntries[i].grfInheritance,
3766                                                   pEntries[i].grfAccessPermissions,
3767                                                   ppsid[i]);
3768             break;
3769         }
3770         case DENY_ACCESS:
3771             status = RtlAddAccessDeniedAceEx(*NewAcl, ACL_REVISION,
3772                                              pEntries[i].grfInheritance,
3773                                              pEntries[i].grfAccessPermissions,
3774                                              ppsid[i]);
3775             break;
3776         case SET_AUDIT_SUCCESS:
3777             status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION,
3778                                             pEntries[i].grfInheritance,
3779                                             pEntries[i].grfAccessPermissions,
3780                                             ppsid[i], TRUE, FALSE);
3781             break;
3782         case SET_AUDIT_FAILURE:
3783             status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION,
3784                                             pEntries[i].grfInheritance,
3785                                             pEntries[i].grfAccessPermissions,
3786                                             ppsid[i], FALSE, TRUE);
3787             break;
3788         default:
3789             FIXME("unhandled access mode %d\n", pEntries[i].grfAccessMode);
3790         }
3791     }
3792
3793     if (OldAcl)
3794     {
3795         for (i = 0; ; i++)
3796         {
3797             BOOL add = TRUE;
3798             ULONG j;
3799             const ACE_HEADER *old_ace_header;
3800             status = RtlGetAce(OldAcl, i, (LPVOID *)&old_ace_header);
3801             if (status != STATUS_SUCCESS) break;
3802             for (j = 0; j < count; j++)
3803             {
3804                 if (pEntries[j].grfAccessMode == SET_ACCESS &&
3805                     old_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE &&
3806                     EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart))
3807                 {
3808                     status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION, pEntries[j].grfInheritance, pEntries[j].grfAccessPermissions, ppsid[j]);
3809                     add = FALSE;
3810                     break;
3811                 }
3812                 else if (pEntries[j].grfAccessMode == REVOKE_ACCESS)
3813                 {
3814                     switch (old_ace_header->AceType)
3815                     {
3816                     case ACCESS_ALLOWED_ACE_TYPE:
3817                         if (EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart))
3818                             add = FALSE;
3819                         break;
3820                     case ACCESS_DENIED_ACE_TYPE:
3821                         if (EqualSid(ppsid[j], &((ACCESS_DENIED_ACE *)old_ace_header)->SidStart))
3822                             add = FALSE;
3823                         break;
3824                     case SYSTEM_AUDIT_ACE_TYPE:
3825                         if (EqualSid(ppsid[j], &((SYSTEM_AUDIT_ACE *)old_ace_header)->SidStart))
3826                             add = FALSE;
3827                         break;
3828                     case SYSTEM_ALARM_ACE_TYPE:
3829                         if (EqualSid(ppsid[j], &((SYSTEM_ALARM_ACE *)old_ace_header)->SidStart))
3830                             add = FALSE;
3831                         break;
3832                     default:
3833                         FIXME("unhandled ace type %d\n", old_ace_header->AceType);
3834                     }
3835
3836                     if (!add)
3837                         break;
3838                 }
3839             }
3840             if (add)
3841                 status = RtlAddAce(*NewAcl, ACL_REVISION, 1, (PACE_HEADER)old_ace_header, old_ace_header->AceSize);
3842             if (status != STATUS_SUCCESS)
3843             {
3844                 WARN("RtlAddAce failed with error 0x%08x\n", status);
3845                 ret = RtlNtStatusToDosError(status);
3846                 break;
3847             }
3848         }
3849     }
3850
3851 exit:
3852     HeapFree(GetProcessHeap(), 0, ppsid);
3853     return ret;
3854 }
3855
3856 /******************************************************************************
3857  * SetNamedSecurityInfoA [ADVAPI32.@]
3858  */
3859 DWORD WINAPI SetNamedSecurityInfoA(LPSTR pObjectName,
3860         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
3861         PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
3862 {
3863     LPWSTR wstr;
3864     DWORD r;
3865
3866     TRACE("%s %d %d %p %p %p %p\n", debugstr_a(pObjectName), ObjectType,
3867            SecurityInfo, psidOwner, psidGroup, pDacl, pSacl);
3868
3869     wstr = SERV_dup(pObjectName);
3870     r = SetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, psidOwner,
3871                            psidGroup, pDacl, pSacl );
3872
3873     HeapFree( GetProcessHeap(), 0, wstr );
3874
3875     return r;
3876 }
3877
3878 BOOL WINAPI SetPrivateObjectSecurity( SECURITY_INFORMATION SecurityInformation,
3879     PSECURITY_DESCRIPTOR ModificationDescriptor,
3880     PSECURITY_DESCRIPTOR* ObjectsSecurityDescriptor,
3881     PGENERIC_MAPPING GenericMapping,
3882     HANDLE Token )
3883 {
3884     FIXME("0x%08x %p %p %p %p - stub\n", SecurityInformation, ModificationDescriptor,
3885           ObjectsSecurityDescriptor, GenericMapping, Token);
3886
3887     return TRUE;
3888 }
3889
3890 BOOL WINAPI AreAllAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess )
3891 {
3892     return RtlAreAllAccessesGranted( GrantedAccess, DesiredAccess );
3893 }
3894
3895 /******************************************************************************
3896  * AreAnyAccessesGranted [ADVAPI32.@]
3897  *
3898  * Determines whether or not any of a set of specified access permissions have
3899  * been granted or not.
3900  *
3901  * PARAMS
3902  *   GrantedAccess [I] The permissions that have been granted.
3903  *   DesiredAccess [I] The permissions that you want to have.
3904  *
3905  * RETURNS
3906  *   Nonzero if any of the permissions have been granted, zero if none of the
3907  *   permissions have been granted.
3908  */
3909
3910 BOOL WINAPI AreAnyAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess )
3911 {
3912     return RtlAreAnyAccessesGranted( GrantedAccess, DesiredAccess );
3913 }
3914
3915 /******************************************************************************
3916  * SetNamedSecurityInfoW [ADVAPI32.@]
3917  */
3918 DWORD WINAPI SetNamedSecurityInfoW(LPWSTR pObjectName,
3919         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
3920         PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
3921 {
3922     OBJECT_ATTRIBUTES attr;
3923     UNICODE_STRING nameW;
3924     IO_STATUS_BLOCK io;
3925     DWORD access = 0;
3926     HANDLE hFile;
3927     DWORD status;
3928
3929     TRACE( "%s %d %d %p %p %p %p\n", debugstr_w(pObjectName), ObjectType,
3930            SecurityInfo, psidOwner, psidGroup, pDacl, pSacl);
3931     if (ObjectType != SE_FILE_OBJECT)
3932     {
3933         FIXME( "Object type %d is not currently supported.\n", ObjectType );
3934         return ERROR_SUCCESS;
3935     }
3936
3937     if (!pObjectName) return ERROR_INVALID_PARAMETER;
3938     if (!RtlDosPathNameToNtPathName_U( pObjectName, &nameW, NULL, NULL ))
3939         return ERROR_PATH_NOT_FOUND;
3940
3941     if (SecurityInfo & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION))
3942         access |= WRITE_OWNER;
3943     if (SecurityInfo & DACL_SECURITY_INFORMATION)
3944         access |= WRITE_DAC;
3945     if (SecurityInfo & SACL_SECURITY_INFORMATION)
3946         access |= ACCESS_SYSTEM_SECURITY;
3947     attr.Length = sizeof(attr);
3948     attr.RootDirectory = 0;
3949     attr.Attributes = OBJ_CASE_INSENSITIVE;
3950     attr.ObjectName = &nameW;
3951     attr.SecurityDescriptor = NULL;
3952
3953     status = NtCreateFile( &hFile, access, &attr, &io, NULL, FILE_FLAG_BACKUP_SEMANTICS,
3954                            FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, FILE_OPEN,
3955                            FILE_OPEN_FOR_BACKUP_INTENT, NULL, 0 );
3956     RtlFreeUnicodeString( &nameW );
3957     if (status != STATUS_SUCCESS)
3958         return RtlNtStatusToDosError( status );
3959     status = SetSecurityInfo( hFile, ObjectType, SecurityInfo, psidOwner, psidGroup, pDacl, pSacl );
3960     CloseHandle( hFile );
3961     return status;
3962 }
3963
3964 /******************************************************************************
