2 * dlls/advapi32/security.c
3 * FIXME: for all functions thunking down to Rtl* functions: implement SetLastError()
12 #include "debugtools.h"
13 #include "winversion.h"
15 DEFAULT_DEBUG_CHANNEL(advapi)
16 DECLARE_DEBUG_CHANNEL(security)
18 #define CallWin32ToNt(func) \
21 if (ret !=STATUS_SUCCESS) \
22 { SetLastError (RtlNtStatusToDosError(ret)); return FALSE; } \
26 static void dumpLsaAttributes( PLSA_OBJECT_ATTRIBUTES oa )
30 TRACE("\n\tlength=%lu, rootdir=0x%08x, objectname=%s\n\tattr=0x%08lx, sid=%p qos=%p\n",
31 oa->Length, oa->RootDirectory,
32 oa->ObjectName?debugstr_w(oa->ObjectName->Buffer):"null",
33 oa->Attributes, oa->SecurityDescriptor, oa->SecurityQualityOfService);
37 /* ##############################
38 ###### TOKEN FUNCTIONS ######
39 ##############################
42 /******************************************************************************
43 * OpenProcessToken [ADVAPI32.109]
44 * Opens the access token associated with a process
47 * ProcessHandle [I] Handle to process
48 * DesiredAccess [I] Desired access to process
49 * TokenHandle [O] Pointer to handle of open access token
54 OpenProcessToken( HANDLE ProcessHandle, DWORD DesiredAccess,
57 CallWin32ToNt(NtOpenProcessToken( ProcessHandle, DesiredAccess, TokenHandle ));
60 /******************************************************************************
61 * OpenThreadToken [ADVAPI32.114]
70 OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess,
71 BOOL OpenAsSelf, HANDLE *TokenHandle)
73 CallWin32ToNt (NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle));
76 /******************************************************************************
77 * AdjustTokenPrivileges [ADVAPI32.10]
81 * DisableAllPrivileges []
88 AdjustTokenPrivileges( HANDLE TokenHandle, BOOL DisableAllPrivileges,
89 LPVOID NewState, DWORD BufferLength,
90 LPVOID PreviousState, LPDWORD ReturnLength )
92 CallWin32ToNt(NtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges, NewState, BufferLength, PreviousState, ReturnLength));
95 /******************************************************************************
96 * GetTokenInformation [ADVAPI32.66]
107 GetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
108 LPVOID tokeninfo, DWORD tokeninfolength, LPDWORD retlen )
110 CallWin32ToNt (NtQueryInformationToken( token, tokeninfoclass, tokeninfo, tokeninfolength, retlen));
113 /*************************************************************************
114 * SetThreadToken [ADVAPI32.231]
116 * Assigns an "impersonation token" to a thread so it can assume the
117 * security privledges of another thread or process. Can also remove
118 * a previously assigned token. Only supported on NT - it's a stub
119 * exactly like this one on Win9X.
