2 * Unit tests for security functions
4 * Copyright (c) 2004 Mike McCormack
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
25 #define WIN32_NO_STATUS
36 #include "wine/test.h"
38 typedef VOID (WINAPI *fnBuildTrusteeWithSidA)( PTRUSTEEA pTrustee, PSID pSid );
39 typedef VOID (WINAPI *fnBuildTrusteeWithNameA)( PTRUSTEEA pTrustee, LPSTR pName );
40 typedef VOID (WINAPI *fnBuildTrusteeWithObjectsAndNameA)( PTRUSTEEA pTrustee,
41 POBJECTS_AND_NAME_A pObjName,
42 SE_OBJECT_TYPE ObjectType,
44 LPSTR InheritedObjectTypeName,
46 typedef VOID (WINAPI *fnBuildTrusteeWithObjectsAndSidA)( PTRUSTEEA pTrustee,
47 POBJECTS_AND_SID pObjSid,
49 GUID* pInheritedObjectGuid,
51 typedef LPSTR (WINAPI *fnGetTrusteeNameA)( PTRUSTEEA pTrustee );
52 typedef BOOL (WINAPI *fnConvertSidToStringSidA)( PSID pSid, LPSTR *str );
53 typedef BOOL (WINAPI *fnConvertStringSidToSidA)( LPCSTR str, PSID pSid );
54 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorA)(LPCSTR, DWORD,
55 PSECURITY_DESCRIPTOR*, PULONG );
56 typedef BOOL (WINAPI *fnGetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
57 PSECURITY_DESCRIPTOR, DWORD, LPDWORD);
58 typedef DWORD (WINAPI *fnRtlAdjustPrivilege)(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
59 typedef BOOL (WINAPI *fnCreateWellKnownSid)(WELL_KNOWN_SID_TYPE,PSID,PSID,DWORD*);
60 typedef BOOL (WINAPI *fnDuplicateTokenEx)(HANDLE,DWORD,LPSECURITY_ATTRIBUTES,
61 SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
63 typedef NTSTATUS (WINAPI *fnLsaQueryInformationPolicy)(LSA_HANDLE,POLICY_INFORMATION_CLASS,PVOID*);
64 typedef NTSTATUS (WINAPI *fnLsaClose)(LSA_HANDLE);
65 typedef NTSTATUS (WINAPI *fnLsaFreeMemory)(PVOID);
66 typedef NTSTATUS (WINAPI *fnLsaOpenPolicy)(PLSA_UNICODE_STRING,PLSA_OBJECT_ATTRIBUTES,ACCESS_MASK,PLSA_HANDLE);
67 static NTSTATUS (WINAPI *pNtQueryObject)(HANDLE,OBJECT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
73 fnBuildTrusteeWithSidA pBuildTrusteeWithSidA;
74 fnBuildTrusteeWithNameA pBuildTrusteeWithNameA;
75 fnBuildTrusteeWithObjectsAndNameA pBuildTrusteeWithObjectsAndNameA;
76 fnBuildTrusteeWithObjectsAndSidA pBuildTrusteeWithObjectsAndSidA;
77 fnGetTrusteeNameA pGetTrusteeNameA;
78 fnConvertSidToStringSidA pConvertSidToStringSidA;
79 fnConvertStringSidToSidA pConvertStringSidToSidA;
80 fnGetFileSecurityA pGetFileSecurityA;
81 fnRtlAdjustPrivilege pRtlAdjustPrivilege;
82 fnCreateWellKnownSid pCreateWellKnownSid;
83 fnDuplicateTokenEx pDuplicateTokenEx;
84 fnLsaQueryInformationPolicy pLsaQueryInformationPolicy;
86 fnLsaFreeMemory pLsaFreeMemory;
87 fnLsaOpenPolicy pLsaOpenPolicy;
91 SID_IDENTIFIER_AUTHORITY auth;
95 static void init(void)
99 hntdll = GetModuleHandleA("ntdll.dll");
100 pNtQueryObject = (void *)GetProcAddress( hntdll, "NtQueryObject" );
102 hmod = GetModuleHandle("advapi32.dll");
103 pConvertStringSecurityDescriptorToSecurityDescriptorA =
104 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
106 myARGC = winetest_get_mainargs( &myARGV );
109 static void test_str_sid(const char *str_sid)
114 if (pConvertStringSidToSidA(str_sid, &psid))
116 if (pConvertSidToStringSidA(psid, &temp))
118 trace(" %s: %s\n", str_sid, temp);
125 if (GetLastError() != ERROR_INVALID_SID)
126 trace(" %s: couldn't be converted, returned %d\n", str_sid, GetLastError());
128 trace(" %s: couldn't be converted\n", str_sid);
132 static void test_sid(void)
134 struct sidRef refs[] = {
135 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
136 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
137 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
138 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
139 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
140 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
142 const char noSubAuthStr[] = "S-1-5";
148 pConvertSidToStringSidA = (fnConvertSidToStringSidA)
149 GetProcAddress( hmod, "ConvertSidToStringSidA" );
150 if( !pConvertSidToStringSidA )
152 pConvertStringSidToSidA = (fnConvertStringSidToSidA)
153 GetProcAddress( hmod, "ConvertStringSidToSidA" );
154 if( !pConvertStringSidToSidA )
157 r = pConvertStringSidToSidA( NULL, NULL );
158 ok( !r, "expected failure with NULL parameters\n" );
159 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED )
161 ok( GetLastError() == ERROR_INVALID_PARAMETER,
162 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
165 r = pConvertStringSidToSidA( refs[0].refStr, NULL );
166 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
167 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
170 r = pConvertStringSidToSidA( NULL, &str );
171 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
172 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
175 r = pConvertStringSidToSidA( noSubAuthStr, &psid );
177 "expected failure with no sub authorities\n" );
178 ok( GetLastError() == ERROR_INVALID_SID,
179 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
182 for( i = 0; i < sizeof(refs) / sizeof(refs[0]); i++ )
186 r = AllocateAndInitializeSid( &refs[i].auth, 1,1,0,0,0,0,0,0,0,
188 ok( r, "failed to allocate sid\n" );
189 r = pConvertSidToStringSidA( psid, &str );
190 ok( r, "failed to convert sid\n" );
193 ok( !strcmp( str, refs[i].refStr ),
194 "incorrect sid, expected %s, got %s\n", refs[i].refStr, str );
200 r = pConvertStringSidToSidA( refs[i].refStr, &psid );
201 ok( r, "failed to parse sid string\n" );
204 !memcmp( pisid->IdentifierAuthority.Value, refs[i].auth.Value,
205 sizeof(refs[i].auth) ),
206 "string sid %s didn't parse to expected value\n"
207 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
209 MAKEWORD( pisid->IdentifierAuthority.Value[1],
210 pisid->IdentifierAuthority.Value[0] ),
211 MAKELONG( MAKEWORD( pisid->IdentifierAuthority.Value[5],
212 pisid->IdentifierAuthority.Value[4] ),
213 MAKEWORD( pisid->IdentifierAuthority.Value[3],
214 pisid->IdentifierAuthority.Value[2] ) ),
215 MAKEWORD( refs[i].auth.Value[1], refs[i].auth.Value[0] ),
216 MAKELONG( MAKEWORD( refs[i].auth.Value[5], refs[i].auth.Value[4] ),
217 MAKEWORD( refs[i].auth.Value[3], refs[i].auth.Value[2] ) ) );
222 trace("String SIDs:\n");
263 static void test_trustee(void)
265 GUID ObjectType = {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
266 GUID InheritedObjectType = {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
268 OBJECTS_AND_NAME_ oan;
272 char szObjectTypeName[] = "ObjectTypeName";
273 char szInheritedObjectTypeName[] = "InheritedObjectTypeName";
274 char szTrusteeName[] = "szTrusteeName";
275 SID_IDENTIFIER_AUTHORITY auth = { {0x11,0x22,0,0,0, 0} };
277 memset( &ZeroGuid, 0x00, sizeof (ZeroGuid) );
279 pBuildTrusteeWithSidA = (fnBuildTrusteeWithSidA)
280 GetProcAddress( hmod, "BuildTrusteeWithSidA" );
281 pBuildTrusteeWithNameA = (fnBuildTrusteeWithNameA)
282 GetProcAddress( hmod, "BuildTrusteeWithNameA" );
283 pBuildTrusteeWithObjectsAndNameA = (fnBuildTrusteeWithObjectsAndNameA)
284 GetProcAddress (hmod, "BuildTrusteeWithObjectsAndNameA" );
285 pBuildTrusteeWithObjectsAndSidA = (fnBuildTrusteeWithObjectsAndSidA)
286 GetProcAddress (hmod, "BuildTrusteeWithObjectsAndSidA" );
287 pGetTrusteeNameA = (fnGetTrusteeNameA)
288 GetProcAddress (hmod, "GetTrusteeNameA" );
289 if( !pBuildTrusteeWithSidA || !pBuildTrusteeWithNameA ||
290 !pBuildTrusteeWithObjectsAndNameA || !pBuildTrusteeWithObjectsAndSidA ||
294 if ( ! AllocateAndInitializeSid( &auth, 1, 42, 0,0,0,0,0,0,0,&psid ) )
296 trace( "failed to init SID\n" );
300 /* test BuildTrusteeWithSidA */
301 memset( &trustee, 0xff, sizeof trustee );
302 pBuildTrusteeWithSidA( &trustee, psid );
304 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
305 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
306 "MultipleTrusteeOperation wrong\n");
307 ok( trustee.TrusteeForm == TRUSTEE_IS_SID, "TrusteeForm wrong\n");
308 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
309 ok( trustee.ptstrName == (LPSTR) psid, "ptstrName wrong\n" );
311 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
312 memset( &trustee, 0xff, sizeof trustee );
313 memset( &oas, 0xff, sizeof(oas) );
314 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, &ObjectType,
315 &InheritedObjectType, psid);
317 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
