2 * dlls/advapi32/security.c
3 * FIXME: for all functions thunking down to Rtl* functions: implement SetLastError()
12 #include "debugtools.h"
14 DECLARE_DEBUG_CHANNEL(advapi)
15 DECLARE_DEBUG_CHANNEL(security)
17 #define CallWin32ToNt(func) \
20 if (ret !=STATUS_SUCCESS) \
21 { SetLastError (RtlNtStatusToDosError(ret)); return FALSE; } \
25 /* ##############################
26 ###### TOKEN FUNCTIONS ######
27 ##############################
30 /******************************************************************************
31 * OpenProcessToken [ADVAPI32.109]
32 * Opens the access token associated with a process
35 * ProcessHandle [I] Handle to process
36 * DesiredAccess [I] Desired access to process
37 * TokenHandle [O] Pointer to handle of open access token
42 OpenProcessToken( HANDLE ProcessHandle, DWORD DesiredAccess,
45 CallWin32ToNt(NtOpenProcessToken( ProcessHandle, DesiredAccess, TokenHandle ));
48 /******************************************************************************
49 * OpenThreadToken [ADVAPI32.114]
58 OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess,
59 BOOL OpenAsSelf, HANDLE *TokenHandle)
61 CallWin32ToNt (NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle));
64 /******************************************************************************
65 * AdjustTokenPrivileges [ADVAPI32.10]
69 * DisableAllPrivileges []
76 AdjustTokenPrivileges( HANDLE TokenHandle, BOOL DisableAllPrivileges,
77 LPVOID NewState, DWORD BufferLength,
78 LPVOID PreviousState, LPDWORD ReturnLength )
80 CallWin32ToNt(NtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges, NewState, BufferLength, PreviousState, ReturnLength));
83 /******************************************************************************
84 * GetTokenInformation [ADVAPI32.66]
95 GetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
96 LPVOID tokeninfo, DWORD tokeninfolength, LPDWORD retlen )
98 CallWin32ToNt (NtQueryInformationToken( token, tokeninfoclass, tokeninfo, tokeninfolength, retlen));
101 /* ##############################
102 ###### SID FUNCTIONS ######
103 ##############################
106 /******************************************************************************
107 * AllocateAndInitializeSid [ADVAPI32.11]
110 * pIdentifierAuthority []
111 * nSubAuthorityCount []
123 AllocateAndInitializeSid( PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
124 BYTE nSubAuthorityCount,
125 DWORD nSubAuthority0, DWORD nSubAuthority1,
126 DWORD nSubAuthority2, DWORD nSubAuthority3,
127 DWORD nSubAuthority4, DWORD nSubAuthority5,
128 DWORD nSubAuthority6, DWORD nSubAuthority7,
131 if (!(*pSid = HeapAlloc( GetProcessHeap(), 0,
132 GetSidLengthRequired(nSubAuthorityCount))))
134 (*pSid)->Revision = SID_REVISION;
135 if (pIdentifierAuthority)
136 memcpy(&(*pSid)->IdentifierAuthority, pIdentifierAuthority,
137 sizeof (SID_IDENTIFIER_AUTHORITY));
138 *GetSidSubAuthorityCount(*pSid) = nSubAuthorityCount;
140 if (nSubAuthorityCount > 0)
141 *GetSidSubAuthority(*pSid, 0) = nSubAuthority0;
142 if (nSubAuthorityCount > 1)
143 *GetSidSubAuthority(*pSid, 1) = nSubAuthority1;
144 if (nSubAuthorityCount > 2)
145 *GetSidSubAuthority(*pSid, 2) = nSubAuthority2;
146 if (nSubAuthorityCount > 3)
147 *GetSidSubAuthority(*pSid, 3) = nSubAuthority3;
148 if (nSubAuthorityCount > 4)
149 *GetSidSubAuthority(*pSid, 4) = nSubAuthority4;
150 if (nSubAuthorityCount > 5)