123 BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token)
125 FIXME("(%p, %x): stub\n", thread, token);
127 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
132 /* ##############################
133 ###### SID FUNCTIONS ######
134 ##############################
137 /******************************************************************************
138 * AllocateAndInitializeSid [ADVAPI32.11]
141 * pIdentifierAuthority []
142 * nSubAuthorityCount []
154 AllocateAndInitializeSid( PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
155 BYTE nSubAuthorityCount,
156 DWORD nSubAuthority0, DWORD nSubAuthority1,
157 DWORD nSubAuthority2, DWORD nSubAuthority3,
158 DWORD nSubAuthority4, DWORD nSubAuthority5,
159 DWORD nSubAuthority6, DWORD nSubAuthority7,
162 CallWin32ToNt (RtlAllocateAndInitializeSid(
163 pIdentifierAuthority, nSubAuthorityCount,
164 nSubAuthority0, nSubAuthority1, nSubAuthority2, nSubAuthority3,
165 nSubAuthority4, nSubAuthority5, nSubAuthority6, nSubAuthority7,
169 /******************************************************************************
170 * FreeSid [ADVAPI32.42]
179 return NULL; /* is documented like this */
182 /******************************************************************************
183 * CopySid [ADVAPI32.24]
186 * nDestinationSidLength []
191 CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid )
193 return RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid);
196 /******************************************************************************
197 * IsValidSid [ADVAPI32.80]
203 IsValidSid( PSID pSid )
205 return RtlValidSid( pSid );
208 /******************************************************************************
209 * EqualSid [ADVAPI32.40]
216 EqualSid( PSID pSid1, PSID pSid2 )
218 return RtlEqualSid( pSid1, pSid2 );
221 /******************************************************************************
222 * EqualPrefixSid [ADVAPI32.39]
224 BOOL WINAPI EqualPrefixSid (PSID pSid1, PSID pSid2)
226 return RtlEqualPrefixSid(pSid1, pSid2);
229 /******************************************************************************
230 * GetSidLengthRequired [ADVAPI32.63]
233 * nSubAuthorityCount []
236 GetSidLengthRequired( BYTE nSubAuthorityCount )
238 return RtlLengthRequiredSid(nSubAuthorityCount);
241 /******************************************************************************
242 * InitializeSid [ADVAPI32.74]
245 * pIdentifierAuthority []
250 PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
251 BYTE nSubAuthorityCount)
253 return RtlInitializeSid(pSid, pIdentifierAuthority, nSubAuthorityCount);
256 /******************************************************************************
257 * GetSidIdentifierAuthority [ADVAPI32.62]
262 PSID_IDENTIFIER_AUTHORITY WINAPI
263 GetSidIdentifierAuthority( PSID pSid )
265 return RtlIdentifierAuthoritySid(pSid);
268 /******************************************************************************
269 * GetSidSubAuthority [ADVAPI32.64]
276 GetSidSubAuthority( PSID pSid, DWORD nSubAuthority )
278 return RtlSubAuthoritySid(pSid, nSubAuthority);
281 /******************************************************************************
282 * GetSidSubAuthorityCount [ADVAPI32.65]
288 GetSidSubAuthorityCount (PSID pSid)
290 return RtlSubAuthorityCountSid(pSid);
293 /******************************************************************************
294 * GetLengthSid [ADVAPI32.48]
300 GetLengthSid (PSID pSid)
302 return RtlLengthSid(pSid);
305 /* ##############################################
306 ###### SECURITY DESCRIPTOR FUNCTIONS ######
307 ##############################################
310 /******************************************************************************
311 * InitializeSecurityDescriptor [ADVAPI32.73]
318 InitializeSecurityDescriptor( SECURITY_DESCRIPTOR *pDescr, DWORD revision )
320 CallWin32ToNt (RtlCreateSecurityDescriptor(pDescr, revision ));
323 /******************************************************************************
324 * GetSecurityDescriptorLength [ADVAPI32.55]
326 DWORD WINAPI GetSecurityDescriptorLength( SECURITY_DESCRIPTOR *pDescr)
328 return (RtlLengthSecurityDescriptor(pDescr));
331 /******************************************************************************
332 * GetSecurityDescriptorOwner [ADVAPI32.56]
336 * lpbOwnerDefaulted []
