2 * dlls/advapi32/security.c
3 * FIXME: for all functions thunking down to Rtl* functions: implement SetLastError()
12 #include "debugtools.h"
13 #include "winversion.h"
15 DEFAULT_DEBUG_CHANNEL(advapi);
17 #define CallWin32ToNt(func) \
20 if (ret !=STATUS_SUCCESS) \
21 { SetLastError (RtlNtStatusToDosError(ret)); return FALSE; } \
25 static void dumpLsaAttributes( PLSA_OBJECT_ATTRIBUTES oa )
29 TRACE("\n\tlength=%lu, rootdir=0x%08x, objectname=%s\n\tattr=0x%08lx, sid=%p qos=%p\n",
30 oa->Length, oa->RootDirectory,
31 oa->ObjectName?debugstr_w(oa->ObjectName->Buffer):"null",
32 oa->Attributes, oa->SecurityDescriptor, oa->SecurityQualityOfService);
36 /* ##############################
37 ###### TOKEN FUNCTIONS ######
38 ##############################
41 /******************************************************************************
42 * OpenProcessToken [ADVAPI32.109]
43 * Opens the access token associated with a process
46 * ProcessHandle [I] Handle to process
47 * DesiredAccess [I] Desired access to process
48 * TokenHandle [O] Pointer to handle of open access token
53 OpenProcessToken( HANDLE ProcessHandle, DWORD DesiredAccess,
56 CallWin32ToNt(NtOpenProcessToken( ProcessHandle, DesiredAccess, TokenHandle ));
59 /******************************************************************************
60 * OpenThreadToken [ADVAPI32.114]
69 OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess,
70 BOOL OpenAsSelf, HANDLE *TokenHandle)
72 CallWin32ToNt (NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle));
75 /******************************************************************************
76 * AdjustTokenPrivileges [ADVAPI32.10]
80 * DisableAllPrivileges []
87 AdjustTokenPrivileges( HANDLE TokenHandle, BOOL DisableAllPrivileges,
88 LPVOID NewState, DWORD BufferLength,
89 LPVOID PreviousState, LPDWORD ReturnLength )
91 CallWin32ToNt(NtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges, NewState, BufferLength, PreviousState, ReturnLength));
94 /******************************************************************************
95 * GetTokenInformation [ADVAPI32.66]
106 GetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
107 LPVOID tokeninfo, DWORD tokeninfolength, LPDWORD retlen )
109 CallWin32ToNt (NtQueryInformationToken( token, tokeninfoclass, tokeninfo, tokeninfolength, retlen));
112 /*************************************************************************
113 * SetThreadToken [ADVAPI32.231]
115 * Assigns an "impersonation token" to a thread so it can assume the
116 * security privledges of another thread or process. Can also remove
117 * a previously assigned token. Only supported on NT - it's a stub
118 * exactly like this one on Win9X.