3965  * GetExplicitEntriesFromAclA [ADVAPI32.@]
3966  */
3967 DWORD WINAPI GetExplicitEntriesFromAclA( PACL pacl, PULONG pcCountOfExplicitEntries,
3968         PEXPLICIT_ACCESSA* pListOfExplicitEntries)
3969 {
3970     FIXME("%p %p %p\n",pacl, pcCountOfExplicitEntries, pListOfExplicitEntries);
3971     return ERROR_CALL_NOT_IMPLEMENTED;
3972 }
3973
3974 /******************************************************************************
3975  * GetExplicitEntriesFromAclW [ADVAPI32.@]
3976  */
3977 DWORD WINAPI GetExplicitEntriesFromAclW( PACL pacl, PULONG pcCountOfExplicitEntries,
3978         PEXPLICIT_ACCESSW* pListOfExplicitEntries)
3979 {
3980     FIXME("%p %p %p\n",pacl, pcCountOfExplicitEntries, pListOfExplicitEntries);
3981     return ERROR_CALL_NOT_IMPLEMENTED;
3982 }
3983
3984 /******************************************************************************
3985  * GetAuditedPermissionsFromAclA [ADVAPI32.@]
3986  */
3987 DWORD WINAPI GetAuditedPermissionsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pSuccessfulAuditedRights,
3988         PACCESS_MASK pFailedAuditRights)
3989 {
3990     FIXME("%p %p %p %p\n",pacl, pTrustee, pSuccessfulAuditedRights, pFailedAuditRights);
3991     return ERROR_CALL_NOT_IMPLEMENTED;
3992
3993 }
3994
3995 /******************************************************************************
3996  * GetAuditedPermissionsFromAclW [ADVAPI32.@]
3997  */
3998 DWORD WINAPI GetAuditedPermissionsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pSuccessfulAuditedRights,
3999         PACCESS_MASK pFailedAuditRights)
4000 {
4001     FIXME("%p %p %p %p\n",pacl, pTrustee, pSuccessfulAuditedRights, pFailedAuditRights);
4002     return ERROR_CALL_NOT_IMPLEMENTED;
4003
4004 }
4005
4006 /******************************************************************************
4007  * ParseAclStringFlags
4008  */
4009 static DWORD ParseAclStringFlags(LPCWSTR* StringAcl)
4010 {
4011     DWORD flags = 0;
4012     LPCWSTR szAcl = *StringAcl;
4013
4014     while (*szAcl != '(')
4015     {
4016         if (*szAcl == 'P')
4017         {
4018             flags |= SE_DACL_PROTECTED;
4019         }
4020         else if (*szAcl == 'A')
4021         {
4022             szAcl++;
4023             if (*szAcl == 'R')
4024                 flags |= SE_DACL_AUTO_INHERIT_REQ;
4025             else if (*szAcl == 'I')
4026                 flags |= SE_DACL_AUTO_INHERITED;
4027         }
4028         szAcl++;
4029     }
4030
4031     *StringAcl = szAcl;
4032     return flags;
4033 }
4034
4035 /******************************************************************************
4036  * ParseAceStringType
4037  */
4038 static const ACEFLAG AceType[] =
4039 {
4040     { SDDL_ALARM,          SYSTEM_ALARM_ACE_TYPE },
4041     { SDDL_AUDIT,          SYSTEM_AUDIT_ACE_TYPE },
4042     { SDDL_ACCESS_ALLOWED, ACCESS_ALLOWED_ACE_TYPE },
4043     { SDDL_ACCESS_DENIED,  ACCESS_DENIED_ACE_TYPE },
4044     /*
4045     { SDDL_OBJECT_ACCESS_ALLOWED, ACCESS_ALLOWED_OBJECT_ACE_TYPE },
4046     { SDDL_OBJECT_ACCESS_DENIED,  ACCESS_DENIED_OBJECT_ACE_TYPE },
4047     { SDDL_OBJECT_ALARM,          SYSTEM_ALARM_OBJECT_ACE_TYPE },
4048     { SDDL_OBJECT_AUDIT,          SYSTEM_AUDIT_OBJECT_ACE_TYPE },
4049     */
4050     { NULL, 0 },
4051 };
4052
4053 static BYTE ParseAceStringType(LPCWSTR* StringAcl)
4054 {
4055     UINT len = 0;
4056     LPCWSTR szAcl = *StringAcl;
4057     const ACEFLAG *lpaf = AceType;
4058
4059     while (*szAcl == ' ')
4060         szAcl++;
4061
4062     while (lpaf->wstr &&
4063         (len = strlenW(lpaf->wstr)) &&
4064         strncmpW(lpaf->wstr, szAcl, len))
4065         lpaf++;
4066
4067     if (!lpaf->wstr)
4068         return 0;
4069
4070     *StringAcl = szAcl + len;
4071     return lpaf->value;
4072 }
4073
4074
4075 /******************************************************************************
4076  * ParseAceStringFlags
4077  */
4078 static const ACEFLAG AceFlags[] =
4079 {
4080     { SDDL_CONTAINER_INHERIT, CONTAINER_INHERIT_ACE },
4081     { SDDL_AUDIT_FAILURE,     FAILED_ACCESS_ACE_FLAG },
4082     { SDDL_INHERITED,         INHERITED_ACE },
4083     { SDDL_INHERIT_ONLY,      INHERIT_ONLY_ACE },
4084     { SDDL_NO_PROPAGATE,      NO_PROPAGATE_INHERIT_ACE },
4085     { SDDL_OBJECT_INHERIT,    OBJECT_INHERIT_ACE },
4086     { SDDL_AUDIT_SUCCESS,     SUCCESSFUL_ACCESS_ACE_FLAG },
4087     { NULL, 0 },
4088 };
4089
4090 static BYTE ParseAceStringFlags(LPCWSTR* StringAcl)
4091 {
4092     UINT len = 0;
4093     BYTE flags = 0;
4094     LPCWSTR szAcl = *StringAcl;
4095
4096     while (*szAcl == ' ')
4097         szAcl++;
4098
4099     while (*szAcl != ';')
4100     {
4101         const ACEFLAG *lpaf = AceFlags;
4102
4103         while (lpaf->wstr &&
4104                (len = strlenW(lpaf->wstr)) &&
4105                strncmpW(lpaf->wstr, szAcl, len))
4106             lpaf++;
4107
4108         if (!lpaf->wstr)
4109             return 0;
4110
4111         flags |= lpaf->value;
4112         szAcl += len;
4113     }
4114
4115     *StringAcl = szAcl;
4116     return flags;
4117 }
4118
4119
4120 /******************************************************************************
4121  * ParseAceStringRights
4122  */
4123 static const ACEFLAG AceRights[] =
4124 {
4125     { SDDL_GENERIC_ALL,     GENERIC_ALL },
4126     { SDDL_GENERIC_READ,    GENERIC_READ },
4127     { SDDL_GENERIC_WRITE,   GENERIC_WRITE },
4128     { SDDL_GENERIC_EXECUTE, GENERIC_EXECUTE },
4129
4130     { SDDL_READ_CONTROL,    READ_CONTROL },
4131     { SDDL_STANDARD_DELETE, DELETE },
4132     { SDDL_WRITE_DAC,       WRITE_DAC },
4133     { SDDL_WRITE_OWNER,     WRITE_OWNER },
4134
4135     { SDDL_READ_PROPERTY,   ADS_RIGHT_DS_READ_PROP},
4136     { SDDL_WRITE_PROPERTY,  ADS_RIGHT_DS_WRITE_PROP},
4137     { SDDL_CREATE_CHILD,    ADS_RIGHT_DS_CREATE_CHILD},
4138     { SDDL_DELETE_CHILD,    ADS_RIGHT_DS_DELETE_CHILD},
4139     { SDDL_LIST_CHILDREN,   ADS_RIGHT_ACTRL_DS_LIST},
4140     { SDDL_SELF_WRITE,      ADS_RIGHT_DS_SELF},
4141     { SDDL_LIST_OBJECT,     ADS_RIGHT_DS_LIST_OBJECT},
4142     { SDDL_DELETE_TREE,     ADS_RIGHT_DS_DELETE_TREE},
4143     { SDDL_CONTROL_ACCESS,  ADS_RIGHT_DS_CONTROL_ACCESS},
4144
4145     { SDDL_FILE_ALL,        FILE_ALL_ACCESS },
4146     { SDDL_FILE_READ,       FILE_GENERIC_READ },
4147     { SDDL_FILE_WRITE,      FILE_GENERIC_WRITE },
4148     { SDDL_FILE_EXECUTE,    FILE_GENERIC_EXECUTE },
4149
4150     { SDDL_KEY_ALL,         KEY_ALL_ACCESS },
4151     { SDDL_KEY_READ,        KEY_READ },
4152     { SDDL_KEY_WRITE,       KEY_WRITE },
4153     { SDDL_KEY_EXECUTE,     KEY_EXECUTE },
4154     { NULL, 0 },
4155 };
4156
4157 static DWORD ParseAceStringRights(LPCWSTR* StringAcl)
4158 {
4159     UINT len = 0;
4160     DWORD rights = 0;
4161     LPCWSTR szAcl = *StringAcl;
4162
4163     while (*szAcl == ' ')
4164         szAcl++;
4165
4166     if ((*szAcl == '0') && (*(szAcl + 1) == 'x'))
4167     {
4168         LPCWSTR p = szAcl;
4169
4170         while (*p && *p != ';')
4171             p++;
4172
4173         if (p - szAcl <= 10 /* 8 hex digits + "0x" */ )
4174         {
4175             rights = strtoulW(szAcl, NULL, 16);
4176             szAcl = p;
4177         }
4178         else
4179             WARN("Invalid rights string format: %s\n", debugstr_wn(szAcl, p - szAcl));
4180     }
4181     else
4182     {
4183         while (*szAcl != ';')
4184         {
4185             const ACEFLAG *lpaf = AceRights;
4186
4187             while (lpaf->wstr &&
4188                (len = strlenW(lpaf->wstr)) &&
4189                strncmpW(lpaf->wstr, szAcl, len))
4190             {
4191                lpaf++;
4192             }
4193
4194             if (!lpaf->wstr)
4195                 return 0;
4196
4197             rights |= lpaf->value;
4198             szAcl += len;
4199         }
4200     }
4201
4202     *StringAcl = szAcl;
4203     return rights;
4204 }
4205
4206
4207 /******************************************************************************
4208  * ParseStringAclToAcl
4209  *
4210  * dacl_flags(string_ace1)(string_ace2)... (string_acen)
4211  */
4212 static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags,
4213     PACL pAcl, LPDWORD cBytes)
4214 {
4215     DWORD val;
4216     DWORD sidlen;
4217     DWORD length = sizeof(ACL);
4218     DWORD acesize = 0;
4219     DWORD acecount = 0;
4220     PACCESS_ALLOWED_ACE pAce = NULL; /* pointer to current ACE */
4221     DWORD error = ERROR_INVALID_ACL;
4222
4223     TRACE("%s\n", debugstr_w(StringAcl));
4224
4225     if (!StringAcl)
4226         return FALSE;
4227
4228     if (pAcl) /* pAce is only useful if we're setting values */