318 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
319 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
320 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
321 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
323 ok(oas.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
324 ok(!memcmp(&oas.ObjectTypeGuid, &ObjectType, sizeof(GUID)), "ObjectTypeGuid wrong\n");
325 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
326 ok(oas.pSid == psid, "pSid wrong\n");
328 /* test GetTrusteeNameA */
329 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oas, "GetTrusteeName returned wrong value\n");
331 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
332 memset( &trustee, 0xff, sizeof trustee );
333 memset( &oas, 0xff, sizeof(oas) );
334 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, NULL,
335 &InheritedObjectType, psid);
337 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
338 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
339 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
340 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
341 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
343 ok(oas.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
344 ok(!memcmp(&oas.ObjectTypeGuid, &ZeroGuid, sizeof(GUID)), "ObjectTypeGuid wrong\n");
345 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
346 ok(oas.pSid == psid, "pSid wrong\n");
350 /* test BuildTrusteeWithNameA */
351 memset( &trustee, 0xff, sizeof trustee );
352 pBuildTrusteeWithNameA( &trustee, szTrusteeName );
354 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
355 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
356 "MultipleTrusteeOperation wrong\n");
357 ok( trustee.TrusteeForm == TRUSTEE_IS_NAME, "TrusteeForm wrong\n");
358 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
359 ok( trustee.ptstrName == szTrusteeName, "ptstrName wrong\n" );
361 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
362 memset( &trustee, 0xff, sizeof trustee );
363 memset( &oan, 0xff, sizeof(oan) );
364 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
365 szInheritedObjectTypeName, szTrusteeName);
367 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
368 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
369 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
370 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
371 ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
373 ok(oan.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
374 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
375 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
376 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
378 /* test GetTrusteeNameA */
379 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oan, "GetTrusteeName returned wrong value\n");
381 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
382 memset( &trustee, 0xff, sizeof trustee );
383 memset( &oan, 0xff, sizeof(oan) );
384 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, NULL,
385 szInheritedObjectTypeName, szTrusteeName);
387 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
388 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
389 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
390 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
391 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
393 ok(oan.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
394 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
395 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
396 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
398 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
399 memset( &trustee, 0xff, sizeof trustee );
400 memset( &oan, 0xff, sizeof(oan) );
401 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
402 NULL, szTrusteeName);
404 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
405 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
406 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
407 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
408 ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
410 ok(oan.ObjectsPresent == ACE_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
411 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
412 ok(oan.InheritedObjectTypeName == NULL, "InheritedObjectTypeName wrong\n");
413 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
416 /* If the first isn't defined, assume none is */
417 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
418 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
419 #define SE_CREATE_TOKEN_PRIVILEGE 2L
420 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
421 #define SE_LOCK_MEMORY_PRIVILEGE 4L
422 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
423 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
424 #define SE_TCB_PRIVILEGE 7L
425 #define SE_SECURITY_PRIVILEGE 8L
426 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
427 #define SE_LOAD_DRIVER_PRIVILEGE 10L
428 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
429 #define SE_SYSTEMTIME_PRIVILEGE 12L
430 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
431 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
432 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
433 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
434 #define SE_BACKUP_PRIVILEGE 17L
435 #define SE_RESTORE_PRIVILEGE 18L
436 #define SE_SHUTDOWN_PRIVILEGE 19L
437 #define SE_DEBUG_PRIVILEGE 20L
438 #define SE_AUDIT_PRIVILEGE 21L
439 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
440 #define SE_CHANGE_NOTIFY_PRIVILLEGE 23L
441 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
442 #define SE_UNDOCK_PRIVILEGE 25L
443 #define SE_SYNC_AGENT_PRIVILEGE 26L
444 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
445 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
446 #define SE_IMPERSONATE_PRIVILEGE 29L
447 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
448 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
449 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
451 static void test_allocateLuid(void)
453 BOOL (WINAPI *pAllocateLocallyUniqueId)(PLUID);
457 pAllocateLocallyUniqueId = (void*)GetProcAddress(hmod, "AllocateLocallyUniqueId");
458 if (!pAllocateLocallyUniqueId) return;
460 ret = pAllocateLocallyUniqueId(&luid1);
461 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
465 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
466 ret = pAllocateLocallyUniqueId(&luid2);
468 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
469 ok(luid1.LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE || luid1.HighPart != 0,
470 "AllocateLocallyUniqueId returned a well-known LUID\n");
471 ok(luid1.LowPart != luid2.LowPart || luid1.HighPart != luid2.HighPart,
472 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
473 ret = pAllocateLocallyUniqueId(NULL);
474 ok( !ret && GetLastError() == ERROR_NOACCESS,
475 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
479 static void test_lookupPrivilegeName(void)
481 BOOL (WINAPI *pLookupPrivilegeNameA)(LPCSTR, PLUID, LPSTR, LPDWORD);
482 char buf[MAX_PATH]; /* arbitrary, seems long enough */
483 DWORD cchName = sizeof(buf);
484 LUID luid = { 0, 0 };
488 /* check whether it's available first */
489 pLookupPrivilegeNameA = (void*)GetProcAddress(hmod, "LookupPrivilegeNameA");
490 if (!pLookupPrivilegeNameA) return;
491 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
492 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
493 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
496 /* check with a short buffer */
498 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
499 ret = pLookupPrivilegeNameA(NULL, &luid, NULL, &cchName);
500 ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
501 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
503 ok(cchName == strlen("SeCreateTokenPrivilege") + 1,
504 "LookupPrivilegeNameA returned an incorrect required length for\n"
505 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
506 lstrlenA("SeCreateTokenPrivilege") + 1);
507 /* check a known value and its returned length on success */