339 GetSecurityDescriptorOwner( SECURITY_DESCRIPTOR *pDescr, PSID *pOwner,
340 LPBOOL lpbOwnerDefaulted )
342 CallWin32ToNt (RtlGetOwnerSecurityDescriptor( pDescr, pOwner, (PBOOLEAN)lpbOwnerDefaulted ));
345 /******************************************************************************
346 * SetSecurityDescriptorOwner [ADVAPI32]
350 BOOL WINAPI SetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pSecurityDescriptor,
351 PSID pOwner, BOOL bOwnerDefaulted)
353 CallWin32ToNt (RtlSetOwnerSecurityDescriptor(pSecurityDescriptor, pOwner, bOwnerDefaulted));
355 /******************************************************************************
356 * GetSecurityDescriptorGroup [ADVAPI32.54]
358 BOOL WINAPI GetSecurityDescriptorGroup(
359 PSECURITY_DESCRIPTOR SecurityDescriptor,
361 LPBOOL GroupDefaulted)
363 CallWin32ToNt (RtlGetGroupSecurityDescriptor(SecurityDescriptor, Group, (PBOOLEAN)GroupDefaulted));
365 /******************************************************************************
366 * SetSecurityDescriptorGroup
368 BOOL WINAPI SetSecurityDescriptorGroup ( PSECURITY_DESCRIPTOR SecurityDescriptor,
369 PSID Group, BOOL GroupDefaulted)
371 CallWin32ToNt (RtlSetGroupSecurityDescriptor( SecurityDescriptor, Group, GroupDefaulted));
374 /******************************************************************************
375 * IsValidSecurityDescriptor [ADVAPI32.79]
381 IsValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor )
383 CallWin32ToNt (RtlValidSecurityDescriptor(SecurityDescriptor));
386 /******************************************************************************
387 * GetSecurityDescriptorDacl [ADVAPI.91]
389 BOOL WINAPI GetSecurityDescriptorDacl(
390 IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
391 OUT LPBOOL lpbDaclPresent,
393 OUT LPBOOL lpbDaclDefaulted)
395 CallWin32ToNt (RtlGetDaclSecurityDescriptor(pSecurityDescriptor, (PBOOLEAN)lpbDaclPresent,
396 pDacl, (PBOOLEAN)lpbDaclDefaulted));
399 /******************************************************************************
400 * SetSecurityDescriptorDacl [ADVAPI.224]
403 SetSecurityDescriptorDacl (
404 PSECURITY_DESCRIPTOR lpsd,
409 CallWin32ToNt (RtlSetDaclSecurityDescriptor (lpsd, daclpresent, dacl, dacldefaulted ));
411 /******************************************************************************
412 * GetSecurityDescriptorSacl [ADVAPI.]
414 BOOL WINAPI GetSecurityDescriptorSacl(
415 IN PSECURITY_DESCRIPTOR lpsd,
416 OUT LPBOOL lpbSaclPresent,
418 OUT LPBOOL lpbSaclDefaulted)
420 CallWin32ToNt (RtlGetSaclSecurityDescriptor(lpsd,
421 (PBOOLEAN)lpbSaclPresent, pSacl, (PBOOLEAN)lpbSaclDefaulted));
424 /**************************************************************************
425 * SetSecurityDescriptorSacl [NTDLL.488]
427 BOOL WINAPI SetSecurityDescriptorSacl (
428 PSECURITY_DESCRIPTOR lpsd,
433 CallWin32ToNt (RtlSetSaclSecurityDescriptor(lpsd, saclpresent, lpsacl, sacldefaulted));
435 /******************************************************************************
436 * MakeSelfRelativeSD [ADVAPI32.95]
445 IN PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
446 IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
447 IN OUT LPDWORD lpdwBufferLength)
449 CallWin32ToNt (RtlMakeSelfRelativeSD(pAbsoluteSecurityDescriptor,pSelfRelativeSecurityDescriptor, lpdwBufferLength));
452 /******************************************************************************
453 * GetSecurityDescriptorControl32 [ADVAPI32]
456 BOOL WINAPI GetSecurityDescriptorControl ( PSECURITY_DESCRIPTOR pSecurityDescriptor,
457 PSECURITY_DESCRIPTOR_CONTROL pControl, LPDWORD lpdwRevision)
459 CallWin32ToNt (RtlGetControlSecurityDescriptor(pSecurityDescriptor,pControl,lpdwRevision));
462 /* ##############################
463 ###### ACL FUNCTIONS ######
464 ##############################
467 /*************************************************************************
468 * InitializeAcl [ADVAPI32.111]
470 DWORD WINAPI InitializeAcl(PACL acl, DWORD size, DWORD rev)
472 CallWin32ToNt (RtlCreateAcl(acl, size, rev));
475 /* ##############################
476 ###### MISC FUNCTIONS ######
477 ##############################
480 /******************************************************************************
481 * LookupPrivilegeValue32W [ADVAPI32.93]
482 * Retrieves LUID used on a system to represent the privilege name.