4229         pAce = (PACCESS_ALLOWED_ACE) (pAcl + 1);
4230
4231     /* Parse ACL flags */
4232     *lpdwFlags = ParseAclStringFlags(&StringAcl);
4233
4234     /* Parse ACE */
4235     while (*StringAcl == '(')
4236     {
4237         StringAcl++;
4238
4239         /* Parse ACE type */
4240         val = ParseAceStringType(&StringAcl);
4241         if (pAce)
4242             pAce->Header.AceType = (BYTE) val;
4243         if (*StringAcl != ';')
4244         {
4245             error = RPC_S_INVALID_STRING_UUID;
4246             goto lerr;
4247         }
4248         StringAcl++;
4249
4250         /* Parse ACE flags */
4251         val = ParseAceStringFlags(&StringAcl);
4252         if (pAce)
4253             pAce->Header.AceFlags = (BYTE) val;
4254         if (*StringAcl != ';')
4255             goto lerr;
4256         StringAcl++;
4257
4258         /* Parse ACE rights */
4259         val = ParseAceStringRights(&StringAcl);
4260         if (pAce)
4261             pAce->Mask = val;
4262         if (*StringAcl != ';')
4263             goto lerr;
4264         StringAcl++;
4265
4266         /* Parse ACE object guid */
4267         while (*StringAcl == ' ')
4268             StringAcl++;
4269         if (*StringAcl != ';')
4270         {
4271             FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
4272             goto lerr;
4273         }
4274         StringAcl++;
4275
4276         /* Parse ACE inherit object guid */
4277         while (*StringAcl == ' ')
4278             StringAcl++;
4279         if (*StringAcl != ';')
4280         {
4281             FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
4282             goto lerr;
4283         }
4284         StringAcl++;
4285
4286         /* Parse ACE account sid */
4287         if (ParseStringSidToSid(StringAcl, pAce ? &pAce->SidStart : NULL, &sidlen))
4288         {
4289             while (*StringAcl && *StringAcl != ')')
4290                 StringAcl++;
4291         }
4292
4293         if (*StringAcl != ')')
4294             goto lerr;
4295         StringAcl++;
4296
4297         acesize = sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) + sidlen;
4298         length += acesize;
4299         if (pAce)
4300         {
4301             pAce->Header.AceSize = acesize;
4302             pAce = (PACCESS_ALLOWED_ACE)((LPBYTE)pAce + acesize);
4303         }
4304         acecount++;
4305     }
4306
4307     *cBytes = length;
4308
4309     if (length > 0xffff)
4310     {
4311         ERR("ACL too large\n");
4312         goto lerr;
4313     }
4314
4315     if (pAcl)
4316     {
4317         pAcl->AclRevision = ACL_REVISION;
4318         pAcl->Sbz1 = 0;
4319         pAcl->AclSize = length;
4320         pAcl->AceCount = acecount++;
4321         pAcl->Sbz2 = 0;
4322     }
4323     return TRUE;
4324
4325 lerr:
4326     SetLastError(error);
4327     WARN("Invalid ACE string format\n");
4328     return FALSE;
4329 }
4330
4331
4332 /******************************************************************************
4333  * ParseStringSecurityDescriptorToSecurityDescriptor
4334  */
4335 static BOOL ParseStringSecurityDescriptorToSecurityDescriptor(
4336     LPCWSTR StringSecurityDescriptor,
4337     SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
4338     LPDWORD cBytes)
4339 {
4340     BOOL bret = FALSE;
4341     WCHAR toktype;
4342     WCHAR tok[MAX_PATH];
4343     LPCWSTR lptoken;
4344     LPBYTE lpNext = NULL;
4345     DWORD len;
4346
4347     *cBytes = sizeof(SECURITY_DESCRIPTOR);
4348
4349     if (SecurityDescriptor)
4350         lpNext = (LPBYTE)(SecurityDescriptor + 1);
4351
4352     while (*StringSecurityDescriptor == ' ')
4353         StringSecurityDescriptor++;
4354
4355     while (*StringSecurityDescriptor)
4356     {
4357         toktype = *StringSecurityDescriptor;
4358
4359         /* Expect char identifier followed by ':' */
4360         StringSecurityDescriptor++;
4361         if (*StringSecurityDescriptor != ':')
4362         {
4363             SetLastError(ERROR_INVALID_PARAMETER);
4364             goto lend;
4365         }
4366         StringSecurityDescriptor++;
4367
4368         /* Extract token */
4369         lptoken = StringSecurityDescriptor;
4370         while (*lptoken && *lptoken != ':')
4371             lptoken++;
4372
4373         if (*lptoken)
4374             lptoken--;
4375
4376         len = lptoken - StringSecurityDescriptor;
4377         memcpy( tok, StringSecurityDescriptor, len * sizeof(WCHAR) );
4378         tok[len] = 0;
4379
4380         switch (toktype)
4381         {
4382             case 'O':
4383             {
4384                 DWORD bytes;
4385
4386                 if (!ParseStringSidToSid(tok, lpNext, &bytes))
4387                     goto lend;
4388
4389                 if (SecurityDescriptor)
4390                 {
4391                     SecurityDescriptor->Owner = lpNext - (LPBYTE)SecurityDescriptor;
4392                     lpNext += bytes; /* Advance to next token */
4393                 }
4394
4395                 *cBytes += bytes;
4396
4397                 break;
4398             }
4399
4400             case 'G':
4401             {
4402                 DWORD bytes;
4403
4404                 if (!ParseStringSidToSid(tok, lpNext, &bytes))
4405                     goto lend;
4406
4407                 if (SecurityDescriptor)
4408                 {
4409                     SecurityDescriptor->Group = lpNext - (LPBYTE)SecurityDescriptor;
4410                     lpNext += bytes; /* Advance to next token */
4411                 }
4412
4413                 *cBytes += bytes;
4414
4415                 break;
4416             }
4417
4418             case 'D':
4419             {
4420                 DWORD flags;
4421                 DWORD bytes;
4422
4423                 if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
4424                     goto lend;
4425
4426                 if (SecurityDescriptor)
4427                 {
4428                     SecurityDescriptor->Control |= SE_DACL_PRESENT | flags;
4429                     SecurityDescriptor->Dacl = lpNext - (LPBYTE)SecurityDescriptor;
4430                     lpNext += bytes; /* Advance to next token */
4431                 }
4432
4433                 *cBytes += bytes;
4434
4435                 break;
4436             }
4437
4438             case 'S':
4439             {
4440                 DWORD flags;
4441                 DWORD bytes;
4442
4443                 if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
4444                     goto lend;
4445
4446                 if (SecurityDescriptor)
4447                 {
4448                     SecurityDescriptor->Control |= SE_SACL_PRESENT | flags;
4449                     SecurityDescriptor->Sacl = lpNext - (LPBYTE)SecurityDescriptor;
4450                     lpNext += bytes; /* Advance to next token */
4451                 }
4452
4453                 *cBytes += bytes;
4454
4455                 break;
4456             }
4457
4458             default:
4459                 FIXME("Unknown token\n");
4460                 SetLastError(ERROR_INVALID_PARAMETER);
4461                 goto lend;
4462         }
4463
4464         StringSecurityDescriptor = lptoken;
4465     }
4466
4467     bret = TRUE;
4468
4469 lend:
4470     return bret;
4471 }
4472
4473 /******************************************************************************
4474  * ConvertStringSecurityDescriptorToSecurityDescriptorA [ADVAPI32.@]
4475  */
4476 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorA(
4477         LPCSTR StringSecurityDescriptor,
4478         DWORD StringSDRevision,
4479         PSECURITY_DESCRIPTOR* SecurityDescriptor,
4480         PULONG SecurityDescriptorSize)
4481 {
4482     BOOL ret;
4483     LPWSTR StringSecurityDescriptorW;
4484
4485     if(!StringSecurityDescriptor)
4486         return FALSE;
4487
4488     StringSecurityDescriptorW = SERV_dup(StringSecurityDescriptor);
4489     ret = ConvertStringSecurityDescriptorToSecurityDescriptorW(StringSecurityDescriptorW,
4490                                                                StringSDRevision, SecurityDescriptor,
4491                                                                SecurityDescriptorSize);
4492     HeapFree(GetProcessHeap(), 0, StringSecurityDescriptorW);
4493
4494     return ret;
4495 }
4496
4497 /******************************************************************************
4498  * ConvertStringSecurityDescriptorToSecurityDescriptorW [ADVAPI32.@]
4499  */
4500 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorW(
4501         LPCWSTR StringSecurityDescriptor,