508 cchName = sizeof(buf);
509 ok(pLookupPrivilegeNameA(NULL, &luid, buf, &cchName) &&
510 cchName == strlen("SeCreateTokenPrivilege"),
511 "LookupPrivilegeNameA returned an incorrect output length for\n"
512 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
513 (int)strlen("SeCreateTokenPrivilege"));
514 /* check known values */
515 for (i = SE_MIN_WELL_KNOWN_PRIVILEGE; i < SE_MAX_WELL_KNOWN_PRIVILEGE; i++)
518 cchName = sizeof(buf);
519 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
520 ok( ret || GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
521 "LookupPrivilegeNameA(0.%d) failed: %d\n", i, GetLastError());
523 /* check a bogus LUID */
524 luid.LowPart = 0xdeadbeef;
525 cchName = sizeof(buf);
526 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
527 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
528 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
530 /* check on a bogus system */
531 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
532 cchName = sizeof(buf);
533 ret = pLookupPrivilegeNameA("b0gu5.Nam3", &luid, buf, &cchName);
534 ok( !ret && GetLastError() == RPC_S_SERVER_UNAVAILABLE,
535 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
545 static void test_lookupPrivilegeValue(void)
547 static const struct NameToLUID privs[] = {
548 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE },
549 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE },
550 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE },
551 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE },
552 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE },
553 { "SeTcbPrivilege", SE_TCB_PRIVILEGE },
554 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE },
555 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE },
556 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE },
557 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE },
558 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE },
559 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE },
560 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE },
561 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE },
562 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE },
563 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE },
564 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE },
565 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE },
566 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE },
567 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE },
568 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE },
569 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILLEGE },
570 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE },
571 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE },
572 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE },
573 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE },
574 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE },
575 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE },
576 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE },
578 BOOL (WINAPI *pLookupPrivilegeValueA)(LPCSTR, LPCSTR, PLUID);
583 /* check whether it's available first */
584 pLookupPrivilegeValueA = (void*)GetProcAddress(hmod, "LookupPrivilegeValueA");
585 if (!pLookupPrivilegeValueA) return;
586 ret = pLookupPrivilegeValueA(NULL, "SeCreateTokenPrivilege", &luid);
587 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
590 /* check a bogus system name */
591 ret = pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid);
592 ok( !ret && GetLastError() == RPC_S_SERVER_UNAVAILABLE,
593 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
595 /* check a NULL string */
596 ret = pLookupPrivilegeValueA(NULL, 0, &luid);
597 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
598 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
600 /* check a bogus privilege name */
601 ret = pLookupPrivilegeValueA(NULL, "SeBogusPrivilege", &luid);
602 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
603 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
605 /* check case insensitive */
606 ret = pLookupPrivilegeValueA(NULL, "sEcREATEtOKENpRIVILEGE", &luid);
608 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
610 for (i = 0; i < sizeof(privs) / sizeof(privs[0]); i++)
612 /* Not all privileges are implemented on all Windows versions, so
613 * don't worry if the call fails
615 if (pLookupPrivilegeValueA(NULL, privs[i].name, &luid))
617 ok(luid.LowPart == privs[i].lowPart,
618 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
624 static void test_luid(void)
627 test_lookupPrivilegeName();
628 test_lookupPrivilegeValue();
631 static void test_FileSecurity(void)
633 char directory[MAX_PATH];
634 DWORD retval, outSize;
638 pGetFileSecurityA = (fnGetFileSecurityA)
639 GetProcAddress( hmod, "GetFileSecurityA" );
640 if( !pGetFileSecurityA )
643 retval = GetTempPathA(sizeof(directory), directory);
645 trace("GetTempPathA failed\n");
649 strcpy(directory, "\\Should not exist");
651 SetLastError(NO_ERROR);
652 result = pGetFileSecurityA( directory,OWNER_SECURITY_INFORMATION,buffer,0x40,&outSize);
653 ok(!result, "GetFileSecurityA should fail for not existing directories/files\n");
654 ok( (GetLastError() == ERROR_FILE_NOT_FOUND ) ||
655 (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED) ,
656 "last error ERROR_FILE_NOT_FOUND / ERROR_CALL_NOT_IMPLEMENTED (98) "
657 "expected, got %d\n", GetLastError());
660 static void test_AccessCheck(void)
662 PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL;
664 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
665 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
666 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
667 GENERIC_MAPPING Mapping = { KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS };
674 PRIVILEGE_SET *PrivSet;
680 NtDllModule = GetModuleHandle("ntdll.dll");
683 skip("not running on NT, skipping test\n");
686 pRtlAdjustPrivilege = (fnRtlAdjustPrivilege)
687 GetProcAddress(NtDllModule, "RtlAdjustPrivilege");
688 if (!pRtlAdjustPrivilege)
690 skip("missing RtlAdjustPrivilege, skipping test\n");
694 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
695 res = InitializeAcl(Acl, 256, ACL_REVISION);
696 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
698 skip("ACLs not implemented - skipping tests\n");
701 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
703 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
704 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
706 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
707 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdminSid);
708 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
710 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
711 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
712 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
714 res = AddAccessAllowedAce(Acl, ACL_REVISION, KEY_READ, EveryoneSid);
715 ok(res, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
717 res = AddAccessDeniedAce(Acl, ACL_REVISION, KEY_SET_VALUE, AdminSid);
718 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
720 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
722 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
723 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
725 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
726 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
728 PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
729 PrivSet = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PrivSetLen);
730 PrivSet->PrivilegeCount = 16;
732 res = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &ProcessToken);
733 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
735 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, FALSE, TRUE, &Enabled);
737 res = DuplicateToken(ProcessToken, SecurityIdentification, &Token);
738 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
740 /* SD without owner/group */
741 SetLastError(0xdeadbeef);
742 Access = AccessStatus = 0xdeadbeef;
743 ret = AccessCheck(SecurityDescriptor, Token, KEY_QUERY_VALUE, &Mapping,