151 *GetSidSubAuthority(*pSid, 5) = nSubAuthority5;
152 if (nSubAuthorityCount > 6)
153 *GetSidSubAuthority(*pSid, 6) = nSubAuthority6;
154 if (nSubAuthorityCount > 7)
155 *GetSidSubAuthority(*pSid, 7) = nSubAuthority7;
160 /******************************************************************************
161 * FreeSid [ADVAPI32.42]
169 HeapFree( GetProcessHeap(), 0, pSid );
173 /******************************************************************************
174 * CopySid [ADVAPI32.24]
177 * nDestinationSidLength []
182 CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid )
185 if (!IsValidSid(pSourceSid))
188 if (nDestinationSidLength < GetLengthSid(pSourceSid))
191 memcpy(pDestinationSid, pSourceSid, GetLengthSid(pSourceSid));
196 /******************************************************************************
197 * IsValidSid [ADVAPI32.80]
203 IsValidSid( PSID pSid )
205 if (IsBadReadPtr(pSid, 4))
207 WARN_(security)("(%p): invalid pointer!", pSid);
211 if (pSid->SubAuthorityCount > SID_MAX_SUB_AUTHORITIES)
214 if (!pSid || pSid->Revision != SID_REVISION)
220 /******************************************************************************
221 * EqualSid [ADVAPI32.40]
228 EqualSid( PSID pSid1, PSID pSid2 )
230 if (!IsValidSid(pSid1) || !IsValidSid(pSid2))
233 if (*GetSidSubAuthorityCount(pSid1) != *GetSidSubAuthorityCount(pSid2))
236 if (memcmp(pSid1, pSid2, GetLengthSid(pSid1)) != 0)
242 /******************************************************************************
243 * EqualPrefixSid [ADVAPI32.39]
245 BOOL WINAPI EqualPrefixSid (PSID pSid1, PSID pSid2) {
246 if (!IsValidSid(pSid1) || !IsValidSid(pSid2))
249 if (*GetSidSubAuthorityCount(pSid1) != *GetSidSubAuthorityCount(pSid2))
252 if (memcmp(pSid1, pSid2, GetSidLengthRequired(pSid1->SubAuthorityCount - 1))
259 /******************************************************************************
260 * GetSidLengthRequired [ADVAPI32.63]
263 * nSubAuthorityCount []
266 GetSidLengthRequired( BYTE nSubAuthorityCount )
268 return sizeof (SID) + (nSubAuthorityCount - 1) * sizeof (DWORD);
271 /******************************************************************************
272 * InitializeSid [ADVAPI32.74]
275 * pIdentifierAuthority []
278 InitializeSid (PSID pSid, PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
279 BYTE nSubAuthorityCount)
283 pSid->Revision = SID_REVISION;
284 if (pIdentifierAuthority)
285 memcpy(&pSid->IdentifierAuthority, pIdentifierAuthority,
286 sizeof (SID_IDENTIFIER_AUTHORITY));
287 *GetSidSubAuthorityCount(pSid) = nSubAuthorityCount;
289 for (i = 0; i < nSubAuthorityCount; i++)
290 *GetSidSubAuthority(pSid, i) = 0;
295 /******************************************************************************
296 * GetSidIdentifierAuthority [ADVAPI32.62]
301 PSID_IDENTIFIER_AUTHORITY WINAPI
302 GetSidIdentifierAuthority( PSID pSid )
304 return &pSid->IdentifierAuthority;
307 /******************************************************************************
308 * GetSidSubAuthority [ADVAPI32.64]
315 GetSidSubAuthority( PSID pSid, DWORD nSubAuthority )
317 return &pSid->SubAuthority[nSubAuthority];
320 /******************************************************************************
321 * GetSidSubAuthorityCount [ADVAPI32.65]
327 GetSidSubAuthorityCount (PSID pSid)
329 return &pSid->SubAuthorityCount;
332 /******************************************************************************