485 * lpLuid should be PLUID
488 * lpSystemName [I] Address of string specifying the system
489 * lpName [I] Address of string specifying the privilege
490 * lpLuid [I] Address of locally unique identifier
495 LookupPrivilegeValueW( LPCWSTR lpSystemName, LPCWSTR lpName, LPVOID lpLuid )
497 FIXME("(%s,%s,%p): stub\n",debugstr_w(lpSystemName),
498 debugstr_w(lpName), lpLuid);
502 /******************************************************************************
503 * LookupPrivilegeValue32A [ADVAPI32.92]
506 LookupPrivilegeValueA( LPCSTR lpSystemName, LPCSTR lpName, LPVOID lpLuid )
508 LPWSTR lpSystemNameW = HEAP_strdupAtoW(GetProcessHeap(), 0, lpSystemName);
509 LPWSTR lpNameW = HEAP_strdupAtoW(GetProcessHeap(), 0, lpName);
512 ret = LookupPrivilegeValueW( lpSystemNameW, lpNameW, lpLuid);
513 HeapFree(GetProcessHeap(), 0, lpNameW);
514 HeapFree(GetProcessHeap(), 0, lpSystemNameW);
518 /******************************************************************************
519 * GetFileSecurity32A [ADVAPI32.45]
521 * Obtains Specified information about the security of a file or directory
522 * The information obtained is constrained by the callers access rights and
526 GetFileSecurityA( LPCSTR lpFileName,
527 SECURITY_INFORMATION RequestedInformation,
528 PSECURITY_DESCRIPTOR pSecurityDescriptor,
529 DWORD nLength, LPDWORD lpnLengthNeeded )
531 FIXME("(%s) : stub\n", debugstr_a(lpFileName));
535 /******************************************************************************
536 * GetFileSecurity32W [ADVAPI32.46]
538 * Obtains Specified information about the security of a file or directory
539 * The information obtained is constrained by the callers access rights and
544 * RequestedInformation []
545 * pSecurityDescriptor []
550 GetFileSecurityW( LPCWSTR lpFileName,
551 SECURITY_INFORMATION RequestedInformation,
552 PSECURITY_DESCRIPTOR pSecurityDescriptor,
553 DWORD nLength, LPDWORD lpnLengthNeeded )
555 FIXME("(%s) : stub\n", debugstr_w(lpFileName) );
560 /******************************************************************************
561 * LookupAccountSid32A [ADVAPI32.86]
568 IN OUT LPDWORD accountSize,
570 IN OUT LPDWORD domainSize,
571 OUT PSID_NAME_USE name_use )
573 char * ac = "Administrator";
574 char * dm = "DOMAIN";
575 FIXME_(security)("(%s,sid=%p,%p,%p(%lu),%p,%p(%lu),%p): semi-stub\n",
576 debugstr_a(system),sid,
577 account,accountSize,accountSize?*accountSize:0,
578 domain,domainSize,domainSize?*domainSize:0,
581 if (accountSize) *accountSize = strlen(ac)+1;
582 if (account && (*accountSize > strlen(ac)))
585 if (domainSize) *domainSize = strlen(dm)+1;
586 if (domain && (*domainSize > strlen(dm)))
589 if (name_use) *name_use = SidTypeUser;
593 /******************************************************************************
594 * LookupAccountSid32W [ADVAPI32.87]
610 IN OUT LPDWORD accountSize,
612 IN OUT LPDWORD domainSize,
613 OUT PSID_NAME_USE name_use )
615 char * ac = "Administrator";
616 char * dm = "DOMAIN";
617 FIXME_(security)("(%s,sid=%p,%p,%p(%lu),%p,%p(%lu),%p): semi-stub\n",
618 debugstr_w(system),sid,
619 account,accountSize,accountSize?*accountSize:0,
620 domain,domainSize,domainSize?*domainSize:0,