4502         DWORD StringSDRevision,
4503         PSECURITY_DESCRIPTOR* SecurityDescriptor,
4504         PULONG SecurityDescriptorSize)
4505 {
4506     DWORD cBytes;
4507     SECURITY_DESCRIPTOR* psd;
4508     BOOL bret = FALSE;
4509
4510     TRACE("%s\n", debugstr_w(StringSecurityDescriptor));
4511
4512     if (GetVersion() & 0x80000000)
4513     {
4514         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4515         goto lend;
4516     }
4517     else if (!StringSecurityDescriptor || !SecurityDescriptor)
4518     {
4519         SetLastError(ERROR_INVALID_PARAMETER);
4520         goto lend;
4521     }
4522     else if (StringSDRevision != SID_REVISION)
4523     {
4524         SetLastError(ERROR_UNKNOWN_REVISION);
4525         goto lend;
4526     }
4527
4528     /* Compute security descriptor length */
4529     if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
4530         NULL, &cBytes))
4531         goto lend;
4532
4533     psd = *SecurityDescriptor = LocalAlloc(GMEM_ZEROINIT, cBytes);
4534     if (!psd) goto lend;
4535
4536     psd->Revision = SID_REVISION;
4537     psd->Control |= SE_SELF_RELATIVE;
4538
4539     if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
4540              (SECURITY_DESCRIPTOR_RELATIVE *)psd, &cBytes))
4541     {
4542         LocalFree(psd);
4543         goto lend;
4544     }
4545
4546     if (SecurityDescriptorSize)
4547         *SecurityDescriptorSize = cBytes;
4548
4549     bret = TRUE;
4550
4551 lend:
4552     TRACE(" ret=%d\n", bret);
4553     return bret;
4554 }
4555
4556 static void DumpString(LPCWSTR string, int cch, WCHAR **pwptr, ULONG *plen)
4557 {
4558     if (cch == -1)
4559         cch = strlenW(string);
4560
4561     if (plen)
4562         *plen += cch;
4563
4564     if (pwptr)
4565     {
4566         memcpy(*pwptr, string, sizeof(WCHAR)*cch);
4567         *pwptr += cch;
4568     }
4569 }
4570
4571 static BOOL DumpSidNumeric(PSID psid, WCHAR **pwptr, ULONG *plen)
4572 {
4573     DWORD i;
4574     WCHAR fmt[] = { 'S','-','%','u','-','%','d',0 };
4575     WCHAR subauthfmt[] = { '-','%','u',0 };
4576     WCHAR buf[26];
4577     SID *pisid = psid;
4578
4579     if( !IsValidSid( psid ) || pisid->Revision != SDDL_REVISION)
4580     {
4581         SetLastError(ERROR_INVALID_SID);
4582         return FALSE;
4583     }
4584
4585     if (pisid->IdentifierAuthority.Value[0] ||
4586      pisid->IdentifierAuthority.Value[1])
4587     {
4588         FIXME("not matching MS' bugs\n");
4589         SetLastError(ERROR_INVALID_SID);
4590         return FALSE;
4591     }
4592
4593     sprintfW( buf, fmt, pisid->Revision,
4594         MAKELONG(
4595             MAKEWORD( pisid->IdentifierAuthority.Value[5],
4596                     pisid->IdentifierAuthority.Value[4] ),
4597             MAKEWORD( pisid->IdentifierAuthority.Value[3],
4598                     pisid->IdentifierAuthority.Value[2] )
4599         ) );
4600     DumpString(buf, -1, pwptr, plen);
4601
4602     for( i=0; i<pisid->SubAuthorityCount; i++ )
4603     {
4604         sprintfW( buf, subauthfmt, pisid->SubAuthority[i] );
4605         DumpString(buf, -1, pwptr, plen);
4606     }
4607     return TRUE;
4608 }
4609
4610 static BOOL DumpSid(PSID psid, WCHAR **pwptr, ULONG *plen)
4611 {
4612     size_t i;
4613     for (i = 0; i < sizeof(WellKnownSids) / sizeof(WellKnownSids[0]); i++)
4614     {
4615         if (WellKnownSids[i].wstr[0] && EqualSid(psid, (PSID)&(WellKnownSids[i].Sid.Revision)))
4616         {
4617             DumpString(WellKnownSids[i].wstr, 2, pwptr, plen);
4618             return TRUE;
4619         }
4620     }
4621
4622     return DumpSidNumeric(psid, pwptr, plen);
4623 }
4624
4625 static const LPCWSTR AceRightBitNames[32] = {
4626         SDDL_CREATE_CHILD,        /*  0 */
4627         SDDL_DELETE_CHILD,
4628         SDDL_LIST_CHILDREN,
4629         SDDL_SELF_WRITE,
4630         SDDL_READ_PROPERTY,       /*  4 */
4631         SDDL_WRITE_PROPERTY,
4632         SDDL_DELETE_TREE,
4633         SDDL_LIST_OBJECT,
4634         SDDL_CONTROL_ACCESS,      /*  8 */
4635         NULL,
4636         NULL,
4637         NULL,
4638         NULL,                     /* 12 */
4639         NULL,
4640         NULL,
4641         NULL,
4642         SDDL_STANDARD_DELETE,     /* 16 */
4643         SDDL_READ_CONTROL,
4644         SDDL_WRITE_DAC,
4645         SDDL_WRITE_OWNER,
4646         NULL,                     /* 20 */
4647         NULL,
4648         NULL,
4649         NULL,
4650         NULL,                     /* 24 */
4651         NULL,
4652         NULL,
4653         NULL,
4654         SDDL_GENERIC_ALL,         /* 28 */
4655         SDDL_GENERIC_EXECUTE,
4656         SDDL_GENERIC_WRITE,
4657         SDDL_GENERIC_READ
4658 };
4659
4660 static void DumpRights(DWORD mask, WCHAR **pwptr, ULONG *plen)
4661 {
4662     static const WCHAR fmtW[] = {'0','x','%','x',0};
4663     WCHAR buf[15];
4664     size_t i;
4665
4666     if (mask == 0)
4667         return;
4668
4669     /* first check if the right have name */
4670     for (i = 0; i < sizeof(AceRights)/sizeof(AceRights[0]); i++)
4671     {
4672         if (AceRights[i].wstr == NULL)
4673             break;
4674         if (mask == AceRights[i].value)
4675         {
4676             DumpString(AceRights[i].wstr, -1, pwptr, plen);
4677             return;
4678         }
4679     }
4680
4681     /* then check if it can be built from bit names */
4682     for (i = 0; i < 32; i++)
4683     {
4684         if ((mask & (1 << i)) && (AceRightBitNames[i] == NULL))
4685         {
4686             /* can't be built from bit names */
4687             sprintfW(buf, fmtW, mask);
4688             DumpString(buf, -1, pwptr, plen);
4689             return;
4690         }
4691     }
4692
4693     /* build from bit names */
4694     for (i = 0; i < 32; i++)
4695         if (mask & (1 << i))
4696             DumpString(AceRightBitNames[i], -1, pwptr, plen);
4697 }
4698
4699 static BOOL DumpAce(LPVOID pace, WCHAR **pwptr, ULONG *plen)
4700 {
4701     ACCESS_ALLOWED_ACE *piace; /* all the supported ACEs have the same memory layout */
4702     static const WCHAR openbr = '(';
4703     static const WCHAR closebr = ')';
4704     static const WCHAR semicolon = ';';
4705
4706     if (((PACE_HEADER)pace)->AceType > SYSTEM_ALARM_ACE_TYPE || ((PACE_HEADER)pace)->AceSize < sizeof(ACCESS_ALLOWED_ACE))
4707     {
4708         SetLastError(ERROR_INVALID_ACL);
4709         return FALSE;
4710     }
4711
4712     piace = pace;
4713     DumpString(&openbr, 1, pwptr, plen);
4714     switch (piace->Header.AceType)
4715     {
4716         case ACCESS_ALLOWED_ACE_TYPE:
4717             DumpString(SDDL_ACCESS_ALLOWED, -1, pwptr, plen);
4718             break;
4719         case ACCESS_DENIED_ACE_TYPE:
4720             DumpString(SDDL_ACCESS_DENIED, -1, pwptr, plen);
4721             break;
4722         case SYSTEM_AUDIT_ACE_TYPE:
4723             DumpString(SDDL_AUDIT, -1, pwptr, plen);
4724             break;
4725         case SYSTEM_ALARM_ACE_TYPE:
4726             DumpString(SDDL_ALARM, -1, pwptr, plen);
4727             break;
4728     }
4729     DumpString(&semicolon, 1, pwptr, plen);
4730
4731     if (piace->Header.AceFlags & OBJECT_INHERIT_ACE)
4732         DumpString(SDDL_OBJECT_INHERIT, -1, pwptr, plen);
4733     if (piace->Header.AceFlags & CONTAINER_INHERIT_ACE)
4734         DumpString(SDDL_CONTAINER_INHERIT, -1, pwptr, plen);
4735     if (piace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE)
4736         DumpString(SDDL_NO_PROPAGATE, -1, pwptr, plen);
4737     if (piace->Header.AceFlags & INHERIT_ONLY_ACE)
4738         DumpString(SDDL_INHERIT_ONLY, -1, pwptr, plen);
4739     if (piace->Header.AceFlags & INHERITED_ACE)
4740         DumpString(SDDL_INHERITED, -1, pwptr, plen);
4741     if (piace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG)
4742         DumpString(SDDL_AUDIT_SUCCESS, -1, pwptr, plen);
4743     if (piace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG)
4744         DumpString(SDDL_AUDIT_FAILURE, -1, pwptr, plen);
4745     DumpString(&semicolon, 1, pwptr, plen);
4746     DumpRights(piace->Mask, pwptr, plen);
4747     DumpString(&semicolon, 1, pwptr, plen);
4748     /* objects not supported */
4749     DumpString(&semicolon, 1, pwptr, plen);
4750     /* objects not supported */
4751     DumpString(&semicolon, 1, pwptr, plen);
4752     if (!DumpSid(&piace->SidStart, pwptr, plen))
4753         return FALSE;
4754     DumpString(&closebr, 1, pwptr, plen);
4755     return TRUE;
4756 }
4757
4758 static BOOL DumpAcl(PACL pacl, WCHAR **pwptr, ULONG *plen, BOOL protected, BOOL autoInheritReq, BOOL autoInherited)