333 * GetLengthSid [ADVAPI32.48]
339 GetLengthSid (PSID pSid)
341 return GetSidLengthRequired( * GetSidSubAuthorityCount(pSid) );
344 /* ##############################################
345 ###### SECURITY DESCRIPTOR FUNCTIONS ######
346 ##############################################
349 /******************************************************************************
350 * InitializeSecurityDescriptor [ADVAPI32.73]
357 InitializeSecurityDescriptor( SECURITY_DESCRIPTOR *pDescr, DWORD revision )
359 CallWin32ToNt (RtlCreateSecurityDescriptor(pDescr, revision ));
362 /******************************************************************************
363 * GetSecurityDescriptorLength [ADVAPI32.55]
365 DWORD WINAPI GetSecurityDescriptorLength( SECURITY_DESCRIPTOR *pDescr)
367 return (RtlLengthSecurityDescriptor(pDescr));
370 /******************************************************************************
371 * GetSecurityDescriptorOwner [ADVAPI32.56]
375 * lpbOwnerDefaulted []
378 GetSecurityDescriptorOwner( SECURITY_DESCRIPTOR *pDescr, PSID *pOwner,
379 LPBOOL lpbOwnerDefaulted )
381 CallWin32ToNt (RtlGetOwnerSecurityDescriptor( pDescr, pOwner, (PBOOLEAN)lpbOwnerDefaulted ));
384 /******************************************************************************
385 * SetSecurityDescriptorOwner [ADVAPI32]
389 BOOL WINAPI SetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pSecurityDescriptor,
390 PSID pOwner, BOOL bOwnerDefaulted)
392 CallWin32ToNt (RtlSetOwnerSecurityDescriptor(pSecurityDescriptor, pOwner, bOwnerDefaulted));
394 /******************************************************************************
395 * GetSecurityDescriptorGroup [ADVAPI32.54]
397 BOOL WINAPI GetSecurityDescriptorGroup(
398 PSECURITY_DESCRIPTOR SecurityDescriptor,
400 LPBOOL GroupDefaulted)
402 CallWin32ToNt (RtlGetGroupSecurityDescriptor(SecurityDescriptor, Group, (PBOOLEAN)GroupDefaulted));
404 /******************************************************************************
405 * SetSecurityDescriptorGroup
407 BOOL WINAPI SetSecurityDescriptorGroup ( PSECURITY_DESCRIPTOR SecurityDescriptor,
408 PSID Group, BOOL GroupDefaulted)
410 CallWin32ToNt (RtlSetGroupSecurityDescriptor( SecurityDescriptor, Group, GroupDefaulted));
413 /******************************************************************************
414 * IsValidSecurityDescriptor [ADVAPI32.79]
420 IsValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor )
422 CallWin32ToNt (RtlValidSecurityDescriptor(SecurityDescriptor));
425 /******************************************************************************
426 * GetSecurityDescriptorDacl [ADVAPI.91]
428 BOOL WINAPI GetSecurityDescriptorDacl(
429 IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
430 OUT LPBOOL lpbDaclPresent,
432 OUT LPBOOL lpbDaclDefaulted)
434 CallWin32ToNt (RtlGetDaclSecurityDescriptor(pSecurityDescriptor, (PBOOLEAN)lpbDaclPresent,
435 pDacl, (PBOOLEAN)lpbDaclDefaulted));
438 /******************************************************************************
439 * SetSecurityDescriptorDacl [ADVAPI.224]
442 SetSecurityDescriptorDacl (
443 PSECURITY_DESCRIPTOR lpsd,
448 CallWin32ToNt (RtlSetDaclSecurityDescriptor (lpsd, daclpresent, dacl, dacldefaulted ));
450 /******************************************************************************
451 * GetSecurityDescriptorSacl [ADVAPI.]