744 PrivSet, &PrivSetLen, &Access, &AccessStatus);
745 err = GetLastError();
746 ok(!ret && err == ERROR_INVALID_SECURITY_DESCR, "AccessCheck should have "
747 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err);
748 ok(Access == 0xdeadbeef && AccessStatus == 0xdeadbeef,
749 "Access and/or AccessStatus were changed!\n");
751 /* Set owner and group */
752 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
753 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
754 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, TRUE);
755 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
757 /* Generic access mask */
758 SetLastError(0xdeadbeef);
759 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
760 PrivSet, &PrivSetLen, &Access, &AccessStatus);
761 err = GetLastError();
762 ok(!ret && err == ERROR_GENERIC_NOT_MAPPED, "AccessCheck should have failed "
763 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err);
764 ok(Access == 0xdeadbeef && AccessStatus == 0xdeadbeef,
765 "Access and/or AccessStatus were changed!\n");
767 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
768 PrivSet, &PrivSetLen, &Access, &AccessStatus);
769 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
770 ok(AccessStatus && (Access == KEY_READ),
771 "AccessCheck failed to grant access with error %d\n",
774 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
775 PrivSet, &PrivSetLen, &Access, &AccessStatus);
776 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
778 "AccessCheck failed to grant any access with error %d\n",
780 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access);
782 /* Access denied by SD */
783 SetLastError(0xdeadbeef);
784 ret = AccessCheck(SecurityDescriptor, Token, KEY_WRITE, &Mapping,
785 PrivSet, &PrivSetLen, &Access, &AccessStatus);
786 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
787 err = GetLastError();
788 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
789 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
790 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
793 PrivSet->PrivilegeCount = 16;
794 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
795 PrivSet, &PrivSetLen, &Access, &AccessStatus);
796 ok(ret && !AccessStatus && GetLastError() == ERROR_PRIVILEGE_NOT_HELD,
797 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
800 ret = pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, TRUE, TRUE, &Enabled);
804 PrivSet->PrivilegeCount = 16;
805 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
806 PrivSet, &PrivSetLen, &Access, &AccessStatus);
807 ok(ret && AccessStatus && GetLastError() == 0,
808 "AccessCheck should have succeeded, error %d\n",
810 ok(Access == ACCESS_SYSTEM_SECURITY,
811 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
815 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
820 res = DuplicateToken(ProcessToken, SecurityAnonymous, &Token);
821 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
823 SetLastError(0xdeadbeef);
824 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
825 PrivSet, &PrivSetLen, &Access, &AccessStatus);
826 err = GetLastError();
827 ok(!ret && err == ERROR_BAD_IMPERSONATION_LEVEL, "AccessCheck should have failed "
828 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err);
832 SetLastError(0xdeadbeef);
833 ret = AccessCheck(SecurityDescriptor, ProcessToken, KEY_READ, &Mapping,
834 PrivSet, &PrivSetLen, &Access, &AccessStatus);
835 err = GetLastError();
836 ok(!ret && err == ERROR_NO_IMPERSONATION_TOKEN, "AccessCheck should have failed "
837 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err);
839 CloseHandle(ProcessToken);
842 FreeSid(EveryoneSid);
847 HeapFree(GetProcessHeap(), 0, Acl);
848 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
849 HeapFree(GetProcessHeap(), 0, PrivSet);
852 /* test GetTokenInformation for the various attributes */
853 static void test_token_attr(void)
855 HANDLE Token, ImpersonationToken;
857 TOKEN_PRIVILEGES *Privileges;
858 TOKEN_GROUPS *Groups;
863 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
865 /* cygwin-like use case */
866 SetLastError(0xdeadbeef);
867 ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &Token);
868 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
870 skip("OpenProcessToken is not implemented\n");
873 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
878 ret = GetTokenInformation(Token, TokenUser,(void*)buf, Size, &Size);
879 ok(ret, "GetTokenInformation failed with error %d\n", GetLastError());
880 Size = sizeof(ImpersonationLevel);
881 ret = GetTokenInformation(Token, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
882 GLE = GetLastError();
883 ok(!ret && (GLE == ERROR_INVALID_PARAMETER), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE);
887 if(!pConvertSidToStringSidA)
889 skip("ConvertSidToStringSidA is not available\n");
893 SetLastError(0xdeadbeef);
894 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY|TOKEN_DUPLICATE, &Token);
895 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
898 ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size);
899 Groups = HeapAlloc(GetProcessHeap(), 0, Size);
900 ret = GetTokenInformation(Token, TokenGroups, Groups, Size, &Size);
901 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
902 trace("TokenGroups:\n");
903 for (i = 0; i < Groups->GroupCount; i++)
905 DWORD NameLength = 255;
907 DWORD DomainLength = 255;
909 SID_NAME_USE SidNameUse;
910 pConvertSidToStringSidA(Groups->Groups[i].Sid, &SidString);
913 ret = LookupAccountSid(NULL, Groups->Groups[i].Sid, Name, &NameLength, Domain, &DomainLength, &SidNameUse);
915 trace("\t%s, %s\\%s use: %d attr: 0x%08x\n", SidString, Domain, Name, SidNameUse, Groups->Groups[i].Attributes);
917 trace("\t%s, attr: 0x%08x LookupAccountSid failed with error %d\n", SidString, Groups->Groups[i].Attributes, GetLastError());
918 LocalFree(SidString);
920 HeapFree(GetProcessHeap(), 0, Groups);
923 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
924 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
925 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
926 User = HeapAlloc(GetProcessHeap(), 0, Size);
927 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
929 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
931 pConvertSidToStringSidA(User->User.Sid, &SidString);
932 trace("TokenUser: %s attr: 0x%08x\n", SidString, User->User.Attributes);
933 LocalFree(SidString);
934 HeapFree(GetProcessHeap(), 0, User);
937 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
938 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
939 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
940 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
941 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
943 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
944 trace("TokenPrivileges:\n");
945 for (i = 0; i < Privileges->PrivilegeCount; i++)
948 DWORD NameLen = sizeof(Name)/sizeof(Name[0]);
949 LookupPrivilegeName(NULL, &Privileges->Privileges[i].Luid, Name, &NameLen);
950 trace("\t%s, 0x%x\n", Name, Privileges->Privileges[i].Attributes);
952 HeapFree(GetProcessHeap(), 0, Privileges);
954 ret = DuplicateToken(Token, SecurityAnonymous, &ImpersonationToken);
955 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
957 Size = sizeof(ImpersonationLevel);
958 ret = GetTokenInformation(ImpersonationToken, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
959 ok(ret, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
960 ok(ImpersonationLevel == SecurityAnonymous, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel);
962 CloseHandle(ImpersonationToken);
966 typedef union _MAX_SID
969 char max[SECURITY_MAX_SID_SIZE];
972 static void test_sid_str(PSID * sid)
975 BOOL ret = pConvertSidToStringSidA(sid, &str_sid);
976 ok(ret, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
979 char account[MAX_PATH], domain[MAX_PATH];
981 DWORD acc_size = MAX_PATH;
982 DWORD dom_size = MAX_PATH;
983 ret = LookupAccountSid(NULL, sid, account, &acc_size, domain, &dom_size, &use);
984 ok(ret || (!ret && (GetLastError() == ERROR_NONE_MAPPED)),
985 "LookupAccountSid(%s) failed: %d\n", str_sid, GetLastError());