4759 {
4760     WORD count;
4761     int i;
4762
4763     if (protected)
4764         DumpString(SDDL_PROTECTED, -1, pwptr, plen);
4765     if (autoInheritReq)
4766         DumpString(SDDL_AUTO_INHERIT_REQ, -1, pwptr, plen);
4767     if (autoInherited)
4768         DumpString(SDDL_AUTO_INHERITED, -1, pwptr, plen);
4769
4770     if (pacl == NULL)
4771         return TRUE;
4772
4773     if (!IsValidAcl(pacl))
4774         return FALSE;
4775
4776     count = pacl->AceCount;
4777     for (i = 0; i < count; i++)
4778     {
4779         LPVOID ace;
4780         if (!GetAce(pacl, i, &ace))
4781             return FALSE;
4782         if (!DumpAce(ace, pwptr, plen))
4783             return FALSE;
4784     }
4785
4786     return TRUE;
4787 }
4788
4789 static BOOL DumpOwner(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4790 {
4791     static const WCHAR prefix[] = {'O',':',0};
4792     BOOL bDefaulted;
4793     PSID psid;
4794
4795     if (!GetSecurityDescriptorOwner(SecurityDescriptor, &psid, &bDefaulted))
4796         return FALSE;
4797
4798     if (psid == NULL)
4799         return TRUE;
4800
4801     DumpString(prefix, -1, pwptr, plen);
4802     if (!DumpSid(psid, pwptr, plen))
4803         return FALSE;
4804     return TRUE;
4805 }
4806
4807 static BOOL DumpGroup(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4808 {
4809     static const WCHAR prefix[] = {'G',':',0};
4810     BOOL bDefaulted;
4811     PSID psid;
4812
4813     if (!GetSecurityDescriptorGroup(SecurityDescriptor, &psid, &bDefaulted))
4814         return FALSE;
4815
4816     if (psid == NULL)
4817         return TRUE;
4818
4819     DumpString(prefix, -1, pwptr, plen);
4820     if (!DumpSid(psid, pwptr, plen))
4821         return FALSE;
4822     return TRUE;
4823 }
4824
4825 static BOOL DumpDacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4826 {
4827     static const WCHAR dacl[] = {'D',':',0};
4828     SECURITY_DESCRIPTOR_CONTROL control;
4829     BOOL present, defaulted;
4830     DWORD revision;
4831     PACL pacl;
4832
4833     if (!GetSecurityDescriptorDacl(SecurityDescriptor, &present, &pacl, &defaulted))
4834         return FALSE;
4835
4836     if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
4837         return FALSE;
4838
4839     if (!present)
4840         return TRUE;
4841
4842     DumpString(dacl, 2, pwptr, plen);
4843     if (!DumpAcl(pacl, pwptr, plen, control & SE_DACL_PROTECTED, control & SE_DACL_AUTO_INHERIT_REQ, control & SE_DACL_AUTO_INHERITED))
4844         return FALSE;
4845     return TRUE;
4846 }
4847
4848 static BOOL DumpSacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4849 {
4850     static const WCHAR sacl[] = {'S',':',0};
4851     SECURITY_DESCRIPTOR_CONTROL control;
4852     BOOL present, defaulted;
4853     DWORD revision;
4854     PACL pacl;
4855
4856     if (!GetSecurityDescriptorSacl(SecurityDescriptor, &present, &pacl, &defaulted))
4857         return FALSE;
4858
4859     if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
4860         return FALSE;
4861
4862     if (!present)
4863         return TRUE;
4864
4865     DumpString(sacl, 2, pwptr, plen);
4866     if (!DumpAcl(pacl, pwptr, plen, control & SE_SACL_PROTECTED, control & SE_SACL_AUTO_INHERIT_REQ, control & SE_SACL_AUTO_INHERITED))
4867         return FALSE;
4868     return TRUE;
4869 }
4870
4871 /******************************************************************************
4872  * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
4873  */
4874 BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorW(PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION RequestedInformation, LPWSTR *OutputString, PULONG OutputLen)
4875 {
4876     ULONG len;
4877     WCHAR *wptr, *wstr;
4878
4879     if (SDRevision != SDDL_REVISION_1)
4880     {
4881         ERR("Pogram requested unknown SDDL revision %d\n", SDRevision);
4882         SetLastError(ERROR_UNKNOWN_REVISION);
4883         return FALSE;
4884     }
4885
4886     len = 0;
4887     if (RequestedInformation & OWNER_SECURITY_INFORMATION)
4888         if (!DumpOwner(SecurityDescriptor, NULL, &len))
4889             return FALSE;
4890     if (RequestedInformation & GROUP_SECURITY_INFORMATION)
4891         if (!DumpGroup(SecurityDescriptor, NULL, &len))
4892             return FALSE;
4893     if (RequestedInformation & DACL_SECURITY_INFORMATION)
4894         if (!DumpDacl(SecurityDescriptor, NULL, &len))
4895             return FALSE;
4896     if (RequestedInformation & SACL_SECURITY_INFORMATION)
4897         if (!DumpSacl(SecurityDescriptor, NULL, &len))
4898             return FALSE;
4899
4900     wstr = wptr = LocalAlloc(0, (len + 1)*sizeof(WCHAR));
4901     if (RequestedInformation & OWNER_SECURITY_INFORMATION)
4902         if (!DumpOwner(SecurityDescriptor, &wptr, NULL)) {
4903             LocalFree (wstr);
4904             return FALSE;
4905         }
4906     if (RequestedInformation & GROUP_SECURITY_INFORMATION)
4907         if (!DumpGroup(SecurityDescriptor, &wptr, NULL)) {
4908             LocalFree (wstr);
4909             return FALSE;
4910         }
4911     if (RequestedInformation & DACL_SECURITY_INFORMATION)
4912         if (!DumpDacl(SecurityDescriptor, &wptr, NULL)) {
4913             LocalFree (wstr);
4914             return FALSE;
4915         }
4916     if (RequestedInformation & SACL_SECURITY_INFORMATION)
4917         if (!DumpSacl(SecurityDescriptor, &wptr, NULL)) {
4918             LocalFree (wstr);
4919             return FALSE;
4920         }
4921     *wptr = 0;
4922
4923     TRACE("ret: %s, %d\n", wine_dbgstr_w(wstr), len);
4924     *OutputString = wstr;
4925     if (OutputLen)
4926         *OutputLen = strlenW(*OutputString)+1;
4927     return TRUE;
4928 }
4929
4930 /******************************************************************************
4931  * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
4932  */
4933 BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorA(PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION Information, LPSTR *OutputString, PULONG OutputLen)
4934 {
4935     LPWSTR wstr;
4936     ULONG len;
4937     if (ConvertSecurityDescriptorToStringSecurityDescriptorW(SecurityDescriptor, SDRevision, Information, &wstr, &len))
4938     {
4939         int lenA;
4940
4941         lenA = WideCharToMultiByte(CP_ACP, 0, wstr, len, NULL, 0, NULL, NULL);
4942         *OutputString = HeapAlloc(GetProcessHeap(), 0, lenA);
4943         WideCharToMultiByte(CP_ACP, 0, wstr, len, *OutputString, lenA, NULL, NULL);
4944         LocalFree(wstr);
4945
4946         if (OutputLen != NULL)
4947             *OutputLen = lenA;
4948         return TRUE;
4949     }
4950     else
4951     {
4952         *OutputString = NULL;
4953         if (OutputLen)
4954             *OutputLen = 0;
4955         return FALSE;
4956     }
4957 }
4958
4959 /******************************************************************************
4960  * ConvertStringSidToSidW [ADVAPI32.@]
4961  */
4962 BOOL WINAPI ConvertStringSidToSidW(LPCWSTR StringSid, PSID* Sid)
4963 {
4964     BOOL bret = FALSE;
4965     DWORD cBytes;
4966
4967     TRACE("%s, %p\n", debugstr_w(StringSid), Sid);
4968     if (GetVersion() & 0x80000000)
4969         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4970     else if (!StringSid || !Sid)
4971         SetLastError(ERROR_INVALID_PARAMETER);
4972     else if (ParseStringSidToSid(StringSid, NULL, &cBytes))
4973     {
4974         PSID pSid = *Sid = LocalAlloc(0, cBytes);
4975
4976         bret = ParseStringSidToSid(StringSid, pSid, &cBytes);
4977         if (!bret)
4978             LocalFree(*Sid);
4979     }
4980     return bret;
4981 }
4982
4983 /******************************************************************************
4984  * ConvertStringSidToSidA [ADVAPI32.@]
4985  */
4986 BOOL WINAPI ConvertStringSidToSidA(LPCSTR StringSid, PSID* Sid)
4987 {
4988     BOOL bret = FALSE;
4989
4990     TRACE("%s, %p\n", debugstr_a(StringSid), Sid);
4991     if (GetVersion() & 0x80000000)
4992         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4993     else if (!StringSid || !Sid)
4994         SetLastError(ERROR_INVALID_PARAMETER);
4995     else
4996     {
4997         WCHAR *wStringSid = SERV_dup(StringSid);
4998         bret = ConvertStringSidToSidW(wStringSid, Sid);
4999         HeapFree(GetProcessHeap(), 0, wStringSid);
5000     }
5001     return bret;
5002 }
5003
5004 /******************************************************************************
5005  * ConvertSidToStringSidW [ADVAPI32.@]
5006  *
5007  *  format of SID string is:
5008  *    S-<count>-<auth>-<subauth1>-<subauth2>-<subauth3>...