122 BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token)
124 FIXME("(%p, %x): stub\n", thread, token);
126 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
131 /* ##############################
132 ###### SID FUNCTIONS ######
133 ##############################
136 /******************************************************************************
137 * AllocateAndInitializeSid [ADVAPI32.11]
140 * pIdentifierAuthority []
141 * nSubAuthorityCount []
153 AllocateAndInitializeSid( PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
154 BYTE nSubAuthorityCount,
155 DWORD nSubAuthority0, DWORD nSubAuthority1,
156 DWORD nSubAuthority2, DWORD nSubAuthority3,
157 DWORD nSubAuthority4, DWORD nSubAuthority5,
158 DWORD nSubAuthority6, DWORD nSubAuthority7,
161 CallWin32ToNt (RtlAllocateAndInitializeSid(
162 pIdentifierAuthority, nSubAuthorityCount,
163 nSubAuthority0, nSubAuthority1, nSubAuthority2, nSubAuthority3,
164 nSubAuthority4, nSubAuthority5, nSubAuthority6, nSubAuthority7,
168 /******************************************************************************
169 * FreeSid [ADVAPI32.42]
178 return NULL; /* is documented like this */
181 /******************************************************************************
182 * CopySid [ADVAPI32.24]
185 * nDestinationSidLength []
190 CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid )
192 return RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid);
195 /******************************************************************************
196 * IsValidSid [ADVAPI32.80]
202 IsValidSid( PSID pSid )
204 return RtlValidSid( pSid );
207 /******************************************************************************
208 * EqualSid [ADVAPI32.40]
215 EqualSid( PSID pSid1, PSID pSid2 )
217 return RtlEqualSid( pSid1, pSid2 );
220 /******************************************************************************
221 * EqualPrefixSid [ADVAPI32.39]
223 BOOL WINAPI EqualPrefixSid (PSID pSid1, PSID pSid2)
225 return RtlEqualPrefixSid(pSid1, pSid2);
228 /******************************************************************************
229 * GetSidLengthRequired [ADVAPI32.63]
232 * nSubAuthorityCount []
235 GetSidLengthRequired( BYTE nSubAuthorityCount )
237 return RtlLengthRequiredSid(nSubAuthorityCount);
240 /******************************************************************************
241 * InitializeSid [ADVAPI32.74]
244 * pIdentifierAuthority []
249 PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
250 BYTE nSubAuthorityCount)
252 return RtlInitializeSid(pSid, pIdentifierAuthority, nSubAuthorityCount);
255 /******************************************************************************
256 * GetSidIdentifierAuthority [ADVAPI32.62]
261 PSID_IDENTIFIER_AUTHORITY WINAPI
262 GetSidIdentifierAuthority( PSID pSid )
264 return RtlIdentifierAuthoritySid(pSid);
267 /******************************************************************************
268 * GetSidSubAuthority [ADVAPI32.64]
275 GetSidSubAuthority( PSID pSid, DWORD nSubAuthority )
277 return RtlSubAuthoritySid(pSid, nSubAuthority);
280 /******************************************************************************
281 * GetSidSubAuthorityCount [ADVAPI32.65]
287 GetSidSubAuthorityCount (PSID pSid)
289 return RtlSubAuthorityCountSid(pSid);
292 /******************************************************************************
293 * GetLengthSid [ADVAPI32.48]
299 GetLengthSid (PSID pSid)
301 return RtlLengthSid(pSid);
304 /* ##############################################
305 ###### SECURITY DESCRIPTOR FUNCTIONS ######
306 ##############################################
309 /******************************************************************************
310 * InitializeSecurityDescriptor [ADVAPI32.73]
317 InitializeSecurityDescriptor( SECURITY_DESCRIPTOR *pDescr, DWORD revision )
319 CallWin32ToNt (RtlCreateSecurityDescriptor(pDescr, revision ));
322 /******************************************************************************
323 * GetSecurityDescriptorLength [ADVAPI32.55]
325 DWORD WINAPI GetSecurityDescriptorLength( SECURITY_DESCRIPTOR *pDescr)
327 return (RtlLengthSecurityDescriptor(pDescr));
330 /******************************************************************************
331 * GetSecurityDescriptorOwner [ADVAPI32.56]
335 * lpbOwnerDefaulted []