987 trace(" %s %s\\%s %d\n", str_sid, domain, account, use);
988 else if (GetLastError() == ERROR_NONE_MAPPED)
989 trace(" %s couldn't be mapped\n", str_sid);
994 static void test_LookupAccountSid(void)
996 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
997 CHAR accountA[MAX_PATH], domainA[MAX_PATH];
998 DWORD acc_sizeA, dom_sizeA;
999 DWORD real_acc_sizeA, real_dom_sizeA;
1000 WCHAR accountW[MAX_PATH], domainW[MAX_PATH];
1001 DWORD acc_sizeW, dom_sizeW;
1002 DWORD real_acc_sizeW, real_dom_sizeW;
1003 PSID pUsersSid = NULL;
1011 /* native windows crashes if account size, domain size, or name use is NULL */
1013 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1014 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &pUsersSid);
1015 ok(ret || (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED),
1016 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1018 /* not running on NT so give up */
1019 if (!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1022 real_acc_sizeA = MAX_PATH;
1023 real_dom_sizeA = MAX_PATH;
1024 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1025 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1027 /* try NULL account */
1028 acc_sizeA = MAX_PATH;
1029 dom_sizeA = MAX_PATH;
1030 ret = LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1031 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1033 /* try NULL domain */
1034 acc_sizeA = MAX_PATH;
1035 dom_sizeA = MAX_PATH;
1036 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1037 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1039 /* try a small account buffer */
1041 dom_sizeA = MAX_PATH;
1043 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1044 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1045 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1046 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1048 /* try a 0 sized account buffer */
1050 dom_sizeA = MAX_PATH;
1052 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1053 /* this can fail or succeed depending on OS version but the size will always be returned */
1054 ok(acc_sizeA == real_acc_sizeA + 1,
1055 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1056 real_acc_sizeA + 1, acc_sizeA);
1058 /* try a 0 sized account buffer */
1060 dom_sizeA = MAX_PATH;
1061 ret = LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1062 /* this can fail or succeed depending on OS version but the size will always be returned */
1063 ok(acc_sizeA == real_acc_sizeA + 1,
1064 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1065 real_acc_sizeA + 1, acc_sizeA);
1067 /* try a small domain buffer */
1069 acc_sizeA = MAX_PATH;
1071 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1072 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1073 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1074 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1076 /* try a 0 sized domain buffer */
1078 acc_sizeA = MAX_PATH;
1080 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1081 /* this can fail or succeed depending on OS version but the size will always be returned */
1082 ok(dom_sizeA == real_dom_sizeA + 1,
1083 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1084 real_dom_sizeA + 1, dom_sizeA);
1086 /* try a 0 sized domain buffer */
1088 acc_sizeA = MAX_PATH;
1089 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1090 /* this can fail or succeed depending on OS version but the size will always be returned */
1091 ok(dom_sizeA == real_dom_sizeA + 1,
1092 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1093 real_dom_sizeA + 1, dom_sizeA);
1095 real_acc_sizeW = MAX_PATH;
1096 real_dom_sizeW = MAX_PATH;
1097 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &real_acc_sizeW, domainW, &real_dom_sizeW, &use);
1098 ok(ret, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1100 /* native windows crashes if domainW or accountW is NULL */
1102 /* try a small account buffer */
1104 dom_sizeW = MAX_PATH;
1106 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1107 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1108 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1109 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1111 /* try a 0 sized account buffer */
1113 dom_sizeW = MAX_PATH;
1115 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1116 /* this can fail or succeed depending on OS version but the size will always be returned */
1117 ok(acc_sizeW == real_acc_sizeW + 1,
1118 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1119 real_acc_sizeW + 1, acc_sizeW);
1121 /* try a 0 sized account buffer */
1123 dom_sizeW = MAX_PATH;
1124 ret = LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, domainW, &dom_sizeW, &use);
1125 /* this can fail or succeed depending on OS version but the size will always be returned */
1126 ok(acc_sizeW == real_acc_sizeW + 1,
1127 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1128 real_acc_sizeW + 1, acc_sizeW);
1130 /* try a small domain buffer */
1132 acc_sizeW = MAX_PATH;
1134 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1135 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1136 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1137 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1139 /* try a 0 sized domain buffer */
1141 acc_sizeW = MAX_PATH;
1143 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1144 /* this can fail or succeed depending on OS version but the size will always be returned */
1145 ok(dom_sizeW == real_dom_sizeW + 1,
1146 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1147 real_dom_sizeW + 1, dom_sizeW);
1149 /* try a 0 sized domain buffer */
1151 acc_sizeW = MAX_PATH;
1152 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, NULL, &dom_sizeW, &use);
1153 /* this can fail or succeed depending on OS version but the size will always be returned */
1154 ok(dom_sizeW == real_dom_sizeW + 1,
1155 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1156 real_dom_sizeW + 1, dom_sizeW);
1160 pCreateWellKnownSid = (fnCreateWellKnownSid)GetProcAddress( hmod, "CreateWellKnownSid" );
1162 if (pCreateWellKnownSid && pConvertSidToStringSidA)
1164 trace("Well Known SIDs:\n");
1165 for (i = 0; i <= 60; i++)
1167 size = SECURITY_MAX_SID_SIZE;
1168 if (pCreateWellKnownSid(i, NULL, &max_sid.sid, &size))
1170 if (pConvertSidToStringSidA(&max_sid.sid, &str_sidA))
1172 acc_sizeA = MAX_PATH;
1173 dom_sizeA = MAX_PATH;
1174 if (LookupAccountSidA(NULL, &max_sid.sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use))
1175 trace(" %d: %s %s\\%s %d\n", i, str_sidA, domainA, accountA, use);
1176 LocalFree(str_sidA);
1181 if (GetLastError() != ERROR_INVALID_PARAMETER)
1182 trace(" CreateWellKnownSid(%d) failed: %d\n", i, GetLastError());
1184 trace(" %d: not supported\n", i);
1188 pLsaQueryInformationPolicy = (fnLsaQueryInformationPolicy)GetProcAddress( hmod, "LsaQueryInformationPolicy");
1189 pLsaOpenPolicy = (fnLsaOpenPolicy)GetProcAddress( hmod, "LsaOpenPolicy");
1190 pLsaFreeMemory = (fnLsaFreeMemory)GetProcAddress( hmod, "LsaFreeMemory");
1191 pLsaClose = (fnLsaClose)GetProcAddress( hmod, "LsaClose");
1193 if (pLsaQueryInformationPolicy && pLsaOpenPolicy && pLsaFreeMemory && pLsaClose)
1197 LSA_OBJECT_ATTRIBUTES object_attributes;
1199 ZeroMemory(&object_attributes, sizeof(object_attributes));
1200 object_attributes.Length = sizeof(object_attributes);
1202 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_ALL_ACCESS, &handle);
1203 ok(status == STATUS_SUCCESS || status == STATUS_ACCESS_DENIED,
1204 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status);
1206 /* try a more restricted access mask if necessary */
1207 if (status == STATUS_ACCESS_DENIED) {
1208 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
1209 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_VIEW_LOCAL_INFORMATION, &handle);
1210 ok(status == STATUS_SUCCESS, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status);
1213 if (status == STATUS_SUCCESS)
1215 PPOLICY_ACCOUNT_DOMAIN_INFO info;
1216 status = pLsaQueryInformationPolicy(handle, PolicyAccountDomainInformation, (PVOID*)&info);
1217 ok(status == STATUS_SUCCESS, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status);