453 BOOL WINAPI GetSecurityDescriptorSacl(
454 IN PSECURITY_DESCRIPTOR lpsd,
455 OUT LPBOOL lpbSaclPresent,
457 OUT LPBOOL lpbSaclDefaulted)
459 CallWin32ToNt (RtlGetSaclSecurityDescriptor(lpsd, (PBOOLEAN)lpbSaclPresent,
460 pSacl, (PBOOLEAN)lpbSaclDefaulted));
463 /**************************************************************************
464 * SetSecurityDescriptorSacl [NTDLL.488]
466 BOOL WINAPI SetSecurityDescriptorSacl (
467 PSECURITY_DESCRIPTOR lpsd,
472 CallWin32ToNt (RtlSetSaclSecurityDescriptor(lpsd, saclpresent, lpsacl, sacldefaulted));
474 /******************************************************************************
475 * MakeSelfRelativeSD [ADVAPI32.95]
483 MakeSelfRelativeSD( PSECURITY_DESCRIPTOR lpabssecdesc,
484 PSECURITY_DESCRIPTOR lpselfsecdesc, LPDWORD lpbuflen )
486 FIXME_(advapi)("(%p,%p,%p),stub!\n",lpabssecdesc,lpselfsecdesc,lpbuflen);
490 /******************************************************************************
491 * GetSecurityDescriptorControl32 [ADVAPI32]
494 BOOL WINAPI GetSecurityDescriptorControl ( PSECURITY_DESCRIPTOR pSecurityDescriptor,
495 PSECURITY_DESCRIPTOR_CONTROL pControl, LPDWORD lpdwRevision)
496 { FIXME_(advapi)("(%p,%p,%p),stub!\n",pSecurityDescriptor,pControl,lpdwRevision);
500 /* ##############################
501 ###### MISC FUNCTIONS ######
502 ##############################
505 /******************************************************************************
506 * LookupPrivilegeValue32W [ADVAPI32.93]
507 * Retrieves LUID used on a system to represent the privilege name.
510 * lpLuid should be PLUID
513 * lpSystemName [I] Address of string specifying the system
514 * lpName [I] Address of string specifying the privilege
515 * lpLuid [I] Address of locally unique identifier
520 LookupPrivilegeValueW( LPCWSTR lpSystemName, LPCWSTR lpName, LPVOID lpLuid )
522 FIXME_(advapi)("(%s,%s,%p): stub\n",debugstr_w(lpSystemName),
523 debugstr_w(lpName), lpLuid);
527 /******************************************************************************
528 * LookupPrivilegeValue32A [ADVAPI32.92]
531 LookupPrivilegeValueA( LPCSTR lpSystemName, LPCSTR lpName, LPVOID lpLuid )
533 LPWSTR lpSystemNameW = HEAP_strdupAtoW(GetProcessHeap(), 0, lpSystemName);
534 LPWSTR lpNameW = HEAP_strdupAtoW(GetProcessHeap(), 0, lpName);
535 BOOL ret = LookupPrivilegeValueW( lpSystemNameW, lpNameW, lpLuid);
536 HeapFree(GetProcessHeap(), 0, lpNameW);
537 HeapFree(GetProcessHeap(), 0, lpSystemNameW);
541 /******************************************************************************
542 * GetFileSecurity32A [ADVAPI32.45]
544 * Obtains Specified information about the security of a file or directory
545 * The information obtained is constrained by the callers access rights and
549 GetFileSecurityA( LPCSTR lpFileName,
550 SECURITY_INFORMATION RequestedInformation,
551 PSECURITY_DESCRIPTOR pSecurityDescriptor,
552 DWORD nLength, LPDWORD lpnLengthNeeded )
554 FIXME_(advapi)("(%s) : stub\n", debugstr_a(lpFileName));
558 /******************************************************************************
559 * GetFileSecurity32W [ADVAPI32.46]
561 * Obtains Specified information about the security of a file or directory
562 * The information obtained is constrained by the callers access rights and
567 * RequestedInformation []
568 * pSecurityDescriptor []
573 GetFileSecurityW( LPCWSTR lpFileName,
574 SECURITY_INFORMATION RequestedInformation,
575 PSECURITY_DESCRIPTOR pSecurityDescriptor,
576 DWORD nLength, LPDWORD lpnLengthNeeded )
578 FIXME_(advapi)("(%s) : stub\n", debugstr_w(lpFileName) );
583 /******************************************************************************
584 * LookupAccountSid32A [ADVAPI32.86]
587 LookupAccountSidA( LPCSTR system, PSID sid, LPCSTR account,
588 LPDWORD accountSize, LPCSTR domain, LPDWORD domainSize,
589 PSID_NAME_USE name_use )
591 FIXME_(security)("(%s,%p,%p,%p,%p,%p,%p): stub\n",
592 system,sid,account,accountSize,domain,domainSize,name_use);
593 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