338 GetSecurityDescriptorOwner( SECURITY_DESCRIPTOR *pDescr, PSID *pOwner,
339 LPBOOL lpbOwnerDefaulted )
341 CallWin32ToNt (RtlGetOwnerSecurityDescriptor( pDescr, pOwner, (PBOOLEAN)lpbOwnerDefaulted ));
344 /******************************************************************************
345 * SetSecurityDescriptorOwner [ADVAPI32]
349 BOOL WINAPI SetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pSecurityDescriptor,
350 PSID pOwner, BOOL bOwnerDefaulted)
352 CallWin32ToNt (RtlSetOwnerSecurityDescriptor(pSecurityDescriptor, pOwner, bOwnerDefaulted));
354 /******************************************************************************
355 * GetSecurityDescriptorGroup [ADVAPI32.54]
357 BOOL WINAPI GetSecurityDescriptorGroup(
358 PSECURITY_DESCRIPTOR SecurityDescriptor,
360 LPBOOL GroupDefaulted)
362 CallWin32ToNt (RtlGetGroupSecurityDescriptor(SecurityDescriptor, Group, (PBOOLEAN)GroupDefaulted));
364 /******************************************************************************
365 * SetSecurityDescriptorGroup
367 BOOL WINAPI SetSecurityDescriptorGroup ( PSECURITY_DESCRIPTOR SecurityDescriptor,
368 PSID Group, BOOL GroupDefaulted)
370 CallWin32ToNt (RtlSetGroupSecurityDescriptor( SecurityDescriptor, Group, GroupDefaulted));
373 /******************************************************************************
374 * IsValidSecurityDescriptor [ADVAPI32.79]
380 IsValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor )
382 CallWin32ToNt (RtlValidSecurityDescriptor(SecurityDescriptor));
385 /******************************************************************************
386 * GetSecurityDescriptorDacl [ADVAPI.91]
388 BOOL WINAPI GetSecurityDescriptorDacl(
389 IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
390 OUT LPBOOL lpbDaclPresent,
392 OUT LPBOOL lpbDaclDefaulted)
394 CallWin32ToNt (RtlGetDaclSecurityDescriptor(pSecurityDescriptor, (PBOOLEAN)lpbDaclPresent,
395 pDacl, (PBOOLEAN)lpbDaclDefaulted));
398 /******************************************************************************
399 * SetSecurityDescriptorDacl [ADVAPI.224]
402 SetSecurityDescriptorDacl (
403 PSECURITY_DESCRIPTOR lpsd,
408 CallWin32ToNt (RtlSetDaclSecurityDescriptor (lpsd, daclpresent, dacl, dacldefaulted ));
410 /******************************************************************************
411 * GetSecurityDescriptorSacl [ADVAPI.]
413 BOOL WINAPI GetSecurityDescriptorSacl(
414 IN PSECURITY_DESCRIPTOR lpsd,
415 OUT LPBOOL lpbSaclPresent,
417 OUT LPBOOL lpbSaclDefaulted)
419 CallWin32ToNt (RtlGetSaclSecurityDescriptor(lpsd,
420 (PBOOLEAN)lpbSaclPresent, pSacl, (PBOOLEAN)lpbSaclDefaulted));
423 /**************************************************************************
424 * SetSecurityDescriptorSacl [NTDLL.488]
426 BOOL WINAPI SetSecurityDescriptorSacl (
427 PSECURITY_DESCRIPTOR lpsd,
432 CallWin32ToNt (RtlSetSaclSecurityDescriptor(lpsd, saclpresent, lpsacl, sacldefaulted));
434 /******************************************************************************
435 * MakeSelfRelativeSD [ADVAPI32.95]
444 IN PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
445 IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
446 IN OUT LPDWORD lpdwBufferLength)
448 CallWin32ToNt (RtlMakeSelfRelativeSD(pAbsoluteSecurityDescriptor,pSelfRelativeSecurityDescriptor, lpdwBufferLength));
451 /******************************************************************************
452 * GetSecurityDescriptorControl [ADVAPI32]
455 BOOL WINAPI GetSecurityDescriptorControl ( PSECURITY_DESCRIPTOR pSecurityDescriptor,
456 PSECURITY_DESCRIPTOR_CONTROL pControl, LPDWORD lpdwRevision)
458 CallWin32ToNt (RtlGetControlSecurityDescriptor(pSecurityDescriptor,pControl,lpdwRevision));
461 /* ##############################
462 ###### ACL FUNCTIONS ######
463 ##############################
466 /*************************************************************************
467 * InitializeAcl [ADVAPI32.111]
469 DWORD WINAPI InitializeAcl(PACL acl, DWORD size, DWORD rev)
471 CallWin32ToNt (RtlCreateAcl(acl, size, rev));
474 /* ##############################
475 ###### MISC FUNCTIONS ######
476 ##############################
479 /******************************************************************************
480 * LookupPrivilegeValueW [ADVAPI32.93]
481 * Retrieves LUID used on a system to represent the privilege name.