1218 if (status == STATUS_SUCCESS)
1220 ok(info->DomainSid!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
1221 if (info->DomainSid)
1223 int count = *GetSidSubAuthorityCount(info->DomainSid);
1224 CopySid(GetSidLengthRequired(count), &max_sid, info->DomainSid);
1225 test_sid_str((PSID)&max_sid.sid);
1226 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_ADMIN;
1227 max_sid.sid.SubAuthorityCount = count + 1;
1228 test_sid_str((PSID)&max_sid.sid);
1229 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_GUEST;
1230 test_sid_str((PSID)&max_sid.sid);
1231 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ADMINS;
1232 test_sid_str((PSID)&max_sid.sid);
1233 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_USERS;
1234 test_sid_str((PSID)&max_sid.sid);
1235 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_GUESTS;
1236 test_sid_str((PSID)&max_sid.sid);
1237 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_COMPUTERS;
1238 test_sid_str((PSID)&max_sid.sid);
1239 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CONTROLLERS;
1240 test_sid_str((PSID)&max_sid.sid);
1241 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CERT_ADMINS;
1242 test_sid_str((PSID)&max_sid.sid);
1243 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_SCHEMA_ADMINS;
1244 test_sid_str((PSID)&max_sid.sid);
1245 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS;
1246 test_sid_str((PSID)&max_sid.sid);
1247 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_POLICY_ADMINS;
1248 test_sid_str((PSID)&max_sid.sid);
1249 max_sid.sid.SubAuthority[count] = DOMAIN_ALIAS_RID_RAS_SERVERS;
1250 test_sid_str((PSID)&max_sid.sid);
1251 max_sid.sid.SubAuthority[count] = 1000; /* first user account */
1252 test_sid_str((PSID)&max_sid.sid);
1255 pLsaFreeMemory((LPVOID)info);
1258 status = pLsaClose(handle);
1259 ok(status == STATUS_SUCCESS, "LsaClose() failed, returned 0x%08x\n", status);
1265 static void get_sid_info(PSID psid, LPSTR *user, LPSTR *dom)
1267 static CHAR account[UNLEN + 1];
1268 static CHAR domain[UNLEN + 1];
1269 DWORD size, dom_size;
1275 size = dom_size = UNLEN + 1;
1278 LookupAccountSidA(NULL, psid, account, &size, domain, &dom_size, &use);
1281 static void test_LookupAccountName(void)
1283 DWORD sid_size, domain_size, user_size;
1284 DWORD sid_save, domain_save;
1285 CHAR user_name[UNLEN + 1];
1286 SID_NAME_USE sid_use;
1287 LPSTR domain, account, sid_dom;
1291 /* native crashes if (assuming all other parameters correct):
1293 * - Sid is NULL and cbSid is > 0
1294 * - cbSid or cchReferencedDomainName are NULL
1295 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
1298 user_size = UNLEN + 1;
1299 ret = GetUserNameA(user_name, &user_size);
1300 ok(ret, "Failed to get user name\n");
1305 sid_use = 0xcafebabe;
1306 SetLastError(0xdeadbeef);
1307 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
1308 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1310 skip("LookupAccountNameA is not implemented\n");
1313 ok(!ret, "Expected 0, got %d\n", ret);
1314 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1315 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1316 ok(sid_size != 0, "Expected non-zero sid size\n");
1317 ok(domain_size != 0, "Expected non-zero domain size\n");
1318 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
1320 sid_save = sid_size;
1321 domain_save = domain_size;
1323 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
1324 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
1326 /* try valid account name */
1327 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, domain, &domain_size, &sid_use);
1328 get_sid_info(psid, &account, &sid_dom);
1329 ok(ret, "Failed to lookup account name\n");
1330 ok(sid_size == GetLengthSid(psid), "Expected %d, got %d\n", GetLengthSid(psid), sid_size);
1333 ok(!lstrcmp(account, user_name), "Expected %s, got %s\n", user_name, account);
1334 ok(!lstrcmp(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
1335 ok(domain_size == domain_save - 1, "Expected %d, got %d\n", domain_save - 1, domain_size);
1336 ok(lstrlen(domain) == domain_size, "Expected %d\n", lstrlen(domain));
1337 ok(sid_use == SidTypeUser, "Expected SidTypeUser, got %d\n", SidTypeUser);
1339 domain_size = domain_save;
1341 /* NULL Sid with zero sid size */
1342 SetLastError(0xdeadbeef);
1344 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
1345 ok(!ret, "Expected 0, got %d\n", ret);
1346 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1347 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1348 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
1349 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
1351 /* try cchReferencedDomainName - 1 */
1352 SetLastError(0xdeadbeef);
1354 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
1355 ok(!ret, "Expected 0, got %d\n", ret);
1356 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1357 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1358 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
1359 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
1361 /* NULL ReferencedDomainName with zero domain name size */
1362 SetLastError(0xdeadbeef);
1364 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, NULL, &domain_size, &sid_use);
1365 ok(!ret, "Expected 0, got %d\n", ret);
1366 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1367 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1368 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
1369 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
1371 HeapFree(GetProcessHeap(), 0, psid);
1372 HeapFree(GetProcessHeap(), 0, domain);
1374 /* get sizes for NULL account name */
1377 sid_use = 0xcafebabe;
1378 SetLastError(0xdeadbeef);
1379 ret = LookupAccountNameA(NULL, NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
1380 ok(!ret, "Expected 0, got %d\n", ret);
1381 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1382 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1383 ok(sid_size != 0, "Expected non-zero sid size\n");
1384 ok(domain_size != 0, "Expected non-zero domain size\n");
1385 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
1387 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
1388 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
1390 /* try NULL account name */
1391 ret = LookupAccountNameA(NULL, NULL, psid, &sid_size, domain, &domain_size, &sid_use);
1392 get_sid_info(psid, &account, &sid_dom);
1393 ok(ret, "Failed to lookup account name\n");
1396 ok(!lstrcmp(account, "BUILTIN"), "Expected BUILTIN, got %s\n", account);
1397 ok(!lstrcmp(domain, "BUILTIN"), "Expected BUILTIN, got %s\n", domain);
1398 ok(sid_use == SidTypeDomain, "Expected SidTypeDomain, got %d\n", SidTypeDomain);
1401 /* try an invalid account name */
1402 SetLastError(0xdeadbeef);
1405 ret = LookupAccountNameA(NULL, "oogabooga", NULL, &sid_size, NULL, &domain_size, &sid_use);
1406 ok(!ret, "Expected 0, got %d\n", ret);
1409 ok(GetLastError() == ERROR_NONE_MAPPED,
1410 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
1411 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
1412 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
1415 HeapFree(GetProcessHeap(), 0, psid);
1416 HeapFree(GetProcessHeap(), 0, domain);
1419 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,__LINE__)
1420 static void test_granted_access(HANDLE handle, ACCESS_MASK access, int line)
1422 OBJECT_BASIC_INFORMATION obj_info;
1425 if (!pNtQueryObject)
1427 skip_(__FILE__, line)("Not NT platform - skipping tests\n");
1431 status = pNtQueryObject( handle, ObjectBasicInformation, &obj_info,
1432 sizeof(obj_info), NULL );
1433 ok_(__FILE__, line)(!status, "NtQueryObject with err: %08x\n", status);
1434 ok_(__FILE__, line)(obj_info.GrantedAccess == access, "Gratned access should "
1435 "be 0x%08x, instead of 0x%08x\n", access, obj_info.GrantedAccess);
1438 #define CHECK_SET_SECURITY(o,i,e) \
1442 SetLastError( 0xdeadbeef ); \
1443 res = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
1444 err = GetLastError(); \
1445 if (e == ERROR_SUCCESS) \
1446 ok(res, "SetKernelObjectSecurity failed with %d\n", err); \