597 /******************************************************************************
598 * LookupAccountSid32W [ADVAPI32.87]
610 LookupAccountSidW( LPCWSTR system, PSID sid, LPCWSTR account,
611 LPDWORD accountSize, LPCWSTR domain, LPDWORD domainSize,
612 PSID_NAME_USE name_use )
614 FIXME_(security)("(%p,%p,%p,%p,%p,%p,%p): stub\n",
615 system,sid,account,accountSize,domain,domainSize,name_use);
616 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
620 /******************************************************************************
621 * SetFileSecurity32A [ADVAPI32.182]
622 * Sets the security of a file or directory
624 BOOL WINAPI SetFileSecurityA( LPCSTR lpFileName,
625 SECURITY_INFORMATION RequestedInformation,
626 PSECURITY_DESCRIPTOR pSecurityDescriptor)
628 FIXME_(advapi)("(%s) : stub\n", debugstr_a(lpFileName));
632 /******************************************************************************
633 * SetFileSecurity32W [ADVAPI32.183]
634 * Sets the security of a file or directory
638 * RequestedInformation []
639 * pSecurityDescriptor []
642 SetFileSecurityW( LPCWSTR lpFileName,
643 SECURITY_INFORMATION RequestedInformation,
644 PSECURITY_DESCRIPTOR pSecurityDescriptor )
646 FIXME_(advapi)("(%s) : stub\n", debugstr_w(lpFileName) );
650 /******************************************************************************
651 * QueryWindows31FilesMigration [ADVAPI32.266]
657 QueryWindows31FilesMigration( DWORD x1 )
659 FIXME_(advapi)("(%ld):stub\n",x1);
663 /******************************************************************************
664 * SynchronizeWindows31FilesAndWindowsNTRegistry [ADVAPI32.265]
673 SynchronizeWindows31FilesAndWindowsNTRegistry( DWORD x1, DWORD x2, DWORD x3,
676 FIXME_(advapi)("(0x%08lx,0x%08lx,0x%08lx,0x%08lx):stub\n",x1,x2,x3,x4);
680 /******************************************************************************
681 * LsaOpenPolicy [ADVAPI32.200]
690 LsaOpenPolicy(PLSA_UNICODE_STRING SystemName,
691 PLSA_OBJECT_ATTRIBUTES ObjectAttributes,
692 ACCESS_MASK DesiredAccess,
693 PLSA_HANDLE PolicyHandle)
695 FIXME_(advapi)("(%p,%p,0x%08lx,%p):stub\n",
696 SystemName, ObjectAttributes,
697 DesiredAccess, PolicyHandle);
698 return 0xc0000000; /* generic error */
701 /******************************************************************************
702 * NotifyBootConfigStatus [ADVAPI32.97]
708 NotifyBootConfigStatus( DWORD x1 )
710 FIXME_(advapi)("(0x%08lx):stub\n",x1);
714 /******************************************************************************
715 * RevertToSelf [ADVAPI32.180]
723 FIXME_(advapi)("(), stub\n");
727 /******************************************************************************
728 * ImpersonateSelf [ADVAPI32.71]
731 ImpersonateSelf(SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
733 FIXME_(advapi)("(%08x), stub\n", ImpersonationLevel);
737 /******************************************************************************
738 * AccessCheck32 [ADVAPI32.71]
741 AccessCheck(PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken,
742 DWORD DesiredAccess, PGENERIC_MAPPING GenericMapping, PPRIVILEGE_SET PrivilegeSet,
743 LPDWORD PrivilegeSetLength, LPDWORD GrantedAccess, LPBOOL AccessStatus)
745 FIXME_(advapi)("(%p, %04x, %08lx, %p, %p, %p, %p, %p), stub\n",
746 pSecurityDescriptor, ClientToken, DesiredAccess, GenericMapping,
747 PrivilegeSet, PrivilegeSetLength, GrantedAccess, AccessStatus);
748 *AccessStatus = TRUE;
752 /*************************************************************************
753 * SetThreadToken [ADVAPI32.231]
755 * Assigns an "impersonation token" to a thread so it can assume the
756 * security privledges of another thread or process. Can also remove
757 * a previously assigned token. Only supported on NT - it's a stub
758 * exactly like this one on Win9X.
762 BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token)
764 FIXME_(advapi)("(%p, %x): stub\n", thread, token);
766 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);