484 * lpLuid should be PLUID
487 * lpSystemName [I] Address of string specifying the system
488 * lpName [I] Address of string specifying the privilege
489 * lpLuid [I] Address of locally unique identifier
494 LookupPrivilegeValueW( LPCWSTR lpSystemName, LPCWSTR lpName, LPVOID lpLuid )
496 FIXME("(%s,%s,%p): stub\n",debugstr_w(lpSystemName),
497 debugstr_w(lpName), lpLuid);
501 /******************************************************************************
502 * LookupPrivilegeValueA [ADVAPI32.92]
505 LookupPrivilegeValueA( LPCSTR lpSystemName, LPCSTR lpName, LPVOID lpLuid )
507 LPWSTR lpSystemNameW = HEAP_strdupAtoW(GetProcessHeap(), 0, lpSystemName);
508 LPWSTR lpNameW = HEAP_strdupAtoW(GetProcessHeap(), 0, lpName);
511 ret = LookupPrivilegeValueW( lpSystemNameW, lpNameW, lpLuid);
512 HeapFree(GetProcessHeap(), 0, lpNameW);
513 HeapFree(GetProcessHeap(), 0, lpSystemNameW);
517 /******************************************************************************
518 * GetFileSecurityA [ADVAPI32.45]
520 * Obtains Specified information about the security of a file or directory
521 * The information obtained is constrained by the callers access rights and
525 GetFileSecurityA( LPCSTR lpFileName,
526 SECURITY_INFORMATION RequestedInformation,
527 PSECURITY_DESCRIPTOR pSecurityDescriptor,
528 DWORD nLength, LPDWORD lpnLengthNeeded )
530 FIXME("(%s) : stub\n", debugstr_a(lpFileName));
534 /******************************************************************************
535 * GetFileSecurityW [ADVAPI32.46]
537 * Obtains Specified information about the security of a file or directory
538 * The information obtained is constrained by the callers access rights and
543 * RequestedInformation []
544 * pSecurityDescriptor []
549 GetFileSecurityW( LPCWSTR lpFileName,
550 SECURITY_INFORMATION RequestedInformation,
551 PSECURITY_DESCRIPTOR pSecurityDescriptor,
552 DWORD nLength, LPDWORD lpnLengthNeeded )
554 FIXME("(%s) : stub\n", debugstr_w(lpFileName) );
559 /******************************************************************************
560 * LookupAccountSidA [ADVAPI32.86]
567 IN OUT LPDWORD accountSize,
569 IN OUT LPDWORD domainSize,
570 OUT PSID_NAME_USE name_use )
572 char * ac = "Administrator";
573 char * dm = "DOMAIN";
574 FIXME("(%s,sid=%p,%p,%p(%lu),%p,%p(%lu),%p): semi-stub\n",
575 debugstr_a(system),sid,
576 account,accountSize,accountSize?*accountSize:0,
577 domain,domainSize,domainSize?*domainSize:0,
580 if (accountSize) *accountSize = strlen(ac)+1;
581 if (account && (*accountSize > strlen(ac)))
584 if (domainSize) *domainSize = strlen(dm)+1;
585 if (domain && (*domainSize > strlen(dm)))
588 if (name_use) *name_use = SidTypeUser;
592 /******************************************************************************
593 * LookupAccountSidW [ADVAPI32.87]
609 IN OUT LPDWORD accountSize,
611 IN OUT LPDWORD domainSize,
612 OUT PSID_NAME_USE name_use )
614 char * ac = "Administrator";
615 char * dm = "DOMAIN";
616 FIXME("(%s,sid=%p,%p,%p(%lu),%p,%p(%lu),%p): semi-stub\n",
617 debugstr_w(system),sid,
618 account,accountSize,accountSize?*accountSize:0,
619 domain,domainSize,domainSize?*domainSize:0,
622 if (accountSize) *accountSize = strlen(ac)+1;