623 if (accountSize) *accountSize = strlen(ac)+1;
624 if (account && (*accountSize > strlen(ac)))
625 lstrcpyAtoW(account, ac);
627 if (domainSize) *domainSize = strlen(dm)+1;
628 if (domain && (*domainSize > strlen(dm)))
629 lstrcpyAtoW(domain,dm);
631 if (name_use) *name_use = SidTypeUser;
635 /******************************************************************************
636 * SetFileSecurity32A [ADVAPI32.182]
637 * Sets the security of a file or directory
639 BOOL WINAPI SetFileSecurityA( LPCSTR lpFileName,
640 SECURITY_INFORMATION RequestedInformation,
641 PSECURITY_DESCRIPTOR pSecurityDescriptor)
643 FIXME("(%s) : stub\n", debugstr_a(lpFileName));
647 /******************************************************************************
648 * SetFileSecurity32W [ADVAPI32.183]
649 * Sets the security of a file or directory
653 * RequestedInformation []
654 * pSecurityDescriptor []
657 SetFileSecurityW( LPCWSTR lpFileName,
658 SECURITY_INFORMATION RequestedInformation,
659 PSECURITY_DESCRIPTOR pSecurityDescriptor )
661 FIXME("(%s) : stub\n", debugstr_w(lpFileName) );
665 /******************************************************************************
666 * QueryWindows31FilesMigration [ADVAPI32.266]
672 QueryWindows31FilesMigration( DWORD x1 )
674 FIXME("(%ld):stub\n",x1);
678 /******************************************************************************
679 * SynchronizeWindows31FilesAndWindowsNTRegistry [ADVAPI32.265]
688 SynchronizeWindows31FilesAndWindowsNTRegistry( DWORD x1, DWORD x2, DWORD x3,
691 FIXME("(0x%08lx,0x%08lx,0x%08lx,0x%08lx):stub\n",x1,x2,x3,x4);
695 /******************************************************************************
696 * LsaOpenPolicy [ADVAPI32.200]
706 IN PLSA_UNICODE_STRING SystemName,
707 IN PLSA_OBJECT_ATTRIBUTES ObjectAttributes,
708 IN ACCESS_MASK DesiredAccess,
709 IN OUT PLSA_HANDLE PolicyHandle)
711 FIXME("(%s,%p,0x%08lx,%p):stub\n",
712 SystemName?debugstr_w(SystemName->Buffer):"null",
713 ObjectAttributes, DesiredAccess, PolicyHandle);
714 dumpLsaAttributes(ObjectAttributes);
715 if(PolicyHandle) *PolicyHandle = (LSA_HANDLE)0xcafe;
719 /******************************************************************************
720 * LsaQueryInformationPolicy [ADVAPI32.242]
723 LsaQueryInformationPolicy(
724 IN LSA_HANDLE PolicyHandle,
725 IN POLICY_INFORMATION_CLASS InformationClass,
728 FIXME("(%p,0x%08x,%p):stub\n",
729 PolicyHandle, InformationClass, Buffer);
731 if(!Buffer) return FALSE;
732 switch (InformationClass)
734 case PolicyAuditEventsInformation: /* 2 */
736 PPOLICY_AUDIT_EVENTS_INFO p = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(POLICY_AUDIT_EVENTS_INFO));
737 p->AuditingMode = FALSE; /* no auditing */
741 case PolicyPrimaryDomainInformation: /* 3 */
742 case PolicyAccountDomainInformation: /* 5 */
745 { POLICY_PRIMARY_DOMAIN_INFO ppdi;
748 SID_IDENTIFIER_AUTHORITY localSidAuthority = {SECURITY_NT_AUTHORITY};
750 struct di * xdi = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(xdi));
751 RtlInitUnicodeString(&(xdi->ppdi.Name), HEAP_strdupAtoW(GetProcessHeap(),0,"DOMAIN"));
752 xdi->ppdi.Sid = &(xdi->sid);
753 xdi->sid.Revision = SID_REVISION;
754 xdi->sid.SubAuthorityCount = 1;