1448 ok(!res && err == e, "SetKernelObjectSecurity should have failed " \
1449 "with %s, instead of %d\n", #e, err); \
1452 static void test_process_security(void)
1455 char owner[32], group[32];
1456 PSID AdminSid = NULL, UsersSid = NULL;
1458 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
1459 char buffer[MAX_PATH];
1460 PROCESS_INFORMATION info;
1461 STARTUPINFOA startup;
1462 SECURITY_ATTRIBUTES psa;
1463 HANDLE token, event;
1466 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
1467 res = InitializeAcl(Acl, 256, ACL_REVISION);
1468 if (!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
1470 skip("ACLs not implemented - skipping tests\n");
1473 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
1475 /* get owner from the token we might be running as a user not admin */
1476 res = OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED, &token );
1477 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
1480 res = GetTokenInformation( token, TokenOwner, owner, sizeof(owner), &tmp );
1481 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
1482 AdminSid = ((TOKEN_OWNER*)owner)->Owner;
1483 res = GetTokenInformation( token, TokenPrimaryGroup, group, sizeof(group), &tmp );
1484 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
1485 UsersSid = ((TOKEN_PRIMARY_GROUP*)group)->PrimaryGroup;
1487 CloseHandle( token );
1490 res = AddAccessDeniedAce(Acl, ACL_REVISION, PROCESS_VM_READ, AdminSid);
1491 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1492 res = AddAccessAllowedAce(Acl, ACL_REVISION, PROCESS_ALL_ACCESS, AdminSid);
1493 ok(res, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1495 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
1496 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
1497 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1499 event = CreateEvent( NULL, TRUE, TRUE, "test_event" );
1500 ok(event != NULL, "CreateEvent %d\n", GetLastError());
1502 SecurityDescriptor->Revision = 0;
1503 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_UNKNOWN_REVISION );
1504 SecurityDescriptor->Revision = SECURITY_DESCRIPTOR_REVISION;
1506 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
1507 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
1508 CHECK_SET_SECURITY( event, SACL_SECURITY_INFORMATION, ERROR_ACCESS_DENIED );
1509 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
1510 /* NULL DACL is valid and means default DACL from token */
1511 SecurityDescriptor->Control |= SE_DACL_PRESENT;
1512 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
1514 /* Set owner and group and dacl */
1515 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
1516 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1517 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_SUCCESS );
1518 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, FALSE);
1519 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1520 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_SUCCESS );
1521 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1522 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1523 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
1525 sprintf(buffer, "%s tests/security.c test", myARGV[0]);
1526 memset(&startup, 0, sizeof(startup));
1527 startup.cb = sizeof(startup);
1528 startup.dwFlags = STARTF_USESHOWWINDOW;
1529 startup.wShowWindow = SW_SHOWNORMAL;
1531 psa.nLength = sizeof(psa);
1532 psa.lpSecurityDescriptor = SecurityDescriptor;
1533 psa.bInheritHandle = TRUE;
1535 /* Doesn't matter what ACL say we should get full access for ourselves */
1536 ok(CreateProcessA( NULL, buffer, &psa, NULL, FALSE, 0, NULL, NULL, &startup, &info ),
1537 "CreateProcess with err:%d\n", GetLastError());
1538 TEST_GRANTED_ACCESS( info.hProcess, PROCESS_ALL_ACCESS );
1539 ok(WaitForSingleObject(info.hProcess, 30000) == WAIT_OBJECT_0, "Child process termination\n");
1541 CloseHandle( event );
1542 HeapFree(GetProcessHeap(), 0, Acl);
1543 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
1546 static void test_process_security_child(void)
1548 HANDLE handle, handle1;
1552 handle = OpenProcess( PROCESS_TERMINATE, FALSE, GetCurrentProcessId() );
1553 ok(handle != NULL, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
1554 TEST_GRANTED_ACCESS( handle, PROCESS_TERMINATE );
1556 ok(DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
1557 &handle1, 0, TRUE, DUPLICATE_SAME_ACCESS ),
1558 "duplicating handle err:%d\n", GetLastError());
1559 TEST_GRANTED_ACCESS( handle1, PROCESS_TERMINATE );
1561 CloseHandle( handle1 );
1563 SetLastError( 0xdeadbeef );
1564 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
1565 &handle1, PROCESS_ALL_ACCESS, TRUE, 0 );
1566 err = GetLastError();
1568 ok(!ret && err == ERROR_ACCESS_DENIED, "duplicating handle should have failed "
1569 "with STATUS_ACCESS_DENIED, instead of err:%d\n", err);
1571 CloseHandle( handle );
1573 /* These two should fail - they are denied by ACL */
1574 handle = OpenProcess( PROCESS_VM_READ, FALSE, GetCurrentProcessId() );
1576 ok(handle == NULL, "OpenProcess(PROCESS_VM_READ) should have failed\n");
1577 handle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId() );
1579 ok(handle == NULL, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
1581 /* Documented privilege elevation */
1582 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1583 &handle, 0, TRUE, DUPLICATE_SAME_ACCESS ),
1584 "duplicating handle err:%d\n", GetLastError());
1585 TEST_GRANTED_ACCESS( handle, PROCESS_ALL_ACCESS );
1587 CloseHandle( handle );
1589 /* Same only explicitly asking for all access rights */
1590 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1591 &handle, PROCESS_ALL_ACCESS, TRUE, 0 ),
1592 "duplicating handle err:%d\n", GetLastError());
1593 TEST_GRANTED_ACCESS( handle, PROCESS_ALL_ACCESS );
1594 ok(DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
1595 &handle1, PROCESS_VM_READ, TRUE, 0 ),
1596 "duplicating handle err:%d\n", GetLastError());
1597 TEST_GRANTED_ACCESS( handle1, PROCESS_VM_READ );
1598 CloseHandle( handle1 );
1599 CloseHandle( handle );
1602 static void test_impersonation_level(void)
1604 HANDLE Token, ProcessToken;
1607 TOKEN_PRIVILEGES *Privileges;
1609 PRIVILEGE_SET *PrivilegeSet;
1615 pDuplicateTokenEx = (fnDuplicateTokenEx) GetProcAddress(hmod, "DuplicateTokenEx");
1616 if( !pDuplicateTokenEx ) {
1617 skip("DuplicateTokenEx is not available\n");
1620 SetLastError(0xdeadbeef);
1621 ret = ImpersonateSelf(SecurityAnonymous);
1622 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1624 skip("ImpersonateSelf is not implemented\n");
1627 ok(ret, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
1628 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
1629 ok(!ret, "OpenThreadToken should have failed\n");
1630 error = GetLastError();
1631 ok(error == ERROR_CANT_OPEN_ANONYMOUS, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error);
1632 /* can't perform access check when opening object against an anonymous impersonation token */
1634 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
1635 ok(error == ERROR_INVALID_HANDLE, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error);
1639 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &ProcessToken);
1640 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1642 ret = pDuplicateTokenEx(ProcessToken,
1643 TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE, NULL,
1644 SecurityAnonymous, TokenImpersonation, &Token);
1645 ok(ret, "DuplicateTokenEx failed with error %d\n", GetLastError());
1646 /* can't increase the impersonation level */
1647 ret = DuplicateToken(Token, SecurityIdentification, &Token2);
1648 error = GetLastError();
1649 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL,
1650 "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
1651 /* we can query anything from an anonymous token, including the user */
1652 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
1653 error = GetLastError();
1654 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
1655 User = (TOKEN_USER *)HeapAlloc(GetProcessHeap(), 0, Size);
1656 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
1657 ok(ret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1658 HeapFree(GetProcessHeap(), 0, User);