623 if (account && (*accountSize > strlen(ac)))
624 lstrcpyAtoW(account, ac);
626 if (domainSize) *domainSize = strlen(dm)+1;
627 if (domain && (*domainSize > strlen(dm)))
628 lstrcpyAtoW(domain,dm);
630 if (name_use) *name_use = SidTypeUser;
634 /******************************************************************************
635 * SetFileSecurityA [ADVAPI32.182]
636 * Sets the security of a file or directory
638 BOOL WINAPI SetFileSecurityA( LPCSTR lpFileName,
639 SECURITY_INFORMATION RequestedInformation,
640 PSECURITY_DESCRIPTOR pSecurityDescriptor)
642 FIXME("(%s) : stub\n", debugstr_a(lpFileName));
646 /******************************************************************************
647 * SetFileSecurityW [ADVAPI32.183]
648 * Sets the security of a file or directory
652 * RequestedInformation []
653 * pSecurityDescriptor []
656 SetFileSecurityW( LPCWSTR lpFileName,
657 SECURITY_INFORMATION RequestedInformation,
658 PSECURITY_DESCRIPTOR pSecurityDescriptor )
660 FIXME("(%s) : stub\n", debugstr_w(lpFileName) );
664 /******************************************************************************
665 * QueryWindows31FilesMigration [ADVAPI32.266]
671 QueryWindows31FilesMigration( DWORD x1 )
673 FIXME("(%ld):stub\n",x1);
677 /******************************************************************************
678 * SynchronizeWindows31FilesAndWindowsNTRegistry [ADVAPI32.265]
687 SynchronizeWindows31FilesAndWindowsNTRegistry( DWORD x1, DWORD x2, DWORD x3,
690 FIXME("(0x%08lx,0x%08lx,0x%08lx,0x%08lx):stub\n",x1,x2,x3,x4);
694 /******************************************************************************
695 * LsaOpenPolicy [ADVAPI32.200]
705 IN PLSA_UNICODE_STRING SystemName,
706 IN PLSA_OBJECT_ATTRIBUTES ObjectAttributes,
707 IN ACCESS_MASK DesiredAccess,
708 IN OUT PLSA_HANDLE PolicyHandle)
710 FIXME("(%s,%p,0x%08lx,%p):stub\n",
711 SystemName?debugstr_w(SystemName->Buffer):"null",
712 ObjectAttributes, DesiredAccess, PolicyHandle);
713 dumpLsaAttributes(ObjectAttributes);
714 if(PolicyHandle) *PolicyHandle = (LSA_HANDLE)0xcafe;
718 /******************************************************************************
719 * LsaQueryInformationPolicy [ADVAPI32.242]
722 LsaQueryInformationPolicy(
723 IN LSA_HANDLE PolicyHandle,
724 IN POLICY_INFORMATION_CLASS InformationClass,
727 FIXME("(%p,0x%08x,%p):stub\n",
728 PolicyHandle, InformationClass, Buffer);
730 if(!Buffer) return FALSE;
731 switch (InformationClass)
733 case PolicyAuditEventsInformation: /* 2 */
735 PPOLICY_AUDIT_EVENTS_INFO p = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(POLICY_AUDIT_EVENTS_INFO));
736 p->AuditingMode = FALSE; /* no auditing */
740 case PolicyPrimaryDomainInformation: /* 3 */
741 case PolicyAccountDomainInformation: /* 5 */
744 { POLICY_PRIMARY_DOMAIN_INFO ppdi;
747 SID_IDENTIFIER_AUTHORITY localSidAuthority = {SECURITY_NT_AUTHORITY};
749 struct di * xdi = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(xdi));
750 RtlInitUnicodeString(&(xdi->ppdi.Name), HEAP_strdupAtoW(GetProcessHeap(),0,"DOMAIN"));
751 xdi->ppdi.Sid = &(xdi->sid);
752 xdi->sid.Revision = SID_REVISION;
753 xdi->sid.SubAuthorityCount = 1;
754 xdi->sid.IdentifierAuthority = localSidAuthority;