5009  *  where
5010  *    <rev> is the revision of the SID encoded as decimal
5011  *    <auth> is the identifier authority encoded as hex
5012  *    <subauthN> is the subauthority id encoded as decimal
5013  */
5014 BOOL WINAPI ConvertSidToStringSidW( PSID pSid, LPWSTR *pstr )
5015 {
5016     DWORD len = 0;
5017     LPWSTR wstr, wptr;
5018
5019     TRACE("%p %p\n", pSid, pstr );
5020
5021     len = 0;
5022     if (!DumpSidNumeric(pSid, NULL, &len))
5023         return FALSE;
5024     wstr = wptr = LocalAlloc(0, (len+1) * sizeof(WCHAR));
5025     DumpSidNumeric(pSid, &wptr, NULL);
5026     *wptr = 0;
5027
5028     *pstr = wstr;
5029     return TRUE;
5030 }
5031
5032 /******************************************************************************
5033  * ConvertSidToStringSidA [ADVAPI32.@]
5034  */
5035 BOOL WINAPI ConvertSidToStringSidA(PSID pSid, LPSTR *pstr)
5036 {
5037     LPWSTR wstr = NULL;
5038     LPSTR str;
5039     UINT len;
5040
5041     TRACE("%p %p\n", pSid, pstr );
5042
5043     if( !ConvertSidToStringSidW( pSid, &wstr ) )
5044         return FALSE;
5045
5046     len = WideCharToMultiByte( CP_ACP, 0, wstr, -1, NULL, 0, NULL, NULL );
5047     str = LocalAlloc( 0, len );
5048     WideCharToMultiByte( CP_ACP, 0, wstr, -1, str, len, NULL, NULL );
5049     LocalFree( wstr );
5050
5051     *pstr = str;
5052
5053     return TRUE;
5054 }
5055
5056 BOOL WINAPI ConvertToAutoInheritPrivateObjectSecurity(
5057         PSECURITY_DESCRIPTOR pdesc,
5058         PSECURITY_DESCRIPTOR cdesc,
5059         PSECURITY_DESCRIPTOR* ndesc,
5060         GUID* objtype,
5061         BOOL isdir,
5062         PGENERIC_MAPPING genmap )
5063 {
5064     FIXME("%p %p %p %p %d %p - stub\n", pdesc, cdesc, ndesc, objtype, isdir, genmap);
5065
5066     return FALSE;
5067 }
5068
5069 BOOL WINAPI CreatePrivateObjectSecurity(
5070         PSECURITY_DESCRIPTOR ParentDescriptor,
5071         PSECURITY_DESCRIPTOR CreatorDescriptor,
5072         PSECURITY_DESCRIPTOR* NewDescriptor,
5073         BOOL IsDirectoryObject,
5074         HANDLE Token,
5075         PGENERIC_MAPPING GenericMapping )
5076 {
5077     SECURITY_DESCRIPTOR_RELATIVE *relative;
5078     DWORD needed, offset;
5079     BYTE *buffer;
5080
5081     FIXME("%p %p %p %d %p %p - returns fake SECURITY_DESCRIPTOR\n", ParentDescriptor,
5082           CreatorDescriptor, NewDescriptor, IsDirectoryObject, Token, GenericMapping);
5083
5084     needed = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5085     needed += sizeof(sidWorld);
5086     needed += sizeof(sidWorld);
5087     needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5088     needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5089
5090     if (!(buffer = HeapAlloc( GetProcessHeap(), 0, needed ))) return FALSE;
5091     relative = (SECURITY_DESCRIPTOR_RELATIVE *)buffer;
5092     if (!InitializeSecurityDescriptor( relative, SECURITY_DESCRIPTOR_REVISION ))
5093     {
5094         HeapFree( GetProcessHeap(), 0, buffer );
5095         return FALSE;
5096     }
5097     relative->Control |= SE_SELF_RELATIVE;
5098     offset = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5099
5100     memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5101     relative->Owner = offset;
5102     offset += sizeof(sidWorld);
5103
5104     memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5105     relative->Group = offset;
5106     offset += sizeof(sidWorld);
5107
5108     GetWorldAccessACL( (ACL *)(buffer + offset) );
5109     relative->Dacl = offset;
5110     offset += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5111
5112     GetWorldAccessACL( (ACL *)(buffer + offset) );
5113     relative->Sacl = offset;
5114
5115     *NewDescriptor = relative;
5116     return TRUE;
5117 }
5118
5119 BOOL WINAPI DestroyPrivateObjectSecurity( PSECURITY_DESCRIPTOR* ObjectDescriptor )
5120 {
5121     FIXME("%p - stub\n", ObjectDescriptor);
5122
5123     HeapFree( GetProcessHeap(), 0, *ObjectDescriptor );
5124     return TRUE;
5125 }
5126
5127 BOOL WINAPI CreateProcessAsUserA(
5128         HANDLE hToken,
5129         LPCSTR lpApplicationName,
5130         LPSTR lpCommandLine,
5131         LPSECURITY_ATTRIBUTES lpProcessAttributes,
5132         LPSECURITY_ATTRIBUTES lpThreadAttributes,
5133         BOOL bInheritHandles,
5134         DWORD dwCreationFlags,
5135         LPVOID lpEnvironment,
5136         LPCSTR lpCurrentDirectory,
5137         LPSTARTUPINFOA lpStartupInfo,
5138         LPPROCESS_INFORMATION lpProcessInformation )
5139 {
5140     BOOL ret;
5141     WCHAR *appW, *cmdlnW, *cwdW;
5142     STARTUPINFOW sinfo;
5143
5144     TRACE("%p %s %s %p %p %d 0x%08x %p %s %p %p\n", hToken, debugstr_a(lpApplicationName),
5145           debugstr_a(lpCommandLine), lpProcessAttributes, lpThreadAttributes, bInheritHandles,
5146           dwCreationFlags, lpEnvironment, debugstr_a(lpCurrentDirectory), lpStartupInfo, lpProcessInformation);
5147
5148     appW = SERV_dup(lpApplicationName);
5149     cmdlnW = SERV_dup(lpCommandLine);
5150     cwdW = SERV_dup(lpCurrentDirectory);
5151     sinfo.cb = sizeof(sinfo);
5152     sinfo.lpReserved = SERV_dup(lpStartupInfo->lpReserved);
5153     sinfo.lpDesktop = SERV_dup(lpStartupInfo->lpDesktop);
5154     sinfo.lpTitle = SERV_dup(lpStartupInfo->lpTitle);
5155     sinfo.dwX = lpStartupInfo->dwX;
5156     sinfo.dwY = lpStartupInfo->dwY;
5157     sinfo.dwXSize = lpStartupInfo->dwXSize;
5158     sinfo.dwYSize = lpStartupInfo->dwYSize;
5159     sinfo.dwXCountChars = lpStartupInfo->dwXCountChars;
5160     sinfo.dwYCountChars = lpStartupInfo->dwYCountChars;
5161     sinfo.dwFillAttribute = lpStartupInfo->dwFillAttribute;
5162     sinfo.dwFlags = lpStartupInfo->dwFlags;
5163     sinfo.wShowWindow = lpStartupInfo->wShowWindow;
5164     sinfo.cbReserved2 = lpStartupInfo->cbReserved2;
5165     sinfo.lpReserved2 = lpStartupInfo->lpReserved2;
5166     sinfo.hStdInput = lpStartupInfo->hStdInput;
5167     sinfo.hStdOutput = lpStartupInfo->hStdOutput;
5168     sinfo.hStdError = lpStartupInfo->hStdError;
5169     ret = CreateProcessAsUserW(hToken, appW, cmdlnW, lpProcessAttributes,
5170             lpThreadAttributes, bInheritHandles, dwCreationFlags,
5171             lpEnvironment, cwdW, &sinfo, lpProcessInformation);
5172     HeapFree(GetProcessHeap(), 0, appW);
5173     HeapFree(GetProcessHeap(), 0, cmdlnW);
5174     HeapFree(GetProcessHeap(), 0, cwdW);
5175     HeapFree(GetProcessHeap(), 0, sinfo.lpReserved);
5176     HeapFree(GetProcessHeap(), 0, sinfo.lpDesktop);
5177     HeapFree(GetProcessHeap(), 0, sinfo.lpTitle);
5178
5179     return ret;
5180 }
5181
5182 BOOL WINAPI CreateProcessAsUserW(
5183         HANDLE hToken,
5184         LPCWSTR lpApplicationName,
5185         LPWSTR lpCommandLine,
5186         LPSECURITY_ATTRIBUTES lpProcessAttributes,
5187         LPSECURITY_ATTRIBUTES lpThreadAttributes,
5188         BOOL bInheritHandles,
5189         DWORD dwCreationFlags,
5190         LPVOID lpEnvironment,
5191         LPCWSTR lpCurrentDirectory,
5192         LPSTARTUPINFOW lpStartupInfo,
5193         LPPROCESS_INFORMATION lpProcessInformation )
5194 {
5195     FIXME("%p %s %s %p %p %d 0x%08x %p %s %p %p - semi- stub\n", hToken,
5196           debugstr_w(lpApplicationName), debugstr_w(lpCommandLine), lpProcessAttributes,
5197           lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment,
5198           debugstr_w(lpCurrentDirectory), lpStartupInfo, lpProcessInformation);
5199
5200     /* We should create the process with a suspended main thread */
5201     if (!CreateProcessW (lpApplicationName,
5202                          lpCommandLine,
5203                          lpProcessAttributes,
5204                          lpThreadAttributes,
5205                          bInheritHandles,
5206                          dwCreationFlags, /* CREATE_SUSPENDED */
5207                          lpEnvironment,
5208                          lpCurrentDirectory,
5209                          lpStartupInfo,
5210                          lpProcessInformation))
5211     {
5212       return FALSE;
5213     }
5214
5215     return TRUE;
5216 }
5217
5218 /******************************************************************************
5219  * CreateProcessWithLogonW
5220  */
5221 BOOL WINAPI CreateProcessWithLogonW( LPCWSTR lpUsername, LPCWSTR lpDomain, LPCWSTR lpPassword, DWORD dwLogonFlags,
5222     LPCWSTR lpApplicationName, LPWSTR lpCommandLine, DWORD dwCreationFlags, LPVOID lpEnvironment,
5223     LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation )
5224 {
5225     FIXME("%s %s %s 0x%08x %s %s 0x%08x %p %s %p %p stub\n", debugstr_w(lpUsername), debugstr_w(lpDomain),
5226     debugstr_w(lpPassword), dwLogonFlags, debugstr_w(lpApplicationName),
5227     debugstr_w(lpCommandLine), dwCreationFlags, lpEnvironment, debugstr_w(lpCurrentDirectory),
5228     lpStartupInfo, lpProcessInformation);
5229
5230     return FALSE;
5231 }
5232
5233 /******************************************************************************
5234  * DuplicateTokenEx [ADVAPI32.@]
5235  */
5236 BOOL WINAPI DuplicateTokenEx(
5237         HANDLE ExistingTokenHandle, DWORD dwDesiredAccess,