1660 /* PrivilegeCheck fails with SecurityAnonymous level */
1661 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
1662 error = GetLastError();
1663 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
1664 Privileges = (TOKEN_PRIVILEGES *)HeapAlloc(GetProcessHeap(), 0, Size);
1665 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
1666 ok(ret, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1668 PrivilegeSet = (PRIVILEGE_SET *)HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET, Privilege[Privileges->PrivilegeCount]));
1669 PrivilegeSet->PrivilegeCount = Privileges->PrivilegeCount;
1670 memcpy(PrivilegeSet->Privilege, Privileges->Privileges, PrivilegeSet->PrivilegeCount * sizeof(PrivilegeSet->Privilege[0]));
1671 PrivilegeSet->Control = PRIVILEGE_SET_ALL_NECESSARY;
1672 HeapFree(GetProcessHeap(), 0, Privileges);
1674 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
1675 error = GetLastError();
1676 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
1680 ret = ImpersonateSelf(SecurityIdentification);
1681 ok(ret, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
1682 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
1683 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
1685 /* can't perform access check when opening object against an identification impersonation token */
1686 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
1688 ok(error == ERROR_INVALID_HANDLE, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error);
1690 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
1691 ok(ret, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
1695 ret = ImpersonateSelf(SecurityImpersonation);
1696 ok(ret, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
1697 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
1698 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
1699 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
1700 ok(error == ERROR_SUCCESS, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error);
1702 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
1703 ok(ret, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
1707 CloseHandle(ProcessToken);
1709 HeapFree(GetProcessHeap(), 0, PrivilegeSet);
1712 static void test_SetEntriesInAcl(void)
1714 ACL *acl = (ACL*)0xdeadbeef;
1717 res = SetEntriesInAclW(0, NULL, NULL, &acl);
1718 if(res == ERROR_CALL_NOT_IMPLEMENTED)
1720 skip("SetEntriesInAclW is not implemented\n");
1723 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
1724 ok(acl == NULL, "acl=%p, expected NULL\n", acl);
1727 static void test_GetNamedSecurityInfoA(void)
1729 PSECURITY_DESCRIPTOR pSecDesc;
1731 SECURITY_DESCRIPTOR_CONTROL control;
1734 BOOL owner_defaulted;
1735 BOOL group_defaulted;
1738 CHAR windows_dir[MAX_PATH];
1740 ret = GetWindowsDirectoryA(windows_dir, MAX_PATH);
1741 ok(ret, "GetWindowsDirectory failed with error %d\n", GetLastError());
1743 SetLastError(0xdeadbeef);
1744 error = GetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,
1745 OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
1746 NULL, NULL, NULL, NULL, &pSecDesc);
1747 if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1749 skip("GetNamedSecurityInfoA is not implemented\n");
1752 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
1754 ret = GetSecurityDescriptorControl(pSecDesc, &control, &revision);
1755 ok(ret, "GetSecurityDescriptorControl failed with error %d\n", GetLastError());
1756 ok((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == (SE_SELF_RELATIVE|SE_DACL_PRESENT),
1757 "control (0x%x) doesn't have (SE_SELF_RELATIVE|SE_DACL_PRESENT) flags set\n", control);
1758 ok(revision == SECURITY_DESCRIPTOR_REVISION1, "revision was %d instead of 1\n", revision);
1759 ret = GetSecurityDescriptorOwner(pSecDesc, &owner, &owner_defaulted);
1760 ok(ret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1761 ok(owner != NULL, "owner should not be NULL\n");
1762 ret = GetSecurityDescriptorGroup(pSecDesc, &group, &group_defaulted);
1763 ok(ret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1764 ok(group != NULL, "group should not be NULL\n");
1767 static void test_ConvertStringSecurityDescriptor(void)
1770 PSECURITY_DESCRIPTOR pSD;
1772 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
1774 skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
1778 SetLastError(0xdeadbeef);
1779 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1780 "D:(A;;GA;;;WD)", 0xdeadbeef, &pSD, NULL);
1781 ok(!ret && GetLastError() == ERROR_UNKNOWN_REVISION,
1782 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_UNKNOWN_REVISION instead of %d\n",
1785 /* test ACE string type */
1786 SetLastError(0xdeadbeef);
1787 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1788 "D:(A;;GA;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1789 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1792 SetLastError(0xdeadbeef);
1793 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1794 "D:(D;;GA;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1795 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1798 SetLastError(0xdeadbeef);
1799 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1800 "ERROR:(D;;GA;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1801 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1802 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
1805 /* test ACE string access rights */
1806 SetLastError(0xdeadbeef);
1807 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1808 "D:(A;;GA;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1809 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1811 SetLastError(0xdeadbeef);
1812 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1813 "D:(A;;GRGWGX;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1814 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1816 SetLastError(0xdeadbeef);
1817 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1818 "D:(A;;RCSDWDWO;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1819 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1821 SetLastError(0xdeadbeef);
1822 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1823 "D:(A;;RPWPCCDCLCSWLODTCR;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1825 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1827 SetLastError(0xdeadbeef);
1828 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1829 "D:(A;;FAFRFWFX;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1831 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1833 SetLastError(0xdeadbeef);
1834 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1835 "D:(A;;KAKRKWKX;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1837 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1839 SetLastError(0xdeadbeef);
1840 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1841 "D:(A;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1842 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1845 /* test ACE string access right error case */
1846 SetLastError(0xdeadbeef);
1847 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1848 "D:(A;;ROB;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1850 ok(!ret && GetLastError() == ERROR_INVALID_ACL,
1851 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_ACL instead of %d\n",
1854 /* test ACE string SID */
1855 SetLastError(0xdeadbeef);
1856 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1857 "D:(D;;GA;;;S-1-0-0)", SDDL_REVISION_1, &pSD, NULL);
1858 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1861 SetLastError(0xdeadbeef);
1862 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1863 "D:(D;;GA;;;Nonexistent account)", SDDL_REVISION_1, &pSD, NULL);
1865 ok(!ret && GetLastError() == ERROR_INVALID_ACL,
1866 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_ACL instead of %d\n",
1870 START_TEST(security)
1877 test_process_security_child();
1883 test_FileSecurity();
1886 test_LookupAccountSid();
1887 test_LookupAccountName();
1888 test_process_security();
1889 test_impersonation_level();
1890 test_SetEntriesInAcl();
1891 test_GetNamedSecurityInfoA();
1892 test_ConvertStringSecurityDescriptor();