755 xdi->sid.SubAuthority[0] = SECURITY_LOCAL_SYSTEM_RID;
759 case PolicyAuditLogInformation:
760 case PolicyPdAccountInformation:
761 case PolicyLsaServerRoleInformation:
762 case PolicyReplicaSourceInformation:
763 case PolicyDefaultQuotaInformation:
764 case PolicyModificationInformation:
765 case PolicyAuditFullSetInformation:
766 case PolicyAuditFullQueryInformation:
767 case PolicyDnsDomainInformation:
769 FIXME("category not implemented\n");
776 /******************************************************************************
777 * LsaLookupSids [ADVAPI32.240]
782 LSA_UNICODE_STRING Name;
784 } LSA_TRANSLATED_NAME, *PLSA_TRANSLATED_NAME;
788 LSA_UNICODE_STRING Name;
790 } LSA_TRUST_INFORMATION, *PLSA_TRUST_INFORMATION;
795 PLSA_TRUST_INFORMATION Domains;
796 } LSA_REFERENCED_DOMAIN_LIST, *PLSA_REFERENCED_DOMAIN_LIST;
800 IN LSA_HANDLE PolicyHandle,
803 OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,
804 OUT PLSA_TRANSLATED_NAME *Names )
806 FIXME("%p %lu %p %p %p\n",
807 PolicyHandle, Count, Sids, ReferencedDomains, Names);
811 /******************************************************************************
812 * LsaFreeMemory [ADVAPI32.241]
815 LsaFreeMemory(IN PVOID Buffer)
817 TRACE("(%p)\n",Buffer);
818 return HeapFree(GetProcessHeap(), 0, Buffer);
820 /******************************************************************************
821 * LsaClose [ADVAPI32.243]
824 LsaClose(IN LSA_HANDLE ObjectHandle)
826 FIXME("(%p):stub\n",ObjectHandle);
829 /******************************************************************************
830 * NotifyBootConfigStatus [ADVAPI32.97]
836 NotifyBootConfigStatus( DWORD x1 )
838 FIXME("(0x%08lx):stub\n",x1);
842 /******************************************************************************
843 * RevertToSelf [ADVAPI32.180]
855 /******************************************************************************
856 * ImpersonateSelf [ADVAPI32.71]
859 ImpersonateSelf(SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
861 return RtlImpersonateSelf(ImpersonationLevel);
864 /******************************************************************************
865 * AccessCheck [ADVAPI32.71]
867 * FIXME check cast LPBOOL to PBOOLEAN
871 PSECURITY_DESCRIPTOR SecurityDescriptor,
874 PGENERIC_MAPPING GenericMapping,
875 PPRIVILEGE_SET PrivilegeSet,
876 LPDWORD PrivilegeSetLength,
877 LPDWORD GrantedAccess,
880 CallWin32ToNt (NtAccessCheck(SecurityDescriptor, ClientToken, DesiredAccess,
881 GenericMapping, PrivilegeSet, PrivilegeSetLength, GrantedAccess, (PBOOLEAN)AccessStatus));
884 /*************************************************************************
885 * SetKernelObjectSecurity [ADVAPI32.223]
887 BOOL WINAPI SetKernelObjectSecurity (
889 IN SECURITY_INFORMATION SecurityInformation,
890 IN PSECURITY_DESCRIPTOR SecurityDescriptor )
892 CallWin32ToNt (NtSetSecurityObject (Handle, SecurityInformation, SecurityDescriptor));
895 /******************************************************************************
896 * AddAccessAllowedAce
898 BOOL WINAPI AddAccessAllowedAce(
900 IN DWORD dwAceRevision,
904 return RtlAddAccessAllowedAce(pAcl, dwAceRevision, AccessMask, pSid);