5238         LPSECURITY_ATTRIBUTES lpTokenAttributes,
5239         SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5240         TOKEN_TYPE TokenType,
5241         PHANDLE DuplicateTokenHandle )
5242 {
5243     OBJECT_ATTRIBUTES ObjectAttributes;
5244
5245     TRACE("%p 0x%08x 0x%08x 0x%08x %p\n", ExistingTokenHandle, dwDesiredAccess,
5246           ImpersonationLevel, TokenType, DuplicateTokenHandle);
5247
5248     InitializeObjectAttributes(
5249         &ObjectAttributes,
5250         NULL,
5251         (lpTokenAttributes && lpTokenAttributes->bInheritHandle) ? OBJ_INHERIT : 0,
5252         NULL,
5253         lpTokenAttributes ? lpTokenAttributes->lpSecurityDescriptor : NULL );
5254
5255     return set_ntstatus( NtDuplicateToken( ExistingTokenHandle,
5256                                            dwDesiredAccess,
5257                                            &ObjectAttributes,
5258                                            ImpersonationLevel,
5259                                            TokenType,
5260                                            DuplicateTokenHandle ) );
5261 }
5262
5263 BOOL WINAPI DuplicateToken(
5264         HANDLE ExistingTokenHandle,
5265         SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5266         PHANDLE DuplicateTokenHandle )
5267 {
5268     return DuplicateTokenEx( ExistingTokenHandle, TOKEN_IMPERSONATE | TOKEN_QUERY,
5269                              NULL, ImpersonationLevel, TokenImpersonation,
5270                              DuplicateTokenHandle );
5271 }
5272
5273 /******************************************************************************
5274  * ComputeStringSidSize
5275  */
5276 static DWORD ComputeStringSidSize(LPCWSTR StringSid)
5277 {
5278     if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I(-S)+ */
5279     {
5280         int ctok = 0;
5281         while (*StringSid)
5282         {
5283             if (*StringSid == '-')
5284                 ctok++;
5285             StringSid++;
5286         }
5287
5288         if (ctok >= 3)
5289             return GetSidLengthRequired(ctok - 2);
5290     }
5291     else /* String constant format  - Only available in winxp and above */
5292     {
5293         unsigned int i;
5294
5295         for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
5296             if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
5297                 return GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
5298
5299         for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
5300             if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
5301             {
5302                 MAX_SID local;
5303                 ADVAPI_GetComputerSid(&local);
5304                 return GetSidLengthRequired(*GetSidSubAuthorityCount(&local) + 1);
5305             }
5306
5307     }
5308
5309     return GetSidLengthRequired(0);
5310 }
5311
5312 /******************************************************************************
5313  * ParseStringSidToSid
5314  */
5315 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes)
5316 {
5317     BOOL bret = FALSE;
5318     SID* pisid=pSid;
5319
5320     TRACE("%s, %p, %p\n", debugstr_w(StringSid), pSid, cBytes);
5321     if (!StringSid)
5322     {
5323         SetLastError(ERROR_INVALID_PARAMETER);
5324         TRACE("StringSid is NULL, returning FALSE\n");
5325         return FALSE;
5326     }
5327
5328     while (*StringSid == ' ')
5329         StringSid++;
5330
5331     *cBytes = ComputeStringSidSize(StringSid);
5332     if (!pisid) /* Simply compute the size */
5333     {
5334         TRACE("only size requested, returning TRUE with %d\n", *cBytes);
5335         return TRUE;
5336     }
5337
5338     if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I-S-S */
5339     {
5340         DWORD i = 0, identAuth;
5341         DWORD csubauth = ((*cBytes - GetSidLengthRequired(0)) / sizeof(DWORD));
5342
5343         StringSid += 2; /* Advance to Revision */
5344         pisid->Revision = atoiW(StringSid);
5345
5346         if (pisid->Revision != SDDL_REVISION)
5347         {
5348             TRACE("Revision %d is unknown\n", pisid->Revision);
5349             goto lend; /* ERROR_INVALID_SID */
5350         }
5351         if (csubauth == 0)
5352         {
5353             TRACE("SubAuthorityCount is 0\n");
5354             goto lend; /* ERROR_INVALID_SID */
5355         }
5356
5357         pisid->SubAuthorityCount = csubauth;
5358
5359         /* Advance to identifier authority */
5360         while (*StringSid && *StringSid != '-')
5361             StringSid++;
5362         if (*StringSid == '-')
5363             StringSid++;
5364
5365         /* MS' implementation can't handle values greater than 2^32 - 1, so
5366          * we don't either; assume most significant bytes are always 0
5367          */
5368         pisid->IdentifierAuthority.Value[0] = 0;
5369         pisid->IdentifierAuthority.Value[1] = 0;
5370         identAuth = atoiW(StringSid);
5371         pisid->IdentifierAuthority.Value[5] = identAuth & 0xff;
5372         pisid->IdentifierAuthority.Value[4] = (identAuth & 0xff00) >> 8;
5373         pisid->IdentifierAuthority.Value[3] = (identAuth & 0xff0000) >> 16;
5374         pisid->IdentifierAuthority.Value[2] = (identAuth & 0xff000000) >> 24;
5375
5376         /* Advance to first sub authority */
5377         while (*StringSid && *StringSid != '-')
5378             StringSid++;
5379         if (*StringSid == '-')
5380             StringSid++;
5381
5382         while (*StringSid)
5383         {
5384             pisid->SubAuthority[i++] = atoiW(StringSid);
5385
5386             while (*StringSid && *StringSid != '-')
5387                 StringSid++;
5388             if (*StringSid == '-')
5389                 StringSid++;
5390         }
5391
5392         if (i != pisid->SubAuthorityCount)
5393             goto lend; /* ERROR_INVALID_SID */
5394
5395         bret = TRUE;
5396     }
5397     else /* String constant format  - Only available in winxp and above */
5398     {
5399         unsigned int i;
5400         pisid->Revision = SDDL_REVISION;
5401
5402         for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
5403             if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
5404             {
5405                 DWORD j;
5406                 pisid->SubAuthorityCount = WellKnownSids[i].Sid.SubAuthorityCount;
5407                 pisid->IdentifierAuthority = WellKnownSids[i].Sid.IdentifierAuthority;
5408                 for (j = 0; j < WellKnownSids[i].Sid.SubAuthorityCount; j++)
5409                     pisid->SubAuthority[j] = WellKnownSids[i].Sid.SubAuthority[j];
5410                 bret = TRUE;
5411             }
5412
5413         for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
5414             if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
5415             {
5416                 ADVAPI_GetComputerSid(pisid);
5417                 pisid->SubAuthority[pisid->SubAuthorityCount] = WellKnownRids[i].Rid;
5418                 pisid->SubAuthorityCount++;
5419                 bret = TRUE;
5420             }
5421
5422         if (!bret)
5423             FIXME("String constant not supported: %s\n", debugstr_wn(StringSid, 2));
5424     }
5425
5426 lend:
5427     if (!bret)
5428         SetLastError(ERROR_INVALID_SID);
5429
5430     TRACE("returning %s\n", bret ? "TRUE" : "FALSE");
5431     return bret;
5432 }
5433
5434 /******************************************************************************
5435  * GetNamedSecurityInfoA [ADVAPI32.@]
5436  */
5437 DWORD WINAPI GetNamedSecurityInfoA(LPSTR pObjectName,
5438         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
5439         PSID* ppsidOwner, PSID* ppsidGroup, PACL* ppDacl, PACL* ppSacl,
5440         PSECURITY_DESCRIPTOR* ppSecurityDescriptor)
5441 {
5442     LPWSTR wstr;
5443     DWORD r;
5444
5445     TRACE("%s %d %d %p %p %p %p %p\n", pObjectName, ObjectType, SecurityInfo,
5446         ppsidOwner, ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor);
5447
5448     wstr = SERV_dup(pObjectName);
5449     r = GetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, ppsidOwner,
5450                            ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor );
5451
5452     HeapFree( GetProcessHeap(), 0, wstr );
5453
5454     return r;
5455 }
5456
5457 /******************************************************************************
5458  * GetNamedSecurityInfoW [ADVAPI32.@]
5459  */
5460 DWORD WINAPI GetNamedSecurityInfoW( LPWSTR name, SE_OBJECT_TYPE type,
5461     SECURITY_INFORMATION info, PSID* owner, PSID* group, PACL* dacl,
5462     PACL* sacl, PSECURITY_DESCRIPTOR* descriptor )
5463 {
5464     OBJECT_ATTRIBUTES attr;
5465     UNICODE_STRING nameW;
5466     IO_STATUS_BLOCK io;
5467     DWORD access = 0;
5468     HANDLE hFile;
5469     DWORD status;
5470
5471     TRACE( "%s %d %d %p %p %p %p %p\n", debugstr_w(name), type, info, owner,
5472            group, dacl, sacl, descriptor );
5473     if (type != SE_FILE_OBJECT)
5474     {
5475         FIXME( "Object type %d is not currently supported.\n", type );
5476         if (owner) *owner = NULL;