755 xdi->sid.IdentifierAuthority = localSidAuthority;
756 xdi->sid.SubAuthority[0] = SECURITY_LOCAL_SYSTEM_RID;
760 case PolicyAuditLogInformation:
761 case PolicyPdAccountInformation:
762 case PolicyLsaServerRoleInformation:
763 case PolicyReplicaSourceInformation:
764 case PolicyDefaultQuotaInformation:
765 case PolicyModificationInformation:
766 case PolicyAuditFullSetInformation:
767 case PolicyAuditFullQueryInformation:
768 case PolicyDnsDomainInformation:
770 FIXME("category not implemented\n");
777 /******************************************************************************
778 * LsaLookupSids [ADVAPI32.240]
783 LSA_UNICODE_STRING Name;
785 } LSA_TRANSLATED_NAME, *PLSA_TRANSLATED_NAME;
789 LSA_UNICODE_STRING Name;
791 } LSA_TRUST_INFORMATION, *PLSA_TRUST_INFORMATION;
796 PLSA_TRUST_INFORMATION Domains;
797 } LSA_REFERENCED_DOMAIN_LIST, *PLSA_REFERENCED_DOMAIN_LIST;
801 IN LSA_HANDLE PolicyHandle,
804 OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,
805 OUT PLSA_TRANSLATED_NAME *Names )
807 FIXME("%p %lu %p %p %p\n",
808 PolicyHandle, Count, Sids, ReferencedDomains, Names);
812 /******************************************************************************
813 * LsaFreeMemory [ADVAPI32.241]
816 LsaFreeMemory(IN PVOID Buffer)
818 TRACE("(%p)\n",Buffer);
819 return HeapFree(GetProcessHeap(), 0, Buffer);
821 /******************************************************************************
822 * LsaClose [ADVAPI32.243]
825 LsaClose(IN LSA_HANDLE ObjectHandle)
827 FIXME("(%p):stub\n",ObjectHandle);
830 /******************************************************************************
831 * NotifyBootConfigStatus [ADVAPI32.97]
837 NotifyBootConfigStatus( DWORD x1 )
839 FIXME("(0x%08lx):stub\n",x1);
843 /******************************************************************************
844 * RevertToSelf [ADVAPI32.180]
856 /******************************************************************************
857 * ImpersonateSelf [ADVAPI32.71]
860 ImpersonateSelf(SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
862 return RtlImpersonateSelf(ImpersonationLevel);
865 /******************************************************************************
866 * AccessCheck32 [ADVAPI32.71]
868 * FIXME check cast LPBOOL to PBOOLEAN
872 PSECURITY_DESCRIPTOR SecurityDescriptor,
875 PGENERIC_MAPPING GenericMapping,
876 PPRIVILEGE_SET PrivilegeSet,
877 LPDWORD PrivilegeSetLength,
878 LPDWORD GrantedAccess,
881 CallWin32ToNt (NtAccessCheck(SecurityDescriptor, ClientToken, DesiredAccess,
882 GenericMapping, PrivilegeSet, PrivilegeSetLength, GrantedAccess, (PBOOLEAN)AccessStatus));
885 /*************************************************************************
886 * SetKernelObjectSecurity [ADVAPI32.223]
888 BOOL WINAPI SetKernelObjectSecurity (
890 IN SECURITY_INFORMATION SecurityInformation,
891 IN PSECURITY_DESCRIPTOR SecurityDescriptor )
893 CallWin32ToNt (NtSetSecurityObject (Handle, SecurityInformation, SecurityDescriptor));
896 /******************************************************************************
897 * AddAccessAllowedAce
899 BOOL WINAPI AddAccessAllowedAce(
901 IN DWORD dwAceRevision,
905 return RtlAddAccessAllowedAce(pAcl, dwAceRevision, AccessMask, pSid);