5477         if (group) *group = NULL;
5478         if (dacl) *dacl = NULL;
5479         if (sacl) *sacl = NULL;
5480         if (descriptor) *descriptor = NULL;
5481         return ERROR_SUCCESS;
5482     }
5483
5484     /* A NULL descriptor is allowed if any one of the other pointers is not NULL */
5485     if (!name || !(owner||group||dacl||sacl||descriptor) ) return ERROR_INVALID_PARAMETER;
5486
5487     /* If no descriptor, we have to check that there's a pointer for the requested information */
5488     if( !descriptor && (
5489         ((info & OWNER_SECURITY_INFORMATION) && !owner)
5490     ||  ((info & GROUP_SECURITY_INFORMATION) && !group)
5491     ||  ((info & DACL_SECURITY_INFORMATION)  && !dacl)
5492     ||  ((info & SACL_SECURITY_INFORMATION)  && !sacl)  ))
5493         return ERROR_INVALID_PARAMETER;
5494     if (!RtlDosPathNameToNtPathName_U( name, &nameW, NULL, NULL ))
5495         return ERROR_PATH_NOT_FOUND;
5496
5497     if (info & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION))
5498         access |= READ_CONTROL;
5499     if (info & SACL_SECURITY_INFORMATION)
5500         access |= ACCESS_SYSTEM_SECURITY;
5501     attr.Length = sizeof(attr);
5502     attr.RootDirectory = 0;
5503     attr.Attributes = OBJ_CASE_INSENSITIVE;
5504     attr.ObjectName = &nameW;
5505     attr.SecurityDescriptor = NULL;
5506
5507     status = NtCreateFile( &hFile, access, &attr, &io, NULL, FILE_FLAG_BACKUP_SEMANTICS,
5508                            FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, FILE_OPEN,
5509                            FILE_OPEN_FOR_BACKUP_INTENT, NULL, 0 );
5510     RtlFreeUnicodeString( &nameW );
5511     if (status != STATUS_SUCCESS)
5512         return RtlNtStatusToDosError( status );
5513     status = GetSecurityInfo( hFile, type, info, owner, group, dacl, sacl, descriptor );
5514     CloseHandle( hFile );
5515     return status;
5516 }
5517
5518 /******************************************************************************
5519  * GetNamedSecurityInfoExW [ADVAPI32.@]
5520  */
5521 DWORD WINAPI GetNamedSecurityInfoExW( LPCWSTR object, SE_OBJECT_TYPE type,
5522     SECURITY_INFORMATION info, LPCWSTR provider, LPCWSTR property,
5523     PACTRL_ACCESSW* access_list, PACTRL_AUDITW* audit_list, LPWSTR* owner, LPWSTR* group )
5524 {
5525     FIXME("(%s, %d, %d, %s, %s, %p, %p, %p, %p) stub\n", debugstr_w(object), type, info,
5526         debugstr_w(provider), debugstr_w(property), access_list, audit_list, owner, group);
5527     return ERROR_CALL_NOT_IMPLEMENTED;
5528 }
5529
5530 /******************************************************************************
5531  * GetNamedSecurityInfoExA [ADVAPI32.@]
5532  */
5533 DWORD WINAPI GetNamedSecurityInfoExA( LPCSTR object, SE_OBJECT_TYPE type,
5534     SECURITY_INFORMATION info, LPCSTR provider, LPCSTR property,
5535     PACTRL_ACCESSA* access_list, PACTRL_AUDITA* audit_list, LPSTR* owner, LPSTR* group )
5536 {
5537     FIXME("(%s, %d, %d, %s, %s, %p, %p, %p, %p) stub\n", debugstr_a(object), type, info,
5538         debugstr_a(provider), debugstr_a(property), access_list, audit_list, owner, group);
5539     return ERROR_CALL_NOT_IMPLEMENTED;
5540 }
5541
5542 /******************************************************************************
5543  * DecryptFileW [ADVAPI32.@]
5544  */
5545 BOOL WINAPI DecryptFileW(LPCWSTR lpFileName, DWORD dwReserved)
5546 {
5547     FIXME("%s %08x\n", debugstr_w(lpFileName), dwReserved);
5548     return TRUE;
5549 }
5550
5551 /******************************************************************************
5552  * DecryptFileA [ADVAPI32.@]
5553  */
5554 BOOL WINAPI DecryptFileA(LPCSTR lpFileName, DWORD dwReserved)
5555 {
5556     FIXME("%s %08x\n", debugstr_a(lpFileName), dwReserved);
5557     return TRUE;
5558 }
5559
5560 /******************************************************************************
5561  * EncryptFileW [ADVAPI32.@]
5562  */
5563 BOOL WINAPI EncryptFileW(LPCWSTR lpFileName)
5564 {
5565     FIXME("%s\n", debugstr_w(lpFileName));
5566     return TRUE;
5567 }
5568
5569 /******************************************************************************
5570  * EncryptFileA [ADVAPI32.@]
5571  */
5572 BOOL WINAPI EncryptFileA(LPCSTR lpFileName)
5573 {
5574     FIXME("%s\n", debugstr_a(lpFileName));
5575     return TRUE;
5576 }
5577
5578 /******************************************************************************
5579  * FileEncryptionStatusW [ADVAPI32.@]
5580  */
5581 BOOL WINAPI FileEncryptionStatusW(LPCWSTR lpFileName, LPDWORD lpStatus)
5582 {
5583     FIXME("(%s %p): stub\n", debugstr_w(lpFileName), lpStatus);
5584     if (!lpStatus)
5585         return FALSE;
5586     *lpStatus = FILE_SYSTEM_NOT_SUPPORT;
5587     return TRUE;
5588 }
5589
5590 /******************************************************************************
5591  * FileEncryptionStatusA [ADVAPI32.@]
5592  */
5593 BOOL WINAPI FileEncryptionStatusA(LPCSTR lpFileName, LPDWORD lpStatus)
5594 {
5595     FIXME("(%s %p): stub\n", debugstr_a(lpFileName), lpStatus);
5596     if (!lpStatus)
5597         return FALSE;
5598     *lpStatus = FILE_SYSTEM_NOT_SUPPORT;
5599     return TRUE;
5600 }
5601
5602 /******************************************************************************
5603  * SetSecurityInfo [ADVAPI32.@]
5604  */
5605 DWORD WINAPI SetSecurityInfo(HANDLE handle, SE_OBJECT_TYPE ObjectType,
5606                       SECURITY_INFORMATION SecurityInfo, PSID psidOwner,
5607                       PSID psidGroup, PACL pDacl, PACL pSacl)
5608 {
5609     SECURITY_DESCRIPTOR sd;
5610     NTSTATUS status;
5611
5612     if (!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION))
5613         return ERROR_INVALID_SECURITY_DESCR;
5614
5615     if (SecurityInfo & OWNER_SECURITY_INFORMATION)
5616         SetSecurityDescriptorOwner(&sd, psidOwner, FALSE);
5617     if (SecurityInfo & GROUP_SECURITY_INFORMATION)
5618         SetSecurityDescriptorGroup(&sd, psidGroup, FALSE);
5619     if (SecurityInfo & DACL_SECURITY_INFORMATION)
5620         SetSecurityDescriptorDacl(&sd, TRUE, pDacl, FALSE);
5621     if (SecurityInfo & SACL_SECURITY_INFORMATION)
5622         SetSecurityDescriptorSacl(&sd, TRUE, pSacl, FALSE);
5623
5624     status = NtSetSecurityObject(handle, SecurityInfo, &sd);
5625     return RtlNtStatusToDosError(status);
5626 }
5627
5628 /******************************************************************************
5629  * SaferCreateLevel   [ADVAPI32.@]
5630  */
5631 BOOL WINAPI SaferCreateLevel(DWORD ScopeId, DWORD LevelId, DWORD OpenFlags,
5632                              SAFER_LEVEL_HANDLE* LevelHandle, LPVOID lpReserved)
5633 {
5634     FIXME("(%u, %x, %u, %p, %p) stub\n", ScopeId, LevelId, OpenFlags, LevelHandle, lpReserved);
5635
5636     *LevelHandle = (SAFER_LEVEL_HANDLE)0xdeadbeef;
5637     return TRUE;
5638 }
5639
5640 /******************************************************************************
5641  * SaferComputeTokenFromLevel   [ADVAPI32.@]
5642  */
5643 BOOL WINAPI SaferComputeTokenFromLevel(SAFER_LEVEL_HANDLE handle, HANDLE token, PHANDLE access_token,
5644                                        DWORD flags, LPVOID reserved)
5645 {
5646     FIXME("(%p, %p, %p, %x, %p) stub\n", handle, token, access_token, flags, reserved);
5647
5648     *access_token = (HANDLE)0xdeadbeef;
5649     return TRUE;
5650 }
5651
5652 /******************************************************************************
5653  * SaferCloseLevel   [ADVAPI32.@]
5654  */
5655 BOOL WINAPI SaferCloseLevel(SAFER_LEVEL_HANDLE handle)
5656 {
5657     FIXME("(%p) stub\n", handle);
5658     return TRUE;
5659 }
5660
5661 DWORD WINAPI TreeResetNamedSecurityInfoW( LPWSTR pObjectName,
5662                 SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
5663                 PSID pOwner, PSID pGroup, PACL pDacl, PACL pSacl,
5664                 BOOL KeepExplicit, FN_PROGRESS fnProgress,
5665                 PROG_INVOKE_SETTING ProgressInvokeSetting, PVOID Args)
5666 {
5667     FIXME("(%s, %i, %i, %p, %p, %p, %p, %i, %p, %i, %p  Stub\n",
5668         debugstr_w(pObjectName), ObjectType, SecurityInfo, pOwner, pGroup,
5669         pDacl, pSacl, KeepExplicit, fnProgress, ProgressInvokeSetting, Args);
5670
5671     return ERROR_SUCCESS;
5672 }
5673
5674 /******************************************************************************
5675  * SaferGetPolicyInformation   [ADVAPI32.@]
5676  */
5677 BOOL WINAPI SaferGetPolicyInformation(DWORD scope, SAFER_POLICY_INFO_CLASS class, DWORD size,
5678                                       PVOID buffer, PDWORD required, LPVOID lpReserved)
5679 {
5680     FIXME("(%u %u %u %p %p %p) stub\n", scope, class, size, buffer, required, lpReserved);
5681     return FALSE;
5682 }
5683
5684 /******************************************************************************
5685  * SaferSetLevelInformation   [ADVAPI32.@]
5686  */
5687 BOOL WINAPI SaferSetLevelInformation(SAFER_LEVEL_HANDLE handle, SAFER_OBJECT_INFO_CLASS infotype,
5688                                      LPVOID buffer, DWORD size)
5689 {
5690     FIXME("(%p %u %p %u) stub\n", handle, infotype, buffer, size);
5691     return FALSE;
5692 }